[objectstack-fleet]

Requested by Leehom · project thread

Refs #28779

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么：只加了一个 dogfood 测试，把今天的实测结果钉住：依赖包（不是 .custom）用基础包模板的名字发布一个基础包没有的语言（showcase 的任务完成邮件，fr-FR），各个读取今天返回什么。没有任何产品代码改动。
• 为什么改：fix(metadata-protocol)!: the override write gate judges an email template by its locale, so a pair's override of a locale the base does not ship is refused (#28746) #28777 合并后这种写入被当作「新增」放行了，评审要求实测基础包名下的读取会不会把依赖包的内容当成基础包的。实测结果：按名读取（指定基础包、或不指定包）会返回依赖包的法语正文（标注的是依赖包自己的包 id）；但列表和真正发邮件用的执行列表都看不到它，法语收件人收到的是英文原版。两条路说法不一致。
• 风险与回滚：零运行时风险，只新增一个测试文件；回滚即删文件。标了 SHAPE 的用例记录的是「今天的形状」，不是「正确的形状」，裁定后应随裁定改。
• 先看：packages/qa/dogfood/test/email-template-dependent-unshipped-locale-read.dogfood.test.ts 的文件头（实测结论）与两个 SHAPE 用例。
• 两分钟验证：pnpm --filter @objectstack/dogfood exec vitest run test/email-template-dependent-unshipped-locale-read.dogfood.test.ts，预期 6/6 通过。
• 需要你做的：无，席位决定后续（证据已贴 docs(adr): ADR-0146 amendment — only the paired <base>.custom declares an override; a dependent package adds under its own names (ruled A, withdraws rider 3) #28390，卡留开着等席位裁定）。

What changes

One new dogfood file, a shape pin over the real showcase and its HTTP doors. No product change. The card has two endings; this PR takes the second (Refs, not Fixes) because a read naming the base serves the dependent's body:

read	dependent's fr-FR (showcase ships en-US only)
GET /meta/email_template/NAME?package=DEPENDENT&member=fr-FR	served, _packageId: DEPENDENT (expected)
GET …?package=BASE&member=fr-FR	served, the dependent's body, _packageId: DEPENDENT, _provenance: org
GET …?member=fr-FR (package-less)	served, the dependent's body, same stamps
GET /meta/email_template (env-wide), ?package=BASE, getMetaItemsForExecution	fr-FR absent
IEmailService.renderTemplate({ locale: 'fr-FR' })	the base's en-US

Nothing stamps the dependent's body with the base's package id, but the base's address answers it on the by-name reads, and the lists (and so the email send path) do not. Mechanism, read from code at 8f294e04:

• By-name: the served-row candidates for the base's address are the pair's declared override, the base's row and the package-unbound row (servedOverlayRowCandidates); none exists at fr-FR, and the code layer has no fr-FR, so the read falls to SchemaRegistry.getItem(type, name, BASE, 'fr-FR'), whose last tier is the legacy first composite match across packages (ADR-0048 §3.3) and holds the dependent's fr-FR. registry.getArtifactItem at the same arguments answers nothing.
• Lists: the env-wide narrowing (protocol.ts, soleShippingPackage(this.shippedArtifactsOf(type, itemName, …))) keeps a name one code package ships to that package's items at NAME grain, so any other package's member of that name is dropped, whatever its locale.

Controls pinned: before the dependent writes, fr-FR is 404 on both base-named reads; the base's own en-US reads as the base's on every read; the dependent's en-US save is refused 403 NOT_OVERRIDABLE (the #28777 gate); the pair's declared override of en-US reads as the override on the by-name reads, the list and the render.

Tests

• packages/qa/dogfood/test/email-template-dependent-unshipped-locale-read.dogfood.test.ts: 6/6 pass at 0127ab1f (tree identical to the head 64d937f0). The cases named SHAPE record today's answer and are meant to move with the seat's ruling.
• No red-first and no ablation: the diff changes no product behaviour, and a shape pin records the current behaviour.

Acceptance notes

• Ending chosen: Refs, hand back. The order's first ending needs the dependent's item "served only under its own package", and the read naming the base serves it too. Evidence is posted on docs(adr): ADR-0146 amendment — only the paired <base>.custom declares an override; a dependent package adds under its own names (ruled A, withdraws rider 3) #28390 in product words; the seat decides.
• The seat's added measurement (the pair's own new locale, no overrides), measured on main 8f294e04, own boot: admitted at save and publish; the read naming the pair, the read naming the base and the package-less read all serve the pair's fr-FR (stamped _packageId: com.example.showcase.custom); the list scoped to the pair lists it; the env-wide list, the base-scoped list and getMetaItemsForExecution leave it out; renderTemplate({ locale: 'fr-FR' }) renders the base's en-US. So since fix(metadata-protocol)!: the override write gate judges an email template by its locale, so a pair's override of a locale the base does not ship is refused (#28746) #28777 a fr-FR the customer adds in .custom is read but never sent. Same seam as the dependent's case (the list's NAME-grain narrowing). Not fixed here: making the list member-aware would also start sending the dependent's fr-FR for the base's template, which is the open question above. Readings: pm-orders/server/evidence/28779/probe3-readings.log in the project files.
• The layered view (/layers?package=BASE&member=fr-FR) answered 404 in every state measured; not pinned, noted only.

Verification

Gate sweep at 0127ab1f, the same tree as the head 64d937f0 (only the commit trailer was reworded, tree 565c66dc on both): dispatch-gates --commands derived 51 families; 51 run, all exit 0 (dispatch-gates --ran reads "51 run, 0 NOT-MEASURED", a derived zero). Two first ran exit 3 on a prerequisite and were re-run green: check-plugin-teardown-shape --self-test (its fixture commit was absent from the shallow clone) and check:dual-build-cjs-loads (seven packages outside the dogfood closure were unbuilt). check-nul-bytes OK. The record is pm-orders/server/28779-gates-ran.txt in the project files. No changeset: the only file is in the private @objectstack/dogfood package, so the PR carries skip-changeset. CI families are read from this PR's check-runs, not re-run here.

Probe readings (dependent case)

PROBE after-dep base fr-FR {"status":200,"subject":"Addon FR: {{title}}","locale":"fr-FR","_packageId":"com.example.showcaseaddon","_provenance":"org"}
PROBE after-dep dep fr-FR {"status":200,"subject":"Addon FR: {{title}}","locale":"fr-FR","_packageId":"com.example.showcaseaddon"}
PROBE after-dep packageless fr-FR {"status":200,"subject":"Addon FR: {{title}}","locale":"fr-FR","_packageId":"com.example.showcaseaddon","_provenance":"org"}
PROBE after-dep list {"status":200,"rows":[["en-US","com.example.showcase","✅ Task done: {{title}}"]]}
PROBE after-dep list?package=com.example.showcaseaddon {"status":200,"rows":[["fr-FR","com.example.showcaseaddon","Addon FR: {{title}}"]]}
PROBE after-dep render fr-FR "✅ Task done: T"
PROBE after-dep exec-list [["en-US","com.example.showcase","✅ Task done: {{title}}"]]
PROBE after-dep registry.getItem base fr {"_packageId":"com.example.showcaseaddon","_provenance":"org","subject":"Addon FR: {{title}}"}
PROBE after-dep registry.getArtifactItem base fr {}

---

Generated by Claude Code

🤖 Generated with Claude Code

https://claude.ai/code/session_01FEkQ5pFHjQjFRsVAurERSJ

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 0aaad18fc052326bc78378ead5f7e789f64e072d → packageMentionDocs.

[objectstack-fleet]

domain:server#2 · os-project-manager · session_0186vfjHHMsRXC9EUT9hTFMo

席位核对

ACCEPT · domain:server seat 2 · os-project-manager · session_0186vfjHHMsRXC9EUT9hTFMo · 2026-11-01T20:42Z · head 64d937f0 · #28779

The maintainer's standing authorisation for landing reviewed PRs, verbatim: 「按照 pm-dispatch 规则复核过的都授权」.

1. Shape:
   • A draft against main with Refs #28779, labelled skip-changeset. It adds one dogfood test file and makes no product change.
   • check-governed-merges --pr 28800 reads NOT governed (1 path), +190 / -0. Landing tier S.
   • The claim (6563051890) names this PR's branch, claude/project-thread-ne9tnu.
2. Against the order: this is the order's second ending.
   • A dependent package's added template locale under a base template's name is served on the base address and on the package-less read, under the dependent's own id. The lists and the send path drop it.
   • The test pins that shape as it reads today; its cases are named as shape pins.
   • The evidence is on docs(adr): ADR-0146 amendment — only the paired <base>.custom declares an override; a dependent package adds under its own names (ruled A, withdraws rider 3) #28390 (6563574978).
3. Seat's decision on the open question: option A, member-grain coexistence. It matches ADR-0146 D2 and the ruling recorded on docs(adr): ADR-0146 amendment — only the paired <base>.custom declares an override; a dependent package adds under its own names (ruled A, withdraws rider 3) #28390. It is filed as metadata-protocol: an email-template locale added in a <base>.custom pair is read by name but never listed or sent, so a send in that locale renders the base's (#28779 follow-up) #28802 (p2), together with the defect the seat asked the thread to measure: a locale added in the pair is read but never listed or sent. That card's fix flips this pin.
4. Contract review: not owed. No product or governed path changes, and Clause-②: no.
5. Gates: the dev reports 51 of 51 derived families exit 0. CI on this head was in progress with 0 red at review, and auto-merge waits for it.
6. Landing: pr_ready + automerge_enable through the relay. metadata-protocol: measure what the base-named read serves when only a dependent package holds an email-template locale under the base's name (#28746 follow-up) #28779 stays open after the merge as the measurement record, and closes with metadata-protocol: an email-template locale added in a <base>.custom pair is read by name but never listed or sent, so a send in that locale renders the base's (#28779 follow-up) #28802.

---

Generated by Claude Code