@@ -0,0 +1,10 @@
+---
+'@object-ui/app-shell': patch
+---
+
+fix(app-shell): Studio Access no longer calls a permission set the `.custom` pair added "Package"
+
+Clause-②: no
+Metadata-protocol: none
+
+A permission set held by a read-only base's `.custom` pair (a New similar copy, or a set created there) opened in Studio Access with a "Package" chip in its header, while the rail marked the same row "Added" and the page saved its edits as drafts in the pair. The header chip now reads the customization mark the rail draws, from the same rule (`customizationMarks.ts`): a set the pair adds reads "Custom", and a set the base itself ships, or a customized base set, still reads "Package". Setup and the metadata admin pass no mark and are unchanged. While the base's customization read is loading or has failed, neither the rail nor the header shows a mark, and the header keeps its previous answer.
@@ -106,6 +106,7 @@ import { useDraftAutoSave, type DraftSend } from '../studio-design/useDraftAutoS
 // objectui#12456 — the Studio Access pillar's presentation draws the shared item header.
 import { StudioItemHeader, StudioTab } from '../studio-design/StudioItemHeader.js';
 import { STUDIO_KIND_CHIP } from '../studio-design/studio-tokens.js';
+import type { CustomizationMarkKind } from '../studio-design/customizationMarks.js';
 import { useDisplayLocale } from '@object-ui/i18n';
 import {
   t as translate,
@@ -580,13 +581,23 @@ export interface PermissionMatrixEditPageProps {
    * is the routed page's. Omitted (Setup's permission page): unchanged.
    */
   studio?: PermissionStudioChrome;
+  /**
+   * objectstack#29809 (ADR-0146 D3) — the customization mark the host's rail
+   * draws for this set (`customizationMarks.ts`, the one rule): on a read-only
+   * base, `'added'` for a set its `<base>.custom` pair holds (a New similar
+   * copy or a set created there), `'customized'` for a served override of a
+   * base set. Set only by the Studio Access pillar; omitted (Setup, the
+   * metadata admin) or `null` (no mark, or the read has not answered),
+   * nothing changes. Read by the provenance badge alone.
+   */
+  customizationMark?: CustomizationMarkKind | null;
 }
 
 /* ────────────────────────────────────────────────────────────────── */
 /* Component                                                          */
 /* ────────────────────────────────────────────────────────────────── */
 
-export function PermissionMatrixEditPage({ type, name, packageId, onDraftSaved, publishNonce, onOpenOwd, onDirtyChange, readOnly: readOnlyProp = false, embedded = false, studio }: PermissionMatrixEditPageProps) {
+export function PermissionMatrixEditPage({ type, name, packageId, onDraftSaved, publishNonce, onOpenOwd, onDirtyChange, readOnly: readOnlyProp = false, embedded = false, studio, customizationMark = null }: PermissionMatrixEditPageProps) {
   // objectstack ADR-0146 D1 (#28561) — Studio's "All metadata" area mounts this
   // editor through the routed item page, which hands it no `readOnly`: a
   // read-only package's area is the host gate here, as a pillar's prop is.
@@ -724,7 +735,12 @@ export function PermissionMatrixEditPage({ type, name, packageId, onDraftSaved,
   // envelope's code artifact), else it was authored in this environment. Spec
   // 18 retired the authored `managedBy` (objectstack#23891), and no served
   // datum names a "platform" set, so there are two answers (objectui#12753).
-  const shippedByPackage = !!packageId || codeIsArtifact;
+  // objectstack#29809 (ADR-0146 D3) — a base's `<base>.custom` pair is a
+  // package too, so its door's `packageId` alone called a set the pair adds
+  // "Package" beside the rail's "Added". The host's mark answers that, by the
+  // rule its rail draws from: an added set is the environment's own, whatever
+  // door opened it. A customized base set stays the base's ("Package").
+  const shippedByPackage = customizationMark !== 'added' && (!!packageId || codeIsArtifact);
   const artifactArmOpen = !!entry?.allowEnvironmentOverlay && servedEditable !== false;
   const typeTierOpen = !!(entry?.allowEnvironmentOverlay || entry?.allowRuntimeCreate);
   const canWriteByType = artifactTierApplies ? artifactArmOpen : typeTierOpen;
@@ -1960,7 +1976,8 @@ export function PermissionMatrixEditPage({ type, name, packageId, onDraftSaved,
           this editor already fetches (`codeIsArtifact`, the artifact
           gate's own input). At the environment scope there is no
           `packageId`, so a set a code package ships read "Custom" beside
-          its own lock. */}
+          its own lock. A set a base's pair adds reads "Custom" (the host's
+          `customizationMark`, objectstack#29809). */}
       <Badge variant="outline" className="text-[10px] shrink-0" data-testid="perm-provenance-badge">
         {shippedByPackage ? t('perm.badge.package') : t('perm.badge.custom')}
       </Badge>
 
@@ -20,7 +20,10 @@
  *  - an edit to a base object's grant saves the copy's draft at the pair,
  *    keeping every grant it holds; no write names the base;
  *  - CONTROL: the base's own (read-only) set lists the base's objects and
- *    reads no pair list for them.
+ *    reads no pair list for them;
+ *  - objectstack#29809: the header's provenance chip follows the rail's mark,
+ *    Custom for a set the pair holds (copied or created there), Package for
+ *    the base's own set.
  */
 
 import '@testing-library/jest-dom/vitest';
@@ -273,3 +276,48 @@ describe('CONTROL: the base’s own set (objectstack#29674)', () => {
     expect(header()).not.toHaveTextContent(tFormat('engine.studio.access.bannerPair', 'en', { package: 'Showcase' }));
   });
 });
+
+/**
+ * objectstack#29809 (ADR-0146 D3) — the header's provenance chip and the rail
+ * row's customization mark tell one story: a set the pair holds reads Custom
+ * beside the rail's Added, and the base's own set still reads Package with no
+ * mark. Same harness: the real surface, pillar and page.
+ */
+describe('the header’s provenance chip follows the rail’s mark (objectstack#29809)', () => {
+  /** A set created in the pair: its draft, never published, listed from the pair’s drafts. */
+  const CREATED = 'pair_auditor';
+  const accessRail = () => screen.getByTestId('studio-rail-access');
+  /** The rail row holding `text`, and the kind of mark it carries (`null`: none). */
+  const railMarkOf = (text: string) =>
+    within(accessRail())
+      .getByText(text)
+      .closest('button')
+      ?.querySelector('[data-testid="customization-mark"]')
+      ?.getAttribute('data-kind') ?? null;
+  const chip = () => within(header()).getByTestId('perm-provenance-badge');
+
+  it('a New similar copy in the pair: Custom in the header, Added in the rail', async () => {
+    renderAccess(COPY);
+    await copyOpen();
+    await waitFor(() => expect(railMarkOf('My contributor')).toBe('added'), { timeout: 8000 });
+    expect(chip()).toHaveTextContent(t('perm.badge.custom', 'en'));
+    expect(chip()).not.toHaveTextContent(t('perm.badge.package', 'en'));
+  });
+
+  it('a set created in the pair: Custom in the header, Added in the rail', async () => {
+    srv.pairDrafts.set(`permission/${CREATED}`, { name: CREATED, label: 'Pair auditor', objects: {}, fields: {} });
+    renderAccess(CREATED);
+    await waitFor(() => expect(within(header()).getAllByText(CREATED).length).toBeGreaterThan(0), { timeout: 8000 });
+    await waitFor(() => expect(railMarkOf(CREATED)).toBe('added'), { timeout: 8000 });
+    expect(chip()).toHaveTextContent(t('perm.badge.custom', 'en'));
+  });
+
+  it('CONTROL: the base’s own set reads Package, and its rail row carries no mark', async () => {
+    renderAccess(BASE_SET.name);
+    await waitFor(() => expect(within(header()).getByText('Contributor')).toBeInTheDocument(), { timeout: 8000 });
+    // The read has answered: the copy's row is marked, the base set's is not.
+    await waitFor(() => expect(railMarkOf('My contributor')).toBe('added'), { timeout: 8000 });
+    expect(railMarkOf('Contributor')).toBeNull();
+    expect(chip()).toHaveTextContent(t('perm.badge.package', 'en'));
+  });
+});
@@ -12572,6 +12572,9 @@ export function AccessPillar({
               readOnly={readOnly}
               onDirtyChange={setMatrixDirty}
               embedded
+              // objectstack#29809 — the header's provenance chip reads the
+              // mark this set's rail row draws, so the two tell one story.
+              customizationMark={railMarks?.markOf({ type: 'permission', name: current, addedIn: currentAddedIn }) ?? null}
               studio={{
                 tab: accessTab,
                 onTabChange: setAccessTab,