fix(metadata-protocol): recovery doors run the ADR-0094 mutation projector

[os-musk]

Fixes#14415

Ruling (A)

Director seat, summon #11, decision batch #17, item 2 (verbatim reply: 「同意」). Full ruling text is quoted on the issue thread (comment 5522731140).

What changed

rollbackMetaItem, both limbs of revertCommit, and deleteMetaItem's legacy raw-engine exit restored/removed the metadata row and the in-memory registry, but never called the awaited ADR-0094 mutation projector — so a derived read-model (e.g. permission -> sys_permission_set) stayed on the rolled-back-FROM state until an unrelated save/publish/delete on the same name, or boot reconciliation (D3), re-derived it. saveMetaItem, runPublishSideEffects, and deleteMetaItem's repository branch already ran this hook — this closes the same gap for the projector that a prior card (#14179) closed for the mutation-event choke point, at the same four call sites.

All four sites now call this.runMutationProjector(...), awaited BEFORE the existing fire-and-forget emitMetadataMutation call — the order saveMetaItem's own comment establishes:

door	state	body
rollbackMetaItem (after registry write-through)	active	restored version's body
revertCommit restore limb	active	pre-commit body it wrote back
revertCommit soft-remove limb	deleted	none (matches deleteMetaItem's shape)
deleteMetaItem legacy raw-engine exit	deleted	none — same call the repository branch already makes

deleteMetaItem's legacy exit also now populates projectionApplied on its success return — the same optional key its repository-branch sibling has carried since ADR-0094 shipped (no new declared field; rollbackMetaItem / revertCommit carry none, unchanged).

Symbol fence honored: touched only rollbackMetaItem, both limbs of revertCommit, and deleteMetaItem's legacy raw-engine exit in packages/metadata-protocol/src/protocol.ts. Did not touch listCommits or its emitters (fenced to #14038).

Zone 2 measurement, quoted with file:line (HEAD a32f97047)

• A. Confirmed on origin/main @ d5cbb44f3 (the commit the issue cites): runMutationProjector had exactly 3 call sites (:15438 saveMetaItem, :16671 runPublishSideEffects, :20455 deleteMetaItem repo branch); emitMetadataMutation had 7 (including the four target sites at :19435, :19534, :19915, :20625 — none preceded by a projector call). All four target sites existed and none already projected.
• B.runMutationProjector is private async (protocol.ts, declared ~L4932 pre-diff), best-effort (catches, logs via console.warn, never throws), and MetadataMutationProjector/registerMutationProjector are a server-side extension seam — not part of ObjectStackProtocol's wire contract (same status as onMetadataMutation). Confirms Clause-②: no.
• C. The call deleteMetaItem's repository branch already makes: this.runMutationProjector({ type: singularTypeForRepo, name: request.name, state: 'deleted', organizationId: orgId }) (pre-diff :20455-20460). The legacy exit was missing exactly that call (same shape, same state, org scope from request.organizationId ?? null instead of the resolved orgId — the legacy path's own scoping variable, unchanged from what its existing emitMetadataMutation call already used).
• D. No existing caller depends on the old ordering: packages/plugins/plugin-security/src/permission-set-projection.test.ts (the one projector actually registered today, for permission) has zero tests exercising rollback/revert against the projector — this gap is exactly what the issue reports, so there's nothing today relying on the pre-fix silence. Ran the full objectql consumer suite that drives these three doors directly (protocol-commit-history, protocol-delete-object-registry-heal, protocol-lock-enforcement, protocol-org-overlay-registry-gate, protocol-publish-canonical-fold, protocol-publish-rollback, protocol-revert-org-scope, protocol-writepath-object-ownership — 113 tests) plus the sibling emit-mutation, mutation-listener and cluster-fanout suites (53 tests): all green.

Tests

New file: packages/metadata-protocol/src/protocol.recovery-doors-mutation-projector.test.ts — one pin per door (registers a fake projector, asserts it receives the correct state/body and runs before the mutation listener), a positive control (saveMetaItem), negative controls (unregistered type, throwing projector, already-absent row), a wire-shape check (deleteMetaItem legacy exit's projectionApplied), and a structural guard (exactly 7 runMutationProjector call sites).

Ablation (declared and run before landing): removing the rollbackMetaItem projector call — git checkout HEAD -- <path> restore, confirmed clean via git diff HEAD empty after — turned exactly 2 of the 10 new tests red (the rollback pin's body assertion, and the 7-call-site structural count dropping to 6), the other 8 green. Matches the file's own docblock claim.

Union re-run at HEAD a32f97047 (metadata-protocol + objectql):

Test Files 4 passed (4) — metadata-protocol (53 tests)
Test Files 3 passed (3) — objectql conformance (28 tests)

Gates run (dispatch-derived, node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands, 48 families): all green except two genuine PREREQUISITE NOT MET (exit 3, not a finding) that need a full-tree pnpm build this local run did not do — check:dual-build-cjs-loads and check:type-check-debt's --re-measure; CI's lint.yml builds the full workspace closure before both. check:engine-double-contract initially flagged the new test file's engine double as unrecorded coverage — fixed via node scripts/check-engine-double-contract.mjs --write (3 rows added, 0 lost), re-run green.

Companion ADR PR

Per the ruling, the code PR must not land without the ADR-0094 D2 amendment in flight: #14980 (draft, docs/adr/** governed surface, review requested from os-zhuang and hotlong, human merge only).

Changeset

patch — .changeset/recovery-door-mutation-projector.md (internal projection ordering; no published schema or wire shape moves).

🤖 Generated with Claude Code

https://claude.ai/code/session_0112hMx9hjJ9BgB28X97DS68

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/metadata-protocol, touching 7 documentable anchor(s).

3 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/client-sdk.mdx(via meta.rollbackItem (sdk, the route ledger binds it to POST /api/v1/meta/:type/:name/rollback, selected by route anchor /:type/:name/rollback), rollbackItem (sdk, the bare tail of client method meta.rollbackItem, bound to POST /api/v1/meta/:type/:name/rollback))
• content/docs/kernel/contracts/metadata-service.mdx(via /:type/:name/rollback (route, bridged from symbol rollbackMetaItem — its registrar handler names it))
• content/docs/kernel/services-checklist.mdx(via deleteMetaItem (symbol, a method of class ObjectStackProtocolImplementation))

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 9 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 5bc2f2727aef5d697530c63d64dd5592df445776 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from cdd5acdcc1e4c37fa4cbbeb9654fce87ece5e9e0 — the merge of head a32f970472b5ea4ed8455c0e50c67e2218773c1d into base 5bc2f2727aef5d697530c63d64dd5592df445776, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin cdd5acdcc1e4c37fa4cbbeb9654fce87ece5e9e0 && git checkout cdd5acdcc1e4c37fa4cbbeb9654fce87ece5e9e0
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 5bc2f2727aef5d697530c63d64dd5592df445776 a32f970472b5ea4ed8455c0e50c67e2218773c1d && git checkout -B drift-repro 5bc2f2727aef5d697530c63d64dd5592df445776 && git merge --no-ff a32f970472b5ea4ed8455c0e50c67e2218773c1d
node scripts/docs-audit/affected-docs.mjs --json 5bc2f2727aef5d697530c63d64dd5592df445776

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 5bc2f2727aef5d697530c63d64dd5592df445776 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-musk]

Independent review — PASS; marked ready and armed for the merge queue

An independent reviewer (not the author) re-derived this PR from the ruling and the code rather than from the PR body. Verdict PASS, no blocking defects. What was re-proved rather than accepted:

Clause-② = no, confirmed. Re-derived against the mechanical floor (any new exported symbol, or any new key on a published payload, is always yes). The diff adds only method-body statements inside four existing private methods — no new export. The projectionApplied key the legacy deleteMetaItem exit now populates is not new: it is declared once on that method's single shared return type at packages/metadata-protocol/src/protocol.ts:20271, that declaration line is untouched by this diff, and it already existed on main before this work began. The repository branch has populated the same optional key on the same shared type since ADR-0094 shipped (:20516). runMutationProjector is private async (:4932), never throws, and is a server-side extension seam — not part of the wire contract.

Ablation independently reproduced, both directions. Removing rollbackMetaItem's projector block (:19935-19950) and confirming the on-disk call-site count actually dropped 7 → 6:

 ❯ src/protocol.recovery-doors-mutation-projector.test.ts (10 tests | 2 failed) 78ms
× door 1 — rollbackMetaItem projects the restored body > runs the projector with state: active and the restored body, before the listener
× every projecting door goes through runMutationProjector > has exactly seven `this.runMutationProjector(` call sites
Test Files 1 failed (1)
Tests 2 failed | 8 passed (10)

Exactly the claimed 2 RED / 8 GREEN. Restored via git checkout HEAD --, proven clean with an empty git diff HEAD and git status --short, then 10/10 at restored HEAD. Sibling suites 43/43; an objectql consumer spot-check 28/28; typecheck clean.

Symbol fence against #14038 honored.#14038 is still open and scoped to listCommits (:18988-19106) and its emitters. This diff's five hunks land at :19435, :19544 (both inside revertCommit, :19107-19760), :19935 (inside rollbackMetaItem, :19761-20250), and :20661 / :20699 (inside deleteMetaItem). None falls within or before listCommits.

Org scope checked, no mismatch. The legacy branch never resolves an orgId variable at all: scopedWhere, restoreArtifactRegistryView, the pre-existing emitMetadataMutation call and the new projector call all use request.organizationId ?? null consistently — the branch's own established convention, unchanged here.

No double-run or unhandled-rejection path.runMutationProjector (:4932-4945) awaits inside its own try/catch, so sync throws and async rejections are both caught; all four call sites additionally sit inside their enclosing method's try/catch. revertCommit processes each item exactly once (:19184).

Gates re-derived off the merge base with no path arguments (48 commands): 44 green, 4 legitimate PREREQUISITE NOT MET (exit 3, each self-documented — the saved-turbo-log completeness gate, the repo-scoped-egress half-state gate, and two that read built dist/ for packages this change does not touch and need a whole-workspace build CI performs first). check-governed-merges.mjs --test on the final four-file list: NOT governed (0/4) — ordinary merge-queue landing.

Landing. All 33 check runs on head a32f97047 are success or skipped, zero red. Marked ready and auto-merge armed. The ruling's constraint that this PR must not land without the ADR-0094 D2 amendment in flight is satisfied: #14980 is open (draft, os-zhuang + hotlong requested, skip-changeset, human merge only — that PR is not touched by this seat).

One note for the ruling record, not a defect in this PR

Read with maximal literalness, the ruling's first clause says "rollbackMetaItem … and both limbs of revertCommit project with state: 'active'" and then, one clause later, that "revertCommit's soft-remove limb … project[s] with state: 'deleted'" — the soft-remove limb is one of "both limbs", so the two readings collide. Every independent restatement of the same decision — the issue's own "Suggested shape" section the ruling explicitly adopts, the claim comment, the ADR PR body, and this PR's table — states the coherent version (rollback + restore limb → active; soft-remove limb + legacy delete → deleted), which is what the diff implements and what the tests pin. Flagged so the wording can be tightened on the record if a maintainer wants; it changed nothing about what was built.

---

Generated by Claude Code

[os-musk]

Fixes#14415

Ruling (A)

Director seat, summon #11, decision batch #17, item 2 (verbatim reply: 「同意」). Full ruling text is quoted on the issue thread (comment 5522731140).

What changed

rollbackMetaItem, both limbs of revertCommit, and deleteMetaItem's legacy raw-engine exit restored/removed the metadata row and the in-memory registry, but never called the awaited ADR-0094 mutation projector — so a derived read-model (e.g. permission -> sys_permission_set) stayed on the rolled-back-FROM state until an unrelated save/publish/delete on the same name, or boot reconciliation (D3), re-derived it. saveMetaItem, runPublishSideEffects, and deleteMetaItem's repository branch already ran this hook — this closes the same gap for the projector that a prior card (#14179) closed for the mutation-event choke point, at the same four call sites.

All four sites now call this.runMutationProjector(...), awaited BEFORE the existing fire-and-forget emitMetadataMutation call — the order saveMetaItem's own comment establishes:

door	state	body
rollbackMetaItem (after registry write-through)	active	restored version's body
revertCommit restore limb	active	pre-commit body it wrote back
revertCommit soft-remove limb	deleted	none (matches deleteMetaItem's shape)
deleteMetaItem legacy raw-engine exit	deleted	none — same call the repository branch already makes

deleteMetaItem's legacy exit also now populates projectionApplied on its success return — the same optional key its repository-branch sibling has carried since ADR-0094 shipped (no new declared field; rollbackMetaItem / revertCommit carry none, unchanged).

Symbol fence honored: touched only rollbackMetaItem, both limbs of revertCommit, and deleteMetaItem's legacy raw-engine exit in packages/metadata-protocol/src/protocol.ts. Did not touch listCommits or its emitters (fenced to #14038).

Zone 2 measurement, quoted with file:line (HEAD a32f97047)

• A. Confirmed on origin/main @ d5cbb44f3 (the commit the issue cites): runMutationProjector had exactly 3 call sites (:15438 saveMetaItem, :16671 runPublishSideEffects, :20455 deleteMetaItem repo branch); emitMetadataMutation had 7 (including the four target sites at :19435, :19534, :19915, :20625 — none preceded by a projector call). All four target sites existed and none already projected.
• B.runMutationProjector is private async (protocol.ts, declared ~L4932 pre-diff), best-effort (catches, logs via console.warn, never throws), and MetadataMutationProjector/registerMutationProjector are a server-side extension seam — not part of ObjectStackProtocol's wire contract (same status as onMetadataMutation). Confirms Clause-②: no.
• C. The call deleteMetaItem's repository branch already makes: this.runMutationProjector({ type: singularTypeForRepo, name: request.name, state: 'deleted', organizationId: orgId }) (pre-diff :20455-20460). The legacy exit was missing exactly that call (same shape, same state, org scope from request.organizationId ?? null instead of the resolved orgId — the legacy path's own scoping variable, unchanged from what its existing emitMetadataMutation call already used).
• D. No existing caller depends on the old ordering: packages/plugins/plugin-security/src/permission-set-projection.test.ts (the one projector actually registered today, for permission) has zero tests exercising rollback/revert against the projector — this gap is exactly what the issue reports, so there's nothing today relying on the pre-fix silence. Ran the full objectql consumer suite that drives these three doors directly (protocol-commit-history, protocol-delete-object-registry-heal, protocol-lock-enforcement, protocol-org-overlay-registry-gate, protocol-publish-canonical-fold, protocol-publish-rollback, protocol-revert-org-scope, protocol-writepath-object-ownership — 113 tests) plus the sibling emit-mutation, mutation-listener and cluster-fanout suites (53 tests): all green.

Tests

New file: packages/metadata-protocol/src/protocol.recovery-doors-mutation-projector.test.ts — one pin per door (registers a fake projector, asserts it receives the correct state/body and runs before the mutation listener), a positive control (saveMetaItem), negative controls (unregistered type, throwing projector, already-absent row), a wire-shape check (deleteMetaItem legacy exit's projectionApplied), and a structural guard (exactly 7 runMutationProjector call sites).

Ablation (declared and run before landing): removing the rollbackMetaItem projector call — git checkout HEAD -- <path> restore, confirmed clean via git diff HEAD empty after — turned exactly 2 of the 10 new tests red (the rollback pin's body assertion, and the 7-call-site structural count dropping to 6), the other 8 green. Matches the file's own docblock claim.

Union re-run at HEAD a32f97047 (metadata-protocol + objectql):

Test Files 4 passed (4) — metadata-protocol (53 tests)
Test Files 3 passed (3) — objectql conformance (28 tests)

Gates run (dispatch-derived, node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands, 48 families): all green except two genuine PREREQUISITE NOT MET (exit 3, not a finding) that need a full-tree pnpm build this local run did not do — check:dual-build-cjs-loads and check:type-check-debt's --re-measure; CI's lint.yml builds the full workspace closure before both. check:engine-double-contract initially flagged the new test file's engine double as unrecorded coverage — fixed via node scripts/check-engine-double-contract.mjs --write (3 rows added, 0 lost), re-run green.

Companion ADR PR

Per the ruling, the code PR must not land without the ADR-0094 D2 amendment in flight: #14980 (draft, docs/adr/** governed surface, review requested from os-zhuang and hotlong, human merge only).

Changeset

patch — .changeset/recovery-door-mutation-projector.md (internal projection ordering; no published schema or wire shape moves).

🤖 Generated with Claude Code

https://claude.ai/code/session_0112hMx9hjJ9BgB28X97DS68

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/metadata-protocol, touching 7 documentable anchor(s).

3 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/client-sdk.mdx(via meta.rollbackItem (sdk, the route ledger binds it to POST /api/v1/meta/:type/:name/rollback, selected by route anchor /:type/:name/rollback), rollbackItem (sdk, the bare tail of client method meta.rollbackItem, bound to POST /api/v1/meta/:type/:name/rollback))
• content/docs/kernel/contracts/metadata-service.mdx(via /:type/:name/rollback (route, bridged from symbol rollbackMetaItem — its registrar handler names it))
• content/docs/kernel/services-checklist.mdx(via deleteMetaItem (symbol, a method of class ObjectStackProtocolImplementation))

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 9 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 5bc2f2727aef5d697530c63d64dd5592df445776 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from cdd5acdcc1e4c37fa4cbbeb9654fce87ece5e9e0 — the merge of head a32f970472b5ea4ed8455c0e50c67e2218773c1d into base 5bc2f2727aef5d697530c63d64dd5592df445776, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin cdd5acdcc1e4c37fa4cbbeb9654fce87ece5e9e0 && git checkout cdd5acdcc1e4c37fa4cbbeb9654fce87ece5e9e0
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 5bc2f2727aef5d697530c63d64dd5592df445776 a32f970472b5ea4ed8455c0e50c67e2218773c1d && git checkout -B drift-repro 5bc2f2727aef5d697530c63d64dd5592df445776 && git merge --no-ff a32f970472b5ea4ed8455c0e50c67e2218773c1d
node scripts/docs-audit/affected-docs.mjs --json 5bc2f2727aef5d697530c63d64dd5592df445776

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 5bc2f2727aef5d697530c63d64dd5592df445776 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-musk]

Independent review — PASS; marked ready and armed for the merge queue

An independent reviewer (not the author) re-derived this PR from the ruling and the code rather than from the PR body. Verdict PASS, no blocking defects. What was re-proved rather than accepted:

Clause-② = no, confirmed. Re-derived against the mechanical floor (any new exported symbol, or any new key on a published payload, is always yes). The diff adds only method-body statements inside four existing private methods — no new export. The projectionApplied key the legacy deleteMetaItem exit now populates is not new: it is declared once on that method's single shared return type at packages/metadata-protocol/src/protocol.ts:20271, that declaration line is untouched by this diff, and it already existed on main before this work began. The repository branch has populated the same optional key on the same shared type since ADR-0094 shipped (:20516). runMutationProjector is private async (:4932), never throws, and is a server-side extension seam — not part of the wire contract.

Ablation independently reproduced, both directions. Removing rollbackMetaItem's projector block (:19935-19950) and confirming the on-disk call-site count actually dropped 7 → 6:

 ❯ src/protocol.recovery-doors-mutation-projector.test.ts (10 tests | 2 failed) 78ms
× door 1 — rollbackMetaItem projects the restored body > runs the projector with state: active and the restored body, before the listener
× every projecting door goes through runMutationProjector > has exactly seven `this.runMutationProjector(` call sites
Test Files 1 failed (1)
Tests 2 failed | 8 passed (10)

Exactly the claimed 2 RED / 8 GREEN. Restored via git checkout HEAD --, proven clean with an empty git diff HEAD and git status --short, then 10/10 at restored HEAD. Sibling suites 43/43; an objectql consumer spot-check 28/28; typecheck clean.

Symbol fence against #14038 honored.#14038 is still open and scoped to listCommits (:18988-19106) and its emitters. This diff's five hunks land at :19435, :19544 (both inside revertCommit, :19107-19760), :19935 (inside rollbackMetaItem, :19761-20250), and :20661 / :20699 (inside deleteMetaItem). None falls within or before listCommits.

Org scope checked, no mismatch. The legacy branch never resolves an orgId variable at all: scopedWhere, restoreArtifactRegistryView, the pre-existing emitMetadataMutation call and the new projector call all use request.organizationId ?? null consistently — the branch's own established convention, unchanged here.

No double-run or unhandled-rejection path.runMutationProjector (:4932-4945) awaits inside its own try/catch, so sync throws and async rejections are both caught; all four call sites additionally sit inside their enclosing method's try/catch. revertCommit processes each item exactly once (:19184).

Gates re-derived off the merge base with no path arguments (48 commands): 44 green, 4 legitimate PREREQUISITE NOT MET (exit 3, each self-documented — the saved-turbo-log completeness gate, the repo-scoped-egress half-state gate, and two that read built dist/ for packages this change does not touch and need a whole-workspace build CI performs first). check-governed-merges.mjs --test on the final four-file list: NOT governed (0/4) — ordinary merge-queue landing.

Landing. All 33 check runs on head a32f97047 are success or skipped, zero red. Marked ready and auto-merge armed. The ruling's constraint that this PR must not land without the ADR-0094 D2 amendment in flight is satisfied: #14980 is open (draft, os-zhuang + hotlong requested, skip-changeset, human merge only — that PR is not touched by this seat).

One note for the ruling record, not a defect in this PR

Read with maximal literalness, the ruling's first clause says "rollbackMetaItem … and both limbs of revertCommit project with state: 'active'" and then, one clause later, that "revertCommit's soft-remove limb … project[s] with state: 'deleted'" — the soft-remove limb is one of "both limbs", so the two readings collide. Every independent restatement of the same decision — the issue's own "Suggested shape" section the ruling explicitly adopts, the claim comment, the ADR PR body, and this PR's table — states the coherent version (rollback + restore limb → active; soft-remove limb + legacy delete → deleted), which is what the diff implements and what the tests pin. Flagged so the wording can be tightened on the record if a maintainer wants; it changed nothing about what was built.

---

Generated by Claude Code

[os-musk]

Fixes#14415

Ruling (A)

Director seat, summon #11, decision batch #17, item 2 (verbatim reply: 「同意」). Full ruling text is quoted on the issue thread (comment 5522731140).

What changed

rollbackMetaItem, both limbs of revertCommit, and deleteMetaItem's legacy raw-engine exit restored/removed the metadata row and the in-memory registry, but never called the awaited ADR-0094 mutation projector — so a derived read-model (e.g. permission -> sys_permission_set) stayed on the rolled-back-FROM state until an unrelated save/publish/delete on the same name, or boot reconciliation (D3), re-derived it. saveMetaItem, runPublishSideEffects, and deleteMetaItem's repository branch already ran this hook — this closes the same gap for the projector that a prior card (#14179) closed for the mutation-event choke point, at the same four call sites.

All four sites now call this.runMutationProjector(...), awaited BEFORE the existing fire-and-forget emitMetadataMutation call — the order saveMetaItem's own comment establishes:

door	state	body
rollbackMetaItem (after registry write-through)	active	restored version's body
revertCommit restore limb	active	pre-commit body it wrote back
revertCommit soft-remove limb	deleted	none (matches deleteMetaItem's shape)
deleteMetaItem legacy raw-engine exit	deleted	none — same call the repository branch already makes

deleteMetaItem's legacy exit also now populates projectionApplied on its success return — the same optional key its repository-branch sibling has carried since ADR-0094 shipped (no new declared field; rollbackMetaItem / revertCommit carry none, unchanged).

Symbol fence honored: touched only rollbackMetaItem, both limbs of revertCommit, and deleteMetaItem's legacy raw-engine exit in packages/metadata-protocol/src/protocol.ts. Did not touch listCommits or its emitters (fenced to #14038).

Zone 2 measurement, quoted with file:line (HEAD a32f97047)

• A. Confirmed on origin/main @ d5cbb44f3 (the commit the issue cites): runMutationProjector had exactly 3 call sites (:15438 saveMetaItem, :16671 runPublishSideEffects, :20455 deleteMetaItem repo branch); emitMetadataMutation had 7 (including the four target sites at :19435, :19534, :19915, :20625 — none preceded by a projector call). All four target sites existed and none already projected.
• B.runMutationProjector is private async (protocol.ts, declared ~L4932 pre-diff), best-effort (catches, logs via console.warn, never throws), and MetadataMutationProjector/registerMutationProjector are a server-side extension seam — not part of ObjectStackProtocol's wire contract (same status as onMetadataMutation). Confirms Clause-②: no.
• C. The call deleteMetaItem's repository branch already makes: this.runMutationProjector({ type: singularTypeForRepo, name: request.name, state: 'deleted', organizationId: orgId }) (pre-diff :20455-20460). The legacy exit was missing exactly that call (same shape, same state, org scope from request.organizationId ?? null instead of the resolved orgId — the legacy path's own scoping variable, unchanged from what its existing emitMetadataMutation call already used).
• D. No existing caller depends on the old ordering: packages/plugins/plugin-security/src/permission-set-projection.test.ts (the one projector actually registered today, for permission) has zero tests exercising rollback/revert against the projector — this gap is exactly what the issue reports, so there's nothing today relying on the pre-fix silence. Ran the full objectql consumer suite that drives these three doors directly (protocol-commit-history, protocol-delete-object-registry-heal, protocol-lock-enforcement, protocol-org-overlay-registry-gate, protocol-publish-canonical-fold, protocol-publish-rollback, protocol-revert-org-scope, protocol-writepath-object-ownership — 113 tests) plus the sibling emit-mutation, mutation-listener and cluster-fanout suites (53 tests): all green.

Tests

New file: packages/metadata-protocol/src/protocol.recovery-doors-mutation-projector.test.ts — one pin per door (registers a fake projector, asserts it receives the correct state/body and runs before the mutation listener), a positive control (saveMetaItem), negative controls (unregistered type, throwing projector, already-absent row), a wire-shape check (deleteMetaItem legacy exit's projectionApplied), and a structural guard (exactly 7 runMutationProjector call sites).

Ablation (declared and run before landing): removing the rollbackMetaItem projector call — git checkout HEAD -- <path> restore, confirmed clean via git diff HEAD empty after — turned exactly 2 of the 10 new tests red (the rollback pin's body assertion, and the 7-call-site structural count dropping to 6), the other 8 green. Matches the file's own docblock claim.

Union re-run at HEAD a32f97047 (metadata-protocol + objectql):

Test Files 4 passed (4) — metadata-protocol (53 tests)
Test Files 3 passed (3) — objectql conformance (28 tests)

Gates run (dispatch-derived, node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands, 48 families): all green except two genuine PREREQUISITE NOT MET (exit 3, not a finding) that need a full-tree pnpm build this local run did not do — check:dual-build-cjs-loads and check:type-check-debt's --re-measure; CI's lint.yml builds the full workspace closure before both. check:engine-double-contract initially flagged the new test file's engine double as unrecorded coverage — fixed via node scripts/check-engine-double-contract.mjs --write (3 rows added, 0 lost), re-run green.

Companion ADR PR

Per the ruling, the code PR must not land without the ADR-0094 D2 amendment in flight: #14980 (draft, docs/adr/** governed surface, review requested from os-zhuang and hotlong, human merge only).

Changeset

patch — .changeset/recovery-door-mutation-projector.md (internal projection ordering; no published schema or wire shape moves).

🤖 Generated with Claude Code

https://claude.ai/code/session_0112hMx9hjJ9BgB28X97DS68

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/metadata-protocol, touching 7 documentable anchor(s).

3 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/client-sdk.mdx(via meta.rollbackItem (sdk, the route ledger binds it to POST /api/v1/meta/:type/:name/rollback, selected by route anchor /:type/:name/rollback), rollbackItem (sdk, the bare tail of client method meta.rollbackItem, bound to POST /api/v1/meta/:type/:name/rollback))
• content/docs/kernel/contracts/metadata-service.mdx(via /:type/:name/rollback (route, bridged from symbol rollbackMetaItem — its registrar handler names it))
• content/docs/kernel/services-checklist.mdx(via deleteMetaItem (symbol, a method of class ObjectStackProtocolImplementation))

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 9 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 5bc2f2727aef5d697530c63d64dd5592df445776 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from cdd5acdcc1e4c37fa4cbbeb9654fce87ece5e9e0 — the merge of head a32f970472b5ea4ed8455c0e50c67e2218773c1d into base 5bc2f2727aef5d697530c63d64dd5592df445776, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin cdd5acdcc1e4c37fa4cbbeb9654fce87ece5e9e0 && git checkout cdd5acdcc1e4c37fa4cbbeb9654fce87ece5e9e0
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 5bc2f2727aef5d697530c63d64dd5592df445776 a32f970472b5ea4ed8455c0e50c67e2218773c1d && git checkout -B drift-repro 5bc2f2727aef5d697530c63d64dd5592df445776 && git merge --no-ff a32f970472b5ea4ed8455c0e50c67e2218773c1d
node scripts/docs-audit/affected-docs.mjs --json 5bc2f2727aef5d697530c63d64dd5592df445776

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 5bc2f2727aef5d697530c63d64dd5592df445776 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-musk]

Independent review — PASS; marked ready and armed for the merge queue

An independent reviewer (not the author) re-derived this PR from the ruling and the code rather than from the PR body. Verdict PASS, no blocking defects. What was re-proved rather than accepted:

Clause-② = no, confirmed. Re-derived against the mechanical floor (any new exported symbol, or any new key on a published payload, is always yes). The diff adds only method-body statements inside four existing private methods — no new export. The projectionApplied key the legacy deleteMetaItem exit now populates is not new: it is declared once on that method's single shared return type at packages/metadata-protocol/src/protocol.ts:20271, that declaration line is untouched by this diff, and it already existed on main before this work began. The repository branch has populated the same optional key on the same shared type since ADR-0094 shipped (:20516). runMutationProjector is private async (:4932), never throws, and is a server-side extension seam — not part of the wire contract.

Ablation independently reproduced, both directions. Removing rollbackMetaItem's projector block (:19935-19950) and confirming the on-disk call-site count actually dropped 7 → 6:

 ❯ src/protocol.recovery-doors-mutation-projector.test.ts (10 tests | 2 failed) 78ms
× door 1 — rollbackMetaItem projects the restored body > runs the projector with state: active and the restored body, before the listener
× every projecting door goes through runMutationProjector > has exactly seven `this.runMutationProjector(` call sites
Test Files 1 failed (1)
Tests 2 failed | 8 passed (10)

Exactly the claimed 2 RED / 8 GREEN. Restored via git checkout HEAD --, proven clean with an empty git diff HEAD and git status --short, then 10/10 at restored HEAD. Sibling suites 43/43; an objectql consumer spot-check 28/28; typecheck clean.

Symbol fence against #14038 honored.#14038 is still open and scoped to listCommits (:18988-19106) and its emitters. This diff's five hunks land at :19435, :19544 (both inside revertCommit, :19107-19760), :19935 (inside rollbackMetaItem, :19761-20250), and :20661 / :20699 (inside deleteMetaItem). None falls within or before listCommits.

Org scope checked, no mismatch. The legacy branch never resolves an orgId variable at all: scopedWhere, restoreArtifactRegistryView, the pre-existing emitMetadataMutation call and the new projector call all use request.organizationId ?? null consistently — the branch's own established convention, unchanged here.

No double-run or unhandled-rejection path.runMutationProjector (:4932-4945) awaits inside its own try/catch, so sync throws and async rejections are both caught; all four call sites additionally sit inside their enclosing method's try/catch. revertCommit processes each item exactly once (:19184).

Gates re-derived off the merge base with no path arguments (48 commands): 44 green, 4 legitimate PREREQUISITE NOT MET (exit 3, each self-documented — the saved-turbo-log completeness gate, the repo-scoped-egress half-state gate, and two that read built dist/ for packages this change does not touch and need a whole-workspace build CI performs first). check-governed-merges.mjs --test on the final four-file list: NOT governed (0/4) — ordinary merge-queue landing.

Landing. All 33 check runs on head a32f97047 are success or skipped, zero red. Marked ready and auto-merge armed. The ruling's constraint that this PR must not land without the ADR-0094 D2 amendment in flight is satisfied: #14980 is open (draft, os-zhuang + hotlong requested, skip-changeset, human merge only — that PR is not touched by this seat).

One note for the ruling record, not a defect in this PR

Read with maximal literalness, the ruling's first clause says "rollbackMetaItem … and both limbs of revertCommit project with state: 'active'" and then, one clause later, that "revertCommit's soft-remove limb … project[s] with state: 'deleted'" — the soft-remove limb is one of "both limbs", so the two readings collide. Every independent restatement of the same decision — the issue's own "Suggested shape" section the ruling explicitly adopts, the claim comment, the ADR PR body, and this PR's table — states the coherent version (rollback + restore limb → active; soft-remove limb + legacy delete → deleted), which is what the diff implements and what the tests pin. Flagged so the wording can be tightened on the record if a maintainer wants; it changed nothing about what was built.

---

Generated by Claude Code

[os-musk]

Fixes#14415

Ruling (A)

Director seat, summon #11, decision batch #17, item 2 (verbatim reply: 「同意」). Full ruling text is quoted on the issue thread (comment 5522731140).

What changed

rollbackMetaItem, both limbs of revertCommit, and deleteMetaItem's legacy raw-engine exit restored/removed the metadata row and the in-memory registry, but never called the awaited ADR-0094 mutation projector — so a derived read-model (e.g. permission -> sys_permission_set) stayed on the rolled-back-FROM state until an unrelated save/publish/delete on the same name, or boot reconciliation (D3), re-derived it. saveMetaItem, runPublishSideEffects, and deleteMetaItem's repository branch already ran this hook — this closes the same gap for the projector that a prior card (#14179) closed for the mutation-event choke point, at the same four call sites.

All four sites now call this.runMutationProjector(...), awaited BEFORE the existing fire-and-forget emitMetadataMutation call — the order saveMetaItem's own comment establishes:

door	state	body
rollbackMetaItem (after registry write-through)	active	restored version's body
revertCommit restore limb	active	pre-commit body it wrote back
revertCommit soft-remove limb	deleted	none (matches deleteMetaItem's shape)
deleteMetaItem legacy raw-engine exit	deleted	none — same call the repository branch already makes

deleteMetaItem's legacy exit also now populates projectionApplied on its success return — the same optional key its repository-branch sibling has carried since ADR-0094 shipped (no new declared field; rollbackMetaItem / revertCommit carry none, unchanged).

Symbol fence honored: touched only rollbackMetaItem, both limbs of revertCommit, and deleteMetaItem's legacy raw-engine exit in packages/metadata-protocol/src/protocol.ts. Did not touch listCommits or its emitters (fenced to #14038).

Zone 2 measurement, quoted with file:line (HEAD a32f97047)

• A. Confirmed on origin/main @ d5cbb44f3 (the commit the issue cites): runMutationProjector had exactly 3 call sites (:15438 saveMetaItem, :16671 runPublishSideEffects, :20455 deleteMetaItem repo branch); emitMetadataMutation had 7 (including the four target sites at :19435, :19534, :19915, :20625 — none preceded by a projector call). All four target sites existed and none already projected.
• B.runMutationProjector is private async (protocol.ts, declared ~L4932 pre-diff), best-effort (catches, logs via console.warn, never throws), and MetadataMutationProjector/registerMutationProjector are a server-side extension seam — not part of ObjectStackProtocol's wire contract (same status as onMetadataMutation). Confirms Clause-②: no.
• C. The call deleteMetaItem's repository branch already makes: this.runMutationProjector({ type: singularTypeForRepo, name: request.name, state: 'deleted', organizationId: orgId }) (pre-diff :20455-20460). The legacy exit was missing exactly that call (same shape, same state, org scope from request.organizationId ?? null instead of the resolved orgId — the legacy path's own scoping variable, unchanged from what its existing emitMetadataMutation call already used).
• D. No existing caller depends on the old ordering: packages/plugins/plugin-security/src/permission-set-projection.test.ts (the one projector actually registered today, for permission) has zero tests exercising rollback/revert against the projector — this gap is exactly what the issue reports, so there's nothing today relying on the pre-fix silence. Ran the full objectql consumer suite that drives these three doors directly (protocol-commit-history, protocol-delete-object-registry-heal, protocol-lock-enforcement, protocol-org-overlay-registry-gate, protocol-publish-canonical-fold, protocol-publish-rollback, protocol-revert-org-scope, protocol-writepath-object-ownership — 113 tests) plus the sibling emit-mutation, mutation-listener and cluster-fanout suites (53 tests): all green.

Tests

New file: packages/metadata-protocol/src/protocol.recovery-doors-mutation-projector.test.ts — one pin per door (registers a fake projector, asserts it receives the correct state/body and runs before the mutation listener), a positive control (saveMetaItem), negative controls (unregistered type, throwing projector, already-absent row), a wire-shape check (deleteMetaItem legacy exit's projectionApplied), and a structural guard (exactly 7 runMutationProjector call sites).

Ablation (declared and run before landing): removing the rollbackMetaItem projector call — git checkout HEAD -- <path> restore, confirmed clean via git diff HEAD empty after — turned exactly 2 of the 10 new tests red (the rollback pin's body assertion, and the 7-call-site structural count dropping to 6), the other 8 green. Matches the file's own docblock claim.

Union re-run at HEAD a32f97047 (metadata-protocol + objectql):

Test Files 4 passed (4) — metadata-protocol (53 tests)
Test Files 3 passed (3) — objectql conformance (28 tests)

Gates run (dispatch-derived, node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands, 48 families): all green except two genuine PREREQUISITE NOT MET (exit 3, not a finding) that need a full-tree pnpm build this local run did not do — check:dual-build-cjs-loads and check:type-check-debt's --re-measure; CI's lint.yml builds the full workspace closure before both. check:engine-double-contract initially flagged the new test file's engine double as unrecorded coverage — fixed via node scripts/check-engine-double-contract.mjs --write (3 rows added, 0 lost), re-run green.

Companion ADR PR

Per the ruling, the code PR must not land without the ADR-0094 D2 amendment in flight: #14980 (draft, docs/adr/** governed surface, review requested from os-zhuang and hotlong, human merge only).

Changeset

patch — .changeset/recovery-door-mutation-projector.md (internal projection ordering; no published schema or wire shape moves).

🤖 Generated with Claude Code

https://claude.ai/code/session_0112hMx9hjJ9BgB28X97DS68

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/metadata-protocol, touching 7 documentable anchor(s).

3 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/client-sdk.mdx(via meta.rollbackItem (sdk, the route ledger binds it to POST /api/v1/meta/:type/:name/rollback, selected by route anchor /:type/:name/rollback), rollbackItem (sdk, the bare tail of client method meta.rollbackItem, bound to POST /api/v1/meta/:type/:name/rollback))
• content/docs/kernel/contracts/metadata-service.mdx(via /:type/:name/rollback (route, bridged from symbol rollbackMetaItem — its registrar handler names it))
• content/docs/kernel/services-checklist.mdx(via deleteMetaItem (symbol, a method of class ObjectStackProtocolImplementation))

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 9 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 5bc2f2727aef5d697530c63d64dd5592df445776 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from cdd5acdcc1e4c37fa4cbbeb9654fce87ece5e9e0 — the merge of head a32f970472b5ea4ed8455c0e50c67e2218773c1d into base 5bc2f2727aef5d697530c63d64dd5592df445776, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin cdd5acdcc1e4c37fa4cbbeb9654fce87ece5e9e0 && git checkout cdd5acdcc1e4c37fa4cbbeb9654fce87ece5e9e0
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 5bc2f2727aef5d697530c63d64dd5592df445776 a32f970472b5ea4ed8455c0e50c67e2218773c1d && git checkout -B drift-repro 5bc2f2727aef5d697530c63d64dd5592df445776 && git merge --no-ff a32f970472b5ea4ed8455c0e50c67e2218773c1d
node scripts/docs-audit/affected-docs.mjs --json 5bc2f2727aef5d697530c63d64dd5592df445776

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 5bc2f2727aef5d697530c63d64dd5592df445776 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-musk]

Independent review — PASS; marked ready and armed for the merge queue

An independent reviewer (not the author) re-derived this PR from the ruling and the code rather than from the PR body. Verdict PASS, no blocking defects. What was re-proved rather than accepted:

Clause-② = no, confirmed. Re-derived against the mechanical floor (any new exported symbol, or any new key on a published payload, is always yes). The diff adds only method-body statements inside four existing private methods — no new export. The projectionApplied key the legacy deleteMetaItem exit now populates is not new: it is declared once on that method's single shared return type at packages/metadata-protocol/src/protocol.ts:20271, that declaration line is untouched by this diff, and it already existed on main before this work began. The repository branch has populated the same optional key on the same shared type since ADR-0094 shipped (:20516). runMutationProjector is private async (:4932), never throws, and is a server-side extension seam — not part of the wire contract.

Ablation independently reproduced, both directions. Removing rollbackMetaItem's projector block (:19935-19950) and confirming the on-disk call-site count actually dropped 7 → 6:

 ❯ src/protocol.recovery-doors-mutation-projector.test.ts (10 tests | 2 failed) 78ms
× door 1 — rollbackMetaItem projects the restored body > runs the projector with state: active and the restored body, before the listener
× every projecting door goes through runMutationProjector > has exactly seven `this.runMutationProjector(` call sites
Test Files 1 failed (1)
Tests 2 failed | 8 passed (10)

Exactly the claimed 2 RED / 8 GREEN. Restored via git checkout HEAD --, proven clean with an empty git diff HEAD and git status --short, then 10/10 at restored HEAD. Sibling suites 43/43; an objectql consumer spot-check 28/28; typecheck clean.

Symbol fence against #14038 honored.#14038 is still open and scoped to listCommits (:18988-19106) and its emitters. This diff's five hunks land at :19435, :19544 (both inside revertCommit, :19107-19760), :19935 (inside rollbackMetaItem, :19761-20250), and :20661 / :20699 (inside deleteMetaItem). None falls within or before listCommits.

Org scope checked, no mismatch. The legacy branch never resolves an orgId variable at all: scopedWhere, restoreArtifactRegistryView, the pre-existing emitMetadataMutation call and the new projector call all use request.organizationId ?? null consistently — the branch's own established convention, unchanged here.

No double-run or unhandled-rejection path.runMutationProjector (:4932-4945) awaits inside its own try/catch, so sync throws and async rejections are both caught; all four call sites additionally sit inside their enclosing method's try/catch. revertCommit processes each item exactly once (:19184).

Gates re-derived off the merge base with no path arguments (48 commands): 44 green, 4 legitimate PREREQUISITE NOT MET (exit 3, each self-documented — the saved-turbo-log completeness gate, the repo-scoped-egress half-state gate, and two that read built dist/ for packages this change does not touch and need a whole-workspace build CI performs first). check-governed-merges.mjs --test on the final four-file list: NOT governed (0/4) — ordinary merge-queue landing.

Landing. All 33 check runs on head a32f97047 are success or skipped, zero red. Marked ready and auto-merge armed. The ruling's constraint that this PR must not land without the ADR-0094 D2 amendment in flight is satisfied: #14980 is open (draft, os-zhuang + hotlong requested, skip-changeset, human merge only — that PR is not touched by this seat).

One note for the ruling record, not a defect in this PR

Read with maximal literalness, the ruling's first clause says "rollbackMetaItem … and both limbs of revertCommit project with state: 'active'" and then, one clause later, that "revertCommit's soft-remove limb … project[s] with state: 'deleted'" — the soft-remove limb is one of "both limbs", so the two readings collide. Every independent restatement of the same decision — the issue's own "Suggested shape" section the ruling explicitly adopts, the claim comment, the ADR PR body, and this PR's table — states the coherent version (rollback + restore limb → active; soft-remove limb + legacy delete → deleted), which is what the diff implements and what the tests pin. Flagged so the wording can be tightened on the record if a maintainer wants; it changed nothing about what was built.

---

Generated by Claude Code

[os-musk]

Fixes#14415

Ruling (A)

Director seat, summon #11, decision batch #17, item 2 (verbatim reply: 「同意」). Full ruling text is quoted on the issue thread (comment 5522731140).

What changed

rollbackMetaItem, both limbs of revertCommit, and deleteMetaItem's legacy raw-engine exit restored/removed the metadata row and the in-memory registry, but never called the awaited ADR-0094 mutation projector — so a derived read-model (e.g. permission -> sys_permission_set) stayed on the rolled-back-FROM state until an unrelated save/publish/delete on the same name, or boot reconciliation (D3), re-derived it. saveMetaItem, runPublishSideEffects, and deleteMetaItem's repository branch already ran this hook — this closes the same gap for the projector that a prior card (#14179) closed for the mutation-event choke point, at the same four call sites.

All four sites now call this.runMutationProjector(...), awaited BEFORE the existing fire-and-forget emitMetadataMutation call — the order saveMetaItem's own comment establishes:

door	state	body
rollbackMetaItem (after registry write-through)	active	restored version's body
revertCommit restore limb	active	pre-commit body it wrote back
revertCommit soft-remove limb	deleted	none (matches deleteMetaItem's shape)
deleteMetaItem legacy raw-engine exit	deleted	none — same call the repository branch already makes

deleteMetaItem's legacy exit also now populates projectionApplied on its success return — the same optional key its repository-branch sibling has carried since ADR-0094 shipped (no new declared field; rollbackMetaItem / revertCommit carry none, unchanged).

Symbol fence honored: touched only rollbackMetaItem, both limbs of revertCommit, and deleteMetaItem's legacy raw-engine exit in packages/metadata-protocol/src/protocol.ts. Did not touch listCommits or its emitters (fenced to #14038).

Zone 2 measurement, quoted with file:line (HEAD a32f97047)

• A. Confirmed on origin/main @ d5cbb44f3 (the commit the issue cites): runMutationProjector had exactly 3 call sites (:15438 saveMetaItem, :16671 runPublishSideEffects, :20455 deleteMetaItem repo branch); emitMetadataMutation had 7 (including the four target sites at :19435, :19534, :19915, :20625 — none preceded by a projector call). All four target sites existed and none already projected.
• B.runMutationProjector is private async (protocol.ts, declared ~L4932 pre-diff), best-effort (catches, logs via console.warn, never throws), and MetadataMutationProjector/registerMutationProjector are a server-side extension seam — not part of ObjectStackProtocol's wire contract (same status as onMetadataMutation). Confirms Clause-②: no.
• C. The call deleteMetaItem's repository branch already makes: this.runMutationProjector({ type: singularTypeForRepo, name: request.name, state: 'deleted', organizationId: orgId }) (pre-diff :20455-20460). The legacy exit was missing exactly that call (same shape, same state, org scope from request.organizationId ?? null instead of the resolved orgId — the legacy path's own scoping variable, unchanged from what its existing emitMetadataMutation call already used).
• D. No existing caller depends on the old ordering: packages/plugins/plugin-security/src/permission-set-projection.test.ts (the one projector actually registered today, for permission) has zero tests exercising rollback/revert against the projector — this gap is exactly what the issue reports, so there's nothing today relying on the pre-fix silence. Ran the full objectql consumer suite that drives these three doors directly (protocol-commit-history, protocol-delete-object-registry-heal, protocol-lock-enforcement, protocol-org-overlay-registry-gate, protocol-publish-canonical-fold, protocol-publish-rollback, protocol-revert-org-scope, protocol-writepath-object-ownership — 113 tests) plus the sibling emit-mutation, mutation-listener and cluster-fanout suites (53 tests): all green.

Tests

New file: packages/metadata-protocol/src/protocol.recovery-doors-mutation-projector.test.ts — one pin per door (registers a fake projector, asserts it receives the correct state/body and runs before the mutation listener), a positive control (saveMetaItem), negative controls (unregistered type, throwing projector, already-absent row), a wire-shape check (deleteMetaItem legacy exit's projectionApplied), and a structural guard (exactly 7 runMutationProjector call sites).

Ablation (declared and run before landing): removing the rollbackMetaItem projector call — git checkout HEAD -- <path> restore, confirmed clean via git diff HEAD empty after — turned exactly 2 of the 10 new tests red (the rollback pin's body assertion, and the 7-call-site structural count dropping to 6), the other 8 green. Matches the file's own docblock claim.

Union re-run at HEAD a32f97047 (metadata-protocol + objectql):

Test Files 4 passed (4) — metadata-protocol (53 tests)
Test Files 3 passed (3) — objectql conformance (28 tests)

Gates run (dispatch-derived, node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands, 48 families): all green except two genuine PREREQUISITE NOT MET (exit 3, not a finding) that need a full-tree pnpm build this local run did not do — check:dual-build-cjs-loads and check:type-check-debt's --re-measure; CI's lint.yml builds the full workspace closure before both. check:engine-double-contract initially flagged the new test file's engine double as unrecorded coverage — fixed via node scripts/check-engine-double-contract.mjs --write (3 rows added, 0 lost), re-run green.

Companion ADR PR

Per the ruling, the code PR must not land without the ADR-0094 D2 amendment in flight: #14980 (draft, docs/adr/** governed surface, review requested from os-zhuang and hotlong, human merge only).

Changeset

patch — .changeset/recovery-door-mutation-projector.md (internal projection ordering; no published schema or wire shape moves).

🤖 Generated with Claude Code

https://claude.ai/code/session_0112hMx9hjJ9BgB28X97DS68

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/metadata-protocol, touching 7 documentable anchor(s).

3 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/client-sdk.mdx(via meta.rollbackItem (sdk, the route ledger binds it to POST /api/v1/meta/:type/:name/rollback, selected by route anchor /:type/:name/rollback), rollbackItem (sdk, the bare tail of client method meta.rollbackItem, bound to POST /api/v1/meta/:type/:name/rollback))
• content/docs/kernel/contracts/metadata-service.mdx(via /:type/:name/rollback (route, bridged from symbol rollbackMetaItem — its registrar handler names it))
• content/docs/kernel/services-checklist.mdx(via deleteMetaItem (symbol, a method of class ObjectStackProtocolImplementation))

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 9 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 5bc2f2727aef5d697530c63d64dd5592df445776 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from cdd5acdcc1e4c37fa4cbbeb9654fce87ece5e9e0 — the merge of head a32f970472b5ea4ed8455c0e50c67e2218773c1d into base 5bc2f2727aef5d697530c63d64dd5592df445776, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin cdd5acdcc1e4c37fa4cbbeb9654fce87ece5e9e0 && git checkout cdd5acdcc1e4c37fa4cbbeb9654fce87ece5e9e0
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 5bc2f2727aef5d697530c63d64dd5592df445776 a32f970472b5ea4ed8455c0e50c67e2218773c1d && git checkout -B drift-repro 5bc2f2727aef5d697530c63d64dd5592df445776 && git merge --no-ff a32f970472b5ea4ed8455c0e50c67e2218773c1d
node scripts/docs-audit/affected-docs.mjs --json 5bc2f2727aef5d697530c63d64dd5592df445776

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 5bc2f2727aef5d697530c63d64dd5592df445776 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-musk]

Independent review — PASS; marked ready and armed for the merge queue

An independent reviewer (not the author) re-derived this PR from the ruling and the code rather than from the PR body. Verdict PASS, no blocking defects. What was re-proved rather than accepted:

Clause-② = no, confirmed. Re-derived against the mechanical floor (any new exported symbol, or any new key on a published payload, is always yes). The diff adds only method-body statements inside four existing private methods — no new export. The projectionApplied key the legacy deleteMetaItem exit now populates is not new: it is declared once on that method's single shared return type at packages/metadata-protocol/src/protocol.ts:20271, that declaration line is untouched by this diff, and it already existed on main before this work began. The repository branch has populated the same optional key on the same shared type since ADR-0094 shipped (:20516). runMutationProjector is private async (:4932), never throws, and is a server-side extension seam — not part of the wire contract.

Ablation independently reproduced, both directions. Removing rollbackMetaItem's projector block (:19935-19950) and confirming the on-disk call-site count actually dropped 7 → 6:

 ❯ src/protocol.recovery-doors-mutation-projector.test.ts (10 tests | 2 failed) 78ms
× door 1 — rollbackMetaItem projects the restored body > runs the projector with state: active and the restored body, before the listener
× every projecting door goes through runMutationProjector > has exactly seven `this.runMutationProjector(` call sites
Test Files 1 failed (1)
Tests 2 failed | 8 passed (10)

Exactly the claimed 2 RED / 8 GREEN. Restored via git checkout HEAD --, proven clean with an empty git diff HEAD and git status --short, then 10/10 at restored HEAD. Sibling suites 43/43; an objectql consumer spot-check 28/28; typecheck clean.

Symbol fence against #14038 honored.#14038 is still open and scoped to listCommits (:18988-19106) and its emitters. This diff's five hunks land at :19435, :19544 (both inside revertCommit, :19107-19760), :19935 (inside rollbackMetaItem, :19761-20250), and :20661 / :20699 (inside deleteMetaItem). None falls within or before listCommits.

Org scope checked, no mismatch. The legacy branch never resolves an orgId variable at all: scopedWhere, restoreArtifactRegistryView, the pre-existing emitMetadataMutation call and the new projector call all use request.organizationId ?? null consistently — the branch's own established convention, unchanged here.

No double-run or unhandled-rejection path.runMutationProjector (:4932-4945) awaits inside its own try/catch, so sync throws and async rejections are both caught; all four call sites additionally sit inside their enclosing method's try/catch. revertCommit processes each item exactly once (:19184).

Gates re-derived off the merge base with no path arguments (48 commands): 44 green, 4 legitimate PREREQUISITE NOT MET (exit 3, each self-documented — the saved-turbo-log completeness gate, the repo-scoped-egress half-state gate, and two that read built dist/ for packages this change does not touch and need a whole-workspace build CI performs first). check-governed-merges.mjs --test on the final four-file list: NOT governed (0/4) — ordinary merge-queue landing.

Landing. All 33 check runs on head a32f97047 are success or skipped, zero red. Marked ready and auto-merge armed. The ruling's constraint that this PR must not land without the ADR-0094 D2 amendment in flight is satisfied: #14980 is open (draft, os-zhuang + hotlong requested, skip-changeset, human merge only — that PR is not touched by this seat).

One note for the ruling record, not a defect in this PR

Read with maximal literalness, the ruling's first clause says "rollbackMetaItem … and both limbs of revertCommit project with state: 'active'" and then, one clause later, that "revertCommit's soft-remove limb … project[s] with state: 'deleted'" — the soft-remove limb is one of "both limbs", so the two readings collide. Every independent restatement of the same decision — the issue's own "Suggested shape" section the ruling explicitly adopts, the claim comment, the ADR PR body, and this PR's table — states the coherent version (rollback + restore limb → active; soft-remove limb + legacy delete → deleted), which is what the diff implements and what the tests pin. Flagged so the wording can be tightened on the record if a maintainer wants; it changed nothing about what was built.

---

Generated by Claude Code

[os-musk]

Fixes#14415

Ruling (A)

Director seat, summon #11, decision batch #17, item 2 (verbatim reply: 「同意」). Full ruling text is quoted on the issue thread (comment 5522731140).

What changed

rollbackMetaItem, both limbs of revertCommit, and deleteMetaItem's legacy raw-engine exit restored/removed the metadata row and the in-memory registry, but never called the awaited ADR-0094 mutation projector — so a derived read-model (e.g. permission -> sys_permission_set) stayed on the rolled-back-FROM state until an unrelated save/publish/delete on the same name, or boot reconciliation (D3), re-derived it. saveMetaItem, runPublishSideEffects, and deleteMetaItem's repository branch already ran this hook — this closes the same gap for the projector that a prior card (#14179) closed for the mutation-event choke point, at the same four call sites.

All four sites now call this.runMutationProjector(...), awaited BEFORE the existing fire-and-forget emitMetadataMutation call — the order saveMetaItem's own comment establishes:

door	state	body
rollbackMetaItem (after registry write-through)	active	restored version's body
revertCommit restore limb	active	pre-commit body it wrote back
revertCommit soft-remove limb	deleted	none (matches deleteMetaItem's shape)
deleteMetaItem legacy raw-engine exit	deleted	none — same call the repository branch already makes

deleteMetaItem's legacy exit also now populates projectionApplied on its success return — the same optional key its repository-branch sibling has carried since ADR-0094 shipped (no new declared field; rollbackMetaItem / revertCommit carry none, unchanged).

Symbol fence honored: touched only rollbackMetaItem, both limbs of revertCommit, and deleteMetaItem's legacy raw-engine exit in packages/metadata-protocol/src/protocol.ts. Did not touch listCommits or its emitters (fenced to #14038).

Zone 2 measurement, quoted with file:line (HEAD a32f97047)

• A. Confirmed on origin/main @ d5cbb44f3 (the commit the issue cites): runMutationProjector had exactly 3 call sites (:15438 saveMetaItem, :16671 runPublishSideEffects, :20455 deleteMetaItem repo branch); emitMetadataMutation had 7 (including the four target sites at :19435, :19534, :19915, :20625 — none preceded by a projector call). All four target sites existed and none already projected.
• B.runMutationProjector is private async (protocol.ts, declared ~L4932 pre-diff), best-effort (catches, logs via console.warn, never throws), and MetadataMutationProjector/registerMutationProjector are a server-side extension seam — not part of ObjectStackProtocol's wire contract (same status as onMetadataMutation). Confirms Clause-②: no.
• C. The call deleteMetaItem's repository branch already makes: this.runMutationProjector({ type: singularTypeForRepo, name: request.name, state: 'deleted', organizationId: orgId }) (pre-diff :20455-20460). The legacy exit was missing exactly that call (same shape, same state, org scope from request.organizationId ?? null instead of the resolved orgId — the legacy path's own scoping variable, unchanged from what its existing emitMetadataMutation call already used).
• D. No existing caller depends on the old ordering: packages/plugins/plugin-security/src/permission-set-projection.test.ts (the one projector actually registered today, for permission) has zero tests exercising rollback/revert against the projector — this gap is exactly what the issue reports, so there's nothing today relying on the pre-fix silence. Ran the full objectql consumer suite that drives these three doors directly (protocol-commit-history, protocol-delete-object-registry-heal, protocol-lock-enforcement, protocol-org-overlay-registry-gate, protocol-publish-canonical-fold, protocol-publish-rollback, protocol-revert-org-scope, protocol-writepath-object-ownership — 113 tests) plus the sibling emit-mutation, mutation-listener and cluster-fanout suites (53 tests): all green.

Tests

New file: packages/metadata-protocol/src/protocol.recovery-doors-mutation-projector.test.ts — one pin per door (registers a fake projector, asserts it receives the correct state/body and runs before the mutation listener), a positive control (saveMetaItem), negative controls (unregistered type, throwing projector, already-absent row), a wire-shape check (deleteMetaItem legacy exit's projectionApplied), and a structural guard (exactly 7 runMutationProjector call sites).

Ablation (declared and run before landing): removing the rollbackMetaItem projector call — git checkout HEAD -- <path> restore, confirmed clean via git diff HEAD empty after — turned exactly 2 of the 10 new tests red (the rollback pin's body assertion, and the 7-call-site structural count dropping to 6), the other 8 green. Matches the file's own docblock claim.

Union re-run at HEAD a32f97047 (metadata-protocol + objectql):

Test Files 4 passed (4) — metadata-protocol (53 tests)
Test Files 3 passed (3) — objectql conformance (28 tests)

Gates run (dispatch-derived, node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands, 48 families): all green except two genuine PREREQUISITE NOT MET (exit 3, not a finding) that need a full-tree pnpm build this local run did not do — check:dual-build-cjs-loads and check:type-check-debt's --re-measure; CI's lint.yml builds the full workspace closure before both. check:engine-double-contract initially flagged the new test file's engine double as unrecorded coverage — fixed via node scripts/check-engine-double-contract.mjs --write (3 rows added, 0 lost), re-run green.

Companion ADR PR

Per the ruling, the code PR must not land without the ADR-0094 D2 amendment in flight: #14980 (draft, docs/adr/** governed surface, review requested from os-zhuang and hotlong, human merge only).

Changeset

patch — .changeset/recovery-door-mutation-projector.md (internal projection ordering; no published schema or wire shape moves).

🤖 Generated with Claude Code

https://claude.ai/code/session_0112hMx9hjJ9BgB28X97DS68

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/metadata-protocol, touching 7 documentable anchor(s).

3 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/client-sdk.mdx(via meta.rollbackItem (sdk, the route ledger binds it to POST /api/v1/meta/:type/:name/rollback, selected by route anchor /:type/:name/rollback), rollbackItem (sdk, the bare tail of client method meta.rollbackItem, bound to POST /api/v1/meta/:type/:name/rollback))
• content/docs/kernel/contracts/metadata-service.mdx(via /:type/:name/rollback (route, bridged from symbol rollbackMetaItem — its registrar handler names it))
• content/docs/kernel/services-checklist.mdx(via deleteMetaItem (symbol, a method of class ObjectStackProtocolImplementation))

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 9 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 5bc2f2727aef5d697530c63d64dd5592df445776 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from cdd5acdcc1e4c37fa4cbbeb9654fce87ece5e9e0 — the merge of head a32f970472b5ea4ed8455c0e50c67e2218773c1d into base 5bc2f2727aef5d697530c63d64dd5592df445776, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin cdd5acdcc1e4c37fa4cbbeb9654fce87ece5e9e0 && git checkout cdd5acdcc1e4c37fa4cbbeb9654fce87ece5e9e0
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 5bc2f2727aef5d697530c63d64dd5592df445776 a32f970472b5ea4ed8455c0e50c67e2218773c1d && git checkout -B drift-repro 5bc2f2727aef5d697530c63d64dd5592df445776 && git merge --no-ff a32f970472b5ea4ed8455c0e50c67e2218773c1d
node scripts/docs-audit/affected-docs.mjs --json 5bc2f2727aef5d697530c63d64dd5592df445776

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 5bc2f2727aef5d697530c63d64dd5592df445776 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-musk]

Independent review — PASS; marked ready and armed for the merge queue

An independent reviewer (not the author) re-derived this PR from the ruling and the code rather than from the PR body. Verdict PASS, no blocking defects. What was re-proved rather than accepted:

Clause-② = no, confirmed. Re-derived against the mechanical floor (any new exported symbol, or any new key on a published payload, is always yes). The diff adds only method-body statements inside four existing private methods — no new export. The projectionApplied key the legacy deleteMetaItem exit now populates is not new: it is declared once on that method's single shared return type at packages/metadata-protocol/src/protocol.ts:20271, that declaration line is untouched by this diff, and it already existed on main before this work began. The repository branch has populated the same optional key on the same shared type since ADR-0094 shipped (:20516). runMutationProjector is private async (:4932), never throws, and is a server-side extension seam — not part of the wire contract.

Ablation independently reproduced, both directions. Removing rollbackMetaItem's projector block (:19935-19950) and confirming the on-disk call-site count actually dropped 7 → 6:

 ❯ src/protocol.recovery-doors-mutation-projector.test.ts (10 tests | 2 failed) 78ms
× door 1 — rollbackMetaItem projects the restored body > runs the projector with state: active and the restored body, before the listener
× every projecting door goes through runMutationProjector > has exactly seven `this.runMutationProjector(` call sites
Test Files 1 failed (1)
Tests 2 failed | 8 passed (10)

Exactly the claimed 2 RED / 8 GREEN. Restored via git checkout HEAD --, proven clean with an empty git diff HEAD and git status --short, then 10/10 at restored HEAD. Sibling suites 43/43; an objectql consumer spot-check 28/28; typecheck clean.

Symbol fence against #14038 honored.#14038 is still open and scoped to listCommits (:18988-19106) and its emitters. This diff's five hunks land at :19435, :19544 (both inside revertCommit, :19107-19760), :19935 (inside rollbackMetaItem, :19761-20250), and :20661 / :20699 (inside deleteMetaItem). None falls within or before listCommits.

Org scope checked, no mismatch. The legacy branch never resolves an orgId variable at all: scopedWhere, restoreArtifactRegistryView, the pre-existing emitMetadataMutation call and the new projector call all use request.organizationId ?? null consistently — the branch's own established convention, unchanged here.

No double-run or unhandled-rejection path.runMutationProjector (:4932-4945) awaits inside its own try/catch, so sync throws and async rejections are both caught; all four call sites additionally sit inside their enclosing method's try/catch. revertCommit processes each item exactly once (:19184).

Gates re-derived off the merge base with no path arguments (48 commands): 44 green, 4 legitimate PREREQUISITE NOT MET (exit 3, each self-documented — the saved-turbo-log completeness gate, the repo-scoped-egress half-state gate, and two that read built dist/ for packages this change does not touch and need a whole-workspace build CI performs first). check-governed-merges.mjs --test on the final four-file list: NOT governed (0/4) — ordinary merge-queue landing.

Landing. All 33 check runs on head a32f97047 are success or skipped, zero red. Marked ready and auto-merge armed. The ruling's constraint that this PR must not land without the ADR-0094 D2 amendment in flight is satisfied: #14980 is open (draft, os-zhuang + hotlong requested, skip-changeset, human merge only — that PR is not touched by this seat).

One note for the ruling record, not a defect in this PR

Read with maximal literalness, the ruling's first clause says "rollbackMetaItem … and both limbs of revertCommit project with state: 'active'" and then, one clause later, that "revertCommit's soft-remove limb … project[s] with state: 'deleted'" — the soft-remove limb is one of "both limbs", so the two readings collide. Every independent restatement of the same decision — the issue's own "Suggested shape" section the ruling explicitly adopts, the claim comment, the ADR PR body, and this PR's table — states the coherent version (rollback + restore limb → active; soft-remove limb + legacy delete → deleted), which is what the diff implements and what the tests pin. Flagged so the wording can be tightened on the record if a maintainer wants; it changed nothing about what was built.

---

Generated by Claude Code

[os-musk]

Fixes#14415

Ruling (A)

Director seat, summon #11, decision batch #17, item 2 (verbatim reply: 「同意」). Full ruling text is quoted on the issue thread (comment 5522731140).

What changed

rollbackMetaItem, both limbs of revertCommit, and deleteMetaItem's legacy raw-engine exit restored/removed the metadata row and the in-memory registry, but never called the awaited ADR-0094 mutation projector — so a derived read-model (e.g. permission -> sys_permission_set) stayed on the rolled-back-FROM state until an unrelated save/publish/delete on the same name, or boot reconciliation (D3), re-derived it. saveMetaItem, runPublishSideEffects, and deleteMetaItem's repository branch already ran this hook — this closes the same gap for the projector that a prior card (#14179) closed for the mutation-event choke point, at the same four call sites.

All four sites now call this.runMutationProjector(...), awaited BEFORE the existing fire-and-forget emitMetadataMutation call — the order saveMetaItem's own comment establishes:

door	state	body
rollbackMetaItem (after registry write-through)	active	restored version's body
revertCommit restore limb	active	pre-commit body it wrote back
revertCommit soft-remove limb	deleted	none (matches deleteMetaItem's shape)
deleteMetaItem legacy raw-engine exit	deleted	none — same call the repository branch already makes

deleteMetaItem's legacy exit also now populates projectionApplied on its success return — the same optional key its repository-branch sibling has carried since ADR-0094 shipped (no new declared field; rollbackMetaItem / revertCommit carry none, unchanged).

Symbol fence honored: touched only rollbackMetaItem, both limbs of revertCommit, and deleteMetaItem's legacy raw-engine exit in packages/metadata-protocol/src/protocol.ts. Did not touch listCommits or its emitters (fenced to #14038).

Zone 2 measurement, quoted with file:line (HEAD a32f97047)

• A. Confirmed on origin/main @ d5cbb44f3 (the commit the issue cites): runMutationProjector had exactly 3 call sites (:15438 saveMetaItem, :16671 runPublishSideEffects, :20455 deleteMetaItem repo branch); emitMetadataMutation had 7 (including the four target sites at :19435, :19534, :19915, :20625 — none preceded by a projector call). All four target sites existed and none already projected.
• B.runMutationProjector is private async (protocol.ts, declared ~L4932 pre-diff), best-effort (catches, logs via console.warn, never throws), and MetadataMutationProjector/registerMutationProjector are a server-side extension seam — not part of ObjectStackProtocol's wire contract (same status as onMetadataMutation). Confirms Clause-②: no.
• C. The call deleteMetaItem's repository branch already makes: this.runMutationProjector({ type: singularTypeForRepo, name: request.name, state: 'deleted', organizationId: orgId }) (pre-diff :20455-20460). The legacy exit was missing exactly that call (same shape, same state, org scope from request.organizationId ?? null instead of the resolved orgId — the legacy path's own scoping variable, unchanged from what its existing emitMetadataMutation call already used).
• D. No existing caller depends on the old ordering: packages/plugins/plugin-security/src/permission-set-projection.test.ts (the one projector actually registered today, for permission) has zero tests exercising rollback/revert against the projector — this gap is exactly what the issue reports, so there's nothing today relying on the pre-fix silence. Ran the full objectql consumer suite that drives these three doors directly (protocol-commit-history, protocol-delete-object-registry-heal, protocol-lock-enforcement, protocol-org-overlay-registry-gate, protocol-publish-canonical-fold, protocol-publish-rollback, protocol-revert-org-scope, protocol-writepath-object-ownership — 113 tests) plus the sibling emit-mutation, mutation-listener and cluster-fanout suites (53 tests): all green.

Tests

New file: packages/metadata-protocol/src/protocol.recovery-doors-mutation-projector.test.ts — one pin per door (registers a fake projector, asserts it receives the correct state/body and runs before the mutation listener), a positive control (saveMetaItem), negative controls (unregistered type, throwing projector, already-absent row), a wire-shape check (deleteMetaItem legacy exit's projectionApplied), and a structural guard (exactly 7 runMutationProjector call sites).

Ablation (declared and run before landing): removing the rollbackMetaItem projector call — git checkout HEAD -- <path> restore, confirmed clean via git diff HEAD empty after — turned exactly 2 of the 10 new tests red (the rollback pin's body assertion, and the 7-call-site structural count dropping to 6), the other 8 green. Matches the file's own docblock claim.

Union re-run at HEAD a32f97047 (metadata-protocol + objectql):

Test Files 4 passed (4) — metadata-protocol (53 tests)
Test Files 3 passed (3) — objectql conformance (28 tests)

Gates run (dispatch-derived, node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands, 48 families): all green except two genuine PREREQUISITE NOT MET (exit 3, not a finding) that need a full-tree pnpm build this local run did not do — check:dual-build-cjs-loads and check:type-check-debt's --re-measure; CI's lint.yml builds the full workspace closure before both. check:engine-double-contract initially flagged the new test file's engine double as unrecorded coverage — fixed via node scripts/check-engine-double-contract.mjs --write (3 rows added, 0 lost), re-run green.

Companion ADR PR

Per the ruling, the code PR must not land without the ADR-0094 D2 amendment in flight: #14980 (draft, docs/adr/** governed surface, review requested from os-zhuang and hotlong, human merge only).

Changeset

patch — .changeset/recovery-door-mutation-projector.md (internal projection ordering; no published schema or wire shape moves).

🤖 Generated with Claude Code

https://claude.ai/code/session_0112hMx9hjJ9BgB28X97DS68

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/metadata-protocol, touching 7 documentable anchor(s).

3 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/client-sdk.mdx(via meta.rollbackItem (sdk, the route ledger binds it to POST /api/v1/meta/:type/:name/rollback, selected by route anchor /:type/:name/rollback), rollbackItem (sdk, the bare tail of client method meta.rollbackItem, bound to POST /api/v1/meta/:type/:name/rollback))
• content/docs/kernel/contracts/metadata-service.mdx(via /:type/:name/rollback (route, bridged from symbol rollbackMetaItem — its registrar handler names it))
• content/docs/kernel/services-checklist.mdx(via deleteMetaItem (symbol, a method of class ObjectStackProtocolImplementation))

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 9 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 5bc2f2727aef5d697530c63d64dd5592df445776 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from cdd5acdcc1e4c37fa4cbbeb9654fce87ece5e9e0 — the merge of head a32f970472b5ea4ed8455c0e50c67e2218773c1d into base 5bc2f2727aef5d697530c63d64dd5592df445776, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin cdd5acdcc1e4c37fa4cbbeb9654fce87ece5e9e0 && git checkout cdd5acdcc1e4c37fa4cbbeb9654fce87ece5e9e0
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 5bc2f2727aef5d697530c63d64dd5592df445776 a32f970472b5ea4ed8455c0e50c67e2218773c1d && git checkout -B drift-repro 5bc2f2727aef5d697530c63d64dd5592df445776 && git merge --no-ff a32f970472b5ea4ed8455c0e50c67e2218773c1d
node scripts/docs-audit/affected-docs.mjs --json 5bc2f2727aef5d697530c63d64dd5592df445776

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 5bc2f2727aef5d697530c63d64dd5592df445776 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-musk]

Independent review — PASS; marked ready and armed for the merge queue

An independent reviewer (not the author) re-derived this PR from the ruling and the code rather than from the PR body. Verdict PASS, no blocking defects. What was re-proved rather than accepted:

Clause-② = no, confirmed. Re-derived against the mechanical floor (any new exported symbol, or any new key on a published payload, is always yes). The diff adds only method-body statements inside four existing private methods — no new export. The projectionApplied key the legacy deleteMetaItem exit now populates is not new: it is declared once on that method's single shared return type at packages/metadata-protocol/src/protocol.ts:20271, that declaration line is untouched by this diff, and it already existed on main before this work began. The repository branch has populated the same optional key on the same shared type since ADR-0094 shipped (:20516). runMutationProjector is private async (:4932), never throws, and is a server-side extension seam — not part of the wire contract.

Ablation independently reproduced, both directions. Removing rollbackMetaItem's projector block (:19935-19950) and confirming the on-disk call-site count actually dropped 7 → 6:

 ❯ src/protocol.recovery-doors-mutation-projector.test.ts (10 tests | 2 failed) 78ms
× door 1 — rollbackMetaItem projects the restored body > runs the projector with state: active and the restored body, before the listener
× every projecting door goes through runMutationProjector > has exactly seven `this.runMutationProjector(` call sites
Test Files 1 failed (1)
Tests 2 failed | 8 passed (10)

Exactly the claimed 2 RED / 8 GREEN. Restored via git checkout HEAD --, proven clean with an empty git diff HEAD and git status --short, then 10/10 at restored HEAD. Sibling suites 43/43; an objectql consumer spot-check 28/28; typecheck clean.

Symbol fence against #14038 honored.#14038 is still open and scoped to listCommits (:18988-19106) and its emitters. This diff's five hunks land at :19435, :19544 (both inside revertCommit, :19107-19760), :19935 (inside rollbackMetaItem, :19761-20250), and :20661 / :20699 (inside deleteMetaItem). None falls within or before listCommits.

Org scope checked, no mismatch. The legacy branch never resolves an orgId variable at all: scopedWhere, restoreArtifactRegistryView, the pre-existing emitMetadataMutation call and the new projector call all use request.organizationId ?? null consistently — the branch's own established convention, unchanged here.

No double-run or unhandled-rejection path.runMutationProjector (:4932-4945) awaits inside its own try/catch, so sync throws and async rejections are both caught; all four call sites additionally sit inside their enclosing method's try/catch. revertCommit processes each item exactly once (:19184).

Gates re-derived off the merge base with no path arguments (48 commands): 44 green, 4 legitimate PREREQUISITE NOT MET (exit 3, each self-documented — the saved-turbo-log completeness gate, the repo-scoped-egress half-state gate, and two that read built dist/ for packages this change does not touch and need a whole-workspace build CI performs first). check-governed-merges.mjs --test on the final four-file list: NOT governed (0/4) — ordinary merge-queue landing.

Landing. All 33 check runs on head a32f97047 are success or skipped, zero red. Marked ready and auto-merge armed. The ruling's constraint that this PR must not land without the ADR-0094 D2 amendment in flight is satisfied: #14980 is open (draft, os-zhuang + hotlong requested, skip-changeset, human merge only — that PR is not touched by this seat).

One note for the ruling record, not a defect in this PR

Read with maximal literalness, the ruling's first clause says "rollbackMetaItem … and both limbs of revertCommit project with state: 'active'" and then, one clause later, that "revertCommit's soft-remove limb … project[s] with state: 'deleted'" — the soft-remove limb is one of "both limbs", so the two readings collide. Every independent restatement of the same decision — the issue's own "Suggested shape" section the ruling explicitly adopts, the claim comment, the ADR PR body, and this PR's table — states the coherent version (rollback + restore limb → active; soft-remove limb + legacy delete → deleted), which is what the diff implements and what the tests pin. Flagged so the wording can be tightened on the record if a maintainer wants; it changed nothing about what was built.

---

Generated by Claude Code

[os-musk]

Fixes#14415

Ruling (A)

Director seat, summon #11, decision batch #17, item 2 (verbatim reply: 「同意」). Full ruling text is quoted on the issue thread (comment 5522731140).

What changed

rollbackMetaItem, both limbs of revertCommit, and deleteMetaItem's legacy raw-engine exit restored/removed the metadata row and the in-memory registry, but never called the awaited ADR-0094 mutation projector — so a derived read-model (e.g. permission -> sys_permission_set) stayed on the rolled-back-FROM state until an unrelated save/publish/delete on the same name, or boot reconciliation (D3), re-derived it. saveMetaItem, runPublishSideEffects, and deleteMetaItem's repository branch already ran this hook — this closes the same gap for the projector that a prior card (#14179) closed for the mutation-event choke point, at the same four call sites.

All four sites now call this.runMutationProjector(...), awaited BEFORE the existing fire-and-forget emitMetadataMutation call — the order saveMetaItem's own comment establishes:

door	state	body
rollbackMetaItem (after registry write-through)	active	restored version's body
revertCommit restore limb	active	pre-commit body it wrote back
revertCommit soft-remove limb	deleted	none (matches deleteMetaItem's shape)
deleteMetaItem legacy raw-engine exit	deleted	none — same call the repository branch already makes

deleteMetaItem's legacy exit also now populates projectionApplied on its success return — the same optional key its repository-branch sibling has carried since ADR-0094 shipped (no new declared field; rollbackMetaItem / revertCommit carry none, unchanged).

Symbol fence honored: touched only rollbackMetaItem, both limbs of revertCommit, and deleteMetaItem's legacy raw-engine exit in packages/metadata-protocol/src/protocol.ts. Did not touch listCommits or its emitters (fenced to #14038).

Zone 2 measurement, quoted with file:line (HEAD a32f97047)

• A. Confirmed on origin/main @ d5cbb44f3 (the commit the issue cites): runMutationProjector had exactly 3 call sites (:15438 saveMetaItem, :16671 runPublishSideEffects, :20455 deleteMetaItem repo branch); emitMetadataMutation had 7 (including the four target sites at :19435, :19534, :19915, :20625 — none preceded by a projector call). All four target sites existed and none already projected.
• B.runMutationProjector is private async (protocol.ts, declared ~L4932 pre-diff), best-effort (catches, logs via console.warn, never throws), and MetadataMutationProjector/registerMutationProjector are a server-side extension seam — not part of ObjectStackProtocol's wire contract (same status as onMetadataMutation). Confirms Clause-②: no.
• C. The call deleteMetaItem's repository branch already makes: this.runMutationProjector({ type: singularTypeForRepo, name: request.name, state: 'deleted', organizationId: orgId }) (pre-diff :20455-20460). The legacy exit was missing exactly that call (same shape, same state, org scope from request.organizationId ?? null instead of the resolved orgId — the legacy path's own scoping variable, unchanged from what its existing emitMetadataMutation call already used).
• D. No existing caller depends on the old ordering: packages/plugins/plugin-security/src/permission-set-projection.test.ts (the one projector actually registered today, for permission) has zero tests exercising rollback/revert against the projector — this gap is exactly what the issue reports, so there's nothing today relying on the pre-fix silence. Ran the full objectql consumer suite that drives these three doors directly (protocol-commit-history, protocol-delete-object-registry-heal, protocol-lock-enforcement, protocol-org-overlay-registry-gate, protocol-publish-canonical-fold, protocol-publish-rollback, protocol-revert-org-scope, protocol-writepath-object-ownership — 113 tests) plus the sibling emit-mutation, mutation-listener and cluster-fanout suites (53 tests): all green.

Tests

New file: packages/metadata-protocol/src/protocol.recovery-doors-mutation-projector.test.ts — one pin per door (registers a fake projector, asserts it receives the correct state/body and runs before the mutation listener), a positive control (saveMetaItem), negative controls (unregistered type, throwing projector, already-absent row), a wire-shape check (deleteMetaItem legacy exit's projectionApplied), and a structural guard (exactly 7 runMutationProjector call sites).

Ablation (declared and run before landing): removing the rollbackMetaItem projector call — git checkout HEAD -- <path> restore, confirmed clean via git diff HEAD empty after — turned exactly 2 of the 10 new tests red (the rollback pin's body assertion, and the 7-call-site structural count dropping to 6), the other 8 green. Matches the file's own docblock claim.

Union re-run at HEAD a32f97047 (metadata-protocol + objectql):

Test Files 4 passed (4) — metadata-protocol (53 tests)
Test Files 3 passed (3) — objectql conformance (28 tests)

Gates run (dispatch-derived, node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands, 48 families): all green except two genuine PREREQUISITE NOT MET (exit 3, not a finding) that need a full-tree pnpm build this local run did not do — check:dual-build-cjs-loads and check:type-check-debt's --re-measure; CI's lint.yml builds the full workspace closure before both. check:engine-double-contract initially flagged the new test file's engine double as unrecorded coverage — fixed via node scripts/check-engine-double-contract.mjs --write (3 rows added, 0 lost), re-run green.

Companion ADR PR

Per the ruling, the code PR must not land without the ADR-0094 D2 amendment in flight: #14980 (draft, docs/adr/** governed surface, review requested from os-zhuang and hotlong, human merge only).

Changeset

patch — .changeset/recovery-door-mutation-projector.md (internal projection ordering; no published schema or wire shape moves).

🤖 Generated with Claude Code

https://claude.ai/code/session_0112hMx9hjJ9BgB28X97DS68

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/metadata-protocol, touching 7 documentable anchor(s).

3 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/client-sdk.mdx(via meta.rollbackItem (sdk, the route ledger binds it to POST /api/v1/meta/:type/:name/rollback, selected by route anchor /:type/:name/rollback), rollbackItem (sdk, the bare tail of client method meta.rollbackItem, bound to POST /api/v1/meta/:type/:name/rollback))
• content/docs/kernel/contracts/metadata-service.mdx(via /:type/:name/rollback (route, bridged from symbol rollbackMetaItem — its registrar handler names it))
• content/docs/kernel/services-checklist.mdx(via deleteMetaItem (symbol, a method of class ObjectStackProtocolImplementation))

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 9 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 5bc2f2727aef5d697530c63d64dd5592df445776 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from cdd5acdcc1e4c37fa4cbbeb9654fce87ece5e9e0 — the merge of head a32f970472b5ea4ed8455c0e50c67e2218773c1d into base 5bc2f2727aef5d697530c63d64dd5592df445776, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin cdd5acdcc1e4c37fa4cbbeb9654fce87ece5e9e0 && git checkout cdd5acdcc1e4c37fa4cbbeb9654fce87ece5e9e0
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 5bc2f2727aef5d697530c63d64dd5592df445776 a32f970472b5ea4ed8455c0e50c67e2218773c1d && git checkout -B drift-repro 5bc2f2727aef5d697530c63d64dd5592df445776 && git merge --no-ff a32f970472b5ea4ed8455c0e50c67e2218773c1d
node scripts/docs-audit/affected-docs.mjs --json 5bc2f2727aef5d697530c63d64dd5592df445776

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 5bc2f2727aef5d697530c63d64dd5592df445776 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-musk]

Independent review — PASS; marked ready and armed for the merge queue

An independent reviewer (not the author) re-derived this PR from the ruling and the code rather than from the PR body. Verdict PASS, no blocking defects. What was re-proved rather than accepted:

Clause-② = no, confirmed. Re-derived against the mechanical floor (any new exported symbol, or any new key on a published payload, is always yes). The diff adds only method-body statements inside four existing private methods — no new export. The projectionApplied key the legacy deleteMetaItem exit now populates is not new: it is declared once on that method's single shared return type at packages/metadata-protocol/src/protocol.ts:20271, that declaration line is untouched by this diff, and it already existed on main before this work began. The repository branch has populated the same optional key on the same shared type since ADR-0094 shipped (:20516). runMutationProjector is private async (:4932), never throws, and is a server-side extension seam — not part of the wire contract.

Ablation independently reproduced, both directions. Removing rollbackMetaItem's projector block (:19935-19950) and confirming the on-disk call-site count actually dropped 7 → 6:

 ❯ src/protocol.recovery-doors-mutation-projector.test.ts (10 tests | 2 failed) 78ms
× door 1 — rollbackMetaItem projects the restored body > runs the projector with state: active and the restored body, before the listener
× every projecting door goes through runMutationProjector > has exactly seven `this.runMutationProjector(` call sites
Test Files 1 failed (1)
Tests 2 failed | 8 passed (10)

Exactly the claimed 2 RED / 8 GREEN. Restored via git checkout HEAD --, proven clean with an empty git diff HEAD and git status --short, then 10/10 at restored HEAD. Sibling suites 43/43; an objectql consumer spot-check 28/28; typecheck clean.

Symbol fence against #14038 honored.#14038 is still open and scoped to listCommits (:18988-19106) and its emitters. This diff's five hunks land at :19435, :19544 (both inside revertCommit, :19107-19760), :19935 (inside rollbackMetaItem, :19761-20250), and :20661 / :20699 (inside deleteMetaItem). None falls within or before listCommits.

Org scope checked, no mismatch. The legacy branch never resolves an orgId variable at all: scopedWhere, restoreArtifactRegistryView, the pre-existing emitMetadataMutation call and the new projector call all use request.organizationId ?? null consistently — the branch's own established convention, unchanged here.

No double-run or unhandled-rejection path.runMutationProjector (:4932-4945) awaits inside its own try/catch, so sync throws and async rejections are both caught; all four call sites additionally sit inside their enclosing method's try/catch. revertCommit processes each item exactly once (:19184).

Gates re-derived off the merge base with no path arguments (48 commands): 44 green, 4 legitimate PREREQUISITE NOT MET (exit 3, each self-documented — the saved-turbo-log completeness gate, the repo-scoped-egress half-state gate, and two that read built dist/ for packages this change does not touch and need a whole-workspace build CI performs first). check-governed-merges.mjs --test on the final four-file list: NOT governed (0/4) — ordinary merge-queue landing.

Landing. All 33 check runs on head a32f97047 are success or skipped, zero red. Marked ready and auto-merge armed. The ruling's constraint that this PR must not land without the ADR-0094 D2 amendment in flight is satisfied: #14980 is open (draft, os-zhuang + hotlong requested, skip-changeset, human merge only — that PR is not touched by this seat).

One note for the ruling record, not a defect in this PR

Read with maximal literalness, the ruling's first clause says "rollbackMetaItem … and both limbs of revertCommit project with state: 'active'" and then, one clause later, that "revertCommit's soft-remove limb … project[s] with state: 'deleted'" — the soft-remove limb is one of "both limbs", so the two readings collide. Every independent restatement of the same decision — the issue's own "Suggested shape" section the ruling explicitly adopts, the claim comment, the ADR PR body, and this PR's table — states the coherent version (rollback + restore limb → active; soft-remove limb + legacy delete → deleted), which is what the diff implements and what the tests pin. Flagged so the wording can be tightened on the record if a maintainer wants; it changed nothing about what was built.

---

Generated by Claude Code