metadata-protocol: an action's route beside a package-less row on another object judges no declaration for the holder's own object, and serves the row under the holder's envelope (ADR-0150 D4) #33456

domain:server#5 · os-elon-musk · session_016WV4cyrFFk86Jqf7Mp5Rzw

Parent: #32681 (out-of-scope findings of its second half, PR #33422). Filed by area E2; the change lives in packages/metadata-protocol/src/**, so it is leased to area E1. Area-lease pilot #33059, lease:E1.

Premise (measured on PR #33422 at 8efae7e95f, runtime harness: real ObjectStackProtocolImplementation, real MetadataPlugin boot pass over a writable sys_metadata double; HTTP not measured)

Shapes: package ALPHA binds action approve to account and a package-less row binds approve to contact (the mirror shape); or package BETA binds it to contact alone and a package-less row binds it to account (the single-holder cell). Both save orders.

1. The holder's own route judges no declaration. /actions/account/approve (mirror) and /actions/contact/approve (single-holder cell): resolveRouteActionDeclaration finds no declaration. The execution face (getMetaItemForExecution; judgeBareActionRead returns undefined beside one package holder) answers the environment's item on the other object, and the route rejects it as another object's action. Measured identical before and after PR fix(metadata)!: the unscoped plural read counts an action name's holders per (object, name), so the boot pass keeps a package-less row on another object beside the holder's #33422 (metadata fix ablated and rebuilt), so the boot fold never caused it. PR fix(metadata-protocol, metadata)!: the bare read of an action name weighs its package-less holder, and serves the one enabled holder when a disabled package registered first (ADR-0150 D3) #32551's review records this face as its owner seat's follow-up; no open card carried it.
2. The package-less row is served under the holder's envelope. On /actions/contact/approve (mirror), the environment's custom item is served carrying the holder's _packageId (com.acme.alpha, or com.acme.beta in the single-holder cell) and _provenance: 'package'. The route's own packageId stays unset and the environment's handler runs. Likely cause: the artifact envelope lookup (lookupArtifactItem with envelopePackageId) keys by name, not (object, name).

Do

• The execution face judges an action by (package, object, name) (ADR-0150 D4), as the store and the plural read now do (fix(metadata)!: a package-less object-bound action row is keyed per (object, name) on the stored side, so a package-less save never lands in another object's holder #33318, fix(metadata)!: the unscoped plural read counts an action name's holders per (object, name), so the boot pass keeps a package-less row on another object beside the holder's #33422): the holder's route answers the holder's own item; the package-less row's route answers the environment's item.
• The envelope graft names the holder only for the item that holder holds at that (object, name).
• Declare each moved answer FROM→TO with its Clause-② arm and pin both transports where they reach, both save orders.

Acceptance

• CONTROLs: one package on one object with a package-less row on the same object (its customization, unchanged); two packages on one object (refusal naming both, unchanged); no package-less row.
• Red line: resolution is never loosened; an ambiguity is reported, never guessed.

Suggested-grade: p3 · first-party reach 0 (no first-party path writes a package-less action row, #32681).