fix(lint)!: os build and the object_extension publish door judge each validation rule an object extension adds by the object's own rule pass - #33205

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/lint, @objectstack/spec, touching 5 documentable anchor(s).

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/deployment/validating-metadata.mdx (via AUTHORING_RULES (symbol, a top-level const object))

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin d6c1cf20d4112e29732a134f1516f35025bf7d15 && git checkout d6c1cf20d4112e29732a134f1516f35025bf7d15
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 6e1ab9b286655c5476312ae563ab531f3f36cf38 9d07ffa069baf93055b4da43e19fccbf9237159c && git checkout -B drift-repro 6e1ab9b286655c5476312ae563ab531f3f36cf38 && git merge --no-ff 9d07ffa069baf93055b4da43e19fccbf9237159c

node scripts/docs-audit/affected-docs.mjs --json 6e1ab9b286655c5476312ae563ab531f3f36cf38

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 6e1ab9b286655c5476312ae563ab531f3f36cf38 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

domain:spec#2 · os-tesla · session_01L9qibvfX5bawZKtfa6u7j9

Contract-review-claim: session_01L9qibvfX5bawZKtfa6u7j9 · head 15d0747 · 2026-11-14T03:07Z

Face: schema + narrowing (CONTRACT_REVIEW_TIER); the seat runs it through an isolated subagent.

Generated by Claude Code

domain:spec#2 · os-tesla · session_01L9qibvfX5bawZKtfa6u7j9

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 15d074782c704e5b016436ec2ac8102d5d18411c
Local-runs: none
Scope: packages/spec/src/migrations/entries/semantic/18.object-extension-validation-rule-expression-judged.ts + packages/lint/src/validate-expressions.ts, packages/lint/src/authoring-rules.ts, packages/lint/src/runtime-gate.object-formula-writes.test.ts, packages/lint/src/authored-site-expression.test.ts, packages/runtime/src/domains/meta-object-extension-item.test.ts, packages/runtime/src/domains/packages-disable-module-extension-fields.test.ts

PR #33205 for card #33154, on the schema face (the semantic entry) and the declared narrowing. Read: the card body and its five comments (6865785642, 6868572380, 6868654518, 6869487624, 6870691534), the PR body and its nine-path file list, the net diff against main, and the head's check-runs at 2026-11-14T03:27Z: 68 runs, 58 success, 10 skipped, none failed or pending, the last completed 2026-11-14T03:05Z. Every statement about behaviour below is read from the tree at the head. Nothing was built or run.

One must-fix (F1), one should-fix (F2), three nits (N1 to N3).

① Derived judgments

1. os build, os validate and os lint refuse a stack whose objectExtensions[].validations[] rule fails the rule pass. Right, and a narrowing. The rule's registry entry is commands: ALL (authoring-rules.ts:648), so os lint is a third CLI door. The changeset and the entry name the first two only.
2. The runtime object_extension publish door refuses the same rule with 422 INVALID_METADATA, issue expression-invalid. Right as declared, except that the door also refuses one shape the declaration does not cover (F1).
3. The newly refused shapes. An unknown field, a bare reference, an unregistered function, an unguarded nullable ordering or arithmetic operand, a parent root, a type mismatch, and the hop shapes a declared rule is refused for. Each is a verdict the object's own rules already get. The changeset spells four of them and covers the rest by "the same rule on the object". Right. One refused shape is not named, and is wrong: F1. One declared judgment is not delivered: F2.
4. No exported type or signature moves in @objectstack/lint. Right. judgeValidationRule is a closure inside runStackExpressionPasses, and StackExpressionOptions changes in its docblock only.
5. @objectstack/spec gains one semantic entry in the protocol 18 step, so os migrate meta prints one more block. Right, additive.
6. A new locator. object 'T' · ENTRY · validation 'N' (nested: validation rule 'N' then → 'M'), key path ENTRY.validations[k].SLOT, under the object's own rule id. Right.
7. The object walk is unchanged. Right. Compared line by line, the hoisted body differs from the inline one on main in three places, each object '${objectName}' becoming ${locus}, and the object call site passes locus as that same string.
8. Not gated, as before: a module package registered at boot, and the package-wide draft publish limit the options docblock already states. As declared.

② Semver level

The changeset moves @objectstack/lint and @objectstack/spec at minor. Both are released packages the diff moves (lint source, one spec migration entry), and the kind narrowed takes at least minor, so the level is right. packages/runtime changes in tests only and publishes nothing, so it owes no entry.

The Clause-②: no (narrowing) line and Metadata-protocol: narrowed stand line-initial on the PR body and on the changeset body. The changeset carries the BREAKING banner, the fix, and exactly one ADR-0087 marker, registered object-extension-validation-rule-expression-judged, which is the entry's id. Check Changeset and Lint · CI, release & engine gates are green on the head. The arm is the right arm. The bound it states, "a condition or when the same rule on the object itself is refused for", is exceeded at the door (F1).

③ Boundary flags

• Dev report open_questions: empty.
• Dev report deviations: the attribution line links the card thread, and the ablation's mutate leg needed --source-marker. Neither touches the contract. Accepted.
• Dev report out-of-scope finding (a format rule's regex and a json_schema rule's formats in an extension's validations are judged at neither door): confirmed by reading. Both rules walk obj.validations only (validate-rule-compilability.ts:429). It is a trap of this card's own class, so a card is owed. Escalated to seat 2, the carrier the report names. The changeset's Unchanged line states it.
• The claim's provisional Metadata-protocol: narrowed: stands.
• Amendment 6868654518 (comment only in authoring-rules.ts): held. Seven comment lines; runtimeTypes and the adapter are untouched.
• Amendment 6869487624 (the repaired fixture; the banner and the entry must name the null-guard refusal and its fix): held. Both name it, with the guard.
• File surface: the nine paths are the claimed surface plus the two amendments. No breach.
• New from this review, escalated to seat 2: F2 needs a follow-up card. The flow and hook passes read the same nullable index at their own doors (validate-expressions.ts:3045, :4255). That is outside this diff and not measured; if F1's measurement confirms the served form there, it is a card too.

④ Design judgment

What was tried against the design, and held:

• A rule reading a field another extension adds. It resolves at the build through fieldIndex over objectsAsServed, and at the door through the live target. packages-disable-module-extension-fields.test.ts is a real-door instance: the tenant pair's rule reads qx_credit, which the module's extension adds.
• A republish judged without the package's stored self. objectExtensionWriteFold takes the written package's extension off the target, and the republish case pins it: dropping bonus__c while the rule still reads it is refused.
• The one-pass rule. The object walk and the flow walk read an empty list on an extension write, and the function returns at validate-expressions.ts:4136. Pinned by the case where the target's own broken rule is not charged to the extension write.
• Rule id and locator. expression-invalid, located at the entry, pinned at both doors.
• Tracker ids in printed guidance. None (see the entry below).

packages/spec/src/migrations/entries/semantic/18.object-extension-validation-rule-expression-judged.ts (hits)

• The four printed fields, surface, replacement, reason and acceptanceCriteria, hold no # followed by digits. The one id sits in the leading comment, which is not printed. That is the line packages/cli/test/migrate-meta-engine-guidance.test.ts holds every entry to.
• No D2 conversion and no relevantWhen: both right. The repair is a fact only the author holds, and the surface also lives in stored object_extension rows a stack does not show.
• Its premise holds against the registry: mergeValidationsByName (packages/objectql/src/registry.ts:1160) merges an extension's rules onto the target by name.
• It does not hold against the door for one input: its replacement (lines 23 to 28) and acceptanceCriteria (lines 38 to 41) are false there. See F1.
• N3 below.

packages/lint/src/validate-expressions.ts (implementing)

The hoist is faithful (① item 7). The extension loop passes the target, the entry locator and the rule's key path, and the return after the walk is intact. Two findings on the contract, two nits.

F1, must-fix. At the real object_extension door the null-guard gate reads the registry's injected system columns as nullable declared fields, so the door refuses a rule that os build and the object's own rule pass accept.

• Mechanism. The door hands the walk its live objects: registry.listItems('object') folded with the stored rows (packages/metadata-protocol/src/protocol-authoring-gate.ts:437-474). A registered base layer carries its injected columns in fields, because applySystemFields runs before contributor storage (packages/objectql/src/registry.ts:5890-5895). Each is defined required: false with no defaultValue (packages/spec/src/data/injected-system-column-provenance.ts:61-97). Nothing between the registry and the walk strips them. nullableIndex is built from those objects (validate-expressions.ts:2379, isNullableField at :493), and the new loop sends each extension rule through checkNullGuards for the target (:3641, :4126).
• Effect. An extension rule with an unguarded ordering or arithmetic operand over record.created_at or record.updated_at (or any other injected column) is refused 422 at the door.
  • os build accepts the same entry, because the declared target carries no injected column. The index's own docblock (:508) says it holds declared fields only, so that a record.created_at comparison does not become an error.
  • The object save door accepts the same rule declared on the object, because its subject is the body stripped at protocol-save.ts:582.
• The tree already states this. packages/lint/src/authored-site-expression.ts:105-111 strips the injected columns off registry-served definitions before this same pass, and says why: unstripped, the null-guard gate would judge created_at as a declared nullable field. The extension door does not strip. One consequence is that the MCP validate_expression tool answers clean for a rule the extension publish then refuses.
• Why it is a contract fault. On an update the stored row always holds created_at (the index's docblock: the driver always populates it), so for a rule that runs on update the refusal is false. Whether the column is already bound when an insert rule runs was not traced; if it is not, the door is right there and the build under-covers. Either way the door and the build disagree, and three shipped sentences are false for this input:
  • the entry's replacement ("A rule the expression rule accepts on a declared rule of the same object") and its acceptanceCriteria (a clean os build, then a 200);
  • the declared bound on the changeset and the PR body;
  • the docs sentence "at the door and in os build alike".
• Why the pins do not see it. The lint PARITY case gives the door an authored-shaped target, and the three real-door cases read name, nmae and a field the extension adds. The type index (:2378) has the same served-form difference, there in the truthful direction.
• Basis. Read, not run. One real-door case settles it: an extension rule with an unguarded ordering operand over record.created_at, published through saveMetaItem and publishMetaItem, beside os build of the same entry.
• Remedy, the dev's choice. Either judge the door's objects as authored on an extension write (the strip judgeAuthoredSiteExpression uses), so the door gives the build's verdict; or keep the door's verdict and name it in the entry, the changeset and the docs sentence. Either way, pin it at the real door.

F2, should-fix. A one-hop read through a reference field an extension adds has its leaf unjudged, so the card's trap stays open in that corner.

• refuseUndeclaredHopField (:2447, the loop at :2458) and storedMetadataBodyReferencesFor (:2386) read the reference field's definition off the declared objects, not off the served fold.
• So an extension that adds a lookup, and a rule that reads a misspelt column through it and is otherwise well formed, is accepted at the build. At the door it is accepted when the lookup is the written entry's own. By the helper's own docblock, such a rule then "has no verdict and refuses every write it judges".
• The helper predates this PR and a formula has the same gap. But the new comment at :4111-4114 and the changeset say the rule is judged "against the target as served, through the same indexes", which is wider than what is enforced. A lookup and a rule in one extension is the natural shape on this surface.
• Remedy without moving a reviewed file: add this to the changeset's Unchanged line, and file a follow-up card. No case pins it today.

N1, nit. The key path's index is a counter over recordsOf(ext.validations) (:4123-4129, object-graph.ts:451). On input ObjectExtensionSchema refuses, the path is wrong: a non-record member ahead of the rule shifts the index, and a map-form validations gets an index where the object walk spells no path. This is reachable only on an unparsed stack (os lint). The locator and the verdict are unaffected. Accepted deviation or a follow-up.

N2, nit. The comment at :4116-4118 says the door re-spells the path item-relative (validations.0.condition). The door's 422 keeps objectExtensions[0].validations[0].condition, as this PR's own real-door case pins. The item-relative spelling is itemRelativeIssuePath's, where a draft read reports the publish verdict. The hoisted docblock at :3576-3580 says it correctly.

N3, nit, in the hits file. Two loose sentences in the entry's reason:

• It locates the finding at objectExtensions[0] for the build and the door alike. The build locates at the entry's own index, under packages[J].manifest. in an artifact, as the lint sibling case pins. acceptanceCriteria already spells [N].
• "a rule reading a nullable field with no guard aborted" is wider than the gate, which judges ordering and arithmetic operands only. An equality read is accepted: record.region__c == null is this PR's own repaired fixture.

Fix both with F1's edit to the entry, or leave them as accepted deviations.

packages/lint/src/authoring-rules.ts (implementing)

Comment only, as amended. Its measured sentence holds on reading: examples/app-showcase ships one entry with three plain fields, plugin-auth one entry with fields only, and neither carries a rule.

The four test files (implementing)

• runtime-gate.object-formula-writes.test.ts: the eight cases assert what the PR body says. Two blind spots: no door case over a registry-shaped target (F1), and no hop through a reference the extension adds (F2).
• authored-site-expression.test.ts: the regions follow the hoist. indexOf and isArray stay in the object loop, outside the rule pass, so they rightly leave the table.
• meta-object-extension-item.test.ts: three real-door cases, and the bare region__c fixture repaired to record.region__c.
• packages-disable-module-extension-fields.test.ts: the tenant rule guarded, as the amendment says.

Outside the diff, read only: the object_extension row comment in packages/lint/src/runtime-gate.ts:293-296 still describes the crossing as the extension walk over the written entry's fields. A follow-up.

Implemented-by: claude/project-thread-mn9za6
Reviewed-by: session_01L9qibvfX5bawZKtfa6u7j9

VERDICT: FAIL

Generated by Claude Code

domain:spec#2 · os-tesla · session_01L9qibvfX5bawZKtfa6u7j9

Contract-review-hold: session_01L9qibvfX5bawZKtfa6u7j9 · head 9d07ffa · the maintainer paused lane seats' own contract reviews; reviews go to the new review agent · until a review agent is seated and takes this head

Handover · PR #33205 (card #33154) · 2026-11-14T04:39Z

The seat signs off by the maintainer's instruction. The PR stays a draft and is not accepted. Nothing is armed.

• Review state: record 6870963898 FAILED head 15d07478 with one must-fix (F1), one should-fix (F2) and three nits (N1 to N3). The claim on 15d07478 lapses with the head. The delta review of 15d07478..9d07ffa0 was started and then stopped under the pause. It produced no record, so a delta review of 6870963898 is owed on 9d07ffa0. The face is schema + narrowing at CONTRACT_REVIEW_TIER.
• What r1 says it did (the implementer's account, not a verdict):
  • F1 was measured real: the door returned 422 on an unguarded record.created_at ordering read while build returned []. The fix reads the door's objects through stripInjectedSystemColumns, as authored-site-expression.ts does. It adds PARITY pins in lint and on the real door; ablating the strip turns lint 1/9 and runtime 1/4 red.
  • F2 was measured real and fixed on the prose faces only.
  • N2 and N3 are fixed. N1 stays as an accepted deviation.
  • The PR body was patched to r2 by the seat; the read-back is identical.
• Check-runs on 9d07ffa0 at hand-over: 56 success, 12 skipped, 2 in progress, and Test Core (2/8) + the Test Core aggregate failed. The failures are 4 tests in packages/spec/scripts/build-schemas-check-mode.{deletion-proofs,git-topology}.test.ts, each Hook timed out in 10000ms in a beforeEach (:224). No file in this diff is in those tests' path. One re-run is owed before reading it as this PR's; the seat did not re-run it.
• Follow-up cards filed from the review: A one-hop read through a lookup an object extension adds is accepted with a misspelt target field, then refuses every save #33216 (F2: a one-hop leaf through an extension-added lookup is unjudged) and An object extension's format and json_schema validation rules skip the regex and JSON-schema checks the object's own rules get #33217 (an extension's format / json_schema rules skip the regex and schema checks). One more is not filed because it is unmeasured: the flow and hook passes may read the same unstripped nullable index at their own doors (validate-expressions.ts:3045, :4255, per 6870963898). The next reviewer measures it or files it.
• Landing after a PASS: the lane seat's ACCEPT (the changeset and mdx prose at TIER_DEFAULT), then label-write --land. Not governed: 504 lines at 15d07478.

Generated by Claude Code

domain:spec#2 · os-tesla · session_01L9qibyToDkPxCjvNiWsv6e

Contract-review-claim: session_01L9qibyToDkPxCjvNiWsv6e · head 9d07ffa · 2026-11-14T14:19Z

Face: schema + narrowing (CONTRACT_REVIEW_TIER). The hold 6871853372 is lifted: the maintainer restored seats' own contract reviews ("你现在可以自己契约复审了", project chat, 2026-11-14 14:17Z). This session implemented the PR, so the review runs in an isolated subagent at CONTRACT_REVIEW_TIER that is fed the diff and record 6870963898, not the implementer's conclusions.

Generated by Claude Code

domain:spec#2 · os-tesla · session_01L9qibyToDkPxCjvNiWsv6e

Re-run, once: Test Core (2/8) on head 9d07ffa069baf93055b4da43e19fccbf9237159c (run 43554881417, job 132325981683) failed in 4 tests of packages/spec/scripts/build-schemas-check-mode.deletion-proofs.test.ts and build-schemas-check-mode.git-topology.test.ts. Each failure is Hook timed out in 10000ms in a beforeEach, with no assertion failing. The failures measured nothing. Neither file reads a path this PR changes: the diff touches packages/lint/src, the runtime door tests, one semantic migration entry, a changeset and one mdx page, and these tests build throwaway git repositories under packages/spec/scripts. The @objectstack/spec unit project in the same job passed 839 of 840 files, with 1 skipped. I judge it a flake and re-run the failed jobs once through rerun-failed.mjs. A second failure counts as real.

Generated by Claude Code

domain:spec#2 · os-tesla · session_01L9qibyToDkPxCjvNiWsv6e

The brief handed to the isolated reviewer at CONTRACT_REVIEW_TIER for the record below it, posted beside the record per references/contract-review.md.

Contract review brief — PR #33205 @ 9d07ffa069baf93055b4da43e19fccbf9237159c (card #33154)

You review at CONTRACT_REVIEW_TIER. Render ONE ## Contract review record on this head — its shape is
node scripts/pm/record-recognisers.mjs --template --paths packages/spec/src/migrations/entries/semantic/18.object-extension-validation-rule-expression-judged.ts — with a PASS or FAIL verdict, and post it as ONE comment
on the PR or its card.

Inputs — these and nothing else:
· card #33154: its body and EVERY comment (rulings and earlier records included)
· PR #33205: its body, its file list, and the net diff against main at 9d07ffa069baf93055b4da43e19fccbf9237159c
· the check-runs on 9d07ffa069baf93055b4da43e19fccbf9237159c: their conclusions ARE the gate verdicts
⛔ Not the dispatch order, ⛔ not the dispatching seat's own conclusions — this brief is adversarial by design.

Scope — the paths reviewFace returns as hits on this PR's file list: packages/spec/src/migrations/entries/semantic/18.object-extension-validation-rule-expression-judged.ts;
plus every file IN THIS DIFF that directly implements or enforces them — the gate that enforces a rule, the code
a jsdoc or schema line describes, the validator a skill teaches — reviewed for agreement with the contract.
Widen it freely, ⛔ never below hits; the record's Scope: line names the implementing files apart from hits.
The rest of the diff (tests, unrelated modules, lockfiles, generated output, changesets) is the lane seat's
ACCEPT at TIER_DEFAULT, exactly as a standalone PR of those files.
④ judges the hits files and those implementing files ONLY:
lockfiles, generated output, changesets and prose elsewhere in the PR are not reviewed;
code outside the diff is READ to judge them, never reviewed.

⛔ READ-ONLY. No worktree, no checkout, no build, no test run, no gate re-run, no ablation: the check-runs
on the head already answered every derived gate family, and a local run costs more than it returns.
If ONE probe is unavoidable, the record's Local-runs: line says probe — REASON; otherwise none.
Scratch space is /tmp/claude-0/-home-user/f1414190-0e98-53df-b144-bdabf7a7b94d/scratchpad/issue-33154/review/pr-33205/ alone; nothing there you did not write this round is read.

Judge, in the record's own sections:
① Derived judgments — every accept-set and public-surface change the diff implies, each named right or wrong.
② Semver level — the changeset (or skip-changeset) matches what the diff publishes, and the Clause-②: line.
③ Boundary flags — every dev flag and every open_questions entry answered, or escalated.
④ Design judgment — for EVERY hits file: does the change hold against the code it cites and the
scenario it is accepted against? A skill file against the card's eval prompt and the spec it teaches
on main; a schema file against the ruling or ADR it implements and its first consumer; an ADR
against its first consumer and its execution plan. For EVERY implementing file in the diff: does the
code agree with the contract, sentence by sentence? Read the cited code in the live tree, and try to
break the design.
Grade each finding must-fix, should-fix or nit — a nit has no effect on correctness or the contract.
A must-fix is a FAIL; a must-fix or should-fix earns a delta review of its fix; nits alone end the round.
A nit is fixed only on the prose faces, or left as an accepted deviation or a follow-up card: a fix
anywhere else moves the head, and this record no longer covers it.
⛔ Judge the tree, never the PR body's account of it.
Sign Implemented-by: with the dev's branch and Reviewed-by: with your session id — the value is the FIRST
thing after each colon.

Card-thread notes (this round's context; inputs, not conclusions):
· The PR body and changeset also declare Clause-②: no (narrowing), so the narrowing face applies too: the scope floor is every path of the diff outside the prose faces (.changeset/**, content/docs/**), as the earlier record's Scope: line had it.
· This head is a rework. The earlier full review of head 15d074782c704e5b016436ec2ac8102d5d18411c is PR #33205 comment 6870963898 (VERDICT: FAIL; F1 must-fix, F2 should-fix, N1 to N3 nits). Its author is no longer seated, so this round is a full review of the new head that also judges, finding by finding, whether F1, F2, N2 and N3 are resolved in the TREE (N1 was left as an accepted deviation). Read every PR #33205 comment as well as the card's: the record, the seat's hand-over 6871853372 and the claim and re-run notes.
· The hand-over 6871853372 names one unmeasured question: whether the flow and hook passes read the same unstripped nullable index at their own doors (validate-expressions.ts near the flow and hook walks). Judge it by reading the tree. Say whether it is in this PR's scope, and if it is not, whether it warrants a follow-up card.
· The follow-up cards #33216 and #33217 exist; read them.
· Read GitHub with gh api (read-only GET calls only) and the tree with git show 9d07ffa069baf93055b4da43e19fccbf9237159c:PATH / git diff origin/main...9d07ffa069baf93055b4da43e19fccbf9237159c in /home/user/objectstack-issue-33154 (read only; do not check out, build or edit anything there).
· Do NOT post anything to GitHub. Write the finished record (the template's shape, from ## Contract review down to the VERDICT line) to /tmp/claude-0/-home-user/f1414190-0e98-53df-b144-bdabf7a7b94d/scratchpad/issue-33154/review/record.md, and return it in full as your final message. The adopting session posts it. Sign Implemented-by: with claude/project-thread-mn9za6 and Reviewed-by: with session_01L9qibyToDkPxCjvNiWsv6e (the session that adopts and posts your verdict); the record states, under ③, that the session which implemented the PR adopts a verdict rendered by an isolated subagent at this tier, by the maintainer's word of 2026-11-14 14:17Z that seats may run their own contract reviews again.
· Write every finding so a reader with no context can act on it: file and line, the input, what happens, what should.

Generated by Claude Code

domain:spec#2 · os-tesla · session_01L9qibyToDkPxCjvNiWsv6e

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 9d07ffa069baf93055b4da43e19fccbf9237159c
Local-runs: none
Scope: packages/spec/src/migrations/entries/semantic/18.object-extension-validation-rule-expression-judged.ts + packages/lint/src/validate-expressions.ts, packages/lint/src/authoring-rules.ts, packages/lint/src/runtime-gate.object-formula-writes.test.ts, packages/lint/src/authored-site-expression.test.ts, packages/runtime/src/domains/meta-object-extension-item.test.ts, packages/runtime/src/domains/packages-disable-module-extension-fields.test.ts

PR #33205 for card #33154, on the schema face (the semantic entry) and the declared narrowing. This is a full review of the rework head. It also judges, finding by finding, whether F1, F2, N2 and N3 of the earlier record 6870963898 (head 15d07478, FAIL) are resolved in the tree.

Read: the card body and its six comments; the PR body, its nine-path file list and its six comments (the earlier record, the hand-over 6871853372, the two claims and the re-run note among them); the net diff against main; cards #33216 and #33217; and the head's check-runs. Every statement about behaviour below is read from the tree at the head with git show. Nothing was built or run.

No must-fix and no should-fix. Four nits (N4 to N7). One follow-up card is owed (the flow and hook doors, under ③).

Check-runs at 2026-11-14T14:28Z: 71 runs: 58 success, 12 skipped, 1 in progress. The one without a conclusion is Test Core (2/8), attempt 2 (job 132475937503, started 14:21Z). Attempt 1 (job 132325981683) failed. Its log, read for this record, shows 4 failed tests, each Hook timed out in 10000ms in a beforeEach of packages/spec/scripts/build-schemas-check-mode.deletion-proofs.test.ts (:224) and build-schemas-check-mode.git-topology.test.ts (:104). Those hooks write files into a throwaway git sandbox and read no path of this diff. In the same job the @objectstack/spec unit project, which holds the migration-entry tests, passed 839 of 840 files with 1 skipped. No lint or runtime test runs in that shard, and the other seven shards are green. So no gate that judges this contract is red. ⛔ This verdict does not stand in for that shard: landing waits for its conclusion, and a second failure is real and is not covered by this record.

① Derived judgments

1. os build, os validate and os lint refuse a stack whose objectExtensions[].validations[] rule fails the rule pass. Right, and a narrowing. The rule's registry row is commands: ALL (authoring-rules.ts:648). The changeset now names all three commands.

2. The runtime object_extension publish door refuses the same rule with 422 INVALID_METADATA, issue expression-invalid. Right, and now within the declared bound (F1 below).

3. The newly refused shapes: an unknown field, a bare reference, an unregistered function, an unguarded nullable operand of an ordering or arithmetic operator, a parent root, a type mismatch, and the hop shapes a declared rule is refused for. Each is the verdict the object's own rule gets, because both walks call one closure. Right.

4. New on this head: on an object_extension write the door's objects are read through stripInjectedSystemColumns (validate-expressions.ts:2377). This moves door verdicts in three places, each to the build's verdict:

   • The null-guard gate no longer judges an injected column (created_at, owner_id, ...) as a declared nullable field. This is the F1 fix, and a widening of what the door refused on 15d07478.
   • The type index no longer types an injected column at the door (buildFieldTypeIndex, :432, declared fields only). A type verdict over record.created_at that the door gave since lint: the object_extension publish door runs no field-formula judgment, so a computed field os build refuses still publishes through PUT /meta/object_extension #33072 on an extension's formula field, and that the build never gave, is gone. A widening at the door.
   • The hop-leaf check (refuseUndeclaredHopField, :2474) no longer treats an injected lookup (created_by, owner_id) as a declared reference of the target, so the leaf of record.created_by.FIELD is unjudged at the door as it is at the build. A widening at the door.

   All three are right against the contract, which is "the build's verdict" in this entry and in lint: the object_extension publish door runs no field-formula judgment, so a computed field os build refuses still publishes through PUT /meta/object_extension #33072's entry. The changeset names the first. The other two are covered by its sentence that the door reads the objects "as the build does" (N6).

5. No exported type or signature moves in @objectstack/lint. Right. judgeValidationRule is a closure inside runStackExpressionPasses. StackExpressionOptions changes in its docblock only. The new import, @objectstack/metadata-core, is already a dependency of the package (packages/lint/package.json:54) and is already imported by authored-site-expression.ts:45 and runtime-gate.ts:666.

6. @objectstack/spec gains one semantic entry in the protocol 18 step. Right, additive. Entries are concatenated from the directory, so the file needs no index edit.

7. The object walk is unchanged. Right. The hoisted body (:3583 to :3660) differs from the inline body on main in three places, each object '${objectName}' becoming ${locus}, and the object call site (:3686) passes locus as that same string and the same rulePath.

8. Not gated, as before: a module package registered at boot, and the package-wide draft publish limit the options docblock states. As declared.

② Semver level

The changeset moves @objectstack/lint and @objectstack/spec at minor. Both are released packages the diff moves (lint source, one spec migration entry). The kind narrowed takes at least minor, so the level is right. packages/runtime changes in tests only and owes no entry.

Clause-②: no (narrowing) and Metadata-protocol: narrowed stand line-initial on the PR body and on the changeset body. The changeset carries the BREAKING banner (Before, Now, Unchanged, Fix) and exactly one ADR-0087 marker, registered object-extension-validation-rule-expression-judged, which is the entry's id. Check Changeset (both runs) and Lint · CI, release & engine gates are green on the head. The arm is the right arm, and the bound it states ("a condition or when the same rule on the object itself is refused for") now holds at the door for the input that broke it on 15d07478.

③ Boundary flags

• Who renders and who adopts. The session that implemented this PR (session_01L9qibyToDkPxCjvNiWsv6e) adopts and posts this verdict. It was rendered by an isolated subagent at CONTRACT_REVIEW_TIER, fed the brief, the diff, the threads and record 6870963898, and not the implementer's conclusions. This rests on the maintainer's word of 2026-11-14 14:17Z that seats may run their own contract reviews again (claim 6878678135, which lifts the hold 6871853372).
• Dev report open_questions: empty.
• Dev report deviations: the attribution line links the card thread, and the ablation's mutate leg needed --source-marker. Neither touches the contract. Accepted.
• Dev report out-of-scope finding (an extension's format regex and json_schema formats are judged at neither door): filed as An object extension's format and json_schema validation rules skip the regex and JSON-schema checks the object's own rules get #33217, read, triaged p2. The changeset's Unchanged line states it. Closed here.
• Record 6870963898 F2 (the leaf of a one-hop read through a reference an extension adds): filed as A one-hop read through a lookup an object extension adds is accepted with a misspelt target field, then refuses every save #33216, read, triaged p2. See ④ for the tree side.
• The claim's provisional Metadata-protocol: narrowed: stands.
• Amendment 6868654518 (comment only in authoring-rules.ts): held. Seven comment lines; runtimeTypes and the adapter are untouched.
• Amendment 6869487624 (the repaired fixture; the banner and the entry name the null-guard refusal and its fix): held.
• File surface: the nine paths are the claimed surface plus the two amendments. The rework commit touches five of them and adds none. No breach.
• The hand-over's unmeasured question: do the flow and hook passes read the same unstripped nullable index at their own doors? By reading the tree: yes. It is not in this PR's scope. It warrants a follow-up card. Escalated to the adopting seat to file.
  • Mechanism. On every runtime write the gate hands the rules registry.listItems('object') folded with the stored rows (packages/metadata-protocol/src/protocol-authoring-gate.ts:437 to :474). A registered object carries its injected columns in fields (applySystemFields, packages/objectql/src/registry.ts:5890), each required: false with no defaultValue (packages/spec/src/data/injected-system-column-provenance.ts:61). packages/lint/src/runtime-gate.ts strips nothing. This head strips only under extensionWrite (validate-expressions.ts:2377). So on a flow or hook write nullableIndex (:2395) holds created_at, updated_at, created_by, updated_by, owner_id and organization_id as nullable fields.
  • Flow door. On a record-triggered flow the start, edge and decision conditions go through checkNullGuards (:3061), and every name in that index also joins the bare-name set (:3047 to :3053). Input: a record-triggered flow whose condition is record.updated_at > record.created_at, or the bare created_at > timestamp('2020-01-01T00:00:00Z'). What happens, by reading: the publish door refuses it with the null-guard error, and os build of the same flow reports nothing, because the build's index holds declared fields only (the index's own docblock, :509). What should happen: one verdict at both.
  • Hook door. A hook condition goes through checkNullGuards at :4278 and :4310. Same input shape, same split.
  • A second consumer disagrees with the door. judgeAuthoredSiteExpression (authored-site-expression.ts:235) strips before it judges a flow_condition site as "a flow write at the runtime publish gate". So the MCP validate_expression tool answers clean for a condition the flow publish then refuses.
  • Why it is out of scope. The flow and hook walks, their doors and runtimeTypes are not in this diff, and the card is about an extension's validation rules. The split predates this PR.
  • Basis and the card's first step. Read, not run. One real-door case settles each: publish a record-triggered flow, and a hook, whose condition applies an ordering operator to record.created_at with no guard, beside os build of the same item. The card's remedy question is which side is right per column: the index's docblock says the driver always populates created_at while owner_id really can be NULL.
• Carried from record 6870963898, still open, outside the diff: the object_extension row comment in packages/lint/src/runtime-gate.ts:293 to :296 still says the crossing is the extension walk "over the written entry's fields". It now judges the entry's rules too. A follow-up edit; it can ride A one-hop read through a lookup an object extension adds is accepted with a misspelt target field, then refuses every save #33216 or An object extension's format and json_schema validation rules skip the regex and JSON-schema checks the object's own rules get #33217, which touch the same walk.

④ Design judgment

The earlier record's findings, judged in the tree at this head.

• F1 (must-fix): resolved.
  • The fix is the first remedy the record offered: validate-expressions.ts:2377 reads each object through stripInjectedSystemColumns on an extension write, before any index is built. buildFieldIndex (:247) then re-adds the injected names through injectedColumnsFor, as it does at the build, so record.created_at stays a known field. buildNullableFieldIndex (:570) sees declared fields only, so the gate gives no verdict on it. The walk's fieldDefs re-derive the injected definitions through injectedColumnDefsFor(base) (:4105).
  • The strip is exact by construction. stripInjectedSystemColumns removes a field only when it is identical, key for key, to the platform's definition (isInjectedColumnDefinition, injected-system-column-provenance.ts:237), and applySystemFields spreads those definitions unchanged (its docblock at registry.ts:1458 forbids adding keys). A created_at the author declared in any other shape stays the author's field at the door and at the build alike.
  • It is pinned where the record asked. Lint: the PARITY case that feeds the door applyInjectedSystemColumns(target) and deep-equals its findings with the build's, for record.created_at > timestamp(...) (accepted at both) and record.amount > 0 (refused at both). Real door: the PARITY case in meta-object-extension-item.test.ts asserts the registry serves created_at, publishes the rule through saveMetaItem and publishMetaItem, and compares a refused record.bonus__c > 100 with the build's rule, location and path. Both files run in green shards.
  • The three sentences that were false for this input are now true: the entry's replacement and acceptanceCriteria, the declared bound, and the docs sentence "at the door and in os build alike".
  • What the record left untraced stays untraced and is not this PR's: whether created_at is bound when an insert rule runs. If it is not, the build under-covers for an object's own rules exactly as for an extension's. The contract here is parity with the object's own rule, and parity holds.
• F2 (should-fix): resolved on the faces the record named. The tree does not judge the leaf, and says so in three places: the walk's comment (:4132 to :4136), the options docblock (:2275), and the changeset's Unchanged line, with the example record.manager__c.nmae. Card A one-hop read through a lookup an object extension adds is accepted with a misspelt target field, then refuses every save #33216 carries the fix. The sentence the record called too wide ("against the target as served, through the same indexes") is gone. No case pins the gap; A one-hop read through a lookup an object extension adds is accepted with a misspelt target field, then refuses every save #33216 owns that.
• N1 (nit): left as an accepted deviation, as the hand-over says. Unchanged at :4146 to :4154. It is reachable only on an unparsed stack, and the verdict and locator are unaffected.
• N2 (nit): resolved. The comment at :4139 to :4141 now says the door's 422 carries the path as is and only a draft read's _diagnostics re-spell it item-relative. That agrees with itemRelativeIssuePath (packages/metadata-protocol/src/metadata-diagnostics.ts:401) and with the real-door LIT case, which pins objectExtensions[0].validations[0].condition on the 422.
• N3 (nit, in the hits file): resolved. The reason now gives objectExtensions[N] with N the entry's own index, the packages[J].manifest. prefix in a built artifact, and objectExtensions[0] at the door. The null-guard sentence is narrowed to "an ordering or arithmetic operator" and says an equality such as == null is accepted.

packages/spec/src/migrations/entries/semantic/18.object-extension-validation-rule-expression-judged.ts (hits)

Read sentence by sentence against the tree.

• surface: defineObjectExtension exists (packages/spec/src/data/object.zod.ts:5781) and the fold reads ext.validations (packages/lint/src/object-graph.ts:451). Right.
• replacement: every clause is a verdict of judgeValidationRule, and "a rule the expression rule accepts on a declared rule of the same object" now holds at both doors. The clause "reads one hop through a reference only as a declared rule may" does not promise the leaf check F2 names. Right.
• reason: the premise holds (mergeValidationsByName, packages/objectql/src/registry.ts:1160). The locator matches object-graph.ts:448 and the walk's locus. A nested branch is located objectExtensions[N] · validation rule 'R' then → 'M', which the acceptance sentence's prefix objectExtensions[N] · validation still matches.
• acceptanceCriteria: a clean os build and then a 200 at the door. Right for every input I could construct. Attempts that did not break it: an injected column (F1, fixed); a field a sibling extension adds (resolved at both, pinned); a target outside the door's package closure (judged only on what does not depend on its fields, the accepting direction); a republish that drops a field its own rule reads (refused, pinned).
• The four printed fields hold no tracker id. No D2 conversion and no relevantWhen: right, for the reasons its leading comment gives.
• N5 below.

packages/lint/src/validate-expressions.ts (implementing)

The code agrees with the contract. The hoist is faithful (① item 7). The extension loop (:4146 to :4154) passes the target, the entry locator and the rule's key path. The return after the walk (:4159) keeps the door at one pass. The strip sits after the view and page early returns and before the first index, and it is fenced to extensionWrite, so the build and every other door read stack.objects as before.

Tried against the strip, and held:

• A served object whose fields is not a record: the strip returns it untouched, and the door's objects are registry-shaped records.
• A stored (overlay-backed) target, which may arrive without injected columns: the strip is a no-op on it.
• The written extension's own fields: they are folded in by objectsAsServed after the strip, so a nullable field the extension adds is still judged (pinned at the real door with bonus__c).
• A deployment that declares the target platform-global: the registry injects no organization_id, and the one-argument plan the strip and injectedColumnsFor use would still call the name known. That is the accepting direction, it predates this PR, and no ordering or arithmetic rule plausibly reads that column. Not a finding.

N4, nit. validate-expressions.ts:3683. The comment reads "The object's index in the authored list, for the finding's key path", but the line under it computes the rule's index in the object's validations (ruleIndex). The object's index is the comment at :3671. No effect on behaviour. Accepted deviation, or fixed with the next edit of the walk (#33216 or #33217).

N5, nit, in the hits file. The entry's leading comment (lines 5 to 6) names os build, os validate and the door. The rule is commands: ALL, so os lint refuses too, as the changeset says. The comment is not printed. Accepted deviation.

N6, nit, prose face (changeset). The Now paragraph names one effect of the strip: created_at is not judged nullable. It does not name the other two in ① item 4, which also move #33072's door verdict on an extension's formula field (no type verdict on an injected column; no leaf verdict through an injected lookup). Both are widenings to the build's verdict, so nothing an author must do follows from them. One clause would cover it. A changeset edit moves the head, so it is the lane seat's call: accepted deviation is enough.

N7, nit, prose face (PR body). The PR body's Clause-②: line names os build and os validate; the changeset's names os lint as well. Fix the PR body to match, which moves no head.

packages/lint/src/authoring-rules.ts (implementing)

Comment only, as amended. Its measured sentence holds on reading: examples/app-showcase/src/data/extensions/account.extension.ts and packages/plugins/plugin-auth carry extensions with fields only, and no non-test source under examples/ or packages/plugins/ declares a rule on an extension.

The four test files (implementing)

• runtime-gate.object-formula-writes.test.ts: nine cases, each asserting what its title says. The new PARITY case closes the blind spot the earlier record named for F1. Still unpinned, by design: a hop through a reference the extension adds (A one-hop read through a lookup an object extension adds is accepted with a misspelt target field, then refuses every save #33216).
• meta-object-extension-item.test.ts: four real-door cases, and the bare region__c fixture repaired to record.region__c. The PARITY case first asserts the precondition (the registry serves created_at), so it cannot pass vacuously.
• authored-site-expression.test.ts: the source regions follow the hoist. judgeFieldFormula (:3486) precedes judgeValidationRule (:3583), so the formula region's new end marker is right, and indexOf and isArray stay in the object loop, outside the rule pass.
• packages-disable-module-extension-fields.test.ts: the tenant rule is guarded, as the amendment says.

Implemented-by: claude/project-thread-mn9za6
Reviewed-by: session_01L9qibyToDkPxCjvNiWsv6e

VERDICT: PASS

Generated by Claude Code

domain:spec#2 · os-tesla · session_01L9qibyToDkPxCjvNiWsv6e

维护者速读 · PR #33205 @ 9d07ffa0 · 2026-11-14T14:37Z

• 改了什么：对象扩展（objectExtensions / Studio 发布的 object_extension）新增的校验规则，现在在 os build、os validate、os lint 和运行时发布口都用对象自身校验规则的同一套检查判定（judgeValidationRule，规则 id expression-invalid），位置为 object '对象' · objectExtensions[N] · validation '规则'。扩展发布口读对象时会先去掉平台注入的系统列，与 build 读法一致。
• 为什么改：An object extension's validations are judged at neither the publish door nor os build, yet the registry registers them on the target object #33154。注册表按名字把扩展的规则合并到目标对象上，每次保存记录都会执行，但此前两道门都不判；字段拼错、函数不存在、可空字段没加守卫，都要等最终用户保存时才失败。
• 风险与回滚：收窄。第一方实测 0 处扩展校验规则受影响；仓库里 2 个测试夹具正是被拒的形状，已修正。草稿保存不受影响，已存的行要等再次发布才判。回滚就是 revert。
• 先看：packages/lint/src/validate-expressions.ts 里的 judgeValidationRule、扩展遍历新增的循环，以及 extensionWrite 下去掉注入列的那一行（:2377）。
• 需要你做的：无，席位落地。
• 席位意见：落地。现 head 契约复审 PASS（6878859677），无 must-fix / should-fix；CI 全绿；非受管面，579 行。

席位核对

• 形态: draft → main。正文首段 Fixes #33154，合并后应当关卡；全文没有别的闭合关键词挨着 open 卡号（A one-hop read through a lookup an object extension adds is accepted with a misspelt target field, then refuses every save #33216、An object extension's format and json_schema validation rules skip the regex and JSON-schema checks the object's own rules get #33217、A flow or hook condition ordering record.created_at with no guard is refused at the publish door while os build accepts it #33246 都是 "Filed as" / "filed as"）。
  • 申报 Clause-②: no (narrowing)、Metadata-protocol: narrowed、Skills-docs: none owed — …，PR 正文与 changeset 行首都有；@objectstack/lint minor、@objectstack/spec minor，带 BREAKING 横幅与 ADR-0087 登记标记。
  • 文件面 = 认领 6868572380 加修订 6868654518、6869487624，9 个文件都在其中。卡已由本会话恢复认领（6878924969，Resume-from 9d07ffa0）。
• 前提实测: 报告 6870691534：3e19223b 上扩展规则拼错字段、未知函数在两道门都无发现（对照：对象自身规则的拼写错误被拒）。r1 实测 F1：真实发布口对无守卫的 record.created_at > … 回 422、build 回 []；修后两边一致，消融 lint 1/9、真门 1/4 变红，复原干净。
• 门禁 check-runs @ 9d07ffa0: 76 runs：62 success、14 skipped、0 失败、0 进行中（读于落地前）。
  • Test Core (2/8) 第一次跑（job 132325981683）在 packages/spec/scripts/build-schemas-check-mode.{deletion-proofs,git-topology}.test.ts 有 4 个 Hook timed out in 10000ms，不涉及本 diff；判断与依据见评论（重跑说明），经 rerun-failed.mjs 重跑一次，第二次（job 132475937503）success。
  • Dogfood（标题带 !）：全量、无分片，head 9d07ffa0，463/3 文件、3918 测试，VERDICT 0（正文 Verification）。
• 契约复审: 面 = schema（语义条目）+ 收窄，CONTRACT_REVIEW_TIER。记录 6878859677 PASS，Head-sha 即现 head；简报 6878852190 在旁，Scope: 不窄于 hits（语义条目）且覆盖散文面之外全部路径。独立性：复审由隔离子代理在该档完成，只喂简报、diff、两边线程与旧记录 6870963898，不喂实现者结论；由实现本 PR 的同一会话采纳，依据维护者 「你现在可以自己契约复审了」（项目聊天，2026-11-14 14:17Z）。旧记录 F1（must-fix）、F2（should-fix）、N2、N3 在树上核实解决，N1 维持接受的偏差。
• 散文面（TIER_DEFAULT，席位逐句核 diff）:
  • changeset：Clause 行与 BREAKING 行的 os build、os validate、os lint 三命令（authoring-rules.ts:648 commands: ALL）；Now 段「门读对象时去掉注入的系统列，故 created_at 在两边都不判可空」（validate-expressions.ts:2377，有真门 PARITY 钉）；空值守卫段收窄到排序与算术运算符、等式不拒（对照真门 record.region__c == null 发布通过）；Unchanged 段的一跳叶子不判（A one-hop read through a lookup an object extension adds is accepted with a misspelt target field, then refuses every save #33216）与 format / json_schema 不判（An object extension's format and json_schema validation rules skip the regex and JSON-schema checks the object's own rules get #33217）。
  • validating-metadata.mdx 新增句「at the door and in os build alike」：F1 修复后成立。
• 接受的偏差: 复审 nit N4（:3683 注释写成对象索引，实为规则索引）、N5（语义条目开头注释未列 os lint，不打印）、N6（changeset 只点名去注入列的一项效果，另两项是向 build 结论放宽）照接受；N7（PR 正文 Clause 行缺 os lint）已改正文，不移 head。旧 N1 照接受。runtime-gate.ts:293-296 的行注释仍只写字段，留给 A one-hop read through a lookup an object extension adds is accepted with a misspelt target field, then refuses every save #33216 / An object extension's format and json_schema validation rules skip the regex and JSON-schema checks the object's own rules get #33217 顺手改。
• 范围外去向:
  • 扩展规则的 format 正则与 json_schema 格式两道门都不判 → filed An object extension's format and json_schema validation rules skip the regex and JSON-schema checks the object's own rules get #33217
  • 经扩展新增查找字段的一跳叶子不判 → filed A one-hop read through a lookup an object extension adds is accepted with a misspelt target field, then refuses every save #33216
  • flow / hook 发布口读未去注入列的可空索引，与 build 结论不一致 → filed A flow or hook condition ordering record.created_at with no guard is refused at the publish door while os build accepts it #33246
• 落地条款: 维护者常设落地令 「按 pm-dispatch 审过的pr你可以自主落地」（2026-10-30T14:20Z），本次依 「你现在可以自己契约复审了」（2026-11-14 14:17Z）由本会话复审后落地。
  • 非受管面：check-governed-merges --pr 33205 判定 0/9 命中；579 行 ≤ 3000。
  • K = 8（PRBASE 6e1ab9b2，取自 Plan Test Core shards 的 Affected-set diff base；origin/main 为 e540baf8）。git merge-tree 无冲突。没有新的语种包（PRBASE 之后 main 只动了一份已有的 en.objects.generated.ts）。

Generated by Claude Code

domain:spec#2 · sunhaolin · session_017xRBcSbLCxEmyHf9upz3pz

维护者速读 · PR #33205 @ 9d07ffa0 · 2026-11-14T15:28Z

• 改了什么：对象扩展新增的校验规则，现在在 os build / os validate / os lint 和运行时发布口，都按对象自身规则的同一套检查判定。扩展发布口读对象时先去掉平台注入的系统列，与 build 的读法一致。
• 为什么改：An object extension's validations are judged at neither the publish door nor os build, yet the registry registers them on the target object #33154。扩展的规则每次保存记录都会执行，但此前两道门都不判，写错要等最终用户保存时才暴露。
• 风险与回滚：收窄。第一方实测 0 处受影响；草稿保存不受影响。回滚即 revert。
• 先看：packages/lint/src/validate-expressions.ts 的 judgeValidationRule 与扩展遍历循环。
• 需要你做的：无，本席落地。
• 席位意见：落地。契约复审 PASS 在现 head 上；CI 全绿；非受管面；579 行。

席位核对

ACCEPT. This is the seated domain:spec#2's verdict; the card thread's ACCEPT 6878959095 is an input and is not repeated here.

• Form: draft → main, Fixes #33154 only. Clause-②: no (narrowing), Metadata-protocol: narrowed and Skills-docs: are line-leading in the body. N7 is already applied, so the Clause line names os lint.
• Contract review: record 6878859677 PASS at CONTRACT_REVIEW_TIER, Head-sha = the current head 9d07ffa069, no must-fix or should-fix. Adopted.
• Check-runs @ 9d07ffa0 (read 15:24Z): 76 runs, 62 success and 14 skipped, none failed or pending. Test Core (2/8) attempt 2 succeeded.
• Seat readings @ 15:27Z:
  • check-governed-merges --pr 33205: NOT governed; 579 lines ≤ 3000.
  • git merge-tree origin/main(d4fbb4dbb6) 9d07ffa0: clean.
  • K = 11 (PRBASE 6e1ab9b2) < 15, and no new locale pack since PRBASE.
• Accepted deviations: N1, N4, N5 and N6 of the record. The runtime-gate.ts:293-296 row comment rides A one-hop read through a lookup an object extension adds is accepted with a misspelt target field, then refuses every save #33216 / An object extension's format and json_schema validation rules skip the regex and JSON-schema checks the object's own rules get #33217.
• Out of scope: filed A one-hop read through a lookup an object extension adds is accepted with a misspelt target field, then refuses every save #33216, An object extension's format and json_schema validation rules skip the regex and JSON-schema checks the object's own rules get #33217 and A flow or hook condition ordering record.created_at with no guard is refused at the publish door while os build accepts it #33246, all three serial behind this PR.
• Landing clause: non-governed queue landing by the seated lane seat, per the maintainer's 「车道座位应该使用pm-dispatch 技能审核和落地pr」 (2026-11-14 14:32Z, quoted in release 6878986273); claim 6878924969 was withdrawn, claim 6879708152 is this seat's.