@@ -0,0 +1,15 @@
+---
+'@objectstack/lint': patch
+---
+
+fix(lint): a dataset refused at the save door for a base object outside its package's closure prints the dependency declaration as the fix
+
+Clause-②: no
+Metadata-protocol: none
+
+At the runtime save door a dataset written into a package is judged against that package's closure: its own objects, the objects of the packages its manifest declares in `dependencies`, platform objects, and tenant objects that belong to no package. A base object outside it is refused `422` with `object-reference-unknown`, and its fix line used to read "Point it at one of this stack's objects, or at a platform object by its full name", which sends the author away from the fix that works. Under a closure it now reads "Declare a dependency on the package that defines "OBJECT" in the `dependencies` of "PACKAGE"'s manifest, or point it at an object inside that closure", the prescription the flow trigger and list view doors print for the same closure (ADR-0141 D1).
+
+- **One prescription.** The three doors build that line from one helper, so they cannot drift apart again. The list view door's line is unchanged. The flow trigger door's line now quotes the object and package with double quotes and names "PACKAGE's manifest" instead of "the manifest `dependencies` of package 'PACKAGE'"; its second remedy (`set config.objectName …` / `set config.timeRelative.object …`) is unchanged.
+- **Only the fix line moves.** The verdict, the severity and the message are the same with or without a closure.
+- **Unchanged without a closure.** A write that names no package, and `os validate`, `os build` and `os lint`, print the hint they printed before.
+- `os explain object-reference-unknown` describes the closure case.
@@ -612,6 +612,29 @@ export function suggestName(target: string, known: Iterable<string>): string {
   return best ? ` Did you mean "${best}"?` : '';
 }
 
+/**
+ * The fix line for an object reference outside a package closure — ONE
+ * prescription, printed by every save-door rule that judges an object name
+ * under a stated `packageScope` (#27827): the flow trigger door
+ * (`flow-trigger-unknown-object`), the list view door
+ * (`list-view-object-outside-closure`) and the dataset base-object door
+ * (`object-reference-unknown`). The closure is the written package's own
+ * objects, the objects of the packages its manifest declares in
+ * `dependencies`, and platform objects, so the declaration is the fix that
+ * puts another package's object in reach (ADR-0141 D1). Three hand-written
+ * copies are how one door came to print a remedy pointing away from it.
+ *
+ * `alternative` is the door's own second remedy — the key it re-points, as a
+ * lower-case verb phrase with no trailing period. Like {@link suggestName},
+ * this decides no severity and holds no rule id; the caller's verdict does.
+ */
+export function closureDependencyRemedy(object: string, packageId: string, alternative: string): string {
+  return (
+    `Declare a dependency on the package that defines "${object}" in the \`dependencies\` of ` +
+    `"${packageId}"'s manifest, or ${alternative}`
+  );
+}
+
 function distance(a: string, b: string): number {
   const m = a.length;
   const n = b.length;
 
@@ -97,8 +97,21 @@ describe('reference-integrity suite — membership', () => {
 
   it('wires the same function the package exports', () => {
     const byName = new Map(REFERENCE_INTEGRITY_RULES.map((r) => [r.name, r.run]));
-    expect(byName.get('validateObjectReferences')).toBe(validateObjectReferences);
     expect(byName.get('validateTranslationReferences')).toBe(validateTranslationReferences);
+    // [#27827] `validateObjectReferences` is wired through an adapter that hands
+    // it `ctx.packageScope`, the way `validateListViewFieldRefs` is, so the pin
+    // is on what the member ANSWERS: the exported function's answer, with the
+    // context's closure and without it. The stack carries a real miss, so the
+    // two equalities cannot hold by both sides being empty.
+    const member = byName.get('validateObjectReferences')!;
+    const stack = { objects: [{ name: 'crm_lead', fields: {} }], datasets: [{ name: 'd', object: 'crm_ghost' }] };
+    const scope = { packageId: 'com.acme.crm', dependencies: [] };
+    expect(validateObjectReferences(stack)).toHaveLength(1);
+    expect(member(stack)).toEqual(validateObjectReferences(stack));
+    expect(member(stack, { runtimeWriteType: 'dataset', packageScope: scope })).toEqual(
+      validateObjectReferences(stack, { packageScope: scope }),
+    );
+    expect(member(stack, { runtimeWriteType: 'dataset', packageScope: scope })).not.toEqual(member(stack));
   });
 });
 
 
@@ -224,7 +224,20 @@ export const REFERENCE_INTEGRITY_RULES: readonly ReferenceIntegrityRule[] = [
   // — 0 findings, precision 1.0. The zero is a fact about the corpus AND the
   // door: `rulesRun` read 2 on every one, and the same harness's synthetic
   // probe is refused (`runtime-gate.dataset-writes.test.ts` makes it permanent).
-  { name: 'validateObjectReferences', runtimeTypes: ['flow', 'dataset'], run: validateObjectReferences },
+  //
+  // [#27827] It reads `packageScope` the way `validateListViewFieldRefs` below
+  // does: under a stated closure the snapshot's `objects` are that closure, so
+  // a base object missing from it is outside what the package declared it may
+  // reference, and the `object-reference-unknown` fix line is the closure
+  // prescription the flow and view doors print (declare the dependency,
+  // ADR-0141 D1). Absent — the CLI, or a write that names no package — the
+  // rule prints the hint it always did. The verdict and severity do not move.
+  {
+    name: 'validateObjectReferences',
+    runtimeTypes: ['flow', 'dataset'],
+    run: (stack, ctx) =>
+      validateObjectReferences(stack, ctx?.packageScope ? { packageScope: ctx.packageScope } : {}),
+  },
   // [#9313] `runtimeTypes` gains `view` on this member and its sort sibling:
   // both judge a LIST VIEW's field references, and a standalone list view is
   // written through `PUT /api/v1/meta/view` — the only door a Studio tenant or
@@ -310,7 +323,8 @@ export const REFERENCE_INTEGRITY_RULES: readonly ReferenceIntegrityRule[] = [
   // crossing is its own adjudication with its own non-vacuity control, and
   // this card was scoped to the two axes its title names.
   //
-  // [#24563] The one member that reads `packageScope`. Under a package
+  // [#24563] A member that reads `packageScope` (#27827: so does
+  // `validateObjectReferences` above, for its fix line only). Under a package
   // closure the snapshot's `objects` are that closure (ruling #9612), so a
   // binding missing from it is outside what the package declared it may
   // reference, or nowhere at all — and the member's skip 1 used to read that as
@@ -769,7 +783,9 @@ export interface ReferenceIntegrityRunOptions {
    * force; ABSENT on the CLI commands and on a write that names no package.
    * Read by `validateListViewFieldRefs` and `validateRelatedListRefs`, which
    * read its absence beside a set `runtimeWriteType` as the whole collection
-   * (#24668).
+   * (#24668), and by `validateObjectReferences`, whose
+   * `object-reference-unknown` fix line names the dependency declaration
+   * under it (#27827).
    */
   packageScope?: { readonly packageId: string; readonly dependencies: readonly string[] };
 }
 
@@ -3961,6 +3961,17 @@ const OBJECT_REFERENCE_UNKNOWN_EXPLANATION: RuleExplanation = {
       'object by its full name (the platform user object is `sys_user`, not `user`). The verdict names ' +
       'the nearest defined object when one is close; a view container written with an object\'s short ' +
       'name in a namespaced package is told the prefixed spelling.',
+    // [#27827] The closure case, so the explanation does not contradict the
+    // fix line the save door prints under one (ADR-0141 D1).
+    'A dataset written into a package at the runtime save door is judged against that package\'s ' +
+      'closure instead of one stack: the package\'s own objects, the objects of the packages its ' +
+      'manifest declares in `dependencies`, platform objects, and tenant-authored objects that carry ' +
+      'no package. A base object outside it, whether it belongs to a package the manifest never ' +
+      'declared or exists nowhere at all, is refused with the fix the flow and view doors print for ' +
+      'the same closure: declare a dependency on the package that defines the object in the ' +
+      '`dependencies` of the written package\'s manifest, or point the dataset at an object inside the ' +
+      'closure. A write that names no package, and `os validate`, `os build` and `os lint`, state no ' +
+      'closure and print the fix above.',
   ],
 };
 
 
@@ -38,6 +38,7 @@
 import { describe, expect, it } from 'vitest';
 
 import { REFERENCE_INTEGRITY_RULES } from './reference-integrity-suite.js';
+import { validateObjectReferences } from './validate-object-references.js';
 import {
   runRuntimeAuthoringRules,
   runtimeAuthoringRulesFor,
@@ -242,6 +243,95 @@ describe('the door refuses each crossed rule s own defect (#19143)', () => {
   });
 });
 
+describe('the base-object fix line names the dependency declaration under a package closure (#27827)', () => {
+  // ADR-0141 D1: at the save door a dataset in a package may name its own
+  // objects, its declared dependencies' objects and platform objects. Under a
+  // stated closure the snapshot's `objects` ARE that closure, so a base object
+  // another package defines lands on rung ② — and the fix that works is the
+  // declaration, the line the flow and view doors print for the same closure.
+  const OWN = 'com.acme.billing';
+  const DEP = 'com.acme.core';
+  const STRANGER = 'com.other.analytics';
+  const owned = (name: string, pkg: string) => ({
+    name,
+    label: name,
+    sharingModel: 'private',
+    fields: { name: { type: 'text', label: 'Name' } },
+    _packageId: pkg,
+  });
+  const objects = [owned('acme_invoice', OWN), owned('acme_account', DEP), owned('other_cube', STRANGER)];
+  const scope = { packageId: OWN, dependencies: [DEP] };
+  const write = (object: string, packageScope?: typeof scope) =>
+    runRuntimeAuthoringRules({
+      type: 'dataset',
+      item: cleanDataset({ object, dimensions: [], measures: [] }),
+      context: { objects },
+      ...(packageScope !== undefined ? { packageScope } : {}),
+    });
+  const unknownOf = (r: ReturnType<typeof write>) => r.errors.filter((f) => f.rule === 'object-reference-unknown');
+  const TODAYS_HINT =
+    'Point it at one of this stack\'s objects, or at a platform object by its full name (the platform ' +
+    'user object is "sys_user", not "user")';
+
+  it('closure in force: an object of an undeclared package is refused with the declaration as the fix', () => {
+    const [f, ...rest] = unknownOf(write('other_cube', scope));
+    expect(rest).toEqual([]);
+    expect(f).toMatchObject({ severity: 'error', rule: 'object-reference-unknown' });
+    expect(f!.path).toBe('datasets.acme_invoice_metrics.object');
+    expect(f!.hint).toBe(
+      'Declare a dependency on the package that defines "other_cube" in the `dependencies` of ' +
+        `"${OWN}"'s manifest, or point it at an object inside that closure`,
+    );
+  });
+
+  it('closure in force: a name that exists nowhere gets the same fix — the closure is all the door sees', () => {
+    const [f] = unknownOf(write('ghost_cube', scope));
+    expect(f).toMatchObject({ severity: 'error' });
+    expect(f!.hint).toContain('`dependencies`');
+    expect(f!.hint).toContain(OWN);
+  });
+
+  it('closure in force: the own package and a declared dependency stay inside it — nothing to fix', () => {
+    expect(unknownOf(write('acme_invoice', scope))).toEqual([]);
+    expect(unknownOf(write('acme_account', scope))).toEqual([]);
+  });
+
+  it('no closure: a write that names no package keeps today s hint, and the stranger s object resolves', () => {
+    // The whole collection is the snapshot, so another package's object is no
+    // miss at all; a name that exists nowhere gets the hint the CLI prints.
+    expect(unknownOf(write('other_cube'))).toEqual([]);
+    const [f] = unknownOf(write('ghost_cube'));
+    expect(f).toMatchObject({ severity: 'error', rule: 'object-reference-unknown' });
+    expect(f!.hint).toBe(TODAYS_HINT);
+    expect(f!.hint).not.toContain('dependencies');
+    // An empty package id narrows nothing, so it states no closure either.
+    const [g] = unknownOf(write('ghost_cube', { packageId: '', dependencies: [] }));
+    expect(g!.hint).toBe(TODAYS_HINT);
+    // The CLI reading (`os validate` / `os build` / `os lint`): no closure is
+    // ever stated there, and the line is the one the door prints without one.
+    const [cli, ...more] = validateObjectReferences({
+      objects,
+      datasets: [cleanDataset({ object: 'ghost_cube', dimensions: [], measures: [] })],
+    });
+    expect(more).toEqual([]);
+    expect({ rule: cli!.rule, severity: cli!.severity, message: cli!.message, hint: cli!.hint }).toEqual({
+      rule: f!.rule,
+      severity: f!.severity,
+      message: f!.message,
+      hint: TODAYS_HINT,
+    });
+  });
+
+  it('the verdict is the same both ways — only the fix line moves', () => {
+    const scoped = unknownOf(write('ghost_cube', scope));
+    const whole = unknownOf(write('ghost_cube'));
+    const verdictOf = (fs: typeof scoped) => fs.map(({ severity, rule, where, path, message }) =>
+      ({ severity, rule, where, path, message }));
+    expect(verdictOf(scoped)).toEqual(verdictOf(whole));
+    expect(scoped.map((f) => f.hint)).not.toEqual(whole.map((f) => f.hint));
+  });
+});
+
 describe('the door s fences hold on a dataset write (#4463 D4)', () => {
   it('does not charge this write for a STORED dataset s pre-existing defect', () => {
     // The differential's whole purpose. A tenant's stored dataset may already
 
@@ -582,3 +582,64 @@ describe('the flow door under a package closure (#24669)', () => {
     expect(g).toMatchObject({ severity: 'error', rule: UNKNOWN });
   });
 });
+
+// ─────────────────────────────────────────────────────────────────────────────
+// #27827 — the DATASET door under a package closure, and the one prescription
+// the three doors share: a base object outside the closure is refused with the
+// fix the flow and view doors print (ADR-0141 D1), from one builder.
+// ─────────────────────────────────────────────────────────────────────────────
+
+describe('the dataset door under a package closure, and the shared prescription (#27827)', () => {
+  const objects = packagedTenant(3);
+  const datasetOn = (object: string): AnyRec => ({
+    name: `probe_${object}`,
+    label: 'Probe',
+    object,
+    dimensions: [],
+    measures: [],
+  });
+  const gate = (type: string, item: AnyRec, scope?: RuntimePackageScope) =>
+    runRuntimeAuthoringRules({
+      type,
+      item,
+      context: { objects },
+      ...(scope !== undefined ? { packageScope: scope } : {}),
+    });
+  /** The one refusal each door gives for `other_0_0` under the closure. */
+  const refusalOf = (type: string, item: AnyRec, rule: string): AnyRec => {
+    const fs = gate(type, item, SCOPE).errors.filter((f) => f.rule === rule);
+    expect(fs, `${type} door`).toHaveLength(1);
+    return fs[0]!;
+  };
+
+  it('REFUSES a base object of a package the written one never declared — the fix names the declaration', () => {
+    const f = refusalOf('dataset', datasetOn('other_0_0'), 'object-reference-unknown');
+    expect(f.severity).toBe('error');
+    expect(f.hint).toContain(OWN);
+    expect(f.hint).toContain('`dependencies`');
+    expect(f.hint).toContain('"other_0_0"');
+    // Admitted: the written package, its declared dependency, a platform object.
+    for (const inside of ['crm_account', 'core_user', 'platform_ledger', 'sys_audit_log']) {
+      expect(gate('dataset', datasetOn(inside), SCOPE).errors, inside).toEqual([]);
+    }
+  });
+
+  it('no closure stated: the stranger s object resolves, and a ghost keeps the stack-relative fix', () => {
+    expect(gate('dataset', datasetOn('other_0_0')).errors).toEqual([]);
+    const [f] = gate('dataset', datasetOn('ghost_object')).errors;
+    expect(f).toMatchObject({ severity: 'error', rule: 'object-reference-unknown' });
+    expect(f!.hint.startsWith('Point it at one of this stack\'s objects')).toBe(true);
+  });
+
+  it('the three doors print ONE prescription — the same declaration clause, each door s own alternative', () => {
+    const flow = refusalOf('flow', flowOn('on_other', 'other_0_0'), 'flow-trigger-unknown-object');
+    const view = refusalOf('view', listViewOn('other_0_0', ['name']), 'list-view-object-outside-closure');
+    const dataset = refusalOf('dataset', datasetOn('other_0_0'), 'object-reference-unknown');
+    const clause =
+      `Declare a dependency on the package that defines "other_0_0" in the \`dependencies\` of "${OWN}"'s ` +
+      'manifest, or ';
+    expect(flow.hint).toBe(`${clause}set config.objectName to an object inside that closure`);
+    expect(view.hint).toBe(`${clause}bind the view to an object inside that closure`);
+    expect(dataset.hint).toBe(`${clause}point it at an object inside that closure`);
+  });
+});
@@ -177,7 +177,7 @@ import {
   apiTriggerSecretRefOf,
   resolveFlowTriggerKind,
 } from '@objectstack/spec/automation';
-import { recordsOf, suggestName } from './object-graph.js';
+import { closureDependencyRemedy, recordsOf, suggestName } from './object-graph.js';
 
 export type FlowTriggerReadinessSeverity = 'error' | 'warning';
 
@@ -496,9 +496,8 @@ export function validateFlowTriggerReadiness(
         `objects, the objects of the packages its manifest declares in \`dependencies\`, and platform ` +
         `objects), so the package may not bind a flow to it.` +
         suggestName(objectName, objectNames),
-      hint:
-        `Declare a dependency on the package that defines '${objectName}' in the manifest \`dependencies\` ` +
-        `of package '${pkg}', or set ${at.key} to an object inside that closure`,
+      // [#27827] The one closure prescription the view and dataset doors print too.
+      hint: closureDependencyRemedy(objectName, pkg, `set ${at.key} to an object inside that closure`),
     };
   };
 
 
@@ -398,6 +398,7 @@ import { ListViewSchema } from '@objectstack/spec/ui';
 import { walkFilterFieldKeys } from './filter-walk.js';
 import { retiredKeyRemedy } from './validate-retired-permission-residue.js';
 import {
+  closureDependencyRemedy,
   describeFieldPathVerdict,
   indexObjectGraph,
   isUnjudgeable,
@@ -990,9 +991,8 @@ export function validateListViewFieldRefs(
         `the packages its manifest declares in \`dependencies\`, and platform objects), so none of the view's ` +
         `field references are checked.` +
         suggestName(object, graph.keys()),
-      hint:
-        `Declare a dependency on the package that defines "${object}" in the \`dependencies\` of "${pkg}"'s ` +
-        `manifest, or bind the view to an object inside that closure`,
+      // [#27827] The one closure prescription the flow and dataset doors print too.
+      hint: closureDependencyRemedy(object, pkg, 'bind the view to an object inside that closure'),
     });
   };