feat(spec)!: manifest.id enforces the reverse-domain rule its registry face already had - #18319

📓 Docs Drift Check

This PR changes 6 package(s): @objectstack/cli, create-objectstack, objectstack-blank, @objectstack/plugin-dev, @objectstack/downstream-contract, @objectstack/spec, touching 25 documentable anchor(s). ⚠️ 3 changed file(s) yielded no anchor (packages/plugins/plugin-dev/src/index.ts, packages/spec/api-surface/kernel.json, packages/spec/export-origins/kernel.json), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

16 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json 500c1b56956537dd13dc6b2129dd2fb428da351c.

⛔ 3 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin f38d916596beb104ab477b101d42404e709525dd && git checkout f38d916596beb104ab477b101d42404e709525dd
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 500c1b56956537dd13dc6b2129dd2fb428da351c e9d4431a2d8f64c2cbc63caa299912dd154a6543 && git checkout -B drift-repro 500c1b56956537dd13dc6b2129dd2fb428da351c && git merge --no-ff e9d4431a2d8f64c2cbc63caa299912dd154a6543

node scripts/docs-audit/affected-docs.mjs --json 500c1b56956537dd13dc6b2129dd2fb428da351c

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 500c1b56956537dd13dc6b2129dd2fb428da351c → pass the list as
args.docs, on the commit named under Which tree this was computed on.

This PR is red on purpose, and it is blocked on one maintainer decision — not on an unhandled defect

What is failing, read from GET /commits/d0d859edbcfcf85240665f13207670f304ed5311/check-runs at 2026-09-15T17:16:22Z: 43 check runs, 26 success, 6 skipped, 11 failing — Test Core and its six shards, Dogfood Regression Gate and its three shards.

Why. The card's ruling adopts PackageSchema.manifestId's regex /^[a-z][a-z0-9-]*(\.[a-z][a-z0-9-]*)+$/ for ManifestSchema.id, on the stated premise that 「the one non-conforming id in the tree is the scaffold itself」. That premise is false, and the implementer measured it rather than working around it. Run through the BUILT ManifestSchema at this head, 26 in-tree manifest id literals are refused: 21 real (all under packages/qa, every one failing for an underscore in the last segment — com.dogfood.flow_fixture, com.objectstack.downstream_contract and their siblings), 3 are os init template strings now conforming by construction, and 2 are false positives (a flow node id and a registerService mock).

The reachability question that decides whether those 21 matter was answered by a failing probe with a lit control, before the change:

A  control  version=not-semver          → REFUSED (must match pattern)
B  qa id    com.dogfood.flow_fixture    → ACCEPTED
C  scaffold blank                       → ACCEPTED

So manifest.id does reach ManifestSchema at defineStack() time, and the 21 are real refusals rather than a theoretical concern.

Why nothing was done about them. The dispatch order for this card was explicit: if the 21 turned out to be real, stop and report — ⛔ do not rewrite twenty-one fixture ids on an implementer's own authority, and ⛔ do not weaken the regex. Both prohibitions still hold. Weakening is additionally refused by the ruling itself, which requires the pattern 「declared once and referenced from both sites so the two cannot drift again」; admitting underscores on one side re-opens exactly the drift the card exists to close. packages/qa is also a domain this card did not declare in its claim.

What is needed. One decision, and it is the maintainer's because the ruling's own population statement is what turned out to be wrong:

• A — authorize the 21 renames inside this PR: one mechanical edit per file, underscore to hyphen in the last segment. Measured cost: each id occurs exactly once in the whole tree, at its own declaration, so nothing else addresses the old value, and the refusal message already prints the target. The PR grows by 21 single-line edits into an undeclared domain.
• B — split: a sibling card renames the 21 first, this PR lands after. Cost: two PRs, an ordering dependency no gate enforces, and this PR sits red until then.

The decision is recorded on the card at #17534 and is with the maintainer now. This PR stays draft with no auto-merge and no enqueue until it is answered; the rest of the lane's queue keeps moving.

Not blocked, and already fixed in this PR — a second premise that turned out to be real: every os init template interpolated the snake_case namespace into the id, so os init my-app wrote com.example.my_app, which this schema refuses. Landing the regex without that fix would have shipped a scaffolder whose own output fails its own first os validate.

Generated by Claude Code

Status refresh — the blocker changed, and my earlier comment on this PR is now the wrong description of it

My comment 5684753340 said this PR was held on one question: whether to rename 21 packages/qa ids. The maintainer ruled A (rename them here), the implementer did, and f983362592 completed the twenty-first. Test Core stayed red anyway, so the population was re-measured — and 21 was not it either.

Measured at head f983362592, by two lexically unambiguous passes (the id inside manifest: { on the same line, or on the line immediately after, so nested id keys on navigation items, state machines, view probes and migration entries cannot contaminate the count): 67 manifest ids are refused by the ruled regex, across eight packages — packages/cli 45, packages/runtime 8, packages/plugins 6, packages/spec 3, packages/qa 2, packages/objectql 1, packages/lint 1, packages/rest 1. Both numbers are floors: an id written across three or more lines is invisible to both passes.

The fact that decides how serious this is: of the 63 from the first pass, 62 are in a .test.ts file or under a /test/ path, and the single exception is a docblock example (packages/plugins/plugin-dev/src/index.ts — prose in a comment, not executed). So no shipped, executable manifest id in this repository is refused. The contract change is sound; what was under-estimated is the fixture churn it costs.

Current CI, head f983362592, run 35036842827 still in_progress at 2026-09-15T23:54:42Z: 37 runs — 26 success, 3 skipped, 3 failing (Test Core 1/6, 2/6, 4/6), 5 still going. Down from 11 failing two heads ago; the remainder are the un-renamed fixtures above.

Why nothing further is being pushed. Renaming ~46 more fixtures across seven additional packages is a scope decision, not a repair — and an hour ago I wrongly told the implementer to fold two packages/cli fixtures in as "the same class its predecessor already handled". With eight packages in play that framing does not hold, and I have retracted it. ⛔ No further renames on seat authority. The implementer has been stopped and is reporting needs_decision.

The full measurement and the question now with the maintainer are on the card: #17534 (comment)

This PR stays draft, with no auto-merge and no enqueue, until that is answered. The 21 ruled renames stay as they are — they are correct and they are landed on this branch.

Generated by Claude Code