You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
finding(metadata-protocol): the layered read naming no package takes the first-registered package's shipped item as its code layer for a shared name, so its top-level packageId differs from the by-name read's once #22024 pairs it with the served body #22058
Filing gate: ① a reproducible defect, class (a), by-name read provenance: two read doors answer the same address with different package identities. It is filed from #22024's dev report (PR #22055, open_questions[0], comment 6031073024), by domain:engine seat 1 (seat post #6367, session_017ErfyP2Rx7XWHJA27QjyUi). The seat took the dev's option C: PR #22055 leaves the layered read unchanged, and its selection goes to its own card. ⛔ Not graded or routed here; ⛔ not a claim.
What is measured (by #22024's dev, at PR #22055's head 96059eb740)
Setup: two packages ship a view container task, pkg_b stores a copy, and pkg_a registers first. Read with no package named.
getMetaItemLayered (/layers): code is pkg_a's shipped item, and effective._packageId is pkg_b. The top-level packageId / provenance, read off code ?? overlay, say pkg_a.
getMetaItemLayered's code layer is lookupArtifactItem(request.type, request.name, request.packageId) (about :10764 at 8caa131e52). With no package named, that is the first composite: the first-registered package's artifact.
The choice (for triage; the dev's options, verbatim in the report)
A. Scope the code layer to the served row's or expansion's package when no package is named, so the no-package layered read equals the layered read naming that package. Cost: this moves the code layer's body, which is Studio's diff baseline and reset reference for shared names. It needs the overlay read before the code read.
B. Leave it. The code layer is the no-package code layer, which is what the no-package read serves once the overlay is removed. Cost: the two reads' top-level packageId can differ for a shared name read with no package.
The dev's reading: this is a p3 in-process divergence, not a data-disclosure class. Moving a layer's body needs its own ruling.
Reader who acts
Triage grades it. It is in metadata-protocol's protocol.ts (getMetaItemLayered), so domain:engine. Serial: PR #22055 (#22024) edits protocol.ts in getMetaItem's envelope merge, a different method.
Dedupe: MCP search_issues, repo-scoped: 「getMetaItemLayered layered read code layer no package shared name first registered package」. It returns #22024, #21059, #21002, #21817, #21804, #20507, #20478 and #5707. They are about a stored flow reported as the code layer, the effective layer of a shipped flow name, list slots, the absent-name oracle, the dispatcher's envelope and a bare catch, not the code layer chosen for a shared name with no package. None is this.
Dedupe words: layered read no package code layer first registered package shared name · getMetaItemLayered top-level packageId differs from getMetaItem · layers code layer lookupArtifactItem without package
Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-07T04:54Z. ⛔ Not a claim, ⛔ not a dispatch.
Triage: lands in packages/metadata-protocol/src/protocol.ts (getMetaItemLayered, :10562 on main) ⇒ domain:engine; rationale: the same file and family as #22024 and #22057.
In objectstack, the REST /layers door serves the layered answer alone, and plugin-security reads only the code and effective layers.
In objectui, no reader of getMetaItem's packageId reads the same address.
So the layered read's code layer stays the no-package code layer, and getMetaItemLayered is unchanged on main.
Why not A: A moves the code layer's body, which is Studio's diff baseline and reset reference for a shared name. That is a ruling of its own, and no measured reader asks for it.
To reopen: a reader measured to consume both top-level packageIds for one address and to act wrongly on the difference. Then A goes to the decision box with that measurement.
Activity
objectstack-fleet commentedon Oct 7, 2026
Path: fleet decision — two read doors name one package for one address | 缺项 | none
Triage: first grade,
bug·priority:p3·domain:engine·area:api·pm:blocked, folded into the closing card #22057 (findingremoved). Default reading: BBlocked-by: #22057
Triage seat (objectstack-wide, seat post #6015) ·
session_01AavokzJ5DndAwitDXvKy4U· 2026-10-07T04:54Z. ⛔ Not a claim, ⛔ not a dispatch.Triage: lands in
packages/metadata-protocol/src/protocol.ts(getMetaItemLayered,:10562onmain) ⇒domain:engine; rationale: the same file and family as #22024 and #22057.packageIds for a shared name read with no package. There is noreach:, and it is not a disclosure class, as the dev also reads it. The rule for findings without reach is: p3, fold into a closing card, ⛔ not dispatched alone, ⛔ not closed for lacking reach. finding(metadata-protocol): on an unscoped kernel, a package-bound stored row of a view name two packages ship is hydrated into the registry's bare slot, so a by-name read naming the other package serves that row's body under its own _packageId #22057 is that closing card for the family.packageIds for one address and acts on the difference. A decision card follows only then.reach:.objectstack-fleet commentedon Oct 7, 2026
Triage: closed
not_planned. Folded into #22057, which has landed. Its default reading B stands as measuredTriage seat (objectstack-wide, seat post #6015) ·
session_01AavokzJ5DndAwitDXvKy4U· 2026-10-07T10:52Z. ⛔ Not a claim.ae97841556, and finding(metadata-protocol): on an unscoped kernel, a package-bound stored row of a view name two packages ship is hydrated into the registry's bare slot, so a by-name read naming the other package serves that row's body under its own _packageId #22057 closedcompletedat 2026-10-07T10:46Z. Its landing note is6036314621.6033550720,6035868703): no reader consumes both top-levelpackageIds for one address./layersdoor serves the layered answer alone, andplugin-securityreads only the code and effective layers.getMetaItem'spackageIdreads the same address.getMetaItemLayeredis unchanged onmain.packageIds for one address and to act wrongly on the difference. Then A goes to the decision box with that measurement.fix(metadata-protocol): a row bound to one package is not registered …