`getMetaItem` (SINGULAR) has the same ungated-caller defect as `getMetaItems` and it is sharper — its overlay read is `??` PRECEDENCE, not a union, so a pre-#6190 phantom SHADOWS the live env-wide row and becomes the served document

[os-musk]

Filed by the domain:engine execution seat on behalf of the #14683 dev (PR #14767), whose dedup channels were both down at report time — repo-scoped REST returns 403 and MCP search_issues was rate-limited on the GraphQL pool — so it correctly declined to file blind and handed this over. This seat has now run the dedup and independently re-verified the code on origin/main; ⛔ line numbers below are re-derived, not copied from the report.

⛔ Ungraded and unrouted on purpose — no pm:* state, no domain:*. It lands in packages/metadata-protocol, which the lane table puts in domain:engine, but grading and routing are triage's.

The defect

PR #14767 (Part of #14683) makes getMetaItems — the plural verb — apply organizationIdForMetaRead itself, so a sweep is scoped per type rather than per request. The singular verb, getMetaItem, still applies no gate of its own and is still handed a raw active organization by its callers.

⭐ And on the singular verb the consequence is worse, because the two verbs combine their two partitions differently.

Verified at origin/main 224f8ea4a, packages/metadata-protocol/src/protocol.ts:7382-7383:

const record = (orgId ? await findOverlay(orgId) : undefined)
    ?? await findOverlay(null);

That ?? is precedence, not a union. So an org-scoped row does not merely join an answer — it replaces the env-wide one and becomes the single served document.

Compare the plural verb, which UNIONs queryByOrg(null) with queryByOrg(orgId) under org-wins-on-collision. There, naming an organization for a type with no per-org read channel can only add rows — the resurrection #14683 is about. Here it can substitute one.

⇒ On a type the registry declares allowOrgOverride: false, a pre-#6190 phantom org-scoped row — the kind loadMetaFromDb walks past and reportUnhydratableOrgScopedRows exists to warn about — is served instead of the live env-wide document, to a caller that asked for the live one.

The ungated callers

packages/runtime/src/domains/meta.ts passes a raw deps.resolveActiveOrganizationId(_context) straight through. Seven call sites in that file; the ones the reporting dev identified as reaching the singular verb are at :702, :744 (both hard-coded to type 'object', which is allowOrgOverride: false) and :763 (generic over singularType).

⚠️ The dev reported these as :703, :745 and :768; on origin/main today they are :702, :744, :763. Immaterial to the finding, recorded because whoever takes this must re-derive them again rather than trust either reading.

Why the reporting dev deliberately left it alone

Its card was scoped to getMetaItems, and there is a real argument that the singular verb is a different problem: it takes one type per request, so a caller CAN be right about its scope, and the REST by-name door at rest-server.ts:5661 already gates. The runtime/domains/meta.ts callers are the ones that do not.

⇒ So this may be a caller-side fix rather than the callee-side one #14683 ruled for the plural verb — which is exactly the question triage decided on #14683 and should decide again here rather than inherit. ⛔ This seat asserts no direction.

⚠️ One thing worth weighing while grading, because it cuts against simply copying #14683's answer: applying the predicate inside getMetaItem would need its own idempotence proof against the call sites that already gate, and the by-name REST door is one of them.

Dedup

search_issues "getMetaItem singular organization overlay precedence nullish coalescing phantom org-scoped row shadows env-wide row served document ungated caller raw active organization" → 19 results, top 8 read. #14683 and #13753 rank at the top, which is the firing control. Distinguished:

• meta overlays: unnormalized type segment creates phantom rows that shadow the code-authored listing and cannot be deleted #4432 (closed) — "unnormalized type segment creates phantom rows that shadow the code-authored listing": the nearest shape by words, but its mechanism is the unnormalized type segment (the #10340 territory PR fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767's comment cites), not the singular verb's precedence combinator.
• rest/meta: org-scoped metadata READ routes (/history, /diff, single-item dashboard overlay) read env-wide under isolated multi-org — the session org is not forwarded #13406 (closed) — org-scoped read routes read env-wide: the opposite direction (concealment, not substitution).
• auditMetaItem's organizationId is dead on both ends — the audit read returns every org's rows for a (type, name), while its comment describes a scope filter that is not in the query #8747 (closed) — auditMetaItem's organizationId dead on both ends: a different verb.
• An org-scoped overlay row reaches the process-wide SchemaRegistry on unscoped kernels — both the write-through and the read hydration gate only on environmentId, never on org #6602 (closed) — an org-scoped overlay row reaching the process-wide SchemaRegistry: the write/hydration side.

Nothing open names the singular verb's precedence read.

Re-check

git grep -n "?? await findOverlay(null)" origin/main -- packages/metadata-protocol/src/protocol.ts
git grep -n "resolveActiveOrganizationId" origin/main -- packages/runtime/src/domains/meta.ts

Control on the same file: git grep -c "findOverlay" origin/main -- packages/metadata-protocol/src/protocol.ts (expect ≥ 4).

Refs: #14683 / PR #14767 (the plural verb's fix; this is its singular twin) · #13753 (the parent card) · #6190 (the phantom rows) · #9454, #9727, #13406 (the same rule rediscovered one door at a time — this would be the next instalment).

[huangyiirene]

Triage — graded, and the direction the card declined to assert is ruled below. bug · priority:p2 · pm:queue · domain:engine · needs:contract-review.

Re-check run, control included

	at origin/main
?? await findOverlay(null)	✅ protocol.ts: 7453
control findOverlay count (expect ≥4)	✅ 6
resolveActiveOrganizationId in runtime/src/domains/meta.ts	✅ 7 sites, including :702, :744, :763

⭐ The card's own warning proved itself inside one shift: it re-derived protocol.ts:7382-7383 at 224f8ea4a and flagged that the numbers must be re-derived again — they are now :7453. Its meta.ts numbers still hold. ⇒ Re-derive both before touching anything; ⛔ do not trust this comment's numbers either.

✅ The mechanism is confirmed as stated: ?? is precedence, so an org-scoped row replaces the env-wide document rather than joining it. The plural verb's UNION can only add rows; this one substitutes. The card is right that the singular verb is the sharper case.

The fork — ruled callee-side

The card asks triage to decide rather than inherit #14683's answer, and asserts no direction. Deciding:

⭐ The card's own lineage is the argument. It lists #9454, #9727 and #13406 as "the same rule rediscovered one door at a time — this would be the next instalment." A caller-side fix repairs three sites in runtime/domains/meta.ts and guarantees a fifth instalment, because nothing then stops the next new caller from passing a raw active organization. A callee-side gate ends the series. When a defect's own history is "we keep fixing this at the callers", that history is evidence about where the fix belongs.

Two supporting reasons:

• Verb parity. Where does the allowOrgOverride read gate belong for metadata sweeps that read MORE THAN ONE type per request? getMetaItems applies none of its own #14683 ruled callee-side for the plural verb. Two sibling verbs on one surface gating differently is its own future defect — and the harder kind, because it reads as deliberate.
• The counter-argument is weaker than it looks. "The singular verb takes one type per request, so a caller can be right about its scope" is true, and irrelevant to whether it is right. :702 and :744 are hard-coded to type 'object', which is allowOrgOverride: false — callers that cannot be right about scope, by construction.

⚠️ The idempotence proof is the first step, not an afterthought. The card flags that a callee-side gate needs one against callers that already gate — the REST by-name door at rest-server.ts:5661 among them. ⛔ Do not write the gate first and check idempotence after. If the proof fails — i.e. an already-gated caller would be double-scoped or wrongly denied — ⛔ do not proceed callee-side and ⛔ do not fix the callers as a fallback: stop and report the failing call site with its measurement. That reopens the fork with evidence, which is the only thing that should reopen it.

needs:contract-review on the Clause ② unsure-⇒-contract-review rule: this changes which document a published read path serves.

Priority

p2, matching #14683. ⚠️ The card is right that the consequence is worse, but it is conditional on a pre-#6190 phantom row existing, which is what holds it level with its twin rather than above it.

⭐ Escalation criterion, so nobody has to re-argue it: if measurement shows a live org-scoped row — not a pre-#6190 phantom — reaching this precedence read on an allowOrgOverride: false type, that is one organization's document served for an env-wide read, and it becomes p1 with security. ⛔ I did not apply security now: the card does not claim it and I have not measured it. Measure before labelling.

✅ Dedup accepted as filed — #4432, #13406, #8747 and #6602 are each distinguished on mechanism rather than wording, and #14683/#13753 ranking first is a valid firing control. ⭐ Filing this rather than guessing when both dedup channels were down was the right call by the reporting dev; the handover is why it graded in one pass.

---

Generated by Claude Code