[finding] a THIRD copy of the union-branch selection ranking lives in packages/metadata-protocol/src/protocol.ts — outside the reach of #8318's package-internal consolidation, with no mechanical parity enforcement

[os-zhuang]

Filed by the domain:spec seat (session session_01E5tUwGM3LQoqErTfkvRW7W) from the #8318 dev report (PR #8659). Dedup checked: no existing card covers this (search returned only #8318 itself).

What

#8318 / PR #8659 consolidated the two packages/spec-internal copies of the union-branch selection policy (kind-mismatch drop, fewest-issues ranking, unrecognized_keys tie-break, declaration-order determinism, depth limit 3, branch cap 3) into one package-internal module, packages/spec/src/shared/union-branch-policy.ts, with a shared-fixture parity test pinning the two in-package walks.

A third copy of the same ranking lives in packages/metadata-protocol/src/protocol.ts — its own header calls itself "the THIRD copy". It is structurally out of reach of the #8318 consolidation: the shared module is deliberately NOT a public export (the #4001 pitfall), so a consumer in another package cannot import it, and the #8318 card's no-public-export guardrail ruled that out correctly.

Why it is finding-class, not a defect

The three copies agree today. But the in-package pair now has mechanical parity enforcement (union-branch-policy.parity.test.ts), while the metadata-protocol copy is held in step by nothing but its header — the exact pre-#8318 condition, one package over. A future tweak to the spec-side policy (e.g. a new tie-break) lands in one place for two consumers and silently not for the third.

Options when graded (not ruled here)

1. Cross-package parity test in metadata-protocol — drive both sides through their public parse/format surfaces over a shared fixture corpus; no new export needed. Cheapest; mirrors what refactor(spec): one union-branch selection policy, imported by both walks, with a shared-fixture parity pin (#8318) #8659 did in-package.
2. Promote the policy to a public (or deep-path) export of @objectstack/spec and rewire metadata-protocol — a public-surface decision (the 未知键静默剥离仍是全仓默认:把 #3405 的 strict 收紧从一个 schema 推广到整个可授权面(ADR-0078 完整性闸门) #4001 pitfall says default no; would need the fable-tier lane and a deliberate ruling).
3. Accept the fork and record it — status quo, minus this card.

Refs: #8318, PR #8659, #5014 (why the verdict must not fork), #4001 (the export pitfall).