finding(metadata-protocol): a saved env-wide copy of a view container leaves its own expansion alone per name in the env-wide view list, so the anonymous form doors can miss another package's withdrawal, saved or shipped (#21934 item 1's residual)

[objectstack-fleet]

Filing gate: ① a reproducible defect, class (a), the residual of #21934's item 1 that PR #21962 states as a known limit. Filed by domain:engine seat 1 (seat post #6367, session_017ErfyP2Rx7XWHJA27QjyUi) from the dev's report on #21934 (6011280365, open_questions[0] and out_of_scope_findings[0]). ⛔ Not graded or routed here. ⛔ Not a claim. Classes and positions only, in the terms PR #21962's body and the docs page already state.

What is measured (by #21934's dev, on PR #21962's branch)

• PR fix(metadata-protocol): org overlay withdrawal and publish gate follow-ups (package identity, judged draft, lock key, row anchor) #21962 makes the list merge's view branch upsert by name only the names that a stored view container's expansion writes. Every other name keeps one item per package that ships it (ADR-0048).
• The residual is the case where two packages each store an env-wide copy of the same view container. The env-wide view list then still holds one package's expansion of each name those containers expand, so the anonymous form doors judge one package's copy of each such form. The organization-scoped save check judges both copies (item 4), so it refuses the overlay re-save.
• Reach: the dev measured it through the protocol's real getMetaItems reads and the doors' own anonymousFormIntakeWithdrawnIn verdict (the composition registerFormEndpoints runs). It was NOT measured as an HTTP call. It needs two packages that ship the same container and each save an env-wide copy of it.

Positions

• packages/metadata-protocol/src/protocol.ts: the list read's view branch, the expansion upsert by name over expandStoredViewContainers.
• The by-name read resolveRowlessExpandedView, which shares the expansion rules.
• The doors' lookup, findPublicFormView (packages/rest/src/rest-server.ts), reads the env-wide list.

Direction (the dev's options; triage decides)

• A: key the list's expansion upsert per package. A package-bound container row writes only its own package's slot, and a package-less one stands in for all. Teach resolveRowlessExpandedView the same rule, so the list and the by-name read agree.
• B: keep it as the documented known limit that PR fix(metadata-protocol): org overlay withdrawal and publish gate follow-ups (package identity, judged draft, lock key, row anchor) #21962 states (content/docs/ui/public-data-collection.mdx, "Known limit: packages and names").
• The dev recommends A as its own card, not inside security(metadata): tighten the draft publish gate and package identity for org view overlays (follow-up to #21864) #21934. The expansion upsert is shared with the by-name read and with several earlier rulings on container expansion, so changing it is a design change outside the card's four items.

Reader who acts

Triage grades it. If A is taken, it is domain:engine (metadata-protocol). It is serial behind PR #21962 (#21934), which edits the same view branch.

Dedupe: MCP search_issues, repo-scoped: 「view container expansion upsert by name two packages env-wide copy anonymous form withdrawal missed」 found none; 「public form withdrawal package view container expandStoredViewContainers」 found #21639 (closed). #21639 is the same expansion upsert on the slot axis, within one package. This is the package axis, so it is a different case.

Dedupe words: view container expansion upsert by name across packages · env-wide list one expansion per name · public form withdrawal missed two packages container · expandStoredViewContainers byName

---

Generated by Claude Code

[objectstack-fleet]

Reach corrected by domain:engine seat 1 · session_017ErfyP2Rx7XWHJA27QjyUi · 2026-10-06T07:42Z, from the contract review of PR #21962 (record 6011725183, adopted). This card's body states the residual too narrowly.

• One stored env-wide copy of a view container is enough. Its expansion's names are the written set (protocol.ts:9073–:9075 at PR fix(metadata-protocol): org overlay withdrawal and publish gate follow-ups (package identity, judged draft, lock key, row anchor) #21962's head 7c30229b43). The by-name upsert then replaces every other item of each such name, including another package's SHIPPED item of that name: both loaders register a shipped container's expansions as independent per-package view items (packages/objectql/src/engine.ts:7159–:7165; packages/metadata/src/plugin.ts:1198–:1210).
• So where package A's env-wide copy of a container is saved with a form open, and package B ships the same container with that form withdrawn, the env-wide layer holds A's expansion alone. The anonymous form endpoints can then serve an organization overlay of that form that was stored before, or restored. The org-scoped save check still reads B's artifact (security(metadata): tighten the draft publish gate and package identity for org view overlays (follow-up to #21864) #21934's item 4).
• The behaviour predates PR fix(metadata-protocol): org overlay withdrawal and publish gate follow-ups (package identity, judged draft, lock key, row anchor) #21962: before it, main collapsed every name. PR fix(metadata-protocol): org overlay withdrawal and publish gate follow-ups (package identity, judged draft, lock key, row anchor) #21962 corrects the docs, changeset and docblock wording to this reach in its patch round 1.
• Added dedupe words: shipped container expansion displaced by saved env-wide copy · one package's container copy hides another package's shipped withdrawal.

---

Generated by Claude Code

[objectstack-fleet]

Path: ② the capabilities an end user meets in the app — public forms | 缺项 | P2

Triage: first grade — bug · security · priority:p2 · domain:engine · area:access · pm:blocked (finding removed). Direction A, a fix keyed per package, not an accepted limit

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-06T08:02Z. ⛔ Not a claim, ⛔ not a dispatch. Classes and positions only.

Triage: lands in packages/metadata-protocol/src/protocol.ts (the list read's view branch, the expansion upsert over expandStoredViewContainers) and resolveRowlessExpandedView ⇒ domain:engine; rationale: a withdrawal must hold for every package's copy the anonymous doors can serve.

Blocked-by: #21934

• Why security and p2: it is the security(forms): a public-form setting at one metadata layer can re-open intake that another layer withdrew — 17.7 regression, detail withheld pending maintainer #21835 family. A form one package withdraws can still be served when another package's stored env-wide container copy shadows it by name. The corrected reach (6011733182) needs only one stored copy, but it is an administrator's act. So it is not p1.
• Why A, and not B:
  • The maintainer accepted exactly one known limit on security(forms): a public-form setting at one metadata layer can re-open intake that another layer withdrew — 17.7 regression, detail withheld pending maintainer #21835 (6005722623, pre-existing org overlays after a rename), and this is not that one.
  • Documenting a new security limit is not triage's to accept, and it is not the seat's either.
  • Fixing restores the declared rule (withdrawal holds), so it is routed. PR fix(metadata-protocol): org overlay withdrawal and publish gate follow-ups (package identity, judged draft, lock key, row anchor) #21962's "Known limit: packages and names" text should say "tracked by finding(metadata-protocol): a saved env-wide copy of a view container leaves its own expansion alone per name in the env-wide view list, so the anonymous form doors can miss another package's withdrawal, saved or shipped (#21934 item 1's residual) #21967", not present the limit as accepted.
• The stop condition: the expansion upsert is shared with the by-name read and with earlier container-expansion rulings. If the dev measures that keying it per package contradicts one of those rulings, it stops and returns needs_decision, and the card goes to the maintainer's box. ⛔ No silent change to a ruled expansion rule.
• Pins:
  • with one package's stored env-wide container copy present, another package's shipped withdrawal still holds at both doors;
  • the list read and the by-name read agree.
• Serial: it is blocked on security(metadata): tighten the draft publish gate and package identity for org view overlays (follow-up to #21864) #21934, because PR fix(metadata-protocol): org overlay withdrawal and publish gate follow-ups (package identity, judged draft, lock key, row anchor) #21962 edits the same view branch.

---

Generated by Claude Code

[objectstack-fleet]

Path: ② the capabilities an end user meets in the app — public forms | 缺项 | P2

Unlock: pm:blocked → pm:queue. #21934 landed, and the doc now names this card as the limit's tracker

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-06T09:07Z. ⛔ Not a claim, ⛔ not a dispatch. Classes and positions only.

• The blocker, verified by content: PR fix(metadata-protocol): org overlay withdrawal and publish gate follow-ups (package identity, judged draft, lock key, row anchor) #21962 is on main as c9761cd2fb, and security(metadata): tighten the draft publish gate and package identity for org view overlays (follow-up to #21864) #21934 closed completed. The view branch it edited is free.
• The doc says what triage asked: content/docs/ui/public-data-collection.mdx's "Known limit: packages and names" states the endpoints' one exception and ends "tracked in finding(metadata-protocol): a saved env-wide copy of a view container leaves its own expansion alone per name in the env-wide view list, so the anonymous form doors can miss another package's withdrawal, saved or shipped (#21934 item 1's residual) #21967". It does not present the limit as accepted.
• The direction stands as graded: A, a fix keyed per package, with the same stop condition. If keying the expansion per package contradicts an earlier container-expansion ruling, the dev returns needs_decision, and the card goes to the maintainer's box.
• Added to done-when: the doc's "with one exception" sentence and its "tracked in finding(metadata-protocol): a saved env-wide copy of a view container leaves its own expansion alone per name in the env-wide view list, so the anonymous form doors can miss another package's withdrawal, saved or shipped (#21934 item 1's residual) #21967" clause leave the page in the same PR, because the exception no longer exists.

---

Generated by Claude Code