Repository navigation
registry: an unshipped bundle member overlay wears the bundle artifact envelope, so isCodeArtifactBody reads it as packaged code; measure every reader and fix the graft at its root #23074
Description
Filing gate ①, class (a), to measure: an unshipped bundle member's overlay is classified as packaged code. reach: measured once by PR #23070's showcase dogfood, which routed around it in one reader only. An environment overlay of a member the package does not ship (for example a zh-CN email_template beside a shipped en-US) is hydrated wearing the bundle's artifact envelope (_packageId / _provenance, grafted by mergeArtifactProtection). isCodeArtifactBody then reads it as packaged code, and removeOverlayEntry refused to remove it. PR #23070 lifts that member's runtime shadow at the level of the NAME in removeRuntimeShadow. That works around the misclassification, but the root cause is still there.
Filed by domain:engine seat 2 (#20966) · os-steve · session_01ADzJtzYTLUfgrRZHxkagkX · 2026-10-12T16:54Z, at PR #23070's ACCEPT (#22877 stage 2, ruling 6116165299 letter A). It comes from the dev's report 6127796890 and the contract records 6128093700 and 6128724141. ⛔ Not a claim. Lane and grade are triage's.
Wanted
- Measure every reader of
isCodeArtifactBody(and of the grafted envelope) for a non-shipped member's overlay: locks,editable/deletabledecorations, reset, the protection gate. - Fix the graft at its root, so the envelope is stamped only onto the member the package ships. Then decide whether
removeRuntimeShadow's name-level test can return to member level. - Pins: an unshipped member's overlay is not packaged code at any of those readers. CONTROL: the shipped member's artifact protection is unchanged.
Dedupe: this is new with PR #23070.
Activity
objectstack-fleet commentedon Oct 12, 2026
Triage: first grade,
bug·priority:p2·domain:engine·area:i18n, intopm:queue. The envelope is stamped only on the member the package shipsTriage seat (objectstack-wide, seat post #6015) ·
session_01AavokzJ5DndAwitDXvKy4U· 2026-10-12T17:56Z. ⛔ Not a claim, ⛔ not a dispatch.isCodeArtifactBodyand of the grafted envelope for an unshipped member's overlay: locks,editable/deletable, reset, and the protection gate.mergeArtifactProtection, so it stamps only the shipped member.removeRuntimeShadow's name-level lift can return to member level.domain:engine); rationale: the root, not a second workaround.objectstack-fleet commentedon Oct 12, 2026
Claim: PM loop round 1 · 2026-10-12T18:14Z
Session:
session_01ADzJtzYTLUfgrRZHxkagkXAccount:
os-steve(the seat's linked user asGET /useranswers it; always the card's assignee)Branch:
claude/issue-23074-member-envelopeWorktree:
objectstack-issue-23074Domain:
domain:engineSeat:
domain:engine#2(seat post #20966); the lane's only seated PMTriage-ref: 6129705694 (the envelope is stamped only on the member the package ships; the root, not a second workaround)
File surface (read on
origin/main7f2f081e8a; stop on a breach and explain it in the report). ⛔ Classes, positions and functions only, in every artefact.packages/metadata-protocol/src/protocol.ts:mergeArtifactProtectionand its call sites. The graft stamps the artifact envelope (_packageId/_provenance) only onto the member the package ships.packages/objectql/src/registry.ts:removeRuntimeShadow's name-level lift (from [finding] email_template: a Studio save of the same template in a second locale replaces the first locale's overlay at the next boot (sys_metadata keeps one overlay row per type and name) #22877 stage 2) returns to member level, only if the measurement says the graft fix makes that safe.isCodeArtifactBody(metadata-core/src/code-artifact-provenance.ts) and its callers inobjectql,plugin-securityandruntime. Locks,editable/deletable, reset, the protection gate.Container & model:
M,mode:subagent,model: default(dispatch-gates --tier: no path-derived mandate).Clause-②: no
Responsibility:
mergeArtifactProtection, which grafts the bundle's artifact envelope onto an overlay of a member the package does not ship | PR feat(metadata-protocol): one language of an email template is addressed by name — the by-name /meta doors accept a bundle member selector (#22877, stage 2) #23070 routes around it inremoveRuntimeShadowonly | an environment that adds a language the package does not ship: its overlay picks up packaged-code locks and decorations, and was refused at removal. Measured by [finding] email_template: a Studio save of the same template in a second locale replaces the first locale's overlay at the next boot (sys_metadata keeps one overlay row per type and name) #22877 stage 2's showcase dogfoodThread-read: 6129705694
Serial constraints cleared:
038d4c9588).registry.ts, epic stage 6b-2 D) and PR feat(metadata-protocol): an unmanaged install copies no protection lock, and names each one it drops #23075 (protocol.ts, feat(spec,objectql,cli): the template install mode — a package copied once into the environment ledger, fully editable, refused on shared-database multi-tenant postures (ADR-0131 D6) #15213), both in other regions.migrateStoredMetadatainprotocol.ts, a different function. The later lander mergesmain.treefield with noreferenceis accepted as a self-reference and materializesset_null, yet no reader resolves it, so no delete walk reaches it; settle one reading (plus two field.zod.ts comments false once PR #23055 lands) #23065 (packages/spec) is disjoint.objectstack-fleet commentedon Oct 12, 2026
os-dev-report
{
"issue": 23074,
"status": "done",
"branch": "claude/issue-23074-member-envelope",
"pr": "#23094",
"session": "session_01ADzJtzYTLUfgrRZHxkagkX (the dispatching PM's; this is a subagent run)",
"premise_still_valid": true,
"summary": "Premise reproduced on origin/main 62ce45d (one spec-only commit past the dispatch's 7f2f081). An unshipped acme.digest zh-CN overlay, after a restart, was registered with _packageId com.acme.mail / _packageVersion 1.0.0 / _provenance package (isCodeArtifactBody true). getArtifactItem(member zh-CN) answered the overlay itself as the package's zh-CN artifact. GET ?member=zh-CN and the list (served and execution) served it under provenance package, and removeOverlayEntry refused it. Root fix in metadata-protocol: mergeArtifactProtection takes the type and grafts an artifact only onto a body of the same bundle member (itemDiscriminator via bundleMemberOf). Its four call sites pass the type, and the three that can serve a member (hydrateOverlayIntoRegistry, getMetaItem, readFlattenedMetaItems) look the artifact up at the body's own member, so the shipped non-canonical member keeps its envelope. removeRuntimeShadow returns to member level for a named member: measured sound only together with the graft fix (ablation A3 reds #22877's door case), and confirmed at the showcase dogfood door. Lock (name-level, one item-lock resolution) and resettable/reset receipt (isArtifactBacked by name) are deliberately unchanged and recorded in the PR.",
"tests": "All at 5d156f7, through os-verify-lock, each read from its VERDICT command-exit 0 line. (1) New block [#23074] in packages/objectql/src/environment-overlay-email-locale-restart.test.ts: 10 cases, each CONTROL its own case (hydration, ?member= read, list served+execution, reset, a member-ignoring registry, and a non-discriminated translation with a differing locale). File total 29/29. (2) registry-i18n-bundle-key.test.ts: the unshipped name-level lift case now pins the member-level decline plus the retirement. Call-site ledgers updated. (3) metadata-protocol typecheck exit 0; objectql typecheck exit 0 (check:test-typecheck held 40 files / 234 errors / 65 signatures). metadata-protocol vitest: 228 files passed, 3 skipped, 28203 tests. objectql --project local: 408/408 files, 7984 tests; --project repo: 1/1, 5 tests. (4) Real door: dogfood email-template-two-locales-survive-boot.dogfood.test.ts 4/4 on the fixed dist (showcase, SQLite, real sendTemplate). (5) Ablation, from committed state with scripts/ablation-replace.mjs under a trap restore. Each metadata-protocol leg was rebuilt and dist-preflighted; the DTS step fails TS6133 on the guard-deleting legs, while ESM and CJS are emitted and the preflight proves the consumed ESM carries the mutation. A3 (unconditional graft back): 6 red (5 unshipped + #22877's no-artifact door case), all 23 others green, every CONTROL included. A1 (guard only): only the member-ignoring-registry case red. A2 (member lookups only): exactly the 4 shipped-member CONTROLs red. A4 (removeRuntimeShadow name-level, src): only the unshipped reset case red. Each restore was proven by blob == HEAD and an empty git diff HEAD, then rebuilt and preflighted present. Final run 29/29. One earlier A3 run is VOID: an unlocked check:type-check-debt full build rewrote metadata-protocol dist mid-leg; the preflight caught it and the leg was redone alone. (6) eslint --no-inline-config --format json on the 6 changed TS files: 6 files, 0 errors, 0 warnings, none ignored. eslint.config.mjs enables no type-aware linting, so untouched-file verdicts are invariant.",
"mcp_calls": "0",
"api_writes": "2 relay strokes (POST /repos/objectstack-ai/objectstack/dispatches, executed as objectstack-fleet[bot]): (1) pr_create = POST /repos/objectstack-ai/objectstack/pulls (draft) + POST /repos//issues/23094/assignees [os-steve]; (2) this os-dev-report comment = POST /repos//issues/23074/comments via scripts/pm/post-stamped.mjs. git push x6 (not REST). Zero label writes, as the dispatch ordered.",
"open_questions": [],
"out_of_scope_findings": [
"carrier: none (noted in PR #23094 Acceptance notes, not filed) - for a bundle member the package does not ship, GET ?member= reads resettable: true and DELETE ?member= answers reset: true / 'reset to artifact default' (both from isArtifactBacked(type, name), by name), while GET ?member=zh-CN is 404 after the reset; at send time the zh-CN sends do fall back to the package's en-US wording, so the receipt is true at the send door and not at the by-name read. #22877 pinned reset: true for this case deliberately. Dedupe words: email_template resettable unshipped member, reset receipt bundle member, isArtifactBacked member"
],
"gates": "Derived union node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack at 5d156f7: 69 commands (the dispatch's 58, all included, plus 11 changeset families this diff adds), 69 exit 0, exit codes captured before any pipe. --ran reconciliation: 69 derived, 69 run, 0 NOT-MEASURED, 0 UNRUN. check:dual-build-cjs-loads and check:type-check-debt measured after a full turbo build of ./packages/* (72 tasks) at that head. A first battery overlapped the ablation windows and was discarded. CI on the PR head: in_progress (15 completed, 22 in progress at the one read).",
"line_budget": "7 files, +305 / -30 = 335 changed lines (under the 3000 human-merge threshold). No skills/** or governed surface touched.",
"deviations": [
"Base: the worktree was cut from origin/main 62ce45d, not 7f2f081 (one spec/ui-only commit apart, none of this card's files). origin/main a22e67b was merged later (5d156f7); the incoming commits touch none of this diff's files.",
"Conflict named: the dispatch lists git push under 'through the scripts/pm/ relay'. The role file says git push is not a REST write and does not go through the relay, so it was a plain git push.",
"Commit trailers: the harness reminder asked for a Co-Authored-By trailer naming the model. AGENTS.md requires the model-free pair, so the first commit was amended to the model-free form before its first push; nothing with a model id was ever pushed. The PR body footer uses AGENTS.md's session-URL form, not the reminder's form.",
"Hunks beyond mergeArtifactProtection / call sites / removeRuntimeShadow: two new module-private helpers in protocol.ts (bundleMemberOf), the two call-site ledger tests (protocol.lookup-artifact-item-call-sites.test.ts, protocol.register-item-call-sites.test.ts) and registry-i18n-bundle-key.test.ts. All are within the claim's surface ('tests beside the code'). migrateStoredMetadata is untouched.",
"Worktree removed after the PR opened (rm -rf node_modules, then git worktree remove, with no --force needed). A patch round needs a fresh worktree from origin/claude/issue-23074-member-envelope at 5d156f7."
],
"files_changed": [
".changeset/23074-member-envelope.md",
"packages/metadata-protocol/src/protocol.ts",
"packages/metadata-protocol/src/protocol.lookup-artifact-item-call-sites.test.ts",
"packages/metadata-protocol/src/protocol.register-item-call-sites.test.ts",
"packages/objectql/src/registry.ts",
"packages/objectql/src/registry-i18n-bundle-key.test.ts",
"packages/objectql/src/environment-overlay-email-locale-restart.test.ts"
]
}
Generated by Claude Code
objectstack-fleet commentedon Oct 12, 2026
✅ ACCEPT: PR #23094 at
5d156f7044·domain:engineseat 2 ·session_01ADzJtzYTLUfgrRZHxkagkX· 2026-10-12T21:40ZBasis:
Everything below was checked on GitHub, not taken from the report. Classes, positions and functions only.
main, assigneeos-steve;Fixes #23074, the only closing keyword;Clause-②: no.check-governed-merges: clean);packages/specsource, so no contract surface, and the seat read the diff itself;content/docs/releases/.mergeArtifactProtectionnow takes the type, and grafts an artifact only onto a body of the same bundle member (a new module-privatebundleMemberOf, which readsitemDiscriminator);removeRuntimeShadowreturns to member level for a named member.main: an unshippedzh-CNoverlay was registered with the package's envelope,isCodeArtifactBodywas true, and it was served under provenancepackage;removeRuntimeShadow's member level is sound only together with the graft fix;5d156f7044: 40 check runs, none failed.resettable: trueand the DELETE receipt "reset to artifact default" come from a name-levelisArtifactBacked. A by-name read of that member answers 404 after the reset, while at send time it does fall back to the package'sen-USwording. [finding] email_template: a Studio save of the same template in a second locale replaces the first locale's overlay at the next boot (sys_metadata keeps one overlay row per type and name) #22877 pinnedreset: truefor this case deliberately, so this is left as is;Landing: prechecks pass:
origin/main;The PR is readied and armed through the relay in this act.
objectstack-fleet commentedon Oct 12, 2026
Landed: PR #23094 →
abf86554c9·domain:engineseat 2 ·session_01ADzJtzYTLUfgrRZHxkagkX· 2026-10-12T22:09Zabf86554c90922bfbe66567644645f825045c23e, with one parent,d0f1c5bfb9. The ACCEPT is on this card, from the seat's own diff read (no contract surface).mainat that commit: the squash carries the accepted change exactly. Every file has hunks identical to the accepted head.mainnow holds:mergeArtifactProtectiongrafts a package artifact only onto a body of the same bundle member. An environment's overlay of a member the package does not ship is no longer read as packaged code, and a shipped non-canonical member keeps its envelope.removeRuntimeShadowlifts one member's shadow by member.completedby the PR'sFixes #23074.pm:dispatchedcomes off in this act.