docs(adr-0146): D8 item 3 names the whole-deployment export GET /packages/export, the per-package exports composed unchanged, the pair after its base (#29830)

<!-- claude-projects-attribution: {"github_login":"os-warren"} -->
_Requested by **Warren** · [project
thread](https://claude.ai/code/project/chan_01U5RdnAAmkSQmZbqh6FtqZ8?thread=cmsg_01U5RdnAAmkSQmZbqh6FtqZ8LidAhfGmKFAnjqyk8f1PqF)_
Fixes #29802

Clause-②: no
Metadata-protocol: none

## 维护者速读

- 改了什么:ADR-0146 D8 第 3 条加一句,点名整部署导出 `GET /packages/export`(#28914,PR
#29755 落地):它把各包自己的导出原样拼起来(每个条目恰为该包 `GET /packages/:id/export` 的答案),按
ADR-0141 D5 的启动水合顺序排列,两者都在包里时 `.custom`
配对包排在基础包之后,基础包由代码注册时配对包单独导出、基础包随代码走,自身不作任何新读取;Refs 加一条带日期的出处(#29802、本 PR
#29830、#29755、#28914)。只改措辞,一个文件,+13/−2。
- 为什么改:#29791 澄清后 D8 第 2、3 条只点名了逐包导出;租户现在调用的整部署导出在记录里没有名字(卡 #29802,出自
#29791 合同审查的 delta 记录 6596113742 第 ④ 节)。记录没错,只是沉默。
- 风险与回滚:无代码、无 schema、不改任何裁决;Status 行不加修订条目(与 #29791 同一惯例,出处记在
Refs);回滚即还原这一个 commit。
-
先看:`docs/adr/0146-studio-designs-setup-administers-one-editor-per-item-paired-customize-package.md`
D8 第 3 条(一句),其次 Refs 的 Cards 条目尾部。
- 两分钟验证:`git diff origin/main -- docs/adr/0146-*.md`,预期只有 D8 第 3 条与
Refs;`pnpm check:adr-links && pnpm check:adr-symbol-anchors` 预期绿(两个
`path#symbol` 锚点都解析到声明处:符号锚点计数 735 → 737)。
- 需要你做的:Tier H(`docs/adr/**`):席位合同审查 PASS 并 ACCEPT 后,需要 hotlong 或
os-zhuang 的 GitHub Approve;席位落地,PR 保持 draft。

## What changes

One sentence in ADR-0146 D8 item 3, after the two per-package routes it
already names: the whole-deployment export `GET /packages/export`
(#28914) composes those per-package exports unchanged — every installed
package the deployment's own code does not register, each entry exactly
what its own `GET /packages/:id/export` answers, in ADR-0141 D5's
hydrate order, so a `.custom` pair comes after its base when both are
listed, and the pair of a code-registered base (item 1's code package)
is exported alone, that base travelling with the deployment's code and
not with the bundle — and adds no reading of its own, with the two
symbols anchored
(`packages/runtime/src/domains/packages.ts#assemblePackageExportBundle`,
`packages/spec/src/api/package-lifecycle.zod.ts#PackageExportBundleSchema`).
Refs gains a dated entry naming #29802, this PR, #29755 and #28914. No
code, no schema, no other ADR. The second commit answers the contract
review's two should-fixes (6597286611): the pair-after-base clause now
says when it holds and what happens to the pair of a code-registered
base (the `PackageExportBundleSchema` docblock's "a pair of a `code`
base is still exported"), and the Refs entry names this PR beside the
card, as the #29791 entry does.

Item 3 rather than a Refs-only entry: the card's reach is a reader of D8
learning which export carries a paired override, and item 3 is where the
two per-package routes are named; a Refs entry is provenance, not where
that reader looks. The sentence states what the code already does and
decides nothing new, so there is no `**Amended in place**` entry on the
Status line — the file's own convention (kept by #29791) reserves that
for rulings that change a decision; the dated Refs entry is the
provenance, in the shape #29791's entry set.

## Why

Measured on `origin/main` `b0ef25f5` before writing:

- `assemblePackageExportBundle`
(`packages/runtime/src/domains/packages.ts`, declaration at line 3616,
docblock from line 3598): skips every registry row whose `source` is
`code`, lists the rest once, orders them with `orderHydrationBatch`
(`packages/core/src/hydration-order.ts`, ADR-0141 D5's one sorter) over
`declaredDependencyIds(row.manifest)`
(`packages/core/src/artifact-packages.ts`), and pushes, per id, the
answer of `assemblePackageManifest(deps, id, registry, context)` — the
same call with the same arguments the per-package route `GET
/packages/:id/export` serves at line 2599 (`deps.success(manifest)`).
Nothing is assembled, cleaned or redacted a second way; a package whose
export cannot be assembled fails the whole read.
- `PackageExportBundleSchema`
(`packages/spec/src/api/package-lifecycle.zod.ts`, line 332): its
`packages` description says each entry is "as `GET /packages/:id/export`
answers it, dependencies first … so a `.custom` pair comes after its
base"; the docblock's *One producer* section says the same.
- ADR-0146 D3 has the pair declare its base in `manifest.dependencies`,
so the sorter places the pair after its base whenever both are listed;
ADR-0141 D5's **Decided** paragraph is the hydrate order the sorter
implements.
- ADR-0146 D8 items 2 and 3 (as clarified by #29791) name only `GET
/packages/X.custom/export` and `GET /packages/X/export`; nothing in the
record contradicts the bundle, and nothing names it. The premise holds.

## Tests

Docs-only; no test changes and no ablation (a documentation edit is not
ablated). The derived gate families ran locally at the pushed head
(Verification).

## Acceptance notes

- `skip-changeset`: `docs/adr/**` publishes nothing (the fast lane of
the changeset rule); the label rides `pr_create`.
- `pnpm lint` is the repo-wide eslint scan CI owns; the diff has no
lintable source, and the docs/adr families the derivation names ran
locally instead (Verification).

## Verification

Head `65f1b7ce` on `origin/main` `b0ef25f5`: two commits (the second
answers the contract review's should-fixes), one file, +13/−2. The same
21 derived gates ran at both heads, `42951327` and `65f1b7ce`, with the
same verdicts.

- `node scripts/pm/dispatch-gates.mjs --commands --repo
objectstack-ai/objectstack` derived 21 commands (13 by path, 8
whole-tree). All 21 ran from the worktree at each head with the exit
code captured before any pipe: 21 exit 0, 0 non-zero, both times.
- Prerequisite for `check:doc-formula-expressions`:
`@objectstack/formula` and `@objectstack/lint` built under the verify
lock — `os-verify-lock: VERDICT command-exit 0 · held the lock 163s` at
the first head, a turbo cache hit (4 cached, lock held 6 s) at the
second.
- `node scripts/pm/dispatch-gates.mjs --ran ran-all.list --repo
objectstack-ai/objectstack`: `Run reconciliation — 21 derived, 21 run, 0
NOT-MEASURED, 0 UNRUN.` (exit 0), at both heads.
- `check:adr-symbol-anchors` counts: `origin/main` `b0ef25f5` answers
3050 anchors, 735 symbol (708 declaration); each head answers 3052
anchors, 737 symbol (710 declaration) — the two new `path#symbol`
anchors resolve at their declaration sites.
- `--tier`: the mandated tier for `docs/adr/**` holds (recorded on the
claim's Container & model line); changed lines 15 vs the human-merge
threshold 3000: under.

Exit 0: check-adr-links (+ --self-test), check-closing-keyword-parity (+
--self-test), check-comment-mask-corpus, ci/plan-test-core-shards
--self-test, lint check:doc-formula-expressions, check:adr-anchors,
check:adr-index, check:adr-symbol-anchors, check:ci-filter-parity,
check:closed-ceremony-text, check:cross-package-test-inputs,
check:doc-authoring, check:driver-memory-census, check:gitlink-declared,
check:nul-bytes, check:pm-governed-merges, check:pm-prior-rulings,
check:refd-timer-probe, check:watch-hint-literal.

## Human Minimum

- [x] 1. Schemas start as Zod; `packages/spec` holds no runtime logic.
(untouched)
- [x] 2. Every name I added uses the casing for its kind. (no names
added)
- [x] 3. No formatter ran; `pnpm lint` passes. (the CI-owned repo scan;
the derived docs/adr families ran locally)
- [x] 4. One issue, one branch off an up-to-date `main`, one pull
request.
- [x] 5. A change that publishes carries a changeset, and both
declaration lines are filled in here and in the changeset. (publishes
nothing: `skip-changeset`; both lines above)
- [x] 6. `packages/spec` touched: its generated artifacts are
regenerated and committed. (untouched)
- [x] 7. No hand edits to `content/docs/references/`,
`packages/*/CHANGELOG.md` or `content/docs/releases/`.
- [x] 8. Title, body and comments are in English. (the 维护者速读 block is
the dispatch contract's maintainer digest)
- [x] The *Before Submitting* list in CONTRIBUTING.md is done.

---
_Generated by [Claude
Code](https://claude.ai/code/session_01JQwxbZL4zwPNbxQsb6VsoU)_

<!-- signed: domain:server#2 · os-warren ·
session_01JQwxbZL4zwPNbxQsb6VsoU -->

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]

docs/adr/0146-studio-designs-setup-administers-one-editor-per-item-paired-customize-package.md

@@ -431,7 +431,14 @@ from **one** resolution:
    **outside** X's closure is not a candidate for X's address at all; it is that package's own item, served under its
    own address (ADR-0048 §3.3's qualified reference).
 3. **Export carries the declaration.** `GET /packages/hotcrm.custom/export` carries the overriding item with its
-   `overrides` block; `GET /packages/hotcrm/export` carries the base unchanged. The epic's two-minute check, verbatim:
+   `overrides` block; `GET /packages/hotcrm/export` carries the base unchanged. The whole-deployment export
+   `GET /packages/export` (#28914) composes those per-package exports unchanged — every installed package the
+   deployment's own code does not register, each entry exactly what its own `GET /packages/:id/export` answers, in
+   ADR-0141 D5's hydrate order, so a `.custom` pair comes after its base when both are listed, and the pair of a
+   code-registered base (item 1's code package) is exported alone, that base travelling with the deployment's code
+   and not with the bundle — and adds no reading of its own
+   (`packages/runtime/src/domains/packages.ts#assemblePackageExportBundle`,
+   `packages/spec/src/api/package-lifecycle.zod.ts#PackageExportBundleSchema`). The epic's two-minute check, verbatim:
    「HotCRM 视图「定制」→ 三处读取同一列集、导出带声明、「恢复包原版」回原样」.
 4. **A per-package customization read** (N-15) answers, for a base, its overrides, its extensions and its switched-off
    items — served rows and ledger rows, nothing computed — and the landing's counts and Studio's "only customizations"
@@ -706,7 +713,11 @@ of Q1's refusal and `action` — were ruled by the maintainer on 2026-10-31 (dec
   S13–S15 are folded into this rewrite); PR [#28045](https://github.com/objectstack-ai/objectstack/pull/28045) (the
   Proposed draft this rewrite replaces, hand-merged 2026-10-30); card [#29601](https://github.com/objectstack-ai/objectstack/issues/29601)
   and PR [#29791](https://github.com/objectstack-ai/objectstack/pull/29791) (2026-11-03, wording only: [D8](#d8) item 2 names
-  the pair's export and scopes its lead; *Decided here* #5 scoped with it).
+  the pair's export and scopes its lead; *Decided here* #5 scoped with it); card [#29802](https://github.com/objectstack-ai/objectstack/issues/29802)
+  and PR [#29830](https://github.com/objectstack-ai/objectstack/pull/29830) (2026-11-03, wording only: [D8](#d8) item 3
+  names the whole-deployment export `GET /packages/export`, landed for
+  [#28914](https://github.com/objectstack-ai/objectstack/issues/28914) by PR [#29755](https://github.com/objectstack-ai/objectstack/pull/29755),
+  as composing the per-package exports unchanged, the pair after its base).
 - [#27356](https://github.com/objectstack-ai/objectstack/issues/27356) rows 12, 13, 14, 19, 20, 21 and their landed
   PRs #27376, #27927, #28076.
 - ADR-0005, ADR-0009, ADR-0010, ADR-0029, ADR-0048 (and its 2026-10-08 addendum), ADR-0070, ADR-0126, ADR-0131,