cli/validate: an objectExtensions entry that re-declares an owner's field in fields is not refused, though ADR-0146 D10 refuses it on the extension (the registry only warns)

domain:spec#3 · os-sales · session_01L6bhgTqqeHSwZYJmApbDCa

Filing gate: ① a gap between a ratified rule and its doors, found by the contract review of PR #30533 (comment 6665186290, ③ "Added by this review", escalated to the seat for a card). ⛔ Not a claim.

Business reason. ADR-0146 D10 (docs/adr/0146-… :510-517): "A base field is changed only within a display-property whitelist … Everything else on a base field — type, required, unique, reference, defaultValue, formulas, options membership — is refused on the extension with a prescription naming the whitelist." An extension that writes an owner's field into its fields map instead of fieldPatches replaces the owner's definition whole: packages/objectql/src/registry.ts#mergeObjectDefinitions (:876-889, { ...base.fields, ...extension.fields }). Nothing refuses that on entry, so a module package can silently turn an owner's writable amount: number into text, readonly: true or a formula, and every reader (the engine, and since PR #30533 the lint rules) then judges the field on the extension's definition.

What the code says (at `origin/main` `4831d500`)

packages/objectql/src/registry.ts#reportRedeclaredFields (:5076): when an owner and an extension (or two extensions) declare the same name in fields, the registry console.warns which definition is served. Its docblock: "⛔ Never a refusal, and the served definition is unchanged" (the fold runs on every read while a boot is still registering packages, so the registry is the wrong door to refuse at).
packages/metadata-protocol/src/protocol-extension-field-suffix.ts (judgeExtensionFieldSuffix): the only mechanical extension judge at publish, os validate and the install door; it judges the __c suffix (reserved to .custom; unsuffixed keys inside a .custom pair), not a plain-spelled re-declaration of an owner field by a vendor module (ADR-0029 D7 / ADR-0141 D7 keep that spelling plain).
PR fix(lint)!: the remaining field-name indexes judge an object as served, so a read or write of a field an objectExtensions entry adds is not refused (#30471) #30533's review, ①.3: the shape reaches os validate today, and after fix(lint)!: the remaining field-name indexes judge an object as served, so a read or write of a field an objectExtensions entry adds is not refused (#30471) #30533 the type, readonly and sort rules judge it on the extension's definition (declared in that PR as part of its narrowing).

Wanted

A door that refuses, at os validate and at publish (and the install door, the three points D10 names for __c), an objectExtensions[].fields key naming a field the extended object's owner declares, with a prescription naming fieldPatches and the display-property whitelist, when the entry changes anything outside that whitelist. Where the door lives (the authoring gate beside judgeExtensionFieldSuffix, or a lint rule run by os validate) is the implementing card's measurement.
Measure first: how many first-party artifacts (examples, HotCRM) re-declare an owner field today; a refusal of shapes in use is a Clause-②: yes (narrowing) with its ADR-0087 disposition.
The registry warning stays (it serves bodies no door judged).

Dedupe: repo:objectstack-ai/objectstack is:issue is:open fieldPatches → 7 hits; #28804 (skills evals: no eval checks that an author patches with fieldPatches instead of taking a field over in fields) is the authoring-guidance half of the same rule, not a door; the rest are QA run cards and seat posts. "D10" extension base field refused → seat posts and QA runs only. New.

Suggested-grade: p2 · a ratified ADR rule with no refusing door; a vendor module can change an owner field's type or writability silently.

Generated by Claude Code

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Path: none