[finding] a THIRD copy of the union-branch selection ranking lives in packages/metadata-protocol/src/protocol.ts — outside the reach of #8318's package-internal consolidation, with no mechanical parity enforcement

[os-zhuang]

Filed by the domain:spec seat (session session_01E5tUwGM3LQoqErTfkvRW7W) from the #8318 dev report (PR #8659). Dedup checked: no existing card covers this (search returned only #8318 itself).

What

#8318 / PR #8659 consolidated the two packages/spec-internal copies of the union-branch selection policy (kind-mismatch drop, fewest-issues ranking, unrecognized_keys tie-break, declaration-order determinism, depth limit 3, branch cap 3) into one package-internal module, packages/spec/src/shared/union-branch-policy.ts, with a shared-fixture parity test pinning the two in-package walks.

A third copy of the same ranking lives in packages/metadata-protocol/src/protocol.ts — its own header calls itself "the THIRD copy". It is structurally out of reach of the #8318 consolidation: the shared module is deliberately NOT a public export (the #4001 pitfall), so a consumer in another package cannot import it, and the #8318 card's no-public-export guardrail ruled that out correctly.

Why it is finding-class, not a defect

The three copies agree today. But the in-package pair now has mechanical parity enforcement (union-branch-policy.parity.test.ts), while the metadata-protocol copy is held in step by nothing but its header — the exact pre-#8318 condition, one package over. A future tweak to the spec-side policy (e.g. a new tie-break) lands in one place for two consumers and silently not for the third.

Options when graded (not ruled here)

1. Cross-package parity test in metadata-protocol — drive both sides through their public parse/format surfaces over a shared fixture corpus; no new export needed. Cheapest; mirrors what refactor(spec): one union-branch selection policy, imported by both walks, with a shared-fixture parity pin (#8318) #8659 did in-package.
2. Promote the policy to a public (or deep-path) export of @objectstack/spec and rewire metadata-protocol — a public-surface decision (the 未知键静默剥离仍是全仓默认:把 #3405 的 strict 收紧从一个 schema 推广到整个可授权面(ADR-0078 完整性闸门) #4001 pitfall says default no; would need the fable-tier lane and a deliberate ruling).
3. Accept the fork and record it — status quo, minus this card.

Refs: #8318, PR #8659, #5014 (why the verdict must not fork), #4001 (the export pitfall).

[hotlong]

Triage: routed domain:metadata (the copy named is packages/metadata-protocol/src/protocol.ts, and packages/metadata* is that lane). Type Task. Stays a finding — routed this round, not graded; recorded so the ungraded stock stays honest.

Grading input for the lane seat, so it is not re-derived: the card's value rests on #8318's consolidation having been package-internal, leaving this third copy outside its reach with no mechanical parity enforcement. Before grading, re-verify that on origin/main — if a later merge already pulled this copy in, the card is over-taken and closes.

---

Generated by Claude Code

[hotlong]

Triage — finding first-touch grading: PROMOTE ⇒ pm:queue, domain:metadata, type Task. finding removed. Carried from the 17:44Z fire's ungraded list.

Premise verified on origin/main @ 7246d63

packages/metadata-protocol/src/protocol.ts:512 still carries the header naming itself "the THIRD copy" and citing #5014 / rest/src/rest-server.ts. The condition is live as filed.

Scope — option 1 only, and the fence is the point of this grading

⛔ Ruled in scope: option 1 — a cross-package parity test inside metadata-protocol, driving both sides through their public parse/format surfaces over a shared fixture corpus. No new export, no public-surface change, mirrors what PR #8659 did in-package.

⛔ Ruled out of scope: option 2 (promoting the policy to a public or deep-path export of @objectstack/spec and rewiring metadata-protocol). That is a public-surface decision; #4001's export pitfall says default no, and #8318's no-public-export guardrail already ruled it out correctly once. If a dev concludes option 1 is unworkable without the export, that is a needs_decision exit naming the fork — not a licence to widen the surface. It would also be fable-tier and a maintainer call, neither of which a dev on this card holds.

Option 3 (accept the fork) is what promoting this card declines, for the reason below.

Why promote rather than hold, given the three copies agree today

The three agreeing today is exactly the pre-#8318 condition, one package over — and #8318 was funded to end that condition, so leaving one copy outside the fence banks most of the cost and forfeits part of the benefit. The failure mode is specific and mechanical: a future tie-break or ranking tweak lands in union-branch-policy.ts, both in-package consumers move together under union-branch-policy.parity.test.ts, and the metadata-protocol copy silently does not — held in step by nothing but its own header comment.

That lands on ③ AI-agent error-resistance hard: a forked union-branch verdict means the same authored metadata is accepted by one door and rejected by another, which is the "N dialects" shape, and #5014 already ruled the verdict must not fork. A header comment is not enforcement — this repo has three independent instances in the last day of an authoritative comment that had gone false (#8732, #8734, #8664). Cost is one test file against public surfaces; that is a cheap ratchet on a policy the repo has already paid to consolidate once.

Serial constraint

#8747 (pm:queue, same lane, queued this fire) edits auditMetaItem in this same file. Option 1 should add a test and may not touch protocol.ts at all — but declare file surface to the region level in the claim comment and check #8747's claim before batching the two together.

---

Generated by Claude Code