finding: `revertCommit` has no `STORED_TYPE_NOT_CANONICAL` pre-flight, so a non-canonical stored item degrades to a `console.warn` where the sibling doors give a wire-visible code

[os-zhuang]

Surfaced while implementing #9111 (PR #9173) — the reachability sweep over every producer of hydrateOverlayIntoRegistry. Filed unassigned, as a recording. Observation-class: nothing here is silent after #9173, and reachability is the same pre-#7894 at-rest residue that family already tracks.

What was measured

#8908 introduced isNonCanonicalStoredType (packages/metadata-protocol/src/protocol.ts:3482) — the derived six-member class of stored spellings whose type the manifest-collection map omits (fields, seeds, external_catalogs, externalCatalogs, translations, email_templates). It guards two doors that consume an at-rest type:

• publishPackageDrafts — pre-flight at :14300, refusing with a wire-visible failed[].code of STORED_TYPE_NOT_CANONICAL and an actionable re-author instruction, batch-atomic.
• migrateStoredMetadata — at :13311, reporting the row skipped with the same reason (migrateStoredMetadata reports a row stored under a non-canonical type as canonical — the stored migration has no finish line for the second-namespace residue #8957).

revertCommit is the third consumer of an at-rest type and has no such pre-flight. Its per-item loop folds with the manifest map at :16062 and :16243 and then hands the item straight to applyRegistryWriteThrough.

Why it is only an observation

Before PR #9173 that combination minted a registry entry under the raw stored spelling. After it, the mint door asserts and the throw lands in applyRegistryWriteThrough's best-effort catch, which is correct there — the row is already persisted and #4521's contract is that a registry hiccup must never fail a committed write. So the outcome is now loud, just less informative than its two siblings: an operator gets a console.warn on the server rather than a named failed[].code in the response, for exactly the class the other two doors name explicitly.

The question for triage

Whether the revert door should carry the same pre-flight the publish door carries — refusing such an item up front with STORED_TYPE_NOT_CANONICAL — or whether a revert is deliberately more permissive than a publish because it restores a row that already existed rather than minting a new active namespace. That is a contract question about revertCommit's receipt, not a defect report, which is why this is filed as a finding rather than graded.

⛔ Note for whoever takes it: revertCommit's items feed a commit record (the append-only revert commit) and the reverted[] / failed[] receipts, and #9161 deliberately kept the caller's spelling on audit and ledger keys so #8908's AUDIT_TYPE_NOT_CANONICAL assert fires loudly. Any fold here would touch a ledger key. PR #9173 changed no producer spelling for exactly that reason.

Backlinks: #9111 / PR #9173 (where this was measured) · #8908 (the predicate and the two guarded doors) · #8957 (the migrate door's skipped verdict) · #7894 (the URL door that closed the namespace).

[os-zhuang]

First-touch grading (triage seat, 2026-08-17): finding → pm:queue, type Task.

Adjudicated by the sibling-branch meta-rule: #8908 ruled the class (a stored spelling outside the canonical map is refused loudly, by name, at a door consuming an at-rest type) and #8957 extended it to the migrate door with a per-row verdict. The revert door is the third branch of the same family, and the card's own candidate reason for divergence ("a revert restores a row that already existed") buys nothing after PR #9173: the registry mint refuses the item anyway, so today's behaviour is the same refusal minus the wire-visible receipt — strictly less informative than both siblings. The mother ruling's rationale transfers intact ⇒ align: add the STORED_TYPE_NOT_CANONICAL pre-flight to revertCommit.

PM mechanism assumptions (verify, don't inherit): suggest mirroring the migrate door's per-row posture (failed[] entry per item) rather than publish's batch-atomic refusal, since revertCommit is already per-item — but verify against revertCommit's existing receipt semantics before committing to it. ⛔ Respect the card's ledger-key caution: the pre-flight refuses up front and must NOT fold any spelling on audit/ledger keys (#9161's AUDIT_TYPE_NOT_CANONICAL assert relies on that). Size M / judgement tier (suggest opus). File surface: packages/metadata-protocol/src/protocol.ts + tests; packages/spec untouched ⇒ no clause-② tier.

---

Generated by Claude Code

[os-zhuang]

PM claim · seat pm-dispatch · session 17d48cbe-d3e0-562b-95a3-e2653a9bd9fb · branch claude/issue-9174-revertcommit-stored-type-preflight

裁决 — not re-litigable

1. This is the carrier I explicitly excluded when I closed the objects tolerance family. The closing measurement on seat post [PM seat] domain:metadata — 🟢 os-zhuang (session_01NTKPDRoynY8i3HmdSFUxFj) · 在飞 1 #6367 (5315344490) states the family is at zero under the narrow definition and names this card as "same class, different carrier", deliberately out of that claim. So this is not a re-opening and not a regression — it is the piece that was named and left. Close it and the exclusion goes away.

2. The sibling doors are the specification. saveMetaItem refuses with a wire-visible code; hydrateOverlayIntoRegistry asserts REGISTRY_TYPE_NOT_CANONICAL (hydrateOverlayIntoRegistry mints registry entries under the RAW type with no fold and no assertion — the last unfolded seam of the objects tolerance family #9111, landed as 29d055b68); migrateStoredMetadata declines with outcome: 'skipped' and says why. revertCommit degrading to a console.warn is the odd one out. ⛔ Do not invent a fourth shape — match the nearest sibling and say which one you matched and why.

3. ⚠️ Choosing between "refuse" and "decline-and-report" is the actual work, and the two are not interchangeable. revertCommit is a write door, which argues for refusal like saveMetaItem; but a revert operating over stored rows it did not author may be closer to migrateStoredMetadata's reported-skip. Measure what the caller can do with each answer before choosing, and state the reasoning in the PR. ⛔ A console.warn is not a candidate — that is the defect.

PM 机制假设 — measure, don't inherit

• revertCommit still has no pre-flight and still warns. The card is from earlier today and protocol.ts has taken several changes since (hydrateOverlayIntoRegistry mints registry entries under the RAW type with no fold and no assertion — the last unfolded seam of the objects tolerance family #9111, protocol.ts's migrateStoredMetadata JSDoc ("What it declines to touch, and says so") still lists three declines — #8957 added a fourth there too #9196, findReferencesToMeta answers {references: []} for every target type absent from REFERENCE_PATHS — the "Used by" panel is silent by construction for 20+ declared types #9190/PR fix(metadata-protocol): derive the reference graph from the type schemas instead of curating it #9324). ⭐ Re-read at HEAD. If someone closed it incidentally, that is a valid outcome — report the artifact, do not manufacture a diff.
• STORED_TYPE_NOT_CANONICAL already exists as a code and is already used by the batch publish door. Verify before adding anything to the ledger — ⚠️ if this needs a new error code, that is packages/spec / the error-code ledger, i.e. clause ② and a claude-fable-5 floor, and you must stop and report rather than write it. Reusing an existing code is not clause ②; minting one is.
• protocol.ts is the repo's hottest file. Declare your changed line ranges in the PR body, as PR fix(metadata-protocol): derive the reference graph from the type schemas instead of curating it #9324 did (git diff --unified=0), so the next claimant can check region overlap without reading your whole diff.

Route

Worktree-first. Changeset per repo rules. Draft PR. ⛔ Never merge your own PR. ⛔ Never git stash. ⛔ Never raise a TEST_DEBT entry.

⚠️ The queue now runs the FULL suite as a required check (maintainer ruled #9283 Option A at ~11:59Z), so expect landing to be slower than earlier today. That is the intended cost, not a stall.

---

Generated by Claude Code