[objectstack-fleet]

domain:server#2 · os-sales · session_01L6bhgUCizoYWQVJWjhdR6F

Requested by Sales · project thread

Fixes #27707

Clause-②: no
Metadata-protocol: none
Skills-docs: none — a refusal-order change with no new authorable capability; nothing in skills/** teaches the promotion's refusal order.

维护者速读

• 改了什么: 草稿发布(promotion)时,权限集"重名"检查改为只在确实读到草稿时才执行,与其他三个同类检查一致;另在 objectql 注册表的私有成员上加一行注释,注明 metadata-protocol 按名字调用它。
• 为什么改: 以前没有草稿却去发布一个别人已占用名字的权限集,会先报 NAMESPACE_CONFLICT(别人的事),而不是 NO_DRAFT(调用方自己没草稿);现在先告诉调用方它自己的状态。
• 风险与回滚: 极低——只是"拒绝换拒绝"的顺序调整,无草稿时之前和现在都拒绝,有草稿时检查与顺序不变;回滚即 revert 本 PR。
• 先看: packages/metadata-protocol/src/protocol.ts(promotion 处 if (draftForGate) 一处);packages/metadata-protocol/src/protocol.permission-set-name-cross-package.test.ts(新增一条 pin);packages/objectql/src/registry.ts(仅注释)。
• 两分钟验证: pnpm --filter @objectstack/metadata-protocol exec vitest run --maxWorkers=2 src/protocol.permission-set-name-cross-package.test.ts,预期 18/18 通过。
• 需要你做的: 无,席位落地。

What changes

• packages/metadata-protocol/src/protocol.ts, the draft promotion (publishMetaItem's promotion step, which publishPackageDrafts also goes through): the permissionSetNameCollisionRefusal call now sits under if (draftForGate), like its siblings savedItemNameRefusal, permissionSetOwnerBindingRefusal, defaultRecordPageSaveRefusal and externalBindingSaveRefusal. Before, it ran in a bare block.
• Refusal before/after. If you promote with no draft while another owner holds the name, the answer used to be NAMESPACE_CONFLICT / 422 and is now NO_DRAFT / 404, the repository's answer from repo.promoteDraft.
• The accept set does not change. With draftForGate null, repo.promoteDraft gets expectedDraftHash: null. It then answers NO_DRAFT when no draft row exists, or DraftConflictError when a draft was saved after the gate read. A promotion with no judged draft never succeeds, before or after this change. With a draft, the same refusals run in the same order.
• packages/objectql/src/registry.ts: the doc comment of the private packageHeldSecurityCatalogNames now says that protocol-save-door-refusals.ts (registryPackageHoldersOf) reads it by name. Renaming the member means updating that caller and protocol-permission-set-name-registry-reading.test.ts. This is a comment only.
• Changeset: patch for @objectstack/metadata-protocol. objectql gets none because its change is a comment, so nothing published changes.

Tests

• New pin, through the real promotion door (publishMetaItem, using the harness the PR harden(metadata): a permission set's name is unique across packages #27535 tests use): B holds the active name and A has no draft. Promoting as A answers NO_DRAFT / 404 and leaves only B's active row stored.
• Control, a draft plus a collision: the existing pins still answer NAMESPACE_CONFLICT / 422, for both publishMetaItem and publishPackageDrafts.
• Control, a clean promote: the existing CONTROL pin still succeeds, for a first publish and a re-publish.

Acceptance notes

• None out of scope.

Verification

Red before the fix (test committed first, 83e4daa)

× with no draft at the address, the caller is told about its own state first: the repository's NO_DRAFT (404), not the collision another owner's name would raise
Expected: "NO_DRAFT"
Received: "NAMESPACE_CONFLICT"
Tests  1 failed | 17 passed (18)

Ablation (scripts/ablation-replace.mjs) on the fix commit

Anchor if (draftForGate) { + newline + const nameCollision was replaced by if (true /* ablation: guard removed */) {, landing x1 to x0, blob 5fb0787b to 2d3ef72c.

× with no draft at the address ... Expected: "NO_DRAFT" Received: "NAMESPACE_CONFLICT"
Tests  1 failed | 17 passed (18)
ok restored: blob == HEAD (5fb0787b1465) and `git diff HEAD` is empty

The first ablation attempt used a replacement that was a substring of the anchor. The tool refused it before running anything and restored the file (blob == HEAD), so that attempt was a no-op and is not counted as a reading.

Local gates at 98bfa9d (after merging origin/main 8f25cee)

• @objectstack/metadata-protocol test: 280 files passed, 4 skipped; 21803 tests passed, 26 skipped. Exit 0.
• @objectstack/objectql test: 490/490 files, 9244/9244 tests. Exit 0.
• typecheck for both packages: exit 0.
• eslint --no-inline-config on packages/metadata-protocol and packages/objectql: exit 0 each.
• dispatch-gates --commands: 63 families derived, and every one exits 0. check:dual-build-cjs-loads and check:type-check-debt exited 3 (PREREQUISITE NOT MET) the first time and exited 0 when re-run after the build. --ran reconciliation: 63 run, 0 NOT-MEASURED (a derived zero).
• Overlap check: git merge-tree against fix(metadata-protocol): an object draft's verdict names the namespace-prefix refusal its publish gives (#27444) #27780 (the other open PR on protocol.ts) is clean. No other open PR touches these files.
• Dogfood: not owed, because the title has no ! and there is no (narrowing) arm.

---

Generated by Claude Code

🤖 Generated with Claude Code

https://claude.ai/code/session_01L6bhgUCizoYWQVJWjhdR6F

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/metadata-protocol, @objectstack/objectql, touching 2 documentable anchor(s).

5 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/concepts/metadata-lifecycle.mdx (via SchemaRegistry (symbol, a top-level class))
• content/docs/deployment/environment-variables.mdx (via SchemaRegistry (symbol, a top-level class))
• content/docs/kernel/services-checklist.mdx (via SchemaRegistry (symbol, a top-level class))
• content/docs/plugins/adding-a-metadata-type.mdx (via SchemaRegistry (symbol, a top-level class))
• content/docs/protocol/kernel/plugin-spec.mdx (via SchemaRegistry (symbol, a top-level class))

⛔ 1 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17/17-4.mdx (via SchemaRegistry (symbol, a top-level class))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• the SDK route bridge reached 58 of 210 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 25 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 359e935df26ddb067a9a60e2a7f81c5f80256bcb → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 36429185a802dfa0ed0bfad509def0b4b5a5d5b7 — the merge of head 98bfa9de317fa46d6f62ab3725c20c39e3808cb1 into base 359e935df26ddb067a9a60e2a7f81c5f80256bcb, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 36429185a802dfa0ed0bfad509def0b4b5a5d5b7 && git checkout 36429185a802dfa0ed0bfad509def0b4b5a5d5b7
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 359e935df26ddb067a9a60e2a7f81c5f80256bcb 98bfa9de317fa46d6f62ab3725c20c39e3808cb1 && git checkout -B drift-repro 359e935df26ddb067a9a60e2a7f81c5f80256bcb && git merge --no-ff 98bfa9de317fa46d6f62ab3725c20c39e3808cb1

node scripts/docs-audit/affected-docs.mjs --json 359e935df26ddb067a9a60e2a7f81c5f80256bcb

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 359e935df26ddb067a9a60e2a7f81c5f80256bcb → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

domain:server#2 · os-sales · session_01L6bhgUCizoYWQVJWjhdR6F

维护者速读(席位终稿)

• 改了什么:发布(提升)草稿时,权限集重名判断 permissionSetNameCollisionRefusal 现在和它的四个兄弟判断一样,只在读到草稿时才运行。没有草稿、而另一个所有者占着这个名字时,调用方先拿到关于自己状态的 NO_DRAFT(404),不再是 NAMESPACE_CONFLICT(422)。另给 objectql 注册表的一个私有成员补了调用方注释。
• 为什么改:harden(metadata): a permission set's name is unique across packages #27535 合同审查留下的两条非阻塞建议:拒绝顺序与兄弟判断一致,私有成员改名时能在源头失败。
• 风险与回滚:只是拒绝换拒绝。没有草稿时提升本来就不会成功;有草稿时同样的拒绝、同样的顺序。回滚 = revert 本 PR。
• 先看:packages/metadata-protocol/src/protocol.ts 提升路径里 if (draftForGate) 那一处。
• 两分钟验证:pnpm --filter @objectstack/metadata-protocol exec vitest run src/protocol.permission-set-name-cross-package.test.ts,预期 18/18。
• 需要你做的:无。非受管面,席位落地。

席位意见: ACCEPT。按分诊把重名判断放进与兄弟一致的守卫;接受集不变。

席位核对

ACCEPT · head 98bfa9de317fa46d6f62ab3725c20c39e3808cb1 · 2026-10-30T01:20Z

• 形态: 4 files, +33/−1: one guard in protocol.ts, one pin, a comment-only note in objectql registry.ts, one changeset. No packages/spec, no governed path; Tier S.
• Clause-②: no, Metadata-protocol: none, patch. Refusal for refusal. The seat checked that draftForGate is read for every type at the promotion and that repo.promoteDraft's expected draft hash comes from it, so with no draft the promotion fails either way (NO_DRAFT or a draft conflict); no promotion that used to fail now succeeds.
• 前提实测: the new pin red before the fix (expected NO_DRAFT, received NAMESPACE_CONFLICT); ablation of the guard red, restored to the HEAD blob; the draft-plus-collision controls stay NAMESPACE_CONFLICT.
• 门禁 check-runs: 52 on this head: 37 success, 15 skipped, 0 other (read 2026-10-30T01:20Z); mergeable_state: clean. Derived gates 63/63 exit 0 after the full build, 0 NOT-MEASURED; metadata-protocol 21803 tests, objectql 9244/9244; git merge-tree clean against fix(metadata-protocol): an object draft's verdict names the namespace-prefix refusal its publish gives (#27444) #27780 (merged since).
• 接受的偏差: objectql's test:repo project left to CI Test Core (the objectql change is a comment); the report signature line.
• 范围外去向: none.
• 散文面: changeset and both comments checked against the diff by the seat.
• 落地条款: relay pr_ready + automerge_enable through the merge queue.