[objectstack-fleet]

Requested by Tesla · project thread

Refs #29594 (PR 1 of 5–7: the lookup refactor only; the ensure door returning the App's pair, the customizable verdict, the sys_ pass-through close and the platform pair follow in later PRs)

Clause-②: yes (widening)
Metadata-protocol: none
Ruling-ref: 6691022506

维护者速读

• 改了什么：「这个包的定制包是哪个」这个问题现在只有一个答案入口 pairOf(base)（在 @objectstack/metadata-core），它先问「这个包属于哪个 App」（appOf），再按 App 推出 <id>.custom。原来散在 metadata-protocol、objectql、两个 service 里的 20 处直接推导和 3 处 isCustomizationPairOf 判定都改走它。
• 为什么改：裁决 ① 定制单位 = App（HotCRM 四个包只有一个 app.objectstack.hotcrm.custom）。下一个 PR 只要改 appOf 一处，所有读写门、列表、卸载拒绝就一起按 App 找定制包，不会有漏改的地方各说各话。
• 风险与回滚：本 PR 不改任何行为：appOf 现在原样返回包自己，所以每处答案、拒绝原因、定制包 id 都和今天一模一样；runtime 的两处留给下一个 PR。回滚即 revert 本 PR。
• 先看：packages/metadata-core/src/customization-pair-lookup.ts（整个查找就 3 个函数）；packages/metadata-protocol/src/protocol-packaged-base-refusal.ts（改动最多的一处，5 个调用点 + 1 处判定）；packages/metadata-protocol/src/served-override.ts（被五个读路径共用的判定）。
• 两分钟验证：pnpm --filter @objectstack/metadata-core exec vitest run --maxWorkers=2 src/customization-pair-lookup.test.ts，预期 16 个用例全绿（App、模块、独立包、sys 内核包、无命名空间的包都与旧推导相同）。
• 需要你做的：无，席位落地。

What changes

The lookup (packages/metadata-core/src/customization-pair-lookup.ts, exported from @objectstack/metadata-core).

• appOf(packageId): the App that carries a package for customization. Today the identity: every package is its own App, which is what every call site assumed.
• pairOf(base) = customizationPackageId(appOf(base)): the pair, or the same refusal the id rule names (base_id_missing, base_is_customization_package, base_id_invalid).
• isPairOf(pairId, base): whether pairId is THE pair of base, the predicate isCustomizationPairOf answered.

The id rule itself stays in @objectstack/spec/kernel; packages/spec is untouched. Why metadata-core and not metadata-protocol or objectql: service-datasource (a class (i) site) declares neither of those, only metadata-core, and metadata-core is the one package every class (i) caller already declares (metadata-protocol, objectql, service-automation, service-datasource, runtime). No new dependency edge, no lockfile change. That is the criterion already used for the write dispatch predicates and the code-artifact provenance test in that package (claim amendment 6691222368).

The call sites. Each class (i) site now calls pairOf / isPairOf where it called customizationPackageId(base) / isCustomizationPairOf(pair, base). Nothing else in those functions moved: same branches, same sentences, same refusal codes.

Census of git grep -n customizationPackageId origin/main -- 'packages/**/*.ts' ':!*.test.ts' at 69e133ea: 53 hits in 17 files. (i) = "the pair of this package" derivation, routed through the lookup. (ii) = the definition, a parse ("is this id a pair"), an import, a doc mention or a field name; stays.

File	Hits	(i) routed	(i) deferred	(ii) stays
lint/src/validate-customization-namespace.ts	3	0	0	3: import, doc, L108 is-a-pair skip (the base_is_customization_package reason on the manifest's own id, the same parse as isCustomizationPackage(manifest.id))
metadata-protocol/src/protocol-customization-package.ts	3	1 (L255, ensure door's pair id)	0	2: import (removed), doc (reworded)
metadata-protocol/src/protocol-discovery-and-bases.ts	2	1 (L330, pair translation bundle)	0	1: import
metadata-protocol/src/protocol-environment-rows.ts	2	1 (L296, baseAddressServesMember)	0	1: import
metadata-protocol/src/protocol-meta-layered-reads.ts	3	2 (L408, L413)	0	1: import
metadata-protocol/src/protocol-meta-list-reads.ts	4	3 (L197, L531, L675)	0	1: import
metadata-protocol/src/protocol-overlay-merge.ts	2	1 (L114)	0	1: import
metadata-protocol/src/protocol-packaged-base-refusal.ts	7	5 (L197, L217, L419, L684, L1075)	0	2: import, doc
metadata-protocol/src/protocol-packageless-overlay-migration.ts	3	1 (L383)	0	2: import, doc
metadata-protocol/src/protocol-served-overrides.ts	2	1 (L98)	0	1: import
metadata-protocol/src/protocol-write-gates.ts	2	1 (L330, pairOfAddedMember)	0	1: import
objectql/src/registry.ts	6	1 (L7311, uninstall refusal)	0	5: import, 2 docs, PackageUninstallExtendedError.customizationPackageId field declaration + assignment (a public property name, not a derivation)
runtime/src/domains/packages.ts	4	0	2 (L669 customizeInPairRemedy, L3628 package customizations read)	2: import, doc
services/service-automation/src/flow-precedence.ts	2	1 (L259, undeclaredRemedy)	0	1: import
services/service-datasource/src/plugin.ts	2	1 (L372, import landing)	0	1: import
spec/src/kernel/customization-package.ts	5	0	0	5: the definition and its own inverse/predicate
spec/src/api/package-lifecycle.zod.ts	1	0	0	1: doc
Total	53	20	2	31

Class (i) is 22 (the ruling estimated about 20): 20 routed here, 2 in packages/runtime/src/domains/packages.ts left for PR 2 by the order, because #30756 (same seat) is editing that file.

Plus 3 isCustomizationPairOf(pair, base) sites, the same derivation through a second spec helper, routed to isPairOf (claim amendment 6691222368): metadata-protocol/src/served-override.ts:88 (isServedOverrideRowOf, the predicate five reads share), protocol-class-head.ts:190 (restore intent), protocol-packaged-base-refusal.ts:1076 (declared-override gate, which already reads pairOf two lines up). After this PR, git grep -n "customizationPackageId(\|isCustomizationPairOf(" -- 'packages/**/*.ts' ':!*.test.ts' ':!packages/spec/**' answers 4 lines: the lookup itself, lint's is-a-pair skip, and the 2 deferred runtime sites.

Not in this PR: the ensure door resolving a member to its App and answering the App's pair (200), the customizable verdict, the sys_ pass-through in validateObjectNamespacePrefix, the platform pair, the ADR-0146 D3 amendment (#31014, spec seat). Kernel objects stay not customizable: ③ is ruled (6691217245), the kernel whitelist (Users, Organizations) is a later version's work.

Tests

New packages/metadata-core/src/customization-pair-lookup.test.ts (16 cases): for an App package (app.objectstack.hotcrm), a module its artifact brings (app.objectstack.hotcrm.service, still its own pair today), a standalone package, a sys kernel package (com.objectstack.plugin-auth, scope system) and a manifest with no namespace, appOf is the identity and pairOf equals customizationPackageId and the literal pair; the five refusals match the id rule; isPairOf equals isCustomizationPairOf over seven candidates per row.

The existing suites of every touched package are the behaviour pin: they assert the served answers (pair ids in refusal sentences, served override rows, list and layered reads, uninstall refusal, flow precedence remedy, datasource import landing) and none of them changed.

Ablation (appOf moved off the identity, twice)

Both mutations through node scripts/ablation-replace.mjs on the line return packageId; of customization-pair-lookup.ts, each restored and proved (blob == HEAD bd176c7702ab, git diff HEAD empty, whole-tree git status --porcelain empty).

1. Source, the unit table: return packageId === 'app.objectstack.hotcrm.service' ? 'app.objectstack.hotcrm' : packageId; (the HotCRM module resolved to its App). Tests 2 failed | 14 passed (16): the module row's appOf (Expected: "app.objectstack.hotcrm.service", Received: "app.objectstack.hotcrm") and its isPairOf (expected false to be true). The other rows stay green.
2. Through dist/, the consumers: return packageId === 'com.acme.crm' ? 'com.acme.suite' : packageId;, pnpm --filter @objectstack/metadata-core build, ablation-dist-preflight.mjs @objectstack/metadata-core '"com.acme.suite"' --source-marker=… exit 0 (marker in 2 built files). metadata-protocol served-override.test.ts, protocol.pair-translation-bundle.test.ts, protocol.named-base-overlay-write.test.ts, protocol.packaged-base-refusal.test.ts: 48 failed (23 + 22 + 1 + 2), for example Expected: "'com.acme.crm.custom' (?package=com.acme.crm.custom)", Received: "… save it into 'com.acme.suite.custom' (?package=com.acme.suite.custom) …". So the write gates, the served-override predicate and the pair translation read ask the lookup through the published build. Restore, rebuild, preflight --absent exit 0 (absent from all 12 built files), tree clean.

Verification

Suites, typechecks, lint

Before the merge of origin/main (head 33e47fa35):

• pnpm --filter @objectstack/metadata-core test: Test Files 25 passed, Tests 944 passed
• pnpm --filter @objectstack/lint test: Test Files 196 passed, Tests 8275 passed
• pnpm --filter @objectstack/service-datasource test: Test Files 72 passed, Tests 1239 passed
• pnpm --filter @objectstack/service-automation test: Test Files 264 passed, Tests 3431 passed
• pnpm --filter @objectstack/metadata-protocol test: Test Files 320 passed, 4 skipped; Tests 22487 passed, 26 skipped
• pnpm --filter @objectstack/objectql test: Test Files 560 passed, Tests 11207 passed
• typecheck on metadata-core, metadata-protocol, objectql, service-automation, service-datasource: exit 0 each
• pnpm exec eslint --no-inline-config over the 18 changed .ts files: exit 0
• node scripts/check-platform-checklist.mjs --changed-from origin/main: exit 0 (22 anchors judged, 0 lost)

After merging origin/main at 33bc8ae5f (one conflict, the spec import line of protocol-write-gates.ts: main added DEFAULT_METADATA_TYPE_REGISTRY beside customizationPackageId; resolved to DEFAULT_METADATA_TYPE_REGISTRY alone, the body already read pairOf), pnpm install --frozen-lockfile + closure rebuild, head 979d839e4:

• pnpm --filter @objectstack/metadata-core test: Test Files 25 passed, Tests 944 passed
• pnpm --filter @objectstack/metadata-protocol test: Test Files 320 passed, 4 skipped; Tests 22489 passed, 26 skipped
• pnpm --filter @objectstack/objectql test: Test Files 560 passed, Tests 11207 passed
• pnpm --filter @objectstack/service-automation test: Test Files 264 passed, Tests 3431 passed
• pnpm --filter @objectstack/service-datasource test: Test Files 72 passed, Tests 1279 passed
• typecheck on the same five: exit 0 each
• census re-run on the merged tree: no new customizationPackageId( / isCustomizationPairOf( call site arrived with main

Derived gates

node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack against this diff, every line run with stdin closed, exit codes recorded before any pipe: record /mnt/project-files/server-seat-2/r2026-11-06/out/29594-gates-ran-33e47fa35.list. --ran reconciliation: 65 derived, 64 run, 1 NOT-MEASURED, 0 UNRUN; every run family exit 0.

• NOT MEASURED: pnpm check:dual-build-cjs-loads, reason: PREREQUISITE NOT MET (it reads every package's dist/; this worktree built the closure of the touched packages, not the whole workspace). CI's Lint & Repo Gates runs it on a full build.
• node scripts/check-plugin-teardown-shape.mjs --self-test first answered exit 3 on the shallow clone (pinned fixture commit 621a4876 unreachable); after git fetch origin 621a4876… it is exit 0 (48 cases).

Acceptance notes

• Changeset: Clause-②: yes (widening) (the contract review's reading: three new names on the published @objectstack/metadata-core entry), patch on @objectstack/metadata-core (three new exports), metadata-protocol, objectql, service-automation, service-datasource (their dist now imports the lookup). No served answer changes, so Metadata-protocol: none.
• Deferred to PR 2, named here so it is not lost: packages/runtime/src/domains/packages.ts L669 and L3628 (now L672 / L3737 after the merge). The parse direction (customizationBasePackageId in cli package/install.ts, cloud-connection marketplace-install-local-plugin.ts, runtime, metadata-protocol) is class (ii) and stays: it maps a pair to its base, which under the App unit is the App.
• Outside this census (packages/** only), for PR 2's rehearsal and the domain:ui half: six client-side derivations in ui/packages/app-shell call customizationPackageId from the spec directly: views/metadata-admin/ResourceListPage.tsx:211, views/studio-design/AutomationsFlowRail.tsx:367, BuilderLanding.tsx:163, CustomizationMark.tsx:143, customizationMarks.ts:58, packages-io.ts:239. They answer the same as the server today; once appOf resolves a module to its App they would still derive the module's own pair (for example app.objectstack.hotcrm.service.custom) until the console reads the served pair (ruling 6691022506 routes that to domain:ui, after fix(studio): open system-scope packages read-only, with Customize #29591).
• For PR 2: the module row of the new unit table (app.objectstack.hotcrm.service → app.objectstack.hotcrm.service.custom) pins today's answer on purpose; it is the row the App resolver is meant to flip.
• PackageUninstallExtendedError.customizationPackageId keeps its name: it is a public error property, and renaming it is not part of a no-behaviour-change refactor.
• GitHub writes: this PR through the fleet-write relay pr_create; the harness's assignee/reviewer step is skipped per the dispatch frame (the seat assigns at hand-over).

Head after the review fixes: 678d6d6e (changeset declaration + one test docblock line).

[github-actions]

📓 Docs Drift Check

This PR changes 5 package(s): @objectstack/metadata-core, @objectstack/metadata-protocol, @objectstack/objectql, @objectstack/service-automation, @objectstack/service-datasource, touching 29 documentable anchor(s). ⚠️ 1 changed file(s) yielded no anchor (packages/metadata-core/src/index.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

6 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/concepts/metadata-lifecycle.mdx (via SchemaRegistry (symbol, a top-level class), getMetaItemLayered (symbol, a top-level function))
• content/docs/deployment/environment-variables.mdx (via SchemaRegistry (symbol, a top-level class))
• content/docs/kernel/contracts/metadata-service.mdx (via getPublished (sdk, the bare tail of client method meta.getPublished, bound to GET /api/v1/meta/:type/:name/published; the bare tail of client method meta.getPublished, bound to GET /meta/:type/:name/published))
• content/docs/kernel/services-checklist.mdx (via SchemaRegistry (symbol, a top-level class))
• content/docs/plugins/adding-a-metadata-type.mdx (via SchemaRegistry (symbol, a top-level class))
• content/docs/protocol/kernel/plugin-spec.mdx (via SchemaRegistry (symbol, a top-level class))

⛔ 2 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17/17-3.mdx (via /:type/:name/published (route, bridged from symbol getMetaItemLayered — its route source's handler names it))
• content/docs/releases/v17/17-4.mdx (via SchemaRegistry (symbol, a top-level class))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 1 changed file(s) yielded no anchor (packages/metadata-core/src/index.ts) — pages documenting those are invisible to this run
• the SDK route bridge reached 63 of 222 client-bound route-ledger rows — the other 159 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 159: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 104 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 33 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 7d9f1e973ecc418c21736a58da2eb211f08a3544 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 159648dc7ee6143d8e281ddd8fa2ff684b80545a — the merge of head 678d6d6efecaff6645b7a0692548b2c13a3dacb6 into base 7d9f1e973ecc418c21736a58da2eb211f08a3544, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 159648dc7ee6143d8e281ddd8fa2ff684b80545a && git checkout 159648dc7ee6143d8e281ddd8fa2ff684b80545a
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 7d9f1e973ecc418c21736a58da2eb211f08a3544 678d6d6efecaff6645b7a0692548b2c13a3dacb6 && git checkout -B drift-repro 7d9f1e973ecc418c21736a58da2eb211f08a3544 && git merge --no-ff 678d6d6efecaff6645b7a0692548b2c13a3dacb6

node scripts/docs-audit/affected-docs.mjs --json 7d9f1e973ecc418c21736a58da2eb211f08a3544

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 7d9f1e973ecc418c21736a58da2eb211f08a3544 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

domain:server#2 · os-tesla · session_01L9qibyvxbrLP4jm4PargoH

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 979d839e48a7ef068570e2dfb985ee7e99493005
Local-runs: none
Scope: packages/metadata-core/src/customization-pair-lookup.ts, packages/metadata-core/src/customization-pair-lookup.test.ts, packages/metadata-core/src/index.ts, packages/metadata-protocol/src/protocol-class-head.ts, protocol-customization-package.ts, protocol-discovery-and-bases.ts, protocol-environment-rows.ts, protocol-meta-layered-reads.ts, protocol-meta-list-reads.ts, protocol-overlay-merge.ts, protocol-packaged-base-refusal.ts, protocol-packageless-overlay-migration.ts, protocol-served-overrides.ts, protocol-write-gates.ts, served-override.ts, packages/objectql/src/registry.ts, packages/services/service-automation/src/flow-precedence.ts, packages/services/service-datasource/src/plugin.ts (the whole diff outside the prose face; .changeset/29594-customization-pair-lookup.md read as the ② input) + cited on origin/main (7d9f1e973e): packages/spec/src/kernel/customization-package.ts whole (customizationPackageId, customizationBasePackageId, isCustomizationPackage, isCustomizationPairOf, the refusal reasons, CUSTOMIZATION_PACKAGE_SUFFIX); every customizationPackageId / isCustomizationPairOf hit on origin/main under packages/** non-test (53 + 7 lines, 17 + 3 files) and, for the class (ii) rows, the surrounding code: packages/lint/src/validate-customization-namespace.ts 95–125, packages/runtime/src/domains/packages.ts 660–690 (customizeInPairRemedy) and 3725–3750 (readPackageCustomizations), packages/objectql/src/registry.ts 3322–3400 (PackageUninstallExtendedError.customizationPackageId); the census re-run on 69e133ea for the body's line numbers; packages/metadata-core/package.json (dependencies, exports, publishConfig), tsconfig.json, tsup.config.ts; the package.json of metadata-protocol, objectql, service-automation, service-datasource, runtime and lint (the @objectstack/metadata-core edge); pnpm-lock.yaml and every package.json in the net diff (none); scripts/check-dual-build-cjs-loads.mjs header and .github/workflows/ci.yml 3083 (the job that hosts it); the two vi.mock('@objectstack/spec/kernel') sites in the test corpus; the ui-side derivations under ui/packages/app-shell (six files, outside the census scope); HotCRM src/*/index.ts manifest ids; AGENTS.md Post-Task Checklist step 3, .claude/skills/pm-dispatch/references/contract-review.md, execution-duties.md 70–115 and landing-operations.md 入队与落地 (the Clause-② criterion), packages/metadata-core/CHANGELOG.md (how earlier new exports of this package were declared).

Inputs read: the order dispatch-29594-pr1.md and FRAME.md; card #29594 body; ruling 6691022506 (director#2, maintainer 2026-11-06T17:17Z 「① 定制单位 = App;同意」) and ruling 6691217245 (③ kernel whitelist deferred to a later version, Users + Organizations first); the seat's claim 6691163548 and amendment 6691222368 (home moved to packages/metadata-core; the three isCustomizationPairOf sites added); the os-dev report 6692428237; PR #31026's body, its census table, its 19-file list (+235 / −53), its five commits over merge-base 33bc8ae5ff (0c249372, 965508c2, 11e412ee, 33e47fa3, the main merge 979d839e), the net diff origin/main...979d839e, PR #31008's state (merged 2026-11-06T18:08Z, merge commit d9f8f7fb, an ancestor of this head) and #30756 (open); the docs-drift comment 6692433694; the check-runs on 979d839e, read at 2026-11-06T18:41Z: 46 total, 21 completed/success, 13 completed/skipped, 12 in_progress, 0 failed. Both carriers read by eye: PR body and changeset each carry Clause-②: no and Metadata-protocol: none as line-initial keys, one each; the body carries Ruling-ref: 6691022506 and Refs #29594 (no Fixes). The PR is a draft, mergeable: true, mergeable_state: blocked (checks pending), author objectstack-fleet[bot], branch claude/project-thread-ksdx1z (the claim's branch).

① Derived judgments

• The central question: no served answer changes. appOf(packageId) is return packageId; — a pure function of one string, no registry read, no manifest read, no environment or option, so on main it is the identity for every input and cannot be anything else. pairOf(base) is customizationPackageId(…) over appOf(base) when base is a non-empty string and over base itself otherwise: a non-empty string reaches the id rule unchanged; undefined, '', a number or any other value reaches it as itself and is refused base_id_missing exactly as before; a .custom id reaches it as itself and is refused base_is_customization_package; an id whose pair fails MANIFEST_ID_PATTERN is refused base_id_invalid. So pairOf ≡ customizationPackageId over the whole input domain, value and refusal reason alike. isPairOf(pairId, base) is pair.ok && pair.value === pairId over pairOf(base), which is isCustomizationPairOf's body over customizationPackageId(baseId) verbatim. Hence for every reachable input — an App package (app.objectstack.hotcrm), a module its artifact brings (app.objectstack.hotcrm.service, a real HotCRM id), a standalone package, a sys kernel package (com.objectstack.plugin-auth), a namespace-less manifest (the lookup never reads a namespace; the pair namespace is customizationNamespace's, untouched) — the same pair id, the same refusal and the same predicate value as main. No new 200, no new pair id, no new namespace. TRUE.
• The 20 class (i) sites moved only their call. Every hunk in the 13 consumer files is one of: an import line (the spec helper removed, pairOf / isPairOf added to an existing or new @objectstack/metadata-core import), the one call customizationPackageId(x) → pairOf(x) with the same argument expression and the same guards around it, or a docblock sentence. Branches, refusal sentences, status codes, sort ranks (protocol-meta-layered-reads.ts 408/413), the ?package= remedy text (protocol-packaged-base-refusal.ts 197/217), the uninstall refusal's installedPair (registry.ts 7315) and the PackageUninstallExtendedError shape are byte-identical. The dev's claim "nothing else in those functions moved" is TRUE.
• The 3 isCustomizationPairOf sites. served-override.ts 90 (isServedOverrideRowOf, the predicate five reads share), protocol-class-head.ts 191 (restore intent) and protocol-packaged-base-refusal.ts 1075 (judgeOverrideWrite, which already reads pairOf(base) two lines up) now call isPairOf. Same arguments, same unknown tolerance. TRUE.
• Census. git grep -n customizationPackageId origin/main -- 'packages/**/*.ts' ':!*.test.ts' answers 53 lines in 17 files on today's origin/main as on 69e133ea (the five line numbers I sampled at 69e133ea match the body: discovery 330, write-gates 330, ensure door 255, runtime 669 / 3628, registry 7311). Per-file counts match the table; routed 20 + deferred 2 + stays 31 = 53; the diff's replacements count 20 pairOf + 3 isPairOf. The 31 stays are each an import (removed where the file no longer needs the spec helper), a docblock mention, the spec definition and its own inverse / predicate (5 + 1), the PackageUninstallExtendedError.customizationPackageId property declaration + assignment (a public error field, not a derivation), or lint 108, which reads only the base_is_customization_package refusal reason to skip a manifest that is itself a pair — a parse, and packages/lint does not declare @objectstack/metadata-core, so routing it would have added the edge the home was chosen to avoid. Classification holds. After the merge of main at 33bc8ae5f, no new call site arrived (git diff 33bc8ae5f origin/main adds none). On the head the residual customizationPackageId( / isCustomizationPairOf( outside spec is the four lines the body names (the lookup, lint 108, runtime 672 / 3737) plus two docblock lines in the lookup. TRUE.
• The runtime deferral. packages/runtime/src/domains/packages.ts 672 (customizeInPairRemedy, a remedy sentence) and 3737 (readPackageCustomizations, the extensions read) are class (i) and left on customizationPackageId. Since appOf is the identity, both answer exactly as the routed sites do; nothing diverges until PR 2 moves appOf, which must route them then (the dev's out-of-scope note says so). The order allowed the deferral. One half of the stated reason has lapsed: PR feat(runtime): a host can supply the package-state store (createPackageStateStorePlugin); a refused write fails the enable/disable door with nothing changed #31008 merged at 2026-11-06T18:08Z and its merge commit is inside this head; runtime: enabling a package whose validation rule reads a field of a disabled package is accepted, and every write to that object then answers 400 #30756 (same seat) is still open on that file. Deferral stands; the body's sentence is half-stale (nit).
• No packages/spec edit. The 19-file list carries no packages/spec/** path; customization-package.ts and package-lifecycle.zod.ts keep every export. TRUE.
• The home. @objectstack/metadata-core declares @objectstack/spec and zod only, and its src/ imports none of metadata-protocol, objectql, service-automation, service-datasource or runtime — no cycle. Each of the four consumers (and runtime) already declares @objectstack/metadata-core: workspace:*; service-datasource declares neither metadata-protocol nor objectql, which rules those two homes out. No package.json and no pnpm-lock.yaml in the diff. The new module imports @objectstack/spec/kernel only, no import.meta, no top-level side effect; index.ts adds one export *. TRUE.
• Published face. @objectstack/metadata-core is published (publishConfig.access: public, not private), with a dual exports map on .; index.ts's export * from './customization-pair-lookup.js' adds three reachable names, appOf, pairOf, isPairOf, to that entry. That is a widening of the public face — see ② and should-fix 1.
• Tests. The new unit table (16 cases) pins, for the five shapes the order asked plus the module row, appOf = identity, pairOf = customizationPackageId = the literal pair, the five refusals through pairOf, and isPairOf = isCustomizationPairOf over seven candidates per row plus three edge cases. tsconfig.json include: ['src/**/*'] reaches the test; typecheck runs both programs. The .custom refusal row pins that a pair id passed to pairOf still refuses — the pin PR 2's appOf must keep. The existing suites of every touched package are the behaviour pin (served rows, list and layered reads, write gates, uninstall refusal, flow remedy, import landing) and the diff touches none of them. No test on main mocks the seam (vi.mock('@objectstack/spec/kernel') occurs twice, overriding PROTOCOL_MAJOR and DEFAULT_METADATA_TYPE_REGISTRY only), so the routing is not observable to a mock either. TRUE.
• The two ablations (dev's readings, Local-runs: none). (1) source: appOf maps the HotCRM module to its App → the unit table reds the module row by name (2 of 16). (2) dist: com.acme.crm → com.acme.suite, metadata-core rebuilt, marker present in 2 built files → 48 metadata-protocol tests red across the served-override, pair-translation, named-base overlay write and packaged-base refusal suites, quoting the changed ?package= remedy; restored, marker absent from 12 files, tree clean. Both prove the consumers reach the lookup through the published build, which is what makes PR 2 a one-place change. Shape honest; outputs quoted.
• PR body vs diff. Every claim in "What changes" is in the diff: the three functions, the home and its criterion, the 20 + 3 sites, the untouched spec, the census table, the residual-four sentence, the deferred runtime pair, the "Not in this PR" list (ensure door by App, customizable verdict, sys_ pass-through, platform pair, ADR-0146 D3 amendment docs(adr): ADR-0146 D3 amendment — one .custom pair per App, and one platform pair for the kernel suite (ruling 6691022506 on #29594) #31014). The 維護者速讀 six lines are consistent with it. The verification counts are the dev's; CI on the head is read below.

② Semver level

Metadata-protocol: none is right: no key, accepted value, metadata type, default or meaning an author writes moves; every served /meta answer, refusal and pair id is identical. The changeset is patch on the five packages whose published bytes change (metadata-core's new exports; the four consumers' dist now imports the lookup) — right by step 3 ("none takes patch"; a widening non-protocol change ships patch). Not skip-changeset: five released packages publish. Both carriers carry both line-initial keys once each; Check Changeset is green on this head.

Clause-②: no is the one declaration I do not accept as written. The fleet's criterion (execution-duties.md: 判据:本卡放宽接受集或扩大公开面吗;公开面 = 包构建后的入口声明所达;所达 = 再导出名) reads the built entry's re-exported names; this diff adds three (appOf, pairOf, isPairOf) to a published package's . entry, which is 扩大公开面. The precedent record 6679538573 reasoned the same way in the other direction ("not added to the export list … nothing widened: no (narrowing) is the right spelling"), and this package's own CHANGELOG declares earlier new exports as yes (widening) (resolveObjectSchemaRuntimeView; the @objectstack/spec/ui re-exports) — alongside some no entries that also added exports, so practice is mixed but the rule text is not. The right spelling is Clause-②: yes (widening); the level stays patch. The declaration was copied from the seat's claim 6691163548 and the order, as the dev is told to; the correction is the seat's (claim amendment) and the dev's (PR body + changeset). What the yes would owe — a review at least at TIER_DEFAULT — this record already exceeds, so nothing further is owed once the lines read yes (widening). Should-fix 1, to be corrected before ready; a delta review suffices.

Check-runs on 979d839e at 2026-11-06T18:41Z: 46 total, 21 success, 13 skipped, 12 in progress, 0 failed. Green: Check Changeset, Governed Surface Queue Guard, Dogfood Regression Gate, PR-body guards, Check PR Size, Flag docs affected by code changes, Lint & Repo Gates with every Lint · leg (ESLint, repo & tooling gates, docs & code guards, CI/release & engine gates, PM dispatch-gates, the three scoped legs), Type Check · debt ledger, Type Check · source gates, Test UI, Plan Test Core shards. In progress: Build Core, Test Core 1–8, Type Check · workspace, Type Check · consumer gates, Live E2E UI. check:dual-build-cjs-loads — the one gate the dev could not measure (needs every package's dist) — runs inside Build Core (ci.yml 3083), so it is still unread; its risk is low (the new module has no import.meta and no side effect; the gate parses every emitted .cjs and requires the entry), but it is the gate this PR exists to pass and the seat reads it green before landing. Landing condition: every check completed, 0 failed (contract-review.md ② PR check 全绿), re-read from the API.

③ Boundary flags

• open_questions: none in 6692428237. The dev's out-of-scope note (runtime 672 / 3737 derive directly; the module row is the one PR 2 flips) is read and answered in ①.
• Deviations declared by the dev, all pre-agreed in amendment 6691222368: home metadata-core; the three isCustomizationPairOf sites (served-override.ts is not a protocol-*.ts file); harness assignee step skipped; dual-build-cjs-loads NOT MEASURED locally; patch changeset, not skip-changeset. Each matches the diff.
• File surface: all 19 paths inside the amended claim; no spec, no packages/runtime/src/domains/packages.ts, no governed path, no ui/; size/m; no ! in the title; no dogfood battery owed (no (narrowing) arm).
• Outside the census scope, by design of the order (packages/**): six client-side derivations of the pair in ui/packages/app-shell (ResourceListPage.tsx 211, AutomationsFlowRail.tsx 367, BuilderLanding.tsx 163, CustomizationMark.tsx 143, customizationMarks.ts 58, packages-io.ts 239) call customizationPackageId from the spec. They answer the same as the server today and are not this PR's; under the App unit they become a second spelling that disagrees with the ensure door for a module package. Ruling 6691022506 already routes the console half to domain:ui (fix(studio): open system-scope packages read-only, with Customize #29591 reads the served verdict); should-fix 2 asks that these six be named so PR 2's rehearsal does not meet them by surprise.
• Commits: four plus the merge; trailers Co-Authored-By: Claude + Claude-Session, no Fixes, no model name, no bare login. Author objectstack-fleet[bot].
• Rulings honoured: ① unit = App (the module doc and index.ts comment cite ruling record 6691022506 as provenance, which AGENTS.md allows for a docblock); ③ not in step 1 (the body says kernel objects stay not customizable, Users/Organizations later). The platform pair, the customizable verdict and the sys_ close are correctly absent.
• Independence: rendered by an isolated contract-review subagent fed the order, the card and its two rulings, the claim and its amendment, the os-dev report, the PR body and census, the net diff, every call site and the class (ii) rows on origin/main, the dependency manifests, the gate script and workflow, and the check-runs — not the seat's or the dev's conclusions; adopted by the seat named in Reviewed-by:.

④ Design judgment

• The seam is in the right place and the right shape. One function (appOf) carries the whole App-unit move; pairOf and isPairOf are the only two questions a caller asks, and the module doc forbids the direct spec call for "the pair of this package" while leaving the parse direction (customizationBasePackageId, isCustomizationPackage) with the spec. The residual-four sentence makes the rule checkable by git grep for PR 2's reviewer. The signature (appOf(packageId: string): string) is the one thing PR 2 will have to change — resolving a member to its App needs a manifest or registry read, which a pure function of the id cannot do — and the unit table's rows already carry type, scope and namespace for that day (nit 2). Holds.
• The home holds against the dependency graph. metadata-core is the lowest package all four callers already reach, it depends on none of them, and the two precedents the dev cites (the write dispatch predicates, the code-artifact provenance test) sank there for the same reason. Putting it in metadata-protocol would have forced service-datasource to declare a new edge; objectql likewise. Holds.
• Readability. No drive-by rename, no reformatting; the only prose changes are the docblocks that named the spec helper. The registry.ts import comment states the ruling and the door. Holds.
• The pins are the right pins. The equality table pins the identity by literal value per shape, so a resolver that moves any one row reds that row by name (ablation 1 shows it), and the dist ablation shows the protocol's own suites red when the resolver moves — so PR 2 cannot change the served answer without those suites saying so. Holds.

Findings (none must-fix):

1. should-fix (declaration) — PR body line 6, .changeset/29594-customization-pair-lookup.md line 11, claim 6691163548: Clause-②: no → Clause-②: yes (widening). Three new re-exported names on the published @objectstack/metadata-core entry widen its public face by the fleet's own criterion (execution-duties.md: 公开面 = 包构建后的入口声明所达) and the precedent record 6679538573's reading of it; a wrong no is "可审计的假申报" (landing-operations.md). Level stays patch; Metadata-protocol: none stays; the review the yes owes is this record. The seat amends the claim; the dev edits the two carriers; delta review by this reviewer.
2. should-fix (follow-up note, not this PR) — name the six ui/packages/app-shell derivations (listed in ③) in the PR body's "Deferred" paragraph or on card Customization pairs: every system package shares namespace sys, so only the first can get a .custom pair (422 NAMESPACE_CONFLICT on the rest) #29594 as the domain:ui half's input, so the rehearsal before the ensure-door PR (HotCRM dev:crm, sales + 3 modules → one app.objectstack.hotcrm.custom) expects the console to derive app.objectstack.hotcrm.service.custom on its own until fix(studio): open system-scope packages read-only, with Customize #29591's follow-up reads the served pair. One sentence.

Nits:

• nit — PR body, "Class (i) is 22 … left for PR 2 because runtime: enabling a package whose validation rule reads a field of a disabled package is accepted, and every write to that object then answers 400 #30756 and PR feat(runtime): a host can supply the package-state store (createPackageStateStorePlugin); a refused write fails the enable/disable door with nothing changed #31008 (same seat) are editing that file": feat(runtime): a host can supply the package-state store (createPackageStateStorePlugin); a refused write fails the enable/disable door with nothing changed #31008 merged at 2026-11-06T18:08Z and is inside this head; the reason now rests on runtime: enabling a package whose validation rule reads a field of a disabled package is accepted, and every write to that object then answers 400 #30756 and the order alone. One clause.
• nit — customization-pair-lookup.test.ts: the rows carry type, scope, namespace that nothing reads today; worth one line in the table's docblock saying they are PR 2's inputs, so a reader does not look for the consumer.
• nit — packages/lint/src/validate-customization-namespace.ts 108: the exact spelling of the skip is isCustomizationPackage(manifest.id); today's customizationPackageId(...).reason === 'base_is_customization_package' is the same parse. Under the App unit the lint's question becomes an App-only one — a PR 2+ line, not this PR's.
• nit — for PR 2: pairOf('x.custom') reaches appOf('x.custom'); the App resolver must answer a pair id as itself (or the pair refusal is lost). The refusals table already pins this through pairOf, so it reds if forgotten.

Implemented-by: claude/project-thread-ksdx1z
Reviewed-by: session_01L9qibyvxbrLP4jm4PargoH

VERDICT: PASS — on the contract; landing waits on the in-progress checks (Build Core, which hosts check:dual-build-cjs-loads; Test Core 1–8; Type Check · workspace / consumer gates; Live E2E UI) completing with 0 failed, re-read from the API, and on should-fix 1's two-carrier line.

Record written 2026-11-06T18:44Z.

[objectstack-fleet]

domain:server#2 · os-tesla · session_01L9qibyvxbrLP4jm4PargoH

Contract review · delta

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 678d6d6efecaff6645b7a0692548b2c13a3dacb6
Local-runs: none
Scope: the one commit over the reviewed head, 979d839e..678d6d6e (.changeset/29594-customization-pair-lookup.md line 11; packages/metadata-core/src/customization-pair-lookup.test.ts docblock, +1 line, no code), the PR body as it reads now, claim amendment 6692667330 on #29594, the cancelled runs on 979d839e (Lint & Type Check 42271662399, CI 42271662444; the aggregator TypeScript Type Check job 128085260753 and the cancelled Type Check · workspace job 128077485720 with its step list and log tail), the check-runs on 678d6d6e.

• Why the reviewed head went red. The branch moved at 2026-11-06T18:47Z (push of 678d6d6e); the workflows' concurrency group cancelled both in-flight runs on 979d839e. Type Check · workspace's step 8 is completed/cancelled and its log ends in The operation was canceled. with no error TS line above it; the aggregator TypeScript Type Check then failed on type-check lane typecheck-workspace concluded cancelled -- expected success; six Test Core shards were cancelled the same way. A cancel artefact of the push, not a red the diff caused; nothing in the 979d839 record's ① – ④ moves.
• The delta commit lands findings only. Changeset: Clause-②: no → Clause-②: yes (widening) (should-fix 1); PR body line 6 reads the same, line 114 states the reason, the seat's claim amendment 6692667330 (2026-11-06T18:44Z) carries the same line — the three carriers agree, Metadata-protocol: none and patch unchanged, exactly the correction asked. Test docblock: one sentence that the rows' type, scope, namespace are the App resolver's future inputs (nit 2). PR body line 116 names the six ui/packages/app-shell derivations with the rehearsal expectation and the domain:ui routing (should-fix 2); line 54's deferral now rests on runtime: enabling a package whose validation rule reads a field of a disabled package is accepted, and every write to that object then answers 400 #30756 and the order alone (nit 1). Net diff vs origin/main: 19 files, +236 / −53; no code line changed since 979d839e. Commit trailers clean, no Fixes, no model name.
• Check-runs on 678d6d6e at 2026-11-06T18:50Z: 41 so far, 13 success, 15 skipped, 13 in progress, 0 failed, 0 cancelled. Build Core (hosting check:dual-build-cjs-loads), Test Core 1–8, the Type Check legs and Live E2E UI are the ones still running; the seat re-reads them complete with 0 failed before landing (contract-review.md ② PR check 全绿).

Open after the delta: nothing owed to the dev. Nits 3 and 4 stand as PR 2 notes.

Implemented-by: claude/project-thread-ksdx1z
Reviewed-by: session_01L9qibyvxbrLP4jm4PargoH

VERDICT: PASS (delta) — landing waits only on the 678d6d6e checks completing green.

[objectstack-fleet]

domain:server#2 · os-tesla · session_01L9qibyvxbrLP4jm4PargoH

维护者速读

• 改了什么：「这个包的定制包是哪个」现在只有一个入口 pairOf(base)（@objectstack/metadata-core）：先问 appOf（包属于哪个 App），再推出 <id>.custom。原来散在 metadata-protocol、objectql、两个 service 里的 20 处直接推导和 3 处 isCustomizationPairOf 判定都改走它。
• 为什么改：裁决 ① 定制单位 = App（Customization pairs: every system package shares namespace sys, so only the first can get a .custom pair (422 NAMESPACE_CONFLICT on the rest) #29594 评论 6691022506）。下一个 PR 只改 appOf 一处，所有读写门、列表、卸载拒绝就一起按 App 找定制包。
• 风险与回滚：本 PR 不改行为：appOf 现在原样返回包自己，每处答案、拒绝原因、定制包 id 都与今天相同（16 行等值表逐行钉住，两次消融各红到点名的行）。metadata-core 入口多导出 3 个名字（Clause-② yes (widening)）。回滚＝撤销本 PR。
• 先看：packages/metadata-core/src/customization-pair-lookup.ts（3 个函数），packages/metadata-protocol/src/protocol-packaged-base-refusal.ts（5 个调用点 + 1 处判定）。
• 两分钟验证：pnpm --filter @objectstack/metadata-core exec vitest run --maxWorkers=2 src/customization-pair-lookup.test.ts，预期 16 个用例全绿。
• 需要你做的：无，席位落地。

席位意见：可以落地。

席位核对

ACCEPT · seat domain:server#2 · head 678d6d6e · 2026-11-06T19:12Z

1. Shape: Refs #29594 (PR 1 of the split; the card stays open), draft, base main, 19 files, +236/−53 (289 changed lines, under 3,000; check-governed-merges --pr 31026: 0 of 19 paths governed). Clause-②: yes (widening) (three new re-exported names on the published @objectstack/metadata-core entry), Metadata-protocol: none, patch, on the PR body, the changeset and claim amendment 6692667330. Claim 6691163548, amendment 6691222368 (lookup home metadata-core). Ruling-ref: 6691022506.
2. Premise: ruling ① (unit = App) needs one place that answers the pair; today 20 sites derive <base>.custom on their own. The second ruling 6691217245 (kernel whitelist deferred) does not touch this PR; it shapes PR 2.
3. Review: CONTRACT_REVIEW_TIER review 6692651833 (PASS on 979d839e; should-fix 1 the Clause-② line, should-fix 2 the six ui/packages/app-shell derivations named for the domain:ui half) and delta 6692805697 (PASS on this head; both should-fixes and nits 1–2 in, no code line changed since 979d839e). Nits 3 (lint spelling) and 4 (appOf('x.custom') must answer itself) ride PR 2's order; the refusals table already reds if 4 is forgotten.
4. Gates / check-runs: on head 678d6d6e: 37 success, 15 skipped, 0 failed, 0 in progress (the red TypeScript Type Check on 979d839e was a cancel artefact of the push, read in the delta record). Dev: derived gates and both ablations in report 6692428237.
5. Accepted deviations / out of scope: the two packages/runtime/src/domains/packages.ts sites stay for PR 2 (the order's line; runtime: enabling a package whose validation rule reads a field of a disabled package is accepted, and every write to that object then answers 400 #30756 is editing that file). No packages/spec change.
6. Landing: not governed: the seat readies the PR and arms auto-merge on the maintainer's word in the seat thread 「你应该使用 pm-dispatch 技能审核和落地pr」(2026-11-06T16:49Z).