refactor(metadata-protocol): also move refuseUnmintableMetaType and overlaidShippedContainerViewNames, and follow the moved throw sites in the refusal-opener pin

Both members were earlier stays; re-measured on today's tree, neither moves
the read-seam census nor any by-path pin, so they move on the same terms as
the rest of this cut. The bracketed-refusal-opener pin scans PRODUCERS by
file: the four modules that now hold moved throw sites join it at their own
new Error count, so the scan keeps seeing them.

Claude-Session: https://claude.ai/code/session_01L6bhgVeV5GgzaH9Ny16aSx
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/metadata-protocol/src/protocol-registry-view-predicates.ts

@@ -12,7 +12,9 @@
  *  - `isAnotherPackagesObject` — whether a code package other than the
  *    container's owns its object;
  *  - `registryTakesStoredRows` — whether this protocol's engine registry takes
- *    the rows this kernel stores.
+ *    the rows this kernel stores;
+ *  - `overlaidShippedContainerViewNames` — the view names of the shipped
+ *    container a container row overlays by its own name.
  *
  * A MOVE, not a redesign. Each function below is the body of the
  * `ObjectStackProtocolImplementation` method of the same name as it stood,
@@ -49,6 +51,7 @@ export interface RegistryViewPredicatesHost {
     readonly environmentId: ObjectStackProtocolImplementation['environmentId'];
     readonly expandRuntimeViewContainer: ObjectStackProtocolImplementation['expandRuntimeViewContainer'];
     readonly runtimeViewContainerObject: ObjectStackProtocolImplementation['runtimeViewContainerObject'];
+    readonly runtimeViewContainerPackage: ObjectStackProtocolImplementation['runtimeViewContainerPackage'];
     readonly shippedViewContainerOf: ObjectStackProtocolImplementation['shippedViewContainerOf'];
     readonly storeHydratedIntoRegistry: ObjectStackProtocolImplementation['storeHydratedIntoRegistry'];
 }
@@ -102,3 +105,18 @@ export function isAnotherPackagesObject(this: Pick<RegistryViewPredicatesHost, '
 export function registryTakesStoredRows(this: Pick<RegistryViewPredicatesHost, 'environmentId' | 'storeHydratedIntoRegistry'>): boolean {
     return this.environmentId === undefined || this.storeHydratedIntoRegistry;
 }
+
+/** The body of `ObjectStackProtocolImplementation#overlaidShippedContainerViewNames`; the method's docblock there is its contract. */
+export function overlaidShippedContainerViewNames(
+    this: Pick<RegistryViewPredicatesHost, 'expandRuntimeViewContainer' | 'runtimeViewContainerPackage' | 'shippedViewContainerOf'>,
+    type: string,
+    container: Record<string, unknown>,
+    packageId: string | null | undefined,
+): ReadonlySet<string> {
+    const ownPackageId = this.runtimeViewContainerPackage(type, container, { packageId });
+    const shipped = this.shippedViewContainerOf(type, container.name, ownPackageId);
+    if (shipped === undefined) return new Set();
+    return new Set(
+        this.expandRuntimeViewContainer(type, shipped, { packageId: ownPackageId }).map((view) => String(view.name)),
+    );
+}

packages/metadata-protocol/src/protocol-unmintable-meta-type.ts

@@ -0,0 +1,62 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [#25467 cut 33] The `/meta` save door's refusal of a `:type` segment that is
+ * not a metadata type at all, on the one entry point that mints a
+ * `sys_metadata` namespace, from `ObjectStackProtocolImplementation`, moved
+ * out of `protocol.ts` whole: `refuseUnmintableMetaType`.
+ *
+ * A MOVE, not a redesign. Each function below is the body of the
+ * `ObjectStackProtocolImplementation` method of the same name as it stood,
+ * re-indented one level and otherwise unedited.
+ *
+ * ## How the moved bodies reach the class
+ *
+ * The shape #23050 set for `rest-server.ts` (its `data-action-routes.ts`
+ * header carries the full reasoning), as `protocol-batch-data.ts` applies it.
+ * The class keeps each method — the published `dist/*.d.ts` lists its name,
+ * docblock and declared signature — and its body is one literal of exactly
+ * the {@link UnmintableMetaTypeHost} members it reads, plus a `.call`; a body
+ * that reads no member is called as a plain function. Its call to
+ * `metaTypeNamespaceExists` is handed over as a closure, so it still reaches
+ * the class method, which stays. Every caller keeps calling the class
+ * methods.
+ *
+ * What the bodies read from elsewhere, they import from where `protocol.ts`
+ * imports it. Nothing re-exports this module, so the published surface does
+ * not move.
+ */
+
+import { unrecognisedMetaTypeRefusal } from '@objectstack/spec/shared';
+import type { ObjectStackProtocolImplementation } from './protocol.js';
+
+/**
+ * The `ObjectStackProtocolImplementation` members the function below reads —
+ * every one of them, and no other; the function's `this` is the `Pick` of them. Each is typed AS the class member (an indexed access
+ * on the class), so a change to a member's signature on the class is a change
+ * here too, and naming a member the class does not have is a compile error.
+ */
+export interface UnmintableMetaTypeHost {
+    readonly metaTypeNamespaceExists: ObjectStackProtocolImplementation['metaTypeNamespaceExists'];
+}
+
+/** The body of `ObjectStackProtocolImplementation#refuseUnmintableMetaType`; the method's docblock there is its contract. */
+export async function refuseUnmintableMetaType(this: Pick<UnmintableMetaTypeHost, 'metaTypeNamespaceExists'>, request: { type: string, name: string }): Promise<void> {
+    const unrecognised = unrecognisedMetaTypeRefusal(request.type);
+    if (!unrecognised) return;
+    // The old exemption 1 (skip when the name contains a slash) was
+    // removed by commit 311433f6b — the grammar verdict upstream refuses every
+    // slash-bearing name before this probe runs. See the header.
+    // Exemption 2 — the namespace predates this write.
+    if (await this.metaTypeNamespaceExists(unrecognised.type)) return;
+    const err = new Error(
+        `'${unrecognised.type}' is not a metadata type. The platform declares `
+        + `no such type, and a plugin cannot declare one either: 'additionalTypes' was retired because `
+        + `nothing ever read it — so this write would mint a sys_metadata namespace under `
+        + `type='${unrecognised.type}' that nothing reads and nothing serves. Address a real `
+        + `metadata type; GET /api/v1/meta/types lists the ones this deployment carries.`,
+    );
+    (err as any).code = 'INVALID_REQUEST';
+    (err as any).status = 400;
+    throw err;
+}

packages/metadata-protocol/src/protocol.bracketed-refusal-opener-absence.test.ts

@@ -93,6 +93,13 @@ const PRODUCERS: Readonly<Record<string, number>> = {
   // The package door's save refusal, moved out of `protocol.ts` whole on the
   // same terms.
   'protocol-packaged-base-refusal.ts': 1,
+  // [#25467 cut 33] The named-base rule and the app package-id key, the `/meta`
+  // mint door's refusal, the MetadataService 503 and the overlay-index DDL
+  // probe, moved out of `protocol.ts` whole on the same terms.
+  'protocol-package-scope.ts': 2,
+  'protocol-unmintable-meta-type.ts': 1,
+  'protocol-loud-degradations.ts': 1,
+  'protocol-overlay-index.ts': 1,
   'sys-metadata-repository.ts': 5,
   'runtime-authoring-gate.ts': 1,
 };

packages/metadata-protocol/src/protocol.ts

@@ -425,12 +425,14 @@ import { overlayLockLayerAt, resolveOverlayPackageBinding, storedRowKnownDatasou
 import { throwMetadataServiceUnavailable, warnClosureReadUnavailable } from './protocol-loud-degradations.js';
 // [#25467 cut 33] The overlay-uniqueness indexes and the bundle-member backfill, once per process.
 import { ensureOverlayIndex, ensureOverlayMembersBackfilled } from './protocol-overlay-index.js';
-// [#25467 cut 33] The registry and view-container predicates: stored container expansion, binding, ownership, registry scope.
-import { copiesOwnShippedViewContainer, expandStoredViewContainers, isAnotherPackagesObject, registryTakesStoredRows, runtimeViewContainerObject } from './protocol-registry-view-predicates.js';
+// [#25467 cut 33] The registry and view-container predicates: stored container expansion, binding, ownership, registry scope, overlaid views.
+import { copiesOwnShippedViewContainer, expandStoredViewContainers, isAnotherPackagesObject, overlaidShippedContainerViewNames, registryTakesStoredRows, runtimeViewContainerObject } from './protocol-registry-view-predicates.js';
 // [#25467 cut 33] The ADR-0067 commit row of a publish or revert turn, and its named INSERT.
 import { persistPackageCommitRow, recordPackageCommit } from './protocol-package-commit-record.js';
 // [#25467 cut 33] Package scope: the writable base, the named-base rule, storage teardown, the app package-id key.
 import { isWritablePackage, resolveAppPackageIdKey, shouldDropStorage, uninstalledNamedBaseRefusal } from './protocol-package-scope.js';
+// [#25467 cut 33] The /meta save door's refusal of a `:type` that is no metadata type at all.
+import { refuseUnmintableMetaType } from './protocol-unmintable-meta-type.js';
 // [#25467 cut 33] The deployment's SDUI component manifest, and the load-time page `requires` report against it.
 import { reportPageRequiresAbsentAtLoad, resolveSduiManifest } from './protocol-sdui-manifest.js';
 
@@ -19410,23 +19412,11 @@ export class ObjectStackProtocolImplementation implements
      * existence claim (see {@link metaTypeNamespaceExists}).
      */
     private async refuseUnmintableMetaType(request: { type: string, name: string }): Promise<void> {
-        const unrecognised = unrecognisedMetaTypeRefusal(request.type);
-        if (!unrecognised) return;
-        // The old exemption 1 (skip when the name contains a slash) was
-        // removed by commit 311433f6b — the grammar verdict upstream refuses every
-        // slash-bearing name before this probe runs. See the header.
-        // Exemption 2 — the namespace predates this write.
-        if (await this.metaTypeNamespaceExists(unrecognised.type)) return;
-        const err = new Error(
-            `'${unrecognised.type}' is not a metadata type. The platform declares `
-            + `no such type, and a plugin cannot declare one either: 'additionalTypes' was retired because `
-            + `nothing ever read it — so this write would mint a sys_metadata namespace under `
-            + `type='${unrecognised.type}' that nothing reads and nothing serves. Address a real `
-            + `metadata type; GET /api/v1/meta/types lists the ones this deployment carries.`,
-        );
-        (err as any).code = 'INVALID_REQUEST';
-        (err as any).status = 400;
-        throw err;
+        // [#25467 cut 33] The body moved to `protocol-unmintable-meta-type.ts` (see `UnmintableMetaTypeHost`).
+        const host: ThisParameterType<typeof refuseUnmintableMetaType> = {
+            metaTypeNamespaceExists: (...a) => this.metaTypeNamespaceExists(...a),
+        };
+        return refuseUnmintableMetaType.call(host, request);
     }
 
     /**
@@ -19937,12 +19927,13 @@ export class ObjectStackProtocolImplementation implements
         container: Record<string, unknown>,
         packageId: string | null | undefined,
     ): ReadonlySet<string> {
-        const ownPackageId = this.runtimeViewContainerPackage(type, container, { packageId });
-        const shipped = this.shippedViewContainerOf(type, container.name, ownPackageId);
-        if (shipped === undefined) return new Set();
-        return new Set(
-            this.expandRuntimeViewContainer(type, shipped, { packageId: ownPackageId }).map((view) => String(view.name)),
-        );
+        // [#25467 cut 33] The body moved to `protocol-registry-view-predicates.ts` (see `RegistryViewPredicatesHost`).
+        const host: ThisParameterType<typeof overlaidShippedContainerViewNames> = {
+            expandRuntimeViewContainer: (...a) => this.expandRuntimeViewContainer(...a),
+            runtimeViewContainerPackage: (...a) => this.runtimeViewContainerPackage(...a),
+            shippedViewContainerOf: (...a) => this.shippedViewContainerOf(...a),
+        };
+        return overlaidShippedContainerViewNames.call(host, type, container, packageId);
     }
 
     /**