lint: promote `relationship/master-detail-required` from warning to error, scoped to `controlled_by_parent` — ruled for the v18 boundary (Direction 1 of #8772)

[os-zhuang]

Provenance

Slice C (Direction 1) of the #8772 maintainer ruling (2026-08-16, comment 5306089973): promote the lint rule from warning to error, scoped to controlled_by_parent objects only, landing at the v18 major boundary — not before. Carved into its own card on the maintainer's 2026-08-16 instruction (PM chat, verbatim: 「接受你的建议，开新卡，现有的可以关闭？」), recorded by PM session session_01NYgmGheCzM6NrHZN436Cxf. Intended lane: domain:devx (lands in packages/lint) — domain:* left for triage per the single-producer rule.

Hold record (pm:on-hold — decision made, answer is "at v18")

• Date: 2026-08-16.
• Reason: the ruling schedules this deliberately at the next major (v17 went GA 2026-08-14 two days ago); it is a contract narrowing that belongs on a version boundary with its migration machinery, not mid-line.
• Named restart condition: the v18 major window opens (first v18 RC branch cut / the protocol-18 migration window becomes the active target). Whichever seat runs the v18 release board re-queues this card at that moment.
• Trigger files (opportunistic-restart clause): packages/lint/src/data-model-rules.ts and packages/lint/src/validate-security-posture.test.ts — any dispatch whose file surface intersects them must name this card.

Scope when restarted

• error fires only for a master reference on a controlled_by_parent object, covering all three unsafe shapes: missing required; required: true + readonly; required: true + system (the latter two skipped by record-validator.ts's provenance-flag continue).
• Retire the validate-security-posture.test.ts:434 pin ("stays silent on step 2: ANY master_detail (not marked required)") as a deliberate contract narrowing — never a drive-by test edit. Correction on record: that pin lives in packages/lint/, not plugin-security (the A controlled_by_parent object may declare its master reference without required, so the master-access guard is the only thing preventing an unreachable orphan detail row #8772 body mis-homed it).
• Ships with a v18 migration entry + upgrade-checklist line.
• model: claude-fable-5 mandatory when implemented (accept-set narrowing).
• ⛔ Runtime stays as-is (resolveCbpRelation fallbacks kept — tolerance for existing installs); the guard freeze note (identity sibling) is only lifted once this lands.

Refs: #8772 (ruling + full measurement) · siblings: guard freeze note (identity, immediate), builder-force (spec, immediate).

[os-warren]

Evidence note for the eventual v18 implementer (domain:spec seat, session_01PBjwYLS6BciTQW3c9xQiD2, from the #13699 census — that card is closed as a re-discovery of this one): the lint predicate at packages/lint/src/data-model-rules.ts is def.required !== true, so two of this card's three required unsafe shapes draw NO finding at ANY severity — required: true + readonly, and required: true + system (measured, not read). A one-line severity flip on the existing rule therefore under-delivers this card's own scope while reading as done; the implementation must extend the predicate to all three shapes. Also measured for pricing: the CBP-scoped escalation this card rules turns 0 in-tree corpora red today, and the rule is not registered in authoring-rules.ts (bites only os lint's exit code and the eval rubric). Full census: the os-dev-report on #13699.

---

Generated by Claude Code

[os-warren]

Hold-condition completion (triage seat, H9 patrol of 2026-08-31). ⛔ No state change, no re-grade, no new decision — this transcribes an exit condition this card already states into the machine form the unlock scan can read.

The half-state patrol flags this card under H9: pm:on-hold with no Restart-when: line in either channel. That reading is correct on the literal, and it is only a form problem — the body already carries, verbatim:

Named restart condition: the v18 major window opens (first v18 RC branch cut / the protocol-18 migration window becomes the active target). Whichever seat runs the v18 release board re-queues this card at that moment.

The unlock scan greps the literal key, so a correctly-named condition under a different heading is invisible to it. Adding the line in the house form established on #8345 (triage seat, 2026-08-19, on-hold weak-hit audit), unchanged:

Restart-when: the v18 cycle opens — first true of: .changeset/pre.json exists on origin/main, packages/spec/package.json version matches ^18., a milestone or ref matching v18 exists (git ls-remote origin 'refs/*v18*'), or content/docs/releases/v18.mdx is created — or a maintainer re-schedules the card

All four legs measured false, each with a control

Read against origin/main today:

leg	reading	control
.changeset/pre.json	absent	the .changeset/ tree resolves and lists files — the zero is a reading, not a failed path
packages/spec version	17.2.0	—
a remote ref matching v18	none (git ls-remote origin 'refs/*v18*' empty)	refs/tags/*17* returns real refs, so the remote answers
content/docs/releases/v18.mdx	absent	the directory lists v9 … v17

⇒ v18 has not opened; this hold is sound and stands. The existing Trigger files list (packages/lint/src/data-model-rules.ts, packages/lint/src/validate-security-posture.test.ts) is unchanged and keeps its opportunistic-restart role — the two mechanisms answer different questions, which is why #8345 kept both: a trigger-file list over-fires on incidental churn in those files and never fires on "v18 opened".

Freshness checked before writing: the most recent comment (2026-08-31T08:12:19Z, the #13699 census evidence note) confirms the card is still parked for v18 and changes nothing about the hold. ⚠️ That note also matters to whoever implements this — it measures that the existing predicate def.required !== true draws no finding at any severity for two of this card's three unsafe shapes, so a one-line severity flip would read as done while under-delivering the card's own scope.

---

Generated by Claude Code

[objectstack-fleet]

Triage: hold released, pm:on-hold → pm:queue, graded priority:p3. domain:devx → domain:spec, because packages/lint is an anchored exception of the spec lane

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-07T13:23Z. ⛔ Not a claim, ⛔ not a dispatch.

Released on the maintainer's order in the triage seat's chat: 「你应该先解锁 v18 所有的卡片」, then 「同意」 to the plan. #15193 (the v18 gate) closed on that word (6037915987). The ruling record is #22050 6037890422, and the opening card is #22080 (Changesets pre mode).

• Restart condition: "the v18 cycle opens … or a maintainer re-schedules the card". The maintainer has done so.
• Scope stands as ruled: Direction 1 of A controlled_by_parent object may declare its master reference without required, so the master-access guard is the only thing preventing an unreachable orphan detail row #8772. Promote relationship/master-detail-required from warning to error, scoped to controlled_by_parent.
• Read first: the evidence note on this thread from [finding] relationship/master-detail-required is a lint WARNING while object.zod.ts's own docblock argues the unguarded shape "arms the worst measured failure shape" — severity judgment for the contract owner #13699's census (2026-08-31, on this thread). The lint predicate is def.required !== true, so two of the card's three unsafe shapes draw nothing today. The promotion covers all three, or the PR says which it leaves and why.
• Why p3: an authoring gate tightens. No runtime defect waits on it.
• The release state: a breaking change that lands before release(v18): enter Changesets pre mode on main (changeset pre enter next) with one major marker, so the first v18 prerelease is 18.0.0-next.0 — the opening ruled B on #22050 #22080 is graded minor, with its BREAKING banner and ADR-0087 disposition. After release(v18): enter Changesets pre mode on main (changeset pre enter next) with one major marker, so the first v18 prerelease is 18.0.0-next.0 — the opening ruled B on #22050 #22080 it is graded major. ⛔ chore: version packages #21988 is not merged.