refactor(metadata-protocol): move tenantAuthoredWriteRefusal's body through the host, and read moved bodies through it

The pilot member's body moves to protocol-tenant-authored-write.ts; the
method keeps its docblock and signature and becomes a stub. The class's
static block builds the host. The read-verb fold pin, the lookupArtifactItem
call-site pin and the read-seam census follow host.x(...) calls and
fn(protocolHost(this), ...) stubs into every split module.

Claude-Session: https://claude.ai/code/session_01ADHkmR4MjTzeUv5x6tNkbk
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/metadata-protocol/src/protocol-tenant-authored-write.ts

@@ -0,0 +1,77 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [#25467 E1] The pilot of the host split: `tenantAuthoredWriteRefusal`'s body,
+ * moved out of `protocol.ts` by `scripts/host-split.mjs move` to prove the
+ * machinery E2's section cuts use, on one member.
+ *
+ * A MOVE, not a redesign. The function below is the body of the
+ * `ObjectStackProtocolImplementation` method of the same name as it stood,
+ * re-indented one level, with `this.<member>` read as `host.<member>` and
+ * nothing else changed (`node scripts/host-split.mjs check <base> …` proves
+ * it). The method stays on the class with its docblock and signature, which the
+ * published `.d.ts` prints, and hands its body the host (`protocol-host.ts`).
+ *
+ * What the body reads from elsewhere, it imports from where `protocol.ts`
+ * imports it. Nothing re-exports this module, so the published surface does
+ * not move.
+ */
+
+import {
+    // [#20761, ADR-0126 §2] The ADR-0029 D9.6 reading of a body's own
+    // provenance stamps — asked by {@link
+    // ObjectStackProtocolImplementation.tenantAuthoredWriteRefusal} to tell a
+    // body that CLAIMS to be code-shipped from one that does not.
+    isCodeArtifactBody,
+} from '@objectstack/metadata-core';
+import { PLURAL_TO_SINGULAR } from '@objectstack/spec/shared';
+import type { ProtocolHost } from './protocol-host.js';
+import { canonicalizeMetaRequestType } from './protocol-meta-type-schema.js';
+
+/** The body of `ObjectStackProtocolImplementation#tenantAuthoredWriteRefusal`; the method's docblock there is its contract. */
+export async function tenantAuthoredWriteRefusal(host: Pick<ProtocolHost, 'overrideWriteVerdict' | 'packagedArtifactOwner' | 'packagedBaseRefusal' | 'storedFlowBindingAgrees' | 'uninstalledNamedBaseRefusal'>, request: { type: string; name: string; item: unknown; packageId?: string | null }): Promise<Error | null> {
+    const folded = canonicalizeMetaRequestType(request);
+    const singular = PLURAL_TO_SINGULAR[folded.type] ?? folded.type;
+    if (singular !== 'flow') return null;
+    const shipped = host.packagedArtifactOwner(folded) !== undefined;
+    // [#28412, ADR-0146 D2 / D9] Rule 1's lock does not apply to the
+    // shipping package's declared override: the one override write gate
+    // ({@link overrideWriteVerdict}) admits it as the pair's own row, which
+    // edits nothing the package ships. Any other write of a shipped name
+    // keeps the lock.
+    if (shipped && host.overrideWriteVerdict({
+        type: singular,
+        name: folded.name,
+        item: folded.item,
+        ...(folded.packageId ? { packageId: folded.packageId } : {}),
+    }).verdict !== 'admit') {
+        const locked = host.packagedBaseRefusal({
+            type: folded.type,
+            name: folded.name,
+            operation: 'save',
+            ...(folded.packageId ? { packageId: folded.packageId } : {}),
+        });
+        if (locked) return locked;
+    }
+    // [#20863] The named-base rule (see the docblock): a base the write
+    // names must be a package the registry holds as installed. [#26708]
+    // The rule is {@link uninstalledNamedBaseRefusal}'s, which
+    // `saveMetaItem` asks for every other type too.
+    const unbound = host.uninstalledNamedBaseRefusal({ type: singular, name: folded.name, packageId: folded.packageId });
+    if (unbound) return unbound;
+    if (shipped) return null;
+    if (!isCodeArtifactBody(folded.item)) return null;
+    const stamped = String((folded.item as { _packageId?: unknown })._packageId);
+    if (folded.packageId === stamped) return null;
+    if (await host.storedFlowBindingAgrees(folded.name, stamped)) return null;
+    const err = new Error(
+        `Flow '${folded.name}' was sent with a code-package provenance, but no managed package ships a flow of `
+        + `that name. A flow written through an authoring door is authored in this deployment: which flows a `
+        + `package ships is established by the package loader, never by the definition a caller sends. `
+        + `Remove the provenance keys (_packageId, _packageVersion, _provenance) from the definition and send it `
+        + `again. Nothing was written. See docs/adr/0126-packaged-metadata-customization-model.md.`,
+    );
+    (err as any).code = 'INVALID_METADATA';
+    (err as any).status = 422;
+    return err;
+}

packages/metadata-protocol/src/protocol.lookup-artifact-item-call-sites.test.ts

@@ -34,15 +34,32 @@
  * function the class member delegates to and that member's two calls; the
  * class member keeps its signature in `protocol.ts`, and `shippedArtifactsOf`'s
  * stub there hands the moved body the lookup as a closure, one more site.
+ *
+ * [#25467 E1] …and every other `protocol-*.ts` module of the split, once: a
+ * member's body that moves out of `protocol.ts` (ruling E's host split, or the
+ * per-member series before it) takes its calls with it, so the scan reads every
+ * module the split can move a body to, by the same rule. A site in a moved body
+ * is keyed by its module and the function it sits in. Comments are blanked
+ * before the scan in every file, so a docblock that names the callee (two
+ * modules' do) is not a site.
  */
-import { readFileSync } from 'node:fs';
+import { readdirSync, readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
+import ts from 'typescript';
 import { describe, expect, it } from 'vitest';
 
 const SOURCE = readFileSync(fileURLToPath(new URL('./protocol.ts', import.meta.url)), 'utf8');
 /** [#25467 cut 15] The seam module the lookup's body moved to; scanned with its own header shape. */
 const SEAM_FILE = 'protocol-artifact-lookup.ts';
-const SEAM = readFileSync(fileURLToPath(new URL(`./${SEAM_FILE}`, import.meta.url)), 'utf8');
+/**
+ * [#25467 E1] Every module of the split: `protocol-*.ts` beside `protocol.ts`,
+ * tests excluded — the census's own module pattern (`HOST_SPLIT.module` in
+ * `scripts/check-durability-degradation-log-level.mjs`).
+ */
+const SPLIT_MODULES = readdirSync(fileURLToPath(new URL('.', import.meta.url)))
+    .filter((file) => /^protocol-[a-z0-9-]+\.ts$/.test(file))
+    .sort();
+const MODULE_SOURCES = new Map(SPLIT_MODULES.map((file) => [file, readFileSync(fileURLToPath(new URL(`./${file}`, import.meta.url)), 'utf8')]));
 const CALLEE = 'lookupArtifactItem(';
 /**
  * [#25467 E0] The module the protocol.ts preamble's package-binding helpers moved
@@ -53,16 +70,37 @@ const BINDINGS = readFileSync(fileURLToPath(new URL(`./${BINDINGS_FILE}`, import
 
 /** A class member's header in `protocol.ts`: four spaces, optional modifiers, its name, its parameter list. */
 const MEMBER_HEADER = /^ {4}(?:(?:private|public|protected|static|async|override|readonly)\s+)*([A-Za-z_$][\w$]*)\s*(?:<[^>]*>)?\(/;
-/** A module function's header in the seam module: `export`, optional `async`, `function`, its name, its parameter list. */
-const FUNCTION_HEADER = /^export (?:async )?function ([A-Za-z_$][\w$]*)\s*(?:<[^>]*>)?\(/;
+/** A module function's header in a split module: optional `export` and `async`, `function`, its name, its parameter list. */
+const FUNCTION_HEADER = /^(?:export )?(?:async )?function ([A-Za-z_$][\w$]*)\s*(?:<[^>]*>)?\(/;
+
+/**
+ * [#25467 E1] The source with every comment blanked to spaces (newlines kept), so
+ * offsets and line numbers are the file's own and a docblock that names the
+ * callee is not read as a call. Comment ranges come from the TypeScript parser,
+ * so a `//` inside a string or a template is not a comment.
+ */
+function withoutComments(source: string): string {
+    const sf = ts.createSourceFile('x.ts', source, ts.ScriptTarget.Latest, true, ts.ScriptKind.TS);
+    const chars = source.split('');
+    const blank = (ranges: ts.CommentRange[] | undefined) => {
+        for (const r of ranges ?? []) for (let i = r.pos; i < r.end; i++) if (chars[i] !== '\n') chars[i] = ' ';
+    };
+    const visit = (node: ts.Node) => {
+        blank(ts.getLeadingCommentRanges(source, node.getFullStart()));
+        blank(ts.getTrailingCommentRanges(source, node.getEnd()));
+        for (const child of node.getChildren(sf)) visit(child);
+    };
+    visit(sf);
+    return chars.join('');
+}
 
 interface Site { readonly file?: string; readonly member: string; readonly args: string }
 
-/** Every `lookupArtifactItem(` in `protocol.ts` and the seam module: the file, the member it sits in and its argument text, whitespace-normalised. */
+/** Every `lookupArtifactItem(` in `protocol.ts` and every split module: the file, the member it sits in and its argument text, whitespace-normalised. */
 function sitesIn(): Site[] {
     return [
-        ...sitesOf(SOURCE, MEMBER_HEADER),
-        ...sitesOf(SEAM, FUNCTION_HEADER).map((site) => ({ ...site, file: SEAM_FILE })),
+        ...sitesOf(withoutComments(SOURCE), MEMBER_HEADER),
+        ...SPLIT_MODULES.flatMap((file) => sitesOf(withoutComments(MODULE_SOURCES.get(file)!), FUNCTION_HEADER).map((site) => ({ ...site, file }))),
     ];
 }
 
@@ -173,6 +211,19 @@ describe('[#22024] every lookupArtifactItem( in protocol.ts has a recorded dispo
         expect(found.filter((site) => site.file === SEAM_FILE)).toHaveLength(3);
     });
 
+    it('[#25467 E1] every module of the split is scanned, the host split\'s own included', () => {
+        // Non-vacuity for the population of files: the E0 preamble modules, the
+        // per-member series' modules and the host split's are all read.
+        expect(SPLIT_MODULES.length).toBeGreaterThan(40);
+        expect(SPLIT_MODULES).toContain(SEAM_FILE);
+        expect(SPLIT_MODULES).toContain('protocol-host.ts');
+        expect(SPLIT_MODULES).toContain('protocol-tenant-authored-write.ts');
+        expect(SPLIT_MODULES.some((file) => file.endsWith('.test.ts'))).toBe(false);
+        // A docblock naming the callee is not a site: two modules carry one.
+        expect(MODULE_SOURCES.get('protocol-credential-carry-forward.ts')).toContain('`' + CALLEE);
+        expect(found.filter((site) => site.file === 'protocol-credential-carry-forward.ts')).toEqual([]);
+    });
+
     it('a site passing fewer than three arguments is recorded as passing no package', () => {
         const topLevelArgs = (args: string) => {
             let depth = 0;

packages/metadata-protocol/src/protocol.read-verb-canonical-fold.test.ts

@@ -266,12 +266,42 @@ describe('#9157 — the population, re-derived from the code rather than from th
             }
             return undefined;
         };
+        // [#25467 E1] A member whose body moved out of protocol.ts (ruling E's
+        // host split, or the per-member series before it) keeps its signature
+        // here and its body in a `protocol-*.ts` module: the stub's last line is
+        // `return fn(protocolHost(this), …)` or `return fn.call(host, …)`, `fn` a
+        // named import from that module. The verb is judged by the moved body,
+        // read from the module protocol.ts imports `fn` from: every module, by
+        // this one rule.
+        const moduleImports = new Map<string, string>();
+        for (const m of src.matchAll(/\nimport \{([^}]*)\} from '\.\/(protocol-[a-z0-9-]+)\.js';/g)) {
+            for (const spec of m[1]!.split(',')) {
+                const local = /^\s*(?:\/\/[^\n]*\n\s*)*(?:[A-Za-z_$][\w$]*\s+as\s+)?([A-Za-z_$][\w$]*)\s*$/.exec(spec)?.[1];
+                if (local !== undefined) moduleImports.set(local, `${m[2]}.ts`);
+            }
+        }
+        // The stub's last statement, right before the member's own closing brace
+        // (a member slice runs on to the next scanned member's header).
+        const STUB = /\n {8}return (?:await )?([A-Za-z_$][\w$]*)(?:\(protocolHost\(this\)|\.call\([A-Za-z_$][\w$]*)[,)][^\n]*\n {4}\}\n/;
+        const throughSplit: string[] = [];
+        const movedBody = (body: string): string => {
+            const own = body.slice(0, body.indexOf('\n    }\n') + 7);
+            const fn = STUB.exec(own)?.[1];
+            if (fn === undefined || !moduleImports.has(fn)) return body;
+            const file = moduleImports.get(fn)!;
+            throughSplit.push(fn);
+            const text = readFileSync(fileURLToPath(new URL(`./${file}`, import.meta.url)), 'utf8');
+            const at = text.search(new RegExp(`\\nexport (?:async )?function ${fn}\\b`));
+            expect(at, `the stub hands its body to '${fn}', which ${file} does not export`).toBeGreaterThanOrEqual(0);
+            const end = text.indexOf('\n}\n', at + 1);
+            return text.slice(at, end < 0 ? text.length : end + 2);
+        };
         const delegateBody = (body: string): string => {
             const to = /this\.([A-Za-z_][A-Za-z0-9_]*Unaudited)\(request\)/.exec(body)?.[1];
-            if (to === undefined) return body;
+            if (to === undefined) return movedBody(body);
             const line = lines.findIndex((l) => l.startsWith(`    private async ${to}(`));
             expect(line, `the wrapper delegates to '${to}', which the scan cannot find`).toBeGreaterThanOrEqual(0);
-            return memberSlice(line);
+            return movedBody(memberSlice(line));
         };
 
         const unfolded: string[] = [];
@@ -299,6 +329,10 @@ describe('#9157 — the population, re-derived from the code rather than from th
             (/canonicalizeMetaRequestType\(request\)/.test(body) ? folded : unfolded).push(starts[k]!.name);
         }
 
+        // [#25467 E1] Non-vacuity of the split resolution: the host split's pilot
+        // is judged by its moved body, so a stub regex that stopped matching
+        // would fail here instead of silently judging a one-line stub.
+        expect(throughSplit).toContain('tenantAuthoredWriteRefusal');
         expect(
             unfolded,
             'A `/meta` verb takes a required `type` without folding it at the request boundary. '

packages/metadata-protocol/src/protocol.ts

@@ -69,11 +69,6 @@ import {
     // it prints it at.
     findUndeclarableFieldType,
     isObjectFieldTypeRefused,
-    // [#20761, ADR-0126 §2] The ADR-0029 D9.6 reading of a body's own
-    // provenance stamps — asked by {@link
-    // ObjectStackProtocolImplementation.tenantAuthoredWriteRefusal} to tell a
-    // body that CLAIMS to be code-shipped from one that does not.
-    isCodeArtifactBody,
     // [#21059] The tenant marker the hydrator writes on every stored row it
     // registers (ADR-0010 `_provenance: 'org'`) — read by
     // {@link ObjectStackProtocolImplementation.getMetaItemLayered}'s code-layer
@@ -720,6 +715,11 @@ import type {
     RollbackMetaItemRequest,
     SaveMetaItemRequest,
 } from './protocol-door-requests.js';
+// [#25467 E1] The host a moved member body reaches this class through: the
+// class builds it in its static block below, and a stub hands it to the body.
+import { installProtocolHost, protocolHost } from './protocol-host.js';
+// [#25467 E1] The host split's pilot: one member's whole body, moved through the host.
+import { tenantAuthoredWriteRefusal } from './protocol-tenant-authored-write.js';
 
 /**
  * [#4435/#5138] The 404 a single-record operation answers when the id names no
@@ -1264,6 +1264,19 @@ export class ObjectStackProtocolImplementation implements
         this.authoringChannel = authoringChannel;
     }
 
+    // [#25467 E1] The one place that can read this class's private members builds
+    // the host its moved bodies reach it through (`protocol-host.ts`). A static
+    // block adds no member to the class: the published `.d.ts` does not move.
+    static {
+        installProtocolHost((protocol) => ({
+            overrideWriteVerdict: (...a) => protocol.overrideWriteVerdict(...a),
+            packagedArtifactOwner: (...a) => protocol.packagedArtifactOwner(...a),
+            packagedBaseRefusal: (...a) => protocol.packagedBaseRefusal(...a),
+            storedFlowBindingAgrees: (...a) => protocol.storedFlowBindingAgrees(...a),
+            uninstalledNamedBaseRefusal: (...a) => protocol.uninstalledNamedBaseRefusal(...a),
+        }));
+    }
+
     /**
      * Register a publish-time materializer for a metadata type (ADR-0086 P2).
      * Called by domain plugins at init (e.g. service-automation registers the
@@ -11118,50 +11131,8 @@ export class ObjectStackProtocolImplementation implements
      *          proceed on these grounds.
      */
     async tenantAuthoredWriteRefusal(request: { type: string; name: string; item: unknown; packageId?: string | null }): Promise<Error | null> {
-        const folded = canonicalizeMetaRequestType(request);
-        const singular = PLURAL_TO_SINGULAR[folded.type] ?? folded.type;
-        if (singular !== 'flow') return null;
-        const shipped = this.packagedArtifactOwner(folded) !== undefined;
-        // [#28412, ADR-0146 D2 / D9] Rule 1's lock does not apply to the
-        // shipping package's declared override: the one override write gate
-        // ({@link overrideWriteVerdict}) admits it as the pair's own row, which
-        // edits nothing the package ships. Any other write of a shipped name
-        // keeps the lock.
-        if (shipped && this.overrideWriteVerdict({
-            type: singular,
-            name: folded.name,
-            item: folded.item,
-            ...(folded.packageId ? { packageId: folded.packageId } : {}),
-        }).verdict !== 'admit') {
-            const locked = this.packagedBaseRefusal({
-                type: folded.type,
-                name: folded.name,
-                operation: 'save',
-                ...(folded.packageId ? { packageId: folded.packageId } : {}),
-            });
-            if (locked) return locked;
-        }
-        // [#20863] The named-base rule (see the docblock): a base the write
-        // names must be a package the registry holds as installed. [#26708]
-        // The rule is {@link uninstalledNamedBaseRefusal}'s, which
-        // `saveMetaItem` asks for every other type too.
-        const unbound = this.uninstalledNamedBaseRefusal({ type: singular, name: folded.name, packageId: folded.packageId });
-        if (unbound) return unbound;
-        if (shipped) return null;
-        if (!isCodeArtifactBody(folded.item)) return null;
-        const stamped = String((folded.item as { _packageId?: unknown })._packageId);
-        if (folded.packageId === stamped) return null;
-        if (await this.storedFlowBindingAgrees(folded.name, stamped)) return null;
-        const err = new Error(
-            `Flow '${folded.name}' was sent with a code-package provenance, but no managed package ships a flow of `
-            + `that name. A flow written through an authoring door is authored in this deployment: which flows a `
-            + `package ships is established by the package loader, never by the definition a caller sends. `
-            + `Remove the provenance keys (_packageId, _packageVersion, _provenance) from the definition and send it `
-            + `again. Nothing was written. See docs/adr/0126-packaged-metadata-customization-model.md.`,
-        );
-        (err as any).code = 'INVALID_METADATA';
-        (err as any).status = 422;
-        return err;
+        // [#25467 E1] The body moved to `protocol-tenant-authored-write.ts`; it reaches this class through `protocol-host.ts`.
+        return tenantAuthoredWriteRefusal(protocolHost(this), request);
     }
 
     /**