fix(lint)!: under a package closure, judge a dashboard or report filter key on another package's dataset against that dataset's object (#30005) - #30231

📓 Docs Drift Check

5 anchor(s) derived from 1 changed package(s); no hand-written page names any of them, so this run has nothing to list — not a clean bill of health. This check sees only pages that NAME a derived anchor: one that documents this change in prose, or enumerates it in an authoring dialect, names none and stays invisible to it on every run.

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin a881a71bdb11306aee78cdd08259eae106a188d2 && git checkout a881a71bdb11306aee78cdd08259eae106a188d2
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 5fa9375ec8279a7ee9e779049c0e93661c1786a3 ae7fa514e5fccd5ed58307428b2783bbb3ce63c6 && git checkout -B drift-repro 5fa9375ec8279a7ee9e779049c0e93661c1786a3 && git merge --no-ff ae7fa514e5fccd5ed58307428b2783bbb3ce63c6

node scripts/docs-audit/affected-docs.mjs --json 5fa9375ec8279a7ee9e779049c0e93661c1786a3

domain:server#3 · os-bill · session_01Utp6CbPxYq1wQmUNWvMZkC

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: b37c73da8aff9c8189ccf7fd3ba23d579823de3a
Local-runs: none
Scope: packages/lint/src/runtime-gate.ts, packages/lint/src/runtime-gate.package-closure.test.ts + packages/lint/src/validate-widget-bindings.ts, packages/lint/src/validate-report-runtime-filter.ts, packages/lint/src/object-graph.ts, packages/lint/src/index.ts, packages/lint/src/runtime.ts, packages/metadata-protocol/src/runtime-authoring-gate.ts, packages/metadata-protocol/src/protocol.dashboard-dataset-publish-gate.test.ts, packages/services/service-analytics/src/dataset-filter-field-binding.ts, packages/spec/src/ui/dashboard.zod.ts, packages/spec/src/ui/report.zod.ts, content/docs/deployment/validating-metadata.mdx (prose face, read for the Skills-docs: judgment only)

Face: narrowing. The PR's two code paths decide no face on their own (record-recognisers --template --paths reads them TIER_DEFAULT); the line-initial Clause-②: no (narrowing) on the PR body and in .changeset/30005-cross-closure-dataset-filter-keys.md puts the review on the narrowing face, so the scope floor is every diff path outside the prose faces, both named above. PR user.login is objectstack-fleet[bot], so no author note is owed. No Contract-review-claim, hold or record on this head on either thread at read time (PR thread: one docs-drift bot comment only). Card thread read: 6621257853 (triage), 6647296389 (seat claim), 6648301262 (os-dev report).

① Derived judgments

1. The narrowing itself (correct, as declared). runtime-gate.ts#buildRuntimeWriteSnapshotSet now narrows objects through runtime-gate.ts#narrowObjectsToWriteClosure with a fifth limb, the set runtime-gate.ts#datasetBoundObjectNames(args.type, item, args.context?.datasets): for a dashboard write, the object of every dataset named at widgets[].dataset; for a report write, the object of the dataset at report.dataset and at each blocks[].dataset; every other type answers the shared empty NO_NAMES. Those are exactly the positions the two rules read (validate-widget-bindings.ts#validateWidgetBindings reads w.dataset at L971 and judges w.filter at L1157; validate-report-runtime-filter.ts#validateReportRuntimeFilters reads report.dataset at L122 and block.dataset at L131 and judges both runtimeFilters). Resolution goes through the carried, never-narrowed datasets, so a dangling name re-admits nothing. Applied in the same loop to baseline, candidate and the finding(lint): the runtime gate's object-write baseline drops the written object's stored self, so a master save is refused (422) for a stored detail's violation — the gate's "never charged to someone else's write" contract #22118 stored universe, all from the candidate item's bindings, so the verdict stays candidate MINUS baseline over one object universe. Judged right.
2. What is newly refused (dashboard and report writes with a package scope in force, a bound dataset outside the closure). The dev names two rule ids; the diff reaches six, all through the same "object absent, skip" exit that limb 5 removes:
   • widget-filter-field-unknown (named) — validate-widget-bindings.ts#judgeDatasetFilterKeys skip 1 (!graph.get(object), L772-773) is no longer taken; an unknown key is an error.
   • report-filter-field-unknown (named) — same judge, validate-report-runtime-filter.ts L99-112, container and joined-block keys.
   • widget-filter-field-not-included (⛔ not named) — the judge's second clause (L791-797): a dotted key that resolves but whose prefix is not in the dataset's include, error, pushed at validate-widget-bindings.ts L1172.
   • dashboard-filter-field-unknown and dashboard-filter-field-not-included (⛔ not named), both error, and dashboard-filter-field-unprovisioned (warning) — the (a1) dashboard-level filter check at validate-widget-bindings.ts L1013-1021 takes the identical skip (graph.get(datasetObject)) off the same index and so also starts judging a cross-closure widget's inherited globalFilters/dateRange field. The default dateRange field is injected and stays isUnjudgeable (object-graph.ts#isUnjudgeable, kinds unknowable/hop-untargeted), so a stock board is not newly refused.
     Direction is right for all six (each key lands in the same runtimeFilter slot the door binds), but the changeset's "Now" paragraph and the PR body name only the two; the seat's prose check should have the four added in one sentence (③).
3. Nothing the dataset door binds is refused by the design. Read in judgeDatasetFilterKeys: an injected system column (created_at), a dotted hop that lands on an object the snapshot still lacks, and every operator key stay isUnjudgeable and are never reported; only the base object is re-admitted, so the dotted-hop skip is unchanged. The CONTROL case pins status, estimate_hours: { $gte: 1 } and created_at clean on both write types. One pre-existing exception reaches the new population — a bare dimension or measure name — judged in ③ (not a defect of this diff's design).
4. Flow, list-view and dataset closure refusals unchanged. datasetBoundObjectNames returns NO_NAMES for every type other than dashboard/report (L511), and narrowObjectsToWriteClosure(objects, scope, NO_NAMES) is the old four-limb predicate verbatim (limb 5 is datasetBoundObjects.has(name) on an empty set), so every other write type's snapshot is byte-for-byte the main snapshot: flow-trigger-unknown-object, flow-input-unknown-object, list-view-object-outside-closure and the closure fix line on object-reference-unknown are untouched. Pinned by the DARK case (flow on showcase_task; list view of showcase_task whose chart.dataset is the cross-package dataset) and by the "public four-limb" case.
5. Public surface of @objectstack/lint: unchanged. narrowObjectsToPackageClosure(objects: readonly unknown[], scope: RuntimePackageScope | undefined): readonly unknown[] keeps its signature and answer (delegates with NO_NAMES). datasetBoundObjectNames is exported from the module for the unit pin only: packages/lint/src/index.ts L1165-1179 and packages/lint/src/runtime.ts L65-72 are named export lists (no export * from runtime-gate.js), the entries are tsup-bundled, and the module's .d.ts is not addressable through exports — shipped bytes, not a published accept set (contract-review.md). The three outside callers of the public function (packages/metadata-protocol/src/protocol-object-extension-item.ts L213, packages/runtime/src/domains/new-similar-target.ts L172, ui/packages/app-shell/.../objectPickerClosure.ts) see no change. No new rule id, error code or severity: the door's mapping of a gate error to 422 INVALID_METADATA is the existing one. Clause-②: no (narrowing) is therefore right (nothing widened, the accept set narrowed); Metadata-protocol: narrowed is right (a value an author could write — a filter key the object lacks — is now refused, AGENTS.md step 3 "a value refused … is narrowed"), and both lines are line-initial in the PR body and the changeset.
6. The door is live for limb 5. packages/metadata-protocol/src/runtime-authoring-gate.ts L1300-1316 threads type, packageScope and a context carrying datasets (live + pending) into runRuntimeAuthoringRules, which builds its snapshots through buildRuntimeWriteSnapshotSet (L1267), so both the per-item publish and the package draft publish take the new limb; the dev's door measurement (422 at dashboards[0].widgets[0].filter.no_such_field; status saves; main lint publishes the bad key) agrees with the read.

② Semver level

Changeset .changeset/30005-cross-closure-dataset-filter-keys.md: '@objectstack/lint': minor (lint is a released package: packages/lint/package.json has no private field, version 18.3.0, three exports entries), **BREAKING** banner present, Clause-②: no (narrowing) and Metadata-protocol: narrowed line-initial, exactly one adr-0087: not-required (no-migration-prescription) … marker. Against AGENTS.md Post-Task Checklist step 3: kind narrowed takes at least minor on the moved package — minor ✓; (narrowing) is BREAKING — banner ✓; a breaking changeset states its ADR-0087 disposition in writing — ✓; no spec key, export or config field is removed or renamed, so no FROM → TO migration line and no retiredKey() tombstone is owed, and the "What an author does" paragraph is the right prescription (name a real field). check-changeset-no-major.mjs pushes breaking changes to minor outside pre-mode, so minor + banner is the consistent spelling. The dev's declared level (minor + BREAKING + adr-0087 not-required) is consistent with the changeset and with the diff. Check Changeset, Lint · CI, release & engine gates and Governed Surface Queue Guard are success on this head.

③ Boundary flags

1. Skills-docs: line — present, wrong spelling, and not true as written (seat REWORK item, prose face). The allowed spellings are updated here | follow-up owed — FILES | follow-up #N | none — REASON (pm-dispatch SKILL.md L313; updated here covers "skills/** or the docs"). The PR body reads Skills-docs: none in \skills/**`, which teaches neither rule nor the closure. `content/docs/deployment/validating-metadata.mdx` names the closure's four limbs and not the fifth…— anonewhose own sentence names a docs page this diff makes stale. The page is now false:content/docs/deployment/validating-metadata.mdxL735-739 states the fourth door "narrows that context to the written item's **package closure** — the written package, its declared dependencies, and unconditionally both platform/system objects and rows carrying no package provenance (#9612)", which for a dashboard or report write no longer describes the snapshot (the bound datasets' base objects are carried too). Correct line:Skills-docs: follow-up owed — content/docs/deployment/validating-metadata.mdx(the seat files the card and rewrites it tofollow-up #Nbefore ACCEPT), or the one sentence added to that paragraph in this PR withSkills-docs: updated here. The dev already handed the page to the seat in the Acceptance notes and the report's out_of_scope_findings`; the declaration line has to say so in the template's words. Outside the four contract faces; does not move this verdict.
2. Dev flag — "lint: the dataset filter-key rules refuse a bare dimension or measure name that the dataset door binds at run time #30006 meets a wider population": a real author-facing regression, judged acceptable here, with two conditions for the seat. Scenario: runtime package app.sales (no dependency on the showcase) builds a dashboard on showcase_task_metrics, which declares a dimension { name: 'state', field: 'status' }; the widget carries filter: { state: 'done' }. At run time dataset-filter-field-binding.ts L28-29 and L142 bind state to the dimension's sql, so the tile renders. On main the gate skipped (object absent) and the board published; on this head widget-filter-field-unknown refuses it 422 at dashboards[0].widgets[0].filter.state, because validate-widget-bindings.ts L1157-1168 has no dimension skip (the report rule has one at validate-report-runtime-filter.ts L101; neither rule skips a measure name). So yes: a body the door binds, that published before, is refused after. Why not a must-fix of this PR: the spec declares no dimension- or measure-key capability for these filters (dashboard.zod.ts L1182 "Presentation-scope filter (runtimeFilter)", report.zod.ts L454/L602 "Render-time scope filter"), so no declared capability is taken away at the consumer; the refusal is the rule's own pre-existing verdict on every in-closure dataset (the lint: the dataset filter-key rules refuse a bare dimension or measure name that the dataset door binds at run time #30006 filer measured it there), and route 1's contract is precisely "the cross-closure verdict equals the in-closure one" (pinned); the owning card lint: the dataset filter-key rules refuse a bare dimension or measure name that the dataset door binds at run time #30006 is serial behind this card on the same seat. Conditions: (a) the seat dispatches lint: the dataset filter-key rules refuse a bare dimension or measure name that the dataset door binds at run time #30006 so both changesets ride the same release train — the window between the two landings is the only one in which a cross-closure author meets the refusal with no fix in sight; (b) the changeset's "Accepted, as before" list is not complete for a BREAKING-note reader: one sentence that a bare dimension or measure name is refused on a cross-closure dataset as it already is inside the closure, tracked by lint: the dataset filter-key rules refuse a bare dimension or measure name that the dataset door binds at run time #30006, belongs there (prose face, seat's sentence check).
3. Dev flag — dotted keys. Confirmed in code: only the base object is re-admitted; a hop onto an object the snapshot lacks is unknowable and isUnjudgeable, never a finding. The changeset says so.
4. Dev flag — HTTP status; do the refusal tests assert code and status? No. The nine committed cases are lint-layer and assert rule, path and severity: 'error'; a lint finding carries no code/status (the envelope is the door's). The door mapping of these two rule ids to 422 INVALID_METADATA is pinned in packages/metadata-protocol/src/protocol.dashboard-dataset-publish-gate.test.ts L435-484, but with no package closure in force; the card's pin "refused 422 at the widget path" under a closure was measured at the door (report 6648301262) and not committed, because the claim's file surface stopped at packages/lint. Under review-checklist "拒收用例 ⇒ code+status 最低断言" this is the seat's call: waive on the existing envelope pins plus the measured reading, or widen the file surface by one describe in that metadata-protocol test (a runtime-package dashboard on a cross-package dataset, status/code asserted). Not a contract-face must-fix.
5. Unnamed rule ids (①.2). widget-filter-field-not-included, dashboard-filter-field-unknown, dashboard-filter-field-not-included, dashboard-filter-field-unprovisioned now also reach cross-closure dashboards. Same direction, same door binding; the changeset should name them (prose face).
6. Dev's out-of-scope dogfood red (test/update-by-id-refusal-order.dogfood.test.ts, 404 where 403 is pinned) reproduced with lint at origin/main — not this diff; the report's dedupe words are there for the seat to file. The dogfood_battery field is pinned to this head, full, with the one red explained; noted for the seat's !/narrowing check.
7. Check-runs at read time (2026-11-05 ~03:00Z): Lint · scoped · tooling self-tests, Lint · PM dispatch-gates, Lint · CI, release & engine gates, Governed Surface Queue Guard, Check Changeset, Dogfood Regression Gate, PR-body guards are success; Type Check · workspace/source gates/debt ledger/consumer gates, Type Check UI, Build Core, Test Core (1-8/8), Test UI (1-16/16), Lint · ESLint, Lint · repo & tooling gates, Lint · docs & code guards still in_progress. The queue entry waits for all-green (contract-review.md ②); this record does not stand in for it.
8. open_questions: [] — nothing to answer.

④ Design judgment

• packages/lint/src/runtime-gate.ts — route 1 over route 2, holds against the code it cites and the card. The card asks for one of two routes with a reason, and forbids refusing a key the door binds. The door (dataset-filter-field-binding.ts for queryDataset) resolves a cross-package dataset's filter against that dataset's own object with no closure in force; route 1 hands the two rules exactly that object and changes no rule, so the gate's universe for the filter keys is the door's. Route 2 would owe the cross-closure reference its own verdict, which the card's third pin (a good key still publishes) forbids refusing, and a non-refusing verdict would still leave the keys unjudged unless the object were brought in anyway — the dev's reasoning is right. Keying limb 5 on the written TYPE rather than on "any dataset reference" is the right boundary: the DARK case shows the alternative — a list view's chart.dataset re-admitting the very object the view lists would wave list-view-object-outside-closure through. Positions read agree with the rules' positions one for one; the dangling-dataset and no-datasets exits are right; applying the same set to all three passes keeps candidate MINUS baseline a single question. The public function's four-limb answer is preserved by delegation rather than by a second copy of the predicate — one implementation, as the closure ruling (runtime gate: full runtime-safe rule snapshot for the publish door — the expensive half split out of the object-gating card #9612) requires.
• packages/lint/src/runtime-gate.package-closure.test.ts — the pins carry the scenario. New top-level describe in the component's existing harness (ruling 6583487846). LIT cases assert the exact finding list ([rule, path] pairs) for the filer's repro, the report twin and the joined container+block; the CONTROL case covers field, operator and injected-column keys on both write types; the scoped-equals-whole-collection equality is the strongest statement of route 1's contract; the dangling-dataset, DARK and public-four-limb cases pin what must not move; the unit pin reads both positions and the view exit. Ablation (limb 5 disabled through scripts/ablation-replace.mjs, blob hashes recorded, restored to HEAD): 4 red / 5 green, the five green being the controls and pins that must not depend on the limb — the right split. The datasetBoundObjectNames export exists for this file only and matches the module's existing convention (buildRuntimeWriteSnapshotSet).
• Must-fix defects on the contract faces: none. The two correct declaration lines are Clause-②: no (narrowing) and Metadata-protocol: narrowed; the Skills-docs: line must be rewritten by the dev or seat as in ③.1 before ACCEPT (prose face).

Implemented-by: claude/project-thread-dogsgp
Reviewed-by: session_01Utp6CbPxYq1wQmUNWvMZkC

VERDICT: PASS

domain:server#3 · os-bill · session_01Utp6CbPxYq1wQmUNWvMZkC

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: ae7fa514e5fccd5ed58307428b2783bbb3ce63c6
Local-runs: none
Scope: packages/lint/src/runtime-gate.ts, packages/lint/src/runtime-gate.package-closure.test.ts, packages/metadata-protocol/src/protocol.dashboard-dataset-publish-gate.test.ts + packages/lint/src/validate-widget-bindings.ts, packages/lint/src/validate-report-runtime-filter.ts, packages/metadata-protocol/src/runtime-authoring-gate.ts, .changeset/30005-cross-closure-dataset-filter-keys.md and content/docs/deployment/validating-metadata.mdx (prose faces, sentences read against the diff for the Skills-docs: judgment)

Delta review of the record on b37c73da8aff9c8189ccf7fd3ba23d579823de3a (PR comment 6648480102, PASS, no must-fix): the head moved by one commit, git diff b37c73da..ae7fa514 touches three files and no packages/*/src non-test file — .changeset/30005-cross-closure-dataset-filter-keys.md (+3/−1), content/docs/deployment/validating-metadata.mdx (+6), packages/metadata-protocol/src/protocol.dashboard-dataset-publish-gate.test.ts (+95). packages/lint/src/runtime-gate.ts is byte-identical to the reviewed head (blob c6fdac3163… in the dev's ablation transcript equals the blob reviewed on b37c73d). Items ①–④ of the earlier record stand unchanged except where this delta says otherwise; only the delta is judged below. PR user.login is still objectstack-fleet[bot].

① Derived judgments

1. Accept set and public surface: no change from b37c73d. The code the gate runs is the same blob; the new commit adds a test, a docs paragraph and changeset sentences. Every ① judgment of the earlier record (six rule ids newly reaching cross-closure dashboards and reports; nothing the door binds refused by design; flow, list-view and dataset closure verdicts unchanged; narrowObjectsToPackageClosure unchanged; datasetBoundObjectNames not on a package entry) is unchanged.
2. The door-level pin (protocol.dashboard-dataset-publish-gate.test.ts, new #30005 describe) asserts what the card pins. makeClosureProtocol() adds a showcase-stamped showcase_task (fields name, status) and showcase_task_metrics (object: 'showcase_task', _packageId: 'com.example.showcase') to the stub registry and installs app.runtime with no dependencies via getPackage, so the write's closure is the written package plus platform/unpackaged rows and the dataset's object is outside it. LIT: saveMetaItem({ type: 'dashboard', …, packageId: 'app.runtime' }) with filter: { no_such_field: 'x' } → expect({ status, code }).toEqual({ status: 422, code: 'INVALID_METADATA' }), issues contains ['widget-filter-field-unknown', 'dashboards[0].widgets[0].filter.no_such_field'], and no active dashboard row is stored. CONTROL: filter: { status: 'done' } saves success: true with an active row. status and code are both asserted, as review-checklist asks (the ③.4 gap of the earlier record is closed). The helpers it uses (makeStubEngine L121, dashboardRows, ObjectStackProtocolImplementation L48, vi/beforeEach/afterEach L41) are the file's own; no new import.
3. The pin fails without the fix — read from /mnt/project-files/server-seat3/30005/ablation-door.txt. At HEAD ae7fa514e, scripts/ablation-replace.mjs replaced the limb-5 line in packages/lint/src/runtime-gate.ts with a marker that disables it (anchor 1 → 0, blob c6fdac316370 → bcc5f8d8e8b0), rebuilt @objectstack/lint with --force, and ablation-dist-preflight.mjs found the marker in all four built entry files (so the suite consumed the mutated artifact). vitest run … -t 30005: 1 failed | 1 passed | 13 skipped — the LIT case fails with { status: undefined, code: undefined } (the save went through, the filer's reading), the CONTROL still passes. Restore leg: blob back to c6fdac3163… == HEAD, git diff HEAD empty, rebuilt, preflight --absent confirms the marker gone from all 20 built files and the working tree clean, then the whole file 15 passed (15). This is the mutate/restore shape the ablation rule asks for, with the artifact-level preflight that makes a dist-consuming test's ablation honest.
4. Changeset sentences, read against the diff (prose face; stated here because the Skills-docs: judgment depends on them). (a) "Which rules now judge such a dataset … all six already judging datasets inside the closure: widget-filter-field-unknown, widget-filter-field-not-included, dashboard-filter-field-unknown, dashboard-filter-field-not-included, dashboard-filter-field-unprovisioned and report-filter-field-unknown" — true: exactly the six rule ids the earlier record derived from validate-widget-bindings.ts L1013-1021/L1058/L1079/L1157/L1172 and validate-report-runtime-filter.ts L99-112, all reached through the one "object absent" skip limb 5 removes. (b) "A dimension name as a widget filter key … now refused with widget-filter-field-unknown, as it already was on a dataset inside the closure. The dataset query binds such a key; the correction of that verdict, for both cases, is tracked in lint: the dataset filter-key rules refuse a bare dimension or measure name that the dataset door binds at run time #30006" — true (widget rule has no dimension skip at L1157-1168; the report rule's is at L101; dataset-filter-field-binding.ts L28-29/L142 binds the name; lint: the dataset filter-key rules refuse a bare dimension or measure name that the dataset door binds at run time #30006 covers the dimension and measure halves). The sentence is silent on the measure-name case, which is also lint: the dataset filter-key rules refuse a bare dimension or measure name that the dataset door binds at run time #30006's; silence, not a false statement. (c) Skills-docs: updated here — content/docs/deployment/validating-metadata.mdx (the fourth-door paragraph) now names the fifth closure limb …; skills/** teaches neither the rules nor the closure — true against the docs hunk.
5. Docs sentence, read against the code. validating-metadata.mdx L740-745: "A dashboard or report write also keeps the base object of each dataset it binds (a widget's dataset; a report's dataset and each joined block's), because the datasets are never narrowed and the dataset query resolves a filter against that object whichever package ships it: a filter key the object lacks is refused there just as it is on a dataset inside the closure (lint publish gate: widget-filter-field-unknown and report-filter-field-unknown are silent when the dataset's object is outside the written package's closure #30005). No other write type keeps it, so a flow or a list view never reaches an outside object through a dataset." Every clause matches runtime-gate.ts#datasetBoundObjectNames (positions L515-523, type gate L511) and #buildRuntimeWriteSnapshotSet (datasets carried whole). The page's four-limb sentence is no longer false for the two write types. Build Docs and Check Documentation Links are success on this head.

② Semver level

Unchanged and still consistent: '@objectstack/lint': minor, **BREAKING** banner, Clause-②: no (narrowing), Metadata-protocol: narrowed, one adr-0087: not-required (no-migration-prescription) marker. The delta adds a test to @objectstack/metadata-protocol (tests publish nothing — no changeset owed) and a docs page. Check Changeset is success on this head (run 41959195953, 03:03Z); a second Check Changeset run triggered by the PR-body edit (run 41962338408, 03:33Z) was still in_progress at read time.

③ Boundary flags

1. Skills-docs: line — now a valid spelling and true. PR body L8 and the changeset read Skills-docs: updated here — …: the value opens with the template token updated here (pm-dispatch SKILL.md L313: updated here | follow-up owed — FILES | follow-up #N | none — REASON), followed by the file it updated; the diff does teach the limb in the docs page it names. The earlier record's ③.1 REWORK item is closed. (updated here's second clause, "the package's evals exercise it", has no object for a docs page; the door pin is the exercising test.)
2. No closing keyword next to lint: the dataset filter-key rules refuse a bare dimension or measure name that the dataset door binds at run time #30006. Grep of the new PR body for (close|closes|closed|fix|fixes|fixed|resolve|resolves|resolved)[ :]*#N hits only Fixes #30005 (L4); the changeset has none. The two lint: the dataset filter-key rules refuse a bare dimension or measure name that the dataset door binds at run time #30006 mentions are "(lint: the dataset filter-key rules refuse a bare dimension or measure name that the dataset door binds at run time #30006, serial behind this card, not touched here)" (body L100) and "is tracked in lint: the dataset filter-key rules refuse a bare dimension or measure name that the dataset door binds at run time #30006" (changeset) — zero verbs beside the number, the safe spelling.
3. lint: the dataset filter-key rules refuse a bare dimension or measure name that the dataset door binds at run time #30006 regression (earlier ③.2): condition (b) met, condition (a) remains the seat's. The changeset now carries the dimension-name sentence naming lint: the dataset filter-key rules refuse a bare dimension or measure name that the dataset door binds at run time #30006. Dispatching lint: the dataset filter-key rules refuse a bare dimension or measure name that the dataset door binds at run time #30006 so both ride one release train stays the seat's scheduling matter, not this PR's.
4. Dogfood battery on this head. The reported battery (3487 passed, one pre-existing red reproduced with lint at origin/main) was taken on b37c73d. This head changes no runtime source — git diff --stat names a changeset, a docs page and a metadata-protocol test only — so the battery's subject is byte-identical; Dogfood Regression Gate is success on ae7fa51. Whether the !/narrowing rule accepts a battery pinned to the previous head on a source-identical tree is the seat's call under review-checklist; the reading is stated so it can be made.
5. Check-runs on ae7fa51 at read time (~03:35Z): all required and non-required runs of the 03:03Z push are success (Lint & Repo Gates, TypeScript Type Check, Type Check · workspace/source gates/debt ledger/consumer gates, Type Check UI, Build Core, Build & E2E UI, Build Docs, Test Core 1-8/8, Test UI 1-16/16, Live E2E UI, Dogfood Regression Gate, Governed Surface Queue Guard, Check Changeset, PR-body guards, Spec property liveness, Check Documentation Links, all Lint · jobs); the 03:33Z PR-body-edit re-run has Check Changeset in_progress and Auto Label/Check PR Size skipped. The queue entry waits for that re-run to finish green (contract-review.md ②); this record does not stand in for it.
6. Dev's open_questions: [] — nothing to answer. The earlier record's ③.5 (unnamed rule ids) and ③.4 (code/status) are both closed by this commit.

④ Design judgment

• packages/metadata-protocol/src/protocol.dashboard-dataset-publish-gate.test.ts — the pin sits at the right layer and in the right file: the door that maps a gate error to 422 INVALID_METADATA is the subject, the file is this component's shared harness (ruling 6583487846: a new top-level describe, not a new file), and the harness is extended by overriding registry.listItems and getPackage on the stub rather than by a second engine — the closure (app.runtime installed, no dependencies) is real at the door, not simulated in lint. The LIT asserts envelope, located issue and the absence of a stored active row; the CONTROL asserts the good key still saves under the same closure (the card's third pin, now at the door). The ablation shows the LIT depends on limb 5 through the built artifact and the CONTROL does not. Holds against the card's scenario.
• content/docs/deployment/validating-metadata.mdx — one paragraph, placed where the four limbs are stated, saying what the code does and only that, including the type boundary (flow and list view). Holds against runtime-gate.ts as read.
• packages/lint/src/runtime-gate.ts, runtime-gate.package-closure.test.ts — unchanged since the reviewed head; ④ of comment 6648480102 stands.
• Must-fix defects: none.

Implemented-by: claude/project-thread-dogsgp
Reviewed-by: session_01Utp6CbPxYq1wQmUNWvMZkC

VERDICT: PASS

domain:server#3 · os-bill · session_01Utp6CbPxYq1wQmUNWvMZkC

席位核对

ACCEPT · head ae7fa514e5fccd5ed58307428b2783bbb3ce63c6 · card #30005 (claim 6647296389, amended 6648490802) · 2026-11-05T03:38Z

• Shape: draft PR to main, author objectstack-fleet[bot] (relay), attribution block then Fixes #30005; the only other card number in body and changeset, lint: the dataset filter-key rules refuse a bare dimension or measure name that the dataset door binds at run time #30006, sits beside no closing keyword. 5 files, +359 −1. No governed path, no packages/spec/src/** ⇒ not Tier H.
• Declarations: Clause-②: no (narrowing), Metadata-protocol: narrowed, Skills-docs: updated here — … (valid spelling, true); changeset @objectstack/lint minor with BREAKING and the adr-0087 not-required marker.
• Contract review: PASS at CONTRACT_REVIEW_TIER on the narrowing face: full record 6648480102 on b37c73da, delta 6648998716 on this head (runtime-gate.ts blob unchanged; docs, changeset and the door test checked).
• Gates (check-runs on this head): 69 runs, 59 success, 10 skipped, 0 failed; Lint & Repo Gates, TypeScript Type Check, Check Changeset, Dogfood Regression Gate success. Skips read by name (path-gated UI/docs, opt-in harnesses, the schedule gate): check-expected-skips.mjs cannot run in this container (yaml not installed).
• Dogfood battery: run by the dev at b37c73da, whose source is identical to this head outside the docs, changeset and one test file: 3487 passed, 1 failed (update-by-id-refusal-order), which is the known main-red main red: Dogfood Regression Gate (2/3) fails update-by-id-refusal-order after PR #30165 #30198, not this PR.
• Refusal assertions: lint pins assert rule, path, severity; the door pin asserts status 422 and code INVALID_METADATA, with one ablation recorded (LIT red, CONTROL green, restored).
• Prose read against the diff: the docs fourth-door paragraph's fifth-limb sentences; the changeset's six-rule sentence and its lint: the dataset filter-key rules refuse a bare dimension or measure name that the dataset door binds at run time #30006 sentence.
• Accepted deviation: file surface widened by the seat for the patch round (amendment 6648490802).
• Carried: lint: the dataset filter-key rules refuse a bare dimension or measure name that the dataset door binds at run time #30006 (a bare dimension name as a widget filter key is refused, now also on cross-closure datasets) is next on this seat, for the same release train.
• Writes: dev api_writes 2 + 0, mcp_calls 0.
• Landing: held. The seat's session refused to ready and arm auto-merge on this BREAKING narrowing without the maintainer's word; the seat asked the maintainer in its project thread.

domain:server#3 · os-bill · session_01Utp6CbPxYq1wQmUNWvMZkC

维护者速读（席位终稿）

• 改了什么：发布门按软件包闭包收窄 objects 时，dashboard 与 report 的写入额外保留它绑定的 dataset 的基础对象。运行时包的看板用别的包的 dataset、筛选键写了该对象没有的字段时，发布被 422 拒收；report 的 runtimeFilter 同理；正确的键照常发布。
• 为什么改：以前 dataset 找得到、它的对象却被闭包筛掉，两条筛选键规则走「对象不在快照里」的跳过分支，拼错的键发布成功，读者只看到空图块或报错面板（lint publish gate: widget-filter-field-unknown and report-filter-field-unknown are silent when the dataset's object is outside the written package's closure #30005）。
• 风险与回滚：收窄（BREAKING）：以前能发布的这类拼错筛选键，下次发布被 422 拒绝；已存的看板照常加载。flow、列表视图、dataset 写入的闭包判定不变（有 pin），公开函数 narrowObjectsToPackageClosure 签名与结果不变。回滚即 revert。
• 先看：packages/lint/src/runtime-gate.ts 的 datasetBoundObjectNames 与 narrowObjectsToWriteClosure 的第五肢；测试文件末尾 #30005 一节。
• 两分钟验证：pnpm --filter @objectstack/lint exec vitest run src/runtime-gate.package-closure.test.ts，48 条全过（lint publish gate: widget-filter-field-unknown and report-filter-field-unknown are silent when the dataset's object is outside the written package's closure #30005 一节 9 条）。
• 需要你做的：无。技能定档：非受管面、360 行，不需人审；契约复核 6648998716（Head-sha ae7fa514e5fccd5ed58307428b2783bbb3ce63c6，PASS），席位落地。

席位意见：同意落地。只多拒收闭包外 dataset 上对象确实没有的字段，误伤面有 pin 守住。

席位核对

ACCEPT（重申，补全席位记录） · head ae7fa514e5fccd5ed58307428b2783bbb3ce63c6 · card #30005 (claim 6647296389, amended 6648490802) · 2026-11-05T13:50Z · supersedes the record-only ACCEPT 6649020474.

• Shape: draft PR to main, relay author, Fixes #30005 only. 5 files, +359 −1. check-governed-merges.mjs --pr 30231 → exit 0, NOT governed, 360 ≤ 3000. No merge=os-regen path. mergeable_state clean.
• Premise measured: per the dev's reverse verification on the PR body (cross-package dataset, misspelled key → 200 on main, 422 after); review 6648998716 re-read it.
• Gates (check-runs on this head): 69 runs, 59 success, 10 path-gated skipped, 0 failed. Dogfood battery (! + narrowing): run once at b37c73da, source-identical to this head outside docs/changeset/one test; 3487 passed, 1 failed = known main-red main red: Dogfood Regression Gate (2/3) fails update-by-id-refusal-order after PR #30165 #30198, reported.
• Accepted deviation: battery reading taken one head back on identical source (review 6648998716 accepted it).
• Out of scope: none filed. Skills-docs: updated here — content/docs/deployment/validating-metadata.mdx.
• Landing: BREAKING (!, Clause-②: no (narrowing)), not governed, ≤ 3000 ⇒ the skill requires no human merge; maintainer 13:47Z 「技能不需要我审核的不应该等我」 ⇒ seat lands it now. p0 fix(cloud-connection): stage the ledger adoption copy without mkdtempSync, so main's dispatch-gates lane is green again #30487 is queued ahead.