@@ -2,26 +2,35 @@
 '@objectstack/lint': minor
 ---
 
-fix(lint): a list view written into a package and bound outside that package's closure is reported at the save door, not skipped (#24563)
+fix(lint)!: the save door refuses a list view written into a package and bound outside that package's closure (#24563)
 
-Clause-②: yes
+Clause-②: yes (narrowing)
 
-**Why.** The runtime save door judges a write into a package against that package's closure (ruling #9612): the package's own objects, the objects of the packages its manifest declares in `dependencies`, platform/system objects, and provenance-less overlay rows. Every other object is dropped from the snapshot before any rule runs. The list-view field rule read a binding missing from that snapshot as "an object this stack does not define" and skipped the whole list view. So a list view written into a package and bound to an object of a package it never declared (or to an object that exists nowhere) was stored with every field reference unjudged: `200`, no advisory, while the same body as an overlay write is refused `422 list-view-field-unknown` for an unknown `columns` field. No other rule judged the binding on a `view` write.
+**Why.** The runtime save door judges a write into a package against that package's closure (ruling #9612). The closure is the package's own objects, the objects of the packages its manifest declares in `dependencies`, platform/system objects, and provenance-less overlay rows; every other object is dropped from the snapshot before any rule runs. The list-view field rule read a binding missing from that snapshot as "an object this stack does not define" and skipped the whole list view. So a list view written into a package and bound to an object of a package it never declared, or to an object that exists nowhere, was stored with every field reference unjudged: `200`, no advisory. The same body as an overlay write is refused `422 list-view-field-unknown` for an unknown `columns` field. No other rule judged the binding on a `view` write, and such a view then fails at render ("This view's query was rejected").
 
-**What changes.** At the runtime save door (Studio, REST `/meta`, MCP), a list view written into a package whose bound object is outside the package's closure now draws one `list-view-object-outside-closure` warning, located at the key the binding is read from (`views[0].data.object` for a standalone list view). It rides the save response's `advisories` and the `[Protocol] authoring advisory` log line. This covers a publish-mode save (`PUT /api/v1/meta/view/:name?package=…`, `saveMetaItem`), the promotion of a draft (`publishMetaItem`), and a package draft publish (`publishPackageDrafts`, on the published item's `advisories`). An object that exists nowhere draws the same warning. It is the verdict a flow's out-of-closure trigger object already gets at the same door (`flow-trigger-unknown-object`, `warning`): reported, not refused. The write is still stored, and the list view's field references stay unjudged until the binding is inside the closure. An object written into a package whose built-in `listViews` entry retargets `data.object` outside the closure draws the same warning.
+**What is refused.** A list view written into a package whose bound object is outside the package's closure is refused with one `list-view-object-outside-closure` issue. The issue is located at the key the binding is read from: `views[0].data.object` for a standalone list view, otherwise the container's `objectName` / `object`. The hint names the remedy. An object that exists nowhere is refused the same way. This is the verdict the dataset door already gives an out-of-closure base object under the same closure (`object-reference-unknown`). An object written into a package whose built-in `listViews` entry retargets `data.object` outside the closure is refused the same way. The list view's field references stay unjudged until the binding is inside the closure.
 
-- Fix: declare a dependency on the package that defines the bound object in the `dependencies` of the writing package's manifest, or bind the view to an object inside the closure. Once the object is inside, its fields are judged: an unknown `columns` field is refused `422 list-view-field-unknown`, as at the overlay door.
+**BREAKING — what moves for consumers.** This is an accept-set narrowing on the metadata save door, shipped as `minor` under the launch-window convention for accept-set narrowings (`.changeset/pre.json` is open in `next` pre mode).
+
+- FROM: a publish-mode write of a list view into a package, bound outside the package's closure, answered `200` and was stored, with no issue. This covers `PUT /api/v1/meta/view/:name?package=…` (and `saveMetaItem` in publish mode), the promotion of a draft (`POST /api/v1/meta/view/:name/publish`, `publishMetaItem`), and a package draft publish (`publishPackageDrafts`).
+- TO: it answers `422 INVALID_METADATA`, with the `list-view-object-outside-closure` issue at the binding, and nothing is stored. A package draft publish fails the item, and the batch with it.
+- Fix: declare a dependency on the package that defines the bound object in the `dependencies` of the writing package's manifest, or bind the view to an object the package may reach (its own, a declared dependency's, or a platform object). Then save again. Once the object is inside the closure its fields are judged: an unknown `columns` field is refused `422 list-view-field-unknown`, as at the overlay door. Saving the view as a draft (`mode: 'draft'`) is still allowed, because drafts are never gated; publishing that draft is judged.
+
+**The next save of a stored list view bound outside its package's closure is refused with the fix; stored views keep serving until then.** The door judges writes only. A stored row is not re-judged at boot, and it loads and is served as before.
 
 **Unchanged.**
 
 - A list view bound to an object inside the closure (the package's own, a declared dependency's, a platform/system object, an overlay row): same field verdicts, same refusals.
-- A write that names no package (an overlay write): judged against the whole collection, exactly as before. An object that exists nowhere stays silent there.
+- A write that names no package (an overlay write) is judged against the whole collection, exactly as before. An object that exists nowhere stays unjudged there.
+- The flow door: `flow-trigger-unknown-object` stays an advisory.
 - `os validate`, `os build` and `os lint`: no closure is stated, so the rule skips an unresolvable binding as before.
-- Drafts are not gated.
-- Measured before the change: the 11 views shipped in this repository (`examples/app-crm`, `app-todo`, `app-showcase`, `app-multi-package`, the `create-objectstack` blank template, `qa/downstream-contract`) carry 39 list-view bindings. None is outside its package's closure. The door's `view` rule set finds nothing in any of them, with the package's closure or without it, before or after this change. None of the 97 platform built-in list views retargets `data.object`. Deployed rows were not measured.
+- `OS_ALLOW_UNLINTED_METADATA_WRITES=1` still turns a refusal into a logged write.
+- Measured before crossing: the 11 views shipped in this repository carry 39 list-view bindings, in `examples/app-crm`, `app-todo`, `app-showcase` and `app-multi-package`, the `create-objectstack` blank template, and `qa/downstream-contract`. None is outside its package's closure, and the door's `view` rule set refuses none of them, with the package's closure or without it. None of the 97 platform built-in list views retargets `data.object`. Deployed rows were not measured.
 
 **API.**
 
 - `AuthoringRuleContext` gains an optional `packageScope` (`{ packageId, dependencies }`). Only the runtime publish gate sets it, and only when it narrowed the snapshot's objects to a package closure. `runAuthoringRules` never sets it.
 - `validateListViewFieldRefs(stack, options?)` accepts an optional `{ packageScope }` (`ListViewFieldRefOptions`, exported).
 - `LIST_VIEW_OBJECT_OUTSIDE_CLOSURE` (`'list-view-object-outside-closure'`) is exported.
+
+<!-- adr-0087: not-required (no-migration-prescription) a refusal at the metadata save door of a list view written into a package and bound to an object outside that package's dependency closure: no authorable key, spelling, export or stored shape moves, and no stored row is read, rewritten or converted. A stored list view with such a binding keeps loading until it is next saved, and the repair is the author's choice of which package to declare as a dependency (or which object to bind), which no ledger entry can derive. The other categories are closed on facts: the package publishes (not unpublished); no ADR-0087 id covers this door (not already-registered); and the change is a door verdict, not a declaration or an export (not runtime-interface-only, type-surface-only or runtime-export-retired). -->
@@ -711,7 +711,7 @@ dependencies, and unconditionally both platform/system objects and rows carrying
 no package provenance (#9612); a provenance it cannot read narrows nothing at all.
 That changes what a rule can **resolve**, never which rules run, and nothing at
 this door walks `packages[]`. One rule is told the closure is in force: a list
-view bound to an object outside it draws the advisory
+view bound to an object outside it is refused with
 `list-view-object-outside-closure` instead of having its field references
 skipped (#24563). So "runs per package" names one thing at the three
 CLI doors and another one here, and the `runtime publish` column says neither.
 
@@ -385,7 +385,7 @@ export interface AuthoringRuleContext {
    * "not in this stack": an object missing from a narrowed snapshot is the
    * first, one missing from a whole one may come from another package. Read
    * by `validateListViewFieldRefs` only (through the reference-integrity
-   * suite), which reports a list view bound outside the closure instead of
+   * suite), which refuses a list view bound outside the closure instead of
    * skipping it.
    */
   packageScope?: { readonly packageId: string; readonly dependencies: readonly string[] };
 
@@ -491,7 +491,7 @@ export type {
 // compiled filter), where that door refuses it by name — the loud-failing half
 // #14107 recorded and left open.
 // [#24563] Its THIRD: a list view judged under a package closure whose bound
-// object is outside that closure — reported (advisory) where skip 1 judged
+// object is outside that closure — refused (`error`) where skip 1 judged
 // nothing; `ListViewFieldRefOptions` is how the runtime gate states the closure.
 export {
   validateListViewFieldRefs,
 
@@ -311,9 +311,10 @@ export const REFERENCE_INTEGRITY_RULES: readonly ReferenceIntegrityRule[] = [
   // closure the snapshot's `objects` are that closure (ruling #9612), so a
   // binding missing from it is outside what the package declared it may
   // reference, or nowhere at all — and the member's skip 1 used to read that as
-  // "another package's object" and judge nothing. It now reports the binding
-  // instead (`list-view-object-outside-closure`, `warning`: the verdict a
-  // flow's out-of-closure trigger object gets at the same door). The
+  // "another package's object" and judge nothing. It now refuses the binding
+  // instead (`list-view-object-outside-closure`, `error`: the verdict the
+  // dataset door gives an out-of-closure base object under the same closure;
+  // the flow door's trigger-object advisory is a separate question). The
   // missing-collection argument above is unchanged: the binding is judged
   // against `stack.objects`, the collection every per-write snapshot carries,
   // and the gate states the scope only when it narrowed that collection.
 
@@ -314,48 +314,49 @@ describe('the view door under a package closure (#24563)', () => {
   const whole = (item: AnyRec) => runRuntimeAuthoringRules({ type: 'view', item, context: { objects } });
   const rules = (fs: AnyRec[]) => fs.map((f) => f.rule);
 
-  it('REPORTS a binding into a package the written one never declared — advisory, the flow verdict', () => {
+  it('REFUSES a binding into a package the written one never declared — at the binding, with the remedy', () => {
     const result = scoped(listViewOn('other_0_0'));
 
-    // The verdict a flow's out-of-closure trigger object gets at this door
-    // (`flow-trigger-unknown-object`, pinned above): reported, not refused.
-    expect(result.errors).toEqual([]);
-    expect(result.advisories).toHaveLength(1);
-    expect(result.advisories[0]).toMatchObject({ severity: 'warning', rule: OUTSIDE });
-    expect(result.advisories[0].path).toMatch(/^views(\[0\]|\.other_0_0\.probe_list)\.data\.object$/);
+    // An `error`, so the door refuses the write: the dataset door's verdict
+    // for an out-of-closure base object under the same closure. The flow
+    // door's `flow-trigger-unknown-object` (pinned above) stays advisory.
+    expect(result.advisories).toEqual([]);
+    expect(result.errors).toHaveLength(1);
+    expect(result.errors[0]).toMatchObject({ severity: 'error', rule: OUTSIDE });
+    expect(result.errors[0].path).toMatch(/^views(\[0\]|\.other_0_0\.probe_list)\.data\.object$/);
     // The fix names the remedy and the package it applies to.
-    expect(result.advisories[0].hint).toContain(OWN);
-    expect(result.advisories[0].hint).toContain('dependencies');
+    expect(result.errors[0].hint).toContain(OWN);
+    expect(result.errors[0].hint).toContain('dependencies');
     // ⛔ The field positions stay unjudged: judging them against the whole
     // collection would judge the package against what ruling #9612 says it may
     // not reference.
-    expect(rules(result.advisories)).not.toContain(FIELD_UNKNOWN);
+    expect(rules(result.errors)).not.toContain(FIELD_UNKNOWN);
   });
 
-  it('REPORTS a binding to an object that exists nowhere the same way', () => {
+  it('REFUSES a binding to an object that exists nowhere the same way', () => {
     const result = scoped(listViewOn('nosuch_obj'));
 
-    expect(result.errors).toEqual([]);
-    expect(rules(result.advisories)).toEqual([OUTSIDE]);
+    expect(result.advisories).toEqual([]);
+    expect(rules(result.errors)).toEqual([OUTSIDE]);
   });
 
-  it('REPORTS it under a closure that carries no object at all — an empty graph is still a verdict', () => {
+  it('REFUSES it under a closure that carries no object at all — an empty graph is still a verdict', () => {
     const result = runRuntimeAuthoringRules({
       type: 'view',
       item: listViewOn('nosuch_obj'),
       context: { objects: [] },
       packageScope: SCOPE,
     });
 
-    expect(rules(result.advisories)).toEqual([OUTSIDE]);
+    expect(rules(result.errors)).toEqual([OUTSIDE]);
   });
 
   it('REFUSES an unknown column on an object of the written package — the field verdict is unchanged', () => {
     const result = scoped(listViewOn('crm_account'));
 
     expect(rules(result.errors)).toEqual([FIELD_UNKNOWN]);
     expect(result.errors[0].path).toMatch(/columns\[1\]\.field$/);
-    expect(rules(result.advisories)).not.toContain(OUTSIDE);
+    expect(result.advisories).toEqual([]);
   });
 
   it('admits a known column on an object of the written package', () => {
@@ -366,8 +367,8 @@ describe('the view door under a package closure (#24563)', () => {
   });
 
   it('keeps a DECLARED DEPENDENCY inside the closure — known column admitted, unknown refused', () => {
-    // The discriminating case: a report here would mean the dependency limb
-    // never reached the rule.
+    // The discriminating case: a refusal of the binding here would mean the
+    // dependency limb never reached the rule.
     expect(scoped(listViewOn('core_user', ['name']))).toMatchObject({ errors: [], advisories: [] });
     expect(rules(scoped(listViewOn('core_user')).errors)).toEqual([FIELD_UNKNOWN]);
   });
@@ -381,7 +382,7 @@ describe('the view door under a package closure (#24563)', () => {
 
   it('keeps a provenance-less overlay object inside the closure — its field verdict is unchanged', () => {
     expect(rules(scoped(listViewOn('tenant_overlay')).errors)).toEqual([FIELD_UNKNOWN]);
-    expect(rules(scoped(listViewOn('tenant_overlay')).advisories)).not.toContain(OUTSIDE);
+    expect(scoped(listViewOn('tenant_overlay')).advisories).toEqual([]);
   });
 
   it('a write that names no package is unchanged — the whole collection, field verdict and silence alike', () => {
@@ -398,21 +399,21 @@ describe('the view door under a package closure (#24563)', () => {
 
   it('the flow verdict is unchanged, and a stored object\'s out-of-closure list view is not charged to it', () => {
     // A context object of the written package whose built-in list view
-    // retargets an object outside the closure: the rule now reports that list
+    // retargets an object outside the closure: the rule now refuses that list
     // view, in the baseline and the candidate alike, so it cancels — a flow
-    // publish is not charged with a stored sibling's binding (#4463 D4).
+    // publish is not refused for a stored sibling's binding (#4463 D4).
     const retargeting = obj('crm_board', OWN, {
       listViews: { foreign: { label: 'Foreign', data: { provider: 'object', object: 'other_0_0' }, columns: ['name'] } },
     });
     const withSibling = [...objects, retargeting];
     const flow = (item: AnyRec) =>
       verdict(runRuntimeAuthoringRules({ type: 'flow', item, context: { objects: withSibling }, packageScope: SCOPE }));
 
-    // Non-vacuous: written itself, that object IS reported — the list view
-    // rides the object door too, at the same advisory.
+    // Non-vacuous: written itself, that object IS refused — the list view
+    // rides the object door too, at the same verdict.
     const asWritten = runRuntimeAuthoringRules({ type: 'object', item: retargeting, context: { objects }, packageScope: SCOPE });
-    expect(asWritten.errors).toEqual([]);
-    expect(rules(asWritten.advisories)).toContain(OUTSIDE);
+    expect(rules(asWritten.errors)).toContain(OUTSIDE);
+    expect(rules(asWritten.advisories)).not.toContain(OUTSIDE);
 
     expect(flow(FLOW_INTO_OWN_PACKAGE)).toEqual([]);
     const undeclared = flow(FLOW_INTO_UNDECLARED);