#8146's hatch-aware remedy on the CREATE side is unreachable from `saveMetaItem` — the ADR-0070 D1 gate shadows `readOnlyBaseCreateError` on every kernel

[os-zhuang]

Observation found while implementing #8184 (PR #8353). Filed, not fixed: it lives in saveMetaItem's ADR-0070 D1 gate, a different region of protocol.ts from #8184's fenced one, and adjacent to #7748's declared surface.

What is shadowed

#8146 (7f02367c1) gave BOTH package-door emitters in SysMetadataRepository a hatchOpen remedy selection:

• readOnlyBaseOverrideError — 403 ITEM_LOCKED, override side. Reachable, and The metadata write refusal answers a different code per TOPOLOGY: saveMetaItem's scoped-kernel branch refuses before the repository's package door ever runs #8184 now makes it reachable on scoped kernels too.
• readOnlyBaseCreateError — 422 WRITABLE_PACKAGE_REQUIRED, runtime-only create side. Its hatch clause reads: "OS_METADATA_WRITABLE is set for 'X': it unlocks the metadata TYPE, not package writability, so it does not make a read-only package a writable base."

That second clause cannot be reached through saveMetaItem on any topology. The ADR-0070 D1 gate a few hundred lines above the repository call throws first, on a strictly wider condition:

intent === 'runtime-only' && request.packageId != null && !this.isWritablePackage(request.packageId)

The repository's create door fires on the same predicate plus namedBase (non-empty string) plus "no registry limb returned". Every write that would reach it has already been thrown by D1 — which is topology-independent, so this is not a per-kernel divergence like #8184 was.

Why it is worth recording

The code and status agree (WRITABLE_PACKAGE_REQUIRED / 422), and D1's sentence does not prescribe setting OS_METADATA_WRITABLE, so this is not the retry-forever false-prescription trap #8146 closed on the override side. It is the milder half: an operator who has the hatch open and attempts a runtime-only create into a read-only base is told the base is read-only, and never told that the hatch they set does not reach the package dimension. The override side explains it; the create side does not.

Secondary: it means the create-side hatch clause is only exercised by direct repo.put callers (promoteDraft / restoreVersion / revertCommit), not by the authoring surface it was written for — so a change to that sentence would read as covered while the surface that matters never emits it.

Not proposing a shape

Two readings, and neither is obvious enough to act on unasked: teach D1 the same hatchOpen selection, or let D1 delegate to the repository emitter the way #8184 just did on the override side. The second is the one-emitter direction this lane keeps choosing, but D1 fires before the repository exists in the call and carries its own docs pointer, so it is a real design call rather than a mechanical move.

Related

• The metadata write refusal answers a different code per TOPOLOGY: saveMetaItem's scoped-kernel branch refuses before the repository's package door ever runs #8184 / PR fix(metadata-protocol): the metadata write refusal stops depending on deployment topology (#8184) #8353 — the override side, made topology-independent.
• [Decision] OS_METADATA_WRITABLE unlocks a write on a read-only package while Studio renders a "Read-only" badge — which one is telling the truth? #8146 (7f02367c1) — where the hatchOpen selection landed.
• readonly-package-locks-studio: the read-only metadata refusal keys on the metadata type's overlay policy, not package writability (ITEM_LOCKED / WRITABLE_PACKAGE_REQUIRED never emitted) #7682 — the package door.

---

Generated by Claude Code

[hotlong]

Concentrated findings round (maintainer-directed, 2026-08-13): promoted finding → pm:queue (domain:metadata unchanged — saveMetaItem's D1 gate in metadata-protocol). Type: Task.

Grading rationale: the defect class is a missing-guidance diagnostic (operator with the hatch open is never told the hatch does not reach the package dimension), acceptance set unchanged — lane-delegable. The architecture fork the card declines to pick (teach D1 the hatchOpen selection vs. delegate to the repository emitter) is the dev's judgment in the dispatch brief, with the lane's one-emitter precedent named as the default and D1's fires-before-the-repository constraint as the reason it may not apply. Secondary deliverable worth naming: the create-side hatch clause is currently exercised only via direct repo.put callers — a pin at the authoring surface (once reachable) or an honest comment on the emitter should record that.

⚠️ Serial constraint for the metadata seat: protocol.ts is hot — at minimum the P6–P13 sweep PR (#8333/PR #8436) is in flight on this file; hard-serial behind it and re-verify the D1 region line numbers on the merged ref.

Size/model suggestion: S–M, mode:subagent, opus (the fork needs a small design call).

---

Generated by Claude Code

[os-zhuang]

Claim — session session_012WMpuAfA2KSdDjGF6tm1bH, branch claude/issue-8361-d1-create-side-hatch-clause.

protocol.ts region declaration (per the 3-concurrent-editor cap on this file):

• Region: ObjectStackProtocolImplementation.saveMetaItem → the ADR-0070 D1 gate (the runtime-only + read-only-base refusal). On the merged ref ffb090e6f7 that region is lines 11542–11578 of packages/metadata-protocol/src/protocol.ts — the card's quoted numbers predate f58b1a88 ([finding] metadata-protocol's batch verbs still put caught error text on client-facing payloads — the 8 producers option C did not reach #8333 / PR fix(metadata-protocol): withhold caught driver text from the batch verbs' response payloads (#8333) #8436), which is now on main; re-verified as triage required.
• Not touching The metadata write refusal answers a different code per TOPOLOGY: saveMetaItem's scoped-kernel branch refuses before the repository's package door ever runs #8184's fenced override-side region (~11076–11155) beyond reading it as precedent, and not touching draft-publish-lifecycle: the metadata audit trail records only save — publish, rollback and the 409 conflict denial never write a row #7748's declared surface.

Concurrency check before starting: no currently-open PR has packages/metadata-protocol/src/protocol.ts in its diff against origin/main (checked #8600, #8614, #8610, #8507, #8602, #8456, #8597, #8611), so the cap is 0/3 and this claim takes the first slot.

Serial constraint from triage is cleared: #8333 / PR #8436 landed as f58b1a88ae.

---

Generated by Claude Code

---

Generated by Claude Code