test(cli): hold field-level and action-param object references in agreement on the per-package leg

[os-elon-musk]

Fixes #18204

Part of #14122 — the ADR-0130 tracker stays open; nothing here is a closing keyword for it.

Headline: the reported defect does not reproduce on main — the missing thing was the pin

The card reports that os build's per-package author-time leg refuses an action param's
record-picker reference into a dependency's object while the composed pass accepts it, and
while ADR-0130 R1 accepts the field-level equivalent. Measured on this tree, both levels agree
and have since #16611: the per-package leg resolves the sibling's object at the field level AND
at the action-param level, and still refuses a name no package of the artifact provides.

What DOES reproduce the card, exactly, is the published @objectstack/cli@17.4.0 that the
downstream repro builds against. Read out of that installed tarball:

// node_modules/@objectstack/cli/dist/commands/compile.js  (17.4.0, as installed downstream)
function packageBodyAsStack(body) {
    return { ...body, manifest: body };      // no resolution context at all
}

and its @objectstack/lint@17.4.0 carries neither artifactProvidedObjectNames nor the field
reference site. That is the whole asymmetry the card saw: at that release the action-param
site is judged against one package's own objects (refused), while the field site is not judged
at all (so it looks accepted). Both halves moved in #16611. The downstream fix is a pin bump,
not a change here.

So this PR changes no behaviour. It adds the pin the card asks for — "the refusal must move,
not disappear, and a fixture must prove it" — at the level the card is about.

Measurements

All on examples/app-multi-package (a real two-package artifact: module orders depends on
app core, which owns crm_account), through the real objectstack build:

fixture	reading
unmodified example	exit 0
module action param reference: 'crm_account' (app package's object)	exit 0 — the per-package leg ran and reported nothing
the same param pointed at crm_contract (no package provides it)	exit 1, object-reference-unknown at objects[0].actions[0].params[0].reference

The example edits were a throwaway probe and are not in this diff (restored; git diff HEAD
empty).

What the two new pins hold

• packages/cli/src/utils/artifact-packages.test.ts (new, queue tier) — the real
  artifactPackages + packageBodyAsStack + the real rule. One equality carries four
  verdicts: crm_account absent at BOTH levels (resolved through packages[]), the two
  dangling names present at BOTH levels (the refusal moved, it did not disappear). A CONTROL
  leg with no context reports all four, so the pin can fail.
• packages/cli/test/build-multi-package-artifact.e2e.test.ts — the existing end-to-end case
  for the same seam gains the action-param level, so the same four verdicts are also read
  through the real command.

Why both: the lint-side rule test runs against a local REPLICA of packageBodyAsStack's output
and stays green if the CLI stops producing that shape; the end-to-end file carries the .e2e
name, so OS_TEST_TIERS puts it in the NIGHTLY population and the merge queue never runs it.
The new file is the queue-tier half.

Ablation — the pins fail when the wiring is removed

Mutating packageBodyAsStack back to the 17.4.0 shape ({ ...body, manifest: body }), on-disk
mutation proved by text counts (removed-text 1 to 0, injected-text 1) and by blob hash
(febc6ad4 to 9b4019eb):

ABLATION unit exit=1
ABLATION e2e exit=1

both failing with the same diff — the two crm_account / probe_account paths appearing,
including objects[0].actions[0].params[0].reference, which IS the card's symptom reproduced
on this tree. Restored from HEAD: git diff HEAD empty, blob back to febc6ad4.

Tests and gates

• pnpm --filter @objectstack/cli exec vitest run --project unit — 207 files, 2962 tests, all
  pass (the new file included).
• OS_TEST_TIERS=nightly ... --project integration build-multi-package-artifact — 7 pass. Run
  because the diff touches an integration-layer file.
• pnpm --filter @objectstack/cli typecheck — exit 0.
• pnpm lint (eslint . --no-inline-config, repo-wide, not narrowed) — exit 0 over 6754 files
  at 1a4624be8.
• node scripts/pm/dispatch-gates.mjs --commands derived 57 families; 55 run green, 2 recorded
  exit 3 (PREREQUISITE NOT MET — check:dual-build-cjs-loads and check:i18n-coverage both
  need a full-tree build; this worktree built only the CLI closure). Reconciled with --ran:
  57 derived, 57 accounted, 0 UNRUN. One further self-test, check-plugin-teardown-shape --self-test, exits 1 on this container because the clone is shallow and it cannot reach its
  pinned fixture commit — its tree-judging leg passes.

Changeset

skip-changeset, measured rather than assumed: packages/cli publishes files: ["dist", "README.md", "CHANGELOG.md"], the diff is two test files, and neither name appears anywhere
under packages/cli/dist after a build, while the positive control (packageBodyAsStack)
does. Nothing published moves. The dispatch asked for a patch entry describing what the
per-package pass now accepts; that sentence would be false — it has accepted it since #16611,
whose own changeset carried it.

Clause 2

The claim on the card declares Clause-2: yes on the expectation that the fix widens the
acceptance set. The measurement falsifies that premise for this PR: the accept-set is
byte-identical before and after. needs:contract-review is attached anyway, per the claim, so
the contract seat can re-grade rather than have the label quietly dropped by the executor.

Acceptance notes

Observed while measuring, not filed and not fixed here:

• compile.ts holds two adjacent variables for the same noun — artifactPackageEntries (the
  raw packages[], which is the resolution context the rule reads) and packageEntries (the
  { index, id, body } view). packageBodyAsStack's second parameter is typed unknown, so
  passing the wrong one type-checks and silently restores exactly this refusal. The end-to-end
  and queue-tier pins above now catch it; the type does not. Carrier: whoever next refactors
  that block.
• objectExtensions[].fields[].reference is a third level with a third verdict — not judged at
  all, deliberately and documented in validate-object-references.ts, whose header names the
  cross-artifact case as its own card. Reported per the dispatch's ruling 2 rather than widened
  into.
• os validate runs the union pass only, so it has no per-package leg to disagree with;
  os lint's per-package leg passes the same raw packages[] this one does; os dev spawns
  compile. No fourth verdict found.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json af3add1601d691e67478abbe42fa9fa413494107 → packageMentionDocs.

[os-elon-musk]

pm-note (⛔ not a contract-review record — no Served-tier: line, no verdict; this is a measurement left for whoever renders one)

CI is complete and clean on this head

1a4624be8 — 42 check-runs: 31 success, 11 skipped, 0 pending, 0 failing; mergeable_state: clean. The PR stays draft under needs:contract-review.

The re-grade this PR asks for, and the one reading that does NOT settle it

The claim declared Clause-②: yes; the report's deviation ⑤ says the accept set is byte-identical and asks the contract seat to re-grade rather than have an executor quietly drop the label. That disposition was ACCEPTed. One measurement, so the next reader does not repeat it and does not misread it:

$ node scripts/pm/check-widening-tells.mjs --declaration no --diff <this PR's diff>
✓ 2 changed file(s) — 0 judged against a declared surface (no widening tell), 2 NOT MEASURED.
  ⛔ NOTHING on this diff was examined for widening tells, so this exit 0 is evidence
     about no surface at all.
    no declared surface covers it (2):
      packages/cli/src/utils/artifact-packages.test.ts
      packages/cli/test/build-multi-package-artifact.e2e.test.ts
EXIT=0

⚠️ That exit 0 is not a clearance, and the tool says so itself. Both files are tests, so no declared surface covers them and no tell could have fired whatever they contained. Anyone citing this exit 0 as "no widening" would be citing an unexamined surface.

What DOES support the re-grade is the file list, not the tell gate: the diff is two test files and nothing else (+146 new, +56/-11), no production code, so there is no published surface for it to widen. That is a reading a reviewer can check in one look, and it is the one the record should rest on.

Pre-landing check ② — measured, so it is not re-derived

$ node scripts/pm/check-clause2-carriers.mjs --pair 18213   # exit captured before any pipe
18213 :: exit 4

⚠️ That 4 is the epic residual and is ruled NOT blocking. The target pair is clean in the script's own words — "PR #18213 / card #18204 — the clause-② declaration is readable in the fixed spelling and both carriers agree". The 4 comes only from a second pair derived against the epic tracker #14122, because this PR's body carries Part of #14122. PM ruling, recorded on #18204: a card named only by Part of and identifiable as a tracker is not a clause-② carrier. ⛔ #14122 gets no review label. Mechanism card: #18214, now with four independent measurements — both devs on their own PRs, plus this seat on #18212 and #18213.

⚠️ A reviewer must still check by hand what the script itself flags: the C2-SIBLING row asserts only where the declaration lives, never that the sibling's reading covers this card's half of the increment.

Why this seat is not rendering the review itself

The ACCEPT verdict on #18204 put this PR's clause-② re-grade with the contract seat, and this seat is not going to quietly reverse that the same afternoon by rendering the record itself. Noting the staffing fact plainly, since it is what the wait actually depends on: the domain:cli PM seat card (#6024) reads VACANT, and domain:spec (#6017) reads off-shift since ~15:3xZ.

⛔ No carrier stripped, no ready flip, no queue action taken here.

---

Generated by Claude Code

[os-elon-musk]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 1a4624be8bea7ad46187c241708d38e43baf77ad

① Derived judgments

1. Accept set: unchanged — the PR's claim is TRUE, and it was re-derived rather than taken from the PR. git diff --name-status from the merge base d4554d4f5 to the head lists exactly two paths: A packages/cli/src/utils/artifact-packages.test.ts (+146) and M packages/cli/test/build-multi-package-artifact.e2e.test.ts (+56/−11); the API file list agrees (2 files, +202/−11). Every file a rule reads on this seam carries the same blob id at the merge base, at origin/main (1bdbf82cb, five commits ahead of the merge base) and at the head: artifact-packages.ts febc6ad4, validate-object-references.ts 9a0969e4, compile.ts e0cf9352, lint.ts 5c0e752d. Nothing the two os build legs judge against moves by one byte.

2. Public surface: unchanged — a test-only diff cannot widen the published contract of this package, and here that is measured, not argued. packages/cli/package.json publishes files: ["dist", "README.md", "CHANGELOG.md"]; tsconfig.build.json compiles include: ["src"] with src/**/*.test.ts excluded, and test/** is outside include altogether. After building the head, zero files under packages/cli/dist name either test file, while the positive control packageBodyAsStack lands in five (utils/artifact-packages.js, commands/compile.js, commands/lint.js, utils/nav-contribution-groups.js, artifact-packages.d.ts). The exports map (., ./console, ./hook-body, ./package.json) reaches neither file. No consumer can observe this diff. The only surface it grows is CI-internal: one more file in the queue-tier population, one more case in the nightly one.

3. The premise the claim's Clause-②: yes rests on is FALSE on this tree — verified three ways, none of them the PR's own reading. (a) Source: origin/main:packages/lint/src/validate-object-references.ts defines artifactProvidedObjectNames at line 162 and folds it into rung ① at line 209; origin/main:packages/cli/src/utils/artifact-packages.ts returns { ...body, manifest: body, packages: artifactPackageEntries } and compile.ts:410 passes artifactPackageEntries. Landed by f89dd33cc (PR fix(cli, lint): gate a dangling lookup/master_detail reference, and resolve one across the artifact packages[] #17066, 2026-09-09 13:51Z) with .changeset/lookup-reference-target-gate.md, which is still pending on origin/main. (b) Release tag: @objectstack/cli@17.4.0 points at 7e6337007 (2026-09-09 03:18Z); f89dd33cc is not an ancestor of it. At that commit the lint file has zero occurrences of the symbol, compile.ts:99 reads function packageBodyAsStack(body) with no context parameter, and src/utils/artifact-packages.ts does not exist. (c) Published tarballs: the downstream install (hotcrm/node_modules, node-linker=hoisted, lockfile entry @objectstack/cli@17.4.0 integrity sha512-w1enDe…) carries dist/commands/compile.js:64-66 as packageBodyAsStack(body) { return { ...body, manifest: body }; }, and @objectstack/lint@17.4.0's dist/index.js has zero hits for artifactProvidedObjectNames; its validateObjectReferences resolves against ownObjects alone and walks params[pi].reference / objectOverride but no field reference at all. That is exactly the card's asymmetry — action-param site judged against one package, field site not judged — and it is a property of the 17.4.0 release line, not of main. Downstream remedy: pin bump to a release carrying f89dd33cc; nothing here.

4. Re-grade: Clause-②: no for this PR — the declaration was a conservative pre-measurement call, and the measurement reverses it. Clause ② gates a diff that changes accept/reject behaviour or widens a published surface; judgments 1–2 show this diff does neither. Two further readings bear on the re-grade: check-widening-tells.mjs --declaration no over the PR diff exits 0 with 2 NOT MEASURED (no declared surface covers a test file), so that exit is evidence about nothing and is not what this re-grade rests on; and the repo's own changeset rule ("a PR that declares Clause-②: yes takes at least minor") would, if yes stood, demand a minor on a package whose published source this diff does not move — the yes and the correct skip-changeset cannot both hold. The Contract-text: citation clause for a no applies to a PR that removes a wrongful refusal; this PR removes nothing, so no citation is owed.

5. skip-changeset is the correct form. The rule reserves that label for a diff that publishes nothing from any released package — judgment 2 is that measurement. check-changeset-no-major.mjs's own self-test pins the same reading (packages/cli/test/x.test.ts grows no published surface). A patch entry saying the per-package pass now accepts a sibling's object would be a false release note: that sentence already sits, verbatim in substance, in the pending .changeset/lookup-reference-target-gate.md (@objectstack/lint: minor, @objectstack/cli: patch) that f89dd33cc carried, and the next release compiles it from there.

② Semver level

None — no changeset, skip-changeset attached, and that is the right disposition rather than a shortfall. No published byte of any released package moves (①.2), so there is no package to grade and no level to declare. The alternative offered — an empty-frontmatter changeset — is not a softer option but a CI red: check-empty-changeset.mjs rule 1 refuses a PR that ADDS an empty-frontmatter changeset, on the measured ground that such a file is a real input to changesets/action (it can stall a release, the #4898 shape) while producing no CHANGELOG line; the label produces no input at all. The dispatch's "changeset required (patch)" was written on the premise of a behaviour change; the premise fails (①.3) and the constraint falls with it. Check Changeset on this head reads success (plus two skipped re-runs) with the label present.

③ Boundary flags

Deviation 1 — no changeset, skip-changeset instead: acceptable. Judged at ② and ①.5.

Deviation 2 — no production code at all: acceptable, on the strength of ①.3 and of the ablations below. The ruling's two substantive demands — the refusal MOVES rather than disappears, and the two reference levels agree — hold on this tree and are now pinned at both levels. Measured on the head with each mutation proven on disk and restored from HEAD (tree clean, git diff HEAD empty, artifact-packages.ts back at febc6ad4):

ablation	queue-tier pin src/utils/artifact-packages.test.ts	nightly pin test/build-multi-package-artifact.e2e.test.ts
baseline, unmodified head	exit 0 (4/4)	exit 0 (7/7)
A1 — packageBodyAsStack back to the 17.4.0 shape ({ ...body, manifest: body }, blob 9b4019eb)	exit 1 — 2 failed; the equality receives all four paths, objects[0].actions[0].params[0].reference among them	exit 1 — 1 failed, same four-path diff
A2 — compile.ts:410 hands the WRONG variable (packageEntries, the { index, id, body } view)	exit 0 (4/4) — not caught	exit 1 — 1 failed, same diff
A3 — lint rule rung ① stops folding artifactProvidedObjectNames (ESM/CJS dist rebuilt with the ablation; DTS step fails TS6133 on the orphaned function, an artifact of the ablation, not a reading)	exit 1 — 1 failed, four-path diff	exit 1 — 1 failed

So the pins hold against the regression the card reports (A1) and against its lint-side half (A3), at both levels, in both tiers. One measured limit, and the PR body overstates it: the acceptance note claims "the end-to-end and queue-tier pins above now catch" a compile.ts refactor that passes the wrong variable. Only the nightly pin does (A2). The queue-tier pin asserts packageBodyAsStack with a context the TEST supplies, so a call-site regression in compile.ts lands green in the merge queue and is found the next morning — the same shape the header of the new file describes for the e2e case. This is a gap in coverage the PR ADDS to, not one it creates: before this PR the call site had no queue-tier pin either, and the e2e case already lived in the nightly population. Recorded as a finding for whoever next touches compile.ts step 3b-ii; ⛔ not a defect of this diff and not a reason to widen it here. One further reading on the same pin: @objectstack/lint is not aliased in packages/cli/vitest.config.ts, so the queue-tier pin reads the rule out of packages/lint/dist; turbo's test task depends on ^build, which is what keeps that dist current in CI. A3 was run through a rebuilt dist for that reason.

Deviation 3 — GitHub writes over REST with the token rather than the MCP write tools the dispatch named: outside this review's subject. Not a contract reading; reported, with reads and writes enumerated, rather than silently resolved. Nothing here to grade.

Deviation 4 — needs:contract-review hung on the card as well as the PR: acceptable and required. check-clause2-carriers.mjs row C1 refuses a split carrier in either direction. Read back: PR #18213 carries size/m, tests, skip-changeset, needs:contract-review; card #18204 carries bug, priority:p1, pm:dispatched, domain:cli, needs:contract-review. Both carriers present.

Deviation 5 — Clause-②: yes left standing for the contract seat to re-grade: acceptable in procedure, and the re-grade is rendered at ①.4 as no. An executor stripping a seat's declaration would have been the wrong order; leaving the label on and asking for the re-grade was the right one.

open_questions empty: consistent with the report — the one open item (below) was surfaced in gates rather than hidden, which is where it belongs.

Residual exit 4 from node scripts/pm/check-clause2-carriers.mjs --pair 18213 (exit code written to a file before any read): does not bear on this verdict, and the landing seat must carry the written ruling rather than a clean exit. The run's own words on the target pair: "PR #18213 / card #18204 — the clause-② declaration is readable in the fixed spelling and both carriers agree." The 4 comes solely from a second pair, #18213 / #14122, derived because the body's Part of #14122 line sits at the declaration position (deliveryEvidence returns part-of) and derivePairs states the evidence kind "is never a filter here". #14122 is the open ADR-0130 tracking card with no claim comment and no Clause-②: line; hanging a per-PR review gate on an epic that stays open across many PRs would leave a label nothing can ever clear, and the dev's refusal to do so was correct. Mechanism card #18214 is open (tooling, domain:devx, finding, priority:p3). Until it lands, --pair 18213 keeps returning 4 on that row; the pre-landing check ② reading for this PR is the PM ruling recorded on #18204 (the Part of-named epic tracker is not a clause-② carrier), and ⛔ #14122 receives no label.

CI on this head: 42 check-runs — 31 success, 11 skipped, 0 failing, 0 pending; all six required contexts (Lint & Repo Gates, TypeScript Type Check, Test Core, Dogfood Regression Gate, Build Core, Temporal Conformance (live PG + MySQL)) success; mergeable_state: clean. The head is five commits behind origin/main; the four production files on this seam are byte-identical across that gap (①.1), so the queue's rebuild onto current main changes nothing the pins read.

Implemented-by: claude/issue-18204-per-package-dependency-closure
Reviewed-by: session_01T3YsvpK1PvYf9n1YUhYP6W

VERDICT: PASS

---

Generated by Claude Code