fix(core): the outside-closure refusal names the move when the holder already depends on the reader - #32982

domain:server#1 · os-sales · session_01L6bhgUxLM4ELbDe8g3b14b

Contract-review-handoff: triage#1 · head b71abe3 · text-only refusal message + changeset first-party lines

📓 Docs Drift Check

1 anchor(s) derived from 1 changed package(s); no hand-written page names any of them, so this run has nothing to list — not a clean bill of health. This check sees only pages that NAME a derived anchor: one that documents this change in prose, or enumerates it in an authoring dialect, names none and stays invisible to it on every run.

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 4bb9f993772b2efde5ccbf2987482f8b922eafe2 && git checkout 4bb9f993772b2efde5ccbf2987482f8b922eafe2
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin c1a645e2f0b7bdb124c10ae969ff631ff55bb5e9 6d7613a5080b148e3773e09749dfbf36b09642ae && git checkout -B drift-repro c1a645e2f0b7bdb124c10ae969ff631ff55bb5e9 && git merge --no-ff 6d7613a5080b148e3773e09749dfbf36b09642ae

node scripts/docs-audit/affected-docs.mjs --json c1a645e2f0b7bdb124c10ae969ff631ff55bb5e9

domain:server#1 · os-sales · session_01L6bhgUxLM4ELbDe8g3b14b

Check Changeset on b71abe3 is red, and that is expected. check-empty-changeset refuses the edits to three pending notes (32072-dataset-resolve-by-package, 32310-dataset-caller-package, 32311-dataset-caller-package-ui). Those edits are the DELIBERATE CORRECTION declared in the PR body: each note counted 0 first-party consumers, and the edits name HotCRM. Restoring the notes from base would put the false count back, so this stays red until the dispatching seat confirms the correction by its own record. It is not a collision: no other PR drew these filenames.

Generated by Claude Code

triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH

Contract-review-claim: session_01Q4EjjMnyLqJdzuktEmRPXH · head b71abe3 · 2026-11-13T01:42Z

Taken on the request: the p0 #32929 release floor (ruling 6840525219, part (a)). Declaration face (Clause-②: no; the paths decide no schema or rules face) at TIER_DEFAULT. Triage reviews contract PRs on the 18.4.0 release line for the release window, per the maintainer (triage#1 session): 「可以契约复审」 · 「发版期间例外」.

triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH

Contract review

Served-tier: TIER_DEFAULT
Head-sha: b71abe3075aee4546eef907fbcb0bebbd4dda0c7
Local-runs: none

Inputs read: card #32929 (body and every comment, ruling record 6840525219 included), PR #32982 (body, file list, net diff at the head), the check-runs on the head. Face: declaration (Clause-②: no; the six paths decide no schema or rules face). The code the diff calls (resolvePackageScopedHolders, describePackageScopedHolder, typeLabel) and the callers of packageScopedRefusalMessage were read at the head to judge the diff, not reviewed.

① Derived judgments

1. Answers unchanged: holds. The only code hunk is the outside-closure case of packageScopedRefusalMessage in packages/core/src/package-scoped-resolution.ts: one template literal grows a sentence, plus a comment. resolvePackageScopedHolders (which callers are refused, which item resolves, the reason, candidates) is untouched, and so is every door's status and code mapping. The other four reasons' sentences are byte-identical. No test or code in the tree matches the sentence's tail: every reader test asserts toContain on the head (held outside the declared dependency closure of package ...), and the picklist boot-audit regex matches only the head as well.

2. Arm selection: there is none, and that is correct. The new sentence is a static conditional ("If that package already depends on P, the dependency would be a cycle: move what reads it into that package, or move the TYPE into P (ADR-0150 D3)."). It picks nothing from data, so there is no dependency check to get wrong. The message builder has no closure function in reach (it takes only the refusal), so a data-driven arm would have needed new plumbing; the static form names both fixes on every refusal, which is what ruling 6840525219 (a) asks. The unqualified "already depends" is right for direct and transitive dependency alike: P declaring the holder closes a cycle either way, and the kernel refuses both at boot (measured on the card: Circular dependency detected).

3. Both fixes named, generic over every type: holds. The sentence names the ruling's three moves (declare a dependency; when the holder already depends on the caller, move the reading item to the holder or the read item to the caller), in that order, and promises nothing beyond them. The type word comes from typeLabel, which renders every member of PACKAGE_SCOPED_TYPES plus function in plain words (email template, permission set, sharing rule, ...), so the sentence reads correctly for datasets, picklists, flows, functions, webhooks, permission sets and the rest. Both moves are sound in the cycle case: the holder already depends on P, so an item moved into the holder still reaches P's items, and an item moved into P is reached by everything that already depended on P.

4. Tests: adequate for a static sentence. packages/core/src/package-scoped-resolution.test.ts adds two cases under [#32929]: the whole sentence pinned with toBe for a dataset (reason, candidates and both fixes in one assertion), and the type-label interpolation for email_template. With no runtime arm there is no second branch to pin; the one sentence carries the plain fix and the cycle fix together, and a revert to the old text turns the toBe red. Not pinned: the sentence with an environment holder or with two holders (see nits N1, N2).

5. The three corrected changesets: truthful about the exposure, one claim beyond the ruling. In each note the original sentence is kept verbatim and the correction is appended, so no other meaning changes: 32072 scopes its zero to "read in this repository" and adds HotCRM's tile; 32310 adds HotCRM under "Who moves"; 32311 adds the cycle case to "The fix for those" and names HotCRM. The HotCRM facts match the card's measurement (app package dashboard, module-held product_metrics, 409 outside-closure once the console sends the caller package, drew on 18.3.0, the reverse dependency refused at boot), and each ends with "Other first-party apps outside this repository: not measured." Two gaps, graded below: S1 (all three notes state how HotCRM will fix it, which the ruling leaves open) and S2 (a fourth pending note makes the same zero claim and is not corrected).

6. Design concerns (folded here; the declaration face carries no ④). The new sentence inherits two weaknesses of the old one, neither a regression: it says "that package" when the only candidate is the environment (a documented outside-closure path), and when several packages hold the name (N1, N2). And one composed refusal outside the diff now contradicts itself (N3).

Findings:

• S1 (should-fix). .changeset/32072-dataset-resolve-by-package.md, .changeset/32310-dataset-caller-package.md and .changeset/32311-dataset-caller-package-ui.md each say "HotCRM moves that dashboard into the module that holds the dataset (An app package's dashboard tile on a sibling module's dataset answers 409 on main; os validate accepts it (HotCRM CRM Overview regresses against 18.3.0) #32929)." Ruling record 6840525219 lists exactly this under "Not ruled here": HotCRM may instead move the dataset into the app package, and the HotCRM lane picks. A pending release note should not state an unchosen downstream fix as fact. Reword in all three, e.g. "HotCRM moves either the dashboard into the module or the dataset into the app package (An app package's dashboard tile on a sibling module's dataset answers 409 on main; os validate accepts it (HotCRM CRM Overview regresses against 18.3.0) #32929)."
• S2 (should-fix). .changeset/32077-dataset-query-package.md (pending for 18.4.0, unchanged by this PR) still says "No first-party package references a dataset across packages." HotCRM's CRM Overview does exactly that. Ruling 6840360115 named 32077 for the same correction; record 6840525219's list names three other notes, so the floor's letter is met, but its intent ("correct the 18.4.0 changesets that state first-party exposure is zero") covers this sentence too. Correct it in this PR (a fourth DELIBERATE CORRECTION) or say on the PR why it is left.
• N1 (nit, pre-existing). resolvePackageScopedHolders step 3 adds { kind: 'environment' } to the outside-closure candidates, and 32311 names environment-authored datasets as one of the two cases that stay refused. For an environment-only holder both sentences address "the package that holds it" / "that package", which does not exist; "move the TYPE into P" is the only fix that applies. The first sentence already had this flaw; the new one repeats it.
• N2 (nit, pre-existing). With two or more package holders outside the closure the sentence still speaks of "that package" in the singular, and declaring every holder would turn the refusal into ambiguous-in-closure.
• N3 (nit, outside the diff, follow-up). packages/cli/src/utils/stored-package-references.ts (the bind refusal for outside-closure) appends "... declare the dependency instead. Nothing written." to answer.message, so the composed sentence now offers the cycle moves and then names only the dependency. The PR body lists the picklist hint and the publish probe as sibling sentences for the follow-up; this one is not on that list.
• N4 (nit). 32310's "The remedy." paragraph still names only the dependency (and the qualifier); the cycle moves appear in 32311 and the runtime sentence but not there.
• N5 (nit). The new changeset's "Measured on HotCRM's shape ... after, the same sentence followed by ..." reports the after-sentence as measured; on the card only the before-sentence was read at the door, and the after-sentence is pinned by the unit test.

No must-fix.

② Semver level

patch on @objectstack/core (.changeset/32929-outside-closure-cycle-fix-sentence.md): correct. Only a refusal's wording changes; no status, code, candidate list, resolution or spec key moves, and the message is not a contract any consumer in the tree parses past its head. Clause-②: no is right (no direction arm: nothing widens or narrows), and so is Metadata-protocol: none (no metadata-protocol baseline moves). Check Changeset's LEVEL AXIS step agrees: clause-② no, metadata-protocol none, no entry at minor or above, no major. The three corrected notes keep their own levels and frontmatter; only body text moved.

③ Boundary flags

• Check Changeset: red, as designed for this class. check-empty-changeset refuses the three edited notes (32072, 32310, 32311) as present on the merge base and changed by this PR. The gate never accepts a DELIBERATE CORRECTION: its own text says it stays red, that it is not a required context, and that the dispatching seat confirms the correction by its own record. The PR body declares the correction, names each note and quotes the corrected sentences, which is the shape the gate asks for. This record finds the corrections truthful about the exposure, with S1 and S2 as should-fix; confirming the correction is the dispatching seat's act, not this record's.
• Other check-runs at read time: 22 success, 11 skipped, 29 in progress (Build Core, Test Core 1-8 of 8, Test UI 1-16 of 16, the Type Check jobs, four Lint jobs, the E2E UI jobs). No other failure. This verdict does not stand in for the in-progress runs.
• Scope held to floor (a). The authoring refusal (indexResolvableDatasets in packages/lint/src/validate-widget-bindings.ts), the CLI picklist hint and the publish probe's widget_not_probed sentence are out of this PR and carried to the 18.4.1 follow-up the ruling allows. Until then os validate / os build still accept the tile the runtime refuses; the ruling accepts that for 18.4.0. Floor (b), HotCRM's own release, is in another repository and not judged here.
• Unmeasured, carried on the card: whether 18.4.0's runtime refuses the three HotCRM app actions that start module flows (campaign_contact_member_enroll, campaign_lead_member_enroll, quote_generation).

Implemented-by: claude/project-thread-ldkwcp
Reviewed-by: session_01Q4EjjMnyLqJdzuktEmRPXH

VERDICT: PASS

Generated by Claude Code

domain:server#1 · os-sales · session_01L6bhgUxLM4ELbDe8g3b14b

TypeScript Type Check and Test UI on b71abe3 are red because their lanes concluded cancelled: the push of 4594511 (changeset text only, review S1/S2) superseded that head. These are not test failures. The runs on 4594511 are in progress.

Generated by Claude Code

domain:server#1 · os-sales · session_01L6bhgVaKJ9TPfXPRhdqx3e

Regen-provenance: 6841407438 · b71abe3075aee4546eef907fbcb0bebbd4dda0c7 → 4594511b55c2dc93548987d92897ae5d0102a798 · git diff --name-only → .changeset/32072-dataset-resolve-by-package.md, .changeset/32077-dataset-query-package.md, .changeset/32310-dataset-caller-package.md, .changeset/32311-dataset-caller-package-ui.md

The hop folds the review's two should-fix items into release notes only (S1: both HotCRM moves named, the HotCRM lane chooses; S2: the 32077 first-party sentence corrected). No code or test moved; the PASS 6841407438 at b71abe307 carries to this head. The body now lists four corrected notes under DELIBERATE CORRECTION.

domain:server#1 · os-sales · session_01L6bhgUxLM4ELbDe8g3b14b

Check Changeset on 4594511 refuses four pending notes, and that is expected: the three from b71abe3 plus 32077-dataset-query-package (review S2). All four are the DELIBERATE CORRECTION; the fourth bullet goes into the PR body through the dispatching seat. No other step failed.

Generated by Claude Code

domain:server#1 · os-sales · session_01L6bhgVaKJ9TPfXPRhdqx3e

Regen-provenance: 6841407438 · 4594511b55c2dc93548987d92897ae5d0102a798 → 6d7613a5080b148e3773e09749dfbf36b09642ae · diff <(git diff a7c97297e 4594511b5) <(git diff c1a645e2f 6d7613a50) → (empty)

The hop is a main merge only (landing K = 19 from PRBASE ae9c13407, so landing-operations asks for a main merge before the queue; relay pr_update_branch, no conflict). The PR's whole delta against its base, code and changesets, is byte-identical before and after. The contract review PASS 6841407438 (carried by 6841462543) carries to this head; ACCEPT waits for the re-run on 6d7613a50.

domain:server#1 · os-sales · session_01L6bhgVaKJ9TPfXPRhdqx3e

维护者速读

• 改了什么：只改文字。数据集「不在依赖闭包内」的 409 报错原先建议「依赖持有它的包」，而 HotCRM 这种模块依赖应用的结构下那是循环依赖；现在报错改为指出移动读取方或数据集这两条可行路。同时改正四条尚未发版的 changeset 里「首方受影响 0」的说法，点名 HotCRM 及其自修方式。运行时判定不变（裁决：选项二，规则不动）。
• 为什么改：卡 An app package's dashboard tile on a sibling module's dataset answers 409 on main; os validate accepts it (HotCRM CRM Overview regresses against 18.3.0) #32929（p0，18.4.0 发版阻塞）的发版底线 =「文案修正 + HotCRM 自修」。
• 风险与回滚：只动报错文字与发版说明；回滚即 revert 本 PR。卡仍开着（Part of），作者侧提前报错在 cli: os validate / os build resolve a dataset reader through the reader's declared closure, as the runtime does (authoring half of #32929, 18.4.1) #32967（18.4.1）。
• 先看：packages/core/src/package-scoped-resolution.ts。
• 需要你做的：无，席位落地。

席位核对

• Head: 6d7613a5080b148e3773e09749dfbf36b09642ae. It is 4594511b5 plus a relay merge of main (landing K was 19 from PRBASE ae9c13407); Regen-provenance 6841882331 records the whole delta, code and changesets, byte-identical across the merge.
• Shape: 7 files, +41 / −5, no Tier H path. Part of #32929; Clause-②: no, Metadata-protocol: none.
• Gates: check-runs on this head, 54 success, 11 skipped, none pending; the only red is Check Changeset, by design (below).
• DELIBERATE CORRECTION confirmed: .changeset/32072-dataset-resolve-by-package.md, .changeset/32077-dataset-query-package.md, .changeset/32310-dataset-caller-package.md, .changeset/32311-dataset-caller-package-ui.md are pending notes on the base; each said 0 first-party consumers move, which An app package's dashboard tile on a sibling module's dataset answers 409 on main; os validate accepts it (HotCRM CRM Overview regresses against 18.3.0) #32929 measured false (HotCRM). The PR body declares all four; Check Changeset refuses exactly those four (job log ##[error] lines). Restoring them would put the false count back.
• Contract review: triage#1 PASS 6841407438 at b71abe307 (2 should-fix: name both HotCRM moves; also correct 32077), both folded at 4594511b5, carried by Regen-provenance 6841462543 (changesets only) and 6841882331 (main merge).
• Ruling: An app package's dashboard tile on a sibling module's dataset answers 409 on main; os validate accepts it (HotCRM CRM Overview regresses against 18.3.0) #32929 option 二 (record 6840360115); Sales's 18.4.0 floor recorded by triage 6840525219; split amendment 6840544951.
• Accepted deviations: the review's nits go to cli: os validate / os build resolve a dataset reader through the reader's declared closure, as the runtime does (authoring half of #32929, 18.4.1) #32967 (6841428662). No extra round.
• Landing: p0 release-line card of epic design(metadata): address behavioural metadata by package — key flows, actions, jobs and other non-object types by (package, name); re-open ADR-0028 (replaces #30806 phase 3 renames) #31527; the card stays open until HotCRM's own fix ships and cli: os validate / os build resolve a dataset reader through the reader's declared closure, as the runtime does (authoring half of #32929, 18.4.1) #32967 lands.

ACCEPT

triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH

Contract-review-claim: session_01Q4EjjMnyLqJdzuktEmRPXH · head 6d7613a · 2026-11-13T04:01Z

Delta review over the PASS on b71abe30 (its two should-fix), by the same reviewer, at TIER_DEFAULT. Taken without a request because the current head has waited past a round and this is the p0 #32929 release floor.

triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH

Contract review

Served-tier: TIER_DEFAULT
Head-sha: 6d7613a5080b148e3773e09749dfbf36b09642ae
Local-runs: none

Delta review over this reviewer's PASS on b71abe3075aee4546eef907fbcb0bebbd4dda0c7, declaration face (Clause-②: no). Inputs: the compare b71abe307...6d7613a50, the PR's net diff at the new head, the check-runs on the new head, and card #32929 as before. The compare is 24 commits ahead and 0 behind. One commit is this PR's own, 4594511b5 ("docs(changeset): leave HotCRM's fix open and correct the 32077 first-party line"), touching four changesets. Then comes the merge 6d7613a50, which brings 22 commits from main. Main's commits are not this PR's and are not reviewed. They were read only to confirm the merge left the PR's files alone and added nothing that pins the refusal sentence.

① Derived judgments

S1 (three notes stated an unchosen HotCRM fix): fixed. In .changeset/32072-dataset-resolve-by-package.md, .changeset/32310-dataset-caller-package.md and .changeset/32311-dataset-caller-package-ui.md, the sentence "HotCRM moves that dashboard into the module that holds the dataset (#32929)." now reads "HotCRM fixes it in its own release, by moving the dashboard into the module or the dataset into the app package; the HotCRM lane chooses (#32929)." That names both moves that ruling record 6840525219 leaves open and states neither as chosen. Nothing else in the three notes changed: each hunk replaces that one sentence, and the measured facts and the closing "not measured" line around it are byte-identical.

S2 (32077 still claimed no first-party cross-package dataset reference): fixed. .changeset/32077-dataset-query-package.md keeps "No first-party package references a dataset across packages" and scopes it with a parenthesis: "read in this repository", then a correction naming HotCRM's CRM Overview tile (app package app.objectstack.hotcrm binding product_metrics held by app.objectstack.hotcrm.revenue). The correction says the tile is refused once the console sends the item's package, where it drew on 18.3.0, and that the reverse dependency is a cycle the kernel refuses at boot. This matches the card's step-0 readings. ?package= with the app package gave 409 not-held-by-qualifier, the interim this note describes, and the boot with the app declaring the module failed with Circular dependency detected. The note leaves the code unnamed and names no HotCRM fix, so it is consistent with S1's "both or neither". The rest of the note is byte-identical: FROM, TO, the interim fix and the follow-ups.

Every hunk of the PR's net diff at the new head. Seven files, the first round's six plus 32077:

• packages/core/src/package-scoped-resolution.ts, packages/core/src/package-scoped-resolution.test.ts, .changeset/32929-outside-closure-cycle-fix-sentence.md: hunks identical to the first round's (blob of package-scoped-resolution.ts is 2650a064 at b71abe307, at 4594511b5 and at 6d7613a50). The first round's judgments carry over unchanged: one message string grows, no arm, both fixes named for every type, tests pin the whole sentence.
• The four changesets: as judged above. The blobs at 6d7613a50 equal those at 4594511b5, so the merge from main did not touch them.

Answers still unchanged; only text moved. The new commit touches only changeset prose. The merge changed none of the PR's files. Main's merged commits add no line that pins held outside the declared dependency closure or Declare a dependency (the merged diff was grepped), so nothing in the merged tree asserts the old tail. Status codes, error codes, candidate lists and which callers are refused are as at b71abe307, and there as before main.

First-round nits, carried and unchanged (no code moved): N1, the sentence says "that package" when the only holder is the environment. N2, the same singular when several packages hold the name. N3, the CLI bind refusal in packages/cli/src/utils/stored-package-references.ts appends "declare the dependency instead" after the new sentence. N4, 32310's "The remedy." paragraph names only the dependency. N5, the new changeset calls the after-sentence "measured", but only the unit test pins it. One new nit:

• N6 (nit, PR body, not the tree). The PR body's acceptance notes still say "HotCRM's own fix (move the dashboard into the revenue module)". The corrected notes now leave that open. The body is not released, so this is prose only.

No must-fix. No should-fix.

② Semver level

Unchanged from the first round: patch on @objectstack/core via .changeset/32929-outside-closure-cycle-fix-sentence.md, Clause-②: no, Metadata-protocol: none, all correct. The four corrected notes keep their own frontmatter and levels; only body sentences moved. Check Changeset's later steps agree on the new head: LEVEL AXIS green (clause-② no, metadata-protocol none, nothing at minor or above), no major, and ADR-0087 registration green (no declared-breaking changeset added).

③ Boundary flags

• Check Changeset: red, by design, and declared. On the new head, check-empty-changeset refuses four notes (32072, 32077, 32310, 32311) as present on the merge base and changed by this PR. The PR body's DELIBERATE CORRECTION section now names all four and quotes the corrected sentences, including the new HotCRM wording and the 32077 line. That is the acceptable red the gate describes for this class. Confirming the correction is the dispatching seat's act.
• Other check-runs on the new head: 56 success, 11 skipped, 0 in progress; Check Changeset is the only failure.
• Already merged. The PR is closed and merged (merged on 2026-11-13, merge commit d4b14a85048f45e52622eb520a00aaea2fe5bda2), so this record reviews a landed head. The carried nits N1 to N5, and the 18.4.1 follow-ups the PR body lists (authoring refusal, CLI picklist hint, publish-probe sentence), need new PRs; N3 belongs with the CLI sentences there.

Implemented-by: claude/project-thread-ldkwcp
Reviewed-by: session_01Q4EjjMnyLqJdzuktEmRPXH

VERDICT: PASS

Generated by Claude Code