Repository navigation
metadata-protocol: the boot's metadata_sealed_overlay_unserved line counts a served .custom flow override and tells the operator to delete it #28771
Description
domain:server#1 · os-project-manager · session_01R1q2xdtYgU6FKrZ7LgjPCC
Filing gate: ① class (a) out-of-scope finding from the #28717 dev (os-dev-report 6562183858, out_of_scope_findings[0], carrier: none). Filed by domain:server seat 1. ⛔ Not a claim.
Reach: every loadMetaFromDb boot of a store that holds a declared <base>.custom flow override. Since #28412 (PR #28693), that row is served and armed in place of the base's flow.
What happens
The boot prints [Protocol] [metadata_sealed_overlay_unserved] (reportSealedOverlayRows, packages/metadata-protocol/src/protocol-sealed-overlay-report.ts, called from protocol.ts around L29500). It counts the declared override row alongside a legacy package-less row: "flow×2 … No read serves them — the package's own definition is served … re-express it as a new item under a new name … then delete the stored row". The override IS served, so this line tells the operator to delete the live customization. That is a destructive remedy aimed at a working row. It was measured in packages/services/service-automation/.../flow-declared-override-first-boot-pull.integration.test.ts (PR #28770).
Wanted
- The sealed-overlay census stops counting a row that the served-override rule serves. The judgement is the existing
isServedOverrideRowOfon the row's column binding (storedRowBindingOf/package_id), never a body_packageId. ⛔ No second predicate. - A truly unserved row, such as the legacy package-less row service-automation: at boot a package-less flow row can take the bare slot of a shipped flow name over its declared <base>.custom override until kernel:ready re-arms #28717 leaves shadowed, is still reported with its remedies.
- Tests: a boot holding only the declared override prints no
metadata_sealed_overlay_unservedline for it. A boot holding the override plus a legacy row reports the legacy row alone (count 1). Ablation.
Triage: p2 · bug · domain:server
Ruling-ref: the maintainer's 「定级你可以自己决定」 (2026-11-01). Graded p2 rather than p3 because the line prescribes deleting a live, armed customization. An operator who follows it silently reverts the tenant to the base flow. Nothing is wrong on the wire, so it is not p1.
Declarations expected: Clause-②: no (a log line only; no served value changes), Metadata-protocol: none, @objectstack/metadata-protocol patch.
Dedupe: searched metadata_sealed_overlay_unserved, sealed overlay unserved declared override; nothing open.
Links back: #28717, PR #28770, #28412, PR #28693, ADR-0131 D6, ADR-0146 D2
Generated by Claude Code
Activity
objectstack-fleet commentedon Nov 1, 2026
domain:server#1 · os-project-manager · session_01R1q2xdtYgU6FKrZ7LgjPCC
Claim: PM loop round 1 · card thread · 2026-11-01T19:54Z
Session:
session_01R1q2xdtYgU6FKrZ7LgjPCC(the seat); the card thread issession_01FEkQ5oTRCUNQ4EA3YV84sZ(the #28412 / #28717 card thread, continuing)Account:
os-project-manager(the seat's linked user; the card's assignee)Branch:
claude/project-thread-jqgfyc(the card thread's harness-pinned branch, restarted frommainafter PR #28770; it names no issue, so this claim is the identity record)Worktree: the card thread's own container checkout
Domain:
domain:serverSeat:
domain:server#1Ruling-ref: 「定级你可以自己决定」 (Leehom, 2026-11-01T12:11Z); seat 1 filed and graded the card p2 from #28717's out-of-scope finding.
File surface: the sealed-overlay census in
packages/metadata-protocol/src/protocol.ts(the row set handed toreportSealedOverlayRows) andprotocol-sealed-overlay-report.ts, their tests, and apatchchangeset. ⛔ Nopackages/spec/**, no change to which row is served or armed.Container & model:
S,mode:thread, model and effort as the thread was openedClause-②: no (expected: a boot log line only; the dev measures it, and a new export reads yes (widening))
Metadata-protocol: none (expected)
Responsibility: the code is the boot census of
@objectstack/metadata-protocol· the platform path is a served.customflow override counted as unserved · reached by everyloadMetaFromDbboot of a store holding oneThread-read: none
Premise: holds; #28412 (PR #28693) and #28717 (PR #28770,
8f294e04b3) are onmainSerial constraints cleared: #28776 (seat 1) edits
reassignOrphanedMetadata. #28574 (seat 1) edits the save and publish doors. Seat 5's #28576 editspackagelessAddress/refusePackagedBaseOverride. All are outside this surface. Mergeorigin/mainonce if one lands first.Resume-from: none — fresh from
origin/mainState:
pm:queue→pm:dispatched, assigned toos-project-manager, recorded by this claim.Generated by Claude Code
objectstack-fleet commentedon Nov 1, 2026
domain:server#1 · os-project-manager · session_01R1q2xdtYgU6FKrZ7LgjPCC
os-dev-report
{
"issue": 28771,
"status": "done",
"branch": "claude/project-thread-jqgfyc",
"pr": "#28801",
"session": "session_01FEkQ5oTRCUNQ4EA3YV84sZ",
"premise_still_valid": true,
"summary": "loadMetaFromDb in metadata-protocol protocol.ts no longer adds a row to the sealed-overlay census (the rows handed to reportSealedOverlayRows, behind [metadata_sealed_overlay_unserved]) when the one served-override predicate admits it. The check is isServedOverrideRowOf(record, packagedArtifactOwner(type, name)), on the row package_id column, never a body _packageId. So a declared BASE.custom flow override, served and armed since #28412, is no longer told to be deleted. Every unserved row is still reported with both remedies, including the legacy package-less row #28717 leaves shadowed, and the count drops by exactly the served rows. Only the census push is conditioned: the object skip, hydration, and what is served or armed are unchanged. No new export, so Clause-② is no. Metadata-protocol none, patch changeset. The branch was restarted from origin/main d9c4cdc and plain-pushed (the remote branch had been deleted on the #28770 merge).",
"tests": "New: 7 cases in metadata-protocol protocol.reads-environment-only.test.ts section 3 (env-kernel harness, loadMetaFromDb, packaged flow artifact): override-only prints no sealed line; override plus legacy reports the legacy row alone (1 row, flow×1, both remedies); controls still reported (legacy alone, the pair undeclared row, a dependent package declaration, a package-less row stamping the pair and declaring). Red first with protocol.ts restored to main d9c4cdc (suite imports source, no dist step): Tests 2 failed | 25 passed (27). The override-only case printed "flow×1 (managed_flow) … delete the stored row"; the override-plus-legacy case counted "2 … flow×2". Restore: git checkout HEAD, blob == HEAD, git diff HEAD empty. Ablation via ablation-replace.mjs: the exclusion made always false (anchor hit, 1 marker on disk) gave the same 2 red, Tests 2 failed | 25 passed. Restore: ok restored, blob == HEAD, git diff HEAD empty, marker 0, porcelain empty. Head c3a0c54: the file 27/27; metadata-protocol full suite Test Files 295 passed | 4 skipped, Tests 22065 passed | 26 skipped; service-automation full suite Test Files 254 passed, Tests 3269 passed (both under the verify lock, VERDICT command-exit 0).",
"gates": "dispatch-gates --commands --repo objectstack-ai/objectstack on c3a0c54: 61 families, each run with its exit captured before any pipe, all exit 0. --ran: 61 derived, 61 run, 0 NOT-MEASURED, 0 UNRUN. tsc --noEmit for metadata-protocol exit 0; eslint --no-inline-config packages/metadata-protocol exit 0; check-nul-bytes exit 0. CI on PR #28801 was not awaited.",
"dogfood_battery": "n/a, no ! in the PR title and no (narrowing) arm (Clause-②: no)",
"mcp_calls": "2 — mcp__github__issue_read x2 (get #28771, get_comments #28771); no write tool",
"api_writes": "3 — git push of claude/project-thread-jqgfyc (recreated, c3a0c54); relay fleet-write pr_create (run 41348089067, read-back identical, assignees none, no labels named); this os-dev-report via post-stamped.mjs --comment=28771",
"open_questions": [],
"out_of_scope_findings": []
}
Generated by Claude Code
objectstack-fleet commentedon Nov 1, 2026
domain:server#1 · os-project-manager · session_01R1q2xdtYgU6FKrZ7LgjPCC
Landing record · #28771 · PR #28801
PR #28801 merged by the merge queue as
70bf434385onmain(Fixes #28771;Clause-②: no, with no contract review owed; ACCEPT6563836979). The card closed on the merge.git ls-remote origin 'refs/heads/gh-readonly-queue/main/pr-28801-*'origin/mainby contentgit diff --quiet 70bf434385 origin/main --the PR's 3 filesgit merge-base --is-ancestor 70bf434385 origin/mainmetadata_sealed_overlay_unservedcensus no longer counts a row thatisServedOverrideRowOfadmits as the served override of its packaged artifact. What the loop loads, serves or arms is unchanged. Unserved rows, including the legacy row service-automation: at boot a package-less flow row can take the bare slot of a shipped flow name over its declared <base>.custom override until kernel:ready re-arms #28717 leaves shadowed, keep their remedies.@objectstack/metadata-protocolpatch,Metadata-protocol: none.Release: branch
claude/project-thread-jqgfycmerged; nothing unpushed.pm:dispatchedremoved and the card unassigned.Generated by Claude Code