fix(metadata-protocol)!: an item's lock is the strictest lock among the stored rows in scope for its address (#21761)

[objectstack-fleet]

Fixes #21761
Clause-②: no (narrowing)

What changes

An item's ADR-0010 lock is now selected from the item's address (type, name, organization scope, packageId) by one function, resolveOverlayLockLayer in packages/metadata-protocol/src/item-lock.ts. The write doors' _lock gate, getMetaItem, getMetaItemLayered and the list all call it. No caller pre-selects a row for the lock any more.

• The rows in scope. ADR-0005 precedence, as before: the organization's rows when it holds any row of the item, else the env-wide rows. Within that scope, every row of the item counts, whichever package it is bound to.
• The lock is the strictest among them. A write is refused when any row in scope refuses it, and a delete likewise (strictestLock, read off the lock algebra). Two rows that refuse different verbs (no-overlay, no-delete) join to full.
• Content stays prefer-local (ADR-0048). findServedOverlayRow is unchanged in what it serves; it now decides the content only. A read naming package A is still served A's row. When the binding lock comes from another row, the served body carries the binding row's lock family (withOverlayLockFamily), so the body never states a lock the envelope does not report.
• Prose. Among rows that declare the strictest lock, the reported lockReason / lockDocsUrl / lockSource are the address's own package row's, then the package-less row's, then other packages' by id. So the prose does not depend on row order either.

Landing points, as the claim's file surface said: item-lock.ts, and the row selection in protocol.ts (overlayLockLayerAt; the gate's readLockGateOverlayLayer; the lock source of both reads; the list item and the getMetaDiagnostics tile through the list body). One test file outside that surface: packages/objectql/src/protocol-meta.test.ts, whose outage double now fails find as well as findOne, because the gate's first read is a find. The rest of the diff is tests, the changeset, and the engine-double ledger row check:engine-double-contract --write added.

Rulings honoured, and one place they meet

• Strictest-wins, content prefer-local, no prefer-local lock: as ruled in 5982313964 and restated in 5982824254.
• Rows in scope for a request naming package A. The ruling names A's row and the package-less row. This PR keeps both and also keeps other packages' rows of the same name in scope (pin 7). Measured reason: before this change the gate asked with no package, so findOne could return package B's row. In arrangement A none + B full with B returned first, a save naming A was refused at the merge base. With A and the package-less row only, it would be admitted. That is a widening, which the ruling itself excludes ("never more permissive than either row the door could pick today"). The delete door also carries no package at all (DeleteMetaItemRequest declares none), so a package-scoped deletable can report that door only from a package-agnostic row set. Narrowing the set to A's row and the package-less row is a widening and stays the maintainer's to rule; it is raised in the report, not taken here.
• Rows in scope for a request naming no package. Every row of the item in scope: exactly the set the gate's findOne could have returned. So the lock is never more permissive than any row the door could pick before.

H1: the package axis, before and after

Before (merge base ebfe658c72):

• The gate went through readLockGateOverlayLayer → findServedOverlayRow, with no packageId, canonical spelling only, and bound the row findOne returned first. A save with ?package= reached the gate without its package (measured: the gate's address was package-less for every request), and a delete carries none.
• getMetaItem and getMetaItemLayered handed findServedOverlayRow the request's packageId (present or absent) and took that row's lock.
• The list item and the diagnostics tile never called findServedOverlayRow. They read the lock off the body the list's per-slot merge picked (the latest of the package's row and the package-less row).

After (this branch's sources at 05b41c9449; the later merges of origin/main touch no file of metadata-protocol): every caller hands resolveOverlayLockLayer its address. The gate's address carries packageId for save and publish and none for delete and rollback; the reads carry the request's. Measured over an engine double, 30 requests, both findOne orders. b→h = merge base → this head; the door columns are the _lock gate's verdict; reads are store reads per call.

arrangement · row order · request	getMetaItem lock	layered lock	list item _lock	tile locked	door save	door delete	gate reads	getMetaItem reads
arr1 pkgless none + A full [as] · package A	full→full	full→full	full→full	1→1	admitted→refused	admitted→refused	1→1	1→2
arr1 pkgless none + A full [as] · no package	none→full	none→full	full→full	1→1	admitted→refused	admitted→refused	1→1	1→2
arr1 pkgless none + A full [rev] · package A	full→full	full→full	full→full	1→1	refused→refused	refused→refused	1→1	1→2
arr1 pkgless none + A full [rev] · no package	full→full	full→full	none→full	0→1	refused→refused	refused→refused	1→1	1→2
arr2 A none + pkgless full [as] · package A	none→full	none→full	none→full	0→1	admitted→refused	admitted→refused	1→1	1→2
arr2 A none + pkgless full [as] · no package	none→full	none→full	full→full	1→1	admitted→refused	admitted→refused	1→1	1→2
arr2 A none + pkgless full [rev] · package A	none→full	none→full	none→full	0→1	refused→refused	refused→refused	1→1	1→2
arr2 A none + pkgless full [rev] · no package	full→full	full→full	none→full	0→1	refused→refused	refused→refused	1→1	1→2
arr3a pkgless no-overlay + A no-delete [as] · package A	no-delete→full	no-delete→full	no-delete→full	1→1	refused→refused	admitted→refused	1→1	1→2
arr3a pkgless no-overlay + A no-delete [as] · no package	no-overlay→full	no-overlay→full	no-delete→full	1→1	refused→refused	admitted→refused	1→1	1→2
arr3a pkgless no-overlay + A no-delete [rev] · package A	no-delete→full	no-delete→full	no-delete→full	1→1	admitted→refused	refused→refused	1→1	1→2
arr3a pkgless no-overlay + A no-delete [rev] · no package	no-delete→full	no-delete→full	no-overlay→full	1→1	admitted→refused	refused→refused	1→1	1→2
arr3b pkgless full + A no-overlay [as] · package A	no-overlay→full	no-overlay→full	no-overlay→full	1→1	refused→refused	refused→refused	1→1	1→2
arr3b pkgless full + A no-overlay [as] · no package	full→full	full→full	no-overlay→full	1→1	refused→refused	refused→refused	1→1	1→2
arr3b pkgless full + A no-overlay [rev] · package A	no-overlay→full	no-overlay→full	no-overlay→full	1→1	refused→refused	admitted→refused	1→1	1→2
arr3b pkgless full + A no-overlay [rev] · no package	no-overlay→full	no-overlay→full	full→full	1→1	refused→refused	admitted→refused	1→1	1→2
arr3c pkgless no-delete + A full [as] · package A	full→full	full→full	full→full	1→1	admitted→refused	refused→refused	1→1	1→2
arr3c pkgless no-delete + A full [as] · no package	no-delete→full	no-delete→full	full→full	1→1	admitted→refused	refused→refused	1→1	1→2
arr3c pkgless no-delete + A full [rev] · package A	full→full	full→full	full→full	1→1	refused→refused	refused→refused	1→1	1→2
arr3c pkgless no-delete + A full [rev] · no package	full→full	full→full	no-delete→full	1→1	refused→refused	refused→refused	1→1	1→2
xB1 A none + B full [as] · package A	none→full	none→full	none→full	0→1	admitted→refused	admitted→refused	1→1	1→2
xB1 A none + B full [as] · no package	none→full	none→full	full→full	1→1	admitted→refused	admitted→refused	1→1	1→2
xB1 A none + B full [rev] · package A	none→full	none→full	none→full	0→1	refused→refused	refused→refused	1→1	1→2
xB1 A none + B full [rev] · no package	full→full	full→full	none→full	0→1	refused→refused	refused→refused	1→1	1→2
xB2 pkgless none + A none + B full [as] · package A	none→full	none→full	none→full	0→1	admitted→refused	admitted→refused	1→1	1→2
xB2 pkgless none + A none + B full [as] · no package	none→full	none→full	full→full	1→1	admitted→refused	admitted→refused	1→1	1→2
xB2 pkgless none + A none + B full [rev] · package A	none→full	none→full	none→full	0→1	refused→refused	refused→refused	1→1	1→2
xB2 pkgless none + A none + B full [rev] · no package	full→full	full→full	none→full	0→1	refused→refused	refused→refused	1→1	1→2
xOrg org B full + env A none · org + package A	none→full	none→full	none→full	0→1	refused→refused	refused→refused	1→1	5→6
xOrg org B full + env A none · org, no package	full→full	full→full	full→full	1→1	refused→refused	refused→refused	1→1	1→2

Summary over the 30 requests and 60 door verdicts:

• 0 widenings (no write refused at the base is admitted at head).
• 24 narrowings, all where the base verdict depended on row order.
• 36 unchanged.
• Order-dependent groups: 14 of 14 at the base, 0 of 14 at head.
• Requests where getMetaItem, getMetaItemLayered and the door disagree: 8 of 30 at the base, 0 of 30 at head.

H2, H3, H4, H5

• H2 (what the door carries). Measured: the save door had request.packageId in hand, but assertLockAllowsWrite never received it, so the gate saw no package; the delete request declares none. It now carries it for save and publish. Rows in scope are package-agnostic for every address (above), so carrying the package picks only the prose, never the rows. Widening check: 0 of 60 door verdicts.

• H3 (content stays prefer-local). Both reads' full envelopes and bodies (layered: code, overlay, effective) and the list items were dumped for all 30 requests at the base sources and at 05b41c9449. With the lock family masked (lock, lockReason, lockSource, lockDocsUrl, editable, deletable, and _lock / _lockReason / _lockSource / _lockDocsUrl anywhere), the dumps are byte-identical: 0 diffs in 90.

• H4 (one address, one selection). resolveOverlayLockLayer(address, rowsIn, { otherSpelling }). The address fields are ITEM_ADDRESS_FIELDS = ['type', 'name', 'organizationId', 'packageId']. rowsIn(organizationId, spelling) returns every stored row of the item in one scope under one spelling; the function applies the precedence and the strictest join itself. Callers:

  • the protocol's overlayLockLayerAt, an engine find per scope, used by the gate, getMetaItem and getMetaItemLayered;
  • the list, a filter over the package-agnostic rows it read.

  The one declared difference is unchanged: the gate passes otherSpelling: false, the reads true (meta overlays: unnormalized type segment creates phantom rows that shadow the code-authored listing and cannot be deleted #4432).

• H5 (fail-closed, store reads). A failing read in scope still refuses with 503 (pin 6, with and without a package; the getEffectiveLock 的 overlay 读用裸 catch,sys_metadata 读失败时保护闸门 fail-open(_lock 落成 'none',写/删被放行) #5706 pin's double now fails the gate's find). The gate's store reads per check are unchanged in count: one read per scope, stopping at the first scope that holds a row. Before that was findOne; now it is find, because the strictest lock needs every row of the item, and findOne cannot enumerate them. Measured: 1→1 on all 30 requests. The reads pay one extra find per active read (1→2; 5→6 in the org-plus-package case), because the content row (prefer-local) and the lock rows (all in scope) are different sets. A package-scoped list pays one extra package-agnostic row read, which the overlay cache answers on a hit.

Pins

In protocol.lock-one-resolution.test.ts:

1. The generated pin gains the address as input columns: requestPackage (packageId absent / present) and packageRow (the package's row: none, or each lock level), beside the existing package-less storedRow.
   • Its completeness check names every field of ITEM_ADDRESS_FIELDS against an axis (ADDRESS_AXES, keyed by ItemAddressField, so a new field fails typecheck and the run).
   • Every row runs under both orders the store can return the two rows in.
   • Every row asserts getMetaItem = getMetaItemLayered = the door, for save and delete, against an oracle written from the rule.
   • 16 320 rows, plus the subset check that PR fix(metadata-protocol)!: the ADR-0010 _lock gate reads the row the read serves for the request's organization (#21716) #21737's 64 rows are still in the table.
2. Pin 4: arrangement 1 (package-less none, package full), both orders, package named and not. The reads and the door agree on full, the body says full, and content is the package's own row.
3. Pin 5: arrangement 2 (package none, package-less full), both orders. full, never none; the refusal carries the binding row's prose.
4. Pin 6: the getEffectiveLock 的 overlay 读用裸 catch,sys_metadata 读失败时保护闸门 fail-open(_lock 落成 'none',写/删被放行) #5706 outage. Every sys_metadata read fails, and save (with and without a package) and delete answer 503 from the gate.
5. Pin 7: a third package's row binds a save naming A, under both orders. An organization holding only another package's row is the scope for reads and door alike. The list item and the tile report the item's lock.

(The dispatch order's pins 2 and 3 are this file's pins 4 and 5: the file already had #21738's pins 2 and 3.)

Reverse verification

Committed first (68567308d1). The gate's pre-change selection was restored through scripts/ablation-replace.mjs: one row, package-agnostic, canonical, findOne org then env.

• The anchor hit 1 → 0 and the marker 0 → 1; blob 388e091cb01e → cf3701af4ce0.
• The tests resolve ./protocol.js from src, so no dist was involved.
• Predicted, then measured, on -t '#21761. pin (4|5)': 5 red / 4 green.
  • Red: pin 4 "package-less row returned first" (package named and not); pin 5 "package row returned first" (package named and not); pin 5's refusal-prose case. Each failed with expected 'admitted' to deeply equal { refused: … }, or a non-lock error where ITEM_LOCKED was expected.
  • Green: the four cases where the old gate's first row happened to be the binding one.
• Restored with git checkout HEAD -- PATH (absolute path, under trap). Blob after = blob at HEAD = 388e091cb01e; git diff HEAD empty.

Tests

At 7fe49587a0 (after merging origin/main at e83c9f6154). The final head 273ead3408 adds only a second merge of origin/main (e27a7c0c9e), which touches cloud-connection, service-storage, a pm reference doc and two ratchet baselines and no file of spec, metadata-core, metadata-protocol or objectql, so these readings carry:

• pnpm --filter @objectstack/metadata-protocol exec vitest run --maxWorkers=2: 213 files passed, 3 skipped; 19 952 tests passed, 19 skipped.
• pnpm --filter @objectstack/metadata-protocol typecheck: exit 0. tsc --listFiles includes all four edited test files.
• objectql, against the rebuilt metadata-protocol dist: the 8 lock-touching protocol files pass (160 tests). The full objectql suite passed at 632a00751d: 373 files, 7463 tests.

Gates

All at head 273ead3408, after the final commit.

• node scripts/pm/dispatch-gates.mjs --commands (no paths) derived 74 commands. All 74 ran, plus the 54-row artifact-roster block it prints outside its total and the four symbol-anchor sweeps (check:adr-symbol-anchors, check:scripts-symbol-anchors, check:spec-docblock-symbol-anchors, check:adr-anchors): 132 commands, 129 exit 0.
• dispatch-gates --ran over the recorded cmd :: exit N list: "74 derived famil(ies) accounted for — 74 run, 0 NOT-MEASURED (a DERIVED zero — all 74 recorded an exit code and none of them is 3)".
• The three non-zero results are roster gates that read a pull request, and locally have none (exit 2, NOT WIRED):
  • check-partof-closing-keyword: re-run with this body as PR_BODY, exit 0;
  • check-closing-target-claim and check-single-claim-paths: NOT MEASURED. Each needs a PR number and an API token; this session's GH_TOKEN is invalid, and their guard workflows run on the PR.
• check-closing-keyword-parity --body: only #21761 binds.
• Named readings:
  • check:engine-double-contract: OK, after recording the one new pinned row through its own --write.
  • check:durability-log-level: green, read-seam invention included.
  • check:lean-entry-closure: green, after building objectql.
  • check:dual-build-cjs-loads: green.
  • check:nul-bytes: OK.
  • check:changeset-no-major: the level axis was measured with a simulated PR body carrying this Clause-② line (minor passes; patch exits 1).
  • check:adr-0087-registration: one declared-breaking changeset, carrying its disposition.
• Lint, a proven narrowing.
  • Command: eslint --no-inline-config --format json over the 7 touched .ts files, at 273ead3408: 7 files, 0 errors, 0 warnings.
  • Population, read from eslint's own calculateConfigForFile / isPathIgnored: every one of the 7 is linted (none ignored).
  • Invariance: eslint.config.mjs enables no type-aware linting (no parserOptions.project, which reads null for each file), so this diff cannot move any untouched file's verdict.
  • The repo-wide pnpm lint is CI's.
• NOT MEASURED here, CI's:
  • Test Core shards beyond the two packages above;
  • Temporal Conformance, Dogfood, Build Core;
  • the workspace type-check lane.

Acceptance notes

• Changeset grade. The dispatch order asked for patch. check-changeset-no-major.mjs refuses patch on a moved package under Clause-②: no (narrowing) during the launch window. It was measured on a throwaway local commit: exit 1, "it grades NO package whose packages/**/src/** it moves" at the level a narrowing owes. So the changeset is minor, with the ! title and an ADR-0087 not-required (no-migration-prescription) disposition; check:adr-0087-registration reads it.

• Artifact layer, same family, not changed here. The reads look the artifact up package-scoped (lookupArtifactItem(type, name, packageId)); the gate looks it up package-agnostically. Measured on a registry double that mirrors getArtifactItem's prefer-local-then-first-composite order, with packages B (full, registered first) and A (no lock) shipping one view name:

  • getMetaItem naming A reads lock: none, editable: true;
  • a save naming A is refused ITEM_LOCKED with source=artifact and B's reason.

  Reported in the PR's report as a finding for the seat.

• The list serves the latest of a slot's rows. mergePackageAwareOverlay picks, per package slot, the latest of that package's row and the package-less row. With both present, the list's body for package A is the package-less row when it comes back later, while getMetaItem naming A serves A's row (H1 table, list column at the base). The lock family on the list body now follows the binding rows; the content selection is unchanged and is reported as a finding.

• getMetaItemLayered's effective body now carries the binding overlay lock family as getMetaItem's body does. code and overlay stay raw. On the artifact axis effective still never carried the artifact's family, as before.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/metadata-protocol, touching 44 documentable anchor(s).

31 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json 045f764c2672c499d85393c0a37ef90ddd48263d.

⛔ 12 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 1 cross-cutting symbol(s) contributed no route anchor: organizationId (5 routes)
• 2 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 11 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 045f764c2672c499d85393c0a37ef90ddd48263d → packageMentionDocs.

Which tree this was computed on

This run read content/docs from e3a6e7b9df3f4b5ee201d8114cdcd8648fb05c05 — the merge of head 273ead34085a40d3aea4ed1e68394eafb6a428d6 into base 045f764c2672c499d85393c0a37ef90ddd48263d, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin e3a6e7b9df3f4b5ee201d8114cdcd8648fb05c05 && git checkout e3a6e7b9df3f4b5ee201d8114cdcd8648fb05c05
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 045f764c2672c499d85393c0a37ef90ddd48263d 273ead34085a40d3aea4ed1e68394eafb6a428d6 && git checkout -B drift-repro 045f764c2672c499d85393c0a37ef90ddd48263d && git merge --no-ff 273ead34085a40d3aea4ed1e68394eafb6a428d6

node scripts/docs-audit/affected-docs.mjs --json 045f764c2672c499d85393c0a37ef90ddd48263d

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 045f764c2672c499d85393c0a37ef90ddd48263d → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

ACCEPT (seat review) — PR #21801 at head 273ead3408

domain:engine#1 · session_017ErfyP2Rx7XWHJA27QjyUi · read at 2026-10-05T02:10Z. The os-dev report is on #21761 (5986879399). Judged against GitHub and the branch, not against the report.

• Shape: draft, base main, assignee os-project-manager.

  • The first lines are Fixes #21761 and Clause-②: no (narrowing).
  • The closing-keyword scan finds #21761 only.

• Scope: 9 files, +923/-194:

  • metadata-protocol's item-lock.ts and protocol.ts;
  • the generated pin and three test doubles whose gate read is now find;
  • objectql's protocol-meta.test.ts outage double;
  • one engine-double-contract row, written by the gate's own --write;
  • the changeset.

  NOT governed, and no packages/spec/src/** path. Clause-② is no, so no contract review is owed.

• The diff, read: triage's direction (5982313964, restated by the unlock 5982824254).

  • resolveOverlayLockLayer(address, rowsIn, { otherSpelling }) in item-lock.ts is the one selection. Every caller hands it the item's address (ITEM_ADDRESS_FIELDS: type, name, organization, package): the _lock gate through readLockGateOverlayLayer, getMetaItem, getMetaItemLayered (its effective body included) and the list items the diagnostics tile counts. No caller pre-selects a row for the lock any more.
  • The rows in scope follow ADR-0005: the organization's rows when it holds any row of the item, else the env-wide rows. The lock is the strictest among them, read off the lock algebra (strictestLock), so no-overlay with no-delete gives full.
  • Content stays prefer-local: findServedOverlayRow now decides content only. A served body carries the binding row's lock family through withOverlayLockFamily.
  • The gate keeps getEffectiveLock 的 overlay 读用裸 catch,sys_metadata 读失败时保护闸门 fail-open(_lock 落成 'none',写/删被放行) #5706: overlayLockLayerAt runs inside the same fail-closed catch, and pin 6 holds it. Its store reads per check stay 1 to 1.

• Measured:

  • Of 60 door verdicts over 30 requests and both row orders: 0 widenings and 24 narrowings.
  • Row-order-dependent groups fell from 14 of 14 to 0 of 14.
  • Read-versus-door disagreements fell from 8 of 30 to 0 of 30.
  • Masked content was byte-identical in all 90 dumps (H3).

• Pins:

  • Pin 1, the generated pin: its address column comes from ITEM_ADDRESS_FIELDS, under a completeness check keyed by field. 16320 rows, each under both row orders.
  • Named pins:
    • 4: arrangement 1;
    • 5: arrangement 2, never none;
    • 6: the getEffectiveLock 的 overlay 读用裸 catch,sys_metadata 读失败时保护闸门 fail-open(_lock 落成 'none',写/删被放行) #5706 outage;
    • 7: a third package's row stays in scope.

• Reverse verification: from committed 68567308d1, the gate's pre-change selection was planted (findOne, org then env, no package).

  • Pin 4 failed on the package-less-row-first order, ×2.
  • Pin 5 failed on the package-row-first order, ×2, plus its refusal-prose case.
  • The other four selected cases stayed green.
  • The restore was proved by blob equality and an empty git diff HEAD.

The dev's open questions, answered

1. Another package's row in scope: A, keep it.
   • Triage's selection rule rests on one premise (5982313964): "Strictest-wins is never more permissive than either row the door could pick today, so it does not widen."
   • The door today asks with no package, so it can bind any row of the item, a third package's row included.
   • The two-row set in the ruling's sentence therefore breaks that premise. Measured: with A's none and B's full, B returned first, a save naming A goes from refused to admitted. That is a widening, which the ruling reserves to the maintainer (⛔).
   • A is the only set that keeps the ruling's ⛔. This applies the ruling; it does not reopen it.
2. Changeset grade: A, minor.
   • Under Clause-②: no (narrowing), check-changeset-no-major refuses patch on a moved package (measured: patch exits 1, minor exits 0).
   • AGENTS.md's post-task checklist grades a narrowing the same way.
   • The order's patch was the seat's error. The ! title and the ADR-0087 not-required (no-migration-prescription) disposition match.

Changeset, checked sentence by sentence

• The four "what moves for consumers" bullets match pins 4, 5 and 7 and the census rows.
• The no-overlay + no-delete → full bullet matches the arr3 rows.
• "No write the door refused before is admitted now" matches the 0-widening census.
• "Content stays prefer-local" matches H3's 0 of 90.

Evidence

• metadata-protocol: 19952 tests pass in 213 files, at 7fe49587a0 under os-verify-lock. The final merge of origin/main touches none of its files.
• objectql: 7463 tests pass.
• The typecheck is green, and --listFiles compiles the edited tests.

Gates

• dispatch-gates --ran: 74 of 74 exit 0.
• The artifact roster, the four symbol-anchor sweeps and check:engine-double-contract (after its own --write) are green.
• The 3 PR-context guards were NOT MEASURED locally, because the dev session's token was invalid. CI runs them on this head: "The card this PR closes must claim this branch", "No other open PR may claim the same single-writer path" and "No other open PR may claim the same issue" are all success.
• CI: read at landing.

Deviations, read

• Out of the claim's file surface: the test doubles and the pinned row. Each follows from the gate's read becoming find.
• A local commit with --no-verify: used once, only to measure the patch grade. It was reset and never pushed.
• One command refused by the dev session's safety check (an rm -f over a shell variable). The dev re-issued it in the check's own suggested safe form. The seat redid nothing.

Out-of-scope findings, filed by the seat

• [finding] lock family, artifact layer × package axis: the _lock gate looks up the packaged artifact with no package while both reads look it up with the request's package #21803: the _lock gate looks up the packaged artifact with no package, while both reads look it up with the request's package. This is the lock family's one remaining position.
• [finding] getMetaItems: a package's list slot can serve the package-less row's body while getMetaItem naming that package serves the package's own row #21804: a package's list slot can serve the package-less row's body, while getMetaItem naming that package serves the package's own row. That breaks mergePackageAwareOverlay's own "the list and single-item paths agree".

---

Generated by Claude Code