[maintainer] refactor(metadata-protocol): split src/protocol.ts (33,065 lines, +10,169 in 30 days) along its ObjectStackProtocolImplementation seams, one move-only slice per PR

Filing gate ③: a task the maintainer dispatched, quoted verbatim below. Filed by domain:services seat 1 (seat post #6021) · os-sales · session session_016g7nYP9wdNx1GDa5XDr7Uy, as the domain:engine half of #24586's restart act. That half was handed over unfiled in 6341834009, and the engine surface is now this project's, folded into domain:server by PR #25247. ⛔ Not a claim.

The maintainer's words, verbatim (#24586, recorded in 6270097840): 「24586 同意A，是否建议这波分拆等 v18 发布之后再处理。」 Triage read the restart condition (npm @objectstack/spec latest ≥ 18.0.0) as true in 6291735609. The ruling's restart act: "one [maintainer] card per file over 10,000 lines into its owning lane … Each card starts with a fresh seam measurement taken at that time, in #23050's shape", and "protocol.ts goes first".

Reader who acts: the domain:server lane, engine surface (packages/metadata-protocol was domain:engine's). One dispatch per slice.

Measured (on `origin/main` `b2c0752900`, 2026-10-23)

Size and churn:
- 33,065 lines, up from 22,896 thirty days ago (dabf8d795e, the last commit before 2026-09-23T15:00Z): +10,169, +44.4%.
- 28 commits in 7 days and 184 in 30 days.
- git blame --since=2026-09-23T15:00Z attributes 13,445 lines (40.7%) to the last 30 days.
Structure:
- a 6,643-line module preamble: helpers, three error classes, and the query-param and filter vocabulary;
- one ObjectStackProtocolImplementation class, lines 6644–32941 (26,298 lines, 267 members);
- a 124-line trailer of package-persist helpers.
The sections, by contiguous member ranges:

section	lines	lines from the last 30 days
module preamble (helpers, error classes, query-param and filter vocabulary)	6,643	2,255
class head, flow/SDUI resolvers, registration hooks, authoring gates, mutation pub/sub, overlay index	1,961	707
discovery, types, diagnostics, packaged bases, credential carry-forward	1,578	339
metadata reads (`getMetaItems`, `readFlattenedMetaItems`, overlay rows, `readMetaItem`, layered, audit, `getUiView`)	2,872	1,696
query validation (`assertFieldsExist`, `refuseInternal`)	1,643	358
data CRUD (`findData` … `readAsCaller`)	1,393	274
`searchAll` + meta cache	605	160
batch and `*Many` data	1,067	33
write gates (overlay/code-only/organization/sealed/packaged-base, locks, version tokens, conflict audit)	2,619	1,772
registry hydration, view expansion, write-through, object storage	1,996	1,112
save refusals, `saveMetaItem` (1,535 lines alone), `saveConflict`, `migrateStoredMetadata`	2,960	1,666
history, publish, drafts, publish backfill (`publishPackageDrafts` 969 lines)	2,600	828
package revert/delete/duplicate/import, orphans, commits, `revertCommit`, rollback	2,837	1,335
diff, `deleteMetaItem`, `loadMetaFromDb`, load reports, `findReferencesToMeta`	1,831	624
install/update package + module trailer	460	286

Shared state a split must pass:
- The fields are engine (149 refs), getServicesRegistry (16), environmentId (11), the cluster pub/sub trio (clusterPubSub, clusterNodeId, clusterUnsubscribe), the two listener sets, authoringChannel, and about 20 warn-once and cache flags.
- Coupling is mostly method-to-method: 597 this.X( calls over 206 distinct members. Reads, write gates and saves call one another across the sections above.
What reads it by path:
- The ADR anchor file scripts/adr-anchors/packages__metadata-protocol__src__protocol.ts.json. It holds ADR-0005, 0029, 0087, 0119 and 0126, and its invariant names the two object-hydration seams applyObjectRegistryMutation and loadMetaFromDb. The metadata-plugin.zod.ts anchor file and scripts/symbol-anchors.mjs also name the file.
- 10 more files under scripts/: check-durability-degradation-log-level.mjs, check-engine-double-contract.mjs (+ .pinned.json, .seams.json), check-filter-alias-parity.mjs, check-nul-bytes.mjs, check-system-context-census.mjs, docs-audit/affected-docs.mjs, objectql-double-limit.baseline.json, query-options-erasure-baseline.json.
- 22 files under docs/ and content/, 11 of them ADRs.
- Tests: 180 test files in metadata-protocol import it, and 71 files in other packages name it by path.
In flight: none of the 21 open PRs touch the file.

The ask (from #24586's ruling and #23050's shape)

Split along the existing seams, one area per PR. Each slice is move-only: no logic changes.
Shared state stays explicit: moved code reaches the class's shared members through one named context object (the host pattern of [maintainer] refactor(rest): split packages/rest/src/rest-server.ts (13,701 lines, 70 commits in 30 days) along its register*Endpoints seams, one move-only slice per PR, /meta after #22877 stage 2 #23050, [maintainer] refactor(service-automation): split src/engine.ts (13,735 lines, +2,199 in 30 days) along its AutomationEngine seams, one move-only slice per PR #25222, [maintainer] refactor(plugin-security): split src/security-plugin.ts (10,746 lines, +2,803 in 30 days) along its SecurityPlugin seams, one move-only slice per PR #25223 and [maintainer] refactor(plugin-auth): split src/auth-manager.ts (10,338 lines, +1,867 in 30 days) along its AuthManager seams, one move-only slice per PR #25224). ⛔ Not a second copy of a helper, ⛔ not a re-derivation.
Every slice proves it moved nothing:
- every gate, baseline, ADR anchor and docs anchor that reads the file by path is migrated in the same PR and stays green;
- the ADR-0029 D9.8/D9.9 invariant's two seams keep a resolving anchor;
- the package's public .d.ts stays identical.
- ⛔ A gate whose target moved must not go silently empty.
Serial with the file's in-flight PRs: a slice waits for an open PR on the same region, or that PR merges main after the slice. At 28 commits a week, every slice measures the file's open PRs again at claim.
⛔ No new gate.

Not in this card

Any behaviour change.
A design change to the shared members beyond giving them an explicit context.
objectql/src/engine.ts (23,903 lines) and driver-sql/src/sql-driver.ts (22,096 lines). They are the other two engine-surface files under the same ruling, and they are filed once this card's first slices have landed ([Decision] Split the platform's largest, fastest-growing source files (protocol.ts 32,428 lines, +10,002 in 30 days) the way rest-server.ts was split, or leave them #24586's order: protocol.ts first).
spec/src/conversions/registry.ts, which belongs to domain:spec.

Dedupe

MCP search_issues on this repository, closed included, with two queries:

"split protocol.ts metadata-protocol move-only maintainer refactor"
"refactor split objectql engine.ts sql-driver.ts large file"

The hits were #24586 (the ruling this card carries out), #25222, #25223 and #25224 (the domain:services files), and #23050 (closed, rest-server.ts). None covers protocol.ts. New.

Generated by Claude Code

Claim: card thread · domain:server (former domain:engine surface) · for domain:services seat 1 (seat post #6021, project run by the Sales account; 由Sales账户的项目负责) · p2 · series card, cut 1 (one PR; cuts strictly serial) · 2026-10-23T15:20Z
Session: session_01J8pUyVs5eas1AjMdReJM7C
Account: os-sales (the seat's linked user; the card's assignee)
Branch: claude/project-thread-uasfag (the harness-pinned branch for this session, cut from origin/main ab510f4c43; it names no issue, so the Duplicate Fix Guard's branch-name hint will not match — this claim is the identity record)
Worktree: objectstack-wt (a linked worktree in this session's container)
Domain: domain:server
Seat: domain:services#1 (seat post #6021; the PR goes back to that seat for ACCEPT)
Ruling: #24586 letter A (6270097840), restart read in 6291735609. The series' .d.ts bar is ruling 6348891160 (sorted-union identity; raw identity reported when it holds).
Container & model: M, mode:thread, effort: high
Clause-②: no
Metadata-protocol: none
Responsibility: n/a — not a defect card (a [maintainer] refactor card).
Thread-read: none
Serial constraints cleared: none of the 21 open PRs touches packages/metadata-protocol/src/protocol.ts (each PR's file list read in this act against origin/main; #25451 touches only protocol.runtime-authoring-gate.test.ts, the Version Packages PR #24876 only CHANGELOG.md / package.json). No pm:dispatched card's claimed file surface names the file. Re-measured again before pr_create; a new open PR on the moved region means this cut yields.

File surface (read on origin/main ab510f4c43, where protocol.ts is 33,065 lines):

Cut 1 = the card's "batch and *Many data" section (the seat's suggested first slice: 1,067 lines, 33 of them from the last 30 days). Sixteen ObjectStackProtocolImplementation method bodies move unedited from packages/metadata-protocol/src/protocol.ts into a new module, packages/metadata-protocol/src/protocol-batch-data.ts, in the host shape of #23050 / #25222 / #25223 / #25224:

public: batchData :16696, createManyData :17263, insertManyData :17348, updateManyData :17390, deleteManyData :17574;
private: runAtomicBatchData :16739, runAtomicBatch :16775, runBatchDataLoop :16850, reconcileStoppedBatch :17108, locateBatchCause :17170, buildBatchDataResponse :17182, buildRolledBackBatchResponse :17219, runUpdateManyLoop :17424, buildUpdateManyResponse :17497, runDeleteManyLoop :17619, buildDeleteManyResponse :17708.
triggerAutomation :17527 sits between them but is not batch code; it stays.

How the host is built:

The class keeps every method, with its docblock, signature and position; each body becomes a literal of exactly the members it reads, plus a .call. async is dropped from the stubs, which return the moved function's promise.
Members read, measured by AST: engine (field), and the methods assertObjectRegistered, assertRecordExists, probeRecord plus the moved methods' calls to one another. Methods go as late-bound closures, so a spy or double set on the instance is still the one a body reaches. engine goes as a getter.
The only outside caller of a moved method is applyPublishBackfill (this.updateManyData(), which keeps calling the class method.

Module-level declarations the moved bodies read (all stay in protocol.ts; each has readers outside the moved text except mergeDroppedFieldEvents, which stays too, so no declaration moves):

export added in place, imported back by value or type from ./protocol.js: byIdUpdateRecord, mergeDroppedFieldEvents, rowOperationFailureFallback, rowRequiredIdError, toRowApiError, type BatchDataRowResult, type BatchDataLoopOutcome. src/index.ts exports from ./protocol.js by name, so none of them is published; the proof measures it (raw .d.ts and ESM/CJS export lists base vs head). Every value import is read only inside function bodies, so the module cycle is evaluation-safe; the PR lists each read site.
Imports the new module takes from packages directly (as protocol.ts does): engineCanRollBack, recordNotFoundError (@objectstack/core), omitInternalFieldsFromWriteResponse (./write-response-internal-fields.js), and the @objectstack/spec types the bodies name.

Path readers migrated in the same PR (each measured base vs head in the PR):

scripts/adr-anchors/: the protocol.ts entry's ADR-0119 paragraph describes batchData's atomic path, which moves. Per the series' rule, the new module gets its own entry carrying ADR-0119 and that paragraph verbatim; the protocol.ts entry is unchanged (ADR-0119 is still cited at five sites outside the moved text). check:adr-anchors decision-letter totals reported base and head.
protocol.bracketed-refusal-opener-absence.test.ts: the moved text holds 5 new Error( sites, so the new module joins its PRODUCERS list with a measured floor; otherwise those sites would leave the scan silently. protocol.ts keeps its floor of 5.
docs/adr/0119-…md anchors protocol.ts#batchData: the method shell stays, so it still resolves; check-adr-symbol-anchors run by hand at both ends.
Census and ledgers run base and head: tenant-audit census (the moved bodies hold engine insert/update/delete calls; if they shift class, --write plus the page's prose count, with a per-site base/head comparison), system-context census (0 isSystem reads in the moved text), query-options erasure ratchet (0 counted find/findOne/count/aggregate sites in the moved text), engine-double contract seams (deleteData / updateData rows, which stay), durability log level (scans the whole package).

⛔ Nothing else changes: no moved body is edited; the only stay-behind edits are the export keywords above and the stub bodies; no ADR or docs/adr/** text is edited; no new gate. One PR, skip-changeset (no behaviour change), Part of #25467.

Proof the PR carries: AST leaf-token identity of every moved body (with a one-token negative control), .d.ts block per ruling 6348891160 (raw and normalised sha256 base/head, normaliser, raw diff line count, positive control), ESM/CJS export lists, the metadata-protocol suite at base and head (same counts), dispatch-gates --commands all run with exits, and the hand gates above.

Landed cut 1 (batch and *Many data) · domain:services seat 1 (seat post #6021) · os-sales · session_016g7nYP9wdNx1GDa5XDr7Uy · 2026-10-23T17:23Z

reading	value
PR #25494	MERGED through the queue (the seat's ACCEPT is on the PR), head `b55faf2162`
`origin/main`	carries `bf5855b5bc`

State: the card stays open and dispatched (Part of). The card thread plans cut 2 on the merged protocol.ts and re-checks the in-flight PRs on the file first (serial rule). It claims cut 2 afresh before it pushes.

Generated by Claude Code

Claim: card thread · domain:server (former domain:engine surface) · for domain:services seat 1 (seat post #6021, project run by the Sales account; 由Sales账户的项目负责) · p2 · series card, cut 2 (one PR; cuts strictly serial; cut 1 landed as #25494, bf5855b5bc) · 2026-10-23T17:30Z
Session: session_01J8pUyVs5eas1AjMdReJM7C
Account: os-sales (the seat's linked user; the card's assignee)
Branch: claude/project-thread-uasfag (the harness-pinned branch for this session, restarted from origin/main 5188e7f18f after cut 1 merged; it names no issue, so this claim is the identity record)
Worktree: objectstack-wt (a linked worktree in this session's container)
Domain: domain:server
Seat: domain:services#1 (seat post #6021; scope agreed with the seat before this claim; the PR goes back to that seat for ACCEPT)
Ruling: #24586 letter A (6270097840), restart read in 6291735609. The series' .d.ts bar is ruling 6348891160 (sorted-union identity; raw identity reported when it holds).
Container & model: M, mode:thread, effort: high
Clause-②: no
Metadata-protocol: none
Responsibility: n/a — not a defect card (a [maintainer] refactor card).
Thread-read: none
Serial constraints cleared: none of the 12 open PRs touches packages/metadata-protocol/src/protocol.ts (each PR's file list read in this act, the Version Packages PR #24876 paged through all 395 files: only CHANGELOG.md / package.json in this package). Re-measured again before pr_create; a new open PR on the moved region means this cut yields.

File surface (read on origin/main 5188e7f18f, where protocol.ts is 32,468 lines):

Cut 2 = the discovery and diagnostics bodies from the card's "discovery, types, diagnostics, packaged bases, credential carry-forward" section: about 800 lines, 42 of them from the last 30 days (5%, the coldest slice left). Three ObjectStackProtocolImplementation method bodies move unedited into a new module, packages/metadata-protocol/src/protocol-discovery.ts (host DiscoveryHost), in the shape cut 1 used (#23050 shape B):

public: getDiscovery :8570, getMetaDiagnostics :9257;
private: listLiveMetadataTypes :9059.
Members read, measured by AST: engine (field, as a getter), and the methods getServicesRegistry, searchAll, getMetaItems, shippingPackagesOf, artifactLockLayerAt, servedLockState, isArtifactBacked (late-bound closures).

Stays, deliberately:

getMetaTypes :9077, between them: its body reads the private static ObjectStackProtocolImplementation.envWritableTypes(), which a module function cannot reach unedited (private statics stay, as in [maintainer] refactor(plugin-auth): split src/auth-manager.ts (10,338 lines, +1,867 in 30 days) along its AuthManager seams, one move-only slice per PR #25224). TYPE_TO_FORM, HAND_CRAFTED_SCHEMAS and toJsonSchemaSafe, read by it, stay with it. It keeps calling listLiveMetadataTypes through the class.
getProjectId :8566: its body is no longer than its stub would be.

Module-level declarations:

SERVICE_CONFIG :5498 is read only by getDiscovery: it moves with it, unedited with its docblocks, unexported.
type ShippingPackages :2304 is read by code that stays too: export added in place, imported back as a type. src/index.ts exports from ./protocol.js by name, so it is not published; the proof measures it.
The module imports from the same specifiers protocol.ts uses (@objectstack/spec/api, /system, /kernel, @objectstack/core, ./discovery-version.js, ./metadata-diagnostics.js, ./item-lock.js).

Readers (measured; the PR reports each base vs head):

scripts/adr-anchors/ protocol.ts entry: none of its paragraphs (ADR-0029 D9.8/D9.9 hydration seams, ADR-0119 batchData, ADR-0005/0087 view storage, ADR-0126 flow Regime C) describes these bodies, so no new entry. The decision letters inside the moved bodies leave the anchored surface; the exact check:adr-anchors count is reported base → head.
docs/qa/platform-checklist/areas/studio-authoring.json anchors protocol.ts#getMetaDiagnostics: the method shell stays, so it still resolves; not edited; check-platform-checklist at both ends.
None in the moved text: isSystem reads (system-context census), engine find/findOne/count/aggregate (erasure ratchet), engine update/delete seams (engine-double contract), new Error( (bracketed-refusal PRODUCERS), and none of the package's source-scanning pins' patterns.

⛔ Nothing else changes: no moved body is edited; the only stay-behind edits are the one export keyword and the stub bodies; no ADR or docs/** text is edited; no new gate. One PR, skip-changeset, Part of #25467.

Proof the PR carries, as cut 1: AST leaf-token identity of every moved body (with a negative control), .d.ts block per ruling 6348891160 (raw and normalised sha256 base/head, normaliser, raw diff, positive control), ESM/CJS export lists, the metadata-protocol suite at base and head, dispatch-gates --commands all run with exits and --ran, and the hand gates (check-adr-symbol-anchors, check:adr-anchors with letters, censuses, check-platform-checklist) at both ends.

Claim amendment: cut 2 of #25467 (amends claim 6370841668) · domain:services seat 1 (seat post #6021; 由Sales账户的项目负责) · 2026-10-23T17:45Z
Session: session_01J8pUyVs5eas1AjMdReJM7C
Branch: claude/project-thread-uasfag (unchanged, base origin/main 5188e7f18f)
Seat: domain:services#1 (the narrowed scope below agreed with the seat before this amendment)
Thread-read: 6370841668

Narrowed scope. Cut 2 is getMetaDiagnostics alone (:9257). Its body moves unedited into packages/metadata-protocol/src/protocol-meta-diagnostics.ts (host MetaDiagnosticsHost, members read: getMetaItems, shippingPackagesOf, artifactLockLayerAt, servedLockState, isArtifactBacked, as late-bound closures). type ShippingPackages gains export in place, as claimed. getDiscovery, listLiveMetadataTypes and SERVICE_CONFIG leave this cut and stay in protocol.ts; nothing else in the claim changes.

Why getDiscovery cannot move (measured, nothing pushed). It is public and its return type is INFERRED (async getDiscovery() {), so dist/index.d.ts prints the type the compiler infers. With its body moved in this series' shape, the stub's type is inferred from the new module, and the emitted .d.ts changed in two ways that are not union-member order: it dropped a property docblock (@deprecated Use name. Removed in protocol 18 (#4828).), and it spliced about 100 lines of an unrelated protocol.ts docblock (the save door's hook-without-body refusal) into a nested description property. Base raw 8e1a224c…, trial head raw fc33e319…; normalised (ruling 6348891160's normaliser) base 5b98a8e8…, trial head different, normalised diff 111 lines. Under ruling 6348891160 that is a stop, not a pass. The token proof and the package suite were clean on that trial; only the published surface moved. listLiveMetadataTypes' body is barely longer than its stub, and SERVICE_CONFIG is read only by getDiscovery, so both stay with it.

Carry-forward for later cuts. A public member with an inferred return type stays in protocol.ts in this series: annotating it would be a signature edit, which needs a ruling. Measured on 5188e7f18f, the public members with no declared type: getDiscovery, getMetaTypes, getMetaItems, getMetaItemsForExecution, getMetaItem, getMetaItemForExecution, getUiView, findData, getData, validateData, createData, cloneData, updateData, deleteData, saveMetaItem.

Decision letters: one leaves the anchored surface with the body (ADR-0110 D3); measured check:adr-anchors 1,979 → 1,978, reported in the PR.

Landed cut 2 · domain:services seat 1 (seat post #6021) · os-sales · session_016g7nYP9wdNx1GDa5XDr7Uy · 2026-10-23T19:27Z

reading	value
PR #25518	MERGED through the queue (ACCEPT `6372365108`), head `9f403be528`
`origin/main`	carries `b2411c001d`

State: the card stays open and dispatched (Part of). The card thread claims the next cut afresh on the merged protocol.ts. Public members whose return type is inferred stay in the class.

Generated by Claude Code

Claim: card thread · domain:server (former domain:engine surface) · for domain:services seat 1 (seat post #6021, project run by the Sales account; 由Sales账户的项目负责) · p2 · series card, cut 3 (one PR; cuts strictly serial; cut 1 landed as #25494 bf5855b5bc, cut 2 as #25518 b2411c001d) · 2026-10-23T19:38Z
Session: session_01J8pUyVs5eas1AjMdReJM7C
Account: os-sales (the seat's linked user; the card's assignee)
Branch: claude/project-thread-uasfag (the harness-pinned branch for this session, restarted from origin/main b2411c001d after cut 2 merged; it names no issue, so this claim is the identity record)
Worktree: objectstack-wt (a linked worktree in this session's container)
Domain: domain:server
Seat: domain:services#1 (seat post #6021; scope A agreed with the seat before this claim, with its conditions carried below; the PR goes back to that seat for ACCEPT)
Ruling: #24586 letter A (6270097840), restart read in 6291735609. The series' .d.ts bar is ruling 6348891160 (sorted-union identity; raw identity reported when it holds).
Container & model: M, mode:thread, effort: high
Clause-②: no
Metadata-protocol: none
Responsibility: n/a — not a defect card (a [maintainer] refactor card).
Thread-read: none
Serial constraints cleared: none of the 9 open PRs touches packages/metadata-protocol/src/protocol.ts (each PR's diff against its merge base read in this act; the Version Packages PR #24876 touches only CHANGELOG.md / package.json in this package). origin/main (f38832be9c) has not touched this package since b2411c001d. Re-measured again before pr_create; a new open PR on the moved region means this cut yields.

File surface (read on origin/main b2411c001d, where protocol.ts is 32,309 lines):

Cut 3 = the query validation: the section :12797–:14502 (1,706 lines, 382 of them from the last 30 days). Nineteen PRIVATE ObjectStackProtocolImplementation methods move unedited into a new module, packages/metadata-protocol/src/protocol-query-validation.ts (host QueryValidationHost), in the shape cuts 1–2 used (#23050 shape B):

assertObjectRegistered :12861, resolveQueryFields :12933, assertQueryParamsAreFields :12961, assertFilterFieldsExist :13064, assertSortFieldsExist :13358, assertProjectionFieldsExist :13546, assertExpandTargetsExist :13670, assertSearchFieldsAreSearchable :13793, assertGroupByFieldsExist :13988, assertAggregationFieldsExist :14103, assertNoInternalFieldEvaluated :14283, refuseInternalInFilter :14313, refuseUnservedRelationTarget :14346, refuseInternalInExpand :14373, servedExpand :14429, servesExpansionTarget :14454, orderByFieldNames :14460, groupByFieldNames :14469, refuseInternalNames :14478.
All private, so the published .d.ts prints no type for any of them: none is on the series' skip list of public inferred-return members.
Members read, measured by AST: engine (field, as a getter), and the methods assertFilterFieldsExist, groupByFieldNames, orderByFieldNames, refuseInternalInExpand, refuseInternalInFilter, refuseInternalNames, refuseUnservedRelationTarget, resolveQueryFields, servedExpand, servesExpansionTarget (late-bound closures, so the recursive walks still go through the protocol).

Module-level declarations, each measured by an AST reader walk over all of protocol.ts (identifier references outside the declaration itself):

Move with the bodies, byte-identical, unexported (no reader outside the moved bodies and the other moved declarations): nestedRelationRoute :392, warnedNoRegistryForDataGate :536 (the mutable let: its only reads and its only write are in assertObjectRegistered, so the state moves whole and is never copied), AGGREGATION_FUNCTIONS :4489, DATE_GRANULARITIES :4490, UNMATERIALIZED_SORT_TYPES :4892, invalidQueryError :4988, suggestQueryParam :5131, collectFilterFieldKeys :5217, INTERNAL_FIELD_WALK_DEPTH :5321, EXPANSION_TARGET_OPERATION :5337, RELATION_CONDITION_TARGET_OPERATION :5348. Their initialisers read only package imports or nothing, so module evaluation order is unaffected.
Stay and gain export in place (read by code that stays, or by a moved helper and by code that stays): collectFilterReads (← collectStoredMetadataFilterFields), invalidSortError (← normalizeSortNodes, invalidSortDirectionKeyError), isObjectOfDisabledPackage and objectPackageDisabledError (← readMetaItemFace, getMetaItemLayered), isPlainRecord (← storableEqual, soleMovedFrom, buildStorableViewNode), suggestFieldName, FILTER_LOGICAL_KEYS, QUERY_PARAM_NEAR_MISS, nearMissKey, ODATA_SPELLING. src/index.ts exports from ./protocol.js by name, so none is published; the proof measures it.
protocol.ts drops the import names that lose every reader (noUnusedLocals); the module imports them from the same specifiers.

Readers (measured; the PR reports each base vs head):

protocol.bracketed-refusal-opener-absence.test.ts PRODUCERS: 17 new Error( sites move (16 in the methods, 1 in invalidQueryError); protocol.ts 104 → 87 against its floor 5, and the new module is listed with its measured floor, 17.
scripts/adr-anchors/ protocol.ts entry: none of its paragraphs (ADR-0029 D9.8/D9.9, ADR-0119 batchData, ADR-0005/0087 view storage, ADR-0126 flow Regime C) describes these bodies, so no new entry. check:adr-anchors decision letters are reported exactly base → head.
docs/qa/platform-checklist/areas/api-backend.json and search.json anchor protocol.ts# moved methods: the method shells stay, so they still resolve; not edited; check-platform-checklist at both ends.
Censuses, the query-options erasure baseline, the engine-double contract seams and the package's source-scanning pins are each run at both ends.
Size: under the 3,000-changed-line bar (measured: +1,591 / −1,283 over 3 files).

⛔ Nothing else changes: no moved body or declaration is edited; the only stay-behind edits are the ten export keywords, the narrowed import lists and the stub bodies; no ADR or docs/** text is edited; no new gate. One PR, skip-changeset, Part of #25467.

Proof the PR carries, as cuts 1–2: AST leaf-token identity of every moved body and declaration (with a negative control), the declaration reader table, .d.ts block per ruling 6348891160 (raw and normalised sha256 base/head, normaliser, raw diff, positive control), ESM/CJS export lists, the metadata-protocol suite at base and head compared per test, dispatch-gates --commands all run with exits and --ran, and the hand gates at both ends.

Landed cut 3 · domain:services seat 1 (seat post #6021) · os-sales · session_016g7nYP9wdNx1GDa5XDr7Uy · 2026-10-23T22:03Z

reading	value
PR #25538	MERGED through the queue (ACCEPT `6375081284`), head `3b1ae50413`
`origin/main`	carries `798d480269`

State: the card stays open and dispatched (Part of). The card thread claims cut 4 afresh on the merged protocol.ts. #25533 also edits protocol.ts (publishDrafts). Its merge-tree is clean, but its byte offsets have shifted, so its .d.ts is re-read before it lands.

Generated by Claude Code

domain:server#1 · os-sales · session_01L6bhgXcN9HaZYSEUdJWEjw

Claim: PM loop round 1 · card thread · cut 32 (parseCommitItems) · 2026-10-29T04:10Z
Session: session_01L6bhgXcN9HaZYSEUdJWEjw (the seat); the card thread is session_01L6bhgVaAsaDVwT6XfwB5yk
Account: os-sales (the seat's linked user; the card's assignee)
Branch: claude/project-thread-xbievt (the card thread's harness-pinned branch; it names no issue, so this claim is the identity record)
Worktree: the card thread's own container checkout
Domain: domain:server
Seat: domain:server#1
Ruling-ref: #24586 ruling A (6270097840); card body "Each slice is move-only: no logic changes"; .d.ts bar ruling 6348891160
File surface: packages/metadata-protocol/src/protocol.ts (the parseCommitItems body becomes a stub; CommitPlanItem gains export in place), new packages/metadata-protocol/src/protocol-commit-items.ts, any by-path reader of the moved body. ⛔ No packages/spec/**, ⛔ no docs/adr/** (stop on breach; explain in the report)
Container & model: S (build-heavy: .d.ts bar, census, derived gates), mode:thread, model: default tier (dispatch-gates.mjs --tier: "no path-derived mandate"), effort: medium
Clause-②: no
Metadata-protocol: none
Responsibility: n/a — not a defect card
Thread-read: 6468281430
Premise: holds (read-only premise reading at origin/main c4c515ad3: parseCommitItems is still in protocol.ts with its two callers listPackageCommits and revertCommit; no protocol-commit-items.ts; correction to cut 31's proposal: CommitPlanItem is a non-exported module type, not an import)
Serial constraints cleared: no open PR touches packages/metadata-protocol/** (15 open PRs read); the knock 6407681586 (#25783, closed) is disjoint; #25522 cut 19 (this seat, card thread) touches packages/objectql only. Lane card threads at claim: 2 of the maintainer's 5.

Generated by Claude Code

domain:server#1 · os-sales · session_01L6bhgVaAsaDVwT6XfwB5yk
os-dev-report
{
"issue": 25467,
"status": "done",
"branch": "claude/project-thread-xbievt",
"pr": "#27406",
"session": "session_01L6bhgVaAsaDVwT6XfwB5yk — the card thread (claim 6487683544)",
"premise_still_valid": true,
"summary": "Cut 32, move-only, the one member as proposed: parseCommitItems (base :26479, private, return type declared CommitPlanItem[], 10 body lines, no docblock) moved into the new protocol-commit-items.ts (44 lines). It reads no class member, so there is no host: the stub is return parseCommitItems(raw);, as cut 26 did for orgWallEnforced. Both callers stay on the class method: listCommits (base :26577) and revertCommit (base :26693); the claim's premise named the first one listPackageCommits, the method is listCommits. PM correction confirmed: CommitPlanItem is protocol.ts's own non-exported type alias (base :2751), not an import; it gains export in place and the module uses import type (precedent cuts 16/23/31; disclosed in the PR). Screen: no private-static read, no this.constructor read (no this at all), 0 new Error(; the try/catch guards JSON.parse, not a storage read. Read-seam census 89 at base and head, identical --list. 60 changed lines (+49/-11; estimate 40-70). protocol.ts 29,514 -> 29,508. Commits: dda5102 (move) on main c4c515a; merge of main 9b33088 (4 commits up to 7e200b4, none in this package); a093981, a comment-only fix of the new module's header (caller name). Head a093981.",
"tests": "metadata-protocol suite (vitest --maxWorkers=2, json reporter, under os-verify-lock): base c4c515a (src swapped tree-only, restored from HEAD under a trap), move commit dda5102 and final head a093981 all 21,800 tests (21,774 passed, 0 failed, 26 skipped), 283 files; per test name over 21,787 distinct names 0 lost/added/changed. AST compare: 73 tokens, 0 differ, ws-collapsed text incl. comments equal. Negative controls, one-token in-memory swaps, each differ 1: typeof raw === 'string' -> 'object'; Array.isArray(p) ? p -> Array.isArray(raw) ? p. Class 304 members, 303 byte-identical, 1 stub keeps leading trivia+signature. Top level: 264 of 265 non-class statements byte-identical; the other is CommitPlanItem gaining export; head adds the module import. tsc --noEmit 0 at head (before and after the merge); eslint --no-inline-config packages/metadata-protocol 0, no output.",
"gates": ".d.ts (ruling 6348891160), base c4c515a vs head, one dependency tree (full turbo build 115/115): RAW 4cb92b2e20135dd78d07fd2800b1d2a050a432b923cd511d5b50f3ed6de29a58 (784,960 bytes) and NORMALISED a4dcc2306638c29983bceaf7258df71a29a3020a3ec26904c9830a0cecd0c70e at both ends, index.d.ts = index.d.cts; raw-diff 0 lines, so raw identity holds (the cut 25 comment-offset trap did not fire); same hashes on dda5102, the merged tree and a093981. Positive control (private dropped) -> raw ca90763579860f2c (785,652 bytes), normalised b7639852d59f8343, printing parseCommitItems(raw: unknown): CommitPlanItem[]. index.js 20239680cb0cf515 -> e5abe0490663649f (index.cjs f3ac1e9bdd5b9e96 -> 1c36338d33aa16a5); function parseCommitItems( 0 -> 1 in each bundle. Export tables ESM+CJS 78 names sha e47ac7c753bcb8be at both ends; neither parseCommitItems nor CommitPlanItem. Hand gates exit 0 at both ends (base in a clean detached worktree at c4c515a), identical: adr-anchors, adr-symbol-anchors, system-context-census, tenant-audit-census, query-options-erasure-ratchet (50 sites / 15 files), filter-alias-parity, durability-degradation-log-level (89; --list identical after stripping [@:][0-9]+, 165 lines). nul-bytes +1 file. engine-double-contract: seams 13997->13999 and 14022->14024; productionFiles 3,876 -> 3,878. On the final head adr-anchors equals main 7e200b4's output (60,467 citations; the +1 vs base comes from the merged main commits) and durability equals base. platform-checklist --changed-from origin/main OK (32 judged, 0 lost). Governed: 0 of 2 paths, 60 lines. Derived on a093981: 46/46 exit 0; --ran 46 derived, 46 run, 0 NOT-MEASURED, 0 UNRUN. Open PRs at pr_create (23): none edits protocol.ts; #26517 (Version Packages, CHANGELOG/package.json in this package) conflicts with this head in exactly the 4 ui/packages/*/package.json files it already conflicts with on main ad2c286 (bare clone, no merge driver). main moved 1 commit after the merge (ad2c286, plugin-grid), merge-tree clean, not merged again. CI at report time: just started.",
"dogfood_battery": "n/a — no ! in the PR title and the claim's Clause-② is no with no (narrowing) arm",
"mcp_calls": "0 GitHub MCP calls (claim, cut 31 report/PR and open-PR list read by the REST API through gh api); 0 GitHub MCP writes; no subscribe_pr_activity",
"api_writes": "4 — git push of claude/project-thread-xbievt (3 pushes of one branch); relay pr_create (run 40822860405 -> #27406, draft, assignee os-sales, label skip-changeset; read back 13,313 body bytes identical); relay pr_request_reviewers os-sales (run 40822933692; requested_reviewers reads [os-sales]); this os-dev-report via post-stamped.mjs",
"line_budget": "60 changed lines (+49/-11), under the 3,000-line bar",
"files_changed": [
"packages/metadata-protocol/src/protocol.ts",
"packages/metadata-protocol/src/protocol-commit-items.ts"
],
"deviations": [
"CommitPlanItem gains export in place (the dispatch's correction; precedent cuts 16/23/31). Its statement is otherwise unedited; index.ts names exports one by one and does not name it, so the .d.ts and the 78-name export tables are unchanged. It is the only top-level statement that differs.",
"One commit after the merge, a093981, edits only the new module's header comment (it named the caller listPackageCommits, taken from the claim's premise; the method is listCommits). Every head reading was re-taken on it: build and .d.ts hashes, AST compare, suite, tsc, derived gates and the comment-reading hand gates."
],
"open_questions": [],
"out_of_scope_findings": [
"Liveness ledger follow-up, carried forward (packages/spec/**, outside this card): manifest.json dependencies -> protocol.ts#resolveWritePackageScope (cut 19) and seed.json -> protocol.ts#applySeedBodies (cut 14). No row points at the cut 32 member.",
"#26517 (Version Packages) conflicts with main itself in ui/packages/cli, data-objectstack, fields and types package.json; not this card's, noted for the seat."
]
}

domain:server#1 · os-sales · session_01L6bhgXcN9HaZYSEUdJWEjw

Release: cut 32 delivered · back to `pm:queue` · `domain:server#1` · 2026-10-29T06:02Z

⛔ Not a claim. This card is Part of a series, and the seat's claim on cut 32 ends with its merge.

Delivered: PR refactor(metadata-protocol): move the commit plan items parse out of protocol.ts into protocol-commit-items.ts (#25467 cut 32) #27406, merged 2026-10-29T06:02Z (9f57dcc6d8).
- parseCommitItems moved into packages/metadata-protocol/src/protocol-commit-items.ts, with no host.
- CommitPlanItem gained export in place. It is not on the package surface.
- protocol.ts went from 29,514 to 29,508 lines.
- Seat record: ACCEPT 6488985490. Dev report: 6488726644.
Carried forward (not this lane's): the spec liveness ledger still points two rows at protocol.ts:
- manifest.json dependencies → protocol.ts#resolveWritePackageScope (moved in cut 19);
- seed.json → protocol.ts#applySeedBodies (moved in cut 14).
Those rows live in packages/spec/**, so the spec lane re-points them.
Next claimant: re-price the next member on fresh origin/main before quoting a size. No branch carries unmerged work for this card (Resume-from: none).

Generated by Claude Code

domain:server#1 · os-sales · session_01L6bhgXcN9HaZYSEUdJWEjw

Claim: PM loop round 2 · card thread · cut 33 (a batch of the remaining movable private members, from storedRowKnownDatasources) · 2026-10-29T06:07Z
Session: session_01L6bhgXcN9HaZYSEUdJWEjw (the seat); the card thread is session_01L6bhgVeV5GgzaH9Ny16aSx
Account: os-sales (the seat's linked user; the card's assignee)
Branch: claude/project-thread-06v1io (the card thread's harness-pinned branch; it names no issue, so this claim is the identity record)
Worktree: the card thread's own container checkout
Domain: domain:server
Seat: domain:server#1
Ruling-ref: #24586 ruling A (6270097840); card body "Each slice is move-only: no logic changes"; .d.ts bar ruling 6348891160
File surface: packages/metadata-protocol/src/protocol.ts (moved bodies become stubs), new packages/metadata-protocol/src/protocol-*.ts modules grouped by theme, any by-path reader of a moved body. One PR under 3,000 changed lines. ⛔ No packages/spec/**, ⛔ no docs/adr/** (stop on breach; explain in the report)
Container & model: S–M (build-heavy: .d.ts bar, census, derived gates), mode:thread, model: default tier (dispatch-gates.mjs --tier: "no path-derived mandate"), effort: medium
Clause-②: no
Metadata-protocol: none
Responsibility: n/a — not a defect card
Thread-read: 6489282987
Premise: holds (read at origin/main c5d463417: storedRowKnownDatasources is still a private method body in protocol.ts, line 6555; cut 32 landed as 9f57dcc6d8; cut 31's member census leaves 138 class members with live bodies, 81 of them private). Single-member cuts now yield 6 to 10 lines, so this cut screens every remaining private member with a live body and moves all that pass. The report lists each reject with its reason, so the next claimant can tell whether the series is spent.
Serial constraints cleared: no open PR touches packages/metadata-protocol/** (all open PRs' file lists read). Lane card threads at claim: 1 of the maintainer's 5.

Generated by Claude Code

Navigation Menu

Repository navigation

[maintainer] refactor(metadata-protocol): split `src/protocol.ts` (33,065 lines, +10,169 in 30 days) along its `ObjectStackProtocolImplementation` seams, one move-only slice per PR #25467

Measured (on `origin/main` `b2c0752900`, 2026-10-23)

The ask (from #24586's ruling and #23050's shape)

Not in this card

Dedupe

103 remaining items

Release: cut 32 delivered · back to `pm:queue` · `domain:server#1` · 2026-10-29T06:02Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[maintainer] refactor(metadata-protocol): split src/protocol.ts (33,065 lines, +10,169 in 30 days) along its ObjectStackProtocolImplementation seams, one move-only slice per PR #25467

Description

Measured (on origin/main b2c0752900, 2026-10-23)

The ask (from #24586's ruling and #23050's shape)

Not in this card

Dedupe

Activity

objectstack-fleet commented on Oct 23, 2026

objectstack-fleet commented on Oct 23, 2026

objectstack-fleet commented on Oct 23, 2026

objectstack-fleet commented on Oct 23, 2026

objectstack-fleet commented on Oct 23, 2026

objectstack-fleet commented on Oct 23, 2026

objectstack-fleet commented on Oct 23, 2026

103 remaining items

objectstack-fleet commented on Oct 29, 2026

objectstack-fleet commented on Oct 29, 2026

objectstack-fleet commented on Oct 29, 2026

Release: cut 32 delivered · back to pm:queue · domain:server#1 · 2026-10-29T06:02Z

objectstack-fleet commented on Oct 29, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

[maintainer] refactor(metadata-protocol): split `src/protocol.ts` (33,065 lines, +10,169 in 30 days) along its `ObjectStackProtocolImplementation` seams, one move-only slice per PR #25467

Measured (on `origin/main` `b2c0752900`, 2026-10-23)

Release: cut 32 delivered · back to `pm:queue` · `domain:server#1` · 2026-10-29T06:02Z