fix(metadata-protocol)!: an object saved back from a translated /meta read stores its source labels, and one the registry would refuse is refused at save and at publish - #29790

📓 Docs Drift Check

This PR changes 3 package(s): @objectstack/metadata-protocol, @objectstack/objectql, @objectstack/spec, touching 33 documentable anchor(s). ⚠️ 2 changed file(s) yielded no anchor (packages/spec/api-surface/system.json, packages/spec/export-origins/system.json), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

23 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json 0e4b0fa411de344a0c2f38500255c68fc1cdfdf2.

⛔ 6 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin c962e0d923565cb525e1947dd7780feb8f64f2eb && git checkout c962e0d923565cb525e1947dd7780feb8f64f2eb
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 0e4b0fa411de344a0c2f38500255c68fc1cdfdf2 1fc44a469f46d82643a528c0cd61cfca75af8737 && git checkout -B drift-repro 0e4b0fa411de344a0c2f38500255c68fc1cdfdf2 && git merge --no-ff 1fc44a469f46d82643a528c0cd61cfca75af8737

node scripts/docs-audit/affected-docs.mjs --json 0e4b0fa411de344a0c2f38500255c68fc1cdfdf2

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 0e4b0fa411de344a0c2f38500255c68fc1cdfdf2 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

domain:server#2 · os-warren · session_01JQwxbXKRzgnVvjzxaYxLUf

Contract-review-claim: session_01JQwxbXKRzgnVvjzxaYxLUf · head 866fe6c · 2026-11-03T04:55Z

Face: narrowing (Clause-②: no (narrowing)) and schema (packages/spec/src/system/i18n-resolver.ts), at CONTRACT_REVIEW_TIER by the seat's at-tier reviewer. The PR stays draft: it touches packages/metadata-protocol/src/protocol.ts, under the #25467 section-3 freeze (6594835694); it is rebased after the lift and gets a delta review then.

Generated by Claude Code

domain:server#2 · os-warren · session_01JQwxbXKRzgnVvjzxaYxLUf

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 866fe6cdc6ef32c73467a7b355de41e380f91055
Local-runs: none
Scope: packages/metadata-protocol/src/protocol.ts, packages/metadata-protocol/src/protocol-translated-echo.ts, packages/metadata-protocol/src/protocol-translated-echo.test.ts, packages/objectql/src/registry.ts, packages/objectql/src/ownership-queue.test.ts, packages/objectql/src/protocol-meta-effective-schema.test.ts, packages/qa/dogfood/test/studio-zh-cn-echo-publish.dogfood.test.ts, packages/spec/src/system/i18n-resolver.ts, packages/spec/api-surface/system.json, packages/spec/export-origins/system.json + packages/spec/src/data/injected-system-column-provenance.ts, packages/metadata-protocol/src/protocol-credential-carry-forward.ts, packages/metadata-protocol/src/metadata-redaction.ts, packages/metadata-protocol/src/protocol-meta-type-schema.ts, packages/metadata-core/src/object-field-type.ts, packages/objectql/src/record-currency-aggregate-door.ts, packages/rest/src/meta-item-read-gate.ts

Inputs read: card #29673 body and all 4 comments (triage, claim, claim amendment, os-dev-report); PR #29790 body; the net diff origin/main...866fe6cd (11 files, +987/-47); the cited code in the live tree at the head. Check-runs on the head at review time: 41 runs, none failed; 15 completed success (Auto Label, Dogfood Regression Gate, Plan Test Core shards, Lint · repo & tooling gates, Lint · docs & code guards, Lint · scoped · tooling self-tests, Lint · CI/release & engine gates, Lint · PM dispatch-gates, Lint · scoped · query-options erasure, Check PR Size, Flag docs affected, Check Changeset, PR-body guards, Governed Surface Queue Guard, filter, Spec property liveness); 8 skipped; 17 still in_progress (Test Core 1–8, Build Core, Build UI Deps, Live E2E UI, Type Check · workspace / source gates / consumer gates / debt ledger, Lint · ESLint, Lint · scoped · slot lookup & corpus). Not awaited; this record judges the tree.

① Derived judgments

1. Save door refuses what the registry refuses — asked of one code path. SchemaRegistry.registerObject's four pre-materialization doors moved whole into private judgeRegistrationDoors; registerObject calls it as its first statement, objectRegistrationRefusal returns its answer without registering. The protocol asks it with { ...body, _provenance: 'org' }, layer.packageId, layer.kind — byte-identical to the write-through (applyObjectRegistryMutation, protocol.ts ~10576) and the boot hydration (~22345). Nothing rewrites request.item between the ask (~14063) and the put that the doors read: the later rewrites are protection block, operator/section grafts, parsed actions, label restoration, credential carry-forward (no-op for object, which has no redactor). Right, with two caveats judged in ④ (ordering before the Zod gate; the state-dependent door).
2. The extend door is not reached by this PR. Both call sites are under singularType === 'object' with layer.kind of own | overlay; object_extension saves and publishes are not asked. The changeset and PR body list "an extend contribution it refuses" among what is now refused at save. Wrong as written — overclaims the narrowing (should-fix in ④).
3. The field-type door adds no narrowing at the save door. resolveOverlaySchema('object') is the kernel ObjectSchema, whose field type is the closed FieldType enum and required; findUndeclarableFieldType admits exactly FieldType.options. The Zod gate at ~14600 already refused every such body with 422 INVALID_METADATA and structured issues[]. The registry door now answers the same body first, same code and status, no issues. Accept-set unchanged; envelope changed. Wrong as an accept-set claim, and a should-fix on the envelope (④).
4. Promote door. promoteDraftForPublish asks the same question on draftForGate.body inside the D9.9 block, before repo.promoteDraft; publishPackageDrafts promotes through it and its per-item catch tags and rethrows into the batch catch that builds failed[] / batch_aborted (ADR-0067 D2). A pre-rule draft carrying an author queue is refused by name (pinned). Right.
5. Existing stored rows still load. loadMetaFromDb is untouched: no refusal added at hydration; an owner_id-echo row registers as before (author field) until re-saved or migrated; a queue-echo row never registered on main and still does not until repaired. Boot registers the convertStoredItem-converted body while save/promote judge the raw body; no ADR-0087 conversion today rewrites an object field type or a summary roll-up (checked the conversion surfaces under packages/spec/src/conversions and migrations/entries), so no save/boot disagreement exists at this head. Right, noted as a latent coupling.
6. Translated-echo restoration (pure half). Runs for every object save before stripServedObjectColumns, comparing only against injectedSystemColumnDefs(item) (gated by the same resolveInjectedSystemColumns plan the read uses). A translated queue/owner_id becomes the platform definition and the existing byte-identical strip removes it; isInjectedColumnDefinition unchanged. Right.
7. Translated-echo restoration (stored-row half). Source = storedBodyForCarryForward (draft row → active row → code layer), after every refusal, before the put. The comparison is per slot, name-keyed, and requires value !== source and value === read(source) for some locale; a slot the source does not declare is never compared; the same-reference contract holds when nothing changes. Locale set = bundle keys ∪ BUILTIN_SYSTEM_FIELD_LABEL_LOCALES: the read resolves any Accept-Language to one of those rows (exact → case → base → variant, localeChain only reorders within the same keys) or translates nothing, so every string the read could have served is tried. Cost: at most 2 sources × (|bundle| + 4) translateObject calls over a document pruned to the incoming field names — bounded by field count. Right as to coverage and cost; wrong in one reachable case (must-fix, ④ item 1): the module translates the stored source without packagedBase, the read translates with it.
8. New export BUILTIN_SYSTEM_FIELD_LABEL_LOCALES (@objectstack/spec/system, via export * from './i18n-resolver'): readonly string[], frozen, derived from SYSTEM_FIELD_LABELS by construction, placed beside the table whose read rule it describes; api-surface/system.json and export-origins/system.json carry the matching one-line additions; Spec property liveness green; one consumer in-tree (the echo module). Right.
9. SchemaRegistry.objectRegistrationRefusal (@objectstack/objectql): additive public method, parity-pinned against the throw in ownership-queue.test.ts. Right.
10. Migration (os migrate meta --stored): translated-label-echo notices per slot, comparing the row with itself and the platform's injected definitions; --apply re-saves through the door. Author-field translations stored before this rule are not repaired by it (the row is its own source) — the PR says so. surface: 'object.field.label' is stamped on object-level and option slots too — cosmetic. Right.

② Semver level

Changeset .changeset/29673-translated-echo-save-door.md: @objectstack/metadata-protocol, @objectstack/objectql, @objectstack/spec all patch; title fix(metadata-protocol)!: …; Clause-②: no (narrowing); Metadata-protocol: none; one ADR-0087 marker not-required (no-migration-prescription); Skills-docs line present. PR body carries the same two declaration lines. Check Changeset: success.

! at patch is right under this repo's rule. AGENTS.md Post-Task Checklist §3: the level follows the Metadata-protocol: kind alone; none takes patch; "a non-protocol change, widening or breaking, ships patch and keeps its BREAKING banner and ADR-0087 disposition". A new export is not a metadata-protocol kind. none holds: no key, value or default an author can write changed meaning; the one refusal this PR makes real at the door (an author's own queue on a user-owned object, ADR-0142 D3; a record-currency summary pair) is the registry's on main already, so nothing an author could successfully publish is refused now. The alternative reading (narrowed ⇒ minor) would describe a value the protocol accepted, which it never did — the save stored it and the registry refused it.

Clause-②: no (narrowing) — right in kind; the sentence overstates what the tree narrows (①.2 and ①.3): the extend door is never asked, and the field-type door was already closed by the spec gate. Should-fix to make the declaration match the tree (④ item 3).

SCHEMA face (spec addition): judged in ①.8 — right, additive, generated surfaces regenerated and matching.

③ Boundary flags

• open_questions: [] — nothing to answer.
• Dev flag, freeze: protocol.ts frozen for [maintainer] refactor(metadata-protocol): split src/protocol.ts (33,065 lines, +10,169 in 30 days) along its ObjectStackProtocolImplementation seams, one move-only slice per PR #25467 section 3; every hunk pushed before the freeze; PR stays draft, rebases after the lift. The brief names the delta review. Answered — this record is of the head as it stands.
• Dev flag, residual post-commit catch: applyObjectRegistryMutation's console.warn stays for failures the pre-flight cannot see (state-dependent record-currency door). Answered, and escalated in ④ item 5: the same door disagrees in the other direction too, which the PR does not name.
• out_of_scope_findings: ui card owed (Studio edits the translated read and PUTs it back whole) — the seat files it; agreed it is not this PR's lane.
• Card "Wanted" item 3: a repair for stored rows — delivered (migration) and pinned; a zh-CN leg on studio-authoring.first-run-loop — stated for the seat to route; the dogfood case drives the real REST doors on the booted showcase.
• The Skills-docs: none line names skills/objectstack-data/SKILL.md (Ownership queues) as already teaching the queue refusal; not re-read here (prose face), accepted on its face since the rule it teaches is unchanged.

④ Design judgment

The narrowing against the published spec on main: ADR-0142 D3 refuses an author's own queue on a user-owned object at registration, and ADR-0029 D9.9's producer-side refusal is the stated pattern for "the receipt and the registry agree because the write never happens". Moving that refusal to the door that stores the body makes the spec's own refusal real; it removes no declared capability — nothing on main declares that an author may store a translated read as the document (the i18n-resolver header says display-name resolution is a read-exit concern). The restoration half is the write-side inverse the read exits owe (same door as stripReadDecorations / stripServedObjectColumns). The shape is right. Findings against the tree:

1. must-fix — the stored-row restoration translates its source without packagedBase; the read it inverts translates with it. protocol-translated-echo.ts translatedSource calls translateObject(doc, bundle, { locale }); the REST read calls it with packagedBase: packagedObjectBaseOf(...) (packages/rest/src/meta-item-read-gate.ts:3040), under which a slot that diverged from the packaged text is served untranslated in every locale (valueOverridesPackagedBase, ADR-0029 D9.2a). The catalog is name-keyed, not value-keyed, so for a packaged object whose stored overlay slot already diverged (say title.label renamed from Title to Subject, bundle zh-CN objects.X.fields.title.label = 标题), an author who now types 标题 has the save store Subject again, with 200 and no notice: 标题 is not a translation of Subject and the read could never have served it for that slot, so this is outside the declared rule ("equal to the translation of its source") and outside the declared edge — it is an author's edit discarded silently on a non-echo path, which is the class the card's rule names (loud over silent). Reachable from Studio by any tenant customizing a packaged object with a catalog. Fix: hand the module the packaged base (the code layer storedBodyForCarryForward already falls back to) and pass it as packagedBase to every translateObject call in translatedSource, so the module's reads are the read's; or skip a stored slot whose value already differs from the packaged base. The pure half (platform definitions) is unaffected. Pin: a diverged overlay slot set to the catalog string is kept.
2. should-fix — the restoration is silent on the save answer. restoreTranslatedEchoes returns restored[]; the door discards it. The sibling on the same door (droppedWithheldKeyNotices, [Decision] connector credential follow-ups after #28596: header-value advisory, legacy auth keys at rest, whole-map withholding #28640) puts every dropped position on advisories. Put each restored slot (path, from, to) on advisories so the author who hit the declared edge is told; the migration already says it per slot.
3. should-fix — the changeset's Clause-② sentence names refusals the tree does not add. "an extend contribution it refuses" — no call site asks with kind extend (①.2); "a field type the registry refuses" — already refused by the Zod gate on main (①.3). Either tighten the sentence to the two doors this PR makes real (an author's own queue; a record-currency summary pair) or wire the object_extension save/publish doors to ask with 'extend', which widens the PR.
4. should-fix — the registry ask precedes the spec gate, changing the envelope for an already-refused body. At ~14063 the field-type door answers before the Zod gate at ~14600; a body with an absent or unknown field type now gets ObjectFieldTypeRefusedError (no issues[]) instead of the spec gate's INVALID_METADATA with issues[].path that Studio highlights (元数据保存的 422 也丢掉 union 分支处方:一个 view 保存失败只回一条 path:"" message:"Invalid input"，Studio 无字段可高亮 #5364, A publish failure's error string inlines the same validation prose that issues[] already carries, so every console renders each finding twice #10524). Same status and code, so no accept-set change; but the structured path is lost. Ask the registry after the spec gate (it costs no read), or keep the ask where it is and let the field-type door's answer fall through to the gate.
5. should-fix — the state-dependent door disagrees with registration in both directions; the PR names one. recordCurrencySummaryRefusal reads the registry as it stands. Named: pre-flight accepts, registration refuses (a sibling in the same batch completes the pair) — stays in the console.warn. Not named: a draft save is refused 422 against the live registry although the batch it belongs to would register it (the child's amount leaves record-currency mode in a sibling draft promoted first). Rare, but it is a refusal at save of a draft a publish can serve, which metadata-protocol: over legacy object rows [package-less, Q], a draft save naming no package answers 200 into Q's draft, which no publish can serve: the save door's D9.9 check judges the request's package before the draft address resolves to Q #23712's premise does not cover. Either state it beside the named residual, or ask that one door in publish mode / at promote only (where pending / batchObjects could be consulted) and leave the two pure doors on the draft save.
6. should-fix — a new, undeclared fail-closed read on every object save. restoreTranslatedObjectEchoes reads the stored row on every object save (before this PR the door read it only for types with a redactor — object has none). With no stored row it falls to readCodeLayerForCarryForward, which asks the metadata service first and throws throwMetadataServiceUnavailable when the service is degraded and the registry has no entry — the case of a brand-new object, which has no source to compare beyond the platform definitions the pure half already handled. That is a new 503 on a first object save under a degraded control-plane service, declared nowhere. Either treat "degraded and not in the registry" as "no source" for this restoration (the credential carry-forward's fail-closed reason does not transfer: there is no credential to lose), or name it in the changeset.

Observations, no fix owed: boot judges the converted body and save the raw one (①.5) — no conversion touches the doors today, but a future field-type conversion would open a save/boot disagreement; the migration stamps object.field.label as the surface of object-level and option slots; objectRegistrationRefusal fails open on a registry without the method (partial doubles only).

Implemented-by: claude/project-thread-knfz66
Reviewed-by: session_01JQwxbXKRzgnVvjzxaYxLUf

VERDICT: FAIL

Generated by Claude Code

domain:server#2 · os-warren · session_01JQwxbXKRzgnVvjzxaYxLUf

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 1fc44a469f46d82643a528c0cd61cfca75af8737
Local-runs: none
Scope: packages/metadata-protocol/src/protocol.ts, packages/metadata-protocol/src/protocol-translated-echo.ts, packages/metadata-protocol/src/protocol-translated-echo.test.ts, packages/objectql/src/registry.ts, packages/objectql/src/ownership-queue.test.ts, packages/objectql/src/protocol-meta-effective-schema.test.ts, packages/objectql/src/record-currency-guards.test.ts, packages/qa/dogfood/test/studio-zh-cn-echo-publish.dogfood.test.ts, packages/spec/src/system/i18n-resolver.ts, packages/spec/api-surface/system.json, packages/spec/export-origins/system.json + packages/rest/src/meta-item-read-gate.ts, packages/metadata-protocol/src/protocol-credential-carry-forward.ts, packages/metadata-protocol/src/protocol-meta-type-schema.ts, packages/objectql/src/record-currency-aggregate-door.ts

Delta record on the FAIL record 6595971055 rendered on 866fe6cdc6ef32c73467a7b355de41e380f91055. Read: the branch's own commits since that head (2122d31b, 2c356102, 633de463, ee847d3e before the merge; 1fc44a46 after it), the merge commit ab2b4fb7 of origin/main 339f63da (its diff against main touches exactly the PR's twelve files — a clean merge carrying no foreign content, no protocol.ts conflict), the full net diff origin/main...1fc44a46 for the hits files, card comment 6598058279 (the dev's delta report), and the check-runs on 1fc44a46: 64 runs, 55 success (Test Core 1–8 and the aggregate, Test UI 1–16 and the aggregate, Build Core, Build UI Deps, Build & E2E UI, Live E2E UI, Type Check · workspace / source gates / consumer gates / debt ledger, Type Check UI, TypeScript Type Check, every Lint gate, Check Changeset, Governed Surface Queue Guard, PR-body guards, Spec property liveness, Dogfood Regression Gate, Check PR Size, Flag docs, Auto Label, Plan Test Core shards, filter), 9 skipped, none failed, none in progress. Judged on the tree.

① Derived judgments

Each finding of 6595971055, against the tree at this head:

1. must-fix (packagedBase) — fixed. restoreTranslatedEchoes takes packagedBase and translatedSource passes it to every translateObject call, so the module's read of the stored source is the REST read's (valueOverridesPackagedBase withholds the catalog from a diverged slot). The door hands it this.getPackagedObjectBase(request.name) — the same accessor packagedObjectBaseOf in packages/rest/src/meta-item-read-gate.ts reads for translateObject's packagedBase; a registry lookup under try/catch, undefined for a tenant-authored or unknown object. With no stored row the source is that packaged base itself (translated against itself: nothing diverged, so every slot is a translation's source — the body a read of an unoverlaid packaged object served). Pinned at the module (diverged Total kept, undiverged control restored) and at the door (Subject + typed 标题 kept with no advisory; the no-base control restores Subject). Right.
2. should-fix (silent restoration) — fixed. restoreTranslatedObjectEchoes returns { item, restored }; translatedEchoNotices builds one info RuntimeAuthoringIssue per restored author slot (rule: 'translated-label-echo', path of the form objects.NAME.fields.F.label, message and hint) and the door appends them to saveNotices beside droppedWithheldKeyNotices. The pure half's injected columns are not reported, which is right: the strip removes them and the stored document never carried them. Pinned (advisories carries exactly the one slot). Right.
3. should-fix (changeset overclaim) — fixed. The Clause-② sentence now names the one refusal the door makes new (an author's own queue on a user-owned object, ADR-0142 D3) and the read-serves-for-its-source rule; the body says the field type was already refused by the object schema, drops the extend claim, and states the record-currency door is left to the registration. Matches the tree (②). Right.
4. should-fix (ask before the spec gate) — fixed. The D9.9 block records objectRegistrationLayer; the registry is asked inside the spec-gate block after the parse-failure throw (protocol.ts ~14393), so a body both refuse keeps the gate's issues[]. Pinned with type: 'no_such_type' (name is not ObjectFieldTypeRefusedError, issues non-empty, message failed spec validation). Right. One observation, no fix owed: the ask sits inside if (schema), so on a host where resolveOverlaySchema('object') answers null it is skipped along with the gate; object's schema is the kernel's built-in ObjectSchema, so no production path reaches that arm.
5. should-fix (state-dependent door) — fixed, by the second option offered. objectRegistrationRefusal calls judgeRegistrationDoors(..., { bodyOnly: true }), which returns before the record-currency summary door; registerObject still runs it. Neither save nor promote now refuses on state a sibling draft can change, in either direction; the registration's refusal stays in the write-through's console.warn, and the changeset says so. Pinned in record-currency-guards.test.ts (pre-flight null, registration refuses by name, nothing registered). Right, and the residual is declared.
6. should-fix (degraded-service read) — fixed. The restoration calls storedBodyForCarryForward with a host whose readCodeLayerForCarryForward answers the packaged base, so readItemFromMetadataService is never reached on this path; the earlier getItem guard in readCodeLayerForCarryForward is reverted (the net diff against main no longer touches that method). Pinned: a brand-new object draft saves with a metadata service whose getDiagnosed reports degraded. Right.

Unchanged from 6595971055 and still right: one code path for pre-flight and registration (judgeRegistrationDoors first statement of registerObject), the same _provenance/package/kind as the write-through and boot; body judged equals body stored for door purposes (the rewrites after the ask touch protection, operator/section grafts, parsed actions, labels, credentials only); the promote asks draftForGate.body before repo.promoteDraft and a batch throw lands in failed[]; boot hydration unchanged, existing rows load; the migration compares a row with itself and the injected definitions (no packagedBase needed, and none passed); locale set and cost as before; the spec export BUILTIN_SYSTEM_FIELD_LABEL_LOCALES and its two generated-surface lines are byte-identical to the reviewed head (net spec diff unchanged).

② Semver level

Changeset still patch × 3 with the ! title, Clause-②: no (narrowing), Metadata-protocol: none, one ADR-0087 not-required marker; Check Changeset success on this head. The level judgment of 6595971055 stands: AGENTS.md §3 makes the level follow the protocol kind alone, none ⇒ patch, a non-protocol breaking change keeps its banner at patch; none holds because the one refusal made real is the registry's on main. The Clause-② sentence now matches the tree (①.3). Right.

③ Boundary flags

• open_questions: [], out_of_scope_findings: [] in the delta report — nothing to answer.
• Freeze: lifted; origin/main 339f63da merged clean as a merge commit; this record covers the merged tree at 1fc44a46.
• Residual: the record-currency summary door at registration stays a console.warn in both directions — declared in the changeset body and the PR amendments; the ui card remains the seat's.
• Body amendments the report lists (items 1–2 of What changes, the advisory, the residual, the verification readings): the PR body is the dev's account; the tree is what this record judges, and the tree matches the amendments as described.

④ Design judgment

The narrowing is as judged on 866fe6c: it makes ADR-0142 D3's and ADR-0029 D9.9's refusals real at the producer and removes no declared capability. The one defect that failed the previous head — a name-keyed restoration undoing an author's edit on a slot the read never translates — is closed at its cause (the module now reads with the read's own options), and the restoration is loud on the save answer. No new finding. The design holds.

Implemented-by: claude/project-thread-knfz66
Reviewed-by: session_01JQwxbXKRzgnVvjzxaYxLUf

VERDICT: PASS

Generated by Claude Code

domain:server#2 · os-warren · session_01JQwxbXKRzgnVvjzxaYxLUf

维护者速读

• 改了什么：对象保存入口（PUT /api/v1/meta/object/NAME，草稿与直接保存）把中文读取时被翻译的系统列与作者标签还原成源文本再存，还原的作者标签在保存回答里以提示（translated-label-echo）列出；注册表本会拒绝的对象在保存时就 422，而不是保存成功、发布“成功”、却永远注册不上。
• 为什么改：Studio in zh-CN: a new object publishes "successfully" and never reaches the data plane, because its echoed queue column carries a translated label #29673：中文 Studio 读回对象再保存，queue 等列被当成作者自定义字段，注册表拒绝注册，数据接口 404。
• 风险与回滚：收窄——注册表本就拒绝的对象现在保存即 422；作者恰好把标签写成某语言对源标签的译文时会被还原，但会在回答里看到提示。回滚即 revert。
• 先看：packages/metadata-protocol/src/protocol-translated-echo.ts，以及 protocol.ts 里 saveMetaItemUnaudited 调用它的两处。
• 两分钟验证：pnpm --filter @objectstack/objectql exec vitest run src/protocol-meta-effective-schema.test.ts。
• 需要你做的：无，席位落地。
• 席位意见：达档契约复核首轮 FAIL（一条必改五条建议），六条全部修完，增量复核 PASS；可落地。

席位核对

ACCEPT · domain:server#2 · head 1fc44a469f46d82643a528c0cd61cfca75af8737 · 2026-11-03T07:43Z · contract review at CONTRACT_REVIEW_TIER (narrowing face, i18n-resolver.ts schema face): FAIL 6595971055 on 866fe6cd, delta PASS 6598122054 on this head, by an independent at-tier subagent adopted by this seat; not governed (check-governed-merges --pr 29790 0 of 12 paths)

1. Shape: draft, base main, Fixes #29673, Clause-②: no (narrowing), Metadata-protocol: none, Skills-docs: none — skills/objectstack-data/SKILL.md (Ownership queues) already teaches the refusal; patch changeset. 12 files, +1186/−45, 1231 changed lines. Main 339f63da (the protocol.ts freeze lift) merged clean as ab2b4fb7; its diff vs main touches exactly the PR's 12 files.
2. Contract review: round one FAIL: must-fix 1 (the stored-row half translated without packagedBase, unlike the REST read gate), should-fixes 2–6 (silent restoration, changeset overclaim, registry asked before the spec gate, a state-dependent record-currency door, a 503 on a brand-new object when the service is degraded). The delta record finds each fixed and pinned on this head, the design holding and no new finding.
3. Gates on this head: check-runs pinned to 1fc44a46: 64 total, 55 success, 9 skipped, 0 failed. Dev: 85/85 derived families exit 0, --ran 0 NOT-MEASURED; pnpm lint 0; battery 3356 passed, 28 skipped; each new pin's ablation red as predicted; restore leg 20/20 (delta report 6598058279).
4. Accepted deviations: the registry ask sits inside if (schema), a skip that production never takes (the object schema is the kernel built-in); observation only in the delta record. Registration still logs its own refusal (declared residual).
5. Out of scope: the designer edits the translated read: filed as ui card studio(designer): the object designer edits the Accept-Language-translated /meta read and PUTs it back whole, injected columns included #29793. The zh-CN first-run loop (Studio read → save → publish → data route) is carried in the landing record. security_findings: none.
6. Landing: not governed, under 3000 lines ⇒ the seat lands it (pr_ready + automerge_enable) after the refreshed PR body is applied. At MERGED: landing record on Studio in zh-CN: a new object publishes "successfully" and never reaches the data plane, because its echoed queue column carries a translated label #29673, pm:dispatched removed, card thread released.

Generated by Claude Code