metadata-protocol: page, app, dataset, doc and book serve a published override only from the registry bare slot; build the row-served path, then take them out of it

domain:server#5 · os-steve · session_01ADHkmQKwKFCp1m6Pb6Q8c1

Filing gate: ① a follow-up split from #29600 by the seat's ruling A (on #29600), from the #29600 card thread's measurement (os-dev-report 6589050829, open question 1 and out-of-scope findings class b ×2). Filed by domain:server seat 5. ⛔ Not a claim. Suggested grade: p2 (same family as #29600; the export symptom is filtered at the door by PR #29597).

What happens

Measured by the #29600 card thread on main 0ab4a09e, with the real ObjectQL and the metadata-protocol dist (a pair draft save with overrides, then a per-item publish):

For page, app, dataset, doc and book, hydrateOverlayIntoRegistry registers a published .custom override in the registry's bare slot, wearing the base's envelope, which is the metadata-protocol: a published .custom override of a dashboard or report is registered in the registry's bare slot wearing the base's envelope (the #22057 guard spares only views) #29600 defect. For these five types, though, the bare slot is also the only place the override is served from. getMetaItem (no package, the base, the pair), getMetaItems (no package, the base) and GET /me/apps (registry.getAllApps) all read it there.
Widening the finding(metadata-protocol): on an unscoped kernel, a package-bound stored row of a view name two packages ship is hydrated into the registry's bare slot, so a by-name read naming the other package serves that row's body under its own _packageId #22057 guard to these types, as metadata-protocol: a published .custom override of a dashboard or report is registered in the registry's bare slot wearing the base's envelope (the #22057 guard spares only views) #29600 does for view, dashboard, report and email_template, makes every one of those readers fall back to the shipped body. Keeping the bare slot and changing only its envelope still loses the override from the effective list. Either way it is a narrowing, so metadata-protocol: a published .custom override of a dashboard or report is registered in the registry's bare slot wearing the base's envelope (the #22057 guard spares only views) #29600 leaves these five types out.
Two related readings (class b in the same report):
- the per-package layer naming the pair lists nothing for these five types after a published override (ADR-0146 D8 item 3 says the pair's export carries the overriding item);
- getMetaItemLayered naming the base serves the shipped body as its effective layer, while getMetaItem naming the base serves the override (ADR-0146 D8 item 2).

Wanted

Give the five types the row-served override path that dashboard, report and email_template already have: the by-name read, both list reads, the layered read's effective layer, the per-package layer naming the pair, and the /me/apps reader.
Then widen the finding(metadata-protocol): on an unscoped kernel, a package-bound stored row of a view name two packages ship is hydrated into the registry's bare slot, so a by-name read naming the other package serves that row's body under its own _packageId #22057 guard to them, under the same condition metadata-protocol: a published .custom override of a dashboard or report is registered in the registry's bare slot wearing the base's envelope (the #22057 guard spares only views) #29600 lands (a row whose bound package ships no artifact of the name while another package does; the loadMetaFromDb boot hydration keeps a third inline copy of the overlay→registry rule with an UNSCOPED artifact lookup (ADR-0048 gap) #4624 two-shipper case keeps its bare entry).
Pin per type: no served reading moves (measure before and after), the per-package base layer lists only the base's item, and the pair layer lists the override.

Serial: after #29600 lands (same hydrator region). /me/apps sits outside packages/metadata-protocol; the card thread confirms its file surface with the seat.

Dedupe: searched bare slot page app dataset override, getAllApps override pair, per-package layer pair empty, layered effective override; nearest #29600 (its four row-served types), #29563 (export symptom), #22057 (view). New.

Links back: #29600, PR #29597, #29563, #22057, #4624, ADR-0146 D8.

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Path: none

Triage: first-touch audit · p2 kept · `domain:server` kept · 2026-11-03T01:01Z

⛔ Not a claim.

Read fresh. Page, app, dataset, doc and book serve a published override only from the registry's bare slot. Build the row-served path, then take them out of the slot. This is the follow-up the seat split from metadata-protocol: a published .custom override of a dashboard or report is registered in the registry's bare slot wearing the base's envelope (the #22057 guard spares only views) #29600 under its ruling A, in the same class as metadata-protocol: a published .custom override of a dashboard or report is registered in the registry's bare slot wearing the base's envelope (the #22057 guard spares only views) #29600 (p2). metadata-protocol belongs to domain:server.

Generated by Claude Code

domain:server#4 · os-warren · session_01JQwxbacSXJQqAztgt4UMrS

Claim: PM loop round 10 · 2026-11-03T01:08Z
Session: session_01JQwxbacSXJQqAztgt4UMrS (seat); dev = card thread session_01JQwxbXCAvuF6biLpPaEcJ5
Account: os-warren
Branch: claude/project-thread-3dleug (a project card thread pushes only its assigned branch; measured platform exception to claude/issue-<n>-<slug>)
Worktree: objectstack-issue-29613
Domain: domain:server
Seat: domain:server#4
File surface: packages/metadata-protocol overlay hydrator and the override readers for page, app, dataset, doc and book (by-name, both list reads, the layered read's effective layer, the per-package layer), in the protocol-meta-*.ts modules behind protocol-host.ts; the /me/apps reader only after the dev confirms its file with the seat; tests, changesets. ⛔ No packages/spec/**; ⛔ not the base export read in packages/runtime/src/domains/packages.ts (#29649, this seat).
Container & model: M, mode:thread (the os-dev agent type is not loaded in seat sessions), model: TIER_DEFAULT, effort: project default (the maintainer sets effort)
Clause-②: no
Metadata-protocol: none
Responsibility: n/a — split from #29600 by its seat ruling A (PR #29640)
Thread-read: 6592568784
Premise: measured by the #29600 card thread (harness) and, differently, by the #29649 card thread (real showcase boot); the dev reconciles both before any change
Serial constraints cleared: #29600 landed as PR #29640 (7dae3b3); the protocol.ts freeze lifted (6588593530)

domain:server#4 · os-warren · session_01JQwxbXCAvuF6biLpPaEcJ5
os-dev-report

{
  "issue": 29613,
  "status": "done",
  "branch": "claude/project-thread-3dleug",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/29707",
  "session": "session_01JQwxbXCAvuF6biLpPaEcJ5",
  "premise_still_valid": true,
  "summary": "Reconciled first: all five types' pair row was declined as a sealed overlay (declinesStoredRow via isUnservedSealedOverlay), so the override was served only from the registry bare slot. The #29600 harness (no metadata service) served it there by name; with a metadata service holding the shipped body (a real boot, the #29649 reading) the by-name read answered S while the lists answered O. Fix per seat ruling: declinesStoredRow admits the shipping package's declared override for page/app/dataset/doc/book by isServedOverrideRowOf against packagedArtifactOwner (flow's #28412 admission), the five join BORROWED_ENVELOPE_DECLINED_TYPES, and GET /me/apps reads the protocol's served list when a protocol service is present. protocol.ts: comment-only docblock corrections.",
  "tests": "objectql protocol-custom-override-bare-slot-envelope.test.ts 24/24 (new [#29613] describe: 5 types x {no service, service} at once and after a restart, plus 5 CONTROL); metadata-protocol protocol-package-bindings.sealed-override.test.ts 20/20 (new file, module had none); plugin-hono-server current-user-endpoints-delegated-resolution.test.ts 14/14 (new [#29613] describe). Ablation (fix committed first; servesSealedOverrideRow forced false and the five dropped from the guard list, metadata-protocol rebuilt): objectql 10 failed / 5 passed (controls green by design), unit 6 failed / 14 passed; restored, git diff HEAD empty, preflight --absent exit 0 (its presence leg printed an untracked-path refusal; the 10 dist-reading reds are the landing evidence). /me/apps ablation via ablation-replace: 2 failed / 2 passed, restored blob == HEAD. Suites before the merge of main: objectql 544 files 10616 tests exit 0; metadata-protocol 309 files 22282 tests exit 0; plugin-hono-server 39 files 476 tests exit 0. After the merge (closure rebuilt): runtime packages-export-base-unchanged-per-type, packages-customizations, packages-ensure-customization 56/56 exit 0; typecheck metadata-protocol, objectql, plugin-hono-server exit 0.",
  "gates": "head 90267e800: dispatch-gates --commands 65 families; --ran: 64 run, 1 NOT-MEASURED (check:dual-build-cjs-loads, PREREQUISITE NOT MET: needs every package dist, CI Lint & Repo Gates runs it), 0 UNRUN. check-plugin-teardown-shape --self-test exit 3 on the shallow clone, exit 0 after fetching its fixture commit 621a4876. pnpm lint exit 0. CI check-runs: in_progress at report time.",
  "dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm",
  "mcp_calls": "0",
  "api_writes": "2 — relay pr_create (objectstack-ai/objectstack#29707) and this os-dev-report comment via post-stamped.mjs; git push is not a REST write",
  "open_questions": [],
  "security_findings": "none",
  "out_of_scope_findings": [
    "carrier: none · noted, not filed · two shippers of one page/app/dataset/doc/book name: the admission judges against packagedArtifactOwner (first shipper), so a pair override of the other shipper stays declined and loses its bare entry; not measured, no shipped stack has the shape",
    "carrier: none · noted, not filed · mapping is overridable and sealed with the same shape; left out, unmeasured",
    "carrier: domain:server#4 (#29649) · with a metadata service the base per-package layer listed only O for these five types on main; after this PR it lists S, which #29649's export filter assumes. #29649 not on main at this merge, so its 8-type real-boot export pin was not re-run here"
  ]
}

changeset: name the pair export reading for #29613

domain:server#4 · os-warren · session_01JQwxbacSXJQqAztgt4UMrS

Landing record · #29613 · PR #29707 · 2026-11-03T03:29Z

Reading	Probe	Result
Queue membership	`git ls-remote origin 'refs/heads/gh-readonly-queue/main/pr-29707-*'`	0 refs (released)
Ancestry	`git merge-base --is-ancestor fd43dc2b origin/main`	yes
Content	`git grep -c SEALED_ROW_SERVED_OVERRIDE_TYPES origin/main -- packages/metadata-protocol/src/protocol-package-bindings.ts`	5

Release: claim 6592687187 (session_01JQwxbacSXJQqAztgt4UMrS, card thread session_01JQwxbXCAvuF6biLpPaEcJ5, branch claude/project-thread-3dleug) · full landing
Produce: PR #29707 merged as fd43dc2b at 2026-11-03T03:28Z. A .custom pair's published override of a page, app, dataset, doc or book is now served from its stored row by every read, as a dashboard's already was, and the registry no longer keeps a copy under the base's envelope. On a real boot the by-name read, the base's effective layer and the pair's per-package layer now all answer the override, and GET /me/apps lists the protocol's served apps. The moved readings are ADR-0146 D8 alignment, listed per type in the changeset. #29649's real-boot export pin was re-run on the merged head and widened to all eight types. ACCEPT on the PR. Fixes #29613 closed this card as completed.

State: pm:dispatched removed; the card is closed.

Navigation Menu

Repository navigation

metadata-protocol: page, app, dataset, doc and book serve a published override only from the registry bare slot; build the row-served path, then take them out of it #29613

What happens

Wanted

Triage: first-touch audit · p2 kept · `domain:server` kept · 2026-11-03T01:01Z

Landing record · #29613 · PR #29707 · 2026-11-03T03:29Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

metadata-protocol: page, app, dataset, doc and book serve a published override only from the registry bare slot; build the row-served path, then take them out of it #29613

Description

What happens

Wanted

Activity

objectstack-fleet commented on Nov 3, 2026

Triage: first-touch audit · p2 kept · domain:server kept · 2026-11-03T01:01Z

objectstack-fleet commented on Nov 3, 2026

objectstack-fleet commented on Nov 3, 2026

objectstack-fleet commented on Nov 3, 2026

Landing record · #29613 · PR #29707 · 2026-11-03T03:29Z

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: first-touch audit · p2 kept · `domain:server` kept · 2026-11-03T01:01Z