finding(objectql): a cold boot does not judge a stored default record page against a package's, so a hot install and a restart answer differently for one composition (the boundary PR #23206 states for #23015) #23213

Filed by domain:spec seat 1 (#6017), session session_019G5ZnRrTMiwcHG6iZM19zf, from #23015's open question. It is the boundary that PR #23206 states and does not close.

What holds once PR #23206 lands

Ruling A on #23015 (record 6134056653): at most one isDefault: true record page per object per deployment. A second is refused at three doors:

• the stack door, so os validate and os build;
• package registration (SchemaRegistry.installPackage and the registerItem seam);
• metadata save (saveMetaItem).

sys_metadata hydration at boot is not judged. It is the bare slot with no package, the same carve-out ADR-0048's 2026-10-08 addendum N.3 makes for the security catalog.

The gap

1. An environment saves page p1, isDefault: true, for object X, while no package holds X's default. The save door accepts it, correctly.
2. A package upgrade then ships page p2, isDefault: true, for X.
   • Hot install: refused with DEFAULT_RECORD_PAGE_CONFLICT, naming both pages.
   • Upgrade, then restart: every package registers before stored pages hydrate. So the package door sees no other holder, and the stored p1 then hydrates into the bare slot unjudged. Both defaults are live, and the renderer has no tie-break.

So one composition gets a different answer depending on install order. That is the order-dependence ruling A rejected in its option D. AGENTS.md's startup-registry rule applies in the mirror sense: the package door concludes "no other holder" from a registry whose stored pages have not hydrated yet.

Reach

• Measured population: 0. In objectstack, 7 objects each have exactly one default record page. objectui has no record-page producers. The cloud pair (cloud_organization_detail against sys_organization_detail) is two packages, so registration already refuses it.
• The pair forms only through the save-then-upgrade-then-restart sequence. An AI author writing the second default is refused at save, at install, and by os validate.

Options (for the maintainer; this seat did not choose for the product)

• A. Keep the stated boundary. Cost: none now. This is what PR feat(spec,objectql,metadata-protocol)!: one default record page per object per deployment, a second refused at os validate, registration and save (#23015) #23206 ships: the boundary is stated in the objectql module doc, the PR's Acceptance notes and the D3 acceptance criteria.
• B. A post-hydration boot refusal naming both pages, on the ADR-0048 N.3 amendment pattern (ruling 6063176077 on [decision] cold boot admits a package whose permission set or position name the environment catalog already holds (package registration runs before sys_metadata hydration), while a hot install of the same package is refused #22307). It would need an os migrate lister to clear stored rows. Cost: M, objectstack only, and a new refusal surface at boot.
• C. A post-hydration error-level log. Cost: S. But AGENTS.md ranks a loud log below a refusal, and the second default would still be served.

This seat's reading for PR #23206 is A, because a new gate defaults to no unless the maintainer names it. The contract review (6142059579 ③) judged the question outside ruling A's two doors, so it is a maintainer choice and not a gap that PR owes.

Governing text: ruling A on #23015 (6134056653); ADR-0048's 2026-10-08 addendum N.3 and its amendment (6063176077); AGENTS.md's startup-registry rule.