Found while implementing #4521 (PR #4622). Unassigned — nobody is on this. Recording only, per Prime Directive #10.
#4521 deduplicated the overlay→SchemaRegistry registration rule into hydrateOverlayIntoRegistry (protection-envelope graft per ADR-0010 §3.3 + package-scoped artifact lookup per ADR-0048/#1828) and made the read-side hydration in getMetaItems and the new write-through share it.
There is a third copy the PR deliberately did not touch: the boot hydration in loadMetaFromDb (packages/metadata-protocol/src/protocol.ts, non-object branch, around the mergeArtifactProtection call at ~line 8969). It open-codes the same graft but calls this.lookupArtifactItem(normalizedType, name) without the row's record.packageId — the exact pre-#1828 shape #1828 fixed in getMetaItems: a name-colliding overlay can graft the first-registered package's _lock/_packageId/_provenance onto another package's row at boot.
Suggested fix: replace the inline block with this.hydrateOverlayIntoRegistry(normalizedType, data, record.packageId) — one rule, one implementation, and the ADR-0048 scoping applies at boot too. Needs a look at whether any boot-order assumption (artifacts loading after this hydration) depends on the current unscoped lookup, plus a pin test with two packages shipping same-named artifacts.
Not done in #4622 because it changes boot-time behaviour and is unrelated to the #4521 read-your-writes window (no silent scope expansion).
Found while implementing #4521 (PR #4622). Unassigned — nobody is on this. Recording only, per Prime Directive #10.
#4521 deduplicated the overlay→SchemaRegistry registration rule into
hydrateOverlayIntoRegistry(protection-envelope graft per ADR-0010 §3.3 + package-scoped artifact lookup per ADR-0048/#1828) and made the read-side hydration ingetMetaItemsand the new write-through share it.There is a third copy the PR deliberately did not touch: the boot hydration in
loadMetaFromDb(packages/metadata-protocol/src/protocol.ts, non-object branch, around themergeArtifactProtectioncall at ~line 8969). It open-codes the same graft but callsthis.lookupArtifactItem(normalizedType, name)without the row'srecord.packageId— the exact pre-#1828 shape #1828 fixed ingetMetaItems: a name-colliding overlay can graft the first-registered package's_lock/_packageId/_provenanceonto another package's row at boot.Suggested fix: replace the inline block with
this.hydrateOverlayIntoRegistry(normalizedType, data, record.packageId)— one rule, one implementation, and the ADR-0048 scoping applies at boot too. Needs a look at whether any boot-order assumption (artifacts loading after this hydration) depends on the current unscoped lookup, plus a pin test with two packages shipping same-named artifacts.Not done in #4622 because it changes boot-time behaviour and is unrelated to the #4521 read-your-writes window (no silent scope expansion).