fix(dogfood): the wall CONTROL cases' packages declare the CRM dependency and their publish lines read the receipt

[objectstack-fleet]

Fixes #24725

Clause-②: no

The two CONTROL cases of packages/qa/dogfood/test/wall-environment-metadata-refusal.dogfood.test.ts that PR #24724 held off now publish for real and assert it. They are the walled CONTROL: the platform operator writes at every one of these doors case (both postures, isolated and group) and the single (CONTROL) case. Before this change, each one's publish-drafts was refused with a 200, and the status-only ok() read that refusal as a write.

The ruled closure narrowing (PR #24630, 9f12d06770) is unchanged, as are every save-door and publish rule, every other case in this file (the /packages case PR #24724 changed included), and every other dogfood file. This PR changes one test file and nothing else.

What changes (two cases, one file, +19 / -4)

• Each case's package declares the CRM dependency at create. POST /packages now sends dependencies: { [CRM_PKG]: '*' }, where CRM_PKG is the file's existing constant for com.example.crm (examples/app-crm's manifest.id). This covers com.em.PREFIX.opctl (walled) and com.em.sin.a (single).
• Each publish line asserts the receipt in data. The receipt must read { success: true, outcome: 'published', publishedCount: 1 }, with failed[] as the assertion message. The form is copied byte for byte from the /packages case. It stays inline rather than moving into a helper, so the /packages case's lines stay untouched and a failure points at each case's own line.
• The view names stay on crm_lead (crm_lead.em_PREFIX_pkgv, crm_lead.em_sin_pv), so no later line changes. ok() stays status-only for every other line.

Evidence

Every run used the same command, pnpm exec vitest run --maxWorkers=2 test/wall-environment-metadata-refusal.dogfood.test.ts in packages/qa/dogfood, under the shared verify lock.

• The closure was built by pnpm turbo run build --filter=@objectstack/dogfood --concurrency=2: 66/66 tasks, the dogfood gate's own build target.
• The file runs both walled postures (isolated, group) and the single control in one run. That is how the gate's turbo run test --filter=@objectstack/dogfood executes it, since OS_TEST_SHARD only slices whole files. So one run covers every variant the gate runs.
• Each instrumented or mutated run went through scripts/ablation-replace.mjs in WRAP mode. Each was restored and proven hash-equal to HEAD: blob 16c8fd8a2 for R0, 3bfd0b150 for R2 to R4, with git diff HEAD empty.

Run	Tree	Result
R0 (before, instrumented)	580fd4ed3 (origin/main), with a log of each CONTROL publish-drafts receipt	23 passed: the false green. All three receipts are 200 {"success":false,"outcome":"refused","publishedCount":0,"failedCount":1,...}, each with list-view-object-outside-closure: crm_lead.em_iso_pkgv into com.em.iso.opctl, crm_lead.em_gro_pkgv into com.em.gro.opctl, and crm_lead.em_sin_pv into com.em.sin.a
R1 (green)	cff4ff61e, this change	23 passed
R2 (after, instrumented)	cff4ff61e plus the receipt log	23 passed. All three receipts are 200 {"success":true,"outcome":"published","publishedCount":1,"failedCount":0,...}, for the same three views
R3 (ablation)	cff4ff61e with dependencies removed from the two CONTROL packages only (the /packages case keeps its own)	3 failed / 20 passed. The failures are at the receipt assertion, :333:10 (isolated and group) and :378:8 (single). Received { success: false, outcome: 'refused', publishedCount: 0 }. The message is failed[]: view/crm_lead.em_sin_pv failed author-time validation: 1 issue — views[0].object [list-view-object-outside-closure] (the same for em_iso_pkgv and em_gro_pkgv)
R4 (doors after the publish, instrumented)	cff4ff61e plus logs of the next doors	23 passed. In both walled postures, duplicate answers 200 with copiedCount: 1, and the copy holds crm_lead.em_PREFIX_pkgv as active. DELETE /packages/com.em.PREFIX.opctl answers 200 with deletedCount: 1 (the published view) and registryRemoved: true, and the operator's GET then answers 404. Under single, A's DELETE /packages/com.em.sin.a answers 200 with deletedCount: 1, and no sys_metadata row of the package remains

What the runs establish:

• On main both CONTROLs measured nothing at the publish-drafts door (R0).
• With the dependency declared, the operator (walled) and A, a manage_metadata holder below the operator, under single really publish. A's create with dependencies answers 201 (R1, R2).
• Each CONTROL can now fail at that door, and names the cause when it does (R3).
• Each door after the publish now acts on a package holding a published view, and answers as before (R4).

Gates (local subset, on cff4ff61e)

• tsc --noEmit in packages/qa/dogfood: TSC_EXIT=0, and --listFiles includes this file.
• node scripts/pm/dispatch-gates.mjs --commands derived 55 families. 54 exit 0. pnpm check:dual-build-cjs-loads exits 3 with PREREQUISITE NOT MET: it reads every package's dist, and eight packages outside the dogfood closure are unbuilt locally. That family is NOT MEASURED locally, and CI's Lint & Repo Gates reads it. --ran reconciliation: 55 derived famil(ies) accounted for — 54 run, 1 NOT-MEASURED, 0 UNRUN.
• pnpm lint (eslint . --no-inline-config): LINT_EXIT=0, no finding.
• Dogfood is not in the PR or queue fast set. It runs on main's hourly full battery, and the runs above are its pre-merge reading.

Changeset

None. skip-changeset applies: the diff is one file under packages/qa/dogfood/test/, and @objectstack/dogfood is "private": true, so it publishes nothing.

Acceptance notes

• ok() still reads only the status for every other line of these two cases. R4 read the bodies of duplicate and DELETE in addition, and both carry a success receipt. No other door's body was read here.
• Under single, A's GET /packages/com.em.sin.a after the delete answers 403, not 404. That is the read gate as written: package reads need studio.access or setup.access (packages/runtime/src/domains/packages.ts), which A does not hold. It is not a line of this file.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 580fd4ed3c98a1752dfb0041b45cc713644fef7e → packageMentionDocs.

[objectstack-fleet]

席位核对 · ACCEPT

domain:cli seat 2 (#22648) · os-justin · session session_01LmjU2x1faLZ39DVTFyVca6 · 2026-10-20T05:10Z · head cff4ff61e3 · claim 6283447240 → report 6283861375. No contract face (Clause-②: no, a test file only), so no review of record is owed.

Check	Reading
Shape	Draft, base main. First line Fixes #24725; Clause-②: no line-initial. Assignee os-justin = the card's. skip-changeset is applied in the create stroke, and correct: one file under packages/qa/dogfood/test/, and @objectstack/dogfood is private.
Surface	1 file, wall-environment-metadata-refusal.dogfood.test.ts (+19 / −4), the two CONTROL cases only, inside the claim. Read on origin/main...cff4ff61e3: the /packages case's lines (PR #24724) are byte-unchanged, and no case is skipped, quarantined or re-timed. check-governed-merges.mjs --pr 24777: NOT governed, 23 changed lines.
Mechanism	Each package declares dependencies: { [CRM_PKG]: '*' } at POST /packages (com.em.<p>.opctl, com.em.sin.a), and each publish-drafts line asserts { success: true, outcome: 'published', publishedCount: 1 } with failed[] as the message. That is the /packages case's form, inline. The new published / receipt locals sit in their own it scopes, and tsc --noEmit reads 0. The narrowing is untouched.
Evidence	R0 on main 580fd4ed3: 23 passed while all three receipts read refused with list-view-object-outside-closure, which is the card's false green. R2 after: all three read published, publishedCount: 1. R3, with the dependency removed: 3 failed exactly at the receipt lines, naming the rule. So each CONTROL can now fail at the door. R4: duplicate and DELETE after a real publish answer 200 as before, in both walled postures and under single, with no finding. Every mutation was restored hash-equal to HEAD.
Gates	Local: 55 derived families, 54 exit 0, and check:dual-build-cjs-loads NOT MEASURED (unbuilt dist outside the closure; CI's Lint carries it); pnpm lint exit 0. Check-runs on this head (38, latest per name), read at this act: 19 success, 8 skipped (the dogfood shards among them, which run on main's hourly battery), 11 in_progress (Lint, Type Check, Test Core 1–3). Landing waits on all of them.

Accepted deviations:

• The commit uses AGENTS.md's model-free trailers. That is correct for this repo.
• test:repo, check:dev-prereqs and check:skill-frame-freshness were not run locally because their paths are untouched. CI carries them.

Out-of-scope dispositions (one line each):

• Under single, A's GET of the deleted package answers 403, not 404, because package reads need studio.access or setup.access. That is the read gate as written, and no line of this file reads it. No card.

Landing: through the merge queue by this seat once every check on this head reads success (or an expected skip). The dogfood measurement on main is the first hourly run carrying the merge commit.

---

Generated by Claude Code