`GET /meta/object/:name` drops the multi-tenant `indexes` stamp — the fourth materialization stamp on the #8268 seam, and the one whose converger is a second implementation

[os-zhuang]

Filed by the #8268 dev agent, measured while enumerating the stamps that cross the /meta read-exit materialization seam. Unassigned.

Blocked-by: #8268

Symptom

On a multi-tenant deployment, SchemaRegistry.registerObject stamps a tenant index onto every object it materializes:

registry.getObject('showcase_account').indexes
 => [ { fields: ['organization_id'] } ]

GET /meta/object/:name serves the same object with no indexes key at all when the by-name read is answered from the metadata service or a sys_metadata overlay row. Same object, same moment, same host.

The measurement

Real SchemaRegistry + real ObjectStackProtocolImplementation + real RestServer, metadata service holding the artifact's raw declaration (serviceMode: 'artifact'), multiTenant: true, diffed key by key:

byName vs registry diverge on keys: indexes, nameField
byName.indexes = undefined
registry.indexes = [ { fields: ['organization_id'] } ]

nameField is #8268 and is fixed there. indexes is this issue. With #8268's fix in place the same host reduces to exactly one diverging key:

byName vs registry diverge on keys: indexes

which is pinned as an EXPECTED divergence in packages/rest/src/meta-object-materialization-agreement.test.ts (MEASURES the un-converged multi-tenant indexes stamp), so this issue's fix will turn that pin red and it should be updated in the same PR.

Root cause — and it is the shape d5031f6a1 was about

The read exits converge the #6562 system-column stamp with applyInjectedSystemColumns in packages/metadata-core/src/injected-system-columns.ts. That function is a second implementation of what applySystemFields (packages/spec/src/data) does at registration, and the two have drifted: applySystemFields injects the tenant column and its index, while applyInjectedSystemColumns converges the fields map only.

This is worth stating precisely, because it is the general lesson rather than one bug:

• __search (/meta/object/:name answers the __search question two different ways — drops it for all 22 package objects, keeps it for all 71 platform objects (and the list route keeps it for both) #8038) converges by delegating to the registry (provisionSearchCompanionOnto) and has not drifted.
• nameField (GET /meta/object/:name drops nameField for artifact-ingested objects — the third materialization stamp to diverge on this seam #8268) had no converger at all and was simply missing.
• the system-column family converges through a re-implementation, and it is the one that silently disagrees with its producer.

d5031f6a1 fixed the neighbouring getMetaItems read merge by deleting a second implementation and calling the canonical one. The same move applies here.

Where (anchored on function names, not line numbers)

• packages/spec/src/data — applySystemFields, the producer; stamps the tenant column and the index.
• packages/metadata-core/src/injected-system-columns.ts — applyInjectedSystemColumns / resolveInjectedSystemColumns, the read-exit converger that handles the fields map only.
• packages/metadata-protocol/src/protocol.ts — governServedItem composes the converger at every read exit.
• ⚠️ The write path owes any fix here a counterpart, the same way stripInjectedSystemColumns and stripMaterializedStampsFrom are owed: indexes is a concatenated array under mergeObjectDefinitions, not a last-writer-wins scalar, so a strip that is not exactness-bounded will duplicate entries on a GET to PUT round trip. The landed [P3] Read decorations (_diagnostics, _draft) round-trip into persisted sys_metadata bodies #4326 round-trip pins catch this.

Reproduction

1. new SchemaRegistry({ multiTenant: true }), register an object with a title-eligible field as ownership: 'own'.
2. Put the raw declaration into the metadata service under get('object', name).
3. Read GET /meta/object/:name through a real RestServer and compare against registry.getObject(name).
4. byName.indexes is undefined; the registry's is [ { fields: ['organization_id'] } ].

The harness in packages/rest/src/meta-object-materialization-agreement.test.ts already builds this host — its measure({ serviceMode: 'artifact', multiTenant: true }) is the reproduction.

Why it matters

indexes is not decoration. A consumer reading the by-name answer concludes the object has no tenant index, which is the input to migration planning, to index-advice tooling, and to any consumer reasoning about query cost. The platform does create the index; only this read denies it.

Dedup

GitHub search: applySystemFields indexes / multi-tenant index / read-exit divergence — nearest neighbours are #8323 (tenant-scoped UNIQUE indexes going global — a driver DDL concern, not a read-serving one) and #6810 (closed; applySystemFields stamping an indexed KEY that FieldSchema rejects — a spec-validity defect on the field, not the table-level indexes array). Neither is a twin. nameField divergence is #8268.

Related

#8268 (the seam and its inventory) · #8038 · #6562 (the 2026-08-08 Option B ruling this converges under) · d5031f6a1 (#8332, the same "two implementations of one job" shape) · ADR-0029 D9

---

Generated by Claude Code

[hotlong]

Triage: lands in packages/metadata-core (applyInjectedSystemColumns — the drifted re-implementation converger) with the pin update in packages/rest's materialization-agreement test ⇒ domain:metadata, type Bug, pm:blocked with Blocked-by: #8268 added to the body. Rationale for blocking rather than queueing: the card's own measurement is stated relative to #8268's fix ("with #8268's fix in place the same host reduces to exactly one diverging key"), and both cards edit packages/rest/src/meta-object-materialization-agreement.test.ts — same-file serial discipline while #8268 is in flight (PR open). On unlock, re-verify the file surface on the merged ref before dispatch; the ⚠️ write-path counterpart note (concatenated indexes under mergeObjectDefinitions — an unbounded strip duplicates entries on GET→PUT round trip) belongs in the dispatch brief. Dedup confirmed as the card states: #8323 is driver DDL, #6810 (closed) is a field-level spec-validity defect — no twin.

---

Generated by Claude Code

[os-zhuang]

Unblocked and dispatched — Blocked-by: #8268 is spent

#8268 landed as 75fd301d at 11:08Z today (PR #8380). Triage blocked this card for two reasons and both are now discharged:

1. "the card's own measurement is stated relative to GET /meta/object/:name drops nameField for artifact-ingested objects — the third materialization stamp to diverge on this seam #8268's fix" — that fix is on main, so the predicted post-GET /meta/object/:name drops nameField for artifact-ingested objects — the third materialization stamp to diverge on this seam #8268 state (byName vs registry diverge on keys: indexes, exactly one key) is now directly measurable rather than hypothetical. The dev is instructed to confirm it as measurement 1 before planning anything.
2. "both cards edit packages/rest/src/meta-object-materialization-agreement.test.ts — same-file serial discipline while GET /meta/object/:name drops nameField for artifact-ingested objects — the third materialization stamp to diverge on this seam #8268 is in flight" — fix(metadata-protocol,objectql): the /meta read exits materialize a served base the way the registry materializes its own (#8268) #8380 is merged, so the serialisation is satisfied. The file and its pins are on main.

pm:blocked → pm:dispatched. Triage's unlock instruction — re-verify the file surface on the merged ref before dispatch — is carried into the brief as a first step, not an assumption.

Triage's ⚠️ note is in the brief as the card's central trap, promoted rather than mentioned: indexes is a concatenated array under mergeObjectDefinitions, not a last-writer-wins scalar, so a strip that is not exactness-bounded duplicates entries on every GET → PUT cycle. The brief requires a two-cycle round-trip measurement specifically because a strip that never fires and a strip that is correctly bounded are indistinguishable on a single pass, and names the landed #4326 pins as the gate.

Also carried in as binding:

• The fix shape is d5031f6a1's — delete the second implementation and call the canonical one. ⛔ Not an indexes line added to the copy, which would leave two implementations to drift again. This card's own root-cause section is the argument, and it generalises: the stamp that delegates (__search) has not drifted, the stamp with no converger (nameField) was simply missing, and the stamp converged by a re-implementation is the one that silently disagrees with its producer.
• The MEASURES the un-converged multi-tenant indexes stamp pin is supposed to go red — it was written as a deliberate expected-divergence tripwire so this fix fails it on purpose. Update it in the same PR.
• ⚠️ The brief assumes this does not need packages/metadata-protocol/src/protocol.ts (governServedItem composes the converger, but the converger is what changes). That file is at its 3-editor cap, so if the fix reaches it the dev stops and reports rather than landing a fourth editor blind.
• A single-tenant control is required: on multiTenant: false the read must serve no tenant index, or "converged" is indistinguishable from "always stamps an index".

---

Generated by Claude Code