ADR-0126 §6.4 factual correction: "consumed by zero runtime packages" was instrument blindness — the paper customization module had a build-against consumer in packages/metadata at the measured ref

[os-trump]

Step 3 of the maintainer-ruled execution chain on #12057 (ruling: comment 5459699497, adopting decision comment 5451376436 — verbatim chain line: 「ADR 更正单独 draft PR 挂人工合并」). Sibling of #13135, which executes the widened retirement itself.

What to correct

docs/adr/0126-packaged-metadata-customization-model.md §6.4 records the predicate "consumed by zero runtime packages" for kernel/metadata-customization.zod.ts. The fork report on #12057 (comment 5451357017) established that this reading was instrument blindness at measurement time, not later drift:

• The schema-name grep set genuinely reads zero outside packages/spec, with positive controls — that instrument was blind to the module's exported TYPE names.
• The widened measurement finds a real build-against consumer: packages/metadata/src/metadata-manager.ts:45 imports type MetadataOverlay from @objectstack/spec/kernel and implements a working overlay limb (in-memory map at 315-316; getOverlay/saveOverlay/removeOverlay/getEffective at 2166-2245) — unreachable from any served surface (no route serves the paper endpoints; only its own unit tests call the methods).
• Verified present at the original card's measured ref 0b048393f via git show, so the zero-consumer reading was wrong when recorded, and §6.4 inherited it.

What is NOT touched

⛔ The model-level ruling is not re-opened: §6.4's supersession ("nothing may build against it") and the retirement charter stand — the maintainer's 2026-08-29 ruling adopts retirement on the widened evidence. This card corrects only the factual record so the ADR does not teach a false measurement.

Deliverable

ONE docs-only draft PR editing docs/adr/0126-packaged-metadata-customization-model.md. Follow the ADR file's own correction convention if it has one (dated addendum / correction note); otherwise add a dated "Correction (2026-08-29)" note under §6.4 stating the corrected predicate (one unreachable build-against consumer in packages/metadata, reachable only from its own unit tests; zero served-surface consumers) and citing #12057 comment 5451357017. Governed surface — the PR stays draft, human merge: ⛔ never mark ready, never arm auto-merge.

Size: S. Clause-②: no (no packages/spec/src/** touch; no accept/reject or public-surface change — a docs factual note on a governed file whose landing is human).

[os-trump]

Claim: PM loop round R7 (domain:spec seat)
Session: session_01LpRNHxWZgSUgVnFT9mQQo4
Branch: claude/issue-13136-adr-0126-factual-correction
Worktree: objectstack-issue-13136
Domain: domain:spec — inherited from #12057's triage routing, same basis as sibling #13135 (unlock note 5420361646); pm:retriage path open.
File surface: docs/adr/0126-packaged-metadata-customization-model.md only — dated correction note under §6.4 (or the file's own correction convention). Draft PR, human merge: ⛔ never mark ready, never arm auto-merge. Stop on breach; explain in the report.
Container & model: S, mode:subagent, standard tier — Clause-②: no (no packages/spec/src/** touch; a factual docs note on a governed file; no accept/reject or public-surface change).
Authorization (direct channel; verbatim per protocol): maintainer 2026-08-29 「同意」 (#12057 comment 5459699497), adopting decision comment 5451376436's chain: 「ADR 更正单独 draft PR 挂人工合并」.
Serial constraints cleared: single governed file; no in-flight claim touches docs/adr/0126-* (sibling #13135's charter explicitly excludes it; #13002/#12384 surfaces disjoint).

---

Generated by Claude Code

[os-trump]

os-dev claim — starting work on this card.

• Session: session_01LpRNHxWZgSUgVnFT9mQQo4 (dispatched by the domain:spec PM seat, loop round R7)
• Branch: claude/issue-13136-adr-0126-factual-correction
• Scope: docs-only, docs/adr/0126-packaged-metadata-customization-model.md §6.4 factual correction. No other file touched; the §6.4 supersession ruling and the retirement charter are not re-opened.

---

Generated by Claude Code

[os-trump]

os-dev-report

{
 "issue": 13136,
 "status": "done",
 "branch": "claude/issue-13136-adr-0126-factual-correction",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/13139",
 "premise_still_valid": true,
 "summary": "ADR-0126 now records the corrected predicate for the paper customization module: one unreachable build-against consumer, zero served-surface consumers — instrument blindness at measurement time, not later drift. Delivered as an inline dated correction under §6.4 following the corpus's established convention (the ADR-0088 form: a per-claim '⚠️ Correction (#issue, date):' appended to the exact claim rather than rewriting it, explicitly recording the governing decision as unaffected; two prior instances, #4936 and #10724). Every fact was re-measured in-branch before writing, not taken from the report: MetadataOverlay is exported at metadata-customization.zod.ts:311; packages/metadata/src/metadata-manager.ts:45 imports it and backs a live overlay limb (map 315-316, getOverlay/saveOverlay/removeOverlay/getEffective at 2166-2249); a repo-wide git grep at ref 0b048393f returns only the module's own internal use and that package's own unit tests as callers — no served surface. Present at 0b048393f (the ADR's own Evidence ref) and still present on base 4d94823a3. SCOPE NOTE — the diff has two hunks in the one chartered file: §6.4 carries the full correction as chartered, and §1.1 gets a one-clause pointer because it restates the identical false predicate ('consumed by zero runtime packages') and would otherwise keep teaching it. Taken as a bounded in-place fix (same file, same defect class, mechanically pinned by the same evidence, no new verification surface) and declared in the PR body; it is a pointer to §6.4, not a second copy. The model ruling is NOT re-opened — the supersession and the enforce-or-remove charter are stated as standing, and sibling #13135 is described as in flight, never as landed. PR is DRAFT for the maintainer's hand-merge: not marked ready, no auto-merge, not queued. skip-changeset applied per the docs-only class (single docs/adr/** file publishes nothing from any package); the label write used the read-union-write path because the additive REST endpoint is 403 for this seat, and the read caught two bot labels (documentation, size/s) a bare set-write would have stripped.",
 "tests": "Gate family derived mechanically — `node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack`, no hand-fed paths (exit 0; it read 1 path vs merge base 4d94823a3, three-dot semantics, and asserted the answer belongs to objectstack-ai/objectstack). Five families matched; all five run GREEN after the final commit, at c343bf0b1 (tree clean, nothing landed after the run). Exit codes captured before any pipe via redirect-then-tail. Verdict lines as each gate printed them: check:adr-anchors — 'check-adr-anchors: OK (52 anchored file(s), every governing ADR still referenced; 126 decision number(s) ...; 30009 citation(s) across 3818 file(s) resolve)'; check:doc-authoring — '✓ doc authoring guard: 392 files clean — no bare metadata literals.'; check:doc-formula-expressions — '✓ check:doc-formula-expressions: 22 record-scoped formula example(s) across 425 files / 1453 TS blocks judged clean by @objectstack/formula.'; check:pm-governed-merges — '✓ check-governed-merges --self-test: 206 assertions' plus 'live: the real generator declared 9 output(s) and certified this tree'; check-adr-links.mjs — '✅ check-adr-links: 571 relative link destination(s) under docs/adr/ resolve'. NOT-MEASURED episode, recorded rather than smoothed over: check:doc-formula-expressions first exited 1 with 'PREREQUISITE NOT MET — the workspace package @objectstack/formula is not built', whose own text says 'Nothing was measured: this gate exited before running a single check'. Read as NOT MEASURED, not as a red gate. Cleared by building @objectstack/formula and then @objectstack/lint (both through scripts/pm/os-verify-lock.sh, VERDICT command-exit 0 on each), after which the gate ran and passed on its own terms. No gate was weakened or skipped. NO ABLATION was performed and none is claimed — the diff is prose in one markdown file, so there is no guard whose failure could be demonstrated; saying so beats filling the field with a template. Control-byte self-scan on the edited file clean (grep -naP over the C0 set plus DEL, no matches). PR body read back in full after creation: intact through the footer, draft true, 1 file, +20/-1.",
 "mcp_calls": "12 — claim comment, issue body, issue comments, create PR, 2 failed get_labels probes, pull_request_read, 2 list_pull_requests (label read + read-back), issue_write labels, this report comment, and its read-back",
 "open_questions": [],
 "out_of_scope_findings": [
 "NOT FILED — handed to PM instead, because it is agent-tooling behaviour rather than an objectstack defect, so filing it in this repo would be the wrong home: on a freshly created PR, MCP `issue_read` method `get_labels` fails with 'Could not resolve to an Issue with the number of 13139' (reproduced twice, ~1 min apart), while `list_pull_requests` with fields ['labels'] returns them correctly. This matters beyond one card: the label protocol's mandated read-union-write fallback depends on that read, and a seat that reads the failure as 'no labels' would write a bare set and silently strip concurrent bot labels — exactly what would have happened here to `documentation` and `size/s`. Suggested home if PM agrees it is worth recording: the pm-dispatch references/rest-channel.md or platform-readings channel note, not a repo issue."
 ]
}

---

Generated by Claude Code

[os-trump]

ACCEPT (domain:spec seat, session_01LpRNHxWZgSUgVnFT9mQQo4, R7) — dev report reviewed; PR #13139 stands as chartered.

• The correction follows the corpus's own convention (the ADR-0088 form: a per-claim "⚠️ Correction (#issue, date)" appended to the exact claim, two prior instances cited) rather than rewriting the ruling; the model-level decision is explicitly stated as standing, and sibling Retire the paper metadata-customization protocol with its full coupling set — spec module, authorable customizationPolicies/mergeStrategy keys, metadata API §5, optional IMetadataService overlay methods, unreachable packages/metadata limb (re-charter of #12057) #13135 is described as in flight, never landed.
• Scope note accepted: the second hunk in §1.1 is a one-clause pointer to the §6.4 correction because §1.1 restates the identical false predicate — same file, same defect class, pinned by the same evidence; declared in the PR body, not silent widening.
• Every fact re-measured in-branch (export at metadata-customization.zod.ts:311, the metadata-manager.ts:45 import + limb, the ref-0b048393f grep with no served-surface caller) rather than copied from the fork report. Five derived gate families green at c343bf0b1 with quoted verdicts; the formula-gate PREREQUISITE NOT MET episode correctly read as not-measured, cleared by building, then re-run green.
• Governed surface: the PR is DRAFT and stays draft for the maintainer's hand-merge — ⛔ this seat never marks it ready and never arms auto-merge. Patrol re-checks the PR each fire; residue strips when the card closes at merge.

The dev's tooling observation (MCP get_labels failing on a fresh PR number while list_pull_requests returns labels — a read that, misread as "no labels", would make the RMW fallback strip concurrent bot labels) is a platform-facts channel note; this seat routes it to the skills lane rather than a repo issue.

---

Generated by Claude Code