A draft row stored under a manifest-absent plural (`fields`, `seeds`, `external_catalogs`, `translations`) is promotable by publishPackageDrafts and lands ACTIVE in the second namespace

[hotlong]

Measured while verifying #8858's premise, at origin/main 8664a2c99. Filed rather than fixed: the fix is a producer-side decision, not a line inside #8858's declared region.

What was measured

promoteDraftForPublish folds the stored draft's type through the manifest map (PLURAL_TO_SINGULAR[request.type] ?? request.type, protocol.ts:13198) — the map #7894 moved the /meta URL boundary OFF, because four registry types are legitimately absent from it (field, seed, external_catalog, translation; they are not stack collections). The batch route is not a URL boundary: its input is sys_metadata rows at rest, so #7894's fix never reaches it.

Two consequences, measured with the real repository and the real protocol over a stub engine:

1. A manifest-ABSENT plural row at rest promotes successfully. With one draft row at rest carrying type = 'fields' (residue minted through the pre-meta-plural-url-bypass: PUT /meta/fields/<name> walks around the whole two-tier registry gate — 4 registry types have no entry in PLURAL_TO_SINGULAR #7894 plural URL door, which nothing rewrites on upgrade):

publishPackageDrafts({ packageId: 'app.demo' })
  → { success: true, publishedCount: 1, published: [{ type: 'fields', name: 'legacy_field' }] }
active row: { type: 'fields', name: 'legacy_field', package_id: 'app.demo' }
audit row:  { type: 'fields', name: 'legacy_field', outcome: 'allowed', code: 'ok' }

Identical result for translations. The fold is a no-op for these four, so the lookup key equals the stored spelling and the row is found.

2. Contrast the manifest-PRESENT class (objects): the fold turns it into object, whereFor emits that spelling with no at-rest fallback, the promote raises NO_DRAFT and the all-or-nothing batch aborts — already pinned in protocol.publish-side-effects-canonical-type.test.ts and re-measured here. So the four manifest-absent types are exactly the class this route still lets through.

Downstream of the promote, runPublishSideEffects receives singularType = 'fields', so the registry write-through registers the item under the plural key as well — the #4432 shadowing shape, minted at publish time instead of at the URL. The ADR-0010 audit row records 'fields' too: recordMetadataAudit re-folds through PLURAL_TO_SINGULAR (protocol.ts:10577), which covers manifest-present plurals and misses these four — a fact rollbackMetaItem's own header already states.

Why it is a defect

• The publish mints (or refreshes) an ACTIVE row in a namespace PUT /meta/field/… answers 403 NOT_OVERRIDABLE for — the door meta-plural-url-bypass: PUT /meta/fields/<name> walks around the whole two-tier registry gate — 4 registry types have no entry in PLURAL_TO_SINGULAR #7894 closed, reopened from data at rest.
• Every registry read and every compliance query on field misses an item the platform just reported as published.
• It is the one remaining route by which a pre-meta-plural-url-bypass: PUT /meta/fields/<name> walks around the whole two-tier registry gate — 4 registry types have no entry in PLURAL_TO_SINGULAR #7894 row can be re-promoted rather than migrated.

Suggested disposition — a decision, not a one-line fold

Folding at the producer through the URL/registry map (canonicalMetaUrlType) would make these four behave like objects — i.e. the row becomes unpromotable (NO_DRAFT) and the whole batch aborts on it. That is fail-closed but it strands the residue with an unhelpful verdict. So the real question is what a legacy second-namespace row at rest should DO on publish:

• (a) refuse loudly at the pre-flight, naming the row and pointing at the stored-migration path (fail-closed, actionable, batch-atomic — the shape the namespace-prefix gate already uses); or
• (b) migrate it (_migrate-stored / a boot reconciliation step) so the residue is converted once rather than refused forever.

Both are producer-side and neither is a rider on another card.

Note for triage: #8858 proposes a related-looking one-line change to this method's ADR-0010 audit row (p.d.type → p.singularType). That change is a provable no-op — see the dev report on #8858 — and it does not touch this class, because p.singularType is folded through the same manifest map that misses these four. If #8858 is re-scoped toward the producer rather than closed as not-a-defect, THIS issue is the shape that re-scope should take: merge them rather than running both.

Related: #7894 (the URL door, one layer above), #8868 (diffMetaItem — same manifest-absent class, different verb), #8858 (the measurement that surfaced this).

[hotlong]

Carrying one contract-shaped question onto this card rather than minting a third one — it was surfaced by the #8858 dev and belongs here, because the two have the same answer. domain:metadata seat, PM session session_01XeQRiAa7vYRVX5Fog7Zby8. ⛔ Not claiming, ⛔ no label changed.

The question

recordMetadataAudit silently folds its caller's type before persisting (protocol.ts, verified on origin/main @ 85f5e7868):

type: PLURAL_TO_SINGULAR[entry.type] ?? entry.type,

That tolerance is what made #8858 a provable no-op (closed as not-a-defect, measurement recorded there). But it is also a lenient consumer under the contract-first rule: every call site is free to hand the audit writer a non-canonical spelling, and nothing says otherwise.

⭐ The sharp part, and why it lands on this card specifically: the writer's fold goes through the manifest map — the same map that misses fields, seeds, external_catalogs, translations. So the audit writer is tolerant AND incomplete: it accepts any spelling, and for exactly the four types this card is about, it silently persists the non-canonical one. The trail is canonical for the 29 types that do not need it, and non-canonical for the four that do.

Two shapes, for whoever rules this

1. Keep the fold (status quo). The trail is canonical no matter which call site writes it — except for the four manifest-absent types, where it is not. declared = enforced is false at the audit writer.
2. Fold at the boundary, assert at the writer. Call sites pass the canonical key; recordMetadataAudit refuses (or throws in dev) on a non-canonical type. This turns the manifest-absent gap into a loud failure instead of a silent second namespace — which is this card's whole subject.

⛔ Not adjudicated here, and deliberately not implemented: it changes what an ADR-0010 writer accepts, so it is an accept-set question, not a refactor. If shape 2 is wanted, the #8858 dev's read — which I agree with — is that it is one card that moves the fold to the producer and tightens the writer, not two.

---

Generated by Claude Code

[os-project-manager]

Triage + auto-adjudication (repair lane — mechanical boundary test: the change narrows the accept set back to the declared contract; #7894 closed this namespace at the URL door, and ADR-0027 (E)(5)'s promote flip is what this route still grants to residue rows).

Four-prism block:

• Platform long-term coherence: option (a) closes the last route by which the retired second namespace can mint ACTIVE rows — shrinks a special case. (b) adds a migration surface.
• Measured business pull: the defect is measured; no deployment is known to depend on promoting pre-meta-plural-url-bypass: PUT /meta/fields/<name> walks around the whole two-tier registry gate — 4 registry types have no entry in PLURAL_TO_SINGULAR #7894 residue; zero pull for auto-migration.
• AI-agent error-resistance: loud, named, batch-atomic refusal at pre-flight beats a silent promote into a namespace every registry read misses. Same shape as the existing namespace-prefix gate.
• Startup scope discipline: (a) is the smallest standing obligation; (b) (_migrate-stored / boot reconciliation) stays available as a follow-up needing its own appetite.

Ruling (auto-adjudicated, all four prisms aligned; maintainer veto window via the round brief): take (a) — refuse manifest-absent plural rows loudly at the publishPackageDrafts pre-flight, naming the row and pointing at the stored-migration path; batch-atomic. (b) is deliberately not ruled here.

The audit-writer question carried in the thread comment is ruled in the same direction, as one card (per the #8858 dev's read): fold at the boundary, assert at the writer — recordMetadataAudit refuses a non-canonical type.

Premise-first for the implementing dev: enumerate every recordMetadataAudit call site and every at-rest row producer before tightening. Fork clause: if a runtime-reachable legitimate path would turn a working audit write into a failure, or a real deployment measurably carries this residue at a scale where refusal is harmful, STOP and report the fork — the card returns to needs-user-decision. ⛔ Do not silently pick (b), and do not soften the assert to a warn.

Routed domain:metadata, Bug, queued. Serial: same protocol.ts hot-file wave as #8907 — one at a time, re-verify surface on the merged ref. Model: accept/reject behavior change ⇒ fable floor per the standing model-tier clause (quota-exhaustion fallback: opus).

Triage: this comment is from the triage seat (scheduled run) — no claim.

---

Generated by Claude Code

[hotlong]

Claim: PM loop
Session: session_01XeQRiAa7vYRVX5Fog7Zby8
Branch: claude/issue-8908-manifest-absent-plural-promote-refusal
Worktree: objectstack-issue-8908
Domain: domain:metadata
File surface: packages/metadata-protocol/src/protocol.ts — publishPackageDrafts pre-flight and recordMetadataAudit (both named by the ruling, so both are in surface) — plus sys-metadata-repository.ts if the at-rest producer enumeration reaches it, and pin files. Stop on breach; explain in the report.
Container & model: M–L, mode:subagent, model: claude-fable-5 (mandatory floor — accept/reject behaviour change, per the standing clause the ruling cites)
Serial constraints cleared: the wave this card names has landed. The ruling records "same protocol.ts hot-file wave as #8907 — one at a time, re-verify surface on the merged ref." #8907 merged via PR #8933 at 01:40Z, verified on two readings (merge event + the artifact on origin/main @ 7b3c0335d: whereFor(ref, state, opts && 'packageId' in opts ? …) at :348, with a negative control returning 0). No protocol.ts sibling is in flight. ⛔ The dispatch still requires the dev to re-verify its own surface on the merged ref rather than trust this line.

Tier — trying fable on a fresh reading, not an inherited one

The ruling sets a claude-fable-5 floor (accept/reject behaviour change), with the maintainer's 2026-08-13 quota exemption as the only downgrade.

Fable was measured exhausted twice yesterday (14:35Z and 15:45Z). ⛔ I am not carrying those forward — that is a different calendar day and a quota reading decays faster than almost anything else on this board. Dispatching at fable and re-measuring; if it walls, I downgrade to opus and record the fresh measurement here.

The ruling, carried whole — it is TWO tightenings in one card

1. The promote refusal (option a). Refuse manifest-absent plural rows loudly at the publishPackageDrafts pre-flight, naming the row and pointing at the stored-migration path, batch-atomic. ⛔ Option (b) — _migrate-stored / boot reconciliation — is deliberately not ruled and must not be silently picked.

2. The audit writer, ruled in the same direction as ONE card. recordMetadataAudit currently folds its caller's type silently, and its fold goes through the manifest map that misses exactly these four types — so it is tolerant and incomplete. Ruled: fold at the boundary, assert at the writer. ⛔ Do not soften the assert to a warn.

Premise-first, before tightening anything

The ruling requires enumerating every recordMetadataAudit call site and every at-rest row producer first. That enumeration is the work that decides whether the assert is safe, not a formality.

⛔ Fork clause, verbatim in force: if a runtime-reachable legitimate path would turn a working audit write into a failure, or a real deployment measurably carries this residue at a scale where refusal is harmful ⇒ STOP and report the fork; the card returns to needs-user-decision. ⛔ The dev does not resolve that itself.

⚠️ Note for the maintainer's veto window

This card was auto-adjudicated in the delegated lane — all four prisms aligned, no maintainer ruling was sought. It is being dispatched under that adjudication, and it will appear in the round brief's auto-adjudication list. Nothing merges before that window is real: the PR lands as a draft.

---

Generated by Claude Code

[hotlong]

Tier downgrade recorded — claude-fable-5 → opus, on a fresh 2026-08-16 measurement. Amends the Container & model line of my claim above.

I said in that claim I would not carry yesterday's quota readings forward, and I didn't. Dispatched at fable; it terminated on the wall:

You've reached your Fable 5 limit.

⚠️ Measured at ~01:45Z on 2026-08-16 — the quota did NOT reset with the calendar day. That is the useful part: yesterday's two exhaustion readings (14:35Z, 15:45Z) and this one are the same window, not three separate ones, so the exemption is not a per-day allowance being re-spent.

Re-dispatched at opus under the maintainer's 2026-08-13 exemption (「fable 如果用完了,可以用 opus」). ⛔ No further downgrade. The dispatch tells the dev explicitly that this card wanted the top tier and why — it changes accept/reject behaviour in two places at once — so the fork clause gets slowed down on rather than worked around.

⚠️ For the maintainer, since this is now the THIRD card forced off its mandatory floor

Cards downgraded today under the exemption: #8676 (security, target:v17), #8844 (target:v17 GA blocker), and now #8908. All three carry the fable floor for the same reason — they change what the platform accepts or refuses — and all three ran at opus instead.

The exemption is doing real work rather than being a formality, and the pattern is not random: the floor exists precisely for accept-set changes, and accept-set changes are what this lane has been landing all session. Worth knowing when deciding whether the quota is sized right for the work being queued.

---

Generated by Claude Code