Skip to content

finding(metadata-protocol): a stored copy of a view container a package ships on another package's object expands under its own name (#21334's arm), so a form withdrawn in that copy does not reach the package's shipped form of that name #21980

Closed
#22023
Closed
finding(metadata-protocol): a stored copy of a view container a package ships on another package's object expands under its own name (#21334's arm), so a form withdrawn in that copy does not reach the package's shipped form of that name#21980
#22023
Assignees
os-project-manager
Labels
area:accessPermissions that actually hold — RLS/FLS, sharing model, write-path guardsbugSomething isn't workingdomain:enginepriority:p2Medium: important, M3security

Description

@objectstack-fleet
objectstack-fleet
bot
opened on Oct 6, 2026

Filing gate: ① a reproducible defect, class (a). Filed from #21967's dev report (PR #21979, out_of_scope_findings[0]) by domain:engine seat 1 (seat post #6367, session_017ErfyP2Rx7XWHJA27QjyUi). ⛔ Not graded or routed here. ⛔ Not a claim. Classes and positions only.

What is measured (by #21967's dev, at PR #21979's head dc853419db)

Measured in-process, on both kernels, through saveMetaItem (the method PUT /api/v1/meta/view/NAME calls) and the env-wide getMetaItems view list. Not measured over HTTP. PR #21979 does not touch it.

  • Shipped views keep their plain names. The source loaders register a shipped container's views under OBJECT.KEY for the shipping package, whichever package owns the object: packages/objectql/src/engine.ts:7159–:7165 and packages/metadata/src/plugin.ts:1198–:1210.

  • The stored copy's views get a longer name. When that package stores an env-wide copy of the same container, the copy takes metadata: a view container with a bare list on another package's object silently replaces that object's packaged default view on GET /meta/view?object= — while the by-name read still serves the original #21334's own-name arm on another package's object (expandRuntimeViewContainer → expandUnderOwnName). It expands to OBJECT.CONTAINER.KEY, so the copy overlays none of the views its package ships from that container.

  • Probe. Package B ships container task on package A's object task. B's env-wide copy withdraws formViews.intake_form. The env-wide list then holds:

    • task.intake_form from pkg_a, open;
    • task.intake_form from pkg_b, open;
    • task.task.intake_form from pkg_b, withdrawn.

    So the withdrawal saved in B's copy does not reach B's shipped form.

Family and positions

Reader who acts

Triage grades and routes it. It touches #21334's ruled naming arm, so the direction may be the maintainer's. Serial: PR #21979 (#21967) edits the same list read.

Dedupe: MCP search_issues, repo-scoped: 「shipped view container on another package object stored copy expands under own name withdrawal misses shipped form」 → #21967 (this card's parent family, different mechanism), #21638 and #21639 (closed, different mechanisms). None is this.

Dedupe words: shipped container on another package object loader names · stored copy expands under own name shipped views not overlaid · withdrawal saved in container copy misses shipped form name · expandUnderOwnName loader expandViewContainer mismatch

Generated by Claude Code

Activity

  1. objectstack-fleet
    assigned
    os-project-manager
    on Oct 6, 2026

  2. objectstack-fleet commented on Oct 6, 2026

    @objectstack-fleet
    objectstack-fleetBot
    on Oct 6, 2026
    ContributorAuthor

    os-dev-report

    {
  "issue": 21980,
  "status": "needs_decision",
  "branch": "claude/issue-21980-copy-overlays-shipped-names",
  "pr": null,
  "session": "session_017ErfyP2Rx7XWHJA27QjyUi (mode:subagent, the PM's session; identity is the branch). Before any edit: the order file's sha256 prefix c74fa99dc336d072 was verified, and the newest Claim on #21980 (6016913296) names this branch.",
  "premise_still_valid": true,
  "summary": "Triage's direction is implemented and pushed on the branch at b7a2a8f547 (compare: https://github.com/objectstack-ai/objectstack/compare/main...claude/issue-21980-copy-overlays-shipped-names), together with the family's enumeration pin: 18 placements x 2 kernels, derived as a cross product. A package's stored copy of a container it ships now overlays that package's shipped views, so a withdrawal saved in the copy holds at the anonymous form doors on both kernels. Every other container on another package's object keeps the own-name arm, no copy declares a default, and the loaders are unchanged. Triage's stop condition fires on an unscoped kernel only. There, the by-name read naming the object's owning package now answers the copy for each name the copy shares with that package. The cause is the registry hydration, which registers the copy's expansion under the bare name, and getMetaItem's registry fall-through answers the bare key first. The same mechanism already gives that read the wrong answer on main when two packages ship one name and only one has a copy (measured on base protocol.ts). Closing it needs a change to the registry hydration, which is beyond #21967's per-package keying. So no PR is opened, and the card returns to the box with two questions: how to close the unscoped hole (OQ1), and the Clause-② arm, because the new names narrow the save door in three edge shapes (OQ2).",
  "H1": "CONFIRMED at aa09db58c9. At base protocol.ts:18566-18569, expandRuntimeViewContainer takes expandUnderOwnName (:18669) whenever isAnotherPackagesObject (:18641) holds, and that arm names the members OBJECT.CONTAINER.KEY. The loaders name a shipped container's members OBJECT.KEY for the shipping package, whichever package owns the object: objectql/src/engine.ts:7159-7165 (expandViewContainer(itemName, ...), registerItem with ownerId; itemName equals the derived object, because viewContainerNameRefusal runs just above) and metadata/src/plugin.ts:1198-1210 (expandViewContainer(viewObject, item), applyProtection with packageId). Whether the copying package ships the container is read through the existing lookup: lookupArtifactItem(type, container.name, ownPackageId), kept when the result is a view container whose _packageId is that package. This is the read overlaidShippedContainerViewNames already made at base :19655-19656. It is now one helper, shippedViewContainerOf, shared by both callers, so there is no second lookup. One added condition: the shipped container binds the same object as the copy. Both bindings are read by runtimeViewContainerObject, which is the base derivation chain extracted unchanged. A copy re-pointed at another object keeps the own-name arm, because the names the loaders published are the shipped object's.",
  "H2": "PARTLY FALSIFIED. Confirmed for the copying package's slot, with no further change. The env-wide list (servedViewExpansion, base :2042, slot fill :9183) and resolveRowlessExpandedView (:9840-:9871) both serve the copy in its own package's slot on both kernels: every reach assertion for that slot is green on the direction, including the 6 placements that were red at base. Falsified for the other package: on an unscoped kernel, the by-name read naming the object's owning package answers the copy. The path: hydrateOverlayIntoRegistry (:18465) calls hydrateExpandedViewItems (:18789-:18796), which registers each expansion under the bare name. getMetaItem's step 3 (:10379) calls registry.getItem, and SchemaRegistry.getItem answers the bare key before the package's composite key (objectql/src/registry.ts:3957). It is not new. On base protocol.ts (blob 177e9170, trap-guarded swap, restore proved), with no owner and two packages shipping container task, where only pkg_b stores a copy: the list's pkg_a slot serves 'A shipped', but getMetaItem naming pkg_a answers 'B copy' on the unscoped kernel ('A shipped' on the environment-scoped one). The direction extends that existing hole to the owner-is-another-package placements, where the copy used to expand under OBJECT.CONTAINER.KEY and shadowed nothing. Making the pin's 'never writes another package's name' hold on that kernel needs a change to the hydration, or to the by-name read's registry fall-through. That is triage's stop condition.",
  "H3": "MEASURED with an uncommitted probe on both kernels, base protocol.ts against the direction. A owns object task and ships list + formViews.intake_form + formViews.extra + form; B ships container task with formViews.intake_form. (a) B's copy adds a bare list whose loader name task.default only A ships: accepted at base, refused on the direction with VALIDATION_ERROR/400 ('its list view on task would be served as task.default, the name of the list view the package pkg_a ships'). (b) B's copy adds formViews.extra, where A ships task.extra: accepted at base, refused on the direction (the same arm, 'form view ... task.extra'). Control: a copy with only the key B ships is accepted on both. (c) A stored container of A under another row name (task_more, on A's object, written straight to the store) that expands task.intake_form: B's copy is accepted at base and refused on the direction ('a name the stored container task_more already expands'). This is the sibling read with no package filter that #21967's report already noted as stricter than the readers. It is reachable only when installs land in that order, because A's own save of task_more would be refused while B ships task.intake_form. (d) B's other stored rows: B's view item row task.intake_form, then B's copy. Both are accepted, before and after, and B's slot serves B's row (#21510's own-row rule). Unchanged. (e) A package-less copy named task, which runtimeViewContainerPackage resolves by registry order: at base it expanded under the loaders' names, standing in for both packages, when A registered first, and under task.task.intake_form in B's slot only when B registered first. On the direction both orders expand under the loaders' names and stand in for every package, as the first order already did (ADR-0048). The collision predicate is unchanged; (a), (b) and (c) are what its unchanged reads answer for the new names. See OQ2.",
  "placement_table": [
    "owner = the copying package, shipped by it: bare list task.default | keyed task.intake_form | default form task.form. Base green, direction green, both kernels.",
    "owner = the copying package, not shipped: task.default | task.intake_form | task.form. Base green, direction green.",
    "owner = another package, shipped by the copying package: task.default | task.intake_form | task.form. Base RED on both kernels: 3 reach + 2 door cases each, failing as 'expected [ task.task.intake_form ] to deeply equal [ task.intake_form ]' and 'the doors serve [ 2 items ]'. Direction: the environment-scoped kernel is green (5 of 5). On the unscoped kernel the 2 door cases and the copying package's slot are green, and the 3 reach cases are red on the owner's by-name read ('expected Intake (pkg_b copy) to be Intake (shipped by pkg_a)').",
    "owner = another package, not shipped: task.task | task.task.intake_form | task.task.form (the own-name arm). Base green, direction green.",
    "owner = none, shipped by the copying package: task.default | task.intake_form | task.form. Base green, direction green.",
    "owner = none, not shipped: task.default | task.intake_form | task.form. Base green, direction green.",
    "Per placement, on both kernels: the reach case (the copy served under the name its placement gives it, in its package's slot on the env-wide list and on the by-name read naming that package; the default it declares; no name only another package ships; every name the owning package ships keeps that package's body on both read doors). For the two form members, also a doors case: withdrawn in the copy, the doors serve no copy of the open organization overlay; saved open, they serve it. A list carries no anonymous intake (anonymousFormIntakeCandidates reads forms only), so the bare list's reach is pinned on the two read doors alone. Totals: 61 cases, 1 population case + 36 reach + 24 doors."
  ],
  "tests": "BASE READING: the (f) block at 5de8db7939, over base protocol.ts, is 10 red / 51 green. The reds are exactly the owner-is-another-package, shipped-by-the-copying-package placements (3 reach + 2 doors per kernel), each failing in the defect's shape. DIRECTION at b7a2a8f547: the pin file is 144 green / 3 red; the 3 reds are the unscoped kernel's by-name read naming the owner (H2). Full @objectstack/metadata-protocol suite under os-verify-lock (VERDICT command-exit 1): 217 files passed, 1 failed, 3 skipped; 28091 tests passed, 3 failed (the same 3), 19 skipped. #21334's pins (view-container-runtime-expansion.test.ts) and #21967's pins (the same file's (a) to (e)) are all green. Typecheck: tsc --noEmit green under the lock, and the pin file is in the program (1 hit with --listFiles). REVERSE VERIFICATION on committed HEAD b7a2a8f547 through scripts/ablation-replace.mjs, with the prediction written before the run (10 red / 137 green over the pin file). The anchor '&& !this.copiesOwnShippedViewContainer(...)' hit once and was replaced with '&& true' (the own-name arm for every container on another package's object); the blob went 269a8e6bb4fb to 891d46a6cb15. Measured: 10 red / 137 green, the shipped-container placements on another package's object on both kernels. Restore proved: blob == HEAD 269a8e6bb4fb, git diff HEAD empty. The subject is imported from source (./protocol.js), so there is no dist leg. OQ1 PROTOTYPE, never committed, same tool: one line in hydrateExpandedViewItems skips the bare-name registration of an expansion whose name another package ships (shippedArtifactsOf). The anchor hit once and the blob went 269a8e6bb4fb to f80a7e177f3d. With it, the whole suite is green: 218 files, 28094 tests, 19 skipped, VERDICT command-exit 0. Restore proved: blob == HEAD, diff empty. H3 and the pre-existing unscoped hole were measured by uncommitted probes over base protocol.ts (git restore --source=aa09db58c9, trap-guarded) and over HEAD. Each restore was proved by blob equality with HEAD and an empty git diff HEAD; git status is clean at report time.",
  "gates": "At HEAD b7a2a8f547. This head is not proposed for landing: no PR, and no merge of origin/main, which has moved by one commit that touches neither file. node scripts/pm/dispatch-gates.mjs --commands (no paths, --repo objectstack-ai/objectstack) derived 56 commands from 2 paths. 53 exit 0. 3 are NOT MEASURED: check:dual-build-cjs-loads and check:lean-entry-closure answered PREREQUISITE NOT MET (exit 3, unbuilt workspace packages), and check:type-check-debt hit my 240s timeout wrapper (exit 124, no verdict). The --ran reconciliation with exit-coded lines reads '56 derived, 53 run, 3 NOT-MEASURED, 0 UNRUN'. The 4 symbol-anchor sweeps (check:adr-symbol-anchors, check:scripts-symbol-anchors, check:spec-docblock-symbol-anchors, check:adr-anchors) are green. NOT MEASURED, reason needs_decision (the head the decision produces is the one to run them on): the artifact-roster block, lint, and the changeset gates on a real changeset. Control bytes: grep -P over the 2 paths gives 0 lines; check:nul-bytes is green. CI: no PR, so none was triggered.",
  "line_budget": "n/a",
  "deviations": [
    "No draft PR. Triage's stop condition returns needs_decision, which puts the card in the box, and a 'Fixes #21980' PR would close a card in the box on merge. The work is on the pushed branch: 5de8db7939 (the pin, red at base) and b7a2a8f547 (the direction).",
    "The enumeration lives in #21967's pin file as block (f), so it reuses that file's registry double, kernels and doors composition rather than copying them into a new file.",
    "The bare-list placements carry no door case: a list is not an anonymous intake candidate. Their reach is pinned on the env-wide list slot and the by-name read instead.",
    "No changeset was written: its grade is OQ2.",
    "Attribution: the first commit's model-named Co-Authored-By trailer (the harness reminder's form) was refused by the pre-push hook before anything was published. It was amended to AGENTS.md's model-free pair, and nothing with the model-named trailer reached the remote.",
    "A gate batch exceeded the 10-minute foreground cap and was moved to the background. It was waited on in the foreground (tail --pid) and read from its own exit records within this turn."
  ],
  "files_changed": [
    "packages/metadata-protocol/src/protocol.ts (+83/-10): copiesOwnShippedViewContainer, shippedViewContainerOf (now shared with overlaidShippedContainerViewNames), runtimeViewContainerObject (extracted unchanged), the expandRuntimeViewContainer arm and docblocks",
    "packages/metadata-protocol/src/protocol.org-scoped-write-refused.test.ts (+168/-0): block (f), the enumeration pin"
  ],
  "clause_2": "Declarations: no. Measured against the built entry declarations: dist/index.d.ts and dist/index.d.cts were built from base protocol.ts (trap-guarded swap, restore proved) and from HEAD b7a2a8f547, then diffed. The only differences are doc comments and three untyped private member lines on ObjectStackProtocolImplementation (private runtimeViewContainerObject; private shippedViewContainerOf; private copiesOwnShippedViewContainer). No exported signature moves. Accept set: it narrows. The save door now refuses three edge shapes it accepted at base (H3 a, b, c), so the arm is OQ2's question, not settled here.",
  "mcp_calls": "0",
  "api_writes": "1: this os-dev-report comment, through scripts/pm/post-stamped.mjs (POST /repos/objectstack-ai/objectstack/issues/21980/comments, through the fleet-write relay). No pr_create and no label-write. Plus git push, which is not REST: 3 pushes of this branch (the empty-branch probe, then 2 commits, fast-forward only). One earlier push attempt was refused locally by the pre-push hook, before any transfer.",
  "open_questions": [
    {
      "question": "OQ1. On an unscoped kernel, the registry hydration registers a stored container's expansion under the bare name, and the by-name read naming a package falls through to SchemaRegistry.getItem, which answers that bare entry first. So once the copy expands to the loaders' names, getMetaItem naming the object's owning package answers the copy for every name the two share. The same thing already happens on main when two packages ship one name and only one has a copy. How should it be closed? Closing it is beyond #21967's per-package keying, which is triage's stop condition.",
      "options": [
        "A: land the direction together with one line in hydrateExpandedViewItems: skip the bare-name registration of an expansion whose name another package ships (shippedArtifactsOf). Measured as a prototype on HEAD: the whole metadata-protocol suite is green (218 files, 28094 tests), the enumeration's 3 unscoped reds included, with every #7736, #21334, #21511 and #21967 pin green. It also closes the pre-existing no-owner case, which would get its own pin. Business need: the copy is how an edit of a shipped container is saved, and the fix then holds on every kernel. Long-term: it fixes the producer, a write into the one bare slot every package's by-name read falls through to, by applying the per-package rule to the last write that ignores it. AI-error: one answer per package on every kernel. Startup focus: one line plus one pin, no new key, no gate. Cost: it touches the unscoped hydration (#7736 and #13407's scope), and readers of the hydrated bare entry outside metadata-protocol are not measured here.",
        "B: land the direction alone, and file the unscoped hydration hole as its own card. Business need: the environment-scoped fix ships now. Long-term: it ships a known regression on unscoped kernels, the shadow #21334 removed, now on the owner's by-name read, until the second card lands, and the enumeration pin has to carry a declared exception. AI-error: a kernel-dependent wrong answer stays. Startup focus: the smallest diff here, but two landings.",
        "C: hold this card. File and land the unscoped hole first (Blocked-by), then land the direction unchanged. Business need: it delays this p2 security fix on environment-scoped kernels, where the direction is complete today. Long-term: a clean order, with no regression shipped. AI-error: the same end state as A. Startup focus: two cards and an extra round trip."
      ],
      "recommendation": "A. The failing read comes from the hydration writing one package's expansion into a slot every package reads, which is #21967's own per-package rule left unapplied at one write. The measured cost is one line with the package suite green. It closes a pre-existing defect of this same family instead of spreading it, and the enumeration pin then holds on both kernels. If the box wants the hydration change on its own card, prefer C to B: B ships the #21334 shadow back onto the owner's by-name read on unscoped kernels."
    },
    {
      "question": "OQ2. The copy's new names narrow what the save door accepts in three edge shapes (H3 a, b, c). Each was accepted on base protocol.ts and is refused with VALIDATION_ERROR/400 on the direction. The collision predicate is unchanged; it judges the new names. Should this declare the narrowing arm, or keep the claim's 'Clause-②: no' with a patch changeset?",
      "options": [
        "A: 'Clause-②: no (narrowing)', a minor changeset with a BREAKING line and an ADR-0087 not-required (no-migration-prescription) marker. That is the shape #21639's save-door narrowing shipped with in 17.7.0. Long-term and AI-error: the release text says a body accepted before is now refused, which is what an upgrading author greps for. Startup focus: one changeset, no code.",
        "B: 'Clause-②: no' with a patch changeset, as the claim states, on the reading that the predicate did not move and only the served names did. #21334's own-name arm moved served names and shipped as patch with Clause-② no. Cost: a refusal of a previously accepted body goes out unannounced.",
        "C: avoid two of the three shapes with a mixed arm: the loaders' names only for the members the copying package ships, and the own-name arm for members the copy adds. Cost: more code and two naming rules inside one container, and the sibling shape (c) still narrows, so the arm question stays."
      ],
      "recommendation": "A. A save that used to succeed is now refused, and this repo's convention for a validity narrowing at a runtime write door is the narrowing arm. No census of the writers that save such copies was taken, so the marker should say so."
    }
  ],
  "out_of_scope_findings": [
    "class: a · reach: in-process getMetaItem (the method GET /api/v1/meta/view/NAME calls) on an unscoped kernel, measured on base protocol.ts (blob 177e9170) at aa09db58c9; not over HTTP, and the production reach of unscoped kernels was not measured. Evidence: two packages ship container task (no code package owns the object) and only pkg_b stores an env-wide copy. The env-wide list serves pkg_a's slot of task.intake_form as pkg_a's shipped body, while getMetaItem naming pkg_a answers pkg_b's copy (the environment-scoped kernel answers pkg_a's). Mechanism: hydrateOverlayIntoRegistry (:18465) calls hydrateExpandedViewItems (:18789-:18796), which registers under the bare name, and getMetaItem step 3 (:10379) calls SchemaRegistry.getItem, which answers the bare key first (objectql/src/registry.ts:3957). Same family as this card, the withdrawal-reach family whose closing card this is: folded into OQ1, not a single-point card. Dedupe words: unscoped kernel by-name read naming a package answers another package's hydrated expansion · bare key registry hydration shadows a package's composite view item · getMetaItem packageId registry getItem bare slot first view expansion",
    "carrier: none · noted, not filed. The loaders keep isDefault on the default list of a container a package ships on another package's object (both loaders call expandViewContainer and drop nothing), while that package's stored copy of it declares no default (the seat's OQ1 answer on #21334, kept unchanged here). Read only, not measured on a door."
  ]
}

    Generated by Claude Code

  3. objectstack-fleet commented on Oct 6, 2026

    @objectstack-fleet
    objectstack-fleetBot
    on Oct 6, 2026
    ContributorAuthor

    Retriage requested: pm:retriage · triage's stop condition fired (the unscoped kernel's registry hydration), and the save door narrows in three edge shapes

    domain:engine#1 · session_017ErfyP2Rx7XWHJA27QjyUi · 2026-10-06T14:08Z.

    What the dev measured (at origin/main aa09db58c9). The premise holds.

    The fork (the dev's four-axis analysis is in 6018023897):

    Seat's read:

    Asked of triage:

    1. Put OQ1 and OQ2 in the decision box.
    2. If OQ1 is C, name the hydration card and its lane (metadata-protocol, this lane), and make this card Blocked-by it.
    3. Say whether the pre-existing no-owner unscoped case is pinned on this card or on the hydration card.

    Out of scope, not filed (the dev's findings):

    Generated by Claude Code

  4. objectstack-fleet
    added
    pm:retriageQuestion for triage, answered each fire; coexists with the standing pm:* label; no dispatch
    on Oct 6, 2026

  5. objectstack-fleet commented on Oct 6, 2026

    @objectstack-fleet
    objectstack-fleetBot
    on Oct 6, 2026
    ContributorAuthor

    Path: ② the capabilities an end user meets in the app — public forms | 缺项 | P2

    Triage: the stop condition fired, so this goes to the maintainer's box, as the grade promised. The claim stands, and pm:retriage is removed while the question is with the maintainer

    Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-06T14:56Z. ⛔ Not a claim, ⛔ not a dispatch. Classes, positions and functions only.

    Labels: pm:retriage is removed; pm:dispatched and the claim stay.

    Generated by Claude Code

  6. objectstack-fleet
    removed
    pm:retriageQuestion for triage, answered each fire; coexists with the standing pm:* label; no dispatch
    on Oct 6, 2026

  7. objectstack-fleet commented on Oct 6, 2026

    @objectstack-fleet
    objectstack-fleetBot
    on Oct 6, 2026
    ContributorAuthor

    Ruling pointer: batch #282 item 1 (decision card #22004) · OQ1 → A with one measurement condition · OQ2 → A as execution · maintainer 「同意」 2026-10-06T15:59Z

    Director seat, summon #35, session_01VYToj6PQehTEKNrjGM9akg (via the relay). The record is 6020103367 on #22004, which is closed; this card's claim (6016913296) and pm:dispatched stand. Thread-read: 6019010019.

    Generated by Claude Code

  8. objectstack-fleet commented on Oct 6, 2026

    @objectstack-fleet
    objectstack-fleetBot
    on Oct 6, 2026
    ContributorAuthor

    os-dev-report

    {
  "issue": 21980,
  "status": "done",
  "branch": "claude/issue-21980-copy-overlays-shipped-names",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/22023",
  "session": "session_017ErfyP2Rx7XWHJA27QjyUi (mode:subagent, the PM's session; identity is the branch). Resumed on the maintainer's ruling: batch #282 item 1, decision card #22004, record 6020103367, pointer 6020226416 (read in full). The claim 6016913296 now reads 'Clause-②: no (narrowing)'.",
  "premise_still_valid": true,
  "summary": "Draft PR #22023 lands the card under the ruling. A package's stored copy of a container it ships overlays that package's shipped views, so a withdrawal saved in the copy holds at the anonymous form doors, on both kernels; the direction is pushed unchanged at b7a2a8f547. OQ1 A: hydrateExpandedViewItems (protocol.ts:18878-18891) no longer registers, under the bare name, an expansion whose name another package ships (shippedArtifactsOf). This closes the unscoped by-name hole, including the pre-existing no-owner case, which pin (g) covers. The ruling's condition was measured before opening the PR. The by-name read naming no package answers everywhere: never an absence, at base, at the direction and at head, on both kernels and in both registry orders. The hydration line leaves that read unchanged; pin (h) covers it. One difference from the condition's wording is open in OQ1 below. OQ2 A: a minor changeset with 'Clause-②: no (narrowing)', a BREAKING line naming the three save-door shapes with their remedy, and the ADR-0087 not-required (no-migration-prescription) marker, which says no census of the writers of such copies was taken. The commit carrying it is 'fix(metadata-protocol)!:', and so is the PR title.",
  "H1": "CONFIRMED (unchanged from round 1). At base aa09db58c9, protocol.ts:18566-18569 took expandUnderOwnName (:18669) whenever isAnotherPackagesObject (:18641) held, naming members OBJECT.CONTAINER.KEY. The loaders name a shipped container's members OBJECT.KEY for the shipping package, whichever package owns the object (objectql/src/engine.ts:7159-7165, metadata/src/plugin.ts:1198-1210). 'The copying package ships this container' is read through the one existing lookup, now the helper shippedViewContainerOf (head :18641), which overlaidShippedContainerViewNames shares. The object binding is read by runtimeViewContainerObject (head :18627), the base chain extracted unchanged.",
  "H2": "PARTLY FALSIFIED in round 1, resolved by the ruling's OQ1 A. The copying package's slot needed nothing beyond #21967's keying: the list's servedViewExpansion and resolveRowlessExpandedView both serve the copy there. The other package's by-name read on an unscoped kernel needed the hydration line. hydrateExpandedViewItems registered every expansion under the bare name, and getMetaItem's registry fall-through (SchemaRegistry.getItem, objectql/src/registry.ts:3957) answers the bare key first. With the line, pin (f)'s 3 unscoped owner reads and pin (g)'s 6 unscoped cases are green.",
  "H3": "UNCHANGED from round 1. The save door narrows in three shapes, each accepted on base and refused on head with VALIDATION_ERROR/400 on both kernels: (a) an added bare list whose loader name only the other package ships; (b) an added keyed member whose loader name only the other package ships; (c) a sibling stored container under another row name already expanding the name, reachable only by install order. Unchanged: (d) the package's own view item row. (e) A package-less copy resolved by registry order now takes the loaders' names in both orders. The collision predicate is not edited.",
  "condition": "MEASURED; the stop criterion (an absence) did not fire. Measured through getMetaItem with no packageId, on both kernels and in both registry orders, for each of the 3 members, with the object owned by the other package or by none. Three points: base aa09db58c9 (blob 177e9170), the direction b7a2a8f547 (blob 269a8e6b) and head 2322b5bb04 (blob 400cd431). Each was a trap-guarded swap of protocol.ts, with the restore proven by blob equality for both swapped files and an empty git diff HEAD. Results: 24 cells per point, 72 reads, every one answers an item. The hydration line leaves this read unchanged: the direction's 24 rows equal head's 24 rows on both kernels. The answer is not owner-stable, and it was not at base either. At base it answered whichever package registered first (with the owner first, the owner's shipped item; with the copying package first, that package's shipped item). From the direction on it answers the copy's body, the last expansion of the name (servedViewExpansion naming no package). When the other package registered first, that answer carries the other package's _packageId: getMetaItem :10431 grafts lookupArtifactItem(type, name) with no package. On base the same mislabel already happens in the no-owner case, e.g. 'no-pkg after copy: Intake (pkg_b copy) [pkg_a]'. Pin (h) asserts what the ruling guards: an answer on both kernels, the same body on both, and a body the env-wide list serves under the name. It deliberately does not pin which package's body or stamp. Census of the hydrated bare entry's readers outside metadata-protocol, at the merged head: no non-test file calls getItem, listItems or getArtifactItem on view directly; MetadataManager.getViewsByObject reads its own loader store; the objectql facade's generic get and list are getMetaItem's step 2, after step 1b has answered the expansion from its row.",
  "placement_table": [
    "(f), 18 placements x 2 kernels. Owner = the copying package, shipped or not; owner = none, shipped or not: the copy is served under OBJECT.KEY (task.default, task.intake_form, task.form). Green at base and at head.",
    "Owner = another package, not shipped: the own-name arm, OBJECT.CONTAINER.KEY (task.task, task.task.intake_form, task.task.form). Green at base and at head.",
    "Owner = another package, shipped by the copying package: OBJECT.KEY. Red at base (10 cases); at the direction, 3 unscoped owner by-name reads red; at head all green on both kernels.",
    "(g), 3 members x 2 copying packages x 2 kernels = 12 cases: two packages ship container task, one stores a copy, and the by-name read naming each package answers its own item. Green at head; the 6 unscoped cases are red with the hydration line taken out.",
    "(h), 3 members x 2 owners (the other package, none) x 2 registry orders = 12 cases, each over both kernels: the no-package by-name read answers, with the same body on both kernels, a body the list serves. Green at head and with the hydration line taken out.",
    "Pin file totals at head: 171 cases, all green."
  ],
  "tests": "Head ca60b61d7b (merged origin/main at 803764a36f). Full @objectstack/metadata-protocol suite under os-verify-lock, VERDICT command-exit 0: 218 files passed, 3 skipped; 28127 tests passed, 19 skipped. Pin file: 171/171. Typecheck: pnpm --filter @objectstack/metadata-protocol typecheck exits 0 (exit captured before any pipe); the pin file is in the program (--listFiles hit in round 1, same tsconfig). REVERSE VERIFICATION on committed head ca60b61d7b through scripts/ablation-replace.mjs, predictions written into the driver scripts first. Each anchor hit once and the blob changed on disk; each restore was proven: blob == HEAD 400cd431ef84, git diff HEAD empty, git status clean. (1) The hydration line taken out (anchor 'if (anotherShips) continue;', blob 400cd431ef84 -> cb58d51e1385): predicted 9 red / 162 green, measured 9 / 162. The reds: (f)'s 3 unscoped owner reads and (g)'s 6 unscoped cases; (h) green, as the condition measurement predicted. (2) The own-name arm restored for the copy (anchor '&& !this.copiesOwnShippedViewContainer(...)', blob -> 1074fe2c933b): predicted 10 red / 161 green, measured 10 / 161, all in the shipped-on-another-package's-object placements. The subject is imported from source (./protocol.js), so there is no dist leg. The round-1 measurements (base reading 10 red / 51 green, H3 probes) stand as reported in 6018023897.",
  "gates": "At head ca60b61d7b. node scripts/pm/dispatch-gates.mjs --commands (no paths, --repo objectstack-ai/objectstack) derived 64 commands from 3 paths (the changeset, the pin file, protocol.ts); all 64 exit 0. --ran with exit-coded lines reads '64 derived, 64 run, 0 NOT-MEASURED, 0 UNRUN (a DERIVED zero)'. Three first answered PREREQUISITE NOT MET (exit 3, unbuilt workspace): check:dual-build-cjs-loads, check:lean-entry-closure and check:published-readme-exports. check:type-check-debt ran under the lock (VERDICT command-exit 0, 339s) and built the workspace, and all three reran green. The artifact-roster block outside the total (54 commands, 37 verdict + 17 self-test) is 54 exit 0. check-closing-target-claim, check-single-claim-paths and check-partof-closing-keyword were run with PR #22023's context after it opened. The ADR-0087 gate shows 1 declared-breaking changeset with its not-required (no-migration-prescription) disposition. The no-major gate finds no major. The 4 symbol-anchor sweeps (check:adr-symbol-anchors, check:scripts-symbol-anchors, check:spec-docblock-symbol-anchors, check:adr-anchors) are green. LINT, narrowed with all three proofs: (1) the population is read from eslint.config.mjs: its TS glob covers both .ts files, and no files glob matches .md; (2) eslint --no-inline-config --format json counts 2 files, 0 errors, 0 warnings; (3) invariance: no parserOptions.project or projectService, and the config's only disk reads are scripts/slot-lookup-baseline.json and scripts/query-options-erasure-baseline.json, neither touched, so the diff cannot move an untouched file's verdict. Control bytes: grep -P over the 3 paths gives 0 lines; check:nul-bytes is green. origin/main moved by one commit after the merge (1fb274e61c, #22001, which also edits protocol.ts); git merge-tree --write-tree HEAD origin/main is clean (exit 0), and protocol.ts carries no custom merge driver. It is not re-merged; CI runs on the merge ref. CI is not awaited.",
  "line_budget": "n/a",
  "deviations": [
    "The ruling's condition says the no-package read 'answers the owning package's shipped item before the change and still answers it after'. Measured: it never answers nothing (the stop criterion), and the hydration line does not change it. But it was not owner-stable at base (registry order decided), and from the direction on it answers the copy's body. Pin (h) asserts the guarded half (an answer, the same on both kernels, a body the list serves), not the owner. The PR was opened because the stated stop criterion did not fire; the difference is OQ1 for the seat before merge.",
    "Block (h) and block (g) live inside block (f), so they reuse its harness. The no-package read pin derives its placement from PLACEMENTS rather than restating it.",
    "origin/main moved by one commit after the merge commit. It merges cleanly and is not re-merged, so the gate union stands on ca60b61d7b.",
    "A gate run was moved to the background by the foreground cap (check:type-check-debt under the lock). It was waited on in the foreground with tail --pid and read from its own log within this turn.",
    "Attribution: commits carry AGENTS.md's model-free trailer pair, and the PR body ends with AGENTS.md's session-URL footer, not the harness reminder's model-named forms. AGENTS.md takes precedence, and the pre-push hook refuses a model id."
  ],
  "files_changed": [
    "packages/metadata-protocol/src/protocol.ts (+104/-10 vs main): copiesOwnShippedViewContainer, shippedViewContainerOf (shared with overlaidShippedContainerViewNames), runtimeViewContainerObject (extracted unchanged), the expandRuntimeViewContainer arm, the hydrateExpandedViewItems line, and docblocks",
    "packages/metadata-protocol/src/protocol.org-scoped-write-refused.test.ts (+239/-0): blocks (f), (g) and (h)",
    ".changeset/21980-copy-overlays-shipped-names.md (+27/-0, new): @objectstack/metadata-protocol minor"
  ],
  "clause_2": "no (narrowing), as revised in the claim. Declarations: dist/index.d.ts and dist/index.d.cts were built from origin/main's protocol.ts (blob 177e9170, trap-guarded swap, restore proven) and from head ca60b61d7b, then diffed (11544 -> 11609 lines). The non-comment difference is exactly three untyped private member lines on ObjectStackProtocolImplementation: private runtimeViewContainerObject; private shippedViewContainerOf; private copiesOwnShippedViewContainer. No exported signature moves. Accept set: the save door now refuses three shapes it accepted (H3 a, b, c); that is the narrowing arm, carried in the changeset and on line 2 of the PR body.",
  "mcp_calls": "0",
  "api_writes": "3 relay strokes this round, each one POST /repos/objectstack-ai/objectstack/dispatches executed by fleet-write.yml as objectstack-fleet[bot]: (1) pr_create, executed as POST /repos/objectstack-ai/objectstack/pulls: PR #22023, draft, run 37502124560, 9708 bytes sent and stored identical, read back; (2) label-write assignee, executed as POST /repos/objectstack-ai/objectstack/issues/22023/assignees: run 37502244926, read back assignee os-project-manager; no label written, and size/m was added by another actor; (3) this os-dev-report comment, executed as POST /repos/objectstack-ai/objectstack/issues/21980/comments. Plus git push (not REST): 3 fast-forward pushes this round (2322b5bb04; 7a799e8c7e + bcd4915012; the merge ca60b61d7b). No pushed commit was amended. Round 1 wrote 1 comment (6018023897) and 3 pushes.",
  "open_questions": [
    {
      "question": "OQ1 (before merge, for the seat). The ruling's condition expects the no-package by-name read to answer 'the owning package's shipped item before the change and still after'. Measured: it never answers nothing, and the hydration line leaves it unchanged. But for a name two packages ship it was never owner-stable: at base, registry order decided. From the direction on it answers the copy's body (servedViewExpansion naming no package, #21967's rule), and when the other package registered first that answer wears the other package's _packageId (getMetaItem :10431). Is that acceptable for merge, with the stamp filed as its own card?",
      "options": [
        "A: merge as is, and file the no-package envelope graft as its own card (class a, the by-name provenance family). Business need: the p2 withdrawal fix lands on the last 17.x list. Long-term: the graft predates this card (the no-owner case on base) and needs its own by-name read change. AI-error: an AI reading a no-package by-name answer can be told the wrong package until that card lands. Startup focus: no extra scope here.",
        "B: hold the merge until the graft is closed, by a by-name read change that grafts the served expansion's own package's artifact. Business need: delays a p2 security fix. Long-term: the same end state. Startup focus: widens this card past the ruling's scope."
      ],
      "recommendation": "A. The ruling's stop criterion is an absence, and none was measured. The hydration line, the ruling's subject, is neutral for this read. The owner-instability and the stamp predate the direction (base: registry order, and the no-owner graft), so they belong to the by-name read's own card, not to this family's closing card."
    }
  ],
  "out_of_scope_findings": [
    "class: a · reach: in-process getMetaItem with no packageId (the method GET /api/v1/meta/view/NAME calls when no package is named), measured on both kernels at base aa09db58c9 and at head; not over HTTP. Evidence: two packages ship container task (no code package owns the object) and pkg_b stores a copy. With pkg_a registered first, getMetaItem with no package answers 'Intake (pkg_b copy)' carrying _packageId pkg_a, on base and on head, on both kernels. From this PR on, the same happens when pkg_a owns the object. Mechanism: getMetaItem :10431 merges lookupArtifactItem(type, name) with no package (the first composite, the first-registered package) over the body step 1b served (the last expansion, servedViewExpansion naming none). Family: by-name read provenance (the envelope a served item wears). It is not this withdrawal-reach family, so it is not folded here. Dedupe words: by-name read naming no package grafts first registered package envelope onto another package's expansion · getMetaItem no packageId _packageId mislabel view expansion · lookupArtifactItem without package wrong provenance served view",
    "carrier: none · noted, not filed (PR Acceptance notes). The loaders keep isDefault on the default list of a container a package ships on another package's object, while that package's stored copy of it declares no default (the seat's earlier answer, kept). Read only, not measured on a door."
  ]
}

    Generated by Claude Code

  9. objectstack-fleet commented on Oct 6, 2026

    @objectstack-fleet
    objectstack-fleetBot
    on Oct 6, 2026
    ContributorAuthor

    Merge condition measured: no absence, but the no-package answer is not the owner's. Confirmation requested before landing PR #22023 · pm:retriage

    domain:engine#1 · session_017ErfyP2Rx7XWHJA27QjyUi · 2026-10-06T17:22Z. The dev's report is 6021602255. PR #22023 is a draft at ca60b61d7b (Fixes #21980, Clause-②: no (narrowing)). ⛔ The claim (6016913296) and pm:dispatched stay. The seat does not land the PR until this is answered.

    The ruling's condition (6020226416, verbatim): "On an unscoped kernel, for a name two packages share, a by-name read with NO package named must answer the owning package's shipped item after the change as it does before, never an absence. … If the read turns into an absence, A stops and the order is C."

    What the dev measured. The read is getMetaItem with no packageId, on both kernels and in both registry orders, for each of the 3 members, with the object owned by the other package or by none. That is 24 cells at each of three points: base aa09db58c9, the direction b7a2a8f547, and head ca60b61d7b.

    The seat's read.

    Asked (director and triage, for the maintainer):

    Meanwhile the seat takes the PR's CI and its landing readings, so that A lands without a further round.

    Generated by Claude Code

  10. objectstack-fleet
    added
    pm:retriageQuestion for triage, answered each fire; coexists with the standing pm:* label; no dispatch
    on Oct 6, 2026

  11. objectstack-fleet commented on Oct 6, 2026

    @objectstack-fleet
    objectstack-fleetBot
    on Oct 6, 2026
    ContributorAuthor

    Triage: the seat's question about the merge condition goes to the box as decision card #22027. The claim stands, and pm:retriage is removed while the question is open

    Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-06T17:53Z. ⛔ Not a claim, ⛔ not a dispatch. Classes, positions and functions only.

    Labels: pm:retriage is removed. pm:dispatched and the claim stay.

  12. objectstack-fleet
    removed
    pm:retriageQuestion for triage, answered each fire; coexists with the standing pm:* label; no dispatch
    on Oct 6, 2026

  13. objectstack-fleet commented on Oct 7, 2026

    @objectstack-fleet
    objectstack-fleetBot
    on Oct 7, 2026
    ContributorAuthor

    Ruling pointer: batch #283 item 2 (decision card #22027) · A · maintainer 「其他同意」 2026-10-07T01:26Z

    Director seat, summon #35, session_01VYToj6PQehTEKNrjGM9akg (via the relay). The record is 6028832449 on #22027, which is closed; this card's claim and pm:dispatched stand. Thread-read: 6022209890.

    Generated by Claude Code

  14. objectstack-fleet
    closed this as completedin #22023on Oct 7, 2026

  15. objectstack-fleet commented on Oct 7, 2026

    @objectstack-fleet
    objectstack-fleetBot
    on Oct 7, 2026
    ContributorAuthor

    Landed: PR #22023 → 8caa131e52 on main. It merged through the merge queue at 2026-10-07T01:57Z, after entering the queue at 2026-10-07T01:34Z. Verified at 2026-10-07T01:57Z. domain:engine#1 · session_017ErfyP2Rx7XWHJA27QjyUi.

    Generated by Claude Code

  16. objectstack-fleet
    removed
    pm:dispatched
    on Oct 7, 2026
  17. akarma-synetal
    added 3 commits that reference this issue on Oct 7, 2026

    fix(metadata-protocol)!: a package's stored copy of a container it sh…

    8caa131

    fix(metadata-protocol): a by-name read naming no package wears the en…

    2015c54

    fix(metadata-protocol): a row bound to one package is not registered …

    ae97841
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

area:accessPermissions that actually hold — RLS/FLS, sharing model, write-path guardsbugSomething isn't workingdomain:enginepriority:p2Medium: important, M3security

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions