[objectstack-fleet]

Requested by Warren · project thread
Fixes #29518

Clause-②: no (narrowing)
Metadata-protocol: narrowed
Skills-docs: none — no file under skills/** teaches a packages[] stack's top level, its residual, or a _packageId stamp on a top-level dataset; every taught dataset sits in a single-package stack, which has no residual.

维护者速读

• 改了什么：多包 stack（带 packages[]）顶层声明、但没有任何包体声明的 datasets 条目，现在按 ADR-0130 D4 的残余规则登记在 stack 自己的 manifest.id 下；构建门（spec 镜像）与启动门同步判断它的 _packageId 印记。
• 为什么改：之前这种数据集既不登记也不报错，被静默丢弃；引用它的仪表盘或报表要到运行时才失败，离原因很远。
• 风险与回滚：顶层带外包 _packageId 印记的残余数据集现在会被拒（之前静默丢弃），故声明 narrowed；另外 artifact 启动时各包体的数据集也会进入元数据服务（封闭运行时 GET /meta/dataset 不再为空）。回滚即还原本 PR。
• 先看：packages/metadata/src/plugin.ts（ARTIFACT_FIELD_TO_TYPE 新增 datasets）、packages/spec/src/stack.zod.ts（TOP_LEVEL_COLLECTIONS_NEVER_RESIDUAL 去掉 datasets）、新 pin manifest-service-residual-objects.test.ts 的 datasets 块。
• 两分钟验证：pnpm --filter @objectstack/objectql exec vitest run src/manifest-service-residual-objects.test.ts -t datasets，预期 2 个用例全绿（构建依赖闭包后）。
• 需要你做的：无，席位契约复核后落地。

What changes

• packages/metadata/src/plugin.ts: ARTIFACT_FIELD_TO_TYPE gains datasets: 'dataset', with a comment saying why and that the seed data: collection stays unmapped. That one map is what the residual rule (unclaimedTopLevel) walks, so a packages[] stack's top-level dataset that no body declares is now listed as residual. Both boot doors register it under the stack's manifest id and version (the metadata door through registerUnclaimedTopLevel, the engine through the manifest service's existing residual seam, unchanged), and both apply the owner-stamp refusal they already apply to every other residual item.
• The same map is the artifact door's body loop, so every package body's datasets also reach the metadata service from a compiled artifact, with provenance. Before, only the ObjectQL registry took them (its METADATA_ARRAY_KEYS loop).
• packages/spec/src/stack.zod.ts: the build-door mirror TOP_LEVEL_COLLECTIONS_NEVER_RESIDUAL drops datasets and keeps data and jobs; its docblock says why. Not exported, so no API-surface or generated artifact moves. Triage designated this a cross-domain single PR (6585309156); PR docs(spec): TOP_LEVEL_COLLECTIONS_NEVER_RESIDUAL names the readers of top-level datasets the tree has #29514 had merged first.
• packages/spec/src/stack-collection-item-owner-stamp.test.ts: the "filed by no boot door" case drops datasets; a new case pins that a foreign-stamped residual dataset raises the judge's issue at datasets.0._packageId.
• packages/metadata/src/owner-stamp-residual-build-boot.test.ts: the reading becomes ['data', 'jobs'], and the comment above it no longer says datasets are read off the stack whole (the rider from the contract review of PR docs(spec): TOP_LEVEL_COLLECTIONS_NEVER_RESIDUAL names the readers of top-level datasets the tree has #29514, record 6583699079).
• scripts/check-stack-collection-maps.mjs: the ARTIFACT_FIELD_TO_TYPE waiver row loses datasets from its keys (the gate reds a stale waiver) and its text no longer says AppPlugin consumes datasets off the bundle; it says why the key left.
• New pin block in packages/objectql/src/manifest-service-residual-objects.test.ts: a residual dataset registers under the stack's manifest id and version beside a body's own; CONTROL: a top-level dataset a body repeats stays the body's, registered once.
• One changeset: minor for @objectstack/spec and @objectstack/metadata (the kind is narrowed), carrying the three declaration lines and the fix for an author whose stack now refuses.

Why

ADR-0130 D4's residual rule exists so a top-level item is either registered or refused, never silently lost. datasets had no ARTIFACT_FIELD_TO_TYPE entry, so the rule never saw it. Measured on a kernel boot (ObjectKernel + ObjectQLPlugin, the stack handed to the manifest service as AppPlugin hands it): nothing thrown, listItems('dataset') answered the body's dataset only, and no line named the residual one.

Tests

• Red first, at the commit that adds the pin (before the fix): registers a residual dataset under the stack's manifest id and version, beside a body's own failed (expected [ [ 'acme_case_body', …(2) ] ] to deeply equal [ [ 'acme_case_body', …(2) ], …(1) ]); the CONTROL passed. With the mapping: 62/62 in that file.
• Reverse verification of the spec pin, at the final head: putting datasets back into TOP_LEVEL_COLLECTIONS_NEVER_RESIDUAL turns the new spec case red (1 failed, 47 passed); restored with git checkout HEAD --, git diff HEAD empty.
• Before the spec line, the metadata mirror test was red exactly as predicted (datasets: build verdict == unclaimedTopLevel lists it (true): expected false to be true); with it, 27/27.
• Suites: at head ae0a25e6 (the last commit adds only the changeset's ADR-0087 marker), each under the verify lock: @objectstack/spec 888 files / 25184 tests passed (1 todo); @objectstack/metadata 68 / 956 passed; @objectstack/objectql manifest-service-residual-objects.test.ts 62/62. The full @objectstack/objectql suite (535 files / 10398 tests) and @objectstack/runtime suite (527 files / 9695 passed, 19 skipped) passed with the mapping before the rebase onto ff827bcf; the spec line changes no runtime path they exercise. typecheck exit 0 for spec, metadata and objectql.

Acceptance notes

• Artifact boot measured before and after (scratch probe, deleted). createStandaloneStack over a multi-package artifact with a residual dataset: getMetaItems({ type: 'dataset' }) went from the body's dataset only to body + residual (owner com.probe.release), and getMetaItem for the residual went from a stub with no item to the served item. Single-package artifact: /meta/dataset unchanged; the metadata service's own list went from empty to the body dataset. The artifact door alone (as a sealed runtime runs it, no AppPlugin): manager.list('dataset') went from empty to every body's dataset plus the residual, each stamped with its package id and version, and the residual warn counts the dataset with the other residual items. No boot failed in any reading.
• jobs, datasources and translations stay on the waiver row: they are a different fact (AppPlugin does consume them off the bundle) and were not measured here.

Verification

All readings at head ae0a25e6, merge base ff827bcf.

Derived gates: 101 derived, 100 exit 0, 1 NOT MEASURED; plus pnpm lint

• node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 101 commands from the 7 changed paths; every one was run and its exit code recorded, and --ran reconciled the record: 101 derived famil(ies) accounted for — 100 run, 1 NOT-MEASURED.
• First pass: check-adr-0087-registration exited 1 (the narrowed changeset had no ADR-0087 marker); the marker commit makes it exit 0 (not-required (no-migration-prescription)), and every changeset-reading gate was rerun on that head (no-major, empty-changeset, changeset-gate-self-tests, doc-authoring, issue-citations, nul-bytes, closing-keyword-parity, stack-collection-maps): all exit 0. check-plugin-teardown-shape --self-test exited 3 until its pinned control commit was fetched, then 0.
• NOT MEASURED, reason: prerequisite not met (exit 3). pnpm check:dual-build-cjs-loads needs every package built; CI's Build Core runs it.
• pnpm lint: exit 0. node scripts/check-stack-collection-maps.mjs --self-test: exit 0 (18 assertions).

test:repo was not run locally (it belongs to CI's Test Core). Dogfood battery at dd552104 (owed by the (narrowing) arm): closure built, pnpm --filter @objectstack/dogfood test under the verify lock, VERDICT command-exit 0; Test Files 397 passed | 3 skipped (400), Tests 3277 passed | 28 skipped (3305), no failures.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

2 anchor(s) derived from 2 changed package(s); no hand-written page names any of them, so this run has nothing to list — not a clean bill of health. This check sees only pages that NAME a derived anchor: one that documents this change in prose, or enumerates it in an authoring dialect, names none and stays invisible to it on every run.

What this run could not see

• 1 name(s) were too generic to anchor anything (single lowercase words)
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 171 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 50e35a280994dcecb714b6fa1f2d44840900f5e7 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 71b0adfe0ee4b5d16a335747a254e1dcabd5af10 — the merge of head dd5521040e2ba6c6ae9873c8cdc8649ec68ece4e into base 50e35a280994dcecb714b6fa1f2d44840900f5e7, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 71b0adfe0ee4b5d16a335747a254e1dcabd5af10 && git checkout 71b0adfe0ee4b5d16a335747a254e1dcabd5af10
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 50e35a280994dcecb714b6fa1f2d44840900f5e7 dd5521040e2ba6c6ae9873c8cdc8649ec68ece4e && git checkout -B drift-repro 50e35a280994dcecb714b6fa1f2d44840900f5e7 && git merge --no-ff dd5521040e2ba6c6ae9873c8cdc8649ec68ece4e

node scripts/docs-audit/affected-docs.mjs --json 50e35a280994dcecb714b6fa1f2d44840900f5e7

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

[objectstack-fleet]

domain:server#4 · os-warren · session_01JQwxbacSXJQqAztgt4UMrS

Contract-review-claim: session_01JQwxbacSXJQqAztgt4UMrS · head dd55210 · 2026-11-02T20:35Z

[objectstack-fleet]

domain:server#4 · os-warren · session_01JQwxbacSXJQqAztgt4UMrS

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: dd5521040e2ba6c6ae9873c8cdc8649ec68ece4e
Local-runs: none
Scope: packages/spec/src/stack.zod.ts, packages/metadata/src/plugin.ts, scripts/check-stack-collection-maps.mjs, packages/metadata/src/owner-stamp-residual-build-boot.test.ts, packages/objectql/src/manifest-service-residual-objects.test.ts, packages/spec/src/stack-collection-item-owner-stamp.test.ts + packages/spec/src/kernel/collection-item-owner-stamp.ts, packages/spec/src/kernel/metadata-plugin.zod.ts, packages/spec/src/meta-spelling/manifest-collection-spelling.ts, packages/objectql/src/plugin.ts, packages/objectql/src/engine.ts, packages/runtime/src/app-plugin.ts, packages/runtime/src/artifact-collections.ts, packages/rest/src/analytics-routes.ts, packages/metadata-protocol/src/protocol.ts, packages/cli/src/utils/view-container-names.ts, packages/cli/src/utils/picklist-references.ts, packages/core/src/metadata-service-contract.ts, docs/adr/0130-release-artifact-as-co-ownership-boundary.md, docs/adr/0010-metadata-protection-model.md, docs/adr/0021-analytics-dataset-semantic-layer.md

Inputs: card #29518 (body and all six comments), PR #29593 (body, file list, git diff origin/main...dd552104 at merge base ff827bcf), and the check-runs on the head, read twice (20:36Z and 20:44Z). The changeset is a prose face: judged in ②, not in ④.

① Derived judgments

• Build-door accept set (ObjectStackDefinitionSchema, the owner-stamp refinement). A packages[] stack's top-level datasets[i] whose name no body's datasets claims is now judged as residual: a _packageId other than manifest.id raises datasets.i._packageId. Before, TOP_LEVEL_COLLECTIONS_NEVER_RESIDUAL excluded datasets and such an item parsed whatever it wore. Narrowing, right. The set is a mirror of unclaimedTopLevel's walk, and the walk now carries datasets; I took the set difference at head myself: OWNER_STAMP_JUDGED_COLLECTIONS minus the keys of ARTIFACT_FIELD_TO_TYPE is exactly {data, jobs}, which is what the mirror now holds and what the metadata mirror test pins (notResidual == ['data', 'jobs']).
• Everything else the build door accepts is unchanged. A package BODY's datasets were already judged (datasets sits in OWNER_STAMP_JUDGED_COLLECTIONS, both doors); a stack without packages[] takes the untouched single-body branch; an unstamped residual dataset parses as before; a top-level dataset a body repeats is a claimed slot and is not judged at the top level. Right.
• Public surface of @objectstack/spec: nothing moves. TOP_LEVEL_COLLECTIONS_NEVER_RESIDUAL is a module-private const; at head the only file naming it is stack.zod.ts (no api-surface, baseline or generated file). The minor is the kind's floor, not a surface move. Right.
• @objectstack/metadata (ARTIFACT_FIELD_TO_TYPE gains datasets: 'dataset'). Three consequences, each read in the cited code: (a) unclaimedTopLevel lists a residual dataset (slot = name, via artifactItemSlot); (b) registerUnclaimedTopLevel registers it under manifest.id/version through registerArtifactBodyCollections, whose artifactItemOwnerStampRefusal judges the field because it is in the judged set, so a foreign stamp is VALIDATION_ERROR 400 at _packageId; (c) the artifact door's body loop now also writes every body's datasets into the in-memory loader and the MetadataManager, stamped with the body's provenance (dataset is a registered type, loadOrder 55, before report/dashboard). (c) is runtime behaviour, not a key an author writes, so folding it under narrowed rather than declaring an added kind is right (narrowed wins the several-kinds rule anyway).
• @objectstack/objectql: no source change needed, and none made. The engine's residual seam registerUnclaimedTopLevelItems is generic (registerItem(type, …) for every residual type outside {object, picklist, object_extension}), with collectionItemOwnerStampRefusal applied first; the body seam's METADATA_ARRAY_KEYS already carries datasets and registers through the same registerItem('dataset', …). So a residual dataset lands in the registry under the stack's id and version, as the new kernel-boot pin asserts (RELEASE_ID/1.0.0 beside the body's SERVICE_ID/2.4.0, the artifact's own entry left unstamped). Right.
• No second-writer hazard. ObjectQLPlugin.loadMetadataFromService syncs object/view/app/flow/hook only, never dataset; the protocol's readFlattenedMetaItems answers GET /meta/dataset from engine.registry.listItems plus stored overlays, not from the MetadataManager, so the artifact door's new manager copy cannot duplicate the served list on an ObjectQL kernel. That matches the PR's measured "single-package artifact: /meta/dataset unchanged; the metadata service's own list went from empty to the body dataset" and makes the sealed (artifact-only) runtime the one whose served list changes. Right, and declared in the changeset.
• CLI readers of the residual rule. view-container-names.ts keeps only type === 'view' residual items; picklist-references.ts reads only residual picklists. A residual dataset adds no os validate / os build finding beyond the schema's own stamp issue. Right.
• First consumer. packages/rest/src/analytics-routes.ts resolves body.datasetName through getMetaItems({ type: 'dataset' }) and answers 404 NOT_FOUND otherwise. That is the card's run-time failure far from the cause; with the dataset registered under the stack's id it is found. Right.
• scripts/check-stack-collection-maps.mjs. With the map entry present, a missing waiver naming datasets is stale and the gate reds stale waivers, so the key had to leave the row. The row's sentence now holds for the three keys that remain (AppPlugin does schedule jobs and read datasources/translations off the bundle) and says why datasets was never the same fact: every "datasets" AppPlugin reads is a seed dataset (data:, readSeedDatasets/mergeSeedDatasets), never the ADR-0021 kind. Right.

② Semver level

• .changeset/29518-residual-top-level-datasets.md: @objectstack/spec: minor, @objectstack/metadata: minor. Both publish (neither package.json is private, both at 18.2.0). The kind is narrowed, which takes at least minor on each package the diff moves. @objectstack/objectql moves only a test file and scripts/ is not a package, so no third entry is owed. One file for two packages is a legal changeset. Matches the diff.
• Clause-②: no (narrowing) and Metadata-protocol: narrowed, line-initial in both the PR body and the changeset, one arm from the closed pair. The diff refuses a value that used to parse (a foreign _packageId on a residual dataset), which is the definition of narrowed, and it widens no authorable surface, so no with the (narrowing) arm is the right declaration and the face this record stands on. The ADR-0087 marker is present exactly once, not-required (no-migration-prescription), and the body carries the fix in writing (drop the stamp, or declare the dataset inside its owner's packages[] entry). No conversion could rewrite ownership, and a stack carrying such an item lost the dataset at boot before, so no working stored state is preserved by a migration. Disposition holds.
• Check-runs: the first Check Changeset run on the head concluded failure (level axis: narrowed beside a Clause-②: no with no arm) because it read the PR body before the body edit that added the arm; the superseding run on the same head concluded success. The gate's standing verdict on this head is the later one.

③ Boundary flags

• Dev report 6587764387: open_questions: [], security_findings: none, premise_still_valid: true. Deviations: one changeset file carrying both packages (allowed, both names and levels read) and the report signed with the dispatching seat's lane (cosmetic). Answered.
• out_of_scope_findings: jobs, datasources, translations stay on the waiver row, not measured here. Not a defect of this change and not a contract violation; the row's sentence is now accurate for those three. Answered, no card owed.
• Escalated, should-fix (prose, non-blocking): the PR body's "No dogfood run: no ! in the title and no (narrowing) arm on the Clause-② line" and the report's dogfood_battery: n/a contradict the body's own Clause-②: no (narrowing). The arm was added at the head commit after the first changeset gate reading; the dev skill owes the full dogfood battery once on the final head when the arm is (narrowing). The head's Dogfood Regression Gate check-run concluded success, so the mechanical reading exists; the sentence in the body is stale and the adopting seat should have it corrected or the local battery recorded.
• Claim chain: claim 6585254964 amended by 6586240516 on triage's cross-domain designation 6585309156, which widened the file surface to packages/spec/src/stack.zod.ts and named this review. The diff stays inside the amended surface; protocol.ts (frozen) is untouched. Rider 6583740976 (the comment at owner-stamp-residual-build-boot.test.ts L173-175) is done in the diff. Answered.
• PR author objectstack-fleet[bot] (relay write), head repo equals base repo (not a fork), draft, 100/22 lines, no governed surface in the file list (Governed Surface Queue Guard success). The schema face alone owes this record.
• Check-runs on the head at 20:47Z (third read): success for Check Changeset (superseding run), Build Core, Dogfood Regression Gate, Governed Surface Queue Guard, Lint · CI, release & engine gates, Lint · ESLint, Lint · docs & code guards, Lint · repo & tooling gates, the three Lint · scoped jobs, Type Check · source gates / consumer gates / debt ledger, Spec property liveness, Plan Test Core shards, Build UI Deps, Build & E2E UI, Live E2E UI, Check PR Size, PR-body guards; the one failure is the first Check Changeset run superseded above; still in_progress: Test Core (8 shards), Type Check · workspace, Type Check UI, Test UI (16 shards), Lint · PM dispatch-gates. The landing waits on the required set going green; this record judges the contract and names the gate state as read.

④ Design judgment

packages/spec/src/stack.zod.ts (schema face; against ADR-0130 D4's residual rule as the code carries it, ADR-0010's one owner-stamp judge, ADR-0021's dataset as a registered metadata type, and its first consumer). The mirror's whole contract is to agree with unclaimedTopLevel collection by collection; once the door's map carries datasets, keeping it in the never-residual set would make the build door accept what the boot refuses, which is the disagreement the metadata mirror test exists to catch (it went red before the spec line, as the PR says, and the reverse verification at the final head is consistent with that). Dropping datasets is the only edit that restores the mirror. I checked the three places the mirror could still drift: slot derivation (residualSlotOf reads name; artifactItemSlot reads name for every non-view type), owner (manifest.id on both sides; unclaimed.ownerId falls back to id only when manifest is absent, where the schema judges against no package in the same way), and the singular spelling (pluralToSingular('datasets') is 'dataset', the registry type). The docblock now states the two-collection reading correctly (data to the seed loader, jobs scheduled, both off the merged stack through resolveArtifactCollections) and drops the retired "datasets are read off the package bodies only" sentence. Break attempts: a top-level dataset a body repeats stays the body's and is judged nowhere at the top level (CONTROL pin); a residual dataset with no name has no slot at either door; a config-door stack parsed with strict: false never meets this gate, but registerUnclaimedTopLevel and the engine's residual seam both judge it, so no door accepts what the other refuses. Holds. No must-fix.

packages/metadata/src/plugin.ts. One map entry with its reason in place; the map's own gate pins it to the schema in both directions. The "see the end of this map" pointer for the seed data: collection is accurate. Making the artifact door the metadata-service registrar of body datasets is a consequence the changeset declares rather than hides. Holds.

scripts/check-stack-collection-maps.mjs. Waiver keys and text track the map; the self-test ran in Lint · repo & tooling gates (success). Holds.

The three test files. The spec pin asserts the issue path datasets.0._packageId on a residual dataset and keeps data/jobs on the never-judged table; the metadata mirror holds the two doors equal and reads ['data', 'jobs']; the kernel-boot pin registers the residual dataset under the stack's id and version beside a body's own, with the CONTROL for a repeated top-level dataset. These are the right layers. Should-fix, non-blocking: no pin names datasets at the metadata door's registration (the mirror's sink is a no-op and asserts refusal only; the artifact-boot reading in the PR is a deleted scratch probe). The decision half and the engine door are pinned, and the metadata door's loop is generic over the map, so this is a coverage note, not a hole.

Implemented-by: claude/project-thread-h6f14s
Reviewed-by: session_01JQwxbacSXJQqAztgt4UMrS

VERDICT: PASS

[objectstack-fleet]

domain:server#4 · os-warren · session_01JQwxbacSXJQqAztgt4UMrS

席位核对

ACCEPT · domain:server#4 · head dd5521040e2ba6c6ae9873c8cdc8649ec68ece4e · 2026-11-02T21:22Z · seat review of record at TIER_DEFAULT for the whole PR; the contract face (packages/spec/src/stack.zod.ts, declared narrowing) carries contract review PASS at CONTRACT_REVIEW_TIER on this head (record 6588144155). Not governed: check-governed-merges --pr 29593 0 of 7 paths.

1. Shape: draft, base main, body line 3 Fixes #29518. 7 files, +100/-22: one changeset (minor for @objectstack/spec and @objectstack/metadata), ARTIFACT_FIELD_TO_TYPE gains datasets: 'dataset' (metadata), TOP_LEVEL_COLLECTIONS_NEVER_RESIDUAL drops datasets (spec), the waiver row in scripts/check-stack-collection-maps.mjs, three test files. Inside the amended claim surface (6586240516, triage cross-domain designation 6585309156). protocol.ts untouched.
2. Premise measured: a packages[] stack's top-level dataset that no body declares was neither registered nor refused, so a dashboard or report naming it failed at run time; the spec pin reds without the fix and the kernel-boot pin registers the residual dataset under the stack's id and version (dev report 6587764387).
3. Gates on this head: check-runs pinned to dd552104: every completed run success except the first Check Changeset run, which read the body before the (narrowing) arm and is superseded by successful runs on the same head (the latest after the seat's body edit). mergeable_state clean. Dev local: dispatch-gates --ran 101 derived / 100 exit 0 / 1 NOT MEASURED (check:dual-build-cjs-loads, covered by Build Core), pnpm lint 0, spec 25184 and metadata 956 tests, dogfood battery exit 0 (397 files, 3277 tests).
4. Accepted deviations: the review's should-fix coverage note (no pin names datasets at the metadata door's registration; that door's loop is generic over the map and both the decision half and the engine door are pinned) is accepted without a change. The review's other should-fix (stale dogfood sentence) is fixed in the body.
5. Out of scope: jobs, datasources, translations stay on the waiver row (not measured here, no card owed per the review's ③). Skills-docs: none with the reason in the body.
6. Landing: not governed, under 3000 lines, contract PASS on this head ⇒ the seat lands it (pr_ready + automerge_enable). At MERGED: landing record on boot: a packages[] stack's top-level datasets item that no package body declares is dropped with no refusal and no registration #29518 (closed by Fixes), pm:dispatched removed.