test(objectql): measure the lean entry's loaded-module closure as a package set (#16939)

The ADR-0076 D2 boundary is guarded today by a source scan over two
hard-coded names in packages/objectql/src/core-boundary.ratchet.test.ts.
That shape is neither transitive nor able to see a heavyweight arriving
through any other specifier, which is how #14680 arrived — three packages
deep, invisible to every gate for the whole time it was live.

scripts/check-lean-entry-closure.mjs loads the BUILT lean entry in a fresh
child per published condition, collects the evaluated module set through
module.registerHooks unioned with require.cache, attributes each module to
its owning package, and asserts:

  DENIED    no module belongs to a package ADR-0076 D2 excludes
  ADMITTED  the measured package set equals ADMITTED_PACKAGES exactly —
            so an arrival nobody predicted fails BY NAME, which is the one
            thing a forbidden list cannot do
  AGREE     the two published conditions carry the same package set

No size figure anywhere: the #9803 discipline the neighbouring file
established is inherited, and re-measured on this subject — the package set
is identical across the import and require conditions while the module
count and byte total are not.

With no dist/ it exits 3 PREREQUISITE NOT MET, never a skip and never a
pass; it runs in ci.yml's build-core, which builds first.


Claude-Session: https://claude.ai/code/session_01ADLdAs2pVcH17h9tZKWMBg

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-musk

.github/workflows/ci.yml

@@ -1719,6 +1719,21 @@ jobs:
       - name: No published source map embeds source text
         run: pnpm check:sourcemap-no-sources-content
 
+      # #15347. The ADR-0076 D2 boundary ratchet beside `core.ts` scans SOURCE
+      # TEXT for two hard-coded names, so it is neither transitive nor able to
+      # see a heavyweight arriving through any other specifier — which is
+      # exactly how #14680 arrived, three packages deep, invisible to every
+      # gate for the whole time it was live. This one loads the built lean
+      # entry in a fresh child per published condition and asserts the PACKAGE
+      # SET it evaluates: an exclusion claim, decidable and unit-carrying, with
+      # no size figure anywhere (#9803). Lives here for the same reason the two
+      # steps above do — it reads a real `dist/`, and with none it exits 3
+      # (PREREQUISITE NOT MET), never a silent green. Its header is the
+      # authority on detail, including why it is not a case in the vitest file
+      # it guards beside.
+      - name: The lean engine entry loads no forbidden or unlisted package
+        run: pnpm check:lean-entry-closure
+
       - name: Analyze bundle size
         run: pnpm --filter @objectstack/spec analyze
 

package.json

@@ -156,6 +156,7 @@
     "check:published-readme-exports": "node scripts/check-published-readme-exports.mjs --self-test && node scripts/check-published-readme-exports.mjs",
     "check:published-readme-links": "node scripts/check-published-readme-links.mjs --self-test && node scripts/check-published-readme-links.mjs",
     "check:dual-build-cjs-loads": "node scripts/check-dual-build-cjs-loads.mjs --self-test && node scripts/check-dual-build-cjs-loads.mjs",
+    "check:lean-entry-closure": "node scripts/check-lean-entry-closure.mjs --self-test && node scripts/check-lean-entry-closure.mjs",
     "check:dts-closure": "node scripts/check-dts-closure.mjs --self-test && node scripts/check-dts-closure.mjs",
     "check:sourcemap-no-sources-content": "node scripts/check-sourcemap-no-sources-content.mjs --self-test && node scripts/check-sourcemap-no-sources-content.mjs",
     "check:type-check-coverage": "node scripts/check-type-check-coverage.mjs --self-test && node scripts/check-type-check-coverage.mjs",

packages/objectql/src/core-boundary.ratchet.test.ts

@@ -46,6 +46,25 @@
 // pins it. The second test keeps a figure from growing back into core.ts.
 // ---------------------------------------------------------------------------
 //
+// What this file does NOT see, and what does (#15347)
+//
+// This is a SOURCE SCAN over two hard-coded names. Both limits are by
+// construction, and #14680 is what they cost: a heavyweight arriving through
+// any other specifier is outside FORBIDDEN_PACKAGES, and a scan of this
+// package's own sources cannot follow one that arrives three packages deep —
+// which is how that one arrived, invisible to every gate for the whole time it
+// was live.
+//
+// The transitive half now lives in `scripts/check-lean-entry-closure.mjs`. It
+// loads the BUILT lean entry in a fresh child per published condition and
+// asserts the package set the entry actually evaluates — an exclusion claim, in
+// the same discipline as this file's: a set of package names, never a size.
+//
+// ⛔ It does not replace this test and this test is not folded into it. That one
+// needs a built `dist/` and runs in ci.yml's `build-core`; this one deliberately
+// needs NOTHING — no build, no install, no child process — so it still answers
+// on a tree where the other cannot run at all. Two instruments, one boundary.
+//
 // If this test fails, you added a forbidden import somewhere reachable from
 // core.ts. Keep metadata/plugin/kernel concerns out of the core closure.