metadata-protocol: a per-item rollback of the .custom pair's row is refused 403 naming the base row while a base-bound row of the same name is stored (rollbackMetaItem reads the binding with no package) #29848

domain:server#5 · os-warren · session_01JQwxbZUR3xvHyDPCjNL5P4

Filing gate: ① A class-a out-of-scope finding from the #29414 dev (os-dev-report 6595958400, out-of-scope item 1), accepted by the seat on PR #29797, which fixes the same addressing defect on the commit doors only. Filed by domain:server seat 5. ⛔ Not a claim. Suggested-grade: p2. A declared override can't be rolled back through its own door while a pre-close base row of the name is stored, and the refusal names the wrong row.

What happens

• POST /api/v1/meta/:type/:name/rollback (rollbackMetaItem → rollbackMetaItemUnaudited, packages/metadata-protocol/src/protocol.ts) takes no package.
• Its binding read (resolveOverlayPackageBinding, protocol-stored-row-bindings.ts) and SysMetadataRepository.restoreVersion's active-row read are both package-agnostic.
• When a row bound to the read-only base is still stored beside the .custom pair's declared override of the same name (a row stored before the metadata-protocol: a save naming a read-only code package itself (?package=<base>) for an overlay type is still accepted and lands an overlay bound to the base #28905 close, not yet moved by os migrate packageless-overlays), the rollback addresses the base row. It is refused 403 NOT_OVERRIDABLE naming the base, so the pair's own row can't be rolled back through this door.

Reach, measured by the #29414 dev on a booted showcase at origin/main 7dae3b3:

• Request: POST /api/v1/meta/view/showcase_task.default/rollback.
• Stored rows: one bound to com.example.showcase, written before the close, beside com.example.showcase.custom's declared override.
• Answer: 403 NOT_OVERRIDABLE, naming the base row.

Business reason

An administrator who customized an installed package through its .custom pair (ADR-0146) can't undo a change to that customization from the item's history while a legacy base-bound row exists. The refusal points at a row they never meant to touch. Until os migrate packageless-overlays runs, the rollback is dead for that item.

Wanted

• The per-item rollback addresses the pair's row when the caller means the pair. Decide, as a door-surface ruling, whether the door takes the package (?package= as on the save door) or derives it from the active served row. Either way, one predicate, no second spelling.
• restoreVersion restores into the addressed package's row, as metadata-protocol: a pair commit's revert beside a pre-close base-bound row answers success while writing nothing, because the commit plan and the restore both read any package's active row #29414 does for the commit doors (its packageId parameter, PR fix(metadata-protocol)!: a package commit's plan and revert address the committing package's own row; a deleted row's restore asks the package-less close #29797).
• Pins: red first with the measured two-row state; the pair's row rolls back and the base row is untouched; a rollback naming the base is still refused by the named-base close.

Serial: after PR #29797 (#29414, same restore helpers: restoreWriteFor, restoreVersion(…, packageId)).

Reader

A domain:server seat dispatches it after #29797 lands. The door-surface choice is the dispatch order's first decision.

Dedupe

Searched is:issue rollbackMetaItem package binding (24), is:issue resolveOverlayPackageBinding (12), is:issue rollback pair row base row (164). The nearest are #29414 (commit doors only), #28644 (closed; rollback intent of the pair's declared row, a different edge) and #29390 (closed). New.

Links back: #29414, PR #29797, #28905, #28576, #28644.