feat(spec,cli)!: one stack authoring shape — os validate / os build refuse a default export defineStack did not build

[objectstack-fleet]

Fixes #20367
Clause-②: yes

Implements ruling B on #20367 (Ruling-ref: 5869334748): one authoring shape. os validate and os build now refuse a default export that no stack producer built, and composeStacks refuses an input no producer built. The six STACK_* cross-field refusals (capability, cross-reference, namespace prefix, single app, hierarchy scope, trigger capability) therefore reach both doors by construction, not only when the author happened to call defineStack().

What changed

spec (@objectstack/spec)

• src/stack-provenance.ts (new): a non-enumerable, non-writable Symbol.for('objectstack.stack.provenance') mark. The precedent is data/filter-subtree-provenance.ts. Stamping is internal to the two producers. The one published predicate is hasStackProvenance(value), re-exported from stack.zod.ts.
• stack.zod.ts: defineStack stamps its return value in both strict and strict: false mode. composeStacks stamps its artifact at every arity. Its step 0 refuses unbuilt inputs with STACK_PROVENANCE_MISSING (422), naming each refused input. This runs first, ahead of the single-input early return. The cross-field validators are unchanged and stay inside the producer.
• api/error-code-ledger.zod.ts: registers STACK_PROVENANCE_MISSING under @objectstack/spec (emitted by composeStacks) and under @objectstack/cli (emitted by the doors). One condition, two emitters, following the ENVIRONMENT_NOT_FOUND precedent. The :1323-1328 comment is left as written. The family is now raised by both doors through provenance.
• ADR-0087 semantic migration entry stack-config-default-export-unbuilt-refused, plus the regenerated registry.ts, api-surface/root.json, export-origins/root.json and two reference docs pages.

cli (@objectstack/cli)

• utils/config.ts: loadConfig reads the mark off the default export before the named-export merge, which is a spread and drops the mark. It exposes the result as LoadedConfig.stackProvenance.
• utils/stack-provenance-refusal.ts (new): refuseUnbuiltStack throws a STACK_PROVENANCE_MISSING / 422 error with the prescription to wrap the export in defineStack(...).
• commands/validate.ts and commands/compile.ts: step 1a, directly after load and ahead of every other judgement. The throw lands in each command's existing catch-all, so the --json envelope keeps its shape: valid/success, error, code, warnings, conversions. This is the same envelope a defineStack refusal raised at load already reaches. PR fix(objectql,cli): os validate refuses a view container whose name disagrees with its object, as boot does (#20331) #20391's step 2c is on main, and this step sits above it in the same try, feeding the same catch-all envelope.
• test/validate-build-gate-parity.test.ts: the roster gains a row for refuseUnbuiltStack in SHARED_NON_REGISTRY_GATES.
• Retired the plain-object door in three places: the plugin README template in create.ts, the generate.ts field-type comment, and the environment-routing.mdx sentence about spread configs.

Premise test (ruled to be run first)

The premise was that host-shaped exports (a plugins list of instantiated plugin objects, i.e. the os serve / os migrate host configs) do not go through these two doors. Measured on this tree, it holds for those host configs:

• The only plain-object host configs in the repo are CLI test fixtures for os serve, os migrate and os doctor. None of them runs os validate, os build or os dev, and every one of them passes unchanged in the unit, integration and nightly tiers.
• The one host-shaped config that does reach both doors is examples/app-showcase, which is authored through defineStack. It carries the mark and passes both doors.
• A plain host-shaped export can mechanically reach the doors. The ablation leg below shows it passed os build at exit 0 before this change. It is now refused like any other unbuilt export, and the prescribed fix works: defineStack({ manifest, plugins: [instance] }) is accepted by both doors. That row is pinned.

Pins (test/stack-provenance-door.test.ts, integration tier, both doors, code + exit)

default export	answer at os validate --json and os build --json
defective stack (requires: ['no-such-capability']) as defineStack({ … })	STACK_CAPABILITY_UNKNOWN, exit 1
the SAME stack as a plain object	STACK_PROVENANCE_MISSING, exit 1; the prescription's first sentence is asserted; os build writes no artifact
host-shaped plain object	STACK_PROVENANCE_MISSING, exit 1
host-shaped defineStack({ … })	accepted, exit 0
spread copy { ...defineStack(…), api: {} }	STACK_PROVENANCE_MISSING, exit 1
defineStack + named export onEnable	accepted, exit 0 (the mark is read before the merge)

packages/spec/src/stack-provenance.test.ts pins the rest:

• both producers stamp, in every mode and at every arity;
• the mark is not visible through Object.keys, JSON.stringify or the strict schema;
• false for a literal, a spread copy, an assign copy, a JSON copy or a structured clone;
• composeStacks refuses first, names every input and refuses a lone input;
• both ledger rows exist.

Examples: the echo from route D does not reproduce. Measured with the built CLI at the merged head:

example	os validate	os build
examples/app-crm	exit 0, valid: true	exit 0, success: true
examples/app-todo	exit 0, valid: true	exit 0, success: true
examples/app-multi-package	exit 0, valid: true	exit 0, success: true
examples/app-showcase	exit 0, valid: true	exit 0, success: true

The build door is also held in CI: each example's build script is objectstack build, and the root turbo run build ran all four green (Tasks: 73 successful, 73 total).

Verification record

• Ablation. Committed first, then mutated through scripts/ablation-replace.mjs: if (loaded.stackProvenance) return; became return;, landing confirmed by anchor 1 → 0 and blob 5ce32a82 → d78f0948. The door test's plain-object rows went red (4 failed; under the mutation the plain defective stack answered code: undefined at exit 0 and the plain host shape built at exit 0, which is the original defect). The file was restored byte-identical: its blob equals the HEAD blob and git diff HEAD is empty. The green leg is the full integration run at HEAD.
• @objectstack/spec: vitest run, 602 files, 17349 passed.
• @objectstack/cli unit: 233 files, 3336 passed.
• @objectstack/cli integration: 62 files, 533 passed, 1 skipped.
• @objectstack/cli nightly e2e tier (OS_TEST_TIERS=nightly): the 18 files this change reddened or touched are green, 96 + 57 + 6 tests across three runs. The first full nightly run (17 red files) is what named them.
• Other consumers: the composeStacks test inputs in @objectstack/metadata, @objectstack/runtime, @objectstack/plugin-dev and @objectstack/plugin-security are green (1 + 3 + 1 + 1 files). Filter direction: composeStacks / os validate / os build callers found by git grep over packages/**. No non-test caller of composeStacks exists outside stack.zod.ts; every other hit is a comment.
• Typecheck: pnpm --filter @objectstack/cli --filter @objectstack/spec typecheck, exit 0, including check:test-typecheck.
• Generated artifacts: pnpm --filter @objectstack/spec check:generated --fix rewrote only the three it proved stale (api-surface, export-origins, docs). All 15 were green on re-check.
• Gates: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands derived 123 commands at head 0360658. 122 exited 0. One is NOT MEASURED: node scripts/check-plugin-teardown-shape.mjs --self-test exited 3 on the shallow clone, because its pinned fixture commit is unreachable; it is checker-health only. --ran reconciliation: 123 accounted, 122 run, 1 NOT-MEASURED. Four gates first exited 3 for lack of a full build (check:skill-examples, check:dual-build-cjs-loads, check:i18n-coverage, check:type-check-debt). They were re-run after the full build and exited 0.

Fixture census

The dispatch estimated "63 CLI test files". The instrument used here is the suite's own reds after the change, across all three tiers, plus git grep for composeStacks( inputs:

• CLI: 3 unit, 11 integration and 17 nightly e2e files red, plus the re-judged requires-retired-capability.e2e.test.ts. Each fixture was rewritten to defineStack(…) with spec linked into the temp dir through the new test/helpers/define-stack-fixture.ts.
• spec: 4 test files red. Their hand-built inputs are now a built stack mutated after defineStack returned: the mark survives in-place mutation, so this is the reachable route to the composer guards.
• Other packages: 3 test files with plain composeStacks inputs.

Fixtures for os serve, os migrate, os doctor and os lint were not rewritten. Those doors are outside the ruled surface and do not refuse; this is the host-config premise above.

Acceptance notes

• Pin re-judged: requires-retired-capability.e2e.test.ts. An unknown requires token is now the producer's STACK_CAPABILITY_UNKNOWN, exit 1, at both doors. The retired token's spec-owned prescription is asserted verbatim in the refusal message, and the typo hint is asserted to appear exactly once, for the misspelled token.
• Pins re-judged: the conversions and --strict pins. These are validate-json-failure-conversions.e2e, build-json-failure-conversions.e2e and the [finding] the conversions-only exit-code cell of os validate --json --strict is documented but untested — every fixture raises zero conversions #11301 cell of validate-json-strict-exit.e2e. defineStack applies every ADR-0087 D2 conversion itself at load, in either mode, and reports it on stderr. That leaves the doors' own step-2 sink nothing to convert on any accepted config, so conversions is [] on every exit and --strict does not fail on a retiring conversion. This was already true for every defineStack config before this PR. The pins now assert [] plus the live notice on the producer's stderr line, matched by conversion id and path. The loss is raised as an open question in the report, not fixed here.
• os dev compiles through os build, so it refuses an unbuilt export when it compiles. os serve, os migrate, os lint and os generate still load unmarked configs, because the ruling scopes the refusal to os validate and os build. The generate.ts comment now says so rather than claiming the door is gone everywhere.
• Fixture spelling. Fixtures whose content is the door's to judge use defineStack(…, { strict: false }): schema errors the door must report, rule findings, the conversion fixtures. Valid fixtures use strict defineStack.
• Landing site vs the declared surface. Three additions go beyond the claim's file surface: the ADR-0087 semantic entry and its generated registry.ts region (the registered disposition the breaking changeset needs), test inputs in three other packages, and the stale comment in capability-preflight.test.ts. Each is required by the change itself.
• Serial constraint. PR fix(objectql,cli): os validate refuses a view container whose name disagrees with its object, as boot does (#20331) #20391 is on main. main was merged into this branch at 6e3e546 before this PR opened.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/cli, @objectstack/spec, touching 22 documentable anchor(s). ⚠️ 2 changed file(s) yielded no anchor (packages/spec/api-surface/root.json, packages/spec/export-origins/root.json), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

29 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json e956924e17b8407ff443b12ccdeefa64d3c5de06.

⛔ 10 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 2 changed file(s) yielded no anchor (packages/spec/api-surface/root.json, packages/spec/export-origins/root.json) — pages documenting those are invisible to this run
• 3 anchor(s) matched too much of the corpus to be a work list: defineStack (symbol, 63 pages), defineStack (literal, 63 pages), os validate (command, 53 pages)
• 8 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 143 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json e956924e17b8407ff443b12ccdeefa64d3c5de06 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from d0ba084b70ba858f96ef6426ba93cd577dede97a — the merge of head 5355f47597da44acf15b0e760b827fe766bef349 into base e956924e17b8407ff443b12ccdeefa64d3c5de06, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin d0ba084b70ba858f96ef6426ba93cd577dede97a && git checkout d0ba084b70ba858f96ef6426ba93cd577dede97a
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin e956924e17b8407ff443b12ccdeefa64d3c5de06 5355f47597da44acf15b0e760b827fe766bef349 && git checkout -B drift-repro e956924e17b8407ff443b12ccdeefa64d3c5de06 && git merge --no-ff 5355f47597da44acf15b0e760b827fe766bef349

node scripts/docs-audit/affected-docs.mjs --json e956924e17b8407ff443b12ccdeefa64d3c5de06

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs e956924e17b8407ff443b12ccdeefa64d3c5de06 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Heads-up for this PR's dev: main moved under validate-build-gate-parity.test.ts

_{domain:cli execution PM seat #6024 · session local_1d2a197c-c20e-4e90-9be8-413d4d432289 · written 2026-09-28T15:33Z · ⛔ not a review and no state change}

PR #20459 (#20393) landed at acd00952. A git merge-tree of origin/main against this PR's head 03606587 conflicts on packages/cli/test/validate-build-gate-parity.test.ts; compile.ts and validate.ts auto-merge. What each side changed, and how the two stack, is on #20367 (5873269599). In short: keep both ledger changes and merge main before you re-run the parity file and the --json failure pins.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 5355f47597da44acf15b0e760b827fe766bef349
Local-runs: none

Inputs: card #20367 (body and all 11 comments — ruling 5869334748 letter B with its execution parameters, decision box 5866732842, dev reports 5872377284 and 5873886274, the cli seat's cross-seat notice 5873269599); PR #20460 (body, its 2 comments, the 61-file list); the net diff origin/main...5355f475 read from git objects (merge-base dc0ab6a2 = the PR base; 61 files, +1463 / -265, reconciled with the API); the 36 check-runs on the head. Nothing was built, run or re-run.

Gate verdicts on the head: 34 success, 2 skipped (Console Pin Gate, path-filtered; Packed-tarball smoke (opt-in)), 0 failures. All seven required contexts are success: Lint & Repo Gates, TypeScript Type Check, Test Core, Dogfood Regression Gate, Build Core, Temporal Conformance (live PG + MySQL), Governed Surface Queue Guard. No governed-surface path in the file list; head repo = base repo; 1728 changed lines; mergeable_state: clean; #20459 (acd00952) is an ancestor of the head.

① Derived judgments

Every accept-set and public-surface change the diff implies, judged against ruling B's execution parameters and the measured tree.

1. @objectstack/spec root gains hasStackProvenance(value) — WIDENING, right. Exactly the ruling's "one exported predicate": api-surface/root.json and export-origins/root.json regenerated (+1 each, nothing removed); markStackProvenance stays module-internal (stack.zod.ts:3711 re-exports only the predicate, no exports subpath reaches stack-provenance.ts, no importer outside the two producers).
2. defineStack output — strict and strict: false — carries a non-enumerable, non-writable, non-configurable Symbol.for('objectstack.stack.provenance') mark (stack.zod.ts:3609, :3703) — right per "both modes stamp". Invisible to Object.keys, JSON.stringify and the strict schema, and the author's input is not mutated — all pinned in stack-provenance.test.ts. Residual, by the ruling's own choice: a strict: false export passes both doors without the family's judgement; the migration entry's replacement text says so.
3. composeStacks accept-set NARROWS — right. Step 0 refuses every unmarked input with STACK_PROVENANCE_MISSING / 422, naming each, before the single-input early return and before any conflict rule (pinned: lone input, spread copy, and a conflicting input refused for provenance first); the output is marked at arity 0, 1 (the marked input itself) and N.
4. STACK_PROVENANCE_MISSING registered under @objectstack/spec and @objectstack/cli — right: one condition, two emitters, on the ENVIRONMENT_NOT_FOUND precedent (error-code-ledger.zod.ts:975 / :991); contract.mdx enum +1 (322) and the ledger reference page regenerated. The :1323-1328 comment is byte-identical to origin/main — right, "stays true as written".
5. os validate / os build accept-set NARROWS — right. Step 1a refuseUnbuiltStack(loaded) sits directly after loadConfig, inside the same try as every later step, ahead of fix(objectql,cli): os validate refuses a view container whose name disagrees with its object, as boot does (#20331) #20391 step 2c and fix(cli): os build refuses a view container whose name disagrees with its object, as boot does (#20393) #20459 step 3a; it throws into each command's existing catch-all, whose --json face is unchanged (valid or success, error, code via errorCodeFields, warnings, conversions, duration); os build writes no artifact (pinned). Six rows at two doors pinned by code + exit in stack-provenance-door.test.ts.
6. loadConfig reads the mark off mod.default at config.ts:458, before the named-export spread at :475 — right (the defineStack + onEnable control is pinned). LoadedConfig.stackProvenance is CLI-internal: loadConfig is on none of @objectstack/cli's entries (., ./console, ./hook-body).
7. os dev refuses through its compile spawn (dev.ts:364-366) — a consequence of the ruled scope, not a widening; right. os serve, os migrate, os lint, os generate and os doctor load configs unchanged — right per the ruling's scope.
8. A spread copy of a built stack is refused — right ("a copy of a built stack is refused too"). environment-routing.mdx:72-77 no longer offers the spread; the create.ts README template emits defineStack; the generate.ts:811-817 comment states the shape is retired at the doors while this command still loads it — right, and honest about its own scope.
9. ADR-0087: D3 semantic entry stack-config-default-export-unbuilt-refused (no D2 conversion — the module shape is source, not a metadata key) plus the generated registry.ts step-18 region — right; the registered disposition a breaking changeset with a prescription requires. Its gates ride the green TypeScript Type Check.
10. Fixtures: 34 CLI test files and 3 in metadata / runtime / plugin-dev authored through defineStack; the new test/helpers/define-stack-fixture.ts links spec by package specifier, not by a cross-package source read; the 24 mechanically rewritten files change no expect / it / describe line (audited over the diff). requires-retired-capability.e2e.test.ts re-judged to STACK_CAPABILITY_UNKNOWN exit 1 at both doors, the prescription verbatim, the typo hint exactly once — right per the ruling.
11. Plain export default { remaining in CLI tests at the head: 43 files (63 on origin/main). Measured: none reaches either door — migrate-meta.e2e.test.ts's one os validate call runs on its defineStack fixture (:384, :453); the four serve files that mention build spawn serve only; the rest are doctor / serve / migrate / lint / unit-only fixtures. Judged in ③.
12. validate-build-gate-parity.test.ts: refuseUnbuiltStack added to SHARED_NON_REGISTRY_GATES beside findViewContainerNameRefusals — both intents of the fix(cli): os build refuses a view container whose name disagrees with its object, as boot does (#20393) #20459 conflict kept; right.
13. Examples app-crm / app-todo / app-multi-package / app-showcase pass both doors — the build door is held in CI (each example's build script under Build Core), the validate door by construction (a marked export is accepted without re-judgement, so route D's echo cannot reproduce) and by the dev's built-CLI reading in the PR body. Right. Dogfood Verify CLI runs os verify, not os validate, on app-crm / app-showcase.
14. Docs: no hand-written page under content/docs, no published skill, no create-objectstack template and no example demos a plain-object stack config at the head (censused).

Nothing named wrong.

② Semver level

.changeset/20367-one-stack-authoring-shape.md: @objectstack/spec: minor, @objectstack/cli: minor — matches what the diff publishes. Clause-②: yes (narrowing): yes because the spec surface widens (one export, one code) and the (narrowing) arm because the accept-set narrows at composeStacks and both doors — BREAKING, and the body carries the FROM / TO migration, the one-line fix and exactly one ADR-0087 marker (registered, naming the entry). major is refused repo-wide (check-changeset-no-major), so minor is the ceiling; the PR title carries !. The PR body's Clause-②: yes and the claim's Clause-②: yes agree on the value; the arm lives on the changeset, where the ADR-0087 gate reads it (yes (narrowing) is a recognised spelling in that gate's self-test). Packages touched only in tests (metadata, runtime, plugin-dev) publish nothing. Check Changeset is success. Right.

③ Boundary flags

Dev report 5872377284, deviations:

• Fixture census re-derived: 34 files (+1 in the merge round), not the ruling's "63" — ANSWERED, right. The ruling's own text scopes the refusal to os validate / os build and treats serve / migrate as host doors that keep loading; the 63 was the decision box's git grep -l "export default {" reading, which counts host-door fixtures. Every fixture the two doors judge is rewritten; the 43 that remain never reach a door (① item 11), so rewriting them would pin nothing.
• Landing site beyond the claim's file surface (ADR-0087 entry + registry.ts; three other-package tests; stale comments) — ANSWERED, right: each is a consequence of the ruled disposition or of the narrowed composeStacks accept-set.
• No cross-package examples pin — ANSWERED, ① item 13.
• Conversions and --strict pins re-judged to conversions: [] plus the producer's stderr notice — ANSWERED, right: the door's sink was already empty for every defineStack config before this PR; the pins record the loss ("Recorded, not endorsed") and keep an anti-vacuity guard on stderr rather than deleting it. See OQ1.
• Base moved after opening — superseded by merge round 1 (5873886274): the head sits on dc0ab6a2.

Merge round 5873886274, deviation: build-view-container-name.test.ts (a #20459 file) rewritten — ANSWERED, required: its plain fixtures are refused at os build. The cli seat's notice 5873269599 is discharged: main merged, both parity-ledger intents kept, step 1a ahead of 2c / 3a in one envelope.

Open questions:

• OQ0, the host-shaped premise reading — ANSWERED from the ruling's text: B refuses every unmarked default export and names no shape exemption, so reading A is the ruling's; measured: no plain host config in the repo reaches the doors, app-showcase (host-shaped, defineStack) passes, and the prescribed wrap defineStack({ plugins: [instance] }) is accepted (pinned). The dev neither forced the premise nor fell back to A. ESCALATED for acknowledgement (E1), because the premise as written did not hold on the mechanical reading and the ruling asked for that to be reported.
• OQ1, producer conversion notices never reach the door envelope — ANSWERED: a follow-up card (option A); outside the ruled surface; pre-existing for every defineStack config; the PR's acceptance notes and out_of_scope_findings[0] carry it in filing shape. Duty on the owning seat: file it.
• OQ2, code name — ANSWERED: STACK_PROVENANCE_MISSING accepted (STACK_ family, subject_condition, dual-registered on the ledger's precedent; casing and vocabulary gates green).
• OQ3, extend the one-shape rule to serve / migrate / lint / generate — ANSWERED from the text: the ruling names two doors plus composeStacks; a wider scope is a new decision, not this PR.

Gates: check-plugin-teardown-shape --self-test NOT MEASURED locally by the dev (shallow clone) — checker-health only; Lint & Repo Gates on the head is success. Console Pin Gate skipped: the api-surface delta is additive (+1 / -0), so no removal reaches the pinned sibling.

ESCALATED (named questions, not verdict changes):

• E1 — Premise outcome, for the maintainer: a plain host-shaped export (plugins: [instance], no defineStack) CAN reach os validate / os build and is now refused with STACK_PROVENANCE_MISSING like any other unmarked export; the wrap is accepted. Does B stand as ruled, with no host-shape carve-out? The diff assumes yes — the only reading compatible with the ruling's text.

Implemented-by: session_01RTkKf8Dn5F4mepiZZfWoxH
Reviewed-by: session_014EJ1ED8X4MMrT18BhVx4tx

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

Director pointer · 2026-09-29T01:24Z: the maintainer answered E1 of record 5874193973 — ruling B on #20367 stands with no host-shape carve-out (ruling 5881817230 on the card, batch #240 item 1, letter A). needs-user-decision leaves this PR in the same stroke; the landing is the seat's. Director seat, session_01AsCNgFBs8HCjwhyHQsFbx3 (objectstack#12708).