[PM seat] domain:metadata — 🟢 os-zhuang

[hotlong]

本贴是 domain:metadata 座位的唯一权威登记。 座位贴协议:索引 = label:pm:seat,总入口 #4604(指针页)。本席由维护者 2026-08-07 批准自 domain:engine-core 拆出(拆域 SKILL PR #6370)。

单写手规则:只有在任座位 PM 编辑本贴正文;接管/移交 = 改正文 + 一条审计评论。空缺争用:动手前重拉正文、审计评论时间戳先到先得、写后回读。活性判定(惰性,无心跳,仅接管冲突时评估):>24h 无产出即可回收。

范围

engine 的元数据半边,按包边界切(Anchoring rule 原样适用):

• packages/metadata*(metadata service / registry / directory 机制)
• packages/platform-objects(内置平台对象定义)

红线:

• ⛔ 改变元数据格式/接受面的改动归 domain:spec(先例 meta: bind Zod schemas for webhook / connector / sharing_rule WITHOUT registering the kinds — close the unvalidated PUT /meta write hole (#2657 audit, option A) #6245/feat(spec): action param 的 options[] 声明逐选项 visibleWhen (#5016) #6235)。
• ⛔ ObjectQL 编译/查询执行、formula、core runtime 归 domain:engine-core(母席)。
• ⛔ /meta HTTP 路由本体在 packages/rest,归 domain:cli;跨半边按主要落点判,拿不准 FLAG 回分诊。
• ⛔ content/docs/releases/ 恒不许碰。

卡点自报信号(座位职责)

1. 队列水位:连续 3 天 >15 张、或平均滞留 >48h → 提频/加 batch/继续拆域;
2. 与 engine-core 跨界卡连续出现 → 回分诊重划边界;
3. 分诊脉冲(单次灌入 20+)→ 一次性 sweep 专项吃掉。

当前 PM(会话或 Routine ID)

• GitHub: os-zhuang
• Session: session_01W6bLax4KMrSfnE1ydFU8Dw
• Seated: 2026-08-08T08:35Z — via maintainer invocation /pm-dispatch metadata
• 姿态: 待命(2026-08-09T01:2xZ 起车道全清:在飞 0、可派 0;巡逻续跑,新供给/裁决即重启派发)
• 批次上限:5(维护者 2026-08-08 指令)。
• protocol.ts 并行授权:维护者 2026-08-08 显式授权区域不相交并行作者;落地端逐张串行;同函数/同区域恒不同批。
• 前任:GitHub baozhoutao,会话 session_01KDU3qAuJyajAQm3GkUXdfA,任期至 2026-08-08T08:2xZ(计划性收官)。

说明 —— 台账(os-zhuang 任期,01:2xZ 二次全清)

已 MERGED(18 卡 18 PR,零返工零升级)

卡	PR	commit
#6563 交接项	#6642	e6025e9
#6417 NULL-safe 视图索引	#6666	bb7cb417c
#5079 删除后三面陈旧	#6687	114e72795
#6036 死选项 runtime	#6700	61282f906
#6285 发布期护栏	#6708	a5d25734c
#6479 PATCH 路径 id(v17)	#6709	252f71bd6
#6620 软删限支意图(v17)	#6768	75e6871bf
#6660 死翻译键 ×14	#6767	d42a92fc6
#6418 probe-first 移植	#6770	bed427f7e
#6602 org 泄漏收口(v17)	#6779	4bb6f01af
#6659 SSO 四语标签	#6787	e78760861
#6621 revert 刷新 registry(v17)	#6807	271cee131
#6562 effective schema 读(Option B)	#6811	5e247fd6b
#6772 probe SQL PG 合法性	#6817	50a8d115a
#6640 preserveAudit UPDATE-only + 响亮拒绝(裁决 Option 2)	#6823	2ab1257c9
#6771 overlay 索引单一生产者(major,ADR-0087 marker)	#6824	9960cd2a0
#6780 org-gated registry heal(方向 b,v17)	#6826	725c7b023
#6699 classifyIndexFailure 错误对象穿线(#6250 家族第五词表)	#6845	53aeb027f

v17 板本任期已摘 6 张;revertCommit 三部曲(#6563/#6620/#6621)全落。

在飞

零。 二次全清(首次 20:35Z,本次 01:2xZ)。

队列与供给(4 张持卡,全部有明确等待项;可派 0)

• api 注册表条目声明 allowRuntimeCreate: true,但运行时创建的端点匹配器永远看不见 —— 声明的能力运行时不兑现(真实 boot 实测) #5488(v17):裁决已落(Option B),等分诊席对不可拆跨域卡落车道指定(前任 2026-08-08T03:58Z 的申请,建议 spec 席)→ 指定未落,持卡不动。
• IMetadataService.list() presents a known-partial answer as a complete one — the #5840 shape on the plural read #6504:Option A 已裁,契约行等分诊拆转 spec 席后本席接实现半边。
• [P2] 运行时授权门扩到 object 写入 + 全量 runtime-safe 规则快照(#4463 P1 之后) #4716/[P2/P3] 运行时授权门的 advisory findings 要进响应并被 Studio 渲染 + docs「the gate」补第四列(#4463 收尾) #4717:gate 后继,前提押在 #4463 运行时发布门在 host-config 拓扑(environmentId 未绑定)上整体不跑——#5086 只把 code-only 拒绝移出了同一条短路 #6710 裁决上;[P2/P3] 运行时授权门的 advisory findings 要进响应并被 Studio 渲染 + docs「the gate」补第四列(#4463 收尾) #4717 另需分诊拆分。
• org 作用域的 flow overlay 只在「本进程内发布后」绑定触发器,重启后静默失绑——冷启动两条读路径都把 organization_id 非空的行滤掉了 #6190(v17):已裁并入队,现已 assign(17:17Z 尚有活动)+ Blocked-by: #6191,非本席可派;巡逻跟踪解锁与认领活性。
• 供给候选(findings 等分诊晋级):[docs] ADR-0005 的「Index migration」段落描述的是已不存在的机制：addSysMetadataOverlayIndex 已随 #6771 删除，段落还写着 project_id 与 partial 键 #6825、docs: state-machine.mdx 仍称 preserveAudit 的 readonly 白名单让 upsert「不再静默丢弃」—— create 半边不成立（#6640 收窄后的残留） #6827、[finding] classifyIndexFailure's dialect arm reads only the OUTER message — a wrapped dialect refusal loses the unsupported verdict, and with it overlay-index's fallback index #6848;A deleted runtime object is still served by SchemaRegistry.getObject — the registry heal reaches the metadata map but never objectContributors #6808(已由 engine-core 席落地 PR fix(objectql): deleting an object really unregisters it — a name-addressed SchemaRegistry.unregisterObject (#6808) #6818 47a4e676)/meta: applySystemFields stamps indexed on organization_id — a key FieldSchema rejects by name, so every registry-backed object read answers _diagnostics: { valid: false } #6810 归 engine-core 席。

决策箱(维护者)

卡	状态
#6710(v17)	本席唯一决策箱卡 —— carve-out 表达方式 A1/A2/A3,荐 A1(卡上 23:40Z PM 评论;boot 级前提已证实,Option A 撞派发令 STOP)

旧读数更正存档(00:4xZ 回源):#6190 已裁并入队;#6603 已改判 domain:cli —— 均已移出决策箱。

跨车道备忘

• spec-surface 席([PM seat] domain:spec-surface — 🟢 os-project-manager #6298):[观察] stripReadonlyForInsert 完全不读 preserveAudit —— readonly 的历史导入豁免在 INSERT 侧是 declared ≠ enforced #6640 的 .describe() 收窄知会已发,veto 窗口随 PR fix(metadata-protocol,spec): preserveAudit is UPDATE-only — narrow the contract and warn loudly on a non-system INSERT (#6640) #6823 合并平静关闭。
• engine-core 席([PM seat] domain:engine-core — 🟢 os-zhuang #6019,暂停中):fix(metadata-protocol): a /meta object read serves the effective runtime schema, whichever layer answered (#6562) #6811 搬迁知会 default-if-silent 已落地;PR fix(metadata-protocol): an org-scoped DELETE no longer evicts the env-wide registry entry (#6780) #6826 扩展了 packages/objectql 的 An org-scoped overlay row reaches the process-wide SchemaRegistry on unscoped kernels — both the write-through and the read hydration gate only on environmentId, never on org #6602 pin 文件(test-only);其 A deleted runtime object is still served by SchemaRegistry.getObject — the registry heal reaches the metadata map but never objectContributors #6808/PR fix(objectql): deleting an object really unregisters it — a name-addressed SchemaRegistry.unregisterObject (#6808) #6818(47a4e676)触及 restoreArtifactRegistryView tier-3 分支,与本席 An org-scoped metadata DELETE evicts the ENV-WIDE registry entry for every org — restoreArtifactRegistryView is (type, name)-addressed and org-blind #6780 的 org 门共存已由 CI 验证 —— 后续本席动该函数时 base 须 ≥ 47a4e676。
• cli 席 @objectstack/client 的 packages.* 与 datasources.external.* 无法跟随非默认 API base:external 面硬编码 /api/v1,rest 面 discovery 也从不通告 routes.packages #6633 闭环;finding: after ADR-0106, a restricted caller's GET → edit → PUT of an object schema DELETES the fields that were masked out of their read #6603 现属 cli 车道(v17);os-dev 模型已 fix(agents): 把 os-dev 的模型钉死为 opus,不再继承 PM 会话模型 (#6686) #6688 钉死 opus。

运维注记(本任期实测,交接必读)

1. flip 定点 6-9 分钟核 job 结论;auto-merge 首挂可能静默失效(fix(objectql,metadata-protocol): a deleted runtime-created overlay leaves the registry, so list/get/dispatch agree (#5079) #6687)—— 落地双读数是唯一抓手;读 main 窗口宁大勿小(fix(metadata-protocol): PATCH /data/:object/:id binds the PATH row, not the body's id (#6479) #6709 grep ≥40;fix(metadata-protocol): classify a failed index build from the ERROR, not its message (#6699) #6845 落地读数 perPage=5 差点漏,扩到 10 才见)。
2. 台账读数会过期([metadata-core] sys_view_definition 的"活跃行唯一"从未生效——归档视图仍占用 (name, organization_id, owner) 名额 #5839,org 作用域的 flow overlay 只在「本进程内发布后」绑定触发器,重启后静默失绑——冷启动两条读路径都把 organization_id 非空的行滤掉了 #6190/finding: after ADR-0106, a restricted caller's GET → edit → PUT of an object schema DELETES the fields that were masked out of their read #6603 再证):跨席/决策箱条目消费前必须回源核实。
3. session limit 灭批 ×3(共 11 人次):SendMessage 复活 = resume from transcript 零丢失;按名字不可达时用 spawn 返回的 agentId 直发(实测五发五中)。复活消息按「幂等 + 判据」写。
4. worktree footgun ×2:git checkout <分支> -- <文件> 首提交前静默回退 —— 派发令带警示行;建议进 os-dev 定义(任期复盘项)。
5. 派发令三分区(裁决/机制假设/标准条款)+ 后继定价必答项:19 单 19 中(18 落地 + 1 needs_decision 按 STOP 设计出口)零返工。文件锚点会漂移([finding] classifyIndexFailure is a FIFTH private unique-violation vocabulary, missed by #6250's inventory — and it reads only the message channel #6699 经 [metadata-protocol] ensureOverlayIndex 先 DROP 后 CREATE：partial 索引建失败时 sys_metadata 会静默地失去覆盖层唯一约束 #6418 搬家)—— 派发令锚定函数名而非行号,前提保鲜必查新地址。
6. 开发产出的 PR body 必须英文 —— fix(metadata-protocol): an org-scoped DELETE no longer evicts the env-wide registry entry (#6780) #6826 中文 body 由 PM 改写;Round-5 起写进派发令(fix(metadata-protocol): classify a failed index build from the ERROR, not its message (#6699) #6845 已英文)。
7. SKILL 复盘:前任 [skill] pm-dispatch: 5 lessons from the domain:metadata seat's first term (8 cards MERGED / 0 rework / 4 dev-side falsifications) #6644;本任期复盘立卡安排在座位移交时(待命≠移交)。

定时器:巡逻链 send_later(现役 trig_01Ti2GeogQttkBh95rffjQRC @ 2026-08-09T02:02Z;待命期后续可放宽 60-70 分钟);旧钟均已 spent。

[baozhoutao]

Seat takeover: domain:metadata.

• GitHub account: baozhoutao
• Session: session_01KDU3qAuJyajAQm3GkUXdfA
• Seated via: maintainer invocation /pm-dispatch metadata (seat was listed ⏳ vacant, awaiting maintainer assignment per the sticker body)
• Same-stroke updates (three-element pairing): title → [PM seat] domain:metadata — 🟢 baozhoutao, assignee → baozhoutao, body "当前 PM" section updated. Body is authoritative.

Posture on arrival: per the sticker body, this seat does not dispatch until the inventory migration (triage seat's MOVE/STAY/FLAG audit out of domain:engine-core) is recorded complete. I will verify migration state next; until it is complete this seat runs standby duties only (queue watch, blocked-unlock sweep, no claims, no dispatches).

---

Generated by Claude Code