[finding] saveMetaItem's Phase 3a-destructive gate declares a `field` limb that can never produce a finding — two independent reasons

[os-elon]

Observed while inventorying the DESTRUCTIVE_CHANGE 409's wire faces for #10886. Not a defect anyone can trip — a declared limb with no enforcement behind it, filed so it is not rediscovered as a bug.

The declaration

packages/metadata-protocol/src/protocol.ts, saveMetaItem Phase 3a-destructive (currently around :13157):

if (!request.force && (singularType === 'object' || singularType === 'field')) {

The field half of that disjunction is inert, for two reasons that are independent of each other — either alone is sufficient.

Reason 1 — a field body has no fields map to diff

detectDestructiveObjectChanges(prev, next) (same file, currently around :3141) reads prev.fields and next.fields and returns [] when neither is an object. A field metadata item's body IS a single field definition (FieldSchema — name, type, label, …), not a container carrying a fields map. So for singularType === 'field' the detector returns an empty array unconditionally and the gate never fires.

Reason 2 — field cannot be written through this door at all

packages/spec/src/kernel/metadata-plugin.zod.ts:733 declares the type code-only:

{ type: 'field', label: 'Field', …, supportsOverlay: false, allowOrgOverride: false, allowRuntimeCreate: false, … }

Measured through the real saveMetaItem against a seeded sys_metadata row of type: 'field', the write is refused before persistence with:

code = NOT_CREATABLE
[not_creatable] Metadata type 'field' is code-only: the metadata-type registry declares
allowRuntimeCreate=false and allowOrgOverride=false, so it cannot be created through the
runtime metadata API …

So no caller can reach the destructive gate with singularType === 'field' even if reason 1 were fixed.

Why it is worth recording rather than silently deleting

The limb reads as coverage. #10886's inventory had to establish, per face, exactly which types can reach this gate, and the field spelling in the condition is the one thing that makes the answer look wider than it is — an inventory that trusted the condition would have had to chase a face population that does not exist.

Disposition is a judgement call and deliberately not made here: dropping the dead limb (Prime Directive #10's trim-it arm) versus giving field a real destructive diff (a type change on a standalone field IS a data-loss event in principle) point in opposite directions, and the second only makes sense if field ever becomes runtime-writable. No behaviour depends on the answer today.

Measured on origin/main at 490879ad0f.

[huangyiirene]

Concentration-round first-touch: promoted finding → pm:queue, Task S, domain:engine. Ruled at triage between the card's two directions: trim the dead limb — both reasons are measured and independent (field bodies have no fields map to diff; field is code-only and cannot reach this door), so the condition currently overstates the gate's coverage to every future inventory. Delete singularType === 'field' from the disjunction with a comment citing this card; the "give field a real destructive diff" direction only becomes meaningful if field ever becomes runtime-writable, and returns then as a Feature with that change. Hot-surface note: protocol.ts also carries queued #11015 and the #11017/#10888 family — engine seat sequences.

---

Generated by Claude Code

[os-zhuang]

Claim: PM loop round 8
Session: session_01RfyXxZ2WPjcjhuXpiQQc3y
Branch: claude/issue-11014-trim-dead-field-limb
Worktree: objectstack-issue-11014
Domain: domain:engine
File surface: packages/metadata-protocol/src/protocol.ts (saveMetaItem Phase 3a-destructive, the disjunction at :13333) + a pin + changeset (stop on breach; explain in the report)
Container & model: S, mode:subagent
Clause-②: no — the limb being removed can never fire, so no call changes verdict. That is exactly what you must re-verify before deleting (below).
Serial constraints cleared: protocol.ts is free — PR #11156 (#11003) merged as c74aefe63; #11015 / #10888 / #11017 all landed earlier this term. sys-metadata-repository.ts is also released (#11139 merged). In-flight siblings: #11067 (driver-sql), #10744 / #10729 (queued PRs, other packages) — all disjoint. Lane dev slots in use at claim: 1.

Triage ruled the direction — the card deliberately left it open, triage closed it

The card states its own disposition as undecided ("dropping the dead limb versus giving field a real destructive diff point in opposite directions"). Triage's first-touch picked one:

trim the dead limb — both reasons are measured and independent … Delete singularType === 'field' from the disjunction with a comment citing this card; the "give field a real destructive diff" direction only becomes meaningful if field ever becomes runtime-writable, and returns then as a Feature with that change.

⛔ Do not re-open that choice. If implementation makes trimming look wrong, stop and report rather than switching arms.

Premise re-verified on merged main @ ec79b1151 — ⚠️ the line has MOVED

The card cites "currently around :13157". Tonight's merges shifted it. Measured now:

what	where
the disjunction	protocol.ts:13333 — if (!request.force && (singularType === 'object' || singularType === 'field')) {
detectDestructiveObjectChanges	protocol.ts:3212
field declared code-only	packages/spec/src/kernel/metadata-plugin.zod.ts:733 — allowRuntimeCreate: false, allowOrgOverride: false, supportsOverlay: false

⛔ Re-verify BOTH reasons before deleting — this is the whole risk of the card

The limb is safe to delete only because it cannot fire, and that rests on two independent claims. Either one failing turns a trim into a removal of real coverage:

1. A field body has no fields map to diff. detectDestructiveObjectChanges(prev, next) reads prev.fields / next.fields and returns [] when neither is an object. A field item's body is a single field definition (FieldSchema), not a container. Confirm at :3212 that the early-return still behaves that way.
2. field cannot reach this door at all. The type is code-only, so a write is refused with NOT_CREATABLE before persistence. The card measured that through the real saveMetaItem; re-measure it rather than trusting the quote.

If either reason no longer holds, ⛔ stop and report — do not delete.

Deliverable shape

• Delete singularType === 'field' from the disjunction, leaving a comment citing [finding] saveMetaItem's Phase 3a-destructive gate declares a field limb that can never produce a finding — two independent reasons #11014 and stating why it was inert (both reasons), so a future reader does not "restore" it as missing coverage.
• Pin it. The point of the card is that the condition made the gate's coverage read wider than it is, and an inventory that trusted it chased a face population that does not exist. A test asserting that a field write is refused before the destructive gate — i.e. that the gate's reachable type set is object alone — is what stops the limb growing back.
• ⛔ packages/spec is read-only for you. Reason 2 lives there; read metadata-plugin.zod.ts:733, do not edit it.

⛔ Boundaries

1. ⛔ Never edit content/docs/releases/. Breaking changes ship as minor, never major.
2. ⛔ Do not skip/disable/quarantine a test, and ⛔ do not raise a ratchet's ceiling to pass it — fix the code the way the ratchet prescribes.
3. ⚠️ A new test declaring an engine double must route update()/delete() through assertEngineUpdateDispatch/assertEngineDeleteDispatch from @objectstack/metadata-core (⛔ never from objectql — reverse edge, turbo refuses). That predicate was tightened tonight by A compare-and-set where on a by-id update is silently inert — the extra predicate keys never reach the driver, and SqlHttpOutbox.redeliver's status guard is one of them #11009 (8cc840198): a by-id write whose where carries keys beyond id is now refused. Branch from fresh origin/main.
4. ⛔ packages/drivers/driver-sql/src/sql-driver.ts is held by in-flight driver-sql: updated_at is never refreshed on a deployment that skips boot schema sync — tablesWithTimestamps is also only filled by DDL #11067 — out of bounds.

---

Generated by Claude Code