[objectstack-fleet]

Requested by Sales · project thread

Part of #25467
Clause-②: no
Metadata-protocol: none
Ruling-ref: 6270097840

维护者速读

• 改了什么：把 protocol.ts 里 22 个私有方法的方法体原样搬进 8 个按主题划分的新文件（存储行绑定、显式降级、overlay 索引、视图容器判断、包提交记录、包作用域、/meta 铸造拒绝、SDUI 清单），类上的方法、签名和文档注释都保留，只剩一行调用。
• 为什么改：[maintainer] refactor(metadata-protocol): split src/protocol.ts (33,065 lines, +10,169 in 30 days) along its ObjectStackProtocolImplementation seams, one move-only slice per PR #25467 拆分超大文件 protocol.ts 的第 33 刀。单个成员一刀只能减 6 到 10 行，这次按派发令一次搬完所有通过筛查的私有成员；筛完后私有成员这条线已经搬尽。
• 风险与回滚：低。22 个方法体逐 token 相同（2,061 个 token，差异 0），发布的 .d.ts 与 main 原始字节完全相同，包测试与 main 逐条比对 0 丢失 0 变化，只多了 4 条新登记行带来的用例；回滚就是还原这一个 PR。
• 先看：protocol.ts 里带 [#25467 cut 33] 标记的 22 个桩方法，以及 protocol.bracketed-refusal-opener-absence.test.ts 里新增的 4 行 PRODUCERS 登记。
• 两分钟验证：pnpm --filter @objectstack/metadata-protocol exec vitest run --maxWorkers=2 src/protocol.bracketed-refusal-opener-absence.test.ts src/protocol.register-item-call-sites.test.ts，预期全部通过。
• 需要你做的：无，席位落地。

What changes

Cut 33 of the protocol.ts split (#24586 ruling A, recorded in 6270097840). Cuts 1–32 landed; cut 32 is #27406. The claim is 6489357157. The dispatch asked for a batch: start from cut 31's alternative (6465513012, storedRowKnownDatasources), screen every remaining private member with a live body on fresh main, and move every one that passes in one PR under 3,000 lines, grouped by theme.

22 ObjectStackProtocolImplementation members move unedited into 8 new modules under packages/metadata-protocol/src/ (#23050 shape B):

Module	Members (base line, body lines, AST tokens)	Host
protocol-stored-row-bindings.ts (113 lines)	storedRowKnownDatasources (:6555, 6, 102), overlayLockLayerAt (:10478, 13, 138), resolveOverlayPackageBinding (:19272, 11, 65)	StoredRowBindingsHost
protocol-loud-degradations.ts (69)	throwMetadataServiceUnavailable (:9407, 7, 29), warnClosureReadUnavailable (:23514, 9, 36)	LoudDegradationsHost; the first reads no member
protocol-overlay-index.ts (95)	ensureOverlayIndex (:8017, 37, 160), ensureOverlayMembersBackfilled (:8072, 3, 28)	OverlayIndexHost, with getter and setter for the two one-shot flags
protocol-registry-view-predicates.ts (122)	expandStoredViewContainers (:10277, 7, 76), runtimeViewContainerObject (:18209, 4, 53), copiesOwnShippedViewContainer (:18241, 2, 32), isAnotherPackagesObject (:18295, 6, 59), registryTakesStoredRows (:18647, 1, 13), overlaidShippedContainerViewNames (:20018, 6, 82)	RegistryViewPredicatesHost; runtimeViewContainerObject reads no member
protocol-package-commit-record.ts (137)	persistPackageCommitRow (:26369, 2, 24), recordPackageCommit (:26397, 71, 342)	PackageCommitRecordHost
protocol-package-scope.ts (150)	uninstalledNamedBaseRefusal (:16236, 28, 175), isWritablePackage (:16577, 1, 12), shouldDropStorage (:19325, 6, 53), resolveAppPackageIdKey (:10582, 38, 323)	PackageScopeHost; shouldDropStorage reads no member
protocol-unmintable-meta-type.ts (62)	refuseUnmintableMetaType (:19495, 17, 82)	UnmintableMetaTypeHost
protocol-sdui-manifest.ts (77)	resolveSduiManifest (:6750, 12, 66), reportPageRequiresAbsentAtLoad (:28937, 13, 111)	SduiManifestHost; the second reads no member

Base lines are protocol.ts at main f7188b562b, which is byte-identical to the claim's base c5d4634174 for this file. 300 body lines and 2,061 AST tokens in total.

• The class keeps every member: name, modifiers, signature, docblock and position. Each body is now one call into its module, marked // [#25467 cut 33] The body moved to ....
• Shape B, as cuts 20–32. A body that reads this builds one const host: ThisParameterType<typeof fn> = {...} and returns fn.call(host, ...). Methods are passed as closures over this, fields as getters, and the two written flags (overlayIndexEnsured, overlayMembersBackfilled) as getter plus setter. The host type is the module's one named context; there is no second copy. The 4 bodies with no this call the plain function directly, as cut 26 did. The generic resolveAppPackageIdKey is called as (resolveAppPackageIdKey<R>).call(host, ...).
• Every caller still calls the class method. No call site changes and no member changes visibility.
• protocol.ts goes from 29,508 to 29,346 lines. The PR is +982 / −312 over 10 files, 1,294 changed lines. The card stays open for later cuts.

Screened and rejected

Every private, non-static class member with a live body on fresh main was screened. A member had to pass four checks: no private-static read, no this.constructor read, no by-path reader of its body, and an unchanged read-seam census (--list included). Each candidate was also run through the package suite and the hand gates on a trial tree. These 40 stay:

Reason	Members
Reads a private static (7)	isSealedManagedItem (registryAllowsOverlay), refusePackagedBaseRemoval (mergesOverlayAtRead), recordOptimisticConflictAudit (optimisticConflictAuditEntry), applyObjectRegistryMutation (overlayPackageMismatchError; also the register-item and write-through pins, and the ADR-0029 seam), reconcileViewExpansions (registeredViewExpansions; also its pins), promoteDraftForPublish (4 statics; also the view-expansion pin), readRevertableCommit (organizationScopedWriteRefusal)
protocol.lookup-artifact-item-call-sites pin keys lookupArtifactItem( sites by member in protocol.ts (11)	packagedArtifactBase, readCodeLayerForCarryForward, readFlattenedMetaItems (also view-expansion), readMetaItem, isArtifactBacked, isNestedArtifactField, shippedViewContainerOf, runtimeViewContainerPackage, isShippedByAnotherPackage, expandRuntimeViewContainer, viewContainerNameCollisionRefusal
Other by-path pins on protocol.ts (11)	emitMetadataMutation (recovery-doors counts this.emitMetadataMutation( and its private declaration), applyRemoteMetadataMutation (recovery-doors body scan, view-expansion), getOverlayRepo (view-expansion: new SysMetadataRepository( must sit in it), hydrateOverlayIntoRegistry (lookup, register-item, view-expansion, hydrate-canonical-type), hydrateExpandedViewItems (view-expansion), applyRegistryWriteThrough (view-expansion, write-through, hydrate), restoreArtifactRegistryView (register-item, view-expansion), runPublishSideEffects (view-expansion, recovery-doors), ensureObjectStorage and dropObjectStorage (the write-through-spelling pin counts if (type !== 'object') return; in protocol.ts), anotherPackageShips (the register-item pin regex-matches its body; measured red on the trial tree)
Moves the read-seam census (8)	findEnvironmentRows (89 → 73), findEnvironmentRow (→ 82), findServedOverlayRow (→ 86), storedFlowBindingAgrees (→ 88), foldStoredCollection (→ 88), rethrowUnlessMetadataStoreUnprovisioned (exit 1, a 70-line --list diff: it is the benign-error discriminator), unmanagedImportCollisions (→ 88), rollBackUnmanagedImport (→ 88)
Other (3)	probeRecord (the query-options-erasure ratchet reds: a new erasure site in a new file; it is also an engine-double seam), packagelessAddress (census 90 → 86), metaTypeNamespaceExists (census 90 → 89)

The census readings in the first rows were taken against base c5d4634174 (89); the last two against main (90).

The private series is spent. After this cut no private member with a live body passes the screen. The 57 public members were not screened; inferred-return publics stay, per the seat's shape call.

Tests

One test file changes, and it is the path-reader migration the ruling requires: protocol.bracketed-refusal-opener-absence.test.ts keeps a per-file floor of new Error( producers (PRODUCERS). Five new Error( sites move, so four new modules get their row, under a [#25467 cut 33] comment, after 'protocol-packaged-base-refusal.ts': 1,:

'protocol-package-scope.ts': 2,
'protocol-unmintable-meta-type.ts': 1,
'protocol-loud-degradations.ts': 1,
'protocol-overlay-index.ts': 1,

Each row adds one generated case, so the suite grows by 4 (see Verification). No other test changes. The moved members are driven end to end by the existing suites (package install and uninstall, the /meta save and publish doors, view-container expansion, overlay hydration, SDUI page loads); all pass at both ends.

Acceptance notes

• Two top-level helpers gain export in place. rowMatchesOverlayWhere (read by overlayLockLayerAt) and metadataStoreUnavailableError (read by throwMetadataServiceUnavailable) are protocol.ts's own non-exported functions. Each gains the export keyword with nothing else in its statement changed, as CommitPlanItem did in cut 32. Both keep readers in protocol.ts and stay there. index.ts names its re-exports one by one and names neither, so the published surface does not move (the .d.ts is raw-identical, below).
• Imports that lost their last reader are removed from protocol.ts: isUsableSduiManifest, findPageRequiresAbsentFromManifest, isWritablePackageShared (with its [#7560] comment), ensureMetadataOverlayIndexes, driverCanRunSql and resolveDriverExec (the whole driver-exec import), and isAppPackageIdKey (with its [#23183] comment). The two comments travel with the import into protocol-package-scope.ts. SDUI_MANIFEST_SERVICE and backfillOverlayBundleMembers stay: docblocks still @link them.
• One read-seam --list line changes file, with the same verdict and count. recordPackageCommit's catch that "guards persistPackageCommitRow() → loud (error)" now sits in protocol-package-commit-record.ts. The census stays at 90.
• check-adr-anchors counts move, and the gate passes at both ends. Citations 60,579 → 60,582 and files 8,558 → 8,561, because the moved bodies' ADR citations now also appear in the new modules. Decision-letter citations on the anchored surface go 1,910 → 1,909: one moved letter citation left protocol.ts for a module outside the anchored set. check-adr-symbol-anchors output is identical.
• The cut 25 docblock-offset trap did not fire. The .d.ts is raw-identical to main.
• History. The branch holds the move commit a04a2c73cc on c5d4634174, one merge of main f7188b562b (19 commits, none in packages/metadata-protocol/), and 044b4d97de. That commit adds refuseUnmintableMetaType and overlaidShippedContainerViewNames, which had been held back and passed every check on a re-measure against main, and it adds the PRODUCERS rows. The whole move was regenerated by script on that commit, so the two late members follow the same recipe. The first commit's subject says 21 members and seven modules; it moved 20.
• Branch name. claude/project-thread-06v1io is the harness-pinned branch for this thread. It names no issue, so the claim comment is the identity record.
• Serial with in-flight PRs. At pr_create, of the 25 open PRs one edits protocol.ts: harden(metadata): a permission set's name is unique across packages #27535 (permission-set name uniqueness, +57/−3 in protocol.ts). git merge-tree --write-tree of this head with its head 4cd524bf0b is clean, and its added lines call none of the moved members. chore: version packages #26517 (Version Packages) touches only CHANGELOG.md and package.json in this package. main moved after the merge (to aef631b80b); the one new commit in this package only adds protocol.draft-publish-verdict.test.ts, and git merge-tree with it is clean, so main was not merged again.
• Liveness ledger follow-up, carried forward (packages/spec/**, outside this card): manifest.json's dependencies row → protocol.ts#resolveWritePackageScope (cut 19) and seed.json → protocol.ts#applySeedBodies (cut 14). No row points at this cut's members.
• No changeset: skip-changeset, per ruling 6348891160.

Verification

Proof of move-only

The compare reads the TypeScript compiler's AST leaf tokens, with JSDoc skipped, over each member's parameters, return type and body, protocol.ts at main against the head module:

overlayLockLayerAt 138 tokens differ 0 text equal
resolveOverlayPackageBinding 65 tokens differ 0 text equal
storedRowKnownDatasources 102 tokens differ 0 text equal
throwMetadataServiceUnavailable 29 tokens differ 0 text equal
warnClosureReadUnavailable 36 tokens differ 0 text equal
ensureOverlayIndex 160 tokens differ 0 text equal
ensureOverlayMembersBackfilled 28 tokens differ 0 text equal
expandStoredViewContainers 76 tokens differ 0 text equal
runtimeViewContainerObject 53 tokens differ 0 text equal
copiesOwnShippedViewContainer 32 tokens differ 0 text equal
isAnotherPackagesObject 59 tokens differ 0 text equal
registryTakesStoredRows 13 tokens differ 0 text equal
overlaidShippedContainerViewNames 82 tokens differ 0 text equal
persistPackageCommitRow 24 tokens differ 0 text equal
recordPackageCommit 342 tokens differ 0 text equal
isWritablePackage 12 tokens differ 0 text equal
uninstalledNamedBaseRefusal 175 tokens differ 0 text equal
shouldDropStorage 53 tokens differ 0 text equal
resolveAppPackageIdKey 323 tokens differ 0 text equal
refuseUnmintableMetaType 82 tokens differ 0 text equal
resolveSduiManifest 66 tokens differ 0 text equal
reportPageRequiresAbsentAtLoad 111 tokens differ 0 text equal
TOTAL 2061 differ 0

"text equal" is the whitespace-collapsed source text, comments included. Negative controls, one token changed in an in-memory copy of the head module, each differ 1: registryTakesStoredRows === → !==; isWritablePackage packageId → pkg; overlaidShippedContainerViewNames ownPackageId → pkg; refuseUnmintableMetaType 400 → 409.

• Class side. 304 members at both ends, same order. The 282 that did not move are byte-identical, leading comments included; the 22 stubs keep their leading trivia and signature byte-identical.
• Top level. 266 → 271 statements; 259 byte-identical. The rest: the 8 module imports (each with a one-line [#25467 cut 33] comment), the two helpers with export added, and the removed imports listed above.
• tsc --noEmit in packages/metadata-protocol: exit 0. pnpm exec eslint --no-inline-config packages/metadata-protocol: exit 0, no output.

The published .d.ts (ruling 6348891160)

Built with pnpm --filter @objectstack/metadata-protocol build against one dependency tree (a full turbo run build). The base and main legs swapped the package src/ tree-only and restored it from HEAD under a trap; afterwards git status --porcelain was empty.

Reading	Base c5d4634174	Move commit a04a2c73cc	main f7188b562b	Final head 044b4d97de
raw sha256 dist/index.d.ts = dist/index.d.cts	4cb92b2e20135dd78d07fd2800b1d2a050a432b923cd511d5b50f3ed6de29a58 (784,960 bytes)	same as base	08235c712877a28a3cdf7c36d96d18fc72b246c8533eae22feb64aaae7af12ea (785,044 bytes)	same as main
normalised sha256	a4dcc2306638c29983bceaf7258df71a29a3020a3ec26904c9830a0cecd0c70e	same as base	6faa3395b5c4ccdc2e24a47a359fa8a2f35bd1aaa2f3df821ea164c316a11192	same as main
raw-diff lines		0 against base		0 against main

The merged tree 2c6ff0ae gives the main hashes too; the .d.ts moved between base and main only through the merged main commits. Bundles change as expected: index.js e5abe0490663649f → d80799c603dc52be, index.cjs 1c36338d33aa16a5 → c8cbc5fc5a540a2d (sha256, 16). The ESM and CJS export tables are the same 78 names (e47ac7c753bcb8be) at both ends; none of the moved functions or the two exported helpers appears.

Normaliser, verbatim:

node -e 'const s=require("fs").readFileSync(process.argv[1],"utf8");process.stdout.write(s.replace(/"[^"\n]*"(?:\s*\|\s*"[^"\n]*")+/g,r=>r.split(/\s*\|\s*/).sort().join(" | ")))' dist/index.d.ts | sha256sum

Positive control. On the final head .d.ts, private storedRowKnownDatasources; was made public (a 2-line raw diff). Raw goes to 66b4b1c26cdbfa9b…, normalised to b248e476c8ff57fb…, both different from the bar. So the bar can see a change on a moved member.

Gates and suites

Package suite

packages/metadata-protocol, vitest --maxWorkers=2, JSON reporter, under the shared verify lock.

• Base c5d4634174 and move commit a04a2c73cc: both 21,800 tests (21,774 passed, 0 failed, 26 skipped), 283 files; per test 0 lost, 0 added, 0 changed.
• main f7188b562b (src swapped tree-only, restored under a trap): 21,800 tests (21,774 passed, 0 failed, 26 skipped), 283 files.
• Final head 044b4d97de: 21,804 tests (21,778 passed, 0 failed, 26 skipped), 283 files. Per test name and status over 21,787 distinct names against main: 0 lost, 0 changed, 4 added, all four the new PRODUCERS rows.

Hand gates, main and head

All 13 exit 0 at both main f7188b562b and the final head.

• Identical output: check-adr-symbol-anchors, check-system-context-census, check-tenant-audit-census, check-query-options-erasure-ratchet (50 unswept non-test sites in 15 files, none new), check-filter-alias-parity, check-durability-degradation-log-level (90 read seam(s)), the spec liveness gate, check-platform-checklist.
• check-durability-degradation-log-level --list: identical once [@:][0-9]+ is stripped, except the one recordPackageCommit line that changes file (above).
• check-adr-anchors: counts as noted in Acceptance notes.
• check-startup-registry: scanned files 3,693 → 3,702. check-nul-bytes: 21,998 → 22,006 files. check-engine-double-contract: the updateData/deleteData seams keep their entries at new line numbers; productionFiles 3,887 → 3,896. Each count is the new modules plus build output in the head tree, as in cuts 20–32.
• check-platform-checklist --changed-from origin/main: OK, 32 anchors judged, 0 lost.
• check-governed-merges --branch claude/project-thread-06v1io: 0 of 10 paths in the register (13 surfaces), NOT governed; 1,294 changed lines, under the 3,000-line bar.

Derived gates

dispatch-gates --commands --repo objectstack-ai/objectstack on 044b4d97de derives 52 gates on 10 changed paths; re-derived against main aef631b80b, the list is unchanged. All 52 exit 0 after a full turbo run build. dispatch-gates --ran reports 52 derived, 52 run, 0 NOT-MEASURED, 0 UNRUN, and exits 0.

🤖 Generated with Claude Code

https://claude.ai/code/session_01L6bhgVeV5GgzaH9Ny16aSx

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/metadata-protocol, touching 81 documentable anchor(s).

38 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json aef631b80b3175f2f43287a6e0185c828c356ac8.

⛔ 13 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 1 cross-cutting symbol(s) contributed no route anchor: environmentId (38 routes)
• 1 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 58 of 210 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 10 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json aef631b80b3175f2f43287a6e0185c828c356ac8 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 2173b1df02ad189278fb4507b3f5b15513b1378c — the merge of head 044b4d97de892c2ad6277961ee43b27a56f1dd0d into base aef631b80b3175f2f43287a6e0185c828c356ac8, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 2173b1df02ad189278fb4507b3f5b15513b1378c && git checkout 2173b1df02ad189278fb4507b3f5b15513b1378c
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin aef631b80b3175f2f43287a6e0185c828c356ac8 044b4d97de892c2ad6277961ee43b27a56f1dd0d && git checkout -B drift-repro aef631b80b3175f2f43287a6e0185c828c356ac8 && git merge --no-ff 044b4d97de892c2ad6277961ee43b27a56f1dd0d

node scripts/docs-audit/affected-docs.mjs --json aef631b80b3175f2f43287a6e0185c828c356ac8

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs aef631b80b3175f2f43287a6e0185c828c356ac8 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

domain:server#1 · os-sales · session_01L6bhgXcN9HaZYSEUdJWEjw

维护者速读(席位终稿)

• 改了什么：protocol.ts 里 22 个私有方法的方法体原样搬进 8 个按主题划分的新模块，类上的方法、签名、文档注释和位置都不变，只剩一行调用。
• 为什么改：[maintainer] refactor(metadata-protocol): split src/protocol.ts (33,065 lines, +10,169 in 30 days) along its ObjectStackProtocolImplementation seams, one move-only slice per PR #25467 拆分超大文件 protocol.ts 的第 33 刀（[Decision] Split the platform's largest, fastest-growing source files (protocol.ts 32,428 lines, +10,002 in 30 days) the way rest-server.ts was split, or leave them #24586 裁决 A）。所有剩余私有成员都筛过一遍，这一刀把能搬的全部搬完，私有成员这条线到此搬尽。
• 风险与回滚：低。方法体逐 token 相同，发布的 .d.ts 与 main 字节相同，没有调用点改动；回滚就是还原这一个 PR。
• 先看：protocol.ts 里带 [#25467 cut 33] 的 22 个桩方法，以及 protocol.bracketed-refusal-opener-absence.test.ts 新增的 4 行 PRODUCERS（5 处 new Error( 随方法体搬走，扫描跟着搬）。
• 两分钟验证：pnpm --filter @objectstack/metadata-protocol exec vitest run --maxWorkers=2 src/protocol.bracketed-refusal-opener-absence.test.ts src/protocol.register-item-call-sites.test.ts，预期全部通过。
• 需要你做的：无。Tier S，席位落地。

席位意见：接受。纯搬移，形状与第 20–32 刀相同；普查从第 32 刀的 89 到本刀的 90，是 main 自己的变化（正文已说明，读数取自 main），不是本 PR 带来的。

席位核对 — ACCEPT · domain:server#1 · head 044b4d9 · 2026-10-29T12:08Z

• Shape: move-only cut, [maintainer] refactor(rest): split packages/rest/src/rest-server.ts (13,701 lines, 70 commits in 30 days) along its register*Endpoints seams, one move-only slice per PR, /meta after #22877 stage 2 #23050 shape B (host object + fn.call(host, …); no-this bodies call the function directly). 22 members into 8 modules; every class member keeps name, modifiers, signature, docblock and position; no call site changes. Seat spot-read of the protocol.ts import block and stub markers (30 [#25467 cut 33] lines in the diff) and the PRODUCERS hunk.
• Premise: the claim 6489357157 holds on this head; Part of #25467, Ruling-ref: 6270097840.
• Gates: 53 check-runs on this head: 34 success, 19 skipped, 0 failed, 0 pending. check-expected-skips --pr 27540 (from a fresh origin/main checkout): VERDICT … OK — 19 skipped check-run(s), every one in main's roster (exit 0). mergeable_state: clean.
• Contract review: not owed. check-governed-merges --pr 27540: NOT governed, 0 of 10 paths on the register; Clause-②: no (no export or accept-set change; .d.ts byte-identical per the PR's measurement); no packages/spec/src/**, no governed rule text, no narrowing.
• Accepted deviations: 4 new PRODUCERS rows in protocol.bracketed-refusal-opener-absence.test.ts: the path-reader migration the split ruling requires (the 5 moved new Error( sites keep their family's floor); protocol.ts's own floor of 5 still stands. Two top-level helpers exported in place from their new modules, not reachable from the package's published entry types.
• Declaration: Clause-②: no, Metadata-protocol: none, skip-changeset (internal move, nothing published changes).
• Out of scope: the private-member line of the series is spent (40 members screened and rejected, reasons tabled in the PR body). The next cut needs a pin-migration ruling or a public-member shape plan; recorded on [maintainer] refactor(metadata-protocol): split src/protocol.ts (33,065 lines, +10,169 in 30 days) along its ObjectStackProtocolImplementation seams, one move-only slice per PR #25467 at release. Skills-docs: none.
• Landing: Tier S, 1,294 changed lines ≤ 3000 → pr_ready + automerge_enable via the relay now; on merge, [maintainer] refactor(metadata-protocol): split src/protocol.ts (33,065 lines, +10,169 in 30 days) along its ObjectStackProtocolImplementation seams, one move-only slice per PR #25467 goes back to pm:queue with a delivered/remaining note.