[claude]

Part of #16980 — ⛔ deliberately NOT Fixes. This lands options 1, 2 and 3. The half left open is the one the ruling reserved: adding the @objectstack/metadata/errors row to GUARDED_ENTRIES, which needs a second ADMITTED_PACKAGES set and therefore a MAINTAINER decision. The PM decides whether the card closes on this PR.

scripts/check-lean-entry-closure.mjs's resolveConditions() handed exports[subpath][flavour] straight to node:path's resolve() with no string check. Options 1 + 2 + 3 from the card, per the dispatch ruling. ⛔ No GUARDED_ENTRIES row is added and ADMITTED_PACKAGES is untouched.

Clause-②: no
scripts/** only — one file. Re-derived rather than copied: 70 published (non-private) manifests, zero ship scripts/check-lean-entry-closure.mjs in their files[]; positive control, 70 of 70 ship a dist/ path. So the change reaches 0 published surfaces.

Before leg — the card's own recipe, reproduced verbatim

Measured on a freshly created worktree at origin/main c43bac7048, UNBUILT (packages/objectql/dist and packages/metadata/dist both absent). The gate blob is byte-identical to the 854639b311 the brief pinned (e9370b2db2), so the brief's line numbers still hold.

row    { id: '@objectstack/metadata/errors', pkgDir: 'packages/metadata', subpath: './errors' }
  =>   THREW TypeError: The "paths[2]" argument must be of type string. Received an instance of Object

row    { id: '@objectstack/objectql/core', pkgDir: 'packages/objectql', subpath: './core' }
  =>   returned normally: {"conditions":[],"missing":[
         "@objectstack/objectql/core (import) -> packages/objectql/dist/core.mjs",
         "@objectstack/objectql/core (require) -> packages/objectql/dist/core.js"]}

⚠️ The control's missing is the deliberate exit-3 PREREQUISITE path on an unbuilt tree, not the defect — as the card and the brief both warn.

After leg — same recipe, same rows, same tree

row    { id: '@objectstack/metadata/errors', ... }
  =>   returned normally: {"conditions":[],"missing":[
         "@objectstack/metadata/errors (import) -> packages/metadata/dist/errors.js",
         "@objectstack/metadata/errors (require) -> packages/metadata/dist/errors.cjs"]}

The metadata row now reaches the gate's own diagnostics with its targets named, instead of never reaching a diagnostic at all.

The flat control is byte-identical, and that is measured mechanically rather than eyeballed: git show origin/main:scripts/check-lean-entry-closure.mjs was written beside the patched file (same directory, so ROOT resolves identically), both were imported in one process, and their control-row results were string-compared.

BEFORE(origin/main gate): RETURNED {"conditions":[],"missing":["@objectstack/objectql/core (import) -> packages/objectql/dist/core.mjs","@objectstack/objectql/core (require) -> packages/objectql/dist/core.js"]}
AFTER (patched gate)    : RETURNED {"conditions":[],"missing":["@objectstack/objectql/core (import) -> packages/objectql/dist/core.mjs","@objectstack/objectql/core (require) -> packages/objectql/dist/core.js"]}
BYTE-IDENTICAL: YES

The temporary baseline copy was removed; git status --porcelain showed only the one intended modification afterwards.

What a future author now gets for an unreadable shape (option 2)

End-to-end through resolveConditions() against a real fixture manifest whose import condition is an object with no default:

THREW Error:
…/thirdshape/package.json declares exports["./errors"]["import"] as an object with keys
[types, browser] and no string "default"; this gate reads a condition only as a path string,
or as a nested condition object whose "default" is a path string.
          entry:   @thirdshape/pkg/errors
          subpath: ./errors
          flavour: import
          ⇒ Either that manifest is wrong, or it uses an exports spelling conditionTarget() in
            this file has not been taught. This gate cannot tell which from here, so it names the
            shape and stops. ⛔ What it may not do is resolve something anyway: a closure measured
            from the wrong artifact would be reported as if it were the right one.

Error, not TypeError — so the refusal is distinguishable from the node:path crash it replaces. On acceptance criterion 5 (the message must be honest): it names both live causes and asserts neither, because from inside conditionTarget() the gate genuinely cannot tell a malformed manifest from an exports spelling it has not been taught. It does not tell the reader to build, and it does not claim the manifest is wrong.

⚠️ Deliberate behaviour narrowing, stated because it is not free. The old if (!rel) continue skipped every falsy value. Now only undefined/null mean "this condition is not published"; "" and false are refusals. No manifest in this workspace has either (measured below), so nothing in the tree changes — but it is a change, not a refactor.

Negative control — the gate on a BUILT tree, figures RE-DERIVED

Built with pnpm turbo run build --filter=@objectstack/objectql --concurrency=2 under scripts/pm/os-verify-lock.sh (15 of 15 tasks successful; VERDICT command-exit 0).

✓ check-lean-entry-closure self-test: 22 cases pass (attribution, all three judgements, the
  disjointness wall, two real child loads, both condition spellings plus two refusals, the prerequisite).
✓ check-lean-entry-closure: 2 published condition(s) measured from a real load.
  @objectstack/objectql/core (import): 15 packages, 185 modules
  @objectstack/objectql/core (require): 15 packages, 183 modules
  Admitted set held exactly (15 packages); 6 denied names absent.

⭐ Re-derived on c43bac7048 + this branch, not copied from the card. They land on the card's figures — 2 conditions, 15 packages, 185 / 183 modules, admitted set held exactly — which is the result, not the input.

And the strongest form of "unchanged": the origin/main gate and the patched gate were both run against this same built tree and their stdout diffed byte for byte — identical.

Self-test: one case per branch, and the floor ratcheted

New battery reading a condition, 6 cases: flat condition, nested condition, absent condition, an object with no default refused, a third shape (array) refused, and one end-to-end resolveConditions() over a nested fixture manifest. Roster 5 → 6 batteries; SELF_TEST_BATTERY_FLOOR 5 → 6; cases 16 → 22.

Every mutation below was proved on disk (grep -c on the exact anchor text before and after, plus the file's git hash-object against its HEAD blob) and restored with git checkout HEAD -- <path>, verified by an empty git diff HEAD and by the restored blob hashing back to 8672f581160c61f80134ea605072ade106d2b850. The fix was committed first, so the restore leg pointed at a HEAD that carried it.

Firing control — SELF_TEST_BATTERY_FLOOR 6 → 7, i.e. above the 6 declared batteries:

✗ SELF_TEST_BATTERIES declares 6 batteries, below the pinned 7 — a battery deleted from the
  roster takes its own floor with it.
✗ check-lean-entry-closure self-test: 1 of 23 case(s) failed.

Nonsense control — the roster name changed to one no case registers under ('reading a condition' → 'reading a conditionZZZ'), the exact silencing the roster exists to catch:

✗ self-test battery "reading a condition" registered 6 case(s) but is not declared in
  SELF_TEST_BATTERIES — an assertion attributed to no declared battery is one nothing floors.
✗ self-test battery "reading a conditionZZZ" DID NOT RUN — 0 cases registered, 6 pinned.
  The verdict below would have claimed those cases hold.

Ablation of the fix itself — conditionTarget() reverted to the pre-fix return value;. The new battery does not merely go red, it reproduces the reported defect exactly, at the same argument index:

TypeError [ERR_INVALID_ARG_TYPE]: The "paths[2]" argument must be of type string.
  Received an instance of Object
    at resolve (node:path:1272:7)
    at resolveConditions (…/scripts/check-lean-entry-closure.mjs:541:20)

Header (option 3) — the sentence that stays false after 1 and 2

The table shape is what makes that a one-row change for whoever owns it. is replaced with what a second entry actually costs: its own ADMITTED_PACKAGES set, and a package entering an admitted set moves the ADR-0076 D2 boundary and carries RATCHET_AUTHORITY_MARKER = '⛔ MAINTAINER-ONLY'. ⇒ Whoever owns a second entry owns a maintainer decision, not just a row.

Does option 1 actually cover this repo? (the triage seat left this unmeasured)

The triage comment asked, explicitly, not to assume .default exists on all nested conditions. Measured across all 71 workspace manifests with an exports map:

condition value	count	lacking a string default
flat (string)	109	n/a
nested (object)	102	0
any third shape	0	n/a

⇒ Option 1 covers 211 of 211 live conditions. And because there are zero third shapes in the tree today, option 2 is prophylactic by construction — which is why its self-test cases have to supply the third shape synthetically. That is the honest reading of what each half buys.

Gates run — TEXT, not just exit codes

node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 31 families from the merge base c43bac704 (its own change-set derivation, not a hand-written list). All 31 were run and reconciled:

Run reconciliation — 31 derived, 31 run, 0 NOT-MEASURED, 0 UNRUN.
✓ dispatch-gates --ran: 31 derived famil(ies) accounted for — 31 run, 0 NOT-MEASURED.

Zero non-zero exits across the batch. Named among them: check:lean-entry-closure, check:ratchet-remedy-authority (it reads this very file), check:nul-bytes, check:self-test-wired, check:scripts-symbol-anchors, check:pm-dispatch-gates.

Beyond the derived set:

• eslint . --no-inline-config was run in full, not narrowed — 6410 files, 0 errors, 0 warnings, on the final commit 9998c82a5e. No narrowing argument is needed. (For the record, the config states at eslint.config.mjs:328 that there is no parserOptions.project and no typed rules.)
• packages/objectql/src/core-boundary.ratchet.test.ts — the neighbouring source-scan guard: 1 file / 2 tests passed. It names this gate only in a comment; there is no executable coupling.
• Control-character sweep beyond check:nul-bytes: grep -naP '[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]' on the changed file — no hits.

⚠️ What I swept and what I did NOT — this list is not complete

Swept: the 31 derived families, the full repo eslint, the neighbouring ratchet test, the published-manifest files[] reach, the workspace-wide condition-shape census, control characters.

Not swept, and I am naming them rather than implying clearance:

• The 48 artifact-roster families, 11 wide-population families and 13 pending-changeset families that dispatch-gates itself prints as outside the derived total. Their silence is a fact about a list, not about these paths.
• Two families that take a value from the workflow (check-shard-attestation, check-test-completeness) — NOT MEASURED locally by construction.
• CI convergence. I did not wait for it.

⚠️ Two judgement calls a reviewer should check rather than take

1. The refusal throws; it does not become a findings[] entry. So through main() it still surfaces as an uncaught Error with a stack — the message is on top and carries everything, but it is not routed through the gate's own ✗ N finding(s) report. I kept the existing mechanism deliberately: the shape guard one level up (exports[subpath] is not an object) already throws the same way, and the triage seat's advice was to move that existing pattern down a level rather than design a new diagnostic style. Deciding that "this gate cannot measure this row" deserves its own report channel — a fourth judgement alongside pass, finding and PREREQUISITE — is a wider call that belongs with whoever adds a second entry. ⛔ It is not the PREREQUISITE path: routing it there would print "run the build first", which is a cause that did not occur.
2. Line number correction for the record. The brief cites the header sentence at :116; on origin/main c43bac7048 it spans :120-121. RATCHET_AUTHORITY_MARKER at :156 is exact.

⛔ I did not add the @objectstack/metadata/errors row and did not widen ADMITTED_PACKAGES. Nothing I measured changed my view that adding it is a separate card and a maintainer decision — and the census above sharpens the price rather than lowering it: the row would resolve cleanly now, which is precisely what makes the second admitted set the whole remaining cost.

Changeset: scripts/ reaches 0 published manifests (measured above). If Check Changeset reds, I have not labelled — that is the PM's skip-changeset to apply.

🤖 Generated with Claude Code

https://claude.ai/code/session_012GKcPZbMoGq7WPzKLfRBTU

---

Generated by Claude Code