@@ -0,0 +1,10 @@
+---
+'@objectstack/runtime': patch
+---
+
+fix(runtime): a flow clone the engine refuses no longer installs the source's empty `.custom` customization package
+
+Clause-②: no
+Metadata-protocol: none
+
+`POST /api/v1/automation/:name/clone` without `package` lands the copy in the source's paired customization package `<base>.custom`, ensuring it if needed. The pair used to be ensured before the engine validated the copy, so a clone refused `400` for an illegal machine name (or any other definition the engine refuses) still left a newly installed, empty `<base>.custom` in the package list and in Studio. The pair is now ensured only after the engine has accepted the copy, so a refused clone changes nothing. Refusals that can only come later — the ensured pair judged not writable, or the store refusing the save — still leave the pair in place, which is its ordinary state: ensure is idempotent, an empty pair is valid, and the next clone reuses it.
@@ -42,6 +42,7 @@ import { SqlDriver } from '@objectstack/driver-sql';
 import { ObjectStackProtocolImplementation } from '@objectstack/metadata-protocol';
 import { SysMetadata, SysMetadataHistoryObject, SysMetadataAuditObject } from '@objectstack/platform-objects/metadata';
 import { CloneFlowRequestSchema, CloneFlowResponseSchema } from '@objectstack/spec/api';
+import { FlowSchema } from '@objectstack/spec/automation';
 import { ROUTE_LEDGER } from '../route-ledger.js';
 import { HttpDispatcher } from '../http-dispatcher.js';
 import { validationFailureDetails, VALIDATION_FAILED_STATUS } from '../validation-failure.js';
@@ -97,7 +98,13 @@ interface Answer {
     body: any;
 }
 
-async function boot() {
+/**
+ * `parse`: the engine's registration as a strict `FlowSchema` parse — the
+ * check `registerFlow` runs first (`canonicalizeFlow`), so a definition the
+ * protocol refuses (an illegal machine name among it) throws the way the real
+ * engine throws. The default rig's engine is a map that accepts anything.
+ */
+async function boot(options: { parse?: boolean } = {}) {
     const engine = new ObjectQL();
     liveEngines.push(engine);
     engine.registerDriver(new SqlDriver({
@@ -126,7 +133,11 @@ async function boot() {
     const protocol = new ObjectStackProtocolImplementation(engine as any, () => services);
 
     const flows = new Map<string, any>([[SOURCE, shipped], [LOCAL, flowOf(LOCAL)]]);
-    const registerFlow = vi.fn((name: string, definition: unknown) => { flows.set(name, definition); return definition; });
+    const registerFlow = vi.fn((name: string, definition: unknown) => {
+        if (options.parse) FlowSchema.parse(definition);
+        flows.set(name, definition);
+        return definition;
+    });
     const unregisterFlow = vi.fn((name: string) => { flows.delete(name); });
     const getFlow = vi.fn(async (name: string) => flows.get(name) ?? null);
     const named: Record<string, unknown> = {
@@ -310,6 +321,37 @@ describe('[#28149] a source no package ships has no pair', () => {
     }, 60_000);
 });
 
+describe('[#29016] a clone the engine refuses installs no pair', () => {
+    it('control — with the parsing engine, a legal name still lands in the ensured pair', async () => {
+        const rig = await boot({ parse: true });
+
+        const answer = await rig.clone(SOURCE, { name: 'acme_lead_followup', label: 'Lead follow-up (ACME)' });
+
+        expect(answer.status, JSON.stringify(answer.body)).toBe(200);
+        expect(answer.data.packageId).toBe(PAIR);
+        expect(rig.installed()).toContain(PAIR);
+    }, 60_000);
+
+    it('an illegal machine name is refused 400 and the package list is unchanged', async () => {
+        const rig = await boot({ parse: true });
+        const before = rig.installed();
+        const publishedBefore = rig.published.length;
+
+        const answer = await rig.clone(SOURCE, { name: 'Bad-Name!', label: 'Illegal' });
+
+        expect(answer.status, JSON.stringify(answer.body)).toBe(400);
+        expect(answer.code).toBe('VALIDATION_FAILED');
+        expect(answer.body.error.details.fields).toMatchObject([{ field: 'name' }]);
+        // A refused clone changes nothing: no pair installed or persisted…
+        expect(rig.installed()).toEqual(before);
+        expect(rig.installed()).not.toContain(PAIR);
+        expect(rig.published.length).toBe(publishedBefore);
+        // …and no copy registered or stored.
+        expect(rig.flows.has('Bad-Name!')).toBe(false);
+        expect(await rig.rows('Bad-Name!')).toEqual([]);
+    }, 60_000);
+});
+
 describe('[#28149] the contract: the ledger row names the schemas this suite parses with', () => {
     it('the clone row is SDK surface and names CloneFlowRequestSchema / CloneFlowResponseSchema', () => {
         const row = ROUTE_LEDGER.find((e) => e.route === 'POST /automation/:name/clone');
 
@@ -2337,12 +2337,16 @@ async function registerAndSaveFlow(
     definition: unknown,
     door: 'definition' | 'clone',
     /**
-     * [#28149] The package the clone door resolved for its copy
+     * [#28149, #29016] Where the clone door's copy lands
      * ({@link resolveCloneTarget}) — the one caller here that holds a package
      * of its own choosing rather than a stamp. The definition doors pass none.
+     * Asked AFTER the engine has accepted the definition and before the save:
+     * landing may install the source's paired customization package, and a
+     * definition the engine refuses must leave nothing installed. A landing
+     * that refuses (or throws) undoes the registration like a refused save.
      */
-    packageId?: string,
-): Promise<{ registered: unknown } | { refused: HttpDispatcherResult }> {
+    land?: () => Promise<CloneLanding>,
+): Promise<{ registered: unknown; packageId?: string } | { refused: HttpDispatcherResult }> {
     const store: (Partial<Pick<ObjectStackProtocolImplementation, 'saveMetaItem'>>
         & Partial<Pick<MetadataProtocol, 'getMetaItems'>>) | undefined =
         await deps.resolveServiceOrLoud(context, 'protocol');
@@ -2355,6 +2359,21 @@ async function registerAndSaveFlow(
             refused: { handled: true, response: deps.errorFromThrown(flowDefinitionRefusal(e), VALIDATION_FAILED_STATUS) },
         };
     }
+    let packageId: string | undefined;
+    if (land) {
+        let landing: CloneLanding;
+        try {
+            landing = await land();
+        } catch (e) {
+            restoreFlowRegistration(automationService, name, held);
+            throw e;
+        }
+        if ('refused' in landing) {
+            restoreFlowRegistration(automationService, name, held);
+            return landing;
+        }
+        packageId = landing.packageId;
+    }
     if (typeof store?.saveMetaItem === 'function') {
         // [#27414, ADR-0073 D3] The save names who asked: the caller's user id
         // as the save's `actor`, which the store records in
@@ -2387,9 +2406,12 @@ async function registerAndSaveFlow(
             };
         }
     }
-    return { registered };
+    return { registered, ...(packageId !== undefined ? { packageId } : {}) };
 }
 
+/** [#28149] The package a clone's copy lands in, or the refusal that stops it. */
+type CloneLanding = { packageId: string } | { refused: HttpDispatcherResult };
+
 /**
  * [#28149, ADR-0146 D3/D4] WHERE the clone door's copy lands — "new similar":
  * a package, always (ADR-0070 D5/D6 retired the package-less scope, and ⛔ no
@@ -2423,17 +2445,25 @@ async function registerAndSaveFlow(
  * has nowhere to land a copy: `501`, never the package-less write it used to
  * make.
  *
- * Ordering: the pair is ensured before the copy is registered and saved, so a
- * save the store then refuses leaves the pair in place. That is the pair's
- * ordinary state — ensure is idempotent and an empty pair is a valid one —
- * and the next clone reuses it.
+ * Ordering [#29016] — a refused clone installs nothing it can avoid. Every
+ * judgement that needs no pair (the 501 above, the omitted-`package` 400 for a
+ * source no package ships, the explicit target's rule) is made HERE, before
+ * anything is registered. The pair itself is ensured only by the returned
+ * `land`, which {@link registerAndSaveFlow} calls after the engine has
+ * accepted the copy: the engine's registration is the one validation of a
+ * flow definition (strict parse — the name pattern among it — cycles, node
+ * config keys, expressions), so a copy it refuses is refused before any pair
+ * exists, with no second copy of that check here. A refusal that can only
+ * come later — the ensured pair judged not writable, or the save refused —
+ * leaves the pair in place: that is the pair's ordinary state (ensure is
+ * idempotent and an empty pair is a valid one) and the next clone reuses it.
  */
 async function resolveCloneTarget(
     deps: DomainHandlerDeps,
     context: HttpProtocolContext,
     sourceName: string,
     requested: string | undefined,
-): Promise<{ packageId: string } | { refused: HttpDispatcherResult }> {
+): Promise<{ land: () => Promise<CloneLanding> } | { refused: HttpDispatcherResult }> {
     const protocol: Partial<Pick<ObjectStackProtocolImplementation,
         'ensureCustomizationPackage' | 'packagedArtifactOwner' | 'saveMetaItem'>> | undefined =
         await deps.resolveServiceOrLoud(context, 'protocol');
@@ -2453,30 +2483,38 @@ async function resolveCloneTarget(
     }
     const subject = `flow '${sourceName}'`;
     const owner = protocol.packagedArtifactOwner({ type: FLOW_METADATA_TYPE, name: sourceName });
-    let target: string;
+    const ensure = protocol.ensureCustomizationPackage;
+    const judge = async (target: string): Promise<CloneLanding> => {
+        const refusal = newSimilarTargetRefusal(await deps.getObjectQL(context), {
+            target,
+            subject,
+            ...(owner !== undefined ? { sourcePackageId: owner } : {}),
+        });
+        return refusal ? { refused: newSimilarTargetRefusalAnswer(deps, refusal) } : { packageId: target };
+    };
     if (requested !== undefined) {
-        target = requested;
-    } else {
-        if (owner === undefined) {
-            throw validationFailure(
-                `Flow '${sourceName}' is not shipped by a package, so it has no paired customization package to `
-                + 'land a copy in (ADR-0146 D3): name the package the copy lands in with `package`.',
-                [{ field: 'package', code: 'required', message: 'the source has no paired customization package' }],
-            );
-        }
-        try {
-            target = (await protocol.ensureCustomizationPackage({ basePackageId: owner })).packageId;
-        } catch (e) {
-            return { refused: { handled: true, response: deps.errorFromThrown(e) } };
-        }
+        const landing = await judge(requested);
+        if ('refused' in landing) return landing;
+        return { land: async () => landing };
     }
-    const refusal = newSimilarTargetRefusal(await deps.getObjectQL(context), {
-        target,
-        subject,
-        ...(owner !== undefined ? { sourcePackageId: owner } : {}),
-    });
-    if (refusal) return { refused: newSimilarTargetRefusalAnswer(deps, refusal) };
-    return { packageId: target };
+    if (owner === undefined) {
+        throw validationFailure(
+            `Flow '${sourceName}' is not shipped by a package, so it has no paired customization package to `
+            + 'land a copy in (ADR-0146 D3): name the package the copy lands in with `package`.',
+            [{ field: 'package', code: 'required', message: 'the source has no paired customization package' }],
+        );
+    }
+    return {
+        land: async () => {
+            let pair: string;
+            try {
+                pair = (await ensure.call(protocol, { basePackageId: owner })).packageId;
+            } catch (e) {
+                return { refused: { handled: true, response: deps.errorFromThrown(e) } };
+            }
+            return judge(pair);
+        },
+    };
 }
 
 /** The engine methods {@link unregisterAndDeleteFlow} drives. */
@@ -3761,9 +3799,13 @@ export async function handleAutomationRequest(deps: DomainHandlerDeps, path: str
                 }
 
                 // [#28149, ADR-0146 D3/D4] WHERE the copy lands — never without
-                // a package (ADR-0070 D5/D6). Resolved after every refusal above
+                // a package (ADR-0070 D5/D6). Judged after every refusal above
                 // and before anything is registered, so a refused target leaves
-                // no copy behind (see `resolveCloneTarget`).
+                // no copy behind; the default pair is ENSURED only once the
+                // engine has accepted the copy (`target.land`, asked by
+                // `registerAndSaveFlow`), so a copy the engine refuses — an
+                // illegal name among it — installs no pair [#29016] (see
+                // `resolveCloneTarget`).
                 const target = await resolveCloneTarget(deps, context, name, requestedPackage);
                 if ('refused' in target) return target.refused;
 
@@ -3793,7 +3835,7 @@ export async function handleAutomationRequest(deps: DomainHandlerDeps, path: str
                 // deployment can no longer register. The target name is new (the
                 // collision probe above), so a save that fails withdraws it.
                 const written = await registerAndSaveFlow(
-                    deps, context, automationService as FlowRegistrationService, targetName, clone, 'clone', target.packageId,
+                    deps, context, automationService as FlowRegistrationService, targetName, clone, 'clone', target.land,
                 );
                 if ('refused' in written) return written.refused;
                 // ⛔ NO ANCESTRY on the way out either (ADR-0126 amendment
@@ -3812,7 +3854,7 @@ export async function handleAutomationRequest(deps: DomainHandlerDeps, path: str
                 // came from, so it records no lineage.
                 return {
                     handled: true,
-                    response: deps.success({ flow: servedFlowDefinition(clone), packageId: target.packageId, notice: FLOW_CLONE_NOTICE }),
+                    response: deps.success({ flow: servedFlowDefinition(clone), packageId: written.packageId, notice: FLOW_CLONE_NOTICE }),
                 };
             }
         }