fix(core,runtime,plugin-dev,plugin-security): refuse packages: null as malformed, never absent

[objectstack-fleet]

Fixes #19926
Clause-②: no (narrowing)

Executes ruling 5805260775 (letter A, class-1): packages: null on a release artifact is malformed and refused, never read as absent. ObjectStackDefinitionSchema.packages is z.array(ArtifactPackageSchema).optional(), and .optional() admits undefined, not null. The schema and composeStacks (two or more inputs) already refused null; every runtime reader read it as absent. The readers now follow the declaration. ⛔ The schema does not change, and no error code is added: null gets the envelope {}, 0 and 'x' already get, INVALID_ARTIFACT_PACKAGES / status: 422.

Per reader, before and after (packages: null)

reader	before	after
@objectstack/core resolveArtifactPackageOrder	[artifact] (the absent branch)	refused, INVALID_ARTIFACT_PACKAGES / 422
@objectstack/runtime resolveArtifactCollections	the argument, by identity	refused (the resolver's envelope)
@objectstack/plugin-dev stackDeclaresTranslations (via devI18nPluginOptions)	false	refused (the resolver's envelope)
@objectstack/plugin-security appSecurityPluginOptions	read the top level	refused (the resolver's envelope)
ObjectStackDefinitionSchema	refused, invalid_type	unchanged
composeStacks, two or more inputs	refused, STACK_SCHEMA_INVALID / 422	unchanged

Controls stay put at every reader: an absent packages (no key, or an explicit undefined) is still the single-package branch, by identity; an array is still read as its entries.

The ruling's three items, and where each landed

1. Readers. resolveArtifactPackageOrder drops its declared === null branch, so its @throws / header wording 「present but is not an array」 is now literally true. The runtime reader's guard and the plugin-dev guard are spelled exactly as the resolver's absent branch (undefined only), and they moved in the same commit. plugin-security has no guard of its own; it inherits the refusal, and its docblock no longer names a null absent branch. The core message names the value null instead of typeof null (which reads object).
2. Pins. null is refused at the schema (invalid_type at packages), at composeStacks with two inputs in both positions (STACK_SCHEMA_INVALID, 422, issue path packages), and at each reader (code + status), each beside its absent and array controls. The plugin-dev LOCKSTEP pin asks the private guard and resolveArtifactPackageOrder directly and asserts they return the same envelope on { packages: null } and agree on an absent key. That is the pin the PR fix(runtime): refuse a non-array packages in resolveArtifactCollections #19924 re-review asked for.
3. Spec rule text. The paragraph beside AssembledPackageBodySchema that carved null out ("the one value this rule does not settle") now names null as malformed. It is TSDoc only; the schema bytes are unchanged.

Pin sweep

git grep over every test for packages next to null found three pins asserting the old absent reading: packages/runtime/src/artifact-collections.test.ts, packages/plugins/plugin-dev/src/dev-i18n-packages-reader.test.ts and packages/plugins/plugin-security/src/app-default-permission-set.test.ts. All three are flipped in this PR. Each null row now asserts the refusal's substance (code and status); none of the flips just deletes an assertion. packages/lint/src/validate-object-references.test.ts also iterates null over packages. It pins the lint reader, which is sibling #20206's surface and is fenced out of this claim. It is not touched here.

Producer census (mechanism hypothesis H3)

No in-repo producer writes packages: null. The census covered examples/, fixtures, tests and generated artifacts, with packages followed by : and null, quoted or bare. The only hits were the three test pins above and the pending .changeset/15293-non-array-packages-refusal.md sentence below. os build / os validate refuse the value at the schema before any reader runs.

Clause-② — measured, and it differs from the claim's line

The claim reads Clause-②: no. Measured: the accept set of published exports narrows. resolveArtifactPackageOrder (@objectstack/core root export), devI18nPluginOptions (@objectstack/plugin-dev), appSecurityPluginOptions (@objectstack/plugin-security) and carriedPackageIds (@objectstack/runtime) all returned an answer for { packages: null } and now throw. So the line is no (narrowing): breaking, graded minor under the launch-window convention, in this body and in the changeset. The ADR-0087 disposition is not-required (no-migration-prescription). Nothing authorable moves, because the schema already refused the value. This follows the .changeset/18239-merge-objects-refusal.md precedent (a runtime narrowing on inputs that bypassed the parse). check-adr-0087-registration reads it green.

Deviations from the claim's file surface (declared, not silent)

• packages/spec/src/stack.zod.ts: the claim fences this file ("the schema already refuses null"). The edit is ruling item 3's rule text, and it is TSDoc only; the schema is unchanged, which is what the fence protects. Without it, the one statement of the rule that all four readers cite would still say the readers treat null as absent, and this PR would make that false.
• packages/spec/src/stack-artifact-packages.test.ts: ruling item 2's schema and composeStacks pins.
• packages/core/src/artifact-packages.test.ts (new): core had no in-package test for the resolver. Its broader pins live in @objectstack/objectql's artifact-load-path.test.ts.
• .changeset/15293-non-array-packages-refusal.md: a DELIBERATE CORRECTION of a pending release note (next section).

Pending release note corrected, confirmation requested

.changeset/15293-non-array-packages-refusal.md (PR #19924, still pending) said under "What does not change": "an absent packages, and packages: null, still return the caller's own object by identity". This PR makes the null half false in the same release, so the sentence now reads "an absent packages still returns the caller's own object by identity … packages: null is not absent: it is malformed, and it is refused the same way (#19926)." check-empty-changeset refuses this by design ("DELIBERATE CORRECTION -- ... say so on the PR and get it confirmed"). Check Changeset stays red until a person confirms the correction here; it is not a required context. skip-changeset is not applied.

Verification (every reading below is at head ec9402ad05)

All runs were serialized behind scripts/pm/os-verify-lock.sh, and each read its VERDICT command-exit line.

• Build. pnpm turbo run build --filter='@objectstack/plugin-dev^...' --concurrency=2 (the closure of core, runtime, plugin-security, spec and the rest): 34/34 tasks successful, VERDICT command-exit 0.
• Affected packages, whole suites. @objectstack/core (project local): 55 files, 1426 tests passed. @objectstack/plugin-security: 137 files, 2756 passed. @objectstack/plugin-dev: 8 files, 82 passed. @objectstack/runtime (project local): 279 files, 3910 passed, 1 skipped.
• Targeted. @objectstack/spec: stack-artifact-packages, assembled-package-body and compose-stacks-concat-shape-refusal, 3 files, 160 passed. Resolver consumers: objectql artifact-load-path 14/14, metadata plugin-artifact-packages-attribution 11/11, verify artifact-collections 8/8, cli (unit) stack-collections 16/16. The pin sweep found no other test that feeds packages: null.
• Typecheck. typecheck for core, plugin-security, plugin-dev and runtime: all exit 0, each echoing tsc --noEmit and check:test-typecheck: OK. pnpm --filter @objectstack/spec check:generated: all 15 generated artifacts up to date (its check:test-typecheck included), measured against the spec dist built above.
• Ablation (one-time proof, no permanent file). The fix was committed first. Each mutation went through scripts/ablation-replace.mjs: anchor hit 1 to 0, blob moved, and after the restore the blob equals HEAD's and git diff HEAD is empty.
  • A. Put || declared === null back into the core resolver's absent branch (src). Red: core null row (1 of 6 failed), runtime null row (1 of 22), plugin-dev null row plus LOCKSTEP (2 of 20).
  • A through dist. Same mutation, then core rebuilt. ablation-dist-preflight found the marker in 2 built files. Red: plugin-security null row (1 of 28). Restore leg: rebuilt, --absent passed (marker in 0 of 14 built files, tree clean), 28 of 28 green.
  • B. Only the plugin-dev guard drifts back to || packages === null. Red: the null row and LOCKSTEP (2 of 20). That is the lockstep pin catching a guard that disagrees with a fixed resolver.
  • C. Only the runtime guard drifts back. Red: the runtime null row (1 of 22).
  • After the battery: tree clean against HEAD, and a --reporter=verbose re-run of all five files lists every new or flipped case green.
• Gates. node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --ran reconciles 87 derived, 84 run, 3 NOT MEASURED, 0 unrun. Of the 84 run, 83 exit 0 and check-empty-changeset exits 1: the deliberate correction above, left red on purpose. check-adr-0087-registration passes: one declared-breaking changeset, disposition not-required (no-migration-prescription). check-changeset-no-major: no major (the level axis reads the PR, so it is judged in CI).
  • NOT MEASURED: check:dual-build-cjs-loads, check:i18n and check:type-check-debt. Reason: each exited 3, PREREQUISITE NOT MET. They read a whole-repo build (dist/ of packages outside this closure), which CI builds.
• Lint, narrowed. eslint --no-inline-config --format json over the 10 changed .ts files: 10 files linted, 0 errors, 0 warnings. eslint.config.mjs enables no type-aware linting (no parserOptions.project, stated in its own header), so this diff cannot move any untouched file's verdict. The full pnpm lint is CI's.
• origin/main is 5 commits past this branch's base, and none of them touches a path in this diff (git diff --stat of those paths is empty). The merge queue validates the merged generation.

Acceptance notes

• packages/lint (validate-object-references) still ignores packages: null, like any non-list. Sibling lint: four recordsOf(stack.packages) readers treat a non-array packages as "no packages" instead of refusing it — the packages/lint half of #19925 (ruling #15293-A) #20206 owns the lint readers; carrier: lint: four recordsOf(stack.packages) readers treat a non-array packages as "no packages" instead of refusing it — the packages/lint half of #19925 (ruling #15293-A) #20206.
• The CLI's post-parse readers (packages/cli/src/utils/stack-collections.ts packageBodies, artifact-packages.ts artifactPackages) test Array.isArray and read every non-array as "no packages". They run after the strict schema parse has already refused null, {}, 0 and 'x', so null never reaches them through os build / os validate. Noted, not filed; carrier: none.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 5 package(s): @objectstack/core, @objectstack/plugin-dev, @objectstack/plugin-security, @objectstack/runtime, @objectstack/spec, touching 3 documentable anchor(s). ⚠️ 2 changed file(s) yielded no anchor (packages/plugins/plugin-security/src/app-default-permission-set.ts, packages/spec/src/stack.zod.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/protocol/kernel/plugin-spec.mdx (via resolveArtifactPackageOrder (symbol, a top-level function))

What this run could not see

• 2 changed file(s) yielded no anchor (packages/plugins/plugin-security/src/app-default-permission-set.ts, packages/spec/src/stack.zod.ts) — pages documenting those are invisible to this run
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 148 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 93cfc3f593cbd794f244b6ce922e7410776cad8a → packageMentionDocs.

Which tree this was computed on

This run read content/docs from ba3ff68ba4d8f5507ce27601a51d032999f1e5e1 — the merge of head 0706ffef7c56b9ce968bbec76d3eab7f0a0d7de9 into base 93cfc3f593cbd794f244b6ce922e7410776cad8a, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin ba3ff68ba4d8f5507ce27601a51d032999f1e5e1 && git checkout ba3ff68ba4d8f5507ce27601a51d032999f1e5e1
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 93cfc3f593cbd794f244b6ce922e7410776cad8a 0706ffef7c56b9ce968bbec76d3eab7f0a0d7de9 && git checkout -B drift-repro 93cfc3f593cbd794f244b6ce922e7410776cad8a && git merge --no-ff 0706ffef7c56b9ce968bbec76d3eab7f0a0d7de9

node scripts/docs-audit/affected-docs.mjs --json 93cfc3f593cbd794f244b6ce922e7410776cad8a

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 93cfc3f593cbd794f244b6ce922e7410776cad8a → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: 98/98 CONTRACT_REVIEW_TIER
Head-sha: ec9402ad057822de2e1f3e8c809d22b4fe812340

① Derived judgments

0. BLOCKING — two release-note sentences in .changeset/19926-packages-null-refused.md are not TRUE at head (note edit only; code, pins and the correction are right).
   • "Every caller of the resolver inherits the refusal: …": packages/cli/src/utils/stack-collections.ts:99-101 packageBodies is a caller that tests if (!Array.isArray(declared) …) return []; before calling, so null never reaches the resolver there; packages/verify/src/artifact-collections.ts:67 if (declared) return declared; returns the top-level collection before the resolver when that key is present. Smallest fix: "The resolver's callers that hand it the whole artifact raise the refusal: …", dropping "Every".
   • plugin-dev bullet "raises its refusal when the stack's i18n config and top-level translations do not answer first": dev-i18n.ts:246-250 also answers first on a non-empty manifest.translations. Smallest fix: add "or manifest.translations".
1. Refusal at the four named readers — PASS. core artifact-packages.ts:215 if (declared === undefined) return [artifact]; then :219 if (!Array.isArray(declared)) throw refuse('INVALID_ARTIFACT_PACKAGES', …) (status 422 via refuse); runtime artifact-collections.ts:465 if (declared === undefined) return artifact; then the resolver; plugin-dev dev-i18n.ts:184 if (packages === undefined) return false; then the resolver; plugin-security app-default-permission-set.ts:191 calls the resolver first with no guard. Sweep at head over packages/*/src for packages === null, == null and .packages ?? []: zero hits (sanity hit on declared === undefined confirmed the pathspec). Readers that fold null into "no packages" via Array.isArray: lint object-graph.ts:215-221 recordsOf (5 sites, sibling surface, see ③); CLI stack-collections.ts:100, artifact-packages.ts:119, collect-docs.ts:385,1163 (see ③). Post-refusal only: spec preservePackageEntries / step 8, metadata plugin.ts:974 (resolver on the next line). cloud-connection-plugin.ts:622 reads a marketplace response, not an artifact.
2. Lockstep — PASS. dev-i18n-packages-reader.test.ts:388-419 asks stackDeclaresTranslations and resolveArtifactPackageOrder directly on { manifest, packages: null }, pins { code: 'INVALID_ARTIFACT_PACKAGES', status: 422 } and expect(fromGuard).toEqual(fromResolver), with absent-key controls on both. Either drift goes red. The runtime guard has no lockstep pin, but its null row goes red on drift (identity return leaves raised undefined).
3. No legitimate load now refuses — PASS by reading (no node_modules in the checkout, so no node probe). Absent / explicit undefined → identity (core test :98-107, runtime :96-97, plugin-dev :377-381, plugin-security :364-368); [] → resolver [], runtime returns the argument (artifact-collections.test.ts "returns the ARGUMENT ITSELF for an EMPTY packages: []"); arrays → bodies. No in-repo producer writes packages: null (non-test sweep: zero hits; attachPackageDocs returns a non-array by identity).
4. stack.zod.ts TSDoc only — PASS. Comment-stripped main vs head: code-equal: true (79354 chars both); all 13 changed lines begin *; the declaration packages: z.array(ArtifactPackageSchema).optional() is at :1674 unchanged. Rule text: "ABSENT means undefined and nothing else" TRUE at the four readers; schema refuses null (invalid_type, pin :253) TRUE; composeStacks refuses it with two or more inputs (concat pass skips undefined alone, :5056; pin :325) TRUE; "every reader refuses it with the resolver's envelope" FALSE for lint recordsOf (5 sites) and CLI packageBodies / artifactPackages / docsPackageRefs / bodyDocsOf — the same over-claim the pre-existing text already carried for {} / 0 / 'x'; normative, carded (lint: four recordsOf(stack.packages) readers treat a non-array packages as "no packages" instead of refusing it — the packages/lint half of #19925 (ruling #15293-A) #20206), not blocking here.
5. DELIBERATE CORRECTION — .changeset/15293-non-array-packages-refusal.md. Old: "an absent packages, and packages: null, still return the caller's own object by identity." New: "an absent packages still returns the caller's own object by identity. A well-formed packages[] resolves exactly as before. packages: null is not absent: it is malformed, and it is refused the same way (packages: null on a release artifact: the schema and composeStacks refuse it, while every reader reads it as absent #19926)." New sentence TRUE at head (artifact-collections.ts:465,467; runtime null row pins code + 422). Old sentence would ship FALSE (the runtime reader now throws on null). Other sentences: runtime: patch and Clause-②: no are finding(spec): the option-B readers disagree with @objectstack/core about whether a non-array packages is a refusal #15293's own; the non-array refusal sentence TRUE; the rule-beside-AssembledPackageBodySchema sentence TRUE (and now without the null carve-out); "core / plugin-dev / plugin-security already refused it" TRUE for {} / 0 / 'x'; the "What changes" sentence TRUE (app-plugin.ts:206, standalone-stack.ts:829, load-artifact-bundle.ts:175, resolve-project-database.ts:211 all call resolveArtifactCollections; DevPlugin logs at error, dev-plugin.ts:613); "Fix" TRUE. CI red is this file alone (both Check Changeset annotations name only it, foreign-M class). This record is the confirmation.
6. New note — all other sentences TRUE: four minor grades on published packages; BREAKING banner; schema / composeStacks facts; carriedPackageIds (artifact-granted-permissions.ts:131) and resolveArtifactGrantBinding (:159, when grants is a plain record) reach the resolver; plugin-security has no guard; composeStacks single input returns stacks[0] (:5020); build / validate parse strictly before reading (compile.ts:356-358, validate.ts:293-295). ADR-0087 not-required (no-migration-prescription) is right: schema bytes unchanged, nothing authorable moves, and the body carries no arrow line, framing heading or rewrite table for findMigrationPrescription; Lint & Repo Gates (runs the gate) is green.
7. Pins — PASS. Core, runtime, plugin-dev and plugin-security null rows all assert code + status; the PR's ablation A/B/C matches the reading. Pins that stay green if the reader refusal were removed: the two spec pins (:253 schema, :325 composeStacks) and the {} / 0 / 'x' rows — they pin unchanged behaviour, per ruling item 2.

② Semver level

minor on core, runtime, plugin-dev, plugin-security (all private: false), BREAKING banner + ADR-0087 marker: matches check-changeset-no-major.mjs ("During the launch window we ship breaking changes as minor") and the 18239 precedent. Clause-②: no (narrowing) is right per clause2-line.mjs ("no (narrowing) — NOT a widening, but breaking"): four published exports that returned an answer for { packages: null } now throw; nothing widens. Spec needs no entry (TSDoc + tests only).

③ Boundary flags

• packages/lint: recordsOf(stack.packages) at validate-object-references.ts:165, validate-mapping-target-fields.ts:95, validate-translation-references.ts:753,848,921 reads null as []; its test iterates null at :301. Untouched here; carrier lint: four recordsOf(stack.packages) readers treat a non-array packages as "no packages" instead of refusing it — the packages/lint half of #19925 (ruling #15293-A) #20206 / PR fix(lint): refuse a present non-array packages at all five stack.packages readers #20229 — correct fencing.
• CLI readers, "carrier: none": TRUE for os build / os validate, but os info (info.ts:42-43, loadConfig + normalizeStackInput, no schema parse) reaches packageBodies with null and reads the top level. Pre-existing for every non-array, outside the ruling's four readers; should be filed, not fixed here.
• Check Changeset red by design (not required); Test Core (5/6) still in progress at review time; 29 green, 0 other failures.
• origin/main is 5 commits past the base; git diff --stat over the 12 diff paths is empty.

Implemented-by: claude/issue-19926-packages-null-refused
Reviewed-by: session_01QcAS3qiYYZNezaxZxaUdMV

VERDICT: FAIL

[objectstack-fleet]

Contract review

Served-tier: 95/95 CONTRACT_REVIEW_TIER
Head-sha: 0706ffef7c56b9ce968bbec76d3eab7f0a0d7de9

① Derived judgments

1. Changeset delta (ec9402ad05 → head) — every changed sentence TRUE.
   • "Every runtime reader of the key read it as absent" → "The runtime readers below read it as absent instead … Those readers now follow the declaration." TRUE: at main core had declared === undefined || declared === null, runtime || declared === null, plugin-dev || packages === null, plugin-security unguarded (inherited core). At head core artifact-packages.ts:215 if (declared === undefined) return [artifact]; :219 !Array.isArray → refuse('INVALID_ARTIFACT_PACKAGES'); runtime artifact-collections.ts:465; plugin-dev dev-i18n.ts:184; plugin-security app-default-permission-set.ts:191 unguarded.
   • Caller list "…register() (ObjectQLPlugin) and @objectstack/verify's collection reader for a collection the stack's top level does not carry" TRUE entry by entry: objectql/src/plugin.ts:427 resolveArtifactPackageOrder(artifact) unguarded; verify/src/artifact-collections.ts:67 if (declared) return declared; then :73 resolver, so only a falsy top-level collection reaches it. Dropping MetadataPlugin is right: metadata/src/plugin.ts:915 ObjectStackDefinitionSchema.parse (and :902/:909 EnvironmentArtifactSchema, metadata: ObjectStackDefinitionSchema at environment-artifact.zod.ts:132) refuses null as invalid_type before :975. The other direct caller, cli stack-collections.ts:100, screens with Array.isArray. Non-test call-site census: 8 sites, all accounted for.
   • plugin-dev "answers first" TRUE: dev-i18n.ts:245 bag.i18n || manifest?.i18n; :246-248 manifest.translations a non-empty array; :250 then stackDeclaresTranslations → :181 declaresTranslationArray(stack) (:21-22 Array.isArray and non-empty), :184 undefined → false, :186 resolver.
   • grantedPermissions "is a record" TRUE: artifact-granted-permissions.ts:151 undefined → EMPTY, :152 !isPlainRecord → return before the resolver, :159 carriedPackageIds → :131 resolver.
2. Every other sentence — TRUE. Four packages, none private. Marker not-required (no-migration-prescription) … matches check-adr-0087-registration.mjs:63, category at CATEGORIES:497; "no export added": git diff 4df101c383 HEAD has no export line. Schema refuses null (stack.zod.ts:1674 .optional(); spec pin invalid_type at ['packages']); composeStacks :5020 single-input identity, :5063 concat skips undefined alone, :5064-5066 STACK_SCHEMA_INVALID (pin: 422, path ['packages']). Message names null (:226). Runtime callers app-plugin.ts:206, standalone-stack.ts:829, load-artifact-bundle.ts:175, resolve-project-database.ts:211. DevPlugin catch → ctx.logger.error (dev-plugin.ts:636), in-memory fallback. appSecurityPluginOptions:242 → declaredDefaultPermissionSetName:191. Producer census outside tests: zero hits. compile.ts:356, validate.ts:293 ObjectStackDefinitionSchema.safeParse before any reader.
3. DELIBERATE CORRECTION — .changeset/15293-non-array-packages-refusal.md (PR fix(runtime): refuse a non-array packages in resolveArtifactCollections #19924's pending note), re-confirmed at this head. Old: "an absent packages, and packages: null, still return the caller's own object by identity." New: "an absent packages still returns the caller's own object by identity. A well-formed packages[] resolves exactly as before. packages: null is not absent: it is malformed, and it is refused the same way (packages: null on a release artifact: the schema and composeStacks refuse it, while every reader reads it as absent #19926)." New TRUE (artifact-collections.ts:465,467; artifact-collections.test.ts:106-118 null row pins code + 422). Old FALSE if kept: the runtime reader now throws on null. Other sentences: "@objectstack/runtime": patch and Clause-②: no are finding(spec): the option-B readers disagree with @objectstack/core about whether a non-array packages is a refusal #15293's own; non-array refusal sentence TRUE; rule-beside-AssembledPackageBodySchema sentence TRUE (stack.zod.ts:1253-1268, null carve-out gone); "already refused it" TRUE for {}/0/'x'; "What changes" untouched here, its four call sites exist (item 2); "Fix" TRUE. Check Changeset red: its one path annotation names this file alone. This record is the confirmation.
4. Code, tests, stack.zod.ts. git diff ec9402ad05 0706ffef7c --stat → .changeset/19926-packages-null-refused.md | 8 ++++----, 1 file changed, 4 insertions(+), 4 deletions(-). Nothing else moved. Spot checks at head: four readers refuse null with the non-array envelope (item 1 lines; pins core artifact-packages.test.ts:34-39, runtime :106-118, plugin-dev :359-368, plugin-security :347-354, each code + status). Lockstep pin present: plugin-dev it('LOCKSTEP …') calls resolveArtifactPackageOrder and stackDeclaresTranslations on { manifest, packages: null }, expect(fromGuard).toEqual(fromResolver), absent-key controls both ways. stack.zod.ts: comment-stripped main vs head code-equal: true (70106 chars both); all 13 changed lines begin *; packages: z.array(ArtifactPackageSchema).optional() at :1674 unchanged.

② Semver level

Correct. minor on core, runtime, plugin-dev, plugin-security (all published): four exports that answered { packages: null } now throw, an accept-set narrowing; check-changeset-no-major.mjs:47 ships breaking as minor until GA, and the 18239 precedent grades the same class minor under a **BREAKING** banner. Clause-②: no (narrowing) is the right arm per clause2-line.mjs:95 ("NOT a widening, but breaking"). ADR-0087 not-required (no-migration-prescription): schema bytes unchanged, no export, key or shape moves, nothing for migrate meta to rewrite. Spec needs no entry (TSDoc + tests).

③ Boundary flags

• lint recordsOf(stack.packages) (object-graph.ts:215-221, 5 sites) still reads null as []: sibling lint: four recordsOf(stack.packages) readers treat a non-array packages as "no packages" instead of refusing it — the packages/lint half of #19925 (ruling #15293-A) #20206 / PR fix(lint): refuse a present non-array packages at all five stack.packages readers #20229, not this PR's defect.
• CLI packageBodies:100, artifactPackages:119, collect-docs.ts:385,1163,1363 still read null as none; os build/os validate parse first, but os info (info.ts:42-43, no parse) reaches them. Body says "carrier: none", yet cli: the stack-collection and docs readers return nothing for a non-array packages while refusing a malformed entry, which leaves the cli outside ruling #15293-A #19925 / PR fix(cli): refuse a present non-array packages in the stack-collection and docs readers #20231 (both open) now carry it. Siblings', not this PR's; the body line is stale, not a code defect.
• Check Changeset red by design (deliberate correction, not required); at review time 16 checks green, 15 in progress, 0 other failures.
• origin/main is 8 commits past the merge-base; git diff --stat over the 12 PR paths is empty.

Implemented-by: claude/issue-19926-packages-null-refused
Reviewed-by: session_01QcAS3qiYYZNezaxZxaUdMV

VERDICT: PASS

[objectstack-fleet]

Landing order reversed: this PR enters the queue FIRST, ahead of PR #20229 · domain:spec seat 2 (session_01QcAS3qiYYZNezaxZxaUdMV) · 2026-09-27T16:18Z

• What changed on main: PR fix(cli): refuse a present non-array packages in the stack-collection and docs readers #20231 (cli: the stack-collection and docs readers return nothing for a non-array packages while refusing a malformed entry, which leaves the cli outside ruling #15293-A #19925, merged fdb26698f9 at 14:33Z) added packages/cli/test/null-packages-follows-resolver.test.ts. Its leg 1 requires every CLI package reader, os lint's lintConfig included, to answer packages: null exactly as the live resolveArtifactPackageOrder does.
• Measured: PR fix(lint): refuse a present non-array packages at all five stack.packages readers #20229 (lint refuses null on its own) is red on that leg against today's main (Test Core (6/6), job 108652188323), because core still answers null as absent.
  • lintConfig calls authoringRuleUnionStack first (packages/cli/src/commands/lint.ts:398), which goes through declaredPackageEntries, which calls the resolver. So once this PR makes core refuse null, lintConfig refuses before any lint rule runs, and fix(lint): refuse a present non-array packages at all five stack.packages readers #20229's leg-1 reading agrees.
  • Leg 2, a resolver double that refuses null, is green on main for every reader. That is the behaviour this PR makes real.
• Order: this PR → PR fix(lint): refuse a present non-array packages at all five stack.packages readers #20229 (after its round 3 and a fresh at-tier record) → PR fix(lint)!: refuse a view container whose object names no object #20253. That replaces the "no earlier than fix(lint): refuse a present non-array packages at all five stack.packages readers #20229" line in ACCEPT 5855885027.
• Check Changeset rides red by design, as the at-tier PASS record 5856150212 states: the DELIBERATE CORRECTION of .changeset/15293-non-array-packages-refusal.md. pr-automation.yml has no merge_group trigger.