Repository navigation
ADR-0029 D9's control-plane pin can now assert code + status like its project-kernel sibling (unblocked by #7426) #7470
Description
Filed by the domain:metadata seat from #7426's report (open question 1), rather than left in that thread. Unassigned; no domain:* label — routing is the triage seat's call (the file is in packages/objectql, which is not this lane's surface even though the cause was).
What just changed
packages/objectql/src/protocol-object-overlay-layer.test.ts — ADR-0029 D9's pin file — contains a deliberate asymmetry:
- the project-kernel leg asserts the full ADR-0112 envelope (
code+status); - the control-plane leg asserts only a message substring.
That was not a style choice. It was the only thing that leg could assert, because deleteMetaItem's catch re-wrap carried status forward and dropped code, so a repository refusal reached the caller as 403 with code: undefined. The pin was shaped around a defect.
PR #7466 (#7426) fixes the cause, so the constraint is gone. Measured in that PR: the control-plane leg now answers 403 + NOT_OVERRIDABLE, and #6960's own pin (protocol.legacy-overlay-delete.test.ts) had its equivalent topology branch deleted in the same change, with every leg now asserting code + status.
Why this is a separate card
#7426's dispatch carried an explicit STOP on touching D9's pin file, and the dev honoured it exactly — packages/objectql is absent from that PR's diff. That was the right call while the fix was in flight: a card that both changes a behaviour and rewrites the pin asserting the old behaviour cannot produce clean reverse verification.
Now that the cause has landed, tightening the pin is a small, self-contained change with a real payoff: an assertion shaped around a defect keeps passing after the defect is fixed, and silently stops testing what its name claims.
Scope
- Replace the control-plane leg's message-substring check with
code+status, matching its project-kernel sibling. - Remove or correct any comment in that file explaining the asymmetry — the explanation becomes false the moment the assertion changes. (
deleteMetaItem's catch re-wrap drops the errorcode, so a repository refusal reaches the caller as a 403 with no catalogued code #7426 had to do exactly this inprotocol.legacy-overlay-delete.test.ts, where the comment named this issue's cause by number.)
Also recorded here, deliberately not filed as its own card
#7426's dev measured a prose divergence between the two producers: deleteMetaItem's own two-tier block writes [not_overridable] while SysMetadataRepository writes [NOT_OVERRIDABLE]. Machine-side this is now irrelevant — both set code correctly, and ADR-0112's whole point is that the catalog governs error.code while message prose is a different surface. It is only confusing for a human grepping logs. Worth folding into this card if whoever takes it is already in the area; not worth a card of its own, and explicitly not an error.code defect.
Refs: #7426 / PR #7466 (the cause and its fix), #6960 / PR #7429 (whose pin carried the same asymmetry), #7277 / PR #7306 (ADR-0029 D9), ADR-0112.
Activity
os-zhuang commentedon Aug 10, 2026
Gate cleared — the
Blocked-by: #7466line in the body is now stale.PR #7466 merged as
2c28df96e(2026-08-10T14:47:43Z), verified by unbounded subject-shape grep and a single-parent check. So the cause this card waits on is onmain, and the control-plane leg of D9's pin can now be tightened without going red.Recording it here within minutes rather than leaving the body's warning to rot, because this lane has been bitten by exactly that: #7134 sat
pm:blockedfor ~17 hours on aBlocked-by:line whose PR had merged six minutes after the card was filed. A blocker sentence is true at the moment it is written and stops being true without anyone editing it.Card is fully dispatchable — no remaining gate.
2c28df96etouchedpackages/metadata-protocol/src/protocol.legacy-overlay-delete.test.ts(deleting #6960's own topology branch). It did not touchpackages/objectql/src/protocol-object-overlay-layer.test.ts, which is this card's target — that file is byte-identical to before. Confirm that at the merged ref before editing; "upstream merged" is not the same as "the file still looks like the card says".Generated by Claude Code
os-zhuang commentedon Aug 10, 2026
Triage:
pm:queuestands (filed with it),domain:engine-coreappended.packages/objectql/src/protocol-object-overlay-layer.test.ts—packages/objectql⇒domain:engine-coreper the domain table. Anchor read onorigin/main@2c28df9: the control-plane leg still asserts by message substring (expect(String(refused.message)).toContain('NOT_OVERRIDABLE'), line 403) while the project-kernel legs assertcode+status(lines 294–295, 318–319) — the asymmetry this card removes is live.Blocked-by: #7466is already cleared — PR fix(metadata-protocol):deleteMetaItem's catch re-wrap carries the errorcode(#7426) #7466 merged 2026-08-10T15:03:36Z as2c28df96e, which is the currentorigin/maintip; the gate-cleared comment on this thread is confirmed. Card is dispatchable as-is, nopm:blocked.overlay/D9/pin — only unrelated hits [finding] Two more copies of the retired ADR-0094 2026-07-14 overlay direction survive outsideplugin-security— a dogfood test header and ADR-0094's own D2 cross-reference #7351/flaky:sql-driver-overlay-index-drift.test.ts「stays silent on the SECOND boot, when the runtime ledger starts empty again」偶发判红 #6522).target:v17: no — test-assertion tightening, not a released-surface defect; the behavioral fix already shipped in fix(metadata-protocol):deleteMetaItem's catch re-wrap carries the errorcode(#7426) #7466.本评论来自分诊座位 Routine（#5474 试点），不构成认领。
Generated by Claude Code
claude commentedon Aug 10, 2026
Race re-read: body + 15:23Z triage re-read; no competing session.
assigneesmeasured EMPTY immediately before assigning;pm:queue→pm:dispatchedsame write.Prerequisite verified before dispatch: PR #7466 merged as
2c28df96e(the exact SHA the triage anchor read), #7426closed/completed— the cause is fixed, the pin can now assert what its project-kernel sibling asserts.(Edited: the Session line initially carried a typo'd ID — corrected in place minutes later by the same session, since a wrong ID defeats the line's arbitration purpose.)
Generated by Claude Code
claude commentedon Aug 10, 2026
ACCEPT — PR #7478. Ready + queued.
Verified (28 runs, 0 not-green, re-read by the seat — ⛔ not taken from the dev's poll alone):
code === 'NOT_OVERRIDABLE'+status === 403, mirroring the project-kernel sibling; the message-substring assertion is dropped because the sibling carries none — style matched, not improvised. One file, +2/−1.deleteMetaItem's catch re-wrap carries the errorcode(#7426) #7466's own pin (protocol.delete-rewrap-envelope.test.ts) assertsNOT_OVERRIDABLE/403 for control-plane, and2c28df96ewas verified an ancestor of the branch base before any edit.2c28df96e^and rebuilt ⇒ exactly 1 failed / 15 passed, the control-plane leg,expected undefined to be 'NOT_OVERRIDABLE'— i.e. the new pin sees precisely the pre-fix(metadata-protocol):deleteMetaItem's catch re-wrap carries the errorcode(#7426) #7466 defect the old substring assertion could not; restored ⇒ 16/16.skip-changesetper the gate's route 2 (tests-only), written read-then-union and read back through the bots:['size/xs', 'skip-changeset', 'tests'];Check Changesetsuccess.[not_overridable]vs[NOT_OVERRIDABLE]) correctly left out — different package, and the issue itself grades it below a card; noted in the PR body.First S-grade card through mode:subagent under the new tier policy — the shape held: subagent did the one-file work and reported structured; the seat owned CI convergence, ready-flip and landing per L2. Auto-merge armed; issue closes on merge.
Generated by Claude Code
test(objectql): control-plane leg of ADR-0029 D9's pin asserts the fu…