rest: by-name doors take an optional namespace segment and the _env segment, and answer 409 with the candidates on ambiguity (ADR-0150 child G1) #31691

epic:#31527#1 · os-steve · session_01ADHkmP7o3uDTti21wLTfPf

Filing gate: ④ coordination node: child G1 of the epic #31527 (parent and per-layer children), as ADR-0150 (docs/adr/0150-behavioural-metadata-addressed-by-package-objects-keep-the-literal-prefix.md, merged in #31586 at 5d1382a)'s execution plan lists it. Filed by the epic seat after its take-over (6727547008; the previous holder's hand-over 6727376945 left this row unfiled). ⛔ Not a claim.
Ruling-ref: per-type table A (6723462584); epic A 「立专题」 (6723499113); division of labour A 「留核心，其余交车道」 (6723571682); Q1/Q2 (6724050556); Q3 (6724530715); D2 (6724570466); ADR-0150 accepted by merge (#31586).
Business reason: inherited from the parent #31527. Behavioural metadata is addressed by (package, name), so two installed packages can each ship an item of the same name and every reader answers the right one, or refuses with the candidates, instead of silently taking the first match.
Reader: the next domain:server seat picks it from the queue once every Blocked-by: below is closed; the epic seat reviews its PR against the red lines below (ruling 6723571682).
Dedupe (open AND closed): namespace segment 409 candidates (13; top hits #31527(open) #30806(open) #25807(closed), none on point: they are this epic, its parent #30806, or a release sweep).
class: d · type: Feature
Grade: p1, inherited from the parent (self-graded under 「定级你可以自己决定」).
Blocked-by: #31575
Blocked-by: #31670
Blocked-by: #31681
Blocked-by: #31669

维护者速读

REST 按名字的入口（/automation、/automation/hooks、/actions、/meta、connectors）可以带上可选的命名空间段和 _env 段；名字有歧义时返回 409 并列出候选。只有一个持有者的裸名字照旧可用。

What to build

The REST doors gain D5's address grammar: an optional namespace segment and the _env segment on /automation, /automation/hooks, /actions, /meta and connectors, each read through R's resolver (D3). An ambiguous bare name answers 409 RESOURCE_CONFLICT naming every candidate. ?package=X is the exact qualifier (D5). The install gate refuses a namespace that spells a grammar literal, reading the refused-literal constant from spec/kernel (P), and route-ledger.ts's test pins that constant.

Surface

• Expected file surface: runtime domains/*.ts, route-ledger.ts; objectql registry.ts (installPackage, the refused-literal check). registry.ts installPackage is shared with N (objectql: refuse a (type, name) held twice inside one namespace for the uncovered bucket 2/3 types (ADR-0150 child N) #31670) and K (install/validate/publish doors: refuse a namespace equal to an object name, both directions (ADR-0150 child K) #31681): this card runs after both, on the same seat.
• Clause-②: yes (additive: an optional segment and a new 409 answer on existing routes).
• Narrowing: yes: a namespace spelling a grammar literal is refused at install (first-party: none); a today-ambiguous bare name of an uncovered type answers 409 (measured first-party: 0); and ?package=X as the exact qualifier refuses what today's read serves through getItem's bare slot and first-composite fallback (protocol-meta-item-reads.ts): a name that only the environment holds, and a name held by a package other than X (not measurable first-party; the refusal names the holders). A bare address with one holder still resolves.

Acceptance — the epic's three red lines (every child shares them)

• Resolution never loosens. No first-registered fallback, no environment-wide guess for a caller with a package, no silent pick.
• Ambiguity is reported, never guessed. Every refusal and every migration report names every candidate.
• Independently releasable (red line 3). The PR proves it with ADR-0150's four readings: (a) the phase-1 one-holder tests stay green; (b) bare-name behaviour (URLs, MCP, SDK) is unchanged for every name with one holder, except this card's declared narrowing; (c) any migration is re-runnable and never guesses; (d) its Clause-②: declaration and, where it changes the protocol, its ADR-0087 migration entry.
• The epic seat accepts the PR against these lines; a narrowing beyond the declared one goes to the maintainer (needs-user-decision) before landing.

Parent: #31527.