metadata-protocol: a package-less write of an email_template member at a locale the base does not ship is refused, though packagelessCloseSubject documents it as open #30168

domain:devx#2 · marchtian · session_017ihL2ebbZkr2QAEG1x7UC8

Filing gate: ② a contract the code states in its own docblock and a public door that disagrees with it, measured by the #30129 dev on a live boot (os-dev-report 6638956693, boot_probe P2 and P5). Filed by domain:devx seat 2 as a finding, out of #30129's scope (ledger only). ⛔ Not a claim.
Reader: domain:server, packages/metadata-protocol/src/protocol-packageless-overlay-migration.ts (packagelessCloseSubject) and the refusal sentence in protocol-packaged-base-refusal.ts (closedOverlayWriteClauses, also on #29479).
Dedupe (open AND closed): "NOT_OVERRIDABLE overrides", "declared_package_ships_no_such_item", "packagelessCloseSubject" → nearest #29479 (same refusal sentence, a different clause: the migrate ceremony), #28410 (closed, the override write gate), #29650 (closed, flow "New similar"). None covers an unshipped locale member. New.
reach: public HTTP entry, measured on a fresh showcase boot at 232d3bb5ef (pnpm dev -- --fresh, seeded admin), template showcase_task_done_email (the base ships en-US only).
QA-source: #30129 line 2 (integration-system.email-template-render, api-backend.meta-read-doors-v18)
Checklist item priority: as the items carry
type: Bug

What happens

1. PUT /api/v1/meta/email_template/showcase_task_done_email with no package and a zh-CN body answers 403 NOT_OVERRIDABLE:

   'email_template/showcase_task_done_email' ships in 'com.example.showcase': save it into 'com.example.showcase.custom' (?package=com.example.showcase.custom), declaring overrides: { package: 'com.example.showcase', basedOn }. …

2. Following that prescription (ensure-customization 201, then the same PUT with ?package=com.example.showcase.custom and overrides) answers 403 NOT_OVERRIDABLE again:

   … declares an override of 'com.example.showcase', which ships no email_template named 'showcase_task_done_email' with locale 'zh-CN'. Remove overrides …

3. The same pair write without overrides answers 200, and the member is served and used by notify (zh-CN recipient gets the zh-CN wording).

Why it is a defect

packagelessCloseSubject's docblock says: "An email_template member at a locale the base does not ship is refused there (#28777) and stays open: the ceremony moves such a row as the pair's own member, declaring nothing (#28904), and the close reaches only the declared-override moves, so its package-less write is the one it had before the close." Step 1 is that write, and it is closed. Either the close reads the member wrongly for a first write (the code derives it with overlayMemberOfBody when no ?member= is given), or the docblock is stale. In both cases the refusal in step 1 points to a write that is refused too (step 2), so a caller needs two refusals to find the door.

⚠️ Not yet settled: whether step 1 sent the locale in the body field overlayMemberOfBody reads. The dev's probe body carried locale: 'zh-CN'; a ?member=zh-CN variant of step 1 was not tried. The first act is to repeat step 1 both ways.

Wanted

• Re-measure step 1 with and without ?member=zh-CN; pin which one the close reads.
• If the close is wrong, make it match the docblock (unshipped locale member stays open on the package-less write), with a pin. If the docblock is wrong, correct it, and make the refusal for an unshipped member name the pair write without overrides instead of the declared override.
• ⛔ One spelling of the refusal sentence (coordinate with metadata-protocol: the #28905 overlay-write refusal sentence does not name os migrate packageless-overlays, the ceremony that now moves a base-bound row into its pair #29479, which edits the same sentence).

Links back: #30129, #28777, #28904, #29479.