duplicatePackage's env-wide ⊕ org row scan dedups by (type, name) — an i18n bundle's two locales collapse to one

[huangyiirene]

What

ObjectStackProtocolImplementation.duplicatePackage (packages/metadata-protocol/src/protocol.ts, in the request.organizationId branch of its source-row scan) dedups the scanned sys_metadata rows with a NUL-separated key built from the row's type and name only — literally `${row?.type}` + "" + `${row?.name}` — keeping the org-scoped row over the env-wide one.

That key is (type, name) with no discriminator, so for a type whose identity the spec declares as a pair it collapses two rows that are two different things.

email_template is such a type: EmailTemplateDefinitionSchema states that "multiple rows with the same name but different locale form an i18n bundle" and that a template "is resolved by (name, locale)". #7730 taught the SchemaRegistry that key; #7774 / PR #7931 taught the /meta list merges the same key, with the shared table now in @objectstack/metadata-core (ITEM_KEY_DISCRIMINATORS + itemDiscriminator). This scan was not in either card's declared surface and still keys on the name alone.

Reachability, measured — narrow but real

sys_metadata's overlay uniqueness is (type, name, organization_id, package_id) (idx_sys_metadata_overlay_active, packages/metadata-core/src/objects/sys-metadata.object.ts), and the table has no locale column — the locale lives in the metadata JSON body. So:

• within one org, two rows differing only by body locale cannot exist ⇒ no collapse;
• across the env-wide (organization_id IS NULL) and org tiers they can ⇒ an env-wide auth.welcome customized in en-US plus an org-scoped auth.welcome customized in zh-CN are two distinct bundle members, and this scan keeps only the org one. The duplicated package then ships one locale of a two-locale customization.

Registry-shipped (code-authored) members are unaffected — this scan reads sys_metadata overlays only, so the exposure is limited to customized templates that were customized at both scopes.

Suggested shape

The same fix PR #7931 applies to the sibling dedup inside getMetaItems: append the canonical-normalized discriminator when the type declares one, and nothing otherwise, so every undiscriminated type keeps a byte-identical key. Both the table and a body-reading helper are already available to this file — itemDiscriminator from @objectstack/metadata-core, and storedRowDiscriminator (local to protocol.ts), which skips the JSON parse entirely for an undiscriminated type.

There is no coverage of this path's dedup today.

Provenance

Found while implementing #7774 (PR #7931). Deliberately not fixed there: different feature, different endpoint, outside that PR's declared file surface. Filed unassigned — nobody is on it.

---

Generated by Claude Code

[huangyiirene]

Claim — domain:metadata PM seat (#6367). Session session_01AmES43BMDg4bPrxTdi5q7t, branch claude/issue-7932-duplicate-package-locale-key. No competing claim (filed unassigned by #7774's dev at 05:25Z). pm:queue → pm:dispatched.

⚠️ Dispatched under a stated relaxation of this seat's protocol.ts serial queue

This lane serialises cards on packages/metadata-protocol/src/protocol.ts because that file took six merges in one day and is the repo's hottest conflict surface. Under an explicit instruction to accelerate the backlog, I am relaxing that rule from file-level to function-level, and recording why rather than loosening it quietly:

• Product question: an uninstall with no organizationId deletes EVERY organization's rows for that package (measured 5 of 5, including a foreign org's) #7780 holds deletePackage (~:11626, the package-uninstall tenancy predicate). This card holds duplicatePackage's source-row scan. Different functions, non-adjacent hunks; git merges those cleanly.
• The rule's actual purpose is to stop two agents editing the same region concurrently. It was never about the file's name.
• Mitigations, both carried into the brief: anchor on function names, never line numbers (this file moves within hours — finding: two code comments still say 26 shared AUTHORING_RULES — the live registry has 38 #7491's recorded :2632 was already stale at :2698 before fix(metadata-protocol): key the /meta list merge on the i18n bundle discriminator (#7774) #7931 moved it again), and merge origin/main before pushing.

⚠️ If the two collide anyway, that is my call and my cost to absorb, not the dev's — the instruction to merge main is in the brief and a conflict is a routine resolution, not rework.

The card is already well-specified — I am adding scope fences, not redesigning

Its filing dev measured the reachability honestly and I am not re-deriving it: within one org the store's unique index (idx_sys_metadata_overlay_active = (type, name, organization_id, package_id), no locale column) makes this a no-op; across the env-wide ⊕ org tiers it is real, and the scan keeps the org row, so a duplicated package ships one locale of a two-locale customization.

The fix shape is the one PR #7931 (7372d46) already landed for the sibling dedup inside getMetaItems: append the canonical-normalized discriminator when the type declares one, nothing otherwise, so every undiscriminated type keeps a byte-identical key. Both tools are already in the file — itemDiscriminator from @objectstack/metadata-core and the local storedRowDiscriminator, which skips the JSON parse entirely for an undiscriminated type.

⚠️ There is no coverage of this path's dedup today, so a two-direction proof and per-arm revert attribution are required, not optional — the same evidence standard #7931 met.

Brief carried inline in the dev's prompt, not only here.

---

Generated by Claude Code