rollback-verb-skips-the-canonical-fold: `rollbackMetaItem` addresses around the ADR-0010 overlay `_lock` when spelled with a plural

[hotlong]

Measured while implementing #8769 (not fixed there — out of that card's declared region, which is publishMetaItem).

What was measured

#8769 routed publishMetaItem through canonicalizeMetaRequestType, making it the seventh /meta entry point to funnel through the boundary fold. rollbackMetaItem is an eighth entry point on the same URL family, and it does not funnel through it either.

Measured on origin/main @ 60ade586e:

• packages/metadata-protocol/src/protocol.ts:15298 — async rollbackMetaItem(request: { type, name, toVersion, ... }); no canonicalizeMetaRequestType call in its body. The seven that do fold are getMetaItems (:5048), getMetaItem (:5445), getMetaItemLayered (:5852), getMetaItemCached (:8835), saveMetaItem (:11375), publishMetaItem (:12703, added by meta-publish-verb-skips-the-canonical-fold: publishMetaItem is the one /meta entry point that reads the MANIFEST map instead of the URL map #8769) and deleteMetaItem (:15621).
• :15320 — const singularType = PLURAL_TO_SINGULAR[request.type] ?? request.type, the MANIFEST-collection map, i.e. the exact lookup meta-plural-url-bypass: PUT /meta/fields/<name> walks around the whole two-tier registry gate — 4 registry types have no entry in PLURAL_TO_SINGULAR #7894 replaced at the boundary.
• :15331 — the ADR-0010 gate is called with type: request.type, raw, while every row operation below it (:15358, :15362, :15374, :15393) uses the folded singularType.

That asymmetry is the same one #8769 pinned one verb over. assertLockAllowsWrite delegates to getEffectiveLock, whose artifact limb folds and whose overlay limb does not — it queries sys_metadata with the raw type (:10310). So for a type present in the manifest map, a rollback addressed with the plural spelling looks the lock up under a type no row carries, gets 'none' back — which is not a neutral value, it is the verdict "the author declared no protection" (#5706) — and then performs the write against the folded key, which resolves the protected row perfectly.

Reachable from the wire: POST /api/v1/meta/:type/:name/rollback is a registered route with a caller-supplied :type (packages/rest/src/rest-route-ledger.ts:183, handler at packages/rest/src/rest-server.ts:6510).

Why this is filed rather than fixed in #8769

#8769's dispatch declared its file surface as publishMetaItem and its region; this is a different method. It is also not merely the same fix pasted: rollbackMetaItem writes a new active row from history rather than promoting a draft, so the fold's blast radius there (the not_revertable refusal sentence at :15323, the receipt at :15380, the conflict message at :15385) wants its own measurement and its own pin.

Severity, stated at its real width

Same preconditions #8769 measured for the publish verb, so the window is narrow and should not be rounded up: it needs an environment kernel (lockWriteRefusal and assertLockAllowsWrite both open with if (this.environmentId === undefined) return null, skipping the gate wholesale otherwise), and a lock carried by a stored overlay row rather than a packaged artifact (the artifact limb folds, so an artifact _lock is found under either spelling).

Within that window it is a lock gate that can be addressed around from the wire, and "a lock gate must not fail open" is the rule getEffectiveLock already carries in its own header.

Suggested disposition

Route rollbackMetaItem through canonicalizeMetaRequestType like the seven siblings, with a pin in the shape #8769 used (packages/objectql/src/protocol-publish-canonical-fold.test.ts group C — canonical spelling refused by the lock, plural spelling refused by the SAME lock, and the protected body unchanged).

Worth deciding at the same time whether the durable fix is at getEffectiveLock instead: folding its overlay limb would close this class at the producer for every present and future caller, rather than once per entry point. That is the contract-first shape, but it is a change to a shared gate and wants a maintainer's call rather than a dev's.

Backlink: #8769 · the boundary fold's rationale is #7894 · the fail-open-is-not-neutral rule is #5706.

[hotlong]

Triage: queued — pm:queue · domain:metadata · Bug. Triage seat (whole-repo Routine), fire 08:47Z.

Not escalated

The card asks whether the durable fix belongs at getEffectiveLock instead, and says that "wants a maintainer's call." Most of what feels like a decision is not one, and this is the common case: the narrow fix restores a stated invariant — getEffectiveLock already carries "a lock gate must not fail open" in its own header, and #5706 already ruled that 'none' is a verdict ("the author declared no protection"), not a neutral value. Restoring an invariant is a named non-escalation class: the finding carries its own decision.

The eighth entry point is also not a design choice — seven siblings already fold, #8769 made the seventh one two days ago, and this one is the straggler. Queuing the narrow fix is following a precedent, not setting one.

⛔ The producer-side question is deliberately left out of scope, not answered. Folding getEffectiveLock's overlay limb would close the class at the producer for every present and future caller, and the card is right that it is the contract-first shape. It is also a change to a shared gate with a blast radius nobody has measured. That belongs in its own card with its own measurement — ⛔ not as a rider on this one, and ⛔ not silently foreclosed by fixing the verb. If the dev finds while working that the per-verb fix cannot be made correct without touching the shared gate, stop and report the fork rather than widening the diff.

Premises re-verified on origin/main @ 6b6b606, not inherited

The card measured at 60ade586e; re-checked because line numbers in this file move under every merge. packages/metadata-protocol/src/protocol.ts is the landing site and the claims hold in substance — rollbackMetaItem does not call canonicalizeMetaRequestType, uses the PLURAL_TO_SINGULAR manifest map directly, and passes the raw request.type to the ADR-0010 gate while the row operations below it use the folded key. ⚠️ Line numbers in the card are already stale and the dev must re-locate rather than trust them: protocol.ts has taken merges since. Reachability from the wire is confirmed — POST /api/v1/meta/:type/:name/rollback is a registered route with a caller-supplied :type.

The severity is stated at its real width on the card and I am not rounding it up: it needs an environment kernel and a lock carried by a stored overlay row rather than a packaged artifact (the artifact limb folds either spelling). Narrow window, but inside it a lock gate is addressable around from the wire.

⚠️ Serial constraint — protocol.ts is the hottest file in the repo right now

This file is the landing site for a growing stack of cards; briefs this morning counted six, and this makes it seven. Declare your file surface at REGION level (method + line range), not at file level, or you will collide with a sibling. Known neighbours as of this fire: #7643 and #8660 (searchAll / union-branch ranking), #8786 (searchAll / renderTitle), #8783 (zodIssuesToMetadataIssues), #8798 and #8833 (diffMetaItem — PR #8841 in flight), #8818 (saveMetaItem's first guard). rollbackMetaItem (~:15298) is disjoint from all of them, which is why this card is queueable now rather than blocked — but re-verify that on the merged ref at claim time, since several of those are actively landing.

⭐ The suggested pin shape on the card is good and should be kept: #8769's protocol-publish-canonical-fold.test.ts group C — canonical spelling refused by the lock, plural spelling refused by the same lock, protected body unchanged. The third clause is the one that matters; the first two can both pass while the write still lands.

---

Generated by Claude Code

[hotlong]

Claim: PM loop round 12
Session: session_01XeQRiAa7vYRVX5Fog7Zby8
Branch: claude/issue-8819-rollback-canonical-fold
Worktree: objectstack-issue-8819
Domain: domain:metadata
File surface: packages/metadata-protocol/src/protocol.ts REGION rollbackMetaItem only, :15427–:15587 (bounded above by deleteMetaItem's neighbourhood and below by diffMetaItem at :15588), plus the pin in packages/objectql/src/protocol-publish-canonical-fold.test.ts (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: opus — above the sonnet floor because the card carries a live fork (per-verb fix vs. producer-side getEffectiveLock fold) that the dev may have to call and stop on, which is judgment, not mechanism
Serial constraints cleared: protocol.ts is the repo's hottest file and is dispatched at REGION level. In flight against it right now: PR #8770 (getMetaTypes / mint door — in the merge queue at this moment, queue ref gh-readonly-queue/main/pr-8770-fd6bdf89) and #8820 (same batch, region ensureObjectStorage :11381 + call sites :12225 / :13065). Both are disjoint from :15427–:15587. Landed since triage's note and therefore no longer constraints: #8818, #8783, #8798, #8769/#8825.

Stale-premise check — run, and it changes one thing

Triage re-verified at 6b6b606. origin/main is now fd6bdf89f and I re-verified there rather than inheriting either reading. The premise holds, and the three load-bearing lines have moved:

:15448 const singularType = PLURAL_TO_SINGULAR[request.type] ?? request.type;
:15459 const _rollbackLockErr = await this.assertLockAllowsWrite({
:15460 type: request.type, <-- RAW, the defect
:15475 this.resolveMetaItemOrgScope(singularType, …) <-- folded, like everything below

⚠️ Recording a near-miss so the next reader does not repeat it: my first pass grepped the region for singularType and assertLockAllowsWrite and got a hit list in which singularType, appeared directly under the assertLockAllowsWrite({ line — which reads exactly like "the gate already gets the folded value, the card is stale." It was the resolveMetaItemOrgScope call 15 lines further down, pulled adjacent by the filter. Reading the actual block is what settled it. The card's line numbers are stale; re-derive from the tree, and read blocks rather than filtered hit lists.

---

Generated by Claude Code