publishPackageDrafts can promote (and drain) ANOTHER package's draft row — the promote resolves the draft without the ADR-0048 package dimension

[hotlong]

Measured while verifying #8858's premise (a different concern in the same method), at origin/main 8664a2c99. Not fixed there: outside that card's declared region and a different defect class.

What was measured

publishPackageDrafts lists the package's drafts with repo.listDrafts({ packageId }) (sys-metadata-repository.ts:876 — filters package_id = :packageId), then promotes each through promoteDraftForPublish → repo.promoteDraft(ref, …). promoteDraft resolves the row it is about to promote with

const draftRow = await this.engine.findOne('sys_metadata', {
 where: this.whereFor(ref, 'draft'),
});

and whereFor (sys-metadata-repository.ts:1385) omits the package_id dimension when the caller passes no packageId — deliberately, per its own comment: "the package dimension is left out so the query keeps its historical 'match any package' behaviour — which is what the RESOLVING reads want (delete/promote/restore each locate the one row whatever it is bound to)". ADR-0048 keys overlay rows by (org, type, name, package_id) precisely so that two installed packages shipping the same name each get their OWN row, so "the one row" is an assumption the key model does not guarantee.

Measured with the real SysMetadataRepository and the real protocol over a stub engine — two ordinary singular object/shared_ticket drafts, one bound to app.other, one to app.demo, then publishPackageDrafts({ packageId: 'app.demo' }):

response: { success: true, publishedCount: 1,
 published: [{ type: 'object', name: 'shared_ticket' }] }
active row: { type: 'object', name: 'shared_ticket', package_id: 'app.other', label: 'FROM_OTHER' }
draft row: { type: 'object', name: 'shared_ticket', package_id: 'app.demo', label: 'FROM_DEMO' } ← still pending
audit row: { type: 'object', name: 'shared_ticket', outcome: 'allowed', code: 'ok' }

Publishing app.demo promoted app.other's pending draft to active, drained that package's draft row, recorded it under app.demo's ADR-0067 commit and its ADR-0010 audit row — and left app.demo's own edit pending, while answering success: true.

No legacy residue is involved: both rows are ordinary drafts a normal saveMetaItem(..., mode: 'draft') produces.

⚠️ Which of the two rows wins is UNSPECIFIED, not "always the other package". The stub returns the first match in insertion order; a real driver's findOne has no defined order without an ORDER BY. The defect is that the query cannot distinguish the rows, not the particular winner — so on a real driver this is a coin toss, per publish.

Two adjacent shapes, also measured: a legacy plural-typed draft row (type = 'objects') bound to package A promotes the singular twin bound to package B, or a package-less singular twin — which is also how the batch's all-or-nothing NO_DRAFT abort for at-rest plural rows can be walked around.

Why it is a defect

• A publish of package A can silently publish package B's unreviewed pending change, attributed to A's commit id.
• A's own draft stays pending while the response reports the item as published: the author sees "published" and the environment does not have the edit.
• ADR-0048 exists so two packages shipping the same name stay separate; this lookup re-merges them at the one door that writes active.

Suggested disposition

Resolve the draft under the same key the caller listed it by: thread the row's package_id from listDrafts through promoteDraftForPublish into promoteDraft, exactly as PromotedDraft.draftOrgId already threads the draft's own org scope for the analogous org-partition bug (#3115). whereFor already accepts a packageId argument (string → eq, null → IS NULL), so this is threading a value, not a new query shape. The same question should be asked of the other "match any package" resolving reads that comment names (delete / restore).

Related: #6215 (the same package-binding blind spot one verb over, in restoreVersion's parent lookup).

Backlink: #8858 (the measurement that surfaced this).

[os-project-manager]

Triage: lands in packages/metadata (sys-metadata-repository.ts promoteDraft/whereFor + protocol promoteDraftForPublish); routed domain:metadata, queued as Bug.

Rationale: the measured cross-package promotion violates the ADR-0048 overlay key — restoring the package dimension on the resolving read is invariant-restoration, no decision needed. The suggested fix (thread the listed row's package_id from listDrafts through promoteDraftForPublish into promoteDraft; whereFor already accepts it) mirrors the existing draftOrgId threading for the org-partition analogue. The dispatch should also ask the card's stated question of the other "match any package" resolving reads (delete / restore) — report, don't silently widen scope.

Serial constraint (hot file): metadata-protocol/protocol.ts + sys-metadata-repository.ts carry an in-flight wave (#8868 in flight · #8862 blocked · this card · #8908). One at a time; the executing seat must re-verify this card's file surface on the merged ref before dispatch. Related, not merged: #6215 (same blind spot, restoreVersion parent lookup — different verb).

Size/model suggestion: M, opus.

Triage: this comment is from the triage seat (scheduled run) — no claim.

---

Generated by Claude Code

[hotlong]

Claim: PM loop
Session: session_01XeQRiAa7vYRVX5Fog7Zby8
Branch: claude/issue-8907-promote-draft-package-dimension
Worktree: objectstack-issue-8907
Domain: domain:metadata
File surface: packages/metadata-protocol/src/sys-metadata-repository.ts (whole file — uncontended) plus packages/metadata-protocol/src/protocol.ts REGION promoteDraftForPublish ONLY (:13196 → end of method, on origin/main @ 3043e9887), and pin files. Stop on breach; explain in the report.
Container & model: M, mode:subagent, model: opus (triage's suggestion, adopted)
Serial constraints cleared: see below — the wave head has landed, and the one live sibling is region-disjoint.

The serial constraint this card names is discharged

Triage recorded the hot-file wave as "#8868 in flight · #8862 blocked · this card · #8908 — one at a time", and required the executing seat to re-verify the file surface on the merged ref before dispatch. Doing exactly that:

• diff-verb-skips-the-canonical-fold: diffMetaItem answers an EMPTY diff for a manifest-absent type addressed with a plural #8868 merged at 19:43:46Z via PR fix(metadata-protocol): fold diffMetaItem's type at the boundary and stop serving a history outage as an empty diff #8921, confirmed on two readings (queue/merge event and the artifact on origin/main @ 3043e9887 — new pin file present at 353 lines with a negative control returning 0, canonicalizeMetaRequestType and rethrowUnlessMetadataStoreUnprovisioned both inside diffMetaItem). Third type === 'objects' tolerance in protocol.ts: applyObjectRegistryMutation CONSUMES the tolerant spelling rather than only guarding on it #8862 has since moved pm:blocked → pm:queue, which is the same unblock observed from the other side.
• The one live sibling is [finding] getMetaDiagnostics swallows the 503 that #5532 raised — an unreadable metadata store is published as "0 problems", and the type vanishes from the Studio tile counts #8855 (PR fix(metadata-protocol): propagate the metadata-store 503 out of getMetaDiagnostics (#8855) #8923, open), whose declared region is getMetaDiagnostics — :4701 on the merged ref. This card's protocol region is promoteDraftForPublish at :13196. ~8,500 lines apart, and sys-metadata-repository.ts is a different file that no live dispatch touches.

⚠️ Correcting triage's landing site before it becomes a wrong file-surface declaration

The triage note says this "lands in packages/metadata (sys-metadata-repository.ts …)". Measured on origin/main: there is no packages/metadata/src/sys-metadata-repository.ts. The file is packages/metadata-protocol/src/sys-metadata-repository.ts (probe validated — packages/metadata/src/ does exist, with 60 files, so the miss is a real reading and not a bad path).

⛔ The lane is unaffected — both are domain:metadata. But the correction is load-bearing for the region declaration above, because it puts the repository half in the same package as the live sibling rather than a different one. Regions still disjoint; recording it so the next reader does not inherit the wrong path.

Dispatch carries the ruling as written

Restoring the ADR-0048 package dimension on the resolving read is invariant-restoration — no decision needed. The suggested mechanism (thread the listed row's package_id from listDrafts through promoteDraftForPublish into promoteDraft; whereFor already accepts it) mirrors the existing draftOrgId threading for the org-partition analogue, and the dev is told to verify that before building on it.

⛔ The card's question about the other "match any package" resolving reads (delete / restore) is to be reported, not silently widened into. Related and deliberately not merged in: #6215 (same blind spot, restoreVersion parent lookup — a different verb).

---

Generated by Claude Code

[hotlong]

{
 "issue": 8907,
 "status": "done",
 "branch": "claude/issue-8907-promote-draft-package-dimension",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/8933",
 "premise_still_valid": true,
 "summary": "Premise verified and reproduced independently before implementing: with two packages holding drafts for the same (type, name), publishing app.demo promoted app.other's row and left app.demo's own draft pending, answering success: true. All three Zone-2 mechanism parts verified TRUE on the merged ref, so the dispatched threading was built as specified: (a) whereFor(ref, state, packageId?) already accepts the dimension (string eq / null IS NULL / undefined omits); (b) listDrafts already returns packageId per row; (c) draftOrgId is exactly the shape mirrored (d.organizationId -> request.organizationId -> getOverlayRepo). The DRAIN needed fixing too — it is the other half of the card's own title. promoteDraft now drops the row it actually promoted using that row's binding; left package-agnostic it either deletes another package's draft or (when bodies differ) trips the optimistic-lock mismatch that draftDrainVerdict silences as benign, leaving the just-published draft pending forever. That limb was separately ablated and is independently load-bearing. ⚠️ ONE DECLARED-REGION BREACH, flagged not assumed: the call site in publishPackageDrafts passing packageId: d.packageId lands outside the declared promoteDraftForPublish region. It is structurally unavoidable — listDrafts is called there, so 'thread from listDrafts through promoteDraftForPublish' cannot be done without it, and the other two edits are inert dead code (Prime Directive #10 corollary) without it. It sits ~9,200 lines from the live sibling #8855's getMetaDiagnostics region, preserving the conflict-safety property the declaration exists for. publishMetaItem (names no package) is behaviourally unchanged; the shared DeleteOptions contract in metadata-core is untouched — packageId on the repository's delete is a local extension exactly as state already is.",
 "tests": "Union run AFTER the final commit, at HEAD 843ca40aa (the merge commit; origin/main was merged in cleanly, no conflicts, and everything below was re-run at that head). PIN CAN FAIL — ablated, two limbs, direction predicted before running. Pre-fix red, matching the card verbatim: \"expected 'app.demo' to be 'app.other'\" wait — actual output: AssertionError: expected 'app.other' to be 'app.demo' (active row) and expected 'app.demo' to be 'app.other' (surviving draft). Drain-only ablation (resolving-read fix left in place) gave the predicted DIFFERENT failure: promote case stayed GREEN, drain case red with 'expected [ { id: r_1, …(10) }, …(1) ] to have a length of 1 but got 2' — both drafts surviving via the silent benign-conflict path. Ablation is source-level (suite imports ./protocol.js, vitest resolves src), so no dist rebuild applies to it; restored via git checkout from the fix commit, working tree then byte-identical to HEAD. SUITES all green at merged head: metadata-protocol 106 files/1512 tests; objectql 211/3695 (carries the adjacent sys-metadata-repository-list-drafts.test.ts); rest 119/1962; runtime 164/2452; service-automation 80/962; qa/dogfood 110/779 (dist-resolving, ran against a closure rebuilt after the fix); metadata 31/603; metadata-core 10/162; client 23/301. Consumers are the DOWNSTREAM direction (pnpm --filter '...@objectstack/metadata-protocol', prefix form), scoped to the seam's real consumption radius (grep of promoteDraft/publishPackageDrafts/listDrafts) rather than all 44 dependents. GATES green at the same HEAD: check:nul-bytes, check:engine-double-contract (new fake engine is PINNED — 270 pinned, no ledger entry needed), check:durability-log-level, check:cross-package-test-inputs, check:filter-alias-parity, check:query-options-erasure, check:type-check-coverage, check:type-check-debt --re-measure (33 entries, 1926 raw errors, none above its recorded number; metadata-protocol stays at its recorded 63 ⇒ the new test file adds ZERO tsc errors; the 1 surplus is @objectstack/lint at -1, pre-existing). Gates beyond the prompt's list were re-derived from actual changed paths via scripts/pm/dispatch-gates.mjs: it surfaced cross-package-test-inputs, durability-log-level, filter-alias-parity, query-options-erasure, plus the two type-check families; I added engine-double-contract and nul-bytes by convention.",
 "open_questions": [
 {
 "question": "The other 'match any package' resolving reads — the user-facing delete verb (SysMetadataRepository.delete) and restoreVersion — still resolve the overlay row without the ADR-0048 package dimension. Same blind spot, different verbs. Reported not acted on, per the ruling. I could NOT discharge the search-before-file duty (GitHub issue search returned 'API rate limit already exceeded' on two attempts), so I did not file blind — #6215 already covers the restoreVersion half, and the delete half may or may not have a card.",
 "options": [
 "A — PM files (or locates) one card for the delete verb's resolving read, separate from #6215; the seam is now cheap to fix because delete already accepts an optional packageId after this PR",
 "B — fold the delete verb into #6215 as a sub-issue, since it is the same blind spot and the same file",
 "C — leave both unfiled until a defect is measured on them"
 ],
 "recommendation": "A. The mechanism is now proven and the option is already plumbed (delete takes packageId; whereFor takes it; only the call sites are unstated), so the fix is a value-threading exercise identical to this card. C is wrong on the startup-focus axis read correctly: this is not speculative capability surface, it is a MEASURED key-model violation one verb over — the delete door writes nothing to active, but it can drop the wrong package's row, and the drain ablation in this PR shows how silently that class fails. B risks re-scoping #6215 (restoreVersion's parent lookup) mid-flight; a separate card keeps each verb's evidence its own."
 },
 {
 "question": "Declared-region breach: one edit (packageId: d.packageId at the publishPackageDrafts call site) lands outside the declared promoteDraftForPublish region. The dispatched MECHANISM entails it — listDrafts is called there — so the region declaration and the mechanism it dispatched are inconsistent with each other, not merely tight.",
 "options": [
 "A — accept the PR as landed; the breach is 1 property on an existing object literal, ~9,200 lines from the live sibling's region, so the conflict-safety property the declaration protects is intact",
 "B — reject and re-dispatch with a widened region declaration covering the call site"
 ],
 "recommendation": "A. B costs a full re-dispatch round for zero safety gain: the merge already landed clean against a main that advanced 5 commits, and the sibling #8855 edits a region ~9,200 lines away. I surfaced rather than silently widened because the ⛔ was explicit; the judgement of whether that was the right call is the PM's, and reverting the one line is trivial if not."
 }
 ],
 "out_of_scope_findings": []
}

---

Generated by Claude Code

[hotlong]

Errata on the report above (no marker on this comment — the report comment remains the single os-dev-report record; only one phrase in its tests field is clumsy, no fact changes).

The pre-fix red is stated there mid-sentence with a stray "wait —". The clean version, which is what the run actually printed:

AssertionError: expected 'app.other' to be 'app.demo' ← active row: app.other's draft was promoted
AssertionError: expected 'app.demo' to be 'app.other' ← surviving draft: app.demo's own edit left pending

Both are from the pre-fix run of the new pin and match the card's measurement: publishing app.demo promoted and drained app.other's row while leaving app.demo's edit pending. Every other figure in the report stands as written.

---

Generated by Claude Code