@@ -0,0 +1,40 @@
+---
+"@objectstack/spec": minor
+"@objectstack/lint": minor
+---
+
+fix(spec,lint)!: an `objectExtensions` entry that leaves a `controlled_by_parent` object with anything but one required `master_detail` is refused, as the same object declared directly already was (#23210)
+
+Clause-②: no (narrowing)
+
+<!-- adr-0087: registered cbp-extension-merged-master-refused -->
+
+**BREAKING** (an accept-set narrowing on a published authoring surface), shipped as `minor` under the launch-window convention for breaking changes.
+
+ADR-0055 §1: a `controlled_by_parent` object derives its master from exactly one `master_detail` field declared `required: true`. `ObjectSchema` refuses an object that declares anything else, and so does the security-posture lint. Neither looked at the object the runtime actually runs: at boot the registry merges every `objectExtensions` entry onto its target, field by field, so an extension could add a second required `master_detail`, or demote the one master. `defineStack`, `os validate` and the lint passed the stack, and the runtime then derived no master: every read of the object denied, every write refused with `422 INVALID_METADATA`.
+
+**What is refused, and where.**
+
+- **`@objectstack/spec`.** `ObjectStackDefinitionSchema` (so `defineStack`, `os validate`, `os build`, the lint scorer and an artifact load) judges the rule on the merged field set of every `controlled_by_parent` object that an `objectExtensions` entry of the same stack extends. In a multi-package artifact (`packages[]`), an extension in any package judges an object any package declares. The merge is read as the registry computes it: fields by name, a later writer replacing the whole field, extensions in ascending `priority`. The issue sits at the `fields` of the extension that wrote the deciding field (`objectExtensions.0.fields`, or `packages.0.manifest.objectExtensions.0.fields`), with the message the same object gets when declared directly. `defineStack` throws `STACK_SCHEMA_INVALID` (422) carrying it.
+- **`@objectstack/lint`.** `security-controlled-by-parent-ambiguous-relation` and `security-controlled-by-parent-no-relation` judge the same merged shape and report it at the same extension, in the words of the declared object's finding.
+
+No export, signature or error code is added or removed.
+
+## FROM → TO
+
+| stack | FROM | TO |
+|:--|:--|:--|
+| `objects: [{ name: 'cbpx_line', sharingModel: 'controlled_by_parent', fields: { header: { type: 'master_detail', reference: 'cbpx_header', required: true } } }, …]`, `objectExtensions: [{ extend: 'cbpx_line', fields: { other: { type: 'master_detail', reference: 'cbpx_other', required: true } } }]` | accepted; at runtime the object derived no master and failed closed | refused at `objectExtensions.0.fields`: "Object 'cbpx_line' declares sharingModel 'controlled_by_parent' with 2 required `master_detail` fields (`header`, `other`)…" |
+| the same object, extended with `fields: { header: { type: 'master_detail', reference: 'cbpx_header', required: false } }` | accepted; no master at runtime | refused at `objectExtensions.0.fields`: "…but no required `master_detail` field…" |
+| an artifact built before this change that carries either shape | loaded; the object failed closed | refused at load; rebuild it from the corrected source |
+
+**Remedy, in one line.** In the extension, drop the second master or declare it `type: 'lookup'`, and never redeclare the object's master with `required: false` or another type.
+
+**Unchanged.**
+
+- An extension adding any non-master field (a `lookup` to another parent included) to a `controlled_by_parent` object.
+- An extension whose target the stack does not declare: another package's object, or the platform's. It is not judged, and the runtime's fail-closed refusal remains the backstop there.
+- An object already refused as declared is reported once, at the object.
+- In a multi-package artifact, a target on which two packages write one field at the same `priority`: the winner is the order the artifact loader registers them in, which the parse does not compute, so it is not judged.
+- Stored `sys_metadata` rows: an extension is merged only when a stack or an artifact registers, so no stored row carries the shape and none is rewritten.
+- The step-18 entry `cbp-extension-merged-master-refused` carries the prescription for `os migrate meta`. It is asked only of a stack that declares `objectExtensions`.
@@ -0,0 +1,48 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+import type { SemanticMigration } from '../../types.js';
+
+// ADR-0055 §1, judged on the object the runtime runs. An accept-set narrowing
+// of the stack schema: an objectExtensions entry that leaves a
+// controlled_by_parent object the same stack declares with anything but one
+// required master_detail is refused, as the same object declared directly
+// already was (cbp-master-relation-tiers-retired). No D2 conversion: which
+// master stays is the owner's pick, and turning one into a lookup changes what
+// deleting its master does. No stored row carries the shape — an extension is
+// merged only when a stack or artifact registers — so the consequence at rest
+// is an artifact built before 18, which its load now refuses.
+export const entry: SemanticMigration = {
+  id: 'cbp-extension-merged-master-refused',
+  // No backticks in `surface` — build-upgrade-guide renders it inside a code
+  // span already, and a nested backtick would close it.
+  surface:
+    'objectExtensions[].fields (also packages[].manifest.objectExtensions[].fields) merged into a '
+    + 'sharingModel: controlled_by_parent object the same stack or artifact declares',
+  replacement:
+    'The object as merged keeps exactly one master_detail field declared required: true. An extension of a '
+    + 'controlled_by_parent object adds every other parent as a lookup field (drop the second master, or '
+    + 'declare it type: \'lookup\'), and never redeclares the master field with required: false or another '
+    + 'type. If a second parent must govern the rows, that is a different object design, decided by the '
+    + 'owner of the object, not by an extension.',
+  reason:
+    'The registry merges every objectExtensions entry onto its target at boot, a field replaced whole by name, '
+    + 'so an object that passed its own parse could run with two required master_detail fields, or none. The '
+    + 'runtime then derives no master: every read of the object is denied and every write refused with 422 '
+    + 'INVALID_METADATA, while defineStack, objectstack validate and the security-posture lint said nothing, '
+    + 'although they refused the same object declared directly. ObjectStackDefinitionSchema now judges the '
+    + 'ADR-0055 §1 rule on the merged field set of every target the stack declares (in a multi-package '
+    + 'artifact, any package\'s object), and refuses at the extension\'s fields with the message the declared '
+    + 'object gets; the lint reports security-controlled-by-parent-ambiguous-relation or -no-relation at the '
+    + 'same extension. A target the stack does not declare is not judged, so an extension of another '
+    + 'package\'s object still meets the runtime\'s refusal instead. Not convertible: which master stays, and '
+    + 'whether a parent becomes a lookup, are the owner\'s decisions.',
+  acceptanceCriteria:
+    'defineStack, objectstack validate and objectstack build load the stack with no issue at an '
+    + 'objectExtensions entry\'s fields of the form "declares sharingModel \'controlled_by_parent\' with N '
+    + 'required master_detail fields" or "but no required master_detail field", and objectstack lint reports '
+    + 'neither security-controlled-by-parent rule at an objectExtensions path. At runtime the security plugin '
+    + 'logs no "resolves no master relation" line for the extended object, and a member who can read its '
+    + 'master reads its rows. An artifact built before 18 that carries the shape is refused at load until it '
+    + 'is rebuilt from the corrected source.',
+  relevantWhen: { kind: 'stack-declares', keys: ['objectExtensions'] },
+};
@@ -45,6 +45,7 @@ const EXPECTED_RELEVANCE: Readonly<Record<string, readonly string[]>> = {
   '18:analytics-cube-public-default-visible-enforced': ['analyticsCubes'],
   '18:analytics-cube-single-granularity-default-enforced': ['analyticsCubes'],
   '18:api-endpoint-cache-ttl-unit-in-key': ['apis'],
+  '18:cbp-extension-merged-master-refused': ['objectExtensions'],
   '18:chart-config-aria-retired': ['dashboards', 'reports', 'pages'],
   '18:cube-join-sql-and-relationship-retired': ['analyticsCubes'],
   '18:cube-member-inner-name-retired': ['analyticsCubes'],
@@ -82,11 +83,11 @@ describe('which entries carry a relevance question (ENUMERATION)', () => {
     expect(actual).toEqual(EXPECTED_RELEVANCE);
   });
 
-  it('is 25 entries: 5 of protocol 17 and 20 of protocol 18', () => {
+  it('is 26 entries: 5 of protocol 17 and 21 of protocol 18', () => {
     const keys = Object.keys(EXPECTED_RELEVANCE);
-    expect(keys).toHaveLength(25);
+    expect(keys).toHaveLength(26);
     expect(keys.filter((k) => k.startsWith('17:'))).toHaveLength(5);
-    expect(keys.filter((k) => k.startsWith('18:'))).toHaveLength(20);
+    expect(keys.filter((k) => k.startsWith('18:'))).toHaveLength(21);
   });
 
   it('the table names only registered entries (anti-vacuity for the comparison above)', () => {