fix(lint)!: the object_extension publish door judges a computed field an extension adds by the build's field-formula pass, against the extended object as served - #33119

📓 Docs Drift Check

This PR changes 3 package(s): @objectstack/lint, @objectstack/metadata-protocol, @objectstack/spec, touching 16 documentable anchor(s).

4 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/concepts/metadata-lifecycle.mdx (via ObjectStackProtocolImplementation (symbol, a top-level class))
• content/docs/data-modeling/object-extensions.mdx (via object_extension (literal, a string literal in objectExtensionWriteFold; a string literal in runStackExpressionPasses; a string literal in runtimeTypes))
• content/docs/deployment/validating-metadata.mdx (via AUTHORING_RULES (symbol, a top-level const object), runtimeTypes (symbol, a field of const object AUTHORING_RULES), object_extension (literal, a string literal in objectExtensionWriteFold; a string literal in runStackExpressionPasses; a string literal in runtimeTypes))
• content/docs/kernel/cluster.mdx (via ObjectStackProtocolImplementation (symbol, a top-level class), object_extension (literal, a string literal in objectExtensionWriteFold; a string literal in runStackExpressionPasses; a string literal in runtimeTypes))

⛔ 4 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v16.mdx (via ObjectStackProtocolImplementation (symbol, a top-level class))
• content/docs/releases/v17/17-0.mdx (via ObjectStackProtocolImplementation (symbol, a top-level class))
• content/docs/releases/v18/18-3.mdx (via object_extension (literal, a string literal in objectExtensionWriteFold; a string literal in runStackExpressionPasses; a string literal in runtimeTypes))
• content/docs/releases/v18/18-4.mdx (via object_extension (literal, a string literal in objectExtensionWriteFold; a string literal in runStackExpressionPasses; a string literal in runtimeTypes))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 8889d9021bc5f416c9d64f231d0c51f49019bd6e && git checkout 8889d9021bc5f416c9d64f231d0c51f49019bd6e
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin f5121e84d56d4e92a4cc40171c65dab84d801b89 bb8a46225eb8eef07f93863a1adba76b3976e0e1 && git checkout -B drift-repro f5121e84d56d4e92a4cc40171c65dab84d801b89 && git merge --no-ff bb8a46225eb8eef07f93863a1adba76b3976e0e1

node scripts/docs-audit/affected-docs.mjs --json f5121e84d56d4e92a4cc40171c65dab84d801b89

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs f5121e84d56d4e92a4cc40171c65dab84d801b89 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

domain:spec#2 · os-tesla · session_01L9qibvfX5bawZKtfa6u7j9

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 8c1950cb90bf35f15139272d93aed5157d9e813e
Local-runs: probe — what the host hands the gate on an update of a stored extension is not readable from the lint diff; head tree exported with git archive under the scratchpad, checkout untouched
Scope: packages/lint/src/authoring-rules.ts, packages/lint/src/validate-expressions.ts, packages/lint/src/runtime-gate.ts (comment only), packages/spec/src/migrations/entries/semantic/18.object-extension-door-computed-field-expression-judged.ts, packages/lint/src/runtime-gate.object-formula-writes.test.ts, packages/lint/src/validate-security-posture.runtime-surface.test.ts, packages/runtime/src/domains/meta-object-extension-item.test.ts, .changeset/33072-object-extension-door-formula.md (declaration lines and prose) + read at head: packages/lint/src/object-graph.ts, packages/metadata-protocol/src/{protocol-authoring-gate.ts,runtime-authoring-gate.ts,protocol-object-extension-item.ts,protocol-meta-item-reads.ts,metadata-diagnostics.ts}, packages/objectql/src/registry.ts (listItems, ObjectExtensionFoldOptions), packages/spec/src/migrations/types.ts, content/docs/deployment/validating-metadata.mdx

Check-runs at review time (2026-11-13T16:27Z): 67 runs, 56 success, 11 skipped, 0 failed, 0 pending. mergeable_state clean. main moved 9433d4f3 → 5c005e0e with no change to any path of this diff.

Local runs at head, in the scratch tree: @objectstack/lint 202 files / 8625 tests pass; the PR body's -t "#33072" command 10 pass; meta-object-extension-item.test.ts 26 pass; five metadata-protocol gate and extension files 296 pass; packages/spec/src/migrations/ 198 pass. Dropping object_extension from runtimeTypes in the scratch copy turns 8 of 49 red (the dev's ablation 1); restored byte-identical. A reviewer probe of 11 cases drove the real saveMetaItem + publishMetaItem over better-sqlite3 and the real registry; ① cites it.

① Derived judgments

• Roster: runtimeAuthoringRulesFor('object_extension') answers validateStackExpressions, validateSecurityRoleWord. The early return sits inside runStackExpressionPasses, so the vocabulary rule still runs (probe: role__c → 422 security-role-word). Right.
• One pass: on that write the flow loop and the object walk read [], the lint: a stored computed field added by an object extension is never judged by the field-formula pass (stored-expression warnings and expression errors skip it) #32875 extension walk runs, and return issues (validate-expressions.ts:4043) precedes the remaining passes. Three fences and one return: no second walk, no second fold. Right.
• Other writes: extensionWrite is false for every other write type and for the CLI; the three edited expressions then reduce to the merge-base text. Right.
• Snapshot: { objects, permissions, books, datasets, objectExtensions: [item] }; objects is registry.listItems('object') plus stored object rows, narrowed to the written package's closure. The item gate refuses an unregistered or out-of-closure target by the same predicate, so a registry-backed door always carries the target with its declared fields. Right.
• Door equals build on one shared input: 8 bodies through the real door give the same verdict, rule id, where, path and message as runAuthoringRules('build', …). Each refusal is 422 INVALID_METADATA, expression-invalid at object 'crm_account' · objectExtensions[0] · field 'score__c' expression. Right.
• Served, not declared: a field another package's extension adds resolves at the door, and a field the write redefines is judged on the written definition. Right.
• Update of a stored extension: the door judges against the target as served before the write. Wrong on two shapes, S1.
• Differential: the baseline holds no objectExtensions, so every finding on the written entry is the write's. A field stored bad before this gate blocks every later publish of the same per-target row that re-sends it; this is the gate's rule for a finding on the written item (finding(lint): the runtime gate's object-write baseline drops the written object's stored self, so a master save is refused (422) for a stored detail's violation — the gate's "never charged to someone else's write" contract #22118), and the changeset's "judged only when it is published again" covers it. Right.
• No export moves. Right.

② Semver level

Clause-②: no (narrowing) + Metadata-protocol: narrowed is correct: a runtime door newly refuses, and no published schema or exported signature moves. lint minor + spec minor with the BREAKING banner matches #33070. The entry has the five SemanticMigration fields, and the adr-0087: registered id equals the entry id. Every changeset bullet holds except where S1 limits "refuses an extension whose computed field carries an expression os build refuses". Skills-docs: none does not hold (S2).

③ Boundary flags

• open_questions: empty.
• The claim's bare no versus no (narrowing): the arm is correct and is what narrowed requires.
• File surface: packages/runtime/src/domains/meta-object-extension-item.test.ts is outside the listed surface. Acceptable: test only (+42 lines), the publish door's own file, the end-to-end pin the order asks for, declared in the dev report. Production change is confined to packages/lint plus the semantic entry.
• Exposure, verified: examples/app-showcase one entry with three plain fields; packages/plugins/plugin-auth one entry with one secret field; packages/apps/** none; HotCRM 0009f58 none. 0 newly refused.
• Dev out-of-scope, confirmed and not filed: an extension's validations are judged at neither door, yet the registry registers them on the object. The seat decides on a card.
• PR author objectstack-fleet[bot].

④ Design judgment

Reusing the build's walk behind a write-type fence is the right shape: one judge, the registry entry declares the type, the gate owns no judgment. What is not yet right is the universe: an extension's stored self lives folded inside objects, so the candidate is not the object as served after the write (S1).

No must-fix. Two should-fix:

• S1 · the door judges an update against the target as served BEFORE the write. registry.listItems('object') already folds the written package's stored extension of the target; objectsAsServed overlays the written entry by field name and cannot take out what the write drops, and refuseUndeclaredHopField reads the live object. Two measured disagreements with the build on one body:

  • Lenient: publish { bonus__c: number, total__c: formula 'record.amount + record.bonus__c' }, then publish the entry without bonus__c. The door answers 200 and the registry then serves total__c with no bonus__c. The build refuses that body.
  • Strict: publish { ref__c: lookup → crm_region }, then { ref__c: lookup → crm_account, via__c: formula 'record.ref__c.name' }. The door answers 422 unknown field name on crm_region. The build accepts the body.

  Rework: hand the gate the target without the written package's own stored extension of it (the registry already answers a fold without one package's contributions, withoutExtensionsOf), with a pin per direction on the real door. If deferred, the changeset, the entry and the [#33072] docblocks must state the limit.

• S2 · Skills-docs: none is not true of the docs. content/docs/deployment/validating-metadata.mdx:497 gives the CEL row's runtime column as ✓ᶠᵃᶜʰᵒᵛᵖ, where each superscript is a write type the rule inspects; at head the rule also inspects object_extension (ᵒˣ), and lines 601–609 describe that door as running the vocabulary rule only. Rework: add ᵒˣ and a sentence.

Nits:

• N1 · a served object_extension draft's _diagnostics now carries the verdict (draftPublishVerdict reads the same roster). No prose face names it.
• N2 · location parity is index-exact only for a one-entry stack; the changeset's "located where the build locates it" and the entry's reason do not say so. The entry's acceptanceCriteria alternative "or run os validate on the package that ships it" is weaker than the door for a pair package validated alone.
• N3 · tests: no case publishes over a stored self (S1), none pins label() or a hop on the real door, none pins the draft _diagnostics. The "(the differential)" case passes by the object-walk fence.
• N4 · PR body: the list of incoming main commits omits three paths (none in this diff); "an extension of an object outside the written package's closure …" describes an arm the item gate refuses first.

S1 and S2 are owed before landing; this reviewer delta-reviews the fix head.

Implemented-by: claude/project-thread-1oe8qz
Reviewed-by: subagent of session_01L9qibvfX5bawZKtfa6u7j9

VERDICT: PASS

domain:spec#2 · os-tesla · session_01L9qibvfX5bawZKtfa6u7j9

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: ac6dd79dc321ad0b6d8c2bd4f3f87ebf96803ae7
Local-runs: probe — the two S1 shapes and the reach of the fold option are verdicts of the real door over a stored self, not readable from the diff; fix head exported with git archive under the scratchpad, checkout untouched
Scope: delta review of record 6858831273 (head 8c1950cb) and amendments 6858847138 / 6858898742. Delta files: packages/metadata-protocol/src/protocol-authoring-gate.ts, protocol-stored-collection-fold.ts, protocol-object-extender-fold.ts, protocol.ts (the two private wrappers), protocol-authoring-gate.extension-write-fold.test.ts, packages/runtime/src/domains/meta-object-extension-item.test.ts, packages/spec/src/migrations/entries/semantic/18.object-extension-door-computed-field-expression-judged.ts, .changeset/33072-object-extension-door-formula.md, content/docs/deployment/validating-metadata.mdx + what the 14 merged main commits changed on the PR's paths (packages/lint/src/validate-expressions.ts, authoring-rules.ts, packages/metadata-protocol/src/protocol.ts, and the new packages/lint/src/formula-cycle-issues.ts) + read at head: packages/objectql/src/registry.ts (getAllObjects, resolveObjectLeavingExtensionsOut, registerObjectExtension), packages/metadata-protocol/src/{runtime-authoring-gate.ts,protocol-publish-batch.ts}, every other caller of the two folds

Check-runs at review time (2026-11-13T21:03Z): 68 runs, 58 success, 10 skipped, 0 failed, 0 pending. The PR is a draft, mergeable_state clean. main moved bf02d33b → 702c562c; the only PR path it touches is authoring-rules.ts (userTextParams pass-throughs on other entries).

Local runs at head, in the scratch tree: @objectstack/lint 205 files / 8751 tests pass; meta-object-extension-item.test.ts 29 pass; nine metadata-protocol files (the new helper file among them) 331 pass; packages/spec/src/migrations/ 198 pass. Both of the dev's ablations reproduce: with the host narrowing off the three republish pins go red, with the stored half off only the stored-row pin does; both restored byte-identical, 6 of 6 green again. A reviewer probe of 18 cases drove the real save, publish and batch-publish doors at BOTH heads (8c1950cb and ac6dd79d); ① cites it.

① Derived judgments

• S1, lenient direction: publish { bonus__c: number, total__c: formula 'record.amount + record.bonus__c' }, then publish the entry without bonus__c. The door now answers 422 expression-invalid, unknown field bonus__c on crm_account, at object 'crm_account' · objectExtensions[0] · field 'total__c' expression, deep-equal to the build's finding on that body, and the registry stays as published. It answered 200 at 8c1950cb. Right.
• S1, strict direction: publish { ref__c: lookup → crm_region }, then { ref__c: lookup → crm_account, via__c: formula 'record.ref__c.name' }. The door now answers 200 and the build has 0 findings. It answered 422 at 8c1950cb. The same shape on a target that has its own stored object row also moved 422 → 200. Right.
• Everything else the probe ran gives the same answer at both heads: the 8 shared inputs still equal the build; a legacy bad field re-sent still blocks; role__c is still refused; a field the write redefines is judged on the written definition. The draft read's _diagnostics follows the narrowed verdict (the draft without bonus__c reads valid: false). Right.
• Reach, callers: foldStoredCollection has one caller, the gate, which states targetFold only for the object collection on an object_extension write. The five other callers of foldObjectExtendersFromRegistry (item, layered and list reads) pass at most four arguments and the PR does not touch them. objectExtensionWriteFold answers undefined for every other type and for a write naming no package. Right.
• Reach, by name: the registry option is package-wide (isLeftOutExtension matches the package on every object), and withTargetFoldedWithout takes only the target from the narrowed list. Probe: the pair's own tier__c on crm_region stays visible to its crm_account extension on a first publish and on a republish (record.region.tier__c 200, record.region.nope__c 422), and another package's mod_tier on the target stays visible on a republish, in both directions. Right.
• Registry semantics: a package holds one extend contributor per object (registerObjectExtension replaces it), so leaving the package out of the target's fold removes exactly the stored self. An object the package does not extend still reaches the cached resolveObject, so the second list costs a re-fold of the objects that package extends and nothing more. Right.
• Other writes: an object publish of a target the pair also extends gives the same verdict at both heads. Right.
• No published surface moves: neither helper nor StoredCollectionTargetFold is on the package entry, and the two class methods are private. Right.
• S2: row 497 reads ✓ᶠᵃᶜʰᵒˣᵒᵛᵖ, which the legend's longest-first rule reads as flow, action, hook, object_extension, object, view, page (after ᵖ it would have read as position). The sentence at 609–612 matches the code, and the changeset line names the docs edit. Holds in the tree.
• N2: the changeset and the entry state index parity for a package with one entry, reason names the republish semantics, and acceptanceCriteria no longer offers os validate. Right.

② Semver level

Unchanged and still correct: Clause-②: no (narrowing) + Metadata-protocol: narrowed, lint minor + spec minor with the BREAKING banner. The new republish bullet holds against the probe. The entry's replacement ("an expression os build accepts") now holds on the single-item door; S3 is the one door where it does not.

③ Boundary flags

• Surface: the delta stays inside amendments 6858847138 / 6858898742 (four metadata-protocol files, the docs page, the runtime test) plus the new helper test. No packages/lint production line moved in the delta.
• PR body: still the first head's text. False at this head: Skills-docs: none — …, "The host side needed no change", "No production file outside packages/lint changes", "All readings at HEAD 8c1950cb", and a "What changes" list with no metadata-protocol or docs file. The seat's paste of the acceptance notes has to cover all five before landing.
• From the merge, validate-expressions.ts: fix(objectql)!: a formula reading another formula reads its computed value; a cycle of formulas is refused where it is authored #33108 put the formula-cycle member inside the object walk, which this PR fences on an extension write. The member reports declared field names only and the extension walk has no cycle member. Probe: a formula an extension adds that reads itself, or two that read each other, publishes at the door and has 0 findings at the build, while the same formula on a declared object is refused at both. The two doors agree, so this PR's claim holds; the gap belongs to fix(objectql)!: a formula reading another formula reads its computed value; a cycle of formulas is refused where it is authored #33108 × lint: a stored computed field added by an object extension is never judged by the field-formula pass (stored-expression warnings and expression errors skip it) #32875. A cycle closed through a declared formula is named by the build at the declared member and not by the extension door. The seat decides on a card.
• From the merge, the rest: authoring-rules.ts gains userTextParams pass-throughs on two other entries; protocol.ts gains readMetaItemFace host members and a docblock; three new semantic entries, no id clash. main changed nothing in the overlay merge, the registry, object-graph.ts, runtime-gate.ts, the item gate or the save and publish doors.
• Seen by the object-write control, same at both heads, not this diff, one reproduction each: an object's own formula cannot read a field its package's published extension adds (unknown field at the object door, while the build accepts), and the object save's destructive-change guard reads such a field as removed unless forced.
• Carried: an extension's validations are judged at neither door (the seat decides on a card).
• PR author objectstack-fleet[bot].

④ Design judgment

The fix is the right shape. It composes two answers of the registry's own fold by name, adds no fold of its own, and makes the candidate the target as it will be served after the write. Passing the option through the stored fold is needed, as the stored-row ablation shows.

No must-fix. S1 is closed. S2 is closed in the tree; its PR-body line waits on the seat. One should-fix, new at this head's review:

• S3 · the batch publish door refuses a package whose extension drafts depend on each other. Outside the delta and the same at both heads; my first record read that the batch's pending set carries no extension drafts and did not probe it. Shape: the pair drafts { extend: 'crm_region', fields: { tier__c } } and { extend: 'crm_account', fields: { score__c: formula 'record.region.tier__c' } }, then publishPackageDrafts. The answer is INVALID_METADATA, unknown field tier__c on crm_region, and the all-or-nothing batch rolls back both. The build accepts both entries (0 findings, with or without the base in the stack), and publishing the region extension first through the per-item door then accepts the other. Before this PR the extension door ran no formula judgment, so nothing refused that batch (derived, not run on a pre-PR tree). The object door has the same blind spot on main (an object draft hopping into a field a sibling extension draft adds is refused the same way), so the gap is the batch's pending set, which publishPackageDrafts validation closure omits same-batch dataset drafts: a package shipping dashboard+dataset together can never publish (widget-dataset-unknown) #10377 built so a package is judged as one unit. Rework, either: thread the batch's extension drafts into the gate's universe, or state the limit in the changeset and the entry and file a card for the pending set covering both doors. The second is prose only.

Nits:

• N1, N4 · carried as the dev's notes state them.
• N3 · partly closed: a hop is now pinned on the real door. label() and the draft _diagnostics are still unpinned, and no real-door case pins "the package's extension of another object stays served" (a unit pin over hand-built arrays only; probed here, it holds).
• N5 · the class docblocks of foldStoredCollection and foldObjectExtendersFromRegistry, which the moved bodies name as their contract, do not describe the new optional parameters. foldObjectExtendersFromRegistry drops onlyExtensionsOf when both are given, though the registry accepts both; no caller passes both.
• N6 · the changeset frontmatter names lint and spec only, while @objectstack/metadata-protocol now carries the host half. The fixed group moves its version anyway; its changelog will not carry the line.
• N7 · Skills-docs: none owed — … is not one of the four listed spellings; updated here is the listed one for a docs edit in the PR. The seat's amendment allowed it.

S3 is owed before landing. If it is resolved by prose and a card, this record continues under the prose-only head-move rule; a code fix owes a delta review.

Implemented-by: claude/project-thread-1oe8qz
Reviewed-by: subagent of session_01L9qibvfX5bawZKtfa6u7j9

VERDICT: PASS

domain:spec#2 · os-tesla · session_01L9qibvfX5bawZKtfa6u7j9

维护者速读

• 改了什么：运行时发布对象扩展（object_extension）时，现在会像 os build 一样判定扩展新增的计算字段表达式；写错字段名、调用未注册函数等会被拒（422 INVALID_METADATA）。重新发布同一个扩展时，按“去掉本包旧扩展后的目标对象”来判，和 build 一致。
• 为什么改：以前这扇门不判公式，build 会拒的扩展在 Studio 里能发布，到运行时才出错。
• 风险与回滚：这是收紧（Clause-②: no (narrowing)、Metadata-protocol: narrowed），lint/spec minor，metadata-protocol patch，带 BREAKING 说明和语义迁移条目。实测仓库内示例和 HotCRM 新拒 0 条。回滚即 revert。已知限制：批量发布（publishPackageDrafts）里互相依赖的扩展草稿会被误拒，已登记 publishPackageDrafts judges a package's drafts without its own extension drafts, so a formula or hop into a field a sibling extension draft adds is refused and the whole batch rolls back #33152，逐个发布可绕过。
• 先看：packages/metadata-protocol/src/protocol-authoring-gate.ts 的扩展写入取目标方式，和 validate-expressions.ts 的 extensionWrite 分支。
• 两分钟验证：pnpm --filter @objectstack/runtime exec vitest run src/domains/meta-object-extension-item.test.ts，预期 29 条全绿。
• 需要你做的：无，席位落地。另登记了三张后续卡 publishPackageDrafts judges a package's drafts without its own extension drafts, so a formula or hop into a field a sibling extension draft adds is refused and the whole batch rolls back #33152、A formula field an object extension adds that reads itself, or two that read each other, is refused at neither the publish door nor os build #33153、An object extension's validations are judged at neither the publish door nor os build, yet the registry registers them on the target object #33154 待分诊。

席位意见：可以落地。

席位核对

ACCEPT · seat domain:spec#2 · head bb8a4622 · 2026-11-14T00:06Z

1. Shape: Fixes #33072, draft, base main, 14 files, +588/−28. Changeset .changeset/33072-object-extension-door-formula.md: @objectstack/lint minor, @objectstack/spec minor, @objectstack/metadata-protocol patch, with a BREAKING banner. Semantic entry object-extension-door-computed-field-expression-judged. Clause-②: no (narrowing), Metadata-protocol: narrowed. These match claim 6855427836, amendments 6858847138 and 6858898742, and dev report 6858450997.
2. Premise: lint: a stored computed field added by an object extension is never judged by the field-formula pass (stored-expression warnings and expression errors skip it) #32875 gave the build its extension walk. The runtime object_extension door ran no field-formula judgment, so an extension os build refuses could be published from Studio. Exposure: repo examples and HotCRM 0009f58 newly refused 0 (review ③).
3. Review: contract review at tier, through an isolated read-only subagent.
   • Record 6858831273 at 8c1950cb: PASS, with S1 (a republish was judged against the pre-write target) and S2 (docs runtime column).
   • Delta record 6864935727 at ac6dd79d: PASS.
     • S1 is closed in both directions on the real door: dropping a used field gives 200 → 422, deep-equal to the build; a re-targeted lookup gives 422 → 200.
     • S2 is closed.
     • The fold option is confined: one caller of foldStoredCollection, the five other callers of foldObjectExtendersFromRegistry untouched, applied by name to the target only.
     • It raised S3 (the batch pending set carries no extension drafts). The gap exists on main for object drafts too, so the seat took the prose route: the limit is stated in the changeset, the entry and the [#33072] docblocks, and filed as publishPackageDrafts judges a package's drafts without its own extension drafts, so a formula or hop into a field a sibling extension draft adds is refused and the whole batch rolls back #33152.
   • r2 f57cc273, seat-checked: N5 docblocks; N6 metadata-protocol changeset line; the both-given fold call made explicit, equivalent for every single-argument shape, with 2 new pins; PR body rewritten for the current head.
4. Gates / check-runs:
   • Dev at 18771ae0, after merging main (conflict: one hunk in validate-expressions.ts against fix(mcp): validate_expression gives the publish gate's verdict at validation and formula sites #33134's validatorRunByCaller, both kept, independent): full build exit 0, lint 8835, spec migrations 198, extension door file 29, 119/119 derived gates exit 0.
   • bb8a4622 removes the tracker id from the entry's acceptanceCriteria, after 18771ae0 turned Test Core red at packages/cli/test/migrate-meta-engine-guidance.test.ts (semantic-entry guidance carries no tracker id). That test passes locally, and ablating the id back turns it red again.
   • CI on bb8a4622: 68 runs, 58 success, 10 skipped, 0 failed. K = 7; git merge-tree against main 588596af is clean.
   • Not governed (check-governed-merges --pr 33119: 0 of 14 paths), 616 changed lines.
5. Accepted deviations and out-of-scope findings:
   • packages/runtime/src/domains/meta-object-extension-item.test.ts is outside the listed surface. It is test only, the end-to-end pin the order asks for.
   • The metadata-protocol host files are within amendment 6858898742.
   • Follow-ups filed, not fixed here: publishPackageDrafts judges a package's drafts without its own extension drafts, so a formula or hop into a field a sibling extension draft adds is refused and the whole batch rolls back #33152 (batch pending set lacks extension drafts; an object's own formula cannot read its package's published extension field), A formula field an object extension adds that reads itself, or two that read each other, is refused at neither the publish door nor os build #33153 (formula cycles through an extension refused at neither door), An object extension's validations are judged at neither the publish door nor os build, yet the registry registers them on the target object #33154 (extension validations judged at neither door).
   • Nits N1, N3 and N4 are carried in the PR's Acceptance notes.
6. Landing: the seat readies the PR and arms auto-merge under the maintainer's standing words 「车道经理应该使用 pm-dispatch 技能审核和落地pr」. On MERGED: lint: the object_extension publish door runs no field-formula judgment, so a computed field os build refuses still publishes through PUT /meta/object_extension #33072 closes via Fixes; pm:dispatched comes off.