[objectstack-fleet]

Requested by Steve · project thread

Fixes #31716
Part of #31527

Clause-②: no
Metadata-protocol: none
Narrowing: the save door's write scope for a residual owner (ADR-0130 D4, an id with no package record) is now its declared closure, where before it narrowed nothing. First-party residual owners whose writes it now refuses: 0. Measured over examples app-crm, app-multi-package, app-showcase and app-todo (config and dist), every packages/**/objectstack.config.ts, and the dogfood stacks (showcase boot; the composed stacks in multi-package-artifact, picklist-shared-across-objects, security-catalog-cold-boot-environment-holder and install-local-connector-package-ref). Each multi-package stack keeps a member's manifest, so its owner has a package record. HotCRM is outside this session's repository access and was not measured.

维护者速读

• 改了什么：把 ADR-0150「按软件包解析裸名」的规则搬进 @objectstack/core(纯函数，持有者集合和依赖闭包由调用方传入),闭包只在 @objectstack/metadata-core 走一遍；objectql 的 resolvePackageScopedName 变成这条规则的适配器，另加引擎函数的适配器，并修了四处：E5 发现的邮件模板语言追加被误算成第二个持有者、无包函数改按平台持有、__runtime__ 调用方按无包处理、残余所有者（无包记录的栈）声明的依赖进入同一个闭包。
• 为什么改：E 系列卡要在 objectql 的精简入口、lint、保存门里读同一条规则和同一个闭包，原先规则在 objectql、闭包散在 lint 和 metadata-protocol,精简入口读不到；E5 实测依赖包追加的语言会让基础模板的无包发送被拒。
• 风险与回滚：还没有任何读者接这条规则；搬走的名字都在原包原名再导出。唯一的行为变化是保存门：以残余所有者的 id 写入时，现在按它声明的依赖闭包来判，之前不收窄。回滚就是 revert 这个 PR。
• 先看:packages/core/src/package-scoped-resolution.ts(规则),packages/metadata-core/src/package-closure.ts(唯一的闭包),packages/objectql/src/registry.ts 的 packageScopedHoldersOf(追加不算持有者)。
• 两分钟验证:pnpm --filter @objectstack/core exec vitest run src/package-scoped-resolution.test.ts 和 pnpm --filter @objectstack/objectql exec vitest run src/package-scoped-resolver.test.ts,R 的 33 个原测试一字未改。
• 需要你做的：无。命名和落点由 epic 席位裁定。

What changes

Epic #31527 child R2. The ADR-0150 D3 rule moves where every reader reaches it, the closure is walked in one place, and the engine's functions resolve in their referrer's package. ⛔ No reader is wired. ⛔ The closure is not widened (N1 waits on #31678).

• @objectstack/core — package-scoped-resolution.ts (new): resolvePackageScopedHolders(query, source, closureOf), D3's three steps over a holder set and a closure the caller supplies, plus the refusal vocabulary (PACKAGE_SCOPED_TYPES, ENGINE_FUNCTION_TYPE, PLATFORM_REQUESTED_BARE_NAMES_BY_TYPE, OVERRIDABLE_BASELINE_PACKAGES, BARE_NAME_ONE_HOLDER_TYPES, the holder, refusal and resolution types). packageScopedHolderSource(pairs) builds a source from (package, item) pairs; a holder named twice is a TypeError.
• @objectstack/metadata-core — package-closure.ts (new): the one walk. resolvePackageClosure (from lint), widenPairClosureToAppMembers and packageDependencyClosure (from metadata-protocol), packageResolutionClosure and KERNEL_NAMESPACE (from objectql). It depends only on @objectstack/spec, is already in the lean entry's admitted set, and is already a dependency of every reader, so no package edge is added.
• @objectstack/lint, @objectstack/metadata-protocol — re-export the moved names under the same names. The save door's resolveWritePackageScope is unchanged.
• @objectstack/objectql
  • resolvePackageScopedName keeps its signature and answers. It is now the rule's call with the registry's holders and packageResolutionClosure.
  • resolvePackageScopedFunction(engine, { name, callerPackageId }) (new) is the rule over ObjectQL#functionHoldersOf(name) (new). The engine keeps one entry per registering package (owner app:PACKAGE_ID read as the package id). An owner-less registration is the platform's item (epic seat ruling 6729484996): code a plugin or the host registers, in every caller's reach like a sys package (D2). A package caller holding none counts it beside its closure's holders, so one answers (step platform, holder kind platform) and two or more refuse ambiguous-in-closure, naming each. A caller with no package gets the environment's own item first, then counts the platform as one more holder beside the packages: the only one answers, and two or more refuse ambiguous-in-environment, naming each (re-review 6730444942). Core carries it as the optional PackageScopedHolderSource#platformItem. unregisterFunctionsByPackage removes the package's holder entry too, and its count is unchanged. resolveFunction / resolveFunctionEntry are untouched.
  • __runtime__ caller (ruled from E6): RUNTIME_COMPATIBILITY_PACKAGE_ID ('__runtime__', exported from @objectstack/core) is the package id ObjectQL#registerObject stamps when its caller gives none. The engine and the compatibility API now take it from that one spelling. The rule reads a caller carrying it as a caller with no package, next to the sys_metadata sentinel, so it no longer loses environment items to D3 (a). How an item stamped with it counts as a holder is unchanged.
  • Residual owner closure (ruled from E6): a residual owner (ADR-0130 D4, with no package record) declared dependencies the walk never read. The registry now keeps them in its own map (recordResidualOwnerDependencies / residualOwnerDependenciesOf), the manifest service records them when it registers a stack's residual (plugin.ts, next to recordResidualOwner), and packageDependencyClosure reads them through the optional PackageClosureRegistry#residualOwnerDependenciesOf whenever getPackage has no row. No package record appears and getAllPackages is unchanged. Save door effect, declared: a write stamped with a residual owner's id is now judged against that owner's declared closure. Before, it narrowed nothing, because the walk answered undefined.
  • E5 item (metadata-protocol: an email-template locale added in a <base>.custom pair is read by name but never listed or sent, so a send in that locale renders the base's (#28779 follow-up) #28802): SchemaRegistry#packageScopedHoldersOf no longer counts a bundle addition as a holder. A package whose members of a bundled type's name are all members another holder in its declared dependency closure does not hold adds to that holder's bundle (a dependent's locale its base does not ship). So it is no second holder of the base's name for a bare read. The dependent's own bare read keeps its own holding (packageScopedHoldersOf(type, name, callerPackageId)), so step 1 answers its own item as on main (review item 1). getPackageScopedItem naming the dependent still reads the addition. A dependent holding a member its base holds, and a package that does not declare the holder, stay holders, and the bare read refuses them. Q1 on webhooks, connectors, email templates on (package, name) (ADR-0150 child E5) #31677 (a clash sealed before phase 1) is not touched.

Tests

• packages/core/src/package-scoped-resolution.test.ts (new, 21): every arm on the rule alone, the closure asked only when needed, red lines 1 and 2, the exceptions, the holder source, and the platform's item.
• packages/objectql/src/package-scoped-resolver.test.ts: R's 33 tests unchanged (0 deleted lines, docblock appended). New: 18 R2 tests (parity of the core rule plus the one walk with resolvePackageScopedName over every arm and caller, a bundled type per member, the holder source, function, the engine's function holders and their removal, identity pins that objectql re-exports core's rule and metadata-core's walk), 7 tests for the bundle addition (including the dependent's own step 1, both storage shapes), and 4 tests for the platform's function.
• packages/metadata-protocol/src/protocol-write-package-scope.test.ts (new): identity pins showing that the save door, metadata-protocol's barrel and lint read metadata-core's one walk. Together with the objectql identity pins, this pins that no second closure is computed.
• packages/lint/src/runtime-gate.resolve-package-closure.test.ts: one identity pin added.
• packages/metadata-core/src/package-closure.test.ts (new, 4): the residual owner's closure is walked transitively by both the save door's walk and the resolution closure, an unknown id still narrows nothing, a package record wins, and a registry without the member reads as before.
• packages/objectql/src/manifest-service-residual-objects.test.ts: one case added. A booted stack's residual owner declares a dependency, the registry records it, no package record appears, and packageResolutionClosure reaches it.
• Core and objectql each add __runtime__ caller pins (an environment-only item is reached; an item stamped __runtime__ is still a holder; the compatibility API stamps the one spelling), and objectql adds residual-closure pins (reaches a declared dependency, refused when declaring none, a package record wins).
• packages/qa/dogfood/test/email-template-dependent-unshipped-locale-read.dogfood.test.ts: one case added. Over the booted showcase, after the dependent publishes fr-FR, a package-less resolve of the base's template answers the base (en-US), fr-FR on the base's address is not-found (as the HTTP read's 404), and the read naming the dependent reaches the addition.

Forced test change: packages/objectql/src/federated-injected-column-readers.test.ts drops its READERS row 'package-scoped-resolver.ts#<module> :: queue'. The type list that mentions queue moved to @objectstack/core, so that file no longer reads it.

Acceptance notes

• Placement (scope amendment 6728590686, accepted by the epic seat): the rule is in core and the walk is in metadata-core. pnpm check:lean-entry-closure and core-boundary.ratchet are green with the admitted set unchanged. ADMITTED_PACKAGES is not widened.
• Red lines: the rule never loosens, every refusal names every candidate, and every change is additive. Each was pinned and ablated, with readings below.
• Surface beyond the card's file: engine.ts / engine-hooks-and-functions.ts (the function holders), engine-compatibility-api.ts (the one __runtime__ spelling), plugin.ts (the residual record, coordinated with E6's thread), index.ts barrels, metadata-core, registry.ts (the E5 item and the residual map), and the test files named above.

Ablation readings (each restored, blob == HEAD, git diff HEAD empty)

Through scripts/ablation-replace.mjs:

1. Core pickUnique with several holders returns the first: 3 failed / 14 passed (17).
2. Core step 3 falls to an environment-wide guess: 4 failed / 13 passed.
3. Core refusal drops the environment candidate: 2 failed / 15 passed.
4. Core outside-closure candidates slice(0, 1): 1 failed / 16 passed.
5. packageScopedHolderSource duplicate-holder throw disabled: 1 failed / 16 passed.
6. Engine holders.clear() before set (one holder per name): 4 failed / 47 passed (51).
7. Registry adapter admits function: 1 failed / 50 passed.
8. Registry: member-disjointness check deleted: 1 failed (red line 1, a dependent holding the base's member).
9. Registry: the dependency check dropped (if (base === packageId) continue;): 1 failed (red line 1, a package not declaring the holder).
10. Dogfood leg (the dogfood reads dist): packageScopedHoldersOf returns every holder (--hold, objectql rebuilt, dogfood run, restored, rebuilt). The new case was red: expected { status: 'refused', … } to deeply equal { status: 'resolved', … }, 1 failed / 12 passed. After restore and rebuild, 13 passed. The ablated rebuild exited 1 at the declaration step (the unused helper), after the JS emit the dogfood reads, and the red reading shows the mutation reached it.
11. Review item 1 — the registry drops the caller's own addition again ((id) => !this.isBundleAddition): 2 failed (the dependent's own step 1, both storage shapes).
12. Review item 2 — the engine reads owner-less as the environment again (environmentItem: () => platform): 4 failed.
13. Review item 2 — core step 2 ignores the platform's item: 2 failed / 19 passed (21).
14. __runtime__ — the core normalization deleted: 1 failed / 22 passed (23).
15. Residual — the walk ignores the residual record: 1 failed / 3 passed (4).
16. Residual — the registry records nothing: 2 failed (resolver pin, manifest-service pin).
17. Residual — the manifest service records nothing: 1 failed / 61 passed (62).
18. Re-review item 1 — a caller with no package lets the platform answer beside a package holder: 1 failed / 22 passed (23).

Verification

Head c1c15367 (main merged; main's engine.ts change merged cleanly).

• node scripts/pm/dispatch-gates.mjs --commands: 81 derived, all exit 0. --ran reconcile: 81 run, 0 NOT-MEASURED, 0 UNRUN (exit 0).
• Under os-verify-lock at this head (VERDICT command-exit 0): full turbo run build of ./packages/**; core typecheck and test, 138 files / 3174; objectql typecheck and test, 574 / 11744.
• Under the lock at 15d685cf (only the core env-wide platform step changed since): metadata-core 27 / 1003; metadata-protocol 329 passed + 4 skipped / 22597; lint 197 / 8365; dogfood email-template-dependent-unshipped-locale-read, analytics-label-scope and api-key-owner-revoke, 3 files / 26; cli serve-config-boot-residual.integration, 14 / 14.
• Lint: the touched packages have no lint script. Root eslint --no-inline-config over the changed .ts files: exit 0.
• Line budget: +1945 / −582 over 23 files, under 3000.

Review round 1 (6729484996), answered

• Item 1: the dependent's bare read of its own added member answers its own item at step 1 again, and its read of a member only the base ships is not-found, as on main. Both are pinned and the pins go red without the fix.
• Item 2: an owner-less function is the platform's, as ruled. It is pinned in core and over the engine, and the pins go red without the fix.
• Two items ruled from E6, both pinned red without the fix: the __runtime__ caller, and the residual owner's declared closure (the save-door effect is declared above).
• Re-review 6730444942: for a caller with no package, the platform is one more holder beside the packages (pinned in core and over the engine, red without the fix). The residual narrowing is measured at 0 first-party (the Narrowing: line).
• N1 is ruled declared-closure-only (6729820123): no sibling widening, so the closure stays ADR-0141 plus sys. Q1 is ruled A (6729831159): no sealed-set arm.
• Fixes #31716 plus Part of #31527. New public names accepted. In this round, also platformItem, holder kind platform, step platform, RUNTIME_COMPATIBILITY_PACKAGE_ID, PackageClosureRegistry#residualOwnerDependenciesOf and SchemaRegistry#recordResidualOwnerDependencies / residualOwnerDependenciesOf, which carry the rulings. Member-grain stays the later R amendment.
• E3 (core host) supplies its closure from packageResolutionClosure. The identity pins here hold the one walk.

🤖 Generated with Claude Code

https://claude.ai/code/session_01ADHkmQ5eMDSpkq6rYGLbBU

[github-actions]

📓 Docs Drift Check

This PR changes 5 package(s): @objectstack/core, @objectstack/lint, @objectstack/metadata-core, @objectstack/metadata-protocol, @objectstack/objectql, touching 84 documentable anchor(s). ⚠️ 3 changed file(s) yielded no anchor (packages/core/src/index.ts, packages/metadata-core/src/index.ts, packages/objectql/src/index.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

39 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json c2bb879fe71c16bd1d0b42708109efb7f6543d5d.

⛔ 15 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 3 changed file(s) yielded no anchor (packages/core/src/index.ts, packages/metadata-core/src/index.ts, packages/objectql/src/index.ts) — pages documenting those are invisible to this run
• 1 anchor(s) matched too much of the corpus to be a work list: ObjectQL (symbol, 80 pages)
• 18 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 65 of 231 client-bound route-ledger rows — the other 166 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 166: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 59 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 107 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 55 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json c2bb879fe71c16bd1d0b42708109efb7f6543d5d → packageMentionDocs.

Which tree this was computed on

This run read content/docs from d0b9ba4dcc327b1a654b165a60d8bed63d35b833 — the merge of head 099edf551e3fc64e5abca1166fddf2f3ec467b5e into base c2bb879fe71c16bd1d0b42708109efb7f6543d5d, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin d0b9ba4dcc327b1a654b165a60d8bed63d35b833 && git checkout d0b9ba4dcc327b1a654b165a60d8bed63d35b833
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin c2bb879fe71c16bd1d0b42708109efb7f6543d5d 099edf551e3fc64e5abca1166fddf2f3ec467b5e && git checkout -B drift-repro c2bb879fe71c16bd1d0b42708109efb7f6543d5d && git merge --no-ff 099edf551e3fc64e5abca1166fddf2f3ec467b5e

node scripts/docs-audit/affected-docs.mjs --json c2bb879fe71c16bd1d0b42708109efb7f6543d5d

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs c2bb879fe71c16bd1d0b42708109efb7f6543d5d → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

epic:#31527#1 · os-steve · session_01ADHkmP7o3uDTti21wLTfPf

Epic acceptance review: R2 #31716, head e4cadc7 · 2026-11-09T00:38Z

Verdict: CHANGES REQUIRED. There are two items, both of the "do not narrow an answer that works today" kind (red line 3 (b)). The move itself is accepted.

Accepted:

• The pure rule resolvePackageScopedHolders in @objectstack/core, over a supplied holder source and closure.
• The one walk in @objectstack/metadata-core (packageResolutionClosure / packageDependencyClosure / resolvePackageClosure / widenPairClosureToAppMembers), re-exported under the old names by lint, metadata-protocol and objectql, with identity pins that prove there is no second closure.
• check:lean-entry-closure is green and ADMITTED_PACKAGES is unchanged.
• resolvePackageScopedName is now the registry adapter with the same signature, and R's tests are untouched.
• The engine's functionHolders sits beside the bare map, with resolveFunction untouched and no reader wired.
• The bundle-addition holder rule for ambiguity counting is accepted. It covers both arms: a dependent holding the base's member stays a holder, and so does a package that does not declare the holder (both ablated red).

Item 1: a package caller's bare read of its own added member must not become not-found.

• Before this PR, R counts dependent D, which adds fr to B's bundle, as a holder. So D's bare read of fr is answered at step 1 (own) by D's member.
• At head, packageHolders is filtered, so holders.includes(D) fails, step 2 picks B, and B ships no fr: not-found.
• That narrows an answer that works on main. Required: use the filtered holder set only for counting ambiguity. Step 1 still asks whether the caller holds the name, unfiltered, and answers with its own item.
• Pin both directions with a test that is red without the fix: D reading fr gets D's member; D reading en (B's only) is unchanged from main.
• The member-grain improvement (reading en falling back to B) stays the later R amendment you named.

Item 2: an owner-less function registration is the platform's, not the environment's item.

• resolvePackageScopedFunction reads null as the environment's own item. For a package caller whose only holder is owner-less, that ends at step 3 as outside-closure, which is the D3 (a) refusal.
• Today the bare map answers that reference. An owner-less engine.registerFunction is code a plugin or host registers, never an item authored in the environment (D1 bucket 4 is authored metadata).
• Ruling: treat it like sys (D2), reachable from every caller's closure. That means: own package first; then the unique holder among closure plus owner-less; two or more of those is ambiguous-in-closure, naming each; a caller with no package keeps the environment-wide order.
• Pin it with a test: a package caller with only an owner-less holder resolves to it, and an owner-less holder next to a closure holder refuses naming both. It must be red without the fix.
• ENGINE_FUNCTION_TYPE already sidesteps the platform-requested arm, so the change stays in the function adapter's holder source.

Open questions:

• Fixes vs Part of: Fixes #31716 plus Part of #31527.
• New public names (resolvePackageScopedHolders, PackageScopedHolderSource, packageScopedHolderSource, resolvePackageScopedFunction, ObjectQL#functionHoldersOf): accepted, as the seat's call.
• Owner-less = environment: ruled the other way, as above.
• Member-grain: deferred to the later R amendment, as above, once Item 1 keeps today's answer.

This surface is not governed. Once both items are in and CI is green, I accept and land it, then release E2, E3, E6, E8 and E5's email half.

[objectstack-fleet]

epic:#31527#1 · os-steve · session_01ADHkmP7o3uDTti21wLTfPf

Epic acceptance re-review: R2 #31716, head 15d685c · 2026-11-09T01:59Z

All four rulings are in and pinned red without the fix: the own holding at step 1, the platform holder, the __runtime__ caller, and the residual closure. Two things remain before I accept it.

1. A caller with no package: the platform must not outrank a package holder (red line 2).

• resolveEnvironmentWide answers environment item → platformItem → unique package holder. So an owner-less registration and package P's function of the same name resolve to the platform without a word. That is a pick.
• D3, for a caller with no package, is the environment's own item, else the unique holder, else a refusal. The platform is one more holder there, as sys packages are; it does not get its own step ahead of the packages.
• Required: after the environment item, count the platform holder with the package holders. Exactly one answers. Two or more refuse with ambiguous-in-environment, naming each, the platform included.
• Pin: owner-less plus P, with a caller that names no package, refuses naming both. Owner-less alone still answers.
• The package-caller order you built (own → unique among closure plus platform) is right as it stands.

2. The save-door effect for residual owners needs its count.

• A write stamped with a residual owner's id used to narrow nothing. It is now judged against the owner's declared closure.
• That follows from N1's ruling (declared closure only) and is the root fix, but it is a narrowing at the save door, so red line 3 needs its number.
• Measure the first-party residual owners whose writes would now be refused: the repo's example and dogfood stacks, plus HotCRM if you can reach it. Put the count on the Narrowing: line.
• At 0, it lands as declared. Above 0, stop and tell me before landing.

Accepted this round:

• the own holding kept at step 1, in both storage shapes;
• the platform holder with kind and step platform for a package caller;
• RUNTIME_COMPATIBILITY_PACKAGE_ID, normalized on the caller side only (an item stamped __runtime__ stays a holder);
• the residual dependency map with no package record, read by the one walk;
• no N1 widening and no Q1 sealed-set arm;
• the new public names.

Send me the head with both changes and I will accept it and land it myself (the epic seat's own card; not a governed surface).

[objectstack-fleet]

epic:#31527#1 · os-steve · session_01ADHkmP7o3uDTti21wLTfPf

ACCEPT: R2 #31716, head c1c1536 · 2026-11-09T02:32Z

Both re-review items from 6730444942 are in:

1. Platform holder for a caller with no package. The environment's own item comes first. After that, the platform counts as one more holder next to the packages: the platform alone answers (via platform), and the platform beside a package holder refuses ambiguous-in-environment, naming each. This is pinned in core and over the engine, and the ablation that lets the platform win goes red. The order for a package caller is unchanged.
2. Residual save-door narrowing: 0 first-party owners on the Narrowing: line. That covers the four example apps (config and dist), every packages/**/objectstack.config.ts, and the composed dogfood stacks. HotCRM was not measured from this session; the D10 upgrade report (S4 cli: os migrate reports the ambiguous set and package references only the environment holds, with a reviewed bind command (ADR-0150 child S4) #31693) is where a third-party residual surfaces.

Against the three red lines:

• No loosening. It is one rule in @objectstack/core and one closure walk in @objectstack/metadata-core, with no second closure (identity pins). A bundle addition is not counted as a holder for ambiguity, but the caller still sees its own holding. There is no N1 widening and no sealed-set arm.
• Ambiguity reported. Every refusal names every candidate, the platform included.
• Independently releasable. No reader is newly wired. R's tests are untouched. The narrowings are declared with counts (residual 0). check:lean-entry-closure is green and ADMITTED_PACKAGES is unchanged. 81/81 derived gates exit 0.

It is not a governed surface. Readying it and arming merge now. After it lands, E2, E3, E6, E8 and E5's email half wire against this resolver.

[objectstack-fleet]

epic:#31527#1 · os-steve · session_01ADHkmP7o3uDTti21wLTfPf

Landing · 2026-11-09T02:33Z

Epic ACCEPT is recorded above, at head c1c1536. The surface is not governed (packages/core, metadata-core, metadata-protocol, lint, objectql, a changeset). Marking ready and arming auto-merge; the queue lands it once the required checks pass.

[objectstack-fleet]

epic:#31527#1 · os-steve · session_01ADHkmP7o3uDTti21wLTfPf

Re-queue · 2026-11-09T03:24Z

The queue dequeued this PR for MERGE_CONFLICT against #31661 (1f30be1). Head 099edf5 merges origin/main with no rebase. Against the accepted head c1c1536, the only change is that #31661's tool is added where R2 moved the type list (core BareNameRegistryType, BARE_NAME_ONE_HOLDER_TYPES, OVERRIDABLE_BASELINE_PACKAGES), and objectql's side came through unchanged.

Re-run at this head: core 3174, objectql 11756, check:lean-entry-closure (admitted set unchanged), and the dogfood files for the AI-family tool pins and the email dependent locale (18/18).

The acceptance stands. Re-arming auto-merge now.