[objectstack-fleet]

Requested by Steve · project thread

Part of #25467

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么：把 protocol.ts 类定义之上的整段前言（183 条顶层声明，约 6,300 行）原样搬进 22 个按主题命名的 protocol-*.ts 模块；protocol.ts 照旧导出原来导出的每个名字。没有任何逻辑改动。
• 为什么改：protocol.ts 是 server 车道的热文件，每个改它的 PR 都要排队；这是 [maintainer] refactor(metadata-protocol): split src/protocol.ts (33,065 lines, +10,169 in 30 days) along its ObjectStackProtocolImplementation seams, one move-only slice per PR #25467 裁决 E 的第一步 E0（E1、E2 之后另派），按字母 A 的 .d.ts 新判据落地。
• 风险与回滚：低。工具逐条证明 190/190 条语句逐字搬移、无改动无多余；对外 index.d.ts 声明集合、顺序、ESM/CJS 导出名单都不变，原始字节只差空行、一条 import 内的名字顺序、一个字面量联合的成员顺序。另把 QA 清单和 spec liveness 账本里 3 处指向被搬符号的引用改指新模块。回滚即整体 revert 本 PR。
• 先看：packages/metadata-protocol/src/protocol.ts（文件头的 import/export 名单）；packages/metadata-protocol/src/protocol.read-verb-canonical-fold.test.ts（迁移后的按路径 pin）；packages/metadata-protocol/src/protocol.lookup-artifact-item-call-sites.test.ts。
• 两分钟验证：pnpm --filter @objectstack/metadata-protocol exec vitest run src/protocol.read-verb-canonical-fold.test.ts src/protocol.lookup-artifact-item-call-sites.test.ts，预期 2 个文件全绿（main 上的搬移前形态同样绿；搬移后不迁移则红 2 条）。
• 需要你做的：审批合并（改动约 13,200 行，超过 3,000 行人工合并线）；另请确认 packages/spec/liveness/query.json 两处证据引用改指新模块可以留在本 PR（不留则 check:liveness 红）。

What changes

Step E0 of ruling E (6537939895, folded onto #25467 in 6537947529), landed under letter A (6545252863). Move-only.

• Every top-level statement above export class ObjectStackProtocolImplementation in packages/metadata-protocol/src/protocol.ts that is not an import or an export list (183 declarations) moves verbatim, with its leading comments, into one of 22 new themed modules: protocol-meta-type-schema, protocol-authoring-refusals, protocol-metadata-issues, protocol-publish-backfill-request, protocol-data-request-shapes, protocol-view-normalization, protocol-package-bindings, protocol-bundle-members, protocol-overlay-merge, protocol-version-tokens, protocol-write-constants, protocol-client-failures, protocol-list-query-params, protocol-discovery-services, protocol-reference-hits, protocol-write-face, protocol-package-lifecycle-types, protocol-mutation-events, protocol-authoring-channel, protocol-audit-entry, protocol-stored-overlay-types, protocol-door-requests.
• The theming is the predecessor trial's (claude/project-thread-6aibsn@4a35157e, seat 4's report 6542958324), redone by tool on fresh main. The three statements added since that trial follow the statement before them: isActionWithheldByDisabledPackage → protocol-authoring-refusals, perPackageLayerEnvelope → protocol-package-bindings, storedEntryRow → protocol-stored-overlay-types.
• The only new text is import lists, export lists (export { … } at a module's foot for a name that was module-private and is now shared; export { … } from in protocol.ts for every name it exported before) and a module header comment per module. The three preamble export lists that re-export imports (FormFieldInput, recordNotFoundError, stripReadDecorations) stay in protocol.ts with their comments. protocol.ts imports the modules in the order that keeps the rolled-up .d.ts declaration order equal to the base's.
• protocol.ts: 30,912 → 24,892 lines (on main f125ce40da). No class-body member is touched (that is E1/E2).
• Three citations that named a moved symbol at protocol.ts and no longer resolve there are re-pointed at the module it moved to: docs/qa/platform-checklist/areas/studio-authoring.json (diffShallow → protocol-write-face.ts, twice; protectionBlockRefusal → protocol-authoring-refusals.ts) and packages/spec/liveness/query.json (QUERY_AST_KEYS, WIRE_DOLLAR_ALIASES → protocol-list-query-params.ts; red in check:platform-checklist --changed-from and check:liveness before). Citations that still resolve through protocol.ts's re-exports (ConcurrentUpdateError, servedViewExpansion, specValidationFindings, and the ADR texts) are left as they are; check:adr-symbol-anchors is green.
• Changeset .changeset/25467-e0-protocol-preamble-modules.md: patch on @objectstack/metadata-protocol, and patch on @objectstack/spec because liveness/ ships in its tarball; both declaration lines.

Tests

Forced edits, all because a reader names a moved symbol by its file path: two tests and two data files that are not tests.

Two by-path pins read preamble symbols out of protocol.ts and are migrated in this PR (forced test edits, both in packages/metadata-protocol/src/):

• protocol.lookup-artifact-item-call-sites.test.ts: envelopePackageId's one definition is read from protocol-package-bindings.ts; two assertions are added so the pin keeps its reach: protocol.ts defines no copy of its own, and it imports envelopePackageId from that module.
• protocol.read-verb-canonical-fold.test.ts: the four door request aliases (SaveMetaItemRequest … DeleteMetaItemRequest) are read from protocol-door-requests.ts, only when protocol.ts imports them from that module, so the signature judged is still the one the class names.

Two by-path citations in data files are re-pointed (forced, not tests): docs/qa/platform-checklist/areas/studio-authoring.json and packages/spec/liveness/query.json, as listed under What changes.

Before the migration the package suite was 2 failed / 298 passed files, the failures exactly these two pins (13 of 17 verbs found; function envelopePackageId not in protocol.ts).

Ablations (one-off, each from committed HEAD through scripts/ablation-replace.mjs, restored to the HEAD blob with git diff HEAD empty)

• read-verb fold: saveMetaItemUnaudited's request = canonicalizeMetaRequestType(request); replaced by request = { ...request }; (anchor 1 → 0, blob a0a204da0761 → 6d869851bc31). The pin goes red: Tests 1 failed | 17 passed (18), received [ "saveMetaItem" ] against [], the verb whose request type now comes from the moved alias.
• lookup, definition home: the bindings module's envelopePackageId signature changed (served: unknown → served?: unknown; blob e062a10a8f3e → 47d2d431def2). Red: Tests 1 failed | 4 passed (5), expected '// Copyright …' to match /\nfunction envelopePackageId\(request…/.
• lookup, no second copy: a local function envelopePackageId(…) put back into protocol.ts (blob a0a204da0761 → cb2f4764a1cf). Red: Tests 1 failed | 4 passed (5), expected '// Copyright …' not to match /\nfunction envelopePackageId\(/.

Acceptance notes

• Move-only, by tool (a verifier separate from the move tool): every non-import top-level statement of base protocol.ts (190, the class and the three trailer statements included), leading comments included and blank lines before it excluded, appears verbatim exactly once across head protocol.ts and the 22 modules: verbatim 190, missing 0, changed 0, surplus 0, duplicated 0. Head adds import statements (109 → 183), 47 export lists and 165 module-header comment lines. Negative control: one operator changed in protocol-version-tokens.ts (hash = hash & hash → hash = hash | hash) → verbatim 189, changed 1, surplus 1 (simpleHash), exit 1; restored, blob equals HEAD.

• .d.ts, normaliser 2 (letter A). Read-only, not a gate (the card adds no gate). Normalised: drop blank lines; sort the names inside each import brace list; sort each run of consecutive string/number literal members of a union. Everything else survives.

  dist/index.d.ts (= index.d.cts byte for byte, both sides)	base main f125ce40da	head 20d8c2c813
  raw sha256	65a4356b2efed1dd5d25e5d80a55fccfef2adfd4a6c098c686d85f1a4749b0ab	d939f04a7ae66bbf19398a1f7ff4d905748fe9de667b8092105cffae3deec955
  normaliser 2 sha256	7dea44d6d7660b9c7412af3cd0c6aa0382e3ab11dc52505431372f8185ecd97d	7dea44d6d7660b9c7412af3cd0c6aa0382e3ab11dc52505431372f8185ecd97d

  An earlier reading, base 74a19dd857 against head c1d3b9dec3, gave equal normaliser 2 hashes the same way (ff357c33…).

  Raw diff: 11 added blank lines, 1 line pair (the @objectstack/spec/api import brace list, MetadataAuthoringSurface, MetadataAuthoringClient first) and 2 line pairs (columns?: in getMetaTypes()'s inferred return type, members permuted). Declaration sequence (182 top-level statements) identical but for that import line; the final export-list line identical.

  Positive controls (each applied to head, each must differ from base and does): a class's private engine; made public; one name dropped from the export list; MetadataWriteFace moved to the end; one union literal dropped; one readonly removed; and a real one, an earlier layout of this head whose .d.ts carried a leaked JSDoc comment (below). Negative controls (each allowed kind alone, applied to base, must equal base and does): blank lines inserted; the import brace list reversed; the literal union permuted. The controls assert each edit landed (raw text changed).

• A declaration-emit trap met on the way, noted (not filed: it changes no published meaning and is TypeScript's behaviour, not this package's). The first layout of this move published description? /** [#27842] The list's disabledActions … */: string | undefined; inside getMetaTypes()'s inferred return type: the emitter printed a comment that sits in protocol.ts at the byte offset of a node reused from another file. One line more in the protocol.ts header comment moved the offset and the comment left the .d.ts. It struck again after merging main with fix(metadata-protocol)!: a runtime permission-set save refuses a grant on an object that does not exist #29093 (class-body lines shifted); two more lines in the E0 note (now 5 lines, which also tells the next editor to read the raw .d.ts diff) cleared it, and the final reading above has no comment in the raw diff. Normaliser 2 does not tolerate it (positive control P6). Any edit of protocol.ts on main can trip it the same way while getMetaTypes() has an inferred return type; E1/E2 will meet it again and should read their raw diffs for it.

• In flight on the same files, re-read just before opening (origin/main 5780fa49df; 30 commits past this branch's last merge, none touching protocol.ts or any file of this PR, git merge-tree clean, so not merged again). fix(metadata-protocol)!: a runtime permission-set save refuses a grant on an object that does not exist #29093 (metadata: a runtime permission-set save accepts a grant on an object that does not exist (200) — the build refuses the same grant (#18202), so a typo silently grants nothing #28990) has merged and is in this branch. Open PRs that touch protocol.ts, each against this head by git merge-tree:

  • fix(metadata-protocol): the by-id OCC comparison answers only for a row the caller reads #28731 (draft, head 8372e0a1): hunks at base line 3330 (ConcurrentUpdateError's doc comment, which this PR moves to protocol-version-tokens.ts) and in the class body. Conflicts: whichever lands second carries that doc-comment edit to the other side.
  • fix(metadata-protocol)!: a save, publish or rollback naming a read-only base itself onto its view, dashboard, report, translation or email template is refused, naming the .custom pair #29270 (draft), fix(metadata-protocol): a form view naming a field its object lacks reads with the lint's form-field-unknown warning #29307: add names to protocol.ts's own import lists, which stay in protocol.ts, plus class-body hunks. Clean.
  • fix(metadata-protocol): a plain clone does not report the source's empty readonly columns as dropped fields #29290, fix(rest)!: GET /meta/_drafts refuses an unknown type or package filter instead of answering an empty list (#29180) #29295: class-body hunks only. Clean.
  • docs(qa): three studio-authoring knownGaps quote the vitest invocation the ui guard accepts #29317 touches studio-authoring.json in another item (revision 11 of the object designer item). Clean.
    Any of them landing shifts protocol.ts offsets, so the comment leak above can come back on its own; it is not this PR's to guard.

• E0 is one step of a series; Part of #25467 keeps the card open for E1 and E2.

Verification

Readings in this container under scripts/pm/os-verify-lock.sh, on head 20d8c2c813 unless named.

• @objectstack/metadata-protocol build, typecheck, test: VERDICT command-exit 0 · Test Files 301 passed | 4 skipped (305) · Tests 22127 passed | 26 skipped (22153).
• Direct dependents typecheck (pnpm turbo run typecheck on the 11 packages that depend on @objectstack/metadata-protocol: cli, client, cloud-connection, objectql, plugin-approvals, plugin-security, rest, runtime, service-automation, service-messaging, service-package), on 6b1dd49e2b: VERDICT command-exit 0 · Tasks 72 successful, 72 total, every typecheck a cache miss. The two commits after it change the changeset and two comment lines in protocol.ts; the published .d.ts normaliser 2 hash is the same.
• Gates that read protocol.ts or a moved symbol by path: check:filter-alias-parity, check:system-context-census, check:durability-log-level, check:query-options-erasure, check:engine-double-contract, check:objectql-double-limit, check:platform-checklist (in the battery below), plus check:adr-anchors, check:adr-symbol-anchors, check:scripts-symbol-anchors and pnpm --filter @objectstack/spec check:liveness, each exit 0. gen:liveness-counts leaves the tree clean.
• Derived gate battery (dispatch-gates --commands, 71 commands): 71 exit 0. dispatch-gates --ran: 71 derived, 71 run, 0 NOT-MEASURED, 0 UNRUN.
• Lint: root eslint packages/metadata-protocol --no-inline-config (the package has no lint script) exit 0.
• test:repo (Test Core) and the full farm are CI's.

Human Minimum

• 1. Schemas start as Zod; packages/spec holds no runtime logic. (the one packages/spec edit is two evidence citations in liveness/query.json; no schema, type or logic)
• 2. Every name I added uses the casing for its kind. (no name added; module files are kebab-case like their siblings)
• 3. No formatter ran; pnpm lint passes. (scoped to the package)
• 4. One issue, one branch off an up-to-date main, one pull request.
• 5. A change that publishes carries a changeset, and both declaration lines are filled in here and in the changeset.
• 6. packages/spec touched: its generated artifacts are regenerated and committed. (liveness/query.json only; gen:liveness-counts regenerates nothing from it, tree clean)
• 7. No hand edits to content/docs/references/, packages/*/CHANGELOG.md or content/docs/releases/.
• 8. Title, body and comments are in English.
• The Before Submitting list in CONTRIBUTING.md is done.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/metadata-protocol, @objectstack/spec, touching 320 documentable anchor(s). ⚠️ 1 changed file(s) yielded no anchor (packages/spec/liveness/query.json), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

131 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json a2fcede85c09dd54093f03cecc312d0dc861734f.

⛔ 18 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 1 changed file(s) yielded no anchor (packages/spec/liveness/query.json) — pages documenting those are invisible to this run
• 1 cross-cutting symbol(s) contributed no route anchor: packageId (4 routes)
• 5 anchor(s) matched too much of the corpus to be a work list: VALIDATION_FAILED (literal, 39 pages), created_at (literal, 43 pages), /api/v1/data (route, 48 pages), /data/:object (route, 75 pages), /meta/:type/:name (route, 40 pages)
• 52 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 60 of 216 client-bound route-ledger rows — the other 156 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 156: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 101 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 169 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json a2fcede85c09dd54093f03cecc312d0dc861734f → packageMentionDocs.

Which tree this was computed on

This run read content/docs from dcedc0cf044881cecbe99c515dbe06699775ceec — the merge of head fb09f70ad757bee2e4137df6c3029d242832ca26 into base a2fcede85c09dd54093f03cecc312d0dc861734f, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin dcedc0cf044881cecbe99c515dbe06699775ceec && git checkout dcedc0cf044881cecbe99c515dbe06699775ceec
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin a2fcede85c09dd54093f03cecc312d0dc861734f fb09f70ad757bee2e4137df6c3029d242832ca26 && git checkout -B drift-repro a2fcede85c09dd54093f03cecc312d0dc861734f && git merge --no-ff fb09f70ad757bee2e4137df6c3029d242832ca26

node scripts/docs-audit/affected-docs.mjs --json a2fcede85c09dd54093f03cecc312d0dc861734f

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs a2fcede85c09dd54093f03cecc312d0dc861734f → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

domain:server#5 · os-steve · session_01ADHkmQKwKFCp1m6Pb6Q8c1

维护者速读

• 改了什么：把 protocol.ts 类定义之上的整段前言(183 条顶层声明，约 6,300 行)原样搬进 22 个按主题命名的 protocol-*.ts 模块。protocol.ts 照旧导出原来的每个名字，没有逻辑改动。
• 为什么改:protocol.ts 是 server 车道的热文件，改它的 PR 都要排队。这是 [maintainer] refactor(metadata-protocol): split src/protocol.ts (33,065 lines, +10,169 in 30 days) along its ObjectStackProtocolImplementation seams, one move-only slice per PR #25467 裁决 E 的第一步 E0(E1、E2 之后另派),按字母 A 的 .d.ts 新判据(归一器 2)落地。
• 风险与回滚：低。工具证明 190/190 条语句逐字搬移，无改动、无多余。对外 index.d.ts 归一后哈希与 base 相同，原始差异只有空行、一条 import 内的名字顺序、一个字面量联合的成员顺序三类。回滚即整体 revert。
• 先看:protocol.ts 文件头的 import/export 名单，以及两个迁移后的按路径 pin(protocol.read-verb-canonical-fold.test.ts、protocol.lookup-artifact-item-call-sites.test.ts)。
• 两分钟验证:pnpm --filter @objectstack/metadata-protocol exec vitest run src/protocol.read-verb-canonical-fold.test.ts src/protocol.lookup-artifact-item-call-sites.test.ts,两个文件全绿。
• 需要你做的：改动约 13,200 行，超过 3,000 行人工合并线，请 os-zhuang 或 hotlong 在 GitHub 上批准(Approve)。批准后由本席经队列落地，维护者直接合并也可以。packages/spec/liveness/query.json 两处引用改指新模块，本席已同意留在本 PR。

席位意见：与 diff 相符。本席自己做了一遍逐行比对(base 删除行对 head 新增行),第一版丢了三段 import 注释和七个只被 {@link} 用到的 import 名，已在 fb09f70ad7 补回。现在缺的只剩重排过的 import 名单行。

席位核对

ACCEPT · domain:server seat 5 · os-steve · session_01ADHkmQKwKFCp1m6Pb6Q8c1 · 2026-11-02T12:38Z · head fb09f70ad7 · #25467 step E0

1. Shape: draft against main, Part of #25467 (the series continues with E1/E2), and no closing keyword. patch changeset for @objectstack/metadata-protocol and @objectstack/spec (the shipped liveness/ ledger). Clause-②: no, Metadata-protocol: none. Not path-governed; +6,9xx / -6,3xx, 28 files.
2. Against the order: ruling E (6537939895) E0 only, under letter A (6545252863). The move was redone by tool on fresh main, with the predecessor branch as reference only. The move-only verifier reads 190/190 verbatim, 0 changed, 0 surplus, and a negative control goes red. Normaliser 2 hashes of the published index.d.ts are equal base vs head (7dea44d6…), with 6 positive and 3 negative controls passing, and no fourth kind of raw difference. On fb09f70ad7 the raw .d.ts is byte-identical to the previous head, so there is no comment leak. The seat's own line-multiset check of base deletions against head additions leaves only re-flowed import-name lines; the patch round restored three import-attached comment blocks (/meta/types output derivation: mark an ExpressionInputSchema member whose string arm a transform erased, so a consumer can tell 「erased authoring type」 from 「admits anything」 (ruling batch #196 item 3 letter B on objectui#9830) #19295, [security] Stored-metadata-body family: two exits #21120 did not reach. An engine-only door serves an administrator credential material in cleartext, and the data door serves a content hash computed over the withheld credentials #21207, api 注册表条目声明 allowRuntimeCreate: true,但运行时创建的端点匹配器永远看不见 —— 声明的能力运行时不兑现(真实 boot 实测) #5488) and seven doc-link-only import names. No class-body member is touched.
3. Accepted deviations: packages/spec/liveness/query.json re-points two evidence citations to the module the symbols moved to (option A of the dev's question). It is a by-path citation with no schema change, and check:liveness is red without it. docs/qa/platform-checklist/areas/studio-authoring.json re-points three citations. The protocol.ts E0 header note is 5 lines; its length was chosen to clear the .d.ts comment leak. The dependents typecheck (72/72) was read on 6b1dd49e2b, and the commits since then are comments, changeset text and imports, with normaliser 2 unchanged.
4. Gates: the dev reports 71/71 derived gates exit 0 on 20d8c2c813 (0 NOT-MEASURED). The package suite on that head read 301 files / 22127 tests. On fb09f70ad7: tsc and the two by-path pins pass, 11 by-path gates exit 0, and package eslint exits 0. The three ablations of the migrated pins each went red and were restored. Check-runs on this head were still running at this record; the seat lands it only after they are green.
5. Out of scope: the TS declaration emitter can print a class JSDoc inside getMetaTypes()'s inferred return type at some byte layouts of protocol.ts. This goes to E1 as an item: give getMetaTypes() an explicit return type. Not filed separately. Hot file: fix(metadata-protocol): the by-id OCC comparison answers only for a row the caller reads #28731 conflicts on ConcurrentUpdateError's doc comment (now in protocol-version-tokens.ts), and whichever lands second carries it. fix(metadata-protocol)!: a save, publish or rollback naming a read-only base itself onto its view, dashboard, report, translation or email template is refused, naming the .custom pair #29270 / fix(metadata-protocol): a form view naming a field its object lacks reads with the lint's form-field-unknown warning #29307 / fix(metadata-protocol): a plain clone does not report the source's empty readonly columns as dropped fields #29290 / fix(rest)!: GET /meta/_drafts refuses an unknown type or package filter instead of answering an empty list (#29180) #29295 / docs(qa): three studio-authoring knownGaps quote the vitest invocation the ui guard accepts #29317 merge clean.
6. Landing: HUMAN MERGE OR AUTHORIZED APPROVAL. At 13k+ changed lines, over 3,000, this is Tier H by size. The seat does not flip it ready, enqueue it, or arm auto-merge. The PR carries needs-user-decision and waits for an APPROVED review from a GOVERNED_APPROVERS account (os-zhuang, hotlong). After that, this seat lands it through the queue on a green head; the maintainer's own merge is the other landing. A head change after approval needs a re-ACCEPT.