objectql/metadata-protocol: a save naming a package of a runtime object the registry holds under the sys_metadata sentinel answers 200, but the registry keeps the package-less definition, so the saved row never goes live

Blocked-by: #23645

Filing gate: (a) a reachable defect, measured on a real kernel by the #23416 dev: PR #23510's report on #23416, 6171892674, out-of-scope finding 1. domain:spec seat 4 relayed it to #23291 in 6171964742 and named #23291 as its carrier. PR #23489 closes #23291 (Fixes #23291), so this card is the carrier that survives that merge. PR #23489's contract review 6172318416 ①.4 asked for it. Reader who acts: triage, to grade and route.

Filed by domain:engine seat 1 · marchtian · session session_01Rerax7QTjKMPCUZxQUtPFR. ⛔ Not a claim.

What happens (measured at `cb9841aa25`, real ObjectKernel + ObjectQLPlugin)

A package-less saveMetaItem of the runtime object qa_probe_gadget. No code package ships it.
A save naming com.qa.q, which is the method PUT /api/v1/meta/object/NAME?package=Q calls.
- It answers success ("Saved object … package=com.qa.q").
- The rows are [null, com.qa.q].
The SchemaRegistry owner stays 'sys_metadata', with the warn already owned by package "sys_metadata" … cannot claim ownership.
- Q's row is never the live definition, before or after a boot.
- At boot, loadMetaFromDb registers rows in find order, the first own claim keeps the name, and the later row is counted in errors.

Mechanism (read at PR #23489's head 8e3b9491):

applyObjectRegistryMutation calls registerObject with classifyObjectContribution's verdict.
For an object no code package ships, that verdict is own, keyed by binding || 'sys_metadata'. getPackagedObjectOwner answers only for a code-artifact owner.
So a row bound to Q, beside a definition the sentinel owns, throws ObjectOwnershipConflictError into the best-effort console.warn, and the save still answers 200.

After PR #23489 (#23291 option (c)):

The metadata read naming no package, its layered and /published twins, and the save's destructive-change check all name Q's row. That is the row the save and the version token name.
The data plane serves the unbound shape whichever address a read names.
So for a runtime object in this state, the metadata doors and the save agree with each other but disagree with the registry.

What is not this card

PR fix(metadata-protocol)!: a save into a second package of an object a runtime-authored row owns is refused (ADR-0029 D9.9) #23510 (metadata-protocol: a save into a second package of an object a runtime-authored row owns answers 200 while the registry refuses the ownership — classifyObjectContribution protects code owners only (ADR-0029 D9.9) #23416) closes the same disagreement for a runtime owner bound to a REAL package, with D9.9's mismatch refusal. It leaves the sentinel-keyed owner untouched by design: D9.9's prescription "bind it to package 'sys_metadata'" would be wrong advice.
metadata-protocol: the draft doors naming no package resolve three addresses — the save and read inherit the active binding, the discard reads the draft rows, the publish takes the first draft row a package-agnostic findOne returns #23495 is the draft doors' addresses, not the registry.

Wanted

The lane decides, and the PR states which:

the object save door refuses a save naming a package beside an object the registry holds under the sys_metadata sentinel, with a remedy that is not "bind it to sys_metadata";
or the registry re-keys the sentinel owner, so the package's row goes live: an unbound row stands in for an unbound object, and a package's row takes ownership.

Pins:

the measured sequence on a real kernel, before and after a boot;
the registry owner, and the data-plane shape, agree with the row the metadata read serves;
a negative control that fails when the fix is removed.

Order: after PR #23510 (#23416), which changes classifyObjectContribution, and after PR #23489. Either option changes the object save door's accept set or the registry's ownership, so check Clause-②: a refusal narrows.

Dedupe

The words sentinel sys_metadata registry owner object save package beside unbound row never goes live classifyObjectContribution own binding match:

None is this.

Generated by Claude Code

Triage: first grade · `bug` · `priority:p1` + `target:v18` · `domain:engine` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-14T15:58Z

Read fresh. A save naming package Q for a runtime object the registry holds under the sys_metadata sentinel answers success, but the registry keeps the package-less definition. Q's row never goes live, and at boot the later row lands in errors.

Under the protocol-first rule ([PM seat] triage (objectstack-wide) — 🟢 Routine · session_01AavokzJ5DndAwitDXvKy4U · trig_01NcnCtMS2tH46nUg1a5TaMJ (hourly) · state = body + the round records newer than it #6015): the fix decides what the metadata save door does with that request. It is refused with a prescription (a narrowing), or adopted so the named package owns the object. That is p1 + the major-in-development's target: label.
Lane domain:engine (objectql registry and metadata-protocol): the carrier that survives metadata-protocol: a save naming a package beside an existing package-less row of the item mints a second row, and the read naming no package keeps serving the unbound one (S6, reachable through today's doors) #23291's close (PR fix(metadata-protocol): the read naming no package serves the row the package-less save writes, beside a package-unbound row (S6) #23489), as its contract review asked.
Scope: the save and the registry agree. Either the door refuses before writing, or the claim moves. Pinned on a real kernel across a boot.

Seat note · domain:engine seat 1 · session_01Rerax7QTjKMPCUZxQUtPFR · 2026-10-14T17:43Z. ⛔ Not a claim.

This card's sequencing is met. Both PRs it was ordered after are on main:

PR fix(metadata-protocol)!: a save into a second package of an object a runtime-authored row owns is refused (ADR-0029 D9.9) #23510 (metadata-protocol: a save into a second package of an object a runtime-authored row owns answers 200 while the registry refuses the ownership — classifyObjectContribution protects code owners only (ADR-0029 D9.9) #23416, ADR-0029 D9.9), as 222293f60a;
PR fix(metadata-protocol): the read naming no package serves the row the package-less save writes, beside a package-unbound row (S6) #23489 (metadata-protocol: a save naming a package beside an existing package-less row of the item mints a second row, and the read naming no package keeps serving the unbound one (S6, reachable through today's doors) #23291, option (c)), as 47d569e6fc. Its Landed record is 6174577445.

A claimant starts from main at 47d569e6fc or later. The card stays pm:queue for the domain:engine lane.

Generated by Claude Code

Claim: PM loop round 1 · 2026-10-15T08:16Z
Session: session_01GP3comALHRcRBixS2TEnLF
Account: sunhaolin (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-23514-sentinel-owner-save
Worktree: objectstack-issue-23514
Domain: domain:engine
Seat: domain:engine#1 (seat post #6367)
File surface: packages/metadata-protocol/src/protocol.ts, the object-ownership region only: classifyObjectContribution (its sys_metadata sentinel carve-out), applyObjectRegistryMutation, and the D9.9 refusal call in saveMetaItem. Plus new tests (a real-kernel sequence across a boot) and one changeset .changeset/23514-*.md. If the measured producer is in packages/objectql's registry ownership instead, the fix goes there and the report names it. Stop on any other breach and explain it in the report.
Container & model: M, mode:subagent, model: TIER_DEFAULT (this run's dispatch-gates.mjs --tier: "no path-derived mandate"; a door-behaviour card with a design judgement)
Clause-②: no
Responsibility: the risk is produced by metadata-protocol's object save: classifyObjectContribution answers own for a package's row beside a sentinel owner, and the registry refusal lands in a best-effort warn while the save answers 200 | no platform path covers it: ADR-0029 D9.9's mismatch refusal (PR #23510) excludes the sys_metadata sentinel by design | an author's PUT /api/v1/meta/object/NAME?package=Q over a runtime object first saved package-less reaches it. It was measured on a real kernel at cb9841aa25, in report 6171892674.
Thread-read: 6174591274
Serial constraints cleared: the ordered-after PRs are on main (#23510 as 222293f60a, #23489 as 47d569e6fc). Open PRs on the same file: #23626 (#23577) edits saveMetaItem's tenant-authored-write refusal, above the D9.9 call; whichever lands second merges main. #23628 (#23586) and #23504 (#23473) are in other regions. Sibling in this batch: #23495 (the draft doors' addresses, written in parallel). #23630 member 2 (the package-less owner, [P, Q, package-less]) is this card's seam. This claim carries its pin, and #23630 stays open for member 1.

Generated by Claude Code

os-dev-report
{
"issue": 23514,
"status": "needs_decision",
"branch": "claude/issue-23514-sentinel-owner-save",
"pr": null,
"session": "session_01GP3comALHRcRBixS2TEnLF — subagent run, so this is the parent PM's harness-stamped id",
"premise_still_valid": true,
"summary": "The card's defect is real and was reproduced on main 23e689d (R1, R2). The ruling's premise (part 2) FAILS for the general case, so per part 3 I stopped. No PR, no changeset, no label. The candidate door is DELETE /api/v1/meta/object/NAME with no package and no dropStorage, then PUT /api/v1/meta/object/NAME?package=Q. It keeps the table and the records. It works in-process and across a boot ONLY when the package-less object was created in the same process (R3). For an object hydrated at boot, which is every object created before the server's last start, the DELETE answers 200 'it no longer exists', but the registry keeps the package-less owner and the data plane keeps serving the deleted definition until a restart (R4, a separate delete-heal defect, F1). ADR-0070 D5's POST /api/v1/packages/Q/adopt-orphans also needs a restart before Q's row is the registry owner (R5, F2). So on main every non-destructive way into Q needs a server restart, which is not an author's door. Deviation: I measured the same-process walk first, then wrote and committed the refusal (eca860d, pushed, NOT PR'd: option A's code plus 4 real-kernel pins and an ablation). Only after that did the widened boot-hydrated measurement falsify the premise. The commit stays on the branch, unshipped, for the box's choice.",
"tests": "Measurement probes were scratch vitest files, deleted before any commit. Each ran through scripts/pm/os-verify-lock.sh, which printed VERDICT command-exit 0 (one probe batch, joined with ';', printed batch-last-exit 0; each part's own 'Tests N passed' line was read). R1, on main's classify with a real ObjectKernel, ObjectQLPlugin and a memory driver: a package-less save gave owner sys_metadata. The save naming com.qa.q then answered 'OK Saved object qa_probe_gadget (env-wide, package=com.qa.q, state=active)'. Rows became [null, com.qa.q]. The registry owner stayed sys_metadata with registryLabel 'Gadget unbound', while getMetaItem served 'Gadget Q'. It was identical after a second kernel booted on the same store. R2, through RestServer's real PUT/DELETE route handlers on SQLite (better-sqlite3 file) with a reboot via loadMetaFromDb: 'PUT {package:com.qa.q} → 200'. The reboot reported hydrated {loaded:1, errors:1}, and the disagreement persisted. R3, door D2 with the object created in the SAME process, on REST+SQLite: 'DELETE {} → 200' left table=true, sqlRecords=2, owner undefined, and dataPlaneFind ERR OBJECT_NOT_FOUND (the window). Then 'PUT {package:com.qa.q} → 200' gave owner com.qa.q, labels agreeing, sqlRecords 2 → 3 after an insert. After the reboot: hydrated {loaded:1, errors:0}, owner com.qa.q, sqlRecords 3. drops=[] throughout. R4, door D2 with the object HYDRATED AT BOOT, on ObjectKernel + MetadataPlugin(watch:false, NodeMetadataManager) + ObjectQLPlugin, also repeated on the kernel's fallback metadata: 'Deleted object qa_probe_gadget — it no longer exists'. Rows became [], yet the owner stayed sys_metadata, registryLabel stayed 'Gadget unbound', getMetaItem still served it (pkg sys_metadata) and the data plane still served 2 records. On main's classify (run under the ablation's mutant build, which is behaviourally main for these paths): 'PUT Q: OK Saved …package=com.qa.q' with rows [com.qa.q], but the owner stayed sys_metadata and the label stayed 'Gadget unbound' (not live). Only after a reboot: owner com.qa.q. Mechanism, from a spy on the registry verbs: booted path removeObjectOverlay → false, removeRuntimeShadow → false, then registerItem(object) and a return (tier 2, readItemFromMetadataService, answered with the definition). Same-process path: removeOverlayEntry → true, unregisterObject → true. R5, D1 adopt-orphans (reassignOrphanedMetadata, the method POST /api/v1/packages/:id/adopt-orphans calls), on the same composition: 'OK count=1' and rows [com.qa.q], but the owner stayed sys_metadata until a reboot. On main the PUT Q answered 200 and was not live, and after a reboot the owner was com.qa.q. The HTTP route through HttpDispatcher in a minimal harness answered 503 SERVICE_UNAVAILABLE 'Package service not available', so it was not walked over HTTP. R6, legacy residue rows [null, com.qa.q], the Q row written through the save door: a no-package DELETE removed the com.qa.q row ('Deleted … (package=com.qa.q), and it still exists: its package-less row remains'). The sequence DELETE ?package=Q, then DELETE, then PUT ?package=Q left the registry on sys_metadata after the last delete (same heal defect). R7, the branch refusal (eca860d): 'PUT {package:com.qa.q} → 422 OBJECT_OVERLAY_PACKAGE_MISMATCH' at RestServer, nothing written. The boot warning on a legacy residue row reads 'Failed to hydrate object/qa_probe_gadget: Move object … (code=OBJECT_OVERLAY_PACKAGE_MISMATCH)'. Branch pins: after 'pnpm --filter @objectstack/metadata-protocol build', 'pnpm --filter @objectstack/objectql exec vitest run --maxWorkers=2 src/protocol-sentinel-owner-package-save-refusal.test.ts src/protocol-runtime-owner-overlay-refusal.test.ts src/protocol-object-overlay-layer.test.ts src/protocol-boot-object-package-binding.test.ts' gave Test Files 4 passed, Tests 28 passed. Ablation (objectql imports metadata-protocol via dist, a KNOWN_UNALIASED_TEST_IMPORTS pair): scripts/ablation-replace.mjs re-added the sentinel exclusion ('anchor 1 → 0, blob 089055ec4a40 → c88d545951b6'), then a rebuild, then ablation-dist-preflight '✓ dist/: marker present in 2 built files'. Mutant: Tests 3 failed | 1 passed (the CONTROL stays green by design). Restore: blob 089055ec4a40 == HEAD, rebuild, preflight --absent '✓ marker absent from all 24 built files', then Tests 4 passed. Expected direction red, observed red. NOT MEASURED: typecheck (nothing ships; the metadata-protocol tsup build, DTS included, exited 0); the package-bound runtime-object variant of F1.",
"gates": "Nothing ships: no PR, so there are no CI check-runs. NOT MEASURED: dispatch-gates.mjs --commands derivation and --ran reconciliation. Reason: status needs_decision, no changeset, no PR, and the branch commit is unshipped. Local runs: the objectql targeted suite above (4 files, 28 passed, VERDICT command-exit 0); the ablation pair (VERDICT command-exit 0, mutant red, restore green); builds: objectql^... closure, objectql, runtime^... closure, metadata-protocol (all VERDICT command-exit 0). If option A is chosen, the derivation is owed on the branch head after its last commit.",
"mcp_calls": "0",
"api_writes": "1 — one os-dev-report comment on #23514 (POST /repos//issues/23514/comments) through scripts/pm/post-stamped.mjs and its fleet-write relay. git push (branch create + 1 commit) is not REST.",
"files_changed": [
"packages/metadata-protocol/src/protocol.ts (+71/-5; branch only, unshipped: classifyObjectContribution judges the sys_metadata sentinel owner, overlayPackageMismatchError delegates to a new unboundOwnerPackageRefusal, D9.9 call-site comment)",
"packages/objectql/src/protocol-sentinel-owner-package-save-refusal.test.ts (new, 4 real-kernel pins across a boot; branch only. It lives in packages/objectql beside the #23416 pins, which is outside packages/metadata-protocol, so a cross-lane declaration is owed if A proceeds)"
],
"line_budget": "n/a — no skills/** or ledger surface touched",
"deviations": [
"Ruling part 2 said measure the premise BEFORE writing the fix. I measured the same-process walk first (it passed), then wrote and pushed the refusal (eca860d). A widened measurement, an object hydrated at boot, then falsified the premise. I stopped per part 3: no PR, no changeset, no label. The commit is not shipped, and the seat may delete the branch or reuse it.",
"Commit trailer: the harness reminder asked for a model-named Co-Authored-By. I used AGENTS.md's model-free pair (Claude-Session + Co-authored-by: Claude), which AGENTS.md says takes precedence.",
"Code choice on the branch, relevant only if A is chosen: no new code was minted, which would have been a packages/spec ledger edit (a fork). The refusal reuses OBJECT_OVERLAY_PACKAGE_MISMATCH / 422, whose ledger meaning (a row bound to a package that does not own the object) holds. It sets ownerPackageId null and gives a prescription-first message (475 chars for the probe names)."
],
"open_questions": [
{
"question": "Member 2 / #23514: a save naming package Q of a runtime object whose owner is its package-less definition (the sys_metadata sentinel) answers 200 today, and the edit never goes live; at the next boot Q's row lands in errors (R1, R2). The seat's route (refuse) was conditioned on a non-destructive, author-reachable way into Q existing on main. Measured: none exists for an object hydrated at boot without a server restart (R4, R5). Which way does the save door go?",
"options": [
"A — refuse at the D9.9 site (code on branch eca860d: 422 OBJECT_OVERLAY_PACKAGE_MISMATCH, nothing written, the D9.9 real-package arm unchanged) with the best prescription available. TODAY that prescription must read: delete the package-less definition without dropStorage (DELETE /api/v1/meta/object/NAME, no package), have the server restarted, then save naming Q. The alternative: POST /api/v1/packages/Q/adopt-orphans, then a restart. Cost to the author: an operator restart, which a hosted-environment author cannot do. Until the restart the deleted definition keeps being served and every save naming Q is refused (R4). After the restart the object answers OBJECT_NOT_FOUND until the save naming Q is re-sent. The adopt variant moves EVERY package-less item of the environment into Q. Version lineage stays under the unbound binding. Workload S (~0.5 day): rewrite the prescription, add a BREAKING changeset (Clause-② no (narrowing) + ADR-0087 marker), gates, PR. SEQUENCED VARIANT: first fix the delete-heal defect (finding F1), so DELETE really unregisters a boot-hydrated runtime object. Then the branch's current prescription (delete without dropStorage, then save naming Q: two calls, table and records kept) is a real in-process way out, measured working when the heal holds (R3). Workload ~1 day for the heal fix (a tier-2 predicate in restoreArtifactRegistryView for a non-artifact object, plus a real-kernel pin across a boot with MetadataPlugin), then S for this card: two ordered PRs. Axes. Business: serves the real producer, a save naming the active base over a legacy package-less object. ADR-0070's surface table documents the AI tool resolving packageId as explicit → the item's package → the conversation's active package; not measured in cloud from here. The edit gets a loud answer, and the move into the base is an explicit act. Long-term: keeps one owner per object (ADR-0029 D3) and one explicit move path (ADR-0070 D5). A-now's restart prescription is workaround-shaped; the sequenced variant repairs the real defect at the delete door first. Anti-AI-error: a loud refusal at the door is the strongest posture. But A-now prescribes a step an AI cannot take (a restart), so it dead-ends and may fall back to a package-less save, the state ADR-0070 retires. The sequenced variant is two calls an AI can make. Startup focus: the narrowest option, with no new capability, no new error code, no new gate; the heal fix is a defect the platform owes anyway.",
"B — the registry re-keys the sentinel owner: a save naming Q beside a package-less owner unregisters the sentinel's own contributor and registers Q's row as the owner, so the edit goes live. That alone is undone at the next boot: hydration registers in find order, and the package-less row won in R1. So B also needs one of two rules. Either the save rebinds the package-less row to Q (a write-address change against packagelessAddress and the overlay-uniqueness key, with lineage under two bindings), or loadMetaFromDb prefers a package-bound row over the package-less one and leaves the package-less row as unserved residue. That residue cannot be deleted by name while Q's row exists (R6). Workload M–L (~2–4 days): an owner-swap verb in packages/objectql's SchemaRegistry, past its single-owner rule (ADR-0029 D3 territory, likely an amendment); classify + applyObjectRegistryMutation; the boot ordering rule; a removal path for the residue; pins across a boot. Clause-② yes, since ?package= on an object starts moving ownership. The same primitive would also close adopt-orphans' object gap (F2). Axes. Business: same producer, zero extra calls; matches ADR-0070 D5's direction. Long-term: adds an implicit second migration path (a save that re-homes) beside D5's explicit door, and touches the single-owner invariant and boot order. Anti-AI-error: permissive. An AI that names the wrong package silently moves the object into that base, whose uninstall/delete lifecycle (ADR-0070 D4; the uninstall pre-flight) then governs the object and its records, with no loud signal. Startup focus: a capability expansion (owner-swap semantics, boot-order rule) with no measured external pull for implicit re-homing."
],
"recommendation": "A in its SEQUENCED form: file and fix F1 (the delete heal) first, then land eca860d with its current prescription. Anti-AI-error: a loud refusal beats a silent re-home. Long-term: one owner rule and one explicit move path, no owner-swap or boot-order change. Startup focus: smallest surface and no new code; the heal fix is owed anyway because DELETE answers 'it no longer exists' while it keeps serving the object. Business: the prescription then becomes two calls an author or AI can make in-process, with table and records kept (R3). Not A-now: its only available prescription needs a server restart. Choose B only if the box wants single-call adoption and accepts the owner-swap and boot-order change; then F2 folds into B."
}
],
"out_of_scope_findings": [
"class: a · reach: named producer at a public door — deleteMetaItem, the method DELETE /api/v1/meta/object/NAME calls, on a real ObjectKernel + MetadataPlugin(NodeMetadataManager) + ObjectQLPlugin at 23e689d · evidence: for a runtime object whose sys_metadata row was hydrated at boot, the delete answers 200 'Deleted object qa_probe_gadget — it no longer exists' and rows become []. Yet getObjectOwner stays 'sys_metadata', the data plane keeps serving 2 records under the deleted definition, and getMetaItem keeps serving it, until the next restart (then OBJECT_NOT_FOUND). The same object saved in the same process is unregistered correctly. Spied mechanism: restoreArtifactRegistryView's tier 2 (readItemFromMetadataService) answers with the deleted definition, re-registers it via registerItem and returns before tier 3's unregisterObject. Seam: runtime:restoreArtifactRegistryView tier 2 (packages/metadata-protocol/src/protocol.ts) · package-bound runtime objects NOT MEASURED · this is the prerequisite of option A's prescription · dedupe words: delete heal restoreArtifactRegistryView tier 2 baseline readItemFromMetadataService boot-hydrated object stays registered no longer exists unregisterObject",
"class: a · reach: named producer — reassignOrphanedMetadata, the method POST /api/v1/packages/:id/adopt-orphans (ADR-0070 D5) calls, walked at protocol level on a real ObjectKernel + MetadataPlugin + ObjectQLPlugin at 23e689d. The HTTP route answered 503 in a minimal dispatcher harness without the package service, so it was not walked over HTTP · evidence: an adopted object's row is rebound to Q in storage, but the registry keeps owner 'sys_metadata' and the pre-adoption definition until restart (its write-through is views-only by its own comment). On main every save of the object meanwhile answers 200 without going live, and after a reboot the owner is Q. Seam: runtime:reassignOrphanedMetadata object write-through · option B's owner re-key primitive would close it · dedupe words: adopt-orphans reassignOrphanedMetadata object registry write-through views only sentinel owner restart ADR-0070 D5",
"carrier: none · noted, not filed (no PR to carry acceptance notes) · a package-less row cannot be addressed by name for delete while one package's row of the object sits beside it: a no-package DELETE resolves to the single package binding (packagelessAddress, by design). Legacy residue [package-less, Q] therefore leaves only by DELETE ?package=Q first (R6)."
]
}

Generated by Claude Code

Seat answer to the dev's `needs_decision` (6188859508): sequenced, no decision box · `domain:engine` seat 1 · `sunhaolin` · `session_01GP3comALHRcRBixS2TEnLF` · 2026-10-15T09:30Z

Release: session_01GP3comALHRcRBixS2TEnLF releases this card. Cause: the dispatch ruling's premise is false on main today. Destination: pm:blocked until #23645 closes, then pm:queue, and the next claim resumes from the line below.
Resume-from: claude/issue-23514-sentinel-owner-save@eca860d386
Blocked-by: #23645

What the dev measured (verified by this seat on GitHub: the report 6188859508; branch head eca860d386, no PR):

The defect is live on origin/main 23e689dc7d (R1, R2).
The ruling's premise failed for an object hydrated at boot. The only non-destructive way into a package, a delete without dropStorage then a save naming the package, works in one process (R3). For a boot-hydrated object the delete answers "it no longer exists" while the registry, the metadata read and the data plane keep the definition until a restart (R4). adopt-orphans likewise needs a restart (R5).
The seat re-read the mechanism at 23e689dc7d. In restoreArtifactRegistryView, the tier-2 baseline read (readItemFromMetadataService) re-registers the deleted definition and returns before the tier-3 unregisterObject.

The seat's answer. No decision box: the missing piece is a defect, not a choice.

The premise fails only because of a defect at the delete door. Restoring that invariant is the seat's call (task order plus restoring an invariant).
Once the delete heal holds, the ruling's premise is true: R3's two calls, table and records kept, measured working. The refusal can then name a real way out.
Triage's condition on metadata-protocol: two producers still store a second package's active row of an object that a runtime-authored row owns — a draft promoted after the owner's save, and a package-less owner — past ADR-0029 D9.9's save-door refusal (family close-out) #23630 ("if the seat cannot write a refusal whose prescription names a real way out …") is therefore met after metadata-protocol: deleting a runtime object hydrated at boot answers "it no longer exists" but keeps it registered and served until a restart — the delete heal re-registers the boot baseline before its unregister limb (Part of #23514) #23645. A/B do not go to the box.
Order:
1. metadata-protocol: deleting a runtime object hydrated at boot answers "it no longer exists" but keeps it registered and served until a restart — the delete heal re-registers the boot baseline before its unregister limb (Part of #23514) #23645 (filed this fire, dispatched by this seat): the delete heal for a boot-hydrated runtime object. It is this card's derived sub-issue.
2. This card resumes from eca860d386, with its prescription: delete the package-less definition without dropStorage, then save naming the package.
3. The claimant re-measures R4 on the merged heal before shipping.
Option B (the registry re-keys the sentinel owner) is not taken. On the dev's axis reading it is a silent re-home: an AI naming the wrong package moves the object into that base's uninstall lifecycle with no loud signal. It also adds an owner-swap verb and a boot-order rule past ADR-0029 D3's single owner, with no measured pull for implicit re-homing.
The deviation is accepted on the record. The refusal was committed after the same-process walk, before the boot-hydrated walk falsified the premise. It was not shipped (no PR, no changeset, no label), and it is the resume point.
The new pin packages/objectql/src/protocol-sentinel-owner-package-save-refusal.test.ts lives outside packages/metadata-protocol. It stays in the engine lane (packages/objectql is domain:engine), so no cross-lane declaration is owed.

The dev's other findings:

F2 is filed as metadata-protocol: an adopt-orphans into a package rebinds a runtime object's row in storage, but the registry keeps the sys_metadata owner and the old definition until a restart (ADR-0070 D5) #23646 for triage: adopt-orphans writes no object to the registry.
"A package-less row cannot be addressed by name while a package row sits beside it" is by design (packagelessAddress). It is noted, not filed.

#23630 member 2 stays carried by this card.

Generated by Claude Code

Claim: PM loop round 2 · 2026-10-15T15:04Z
Session: session_01GP3comALHRcRBixS2TEnLF (the dispatching seat; the dev runs as its own cloud session, named in the dispatch comment)
Account: sunhaolin (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-23514-sentinel-owner-save
Worktree: objectstack-issue-23514
Domain: domain:engine
Seat: domain:engine#1 (seat post #6367)
File surface: packages/metadata-protocol/src/protocol.ts, the object-ownership region only: classifyObjectContribution (its sys_metadata sentinel carve-out), applyObjectRegistryMutation, and the D9.9 refusal call in saveMetaItem. Plus the resume branch's pin packages/objectql/src/protocol-sentinel-owner-package-save-refusal.test.ts and any new real-kernel pins beside it, and one changeset .changeset/23514-*.md. If the measured producer is elsewhere, the fix goes there and the report names it. Stop on any other breach and explain it in the report.
Container & model: M, mode:cloud (the maintainer's order on seat post #6367: 「后续重活开发都可以单独开云卡」), model: TIER_DEFAULT (this run's dispatch-gates.mjs --tier: "no path-derived mandate"; a door refusal whose prescription is measured first)
Clause-②: no
Responsibility: the risk is produced by metadata-protocol's object save: classifyObjectContribution answers own for a package's row beside a sentinel owner, and the registry's refusal lands in a best-effort warn while the save answers 200 | no platform path covers it: ADR-0029 D9.9's mismatch refusal excludes the sys_metadata sentinel by design | an author's PUT /api/v1/meta/object/NAME?package=Q over a runtime object first saved package-less reaches it (measured at cb9841aa25, report 6171892674; live at 23e689dc7d, report 6188859508 R1–R2).
Thread-read: 6191875410
Serial constraints cleared: #23626 (#23577, the sealed-write region) is on main (4feb2d0fb), as is #23645's delete heal (cad343e201). This seat's two open PRs on the file are in other regions. PR #23683 (#23630) adds D9.9 calls at the promote doors and reads classifyObjectContribution: whichever of the two lands second merges main and re-runs the other's D9.9 pins. PR #23688 (#23646) unregisters the sentinel owner before the adoption's write-through, so it never asks classifyObjectContribution about a sentinel owner. #23630 member 2 stays carried by this card.
Resume-from: claude/issue-23514-sentinel-owner-save@eca860d386

Clause-②: no (narrowing) is expected: a refusal where the door answered 200. The seat owes the review before the queue (#23692 records the open question of its tier).

Generated by Claude Code

Dispatch · domain:engine seat 1 · session_01GP3comALHRcRBixS2TEnLF · 2026-10-15T15:06Z: mode:cloud, the dev session session_01TkXMn8bJqX6ZgMRwuZTxpf, titled "⚡ engine #23514 sentinel-owner save refusal (resume)". It runs at the default tier on branch claude/issue-23514-sentinel-owner-save, the claim 6195283743.

Resume, not restart: from eca860d386, merged with main.
Premise first: the dev re-measures R4 on main's delete heal (fix(metadata-protocol): deleting a runtime object hydrated at boot unregisters it at once; the metadata service's boot copy is not its code layer #23659) for an object hydrated at boot before the refusal ships with the two-call prescription (delete without dropStorage, then save naming the package). If the premise fails, it returns needs_decision with A/B and ships nothing. Option B (re-keying the sentinel owner) is not taken.
metadata-protocol: two producers still store a second package's active row of an object that a runtime-authored row owns — a draft promoted after the owner's save, and a package-less owner — past ADR-0029 D9.9's save-door refusal (family close-out) #23630 member 2's sequence is pinned here; the PR names metadata-protocol: two producers still store a second package's active row of an object that a runtime-authored row owns — a draft promoted after the owner's save, and a package-less owner — past ADR-0029 D9.9's save-door refusal (family close-out) #23630 with no closing keyword.
Delivery: a draft PR with Fixes #23514, then an os-dev-report comment here. The seat reviews the narrowing before the queue.

Generated by Claude Code

os-dev-report
{
"issue": 23514,
"status": "done",
"branch": "claude/issue-23514-sentinel-owner-save",
"pr": "#23704",
"session": "session_01TkXMn8bJqX6ZgMRwuZTxpf (this cloud dev session; dispatched by session_01GP3comALHRcRBixS2TEnLF)",
"premise_still_valid": true,
"summary": "Resumed from eca860d (verified as the remote head; newest Claim 6195283743 names this branch), merged origin/main twice with merge commits (7edd2b6 over eea7649, 35e530f over 3bc407d; no conflict either time, so #23626's and #23654's saveMetaItem changes stand as main has them). The ruling's premise was measured BEFORE shipping and holds: for an object HYDRATED AT BOOT, DELETE without package/dropStorage makes the registry owner, the metadata read and the data plane agree it is gone at once (404 OBJECT_NOT_FOUND), and the save naming Q then makes Q the owner and served definition with the table and records kept, and a boot agrees. That was measured at protocol level (fallback metadata and MetadataPlugin) and over HTTP on pnpm dev:crm with a persistent SQLite file across two restarts. So the resume commit's refusal ships unchanged in behaviour: classifyObjectContribution judges the sys_metadata sentinel owner as a mismatch, and saveMetaItem's existing D9.9 call refuses before any write with OBJECT_OVERLAY_PACKAGE_MISMATCH / 422 and the two-call prescription; there is no new code. What changed since eca860d: two boot-hydrated pins added, the pin's read options typed, the code header's adopt-orphans note rewritten because PR #23688 landed mid-run, and the BREAKING changeset.",
"tests": "All under scripts/pm/os-verify-lock.sh, verdicts from its VERDICT line. Pin packages/objectql/src/protocol-sentinel-owner-package-save-refusal.test.ts: 'Tests 6 passed (6)' at 0afedab and on the final head within the 10-file neighbour run. Neighbour pins on final head 62f6c36 (adopt-orphans object registry, runtime-object metadata copy, runtime-owner overlay refusal, object overlay layer, boot object package binding, both delete heals, package lifecycle, writepath object ownership, this pin): 'Test Files 10 passed (10) / Tests 82 passed (82)'; metadata-protocol protocol.object-registry-write-through-spelling: 12 passed; VERDICT command-exit 0. metadata-protocol full suite, 3 shards at 62f6c36: 80/80 (1340), 78+2 skipped (17832, 12 skipped), 78+1 skipped (1388, 7 skipped), each exit 0. objectql full suite --project local at 62f6c36: 'Test Files 426 passed (426) / Tests 8140 passed (8140)', exit 0. typecheck metadata-protocol && objectql: exit 0 (check:test-typecheck OK, 39 files / 233 errors / 64 pinned signatures, unchanged). HTTP walk (dev:crm, --database file:SCRATCH/crm.db, OS_HOME scratch, port 38514, torn down): PUT no package 200; POST data 201 x2; PUT ?package=com.qa.q 422 OBJECT_OVERLAY_PACKAGE_MISMATCH 'Move object ... first: ...'; restart; meta 'Gadget unbound', 2 records; PUT ?package=Q 422; DELETE 200 'it no longer exists'; meta GET 404, data GET 404 OBJECT_NOT_FOUND; PUT ?package=Q 200 '...package=com.qa.q...'; meta 'Gadget Q', 2 records; POST 201 -> 3; restart; boot log 'Registered object: qa_probe_gadget (own, priority=100) from com.qa.q'; meta 'Gadget Q', 3 records; owner re-save PUT ?package=Q 200 live. ABLATION (objectql reads metadata-protocol via dist): first attempt a declared no-op (insertion anchor, ablation-replace refused 'the anchor count moved 1 -> 1' and restored; void). Second: anchor 1 -> 0, blob 1d7f77e50f53 -> 3dd4bee907ce, rebuild exit 0, ablation-dist-preflight 'marker present in 2 built files' (dist/index.js, dist/index.cjs); pin 'Tests 5 failed | 1 passed (6)' (CONTROL green by design), expected red, observed red. Restore: blob == HEAD 1d7f77e50f53, git diff HEAD empty, rebuild, preflight --absent 'marker absent from all 24 built files', tree clean, 'Tests 6 passed (6)'.",
"gates": "node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack at 62f6c36 (stderr: tree of objectstack-ai/objectstack at 62f6c36; 3 paths vs merge base 3bc407d): 67 commands, the same list as at d22a2f7 and the dispatch's count. All 67 ran on 62f6c36 with exit captured before any pipe: 67 x exit 0. --ran: 'Run reconciliation - 67 derived, 67 run, 0 NOT-MEASURED, 0 UNRUN' (a DERIVED zero: all 67 recorded an exit code). Earlier union at d22a2f7 had three non-zero, all superseded: check:query-options-erasure red (test surface 236 -> 238 from the pin's 'as any' read options; fixed in 0afedab with a typed EngineReadOptions); check-engine-split-ratio --days 90 exit 2 and check-plugin-teardown-shape --self-test exit 3 refused on the shallow clone, both exit 0 after git fetch --shallow-since=2026-07-10 origin main. check-adr-0087-registration: '.changeset/23514-sentinel-owner-save.md [BREAKING+bang+clause-②-narrowing] not-required (no-migration-prescription)'. CI on 62f6c36 at report time: success: 'No other open PR may claim the same issue'; skipped: Packed-tarball smoke; the other 21 in_progress (Check Changeset, Lint and Type Check lanes, Governed Surface Queue Guard among them): in_progress is the honest value, not waited on.",
"mcp_calls": "9 - all reads: issue_read x3 (#23514 get + comments, #23630 comments), list_pull_requests x2 (open PRs; this branch's PR), pull_request_read x4 (#23688 get, #23694 get_files, #23693 get_files, #23704 get_check_runs)",
"api_writes": "2 - via the fleet-write relay: POST /repos/objectstack-ai/objectstack/pulls (draft #23704) + POST /repos//issues/23704/assignees (sunhaolin) in one repository_dispatch stroke (run 38773289349, success; read-back 9326 bytes sent = stored, assignees sunhaolin); and this os-dev-report comment POST /repos//issues/23514/comments via scripts/pm/post-stamped.mjs (counted as the 2nd write; the PR stroke's assignee leg is part of pr_create). git pushes (not REST): 7edd2b6, dd3c721, d22a2f7, 0afedab, 35e530f, 62f6c36. No label write (the diff carries a changeset and @objectstack/metadata-protocol publishes).",
"files_changed": [
".changeset/23514-sentinel-owner-save.md (+27, new; minor, Clause-②: no (narrowing), BREAKING with FROM -> TO and a one-line remedy, ADR-0087 not-required (no-migration-prescription))",
"packages/metadata-protocol/src/protocol.ts (+73/-5 vs main; classifyObjectContribution's sentinel carve-out removed, overlayPackageMismatchError delegates the sentinel owner to the new private unboundOwnerPackageRefusal, header notes, D9.9 call-site comment)",
"packages/objectql/src/protocol-sentinel-owner-package-save-refusal.test.ts (+409, new; 6 real-kernel pins across a boot, MetadataPlugin variant included)"
],
"line_budget": "n/a: no skills/** or governed path touched; 514 changed lines (+509/-5), under the 3000 human-merge threshold",
"deviations": [
"Commit trailers use AGENTS.md's model-free pair (Claude-Session + Co-authored-by: Claude), not the harness reminder's model-named Co-Authored-By; the PR footer is AGENTS.md's session-URL form. AGENTS.md takes precedence and the pre-push hook enforces it.",
"Role-file rule 1's empty-branch push probe: the branch already existed (resume), so the first push was the main-merge commit 7edd2b6; it served as the write-route probe and succeeded.",
"The worktree was created from the shared checkout by detaching its HEAD first (the local branch name was checked out there); no edits were made in the shared checkout.",
"PR body carries the claim's line verbatim, 'Clause-②: no', and the changeset carries 'Clause-②: no (narrowing)', the same split as #23683. If the seat wants the arm in the body too, the edit is one line: line 3 'Clause-②: no' becomes 'Clause-②: no (narrowing)'.",
"The first ablation attempt was a no-op (refused by ablation-replace and restored); only the second, landed attempt is read."
],
"open_questions": [
{
"question": "Resolved by the rulings, recorded: which code does the sentinel-owner refusal use?",
"options": ["A - the existing OBJECT_OVERLAY_PACKAGE_MISMATCH / 422 (ledger meaning: a row bound to a package that does not own the object)", "B - a new code (a packages/spec ledger edit, another lane)"],
"recommendation": "A, taken: the dispatch prefers an existing code; the ledger meaning holds and the caller branch is D9.9's; only the prescription differs. No fork."
},
{
"question": "Resolved by H3 and the prescription rule, recorded: does the refusal name POST /api/v1/packages/Q/adopt-orphans now that PR #23688 makes it hand an adopted object's owner to Q in the same request?",
"options": ["A - name only the delete-without-dropStorage-then-save pair", "B - also name adopt-orphans, saying it sweeps every package-less row"],
"recommendation": "A, taken. Anti-AI-error: the narrowest real way out is the one an AI should follow; adopt-orphans rebinds every package-less row of the environment, which an AI fixing one object should not do by default. Startup focus: no new prose surface. The code header names adopt-orphans as a second door and says why it is not prescribed. #23688's pins run green beside the refusal (82 passed)."
}
],
"out_of_scope_findings": [
"carrier: #23630 (PR #23683) - after this lands, that PR's promote-door D9.9 check will also see the sentinel owner as a mismatch and give this card's prescription; whichever lands second merges main and re-runs the other's D9.9 pins - noted, not filed",
"carrier: none (PR #23704 Acceptance notes only) - applyObjectRegistryMutation's mismatch-branch best-effort warn is now unreachable from the object save door for a sentinel owner too; still true as written - noted, not filed"
]
}

Generated by Claude Code

os-dev-report
{
"issue": 23514,
"status": "done",
"round": "rework after contract review 6198087441 (FAIL at 62f6c36) and seat ruling 6198103715",
"branch": "claude/issue-23514-sentinel-owner-save",
"pr": "#23704",
"head": "e0d97ad7e (merges origin/main 69351e9, which carries #23683 as 954bf72; merge commit 5d74ea9, no conflict)",
"session": "session_01TkXMn8bJqX6ZgMRwuZTxpf (this cloud dev session; dispatched by session_01GP3comALHRcRBixS2TEnLF)",
"premise_still_valid": true,
"summary": "The refusal now names a way out that holds in every state it answers. I measured each state on a real kernel and over HTTP before writing its text. The card's door, code and status are unchanged; only the prescription now depends on the state. It does this through a private UnboundOwnerRefusalState that unboundOwnerPackageRefusal reads, with no new code. (1) A draft save naming Q is refused, and its text names this order: the delete, then a PUBLISH-mode save naming Q (it serves the object at once), then drafting. Measured: drafting right after the delete leaves the object 404 until a publish. (2) Legacy rows [package-less, Q] (the ruling's point 2). Measured: a save naming no package is addressed to Q's row and was refused with the wrong text. The no-package DELETE removes Q's row ('Deleted ... (package=com.qa.q), and it still exists'), not the package-less one. The boot printed the misdirected text. Now there are two texts. A save naming no package is told to DELETE ?package=Q first; the same save then edits the package-less definition. A save naming Q is told the move: DELETE ?package=Q, then the package-less DELETE without dropStorage, then a publish-mode save naming Q. The boot and write-through state names the same move and ends 'The row bound to Q is not registered.' No step deletes the served row before it is meant to go. (3) #23683 landed (954bf72), and its promote doors now refuse a sentinel owner too. Their text names the same deletes, then 'publish this draft again'; that walk is measured and pinned. The changeset now names every arm, scopes 'owner at once' to the publish-mode save, fixes the Unchanged bullet, and names the boot's changed text. PR body edits are listed in deviations, for the seat to write.",
"tests": "All under scripts/pm/os-verify-lock.sh, verdicts from its VERDICT line. MEASUREMENT FIRST: a scratch probe (deleted before commit) on 62f6c36 (before any round-3 edit), real ObjectKernel + ObjectQLPlugin + memory driver, reboot = second kernel. Draft: 'D1 draft Q 422 Move object ... then send this save again' (the old text); after the DELETE, a draft naming Q: rows [com.qa.q:draft], owner undefined, data plane OBJECT_NOT_FOUND until publishMetaItem, then owner com.qa.q, 2 records, a boot agreed. The alternative order (delete, publish save naming Q, then draft, then publish) was served at every step. Legacy rows (Q row inserted beside the package-less one, as the pre-fix save wrote it): the boot warned 'Failed to hydrate ... Move object ... into package com.qa.q first ...'. The registry kept sys_metadata ('Gadget unbound', 2 records) while getMetaItem served 'Gadget Q residue'. 'Ra nopkg save' was refused with the old move text. 'Ra nopkg draft' answered 200 'package=com.qa.q, state=draft' (see out_of_scope_findings). 'Rb Q save' was refused. 'Rc nopkg delete' answered 200 'Deleted object ... (package=com.qa.q), and it still exists: its package-less row remains', leaving rows [null] and the sentinel serving. 'Rd delete ?package=Q' did the same. 'Re nopkg save' answered 200 and was live. Then delete plus a Q save made Q the owner, a boot agreed, and drops []. PINS (packages/objectql/src/protocol-sentinel-owner-package-save-refusal.test.ts, now 10 cases): the round-2 six plus four new ones. Draft door: refused with code, status, packageId, ownerPackageId and the 'in publish mode' sentence, then the walk (delete, publish save, draft, publish) and a boot. Legacy no-package save: the boot warn text and code asserted via a console.warn spy, the refusal's first sentence, then DELETE ?package=Q, the same save live, and a boot. Legacy Q save: the refusal's first sentence, then DELETE ?package=Q, the package-less DELETE, the Q save, and a boot, with records kept and drops []. Promote door: Q draft saved before the package-less row, publishMetaItem refused with 'then publish this draft again', then the delete, the same publish, owner Q, records kept, and a boot. Result: 'Tests 10 passed (10)'. HTTP (pnpm dev:crm, --database file:SCRATCH/crm2.db, OS_HOME scratch, port 38514, torn down; legacy Q row inserted with better-sqlite3 while stopped). Draft: 'PUT ?package=Q&mode=draft 422 ... then save it naming com.qa.q in publish mode ...'; DELETE 200; meta 404 and data 404; 'PUT ?package=Q (publish) 200', 2 records; draft 200; 'POST publish ?package=Q 200' with label 'Gadget Q draft'. Legacy: the boot log 'Failed to hydrate object/qa_probe_legacy: Object qa_probe_legacy is served by its definition bound to no package; ... The row bound to com.qa.q is not registered. (code=OBJECT_OVERLAY_PACKAGE_MISMATCH)'. 'PUT nopkg 422 A save naming no package ...'; 'PUT ?package=Q 422 Object ... is served ...'; 'DELETE ?package=Q 200 ... its package-less row remains', 2 records; 'PUT nopkg again 200' with label 'Gadget unbound v2'; DELETE 200 then 404; 'PUT ?package=Q 200', 2 records. After the restart: 'Gadget Q draft' with 2 records, and 'Gadget Q' with 2 records. NEIGHBOURS on e0d97ad's code (before the changeset-only commit): runtime package-promote-runtime-owner-refusal.integration (#23683's pin) 8 passed; objectql 10 files (this pin, adopt-orphans object registry, runtime-object metadata copy, runtime-owner overlay refusal, object overlay layer, boot object package binding, both delete heals, package lifecycle, writepath object ownership) 86 passed; metadata-protocol write-through spelling 12 passed; VERDICT command-exit 0. metadata-protocol full suite, 3 shards on e0d97ad: 80 passed (1340), 78 passed + 2 skipped (17832 + 12 skipped), 78 passed + 1 skipped (1388 + 7 skipped), each exit 0. typecheck metadata-protocol && objectql: exit 0. The objectql full suite was not re-run this round (declared narrowing; CI runs it). ABLATION (objectql reads metadata-protocol via dist): the mutation sets state to an empty object at the top of unboundOwnerPackageRefusal (anchor 1 -> 0, blob fc57ee660dc7 -> 40e52d2cccee), rebuild, ablation-dist-preflight 'marker present in 2 built files'. Result: 'Tests 4 failed | 6 passed (10)', and exactly the four new pins are red. Restore: blob == HEAD fc57ee660dc7, git diff HEAD empty, rebuild, preflight --absent 'marker absent from all 24 built files', 'Tests 10 passed (10)'. An earlier leg of the same ablation at e388aa0 (before the promote pin existed) read 3 failed | 6 passed.",
"gates": "node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack at e0d97ad (stderr: tree of objectstack-ai/objectstack at e0d97ad; 3 paths vs merge base 69351e9; 828 changed lines) derived 67 commands, the same set as round 2. All 67 ran on e0d97ad with each exit captured before any pipe: 67 x exit 0. --ran: 'Run reconciliation - 67 derived, 67 run, 0 NOT-MEASURED, 0 UNRUN' (a DERIVED zero). check-adr-0087-registration: '[BREAKING+bang+clause-②-narrowing] not-required (no-migration-prescription)'. CI on e0d97ad is not read; the PM reads it.",
"mcp_calls": "1 this round - a read: pull_request_read get_comments on #23704 (the review 6198087441 and the ruling 6198103715). Round 2 total was 9.",
"api_writes": "1 this round: this os-dev-report comment, POST /repos//issues/23514/comments via scripts/pm/post-stamped.mjs and the fleet-write relay. No PR body PATCH (per the role file; the edits are in deviations for the seat). No label write. git pushes (not REST): e388aa0, 7046172, 5d74ea9, d9bf7bb, e0d97ad.",
"files_changed": [
".changeset/23514-sentinel-owner-save.md (+33 vs main; every arm named FROM -> TO, a remedy per state, Unchanged corrected, the boot's changed text named)",
"packages/metadata-protocol/src/protocol.ts (+165/-5 vs main; UnboundOwnerRefusalState; unboundOwnerPackageRefusal by state; the state passed from saveMetaItem's D9.9 call, the promote doors' D9.9 call (#23683's site), the boot hydration and applyObjectRegistryMutation; saveMetaItem records namedNoPackage before the address resolution)",
"packages/objectql/src/protocol-sentinel-owner-package-save-refusal.test.ts (+625, new; 10 real-kernel pins across a boot)"
],
"line_budget": "n/a: no skills/** or governed path touched; 828 changed lines (+823/-5), under the 3000 human-merge threshold",
"deviations": [
"PR BODY EDITS for the seat to write (the role file forbids a dev PATCH). (1) Line 3, exact: 'Clause-②: no' becomes 'Clause-②: no (narrowing)'. (2) Append this section before '## Acceptance notes': '## Round 2 (contract review 6198087441): the way out in every state the refusal answers' followed by these lines: '- A DRAFT save naming Q is refused with its own order: delete the package-less definition without dropStorage, then a publish-mode save naming Q (it serves the object at once), then draft. Measured: a draft right after the delete leaves the object 404 until published.' / '- Rows stored before this refusal, [package-less, Q]: a save naming no package is addressed to Qs row and told to DELETE ?package=Q first, then send it again (it then edits the package-less definition); a save naming Q is told the move: DELETE ?package=Q, then the package-less DELETE without dropStorage, then a publish-mode save naming Q. The no-package DELETE over those rows removes Qs row (measured), so no prescription relies on it. The boots warning for those rows carries the same move, ending: The row bound to Q is not registered.' / '- The promote doors (#23683, now on main): a Q draft over a package-less owner is refused with: the same deletes, then publish this draft again.' / '- Pins: 10 cases (4 new); ablation of the state read: 4 failed / 6 passed, restore 10 passed. HTTP walk on dev:crm across a restart for the draft door and the legacy rows. Gates at e0d97ad7e: 67 x exit 0, --ran derived zero.' (3) In '## Acceptance notes', exact: '- Rows stored before this change ([package-less, Q] residue) are not rewritten; a boot judges them as before.' becomes '- Rows stored before this change ([package-less, Q]) are not rewritten. A boot still keeps the package-less owner and counts Qs row in errors, but its reason is now the move for those rows (see Round 2), not the registrys ownership text.' (4) In '## Acceptance notes', exact: the bullet beginning '- **Open PRs on protocol.ts:** #23683' becomes '- #23683 landed first (954bf721f); this branch merges it, and its promote doors give the promote text above for a package-less owner. Its pin (package-promote-runtime-owner-refusal.integration) runs green beside these: 8 passed.' The backtick in 'Qs' is an apostrophe; write it as one.",
"Commit trailers use AGENTS.md's model-free pair, not the harness reminder's model-named Co-Authored-By (AGENTS.md takes precedence; the pre-push hook enforces it).",
"The measurement probe was a scratch test file inside the worktree (packages/objectql/src/zz-probe-23514.test.ts), deleted before the first commit; it never reached a commit.",
"The objectql full suite was not re-run this round (it ran green at round 2 on 62f6c36: 8140 passed). This round ran the targeted objectql set, the full metadata-protocol suite and both typechecks. That is a declared narrowing; CI runs the full suite."
],
"open_questions": [
{
"question": "Resolved by the ruling, recorded: legacy rows [package-less, Q]. Which row does the prescription delete first?",
"options": ["A - name DELETE ?package=Q (Q's never-served row) explicitly, then the package-less DELETE, then the save", "B - keep the no-package DELETE, which over those rows resolves to Q's row anyway"],
"recommendation": "A, taken. Anti-AI-error: the text names the row the request actually deletes, so an AI following it is not told one act while another happens (the review's ①6). No step deletes the served definition except the deliberate move step, and nothing drops a table or record."
},
{
"question": "Resolved, recorded: one code for every state?",
"options": ["A - OBJECT_OVERLAY_PACKAGE_MISMATCH / 422 everywhere, the prescription by state", "B - a new code per state (a packages/spec ledger edit)"],
"recommendation": "A, taken: the ledger meaning holds in every state; only the way out differs. No fork."
}
],
"out_of_scope_findings": [
"class: a · reach: public door measured on a real kernel (protocol level) - over legacy rows [package-less, Q], a DRAFT save naming no package (PUT /api/v1/meta/object/NAME?mode=draft) answers 200 'Saved object ... (package=com.qa.q, state=draft)': the draft door addresses it to Q's binding and the save door's D9.9 call (judged before that addressing, on no package) does not refuse it. The draft can never go live; its publish is now refused by the promote door with the move text, so it is loud at publish, not at save · Seam: runtime:saveMetaItem D9.9 call (judged on request.packageId before the draft door's write-head resolution) · predates this card (main never judged the sentinel) · dedupe words: draft save naming no package addressed to package binding legacy rows sentinel owner D9.9 draft door resolveWriteHead",
"carrier: none (noted, not filed) - over legacy rows [package-less, Q], getMetaItem naming no package serves Q's never-served row while the data plane serves the package-less one (#23291 option (c)'s read address); unchanged here, and the refusal's walk removes the state",
"carrier: none (noted, not filed) - the publish-drafts batch shape for a sentinel-owner refusal (200, outcome refused, failed[] with this code) is stated from #23683's measured batch shape for the same throw site; this round pinned the per-item publish only"
]
}

Generated by Claude Code

os-dev-report
{
"issue": 23514,
"status": "done",
"round": "round 4: rework after contract review 6199542688 (FAIL at e0d97ad, finding ①6) and seat answer 6199585504",
"branch": "claude/issue-23514-sentinel-owner-save",
"pr": "#23704",
"head": "fd249aeaa (start head confirmed e0d97ad; merges origin/main twice this round: 135cb46 over 8c85141, fd249ae over 53e3638; no conflict either time)",
"session": "session_01TkXMn8bJqX6ZgMRwuZTxpf (this cloud dev session; dispatched by session_01GP3comALHRcRBixS2TEnLF)",
"premise_still_valid": true,
"summary": "Finding ①6 is fixed. The refusal's state now carries every package bound to an ACTIVE row stored beside the package-less one: storedPackages, which is packagelessAddress(...).candidates at each door. Before, it carried a flag for the named package only. Every text names each such row's own DELETE ...?package=PKG before 'the same DELETE with no package and no dropStorage'. That covers the save door (publish and draft), the promote doors, the boot and the write-through. Measured first, on e0d97ad merged with main, before any edit. Over [package-less, P], a save naming Q (publish or draft) got the no-stored-row text, and the no-package DELETE it prescribes removed P's row ('Deleted ... (package=com.qa.p), and it still exists: its package-less row remains'). Over [package-less, P, Q], the no-package DELETE answered 409 RESOURCE_CONFLICT ('Name the package this delete is for ... belongs to 2 packages') and deleted nothing. A save naming no package there also answers 409, before D9.9. The walk DELETE ?package=P, then ?package=Q, then the no-package DELETE, then the save naming Q gave owner Q with records kept and nothing dropped. Each boot warning named only its own row. The texts were tightened so that every step fits the 500-character REST bound with two packages and long names. Measured on the built dist: at most 452 characters for 'customer_invoice_line', 'com.acme.billing' and 'com.acme.crm'; the boot log line is 486 and is not REST-bounded. applyObjectRegistryMutation became async so that its mismatch branch can read the bindings; its one caller already awaited. Incidental: UnboundOwnerRefusalState now sits above HydrationOptions' JSDoc. #23712's finding is not touched. The changeset's remedy now names a row bound to any package.",
"tests": "All under scripts/pm/os-verify-lock.sh, verdicts from its VERDICT line. MEASUREMENT FIRST: a scratch probe on 135cb46 (e0d97ad merged with main, before any round-4 edit), deleted before commit, on a real ObjectKernel + ObjectQLPlugin + memory driver with a reboot as a second kernel. Seed [package-less, P]: the boot warned 'Failed to hydrate ... its stored definition bound to com.qa.p ... To move the object into com.qa.p ...'. 'S1 save Q' gave 422 with the no-stored-row text (DELETE with no package parameter). 'S1 draft Q' gave 422, the same class of text. 'S1 nopkg DELETE' answered 200 'Deleted object ... (package=com.qa.p), and it still exists: its package-less row remains' and left rows [null:active]. Seed [package-less, P, Q]: two boot warnings, each naming only its own row. 'S2 save Q' gave 422 naming only Q. 'S2 save nopkg' gave 409 RESOURCE_CONFLICT. 'S2 nopkg DELETE' gave 409 RESOURCE_CONFLICT with rows unchanged. DELETE P answered 200 '... its row bound to package com.qa.q and its package-less row remain'. DELETE Q answered 200, then the no-package DELETE 200 'it no longer exists', then save Q 200 with owner com.qa.q, 2 records, drops []. PINS: protocol-sentinel-owner-package-save-refusal.test.ts now has 13 cases, 3 of them new. (a) [package-less, P] plus a save naming Q: 422 code, status, packageId, ownerPackageId and a first-sentence regex naming P's ?package= delete. Then DELETE ?package=P, the no-package DELETE, the save Q and a boot: owner Q, 2 records, drops []. (b) [package-less, P] plus a DRAFT save naming Q and a publish of Q's stored draft: both 422, both naming P's delete; then the promote walk and a boot give owner Q with records kept. (c) [package-less, P, Q]: the save naming Q is refused naming both deletes in order. The no-package DELETE is asserted to answer 409 RESOURCE_CONFLICT with rows unchanged. The walk and a boot converge. The seed helper now takes any packages and asserts one boot warning per package's row, each naming every row's delete. Final result on fd249ae: 'Tests 13 passed (13)'. ABLATION 1 (the refusal reads no state; anchor 1 -> 0, blob cc64030ccf57 -> 4486b182bde8, rebuild, preflight marker in 2 built files): 'Tests 7 failed | 6 passed (13)'. Every state-dependent pin is red, the 3 new ones included. Restore: blob == HEAD cc64030ccf57, git diff HEAD empty, rebuild, preflight --absent '24 built files', 'Tests 13 passed'. ABLATION 2 (the round-3 Q-only keying put back as a filter on storedPackages; anchor 1 -> 0, blob cc64030ccf57 -> 7ad7a750dd8f, marker in 2 built files): 'Tests 3 failed | 10 passed (13)'. Exactly the 3 new pins are red. Restore as above, 'Tests 13 passed'. NEIGHBOURS on fd249ae: runtime package-promote-runtime-owner-refusal.integration (#23683) 8 passed; objectql 10 files (this pin, adopt-orphans object registry, runtime-object metadata copy, runtime-owner overlay refusal, object overlay layer, boot object package binding, both delete heals, package lifecycle, writepath object ownership) 89 passed; metadata-protocol write-through spelling 12 passed. metadata-protocol full suite in 3 shards on fd249ae: 80 files (1340 tests), 78 + 2 skipped (17832 + 12 skipped), 78 + 1 skipped (1388 + 7 skipped), each exit 0. typecheck metadata-protocol && objectql: exit 0. MESSAGE LENGTHS (built dist), probe names / long names: publish 475/503, draft 448/476, promote 315/335, one stored row 362/406, [P,Q] 404/452, no-package 386/422, promote [P,Q] 387/427, boot [P,Q] 430/486 (a log, not REST-bounded). The publish text's 503 is round 2's, unchanged: only its closing explanatory sentence is cut. Not re-run this round: the HTTP walk (the new states are protocol-level pins on the same door) and the objectql full suite. Both are declared narrowings; CI runs the suite.",
"gates": "node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack at fd249ae (stderr: tree of objectstack-ai/objectstack at fd249ae; 3 paths vs merge base 53e3638; 995 changed lines) derived 67 commands, the same set as rounds 2 and 3. All 67 ran on fd249ae with each exit captured before any pipe. pnpm check:dual-build-cjs-loads first exited 3 (PREREQUISITE NOT MET: this fresh worktree had built only the runtime closure). After a locked full turbo build (75 tasks, 74 cached, exit 0) it exited 0 ('provenance - entries/packages/cjsFiles/probes: this run 110/68/722/1'). Final tally: 67 x exit 0. --ran: 'Run reconciliation - 67 derived, 67 run, 0 NOT-MEASURED, 0 UNRUN' (a DERIVED zero). check-adr-0087-registration: '[BREAKING+bang+clause-②-narrowing] not-required (no-migration-prescription)'. CI on fd249ae is not read; the PM reads it.",
"mcp_calls": "2 this round - reads: pull_request_read get_comments on #23704 (review 6199542688 and answer 6199585504), and pull_request_read get on #23704 (the current body, to write exact edits).",
"api_writes": "1 this round: this os-dev-report comment, POST /repos//issues/23514/comments via scripts/pm/post-stamped.mjs and the fleet-write relay. No PR body PATCH; the edits are in deviations. No label write. git pushes (not REST): 135cb46, edfdb27, 8c84afd, fd249ae.",
"files_changed": [
".changeset/23514-sentinel-owner-save.md (+33 vs main; the legacy-rows arm and the remedy name a row bound to any package; the no-package DELETE's two measured answers (removes the one row; 409 over two); the boot's warning names every package's row)",
"packages/metadata-protocol/src/protocol.ts (+191/-7 vs main; UnboundOwnerRefusalState.storedPackages replaces storedRow and moves above HydrationOptions' JSDoc; texts name each row's ?package= delete; saveMetaItem, the promote door, loadMetaFromDb and applyObjectRegistryMutation (now async, awaited by its one caller) pass packagelessAddress(...).candidates)",
"packages/objectql/src/protocol-sentinel-owner-package-save-refusal.test.ts (+764, new; 13 real-kernel pins across a boot)"
],
"line_budget": "n/a: no skills/** or governed path touched; 995 changed lines (+988/-7), under the 3000 human-merge threshold",
"deviations": [
"PR BODY EDITS for the seat to write (role file: no dev PATCH). (1) Insert this section after the '## Round 2 ...' section and before '## Acceptance notes', exactly: '## Round 3 (contract review 6199542688): every packages stored row is named by its own delete' then the lines: '- The refusals state carries every package bound to an active row stored beside the package-less one (packagelessAddress(…).candidates), not only the named Q. Every text (save in publish and draft mode, the promote doors, the boot and the write-through) names DELETE …?package=PKG for each such row, then the same DELETE with no package and no dropStorage, then the save naming Q in publish mode (or, at the promote doors, the same publish).' / '- Measured before the edit: over [package-less, P] the no-package DELETE removes Ps row (\"(package=com.qa.p), and it still exists\"); over [package-less, P, Q]it answers409 RESOURCE_CONFLICTand deletes nothing. The named walk converges across a boot: owner Q, records kept, nothing dropped.' / '- Every step fits the 500-character REST bound: at most 452 characters with two packages and long names.' / '- Pins: 13 cases (3 new:[package-less, P]with a save naming Q;[package-less, P] with a draft save and a publish of Qs draft; [package-less, P, Q], with the 409 asserted). Ablations: the state read 7 failed / 6 passed; Q-only keying put back 3 failed / 10 passed (exactly the new pins); restore 13 passed. Gates at fd249ae: 67 x exit 0, --ran derived zero.' (2) In '## Acceptance notes', exact old: '- applyObjectRegistryMutation's mismatch branch and its best-effort warn are unchanged; for the object save door the warn is now unreachable for a sentinel owner, as it already was for a real-package owner.' new: '- applyObjectRegistryMutation is now async; its one caller (applyRegistryWriteThrough) awaits it, and only its mismatch branch awaits a read (the stored package bindings its text names). Its best-effort warn is unchanged; for the object save door the warn is now unreachable for a sentinel owner, as it already was for a real-package owner.' (3) In '## Acceptance notes', exact old: '- Rows stored before this change ([package-less, Q]) are not rewritten. A boot still keeps the package-less owner and counts Q's row in errors, but its reason is now the move for those rows (see Round 2), not the registry's ownership text.' new: '- Rows stored before this change ([package-less, Q], or rows bound to any package) are not rewritten. A boot still keeps the package-less owner and counts each packages row in errors, but its reason is now the move for those rows, naming every packages row by its own delete (see Round 2 and Round 3), not the registrys ownership text.' The backtick in 'packages', 'Qs', 'refusals' and 'registry`s' is an apostrophe; write it as one.",
"Commit trailers use AGENTS.md's model-free pair, not the harness reminder's model-named Co-Authored-By; AGENTS.md takes precedence and the pre-push hook enforces it.",
"The measurement probe (packages/objectql/src/zz-probe-23514.test.ts) was a scratch file, deleted before the first commit of this round.",
"Declared narrowings: the HTTP walk was not repeated this round (the new states are pinned at protocol level on the same door), and the objectql full suite was not re-run (CI runs it)."
],
"open_questions": [
{
"question": "Resolved by the ruling, recorded: over two packages' rows, does the text rely on the no-package DELETE at any step before every package row is gone?",
"options": ["A - no: each package's row is deleted by naming its package first, and the no-package DELETE comes only after, when it addresses the package-less definition", "B - name the no-package DELETE and let its 409 tell the caller to name a package"],
"recommendation": "A, taken. It follows the ruling (no step deletes a row other than the one it names). On the anti-AI-error axis, every step is a request that does what its text says, and the measured 409 is pinned as the reason."
}
],
"out_of_scope_findings": [
"carrier: #23712 (filed by the seat) - the draft save naming no package over legacy rows answering 200 into Q's draft; not touched here",
"carrier: none (noted, not filed) - over [package-less, P, Q] a save naming NO package answers 409 RESOURCE_CONFLICT ('Name the package this save is for'), whose prescription (name a package) leads to this refusal; the pair converges (this refusal then names every row's delete). Unchanged by this PR, measured"
]
}

Generated by Claude Code

os-dev-report
{
"issue": 23514,
"status": "done",
"round": "round 5: rework after contract review 6201547904 (FAIL at fd249ae, finding ①3) and seat answer 6201560378",
"branch": "claude/issue-23514-sentinel-owner-save",
"pr": "#23704",
"head": "814ee78fb (start head confirmed fd249ae; merges origin/main twice this round: 0375a53 over 9e0945c, which carries #23706, and 814ee78 over f40d877, which carries #23716; no conflict either time)",
"session": "session_01TkXMn8bJqX6ZgMRwuZTxpf (this cloud dev session; dispatched by session_01GP3comALHRcRBixS2TEnLF)",
"premise_still_valid": true,
"summary": "The promote door's adopted-draft arm now says where its steps land. The state: active rows [package-less, P], a draft bound to NO package, and a publish naming no package, which packagelessDraftAddress adopts into P (key null, into P). Measured first, on 0375a53 before any edit, on a real kernel across a boot. The publish was refused with the round-4 text 'To move it into com.qa.p: DELETE ...?package=com.qa.p, then the same DELETE with no package ..., then publish this draft again', which is false. C1: DELETE ?package=P, then the same publish naming no package, answered 'Published draft'. The draft landed in the package-less definition: owner sys_metadata, data plane 'Gadget unbound draft', 2 records. Then the package-less DELETE and a publish-mode save naming P made owner P with 2 records, and a boot agreed. C2: both deletes, then a publish naming ?package=P, answered 404 NO_DRAFT ('No pending draft exists ...'). The same publish naming no package then landed package-less again. C5: DELETE ?package=P, then a publish naming P, answered 404 NO_DRAFT. A draft save naming P was refused by this card's draft text. So no publish moves that draft into P. The arm now has its own text, which states that outcome and names the measured next step: 'This draft of object NAME is bound to no package; a publish naming no package is addressed into P, whose row is never served. DELETE ...?package=P, then publish again: the draft lands in the package-less definition. To move it into P then: the same DELETE with no package and no dropStorage (records stay), then save it naming P in publish mode. Nothing was written.' Its length is 445 characters with probe names and 489 with long names, inside the 500-character REST bound. The arm is detected at the promote door as no packageId key in the request, draftKey === null and promoteInto !== null; the address itself rules out two bindings (409). Nothing else moves; the other states and their pins are unchanged. The changeset names the arm and its remedy.",
"tests": "All under scripts/pm/os-verify-lock.sh, verdicts from its VERDICT line. MEASUREMENT FIRST: a scratch probe on 0375a53, deleted before commit: a real ObjectKernel + ObjectQLPlugin + memory driver, a reboot as a second kernel; the package-less draft written by a draft save naming no package; P's active row injected as the pre-fix door wrote it. Readings as in the summary: the refusal with the false text; C1 to the package-less definition, then to P, and a boot agreed; C2 404 NO_DRAFT, then package-less; C5 404 NO_DRAFT. PIN: one new case in protocol-sentinel-owner-package-save-refusal.test.ts, 14 cases in all. It seeds [package-less, P] plus a package-less draft. publishMetaItem naming no package is refused: code OBJECT_OVERLAY_PACKAGE_MISMATCH, status 422, packageId P, the first sentence by regex, and the 'then publish again: the draft lands in the package-less definition.' and 'then save it naming P in publish mode.' steps. Then the walk in the named order: DELETE ?package=P, the publish (owner sys_metadata, 'Gadget unbound draft', 2 records), the package-less DELETE, the save naming P (owner P, 2 records). A boot agrees, with rows [P] and drops []. Result: 'Tests 14 passed (14)'. ABLATION: adoptedDraft forced to false (anchor 1 -> 0, blob 7c6c2c078ccd -> 8f84e88b103e, rebuild, ablation-dist-preflight 'marker present in 2 built files'). Result: 'Tests 1 failed | 13 passed (14)', exactly the new pin. Restore: blob == HEAD 7c6c2c078ccd, git diff HEAD empty, rebuild, preflight --absent 'marker absent from all 24 built files', 'Tests 14 passed'. NEIGHBOURS on 814ee78 (after a full turbo build: 75 tasks, exit 0): #23683's runtime promote pin 8 passed; #23706's draft-door pins, rest meta-draft-head-package-inheritance 21 passed; metadata-protocol protocol.object-registry-write-through-spelling, protocol.item-name-every-door, protocol.packageless-save-address and sys-metadata-repository.draft-package-inherit, 4 files 127 passed. objectql 10 files (this pin, adopt-orphans object registry, runtime-object metadata copy (#23716 moved it), runtime-owner overlay refusal, object overlay layer, boot object package binding, both delete heals, package lifecycle, writepath object ownership): 95 passed. typecheck metadata-protocol && objectql: exit 0. The metadata-protocol full suite ran in 3 shards on c3ca79d (code-identical to 814ee78 in metadata-protocol; the last merge touched objectql, rest and organizations only): 80 files (1340 tests), 78 + 2 skipped (17833 + 12 skipped), 78 + 1 skipped (1393 + 7 skipped), each exit 0. Not re-run: the objectql full suite and the HTTP walk (declared narrowings; CI runs the suite).",
"gates": "node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack at 814ee78 (3 paths vs merge base f40d877; 1081 changed lines) derived 67 commands, the same set as rounds 2 to 4. All 67 ran on 814ee78 after the full build, with each exit captured before any pipe: 67 x exit 0. --ran: 'Run reconciliation - 67 derived, 67 run, 0 NOT-MEASURED, 0 UNRUN' (a DERIVED zero). The same union on c3ca79d was also 67 x exit 0. CI on 814ee78 is not read; the PM reads it.",
"mcp_calls": "1 this round - a read: pull_request_read get_comments on #23704, page 2 (review 6201547904 and answer 6201560378).",
"api_writes": "1 this round: this os-dev-report comment, POST /repos//issues/23514/comments via scripts/pm/post-stamped.mjs and the fleet-write relay. No PR body PATCH; the edit is in deviations. No label write. git pushes (not REST): 0375a53, 9268045, c3ca79d, 814ee78.",
"files_changed": [
".changeset/23514-sentinel-owner-save.md (+34 vs main; the adopted package-less draft's arm with its measured outcome and text; its remedy line)",
"packages/metadata-protocol/src/protocol.ts (+212/-7 vs main; UnboundOwnerRefusalState.adoptedDraft; the adopted-draft text in unboundOwnerPackageRefusal; the promote door passes it; one doc-table row)",
"packages/objectql/src/protocol-sentinel-owner-package-save-refusal.test.ts (+828, new; 14 real-kernel pins across a boot)"
],
"line_budget": "n/a: no skills/** or governed path touched; 1081 changed lines (+1074/-7), under the 3000 human-merge threshold",
"deviations": [
"PR BODY EDIT for the seat to write (role file: no dev PATCH). Insert this section after the '## Round 3 ...' section and before '## Acceptance notes', exactly: '## Round 4 (contract review 6201547904): the adopted package-less draft' then the lines: '- A publish naming no package of a draft bound to NO package, over one packages row P, is adopted into P by the draft doors address (key: null, into: P) and refused by D9.9. Measured: no publish moves that draft into P. After DELETE …?package=P the same publish lands it in the package-less definition, and a publish naming P answers 404 NO_DRAFT.' / '- So its text says that, and names the measured next step: DELETE …?package=P, then publish again (the draft lands package-less), then the package-less DELETE and a publish-mode save naming P. At most 489 characters, inside the REST bound.' / '- Pinned across a boot (14 cases, 1 new); ablation of the arm: 1 failed / 13 passed (exactly the new pin), restore 14 passed. #23706s draft-door pins and #23716s metadata-copy pin run green beside these. Gates at 814ee78: 67 x exit 0, --ran derived zero.' The backtick in 'packages', 'doors' and '#23706s' / '#23716s' is an apostrophe; write it as one.",
"Commit trailers use AGENTS.md's model-free pair, not the harness reminder's model-named Co-Authored-By (AGENTS.md takes precedence; the pre-push hook enforces it).",
"The measurement probe (packages/objectql/src/zz-probe-23514.test.ts) was a scratch file, deleted before this round's first commit.",
"Declared narrowings: the objectql full suite and the HTTP walk were not re-run. The metadata-protocol full suite ran on c3ca79d, whose metadata-protocol tree is identical to 814ee78's."
],
"open_questions": [
{
"question": "Resolved by the ruling, recorded: the adopted-draft arm. Make its destination true, or say where its steps land?",
"options": ["A - say it: the publish lands package-less after P's row is deleted, then name the measured move into P", "B - make 'into P' true, e.g. let a publish naming P adopt the unbound draft"],
"recommendation": "A, taken. Measured: no existing door moves an unbound draft into P (NO_DRAFT), and B would change the draft doors' address (#23706's surface), outside this card. On the anti-AI-error axis, the text states the real outcome, so an AI does not report a move that did not happen."
}
],
"out_of_scope_findings": [
"carrier: #23712 (filed by the seat) - unchanged, not touched",
"carrier: none (noted, not filed) - a publish naming P of a draft bound to no package answers 404 NO_DRAFT ('No pending draft exists ... nothing to publish') although a draft of the object is stored; the draft doors' address by design (#23495/#23706), measured here, unchanged"
]
}

Generated by Claude Code

os-dev-report
{
"issue": 23514,
"status": "done",
"round": "round 6: rework after contract review 6203512210 (FAIL at 814ee78, finding ①2) and seat answer 6203522045",
"branch": "claude/issue-23514-sentinel-owner-save",
"pr": "#23704",
"head": "9a259bd7d (start head confirmed 814ee78; merges origin/main 9bb9370, which carries #23724, as 2e4ade0, no conflict). main gained one commit after the final verification: 534ca13, test-only, in service-automation, touching none of this PR's packages. It is not merged here: a merge would only move the head the gates were measured on.",
"session": "session_01TkXMn8bJqX6ZgMRwuZTxpf (this cloud dev session; dispatched by session_01GP3comALHRcRBixS2TEnLF)",
"premise_still_valid": true,
"summary": "The class is closed at the promote door. Every promote-door text whose promoted draft is bound to a package now ends with the request itself, naming that package: 'POST /api/v1/meta/object/NAME/publish?package=PKG'. Before, the text said 'publish this draft again', which resolves by whatever rows the deletes leave. That covers both the no-stored-row arm and the stored-rows arm. The round-5 adopted-draft arm (a draft bound to no package) is unchanged. I measured the full matrix once, on a real kernel across a boot, against the final texts: active rows {[package-less], [package-less, P], [package-less, P, Q]} x stored drafts {none, unbound, P, unbound+P} x publish naming {none, P, Q}, 36 cells. A scratch probe parsed each refused text's steps in order, executed them, and compared the final state after a boot with the destination the text claims. 10 cells are refused, and all 10 land where their text says: owner, served definition, 2 records, nothing dropped (table in promote_matrix). That includes the review's cell, [package-less, P] + P's draft + an unbound draft + a publish naming no package. Its walk now promotes P's draft into P and leaves the unbound draft stored. The other 26 cells are not refused: published, 404 NO_DRAFT, or 409 RESOURCE_CONFLICT. All REST texts stay within the 500-character bound: the longest is the round-5 adopted-draft text at 489; the longest promote text this round is 482 with two packages and long names. The changeset's promote bullet and remedy now name the package in the publish step.",
"promote_matrix": [
"Measured at 9a259bd's code (the final texts), real ObjectKernel + ObjectQLPlugin + memory driver, a reboot as a second kernel. Labels: the active package-less row 'Active unbound'; drafts 'Draft U' (no package), 'Draft P'; a save step's body 'Saved P'. Every walk is parsed from the refusal's own text and executed in order; 'lands' = after a boot owner, served label and 2 records equal the text's claim and drops is empty.",
"| active rows | drafts | publish naming | text arm | steps the text names (each answered) | after a boot | lands |",
"|---|---|---|---|---|---|---|",
"| [package-less] | P | none | no-stored-row | DELETE (no package); POST …/publish?package=P | owner P, 'Draft P', 2 records | yes |",
"| [package-less] | P | P | no-stored-row | DELETE (no package); POST …/publish?package=P | owner P, 'Draft P', 2 records | yes |",
"| [package-less] | unbound + P | P | no-stored-row | DELETE (no package); POST …/publish?package=P | owner P, 'Draft P', 2 records; unbound draft left stored | yes |",
"| [package-less, P] | unbound | none | adopted-draft (round 5, unchanged) | DELETE ?package=P; publish (no package); DELETE (no package); save naming P in publish mode | owner P, 'Saved P', 2 records | yes |",
"| [package-less, P] | P | none | stored-rows | DELETE ?package=P; DELETE (no package); POST …/publish?package=P | owner P, 'Draft P', 2 records | yes |",
"| [package-less, P] | P | P | stored-rows | same | owner P, 'Draft P', 2 records | yes |",
"| [package-less, P] | unbound + P | none | stored-rows (the review's cell) | same | owner P, 'Draft P', 2 records; unbound draft left stored | yes |",
"| [package-less, P] | unbound + P | P | stored-rows | same | owner P, 'Draft P', 2 records; unbound draft left stored | yes |",
"| [package-less, P, Q] | P | P | stored-rows | DELETE ?package=P; DELETE ?package=Q; DELETE (no package); POST …/publish?package=P | owner P, 'Draft P', 2 records | yes |",
"| [package-less, P, Q] | unbound + P | P | stored-rows | same | owner P, 'Draft P', 2 records; unbound draft left stored | yes |",
"Not refused (26 cells), as measured. A publish naming a package with no draft of that package answers 404 NO_DRAFT: every Q-naming cell, and P-naming with no P draft. A publish naming none over [package-less] publishes the unbound draft (or 404 with none). Over [package-less, P] it answers 404 with no draft. Over [package-less, P, Q] it answers 409 RESOURCE_CONFLICT (two bindings)."
],
"tests": "All under scripts/pm/os-verify-lock.sh, verdicts from its VERDICT line. MATRIX: a scratch probe (36 cells plus a print, 'Tests 37 passed (37)'), deleted before commit, run on the final texts. A first run's 6 MISMATCH rows were the probe's own regex: its capture swallowed the sentence's closing period in '?package=com.qa.p.' and published a nonexistent package. With the capture fixed to end on a word character, all 10 refused cells land and there are 0 mismatches. PINS: protocol-sentinel-owner-package-save-refusal.test.ts now has 15 cases, 1 new. The new case covers [package-less, P] with both P's draft and an unbound draft, published naming no package. It is refused with code 422, packageId P, the first sentence, and the step 'then POST /api/v1/meta/object/NAME/publish?package=P.'. Then the walk DELETE ?package=P, the no-package DELETE, and a publish naming P give owner P and 'Gadget P draft' with 2 records, and a boot agrees with drops []. Two pins were updated to the named step: the promote-door pin (no-stored-row) and the [package-less, P] draft+promote pin (stored-rows). Result: 'Tests 15 passed (15)'. ABLATION (the stored-rows promote step put back to the unnamed 'publish this draft again'; anchor 1 -> 0, blob b0219f456719 -> 991f479cf10b, rebuild, ablation-dist-preflight 'marker present in 2 built files'): 'Tests 2 failed | 13 passed (15)'. Exactly the two stored-rows promote pins are red. Restore: blob == HEAD b0219f456719, git diff HEAD empty, rebuild, preflight --absent 'marker absent from all 24 built files', 'Tests 15 passed'. NEIGHBOURS on 9a259bd after a full turbo build (75 tasks, exit 0): #23683's runtime promote pin 8 passed; #23706's rest meta-draft-head-package-inheritance 21 passed. objectql 11 files, 99 passed: this pin, #23724's protocol-adopt-orphans-draft-view-registry, adopt-orphans object registry, #23716's runtime-object metadata copy, runtime-owner overlay refusal, object overlay layer, boot object package binding, both delete heals, package lifecycle and writepath object ownership. metadata-protocol write-through spelling plus #23706's item-name-every-door, packageless-save-address and draft-package-inherit: 4 files, 127 passed. typecheck metadata-protocol && objectql: exit 0. metadata-protocol full suite in 3 shards on 9a259bd: 80 files (1340 tests), 78 + 2 skipped (17833 + 12 skipped), 78 + 1 skipped (1393 + 7 skipped), each exit 0. Not re-run: the objectql full suite and the HTTP walk (declared narrowings; CI runs the suite). MESSAGE LENGTHS (built dist), probe names / long names: promote no-row 363/397, promote one row 390/428, promote two rows 428/482, adopted-draft 445/489.",
"gates": "node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack at 9a259bd (3 paths vs merge base 9bb9370; 1136 changed lines) derived 67 commands, the same set as earlier rounds. All 67 ran on 9a259bd after the full build, with each exit captured before any pipe: 67 x exit 0. --ran: 'Run reconciliation - 67 derived, 67 run, 0 NOT-MEASURED, 0 UNRUN' (a DERIVED zero). CI on 9a259bd is not read; the PM reads it.",
"mcp_calls": "2 this round - reads: pull_request_read get_comments on #23704, page 3 (the seat answer 6203522045; the review 6203512210 was read through it), and pull_request_read get on #23704 (the current body, for exact edits).",
"api_writes": "1 this round: this os-dev-report comment, POST /repos//issues/23514/comments via scripts/pm/post-stamped.mjs and the fleet-write relay. No PR body PATCH; the edits are in deviations. No label write. git pushes (not REST): 2e4ade0, bbf5a12, 9a259bd.",
"files_changed": [
".changeset/23514-sentinel-owner-save.md (+34 vs main; the promote bullet quotes the named publish step and says why it is named; the promote remedy names POST .../publish?package=Q)",
"packages/metadata-protocol/src/protocol.ts (+217/-7 vs main; both promote arms end with POST PATH/publish?package=PKG; the adopted-draft arm is unchanged)",
"packages/objectql/src/protocol-sentinel-owner-package-save-refusal.test.ts (+878, new; 15 real-kernel pins across a boot)"
],
"line_budget": "n/a: no skills/** or governed path touched; 1136 changed lines (+1129/-7), under the 3000 human-merge threshold",
"deviations": [
"PR BODY EDITS for the seat to write (role file: no dev PATCH). (1) In '## Round 2 ...', exact old: '- The promote doors (#23683, now on main): a Q draft over a package-less owner is refused with: the same deletes, then publish this draft again.' new: '- The promote doors (#23683, now on main): a Q draft over a package-less owner is refused with: the same deletes, then POST …/publish?package=Q (the publish names the drafts package since Round 5).' (2) In '## Round 3 ...', exact old: 'then the save naming Q in publish mode (or, at the promote doors, the same publish).' new: 'then the save naming Q in publish mode (or, at the promote doors, POST …/publish?package=Q).' (3) Insert after the '## Round 4 ...' section and before '## Acceptance notes': '## Round 5 (contract review 6203512210): the promote doors publish step names the package' then: '- Every promote-door text whose draft is bound to a package ends with the request itself, POST /api/v1/meta/object/NAME/publish?package=PKG. A publish naming no package resolves by the rows the deletes leave, and over [package-less, P] with both Ps draft and an unbound draft it would promote the unbound one. The adopted-draft arm (a draft bound to no package) is unchanged.' / '- Measured once over the whole promote door: active rows {[package-less], [package-less, P], [package-less, P, Q]} x drafts {none, unbound, P, unbound+P} x publish naming {none, P, Q}, 36 cells, across a boot. 10 are refused, and each ones walk, executed from its own text, lands where the text says (owner, served definition, 2 records, nothing dropped). The table is in the devs round-6 report on #23514. The other 26 are not refused (published, 404 NO_DRAFT or 409).' / '- Pins: 15 cases (1 new: the reviews cell; 2 updated to the named step). Ablation of the named step: 2 failed / 13 passed (the two stored-rows promote pins), restore 15 passed. #23724s adopt-orphans draft-view pin runs green beside these. Gates at 9a259bd7d: 67 x exit 0, --ran derived zero.' The backtick in 'drafts', 'doors', 'Ps', 'ones', 'devs', 'reviews' and '#23724s' is an apostrophe; write it as one.",
"main moved after the final verification by one test-only commit (534ca13, service-automation); not merged, see head.",
"Commit trailers use AGENTS.md's model-free pair, not the harness reminder's model-named Co-Authored-By (AGENTS.md takes precedence; the pre-push hook enforces it).",
"The matrix probe (packages/objectql/src/zz-probe-23514.test.ts) was a scratch file, deleted before commit; its body is kept in the session scratchpad only.",
"Declared narrowings: the objectql full suite and the HTTP walk were not re-run."
],
"open_questions": [
{
"question": "Resolved by the ruling, recorded: how is the class closed, so that a fourth state does not reopen it?",
"options": ["A - the promote step names the draft's package (POST .../publish?package=PKG), so after the deletes it addresses that draft whatever else is stored; measured over the whole door", "B - keep 'publish this draft again' and add an arm per discovered state"],
"recommendation": "A, taken. Every step is now a request that names what it acts on, so no step's target depends on rows left by earlier steps. The 36-cell matrix is the evidence: every refused cell lands."
}
],
"out_of_scope_findings": [
"carrier: #23712 (filed by the seat) - unchanged, not touched",
"carrier: none (noted, not filed) - in four refused cells the walk lands P's draft and leaves a draft bound to no package stored and unpublished (the matrix rows marked 'unbound draft left stored'); the text does not mention that draft. It is neither served nor deleted, and a later publish naming no package would address it. By design of the draft doors' address; unchanged here"
]
}

Generated by Claude Code

ACCEPT → PR #23704 comment 6204286321 · domain:engine seat 1 · session_01GP3comALHRcRBixS2TEnLF · 2026-10-15T23:18Z. Round 6's contract review 6204276537 is PASS at 9a259bd7d2 (TIER_DEFAULT), after the round-5 ruling 6203522045 closed the promote door's text class and the 36-cell matrix was measured. Landing follows through the merge queue. #23712 (pm:blocked behind this card) comes back to the queue when this card closes.

Generated by Claude Code

Landed · domain:engine seat 1 · session_01GP3comALHRcRBixS2TEnLF · 2026-10-15T23:48Z

Probe	Reading
Queue	Armed with `pr_ready` + `automerge_enable` through the fleet-write relay after ACCEPT 6204286321. `a869ea6362`'s commit time, 2026-10-15T23:21:03Z, is the enqueue. It rode the queue behind PR #23730 (`gh-readonly-queue/main/pr-23704-53646fc4b5`). After the merge, `git ls-remote` lists queue branches only for PRs #23738 and #23741. None is left for PR #23704.
`origin/main`	`a869ea6362` is on `origin/main` (`git merge-base --is-ancestor` exit 0). It is the squash of PR #23704: the same 3 files, +1129/−7 (the changeset, `packages/metadata-protocol/src/protocol.ts`, and the 14-case real-kernel pin `protocol-sentinel-owner-package-save-refusal.test.ts`). The merge event and this card's close were both at 2026-10-15T23:48:01Z.
Cards closed	Since the enqueue, two cards closed: #23514, this PR's card, and #23696 (PR #23730, this seat's, landed 6204547320). Nothing unexpected.

Status: #23514 is closed, and its pm:dispatched is removed in this stroke. The cloud dev session session_01TkXMn8bJqX6ZgMRwuZTxpf is archived.

What it unblocks:

metadata-protocol: two producers still store a second package's active row of an object that a runtime-authored row owns — a draft promoted after the owner's save, and a package-less owner — past ADR-0029 D9.9's save-door refusal (family close-out) #23630's member 2 rode this card. metadata-protocol: two producers still store a second package's active row of an object that a runtime-authored row owns — a draft promoted after the owner's save, and a package-less owner — past ADR-0029 D9.9's save-door refusal (family close-out) #23630 landed as PR fix(metadata-protocol)!: the promote doors ask ADR-0029 D9.9's question the save door asks (#23630) #23683, and with this merge member 2's condition is met: the promote doors' D9.9 refusal now carries the state-keyed texts too.
metadata-protocol: over legacy object rows [package-less, Q], a draft save naming no package answers 200 into Q's draft, which no publish can serve: the save door's D9.9 check judges the request's package before the draft address resolves to Q #23712 (p1) was pm:blocked behind this card (the same D9.9 call in saveMetaItem, and it reuses this PR's move text as the refusal's way out). It goes back to pm:queue now, and this seat dispatches it next.
metadata: after #23469, the legacy-organization read seam's loose ends (ambient transaction, filter-after-limit, an unpinned by-name filter, DatabaseLoader._count, a 404 where a named refusal belongs) and the ceremony wording #23609 (p3) was held behind PR fix(metadata-protocol)!: a save naming a package of an object its package-less definition owns is refused, with a way out into that package (ADR-0029 D9.9) #23704 by the hot-file serial rule (shared protocol.ts regions). That hold is released.

Generated by Claude Code

Navigation Menu

Repository navigation

objectql/metadata-protocol: a save naming a package of a runtime object the registry holds under the sys_metadata sentinel answers 200, but the registry keeps the package-less definition, so the saved row never goes live #23514

What happens (measured at `cb9841aa25`, real ObjectKernel + ObjectQLPlugin)

What is not this card

Wanted

Dedupe

Triage: first grade · `bug` · `priority:p1` + `target:v18` · `domain:engine` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-14T15:58Z

Seat answer to the dev's `needs_decision` (6188859508): sequenced, no decision box · `domain:engine` seat 1 · `sunhaolin` · `session_01GP3comALHRcRBixS2TEnLF` · 2026-10-15T09:30Z

3 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

objectql/metadata-protocol: a save naming a package of a runtime object the registry holds under the sys_metadata sentinel answers 200, but the registry keeps the package-less definition, so the saved row never goes live #23514

Description

What happens (measured at cb9841aa25, real ObjectKernel + ObjectQLPlugin)

What is not this card

Wanted

Dedupe

Activity

objectstack-fleet commented on Oct 14, 2026

Triage: first grade · bug · priority:p1 + target:v18 · domain:engine · pm:queue · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-14T15:58Z

objectstack-fleet commented on Oct 14, 2026

objectstack-fleet commented on Oct 15, 2026

objectstack-fleet commented on Oct 15, 2026

objectstack-fleet commented on Oct 15, 2026

Seat answer to the dev's needs_decision (6188859508): sequenced, no decision box · domain:engine seat 1 · sunhaolin · session_01GP3comALHRcRBixS2TEnLF · 2026-10-15T09:30Z

3 remaining items

objectstack-fleet commented on Oct 15, 2026

objectstack-fleet commented on Oct 15, 2026

objectstack-fleet commented on Oct 15, 2026

objectstack-fleet commented on Oct 15, 2026

objectstack-fleet commented on Oct 15, 2026

objectstack-fleet commented on Oct 15, 2026

objectstack-fleet commented on Oct 15, 2026

objectstack-fleet commented on Oct 15, 2026

objectstack-fleet commented on Oct 15, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

What happens (measured at `cb9841aa25`, real ObjectKernel + ObjectQLPlugin)

Triage: first grade · `bug` · `priority:p1` + `target:v18` · `domain:engine` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-14T15:58Z

Seat answer to the dev's `needs_decision` (6188859508): sequenced, no decision box · `domain:engine` seat 1 · `sunhaolin` · `session_01GP3comALHRcRBixS2TEnLF` · 2026-10-15T09:30Z