[objectstack-fleet]

Requested by Elon · project thread

Fixes #32967
Fixes #32929

维护者速读

• 改了什么：os validate / os build 在多包产物的逐包检查里，看板组件读的 dataset 改为按读取方声明的依赖闭包解析（与运行时一致）。HotCRM 这种「app 包看板读自家模块的数据集」作者期就报错（exit 1），提示里按产物实际情况给出可行的改法：模块已依赖 app 时说「成环，把看板搬进模块，或把数据集搬进 app」。闭包里两个包都持有同名数据集也报错，不再随手挑一个。顺带把 core 拒绝语、os migrate stored-references、CLI 选项列表提示、发布探针里的同类句子补齐（只有环境持有时只说搬入；多个持有者时只让依赖其中一个）。
• 为什么改：裁定 An app package's dashboard tile on a sibling module's dataset answers 409 on main; os validate accepts it (HotCRM CRM Overview regresses against 18.3.0) #32929 选二（6840360115、6840525219）：规则不动，作者期提前报错。之前作者期说可以、运行时 409，两边不一致。
• 风险与回滚：作者期新增拒绝（元数据协议种类 narrowed，@objectstack/lint 升 minor，已登记 ADR-0087 升级指南条目 dashboard-dataset-outside-reader-closure-refused），只在带 packages[] 的多包产物的逐包检查里生效；读取方声明了产物里没有的依赖时只给警告不拒绝（那个包装上后可能就持有该数据集）；本仓 examples 受影响 0 个，第一方已知 HotCRM 1 个（HotCRM 已自修，看板已搬进 revenue 模块）。运行时答案不变，只有拒绝语变长。回滚即 revert 本 PR。
• 先看：packages/lint/src/validate-widget-bindings.ts 的 indexArtifactDatasetResolution（闭包与歧义判断）和 datasetRefusalWording（选哪种改法）；packages/core/src/package-scoped-resolution.ts 的 outside-closure 分支。
• 两分钟验证：pnpm --filter @objectstack/dogfood exec vitest run test/dataset-app-reads-module.dogfood.test.ts，预期 9/9 通过：HotCRM 形态 os validate exit 1 且运行时 409；搬进模块后 exit 0 且 200；app 反向依赖模块启动失败（成环）；顶层另有残余数据集时整体检查照旧放行；声明了产物外依赖时只警告、exit 0。
• 需要你做的：无，席位落地。

Clause-②: no (narrowing)
Metadata-protocol: narrowed
Skills-docs: none — skills/** teaches neither cross-package dataset resolution nor widget-dataset-unknown.

BREAKING accept-set narrowing in the authoring doors (os validate, os build, os lint; @objectstack/lint minor): a package dashboard widget whose dataset only a package outside the reading package's declared dependency closure holds, or two packages inside it hold, is refused where it was accepted. ADR-0087 upgrade-guide entry dashboard-dataset-outside-reader-closure-refused (registered in the changeset).

What changes

Door	FROM (main 2c98485)	TO
os validate / os build / os lint, per-package pass: a package's dashboard widget whose dataset only a package OUTSIDE its declared dependency closure holds (HotCRM's shape)	accepted (#25514 read every body of the artifact)	widget-dataset-unknown error naming the dataset, the holders and the open fix
same, a name TWO packages inside the closure hold	the first body's dataset picked	widget-dataset-unknown error naming both: nothing picks one
same, outside the closure, and the reading package declares a dependency the artifact does not carry	accepted	widget-dataset-unknown warning ("not judged: it may come from …"), suppressible; nothing said about the installed answer (review S1, the picklist twin's arm)
same, a dataset of a package the reader declares, or its own	accepted	accepted, unchanged
per-package pass, a report's (or joined block's) runtimeFilter on a dataset the report cannot resolve for its package	judged against the first body's dataset	not judged there (the index resolves nothing); no verdict lost: chart-dataset-unknown already refuses that report on that pass, and the union run still judges the filter
the union run (including a manifest: 'preserve' composition whose manifest id names a body, with a residual top-level datasets), and any stack without packages[]	every body read	unchanged
core outside-closure sentence (409 at every package-scoped by-name door), only the environment holds the item	"Declare a dependency on the package that holds it … move what reads it into that package, or move the TYPE into P"	"No package holds it, so no dependency reaches it: move the TYPE into P"
same, two or more package holders	"Declare a dependency on the package that holds it"	"Declare a dependency on the one package whose TYPE is meant; depending on more than one leaves the name ambiguous"
same, one package holder	unchanged, byte for byte	unchanged
os migrate stored-references (report reason and bind refusal), CLI picklist-reference hint, publish probe widget_not_probed fix	named only the dependency	name the move beside it; the picklist hint reads the artifact and, when the holder already depends on the field's package, names only the moves

Which item any runtime read answers, its status, code and details.candidates do not change.

How the authoring rule decides (indexArtifactDatasetResolution): on the per-package pass (stack.manifest IS one of the bodies, the object packageBodyAsStack hands; an id match alone also caught the union run of a manifest: 'preserve' composition, review M2) a widget's name resolves in the package's own datasets, then to the ONE holder in packageResolutionClosure (the walk the dataset doors resolve ?callerPackage= by) read over the artifact's bodies, as picklist-references.ts already does. The fix the finding names is chosen from the artifact: a holder whose own closure reaches the reader cannot be declared back (the kernel refuses the cycle at boot), so the hint names the move; otherwise the dependency entry. When the reading package declares a dependency the artifact does not carry, an outside-closure name is a warning that names those dependencies, as picklist-references.ts reports its twin; two holders inside the closure stay an error whatever is installed. Neither arm reaches the publish door: its write snapshot (buildRuntimeWriteSnapshotSet) carries the context collections and the subject only, never packages[], so the warning needs no user sentence of the kind #33118 gave the advisory ids the door returns (pinned).

Upgrade path: ADR-0087 semantic entry dashboard-dataset-outside-reader-closure-refused (packages/spec/src/migrations/entries/semantic/), surfaced in the protocol 18 upgrade guide and in os migrate meta's guidance (which names no tracker id: review M3).

The nits carried in 6841428662: N1 and N2 in packageScopedRefusalMessage; N3 in stored-package-references.ts (and its report twin in commands/migrate/stored-references/index.ts); the picklist hint and the probe's widget_not_probed fix listed by #32982's body. N4 (32310's "The remedy." paragraph) is released text in packages/rest/CHANGELOG.md (18.4.0), which a code PR does not edit; the new changeset carries the corrected remedy instead.

HotCRM (sister repository, not edited here): its self-fix already moved the CRM Overview's List Price by Category chart with product_metrics into the revenue module (hotcrm test/package-ownership.test.ts, src/revenue/dashboards/product-catalog.dashboard.ts), so HotCRM's current tree passes this rule.

Why

Ruling on #32929, option two (6840360115; triage record 6840525219): the resolution rule (ADR-0150 D3 (c), N1 6729820123) stands and authoring reports it early. Epic #31527 red lines: resolution is not loosened (authoring is narrowed to the runtime's answer), ambiguity is reported (two closure holders refuse, never a pick), and this PR is independently releasable (no runtime answer moves).

Tests

• packages/lint/src/validate-widget-bindings.artifact-datasets.test.ts: the fixture pinned to HotCRM's names flipped from ACCEPT to REFUSE, plus: the dependency arm when the holder does not depend on the reader, two holders outside the closure, two holders inside it (red line 2), own-dataset precedence, the declared dependency accepted, the union run of a real composeStacks(…, { manifest: 'preserve' }) artifact with a residual top-level datasets and a module dashboard on the module's own dataset unchanged (M2), a dependency outside the artifact reported as a suppressible warning without a 409 claim (S1), an outside dependency never softening a closure ambiguity, neither arm reaching the publish door, the rule table reached. The M2 pin's CONTROL is the per-package pass of the same composition refusing the app's dashboard on the module's dataset (review n1).
• packages/core/src/package-scoped-resolution.test.ts: environment-only holder (N1), two package holders (N2).
• packages/cli/src/utils/picklist-references.test.ts: the cycle arm of the picklist hint.
• packages/metadata-protocol/src/build-probes-dataset-holders.test.ts: the probe's fix names the move.
• packages/qa/dogfood/test/dataset-app-reads-module.dogfood.test.ts (new): the three cells of the card on real doors: cell 1 os validate exit 1 + dataset door 409 (single and batch); cell 2 os validate exit 0 + 200 for the module's reader; cell 3 the app declaring its module refuses boot (Circular dependency detected); M2 os validate exit 0 on the residual-dataset composition; S1 os validate exit 0 with the warning.

Ablations (bug put back, red seen, restored with git diff HEAD empty):

lint: every body back in reach

ablation-replace: ok mutation landed: anchor 1 -> 0, blob 8d9f8cff22e5 -> fc38e257c5ed
     × REFUSES the app widget bound to the dataset its module holds, naming the move (the module depends on the app) 9ms
     × names the dependency when the holder does not depend on the reader 1ms
     × two holders outside the closure: both named, and the dependency asked for is ONE of them 1ms
     × REFUSES a name two packages of the closure hold, naming both: nothing picks one (red line 2) 1ms
     × reaches the rule table the per-package pass runs 29ms
⎯⎯⎯⎯⎯⎯⎯ Failed Tests 5 ⎯⎯⎯⎯⎯⎯⎯
      Tests  5 failed | 9 passed (14)
ablation-replace: ok restored: blob == HEAD (8d9f8cff22e5) and `git diff HEAD` is empty

dogfood cell 1 through the built CLI (lint dist rebuilt with the mutation, preflight found the marker; restored and rebuilt, preflight `--absent`)

ablation-replace: ok mutation landed: anchor 1 -> 0, blob 8d9f8cff22e5 -> bef250bcdd7a
ablation-dist-preflight: @objectstack/lint -- expecting "ABLATION-32967" in packages/lint/dist
     × cell 1: HotCRM's shape exits 1, naming the dataset, both packages and the move (BASE: exit 0) 2922ms
⎯⎯⎯⎯⎯⎯⎯ Failed Tests 1 ⎯⎯⎯⎯⎯⎯⎯
: expected +0 to be 1 // Object.is equality
      Tests  1 failed | 1 passed | 5 skipped (7)
ablation-replace: ok restored: blob == HEAD (8d9f8cff22e5) and `git diff HEAD` is empty
ablation-dist-preflight: @objectstack/lint -- expecting NO "ABLATION-32967" in packages/lint/dist

lint: the per-package pass recognised by the manifest id again (review M2)

ablation-replace: ok mutation landed: anchor 1 -> 0, blob fe2824efefc1 -> 9246beba24c8
     × the union run of a `manifest: 'preserve'` composition with a residual top-level dataset reads every body, as before (M2) 116ms
⎯⎯⎯⎯⎯⎯⎯ Failed Tests 1 ⎯⎯⎯⎯⎯⎯⎯
      Tests  1 failed | 15 passed (16)
ablation-replace: ok restored: blob == HEAD (fe2824efefc1) and `git diff HEAD` is empty

dogfood M2 cell through the built CLI (lint dist rebuilt with the id match; preflight found the marker; restored and rebuilt, preflight `--absent`)

ablation-replace: ok mutation landed: anchor 1 -> 0, blob fe2824efefc1 -> 8f7044ed9e70
ablation-dist-preflight: @objectstack/lint -- expecting "ABLATION-32967-M2" in packages/lint/dist
✓ dist/: marker present in 4 built files -- the ablation is live in the artifact the suite consumes.
     × M2: a residual top-level dataset leaves the union run unchanged: the module's dashboard on its own dataset exits 0 2704ms
⎯⎯⎯⎯⎯⎯⎯ Failed Tests 1 ⎯⎯⎯⎯⎯⎯⎯
      rule: widget-dataset-unknown  at dashboards[0].widgets[0]
: expected 1 to be +0 // Object.is equality
      Tests  1 failed | 2 passed | 6 skipped (9)
ablation-replace: ok restored: blob == HEAD (fe2824efefc1) and `git diff HEAD` is empty
ablation-dist-preflight: @objectstack/lint -- expecting NO "ABLATION-32967-M2" in packages/lint/dist
✓ dist/: marker absent from all 20 built files -- the artifact the suite consumes no longer carries it. NOT proved by this line: that the marker was ever IN dist/ -- a spelling this build never emits prints the same word

lint: the outside-dependency report arm disabled (review S1)

ablation-replace: ok mutation landed: anchor 1 -> 0, blob fe2824efefc1 -> 37870c5c1c5b
     × REPORTS, not refuses, when the reader declares a dependency the artifact does not carry (S1) 6ms
⎯⎯⎯⎯⎯⎯⎯ Failed Tests 1 ⎯⎯⎯⎯⎯⎯⎯
      Tests  1 failed | 15 passed (16)
ablation-replace: ok restored: blob == HEAD (fe2824efefc1) and `git diff HEAD` is empty

core: environment-only branch disabled

ablation-replace: ok mutation landed: anchor 1 -> 0, blob eb0ae0b19fae -> a33be061f9de
     × [#32967] an environment-only holder: no package to depend on, so the sentence names only the move into the caller 8ms
⎯⎯⎯⎯⎯⎯⎯ Failed Tests 1 ⎯⎯⎯⎯⎯⎯⎯
      Tests  1 failed | 33 passed (34)
ablation-replace: ok restored: blob == HEAD (eb0ae0b19fae) and `git diff HEAD` is empty

cli: picklist cycle arm disabled

ablation-replace: ok mutation landed: anchor 1 -> 0, blob a485eeab42fd -> 872c51602205
     × [#32967] a holder that already depends on the declaring package: the hint names the move, never the cycle 9ms
⎯⎯⎯⎯⎯⎯⎯ Failed Tests 1 ⎯⎯⎯⎯⎯⎯⎯
      Tests  1 failed | 45 passed (46)
ablation-replace: ok restored: blob == HEAD (a485eeab42fd) and `git diff HEAD` is empty

Acceptance notes

• Item 2 of the card, measured: the runtime does NOT refuse an app-package action of type: 'flow' that starts a flow its own module holds (HotCRM's campaign_contact_member_enroll, campaign_lead_member_enroll, quote_generation shape). On a booted build-shaped artifact (app action on the app's object, module flow, module depends on app), POST /api/v1/actions/OBJECT/ACTION answered 200 for both a screen and an autolaunched target, with and without a record; os validate on the same config exits 0. By design: flowServiceForCaller (packages/runtime/src/flow-slot-view.ts) resolves a flow name per caller only when two packages hold it; a one-holder name is the bare read. So authoring and runtime agree here, and no card is filed (the order files one only for a refusal). The asymmetry with datasets (a one-holder dataset outside the closure IS refused) is reported to the seat.
• Not in this PR, carried by lint: os validate / os build refuse a report that reads a dataset its declared dependency holds (chart-dataset-unknown reads stack.datasets alone), while the runtime serves it — report half of #32967 #33128 (the report half of cli: os validate / os build resolve a dataset reader through the reader's declared closure, as the runtime does (authoring half of #32929, 18.4.1) #32967, filed by the seat): chart-dataset-unknown (validate-chart-bindings.ts, which judges a report's and a chart's dataset) indexes stack.datasets alone, so on the per-package pass a report reading a dataset of a package its manifest DECLARES is refused at authoring, while the runtime serves it (?callerPackage=, 200). Measured with runAuthoringRules('validate', …) over a two-package stack: binds dataset "book_metrics", which resolves to no declared dataset. The file is outside the claim's surface; lint: os validate / os build refuse a report that reads a dataset its declared dependency holds (chart-dataset-unknown reads stack.datasets alone), while the runtime serves it — report half of #32967 #33128 carries it.
• A composed stack's residual (top-level) dashboard is judged only by the union run, which has no package provenance, so it keeps reading every body; the per-package pass does not walk the residual.

Verification

Head e29910fcd7 (round 3 after review 6860238813: origin/main merged at 6718884, clean, because #33118 touched validate-widget-bindings.ts; then once more at bf02d33, clean, after the sibling #33124 landed on package-scoped-resolution.ts).

Local, per AGENTS.md §10 (the derived subset; CI runs the farm):

Affected packages on `021038c13e`: build, tests and typecheck (all green)

pnpm exec turbo run build --concurrency=2 --filter='@objectstack/dogfood^...' --filter='@objectstack/cli^...' --filter=@objectstack/cli :: VERDICT command-exit 0
pnpm --filter @objectstack/lint test :: VERDICT command-exit 0
pnpm --filter @objectstack/lint typecheck :: VERDICT command-exit 0
pnpm --filter @objectstack/core test :: VERDICT command-exit 0
pnpm --filter @objectstack/spec exec vitest run --maxWorkers=2 src/migrations scripts/upgrade-guide-docs.test.ts scripts/upgrade-guide-surface-span.test.ts :: VERDICT command-exit 0
pnpm --filter @objectstack/metadata-protocol exec vitest run --maxWorkers=2 src/build-probes-dataset-holders.test.ts src/build-probes-widget-refusal-fix.test.ts :: VERDICT command-exit 0
pnpm --filter @objectstack/cli exec vitest run --project unit --maxWorkers=2 :: VERDICT command-exit 0
pnpm --filter @objectstack/cli exec vitest run test/migrate-meta-engine-guidance.test.ts :: VERDICT command-exit 0
pnpm --filter @objectstack/dogfood exec vitest run --maxWorkers=2 test/dataset-app-reads-module.dogfood.test.ts :: VERDICT command-exit 0
lint 203 files / 8727 tests · core 3371 · spec migrations + upgrade guide 228 · metadata-protocol probes 15 · cli unit 416 / 5934 · cli migrate-meta guidance 3 · dataset-app-reads-module.dogfood 9 / 9

After the second merge, on `e29910fcd7`: the closure rebuilt and the packages the merge touched re-run (all green)

pnpm exec turbo run build --concurrency=2 --filter='@objectstack/dogfood^...' --filter='@objectstack/cli^...' --filter=@objectstack/cli :: VERDICT command-exit 0
pnpm --filter @objectstack/core test :: VERDICT command-exit 0
pnpm --filter @objectstack/core typecheck :: VERDICT command-exit 0
pnpm --filter @objectstack/lint test :: VERDICT command-exit 0
pnpm --filter @objectstack/dogfood exec vitest run --maxWorkers=2 test/dataset-app-reads-module.dogfood.test.ts :: VERDICT command-exit 0
core 3371 · lint 8752 · dataset-app-reads-module.dogfood 9 / 9

Derived gates on `e29910fcd7`: `dispatch-gates --ran` → 98 derived, 98 run, 0 NOT-MEASURED, 0 UNRUN

node scripts/check-adr-0087-registration.mjs --base origin/main :: exit 0
node scripts/check-adr-0087-registration.mjs --self-test :: exit 0
node scripts/check-changeset-no-major.mjs --base origin/main :: exit 0
node scripts/check-closing-keyword-parity.mjs :: exit 0
node scripts/check-closing-keyword-parity.mjs --self-test :: exit 0
node scripts/check-comment-mask-adoption.mjs :: exit 0
node scripts/check-comment-mask-adoption.mjs --self-test :: exit 0
node scripts/check-comment-mask-corpus.mjs :: exit 0
node scripts/check-dev-prereqs.mjs --self-test :: exit 0
node scripts/check-dts-emitted.mjs --self-test :: exit 0
node scripts/check-empty-changeset.mjs --base origin/main :: exit 0
node scripts/check-empty-changeset.mjs --self-test :: exit 0
node scripts/check-issue-citations.mjs :: exit 0
node scripts/check-plugin-teardown-shape.mjs :: exit 0
node scripts/check-plugin-teardown-shape.mjs --self-test :: exit 0
node scripts/ci/assert-turbo-remote-cache.mjs --self-test :: exit 0
node scripts/ci/plan-test-core-shards.mjs --self-test :: exit 0
node scripts/ci/prune-turbo-cache.mjs --self-test :: exit 0
node scripts/ci/snapshot-next.mjs --self-test :: exit 0
node scripts/docs-audit/check-affected-docs.mjs :: exit 0
node scripts/docs-audit/check-drift-comment.mjs :: exit 0
node scripts/pm/release-rehearsal-clone.mjs --self-test :: exit 0
node scripts/release-pending-publish.mjs --self-test :: exit 0
pnpm --filter @objectstack/lint run check:doc-formula-expressions :: exit 0
pnpm --filter @objectstack/spec run check:api-surface :: exit 0
pnpm --filter @objectstack/spec run check:authorable-surface :: exit 0
pnpm --filter @objectstack/spec run check:browser-reachable-entries :: exit 0
pnpm --filter @objectstack/spec run check:docs :: exit 0
pnpm --filter @objectstack/spec run check:dual-source-exports :: exit 0
pnpm --filter @objectstack/spec run check:duration-unit-keys :: exit 0
pnpm --filter @objectstack/spec run check:empty-state :: exit 0
pnpm --filter @objectstack/spec run check:entry-nameability :: exit 0
pnpm --filter @objectstack/spec run check:error-code-provenance :: exit 0
pnpm --filter @objectstack/spec run check:export-origins :: exit 0
pnpm --filter @objectstack/spec run check:exported-any :: exit 0
pnpm --filter @objectstack/spec run check:liveness :: exit 0
pnpm --filter @objectstack/spec run check:llms-txt :: exit 0
pnpm --filter @objectstack/spec run check:skill-refs :: exit 0
pnpm --filter @objectstack/spec run check:spec-changes :: exit 0
pnpm --filter @objectstack/spec run check:strictness-ledger :: exit 0
pnpm --filter @objectstack/spec run check:upgrade-guide :: exit 0
pnpm --filter @objectstack/spec run check:variant-docs :: exit 0
pnpm check:adr-symbol-anchors :: exit 0
pnpm check:changeset-gate-self-tests :: exit 0
pnpm check:ci-filter-parity :: exit 0
pnpm check:cli-command-ids :: exit 0
pnpm check:closed-ceremony-text :: exit 0
pnpm check:cross-package-test-inputs :: exit 0
pnpm check:dispatcher-error-vocabulary :: exit 0
pnpm check:doc-authoring :: exit 0
pnpm check:docs-transcript-drift :: exit 0
pnpm check:driver-memory-census :: exit 0
pnpm check:dts-closure :: exit 0
pnpm check:dual-build-cjs-loads :: exit 0
pnpm check:durability-log-level :: exit 0
pnpm check:engine-double-contract :: exit 0
pnpm check:error-code-casing :: exit 0
pnpm check:error-status-conformance :: exit 0
pnpm check:gitlink-declared :: exit 0
pnpm check:i18n :: exit 0
pnpm check:i18n-coverage :: exit 0
pnpm check:i18n-walk-parity :: exit 0
pnpm check:init-service-contract :: exit 0
pnpm check:issue-citations :: exit 0
pnpm check:kernel-hook-pairs :: exit 0
pnpm check:keyed-text-bounds :: exit 0
pnpm check:lean-entry-closure :: exit 0
pnpm check:logger-receiver-detach :: exit 0
pnpm check:merge-driver :: exit 0
pnpm check:nul-bytes :: exit 0
pnpm check:object-def-param-keys :: exit 0
pnpm check:objectql-double-limit :: exit 0
pnpm check:optional-error-sink :: exit 0
pnpm check:org-identifier :: exit 0
pnpm check:page-declaration-shape :: exit 0
pnpm check:platform-object-tenancy-census :: exit 0
pnpm check:pm-prior-rulings :: exit 0
pnpm check:published-files :: exit 0
pnpm check:query-options-erasure :: exit 0
pnpm check:refd-timer-probe :: exit 0
pnpm check:registry-log-declared :: exit 0
pnpm check:rest-log-spy-declared :: exit 0
pnpm check:role-word :: exit 0
pnpm check:settings-bind-window :: exit 0
pnpm check:slot-lookup :: exit 0
pnpm check:sourcemap-no-sources-content :: exit 0
pnpm check:spec-docblock-symbol-anchors :: exit 0
pnpm check:spec-parsed-alias :: exit 0
pnpm check:startup-registry-verdict :: exit 0
pnpm check:system-context-census :: exit 0
pnpm check:test-source-alias :: exit 0
pnpm check:tier-file-adoption :: exit 0
pnpm check:type-check-coverage :: exit 0
pnpm check:type-check-debt :: exit 0
pnpm check:undeclared-dep-imports :: exit 0
pnpm check:vouch-for-reference-callers :: exit 0
pnpm check:watch-hint-literal :: exit 0
pnpm check:where-matcher :: exit 0

pnpm lint on 021038c13e: exit 0 (the second merge brings only main's files). The full dogfood battery (the (narrowing) arm): green on 71dde93d8b (461 files passed, 3 skipped; 3883 tests passed, 42 skipped; lock VERDICT command-exit 0); the run on e29910fcd7 is in progress and its result goes to the os-dev report on #32967.

Human Minimum

• 1. Schemas start as Zod; packages/spec holds no runtime logic.
• 2. Every name I added uses the casing for its kind.
• 3. No formatter ran; pnpm lint passes (exit 0 on 021038c13e; the later merge adds only main's files).
• 4. One issue, one branch off an up-to-date main, one pull request.
• 5. A change that publishes carries a changeset, and both declaration lines are filled in here and in the changeset.
• 6. packages/spec touched: one ADR-0087 semantic ledger entry file (packages/spec/src/migrations/entries/semantic/18.dashboard-dataset-outside-reader-closure-refused.ts) and nothing else: no schema, no runtime logic; registry.ts is generated and git-ignored; check:spec-changes, check:upgrade-guide and the os migrate meta guidance pin pass.
• 7. No hand edits to content/docs/references/, packages/*/CHANGELOG.md or content/docs/releases/.
• 8. Title, body and comments are in English.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 5 package(s): @objectstack/cli, @objectstack/core, @objectstack/lint, @objectstack/metadata-protocol, @objectstack/spec, touching 17 documentable anchor(s).

3 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/deployment/cli.mdx (via os migrate stored-references (command, read off packages/cli/src/commands/migrate/stored-references/index.ts))
• content/docs/kernel/runtime-services/email-service.mdx (via callerPackageId (symbol, a field of interface ArtifactDatasetResolution))
• content/docs/permissions/system-context.mdx (via os migrate stored-references (command, read off packages/cli/src/commands/migrate/stored-references/index.ts))

⛔ 2 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v16.mdx (via validateWidgetBindings (symbol, a top-level function))
• content/docs/releases/v17/17-1.mdx (via validateWidgetBindings (symbol, a top-level function))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 6 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 65 of 247 client-bound route-ledger rows — the other 182 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 182: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 59 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 123 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 189 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json bf02d33bd64f496aa8166e1a235ef10977927947 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from bf777636dce09b39659ce56e74fb43685fb38be1 — the merge of head e29910fcd7d60f1cab7158c3828ac7402ba29c62 into base bf02d33bd64f496aa8166e1a235ef10977927947, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin bf777636dce09b39659ce56e74fb43685fb38be1 && git checkout bf777636dce09b39659ce56e74fb43685fb38be1
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin bf02d33bd64f496aa8166e1a235ef10977927947 e29910fcd7d60f1cab7158c3828ac7402ba29c62 && git checkout -B drift-repro bf02d33bd64f496aa8166e1a235ef10977927947 && git merge --no-ff e29910fcd7d60f1cab7158c3828ac7402ba29c62

node scripts/docs-audit/affected-docs.mjs --json bf02d33bd64f496aa8166e1a235ef10977927947

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs bf02d33bd64f496aa8166e1a235ef10977927947 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

review#1 · os-tesla · session_01L9qibzosF5fZk98UHos9cv

Contract-review-claim: session_01L9qibzosF5fZk98UHos9cv · head 3eac030 · 2026-11-13T15:39Z

[objectstack-fleet]

review#1 · os-tesla · session_01L9qibzosF5fZk98UHos9cv

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 3eac0305f3b27cac06e06931b5d3546f512f97ee
Local-runs: none
Scope: packages/lint/src/validate-widget-bindings.ts, packages/lint/src/validate-widget-bindings.artifact-datasets.test.ts, packages/core/src/package-scoped-resolution.ts, packages/core/src/package-scoped-resolution.test.ts, packages/cli/src/utils/picklist-references.ts, packages/cli/src/utils/picklist-references.test.ts, packages/cli/src/utils/stored-package-references.ts, packages/cli/src/commands/migrate/stored-references/index.ts, packages/metadata-protocol/src/build-probes.ts, packages/metadata-protocol/src/build-probes-dataset-holders.test.ts, packages/qa/dogfood/test/dataset-app-reads-module.dogfood.test.ts, .changeset/32967-dataset-reader-closure-authoring.md (its declaration lines and level) + read as cited code, not reviewed: packages/lint/src/validate-report-runtime-filter.ts, validate-chart-bindings.ts and validate-report-date-range.ts, packages/cli/src/utils/artifact-packages.ts and stack-collections.ts, packages/metadata-core/src/package-closure.ts, composeStacks in packages/spec/src/stack.zod.ts, scripts/check-changeset-no-major.mjs, scripts/check-adr-0087-registration.mjs, packages/lint/CHANGELOG.md.

First round, read at 2026-11-13T15:50Z. Inputs: card #32967 and its four comments, the PR body, the diff against merge base 9433d4f3 (twelve files, one merge of main), the check-runs on this head, the knock 6857632020. Claim 6857673238.

① Derived judgments

• Clause-②: no (narrowing) is right. os validate, os build and os lint refuse a widget binding they accepted; nothing is widened: the new lint symbols stay off the package entry (packages/lint/src/index.ts is not in the diff) and core gains no export.
• Metadata-protocol: none is not right: the kind is narrowed (M1).
• No runtime answer moves. The core, CLI and probe edits change sentences only: no status, code or details.candidates.

② Semver level

• patch on four packages follows from none. With the kind narrowed, AGENTS.md's Post-Task step 3 asks at least minor on a package the diff moves (@objectstack/lint is the one whose accept set moves), and scripts/check-adr-0087-registration.mjs refuses not-required (no-migration-prescription) outright on a declared narrowing, so the changeset owes a registered upgrade-guide entry (M1).
• The changeset body carries no BREAKING banner, which a (narrowing) arm keeps whatever the kind (the same step: "keeps its BREAKING banner"); the stock narrowing changesets also mark the title !, and this title does not.

③ Boundary flags

• Check-runs on this head, read at 15:42Z: 64 runs, none failed; Test Core and Test UI shards and Type Check · workspace were still running. Not a ground of this verdict.
• Fixes #32967 and Fixes #32929 close the card and its parent. The card's summary names dashboards, reports and joined blocks; the report half is not carried (the PR's own Acceptance notes: chart-dataset-unknown reads stack.datasets alone, so a report reading a DECLARED dependency's dataset is refused at authoring and served at run time). The seat files that before ACCEPT or the PR says Part of.
• No os-dev report on the card at the read; the PR body sends pnpm lint and the full dogfood battery of the (narrowing) arm there, and Human Minimum item 3 is unticked.
• Card item 2 (app actions starting module flows): measured, no refusal, no card; the dataset and flow asymmetry is the seat's to dispose.
• File surface: inside claim 6855987560.
• Release slot: the card says 18.4.1. main already holds a pending minor in the fixed group (.changeset/32978-define-stack-packages-single-app.md), so M1 does not by itself move the level of the next release. The slot is the seat's and the maintainer's.
• main is two commits past the merge base, on paths this diff does not touch. The HotCRM statement is about a sister repository and is not read here.

④ Design judgment

packages/lint/src/validate-widget-bindings.ts. On the per-package pass the walk is the runtime's rule (resolvePackageScopedHolders): the package's own dataset first, then the one holder inside packageResolutionClosure, whatever is held outside it; two inside refuse and nothing is picked; none inside refuses naming every holder. sys bodies are in reach by namespace, and the registry handed to the walk has the shape picklist-references.ts hands it. The wording picks the fix from the artifact (a holder whose own closure reaches the reader is never offered as a dependency), which is what the card asks. Two cases fall outside that (M2, S1) and one neighbour moves unsaid (N1).

packages/core/src/package-scoped-resolution.ts. Sentence branches only: environment-only names the move alone, two or more package holders ask for one dependency, the one-holder sentence is unchanged. Both new branches are pinned.

packages/cli/src/utils/picklist-references.ts, stored-package-references.ts, commands/migrate/stored-references/index.ts, packages/metadata-protocol/src/build-probes.ts. The carried nits of 6841428662, as sentences; the picklist hint's cycle arm reads the artifact and is pinned.

packages/qa/dogfood/test/dataset-app-reads-module.dogfood.test.ts. The card's three cells on real doors. Not run here.

Findings:

• M1 must-fix. The kind is narrowed. AGENTS.md: "a value refused or a requirement tightened is narrowed", and the kind is "the change to what a metadata author can write". After this diff an author can no longer build a package dashboard whose widget names a dataset that only an undeclared package of the artifact holds: os build and os validate exit 1 where they exited 0. That the runtime refused the READ since 18.4.0 does not make it none: no door refused the metadata until this one. Precedent, counted in packages/lint/CHANGELOG.md over the entries that carry a narrowing arm and a kind: 57 narrowed, 1 semantic, 5 none. Of the five, two are runtime doors that take no metadata (769adff, f57eddc), two are doors joining a refusal os build and os validate already made (c133cfe, 7f368f5), and one reads the other way (9127f23, an email template's hole placements, citing ruling A). The 57 include the publish door refusing a widget filter key on a dataset outside the package's closure, and the nearest sibling on main, .changeset/32978-define-stack-packages-single-app.md, is narrowed, minor, registered. Owed: Metadata-protocol: narrowed in the PR body and the changeset, minor on @objectstack/lint at least, an adr-0087: registered ledger entry (the upgrade guide is where an author upgrading a multi-package artifact learns of the refusal before os build makes it), and the BREAKING banner. The card's own dispatch line says none, so the seat corrects it there too. This is derived from the rule text and the weight of precedent; a maintainer ruling that an authoring refusal of this kind is outside the protocol, cited in the PR, would settle it the other way.
• M2 must-fix. The union run is not left as it was for a stack that keeps a top-level datasets. Derived from the code, not run. The per-package pass is recognised by stack.manifest.id naming one of the bodies. The union run of a composeStacks(…, { manifest: 'preserve' }) artifact meets that test too: its manifest is the last input's (selectManifest(…, 'last')), whose body is in packages[]. It stays unchanged only because authoringRuleUnionStack folds every body's datasets onto the top level, and that fold skips a key the top level already carries. So for a packages[] stack with a top-level datasets of its own (the residual ADR-0130 D4 registers under manifest.id) and no top-level dashboards, the folded dashboards of every package are judged as the manifest package's: a module's dashboard on the module's OWN dataset is refused outside-closure, with a sentence saying the installed read answers 409, when the module is outside that package's closure (HotCRM's shape, the module depending on the app). main accepts that stack and the runtime serves the read. The docblock and the pin describe a union whose manifest "is none of its bodies" (com.example.suite), which is not the union the doors hand the rule. Owed: recognise the per-package pass by more than the id (it hands the body itself as manifest), or leave the union run on the every-body read; and a pin on the shape the doors really produce, with a residual dataset.
• S1 should-fix. A dependency the artifact does not carry. picklist-references.ts, the reading this walk says it follows, reports instead of refusing when the declaring package names a dependency outside the artifact, because that package may hold the name (its header, "Declared dependencies outside the stack: reported, never refused"). This walk refuses, and its message states as fact that the installed read answers 409. When the reader declares such a dependency and that package holds the name, the runtime resolves it there and serves it. Take the twin's arm, or say in the message that holders outside the artifact are not read.
• N1 nit. validate-report-runtime-filter.ts reads the same index, so on the per-package pass a report's runtimeFilter on a refused name is no longer judged. No verdict is lost (chart-dataset-unknown already refuses that report there, and the union run still judges the filter), but the FROM/TO table speaks of widgets only.

Implemented-by: session_016WV4czsbPsUx7axSQG2Y9F
Reviewed-by: session_01L9qibzosF5fZk98UHos9cv

VERDICT: FAIL

[objectstack-fleet]

review#1 · os-tesla · session_01L9qibzosF5fZk98UHos9cv

Contract-review-claim: session_01L9qibzosF5fZk98UHos9cv · head 71dde93 · 2026-11-13T17:25Z

Delta of FAIL 6857932402 on the moved head.

[objectstack-fleet]

review#1 · os-tesla · session_01L9qibzosF5fZk98UHos9cv

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 71dde93d8b7b13f4f82375e1a5c9c1f58c6c0233
Local-runs: none
Scope: packages/lint/src/validate-widget-bindings.ts, packages/lint/src/validate-widget-bindings.artifact-datasets.test.ts, packages/qa/dogfood/test/dataset-app-reads-module.dogfood.test.ts, packages/spec/src/migrations/entries/semantic/18.dashboard-dataset-outside-reader-closure-refused.ts, packages/core/src/package-scoped-resolution.ts, packages/core/src/package-scoped-resolution.test.ts, packages/cli/src/utils/picklist-references.ts, packages/cli/src/utils/picklist-references.test.ts, packages/cli/src/utils/stored-package-references.ts, packages/cli/src/commands/migrate/stored-references/index.ts, packages/metadata-protocol/src/build-probes.ts, packages/metadata-protocol/src/build-probes-dataset-holders.test.ts, .changeset/32967-dataset-reader-closure-authoring.md (its declaration lines and level) + read as cited code, not reviewed: packages/cli/src/utils/artifact-packages.ts (artifactPackages, packageBodyAsStack, runPerPackageAuthoringRules), packages/cli/test/migrate-meta-engine-guidance.test.ts, packages/lint/src/validate-widget-bindings.user-text.ts on main, the Check Changeset and Test Core (7/8) job logs of this head.

Delta review of FAIL 6857932402, read at 2026-11-13T17:31Z. Inputs: the interdiff 3eac0305..71dde93d (three commits, five files, no merge of main), the PR title and body as they stand, the check-runs on this head. Claim 6860126441. No knock asked for this round: the owed list showed the head moved under the record. Everything the earlier record judged and the interdiff does not touch stands as read there: the eight core, cli and metadata-protocol files of the Scope line are unchanged since 3eac0305.

① Derived judgments

• The changeset now declares what M1 asked: Clause-②: no (narrowing), Metadata-protocol: narrowed, the BREAKING banner, a ! title, and adr-0087: registered dashboard-dataset-outside-reader-closure-refused.
• The PR does not yet. Its title has no !, and its body still reads Metadata-protocol: none (M1, open on the PR).
• The S1 arm adds one answer to the declaration: a reader that declares a dependency the artifact does not carry gets widget-dataset-unknown as a warning, exit 0, for a name held only outside its closure. The changeset says so under "Now", and the ledger entry's replacement says so.
• No runtime answer moves, as before.

② Semver level

• minor on @objectstack/lint follows from narrowed. patch on @objectstack/spec for the ledger entry and on the three sentence-only packages is right.
• Check Changeset is red on this head. Its log ends on the rule that a minor entry is accounted for by the kind line of the PR body, re-read on the next body edit; the body's line is still none.

③ Boundary flags

• Check-runs on this head, all concluded: 67 runs, 53 success, 11 skipped, 3 failed: Check Changeset, Test Core (7/8) and the Test Core roll-up. Both causes are read from the job logs and named in the findings.
• main is five commits past the merge base, and one of them is on a path of this diff: 5c005e0e gives the advisories of validate-widget-bindings.ts a user sentence per rule id. A git merge-tree of main and this head reports no textual conflict. The S1 warning is a new advisory of that file with no sentence; main gives one only to the ids the publish door can return, and whether that door can return this one is not derived here. The merge is owed before the queue, and the question goes with it.
• The PR body still describes 3eac0305: "How the authoring rule decides" names the id test M2 replaced, the Verification section and the pin counts are that head's, and Human Minimum 6 says packages/spec is not touched. The seat's at ACCEPT.
• Fixes #32929 and the report half (chart-dataset-unknown), card item 2, and the os-dev report on the card: as flagged in the earlier record, unchanged.
• HotCRM, read on its checkout at 4f0ffd8: each module declares the app and nothing else, and the app declares no dependency, so the S1 arm softens nothing there.
• The dogfood cells and the ablations are the report's; none was run here.

④ Design judgment

packages/lint/src/validate-widget-bindings.ts (M2). Fixed. The per-package pass is recognised by the body itself: stack.manifest must be the very object one packages[] entry carries, which is what packageBodyAsStack hands ({ ...body, manifest: body, packages }, with body taken from the same packages array at all three call sites). The union run of a manifest: 'preserve' composition carries the last input's manifest, a different object, so it is back on the every-body read whatever its top level holds. Pinned on the shape the doors produce: a real composeStacks result with a residual top-level dataset in the unit file, and os validate on a config that adds one in the dogfood file. The unit pin goes red on 3eac0305 by the code (the module's dashboard would be judged as the app's).

packages/lint/src/validate-widget-bindings.ts (S1). Fixed, by the twin's arm. A name held only outside the closure is reported, not refused, while the reader declares a dependency the artifact does not carry; the sentence says the name is not judged and makes no claim about the installed read. Two holders inside the closure stay refused, which is right: an outside package can add a holder, never remove one. Pinned in both files, with the suppression.

.changeset/32967-dataset-reader-closure-authoring.md (N1). The report runtimeFilter sentence is added.

packages/spec/src/migrations/entries/semantic/18.dashboard-dataset-outside-reader-closure-refused.ts. The five fields are there and say what the changeset says; the remedy names the three fixes and the reported case. Its reason cites a tracker number, which the guide's own pin refuses (M3).

Findings:

• M1 must-fix, open on the PR. The changeset is right. The PR title still reads fix(lint): with no !, and the PR body still reads Metadata-protocol: none. Check Changeset is red on it. Owed: the ! in the title and Metadata-protocol: narrowed in the body (a body edit re-runs the check; no push is needed for this one).
• M3 must-fix. The ledger entry prints a tracker id. Test Core (7/8) is red on packages/cli/test/migrate-meta-engine-guidance.test.ts: "dashboard-dataset-outside-reader-closure-refused: the printed guidance cites a tracker id: expected 'spec+cli: an artifact's per-package checks refuse an action → flow and a widget → dataset reference that another package of the SAME artifact satisfies (the #18202 family, for flows and datasets) #25514' to be undefined". The entry's reason carries (#25514). Owed: say it without the number.
• n1 nit. The CONTROL of the unit M2 pin hands the app's body as the per-package stack and expects no finding, but that body has no dashboard, so it cannot fail. The refusal on the per-package pass is pinned elsewhere in the file; either drop the CONTROL or give it the app-reads-module dashboard and expect the refusal.
• n2 nit, not this diff's move. With the S1 arm, a name another body holds outside the closure is reported when the reader declares an outside dependency, while a name no body holds stays an error for the same reader, though the same outside package could hold it. The second answer is main's and the changeset lists it as unchanged. The seat may route it or leave it.

M2, S1 and N1 of record 6857932402 are closed on this head. M1 and M3 are the ground of this verdict. The delta on the next head, or on this head once the title and body are edited, is this seat's.

Implemented-by: session_016WV4czsbPsUx7axSQG2Y9F
Reviewed-by: session_01L9qibzosF5fZk98UHos9cv

VERDICT: FAIL

[objectstack-fleet]

review#1 · os-tesla · session_01L9qibzosF5fZk98UHos9cv

Contract-review-claim: session_01L9qibzosF5fZk98UHos9cv · head 021038c · 2026-11-13T18:26Z

Delta of FAIL 6860238813 on the moved head.

[objectstack-fleet]

review#1 · os-tesla · session_01L9qibzosF5fZk98UHos9cv

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 021038c13ebeba8d2003d44926963be2143226ca
Local-runs: none
Scope: packages/lint/src/validate-widget-bindings.ts, packages/lint/src/validate-widget-bindings.artifact-datasets.test.ts, packages/spec/src/migrations/entries/semantic/18.dashboard-dataset-outside-reader-closure-refused.ts, packages/qa/dogfood/test/dataset-app-reads-module.dogfood.test.ts, packages/core/src/package-scoped-resolution.ts, packages/core/src/package-scoped-resolution.test.ts, packages/cli/src/utils/picklist-references.ts, packages/cli/src/utils/picklist-references.test.ts, packages/cli/src/utils/stored-package-references.ts, packages/cli/src/commands/migrate/stored-references/index.ts, packages/metadata-protocol/src/build-probes.ts, packages/metadata-protocol/src/build-probes-dataset-holders.test.ts, .changeset/32967-dataset-reader-closure-authoring.md (its declaration lines and level) + read as cited code, not reviewed: packages/lint/src/runtime-gate.ts (buildRuntimeWriteSnapshots), packages/lint/src/validate-widget-bindings.user-text.ts, packages/lint/CHANGELOG.md (the 18.2.0 entry), the change main made to packages/core/src/package-scoped-resolution.ts after this head's merge.

Delta review of FAIL 6860238813, read at 2026-11-13T18:27Z. Inputs: the interdiff 71dde93d..021038c1 (three commits of this branch on three files, and one merge of main at 67188849 with no conflict), the PR title and body as they stand, the check-runs on this head. Claim 6861495793. No knock asked for this round: the owed list showed the head moved under the record. Everything the two earlier records judged and the interdiff does not touch stands as read there.

① Derived judgments

• The changeset's declaration stands as judged: Clause-②: no (narrowing), Metadata-protocol: narrowed, the BREAKING banner, the ! title, adr-0087: registered.
• The PR still does not carry it: the title reads fix(lint): with no !, and the body reads Metadata-protocol: none (M1).
• The interdiff moves no answer: one word of a ledger sentence, one comment, and tests.

② Semver level

• Unchanged and right: minor on @objectstack/lint, patch on the rest.
• Check Changeset is still red, on the body's kind line. It last ran at 17:37Z, so the body has not been edited since this head was pushed.

③ Boundary flags

• Check-runs on this head, all concluded: 67 runs, 55 success, 11 skipped, 1 failed: Check Changeset (M1). The eight Test Core shards are green, Test Core (7/8) among them.
• main is seven commits past this head's merge of it. One is on a path of this diff: c747cf05 adds tool to a type list in packages/core/src/package-scoped-resolution.ts, away from the sentence branches this PR edits. A git merge-tree of main and this head reports no conflict. One more merge is owed before the queue.
• The PR body still describes 3eac0305 ("How the authoring rule decides", the Verification section, Human Minimum 6). Fixes #32929 and the report half, card item 2, and the os-dev report on the card: as flagged in the two earlier records. The seat's at ACCEPT.
• The local runs and ablations are the report's; none was run here.

④ Design judgment

packages/spec/src/migrations/entries/semantic/18.dashboard-dataset-outside-reader-closure-refused.ts (M3). Fixed. The reason names the release, "since 18.2.0", where it printed a tracker number. The release is the one packages/lint/CHANGELOG.md carries the every-package read under, and the changeset says the same.

packages/lint/src/validate-widget-bindings.artifact-datasets.test.ts (n1). Fixed. The CONTROL now hands the app's body with the module-reading dashboard as the per-package stack, in the shape packageBodyAsStack builds, and expects the one refusal with the cycle hint. It can fail.

packages/lint/src/validate-widget-bindings.ts and the new door pin (the question left with the merge in 6860238813). Answered. The S1 report needs the per-package pass, which is recognised by stack.manifest being a packages[] entry. The publish door's write snapshot carries neither key (runtime-gate.ts builds it from the item and the live context), so the arm cannot run there and owes no user sentence. The pin reads both facts on the door's own functions.

The merge of main took 5c005e0e into validate-widget-bindings.ts without touching this PR's arms.

Findings:

• M1 must-fix, open on the PR, the only one left. The title has no ! and the body reads Metadata-protocol: none; Check Changeset is red on it. Owed: fix(lint)!: in the title and Metadata-protocol: narrowed in the body. A body edit re-runs the check; no push is needed.

M3 and n1 of record 6860238813 are closed on this head; n2 stands as written there, the seat's to route or leave. Once the title and body are edited and Check Changeset is green on this head, the PASS is this seat's without a new push.

Implemented-by: session_016WV4czsbPsUx7axSQG2Y9F
Reviewed-by: session_01L9qibzosF5fZk98UHos9cv

VERDICT: FAIL

[objectstack-fleet]

review#1 · os-tesla · session_01L9qibzosF5fZk98UHos9cv

Contract-review-claim: session_01L9qibzosF5fZk98UHos9cv · head e29910f · 2026-11-13T18:33Z

Delta of FAIL 6861525866 on the moved head (the merge of main), with the edited title and body.

[objectstack-fleet]

review#1 · os-tesla · session_01L9qibzosF5fZk98UHos9cv

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: e29910fcd7d60f1cab7158c3828ac7402ba29c62
Local-runs: none
Scope: packages/lint/src/validate-widget-bindings.ts, packages/lint/src/validate-widget-bindings.artifact-datasets.test.ts, packages/spec/src/migrations/entries/semantic/18.dashboard-dataset-outside-reader-closure-refused.ts, packages/qa/dogfood/test/dataset-app-reads-module.dogfood.test.ts, packages/core/src/package-scoped-resolution.ts, packages/core/src/package-scoped-resolution.test.ts, packages/cli/src/utils/picklist-references.ts, packages/cli/src/utils/picklist-references.test.ts, packages/cli/src/utils/stored-package-references.ts, packages/cli/src/commands/migrate/stored-references/index.ts, packages/metadata-protocol/src/build-probes.ts, packages/metadata-protocol/src/build-probes-dataset-holders.test.ts, .changeset/32967-dataset-reader-closure-authoring.md (its declaration lines and level) + read as cited code, not reviewed: the lines main brought into packages/core/src/package-scoped-resolution.ts; otherwise nothing beyond what record 6861525866 lists.

Delta review of FAIL 6861525866, read at 2026-11-13T19:05Z. The seat edited the PR title and body at 18:27Z, while that record was being written from a read taken at 18:26Z; its M1 was already answered when it was posted, and this record supersedes it. Inputs: the interdiff 021038c1..e29910fc (one merge of main at bf02d33b, no conflict, no commit of this branch), the PR title and body as they stand, the check-runs on this head, the knock 6861546781. Claim 6861663304. In the thirteen files of this diff the merge moves seven lines, all main's: tool joins a type list in packages/core/src/package-scoped-resolution.ts, away from the sentence branches this PR edits. Everything records 6857932402, 6860238813 and 6861525866 judged in the diff stands as read there.

① Derived judgments

• The PR now declares what the changeset declares: the title reads fix(lint)!:, the body reads Clause-②: no (narrowing) and Metadata-protocol: narrowed, with a BREAKING line naming the three authoring doors and the registered upgrade-guide entry.
• Skills-docs: none, with its reason (skills/** teaches neither cross-package dataset resolution nor this rule id), is the line a narrowed kind owes.
• The body's FROM and TO table now carries the outside-dependency warning, the report runtimeFilter row and the union run of a preserve composition, as the code has them.

② Semver level

• minor on @objectstack/lint, patch on @objectstack/spec and the three sentence-only packages, adr-0087: registered: right, as judged.
• Check Changeset re-ran on the edited body and is green.

③ Boundary flags

• Check-runs on this head, all concluded: 67 runs, 56 success, 11 skipped, none failed. The eight Test Core shards, the type checks and Check Changeset are green.
• The merge the earlier record asked for is in this head: main at bf02d33b, its tip at the read.
• The body's Verification section is written for 021038c1, and says the full dogfood battery on it was still running; its line goes to the os-dev report on cli: os validate / os build resolve a dataset reader through the reader's declared closure, as the runtime does (authoring half of #32929, 18.4.1) #32967. The run on 71dde93d is reported green. Not read here.
• The report half of the card is carried by lint: os validate / os build refuse a report that reads a dataset its declared dependency holds (chart-dataset-unknown reads stack.datasets alone), while the runtime serves it — report half of #32967 #33128, filed by the seat, so Fixes #32929 closes the parent with that half on its own card. The seat's.
• Card item 2 (app actions starting module flows): measured, no refusal, no card, as flagged before.
• The local runs and ablations are the report's; none was run here.

④ Design judgment

Nothing new to judge. The findings of the three earlier records are closed on this head: M1 (kind, level, banner, ledger entry, and now the title and body), M2 (the per-package pass recognised by the body itself), M3 (no tracker id in the printed guidance), S1 (the outside-dependency report), N1 and n1.

Findings:

• n2 nit, carried from 6860238813, not this diff's move. A name no body of the artifact holds stays an error for a reader that declares an outside dependency, while a name another body holds outside the closure is reported for the same reader. The first answer is main's. The seat may route it or leave it.

No must-fix.

Implemented-by: session_016WV4czsbPsUx7axSQG2Y9F
Reviewed-by: session_01L9qibzosF5fZk98UHos9cv

VERDICT: PASS

[objectstack-fleet]

epic:#31527#2 · os-elon-musk · session_016WV4czFhtRVZNBeHdQA6PW

ACCEPT · 2026-11-13T19:37Z · head e29910fcd7d60f1cab7158c3828ac7402ba29c62

Verdict: ACCEPT: Fixes #32967 and Fixes #32929 (PR 2 of #32929; ruling option 二). Not governed, 13 files, +825 / −63 (check-governed-merges --pr 33121). This seat lands it, on the maintainer's order 「32929 你接手」 and the standing order that seats review and land with pm-dispatch.

席位核对

1. Shape: draft PR to main, title fix(lint)!:, body Clause-②: no (narrowing) / Metadata-protocol: narrowed with the BREAKING line and adr-0087: registered dashboard-dataset-outside-reader-closure-refused; minor on @objectstack/lint, patch on the rest. Files inside the re-posted claim 6855987560 (its kind line corrected per review M1).
2. Reviews: review#1 FAIL 6857932402 (M1 kind narrowed, M2 per-package pass detection, S1 outside dependency, N1), delta FAIL 6860238813 (M3 tracker id in the ledger guidance), delta FAIL 6861525866 (crossed with the seat's title/body edit), delta PASS 6862333094 on this head: every finding closed; n2 (a name no body holds stays an error for a reader with an outside dependency) is main's answer and is left.
3. Since the PASS: no push; the seat applied body r3 (Verification for this head). The full dogfood battery on this head is green: 461 files passed, 3 skipped; 3895 tests; lock VERDICT 0 (os-dev report 6862971969). dispatch-gates 98/98, 0 NOT-MEASURED; lint 0.
4. Gates on this head: every check-run success or skipped, none failed or pending; Check Changeset green after the body edit. main merged twice (once before the PR, once after sibling feat(objectql, core, metadata)!: tool names held per namespace, and the metadata service keeps each package's tool in its own (package, name) slot (ADR-0150 child B) #33124 landed on package-scoped-resolution.ts); K = 2, mergeable_state: clean.
5. Carried, each to an open card: the report half (chart-dataset-unknown reads stack.datasets alone) → lint: os validate / os build refuse a report that reads a dataset its declared dependency holds (chart-dataset-unknown reads stack.datasets alone), while the runtime serves it — report half of #32967 #33128, so Fixes #32929 closes the parent with that half on its own card (triage 6857990387). Card item 2 (an app action starting a module flow): measured, no refusal on either side, no card.
6. Landing: pr_ready, then auto-merge through the merge queue. The seat follows the PR to MERGED and verifies that cli: os validate / os build resolve a dataset reader through the reader's declared closure, as the runtime does (authoring half of #32929, 18.4.1) #32967 and An app package's dashboard tile on a sibling module's dataset answers 409 on main; os validate accepts it (HotCRM CRM Overview regresses against 18.3.0) #32929 both close.