Epic: package-first authoring (ADR-0070) — bases as the authoring & delete unit

[os-zhuang]

ADR: framework#2277 (ADR-0070, Proposed). This card tracks the cross-repo rollout.

Problem (from a business-user Studio dogfood pass)

Authored metadata can end up orphaned (package_id = null) with no container to delete/export — "a pile of loose metadata, how do I clean it up?". Root cause: no package-first contract. Stopgaps shipped: framework#2252 (coerce-to-null), objectui#1946 (Local scope). We adopt the Airtable base model: create/select a writable package (base) first; author into it; manage/delete/export by base.

Current state per surface (assessment)

• kernel (@objectstack/objectql saveMetaItem): coerces code-pkg runtime writes to null (fix(objectql): don't stamp runtime-authored metadata into a loaded code package #2252) → creates orphans.
• Studio UI (../objectui): selector defaults to a code pkg / null bucket; PackagesPage can create a writable pkg but the create flow doesn't require one; chore(spec): prune 7 dead field governance/compliance props (dead-surface plan) #1946 surfaces the null bucket.
• AI authoring (../cloud service-ai-studio): most advanced — resolvePackageId (metadata-tools.ts:268-328) rejects read-only pkgs (:319), has create_package/set_active_package/apply_blueprint, but auto-defaults to com.workspace (:304) instead of requiring a base.

Rollout checklist

• kernel (D1/D2) — isWritablePackage predicate + reject runtime creates with no writable target (code: 'writable_package_required'); evolve fix(objectql): don't stamp runtime-authored metadata into a loaded code package #2252 coerce-to-null → redirect/reject. @objectstack/objectql protocol.saveMetaItem.
• Studio UI (D3) — create entry points require/prompt-create a base (reuse PackagesPage dialog); selector defaults to a writable base, never null/code-pkg; new items bound to active base. ../objectui.
• AI authoring (D3) — ../cloud service-ai-studio: drop auto-com.workspace fallback (metadata-tools.ts:304) + applyDraft re-bind (:568-573); require active package (error → create_package/set_active_package); apply_blueprint requires package context; update metadata-authoring-skill.ts / solution-design-skill.ts prompts.
• Package = lifecycle unit (D4) — delete-cascade (extend registry.uninstallPackage to writable-base delete), export, snapshot (ADR-0067), duplicate.
• Migration (D5) — repurpose chore(spec): prune 7 dead field governance/compliance props (dead-surface plan) #1946 Local scope as a "move orphans into a base" affordance; bulk-assign legacy null rows; then remove fix(objectql): don't stamp runtime-authored metadata into a loaded code package #2252/chore(spec): prune 7 dead field governance/compliance props (dead-surface plan) #1946 stopgaps.
• Single-tenant default (D6) — default to a writable base, never a null "org/local" scope.
• Dogfood gate — @objectstack/dogfood coverage: create→bind→publish→editable→discoverable→delete-cascade, per surface.

Open questions (see ADR)

1. Auto-provision one "My workspace" base on first authoring (one-click) vs always explicit create?
2. allowOrgOverride in single-tenant: keep overlay for surgical tweaks vs "fork to base" for substantial changes?
3. Delete-cascade: also delete object records, or schema only? (ties to data-lifecycle/retention)
4. Base naming vs stable id (app.<slug>).

Repos: framework (kernel, ADR), ../objectui (Studio), ../cloud (service-ai-studio).