Retire the paper metadata-customization protocol with its full coupling set — spec module, authorable customizationPolicies/mergeStrategy keys, metadata API §5, optional IMetadataService overlay methods, unreachable packages/metadata limb (re-charter of #12057)

[os-trump]

Widened re-charter of #12057, executing the maintainer ruling of 2026-08-29 (comment 5459699497 on #12057: 「同意」 — retirement under ADR-0049 remove; re-scope explicitly not taken) as applied to the evidence of record (fork report, comment 5451357017 on #12057). The single-module deletion the original card described is not compilable — any compiling PR silently performs the wider removal — so this card charters that wider removal honestly.

Charter basis (all on #12057)

• Maintainer ruling: comment 5459699497 (director batch [WIP] Create a new release version #9, 2026-08-29) — retirement adopted, re-scope rejected, execution through the normal dispatch lanes.
• Decision analysis the ruling adopts: comment 5451376436 — recommendation A (widened retirement), with the pre-registered execution chain naming the spec seat.
• Measurement base: fork report comment 5451357017, measured at objectstack 8beb3deaf / objectui efdc6c62. Re-verify every anchor on the current ref before cutting — first work item.
• Model-level record: ADR-0126 §6.4 (docs/adr/0126-packaged-metadata-customization-model.md) — supersedes the module ("nothing may build against it") and charters retirement.

Retirement surface (from the fork report; re-verify each anchor)

1. packages/spec/src/kernel/metadata-customization.zod.ts — module deletion; the kernel/index.ts:24 barrel line.
2. kernel/metadata-plugin.zod.ts:6,499,505 — MetadataPluginConfigSchema.customizationPolicies and .mergeStrategy are authorable config keys embedding CustomizationPolicySchema/MergeStrategyConfigSchema → retire via the spec-property-retirement playbook routes in full (RETIRED_KEYS_BY_MAJOR, conversion registry, ledgers — the authorable-key discipline, not a bare delete).
3. api/metadata.zod.ts:9,201,208 — section-5 Overlay/Customization API contracts built on MetadataOverlaySchema.
4. contracts/metadata-service.ts:49,631-655 — optional getOverlay/saveOverlay/removeOverlay/getEffective members typed MetadataOverlay (contracts/ has no in-flight claim at filing time; IDataEngine.registerDatasourceDef lags the engine after #12758 — the published contract still refuses external.credentialsRef, and listDatasourceDefs is absent #12805 closed via merged PR feat(spec): IDataEngine datasource-def contract catches up to the engine — external.credentialsRef accepted, listDatasourceDefs declared #12949).
5. kernel/metadata-loader.zod.ts:144 — persistence.overlayWritable (its describe names saveOverlay()).
6. packages/metadata/src/metadata-manager.ts:45 import + the overlay limb (315-316 in-memory map; 2166-2245 getOverlay/saveOverlay/removeOverlay + getEffective patch application) — unreachable from any served surface (no route serves the paper endpoints; only its own unit tests call it). Remove the limb + its test cases (metadata-service.test.ts, metadata.test.ts overlay cases) + plugin.ts:347 'overlay' feature log entry + ROADMAP.md:176 row.
7. src/type-alias-convention.pin.test.ts:164 (M86 rows Iso408-411) — adjust per that pin's own convention for removed modules.
8. Regenerated artifacts: api-surface/kernel.json and whatever else the gates prove stale (api-surface/export-origins for contracts, json-schema manifest); the generated reference page content/docs/references/kernel/metadata-customization.mdx disappears with the module; ADR-0087 registration per the gate's own verdict; changeset.

Explicitly NOT in this card

• ADR-0126 §6.4 "consumed by zero runtime packages" factual correction — separate draft-only PR card (governed surface, human merge).
• objectui packages/types/src/views.ts:411 comment-only mention (already says "Do not re-point this at it") — cosmetic, no action.
• Inline vocabulary twins that do NOT import the module (api/package-api.zod.ts:186 mergeStrategy enum; kernel/package-upgrade.zod.ts same three-value vocabulary) — separately declared surfaces, do not touch.

Stop conditions (report the fork on this card, never force)

• Re-verification finds a consumer OUTSIDE the surface above (new coupling since 8beb3deaf), or ADR text contradicting retirement.
• An authorable-key retirement route (conversion/ledger) demands a shape the playbook does not cover.

Serialization notes

• Retirement registries/ledgers and api-surface files are shared hot files with in-flight landing chains (fix(spec): translatePage resolves copy for components nested in properties.children #13111/feat(spec,lint): author-time rejection for unknown component types in spec-reserved namespaces; Phase-2 readiness read keeps both members #13117/docs(spec): anchor the BatchOptions.validateOnly tombstone to the release that removed it #13127) — merge current main before the final push; landing-window serialization owned by the PM.
• content/docs/kernel/contracts/metadata-service.mdx documents getEffective examples and is edited by open PR docs(kernel): teach the dot-qualified view item name in metadata-service.mdx #13133 (metadata-service.mdx teaches FLAT view item names (get('view', 'account_list')) while ViewItemNameSchema requires the dot-qualified form — which grammar governs a stored view row's name? #12384) — merge main before final push; if the page teaches the retired optional members, their teaching goes with them.

Size: L. Clause-②: yes on both legs (PATH: packages/spec/src/**; CONTENT: public-export deletion narrows the published face) — fable-tier dispatch mandatory; needs:contract-review attaches when this card's PR exists.

[os-trump]

Claim: PM loop round R7 (domain:spec seat)
Session: session_01LpRNHxWZgSUgVnFT9mQQo4
Branch: claude/issue-13135-widened-customization-retirement
Worktree: objectstack-issue-13135
Domain: domain:spec — inherited from #12057's triage routing (unlock note 5420361646: route "through the spec seat"); attached at filing under the maintainer-ruled execution chain below; pm:retriage path open if triage disagrees.
File surface: packages/spec/src/kernel/metadata-customization.zod.ts (delete) + kernel/index.ts barrel; kernel/metadata-plugin.zod.ts (authorable customizationPolicies/mergeStrategy via spec-property-retirement routes); api/metadata.zod.ts §5; contracts/metadata-service.ts optional overlay members; kernel/metadata-loader.zod.ts persistence.overlayWritable; packages/metadata/src/metadata-manager.ts limb + tests + plugin.ts feature log + ROADMAP.md row; type-alias-convention.pin.test.ts M86 rows; regenerated api-surface/export-origins/json-schema/reference pages; ADR-0087 registration per gate verdict; ledgers; changeset. Stop on breach; explain in the report.
Container & model: L, mode:subagent, model: claude-fable-5 — Clause-② both legs (PATH: packages/spec/src/**; CONTENT: public-export deletion + authorable-key retirement narrows the published face); dispatch at CONTRACT_REVIEW_TIER.
Clause-②: yes — binds the enqueue gate: needs:contract-review re-attaches the moment this card's PR exists.
Authorization (direct channel; verbatim per protocol): maintainer 2026-08-29 「同意」, recorded by the director session in #12057 comment 5459699497, adopting decision comment 5451376436 whose recommendation A and pre-registered chain this card executes: 「重立宽卡(或两张串行)引本卡与 dev 报告为测量底稿 → 条款② fable 派发 → ADR 更正单独 draft PR 挂人工合并 → 本卡关闭指向新卡」.
Reconciliation on the record: the ruling's "zero consumers with positive controls" line restates #12057's original card-body measurement — true for that card's literal grep set, re-verified with positive controls in the fork report. The same fork report's widened measurement (comment 5451357017) found the couplings this card charters for removal; option B (narrow, as originally dispatched) was established non-executable there. The ruling adopts retirement and rejects only re-scope, so the A-route execution here applies the ruling to the evidence of record — it does not re-litigate it. If the maintainer or director reads the ruling as narrower than option A, say so on this card: the PR stays draft behind contract review until the arming step, which is the veto window.
Serial constraints cleared: contracts/ freed (#12805 closed, PR #12949 merged); in-flight #13002 (check-doc-authoring + driver/ui zod prose) and #12384 (metadata-service.mdx teaching lines, PR #13133) are disjoint except metadata-service.mdx at the landing window — serialized by the PM; landing chains #13111/#13117/#13127 share registries/api-surface hot files — dev merges main before final push.

---

Generated by Claude Code

[os-trump]

os-dev claim — session session_01LpRNHxWZgSUgVnFT9mQQo4 (os-dev seat dispatched by the domain:spec PM seat of the same session, PM loop R7), branch claude/issue-13135-widened-customization-retirement.

Executing the chartered widened retirement (option A per decision comment 5451376436, ruling 5459699497). First work item: re-verify the fork report's grep sets (a)-(h) on current origin/main before any edit. Stop conditions per the charter apply.

---

Generated by Claude Code

[os-trump]

Dead-claim recovery + tier downgrade re-dispatch (domain:spec seat, session_01LpRNHxWZgSUgVnFT9mQQo4, R7).

What happened — the third death mode, with a host signal: the fable dev terminated mid-work on rate_limit HTTP 429, host message verbatim: "You've reached your Fable 5 limit. Switch to another model, or manage usage credits… (model sent to the API: claude-fable-5)". Per the recorded reading of this death mode: dispatch is dead, the premise is intact, the card is stuck on a resource ⇒ dead-claim recovery + worktree salvage, ⛔ no premise re-verification, ⛔ no escalation.

Salvage (verified, not assumed): branch claude/issue-13135-widened-customization-retirement carries three pushed WIP commits (425f36734 → 100ce9034 → c2ef279f0) — 58 files, +1153/-1608 against base 4d94823a3, including the ADR-0087 retired-defs entries, the migrations registry rows, the pin-test updates and the regenerated artifacts — plus two uncommitted files in the live worktree. Nothing lost.

Tier: re-dispatched at opus under the quota-exhaustion exemption (maintainer 2026-08-13, verbatim 「fable 如果用完了,可以用 opus」), whose rule states the downgrade applies to a re-dispatch as well ("重派同样可降") and requires the tier and reason be recorded on the claim — done here. Floor is opus, ⛔ no lower.

Container & model (superseding the original claim line): L, mode:subagent, model: claude-opus-5 — fable measured unavailable (429 above, twice across two agents in this lane within minutes). Clause-② is unchanged and both legs still apply; the compensating control is unchanged too: needs:contract-review attaches to the PR and STAYS.

Landing posture: this seat's own tier fuse now reads claude-opus-5 on both fields, so ⛔ this seat does not contract-review or arm this PR. On delivery the PR is left DRAFT with the gate label on both carriers and a parking note — the review belongs to the triage seat's timed round, with the director seat as the summoned fallback.

Charter, file surface and stop conditions are unchanged from claim 5460676643.

---

Generated by Claude Code

[os-trump]

os-dev continuation claim

Continuing the quota-terminated dispatch at opus under the recorded quota-exhaustion exemption.

• Session: session_01LpRNHxWZgSUgVnFT9mQQo4
• Branch: claude/issue-13135-widened-customization-retirement
• Predecessor WIP already pushed: 425f36734 then 100ce9034 then c2ef279f0
• Posture: NOT a restart. The predecessor's work on this branch survives and is carried forward; the premise is not re-verified per the death-mode rule.

Picking up at the point the predecessor stopped: spec typecheck, the packages/metadata package legs, then the derived gate family, WIP history cleanup, origin/main merge, one push, one DRAFT PR carrying needs:contract-review.

---

Generated by Claude Code