Repository navigation
metadata-protocol: a save naming a package beside an existing package-less row of the item mints a second row, and the read naming no package keeps serving the unbound one (S6, reachable through today's doors) #23291
Description
Filing gate: (a) a reproducible defect. reach: the protocol save and read doors that PUT and GET /api/v1/meta/TYPE/NAME call. Measured over a row-keeping stub engine at PR #23290's head (b546c5ff2, #23165's fix), through the protocol doors; the HTTP route itself was not driven for this sequence. Dev report 6148282605 on #23165, out-of-scope finding 1. #23165's card names this shape "S6", and its "Existing rows" line excludes it: "If one is measured served wrongly, that measurement is its own card." This is that card. Reader who acts: triage, to grade and route (packages/metadata-protocol); then the owning seat.
Filed by domain:spec seat 2 (#18549) · os-justin · session session_01BRQ9Mp1yH7R1az6MaUM18H, at #23165's ACCEPT. ⛔ Not a claim.
What happens (the sequence, at the protocol doors)
- A package-less save of an item with NO package binding writes the package-unbound row (
package_idnull). - A save of the same item naming a package then writes a second row beside it. The stored rows are now
[null 'unbound']and[com.qa.lanebapp 'pkg'], with the unbound row first. - The read naming no package serves
'unbound', and the read naming the package serves'pkg'. - A package-less save then resolves the one bound package (metadata-protocol: a package-less direct save of an item a package owns answers 200 and writes a package-less row the item read never serves; the draft save already resolves the owning package (#11087 / #22128) #23165's option B) and writes the package row ("Saved app … (env-wide, package=com.qa.lanebapp, state=active)"). The read naming no package still serves
'unbound', while the list serves the new body. - A package-less delete removes the package row, and its receipt says the package-less row remains.
So once a package-scoped save lands beside an existing package-less row, the read naming no package (ADR-0048 §3.3, first match) and the save naming no package address different rows.
Governing text
- ADR-0070 TL;DR 1: the package-less state "stops being an authoring destination; it remains only as a read-side rehydration detail and a migration source".
- ADR-0048 §3.3: a context-free read is best-effort and returns the first match.
Wanted
The lane decides which of these fits ADR-0070, and the PR states it:
- the save naming a package refuses to mint a row beside an unbound row of the same item;
- or it adopts that row;
- or the read naming no package resolves the same address the save does.
Pins: the sequence above, with each step's read agreeing with the save's address.
Dedupe
MCP search_issues on this repo, closed included: package-scoped save beside package-less row mints second row read naming no package serves unbound row → 7 hits. #23165 (its parent, which excludes this shape), #22057, #21817 and #21761 are closed siblings on other read and lock paths. None is this.
Dedupe words: package-scoped save beside package-less row; second row unbound first; read naming no package serves unbound; S6 save address read address disagree.
Generated by Claude Code
Activity
objectstack-fleet commentedon Oct 13, 2026
Triage: first grade,
bug·priority:p2·domain:engine,pm:blockedon PR #23290. A package-scoped save beside a package-less row of the item and the read naming no package agree on one address (S6)Triage seat (objectstack-wide, seat post #6015) ·
session_01AavokzJ5DndAwitDXvKy4U· 2026-10-13T15:57Z. ⛔ Not a claim, ⛔ not a dispatch.6148282605), not over HTTP.packages/metadata-protocolisdomain:engine. All three options the card lists (refuse, adopt, or the read resolving the save's address) keep or narrow what the doors accept, soClause-②: no. If the seat finds an option that widens, the work moves to the spec lane.Blocked-by: #23290
Restart-when: PR #23290 has merged.
objectstack-fleet commentedon Oct 13, 2026
Unlock scan:
pm:blocked→pm:queue.Blocked-by: #23290is satisfied: PR #23290 (#23165's fix) merged as543b33dee6Triage seat (objectstack-wide, seat post #6015) ·
session_01AavokzJ5DndAwitDXvKy4U· 2026-10-13T16:04Z. ⛔ Not a claim, ⛔ not a dispatch.main. The card's readings were taken at the PR's headb546c5ff2, not at the merge.objectstack-fleet commentedon Oct 14, 2026
Regrade: p2 → p1 ·
target:v18· protocol-first rule, all lanes · triage seat ·session_01AavokzJ5DndAwitDXvKy4U· 2026-10-14T08:14ZUnder the maintainer's grading rule, recorded on #6015 (
6163099154, amended6163539661) and extended today, 「立卡，规则扩到所有车道，REST 收窄也算」: every metadata-protocol change, and every narrowing of a REST or data door, is p1 +target:v18in every lane. The skill text follows in #23431.Lane, scope and Clause ② are unchanged.
objectstack-fleet commentedon Oct 14, 2026
Claim: PM loop round 1 · 2026-10-14T11:38Z ·
domain:engineseat 1, term 3, on the maintainer's order 「认领 23291，派开发去做」 (seat post #6367; scope note 6167457005)Session:
session_01Rerax7QTjKMPCUZxQUtPFRAccount:
marchtian(the card's assignee)Branch:
claude/issue-23291-package-addressWorktree:
objectstack-issue-23291Domain:
domain:engineSeat:
domain:engine#1File surface:
packages/metadata-protocol/src/**(the package addressing of the save, read and delete doors inprotocol.ts, andsys-metadata-repository.tsonly if the chosen option needs it), the tests that pin them, and one changeset (stop on breach; explain in the report)Container & model:
M,mode:cloud,model: opus(dispatch-gates --tier: "no path-derived mandate … default opus"); contract review atCONTRACT_REVIEW_TIER, served on opus by the maintainer's order recorded in 6166448512Clause-②: no (triage 6149653063: refuse, adopt, or resolve the save's address all keep or narrow what the doors accept; an option that widens moves the work to the spec lane)
Responsibility:
packages/metadata-protocol(this lane's code): the save naming a package mints a row beside the package-unbound row, and the read naming no package takes ADR-0048 §3.3's first match | none (#23165, PR #23290543b33dee6, fixed the package-less save and delete, and its card excludes this shape) | an author who saves with?package=an item that already has a package-less row, throughPUTandGET /api/v1/meta/TYPE/NAME; measured at the protocol doors over a stub engine, not over HTTP. Whether anyone reaches it today is not measured; the dev's measure-first step answers it on a real kernelThread-read: 6163967021
Serial constraints cleared:
protocol.tsis held by five drafts, and whichever lands second mergesmain(#23390 → A). They are this seat's #23469 (S2); seat 2's #23452 (S1) and #23428 (8-post); anddomain:spec's #23464 (#23415, the delete door withdropStorage) and #23468 (#23183, the app read by package id). This card's pins assert none of their behaviour. #23406 (domain:engine, unclaimed, the sealed-item first draft) is a package-axis neighbour this card does not assert. #23297 is closed.Generated by Claude Code
objectstack-fleet commentedon Oct 14, 2026
Session note for claim 6167469011 ·
domain:engineseat 1 · 2026-10-14T11:40Z: the developer is the cloud sessionsession_01Deixz1D9pqfenZADBeqrAR(opus), started from this seat's session. Branch:claude/issue-23291-package-address, offorigin/main.The dev measures first: the five steps on current
mainat the protocol doors, and once over HTTP on a real kernel. It then picks the option (a), (b) or (c) that fits ADR-0070, and the PR states which.The draft PR opens when the build is ready. The seat's contract review runs on opus.
Generated by Claude Code
objectstack-fleet commentedon Oct 14, 2026
os-dev-report
{ "issue": 23291, "status": "done", "branch": "claude/issue-23291-package-address", "pr": "https://github.com/objectstack-ai/objectstack/pull/23489", "session": "session_01Deixz1D9pqfenZADBeqrAR", "premise_still_valid": true, "summary": "Option (c): getMetaItem's read naming no package now selects its stored content at the address packagelessAddress resolves (the one the package-less save, delete and version token already use since #23165), so for a one-package item with a package-unbound row beside the package's row it serves the package's row, as ?package=P does; draft read and draft preview take the same address; lock selection unchanged. Option (b) adopt was implemented first (commit b776dcd1, in SysMetadataRepository.resolveWriteHead) and reverted (890bf1d3): it went red on protocol.org-scoped-write-refused.test.ts, which pins the package-unbound row as the ADR-0048 stand-in for every package with no row of its own, so adopting it into one package strips other packages' customization. (a) refuse was rejected as a door narrowing that needs a remedy that would also delete that stand-in. Both mechanism assumptions measured: the five steps reproduce on main at the protocol doors (90637274) and over HTTP on a real kernel (pnpm dev:todo --fresh; main's read served the unbound BODY with the package row's version TOKEN), and the pair is reachable through today's doors (package-less save of an unbound item, then a save naming the package), not only from pre-ADR-0070 rows. main merged before opening (#23464 had landed); delta vs main = 3 files. Card assignee untouched; PR assignee marchtian.", "tests": "Head 52bfacaa. pnpm --filter @objectstack/metadata-protocol test: Test Files 235 passed | 3 skipped (238); Tests 28395 passed | 19 skipped (28414); typecheck exit 0 (os-verify-lock VERDICT command-exit 0). @objectstack/rest real-route suites (meta-draft-head-package-inheritance, meta-item-version-token-occ, meta-publish-package-scope, meta-item-envelope, meta-item-absent-404, meta-item-layered-route): 82/82. New pins in protocol.packageless-save-address.test.ts (block [#23291], existing ledger-pinned double): five steps, both storage orders, draft reads, edge with another package's row (save+delete refused 409 RESOURCE_CONFLICT, then one-package again after DELETE ?package=Q), stand-in control. Ablation (fix committed first, scripts/ablation-replace.mjs, anchor 1->0, blob 4ffc6d78->46991e7c, restored blob == HEAD, git diff HEAD empty): 4 new pins red (five steps, unbound-first order, draft reads, edge), 2 controls green; suite imports src so no dist leg. HTTP main reading used the same ablation held + metadata-protocol rebuild; ablation-dist-preflight: marker absent from 22 built files; after restore + rebuild: marker present in 2 built files, tree clean against HEAD.", "gates": "Local: node scripts/pm/dispatch-gates.mjs --ran at 52bfacaa: '65 derived famil(ies) accounted for — 64 run, 1 NOT-MEASURED (1 DERIVED from a recorded exit 3)'. All 64 exit 0; NOT MEASURED: node scripts/check-plugin-teardown-shape.mjs --self-test exit 3 (refuses on a shallow clone, positive control pinned to commit 621a4876; CI runs it). An earlier pre-merge run had check:dts-closure and check:dual-build-cjs-loads exit 1 only because that local build used OS_SKIP_DTS=1; both exit 0 at 52bfacaa after a DTS build. CI on PR #23489 at report time: 'No other open PR may claim the same issue' success; 'Packed-tarball smoke (opt-in)' skipped; all others in_progress (Lint & Repo Gates jobs, Type Check jobs, Check Changeset, Governed Surface Queue Guard, Test/Build not yet listed).", "mcp_calls": "4 — mcp__github__issue_read (get, get_comments) x2, mcp__github__pull_request_read (get, get_check_runs) x2; reads only", "api_writes": "3 — via scripts/pm/fleet-write relay (run 38568281010): POST /repos/objectstack-ai/objectstack/pulls (draft), POST /repos/objectstack-ai/objectstack/issues/23489/assignees; via post-stamped.mjs: POST /repos/objectstack-ai/objectstack/issues/23291/comments (this report). git push is not a REST write. No label write (dispatch named none; changeset present).", "open_questions": [ { "question": "Which option fits ADR-0070 (triage 6149653063)?", "options": [ "(a) refuse the save naming a package beside an unbound row", "(b) adopt the unbound row into the package", "(c) the read naming no package resolves the save's address" ], "recommendation": "(c), taken: (b) measured wrong (strips the ADR-0048 stand-in other packages read through; red in protocol.org-scoped-write-refused.test.ts); (a) narrows the save door and its only remedy deletes that stand-in." }, { "question": "Convert stored [null, P] pairs (fold the unbound row into P's) as an ADR-0070 migration step?", "options": [ "A leave both rows (this PR)", "B a migration that folds the unbound row when no other package reads through it" ], "recommendation": "A, unless a measured reader still reaches the wrong row; B is a stored-data decision outside this card." }, { "question": "Conflict between dispatch and os-dev: dispatch suggested (b) as closest to 'migration source'; os-dev rule 6 / dispatch's own measure-first clause decided.", "options": [ "followed the measurement" ], "recommendation": "no action; named per os-dev." } ], "out_of_scope_findings": [ "class: none filed · observation: a package-less DRAFT save that inherits a package answers '(env-wide, state=draft)' without naming the package, unlike the direct save's receipt · noted in PR Acceptance notes / Open questions only · carrier: 承接者:无" ] }Generated by Claude Code
objectstack-fleet commentedon Oct 14, 2026
Seat note ·
domain:engineseat 1 ·session_01Rerax7QTjKMPCUZxQUtPFR· 2026-10-14T13:33Z: PR #23489's contract review is FAIL (6169548673), with option (c) upheld. The patch round has two fixes:getMetaItemLayered(/layers,?layers=,/published) moves onto the save's address.Both were relayed to the dev,
session_01Deixz1D9pqfenZADBeqrAR.The carriers for what the review left outside this card:
[null, P, Q]serves the unbound row's token) is a note only: both writes are refused there, so the token cannot be spent.[null, P]pairs) stays with ADR-0070 D5, not this card.Generated by Claude Code
objectstack-fleet commentedon Oct 14, 2026
os-dev-report
{ "issue": 23291, "status": "done", "branch": "claude/issue-23291-package-address", "pr": "https://github.com/objectstack-ai/objectstack/pull/23489", "session": "session_01Deixz1D9pqfenZADBeqrAR", "premise_still_valid": true, "round": "patch round after contract review 6169548673 (FAIL), new head e39d82de", "summary": "Fix 1 (review 1.9): a new helper, packagelessReadAddress, is shared by getMetaItem and getMetaItemLayered. A layered read naming no package now takes its overlay content row from the address packagelessAddress resolves, so effective, /layers, ?layers= and /published on both hosts follow the plain read; the lock stays at request.packageId. The layered resolution sits outside its catch: inside it, it double-wrapped the #5532 503 and lost the driver error as cause (protocol.metadata-store-outage.test.ts went red, fixed in e39d82de). Fix 2: the changeset now names the item, layered, published and draft reads, states the draft corner's 200 to 404 (strict draft read naming no package, active rows on P, only draft on Q: 404 NO_DRAFT, read it with ?package=Q, preview serves P's active row), and replaces the false sentences. The PR body (rewritten through the relay) also corrects the revert attribution to 5e945626 and the 'no longer an authoring destination' overstatement. E1 and the draft-save receipt are left to the seat's card. No merge of main (GitHub reported clean).", "tests": "Head e39d82de. metadata-protocol test: Test Files 235 passed | 3 skipped; Tests 28397 passed | 19 skipped; typecheck exit 0 (VERDICT command-exit 0). New pins: the layered read in both storage orders (overlay = P's row, effective = the plain read's item, also at step 3 of the five steps), a layered stand-in control (naming a package with no row reports the unbound row), and the draft corner (404 NO_DRAFT by code + status; ?package=Q serves Q's draft; preview serves P's active row, no _draft). Ablation, fix committed first, ablation-replace each leg with restored blob == HEAD and git diff HEAD empty. Layered line at e39d82de: 2 red (five steps, unbound-first order; both on the layered overlay assertion), 37 green. Plain-read line at b463e4be: 5 red (five steps, unbound-first, draft corner, draft reads, edge), 34 green. Real-route suites at e39d82de after a metadata-protocol rebuild: rest, every file driving /published, /layers or ?layers= (23 files), 862 passed; runtime dispatcher /published twin and parity suites (http-dispatcher, meta-published-runtime-publish, meta-item-query-decision, meta-item-read-gate-parity), 401 passed. At b463e4be: the full rest suite, 287 files, 6060 passed, 328 skipped; 9 runtime meta files, 1208 passed.", "gates": "dispatch-gates --ran at e39d82de: 65 derived, 64 run with exit 0, 1 NOT-MEASURED: check-plugin-teardown-shape --self-test exits 3 on a shallow clone (CI runs it). One intermediate union run had check:dual-build-cjs-loads at exit 3, a prerequisite refusal while a build was rewriting dist in the same tree; the clean union at e39d82de has it at exit 0. CI on the new head: not read at report time; the seat re-reviews.", "mcp_calls": "2 this round — mcp__github__issue_read get_comments on #23489 (the review record); reads only", "api_writes": "2 this round — relay run 38581938649: PATCH /repos/objectstack-ai/objectstack/issues/23489 (the PR body: no pr_patch op exists in fleet-write/ops.mjs, and issue_patch on the PR number edits the PR body; read back identical, 12221 bytes); post-stamped: POST /repos/objectstack-ai/objectstack/issues/23291/comments (this report).", "open_questions": [ { "question": "The relay has no pr_patch op; the PR body was edited through issue_patch on #23489. Should a pr_patch op exist?", "options": [ "A keep using issue_patch for PR bodies", "B add a pr_patch op" ], "recommendation": "A: same endpoint family, the body was read back identical." }, { "question": "packagelessAddress now runs twice on a package-less active read (content + token): resolve once?", "options": [ "A follow-up", "B leave" ], "recommendation": "A, as the review notes: a cost fix, not a contract one." } ], "out_of_scope_findings": [ "carrier: the seat's card (review E1) · the draft publish and discard naming no package resolve different addresses from the draft save and the read; the draft-save receipt omits the inherited package" ] }Generated by Claude Code
objectstack-fleet commentedon Oct 14, 2026
Seat note ·
domain:engineseat 1 ·session_01Rerax7QTjKMPCUZxQUtPFR· 2026-10-14T14:54Z: PR #23489's re-review is FAIL (6171238772). Fix 1 and most of fix 2 are discharged, and option (c) stays upheld. The patch round, relayed to the dev:objectsave's destructive-change check reads at the save's own resolved address, and is pinned and ablated;Carrier answers asked for by the record:
packagelessAddressonce per read): declined, recorded here. It costs one indexedsys_metadatafindper package-less item, layered or/publishedread, with no measured latency impact. A card is owed only if a measurement shows one.pr_patchop in the relay): no change.issue_patchon a PR number is GitHub's documented edit, and it read back byte-identical.Generated by Claude Code
objectstack-fleet commentedon Oct 14, 2026
os-dev-report
{ "issue": 23291, "status": "done", "branch": "claude/issue-23291-package-address", "pr": "https://github.com/objectstack-ai/objectstack/pull/23489", "session": "session_01Deixz1D9pqfenZADBeqrAR", "premise_still_valid": true, "round": "patch round 3, after re-review 6171238772 (FAIL); new head 8e3b9491", "summary": "Review 1.5 took the preferred route. saveMetaItem's object destructive-change check now reads the existing item at the save's own resolved address (packageId: request.packageId; a package-less publish save has already resolved it to P, per #23165). Each save is judged against the row it overwrites, which closes the third-package corner: a save naming Q with no row is judged against the unbound stand-in, never against P's row. 2(c): the changeset and PR body no longer claim no write moved. They name the destructive-change check's move in both directions, and add one line that in-process readers naming no package (the data doors' object reads, seed apply, the security catalog echo) follow the read. 'Any package-less write' is now 'a package-less save or delete'. Per the seat: Q0 is answered A, and Q1 is declined, not folded in. No merge of main.", "tests": "Head 8e3b9491. metadata-protocol test: 235 files passed (3 skipped), 28400 tests passed (19 skipped); typecheck exit 0. Full rest suite at 8e3b9491, after a metadata-protocol rebuild (it drives the /meta object saves and the destructive 409 faces): 287 files, 6060 passed, 328 skipped. New pins in the [#23291] destructive-change block, on an object in [null,P] with the unbound row first: (1) a package-less save dropping P-only field c is refused 409 DESTRUCTIVE_CHANGE (code + status), rows unchanged, and accepted with force; (2) one dropping unbound-only field d is accepted and writes P's row; (3) a save naming Q (no row) is accepted when it drops P-only c and refused 409 when it drops stand-in field d. Ablations, fix committed first: (a) ablation-replace on the new destructive-check line at c9e2de86: 1 red (pin 3), 41 green, restored blob == HEAD. (b) Pins 1 and 2 stay green under (a) because the round-1 plain-read resolution independently reads P. With both lines removed (the first held by ablation-replace, the second by an anchored python replace, hit 1 then 0) they go red (2 red, pin 3 green, as main behaves in this order). Restored by git checkout HEAD; hash equals HEAD:path; status clean.", "gates": "dispatch-gates --ran at 8e3b9491: 65 derived, 64 run with exit 0, 1 NOT-MEASURED (check-plugin-teardown-shape --self-test, exit 3 on a shallow clone; CI runs it). check:dual-build-cjs-loads first recorded exit 3 (prerequisite refusal while a metadata-protocol rebuild rewrote dist in the same tree); re-run alone on the settled tree: exit 0. CI on 8e3b9491: not read at report time.", "mcp_calls": "2 this round — mcp__github__issue_read get_comments on #23489 (re-review record), and mcp__claude-code-remote__send_message (the earlier reply to the seat about the b463e4be red)", "api_writes": "2 this round — relay: PATCH /repos/objectstack-ai/objectstack/issues/23489 (PR body, read back identical, 14674 bytes); post-stamped: POST /repos/objectstack-ai/objectstack/issues/23291/comments (this report)", "open_questions": [], "out_of_scope_findings": [ "carrier: #23495 · E1 draft publish/discard addresses and the draft-save receipt (seat-filed)" ] }Generated by Claude Code
objectstack-fleet commentedon Oct 14, 2026
Pointer from
domain:specseat 4 ·session_0121ooBYRmS8ziFXm9ai5YHm· 2026-10-14T15:29Z · ⛔ Not a claim; for this card's seat (domain:engineseat 1) and PR #23489.The #23416 dev measured this card's shape for
type: 'object', with the registry's view beside the rows. It is in PR #23510's report on #23416 (6171892674, out-of-scope finding 1):saveMetaItemon a real kernel (ObjectKernel + ObjectQLPlugin) atcb9841aa25, the methodPUT /api/v1/meta/object/NAME?package=Qcalls.qa_probe_gadget, then a save namingcom.qa.q.[null, com.qa.q].'sys_metadata', with the warnalready owned by package "sys_metadata" … cannot claim ownership.PR #23510 (#23416) closes the same disagreement for a runtime owner bound to a REAL package, with the existing D9.9 mismatch refusal. It leaves the sentinel-keyed owner, which is this card's shape, untouched by design: the D9.9 prescription "bind it to package 'sys_metadata'" would be wrong advice.
Whichever of this card's three options PR #23489 takes, its object case should cover the registry's sentinel owner. Otherwise an object can still be saved into a package the registry will never hold. This seat files no card for it: this card is its carrier.
objectstack-fleet commentedon Oct 14, 2026
Seat note ·
domain:engineseat 1 ·session_01Rerax7QTjKMPCUZxQUtPFR· 2026-10-14T15:48Z: PR #23489's round-3 re-review is PASS (6172318416) at8e3b9491.Landing condition 2 is met:
domain:specseat 4's pointer 6171964742 (the runtime object held by thesys_metadatasentinel owner) now has a carrier that survives this card's close: #23514, sequenced after PR #23510 (#23416) and PR #23489.Landing condition 1, the final head's CI, is open.
8e3b9491, which still has 0 check-runs.Generated by Claude Code
objectstack-fleet commentedon Oct 14, 2026
os-dev-report
{ "issue": 23291, "status": "done", "branch": "claude/issue-23291-package-address", "pr": "https://github.com/objectstack-ai/objectstack/pull/23489", "session": "session_01Deixz1D9pqfenZADBeqrAR", "round": "addendum after re-review PASS 6172318416: new head 46282fff (re-sync push)", "summary": "GitHub had not synced the PR to 8e3b9491. One real commit carries the record's two non-blocking items: the changeset now reads 'No metadata write door's own rule moves', and the third-package destructive pin's refused leg asserts every row is unchanged. The PR API now names 46282fff, and 22 check-runs have started on it. No merge of main.", "tests": "Head 46282fff: pnpm --filter @objectstack/metadata-protocol test: 235 files passed | 3 skipped; 28400 passed | 19 skipped. typecheck exit 0 (VERDICT command-exit 0).", "gates": "CI on 46282fff: in progress at report time (22 check-runs started). The local union was not re-run: the delta from 8e3b9491 is one changeset sentence and one test assertion.", "api_writes": "1 — POST /repos/objectstack-ai/objectstack/issues/23291/comments (this addendum)", "open_questions": [] }Generated by Claude Code
objectstack-fleet commentedon Oct 14, 2026
Seat ACCEPT: PR #23489 (#23291, option (c): the read naming no package serves the save's address) at
46282fff92domain:engineseat 1,session_01Rerax7QTjKMPCUZxQUtPFR(marchtian), 2026-10-14T16:31Z. Cloud devsession_01Deixz1D9pqfenZADBeqrAR.Contract reviews (on opus, under the order 6166448512):
e39d82deb3;8e3b9491.The final delta
8e3b9491..46282fff, checked in-seat (one commit,46282fff92, 2 files, +4 / −2). It carries the round-3 record's two non-blocking items and nothing else:409 DESTRUCTIVE_CHANGE. The rows are snapshotted before the save and compared after it. This adds an assertion and changes no code.No source line moves in the delta, so the PASS at
8e3b9491carries to46282fff.Checklist, read on GitHub:
main. Line 1 isFixes #23291, line 2 isClause-②: no(upheld by the review). Assigneemarchtian. NoCHANGELOG.md, nothing undercontent/docs/releases/, and no model name in any trailer.main:protocol.ts, +61 / −3;[#23291]pin block, +273;@objectstack/metadata-protocolpatch.check-governed-merges --pr 23489reads not governed and 359 changed lines (≤ 3000). This is an ordinary queue landing.46282fff92: 40 check-runs, all completed: 34success, 6 skipped by design (the dogfood shard matrix, Dogfood Verify CLI, Console Pin Gate, Temporal Conformance, Build Docs, Packed-tarball smoke). 0 red, 0 pending.mergeable_state: clean.Carried out of this card (the landing conditions in 6172357809):
sys_metadatasentinel owner (domain:specseat 4's pointer 6171964742), sequenced after PR fix(metadata-protocol)!: a save into a second package of an object a runtime-authored row owns is refused (ADR-0029 D9.9) #23510 and this PR.[null, P]pair: answered no, unless a measured reader still reaches the wrong row (6171252768).Landing: the seat flips the PR ready and arms auto-merge through the relay in this same stroke. GitHub queues it and merges it on green. A Landed record follows on MERGED, and this card closes with the PR (
Fixes #23291).Generated by Claude Code
objectstack-fleet commentedon Oct 14, 2026
Landed: PR #23489 (#23291, option (c)) MERGED as
47d569e6fcdomain:engineseat 1,session_01Rerax7QTjKMPCUZxQUtPFR(marchtian), 2026-10-14T17:43Z.How it landed:
main54af6c0e9a.Fixes #23291closed this card as completed.Byte check, the merged tree against the head the seat accepted (
46282fff92, ACCEPT 6173215707, round-3 review PASS 6172318416):[#23291]pin file.packages/metadata-protocol/src/protocol.tswas also changed onmainafter the PR's base73c7dc4a3d, by three commits:0d3ea295d1(the 8-post retired-catalog cleanup);87d061922f(feat(spec): the app item read answers by package id — 403 / 404 by the package key, per ADR-0048 §3.1 #23468, the app item read by package id);222293f60a(fix(metadata-protocol)!: a save into a second package of an object a runtime-authored row owns is refused (ADR-0029 D9.9) #23510, ADR-0029 D9.9).git merge-treeofmain54af6c0e9aand the accepted head. The PR's hunks are intact and nothing else entered. The queue's full CI ran on that tree and was green.Carried forward (landing conditions 6172357809):
sys_metadatasentinel owner, which is now unblocked, since fix(metadata-protocol)!: a save into a second package of an object a runtime-authored row owns is refused (ADR-0029 D9.9) #23510 and this PR are both onmain.[null, P]pair: answered no, unless a measured reader still reaches the wrong row (6171252768).The dev session is archived.
Generated by Claude Code