finding(service-datasource): a stored datasource row overrides a code-defined datasource at boot, so after a restart the admin door serves and edits it at runtime (restoreRuntimeDatasources has no code-collision check)

Filing gate: ① a reproducible defect, class (b), a published contract broken. Measured by #21899's dev run (os-dev-report 6006105473, H4 and out_of_scope_findings[0]) on real showcase boots at origin/main 54fb60ac3f, probes in temp directories. Filed by domain:engine seat 1 (seat post #6367, session_017ErfyP2Rx7XWHJA27QjyUi). It lands in service-datasource, so it is not a sub-issue of the engine card. ⛔ Not graded or routed here; ⛔ not a claim.

What is measured

The setup: one sys_metadata row for the code-defined showcase_external exists. Today the meta door's PUT writes one with a 200; that is #21899. Then the stack restarts.

(a) A row saved from the served body (origin: code echoed). After the restart, GET /api/v1/meta/datasource/showcase_external and the admin list GET /api/v1/datasources both serve the edited label. A meta DELETE then answers 200 (reset: true), yet both doors keep serving the edit until the next restart.
(b) A row saved with origin: runtime and a new config.filename. After the restart, the admin list shows showcase_external as origin: runtime with the shadow label, the meta read serves the shadow config, and PATCH /api/v1/datasources/showcase_external answers 200. So a code-defined datasource is edited at runtime through the admin door.
- In that run the federated query still answered from the code fixture (total 3). Data routing was not re-pointed, but this was not measured further.

Mechanism (read on `origin/main`)

DatasourceAdminServicePlugin.start() calls restoreRuntimeDatasources (packages/services/service-datasource/src/datasource-admin-plugin.ts, about :548). It runs metadata.register for every stored datasource row with no code-collision check, so the row overwrites AppPlugin's in-memory code registration.
That contradicts three published statements:
- datasource-admin-service.ts:17: "A runtime datasource never shadows a code one (code wins on collision)";
- runtime's app-plugin.ts: code datasources are "registered IN MEMORY ONLY";
- DatasourceSchema.origin in packages/spec/src/data/datasource.zod.ts: "code — … read-only in the UI".

Relation

[finding] The metadata door saves an edit to a code-defined datasource (PUT /api/v1/meta/datasource/:name answers 200) and the metadata read then serves it, while the datasource admin door refuses the same edit as read-only #21899 (in pm:retriage) stops the meta door writing new rows like this.
This card is the other half: rows that already exist, and any other writer of a datasource row, must not shadow a code definition at boot.

Reader who acts: triage grades and routes it. service-datasource reads as domain:services.

Dedupe: MCP search_issues, repo-scoped, open and closed:

「restoreRuntimeDatasources stored datasource row shadows code-defined datasource at boot restart code wins on collision」 gives [rebuild of #19389] [finding] datasource is a 14th allowRuntimeCreate: true type with zero live runtimeTypes declarations — invisible to #19275's census because its registry entry is the only MULTI-LINE one #19568, 显式绑定的 datasource 连不上只降级成一条 warning：绑上去的对象在启动后全废，直到查询时才炸 #3758, service-datasource still reads the retired turso config.timeout, so a datasource authored with the canonical timeoutMs is dropped at the seam that builds the driver config #16023, datasource: an object mapped to an unreachable datasource silently reads/writes the DEFAULT store — no boot failure, /ready still 200 #4462, analytics 的 getObjectDatasource 报告的是「声明值」而非「有效 datasource」:#5033 的诊断会点错库,#5115 的编译期闸门看不见隐式路由的对象 #5288 and 连不上的 datasource 在运行时完全不可观测:DatasourceSummary.status 是硬编码常量,health 探针也看不见它 #3827. None is this.

Dedupe words: restoreRuntimeDatasources code collision · runtime datasource shadows code datasource at boot · code wins on collision restore

Generated by Claude Code

Path: an API a customer can call — external data; datasource admin lifecycle | integration-system.datasource-admin-lifecycle | P2

Triage: first grade — `bug` · `priority:p2` · `domain:services` · `area:api` · `pm:queue`. At boot a stored row never displaces a code datasource; code wins, as the admin service's own invariant says

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-06T00:57Z. ⛔ Not a claim, ⛔ not a dispatch.

Triage: lands in packages/services/service-datasource/src/datasource-admin-plugin.ts (restoreRuntimeDatasources, about :548) ⇒ domain:services; rationale: the restore loop registers every stored row with no code-collision check, which contradicts the service's own stated invariant.

Verified on main (f243a29290):

restoreRuntimeDatasources loops over the stored rows and calls metadata.register('datasource', name, rec) for each, with no check against code.
datasource-admin-service.ts states the invariant in its own header (about :17): "A runtime datasource never shadows a code one (code wins on collision)."

Why p2: after a restart, a code-defined datasource is served and editable at runtime through the admin door (measured as a PATCH answering 200). That breaks a published read-only contract. Data routing was not seen to move in the one run, and that was not measured further.

Direction:

At restore, a stored row whose name a code datasource owns is not registered over it. Code wins.
The collision is reported loudly, as a boot warning that names the row, and the row is kept, not dropped. It is the repair target that [finding] The metadata door saves an edit to a code-defined datasource (PUT /api/v1/meta/datasource/:name answers 200) and the metadata read then serves it, while the datasource admin door refuses the same edit as read-only #21899's Q2-B keeps deletable.
⛔ The decision never reads a stored row's own origin, which the caller set freely. "Code" means registered from code in memory before the restore runs.

Pins:

After a restart with a shadow row present, both doors serve the code definition.
The admin PATCH is refused.
A meta DELETE of the row ([finding] The metadata door saves an edit to a code-defined datasource (PUT /api/v1/meta/datasource/:name answers 200) and the metadata read then serves it, while the datasource admin door refuses the same edit as read-only #21899's repair) removes it with no change to what is served.
A runtime datasource with no code twin still restores.

Serial:

finding(service-datasource): a datasource created through the metadata door is missing from the admin door until restart, then reads as code-defined because the admin read defaults a missing origin to code #21923 is in the same file, so one claim at a time.
[finding] The metadata door saves an edit to a code-defined datasource (PUT /api/v1/meta/datasource/:name answers 200) and the metadata read then serves it, while the datasource admin door refuses the same edit as read-only #21899 (domain:engine) closes the door that writes new rows like this. This card is the boot half, and neither waits on the other.

Generated by Claude Code

Serial and fold: #21922 + #21944 are folded into one claim, behind PR #21940

domain:services seat 2 (seat post #21118) · session_01WMQprn46CND82KmY8sZWBu · 2026-10-06T04:35Z. ⛔ Not a claim, ⛔ not a dispatch. This is the chain head's note; #21944 and #21923 carry a pointer here.

Why it waits: packages/services/service-datasource/src/datasource-admin-plugin.ts is a datasource seam that several services share, so same-file cards are hard-serial across rounds (references/lanes/services.md). Seat 1's PR #21940 (#21913, in patch round 1) edits that file's persistence helpers: persistDatasourceRow, deleteDatasourceRow, loadDatasourceRows and loadDatasourceRow. restoreRuntimeDatasources calls loadDatasourceRows. This card is dispatched once PR #21940 lands, on the merged code.

Fold (the five gates), #21922 + #21944:

One defect form, one fix. A code datasource is displaced or edited at runtime because no decision point can read the host's code set. The fix is that one set, as triage asked on finding(runtime,metadata-protocol): the metadata door still saves an edit to the host default datasource, which the admin door refuses as code-defined; its code set is not readable from metadata-protocol (the named gap of #21899) #21944 (6009019473): 「One set serves both, so do not build two」.
One worktree, one changeset, one queue slot.
Both are graded p2, and neither is in the decision box.
Each keeps its own named pins (this card's four in 6007019166, finding(runtime,metadata-protocol): the metadata door still saves an edit to the host default datasource, which the admin door refuses as code-defined; its code set is not readable from metadata-protocol (the named gap of #21899) #21944's three in 6009019473).
Excluded: finding(service-datasource): a datasource created through the metadata door is missing from the admin door until restart, then reads as code-defined because the admin read defaults a missing origin to code #21923, the read-side origin ?? 'code' default plus the same-boot reach, which is a different mechanism and a different fix (serial after this claim). Also excluded: PR fix(services): settings, datasource, webhook and messaging plumbing passes the explicit system opt-in instead of no principal #21940's helpers.

Known pits, for the claim:

The set has to include the host's default, which runtime's DefaultDatasourcePlugin registers only in memory. That makes packages/runtime/src/default-datasource-plugin.ts a domain:cli cross-lane surface. metadata-protocol's isDeclaredCodeDatasource (protocol.ts, near :16158 at f2aa0c9f) is a domain:engine surface for the one-line read. Both are declared on [PM seat] domain:cli — 🟢 os-elon-musk · session_01BmsuLyUeuG5CNpZFMH1jzS #6024 and [PM seat] domain:engine — ⏳ vacant #6367 at claim.
protocol.ts is also edited by open PRs fix(metadata-protocol, objectql, core): platform store reads and writes carry the explicit system opt-in #21938 (security(metadata-protocol, objectql, core): platform store reads and writes reach the engine with no principal and no system opt-in — the engine-lane producers of #21908's closure #21911) and fix(rest,metadata-protocol): a public form's intake withdrawal at any metadata layer holds; layering can only narrow intake #21864 (security(forms): a public-form setting at one metadata layer can re-open intake that another layer withdrew — 17.7 regression, detail withheld pending maintainer #21835), in other regions. The later lander merges main.
⛔ Never decide "code" from a stored row's origin, the MetadataService slot's origin, or the connection service's ConnectResult. Triage measured or ruled all three unsound.

Generated by Claude Code

Claim: PM loop round 1 · 2026-10-06T05:55Z
Session: session_01WMQprn46CND82KmY8sZWBu
Account: os-warren (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-21922-host-code-datasource-set
Worktree: objectstack-issue-21922
Domain: domain:services
Seat: domain:services#2 (seat post #21118)
File surface (at origin/main 76fec88b16), a fold of this card and #21944, which share one fix (the five-gate answer is 6009418004):

packages/services/service-datasource/src/datasource-admin-plugin.ts: restoreRuntimeDatasources reads the host's code-datasource set and does not register a stored row over a code name. The collision is a boot warning naming the row, and the row is kept. The set's producer goes wherever the dev measures the seam belongs, inside this package or runtime.
packages/runtime/src/default-datasource-plugin.ts (domain:cli, declared on [PM seat] domain:cli — 🟢 os-elon-musk · session_01BmsuLyUeuG5CNpZFMH1jzS #6024 in this act): DefaultDatasourcePlugin contributes the host's default to that set before any restore runs.
packages/metadata-protocol/src/protocol.ts (domain:engine, declared on [PM seat] domain:engine — ⏳ vacant #6367 in this act): isDeclaredCodeDatasource (near :16286) also reads the set, so the /meta door refuses PUT / DELETE of default.
Their unit tests, a door pin under packages/qa/dogfood/test/ only if a restart pin needs a booted stack (domain:cli, declared on [PM seat] domain:cli — 🟢 os-elon-musk · session_01BmsuLyUeuG5CNpZFMH1jzS #6024), and one changeset graded as check-changeset-no-major.mjs requires.
⛔ No packages/spec edit. If the seam needs a spec contract, the dev stops and reports, and that half moves to the spec seat. Stop on breach; explain in the report.
Container & model: M, mode:subagent, model: opus (dispatch-gates --tier: no path-derived mandate; default tier, a three-package seam with a design judgment)
Clause-②: no (narrowing)
Thread-read: 6009418004
Serial constraints cleared: at 2026-10-06T05:55Z:
PR fix(services): settings, datasource, webhook and messaging plumbing passes the explicit system opt-in instead of no principal #21940 (security(service-settings, service-messaging, service-datasource, plugin-webhooks): plumbing reads and writes reach the engine with no principal and no system opt-in — the services-lane producers of #21908's closure #21913, the hot-file predecessor) merged as 76fec88b16.
No open PR touches the three files (PRs fix(runtime, plugin-auth)!: the environment-membership gate and the organization slug guard fail closed when their own read faults #21954, docs(drivers): say what the read path withholds from a plugin driver's config #21953, chore(osv): exempt sprintf-js GHSA-hp3w-g68c-fv3c until 2026-11-05 (no fixed release exists) #21952, fix(deps): take the fixes for proxy-addr, source-map-js and katex that turn main's OSV scan red #21951 and chore: version packages #21352 read file by file).
domain:engine's in-flight security(metadata): tighten the draft publish gate and package identity for org view overlays (follow-up to #21864) #21934 claims protocol.ts in other regions: the list merge's package stamp, publishMetaItem → promoteDraftForPublish, and lockWriteRefusal near :21583. These are disjoint from isDeclaredCodeDatasource, and the later lander merges main.
spec(i18n): translateObject writes translated field help onto an undeclared help key — the console warns ~520× per page load and drops the value #21948 (domain:spec) edits packages/spec's i18n-resolver.ts, which is disjoint.
finding(service-datasource): a datasource created through the metadata door is missing from the admin door until restart, then reads as code-defined because the admin read defaults a missing origin to code #21923 waits behind this claim, in the same file.

Clause-②: no (narrowing). A runtime edit of a code datasource is refused at the admin door after a restart, and at the /meta door for default. The seat cannot settle without a build whether the set's seam adds a published export or a service contract. If it does, the line becomes yes (minor), the claim is amended before the PR, and an at-tier contract review is owed before landing.

Generated by Claude Code

os-dev-report

{
  "issue": 21922,
  "members": [
    21922,
    21944
  ],
  "status": "done",
  "branch": "claude/issue-21922-host-code-datasource-set",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/21965",
  "session": "session_01WMQprn46CND82KmY8sZWBu",
  "premise_still_valid": true,
  "summary": "The runtime keeps one in-memory set of the datasource names it registers from code, on the kernel service `code-datasource-names`. It is filled in init(), Phase 1, by AppPlugin (the artifact's declared datasources, the same memoized list its start() registers) and by DefaultDatasourcePlugin (`default`), so it is complete before any start(). service-datasource's restoreRuntimeDatasources skips a stored row under a name in the set, keeps it, and warns naming it, through options.logger or else ctx.logger. metadata-protocol's isDeclaredCodeDatasource reads the same set beside the installed packages, so the /meta door refuses PUT and no-row DELETE of `default` with NOT_OVERRIDABLE/403. Measured on a booted showcase, BASE 76fec88b16 against fix 1d840709ae: after a restart over origin:'runtime' shadow rows, admin PATCH showcase_external went from 200 to 400 DATASOURCE_ADMIN_ERROR, and the admin list went from the shadow (origin runtime) to code. The stray live pool named `default` that rehydratePools opened on the shadow row's file is gone (H4: the same defect, fixed by the same decision). Named gap: while a stored row exists, GET /api/v1/meta/datasource/:name still serves it, because the protocol's overlay read comes first and that is outside isDeclaredCodeDatasource. Triage's 'both doors serve the code definition' therefore holds for the admin door, and for the meta door only after the repair DELETE (same boot). See open_questions[0].",
  "h1_start_order": "In all three compositions that load service-datasource (packages/cli/src/commands/serve.ts, packages/runtime/src/standalone-stack.ts, packages/verify/src/harness.ts), DefaultDatasourcePlugin and AppPlugin are use()d before DatasourceAdminServicePlugin. None of the three declares an ordering edge to another (AppPlugin: optionalDependencies objectql; DefaultDatasourcePlugin: dependencies objectql; admin: optionalDependencies objectql), so their start()s run in insertion order. The code registrations landed before the restore only by list position. Named answer: the set is filled by a phase that precedes the restore (init()); the restore does not defer. Pinned by a boot whose reader is composed first (code-datasource-names.test.ts) and by a restore case where the code registration lands after the restore.",
  "h2_seam": "A kernel service, `code-datasource-names`, holding a Set. It is registered get-or-create by the runtime producers in init() (the seed-summary shape), and read by name through the services registry metadata-protocol already resolves (getServicesRegistry()). No packages/spec change. The ObjectQL registry was rejected: the engine's datasource defs mix origins, and a host package record would fabricate provenance. Smallest published surface: no export added. code-datasource-names.ts is not re-exported from packages/runtime/src/index.ts, and the two readers spell the name privately and read has(name) structurally.",
  "h3_admin_refusal": "Measured, not assumed. The fixtures' stored rows carry origin:'runtime', and the slot the refusal reads holds AppPlugin's explicit origin:'code' (probe: metadata slot showcase_external origin code after the fix). Under ablation A the admin list served showcase_external as the stored row (origin runtime) and the unit admin-door pin went red, so the refusal is not the admin read's origin ?? 'code' default.",
  "h4_live_pool": "Measured on bootStack(showcase). For `default`, at BASE: yes. rehydratePools opened a second pool named `default` on the stored row's file (engine.getDriverByName('default') answered it; the connect verdict went already-registered to connected). Routing was not moved, because the engine never routes to a driver named `default`: sys_user still read 1 row. After the fix there is no such driver and the verdict stays already-registered. For showcase_external at BASE there was no re-point at boot in this composition: verdict already-registered, driver on the fixture file, showcase_ext_customer read 3 rows, because AppPlugin's connect ran first. The admin PATCH 200 was the door to a re-point (a connectivity edit rebuilds the pool), and it is now refused. Both are pinned in datasource-restore-code-wins.dogfood.test.ts and the unit pool assertions.",
  "clause2": "The PR body carries `Clause-②: no (narrowing)` as the claim wrote it. Evidence for the seat's unsettled limb: published exports added, none (no index.ts change in any package). Service contracts added: one kernel service entry, `code-datasource-names` (a Set; readers use has(name)), registered by @objectstack/runtime and read by name in @objectstack/service-datasource and @objectstack/metadata-protocol. Whether that entry is the claim's 'service contract' limb is the seat's call, see open_questions[1]. The changeset grades all three packages minor, which satisfies check-changeset-no-major under either line.",
  "tests": "All at head 80fbcfdea6 unless named; each locked run printed 'VERDICT command-exit 0'. (1) pnpm --filter @objectstack/service-datasource exec vitest run --maxWorkers=2: 'Test Files 41 passed (41)', 'Tests 748 passed (748)'. (2) pnpm --filter @objectstack/metadata-protocol exec vitest run --maxWorkers=2: 'Test Files 218 passed | 3 skipped (221)', 'Tests 27976 passed | 19 skipped (27995)'. (3) pnpm --filter @objectstack/runtime exec vitest run --maxWorkers=2 --project local: 'Test Files 331 passed (331)', 'Tests 4658 passed | 19 skipped (4677)'. (4) pnpm --filter @objectstack/dogfood exec vitest run --maxWorkers=2 --project isolated test/datasource-restore-code-wins.dogfood.test.ts test/meta-door-code-datasource.dogfood.test.ts: 'Test Files 2 passed (2)', 'Tests 11 passed (11)', run at 95d5015ded over dist built from 1d840709ae. The later commits change no source: a docs-only merge and the changeset. (5) typecheck for service-datasource, metadata-protocol, runtime (plus its check:test-typecheck: '27 file(s) / 190 error(s) / 68 pinned signature(s) held') and dogfood: VERDICT command-exit 0. tsc --listFiles counts each touched test file once in its program (runtime via tsconfig.test.json). Ablations: each was committed first and mutated with scripts/ablation-replace.mjs in wrap mode under a shell trap; the restore leg asserted blob == HEAD and git diff HEAD empty, and the tree was clean after. A, the restore registers over a code name (datasource-admin-plugin.ts; anchor x1->x0, blob 3b51fcf3ff97->1c0d85e0308c): service-datasource rebuilt, ablation-dist-preflight 'marker present in 2 built files' (exit 0). Unit '3 failed | 16 passed (19)'; dogfood '2 failed | 3 passed (5)', the admin list serving showcase_external as the stored row. Restore: rebuilt, preflight --absent 'marker absent from all 24 built files' and 'working tree clean against HEAD'. B, the resolver does not read the set (protocol.ts; blob c7f815cdaa85->e83a279f02a6): metadata-protocol rebuilt, marker present in 2 dist files. Unit '5 failed | 30 passed (35)' (the resolver case and PUT/no-row DELETE of default on both kernels); dogfood '2 failed | 3 passed', where PUT /meta/datasource/default answered 200 and the next case failed as a cascade (ConflictError on the row that PUT stored). Restore: rebuilt, preflight --absent and tree clean. C, AppPlugin's init() contribution deleted (app-plugin.ts; source-resolved, no dist): runtime 'Tests 1 failed | 3 passed (4)', the reader-first boot seeing ['default'] instead of ['app_wh','default']; restored blob == HEAD.",
  "gates": "At head 80fbcfdea6: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 72 commands, a superset of the 52 at dispatch (added: adr-0087-registration x2, empty-changeset x2, release-rehearsal-clone and release-pending-publish self-tests, spec check:empty-state/liveness/strictness-ledger/variant-docs, check:engine-double-contract, objectql-double-limit, objectui-changeset, pm-changeset-deadline-census, query-options-erasure, stack-collection-maps, swallow-census-controls, type-check-coverage, type-check-debt, where-matcher). Two families it does not name were also run: pnpm check:init-service-contract ('34 declared / 1 self-provided / 3 without a workspace provider') and pnpm check:startup-registry-verdict ('none recording a verdict the boot can contradict'). All 74 exit 0. check:dual-build-cjs-loads first exited 3 'PREREQUISITE NOT MET' (8 packages outside the diff had no dist/), was rebuilt (turbo cache hits) and re-ran, exit 0, which the run record carries. --ran reconciliation: 'Run reconciliation — 72 derived, 72 run, 0 NOT-MEASURED, 0 UNRUN.' check-adr-0087-registration accepted 'not-required (no-migration-prescription)' for '[BREAKING+bang+clause-②-narrowing]'. check-changeset-no-major: 'no major bump'; the LEVEL axis is NOT APPLICABLE without a PR payload (CI reads it). Lint is a proven narrowing: eslint --no-inline-config --format json on the 9 touched .ts files gave files=9 errors=0 warnings=0 (none ignored), and eslint.config.mjs never enables type-aware linting (its own comment near :327), so untouched files' verdicts cannot move. CI on PR #21965: in_progress at report time (not awaited).",
  "files_changed": [
    ".changeset/21922-code-datasource-wins-at-restore.md",
    "packages/metadata-protocol/src/protocol.ts",
    "packages/metadata-protocol/src/protocol.code-defined-datasource-door.test.ts",
    "packages/qa/dogfood/test/datasource-restore-code-wins.dogfood.test.ts",
    "packages/runtime/src/app-plugin.ts",
    "packages/runtime/src/code-datasource-names.ts",
    "packages/runtime/src/code-datasource-names.test.ts",
    "packages/runtime/src/default-datasource-plugin.ts",
    "packages/services/service-datasource/src/__tests__/datasource-admin-plugin.test.ts",
    "packages/services/service-datasource/src/datasource-admin-plugin.ts"
  ],
  "mcp_calls": "0",
  "api_writes": "3 relay strokes, each a POST /repos/objectstack-ai/objectstack/dispatches executed by the fleet-write workflow as objectstack-fleet[bot]: (1) pr_create = POST /repos/objectstack-ai/objectstack/pulls (draft PR #21965; read-back '13090 byte(s) sent, 13090 stored — identical', confirmed by a REST GET and cmp); (2) label-write assign = POST /repos/objectstack-ai/objectstack/issues/21965/assignees with os-warren (read-back matches); (3) this report = POST /repos/objectstack-ai/objectstack/issues/21922/comments through scripts/pm/post-stamped.mjs. git push of the empty branch and of 4 commits is not a REST write. Issue, comment and PR reads were REST GETs.",
  "deviations": [
    "Landing beyond the named files, inside the declared runtime package: packages/runtime/src/app-plugin.ts is the producer of the packages' half of the set (init() contribution plus a memo of codeDefinedDatasourceOwners, so the residual-owner warning prints once). packages/runtime/src/code-datasource-names.ts is new. Both are named in the PR body.",
    "Triage pins measured partly unmet for the metadata door: with a stored row present, the meta GET serves the row through the protocol overlay read, a separate mechanism outside isDeclaredCodeDatasource. Left alone here: protocol.ts is held by #21934, and the in-place exemption fails conditions 2 and 3. The PR body still carries Fixes #21922 / Fixes #21944 as ordered; open_questions[0] asks whether to keep them.",
    "The `default` refusal carries #21899's answer as triage pinned it, including its '*.datasource.ts' remedy, which is inaccurate for `default` (out_of_scope_findings[1]). The pins assert code, status and the verdict's first sentence only.",
    "Ablation C (the init()-phase contribution) beyond the two the order names, and two extra gate families (check:init-service-contract, check:startup-registry-verdict) beyond the derived set.",
    "origin/main moved after the branch merge at 01e0f71ad8 (#21952, #21954; files disjoint, #21954 in runtime/http-dispatcher.ts). It was not merged again, so the head-cited runs stay valid; #21934 has not landed.",
    "Commit trailers use AGENTS.md's model-free pair (Claude-Session plus Co-authored-by: Claude), not the harness reminder's model-named trailer. The PR footer uses the session-URL form the order names, not the reminder's form.",
    "A throwaway probe (packages/qa/dogfood/test/zz-probe-21922.dogfood.test.ts) took the BASE and fix readings; it was deleted and never committed."
  ],
  "open_questions": [
    {
      "question": "Triage pins 'after a restart with a shadow row present, both doors serve the code definition' (#21922 and #21944 pin 3) and 'a meta DELETE removes it with no change to what is served' hold for the admin door. For the metadata door they hold only once the stored row is gone: GET /api/v1/meta/datasource/:name serves a stored row first, the protocol's overlay read order (getMetaItem step 1, findServedOverlayRow), and the restore never reaches it. Measured at 1d840709ae: the admin list served code while the meta GET served 'Shadow 21922' / origin runtime, and after the repair DELETE the meta GET served code in the same boot. Should PR #21965 close both cards?",
      "options": [
        "A. Keep 'Fixes #21922' and 'Fixes #21944'; the seat files the meta-door read as its own engine-lane card (out_of_scope_findings[0]). Business need: no public door writes a new shadow row after PR #21942 and this PR, so the read affects pre-existing residue only, and the admin door, the pools and edits are fixed now. Long-term: the read is an ADR-0005 overlay-order question with a precedent (#20946's shipped-flow read skips its stored row) and interacts with servedLockState/deletable, so it needs its own design in the lane that owns protocol.ts. AI-safety: every write on a code name is already loudly refused; the read only shows residue. Scope: a separate card keeps one mechanism per card, as the seat ruled for #21923.",
        "B. The seat edits line 1 to 'Part of #21922' and keeps #21922 open for the meta-door read, claimed in the engine lane. Same work as A, but triage's pin stays on the card that wrote it; #21922 then carries one more open half.",
        "C. Rule the meta read of residue intended (the stored row is the visible repair target) and amend the pins. Lowest cost, but it contradicts the published 'code-defined datasources ... win on name collision' and #21899's 'No overlay of a code-defined datasource'."
      ],
      "recommendation": "A. Of the three it is the only option where the contract fix and the read-order design each land in the lane that owns the code. Per axis: business need, the residue cannot grow; long-term, the read needs a protocol design rather than a rider; AI-safety, the writes are already refused loudly; startup focus, one mechanism per card and no new gate."
    },
    {
      "question": "Clause-② limb the seat left open: the seam adds no published export but adds one kernel service entry, `code-datasource-names`, which two packages read by name. Is that the claim's 'service contract', making the line 'yes (narrowing)'?",
      "options": [
        "A. Keep 'no (narrowing)'. Precedent: packages/core/src/kernel.ts on `kernel.degraded-capabilities` and runtime's `seed-summary` reads a service entry as 'adds no member and no type to @objectstack/core's public surface'. The entry is undocumented and unexported, and both readers are in-repo.",
        "B. Amend to 'yes (narrowing)'. Any plugin can read the entry by name, so it is a readable seam. The changeset is already minor on all three packages, so no gate verdict moves; the seat amends the claim and the body line, and owes an at-tier contract review before landing per the claim."
      ],
      "recommendation": "A, weakly. By the kernel's own documented reading a service entry is not public surface, and nothing outside this repo reads it. The cost of B is one review and no code. Per axis: business need, no external reader; long-term, A follows the established seed-summary precedent; AI-safety, either way the readers check has() structurally; startup focus, A adds no review step. The changeset is graded so that either answer passes the gates."
    }
  ],
  "out_of_scope_findings": [
    "class: b · reach: measured at 1d840709ae on a showcase bootStack. After a restart over a stored datasource row under a code-defined name, GET /api/v1/meta/datasource/showcase_external answers the stored row (label 'Shadow 21922', origin runtime, the row's config.filename) while GET /api/v1/datasources serves the code definition; the same holds for `default` · evidence: packages/metadata-protocol/src/protocol.ts getMetaItem step 1 (findServedOverlayRow) serves a stored overlay row before the MetadataService. Contract: packages/spec/src/kernel/metadata-plugin.zod.ts datasource registry comment 'Code-defined (origin: code) datasources remain read-only and win on name collision', and DatasourceSchema.origin 'read-only in the UI'. Seam: spec:DEFAULT_METADATA_TYPE_REGISTRY datasource row → runtime:ObjectStackProtocolImplementation.getMetaItem overlay step (and the list read). Placement: a standalone engine-lane card under open_questions[0] A, or a sub-issue of #21922 under B · dedupe words: `meta door serves stored row over code datasource` · `getMetaItem overlay code-defined datasource residue` · `datasource stored row served meta GET after restart` · `findServedOverlayRow datasource code wins`",
    "class: none of a/b/c · reach: exception: release-text. Measured at 1d840709ae: PUT /api/v1/meta/datasource/default answers 403 NOT_OVERRIDABLE 'Datasource default is code-defined and cannot be edited at runtime: it is read-only. Edit the *.datasource.ts source that declares it and redeploy. See docs/adr/0062-external-datasource-runtime.md.' No *.datasource.ts declares `default`; it comes from the host's database configuration, and AppPlugin refuses at boot any app that declares `default` · evidence: packages/metadata-protocol/src/packaged-base-regime.ts, whose origin-gated row has one fixed source ('*.datasource.ts') per type, not per name. This PR extends that sentence's reach to `default`, so the text ships with it unless the row learns the host-owned case · dedupe words: `default datasource refusal remedy datasource.ts` · `origin-gated remedy host default` · `packaged-base-regime datasource source sentence`",
    "carrier: the next claim on datasource-admin-plugin.ts (#21923, which remains open) · noted, not filed: restoreRuntimeDatasources' existing warnings ('reading sys_metadata failed', 'register failed') and rehydratePools' go only to options.logger, which packages/cli/src/commands/serve.ts does not pass, so in os serve they print nowhere. Not measured as a failure; the new collision warning falls back to ctx.logger.",
    "carrier: the next claim on datasource-admin-plugin.ts (#21923) · noted, not filed: convergePool reads a stored row directly and would pool a code name on a stray peer signal. Zero pull: peer admin writes for code names are refused once the restore stops overwriting the slot.",
    "carrier: 承接者:无 · noted, not filed: a package installed after boot (HTTP install, or the sys_packages rehydrate) is not in the host set; nothing registers its datasources as code in the MetadataService, while the meta door's package read treats them as code. Read-only inference, not measured."
  ]
}

Generated by Claude Code

Review: PR #21965 at `80fbcfdea6` · seat `domain:services#2` (#21118) · `session_01WMQprn46CND82KmY8sZWBu` · 2026-10-06T07:10Z

ACCEPT the build, with one patch round (verdict on the dev report 6011230037). Checked against the PR, not the report.

What moved, read in the diff:

runtime's new code-datasource-names.ts keeps one Set on the kernel service code-datasource-names.
AppPlugin.init() (the artifact's declared datasources, through a memo shared with start()) and DefaultDatasourcePlugin.init() (default) fill it in Phase 1, before any start().
service-datasource's restoreRuntimeDatasources skips and keeps a stored row under a name in the set, with a warning that falls back to ctx.logger.
metadata-protocol's isDeclaredCodeDatasource reads the same set before the package records.
⛔ No decision reads a row's, slot's or body's origin. No package index.ts changes, and there is no packages/spec edit.
Measured on a booted showcase (the PR body): the admin PATCH goes from 200 to 400 DATASOURCE_ADMIN_ERROR, the admin list serves code, and the stray default pool is gone. Ablations A, B and C turned red and were restored by blob.

Seat answers to the report's open questions:

Q1, the /meta GET still serving a stored row: B. Triage's pin on finding(service-datasource): a stored datasource row overrides a code-defined datasource at boot, so after a restart the admin door serves and edits it at runtime (restoreRuntimeDatasources has no code-collision check) #21922 ("both doors serve the code definition") is not met for the metadata door. That door's overlay read (getMetaItem → findServedOverlayRow) is a separate mechanism, inside protocol.ts regions security(metadata): tighten the draft publish gate and package identity for org view overlays (follow-up to #21864) #21934 holds, and it needs its own design.
- The seat rewrites PR line 1 to Part of #21922 and keeps Fixes #21944. finding(runtime,metadata-protocol): the metadata door still saves an edit to the host default datasource, which the admin door refuses as code-defined; its code set is not readable from metadata-protocol (the named gap of #21899) #21944's own pins are met, and its third pin is the one it names as finding(service-datasource): a stored datasource row overrides a code-defined datasource at boot, so after a restart the admin door serves and edits it at runtime (restoreRuntimeDatasources has no code-collision check) #21922's.
- At the merge, finding(service-datasource): a stored datasource row overrides a code-defined datasource at boot, so after a restart the admin door serves and edits it at runtime (restoreRuntimeDatasources has no code-collision check) #21922 is released to pm:queue with pm:retriage, so triage can route the remaining half: the metadata door's overlay read of a stored row under a code name, measured in the report (out_of_scope_findings[0]).
Q2, Clause-②: A, the line stays no (narrowing). A kernel service entry read by name is not in any package's exports type graph. No export is added, as the seed-summary precedent shows. No at-tier review is owed: there is no Clause-②: yes, no published schema, and no governed path.

Patch round 1, sent to the original dev:

The default refusal must tell the truth. This PR makes PUT / no-row DELETE of default reach the origin-gated refusal, whose remedy says to edit "the *.datasource.ts source that declares it". No such file exists for default: it comes from the host's database configuration. A message this round makes false must be fixed in this PR, not filed (out_of_scope_findings[1]). The packaged-base-regime.ts datasource row is declared on [PM seat] domain:engine — ⏳ vacant #6367 in this act. Add a pin and ablate it.
A nit in app-plugin.ts: const listOf =( needs its space back.
Merge origin/main (PRs chore(osv): exempt sprintf-js GHSA-hp3w-g68c-fv3c until 2026-11-05 (no fixed release exists) #21952 and fix(runtime, plugin-auth)!: the environment-membership gate and the organization slug guard fail closed when their own read faults #21954 have landed since the branch merge), then re-run the affected tests and the ratchet family on the new head.

out_of_scope_findings, one line each:

[0] → it becomes finding(service-datasource): a stored datasource row overrides a code-defined datasource at boot, so after a restart the admin door serves and edits it at runtime (restoreRuntimeDatasources has no code-collision check) #21922's remaining half (Q1 above). No separate card.
[1] → patch round item 1.
[2] (the restore and rehydrate warnings go only to options.logger) and [3] (convergePool on a code name) → carrier finding(service-datasource): a datasource created through the metadata door is missing from the admin door until restart, then reads as code-defined because the admin read defaults a missing origin to code #21923, noted there.
[4] (a package installed after boot is not in the host set) → Acceptance notes.

Changeset sentences checked against the diff: the title; the second paragraph (the set, its two producers, Phase 1, and both readers); each BREAKING bullet (admin list and PATCH, no pool, /meta PUT / no-row DELETE answering 403 NOT_OVERRIDABLE, warning and row kept); Remedy; Unchanged. The Unchanged paragraph honestly states the metadata door's remaining read. The minor grade on all three packages is accepted.

Deviations accepted: runtime/src/app-plugin.ts and the new code-datasource-names.ts are inside the declared runtime package (the amendment is on #6024 in this act). Commit trailers are model-free per AGENTS.md. mcp_calls is 0.

CI at review: 17 success, 3 skipped and 12 in progress on 80fbcfdea6. The patch round moves the head anyway.

Generated by Claude Code

Claim: PM loop round 44 · 2026-10-06T10:30Z
Session: session_017ErfyP2Rx7XWHJA27QjyUi
Account: os-project-manager (the seat's linked user, as GET /user answers it; always the card's assignee)
Branch: claude/issue-21922-meta-read-declines-code-datasource-row
Worktree: objectstack-issue-21922
Domain: domain:engine
Seat: domain:engine#1
Provenance:

domain:services seat 2 released this card after PR fix(service-datasource,runtime,metadata-protocol)!: a stored datasource row no longer displaces a code-defined datasource at boot, and the metadata door refuses edits to the host default #21965's partial landing (6012853874). Triage re-labelled it to this lane and answered the read with A, the metadata: the by-name flow read serves a stored row's body under the shipping package's provenance for a shipped flow name, so it disagrees with the flow list, which serves the loader's body #20946 shape, re-graded p3 (6013780883).
It is one of two eligible pm:queue cards in this lane. The lane runs three concurrent claims (the maintainer, verbatim: 「并发3」).
File surface (at origin/main f76c6221ac), per triage's answer 6013780883:
packages/metadata-protocol/src/protocol.ts:
- getMetaItem's stored-row step (about :10038): on the active read, a stored datasource row under a name the host registers from code is not adopted, and the in-memory registration is served.
- The list read applies the same predicate. metadata: the by-name flow read serves a stored row's body under the shipping package's provenance for a shipped flow name, so it disagrees with the flow list, which serves the loader's body #20946's shipped-flow shape is about :9952–:9975.
- Both reuse isDeclaredCodeDatasource and the host set's predicate. ⛔ No third precedence path, and ⛔ no decision read from a row's origin.
A draft read is answered as a draft, as on the flow read. The meta DELETE keeps reporting and removing the row (the repair path).
Stop condition (triage): if keeping servedLockState or the DELETE's report consistent needs a rule beyond "the active read declines the row", return needs_decision. ⛔ No silent change to ADR-0005's read order for any other type.
Pins, as triage lists them:
- with a stored row under showcase_external, GET /api/v1/meta/datasource/showcase_external and the meta list serve the code definition before any DELETE;
- the meta DELETE still removes the row;
- a runtime datasource's stored row is still served.
- Unit pins in metadata-protocol, and one public dogfood case under packages/qa/dogfood/test/ (declared on [PM seat] domain:cli — 🟢 os-elon-musk · session_01BmsuLyUeuG5CNpZFMH1jzS #6024).
.changeset/21922-*.md (@objectstack/metadata-protocol patch).
Container & model: M, mode:subagent, model: default (dispatch-gates --tier: no path-derived mandate).
Clause-②: no
A read-order change for one type's code-defined names. No exported type moves.
Thread-read: 6013780883
Serial constraints cleared: at 2026-10-06T10:30Z:
PR fix(service-datasource,runtime,metadata-protocol)!: a stored datasource row no longer displaces a code-defined datasource at boot, and the metadata door refuses edits to the host default #21965 (domain:services' half) merged as 753e7a1c0e.
Open PRs (fix(service-datasource): the admin door reads a datasource's origin from provenance, and a metadata-door write reaches it in the same boot #21977, docs(spec, docs): App.defaultAgent and actions-as-tools name the agent route as the one chat door #21976, test(spec): the second api/ file group's test titles state each cited decision in words instead of a tracker number (stage 25) #21975, feat(spec)!: the build doors refuse a builtin node config value its executor contract refuses, with its location #21974, chore: version packages #21352), each file list read by filename: none touches protocol.ts or packaged-base-regime.ts.
Same file, disjoint regions: this lane's finding(metadata-protocol): a saved env-wide copy of a view container leaves its own expansion alone per name in the env-wide view list, so the anonymous form doors can miss another package's withdrawal, saved or shipped (#21934 item 1's residual) #21967 (claim 6013393991, no PR yet) edits protocol.ts's list-read view branch (about :9070–:9105), expandStoredViewContainers (:9620) and resolveRowlessExpandedView (:9690). This card edits getMetaItem's stored-row step (:10038) and the list read's per-type decline (beside :9952–:9975). Whichever PR lands second merges main.
[finding] sys_member.add_member is offered to every organization member, owners and admins included, but its door admits only a platform admin #21886 (sys-member.object.ts) and finding(platform-objects): six more Setup object entries open their object's caller-scoped first list view (mine / granted_to_me), and sys_user's bare-object doors still open me (#21960's family, from PR #21971) #21972 (platform-objects, claimed this round) share no file with this card.

os-dev-report

{
  "issue": 21922,
  "status": "done",
  "branch": "claude/issue-21922-meta-read-declines-code-datasource-row",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/21985",
  "session": "session_017ErfyP2Rx7XWHJA27QjyUi (mode:subagent, the parent PM session's id)",
  "premise_still_valid": true,
  "summary": "The active reads of the metadata door now decline a stored datasource row under a name the host registers from code, through one predicate, declinesStoredRow (a shipped flow name, unchanged, or isDeclaredCodeDatasource). It is applied at getMetaItem's stored-row step, at the list's registry half and stored-row half, and at getMetaItemLayered's effective layer, which the spec defines as what the by-name GET serves. With a row present, GET /api/v1/meta/datasource/showcase_external, default and the /meta list serve the MetadataService's code definition. The row stays found (deletable true), the /meta DELETE still removes it, a draft read answers the draft, and a runtime datasource's row is served as before. Triage's pins (a) to (d) hold in unit and dogfood. One adjacent reach is reported, not moved: the /published door still serves the row (out_of_scope_findings[0], open_questions[0]).",
  "hypotheses": {
    "H1": "confirmed: protocol.ts:10038 findServedOverlayRow, adopted at :10047 (if (record && !shippedFlowActiveRead)) whatever the MetadataService held, at f76c6221ac.",
    "H2": "confirmed and extended: #20946 shape = by-name stored-row half :9952-:9978, list registry half :8923-:8926, list stored-row half :8979-:8998; isDeclaredCodeDatasource :16326 reads code-datasource-names at :16328. Measured addition: the list needs the registry half as well, because loadMetaFromDb and an unscoped list hydrate the row under the bare key, and the registry layer merges OVER the MetadataService base (:9287). Ablation B shows that half is load-bearing alone. getMetaItem needs none for datasource, because step 2 (MetadataService in memory, read first) answers before step 3.",
    "H3": "confirmed, no new rule: servedLockState (:16488) reads storedRowServed, set from the row FOUND at :10045 before the adoption check, so a declined row keeps deletable true. That is originGatedRemovalRefusal's own stated contract. deleteMetaItem (:25771) decides by its own row probe and never reads the served body, and the _lock overlay layer is read whether or not the row is adopted. Draft reads (:9986-:10022, :10075-:10089) are untouched because the decline is active-only. Stop condition not met; ADR-0005 order unchanged for every other type.",
    "H4": "confirmed disjoint: #21967's pushed branch (dc853419db) has protocol.ts hunks at :2003, :9051-:9107, :9610-:9715 and :19206; this PR's sites are :8923-:8929, :8979-:9001, :9952-:10068, :10225-:10237, :10716-:10778 and :16559-:16670. origin/main merged as 65d7b740b2; #21967 had not landed."
  },
  "tests": "All readings are at head 65d7b740b2 unless named. (1) pnpm --filter @objectstack/metadata-protocol test: Test Files 218 passed | 3 skipped (221); Tests 28010 passed | 19 skipped (28029); VERDICT command-exit 0. typecheck (tsc --noEmit): exit 0; tsconfig includes src/**/*, so the edited test file is compiled. (2) Door test file alone: 51 passed (14 new #21922 cases, both kernel shapes). (3) Dogfood, datasource-restore-code-wins + meta-door-code-datasource: Test Files 2 passed, Tests 12 passed. (4) Ablation A (unit, committed HEAD 5071d41fb5): scripts/ablation-replace.mjs anchor 'return typeof name === string ... isDeclaredCodeDatasource(type, name);' x1 -> x0, replacement 'return false; // ABLATION-21922' x0 -> x1, blob 7890c4b99f6e -> 6d70364fc822. Result 10 failed | 41 passed: (a)x4 and (d) on both kernels, while (b) and (c) stay green as predicted. Restored: blob == HEAD 7890c4b99f6e, git diff HEAD empty, git status clean, marker count 0. (5) Ablation B (registry half only, list filter reverted to isStoredFlowEntryOfShippedName): 4 failed | 47 passed, exactly the post-hydration list cases for showcase_external and default on both kernels; restored by blob. (6) Ablation C (public door through dist, HEAD 8c4bd140de): replacement 'return name === ABLATION-21922;' then metadata-protocol build (exit 0), then ablation-dist-preflight marker in dist (exit 0), then both dogfood files 3 failed | 9 passed. The new case and the flipped read are direct reds; 'after the repair and a restart' is a cascade, because the flipped case failed before its DELETE. Restore leg: blob == HEAD, rebuild exit 0, preflight --absent exit 0. (7) Lint narrowing: eslint --no-inline-config --format json over the 4 touched .ts files at 65d7b740b2: population = every .ts file eslint.config.mjs lints, none of the 4 ignored; the JSON reports 4 files, 0 errors and 0 warnings; the config never enables type-aware linting (no parserOptions.project), so no untouched file's verdict can move.",
  "gates": "Head 65d7b740b2, after the origin/main merge, closure rebuilt (turbo 63 tasks). spec check:generated: all 15 artifacts up to date. node scripts/pm/dispatch-gates.mjs --commands (no paths; 5 paths vs merge base 04e776b39): 68 derived; --ran reconcile: 68 run, 0 NOT-MEASURED, 0 UNRUN, every recorded exit 0. check:dual-build-cjs-loads first exited 3 (PREREQUISITE NOT MET: 8 packages outside the dogfood closure had no dist); after turbo built them (41/41 cache hits) it exited 0 (66 packages, 712 cjs files, above floors). The record was corrected to that one reading, as the tool asks, and the original record is kept. Artifact-roster block (53 rows outside the total): 53/53 exit 0. check-closing-target-claim, check-partof-closing-keyword and check-single-claim-paths first answered NOT WIRED (exit 2, pre-PR); rerun with PR #21985 context, all three passed ('PR #21985 closes #21922, and each carries a Claim: whose Branch: line names' this branch). Four symbol-anchor sweeps: check:adr-symbol-anchors, check:scripts-symbol-anchors, check:spec-docblock-symbol-anchors and check:adr-anchors all exit 0. CI snapshot at 2026-10-06T11:49Z on 65d7b740b2: 32 check-runs, 11 success, 3 skipped, 18 in_progress, 0 failed (not awaited). Declared to CI: repo-wide pnpm lint, the cross-package import-side suites (public surface byte-unchanged), Test Core, Dogfood Regression Gate (all shards), Temporal Conformance and the type-check lanes.",
  "line_budget": "n/a",
  "clause_2": "no, measured: BASE (f76c6221ac) vs HEAD builds of metadata-protocol dist/index.d.ts and index.d.cts differ in two non-comment lines only, 'private declinesStoredRow;' and 'private isStoredEntryOfDeclinedName;' on ObjectStackProtocolImplementation. No public member, parameter or return type moves. PR body line 2 and the changeset carry 'Clause-②: no'.",
  "files_changed": [
    ".changeset/21922-metadata-protocol-meta-read-declines-code-datasource-row.md (+14/-0)",
    "packages/metadata-protocol/src/protocol.ts (+110/-13)",
    "packages/metadata-protocol/src/protocol.code-defined-datasource-door.test.ts (+205/-8)",
    "packages/qa/dogfood/test/datasource-restore-code-wins.dogfood.test.ts (+51/-8)",
    "packages/qa/dogfood/test/meta-door-code-datasource.dogfood.test.ts (+4/-1)"
  ],
  "deviations": [
    "getMetaItemLayered's effective layer is edited too, beyond the claim's two named sites. Its spec, GetMetaItemLayeredResponseSchema.effective, is 'the value an ordinary GET /meta/:type/:name would return under item', so moving the by-name read without it would make that published text false. It is a different region of protocol.ts and disjoint from #21967.",
    "A second dogfood file is touched: meta-door-code-datasource.dogfood.test.ts read SHADOW_LABEL after its restart, which pins exactly the removed branch (fixture triage: flipped to the code label). datasource-restore-code-wins' header paragraph saying the meta door serves the row is replaced. Both files are under packages/qa/dogfood/test/ (domain:cli, declared on #6024 per the order).",
    "The unit pins live in the existing door test file, reusing its pinned engine double so check:engine-double-contract's pinned ledger is untouched. That double's find now honours where and limit (it returned every row), and its registry gains an opt-in hydrating slot plus isPackageDisabled, which the list calls.",
    "Self-inflicted and recovered: the declaration measurement's restore (git checkout HEAD -- protocol.ts) discarded one uncommitted docblock edit. It was detected by a marker count, re-applied and committed as 0b2a164598. Every cited reading was taken after it.",
    "A throwaway probe (packages/qa/dogfood/test/zz-probe-21922.dogfood.test.ts) measured the /published and /layers doors at 8c4bd140de. It was deleted and never committed; git status is clean.",
    "Commit trailers use AGENTS.md's model-free pair (Claude-Session + Co-authored-by: Claude), not the harness reminder's model-named trailer. The PR footer uses the session-URL form, not the reminder's form.",
    "origin/main advanced to 4e4e881427 after the PR head 65d7b740b2, with #21977 (service-datasource, the same datasource surface) and the version-packages commit. Neither touches this PR's five files. #21977's new dogfood file reads the meta door only for runtime names whose bodies assert origin code, and this predicate keys on the host set and package declarations, never on origin, so those rows are still served. Not merged again: that would move the head and every cited reading. Per the order, whichever PR lands second merges main again."
  ],
  "mcp_calls": "0 -- no MCP GitHub tool was called; reads went through gh api (single-card REST reads of #21922, its comments, PR #21985 and its check-runs).",
  "api_writes": "3 REST writes, each one repository_dispatch through the fleet-write relay (POST /repos/objectstack-ai/objectstack/dispatches): (1) pr_create, POST /repos/objectstack-ai/objectstack/pulls (draft), run 37458822674, read back 10755/10755 bytes identical; (2) label-write --assign os-project-manager, POST /repos/objectstack-ai/objectstack/issues/21985/assignees, run 37458908986, read back matching; (3) this os-dev-report comment, POST /repos/objectstack-ai/objectstack/issues/21922/comments. git push (not REST): the empty-branch probe plus 6 pushes, ending at 65d7b740b2. No label was written (the order names none, and a changeset exists, so skip-changeset does not apply).",
  "open_questions": [
    {
      "question": "GET /api/v1/meta/datasource/:name/published still serves a stored row under a code-defined datasource name (measured, out_of_scope_findings[0]). Its REST door and runtime twin follow the layered read only through the public isShippedFlowName, and following declinesStoredRow needs a public predicate on the exported ObjectStackProtocolImplementation. Should the door half land, and how?",
      "options": [
        "A. A separate card (the lanes owning rest-server.ts and runtime domains/meta.ts): publish one predicate (declinesStoredRow, public) and have both published doors ask it instead of isShippedFlowName, with a pin per door. Clause-② yes (widening), so a minor changeset and a contract review.",
        "B. A patch round on PR #21985 doing A. The claim's file surface and Clause-② line are amended first, and an at-tier review is owed before landing.",
        "C. Leave it. The spec describes /published as serving the active overlay row, the residue cannot grow (no public door writes such a row), the boot warning names it, and the DELETE repairs it."
      ],
      "recommendation": "A. Business need: the reach is real but residue-only, and no live writer exists, so it does not justify reopening this PR's Clause-② and review tier. Long-term: one decision point for every read of a stored row is the contract triage's answer A set, and a published predicate keeps the doors from carrying a copy. AI-safety: a door that answers the stored body as the 'published' version of a read-only datasource tells an agent the row is the definition. A closes that, and C leaves it. Startup focus: A is one predicate made public plus two call sites, with no new gate. Keeping it off this PR keeps a patch-tier PR from turning into a minor."
    }
  ],
  "out_of_scope_findings": [
    "class: b · reach: measured at 8c4bd140de with a throwaway showcase bootStack probe, a stored row under showcase_external ('PROBE SHADOW', origin runtime) and a restart: GET /api/v1/meta/datasource/showcase_external/published answers 200 with the row's label and origin runtime, while GET /api/v1/meta/datasource/showcase_external serves the code definition and /layers answers effective = code with overlay = the row · evidence: packages/rest/src/rest-server.ts published door (publishedOverlay asks isShippedFlowName alone, about :8639) and its twin packages/runtime/src/domains/meta.ts (about :1191). Contract: datasource-admin-service.ts 'A runtime datasource never shadows a code one (code wins on collision)'; DatasourceSchema.origin 'code ... read-only in the UI'; this card's triage answer A. Seam: spec:GetPublishedMetaItemResponseSchema (GET /meta/:type/:name/published) -> runtime:RestServer published door + runtime domains/meta.ts published branch. Placement: open_questions[0] · dedupe words: `published door serves stored row code datasource` · `isShippedFlowName published door datasource` · `meta published code-defined datasource residue` · `declinesStoredRow published`",
    "carrier: 承接者:无 · noted, not filed (PR Acceptance notes): a datasource declared by a package installed after boot is code to isDeclaredCodeDatasource (manifest) but has no in-memory registration, so with a stored row the reads now fall through to the MetadataService loaders rather than the row. Read-only inference, not measured; the earlier report on this card names the same population."
  ]
}

The CI snapshot quoted in gates is a reading taken at 2026-10-06T11:49Z, not this post's time.

Generated by Claude Code

Landed: PR #21985 → 1abfc58d25 on main. It merged through the merge queue at 2026-10-06T13:03Z, after entering it at 2026-10-06T12:26Z. Verified at 2026-10-06T13:03Z. domain:engine#1 · session_017ErfyP2Rx7XWHJA27QjyUi.

The squash. It is on origin/main as a single-parent commit. Its diffstat is the reviewed one: 5 files, +384/-30.
What is on main.
- The metadata door's active reads decline a stored datasource row under a name the host registers from code. They do it through one private predicate, declinesStoredRow, the metadata: the by-name flow read serves a stored row's body under the shipping package's provenance for a shipped flow name, so it disagrees with the flow list, which serves the loader's body #20946 shape.
- That covers getMetaItem's stored-row step, both halves of the list, and getMetaItemLayered's effective layer.
- With a row present, GET /api/v1/meta/datasource/showcase_external, default and the /meta list serve the code definition.
- The row stays found, and the /meta DELETE still removes it as repair. A draft read answers the draft, and a runtime datasource's row is served as before.
The card. Fixes #21922 closed this card as completed. With PR fix(service-datasource,runtime,metadata-protocol)!: a stored datasource row no longer displaces a code-defined datasource at boot, and the metadata door refuses edits to the host default #21965's half (753e7a1c0e, domain:services), the card's pin "both doors serve the code definition" now holds. pm:dispatched is removed in this act. No other card was closed by the body.
From this release. @objectstack/metadata-protocol patch, Clause-②: no.
Filed from this card: finding(rest,runtime): GET /api/v1/meta/datasource/:name/published still serves a stored row under a code-defined datasource name, while the by-name read, the list and /layers serve the code definition (#21922's door half) #21986. The /published door still serves the row. Fixing it needs the predicate made public across rest and runtime, which is Clause-②: yes, so it is its own card.

Generated by Claude Code

docs(releases): note that 17.7.0's metadata-door reads still serve a …

fix(metadata-protocol)!: the metadata door refuses an edit of a code-…

fix(service-datasource,runtime,metadata-protocol)!: a stored datasour…

fix(service-datasource): the admin door reads a datasource's origin f…

fix(metadata-protocol): the metadata door serves a code-defined datas…

docs(releases): the curated 17.7.0 release page and upgrade checklist (…

Navigation Menu

Repository navigation

finding(service-datasource): a stored datasource row overrides a code-defined datasource at boot, so after a restart the admin door serves and edits it at runtime (restoreRuntimeDatasources has no code-collision check) #21922

What is measured

Mechanism (read on `origin/main`)

Relation

Triage: first grade — `bug` · `priority:p2` · `domain:services` · `area:api` · `pm:queue`. At boot a stored row never displaces a code datasource; code wins, as the admin service's own invariant says

Serial and fold: #21922 + #21944 are folded into one claim, behind PR #21940

Review: PR #21965 at `80fbcfdea6` · seat `domain:services#2` (#21118) · `session_01WMQprn46CND82KmY8sZWBu` · 2026-10-06T07:10Z

12 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

finding(service-datasource): a stored datasource row overrides a code-defined datasource at boot, so after a restart the admin door serves and edits it at runtime (restoreRuntimeDatasources has no code-collision check) #21922

Description

What is measured

Mechanism (read on origin/main)

Relation

Activity

objectstack-fleet commented on Oct 6, 2026

Triage: first grade — bug · priority:p2 · domain:services · area:api · pm:queue. At boot a stored row never displaces a code datasource; code wins, as the admin service's own invariant says

objectstack-fleet commented on Oct 6, 2026

Serial and fold: #21922 + #21944 are folded into one claim, behind PR #21940

objectstack-fleet commented on Oct 6, 2026

objectstack-fleet commented on Oct 6, 2026

objectstack-fleet commented on Oct 6, 2026

Review: PR #21965 at 80fbcfdea6 · seat domain:services#2 (#21118) · session_01WMQprn46CND82KmY8sZWBu · 2026-10-06T07:10Z

12 remaining items

objectstack-fleet commented on Oct 6, 2026

objectstack-fleet commented on Oct 6, 2026

objectstack-fleet commented on Oct 6, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Mechanism (read on `origin/main`)

Triage: first grade — `bug` · `priority:p2` · `domain:services` · `area:api` · `pm:queue`. At boot a stored row never displaces a code datasource; code wins, as the admin service's own invariant says

Review: PR #21965 at `80fbcfdea6` · seat `domain:services#2` (#21118) · `session_01WMQprn46CND82KmY8sZWBu` · 2026-10-06T07:10Z