skills(objectstack-ui): pages.md states the embed scope os build enforces — this package or a declared dependency (#27304)

Fixes #27209
Clause-②: no
Metadata-protocol: none

## 维护者速读
- 改了什么:`skills/objectstack-ui/rules/pages.md`〈Inline metadata views〉里
`os build` 的 lint 句,从「被引用项必须存在于本包」改为「必须存在于本包,或本包在
`manifest.dependencies` 里声明的包(仅直接依赖、单向)」,其余不合范围的引用照旧构建失败并点名所判范围;另加
`@objectstack/skills` 的 patch changeset(`skills/**` 随该包发布)。
- 为什么改:平台已按 `docs/metadata-embed-ref` 的新范围判定嵌入(本包 +
声明的直接依赖),技能文档仍教更窄的规则,会让 AI 作者为了嵌入而重复声明元数据;技能面要陈述平台强制的闭合规则。
- 风险与回滚:零运行时改动,只动一句技能文字与一份 changeset;回滚即 revert 本 PR。文件 token 读数 5691 /
上限 5692(余量 1),后续在该文件再加字须先删字。
- 先看:`skills/objectstack-ui/rules/pages.md` 第 397–401 行(唯一风险 hunk:措辞是否与
`packages/cli/src/utils/collect-docs.ts` `lintMetadataEmbeds` 的范围一致);其次
`.changeset/27209-pages-embed-scope.md`。
- 两分钟验证:`node scripts/check-skills-token-ratchet.mjs` 应打印 `pages.md is
5691 tokens (ceiling 5692; headroom 1)` 且退出 0;`pnpm --filter
@objectstack/skills build` 应报 93 个文件 byte-identical 复制。
- 需要你做的:`skills/**` 为 Tier H 受管面,本 PR 保持 draft,由 `GOVERNED_APPROVERS` 账号
approve 后由席位落地。

## What changes

One sentence in `skills/objectstack-ui/rules/pages.md` (〈Inline metadata
views — the `metadata` fence (ADR-0051)〉), worded from
`lintMetadataEmbeds` / `embedScope` in
`packages/cli/src/utils/collect-docs.ts` and its
`collect-docs.package-docs.test.ts` cases:

Before:

> the referenced object-rule / flow / permission set **must exist in
this package** — a dead same-package reference fails the build (same
posture as a broken link). At render time a missing or forbidden
reference degrades to a placeholder, never a crash.

After:

> the referenced object-rule / flow / permission set **must exist in
this package or one it declares in `manifest.dependencies`** (direct
dependencies only; one-way) — anything else fails the build, naming the
scope it judged (same posture as a broken link). At render time a
missing or forbidden reference degrades to a placeholder, never a crash.

The code this states: the lint's sources are the owner's body plus
`declaredDependencyIds(body)` resolved against the artifact's packages
(direct declarations only; a declared package does not reach back —
pinned by the test `a declaration is one-way: the declared package does
not reach back`), and the refusal text names `this package` or `this
package or its declared dependencies (…)`. Links are a different rule
and still resolve artifact-wide (`lintDocs` against `artifactNames`);
that sentence (`pages.md` line 335) is untouched.

`.changeset/27209-pages-embed-scope.md` — `@objectstack/skills: patch`.
The PM's dispatch assumed `skip-changeset`; measured against AGENTS.md
Post-Task Checklist step 3 (`skip-changeset` is for a diff that
publishes nothing from any released package) and
`packages/skills/package.json` (`@objectstack/skills` ships
`dist/skills/**`, a byte copy of `skills/**`, in its `files`), plus
`pr-automation.yml`'s own text (a `skills/**` change releases
`@objectstack/skills` and never takes the label), a changeset is owed
and the label is not applied.

Token ratchet (`node scripts/check-skills-token-ratchet.mjs`),
`pages.md`: before 5667 / ceiling 5692 (headroom 25) at merge base
`fa5e7825`; after 5691 / 5692 (headroom 1). Net +24 tokens, inside the
headroom the merged tree had (the claim's 5680 / +12 figure was read at
`5b5cff15`; main had moved).

## Tests

Pure docs + changeset diff; no test file changed, no ablation (nothing a
test pins moved).

- `OS_VERIFY_LOCK_SLOT=issue-27209-skills-build bash
scripts/pm/os-verify-lock.sh -c 'pnpm --filter @objectstack/skills
build'` at `c2fb9eee` — `sync-catalog self-test: 9 cases pass`; `93
file(s) across 11 skill(s) copied from skills/** into dist/skills and
read back byte-identical`; `VERDICT command-exit 0`; `diff -q` of the
edited `pages.md` against
`packages/skills/dist/skills/objectstack-ui/rules/pages.md` is empty.

## Acceptance notes

- `pages.md:335` "broken same-package links fail the build" is NOT made
stale by the embed-scope change: `lintDocs` resolves a same-prefix link
against every name the artifact carries (`resolvableNames` =
`artifactNames`, the #18431 C2 shape), a cross-prefix link is deferred
to publish, and a dangling same-prefix link is still `docs/broken-link`.
The in-place fix exemption's first condition (same defect class, made
stale by the same merged change) fails, so the sentence is left as
written. Noted, not filed: that link refusal's message still reads `no
doc named "…" exists in this package` while the set it judged is
artifact-wide — class b candidate against the lint header's own text,
reach: `os build` on a composed artifact with a dangling same-prefix
link; the dangling target also does not exist in that package, so the
words are not false, only narrower than the scope judged; carrier: none.
- The PM's "no changeset / `skip-changeset`" assumption was falsified by
measurement (above); a `patch` changeset for `@objectstack/skills` is in
this PR and no label is applied.
- No `Skills-docs:` line: the kind is `none` and there is no
`(narrowing)` arm.
- Harness attribution: the first commit on this branch was amended
before any push to the model-free trailer pair (`Co-authored-by: Claude`
+ `Claude-Session:`), as the pre-push hook `check:commit-card-trailers`
requires; no history on the remote was rewritten.

## Verification

Local gate subset derived at `c2fb9eee` by `node
scripts/pm/dispatch-gates.mjs --commands --repo
objectstack-ai/objectstack` (43 families) plus the claim's two spec
checks; every exit code captured before any pipe; `--ran`
reconciliation: 43 derived, 43 run, 0 UNRUN.

Green (exit 0, 40 of the 43 + 2 extras): `check-adr-0087-registration`
(`--base origin/main`, `--self-test`), `check-changeset-no-major`,
`check-closing-keyword-parity` (+ self-test),
`check-comment-mask-corpus`, `check-doc-route-spelling` (`--advisory`,
`--self-test`), `check-dts-emitted --self-test`, `check-empty-changeset`
(`--base`, `--self-test`), `check-skills-token-ratchet` (gate: `pages.md
is 5691 tokens (ceiling 5692; headroom 1)`; self-test: 79 cases),
`ci/assert-turbo-remote-cache`, `ci/plan-test-core-shards`,
`ci/prune-turbo-cache`, `pm/release-rehearsal-clone`,
`release-pending-publish` (self-tests), `check:agent-test-spelling`,
`check:changeset-gate-self-tests`, `check:ci-filter-parity`,
`check:closed-ceremony-text`, `check:corpus-claim-drift`,
`check:cross-package-test-inputs`, `check:doc-authoring`,
`check:driver-memory-census`, `check:gitlink-declared`,
`check:nul-bytes`, `check:pm-changeset-deadline-census`,
`check:pm-governed-merges`, `check:pm-skill-id-lint` (104 files clean),
`check:published-files`, `check:refd-timer-probe`, `check:role-word`,
`check:skill-compatibility`, `check:skill-frame-sync`,
`check:skill-identifier-liveness`, `check:sourcemap-no-sources-content`,
`check:watch-hint-literal`, `@objectstack/spec check:skill-docs`,
`@objectstack/spec check:skill-refs`.

NOT MEASURED locally (build-dependent; exit 3 `PREREQUISITE NOT MET`, no
workspace build was run for a docs-only diff — CI's `Lint & Repo Gates`
carries them): `pnpm --filter @objectstack/lint run
check:doc-formula-expressions` (needs `@objectstack/formula` +
`@objectstack/lint` built), `pnpm check:dual-build-cjs-loads` (112
packages without `dist/`), `pnpm check:lean-entry-closure`
(`@objectstack/objectql` dist absent). `pnpm check:dts-closure` exited 0
but swept only the 1 built package (`@objectstack/skills`, which owes no
declaration entry) — read as NOT MEASURED for the TypeScript packages,
not as green.

Dogfood battery: n/a — no `!` in the title and no `(narrowing)` arm.

---
_Generated by [Claude
Code](https://claude.ai/code/session_017xRBcUi2qhP1eKRbZJ1Ze1)_

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]

.changeset/27209-pages-embed-scope.md

@@ -0,0 +1,10 @@
+---
+'@objectstack/skills': patch
+---
+
+docs(skills/objectstack-ui): `pages.md` 〈Inline metadata views〉 states the embed scope `os build` enforces — this package or a package of the same artifact it declares in `manifest.dependencies`
+
+Clause-②: no
+Metadata-protocol: none
+
+The build-lint sentence said a `metadata` fence's referenced object-rule / flow / permission set "must exist in this package". `docs/metadata-embed-ref` judges an embed against the package that ships the doc plus the packages of the same artifact that it declares in `manifest.dependencies` (direct only; one-way), so the rule the skill teaches now matches: an embed may name such a declared package's item, and anything else fails the build. No platform behaviour changes.

skills/objectstack-ui/rules/pages.md

@@ -395,9 +395,10 @@ name: crm_task_status_flow
 `os build` lints every fence: `type` must be one of the three (typo →
 did-you-mean), `name` is required, `state_machine` also needs `object`, and
 the referenced object-rule / flow / permission set **must exist in this
-package** — a dead same-package reference fails the build (same posture as
-a broken link). At render time a missing or forbidden reference degrades to
-a placeholder, never a crash.
+package or in a package of the same artifact that it declares in
+`manifest.dependencies`** (direct only; one-way) — anything else fails the
+build (same posture as a broken link). At render time a missing or forbidden
+reference degrades to a placeholder, never a crash.
 
 Embedding an `object` (data model) or an arbitrary SDUI
 component is **not** supported. **`permission` caveat:** the matrix is not