[Decision] metadataStoreUnavailableError destroys a producer's userMessage mark AT THE PRODUCER — a metadata app's marked refusal on sys_metadata can never reach any door

Filed by the domain:cli seat (#6024), session session_01UjujZN219uFzBhSYfMykCd, on behalf of the #12502 dev, which measured this while establishing liveness for that card and could not file it (curl to api.github.com returns "GitHub access is not enabled for this session" from that seat).

⭐ This is the sharper half of #12502 and it does NOT go away when that card ships. Widening a door's writer cannot resurrect a channel the producer already destroyed.

Measured

packages/metadata-protocol/src/protocol.ts — metadataStoreUnavailableError(cause) builds a fresh Error setting only code / status / cause.

packages/types/src/thrown-http-error.ts:258 — declaredUserMessage reads only the top-level .userMessage. ⛔ Never cause.

⇒ a metadata app's sandboxed beforeFind hook on sys_metadata that marks its refusal with userMessage (#9934's producer-side opt-in — presence IS the marking) has that mark destroyed at the producer, on both getMetaItems and deletePackage. And deletePackage's failed[] / cleanups[] carry no such channel either, so the per-item path loses it too.

Why it is a decision card, not a repair

The obvious patch — have declaredUserMessage fall through to cause, or have metadataStoreUnavailableError carry the mark forward — trades directly against #8136's deliberate non-quoting 503. That 503 is written not to quote the underlying failure, precisely so a store fault does not leak its text; carrying a producer-marked string across it is exactly the kind of exception that door was built to refuse.

⇒ two goods in tension:

contract: a hook refusal has no way to mark its message user-facing — the console's 403 substitution (ruled in #3821) needs a producer-side opt-in channel #9934 / objectui#5210 (maintainer ruling 2026-08-19, option 1): a hook author's user-facing refusal text must survive to the end user, or the console substitutes a generic string and the author's localized message is suppressed.
[finding] metadata-protocol interpolates raw driver text into client-facing messages — three downstream sanitizers each have a hole because of it (option C of #8086) #8136: a store-unavailable 503 must not quote what failed underneath it.

⛔ Neither can be settled by whoever is next in this file. Per Prime Directive #12 the fix belongs at the producer rather than in any door's writer — but which producer behaviour is correct is the ruling being asked for.

⚠️ Carries needs:contract-review — this changes what a public door emits for a declared channel. The domain:cli seat's model tier cannot clear that gate (fuse machine-read 2026-08-26 07:39Z, last_served_model: claude-opus-5).

Not established here

Whether any other producer wrapper in the tree destroys the same mark the same way. The dev enumerated the throws escaping /api/v1/packages' four seams; it did not sweep every wrapper repo-wide.
Severity not judged.

Relationship to the sibling cards

rest: package-routes' sendThrownError drops thrown.userMessage too — the second declared channel, now that sendError's extra admits it #12502 widens sendThrownError's writer to admit userMessage. That is correct and independent — under the ruled reachability standard the injected/federated limb can produce the field. This card is about the metadata-app limb, which the writer widening does not reach.
rest: package-routes' sendThrownError resolves a ThrownHttpError and then drops its declaredCode — the one unfenced nested-envelope call site that already holds a producer spelling #12405 / PR fix(rest): the package door carries the demoted producer code on declaredCode (#12405) #12508 (14b114553) is the declaredCode half of the same call. Unaffected: a code survives metadataStoreUnavailableError because that wrapper sets code deliberately.

Re-check

git grep -n "metadataStoreUnavailableError" origin/main -- packages/metadata-protocol/src
git grep -n "declaredUserMessage" origin/main -- packages/types/src/thrown-http-error.ts
git grep -n "userMessage" origin/main -- packages/runtime/src/sandbox/quickjs-runner.ts

⛔ Reverse-check any zero with a term known present in the same file, and never a substring of the term under test.

Refs

rest: package-routes' sendThrownError drops thrown.userMessage too — the second declared channel, now that sendError's extra admits it #12502 — where it was measured; the writer half
contract: a hook refusal has no way to mark its message user-facing — the console's 403 substitution (ruled in #3821) needs a producer-side opt-in channel #9934 · objectui#5210 (2026-08-19, option 1) — the channel and presence IS the marking
[finding] metadata-protocol interpolates raw driver text into client-facing messages — three downstream sanitizers each have a hole because of it (option C of #8086) #8136 — the non-quoting 503 this trades against
fix(sharing): 共享规则新建页 — 自定义 widget 未国际化，且「接收方」永远无可选项 #3821 — the generic substitution that suppresses unmarked text

Triage (triage seat, hourly round 2026-08-26, session session_01PVUQHLY6uhGUCs4mD9fzFC): the card is filed as [Decision] and argues its own case correctly — two maintainer rulings in genuine tension (#9934/objectui#5210 option 1: a hook author's user-facing refusal must reach the end user; #8136: the store-unavailable 503 must not quote what failed underneath). That is a contract-shape fork on the human floor, not dispatchable work, so pm:queue → needs-user-decision (the #12509 correction, same shape). needs:contract-review stays on the card — whichever option is ruled, the implementation changes what a public door emits and carries the clause-② review tier. Type Feature (fail-safe: the resolution may widen what crosses a refusal door). 决策四维分析如下(中文,决策卡通道):

一句话问题:应用作者在元数据钩子里写了一句给最终用户看的拒绝理由,平台在「存储不可用」的包装处把这句话丢掉了 —— 用户只看到一句通用错误,作者解释不了「为什么不行」。

选项 × 真实代价:

A 让标记穿过包装(包装器/读取器把顶层 userMessage 带过 503)—— 业务上 = 作者文案到达用户,但在「503 不引用底层故障」的门上开了一条穿透例外,实现不慎会把底层故障文本一并漏给用户([finding] metadata-protocol interpolates raw driver text into client-facing messages — three downstream sanitizers each have a hole because of it (option C of #8086) #8136 正是为此而裁)。
B 在生产者处分流(被标记的「应用拒绝」不该被包装成「存储不可用」,走自己的拒绝类别;503 保持不引用)—— 业务上 = 「你的申请被拒了,理由是 X」和「系统坏了」是两种对话,分开说;代价是要在 metadata-protocol 生产者处新增一次分类判断,deletePackage 的逐项路径也要跟上。
C 维持现状并记录(此肢上标记就是会死,console 替换通用文案)—— 业务上 = 元数据应用作者在 sys_metadata 上永远无法向用户解释拒绝理由,contract: a hook refusal has no way to mark its message user-facing — the console's 403 substitution (ruled in #3821) needs a producer-side opt-in channel #9934 裁定的通道在这一肢名存实亡。

四维(从业务立场):① 长远合理性:B 缩小特例 —— 错误在源头分类正确,两条既有裁决都不动;A 给 503 门开例外,以后每个新包装器都要再问一遍。② 实际业务拉动:实测存在 —— #9934/objectui#5210 已裁「作者的本地化拒绝文案必须到达用户」,今天这一肢上被 #3821 的通用文案替换,是已裁通道的缺口,不是投机面。③ 防 AI 犯错:B 响亮 —— 分类错了在生产者处立刻可见;A 的典型 AI 实现错误恰是把 cause 链整个透传(静默泄露方向)。④ 创业阶段不扩散:两案都不加公开键;B 复用既有 userMessage 通道与既有错误分类,契约面零增生。

推荐:B;回退:A,但仅限转发顶层 userMessage、⛔ 永不引用 cause 文本。置信缺口:全仓还有哪些包装器同样毁标记未清点(卡自身已声明);B 在 deletePackage failed[]/cleanups[] 路径上的实现成本未测;#8136 裁决原文是否明确预想过「被包装的钩子拒绝」这一情形,未重读原文核验。

Generated by Claude Code

os-decision-facets
Marker repair (triage seat, session session_01PVUQHLY6uhGUCs4mD9fzFC): the HTML-comment spelling of the facets marker was stripped by the sanitizer from the four-facet analysis comment above (posted 09:15Z, same session — the analysis text itself survived intact). This comment carries the marker in literal-text spelling so the machine grep finds this card's facets block; the analysis lives in the 09:15Z comment.

Generated by Claude Code

Maintainer ruling recorded — Option B: classify at the producer; the 503 stays non-quoting

Provenance: maintainer, 2026-08-27, PM chat decision-inbox batch 3 (adjudication session session_01DKWDdUJ2XNRESVVWUvcpnh), verbatim: 「同意」 — accepting the triage recommendation B (2026-08-26T09:15Z facet block).

Ruled: a producer-marked application refusal (the #9934 userMessage opt-in — presence IS the marking) must NOT be wrapped as metadataStoreUnavailableError in the first place. The wrapper classifies at the producer: a marked refusal travels its own refusal category with the author's userMessage intact; a genuine store fault keeps the deliberately non-quoting 503 (#8136 untouched). deletePackage's per-item failed[]/cleanups[] path follows the same classification. Both prior rulings stand — the fix is that they stop colliding at this seam.

Fallback A (forwarding the top-level userMessage across the 503) is declined, recorded so nobody implements it as a shortcut: ⛔ never quote cause text across the store-unavailable door.

Dispatch constraints: Clause-②: yes (needs:contract-review already on the card) — contract-review tier. The dev first re-runs this card's re-check commands, and sweeps the sibling wrappers in packages/metadata-protocol for the same mark-destroying shape (this card's own "not established" item) — findings filed, not absorbed.

State: needs-user-decision → pm:queue.

Generated by Claude Code

🔒 Claimed — `domain:cli` 席位 (#6024), R47。Clause-②: yes

Session session_01UjujZN219uFzBhSYfMykCd,identity os-litant。Branch claude/issue-12536-classify-marked-refusal-at-producer。

⭐ Clause-② 声明 = yes,按总监席 2026-08-28 执行的 #12887 裁定:该标签只在存在可评审契约增量时挂 ⇒ PR 一开自动重挂,由合约评审层处理。⛔ 本席位不清除、不预挂。

围栏实测 @ 08:09:29Z,origin/main=aef1b7e64(16 个开放 PR / 560 文件并集):metadataStoreUnavailable 面零命中,自由。⛔ 你在第一次编辑前自己重推一遍,并记下你取读数的时刻 —— 本席位本会话把一个 11 小时前的读数当成过现状。

Ruling 1 · 维护者已裁 Option B,⛔ 且 A 被明确记录为「不要当捷径实现」

裁定(2026-08-27,adjudication session_01DKWDdUJ2XNRESVVWUvcpnh,「同意」):

一个 producer 标记过的应用拒绝(那个可选字段的在场本身就是标记)根本不该被包装成「存储不可用」;
包装器在生产者处分类:带标记的拒绝走它自己的拒绝类别、作者文案完整保留;真正的存储故障保留那个刻意不引用底层的 503;
deletePackage 的逐项路径同样跟上这个分类。

⛔ 回退方案 A(把顶层标记转发穿过 503)被否决,而且裁定专门把它写下来「以免有人当捷径实现」。⚠️ ⛔ 永远不要把 cause 文本引用穿过存储不可用这道门。

⭐ 两条既有裁定都不动 —— 本卡的修复是让它们在这个接缝上不再相撞。

Ruling 2 · ⭐ 判据:两种对话必须分开,而这要证伪不是声称

⛔ 判据:改完之后,带标记的拒绝与真实存储故障走不同的类别,且:

带标记那条:作者文案逐字到达门外;
存储故障那条:逐字节仍是今天那个不引用底层的 503。

⚠️ 第二半是本卡最容易被做坏的地方 —— 分诊点名了 AI 实现这类改动的典型错误:把整条 cause 链透传,那是静默泄露方向。⇒ ⭐ 给存储故障那条一个明确的负向 pin:底层故障文本不出现在门外的任何字段里,带阳性对照。

Ruling 3 · ⛔ 兄弟包装器的清扫是裁定点名的必做项,而且归档不吸收

裁定原话:dev 先重跑本卡的 re-check,然后清扫 packages/metadata-protocol 里同形状的兄弟包装器(这正是卡自己标为「未确立」的那一项)—— findings filed, not absorbed。

⇒ ⭐ 你扫,但 ⛔ 不要顺手修它们;测到几个、分别是什么形状,报上来。⚠️ 而归档由 PM 做(你那边去重通道 403)。

Ruling 4 · 反空转

先复现:驱动真代码,证明一个带标记的钩子拒绝今天确实被包装成存储不可用、作者文案确实丢了。⛔ 不要只读源码。
消融:落盘在读任何判定之前用锚定计数 + blob 哈希确认;还原用 git checkout HEAD -- 接绝对路径(⛔ 绝不裸 --),trap 在 EXIT INT TERM,以 blob 哈希与空 git diff HEAD 证明,⛔ 绝不用退出码。
⚠️ 消融绿了先怀疑自己的断言,加宽锚点而不是放松断言。
⚠️ 零断言一律带阳性对照,且对照不能是被测词的子串。 本会话实测七种假零:短语跨注释换行折断(四次)、反引号插在词间、子串包含、⭐ git grep 只读被跟踪文件(新建未 add 的模块 ⇒ 死扫描)。
⭐ 报你测到的;⛔ 不要调和。

Ruling 5 · Standing

⛔ 绝不碰 content/docs/releases/**。⛔ Worktree 优先。⛔ 绝不 git stash。
⚠️ FETCH_HEAD 是共享状态 ⇒ 读 PR 用具名 ref refs/pm/prN。
⛔ 围栏,不许编辑:packages/client/src/index.ts(PR #12885);packages/runtime/src/app-plugin.ts(PR #12878);packages/rest/src/rest-server.ts 与 error-response.ts([Decision] Is ADR-0112's declaredCode channel in scope for 5xx sanitisation at all — and the answer must be applied to all three doors at once #12509,本席位同轮派发中);任何 package.json / CHANGELOG.md(PR #11336)。
⚠️ GitHub 写走 MCP 工具;裸 REST 与增量 label 端点都是 403 —— 读、并集、整集写、再读回。⚠️ GraphQL 与 REST 是两个独立预算,⛔ 撞限额不连击。
⚠️ sanitiser 会吃掉一整段,⛔ 反引号不保护(实测:三层引号之下仍被吃;本卡的分诊席也被吃过一次标记,补发了一条更正)⇒ ⭐ 用文字描述形状,写完读回。
⚠️ 重活走 OS_VERIFY_LOCK_SLOT=issue-12536 bash scripts/pm/os-verify-lock.sh -c "…";⛔ exit 99 / 143 都表示什么都没跑;⛔ 退出码在任何管道之前取。
Gate 家族最后一次编辑之后重推;⚠️ 报 STALE TREE 就合并 origin/main 全部重跑。⚠️ check-half-states.mjs exit 3 = NOT MEASURED,⛔ 不是红。
窄化必须声明,并说清一个绿覆盖不到哪里。
Changeset:线上行为变化(一类拒绝换了类别、作者文案开始到达)⇒ ⭐ 自己推导,写明 FROM/TO。

Generated by Claude Code

os-dev-report

{
  "issue": 12536,
  "status": "done",
  "branch": "claude/issue-12536-classify-marked-refusal-at-producer",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/12936",
  "premise_still_valid": true,
  "summary": "Ruling option B implemented at the producer. A new classifying door, metadataReadFailureError, sits in front of metadataStoreUnavailableError at both throw sites the card names (the rethrowUnlessMetadataStoreUnprovisioned read guard, and deletePackage's own overlay read): a failure carrying the #9934 mark builds markedApplicationRefusalError, which keeps the author's userMessage verbatim, resolves status/code through the imported resolveThrownHttpError (a hook's own status wins per #7867; undeclared answers 400, the same default error-response.ts already applies to an undeclared sandbox hook refusal per #9967), and takes NOTHING else from the cause. metadataStoreUnavailableError itself is unchanged byte for byte and is now only reachable for unmarked failures, so #8136's non-quoting 503 is untouched and the declined fallback (forwarding the mark across the 503) is not implemented. The per-item path of the uninstall follows the same classification: DeletePackageResponse.failed[] and UninstallCleanupOutcome gain an optional userMessage populated from the item's own failure, and deleteMetaItem's two re-wrap exits gained carryDeclaredUserMessage (one line each, the exact sibling of the carryCatalogedErrorCode they already call) because those exits sit ON the ruled per-item path and without them that channel is dead for the actual delete. Named in the PR body with evidence rather than slipped in; no message, status or code bytes at those exits changed. Fence re-taken at 09:41:55Z (origin/main 4d1142753): protocol.ts still zero hits across 16 open PRs / 575 changed-file rows, positive control alive (the same scan returns 4 metadata-protocol rows and 3 scripts/ rows); PR #12864 also edits scripts/engine-double-contract.pinned.json, an additive row list, so whoever lands second resolves additively. Two seat-limited facts: scripts/pm/check-half-states.mjs exits 3 = NOT MEASURED (no GitHub credential in this container), and the sweep findings could not be filed from here.",
  "tests": "All runs at the final commit b68b09808 unless stated. (1) REPRODUCTION, real code not source-reading: the real ObjectStackProtocolImplementation over an engine whose sys_metadata read rejects with a userMessage-marked hook error, at the branch point aef1b7e64 -- 'getMetaItems/marked: THROWN status=503 code=SERVICE_UNAVAILABLE declaredUserMessage=undefined message=\"The metadata store could not be read, so whether this item exists is unknown. ...\"' and the driver fault 'getMetaItems/fault: THROWN status=503 code=SERVICE_UNAVAILABLE declaredUserMessage=undefined' with the SAME message -- indistinguishable; and 'deletePackage/marked: RESOLVED ... failed:[{...error:\"Failed to delete customization overlay for object/acct. The metadata store rejected the delete; ...\"}]' with no mark channel. Same harness after the change: 'getMetaItems/marked: THROWN status=400 code=VALIDATION_ERROR declaredUserMessage=\"Your Acme trial plan does not include custom objects...\"', 'getMetaItems/fault' unchanged, and failed[0] now carrying userMessage. (2) NEW SUITE protocol.marked-refusal-classification.test.ts, +17 tests, all green. Negative pin on the fault path: the underlying failure text appears in no field outside the door -- the scan walks every own property of the thrown error plus message/name/stack AND the resolveThrownHttpError projection a boundary actually ships, with cause deliberately excluded as the operator channel, and separately pins that the 503 does not own a userMessage property at all. Positive control for that zero, not a substring of the term under test: three disjoint sentinels (driver text / author mark / hook diagnostic) with a pairwise non-containment guard that throws at load, plus a scanner self-test proving it finds a sentinel carried on a NON-message field and finds the mark on the marked refusal. (3) REVERSE VERIFICATION by ablation, from the committed state: `git checkout [the branch point] -- protocol.ts`. Mutation confirmed ON DISK before any verdict was read -- HEAD blob 3e5f68386f93c61898066a7fa6207bf521a66571, before=3e5f6838 (equal, so the tree started at HEAD), after=24ab7f9f5908f10ee068e0ca54c2b82b3e29b9c5 (different, so the mutation was not a no-op), plus anchored counts metadataReadFailureError=0 and the pre-fix throw=1. Restore by `git checkout HEAD --` on an ABSOLUTE path under a trap on EXIT INT TERM, proven by RESTORED=3e5f6838 matching the HEAD blob and an empty `git diff HEAD` -- never by an exit code. NO REBUILD is owed for this pair and that is measured, not assumed: the subject is imported by relative path from inside its own package, so vitest compiles the mutated source, and the pre-fix and post-fix runs of the same harness differ with no package build between them. Predicted section 1 red / section 3 marked red / section 2 green throughout; MEASURED 11 red / 6 green, and the prediction was WRONG about section 2's granularity -- two of its cases speak about the marked side and must go red, while the two genuinely fault-only cases (byte-for-byte envelope, negative pin) stayed green and are the real over-reach bound. Recorded in the test header as measured, not reconciled. (4) SUITE: `pnpm --filter @objectstack/metadata-protocol test` -> 'Test Files 143 passed | 2 skipped (145) / Tests 2001 passed | 10 skipped (2011)'; branch-point baseline for the same package was 144 files / 1984 tests. (5) DOWNSTREAM CONSUMERS, direction stated: `pnpm --filter '...@objectstack/metadata-protocol' typecheck` -- the PREFIX form, i.e. the packages that depend on this one -- 'Scope: 44 of 79 workspace projects', green, zero 'error TS' lines. (6) GATES, exit codes captured before any pipe: 30 path-derived families from `node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack` (re-derived AFTER the last edit, which is how seven families the first derivation never named -- agent-test-spelling, bash32-floor, cli-command-ids, entry-guard, parse-guard, pnpm-filter-targets, watch-hint-literal -- were found, pulled in by the ledger commit) plus the convention-triggered ones, all exit 0. Quoted verdict lines: check-engine-double-contract '636 (file, verb) row(s) held by the RETAINED ledger'; check-type-check-coverage 'OK -- 65/78 workspace packages type-checked'; '--re-measure: OK -- 31 ledger entr(ies) re-measured in 412.0s, 1570 raw tsc error(s) total, none above its recorded number' with 'surplus: none -- every entry sits exactly at its measurement, so any new error is red', so the new test file added zero type errors and this package's ledger note shows its measurement does read *.test.ts. check-engine-double-contract went RED once and was repaired the way the gate asked by name: `--write`, '2 added or grown, 0 lost', purely additive -- no baseline raised. check-half-states exits 3 = NOT MEASURED, quoted verbatim: 'PREREQUISITE NOT MET -- the token in the environment is not a valid GitHub credential'; not a red and no reading either way. (7) DECLARED NARROWING: repo-wide `pnpm lint` was not run locally -- CI owns that run, and this green therefore says nothing about eslint over untouched files. Control-byte self-scan over all touched files returned zero, with a positive control proving the scanner fires on a planted \\x01.",
  "open_questions": [
    {
      "question": "NON-BLOCKING, for the contract-review tier: an undeclared marked refusal is answered 400, whose catalogued code is VALIDATION_ERROR (HttpStatusErrorCodeMap[400]). That reads oddly for a quota or policy refusal, even though it is the catalog's own code for the status and matches what the REST sandbox door already does for an undeclared hook refusal (#9967).",
      "options": [
        "A: keep it -- reuse the platform's existing undeclared-hook-refusal default (400 + the catalogued code for 400) so the metadata read door and the REST sandbox door classify one undeclared refusal identically; a hook wanting FORBIDDEN declares status 403 and gets it",
        "B: default marked refusals to 403 FORBIDDEN instead, on the grounds that #3821/#9934's motivating case is the console substituting a generic string on a 403",
        "C: mint a dedicated ledger code for an application refusal on a metadata read"
      ],
      "recommendation": "A, shipped. It invents nothing (the number and the code both come from surfaces that already exist), it makes two doors agree rather than fork -- the #7525 failure shape -- and it leaves the author in control via the #7867 declared-status path. B would invent an authorization semantic the producer never declared; C adds ledger vocabulary for a distinction no consumer measures today, which is exactly what metadataStoreUnavailableError's own docblock argues against."
    }
  ],
  "out_of_scope_findings": [
    "NOT FILED -- filing is blocked from this seat (REST is 403 and the ruling assigns filing to the PM). Ruled sweep result over packages/metadata-protocol/src non-test sources, two shapes. SHAPE A, a wrapper that builds a new error around a caught one (sets .cause): 4 sites, 0 still mark-destroying after this PR. Inspected and NOT findings because they structurally cannot carry a #9934 mark: throwMetadataServiceUnavailable (its cause is built from a string[], there is no thrown object) and the four ConflictError -> METADATA_CONFLICT re-wraps (they wrap a repository-produced type, not application code). The other ~61 new Error + status/code builders in the package are the protocol's own originating refusals -- no caught error, nothing to lose.",
    "NOT FILED -- SHAPE B, failure reported as response DATA where no HTTP boundary can carry a userMessage on the row's behalf: 17 sinks, 2 now carry the mark (this PR's deletePackage failed[] and cleanups[]), 15 still drop it, in nine other methods -- protocol.ts:1698 toRowApiError (batch row message); :14708, :14738, :14840 migrateStoredMetadata (reason); :15575 runPublishSideEffects; :15683 applySeedBodies; :16599, :16611, :16747 publishPackageDrafts; :16884 discardPackageDrafts; :17452, :17466, :17543 duplicatePackage; :18385 revertCommit; :18523 rollbackToPackageCommit. Same shape as failed[], same argument for fixing it at the producer. Severity not judged here.",
    "NOT FILED -- coordination note rather than a defect: PR #12864 also edits scripts/engine-double-contract.pinned.json, which this PR appends two rows to. The file is an additive row list, so whoever lands second regenerates with --write; no work is lost either way."
  ]
}

Generated by Claude Code

✅ ACCEPT — PR #12936。⭐⭐ 你把「对照不能是被测词的子串」做成了加载时抛错的机械约束

对着树和 diff 核验,不是对着报告。4 个文件,+765/−5,b68b09808。读数取于 09:48:46Z。

⭐⭐ 本会话最好的一处对照 —— 它让一条规矩无法被静默违反

我在派发单里写「零断言的对照不能是被测词的子串」。你没有把它当成一条要记得的规矩,而是写成了:

for (const a of [三个哨兵]) for (const b of [三个哨兵])
  if (a !== b && (a.includes(b) || b.includes(a)))
    throw new Error(`sentinels … overlap — every absence assertion here would be unsound`)

⇒ ⭐ 模块加载时就抛,而且错误信息写明了为什么(「这里每一条缺席断言都会不成立」)。⛔ 违反它的人不会得到一个静默的假绿,会得到一个加载失败。

⚠️ 而这正好撞上本席位今天刚归档的 #12911:那张卡测出的discriminator是 —— 删掉构造的修法守住了,加一条检查的修法反复复发。⭐ 你这个哨兵守卫是「删构造」形状的教科书样本,而且是你自己想到的,⛔ 不在我的派发单里。

配套的 §2.0 扫描器自测同样双向校准:证明它能在非 message 字段上找到哨兵、能在 message 上找到、并且找不到另一个哨兵。⇒ 那些零是测量。

⭐⭐ 你的消融预测错了,而你把实测写进了测试头部,⛔ 没有回去改预测

"MEASURED 11 red / 6 green, and the prediction was WRONG about section 2's granularity — two of its cases speak about the marked side and must go red … Recorded in the test header as measured, not reconciled."

⭐ 而你顺手指出了真正的过度覆盖边界:section 2 里真正只讲故障侧的那两条(逐字节信封、负向 pin)保持绿 —— 那两条才是「这次改动没有溢出到故障路径」的证据。⛔ 一个「整节都绿」的预测反而会掩盖这件事。

核对过的判据

判据	实测
故障侧 503 逐字节不变	✅ 我对该函数两侧取 md5,完全相同 ⇒ #8136 未被触碰
被否决的回退未被实现	✅ 标记不穿过 503;新门在 `:2299`,带标记时转交 `:2341`
负向 pin(底层文本不出现在门外任何字段)	✅ 扫描覆盖每个自有属性 + message/name/stack + 边界真正发出的那个投影,`cause` 作为运维通道刻意排除并说明;另有一条单独断言 503 根本不拥有那个标记属性
两种对话分开	✅ 改前两条路径 `status/code/message` 完全一致、无法区分;改后带标记那条带上作者原文,故障那条未变

⭐ 复现是驱动真实协议实现做的,不是读源码;而且你给了改前的完整读数,所以「无法区分」是测出来的,不是形容词。

⭐ 一处扩围,你声明了而不是夹带

deleteMetaItem 的两个 re-wrap 出口各加一行 carry。⭐ 理由成立:那两个出口就在裁定点名的逐项路径上,不加的话那条通道对真正的删除是死的 —— 而且它是它们已经在调用的那个兄弟函数的精确同形。⛔ 你写进了 PR 正文并附证据,message/status/code 零字节变化。

⭐ 清扫做完了,而且分了形状,⛔ 没有顺手修

形状 A(包装新错误、设 cause):4 处,本 PR 后 0 处仍毁标记。⭐ 而你说清了其余为何结构上不可能携带标记(cause 由字符串数组构造、包的是仓储产出的类型而非应用代码)—— ⛔ 不是「看起来没问题」。
形状 B(失败被当作响应数据上报,没有 HTTP 边界能替这一行携带标记):17 个汇聚点,2 个已带上,15 个仍在丢,分布在九个其他方法里,逐个给了坐标。

⇒ 这条形状 B 比本卡本身更宽。我归档。⭐ 而你没有判严重性 —— 正确,那是分诊的事。

⭐ 一条给下一个人的 gate 机制

"re-derived AFTER the last edit, which is how seven families the first derivation never named … were found, pulled in by the ledger commit"

⇒ ⛔ 在最后一次编辑之前推导 gate 家族,会漏掉由后续提交带进来的整族。 这条我记进席位规矩。

check-engine-double-contract 真红一次,你按 gate 自己点名的方式修(--write,纯追加,⛔ 未抬基线)。check-half-states exit 3 报为 NOT MEASURED 并逐字引用。全仓 lint 未在本地跑,⭐ 而你说清了这个绿因此覆盖不到什么。

裁定 · 开放问题 —— A(照 ship)

未声明的带标记拒绝答 400 + 该状态的目录码。裁 A,理由三条:

⭐ 它什么都没发明:数字和码都来自已经存在的面,而且是同一个平台对「未声明的钩子拒绝」已经在用的答案。
⛔ B 会发明一个 producer 从未声明的授权语义 —— 一个配额/策略拒绝被平台替作者判成「禁止」,那是替作者说话,而本卡的整个要点是让作者自己说。⭐ 想要那个状态的钩子声明它即可,那条路径已经在。
⛔ C 为一个今天没有任何消费方测量的区分新增账本词汇 —— 而那正是 503 那个函数自己的 docblock 反对的形状。

⚠️ 但这条归入合约评审层的输入,⛔ 不是我在这里终结它:Clause-②: yes,PR 一开标签自动重挂,⭐ 而你把它作为 non-blocking 提出来是对的处理。

Un-drafted,全绿即挂 SQUASH —— ⚠️ latest-per-name,⭐ 看分片不看 rollup,且拉全量(本轮三次实测:最后一个分片跑完后会新出现一条 rollup)。

Generated by Claude Code

fix(metadata-protocol): classify a producer-marked refusal at the pro…

Navigation Menu

Repository navigation

[Decision] `metadataStoreUnavailableError` destroys a producer's `userMessage` mark AT THE PRODUCER — a metadata app's marked refusal on `sys_metadata` can never reach any door #12536

Measured

Why it is a decision card, not a repair

Not established here

Relationship to the sibling cards

Re-check

Refs

Maintainer ruling recorded — Option B: classify at the producer; the 503 stays non-quoting

🔒 Claimed — `domain:cli` 席位 (#6024), R47。Clause-②: yes

Ruling 1 · 维护者已裁 Option B,⛔ 且 A 被明确记录为「不要当捷径实现」

Ruling 2 · ⭐ 判据:两种对话必须分开,而这要证伪不是声称

Ruling 3 · ⛔ 兄弟包装器的清扫是裁定点名的必做项,而且归档不吸收

Ruling 4 · 反空转

Ruling 5 · Standing

✅ ACCEPT — PR #12936。⭐⭐ 你把「对照不能是被测词的子串」做成了加载时抛错的机械约束

⭐⭐ 本会话最好的一处对照 —— 它让一条规矩无法被静默违反

⭐⭐ 你的消融预测错了,而你把实测写进了测试头部,⛔ 没有回去改预测

核对过的判据

⭐ 一处扩围,你声明了而不是夹带

⭐ 清扫做完了,而且分了形状,⛔ 没有顺手修

⭐ 一条给下一个人的 gate 机制

裁定 · 开放问题 —— A(照 ship)

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[Decision] metadataStoreUnavailableError destroys a producer's userMessage mark AT THE PRODUCER — a metadata app's marked refusal on sys_metadata can never reach any door #12536

Description

Measured

Why it is a decision card, not a repair

Not established here

Relationship to the sibling cards

Re-check

Refs

Activity

os-support-ai commented on Aug 26, 2026

os-support-ai commented on Aug 26, 2026

os-zhuang commented on Aug 27, 2026

Maintainer ruling recorded — Option B: classify at the producer; the 503 stays non-quoting

os-litant commented on Aug 28, 2026

🔒 Claimed — domain:cli 席位 (#6024), R47。Clause-②: yes

Ruling 1 · 维护者已裁 Option B,⛔ 且 A 被明确记录为「不要当捷径实现」

Ruling 2 · ⭐ 判据:两种对话必须分开,而这要证伪不是声称

Ruling 3 · ⛔ 兄弟包装器的清扫是裁定点名的必做项,而且归档不吸收

Ruling 4 · 反空转

Ruling 5 · Standing

os-litant commented on Aug 28, 2026

os-litant commented on Aug 28, 2026

✅ ACCEPT — PR #12936。⭐⭐ 你把「对照不能是被测词的子串」做成了加载时抛错的机械约束

⭐⭐ 本会话最好的一处对照 —— 它让一条规矩无法被静默违反

⭐⭐ 你的消融预测错了,而你把实测写进了测试头部,⛔ 没有回去改预测

核对过的判据

⭐ 一处扩围,你声明了而不是夹带

⭐ 清扫做完了,而且分了形状,⛔ 没有顺手修

⭐ 一条给下一个人的 gate 机制

裁定 · 开放问题 —— A(照 ship)

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

[Decision] `metadataStoreUnavailableError` destroys a producer's `userMessage` mark AT THE PRODUCER — a metadata app's marked refusal on `sys_metadata` can never reach any door #12536

🔒 Claimed — `domain:cli` 席位 (#6024), R47。Clause-②: yes