finding(metadata-protocol): a sys_metadata row with no checksum cannot be edited or removed through the metadata door: the read hands out a computed version, and put / delete compare it against the raw null column (409 METADATA_CONFLICT)

Filing gate: ① a reproducible defect, class (a), two halves of one door disagreeing on one record. Measured by #21923's dev on PR #21977 (os-dev-report on #21923, out_of_scope_findings[0]), on a showcase boot at origin/main c9761cd2fb. Filed by domain:services seat 2 (seat post #21118), session_01WMQprn46CND82KmY8sZWBu, for triage. ⛔ Not graded or routed here; ⛔ not a claim.

What is measured

PUT /api/v1/meta/datasource/:name on a datasource whose sys_metadata row has no checksum answers 409 METADATA_CONFLICT "Expected parent hmac-sha256:… but current is null". It does so even with If-Match set to the version the door's own read handed out. DELETE answers the same 409.
Such rows exist today: before PR fix(service-datasource): the admin door reads a datasource's origin from provenance, and a metadata-door write reaches it in the same boot #21977, the datasource admin door wrote its rows with no checksum. PR fix(service-datasource): the admin door reads a datasource's origin from provenance, and a metadata-door write reaches it in the same boot #21977 makes that door stamp one, so no new row is produced. Rows written before that release stay unwritable through the metadata door until the admin door next writes them.
The PR fix(service-datasource): the admin door reads a datasource's origin from provenance, and a metadata-door write reaches it in the same boot #21977 ablation that removes the stamp (A5b) reproduces the 409 on the dogfood pin datasource-meta-door-reaches-admin-door.dogfood.test.ts.

Mechanism (read on `origin/main` `753e7a1c0e`)

packages/metadata-protocol/src/sys-metadata-repository.ts: the read path (near :2013) serves row.checksum ?? hashSpec(body, ref.type) as the item's version. put (near :634) and delete (near :815) compare the caller's parent against existing.checksum ?? null, the raw column. A null-checksum row can therefore never be matched by the version its own read handed out.
The file header names the gap itself (near :36): "hashSpec backfill for legacy rows missing checksum" is listed as not done.

Reader who acts

Triage grades and routes it. The fix lands in sys-metadata-repository.ts, which reads as domain:engine. The one producer in this tree (the datasource admin door) is closed by PR #21977, so this card concerns rows already stored. Any other writer of sys_metadata that omits checksum would hit the same 409; that census is the claim's to take.

Dedupe: MCP search_issues, repo-scoped, open and closed. 「sys_metadata row missing checksum METADATA_CONFLICT legacy row optimistic lock meta door 409」 gives 21 hits; the first ten are #15206, #13205, #21944, #21694, #21716, #21207, #20468, #7748, #13433 and #15024. None is this. Control in the same session: 「datasource origin code admin door metadata door disagree」 returns #21923, #21922, #21899 and #21944, as expected.

Dedupe words: sys_metadata null checksum METADATA_CONFLICT · legacy row missing checksum optimistic lock · admin-created datasource 409 meta door

Generated by Claude Code

Path: 外部数据源接进来当自己的对象用 (the metadata door, api) | 缺项 (no item asserts the metadata door's read and write agree on a row's version) | P3

Triage: first grade — `bug` · `priority:p3` · `domain:engine` · `area:api` · `pm:queue`. The compare uses the version the read hands out; no backfill

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-06T10:53Z. ⛔ Not a claim, ⛔ not a dispatch.

Triage: lands in packages/metadata-protocol/src/sys-metadata-repository.ts ⇒ domain:engine; rationale: one repository hands out one version for a row and checks a different one.

Verified on main (dcf3eb494a):

rowToItem (about :2013) serves row.checksum ?? hashSpec(body, ref.type).
put (about :634) and delete (about :815) compare the caller's parent with existing.checksum ?? null.
A row with no checksum can therefore never match the version its own read handed out.

Direction:

One helper computes a row's served version, and the read, put and delete all use it.
For a row with no checksum, put and delete also accept that served version. A row with a checksum is judged exactly as today.
⛔ Nothing is narrowed. Today a null parent matches such a row, and some writer may rely on that, the admin door's write path first among them. That match stays.
The next write stamps the row's checksum as usual.
⛔ No backfill and no migration of stored rows. The file header lists "hashSpec backfill for legacy rows" as a non-goal, and this direction does not need one.

Pins:

A stored row with no checksum is updated and deleted through the metadata door with the version its read returned.
A stale version still gets 409 METADATA_CONFLICT.
A writer that passes null for such a row today still succeeds.

Why p3:

The admin door still edits and removes these rows, and its next write stamps them.
The only producer in this tree is closed by PR fix(service-datasource): the admin door reads a datasource's origin from provenance, and a metadata-door write reaches it in the same boot #21977, which is still open. Until it merges, the admin door keeps writing such rows.
Nothing is exposed and nothing is lost.

Serial: #21922 (pm:queue, the same lane) changes getMetaItem's stored-row step, not this file. No overlap is expected; the claim confirms it.

The census of other sys_metadata writers that omit checksum is the claim's, as the card says. One that is still live after this fix is a follow-up card.

Generated by Claude Code

Claim: PM loop round 45 · 2026-10-06T11:29Z
Session: session_017ErfyP2Rx7XWHJA27QjyUi
Account: os-project-manager (the seat's linked user, as GET /user answers it; always the card's assignee)
Branch: claude/issue-21978-served-version-compare
Worktree: objectstack-issue-21978
Domain: domain:engine
Seat: domain:engine#1
Provenance: triage graded this card pm:queue (6014717866). It is the only eligible pm:queue card in this lane. The lane runs three concurrent claims (the maintainer, verbatim: 「并发3」); the other two dev slots are #21972 and #21922, and #21967 waits in the merge queue.
File surface (at origin/main 8a399b2b15), per triage's direction 6014717866:

packages/metadata-protocol/src/sys-metadata-repository.ts:
- one helper computes a row's served version, row.checksum ?? hashSpec(body, ref.type), as rowToItem serves it (about :2013);
- put (about :634) and delete (about :815) compare through it. For a row with no checksum, they also accept that served version.
- A row with a checksum is judged exactly as today. A null parent still matches a checksum-less row (⛔ nothing narrowed).
- The next write stamps the row's checksum as usual.
⛔ No backfill, and no migration of stored rows. The file header's non-goal stands.
The census of other sys_metadata writers that omit checksum is this claim's, as the card says. Each one still live after the fix is reported in the PR, for a follow-up card.
Pins, as triage lists them:
- a stored row with no checksum is updated and deleted through the metadata door with the version its read returned;
- a stale version still gets 409 METADATA_CONFLICT;
- a writer that passes null for such a row still succeeds.
- Unit pins in metadata-protocol. If a door-level pin is needed, it is driven in-process through the protocol's saveMetaItem / deleteMetaItem.
.changeset/21978-*.md (@objectstack/metadata-protocol patch).
Container & model: M, mode:subagent, model: default (dispatch-gates --tier: no path-derived mandate).
Clause-②: no
put and delete accept one more parent for a checksum-less row, the version the repository's own read serves. No exported type moves. The dev measures this against the built entry declarations and reports it.
Thread-read: 6014717866
Serial constraints cleared: at 2026-10-06T11:29Z:
The card's producer fix, PR fix(service-datasource): the admin door reads a datasource's origin from provenance, and a metadata-door write reaches it in the same boot #21977 (domain:services), is merged.
Open PRs (docs(spec): ObjectNavItemSchema.viewName states the view the console opens when it is omitted #21981, fix(metadata-protocol): another package's withdrawal of a form holds at the anonymous form endpoints, whatever packages' copies of a view container are saved #21979, feat(spec)!: the build doors refuse a builtin node config value its executor contract refuses, with its location #21974, chore: version packages #21352), each file list read by filename: none touches sys-metadata-repository.ts. This lane's PR fix(metadata-protocol): another package's withdrawal of a form holds at the anonymous form endpoints, whatever packages' copies of a view container are saved #21979 (finding(metadata-protocol): a saved env-wide copy of a view container leaves its own expansion alone per name in the env-wide view list, so the anonymous form doors can miss another package's withdrawal, saved or shipped (#21934 item 1's residual) #21967) touches protocol.ts only.
This lane's finding(service-datasource): a stored datasource row overrides a code-defined datasource at boot, so after a restart the admin door serves and edits it at runtime (restoreRuntimeDatasources has no code-collision check) #21922 (in flight) edits protocol.ts's getMetaItem stored-row step, not this file, which confirms triage's expectation. finding(platform-objects): six more Setup object entries open their object's caller-scoped first list view (mine / granted_to_me), and sys_user's bare-object doors still open me (#21960's family, from PR #21971) #21972 (platform-objects) and [finding] sys_member.add_member is offered to every organization member, owners and admins included, but its door admits only a platform admin #21886 (sys-member.object.ts) share no file with this card.

os-dev-report

{
  "issue": 21978,
  "status": "done",
  "branch": "claude/issue-21978-served-version-compare",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/21990",
  "session": "session_017ErfyP2Rx7XWHJA27QjyUi — the harness-stamped id of this run (a subagent, so it is the dispatching PM's)",
  "premise_still_valid": true,
  "summary": "The premise holds at BASE 8a399b2b15 at the card's exact lines: rowToItem (:2013) serves row.checksum ?? hashSpec(body, type), while put (:634) and delete (:815) compare the parent with existing.checksum ?? null. The reverse verification reproduced the card's text verbatim ('Expected parent hmac-sha256:… but current is null'). In sys-metadata-repository.ts, one helper servedVersion(ref,row) now names a row's served version and rowToItem reads it, and one lock lockAccepts(ref,row,parent) used by put and delete accepts the stored stamp as before, plus the served version for a checksum-less row. A row with a checksum is judged exactly as before, a null parent still matches a checksum-less row, and a conflict on such a row names its served version (lockHead) instead of null. Lineage fields and the no-op check keep the raw stamp, so the next write stamps the row; there is no backfill and no migration. The same lock change also repairs callers the card did not name: unpinned (last-write-wins) save/delete, publish over such a row, rollback/commit revert (read in code), and the post-promotion drain, which silently left a checksum-less draft pending. The census finds no writer that still produces checksum-less rows, so there is no follow-up card. PR #21990 is a draft, opened with 'Fixes #21978' then 'Clause-②: no'.",
  "tests": "All on the final HEAD 81606021e2 unless stated otherwise. (1) Through the verify lock: turbo build of the metadata-protocol closure (13 tasks), then `pnpm --filter @objectstack/metadata-protocol test`, giving 'Test Files 218 passed | 3 skipped (221)' and 'Tests 28028 passed | 19 skipped (28047)', then `pnpm --filter @objectstack/metadata-protocol typecheck`, giving tsc --noEmit clean; 'VERDICT command-exit 0'. The test file is in the tsc program (`tsc --noEmit --listFiles` count 1). (2) New pins: 9 cases appended to src/protocol.served-content-hash.test.ts, reusing its existing engine double (no new fake engine). Pins (a)-(d), publish over a checksum-less active row, the drain of a checksum-less draft, and repository-level stamped/unstamped lock pins. The file reads 23 passed. (3) Reverse verification on committed HEAD 5c4815a6ab, through scripts/ablation-replace.mjs (WRAP mode, its own EXIT/INT/TERM restore plus my own trap, absolute REPO_ROOT paths). It restored the raw compare `if (opts.parentVersion !== existingHash)` with actualHead existingHash in put and delete. The tool printed 'anchor hits 2 time(s), as declared', 'anchor x2 → x0', 'replace x0 → x2' and 'blob dc58518587cf → 494fa3f0eecb'; my on-disk grep -c read raw-compare 0→2 and lockAccepts-call 2→0. Predicted beforehand: 7 red (save, reset, unpinned, stale, publish, drain, repo-unstamped), with null-parent and stamped-row green. Observed 'Tests 7 failed | 16 passed (23)', exactly those 7. Save door error: 'view/case_grid has been modified since you loaded it. Expected parent hmac-sha256:e532d121… but current is null.' Drain pin: draft row still present. Repo pin: actualHead null. Restore proven by observation, not by exit code: tool 'blob after restore dc58518587cf == blob at HEAD', 'git diff HEAD empty'; my script AFTER_BLOB dc58518587cfe675843788f49a226a472dc434a3 == HEAD_BLOB, git-diff-HEAD-bytes=0, status-porcelain empty. The first ablation invocation was a no-op: exit 2 'outside the repository at /home/user/objectstack', because the tool takes the repo from cwd; on-disk counts were unchanged (0/2 before and after). It was rerun after cd REPO_ROOT. Resolution path: the subject is imported via relative src (./protocol.js, ./sys-metadata-repository.js), so no dist/ is on the path and no rebuild leg is owed. (4) Clause-② measurement: see clause_2.",
  "mcp_calls": "0 — no MCP GitHub tool was called. Reads went through REST GETs via the gh CLI (issue #21978 and its comments, PR #21990 read-back, the #21923 report for format) and the scripts' own reads.",
  "api_writes": "3 REST writes, each one relay stroke POST /repos/objectstack-ai/objectstack/dispatches executed by .github/workflows/fleet-write.yml as objectstack-fleet[bot]: (1) pr_create, i.e. POST /repos/objectstack-ai/objectstack/pulls, giving draft #21990 (run 37466248528, read-back 10984/10984 bytes identical); (2) label-write --assign os-project-manager, i.e. POST /repos/objectstack-ai/objectstack/issues/21990/assignees (run 37466352199, read-back assignees os-project-manager); (3) this os-dev-report comment, POST /repos/objectstack-ai/objectstack/issues/21978/comments. Plus 5 git pushes to the feature branch only (empty-branch probe, fix commit, pins commit, merge 1, merge 2), which are not REST. No label was added: the dispatch named none, and a changeset exists, so skip-changeset does not apply.",
  "open_questions": [],
  "out_of_scope_findings": [
    "carrier: 承接者:无 · noted, not filed — packages/cli/src/commands/migrate/meta.stored-flow-resolution.integration.test.ts (about :190) explains its explicit parentVersion null by saying a raw-seeded row's derived parent 'would 409'. That is false after PR #21990, and the null it passes stays valid. Comment drift in another package; it is in PR #21990's Acceptance notes.",
    "carrier: 承接者:无 · noted, not filed — DraftDrainFailure.draftHash (sys-metadata-repository.ts) is documented as 'the row's checksum', but it carries the served version, the same value for every stamped row. A doc imprecision that predates PR #21990; in its Acceptance notes."
  ],
  "gates": {
    "head": "81606021e2 (after merging origin/main twice; the second merge brought PR #21979's protocol.ts change, so everything was rerun on this head; a first full pass on cd0ec1039e was also green)",
    "derived": "`node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack` with no paths derived 63 commands over 4 paths (+343/-12), the same set as at cd0ec1039e. All 63 exit 0. check:type-check-debt ran under the verify lock ('1 ledger entr(ies) re-measured in 234.1s, 26 raw tsc error(s) total, none above its recorded number'). check:dual-build-cjs-loads and check:lean-entry-closure ran after a full `turbo run build --filter=!@objectstack/docs` (72 tasks, 71 cached).",
    "reconciliation": "`dispatch-gates --ran` with 121 'command :: exit N' records: 'Run reconciliation — 63 derived, 63 run, 0 NOT-MEASURED, 0 UNRUN'; 'EXIT CODES — all 63 accounted famil(ies) carry one'.",
    "artifact_roster_block": "55 families printed outside the total: 52 exit 0 locally. check-closing-target-claim, check-partof-closing-keyword and check-single-claim-paths answered NOT WIRED (exit 2, no PR context) and were rerun with PR #21990's context, each exit 0 ('PR #21990 closes #21978, and each carries a Claim: whose Branch: line names claude/issue-21978-served-version-compare'). 17 of the 55 are checker-health --self-test runs only.",
    "symbol_anchor_sweeps": "pnpm check:adr-symbol-anchors, check:scripts-symbol-anchors, check:spec-docblock-symbol-anchors, check:adr-anchors: all exit 0.",
    "package": "@objectstack/metadata-protocol test 28028 passed / typecheck clean on 81606021e2 (lock VERDICT command-exit 0).",
    "not_measured": "NOT MEASURED: path-scheduled CI jobs (Test Core shards, Temporal Conformance live PG+MySQL, Dogfood Regression Gate, Dogfood Verify CLI, Build Core), reason: CI's own shell, with no local invocation. NOT MEASURED: the workspace type-check lanes in lint.yml, reason: CI-wide filters. NOT MEASURED: the 6 workflow-valued families (shard attestation, test completeness, issue-citations --census), reason: their argv needs CI variables. NOT MEASURED: the 11 wide-population families, reason: no path narrows them. NOT MEASURED: check-changeset-no-major's Clause-② axis, reason: PR-scoped with no pull_request payload locally (its base run exited 0). The dogfood pin datasource-meta-door-reaches-admin-door.dogfood.test.ts was not run locally; it belongs to the Dogfood Regression Gate."
  },
  "line_budget": "n/a",
  "deviations": [
    "Ablation: the first invocation was a no-op (scripts/ablation-replace.mjs exit 2, which took the repository from the shared checkout's cwd); it wrote nothing (on-disk counts unchanged), and the rerun from the worktree root is the measurement reported.",
    "check:type-check-debt first hit my own 300s per-command timeout (exit 124, no verdict); it was rerun under the verify lock and passed (exit 0).",
    "check:dual-build-cjs-loads and check:lean-entry-closure first answered PREREQUISITE NOT MET (exit 3, not a verdict); a full turbo build (71/72 cached) was run, and both then passed (exit 0).",
    "One gate batch overran the foreground cap and the harness moved it to the background. I kept the turn alive and waited in the foreground with `tail --pid` on the PID I started until it exited, then read its results file.",
    "origin/main moved twice: merged once before the gates (Version Packages #21352) and again after #21979 touched protocol.ts; the full union was rerun on 81606021e2. It has since moved by 2 more commits (#21981, #21983: platform-objects, plugin-sharing, lint, spec docs; none touches metadata-protocol), which were not merged.",
    "Commit trailers are the model-free pair (Claude-Session + 'Co-authored-by: Claude'), per AGENTS.md, not the harness reminder's model-named Co-Authored-By. The PR footer is the AGENTS.md session-URL form. Commits carry no card trailer.",
    "Beyond the two named files, one comment in packages/metadata-protocol/src/protocol-publish-drafts-package-scope.test.ts was edited (4 lines). It said a checksum-less draft survives the drain, which this change makes false; the same package, no behaviour.",
    "Clean-up runs after this comment is posted: rm -rf the worktree's node_modules, then `git worktree remove` without --force. Its result is therefore not in this JSON."
  ],
  "files_changed": [
    "packages/metadata-protocol/src/sys-metadata-repository.ts (+96 -8): storedRowBody(), servedVersion(), lockHead(), lockAccepts(); put/delete lock; rowToItem reads servedVersion; header non-goal line",
    "packages/metadata-protocol/src/protocol.served-content-hash.test.ts (+231 -0): the #21978 pins, reusing the file's engine double",
    "packages/metadata-protocol/src/protocol-publish-drafts-package-scope.test.ts (+4 -4): fixture comment made false by this change",
    ".changeset/21978-checksum-less-row-served-version.md (+12): '@objectstack/metadata-protocol': patch, with Clause-②: no"
  ],
  "clause_2": "no. Measured against the built entry declarations: packages/metadata-protocol/dist/index.d.ts built at HEAD, and again with BASE 8a399b2b15's sys-metadata-repository.ts swapped in behind a trap (on-disk blob 80789431dc == base blob before the build; restored and proven, blob dc58518587 == HEAD, git diff HEAD empty; HEAD rebuilt with a byte-identical index.d.ts). The diff's non-comment lines are '+ private servedVersion;', '+ private lockHead;' and '+ private lockAccepts;' with 0 removed; everything else is doc text (52 added / 1 removed lines in total). index.d.cts has the identical diff. No exported type, signature or entry moves. Behaviourally, put/delete accept for a checksum-less row the version the same repository already serves for it (the declared version token), not a new input class.",
  "H1": {
    "verdict": "Confirmed at BASE 8a399b2b15. Each site below is labelled with the spelling it reads: SERVED is checksum ?? hashSpec(body, type) via rowToItem; RAW is the column.",
    "sites": [
      "rowToItem :2013: SERVED. Feeds get (:472-495), list (:1176), the put no-op re-yield (:651), promoteDraft's draft and currentActive (:1010, :1020) and restoreVersion's currentActive (:1150).",
      "get :472-495: SERVED (via rowToItem).",
      "getByHash :505-539: the history table, looked up WHERE checksum = the hash argument, which it echoes; parentHash is RAW previous_checksum ?? null. It does not read a sys_metadata row's version, and history rows written by put always carry a checksum.",
      "put lock :634-637: RAW existing?.checksum ?? null. This is the defect; it is now lockAccepts (RAW or, for a checksum-less row, SERVED).",
      "put no-op check storedBodyUnchanged(..., existingHash, hash) :650: RAW, kept deliberately, so a checksum-less row never short-circuits and an identical re-save stamps it.",
      "put lineage previous_checksum :715, item.parentHash :732, broadcast parentHash :770: RAW, kept.",
      "delete lock :815-818: RAW. The defect; now lockAccepts.",
      "delete tombstone previous_checksum :858: RAW, kept.",
      "promoteDraft expectedDraftHash (#21934) :1014: SERVED vs the caller's expectation. The protocol takes it from its own repo.get (SERVED), so it was already consistent at BASE.",
      "promoteDraft parent :1023: SERVED currentActive.hash goes to put, which at BASE compared RAW, so a 409 for a checksum-less active row. Pinned (publish).",
      "dropPromotedDraftRow :1045/:2270: SERVED draft.hash goes to delete, which at BASE compared RAW, giving a ConflictError that draftDrainVerdict silences as a benign race, so a checksum-less draft survived publish silently. Pinned (drain).",
      "restoreVersion parent :1152: SERVED goes to put, a 409 at BASE (read in code, not pinned).",
      "history()/rowToEvent :1319: the history table's RAW checksum ?? null; a tombstone reads back as op 'delete' with hash null, correct by design.",
      "ConflictError actualHead (:636, :817): RAW at BASE (null for a checksum-less row, hence 'current is null'); now SERVED via lockHead.",
      "Door callers in protocol.ts: saveMetaItem's parent (:20381 unpinned / :20389 token) is SERVED current.hash; deleteMetaItem's (:25992) is SERVED; revertCommit's (:24799) is SERVED; migrateStoredMetadata (:21060) passes RAW row.checksum ?? null; flow-credential-migration calls saveMetaItem with no parent, so SERVED. All except migrateStoredMetadata hit the 409 at BASE."
    ]
  },
  "H2": {
    "verdict": "Confirmed and implemented as hypothesised.",
    "detail": "lockAccepts(ref,row,parent) = parent === (row.checksum ?? null) || (row.checksum ?? null) === null && parent !== null && parent === lockHead(ref,row). The first arm is BASE's compare byte for byte, so a stamped row is judged exactly as before; this is pinned on a row whose stamp differs from its body's hash, where the body's hash and null are refused and the stamp is accepted. Callers passing null for a checksum-less row are migrateStoredMetadata's storedParentVersion: row.checksum ?? null (pinned, succeeds) and saveMetaItem with parentVersion null (storedParentForToken(null) gives null, still matched; e.g. the CLI integration probe). The datasource admin door's write path calls neither put nor delete: writeDatasourceRow / its delete use engine.insert/update/delete directly with no optimistic lock (datasource-admin-plugin.ts :115-165), so this change does not affect it. DeleteOptions.parentVersion is typed string, so no in-tree delete caller passes null; the null match is kept for delete anyway, for symmetry."
  },
  "H3": {
    "verdict": "No writer in this repository still stores a sys_metadata row with a null or absent checksum, after PR #21977 or after this fix, so there is no follow-up card.",
    "census_table": [
      {"writer": "SysMetadataRepository.put (insert/update)", "where": "packages/metadata-protocol/src/sys-metadata-repository.ts", "checksum": "always hashSpec(body, type)", "live_after_21977": "no", "live_after_fix": "no"},
      {"writer": "SysMetadataRepository.delete", "where": "same file", "checksum": "removes the sys_metadata row; the tombstone goes to sys_metadata_history with checksum null by design", "live_after_21977": "n/a (history table)", "live_after_fix": "n/a"},
      {"writer": "datasource admin door writeDatasourceRow", "where": "packages/services/service-datasource/src/datasource-admin-plugin.ts", "checksum": "hashSpec(record, 'datasource') since PR #21977; none before (the legacy population)", "live_after_21977": "no", "live_after_fix": "no; its legacy rows are writable via the served version"},
      {"writer": "datasource admin door delete fallback update {state: 'inactive'}", "where": "same file", "checksum": "partial update, keeps the column", "live_after_21977": "no", "live_after_fix": "no"},
      {"writer": "DatabaseLoader save / create / registerRollback", "where": "packages/metadata/src/loaders/database-loader.ts", "checksum": "contentHash stamp", "live_after_21977": "no", "live_after_fix": "no"},
      {"writer": "protocol orphan adoption (package_id rebind)", "where": "packages/metadata-protocol/src/protocol.ts", "checksum": "partial update, keeps the column", "live_after_21977": "no", "live_after_fix": "no"},
      {"writer": "protocol legacy delete; permission-set overlay discard", "where": "protocol.ts; packages/plugins/plugin-security/src/permission-set-overlay-discard.ts", "checksum": "delete only", "live_after_21977": "no", "live_after_fix": "no"},
      {"writer": "env_id to project_id migration", "where": "packages/metadata/src/migrations/migrate-env-id-to-project-id.ts", "checksum": "column rename DDL", "live_after_21977": "no", "live_after_fix": "no"},
      {"writer": "migrateStoredMetadata; flow credential move", "where": "protocol.ts; packages/services/service-automation/src/flow-credential-migration.ts", "checksum": "through saveMetaItem then put (stamps)", "live_after_21977": "no (both 409'd on checksum-less rows)", "live_after_fix": "no (both now succeed)"},
      {"writer": "generic data door, MCP data bridge, flow write nodes, hook bodies", "where": "sys_metadata object apiMethods ['get','list']; stored-metadata family refusals", "checksum": "refused", "live_after_21977": "no", "live_after_fix": "no"},
      {"writer": "seed datasets", "where": "packages/metadata-protocol/src/seed-loader.ts", "checksum": "no dataset in the tree targets sys_metadata", "live_after_21977": "no producer", "live_after_fix": "no producer"}
    ],
    "tombstone_read_back": "A tombstone lives in sys_metadata_history (metadata null, checksum null, previous_checksum = the deleted row's raw stamp). history()/rowToEvent yields op 'delete' with hash null; getByHash never matches it (WHERE checksum = a string, and metadata null returns null); restoreVersion refuses it with VERSION_NOT_RESTORABLE (409)."
  }
}

Generated by Claude Code

Landed: PR #21990 → 6befe19c6e on main. It merged through the merge queue at 2026-10-06T14:01Z, after entering the queue at 2026-10-06T13:33Z. Verified at 2026-10-06T14:02Z. domain:engine#1 · session_017ErfyP2Rx7XWHJA27QjyUi.

The squash. It is on origin/main as a single-parent commit (parent aa09db58c9). Its diffstat is the reviewed one: 4 files, +343/-12.
What is on main.
- sys-metadata-repository.ts names a row's served version once, in servedVersion, which rowToItem reads.
- put and delete lock through lockAccepts. A stamped row is judged exactly as before. A checksum-less row also accepts the version its read hands out, and a null parent still matches it.
- The next write stamps the row. There is no backfill and no migration.
- The same lock repairs four other paths for such rows: publish, rollback and revert, and the post-promotion drain.
The card. Fixes #21978 closed this card as completed. pm:dispatched is removed in this act. No other card was closed by the body.
From this release (@objectstack/metadata-protocol patch, Clause-②: no).
- A sys_metadata row written before PR fix(service-datasource): the admin door reads a datasource's origin from provenance, and a metadata-door write reaches it in the same boot #21977 without a checksum can be edited and removed through the metadata door with the version its read returns. Before, it answered 409 METADATA_CONFLICT.
Census. No live writer in the tree still produces such rows, so no follow-up card is owed.

Generated by Claude Code

fix(metadata-protocol): put and delete accept the version a checksum-…

Navigation Menu

Repository navigation

finding(metadata-protocol): a sys_metadata row with no checksum cannot be edited or removed through the metadata door: the read hands out a computed version, and put / delete compare it against the raw null column (409 METADATA_CONFLICT) #21978

What is measured

Mechanism (read on `origin/main` `753e7a1c0e`)

Reader who acts

Triage: first grade — `bug` · `priority:p3` · `domain:engine` · `area:api` · `pm:queue`. The compare uses the version the read hands out; no backfill

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

finding(metadata-protocol): a sys_metadata row with no checksum cannot be edited or removed through the metadata door: the read hands out a computed version, and put / delete compare it against the raw null column (409 METADATA_CONFLICT) #21978

Description

What is measured

Mechanism (read on origin/main 753e7a1c0e)

Reader who acts

Activity

objectstack-fleet commented on Oct 6, 2026

Triage: first grade — bug · priority:p3 · domain:engine · area:api · pm:queue. The compare uses the version the read hands out; no backfill

objectstack-fleet commented on Oct 6, 2026

objectstack-fleet commented on Oct 6, 2026

objectstack-fleet commented on Oct 6, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Mechanism (read on `origin/main` `753e7a1c0e`)

Triage: first grade — `bug` · `priority:p3` · `domain:engine` · `area:api` · `pm:queue`. The compare uses the version the read hands out; no backfill