[PM seat] domain:metadata — ⏳ vacant

[hotlong]

This sticker is the sole authoritative registration for the domain:metadata seat. Index = label:pm:seat; entry point #4604. Seat split out of domain:engine-core by maintainer approval 2026-08-07 (PR #6370).

Single-writer rule: only the sitting seat PM edits this body; takeover/handoff = body edit + one audit comment. Liveness is lazy: >24h without output is reclaimable. Read boundary: a takeover reads this body plus only the comments later than its last edit.

Scope

packages/metadata* (incl. metadata-fs, metadata-protocol, metadata-core) and packages/platform-objects.

Red lines: ⛔ metadata format / acceptance-face changes belong to domain:spec (#6017) — the test is "changes the acceptance face", not "touches spec". ObjectQL compilation / query execution / formula / core runtime → domain:engine-core (#6019). The /meta route body lives in packages/rest → domain:cli. packages/lint → devx. ⛔ content/docs/releases/ is never touched in a code PR.

Current PM — 🟢 SEATED

os-zhuang · session_012WMpuAfA2KSdDjGF6tm1bH · seated 2026-08-13 ~03:1xZ (audit comment 5275464073). Standing instruction inherited: batch:5 (maintainer 2026-08-12, 「当前任务处理完后,并发降到5」). Maintainer directive this shift: 「任务很多,加速派发」 — answered with parallelism (batch filled to 5), ⛔ not by downgrading model tiers or skipping serialisation.

⛔⛔ READ THIS BEFORE TRUSTING ANY PROSE SUMMARY IN THIS POST

⭐ The single most expensive thing measured this shift: the previous incumbent's "decision box" prose list was STALE BY SEVEN OF EIGHT ENTRIES, and it stayed stale through a body edit made hours after the rulings landed. Two of its cards (#7529, #7893) had been ruled by the maintainer on 2026-08-12 at 18:24Z — in one sitting, verbatim 「接受你的全部建议。」 — and moved to pm:queue by the ruling comments themselves. The post kept listing them as open questions. The incoming PM read the post, believed it, and reported a false "decision inbox: 8" plus a non-existent label half-state to the maintainer.

⇒ The rule, and it now outranks anything narrative in this file: pm:* labels and the card's own comments are the state. This post is a cache, and caches go stale — including this section. Before treating any card here as open, open the card and read its comments to the end. A ruling arrives as a comment, and no body edit anywhere is obliged to notice it.

⇒ Corollary that cost the most: "the seat post says it needs a decision" is a stale premise exactly like a stale line number. The skill's stale-premise rule says 裁决同罪 — rulings decay like code — and this is that failure in its purest form: a summary of decisions decaying while the decisions themselves were already made.

⚠️ PLATFORM FACTS — measured, ⛔ do not re-derive

1. ⛔ Raw GitHub HTTP is 403 in every container of this fleet — GH_TOKEN/GITHUB_TOKEN exist but are empty; no gh CLI. Only mcp__github__* works. ⛔ Never write curl … api.github.com into a dispatch order.
   • ⭐ This is why scripts/pm/check-half-states.mjs 401s permanently. That guard is unavailable here, not flaky ⇒ half-state discipline is manual.
2. ⭐⭐ git push/fetch/ls-remote DO work — only the API layer is blocked. The rescue channel for any cloud container: poke it to push its report on claude/issue-<n>-handover, read with git fetch + git show FETCH_HEAD:.
3. ⭐ Subagents CAN reach GitHub (they self-open PRs and self-post reports). ⇒ "the PM opens the PR" is cloud-only. All five cards this round are subagents.
4. ⛔ post_turn_summary / status_detail is unreliable — 2 confirmed falsehoods in one shift. ⛔ Never draw a verdict from it.
5. ⚠️ git ls-remote must run with the repo as cwd and always print its control (… 'claude/*' | wc -l, ~203).
6. ⚠️ enable_pr_auto_merge returns an empty-field signature — zero diagnostic value. Confirm by a commit on origin/main or a gh-readonly-queue/* branch hit.
7. ⚠️ list_issues omits assignees even when explicitly requested. A lane listing is not a claim check; open the card.
8. ⚠️ pull_request_read method=get_status shows only legacy commit statuses (Vercel), not check runs. Use get_check_runs.
9. ⚠️ issue_read get_comments on a long card can exceed the tool's output limit (this post's 19 comments = 57KB, rejected whole). Page it (perPage+page) from the tail.
10. ⚠️ list_issues with two labels behaves as OR, not AND — measured this shift ([pm:seat, domain:metadata] returned the whole lane). Intersect locally; ⛔ never read a two-label listing as a filtered set.
11. ⚠️ The API truncates long issue bodies — meta-field-write-inert: an accepted field PUT never reaches the object — a runtime-created field is stored valid=true and is absent from fields forever #7893's "Decision Required" section lived entirely in the unreturned half, which is why that card read as a fix card. Every dispatch order must make the dev self-check its body for truncation.

The region exemption (authorised 2026-08-12)

declare regions at claim time · merge main before opening the PR · merge again after each sibling lands · let the queue arbitrate

Concurrent-editor cap on a hot file: 3, and only with region-level declarations in the claim comment. The exemption suspends queueing, ⛔ not collision-avoidance.

⭐ Worked example from this shift, because the distinction is the whole rule. protocol.ts had four candidates. #8136 (file-wide sweep of error/catch message construction) was dispatched; #7654 was dispatched alongside it as second concurrent editor, because its region is the getMetaItems read merge — genuinely disjoint. #7748 (audit-write sites, incl. assertLockAllowsWrite's deny path) and #8184 (saveMetaItem's scoped-kernel refusal branch) were held, because both sit inside the refusal paths #8136 is rewriting. Region ≠ file, and "the file is busy" is the wrong test in both directions.

Model tiering — two clauses with NO downward discretion

1. ⛔ Any card touching .claude/skills/pm-dispatch/** ⇒ claude-fable-5, filed and dispatched, never PM-edited.
2. ⛔ Any card that changes contract accept/reject behaviour or widens the public surface (domain:spec semantic lane) ⇒ claude-fable-5.

Otherwise sonnet for mechanical cards decided by the gate farm, opus for design judgement; when unsure go up. ⚠️ A directive to go faster is answered with parallelism, not a cheaper tier.

Ledger — 23 landed across the previous term (both queued PRs drained)

card	PR	commit
#7728	#7920	4c5e80e
#7774	#7931	7372d46
#7856	#7992	c7e7900 — 1973-file corpus, 0 hashes changed
#7932	#7993	40e8653
#7780	#7995	3da3da5
#7556	#8015	e3c8ed0
#8027	#8045	fa6dd59
—	#8046	9b959f3
#8003	#8151	5247fda811
#7656	#8179	8eb5d8b9b5
#8038	#8255	a6cd2c152f
#7736	#8257	0e1f6679b4
#8037	#8258	3a27c46edb — ⚠️ Part of, card stays open
#7682	#8185	ebf7d98 — Part of; closure action executed, card closed completed
#8031	#8254	9b2d720 — Fixes, card auto-closed

✅ The inherited Part of closure action on #7682 is discharged (comment 5275468337): label write, delivered/remaining/owner recorded, card closed completed — its whole residue is #8146 and #8184, both open and tracked, so re-queueing would have put a card back in the pool whose content is tracked twice elsewhere.

In flight — 5 cards, batch:5 cap reached, file-disjoint by construction

card	region	model	note
#8136	protocol.ts — error/catch message construction	opus	security; re-dispatched after a stale-claim reclaim
#7654	protocol.ts — getMetaItems read merge	opus	2nd concurrent editor under the region exemption; Part of (bridge half is domain:cli)
#8146	sys-metadata-repository.ts	opus	premise-gated — if the package-less hatch write also binds into a package, NARROW preserves nothing ⇒ fork back to maintainer
#8154	metadata-diagnostics.ts	opus	security; deliverable is the generic per-type redaction hook
#7934	platform-objects / metadata-core	opus	blocker cleared — validateManagedApiMethods verified on origin/main

Held behind #8136 (hold notes posted, release = when #8136 lands): #7748, #8184. Both stay pm:queue/unassigned — ⛔ deliberately not pm:blocked: a serialisation hold is not an upstream dependency.

⛔ Maintainer decision box — 1 card (label-verified, ⛔ not prose)

needs-user-decision in this lane resolves to exactly one card: #8284. Everything the previous post listed here was already ruled, on hold, blocked, or not in this lane. Verified against the label set, not against any summary.

• The i18n catalog is resolved ahead of the document, so a tenant's own Studio rename never reaches either /meta/object read — and neither do extension scalar overrides #8284 — ⭐ the i18n scalar-precedence card, and it supersedes the framing of Object-extension fold leaks the extension's label onto ?layers=true only — the two reads #7556 reconciled on FIELDS now disagree on LABEL #8037: this is not a fold defect. translateObject resolves scalars as catalog ?? document and the catalog wins unconditionally, so a tenant's own Studio rename (PUT, 200 OK) reaches layers.overlay and neither read a writable form derives from. Covers label/pluralLabel/description alike — the latter two carry identical exposure and are simply untriggered on main today.

Adjacent, and NOT in the decision box — do not re-escalate these:

• Check whether sys_session.token — a live session credential — serializes over the data API (ADR-0100 channel 3 has no read protection) #7823 + [security] sys_account stores live third-party OAuth access/refresh/id tokens as plain columns, and the object is API-readable #7987 — one ruling, pm:blocked. internal: true strips sys_session.token at mint, so revoke-other-sessions filters listSessions() by session.token, deletes nothing, and still answers {status:true}. ⭐ A create-only exemption is NOT sufficient — the read path strips too. ⛔ Replay-proven; do not close as won't-fix.
• Reject specs that do not round-trip through JSON at put() — the option-1 tightening deferred by #7856 #8006 — pm:on-hold. ⚠️ Coupled to fix(metadata-core,metadata-fs): hash the serialized form, so put().version identifies the bytes actually stored (#7856) #7992: option 1 refuses exactly the specs fix(metadata-core,metadata-fs): hash the serialized form, so put().version identifies the bytes actually stored (#7856) #7992's 20 contract pins are built from.
• Object-extension fold leaks the extension's label onto ?layers=true only — the two reads #7556 reconciled on FIELDS now disagree on LABEL #8037 — superseded in framing by The i18n catalog is resolved ahead of the document, so a tenant's own Studio rename never reaches either /meta/object read — and neither do extension scalar overrides #8284; read them together.

⭐ RULED AND DISPATCHABLE — front of next round's queue

Both ruled by the maintainer 2026-08-12 18:24Z in one sitting (verbatim 「接受你的全部建议。」), both correctly sitting in pm:queue. Both are instances of one standing principle adopted in that same ruling, which also covers #8010 / #7912:

If the platform cannot honour a declaration, refuse it at the latest checkpoint that can see the whole picture (publish), name the offending key path, and never answer 200.

• The metadata door accepts a dashboard widget dataset binding that names nothing — 200 on both save and publish, referential integrity enforced only at runtime #7529 — ruled option B (allow at save, refuse at publish; name the offending key path). ⚠️ Costing correction recorded with the ruling: this is NOT "one refusal at one existing checkpoint". validateWidgetBindings already implements widget-dataset-unknown at severity error, but is registered surfaces: CLI_ONLY with surfaceReason: RUNTIME_NEEDS_FULL_SNAPSHOT, because RuntimeStackContext carries objects but not datasets. So B costs extending the runtime snapshot. ⇒ Ride the existing vehicle, ⛔ do not open a private path: [P2] 运行时授权门扩到 object 写入 + 全量 runtime-safe 规则快照(#4463 P1 之后) #4716 is the general carrier, and Move validateSecurityPosture onto the runtime publish surface — a measured strictness rollout (#7576's remainder, #4001 pattern) #7891 is the same move already done for validateSecurityPosture — follow that precedent. If [P2] 运行时授权门扩到 object 写入 + 全量 runtime-safe 规则快照(#4463 P1 之后) #4716 lands first this may reduce to a registration change.
• meta-field-write-inert: an accepted field PUT never reaches the object — a runtime-created field is stored valid=true and is absent from fields forever #7893 — ruled option 2, retire the write channel under ADR-0049 enforce-or-remove. Drop allowRuntimeCreate: true on field; the door refuses with a sentence pointing at PUT /meta/object/<name>. Option 1 (build it) is a separate feature card — a build, not a patch. Binding carry-overs: org-override-registry-gate: the field overlay lock is not enforced — an artifact-backed field PUT is accepted 200 (and is inert) #7743's overlay refusal stays; the retirement rides ADR-0087's registry + tombstone procedure; existing sys_metadata rows need a stated disposition in the PR; meta-plural-url-bypass: PUT /meta/fields/<name> walks around the whole two-tier registry gate — 4 registry types have no entry in PLURAL_TO_SINGULAR #7894 is the same door and must be closed in the same pass or explicitly deferred with a reason. ⚠️ Retiring flips a pinned control red on purpose (packages/runtime/src/meta-field-overlay-lock.test.ts:393, pinned by org-override-registry-gate: the field overlay lock is not enforced — an artifact-backed field PUT is accepted 200 (and is inert) #7743 precisely so this could not be retired quietly) — deliberate and on the record, ⛔ not "repaired" to green. ⚠️ Its body is API-truncated; the decision section is only visible in the web UI.

finding — 9

#7216 · #7860 · #8100 · #8169 · #8184 (also held) · #8268 · #8278 · #8284 (also decision) · #8285. A findings-triage round is overdue — #7216 is the oldest and has survived several rounds.

⭐ #8268 argues for ruling the CLASS, not a fourth instance: three materialization stamps have diverged on one seam one at a time — #6562 (system columns) → #8038 (__search) → #8268 (nameField). ⚠️ Read #8268, #8284 and #8037 together before assigning any of them — nameField, label, pluralLabel, description are all scalars in the same last-writer-wins class reached by two different mechanisms. Fixing one in isolation is how this lane got three cards out of one seam, twice.

⛔ Not this seat's

#7850 (drivers/services/objectql) · #7643 (objectui) · #7020 (os-help) · #6504 (assigned os-zhuang by a different session — the account is shared across seats, the session ID is the discriminator) · #4716 (corpus precondition unmet — but see #7529 above, it is that card's named carrier). ⚠️ #7894 needs re-examining rather than inheriting its "not mine (packages/spec)" tag: #7893's ruling names it as the same door, to be closed in the same pass or explicitly deferred. ⚠️ All of these still carry domain:metadata; mislabels are triage's to correct — this seat ⛔ does not change domain:*, it reports.

⛔ Cloud containers

✅ All four archived, each only after its text reached GitHub. ⭐ Read needs_action, not just status_category, before archiving — a container was archived while its needs_action named an unfiled driver-path bug; it survives only as the incomplete lead #8100.

⛔ Inherited process gap, recorded by the incumbent who caused it: when opening a PR on a 403-blocked dev's behalf, get its intended PR body FIRST via the .os-handover channel, and treat draft as the default until the dev says otherwise. Reconstructing a PR body from a branch silently discards the author's merge conditions — it happened twice in one shift.

Handover branches to delete once consumed: claude/issue-7893-handover, claude/issue-8038-handover, claude/issue-8031-handover.

Standing commitments

• Dispatch briefs are three-partitioned — ruling (not re-litigable) / PM mechanism assumption (falsifiable, measure it) / suggested route (optional).
• Gate lists are leads, not specs — PM takes the reading with node scripts/pm/dispatch-gates.mjs; the order tells the dev to re-run it against their actual diff.
• Stale-premise checks cover rulings, not just code — see the ⛔⛔ section at the top of this post for the shift where that was proved twice over.
• Fixes #n vs Part of #n is a closure decision — label write and delivered/remaining/owner comment in the same action.
• STOP / needs_decision is a design exit, not rework.

Notes

• ⭐⭐ When a merge CONCATENATES, a name-based pin proves nothing about the concatenated arrays. mergeObjectDefinitions handles fields (spread), validations/indexes (concatenated) and scalars (last-writer-wins) — three different ways. Ask what a pin does NOT cover before praising it.
• ⭐⭐ A dev that retracts its own filed report is the one to trust.
• ⭐⭐ Reverse verification reported as 5-of-6 with the sixth explained beats a claimed 6-of-6.
• ⭐⭐ Anti-vacuity arms are non-negotiable — on meta-field-write-inert: an accepted field PUT never reaches the object — a runtime-created field is stored valid=true and is absent from fields forever #7893 the dev's first probe asserted against body.item.fields (always []), so a "defect" assertion passed against an empty read. Correct path was body.data.item.fields.
• ⭐⭐ A positive control makes a grep into evidence — sweeping supportsOverlay returned real consumers where they existed and none for field; a search that never returns anything would prove nothing.
• ⭐⭐ Diff two responses KEY BY KEY, not just the field of interest — the only reason GET /meta/object/:name drops nameField for artifact-ingested objects — the third materialization stamp to diverge on this seam #8268 exists.
• ⭐⭐ A card adding a test file to a TEST_DEBT package must name pnpm check:type-check-debt — metadata-protocol has no typecheck script, so a local vitest pass says nothing about its type surface. ⛔ Never fix a type error by raising the ledger — it may only shrink.
• ⭐⭐ Read each job's OWN conclusion — in_progress is not a conclusion, and "no failures yet" is not either.
• ⭐⭐ Controls must exist NOW — a merged branch is auto-deleted and is not a valid probe control.
• ⭐ A falsified PM premise is a SUCCESS outcome. ⚠️ Re-measure the conclusion, not just the evidence.
• ⭐ Re-read code at SOURCE — protocol.ts anchors move within hours; anchor on function names.
• ⭐ A timeout is not an assertion failure. A Test Core red was a 5000ms timeout in someone else's file on a contended sharded runner — not a main-is-red incident. Raised at the queue-steward anchor (队列管家 Routine（三仓总管）：合并队列健康专责化 —— flaky 签名分诊 / 原样重投 / 新签名拦截 / 跨仓 pin 链停滞观测（座位 Routine 化第二例，维护者 2026-08-06 拍板） #5810) ⛔ without editing their ledger (human-upgradeable only).
• ⛔ Never git push --force/--force-with-lease — a dev correctly refused to rewrite pushed history for a PM request, and the request was the PM's to withdraw.
• Open convention question for the maintainer: "a 200 that means nothing happened" is now six instances — meta-field-write-inert: an accepted field PUT never reaches the object — a runtime-created field is stored valid=true and is absent from fields forever #7893, recordIdField is not harvested into the grid's $select — sys_session "Revoke Session" reports success and revokes nothing #8018, reassignOrphanedMetadata, Check whether sys_session.token — a live session credential — serializes over the data API (ADR-0100 channel 3 has no read protection) #7823, view-authoring-live: the documented view-container authoring path is inert at runtime — the container is stored but never served #7736, The i18n catalog is resolved ahead of the document, so a tenant's own Studio rename never reaches either /meta/object read — and neither do extension scalar overrides #8284. The 2026-08-12 standing principle (refuse at publish, name the key path, never answer 200) may already be that convention — ⚠️ if so it should be written down somewhere load-bearing rather than living in two ruling comments.

[baozhoutao]

Seat takeover: domain:metadata.

• GitHub account: baozhoutao
• Session: session_01KDU3qAuJyajAQm3GkUXdfA
• Seated via: maintainer invocation /pm-dispatch metadata (seat was listed ⏳ vacant, awaiting maintainer assignment per the sticker body)
• Same-stroke updates (three-element pairing): title → [PM seat] domain:metadata — 🟢 baozhoutao, assignee → baozhoutao, body "当前 PM" section updated. Body is authoritative.

Posture on arrival: per the sticker body, this seat does not dispatch until the inventory migration (triage seat's MOVE/STAY/FLAG audit out of domain:engine-core) is recorded complete. I will verify migration state next; until it is complete this seat runs standby duties only (queue watch, blocked-unlock sweep, no claims, no dispatches).

---

Generated by Claude Code