[objectstack-fleet]

Requested by Leehom · project thread

Fixes #33135

domain:skills#1 · os-project-manager · session_01FEkQ5obDWQ7NdtH2f9iZXC

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么:ADR-0019 在 2026-11-12 的执行记录里写着「两种形状不受检查:扁平的 composeStacks,和手工拼的 packages[] 包体」。这句改成当日的读数(过去时),并在其后新增一段「自 2026-11-13 起,组合与 packages[] 包体都受检查」,逐条写明 feat(spec)!: composeStacks refuses a flat composition that puts two or more apps under one app or module package id, and every packages[] body is held to one app #32898、feat(spec)!: strict defineStack judges a packages[] stack per body and counts only the top-level apps no body declares against its manifest #33074、feat(spec)!: strict defineStack judges a packages[] stack's namespace prefixes per body and its top level by the residual rule #33122 三次合并各自检查了什么;状态行的「已落地」也补上这三次合并及其提交号。
• 为什么改:这句话两半在 main 上都已不成立:扁平组合把两个以上应用放到同一个 app/module 包名下会被拒(STACK_SINGLE_APP_VIOLATION,422),手工拼的包体也按包分别检查单应用和命名空间前缀。照着旧文字读的作者或 AI 会以为这些形状不受检查。
• 风险与回滚:只改决策记录文字,不动代码、协议和技能包;回滚即还原本 PR。
• 先看:docs/adr/0019-app-as-consumer-unit.md D3 修订说明下的「Enforced for compositions and packages[] bodies since 2026-11-13」一段;再看第 3 行状态行新增的那半句。
• 两分钟验证:pnpm check:adr-symbol-anchors,预期 exit 0、「anchors across 156 records resolve」。
• 需要你做的:受管面 Tier H(docs/adr/**):请批准或合并。

What changes

• docs/adr/0019-app-as-consumer-unit.md, D3, the 2026-11-12 note "Enforced for modules since 2026-11-12". Its sentence "The check reads one defineStack call. Two shapes are not judged (spec: a flat composeStacks (default manifest 'last') of packages with one app each yields one package id with several apps, and no door refuses it (the single-app rule of ADR-0019 D3 as amended) #32810): a flat composeStacks … and a hand-built packages[] body." is rewritten as the reading at that merge, in the past tense, and points to the next paragraph: "At this merge the check read one defineStack call, and two shapes were not judged (spec: a flat composeStacks (default manifest 'last') of packages with one app each yields one package id with several apps, and no door refuses it (the single-app rule of ADR-0019 D3 as amended) #32810): … Both are judged since 2026-11-13; see the next paragraph." The rest of that paragraph is unchanged.
• New dated paragraph "Enforced for compositions and packages[] bodies since 2026-11-13.", following the file's own convention (the 2026-11-12 note keeps the paragraph before it "as written" and adds a dated note). One bullet per merge:
  • feat(spec)!: composeStacks refuses a flat composition that puts two or more apps under one app or module package id, and every packages[] body is held to one app #32898 (0b23b2a0c4): composeStacks refuses a flat composition ('last', 'first' or an index) whose kept manifest is an app or module package and that brings two or more apps, STACK_SINGLE_APP_VIOLATION (422), naming each app and its input; the remedy is manifest: 'preserve'; every packages[] body of a composition is held to one app; a one-input composition is handed back unjudged.
  • feat(spec)!: strict defineStack judges a packages[] stack per body and counts only the top-level apps no body declares against its manifest #33074 (2c98485db5): changes only how strict defineStack counts the top level of a packages[] stack. Before, every top-level app counted against manifest.id; since, the residual rule feat(spec)!: composeStacks refuses a flat composition that puts two or more apps under one app or module package id, and every packages[] body is held to one app #32898 gave composeStacks (top-level apps no body declares count against manifest.id beside that id's own body). Bodies are judged as before, per body since feat(spec)!: composeStacks refuses a flat composition that puts two or more apps under one app or module package id, and every packages[] body is held to one app #32898.
  • feat(spec)!: strict defineStack judges a packages[] stack's namespace prefixes per body and its top level by the residual rule #33122 (5b2ec820c8): strict defineStack judges namespace prefixes per body against the body's own namespace, residual top-level objects against manifest.namespace, STACK_NAMESPACE_PREFIX_INVALID; a body with no namespace is not judged.
  • What stays unjudged at defineStack (other package types, no manifest, strict: false, the last now judged at composeStacks), and the placement sentence, which stands (measured, below).
• Status line, "Landed in spec". After the spec: defineStack refuses a module package that defines more than one app, the enforcement of the amended ADR-0019 D3 (a suite surfaces several apps, one per package) #32586 clause: "and the same rule on a flat composeStacks and on every packages[] body (feat(spec)!: composeStacks refuses a flat composition that puts two or more apps under one app or module package id, and every packages[] body is held to one app #32898, merged 2026-11-13 as 0b23b2a0c4; feat(spec)!: strict defineStack judges a packages[] stack per body and counts only the top-level apps no body declares against its manifest #33074, merged 2026-11-13 as 2c98485db5), and the namespace-prefix rule judged per packages[] body (feat(spec)!: strict defineStack judges a packages[] stack's namespace prefixes per body and its top level by the residual rule #33122, merged 2026-11-13 as 5b2ec820c8)."
• Not touched: the D3 reasons, the 2026-11-12 "Enforced today, and not yet." paragraph, ADR-0130 (the order's surface is this file only), and skills/** (PR docs(skills): a suite composes under manifest preserve; a flat composition of two apps under one package is refused #33475 teaches the flat-compose fact there).

Why

Read on origin/main b392ff7b, not from the card:

• packages/spec/src/stack.zod.ts: collectComposedSingleAppErrors and flatSingleAppFinding (flat result: every app counts against the one kept manifest), SINGLE_APP_PACKAGE_TYPES = app, module, SINGLE_APP_COMPOSE_REMEDY (names manifest: 'preserve'), collectPackageBodySingleAppErrors (each body by its own type, id, apps), validateSingleApp and residualSingleAppFinding (one judge for both doors), namespacePrefixErrors (per body, residual top level), composeStacks' stacks.length === 1 early return.

• examples/app-multi-package/objectstack.config.ts composes with manifest: 'preserve'.

• Attribution per PR, read from each merge commit's tree: residualSingleAppFinding, flatSingleAppFinding and collectPackageBodySingleAppErrors exist at 0b23b2a0c4 (feat(spec)!: composeStacks refuses a flat composition that puts two or more apps under one app or module package id, and every packages[] body is held to one app #32898), where validateSingleApp does not call the residual judge; it does at 2c98485db5 (feat(spec)!: strict defineStack judges a packages[] stack per body and counts only the top-level apps no body declares against its manifest #33074); namespacePrefixErrors first exists at 5b2ec820c8 (feat(spec)!: strict defineStack judges a packages[] stack's namespace prefixes per body and its top level by the residual rule #33122).

• Each merge commit is an ancestor of origin/main (git merge-base --is-ancestor, exit 0 for all three, after deepening the shallow clone).

• One probe against packages/spec/dist built from b392ff7b, not kept as a test:

  Shape	Answer
  flat composeStacks (default 'last') of two module stacks with one app each	refused, STACK_SINGLE_APP_VIOLATION 422
  the same under manifest: 'preserve'	accepted
  hand-built packages[] body (module) with two apps, defineStack	refused, STACK_SINGLE_APP_VIOLATION 422
  hand-built body, namespace svc, object crm_case	refused, STACK_NAMESPACE_PREFIX_INVALID 422
  control: same body with svc_case	accepted
  placement: module with no objects, app names crm_case	accepted
  placement: object-less body's app names a sibling body's object, defineStack and 'preserve' compose	accepted

  The placement sentence therefore stands, as the order asked to measure.

Ruling: Leehom 2026-11-14T21:21:06Z 「开放 p3卡认领」 (p3 cards open for claiming); scope widened to both halves by the skills seat's note 6884985712 on the card.

Acceptance notes

• The 2026-11-12 paragraph is edited, not kept verbatim. The order asks for both "rewrite the whole sentence" and "keep the dated paragraph as the reading at that date". Rewriting the one sentence into the past tense, with a pointer to the new note, does both: the paragraph still reads as at spec: defineStack refuses a module package that defines more than one app, the enforcement of the amended ADR-0019 D3 (a suite surfaces several apps, one per package) #32586's merge, and no present-tense sentence on the page is false.
• No out-of-scope findings.

Verification

Head 691fe886 (round 1, after contract review 6885553305; round 0 was c72ef404), base origin/main b392ff7b.

Derived gates: 21 derived, 21 run, all exit 0

node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 21 families for the one path. Each ran on head c72ef404 (round 0) and again on 691fe886, 21 of 21 exit 0 (33135-gates-ran-r1.txt) with its exit code captured before any pipe, after building @objectstack/lint... under the verify lock (VERDICT command-exit 0, 86s):

• exit 0: check-adr-links (scan and --self-test), check-closing-keyword-parity (scan and --self-test), check-comment-mask-corpus, plan-test-core-shards --self-test, @objectstack/lint check:doc-formula-expressions, check:adr-anchors, check:adr-index, check:adr-symbol-anchors ("3594 anchors across 156 records resolve"), check:ci-filter-parity, check:closed-ceremony-text, check:cross-package-test-inputs, check:doc-authoring, check:driver-memory-census, check:gitlink-declared, check:nul-bytes, check:pm-governed-merges, check:pm-prior-rulings, check:refd-timer-probe, check:watch-hint-literal.
• --ran reconciliation: "21 derived famil(ies) accounted for — 21 run, 0 NOT-MEASURED".
• The path-less symbol continuations (#flatSingleAppFinding, #SINGLE_APP_COMPOSE_REMEDY, #collectPackageBodySingleAppErrors, #validateSingleApp, #residualSingleAppFinding, #namespacePrefixErrors) are not judged by check:adr-symbol-anchors (that spelling is off in this corpus); each was found by grep as a declaration in packages/spec/src/stack.zod.ts on b392ff7b.
• CI families are read from this PR's check-runs, not re-run here.

Tier and governed readings

• dispatch-gates --tier: MANDATORY contract-review tier for docs/adr/**; no one-line exit for this surface. This thread ran at the claim's default model; the seat's in-seat contract review is the owed record.
• node scripts/pm/check-governed-merges.mjs --branch claude/project-thread-bd7546: GOVERNED, landing tier H (人合), docs/adr/** x1. Size +50 / -4, under the 3000 threshold.
• node scripts/pm/check-skill-line-ratchet.mjs: exit 0 (no skill file touched). No changeset: docs/adr/** ships in no package (skip-changeset).

🤖 Generated with Claude Code

https://claude.ai/code/session_01FEkQ5obDWQ7NdtH2f9iZXC

[objectstack-fleet]

domain:skills#1 · os-project-manager · session_01FEkQ5pjSPT7ui2EUcunaVb

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: c72ef4040e14592720e8a46cb708ee7d593a6ce7
Local-runs: none
Scope: docs/adr/0019-app-as-consumer-unit.md + none (the diff is this one file; read, not reviewed: packages/spec/src/stack.zod.ts and packages/spec/src/stack.test.ts on origin/main f068cde84d and at each cited merge commit, examples/app-multi-package/objectstack.config.ts)

Inputs read: card #33135 body and all four comments (triage 6859219233, seat scope note 6884985712, claim 6885232502, os-dev-report 6885394481); PR #33502 body, file list (one file, +40 / -4) and net diff; the check-runs on this head. Base drift: git diff b392ff7bdf4 origin/main is empty for stack.zod.ts, stack.test.ts, examples/app-multi-package/ and this ADR, so the PR's base reading holds on today's main.

Check-runs on this head at render time: 53 completed, 27 success and 26 skipped. None failed and none is pending. The last to finish were Test Core (1/8) and the three Type Check runs (workspace, consumer gates, debt ledger), all success. The derived gate families answer green.

① Derived judgments

• No accept-set change and no public-surface change: the diff is ADR prose only. No schema, export, error code or gate moves. Right.
• The record names two existing refusals, STACK_SINGLE_APP_VIOLATION and STACK_NAMESPACE_PREFIX_INVALID. Both are declared on main (stack.zod.ts, the readonly code lines of StackSingleAppViolationError and StackNamespacePrefixInvalidError) and raised where the ADR says: validateSingleApp and validateNamespacePrefix in strict defineStack, and collectComposedSingleAppErrors in composeStacks step 3c. Right.

② Semver level

• skip-changeset label, no changeset. docs/adr/** ships in no package. Right.
• Clause-②: no. Correct. Nothing narrows or widens at the consumer. The ADR records narrowings that already shipped under their own changesets (feat(spec)!: composeStacks refuses a flat composition that puts two or more apps under one app or module package id, and every packages[] body is held to one app #32898, feat(spec)!: strict defineStack judges a packages[] stack per body and counts only the top-level apps no body declares against its manifest #33074 and feat(spec)!: strict defineStack judges a packages[] stack's namespace prefixes per body and its top level by the residual rule #33122 each carry feat(spec)!).

③ Boundary flags

• open_questions: empty.

• Deviation 1 (tier): the dev ran at the claim's default tier and left the contract review to the seat. This record is that review.

• Deviation 2 (signature as a prose line, not an HTML comment): the PR body does carry the prose line. It also ends with a trailing signed HTML comment in the seat's session, which the seat's relay appears to have added. Process only; the contract is unaffected.

• Deviation 3 (the 2026-11-12 paragraph is edited, not kept verbatim): accepted. See nit N4.

• Merge commits named in the diff, each checked against git log origin/main after deepening the shallow clone:

  • 0b23b2a0c4 is feat(spec)!: composeStacks refuses a flat composition that puts two or more apps under one app or module package id, and every packages[] body is held to one app #32898, merged 2026-11-13.
  • 2c98485db5 is feat(spec)!: strict defineStack judges a packages[] stack per body and counts only the top-level apps no body declares against its manifest #33074, merged 2026-11-13.
  • 5b2ec820c8 is feat(spec)!: strict defineStack judges a packages[] stack's namespace prefixes per body and its top level by the residual rule #33122, merged 2026-11-13.
  • 9ae829108c (already in the file) is the spec: defineStack refuses a module package that defines more than one app, the enforcement of the amended ADR-0019 D3 (a suite surfaces several apps, one per package) #32586 merge, PR feat(spec)!: defineStack holds a module package to at most one app, as it does an app package #32792.

  git merge-base --is-ancestor exits 0 for all four. The merge dates and SHAs in the Status line and in the new note match gh api merged_at and merge_commit_sha.

• No decision changes. The diff touches only (a) the Status line's "Landed in spec" clause, which gains landings, and (b) D3's dated enforcement notes. D1, D2, D4, the D3 amendment, its reasons, the vocabulary table, "Enforced today, and not yet." and "Not decided here." are byte-identical to main.

④ Design judgment

docs/adr/0019-app-as-consumer-unit.md: the change holds against main in substance. Both halves of the old sentence are now false on main, and the new note describes the flat-compose refusal, the per-body walk and the namespace-prefix rule correctly as they stand. The per-merge attribution is wrong in one place, and the closing "still not judged" sentence is too broad. Sentence by sentence against the cited code:

• Flat compose, held. collectComposedSingleAppErrors sends a result with no packages[] to flatSingleAppFinding, gated on SINGLE_APP_PACKAGE_TYPES (app, module). The finding refuses two or more composed apps and names each app with from and the input label. SINGLE_APP_COMPOSE_REMEDY names manifest: 'preserve'. examples/app-multi-package/objectstack.config.ts composes with { manifest: 'preserve' }. composeStacks returns early on stacks.length === 1.
• Per-body walk, held. collectPackageBodySingleAppErrors judges each body by its own type, label and apps. validateSingleApp returns it next to the top-level finding. With packages[], the top level goes through residualSingleAppFinding, the same judge composeStacks uses. The residual is read by name through isResidualTopLevelItem. "Two or more there are refused" agrees with the code: zero residual hands the case to the body rule.
• Namespace prefix, held. namespacePrefixErrors judges each body against body.namespace and residual top-level objects against manifest.namespace. A body with no namespace returns nothing from judge. defineStack raises StackNamespacePrefixInvalidError.
• stack.test.ts pins each of the three, held. The describe holding "refuses a flat composition (the default manifest: 'last') ...", the describe "a packages[] stack is judged per body, and its top level by the residual rule ...", and the describe "a packages[] stack's namespace prefixes are judged per body ...".

Findings:

• S1 (should-fix): per-body judging at defineStack is credited to the wrong merge. The feat(spec)!: strict defineStack judges a packages[] stack per body and counts only the top-level apps no body declares against its manifest #33074 bullet says "strict defineStack judges a stack that carries packages[] per body, each by its own type, id and apps, and its top level by the residual rule". The feat(spec)!: composeStacks refuses a flat composition that puts two or more apps under one app or module package id, and every packages[] body is held to one app #32898 bullet says only "Every packages[] body of a composition is held to one app too". On the tree of 0b23b2a0c4 (feat(spec)!: composeStacks refuses a flat composition that puts two or more apps under one app or module package id, and every packages[] body is held to one app #32898), validateSingleApp already ends with ...collectPackageBodySingleAppErrors(config), so strict defineStack judged every hand-built body from feat(spec)!: composeStacks refuses a flat composition that puts two or more apps under one app or module package id, and every packages[] body is held to one app #32898 on. The pin "refuses, at defineStack, a packages[] body that defines two apps" is in stack.test.ts at 0b23b2a0c4 and absent at its first parent. feat(spec)!: strict defineStack judges a packages[] stack per body and counts only the top-level apps no body declares against its manifest #33074's own PR body says "every body is still judged by collectPackageBodySingleAppErrors as before". feat(spec)!: strict defineStack judges a packages[] stack per body and counts only the top-level apps no body declares against its manifest #33074 changed only how the top level of a packages[] stack is counted. It refuses an undeclared top-level app beside the manifest-id body's app, and it accepts an additive artifact's repeated top-level apps that feat(spec)!: composeStacks refuses a flat composition that puts two or more apps under one app or module package id, and every packages[] body is held to one app #32898's reading refused. So the hand-built-body half of the 2026-11-12 sentence became false at feat(spec)!: composeStacks refuses a flat composition that puts two or more apps under one app or module package id, and every packages[] body is held to one app #32898, not at feat(spec)!: strict defineStack judges a packages[] stack per body and counts only the top-level apps no body declares against its manifest #33074. The card's premise ("since feat(spec)!: strict defineStack judges a packages[] stack per body and counts only the top-level apps no body declares against its manifest #33074") carried the same error, and the dev's attribution check tested only the residual call. The date "since 2026-11-13" and the Status line, which credits feat(spec)!: composeStacks refuses a flat composition that puts two or more apps under one app or module package id, and every packages[] body is held to one app #32898 and feat(spec)!: strict defineStack judges a packages[] stack per body and counts only the top-level apps no body declares against its manifest #33074 jointly, stay right. Fix:
  • In the feat(spec)!: composeStacks refuses a flat composition that puts two or more apps under one app or module package id, and every packages[] body is held to one app #32898 bullet, say every packages[] body is held to one app at composeStacks and at strict defineStack (#collectPackageBodySingleAppErrors).
  • In the feat(spec)!: strict defineStack judges a packages[] stack per body and counts only the top-level apps no body declares against its manifest #33074 bullet, say it changed how strict defineStack counts the top level of a packages[] stack: by the residual rule instead of every top-level app, with the bodies judged as before.
• S2 (should-fix): the closing "still not judged" sentence is too broad in two ways. The sentence reads: "At defineStack, package types other than app and module, a stack with no manifest and strict: false are still not judged; a strict: false stack that reaches composeStacks is judged there."
  • (a) manifest and packages are each optional in ObjectStackDefinitionSchema, and no refinement requires a manifest beside packages[]. A hand-built stack with no manifest that carries packages[] still has every body judged, by collectPackageBodySingleAppErrors (single-app) and by namespacePrefixErrors (each body against its own namespace). Only its top level goes unjudged. As written, the sentence repeats for that shape the kind of false "not judged" claim this card exists to remove.
  • (b) The sentence comes right after the namespace-prefix bullet, but composeStacks runs no namespace-prefix check; nothing in composeStacks calls validateNamespacePrefix or namespacePrefixErrors. It judges a strict: false input only by the single-app rule, and only with two or more inputs (the one-input early return).
  • Fix: say a stack with no manifest leaves only its top level unjudged, and say the composeStacks judgment of a strict: false stack is the single-app rule, with two or more inputs.
• N1 (nit): the flat-composition description doesn't cover a nested-artifact input. "Keeps one manifest and puts every input's apps under its id" does not hold when one input carries packages[]. The flat result then carries packages[] and is judged by the residual rule, and the bodies' flattened copies are accepted. That case is pinned by "accepts a flat composition of a nested artifact whose flattened copy repeats its bodies' apps". The refusal stated in the ADR is still right for inputs with no packages[]. A qualifier would do.
• N2 (nit): path-less symbol anchors. In the feat(spec)!: strict defineStack judges a packages[] stack per body and counts only the top-level apps no body declares against its manifest #33074 and feat(spec)!: strict defineStack judges a packages[] stack's namespace prefixes per body and its top level by the residual rule #33122 bullets, #validateSingleApp, #residualSingleAppFinding and #namespacePrefixErrors stand with no path in the bullet. Elsewhere in this file, a #sym continuation follows a path#sym on the same line (reason 1, reason 2). check:adr-symbol-anchors does not judge this spelling, as the PR body says. All seven symbols are declared in packages/spec/src/stack.zod.ts on main, so nothing dangles. Repeating the path once per bullet would make each bullet resolvable on its own.
• N3 (nit): "the reading at spec: defineStack refuses a module package that defines more than one app, the enforcement of the amended ADR-0019 D3 (a suite surfaces several apps, one per package) #32586's merge" names an issue. The merged change is PR feat(spec)!: defineStack holds a module package to at most one app, as it does an app package #32792 (9ae829108c). The file already says "spec: defineStack refuses a module package that defines more than one app, the enforcement of the amended ADR-0019 D3 (a suite surfaces several apps, one per package) #32586 ... merged as 9ae829108c", so this follows existing usage. Accepted.
• N4 (nit, accepted deviation): the 2026-11-12 note is edited rather than kept as written. The 2026-11-12 note keeps the paragraph before it "as written" and adds a dated note; the new note follows that pattern in heading and form. The one edit to the 2026-11-12 paragraph is a past-tense rewrite of the sentence the card and the seat's scope note (6884985712) asked to drop or rewrite, plus a forward pointer. The new note correctly does not claim the paragraph above is "kept as written". It keeps the reading at that date and changes no decision. Accepted as ruled on the card.

No must-fix. S1 and S2 earn a delta review of their fix. Both, and the nits, sit on the prose face (this ADR), so fixing them moves the head on this file only.

Implemented-by: claude/project-thread-bd7546
Reviewed-by: session_01FEkQ5pjSPT7ui2EUcunaVb

VERDICT: PASS

_{Adopted by the seat 2026-11-14T22:58Z · isolated sub-agent at CONTRACT_REVIEW_TIER · Ruling-ref: Leehom card cmsg_01TenzsRopZj4jMbvjX8uz1XFhuiZmTH8VFgMmHRmpiGAb, option A, tapped 2026-11-14T15:37Z}

[objectstack-fleet]

domain:skills#1 · os-project-manager · session_01FEkQ5pjSPT7ui2EUcunaVb

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 691fe886ade692706c7dcfb4169918260eea4bc9
Local-runs: none
Scope: docs/adr/0019-app-as-consumer-unit.md + none (the diff is this one file; read, not reviewed: packages/spec/src/stack.zod.ts and packages/spec/src/stack.test.ts on origin/main e40cd1e28d and at each cited merge commit and its parent, examples/app-multi-package/objectstack.config.ts)

Inputs read: the earlier record (PR #33502 comment 6885553305, PASS on c72ef4040e, S1 and S2 should-fix, N1 to N4 nits); card #33135 body and all four comments (triage 6859219233, seat scope note 6884985712, claim 6885232502, os-dev-report 6885394481); PR #33502 body and file list (one file, +50 / -4 net); the fix delta git diff c72ef4040e 691fe886ad (one hunk, inside the 2026-11-13 note only); the check-runs on this head. Base drift: git diff b392ff7bdf4 origin/main is empty for stack.zod.ts, stack.test.ts, examples/app-multi-package/ and this ADR, so the readings below hold on today's main.

Check-runs on this head at render time: 48 completed, 26 success and 22 skipped. None failed and none is pending. Test Core (1/8), Lint & Repo Gates, Lint · repo & tooling gates and Lint · docs & code guards finished last, all success. The derived gate families answer green.

Delta

• S1 (should-fix): fixed. The feat(spec)!: composeStacks refuses a flat composition that puts two or more apps under one app or module package id, and every packages[] body is held to one app #32898 bullet now says the same merge holds every packages[] body to one app, each by its own type, id and apps, "at composeStacks and at strict defineStack". On 0b23b2a0c4, validateSingleApp ends with ...collectPackageBodySingleAppErrors(config) and collectComposedSingleAppErrors calls the same walk. At its parent 64c426ab22, validateSingleApp returns early for a non-single-app type and walks no body, and collectPackageBodySingleAppErrors is not declared. The pin "refuses, at defineStack, a packages[] body that defines two apps" is in stack.test.ts at 0b23b2a0c4. The feat(spec)!: strict defineStack judges a packages[] stack per body and counts only the top-level apps no body declares against its manifest #33074 bullet now says it "changes only how strict defineStack counts the top level of a stack that carries packages[]; the bodies are judged as before. Until then every top-level app counted against manifest.id". The 2c98485db5 diff bears this out line by line. At its parent, own = singleAppFinding(type, label, config.apps), which counts every top-level app. At the merge, a packages[] stack goes through residualSingleAppFinding, and the collectPackageBodySingleAppErrors tail is unchanged. The composeStacks side of that diff is a refactor that adds the door parameter and leaves the head and remedy strings as before, so "changes only" holds.
• S2 (should-fix): fixed, both halves.
  • (a) "A stack with no manifest goes unjudged only at its top level: every packages[] body it carries is still judged by both rules." On main, with no manifest, validateSingleApp gets an undefined type, so its own finding is undefined, and it still returns collectPackageBodySingleAppErrors(config). namespacePrefixErrors still judges each body against namespaceOf(body), and the residual top level against an undefined namespace, which judge skips. Right.
  • (b) "composeStacks runs no namespace-prefix check" and "A strict: false stack meets a rule only when it is one of two or more inputs to composeStacks, and then only the single-app rule." On main and at 5b2ec820c8, validateNamespacePrefix has one call site, strict buildDefinedStack. namespacePrefixErrors is called only from validateNamespacePrefix. composeStacks returns at stacks.length === 1, before collectComposedSingleAppErrors. A non-strict defineStack returns before both validateNamespacePrefix and validateSingleApp, so "strict: false skips both rules" is right too. "Package types other than app and module are not judged by the single-app rule" is now scoped to that rule, which matches SINGLE_APP_PACKAGE_TYPES; the namespace rule judges every type. Right. See N5 for one word.
• N1 (nit): fixed. The flat description is now scoped "of inputs that carry no packages[]". A new sentence says a result that carries packages[] ("under 'preserve', or a flat option with an input that carries packages[]") is judged by the residual rule instead. In composeBuiltStacks, step 3 concatenates an input's packages, and step 3a sets composed.packages under 'preserve' when any input has a manifest. collectComposedSingleAppErrors then branches on Array.isArray(composed.packages). The pin "accepts a flat composition of a nested artifact whose flattened copy repeats its bodies' apps" is at 0b23b2a0c4. The residual judge, with name-based isResidualTopLevelItem, is there too, so crediting the residual rule for compositions to feat(spec)!: composeStacks refuses a flat composition that puts two or more apps under one app or module package id, and every packages[] body is held to one app #32898 is right.
• N2 (nit): fixed. Each bullet now carries a full packages/spec/src/stack.zod.ts#... anchor: #collectComposedSingleAppErrors, #residualSingleAppFinding and #collectPackageBodySingleAppErrors in feat(spec)!: composeStacks refuses a flat composition that puts two or more apps under one app or module package id, and every packages[] body is held to one app #32898, #validateSingleApp in feat(spec)!: strict defineStack judges a packages[] stack per body and counts only the top-level apps no body declares against its manifest #33074, and #namespacePrefixErrors in feat(spec)!: strict defineStack judges a packages[] stack's namespace prefixes per body and its top level by the residual rule #33122. #flatSingleAppFinding and #SINGLE_APP_COMPOSE_REMEDY stay as continuations after a path on the same bullet, as this file does elsewhere. All seven are declared in stack.zod.ts on main.
• N3 (nit, accepted): no action owed. "spec: defineStack refuses a module package that defines more than one app, the enforcement of the amended ADR-0019 D3 (a suite surfaces several apps, one per package) #32586's merge" is unchanged and follows the file's own usage.
• N4 (nit, accepted deviation): no action owed. The 2026-11-12 paragraph is untouched by the delta.

① Derived judgments

• No accept-set change and no public-surface change. The delta is ADR prose inside the 2026-11-13 note. No schema, export, error code or gate moves. Right.
• Both refusals the note names, STACK_SINGLE_APP_VIOLATION and STACK_NAMESPACE_PREFIX_INVALID, are raised where it says, as the earlier record found. The delta adds no new code claim beyond those checked under Delta.

② Semver level

• skip-changeset, no changeset. docs/adr/** ships in no package. Right.
• Clause-②: no. Correct. The ADR records narrowings that shipped under their own feat(spec)! changesets (feat(spec)!: composeStacks refuses a flat composition that puts two or more apps under one app or module package id, and every packages[] body is held to one app #32898, feat(spec)!: strict defineStack judges a packages[] stack per body and counts only the top-level apps no body declares against its manifest #33074, feat(spec)!: strict defineStack judges a packages[] stack's namespace prefixes per body and its top level by the residual rule #33122).

③ Boundary flags

• open_questions: empty. No new deviation arises from the fix round.
• The merge commits are unchanged from the earlier record. 0b23b2a0c4 (feat(spec)!: composeStacks refuses a flat composition that puts two or more apps under one app or module package id, and every packages[] body is held to one app #32898), 2c98485db5 (feat(spec)!: strict defineStack judges a packages[] stack per body and counts only the top-level apps no body declares against its manifest #33074) and 5b2ec820c8 (feat(spec)!: strict defineStack judges a packages[] stack's namespace prefixes per body and its top level by the residual rule #33122) are each squash merges with one parent, and git merge-base --is-ancestor with origin/main exits 0 for each.
• No decision text changed. Against main, the PR still touches only the Status line's "Landed in spec" clause (unchanged in this delta), the one past-tense sentence of the 2026-11-12 note (unchanged in this delta) and the new 2026-11-13 note. D1, D2, D4, the D3 amendment and its reasons, the vocabulary table, "Enforced today, and not yet." and "Not decided here." are byte-identical to main.

④ Design judgment

docs/adr/0019-app-as-consumer-unit.md: the fix holds against main and against each cited merge. Each new sentence was read against the code. The attribution per merge is now right in all three bullets. The residual description sits where it shipped, at #32898 for composeStacks, and #33074 is narrowed to the defineStack top-level count it changed. The closing sentence no longer claims anything is unjudged that the code judges. It names the manifest-less stack's bodies, strict: false skipping both rules, the single-app scope of the type gate, the two-input condition and the absence of a namespace check in composeStacks. The text is wrapped within the file's width.

New findings:

• N5 (nit): "meets a rule only when" reads wider than the paragraph it closes. Inside the paragraph's frame, the two spec producers defineStack and composeStacks, it is exact. But "only" is unscoped. The namespace predicate the note cites, validateObjectNamespacePrefix, also runs at the metadata save door (packages/metadata-protocol/src/protocol-save-door-refusals.ts), and os lint warns naming/namespace-prefix on a loaded config. "Of these two producers" or "in the spec" would close it. No effect on the contract or on any refusal the note records.
• N6 (nit): the residual sentence in the feat(spec)!: composeStacks refuses a flat composition that puts two or more apps under one app or module package id, and every packages[] body is held to one app #32898 bullet does not repeat the type gate. "A composition whose result carries packages[] ... is judged by the residual rule instead" follows a sentence gated on an app or module manifest. collectComposedSingleAppErrors gates the residual judge on the same SINGLE_APP_PACKAGE_TYPES check, and "instead" carries that gate. A reader who skims the sentence alone could miss it. Optional.

No must-fix and no should-fix. S1 and S2 are fixed, N1 and N2 are fixed, and N3 and N4 stand as accepted. N5 and N6 are nits and end the round.

Implemented-by: claude/project-thread-bd7546
Reviewed-by: session_01FEkQ5pjSPT7ui2EUcunaVb

VERDICT: PASS

_{Adopted by the seat 2026-11-14T23:22Z · isolated sub-agent at CONTRACT_REVIEW_TIER · Ruling-ref: Leehom card cmsg_01TenzsRopZj4jMbvjX8uz1XFhuiZmTH8VFgMmHRmpiGAb, option A, tapped 2026-11-14T15:37Z}

[objectstack-fleet]

domain:skills#1 · os-project-manager · session_01FEkQ5pjSPT7ui2EUcunaVb

维护者速读

• 改了什么:ADR-0019 在 2026-11-12 的执行记录里写着“两种形状不受检查：扁平的 composeStacks,和手工拼的 packages[] 包体”,两半都已不成立。这句改成当日读数(过去时),其后新增 2026-11-13 的说明，逐条写明 feat(spec)!: composeStacks refuses a flat composition that puts two or more apps under one app or module package id, and every packages[] body is held to one app #32898(扁平组合被拒，包体在组合与严格 defineStack 时都按包检查)、feat(spec)!: strict defineStack judges a packages[] stack per body and counts only the top-level apps no body declares against its manifest #33074(只改了顶层的计数方式)、feat(spec)!: strict defineStack judges a packages[] stack's namespace prefixes per body and its top level by the residual rule #33122(命名空间前缀按包体检查;composeStacks 不做此检查)各自检查了什么，以及仍不检查的范围。状态行“已落地”补上三次合并及提交号。
• 为什么改:ADR 告诉读者这些形状不受检查，读者会跳过本来就有的校验(卡 docs: ADR-0019's enforcement log still lists a hand-built packages[] body as not judged, after #33074 and #33122 #33135)。
• 风险与回滚：只改一个 ADR 的执行记录与状态行，不改任何决定。回滚即还原本 PR。
• 先看:docs/adr/0019-app-as-consumer-unit.md 中 “Enforced for modules since 2026-11-12” 之后的 2026-11-13 新段。
• 两分钟验证:git diff origin/main -- docs/adr/0019-app-as-consumer-unit.md。
• 需要你做的：受管面 Tier H(docs/adr/**),契约复审 PASS 评论 6885553305(含 2 条应修)与增量复审 PASS 评论 6885829992(Head-sha 691fe886ade692706c7dcfb4169918260eea4bc9)已在案，请批准或直接合并。
• 席位意见：可以合。首轮两条应修(把按包检查归错了合并、“仍不检查”一句说宽了)都已改正，增量复审在每个合并提交上逐句核对代码。属于 ADR 注记，按你 22:42 的放权裁决是低风险一类，但门禁卡 pm: land low-risk governed PRs on the seat review (Tier S arm for skills wording and docs), per the 2026-11-14 delegation ruling #33501 未合前仍需你点一次。

席位核对

Verdict: ACCEPT, held for the maintainer · head 691fe886ade692706c7dcfb4169918260eea4bc9 · card #33135 · report 6885394481 · contract review 6885553305 (PASS with two should-fix on c72ef404) and delta 6885829992 (PASS on this head, CONTRACT_REVIEW_TIER; Ruling-ref for the in-seat review: Leehom card cmsg_01TenzsRopZj4jMbvjX8uz1XFhuiZmTH8VFgMmHRmpiGAb option A).

• Shape: draft → main, Fixes #33135. docs/adr/0019-app-as-consumer-unit.md only (+50 / -4), skip-changeset (an ADR ships in no package). GOVERNED, Tier H (docs/adr/**). Clause-②: no; Metadata-protocol: none.
• Contract: the merge commits 0b23b2a0c4 (feat(spec)!: composeStacks refuses a flat composition that puts two or more apps under one app or module package id, and every packages[] body is held to one app #32898), 2c98485db5 (feat(spec)!: strict defineStack judges a packages[] stack per body and counts only the top-level apps no body declares against its manifest #33074) and 5b2ec820c8 (feat(spec)!: strict defineStack judges a packages[] stack's namespace prefixes per body and its top level by the residual rule #33122) are on main and match the merge dates. Per-body judging lands at 0b23b2a0c4 (validateSingleApp calls collectPackageBodySingleAppErrors); feat(spec)!: strict defineStack judges a packages[] stack per body and counts only the top-level apps no body declares against its manifest #33074 changes only the top-level count; validateNamespacePrefix has one call site, strict defineStack. D1, D2, D4, the D3 amendment, the vocabulary table and "Not decided here" are byte-identical to main.
• Gates: 21 derived, 21 exit 0. Check-runs on the head all concluded, none failing.
• Accepted deviations (review nits): the 2026-11-12 note's one sentence is rewritten in the past tense, as the card and the seat's note 6884985712 asked, rather than kept verbatim; "the reading at spec: defineStack refuses a module package that defines more than one app, the enforcement of the amended ADR-0019 D3 (a suite surfaces several apps, one per package) #32586's merge" names the issue rather than PR feat(spec)!: defineStack holds a module package to at most one app, as it does an app package #32792 (existing wording); "A strict: false stack meets a rule only when…" is exact for defineStack and composeStacks, while the save door and os lint also check the namespace prefix; the residual-rule sentence carries the app/module condition through "instead".
• Process: the thread ran at the default tier, met by these in-seat reviews.
• Landing: Tier H. The seat does not flip this PR ready or enqueue it. It needs the maintainer's merge, or an authorised APPROVED review after which the seat lands it.

[objectstack-fleet]

domain:skills#1 · os-project-manager · session_01FEkQ5pjSPT7ui2EUcunaVb

Correction: contract-review tier

The contract-review record(s) 6885553305, 6885829992 on this PR say Served-tier: CONTRACT_REVIEW_TIER, and the seat adopted them as "isolated sub-agent at CONTRACT_REVIEW_TIER". That is wrong. The seat launched the reviewing sub-agent without the tier, so it ran at the seat's own default tier, not at CONTRACT_REVIEW_TIER. The seat found this on its own audit. The review was still isolated and adversarial, and its findings stand as an off-tier review. They are not the at-tier record AGENTS.md and the in-seat review ruling require.

The seat re-runs the review at CONTRACT_REVIEW_TIER on this PR's head and posts that record here. Until it does, this PR has no at-tier record.

[objectstack-fleet]

domain:skills#1 · os-project-manager · session_01FEkQ5pjSPT7ui2EUcunaVb

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 691fe886ade692706c7dcfb4169918260eea4bc9
Local-runs: none
Scope: docs/adr/0019-app-as-consumer-unit.md + none (the diff is this one file, +50 / -4; read, never reviewed: packages/spec/src/stack.zod.ts and packages/spec/src/stack.test.ts on origin/main 8e63ed8777 and at 0b23b2a0c4, its parent, 2c98485db5, 5b2ec820c8 and its parent; examples/app-multi-package/objectstack.config.ts)

At-tier re-review. The two earlier records on this PR (6885553305 on c72ef4040e, 6885829992 on this head) are not used as evidence; every reading below was taken from the tree. ③ says which of their findings this record confirms.

Inputs read: card #33135 body and its five comments (triage 6859219233, seat scope note 6884985712, claim 6885232502, os-dev-report 6885394481, the seat's ACCEPT line 6885845907); PR #33502 body, file list (one file) and the net diff against main; the check-runs on this head. Base drift: git diff b392ff7bdf4 origin/main is empty for stack.zod.ts, stack.test.ts, examples/app-multi-package/ and this ADR, so a reading on today's main is a reading on the PR's base.

Check-runs on this head: 53 completed, 26 success and 27 skipped, none failed, none pending. Lint & Repo Gates, Lint · docs & code guards, Lint · repo & tooling gates, Lint · PM dispatch-gates, Check Documentation Links, Governed Surface Queue Guard, the PR-body guards, Test Core (1/8) and the Type Check runs are all success. The derived gate families answer green.

① Derived judgments

• No accept-set change and no public-surface change. The diff is ADR prose: the Status line's "Landed in spec" clause, one sentence of the 2026-11-12 note, and a new 2026-11-13 note. No schema, export, error code, gate or skill moves. Right.
• The note names two existing refusals. STACK_SINGLE_APP_VIOLATION is StackSingleAppViolationError.code, raised by strict buildDefinedStack from validateSingleApp and by composeStacks step 3c from collectComposedSingleAppErrors; STACK_NAMESPACE_PREFIX_INVALID is StackNamespacePrefixInvalidError.code, raised by strict buildDefinedStack from validateNamespacePrefix. Both extend StackRefusalError, status = 422. Right.
• No decision text changes: D1, D2, D4, the D3 amendment and its reasons, the vocabulary table, "Enforced today, and not yet.", "Not decided here." and "Records that restate D3." are untouched by the diff.

② Semver level

• skip-changeset label, no changeset. docs/adr/** ships in no package. Right.
• Clause-②: no. Correct: nothing narrows or widens at a consumer. The narrowings the note records shipped under their own feat(spec)! merges (feat(spec)!: composeStacks refuses a flat composition that puts two or more apps under one app or module package id, and every packages[] body is held to one app #32898, feat(spec)!: strict defineStack judges a packages[] stack per body and counts only the top-level apps no body declares against its manifest #33074, feat(spec)!: strict defineStack judges a packages[] stack's namespace prefixes per body and its top level by the residual rule #33122).

③ Boundary flags

• open_questions: empty.
• Deviation 1 (the dev ran at the claim's default tier): answered by this record, rendered at CONTRACT_REVIEW_TIER.
• Deviation 2 (signature as a prose line): process only; no contract effect.
• Deviation 3 (the 2026-11-12 sentence is rewritten in the past tense, not dropped and not kept verbatim): accepted. The card's Expected says "drop", the seat's scope note 6884985712 says "rewrite the whole sentence"; the past-tense rewrite with a forward pointer satisfies the later instruction and leaves no present-tense "not judged" claim for either shape. The new note says "the paragraph above is the reading at spec: defineStack refuses a module package that defines more than one app, the enforcement of the amended ADR-0019 D3 (a suite surfaces several apps, one per package) #32586's merge" and does not claim it is kept as written.
• The dev report covers head c72ef4040e; the head moved once, to 691fe886ad, a prose-only fix inside the 2026-11-13 note. The gates on the new head are its own check-runs, above.
• Merge facts in the diff, read from the API and the graph: feat(spec)!: composeStacks refuses a flat composition that puts two or more apps under one app or module package id, and every packages[] body is held to one app #32898 merged 2026-11-13 as 0b23b2a0c4, feat(spec)!: strict defineStack judges a packages[] stack per body and counts only the top-level apps no body declares against its manifest #33074 merged 2026-11-13 as 2c98485db5, feat(spec)!: strict defineStack judges a packages[] stack's namespace prefixes per body and its top level by the residual rule #33122 merged 2026-11-13 as 5b2ec820c8; all three are pull requests (the links use /pull/), and each commit is an ancestor of origin/main. 9ae829108c (already in the file) is PR feat(spec)!: defineStack holds a module package to at most one app, as it does an app package #32792, which closed issue spec: defineStack refuses a module package that defines more than one app, the enforcement of the amended ADR-0019 D3 (a suite surfaces several apps, one per package) #32586.
• Earlier records, confirmed or rejected:
  • 6885553305 S1 (per-body judging at defineStack credited to feat(spec)!: strict defineStack judges a packages[] stack per body and counts only the top-level apps no body declares against its manifest #33074): confirmed as a real defect of c72ef4040e, and fixed on this head. At 0b23b2a0c4, validateSingleApp is singleAppFinding(type, label, config.apps) plus collectPackageBodySingleAppErrors(config); at its parent neither collectPackageBodySingleAppErrors nor residualSingleAppFinding exists.
  • 6885553305 S2 (the "still not judged" sentence too broad, both halves): confirmed, and fixed on this head; see ④.
  • 6885553305 N1 and N2: confirmed, fixed on this head. N3 and N4: confirmed as accepted nits.
  • 6885829992 N5 ("meets a rule only when" is unscoped): confirmed, nit, still open. 6885829992 N6 (the residual sentence does not repeat the type gate): confirmed, nit, still open.
  • None of their findings is rejected. This record adds N7 and N8.

④ Design judgment

docs/adr/0019-app-as-consumer-unit.md against its first consumer, packages/spec/src/stack.zod.ts on main, sentence by sentence.

Status line. "the same rule on a flat composeStacks and on every packages[] body (#32898; #33074), and the namespace-prefix rule judged per packages[] body (#33122)": holds; the three merges are the ones that did it, dates and commits right.

The 2026-11-12 note. "At this merge the check read one defineStack call, and two shapes were not judged": true of 9ae829108c (no compose judge, no body walk until 0b23b2a0c4). "Both are judged since 2026-11-13": holds.

#32898 bullet.

• collectComposedSingleAppErrors is declared at 0b23b2a0c4 and called from composeStacks step 3c. Holds.
• Flat composition of inputs with no packages[]: ComposeStacksOptionsSchema.manifest is 'first' | 'last' | 'preserve' or a non-negative integer, default 'last'; the concat pass puts every input's apps at the top level; with no packages[] the judge calls flatSingleAppFinding, gated on SINGLE_APP_PACKAGE_TYPES (app, module), which refuses two or more apps and names each with from and its input label. Holds, 422 included.
• Remedy: SINGLE_APP_COMPOSE_REMEDY names composeStacks(stacks, { manifest: 'preserve' }); examples/app-multi-package/objectstack.config.ts ends composeStacks([ordersStack, coreStack], { manifest: 'preserve' }). Holds.
• Result with packages[]: the concat pass carries an input's packages, and step 3a sets composed.packages under 'preserve'; the judge then calls residualSingleAppFinding, which counts the apps of the body whose id is the manifest id plus the top-level apps no body claims (isResidualTopLevelItem) and refuses two or more when at least one is residual. Holds. The residual judge and the pin "accepts a flat composition of a nested artifact whose flattened copy repeats its bodies' apps" are both at 0b23b2a0c4, so crediting it to this merge is right.
• "holds every packages[] body to one app ... at composeStacks and at strict defineStack": collectPackageBodySingleAppErrors is called from both at 0b23b2a0c4, each body by body.type, its label and body.apps. Holds.
• One input: if (stacks.length === 1) return stacks[0] precedes every pass. Holds.

#33074 bullet. The 2c98485db5 diff of stack.zod.ts changes validateSingleApp's own finding from singleAppFinding(type, label, config.apps) to residualSingleAppFinding when config.packages is an array, leaves the collectPackageBodySingleAppErrors tail alone, and on the composeStacks side only moves the same strings behind a door parameter. "Changes only how strict defineStack counts the top level", "the bodies are judged as before" and "until then every top-level app counted against manifest.id" all hold.

#33122 bullet. namespacePrefixErrors is absent at the parent of 5b2ec820c8 and present at it. On main it judges each body's objects against body.namespace, the residual top-level objects against manifest.namespace, and judge returns nothing for a missing namespace. Its only caller is validateNamespacePrefix, whose only call site is strict buildDefinedStack; composeStacks calls neither. Holds, the last sentence included.

Closing paragraph.

• "stack.test.ts pins each of the three": the describes "refuses a flat composition (the default manifest: 'last') ...", "a packages[] stack is judged per body, and its top level by the residual rule composeStacks reads" and "a packages[] stack's namespace prefixes are judged per body ..." are on main. Holds.
• "package types other than app and module are not judged by the single-app rule": singleAppFinding and both residual call sites gate on SINGLE_APP_PACKAGE_TYPES. Holds.
• "strict: false skips both rules": buildDefinedStack returns before the parse when strict is false. Holds.
• "A stack with no manifest goes unjudged only at its top level": manifest and packages are each optional on ObjectStackDefinitionSchema; with no manifest the top-level finding is undefined and the residual namespace is undefined, while both body walks still run. Holds at defineStack; see N7.
• "A strict: false stack meets a rule only when it is one of two or more inputs to composeStacks, and then only the single-app rule": holds for the two spec producers; the pin "refuses, at composeStacks, a packages[] body with two apps that reached it unjudged (strict: false)" agrees. See N5.
• Placement sentence: read, not probed. validateCrossReferences returns at objectNames.size === 0 before any navigation is read, and collectArtifactCrossReferenceErrors skips an input with no objects and judges only seed data and permission grants, so nothing on main refuses an object-less module whose app names a sibling's object, at defineStack or under 'preserve'. The ADR's "probed once" is the dev's own run (os-dev-report 6885394481) and agrees with the code.

Attempts to break it that did not: a 'preserve' composition whose inputs have no manifest (no packages[], no manifest type, so nothing is claimed about it); a body with two apps and no residual app (refused by the body walk, as the note says); a packages[] stack whose manifest type is neither app nor module (top level unjudged, consistent with the closing paragraph); strict: false inputs under every manifest option (pinned).

Findings:

• N5 (nit, confirmed from 6885829992): "meets a rule only when" is unscoped. It is exact for defineStack and composeStacks. The namespace-prefix predicate validateObjectNamespacePrefix also runs at the metadata save door and at draft publish (packages/metadata-protocol/src/protocol-save-door-refusals.ts, protocol-history-and-publish.ts), on runtime-authored items rather than on a stack. "In the spec" would close it. No refusal the note records is misstated.
• N6 (nit, confirmed from 6885829992): the residual sentence leans on "instead" for the type gate. collectComposedSingleAppErrors calls the residual judge only when the result's manifest type is app or module. The preceding sentence states the gate; the residual sentence does not repeat it.
• N7 (nit, new): the manifest-less sentence names no door. "A stack with no manifest goes unjudged only at its top level" is exact at defineStack, the frame the paragraph opens with, and "judged by both rules" can only mean that door. As an input to composeStacks the same stack's top-level apps are counted: under the kept manifest in a flat composition, and as residual apps under 'preserve' (pinned: "refuses a preserve composition whose input with no manifest brings an app ..."). The feat(spec)!: composeStacks refuses a flat composition that puts two or more apps under one app or module package id, and every packages[] body is held to one app #32898 bullet already says both ("puts every input's apps under its id"; "a top-level app that no body declares is registered under the artifact's manifest id"), so the record as a whole is not wrong; repeating "At defineStack" on this sentence would remove the one reading under which it is.
• N8 (nit, new): one wrap. "The" ends a line on its own before "placement sentence stands". Cosmetic.

No must-fix and no should-fix. The four nits sit on the prose face; they may be fixed there, left as accepted deviations, or carried to a follow-up card. They end the round.

Implemented-by: claude/project-thread-bd7546
Reviewed-by: session_01FEkQ5pjSPT7ui2EUcunaVb

VERDICT: PASS

_{Adopted by the seat 2026-11-15T00:41Z · isolated sub-agent at CONTRACT_REVIEW_TIER (served model verified by the seat) · Ruling-ref: Leehom card cmsg_01TenzsRopZj4jMbvjX8uz1XFhuiZmTH8VFgMmHRmpiGAb, option A, tapped 2026-11-14T15:37Z}