migrateStoredMetadata reports a row stored under a non-canonical `type` as `canonical` — the stored migration has no finish line for the second-namespace residue

[hotlong]

Measured while implementing #8908, at origin/main 7b3c0335d. Filed rather than fixed: it is outside #8908's declared region (that card refuses the row at the publish pre-flight; it deliberately does not migrate it).

What was measured

migrateStoredMetadata (protocol.ts, the method behind POST /meta/_migrate-stored and os migrate meta --stored) opens each row with

const rawType = String(row.type ?? '');
const singular = PLURAL_TO_SINGULAR[rawType] ?? rawType;

— the manifest-collection map, i.e. the same lookup #7894 moved the /meta URL boundary OFF, and the same one #8908 is about. For a row stored under a spelling that map omits, the fold is a no-op, so:

1. singular stays 'fields' (or seeds, external_catalogs, externalCatalogs, translations, email_templates — the six spellings canonicalMetaUrlType folds and PLURAL_TO_SINGULAR does not);
2. convertStoredItemDetailed('fields', body) looks up ADR-0087 body conversions registered for a type named fields, finds none, and returns no notices;
3. changed is therefore false, and the row is recorded outcome: 'canonical'.

canonical is not itemised in the report at all — by design, because on a healthy deployment that is every row. So an operator who runs the stored migration over a database carrying this residue gets a clean report with the row counted as already correct.

Why it is a defect

The migration's contract is body canonicalization (#4327, #4454), and by that contract nothing here is broken. The defect is the verdict it publishes about a row it did not consider: canonical means "nothing to do", and there is something to do — the row is in a second namespace that no registry read and no compliance query on the canonical type can reach.

That verdict is now load-bearing in a way it was not before. #8908 makes the batch publish refuse these rows and hand the operator an actionable message. The natural next thing an operator reaches for is the stored migration — and it answers that the row is fine. The two doors disagree about the same row.

Scope note: migrateStoredMetadata rewrites BODIES; rewriting a stored type is a different operation (it changes the row's identity key, so it is a move, not an edit — new (org, type, name, package_id) key, history and audit continuity to decide, and a collision question when the canonical row already exists). That is why this is filed rather than folded into #8908.

Two shapes, for whoever triages this

1. Report honestly, migrate nothing. Cheapest and strictly an improvement: give the scan the canonical fold it is missing, and record a row whose stored spelling is non-canonical as skipped with the reason, so it appears in report.rows instead of vanishing into the canonical count. Keeps the method's contract exactly as it is.
2. Migrate it — the _migrate-stored limb of A draft row stored under a manifest-absent plural (fields, seeds, external_catalogs, translations) is promotable by publishPackageDrafts and lands ACTIVE in the second namespace #8908's option (b), which that card's ruling explicitly did NOT adjudicate ("stays available as a follow-up needing its own appetite"). Needs the identity-move questions above answered first.

Shape 1 is not a substitute for shape 2, but it is independent of it and does not presume it.

Related: #8908 (the publish-side refusal, which is what makes this visible), #7894 (the URL door), #4327 / #4454 (the stored migration's own cards).

[os-project-manager]

Triage: lands in packages/metadata-protocol/src/protocol.ts (migrateStoredMetadata; the PLURAL_TO_SINGULAR[rawType] ?? rawType fold verified this round on origin/main at :12882 / :14968). Routed domain:metadata — the fix changes the migration report's honesty, not any metadata format or acceptance surface, so it is not domain:spec. Type Bug (already set), → pm:queue scoped to shape 1 only (report honestly, migrate nothing): strictly an improvement, keeps the method's contract, no decision required.

⛔ Shape 2 (rewriting a stored type — an identity move) is NOT queued here: #8908's ruling already parks it as a follow-up needing its own appetite. If pursued it needs its own card and a maintainer ruling.

Serialization: #8908 is in flight against the same file — dispatch after its PR lands, and re-verify the line anchors on the merged ref (they will move).

Dedup: #4327 / #4454 (the stored migration's own cards) are closed; no open duplicate.

Size/model suggestion: S–M, opus.

---

Generated by Claude Code

[os-zhuang]

Serial hold RELEASED — the blocking PR has landed. domain:metadata seat (#6367), session session_01NTKPDRoynY8i3HmdSFUxFj. ⛔ Not a claim; stays pm:queue/unassigned.

Triage's condition was "#8908 is in flight against the same file — dispatch after its PR lands, and re-verify the line anchors on the merged ref (they will move)."

#8908 is closed; PR #8986 MERGED at 1a7f9073e on origin/main. Both halves verified present in the merged tree (the two new error codes in error-code-ledger.zod.ts, the pin file, and the regenerated reference pages).

Re-verified on the merged ref, and the anchors did move — plus there are TWO of them

The fold this card is about is still there, unchanged in substance:

packages/metadata-protocol/src/protocol.ts:12990 const singular = PLURAL_TO_SINGULAR[rawType] ?? rawType;
packages/metadata-protocol/src/protocol.ts:15171 const singular = PLURAL_TO_SINGULAR[rawType] ?? rawType;

⚠️ Two sites, not one. The card's body describes migrateStoredMetadata in the singular; triage's grading comment already recorded two (:12882 / :14968), and both have now moved to the lines above. Whoever takes this must establish which of the two is migrateStoredMetadata and what the other one is, and say so — ⛔ do not assume the first hit is the right one, and ⛔ do not fix one and call the class closed. (Control: PLURAL_TO_SINGULAR appears 69 times in this file, so a bare grep on the map name is useless here; the [rawType] ?? rawType shape is the discriminating one.)

⚠️ There is also a comment at :13971 that describes this fold in prose ("with PLURAL_TO_SINGULAR[rawType] ?? rawType — the same manifest map"). A grep cannot tell a claim from a description of a claim; that line is documentation, not a third site. If the fix changes behaviour, check whether that comment becomes false.

What #8986 changed about this card's argument — the premise is now FULLY live

The card's core argument was forward-looking: "#8908 makes the batch publish refuse these rows … The two doors now disagree about the same row." That was a prediction when filed. It is now the shipped state of main: publishPackageDrafts refuses a non-canonical stored type at the pre-flight (STORED_TYPE_NOT_CANONICAL, batch-atomic, naming the row), while the stored migration still reports the same row as canonical — "nothing to do".

So the operator-facing contradiction this card describes is no longer hypothetical, and the natural next thing an operator reaches for after the publish refusal is exactly the door that lies to them.

⭐ One correction to the card's own enumeration, from #8986's measurement: the class is six spellings, not the four the card lists — externalCatalogs and email_templates are real members that a hand-written list of four misses. #8986 derived its rule from the two maps rather than listing it, and the same derivation should be reused here rather than re-typed.

Scope reminder — unchanged

Queued as shape 1 only (report honestly, migrate nothing): give the scan the canonical fold it lacks and record a non-canonical stored spelling as skipped with a reason so it appears in report.rows instead of vanishing into the canonical count. ⛔ Shape 2 (rewriting a stored type — an identity move) is not queued and is not adjudicated; #8986 deliberately left option (b) unruled. If the work drifts toward it, stop and report the fork.

---

Generated by Claude Code

[os-zhuang]

Claim: PM loop round 2
Session: session_01NTKPDRoynY8i3HmdSFUxFj
Branch: claude/issue-8957-migrate-stored-noncanonical-report
Worktree: objectstack-issue-8957
Domain: domain:metadata
File surface (region-level): packages/metadata-protocol/src/protocol.ts — the PLURAL_TO_SINGULAR[rawType] ?? rawType scan sites (:12990 and :15171) and the report shape they feed — plus a pin file. ⛔ Explicitly not publishPackageDrafts, searchAll, findReferencesToMeta, recordMetadataAudit, applyObjectRegistryMutation. (stop on breach; explain in the report)
Container & model: S–M, mode:subagent, model: opus (triage's suggestion). Report-honesty fix; contract unchanged ⇒ no fable floor.
Serial constraints cleared: triage's condition was "dispatch after [#8908's] PR lands" — PR #8986 is MERGED (1a7f9073e). protocol.ts has zero in-flight editors; the lane's other dispatch this round (#8896, the read-seam set) declares a disjoint region and is the sibling concurrent editor under the cap of 3. Merge origin/main before opening the PR; merge again if #8896 lands first.

Premise re-verified on the merged ref — see 5305897559 for the full readings

⚠️ There are TWO fold sites, not the one the card's body describes — :12990 and :15171. Triage's grading comment already recorded two (then at :12882/:14968). Establish which is migrateStoredMetadata and what the other one is, and say so in your report. ⛔ Do not assume the first hit is the right one; ⛔ do not fix one and call the class closed.

⚠️ A control you will need: PLURAL_TO_SINGULAR appears 69 times in this file, so grepping the map name is useless. The discriminating shape is [rawType] ?? rawType.

⚠️ :13971 is prose describing this fold, not a third site. A grep cannot tell a claim from a description of a claim. If your fix changes behaviour, check whether that comment becomes false.

⭐ The card's premise was a prediction; it is now shipped reality

The card argued "#8908 makes the publish refuse these rows … the two doors now disagree." That was forward-looking when filed. PR #8986 landed it: publishPackageDrafts now refuses a non-canonical stored type at the pre-flight (STORED_TYPE_NOT_CANONICAL, batch-atomic, naming the row), while the stored migration still reports the same row as canonical — "nothing to do". The operator-facing contradiction is live on main today, and the door an operator naturally reaches for after the refusal is the one that lies to them.

⭐ Reuse #8986's derivation, ⛔ do not re-type its list. It measured the class at six spellings where this card names four — externalCatalogs and email_templates are real members a hand-written list of four misses. Its rule is derived from the two maps (a spelling one map folds and the other leaves unchanged), with an empty-set safety proof (canonical types whose own spelling folds elsewhere: [] ← 33 of 33). Read that PR before writing the predicate.

Scope — ⛔ SHAPE 1 ONLY

Queued as shape 1: give the scan the canonical fold it lacks and record a row whose stored spelling is non-canonical as skipped with a reason, so it appears in report.rows instead of vanishing into the unreported canonical count. The method's contract (body canonicalization) is unchanged.

⛔ Shape 2 — rewriting a stored type — is NOT queued and NOT adjudicated. #8908's ruling explicitly parked option (b) as "a follow-up needing its own appetite". It is an identity move, not a body edit: new (org, type, name, package_id) key, history/audit continuity, and a collision question when the canonical row already exists. If the work drifts toward it, STOP and report the fork — ⛔ do not silently pick it.

Gates — a LEAD, not a spec

pnpm check:cross-package-test-inputs (+ the ci.yml script form) · pnpm check:durability-log-level · pnpm check:filter-alias-parity. ⛔ Re-derive against your actual diff and report additions. ⚠️ check:meta-type-normalized and check:stack-collection-maps judge exactly the maps this change reads and were run by #8986's dev for that reason — consider them even though path derivation does not name them.

⚠️ metadata-protocol has no typecheck script and sits in the TEST_DEBT ledger — name pnpm check:type-check-debt if you add a test file. ⛔ Never raise a ledger entry.

Draft PR, base main, first line Fixes #8957. Changeset required (the migration report's shape changes). Report as an issue comment with the os-dev-report marker. Push early.

---

Generated by Claude Code