authz caching leg D: `getMetaItems` overlay cache keyed on the registry epoch — resolve the SchemaRegistry-hydration trap explicitly

[os-support-ai]

Leg D (ship second) of the accepted #11633 cross-request caching design. Provenance: design document = #11633 comment 5394942824 (§4 leg D, §10.2); maintainer acceptance = #11633 comment 5404681591 (2026-08-25, verbatim 「接受你的建议，继续」). Filed by PM session session_01KWRU3s15AJz7PGW7a7wdCh.

Content: cross-request cache for getMetaItems' sys_metadata read, keyed on the registry epoch; reuses the shipped metadata.changed channel cross-node.

Hard requirement: the SchemaRegistry-hydration trap named in the design (§4 leg D) must be resolved explicitly in the PR body — stated and designed around, not inherited silently.

Acceptance criterion: "cached answer ≡ uncached answer" identity pin for getMetaItems across an epoch bump (write → epoch change → fresh read), per the design §7 pin plan.

Premise-first: design measured at 992161b728; re-verify the epoch/channel seams on current origin/main before implementing.

[os-trump]

Triage (half-label repair, daily full round): the getMetaItems overlay cache keyed on the registry epoch lands in the metadata/registry layer — domain:engine (metadata family is engine-lane since the 2026-08-19 merge). Leg D of the #11633 ruled design; the SchemaRegistry-hydration trap named in the title is the charter's own constraint. Type Task.

---

Generated by Claude Code

[os-zhuang]

Claim: PM loop round 2
Session: session_01LZbWd2jNV1FErXTPSS4Dry
Branch: claude/issue-11967-getmetaitems-overlay-cache
Worktree: objectstack-issue-11967
Domain: domain:engine
File surface: the getMetaItems seam and its sys_metadata read in the metadata/registry layer, plus its pins. ⛔ packages/spec is READ-ONLY (spec seat); ⛔ do not edit packages/core/src/security/index.ts (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: opus
Clause-②: no — internal cross-request caching bounded by a "cached ≡ uncached" identity pin; no accept/reject change, no public surface widened. ⚠️ If the route requires a new export or changes an observable contract, that is clause ② — stop and report.
Serial constraints cleared: leg C (#11966) landed as squash a8c00e27, and the substrate (#11968) landed as 4bd6faa2 — both on origin/main now, so this leg builds on shipped ground rather than an in-flight branch. ⛔ Queued sibling #12623 (SchemaRegistry.registerObject packageId) touches the same registry family and is serial-queued behind this card — not dispatched. No open PR touches the registry seam.

The ruled design — ⛔ not re-adjudicable

Provenance: design = #11633 comment 5394942824 (§4 leg D, §10.2); maintainer acceptance = #11633 comment 5404681591, 2026-08-25, verbatim, ⛔ untranslated:

接受你的建议，继续

with forks 1A / 2B / 3A / TTL-0. This is leg D, ship-second — leg C shipped first and is now on main.

Content: a cross-request cache for getMetaItems' sys_metadata read, keyed on the registry epoch, reusing the shipped metadata.changed channel cross-node.

⛔ The hard requirement — this one is a deliverable, not a caveat

The SchemaRegistry-hydration trap named in the design (§4 leg D) must be resolved EXPLICITLY in the PR body — stated and designed around, ⛔ not inherited silently.

Read §4 leg D of the design before writing code and address the trap in the PR body in your own words, naming what you measured. ⛔ A PR that implements the cache without that section is incomplete regardless of how green it is.

Acceptance criterion: a "cached answer ≡ uncached answer" identity pin for getMetaItems across an epoch bump (write → epoch change → fresh read), per design §7's pin plan.

PM mechanism assumptions — ⛔ my readings, confirm or refute

• The card says "design measured at 992161b728; re-verify the epoch/channel seams on current origin/main". ⚠️ origin/main has moved a long way since — including leg C and the substrate landing today. Re-measure the epoch and metadata.changed seams as they actually shipped, ⛔ not as the design predicted they would.
• ⭐ Leg C is your worked precedent and it is worth reading before you start. It landed two rules the design did not spell out, both of which may apply here: (1) it caches a success only when the engine exposes the write-epoch seam, declining rather than degrading to a TTL-only shape; (2) its invalidation retires success entries only, because retiring a failure memo on a write would restart log spam a previous card removed. Whether either transfers to leg D is yours to measure — ⛔ do not copy them in, and ⛔ do not assume they do not apply.
• ⚠️ Leg C also refuted a design prediction: the design expected an object-scoped backstop on sys_setting writes, but the substrate that shipped is process-wide and object-agnostic (Fork 1 A), so its backstop over-invalidates — a hit-rate cost, never correctness. Expect the same shape here and say so if you find it.

⛔ Confirm or refute all of the above on the current ref. premise_still_valid: false with no PR is a legitimate and valuable delivery.

---

Generated by Claude Code

[claude]

Dev claim — leg D (ship-second) of the #11633 accepted design.

Session: session_01LZbWd2jNV1FErXTPSS4Dry
Branch: claude/issue-11967-getmetaitems-overlay-cache
Worktree: objectstack-issue-11967, cut from origin/main at 15bf9e85.

Assignee is already set by the PM claim above (5439213960); I am not touching it.

Scope I am working to, as dispatched:

• Cross-request cache for the sys_metadata overlay read inside getMetaItems, keyed on the registry epoch, reusing the shipped metadata.changed channel cross-node (design §4 leg D, §10.2; forks 1A / 2B / 3A / TTL-0).
• Hard requirement carried, not paraphrased: the SchemaRegistry-hydration trap named in design §4 leg D gets an explicit, measured resolution section in the PR body.
• Acceptance criterion: a cached answer is identical to the uncached answer pin across an epoch bump, per design §7's pin plan, with every staleness assertion paired with a hit assertion so neither half passes on a cache that never caches.

Premise-first, before any code: re-measuring the epoch and metadata.changed seams as they actually shipped on the current ref, not as the design predicted at 992161b728. Leg C (a8c00e27) and the substrate (4bd6faa2) are read as landed precedent, not copied in.

Fences respected: packages/spec read-only; packages/core/src/security/index.ts untouched; #12623 (registerObject packageId) is serial-queued behind this card and will be reported, not fixed here.

---

Generated by Claude Code

---

Generated by Claude Code