fix(rest,metadata-protocol): a public form's intake withdrawal at any metadata layer holds; layering can only narrow intake

[objectstack-fleet]

Fixes #21835

Clause-②: yes (widening)

Fixes a regression introduced after 17.6.0 (with #21420); it should land before 17.7.0 is cut.

What

Per the rulings recorded on #21835: a public form's withdrawal is a kill switch, layering can only narrow anonymous intake, a withdrawal closes the same form only, and only an explicit withdrawal counts.

• Anonymous doors (GET /forms/:slug, POST /forms/:slug/submit). Both use one resolver and judge by the name of the view item they serve. When an organization is resolved, the env-wide view list beneath it is read as well. A form is served only when the env-wide item of the same name does not explicitly withdraw a form in the same slot (nested form, the same formViews key, or the flattened config) or with the same slug. Other views that share the public slug never close each other.
• What counts as a withdrawal. A sharing that keeps its publicLink and sets enabled: false or allowAnonymous: false. Only an explicit false counts. Not a withdrawal: an absent switch, a sharing with no link (raw, or schema-parsed), a cleared link, a removed sharing block, or no body of the view at that layer. The public data collection docs page has a "Withdraw a public form" section with these rules.
• Write door (save and publish). An org-scoped view save or draft promotion in the organization the doors read is refused with 403 NOT_OVERRIDABLE when it would leave open a form the env-wide definition explicitly withdraws. It judges by the stored row: the body is compared with the env-wide body of the row it is keyed by (the active env-wide row, else the package artifact), matched by slot or by slug. So renamed formViews keys, form.name, slot moves and listViews collision renames are the same form. It is also judged against the env-wide view list the way the doors read it, with container bodies expanded. Re-saving an overlay that was open before the withdrawal is refused. The message names both remedies.
• Package-shipped forms. A package artifact is part of the env-wide definition, not a separate layer. A package artifact parsed by the stack schema (strict defineStack, the default) carries the schema's default enabled: false, so a shipped form that keeps its link without switching enabled on is an explicit withdrawal and fails closed. An artifact loaded without that parse (defineStack(..., { strict: false }) or a hand-built manifest) is judged as written: a switch it omits is absent, which is not a withdrawal. The env-wide definition is the administrator's switch, so an env-wide save may open a form the package ships closed.
• Known limit: packages and names. A withdrawal of a view name closes that name in every package: when two packages ship a view of the same name, one package's withdrawal also closes the other package's form of that name. It may over-close, never under-close. Per-package precision is tracked in security(metadata): tighten the draft publish gate and package identity for org view overlays (follow-up to #21864) #21934. A publish judges the draft it promotes under the same package key (the stated one, else the resolved draft row's own), so with two packages holding a draft of the same view in one organization, each draft is judged on its own publish.
• Intentional reversal. The earlier behaviour in which an organization overlay re-published a form the package had withdrawn is reversed. A form with no env-wide word on it stays organization-publishable (fix(rest): withdrawing a public form takes effect on every anonymous intake door #21420), and the fix(metadata-protocol): refuse an org-scoped public form withdrawal a walled posture cannot honour #21473 anchors and fix(rest): one anonymous-intake rule honours every declared public-form withdrawal #21566 field allowlist are unchanged.
• Public surface: @objectstack/metadata-core adds one export, anonymousFormIntakeWithdrawnIn (minor). @objectstack/rest and @objectstack/metadata-protocol are patch.
• Known limit (ruled to stay as is). The doors match by served item name, and the write door runs only on an org-scoped save or publish. An organization overlay stored before the env-wide withdrawal, or restored by rollback or commit revert, can still be served if it keeps the form open under a different key or slot than the env-wide definition. Withdrawing the form in that overlay closes it. Stated in the changeset and the docs.

Tests

The first bullet is round 6, the second round 5, the third round 4; the bullets after them were measured at e8778acb96 (round 2):

• Round 6 at 7882eef683 (merged origin/main 9dce635337, merge commit 46d08189a7): metadata-core 18 files, 411 passed; metadata-protocol 216 files (3 skipped), 27940 passed, 19 skipped; rest 260 files, 4912 passed, 326 skipped; objectql 375 files, 7469 passed (suites at 4d5f6c4e61; the later commits touch docs, the changeset and three ported dogfood files only). Typecheck green for metadata-core, metadata-protocol, rest and objectql, test layers included. 97 of 97 derived gates green at 7882eef683, reconciled with dispatch-gates --ran; dispatch-gates --self-test 1976 cases pass. The cross-package skip of round 5 is removed per the ruling, so a withdrawal of a view name closes it in every package again. Pins: another package's withdrawal of the same name closes this package's form too (metadata-core and the doors); with two packages shipping the same view name, a row-anchored rename by a package-bound org save is refused (metadata-protocol), with a withdrawn-save control. Ablation: the two edited sources set back to their round-5 blobs and rebuilt, markers proved in dist/: 1 red in each of metadata-protocol, metadata-core and rest; restored to HEAD (git diff HEAD empty), rebuilt, markers proved absent.
• Round 5 at d8657b5c19: metadata-core 18 files, 411 passed; metadata-protocol 216 files (3 skipped), 27938 passed, 19 skipped; rest 260 files, 4911 passed, 326 skipped; objectql 374 files, 7464 passed. Typecheck green for metadata-core, metadata-protocol, rest and objectql, test layers included. 97 of 97 derived gates green, reconciled with dispatch-gates --ran. New pins: two packages' drafts of one view in one organization are each judged on their own publish; one package's withdrawal of a name closes its own form (metadata-core and both doors; the cross-package half was inverted in round 6). Ablation: removing the package key from the publish gate's draft read turned the two-package pin red, and removing the package comparison turned the cross-package pin red; both restored to HEAD (git diff HEAD empty).
• Round 4 at 79b847042d (targeted): metadata-core anonymous-form-intake.test.ts 39/39, metadata-protocol protocol.org-scoped-write-refused.test.ts 41/41, rest public-form-withdrawal + public-form-intake-availability 43/43. Typecheck green for metadata-core and metadata-protocol. Docs and changeset gates green. New pins: a package parsed false is a withdrawal; an env-wide save opens a package-closed form.
• @objectstack/metadata-core: 18 files, 394 passed.
• @objectstack/rest: 260 files, 4906 passed, 326 skipped.
• @objectstack/metadata-protocol: 214 files (3 skipped), 27752 passed, 19 skipped.
• Typecheck green for all three and dogfood.
• Dogfood (real showcase boot): the layered-withdrawal suite 5/5 (including the re-save refusal) and the five sibling public-form suites 20/20.
• Coverage: two views sharing a slug do not close each other (one read, with and without an organization, and across layers); a cleared link is not a withdrawal; a parsed link-less sharing is not a withdrawal; re-saving an already-open overlay is refused; a container-shaped save is judged after expansion.
• Ablation (source set back to the base blobs, packages rebuilt): 3 / 4 / 4 tests red across metadata-core / rest / metadata-protocol; restored to HEAD.
• Gates: 92 of 95 derived run green; check:skill-examples, check:dual-build-cjs-loads and check:type-check-debt are NOT MEASURED locally (workspace-wide prerequisites) and left to CI.

Acceptance notes

• The known limit above (an overlay stored before the withdrawal, or restored by rollback or revert, with its form under a different key or slot) is accepted per the ruling on security(forms): a public-form setting at one metadata layer can re-open intake that another layer withdrew — 17.7 regression, detail withheld pending maintainer #21835. No provenance or new protocol query was added.
• Two installed apps publishing the same slug is a separate concern (slug collision), out of scope here.
• A package artifact loaded without the stack schema's parse (strict: false, a hand-built manifest) is judged as written; giving every load path the schema's sharing defaults is left as a possible follow-up (see the round 5 report on security(forms): a public-form setting at one metadata layer can re-open intake that another layer withdrew — 17.7 regression, detail withheld pending maintainer #21835).
• An objectql test double now answers the publish gate's draft-row read (protocol-publish-package-drafts.test.ts); that is test-only.
• Maintainer ruling, 2026-10-06: 「撤掉跨包那一改，合并」. The cross-package skip is removed; per-package precision is tracked in security(metadata): tighten the draft publish gate and package identity for org view overlays (follow-up to #21864) #21934.
• This branch carries three dogfood files ported unchanged from test(dogfood): each file's temporary cwd is created from a base the scratch-dir scan can read #21935 (packages/qa/dogfood/test/per-file-cwd.setup.ts, packages/qa/dogfood/test/per-file-cwd.global-setup.ts, packages/qa/dogfood/vitest.config.ts) so the dispatch-gates self-test is green here; they merge away once test(dogfood): each file's temporary cwd is created from a base the scratch-dir scan can read #21935 lands.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 3 package(s): @objectstack/metadata-core, @objectstack/metadata-protocol, @objectstack/rest, touching 12 documentable anchor(s). ⚠️ 1 changed file(s) yielded no anchor (packages/rest/src/rest-server.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

20 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json 9e33ee7c5936e35a38158a7f9fdbcbd4445797a8.

⛔ 6 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 1 changed file(s) yielded no anchor (packages/rest/src/rest-server.ts) — pages documenting those are invisible to this run
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 25 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 9e33ee7c5936e35a38158a7f9fdbcbd4445797a8 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from ee6285d26a5185603e2f201a7a97f39664b99ca0 — the merge of head 7882eef683e0d415c065f50049f705280a5771d6 into base 9e33ee7c5936e35a38158a7f9fdbcbd4445797a8, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin ee6285d26a5185603e2f201a7a97f39664b99ca0 && git checkout ee6285d26a5185603e2f201a7a97f39664b99ca0
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 9e33ee7c5936e35a38158a7f9fdbcbd4445797a8 7882eef683e0d415c065f50049f705280a5771d6 && git checkout -B drift-repro 9e33ee7c5936e35a38158a7f9fdbcbd4445797a8 && git merge --no-ff 7882eef683e0d415c065f50049f705280a5771d6

node scripts/docs-audit/affected-docs.mjs --json 9e33ee7c5936e35a38158a7f9fdbcbd4445797a8

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 9e33ee7c5936e35a38158a7f9fdbcbd4445797a8 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: e8778acb960387682072d73d0a235bda16bb2261
Local-runs: none

Inputs read: card #21835 (body and all six comments: triage, claim, os-dev-report round 1, claim correction, the two refining rulings, os-dev-report round 2), PR #21864 (body, 10-file list, net diff against main), and the check-runs on this head.

① Derived judgments

Accept-set changes:

• Anonymous doors (GET /forms/:slug, POST /forms/:slug/submit), narrowed — right. resolveFormBySlug now also reads the env-wide view layer when an organization is resolved. A candidate is skipped when that layer's body of the same view name, same slot explicitly withdraws the slug. This matches the kill-switch ruling and both refining rulings: 「只关同一个表单」 is enforced by the name and slot match in anonymousFormIntakeWithdrawnIn, and 「不算，写进文档」 by sharingWithdrawsSlug, which needs the same slug kept in publicLink. The reverse direction (withdrawn in the organization, open env-wide) is closed by the organization read itself, because that read prefers the overlay. It is pinned by a test. With no organization, the single env-wide read is the only layer, so nothing changes there.
• Withdrawn-form predicate — right, with one note. "Withdraws" means the same slug is kept in publicLink and the form is not open (enabled !== true or allowAnonymous !== true). A body that keeps the link but leaves a switch absent therefore counts as a withdrawal. That matches the spec's false defaults and the doors' own open rule (raw and parsed bodies agree), and it can only narrow intake, so it stays inside the ruling. A sharing with no link, a cleared or changed link, a removed sharing block, or an absent view body withdraws nothing. Each case is pinned in the metadata-core tests.
• Removed behaviour, intentional reversal — right. The deleted rest test (an organization overlay re-publishing a package-withdrawn form is honoured) is replaced by its inverse, as the ruling requires. That behaviour arrived with fix(rest): withdrawing a public form takes effect on every anonymous intake door #21420 (49524f6906), which is not an ancestor of the 17.6.0 commit 617f25f8a. The reversal therefore narrows no released behaviour.
• Write door, narrowed — right. An org-scoped view save in the organization the doors read used to return null there. It now goes through anonymousFormIntakeReopenRefusal → 403 NOT_OVERRIDABLE when a form the save would leave open is explicitly withdrawn env-wide, judged by the doors' own predicate after container expansion. Saves that keep the form withdrawn, or open nothing the env-wide layer withdrew, are unchanged and pinned as controls. The judgement for saves in organizations the doors do not read is untouched.
• Read cost — right. The extra env-wide view read happens on each anonymous resolution, and only when an organization is resolved. The updated test in public-form-intake-availability.test.ts pins that call sequence (['view','view']), and no object read is added.

Public-surface changes (package exports maps):

• @objectstack/metadata-core ".": +1 export, anonymousFormIntakeWithdrawnIn (re-exported through src/index.ts → export * from './anonymous-form-intake.js'). Additive. No signature of an existing export changes. AnonymousFormIntakeCandidate is unchanged. The new slot helpers are module-private. Right. The claim correction (comment 5993499550) speaks of "two public exports". That is stale: round 2 removed the unreleased anonymousFormWithdrawnSlugs, and the diff carries one export only.
• @objectstack/metadata-protocol: no export change. The new method is private, and packageId? is added to a private method's argument bag. Right.
• @objectstack/rest: no export change. The only change is the internal shape of findPublicFormView. Right.

② Semver level

• The changeset is .changeset/public-form-withdrawal-kill-switch.md: @objectstack/metadata-core: minor, @objectstack/rest: patch, @objectstack/metadata-protocol: patch. These match the diff: one additive export (minor) and two packages whose fix narrows only unreleased behaviour (patch). No major is warranted.
• Clause-②: yes (widening) appears in both the PR body and the changeset. It is well formed, and yes is matched by a minor on the widened package. This supersedes the claim's original Clause-②: no, as the PM's correction records. No (narrowing) arm is owed, because the reversed behaviour never shipped. ADR-0087 disposition: not owed (not breaking). Check Changeset is green on this head.
• Non-blocking wording note: the changeset's "Before this release, an organization overlay … was honoured" could be read as released behaviour. It only ever existed between 17.6.0 and this fix. This does not change the level.

③ Boundary flags

• open_questions[0] (rollback / commit-revert ungated at write time). Answered: option A for this PR. The rulings govern what the anonymous doors serve, and the doors keep such a form closed at read time, so there is no exposure. The remaining cost is an accepted write that is never honoured, which the changeset states. Option B changes the restore path's write ordering, which is beyond this card's surface. It remains a possible follow-up and is not a condition of this PR.
• Round-1 flag (claim file surface omits packages/metadata-core/src). Answered by the PM claim correction, which adds it.
• Round-2 flag (PR body describes the earlier round). Answered. The PR body at this head describes the round-2 design: same-form identity, explicit-only, the re-save refusal, one export.
• Out-of-scope findings. (a) The check:type-check-debt re-measure rewrites dist outside the verify lock (a tooling race). (b) A cross-app slug collision. The maintainer ruled (b) a separate concern. Both are recorded with carrier none, not filed. Neither blocks this PR. Filing them is the PM seat's call.
• Gates. On this head, 21 check-runs are success, 4 are skipped, and none has failed. 14 were still in_progress when this record was written (Test Core 1–6/6, Dogfood Regression Gate 1–3/3, Dogfood Verify CLI, Temporal Conformance, Lint & Repo Gates, Type Check · workspace, Type Check · consumer gates). They cover the families the dev declared NOT MEASURED locally (check:skill-examples, check:dual-build-cjs-loads, check:type-check-debt). This verdict does not certify those families: landing still requires every check green on this head.

Implemented-by: claude/issue-21835-form-withdrawal-kill-switch
Reviewed-by: session_018zT8d8NpiQ1ExhuNd5TxY6

VERDICT: PASS

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: d8657b5c19fd4fd2443953470adb1138f4b1f5df
Local-runs: none

Inputs: card #21835 (body and all 9 comments, rulings 5994082238 and 6005722623, os-dev-reports through round 5, 6007561084), PR #21864 (body, 11 files, net diff against main at this head), and the 43 check-runs on this head. No check-run has failed. 17 are still pending (listed at the end), so this record does not rest on them.

① Derived judgments

• Anonymous doors (rest-server.ts findPublicFormView): RIGHT. The accept-set narrows. When an organization is resolved, the doors also read the env-wide view list, and a candidate is skipped when anonymousFormIntakeWithdrawnIn finds an explicit withdrawal of the same name, matched by slot or by slug. This matches the kill-switch ruling, the "same form only" ruling and the explicit-only ruling (5994082238). Name-anchoring plus the documented known limit is what ruling 6005722623 chose. With no organization, the single read is unchanged. The test change from ['view'] to ['view','view'] is the expected second read.

• Shared judgement (metadata-core anonymousFormIntakeWithdrawnIn, anonymousFormExplicitWithdrawals): RIGHT. It counts only an explicit === false on a sharing that keeps its link. An absent switch, a link-less sharing and a cleared link withdraw nothing, as ruled. The package comparison skips a body only when both sides are bound to different packages. A package-less body is still compared, which fails closed and is consistent with ADR-0048's stand-in reading.

• Publish gate draft key (promoteDraftForPublish): RIGHT. The draft is now judged and promoted under one package key: the stated one, or the resolved draft row's own. This removes the case where the judged draft and the promoted draft could differ. It costs one extra findOne on a publish that states no package (declared). The objectql test double change is test-only.

• Write door, row anchor (metadata-protocol envWideRawViewRows): WRONG. This is what makes renamed keys, form.name, slot moves and collision renames "the same form" at save and publish. Ruling 6005722623 kept the doors name-anchored because, as it states, the write door "already refuses every new escape". Round 5 added a package comparison to the shared judgement, and the overlay body now carries _packageId. But this lookup is still not package-scoped:

  • lookupArtifactItem(type, name) is called without the saved row's package. The registry then returns the first package's artifact of that name in map order.
  • The stored-row branch returns every env-wide row of the name, whatever its package. It also drops the artifact fallback whenever any package has a row.
  • So when more than one package carries a view of that name, the anchor can pick only another package's body. The new package comparison then skips it, and the anchor judges nothing.

  Round 5 brought this in: before it, every body was compared and the anchor failed closed. Because of it, the PR body's and changeset's claim that the row anchor holds is false for a package-bound save in that layout.

  • Required: resolve the env-wide row for the saved row's own package, with the package-less row standing in. That means passing args.packageId to lookupArtifactItem, and falling back to the artifact per package rather than per name.
  • Required: add a pin with two packages that ship the same view name, where one package's row-anchored rename is refused.

• Write door, list judgement and the message: RIGHT. The expanded body is judged against the env-wide list the doors read. 403 NOT_OVERRIDABLE with a userMessage follows the existing refusal's shape. Saves that keep the form withdrawn are still accepted.

• Public surface (the exports maps): the @objectstack/metadata-core . entry re-exports anonymous-form-intake.js wholesale. It gains exactly one symbol, anonymousFormIntakeWithdrawnIn, and the helpers stay module-private: RIGHT. The metadata-protocol additions (anonymousFormIntakeReopenRefusal, envWideRawViewRows, the packageId? argument) are all private: no public-surface change, RIGHT. @objectstack/rest exports nothing new: RIGHT.

② Semver level

• .changeset/public-form-withdrawal-kill-switch.md sets @objectstack/metadata-core: minor, @objectstack/metadata-protocol: patch, @objectstack/rest: patch. That matches what the diff publishes: one additive export in metadata-core, and in the other two a narrowing that fixes a security regression with no surface change. No package is missing. objectql is test-only and dogfood is private, so neither needs an entry. Not major: nothing is removed or retyped. Check Changeset succeeded on 2 of its runs; its third run is pending.
• Clause-②: yes (widening) is consistent across the changeset, the PR body (line 3) and the claim correction 5993499550. It is right for the one new export.
• The behaviour-change bullet (the org overlay re-opening, never shipped in a release, reversed on purpose) is stated. It matches the card's regression note (after 17.6.0, fix(rest): withdrawing a public form takes effect on every anonymous intake door #21420).

③ Boundary flags

• Round-5 open question 1 (fix 3, artifacts loaded without the schema parse, option A): consistent with the rulings, no escalation. Ruling 6005722623 makes a schema-parsed false on a package artifact an explicit withdrawal (「包内的 false 算显式关闭」). Its premise was that parsing makes explicit and absent indistinguishable. A body that was never parsed has no false to count. For such a body the explicit-only ruling 5994082238 governs: an absent switch is not a withdrawal. That is the same rule DB rows get. The default path (strict defineStack) still fails closed. The docs tell authors to set enabled: false explicitly to ship closed. The seat accepting A matches what both rulings say. Option B stays an optional follow-up and is not owed by this card.
• Round-5 open question 2 (PR-body edits): applied. The PR body carries edits 1 to 4 verbatim.
• Round-3 open questions (door identity, package parsed false, package as a layer): answered by ruling 6005722623 and implemented. The door-identity answer's premise is the row-anchor defect in ①, which must be fixed, not re-ruled.
• Round-2 open question (rollback and revert ungated): covered by the known limit in 6005722623. It is stated in the changeset and the docs.
• Round-1 flag (metadata-core missing from the claim's file surface): answered by claim correction 5993499550.
• Unanswered: the round-5 diff edits packages/objectql/src/protocol-publish-package-drafts.test.ts. That is outside the corrected file surface (rest, metadata-protocol, metadata-core, dogfood, .changeset/). The report discloses it, but no claim correction adds it. Required: the seat posts a claim correction that adds the path, test-only.
• Out-of-scope findings (an unlocked dist rewrite by type-check-debt, slug collision across apps, the extra findOne): each was noted with no carrier. None blocks this PR.

Implemented-by: claude/issue-21835-form-withdrawal-kill-switch
Reviewed-by: session_018zT8d8NpiQ1ExhuNd5TxY6

VERDICT: FAIL

FAIL reasons:

1. The write door's row anchor (envWideRawViewRows) is not package-scoped, so round 5's package comparison can turn it into a no-op. A pin for that layout is also needed.
2. The objectql test path is outside the claim's file surface. A claim correction is owed.

Pending check-runs at this head (not waited on): Check Changeset (1 of 3 runs) · Test Core 1/6 to 6/6 · Dogfood Regression Gate 1/3 to 3/3 · Dogfood Verify CLI · Temporal Conformance (live PG + MySQL) · Build Core · Type Check · workspace · Type Check · consumer gates · Type Check · debt ledger · Lint & Repo Gates.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 7882eef683e0d415c065f50049f705280a5771d6
Local-runs: none

Inputs: card #21835 (body and all 12 comments: rulings 5994082238 and 6005722623, claim corrections 5993499550 and 6007635663, os-dev-reports through round 6, 6008895615), PR #21864 (body, 14 files, net diff against main at this head, and the earlier record 6007621979, FAIL at d8657b5c19), and the 39 check-runs on this head. Round 6 answers the maintainer ruling recorded after that FAIL, verbatim 「撤掉跨包那一改，合并」 (remove the cross-package change, then merge). Diffs read: d8657b5c19..7882eef683, 46d08189a7..7882eef683 (round 6 alone), origin/main...7882eef683, and 79b847042d (pre-round-5) for the byte comparisons.

① Derived judgments

• Cross-package skip removed (metadata-core anonymousFormIntakeWithdrawnIn): RIGHT. 4d5f6c4e61 removes the anonymousFormPackageOf helper and the package comparison in the loop. _packageId no longer appears in the module. A withdrawal of a view name again closes every same-name body, whatever its package. That fails closed, which is what the ruling asks for. Only the JSDoc differs from 79b847042d: it now states the known limit and keeps round 5's wording on schema-parsed artifacts.
• Write-door feeders removed (metadata-protocol anonymousFormIntakeReopenRefusal): RIGHT. The bound package stamp is gone from the judged item and from the row-anchor body. I extracted the function at 79b847042d and at this head, and the two are byte-equal (56 lines, cmp clean). envWideRawViewRows is also byte-equal to 79b847042d.
• Round-5 publish-gate key fix kept (promoteDraftForPublish): RIGHT. The draft is still read and promoted under one key, draftKey. That key is the stated binding or, when none is stated, the resolved draft row's own package_id, so the body judged is the body promoted. The two-package draft pins and the objectql test double (test-only, added to the claim by 6007635663) are kept.
• Anonymous doors (rest-server.ts): RIGHT, unchanged this round. When an organization is resolved, the env-wide list is read as well, and the shared judgement is applied name-anchored, as ruling 6005722623 chose. The net diff in rest-server.ts is only the doors' change. The comment hunk seen in 79b847042d..head comes from main.
• Pins inverted: RIGHT.
  • metadata-core: another package's withdrawal of the name now closes this package's form (true), with a control where another package's open body closes nothing.
  • rest: the cross-package door case now expects closed, and a new control serves the form (200/201) when every package's body is open.
  • metadata-protocol: a new single: two packages ship the same view name pin. A package-bound org save that renames the key is refused (403 NOT_OVERRIDABLE) and nothing is saved. A control that keeps the form withdrawn saves.
  • The report's ablation turned each of the three red against the round-5 blobs.
• Row anchor input across packages: RIGHT per the ruling, with a residue I escalate (see ③). envWideRawViewRows compares every env-wide stored row of the name. With no stored row, it falls back to lookupArtifactItem(type, name) with no package, and the registry answers that with its first composite match. So when several packages ship the same view name and no env-wide row is stored, the anchor judges one package's artifact, chosen by registry order. The new protocol pin's stub returns the withdrawing package's artifact for the package-less lookup, so it pins the favourable order only. This input selection is byte-equal to 79b847042d, and the earlier record had already described it to the ruling. It is not introduced by this round.
• Public surface: RIGHT. @objectstack/metadata-core gains exactly one export against main, anonymousFormIntakeWithdrawnIn. The helpers stay module-private. The protocol additions are private, and @objectstack/rest exports nothing new.
• Dogfood port: RIGHT. per-file-cwd.setup.ts, per-file-cwd.global-setup.ts and vitest.config.ts are blob-identical to PR test(dogfood): each file's temporary cwd is created from a base the scratch-dir scan can read #21935's head 2edc5d59d4 (dc1d3de3d4, 284a6f6c9e, 841365bfeb). The port is the same one as on fix(trigger-record-change)!: a record-change flow's trigger record carries the credential mask and omits internal fields #21928 (6008303479). test(dogfood): each file's temporary cwd is created from a base the scratch-dir scan can read #21935 has since merged, and current origin/main (412d7dd024) carries the same three blobs, so against current main the port adds nothing.

② Semver level

• .changeset/public-form-withdrawal-kill-switch.md sets @objectstack/metadata-core: minor, @objectstack/metadata-protocol: patch and @objectstack/rest: patch. That matches what the diff publishes:
  • metadata-core gains one additive export.
  • the other two narrow behaviour to fix a security regression, with no surface change.
  • objectql (test-only) and the private dogfood package need no entry.
  • nothing is removed or retyped, so not major.
• Both Check Changeset runs succeeded on this head.
• Clause-②: yes (widening) appears in the changeset, in PR body line 3 and in claim correction 5993499550. It is right for the one new export.
• The changeset and the docs page state the over-close known limit ("a withdrawal of a view name closes that name in every package … may over-close") and point to security(metadata): tighten the draft publish gate and package identity for org view overlays (follow-up to #21864) #21934. The changeset keeps the one-package-key publish sentence. No wording of the removed per-package rule is left in either file.

③ Boundary flags

• Round-6 open question (PR-body edits 1 to 5): applied. The body carries the known-limit bullet, the round-6 Tests bullet and lead sentence, the edited round-5 bullet, and both acceptance notes, as written.
• Previous FAIL reason 1 (row anchor not package-scoped): answered by the maintainer ruling, not by the required fix. The cross-package change is removed, so the shared judgement no longer skips another package's body.
• Previous FAIL reason 2 (objectql path outside the claim): answered by claim correction 6007635663.
• Escalated, not blocking under the ruling: the "never under-close" sentence. The changeset says "never under-close", and the docs say "it never leaves a withdrawn form open". That holds for the shared judgement given the bodies it is handed. It does not hold for the write door's row-anchor input in the layout above (several packages ship one view name, with no env-wide stored row). There the anchor sees one package's artifact by registry order, and a stored row of any package masks every artifact.
  • The reach is narrow: it needs an administrator-level org save with a rename that the name-anchored list judgement does not catch.
  • The code is the pre-round-5 code the ruling chose to land.
  • Asked of the PM seat: add this input selection (an all-packages artifact read, or a per-package one) to security(metadata): tighten the draft publish gate and package identity for org view overlays (follow-up to #21864) #21934, which today names the doors' package identity but not the anchor's artifact fallback. Also, either narrow the sentence to the shared judgement or confirm the ruling covers it.
• Earlier flags: round-5 fix 3 (unparsed artifacts judged as written), the round-3 questions, rollback and revert, and the round-1 file surface stay answered as the earlier record found. None reopens.
• Out-of-scope findings:
  • The dogfood port's carrier is test(dogfood): each file's temporary cwd is created from a base the scratch-dir scan can read #21935, now merged, so the port merges away.
  • The cold turbo build flake was noted, not filed.
  • Neither blocks this PR.

Implemented-by: claude/issue-21835-form-withdrawal-kill-switch
Reviewed-by: session_018zT8d8NpiQ1ExhuNd5TxY6

VERDICT: PASS

Check-runs at this head: 22 success, 4 skipped, 0 failed. 13 are pending and were not waited on: Test Core 1/6 to 6/6, Dogfood Regression Gate 1/3 to 3/3, Lint & Repo Gates, Temporal Conformance (live PG + MySQL), Type Check · workspace and Type Check · consumer gates. Landing still needs every check green.