docs(adr): correct ADR-0126 §6.4 — the paper protocol's zero-consumer reading was instrument blindness

[os-trump]

Fixes#13136

Step 3 of the maintainer-ruled execution chain on #12057 (ruling: comment 5459699497, adopting decision comment 5451376436 — verbatim chain line: 「ADR 更正单独 draft PR 挂人工合并」). Docs-only factual correction to ADR-0126; the model ruling is untouched.

What this corrects

ADR-0126 recorded the paper customization module (packages/spec/src/kernel/metadata-customization.zod.ts) as "consumed by zero runtime packages". The fork report on #12057 (comment 5451357017) established that this was instrument blindness at measurement time, not later drift, and this PR records that on the ADR.

The corrected predicate: one unreachable build-against consumer, zero served-surface consumers.

Evidence — re-verified in this branch, not taken on trust

Every fact in the note was re-measured against the ADR's own evidence ref 0b048393f before writing it:

• The original instrument was sound within its own scope. The schema-name grep genuinely reads zero outside packages/spec, positive controls included. It was blind to the module's exported type names — MetadataOverlay is exported at metadata-customization.zod.ts:311 (z.input of MetadataOverlaySchema, declared at :106).
• The build-against consumer is real.git show 0b048393f:packages/metadata/src/metadata-manager.ts carries import type { MetadataOverlay } from '@objectstack/spec/kernel'; at line 45, backing a working three-layer overlay limb: the in-memory map at 315-316, and getOverlay / saveOverlay / removeOverlay / getEffective in the block at 2166-2249.
• It is unreachable from any served surface. A repo-wide git grep at that ref for calls to those four methods returns exactly two populations: the module's own internal use inside getEffective (2221, 2232, 2242), and that package's own unit tests (metadata-service.test.ts, metadata.test.ts). No route serves the paper endpoints.
• It was already wrong when recorded. The consumer is present at 0b048393f — the very ref ADR-0126's Evidence header pins — so the ADR inherited a reading that was false at measurement time. It is still present on this branch's base 4d94823a3, at the same line numbers.

What is deliberately NOT touched

The model-level ruling is not re-opened. §6.4's supersession ("nothing may build against it") and the enforce-or-remove charter stand — the maintainer's 2026-08-29 ruling adopts retirement on this widened evidence. The correction note says so explicitly, so a reader cannot mistake it for a reversal. Sibling #13135 executes the widened retirement itself and is still in flight; nothing in this PR claims that work has landed or depends on it.

Diff shape — two hunks, one file, and why there are two

The charter names §6.4, and that is where the correction lives, in full. The second hunk is a bounded in-place fix within the same file and the same defect class: §1.1 carries a restatement of the identical predicate ("consumed by zero runtime packages"), and leaving it un-annotated would have left the ADR still teaching the false measurement one section earlier — the exact outcome the card exists to prevent. It is a pointer, not a second copy: it names the corrected count in one clause and sends the reader to §6.4, keeping one home for the correction. No third location carries the predicate.

Convention followed: the corpus's inline ⚠️ **Correction (#issue, date):** form, appended to the exact claim it corrects rather than rewriting it — the ADR-0088 precedent (two instances, #4936 and #10724), which is also the closest analogue in shape: a per-claim factual correction that explicitly records the governing decision as unaffected. The original wording is left standing so the record shows what was recorded.

Changeset — deliberately none, and the gate's own evidence for it

dispatch-gates.mjs printed the changeset families under an explicit conditional — "Once a changeset exists, 9 more famil(ies) apply — write one unless this card is docs-only". This card is docs-only: the diff is a single file under docs/adr/**, which publishes nothing from any package, so there is no consumer-visible change for a CHANGELOG.md entry to describe. The skip-changeset label is the recorded decision for that class and has been applied to this PR.

Verification

Gate family derived mechanically from the real change set — node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack, no hand-fed paths (it read 1 path vs merge base 4d94823a3, three-dot semantics). All five ran green after the final commit, at c343bf0b1, each exit code captured before any pipe:

Gate	Verdict line it printed
check:adr-anchors	check-adr-anchors: OK (52 anchored file(s), every governing ADR still referenced; 126 decision number(s) …; 30009 citation(s) across 3818 file(s) resolve …)
check:doc-authoring	✓ doc authoring guard: 392 files clean — no bare metadata literals.
check:doc-formula-expressions	✓ check:doc-formula-expressions: 22 record-scoped formula example(s) across 425 files / 1453 TS blocks judged clean by @objectstack/formula.
check:pm-governed-merges	✓ check-governed-merges --self-test: 206 assertions … + live: the real generator declared 9 output(s) and certified this tree
check-adr-links.mjs	✅ check-adr-links: 571 relative link destination(s) under docs/adr/ resolve

One note on the third row, so the run is readable: check:doc-formula-expressions first exited 1 with PREREQUISITE NOT MET — the workspace package @objectstack/formula is not built. That is the gate refusing to measure, not a finding — its own text says "Nothing was measured: this gate exited before running a single check". Building @objectstack/formula and then @objectstack/lint cleared it, after which the gate ran and passed on its own terms. No red gate was worked around.

Governed surface — this PR stays DRAFT

The diff touches docs/adr/**, a governed surface under Prime Directive #14. It is left draft for the maintainer's hand-merge: ⛔ not marked ready, ⛔ no auto-merge armed, ⛔ not queued. Under Prime Directive #13 the merge of an ADR change is the act of adopting it, so "CI is green" carries no authority here.

---

Generated by Claude Code