metadata-protocol: the per-package layer stamps another package's row under a base item name with the base's _packageId (export and form withdrawal layer name the wrong author)

domain:server#2 · os-project-manager · session_0186vfjHHMsRXC9EUT9hTFMo

Filing gate: ① a pre-existing defect read by the PR #28828 contract review (record 6564969561, side reading), found by the #28802 dev in a control. Filed by domain:server seat 2. ⛔ Not a claim. Graded by this seat p3 under 「定级你可以自己决定」 (Leehom, 2026-11-01): a provenance mislabel on two internal readers, reachable only by legacy stored rows.

Reach: the package export and the anonymous form doors' withdrawal layer, for a row another package stored under a base package's item name (only legacy rows: such rows are refused at publish since the #28364 / PR #28777 family).

What happens (read on main at PR #28828's head; not yet measured through a door)

The per-package layer (getMetaItemsPerPackage) seats each stored row under its own package, then the list's envelope graft (finding(metadata-protocol): getMetaItem naming no package grafts the first-registered package's artifact envelope onto another package's served view expansion, so a no-package by-name read can carry the wrong _packageId #22024) looks up the item's artifact for that package.
When that package ships no artifact of the name, the artifact lookup falls back to the first code package that does (registry.getArtifactItem), so the graft stamps the row with the base's _packageId.
Seen in PR fix(metadata-protocol)!: an email template locale added in a .custom pair is listed and sent on the base's address; a dependent's added locale stays under its own package (#28802) #28828's view control: the base's view, a pair row and a dependent row under the same name all read _packageId = the base.
Readers: packages/rest/src/form-routes.ts (form withdrawal layer, views) and packages/runtime/src/domains/packages.ts (package export, a provenance carrier per ADR-0146 D8 item 3).

Wanted

The graft never takes another package's provenance for a row. A row reads its own package on the per-package layer, unless it is a declared override, which keeps today's stamp.
Measure first: a census of stored rows that reach this (as the metadata-protocol: an email-template override of an unshipped locale stored before PR #28777 is served under the base's package id (#28746 follow-up) #28780 evidence did), and whether the pair's own scoped export is affected.
Pin: a per-package-layer case asserting _packageId per row, beside PR fix(metadata-protocol)!: an email template locale added in a .custom pair is listed and sent on the base's address; a dependent's added locale stays under its own package (#28802) #28828's view control.

Dedupe: searched getArtifactItem fallback _packageId, per-package layer provenance; #22024 is the original scoping this defeats. New.

Links back: PR #28828 (record 6564969561), #28802, #22024, ADR-0146 D8/D11.

Generated by Claude Code

domain:server#1 · os-project-manager · session_01R1q2xdtYgU6FKrZ7LgjPCC

Claim: PM loop round 1 · card thread · 2026-11-01T23:13Z
Session: session_01R1q2xdtYgU6FKrZ7LgjPCC (the seat); the card thread is session_01FEkQ5mTYb1BTJNRqf3bdJ8 (the #28735 / #28776 card thread, continuing)
Account: os-project-manager (the seat's linked user; the card's assignee)
Branch: claude/project-thread-xqgh8b (the card thread's harness-pinned branch, restarted from main after PR #28808; it names no issue, so this claim is the identity record)
Worktree: the card thread's own container checkout
Domain: domain:server
Seat: domain:server#1
Ruling-ref: 「定级你可以自己决定」 (Leehom, 2026-11-01T12:11Z); seat 2 filed and graded the card p3. Seat 1 asked seat 2 before claiming; seat 2 keeps #28830.
File surface: the #22024 envelope graft on the per-package layer (getMetaItemsPerPackage, packages/metadata-protocol/src/protocol.ts) and, if needed, an opt-in strict mode on the artifact lookup (protocol-artifact-lookup.ts) with today's default kept; tests in metadata-protocol, runtime (export) and rest (form withdrawal layer); a patch changeset. ⛔ No packages/spec/**, no change to registry.getArtifactItem's fallback for its other callers.
Container & model: S, mode:thread, model and effort as the thread was opened
Clause-②: no (expected: a provenance stamp on an internal layer; the dev measures whether a public door's served answer changes)
Metadata-protocol: none (expected)
Responsibility: the code is the per-package layer of @objectstack/metadata-protocol · the platform path is a row stamped with another package's _packageId · reached by package export and the anonymous form doors' withdrawal layer, for legacy rows another package stored under a base item's name
Thread-read: none
Premise: holds on main, read by the PR #28828 contract review (record 6564969561); step 1 of the order measures it through the doors
Serial constraints cleared: seat 2's #28830 edits the layered read in protocol.ts, not the per-package graft; whichever lands second merges origin/main once and keeps both sides.
Resume-from: none — fresh from origin/main

State: pm:queue → pm:dispatched, assigned to os-project-manager, recorded by this claim.

Generated by Claude Code

domain:server#1 · os-project-manager · session_01FEkQ5mTYb1BTJNRqf3bdJ8

os-dev-report
{
"issue": 28831,
"status": "done",
"branch": "claude/project-thread-xqgh8b",
"pr": "#28857",
"session": "session_01FEkQ5mTYb1BTJNRqf3bdJ8",
"premise_still_valid": true,
"summary": "On the per-package layer (getMetaItemsPerPackage), the #22024 envelope graft now keeps a looked-up artifact only when it is the item's own package's (perPackageLayerEnvelope in protocol.ts); otherwise the row wears no artifact envelope and keeps its own binding. A .custom pair's declared override keeps the base's stamp, judged by isServedOverrideRowOf on the row's package_id at the item's bundle member. registry.getArtifactItem and lookupArtifactItem are unchanged for every other caller, and the new call sits inside layer === 'per-package' only. Step 1 (pm-orders/server/28831-step1-measurement.md): fresh CRM and showcase boots 0 rows, packages/qa seed sites 0 rows; through the real doors the export drops every _ key and the form withdrawal judgement matches by name, so no reader depends on the base's stamp and no public door's answer moves (Clause-②: no, Metadata-protocol: none, patch changeset).",
"tests": "New packages/objectql/src/protocol-per-package-layer-provenance.test.ts, 4 tests (real protocol, real ObjectQL, in-memory driver; #28828's harness), asserting [columns, _packageId, _packageVersion, _provenance] row by row: unscoped layer (the withdrawal layer's read) base/dependent/undeclared pair; declared-override control; scoped layer per package (the export's read); scoped declared-override control. Base (protocol.ts from 1920e48, rebuilt): Tests 2 failed | 2 passed (4), the dependent and pair rows read com.example.showcase · 1.0.0 · package; head 4/4. Ablation via ablation-replace.mjs (condition guarded by globalThis.ABLATE_28831, blob 17bb3db36eed -> 393a0475ef93, rebuilt): 2 failed, the same two; restored blob == HEAD, git diff HEAD empty. Suites at c7b62f4 after a full build (118/118): metadata-protocol 22093 passed | 26 skipped; objectql 10015 passed; rest 6920 passed | 332 skipped; runtime 8252 passed | 19 skipped; all lock VERDICT command-exit 0. Typecheck metadata-protocol + objectql exit 0; eslint --no-inline-config on the touched files exit 0; repo lint command scoped to packages/metadata-protocol and packages/objectql exit 0. The form leg is not pinned at the door: the door reaches the layer (a dependent's withdrawal closes /forms/contact-us 200 -> 404) but reads no stamp, so a door assertion cannot be red on base.",
"gates": "dispatch-gates --commands derived 62 at c7b62f4; all 62 exit 0 (record pm-orders/server/28831-gates-ran.txt); --ran: 62 derived, 62 run, 0 NOT-MEASURED, 0 UNRUN; check:type-check-debt OK with --re-measure OK. CI families: see PR #28857's check-runs.",
"dogfood_battery": "n/a by the template (no ! and no narrowing arm), run anyway: c7b62f4 · os-verify-lock VERDICT command-exit 1 · Test Files 4 failed | 376 passed | 3 skipped (383) · Tests 4 failed | 3123 passed | 28 skipped (3155). The 4 are main's: audit-key-material, audit-mail-bodies, identity-mail-read-gate, upgrade-18x-harness (the 18.0 upgrade-harness files). Same 4 red re-run alone on head, and re-run with protocol.ts from origin/main rebuilt; main's push run 41366661242 at 7f4cbc9 has every Dogfood Regression Gate shard red (identity-mail-read-gate named in shard 2's log). Green at the pre-merge base 1920e48 during the census run (3121 passed, 0 failed).",
"mcp_calls": "9 — read only: issue_read x2 (#28831, its comments), pull_request_read x3 (#28828 get_files, #28828 get, #28808 get_files), actions_list x2 (ci.yml main runs, run 41366661242 jobs), get_job_logs x2 (job 125028259405). No write tool.",
"api_writes": "3 — git push (claude/project-thread-xqgh8b to c7b62f4, plain), relay pr_create (#28857, draft, no assignees, no labels: a changeset is present), and this os-dev-report comment through post-stamped.",
"open_questions": [],
"out_of_scope_findings": [
"class: a · reach: main's Dogfood Regression Gate red since at least 7f4cbc9, 4 upgrade-harness files (audit-key-material, audit-mail-bodies, identity-mail-read-gate, upgrade-18x-harness) · evidence: CI run 41366661242, local re-run with main's protocol.ts · dedupe words: 18.0 database dogfood red, upgrade-18x-harness · carrier: seat 1 · noted, not filed"
]
}

Generated by Claude Code

domain:server#1 · os-project-manager · session_01R1q2xdtYgU6FKrZ7LgjPCC

Landing record · #28831 · PR #28857

PR #28857 merged by the merge queue as 69c9f7c61a on main (Fixes #28831; Clause-②: no, with no contract review owed; ACCEPT 6567232456). The card closed on the merge.

Reading	Probe	Result
Queue membership	`git ls-remote origin 'refs/heads/gh-readonly-queue/main/pr-28857-*'`	0 refs
`origin/main` by content	`git diff --quiet 69c9f7c61a origin/main --` the PR's 3 files	all 3 identical
Ancestry	`git merge-base --is-ancestor 69c9f7c61a origin/main`	holds

Landed: on the per-package layer, a row bound to a package wears its own package's artifact envelope or none, never the base's by the lookup's fallback. A declared served override keeps the base's envelope. The shared lookup and the effective read are unchanged. @objectstack/metadata-protocol patch, Metadata-protocol: none.

Release: branch claude/project-thread-xqgh8b merged; nothing unpushed. pm:dispatched removed and the card unassigned.

Generated by Claude Code

Navigation Menu

Repository navigation

metadata-protocol: the per-package layer stamps another package's row under a base item name with the base's `_packageId` (export and form withdrawal layer name the wrong author) #28831

What happens (read on main at PR #28828's head; not yet measured through a door)

Wanted

Landing record · #28831 · PR #28857

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

metadata-protocol: the per-package layer stamps another package's row under a base item name with the base's _packageId (export and form withdrawal layer name the wrong author) #28831

Description

What happens (read on main at PR #28828's head; not yet measured through a door)

Wanted

Activity

objectstack-fleet commented on Nov 1, 2026

objectstack-fleet commented on Nov 2, 2026

objectstack-fleet commented on Nov 2, 2026

Landing record · #28831 · PR #28857

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

metadata-protocol: the per-package layer stamps another package's row under a base item name with the base's `_packageId` (export and form withdrawal layer name the wrong author) #28831