fix(metadata-protocol): the save check anchors each package's row on that package's env-wide definition

The organization-scoped save check judges a view overlay against the
env-wide body of the row it is keyed by. That anchor is now resolved
per package, the way the list read resolves each package's item: the
package's own env-wide row, else the package-less env-wide row (which
stands in for every package), else that package's artifact. It no
longer falls back to one artifact per name, the first in registry
order, and one package's stored row no longer stands for every
package's artifact of the name.

The "never under-closes" wording on the withdrawal judgement's docblock
and on the public data collection page is narrowed to match what holds:
a withdrawal of a name may over-close across packages; both checks read
every package's env-wide definition, except that the anonymous form
endpoints read one package's expansion of each form name when several
packages' stored view containers expand it.

Pin: with the withdrawing package not first in registry order, a
package-less or package-bound org save that renames the form is
refused; another package's env-wide row anchors that package only;
controls: the save that keeps the form withdrawn saves, and a
package-less env-wide row stands in for every package.

Claude-Session: https://claude.ai/code/session_017ErfyP2Rx7XWHJA27QjyUi
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.changeset/21934-save-check-anchor-per-package.md

@@ -0,0 +1,8 @@
+---
+'@objectstack/metadata-protocol': patch
+---
+
+The organization-scoped save check judges a view overlay against every package's environment-wide definition of its row
+
+- An organization-scoped `view` save or publish in the organization the anonymous form endpoints read is refused when it would leave open a form the environment-wide definition withdraws. Its row anchor is now resolved per package, the way the list read resolves each package's item: each package's own environment-wide row, else the package-less environment-wide row (which stands in for every package), else that package's artifact. Before, with no environment-wide row stored, it judged only the first package's artifact in registry order, and a stored row of any one package hid every package's artifact of the name.
+- The known limit stated with the public-form withdrawal ("it may over-close, never under-close") is narrowed. A withdrawal of a view name still closes that name in every package, so it may over-close. Both checks read every package's environment-wide definition of the name, except at the anonymous endpoints when two packages each have an environment-wide copy of the same view container saved: there the endpoints read one package's copy of each form those containers expand, and can miss the other package's withdrawal of that form until it is withdrawn in each package's copy. The organization-scoped save check still judges both copies.

content/docs/ui/public-data-collection.mdx

@@ -62,13 +62,13 @@ A withdrawal is a kill switch across metadata layers. If the environment-wide de
 
 **Which form a withdrawal closes.** Two checks apply the rule, and they match forms differently:
 
-- **Saving and publishing in an organization** judges the organization's copy against the stored environment-wide definition it overrides (the row its copy is keyed by). Inside that definition, a withdrawn form is the same form as the organization's when they share a place (`form`, the same `formViews` entry, or the view's own `config`) or a public link. A match on either is enough, so a renamed `formViews` key, a `form.name`, a move to another place, a renamed expanded item, and a new or re-cased slug all still count as the same form. A form that differs from every withdrawn form in both place and link is a different form, such as a sibling in the same view.
+- **Saving and publishing in an organization** judges the organization's copy against the stored environment-wide definition it overrides (the row its copy is keyed by, in each package that ships it). Inside that definition, a withdrawn form is the same form as the organization's when they share a place (`form`, the same `formViews` entry, or the view's own `config`) or a public link. A match on either is enough, so a renamed `formViews` key, a `form.name`, a move to another place, a renamed expanded item, and a new or re-cased slug all still count as the same form. A form that differs from every withdrawn form in both place and link is a different form, such as a sibling in the same view.
 - **The anonymous endpoints** judge each form by the name of the view item they serve. Beneath the organization's read they read the environment-wide view list, and a form is closed when the environment-wide item of the same name explicitly withdraws a form in the same place or under the same link.
 - **A different view is a different form.** A different view that uses the same public link (for example, another app's "contact us" form) neither closes this one nor is closed by it.
 
 **Forms a package ships.** A package's form is part of the environment-wide definition, not a separate layer beneath it. A definition parsed by the stack schema (strict `defineStack`, the default) gets the schema's default `enabled: false`, so a shipped form that keeps its link without setting `enabled: true` counts as withdrawn and an organization's copy cannot open it. A definition loaded without that parse (`defineStack(..., { strict: false })` or a hand-built manifest) is judged as written: a switch it leaves out is absent, which is not a withdrawal, so set `enabled: false` explicitly to ship a form closed. The environment-wide definition is the administrator's switch: an environment-wide save may open a form that the package ships closed.
 
-**Known limit: packages and names.** A withdrawal of a view name closes that name in every package. When two packages each ship a view of the same name, one package's withdrawal also closes the other package's form of that name. This may close more than was meant, but it never leaves a withdrawn form open. Per-package precision is tracked in #21934.
+**Known limit: packages and names.** A withdrawal of a view name closes that name in every package. When two packages each ship a view of the same name, one package's withdrawal also closes the other package's form of that name, so this may close more than was meant. Both checks read every package's environment-wide definition of the name, with one exception at the endpoints: when two packages each have an environment-wide copy of the same view container saved, the endpoints read only one package's copy of each form those containers expand, so they can miss the other package's withdrawal of that form. The organization-scoped save check still judges both copies. To close such a form at the endpoints, withdraw it in each package's environment-wide copy.
 
 **Known limit.** The save check runs only when an organization's copy is saved or published. A copy that was already stored before the environment-wide withdrawal, or that a rollback or revert restores, is judged only by the endpoints, which match by served item name. If that copy keeps the form open under a different key or place than the environment-wide definition, the endpoints can still serve it. To close it, withdraw the form in that organization's copy too; the next organization-scoped save of a copy that keeps it open is refused.
 

packages/metadata-core/src/anonymous-form-intake.ts

@@ -322,9 +322,14 @@ function anonymousFormExplicitWithdrawals(view: unknown): Array<{ slot: string;
  * and closes nothing. The package a body is bound to is NOT compared: a
  * withdrawal of a name closes that name's form in every package (a known
  * limit that fails closed: it may over-close another package's form of the
- * same name, never under-close). A layer with no body of the row, or whose body has no
- * explicit withdrawal, withdraws nothing, so a form published only in an
- * organization stays open there.
+ * same name). It judges only the bodies the layer holds, so a caller closes a
+ * name in every package only when its layer holds every package's body of the
+ * name: the organization-scoped write door anchors one body per package, and
+ * the env-wide view list the anonymous doors read holds one item per package
+ * of a name, except that it holds one package's expansion of each name that
+ * stored view containers of several packages expand. A layer with no body of
+ * the row, or whose body has no explicit withdrawal, withdraws nothing, so a
+ * form published only in an organization stays open there.
  */
 export function anonymousFormIntakeWithdrawnIn(
     layer: ReadonlyArray<unknown>,

packages/metadata-protocol/src/protocol.org-scoped-write-refused.test.ts

@@ -1205,3 +1205,72 @@ describe('a publish consults the lock of the package key it resolved', () => {
         expect(draftsOf()).toEqual(['pkg_a']);
     });
 });
+
+// The organization-scoped save check anchors the overlay on the env-wide
+// definition of its row, one per package that holds the name: each package's
+// own env-wide row, else the package-less env-wide row (which stands in for
+// every package), else that package's artifact. So a package that withdraws
+// the form is judged whatever its place in registry order, and another
+// package's stored row anchors that package only.
+describe('the save check anchors each package\'s row on that package\'s env-wide definition', () => {
+    const LINK = '/forms/walled-intake';
+    const open = { enabled: true, allowAnonymous: true, publicLink: LINK };
+    const container = (sharing: Record<string, unknown>, key = 'intake_form') => ({
+        name: 'task', object: 'task', formViews: { [key]: { sharing } },
+    });
+    // Registry order: package A (open) first, so a lookup that names no
+    // package answers A's artifact. Package B, which withdraws, is second.
+    const shippedA = { ...container(open), _packageId: 'pkg_a' };
+    const shippedB = { ...container({ ...open, allowAnonymous: false }), _packageId: 'pkg_b' };
+    // The overlay moves the form to another key, so only the row anchor matches it.
+    const renamedOpen = container(open, 'intake_v2');
+
+    function makeTwoPackageProtocol() {
+        const { engine, rows } = makeStubEngine();
+        engine.registry.listItems = (type: string) => (type === 'view' ? [shippedA, shippedB] : []);
+        engine.registry.getArtifactItem = (type: string, name: string, pkg?: string) => {
+            if (type !== 'view' || name !== 'task') return undefined;
+            return pkg === 'pkg_b' ? shippedB : shippedA;
+        };
+        const services = new Map<string, unknown>([['tenancy', { defaultOrgId: async () => 'org_a' }]]);
+        const protocol = new ObjectStackProtocolImplementation(engine, () => services, 'env_prod') as any;
+        return { protocol, rows };
+    }
+
+    for (const [label, packageId] of [['a package-less', undefined], ['a package A-bound', 'pkg_a']] as const) {
+        it(`the withdrawing package is not first in registry order: ${label} org save that renames the form is refused`, async () => {
+            const { protocol, rows } = makeTwoPackageProtocol();
+            await expect(protocol.saveMetaItem({
+                type: 'view', name: 'task', item: renamedOpen, organizationId: 'org_a',
+                ...(packageId ? { packageId } : {}),
+            })).rejects.toMatchObject({ code: 'NOT_OVERRIDABLE', status: 403, organizationId: 'org_a' });
+            expect(orgRows(rows).filter((r) => r.org === 'org_a')).toEqual([]);
+        });
+    }
+
+    it('another package\'s env-wide row anchors that package only: the org save is still judged against the withdrawing package', async () => {
+        const { protocol, rows } = makeTwoPackageProtocol();
+        expect((await protocol.saveMetaItem({
+            type: 'view', name: 'task', item: { ...container(open), label: 'Task (A, env-wide)' }, packageId: 'pkg_a',
+        })).success).toBe(true);
+        await expect(protocol.saveMetaItem({
+            type: 'view', name: 'task', item: renamedOpen, organizationId: 'org_a',
+        })).rejects.toMatchObject({ code: 'NOT_OVERRIDABLE', status: 403, organizationId: 'org_a' });
+        expect(orgRows(rows).filter((r) => r.org === 'org_a')).toEqual([]);
+    });
+
+    it('control: the same org save that keeps the form withdrawn saves', async () => {
+        const { protocol } = makeTwoPackageProtocol();
+        expect((await protocol.saveMetaItem({
+            type: 'view', name: 'task', item: container({ ...open, allowAnonymous: false }, 'intake_v2'), organizationId: 'org_a',
+        })).success).toBe(true);
+    });
+
+    it('control: a package-less env-wide row stands in for every package, so the org save it leaves open saves', async () => {
+        const { protocol } = makeTwoPackageProtocol();
+        expect((await protocol.saveMetaItem({ type: 'view', name: 'task', item: container(open) })).success).toBe(true);
+        expect((await protocol.saveMetaItem({
+            type: 'view', name: 'task', item: renamedOpen, organizationId: 'org_a',
+        })).success).toBe(true);
+    });
+});

packages/metadata-protocol/src/protocol.ts

@@ -16070,7 +16070,9 @@ export class ObjectStackProtocolImplementation implements
         // by: the env-wide body of row `name`, as stored (a container is not
         // expanded, so a form moved to another key or slot, renamed through
         // `form.name`, or renamed by an expansion collision is still matched
-        // against the form it was, by slot or by slug).
+        // against the form it was, by slot or by slug). [#21934] One body per
+        // package that holds the name ({@link envWideRawViewRows}), so every
+        // package's withdrawal of it is judged, whatever the registry order.
         const envRows = (await this.envWideRawViewRows(args.type, args.name)).map((r) => ({ ...r, name: args.name }));
         if (envRows.length > 0) {
             const own = { ...raw, name: args.name };
@@ -16101,10 +16103,15 @@ export class ObjectStackProtocolImplementation implements
     }
 
     /**
-     * The env-wide body of the `view` row `name`, as stored: the active
-     * env-wide `sys_metadata` row when there is one (the env-wide overlay is
-     * keyed by its own name, ADR-0005), else the code package's artifact of
-     * that name. Empty when neither exists.
+     * The env-wide bodies of the `view` row `name`, as stored, for every
+     * package that holds the name. [#21934] Resolved per package, the way the
+     * list read resolves each package's item (ADR-0048): the package's own
+     * active env-wide `sys_metadata` row (the env-wide overlay is keyed by its
+     * own name, ADR-0005), else the package-less env-wide row, which stands in
+     * for every package's row of the name, else that package's artifact of
+     * the name. So a stored row of one package anchors that package only, and
+     * every package that ships the name is judged on its own definition,
+     * whatever the registry order. Empty when no package holds the name.
      *
      * Read raw, never through the list read: that serves a container only as
      * its expansion, whose item names and slots the overlay author chooses,
@@ -16120,11 +16127,18 @@ export class ObjectStackProtocolImplementation implements
         }
         const stored = this.storedOverlayEntries({ type }, records)
             .filter((e) => e.name === name && e.organizationId === null)
-            .map((e) => e.data)
-            .filter((d): d is Record<string, unknown> => !!d && typeof d === 'object' && !Array.isArray(d));
-        if (stored.length > 0) return stored;
-        const artifact = this.lookupArtifactItem(type, name);
-        return artifact && typeof artifact === 'object' ? [artifact as Record<string, unknown>] : [];
+            .filter((e) => !!e.data && typeof e.data === 'object' && !Array.isArray(e.data));
+        const bodies = stored.map((e) => e.data as Record<string, unknown>);
+        const withOwnRow = new Set(stored.map((e) => e.packageId));
+        // The package-less row stands in for every package without a row of its own.
+        if (withOwnRow.has(undefined)) return bodies;
+        for (const artifact of this.shippedArtifactsOf(type, name)) {
+            if (!artifact || typeof artifact !== 'object' || Array.isArray(artifact)) continue;
+            const pkg = (artifact as { _packageId?: unknown })._packageId;
+            if (typeof pkg === 'string' && withOwnRow.has(pkg)) continue;
+            bodies.push(artifact as Record<string, unknown>);
+        }
+        return bodies;
     }
 
     /**