spec builder: force `required: true` on a `master_detail` reference under `controlled_by_parent` (ruled Direction 2 of #8772)

[os-zhuang]

Provenance

Slice B (Direction 2) of the #8772 maintainer ruling (2026-08-16, comment 5306089973): the authoring builder forces required: true on a master_detail reference under a controlled_by_parent object, so the unsafe shape cannot be newly declared. Carved into its own card on the maintainer's 2026-08-16 instruction (PM chat, verbatim: 「接受你的建议，开新卡，现有的可以关闭？」), recorded by PM session session_01NYgmGheCzM6NrHZN436Cxf. Intended lane: domain:spec (lands in packages/spec's authoring builder) — domain:* left for triage per the single-producer rule.

Dispatch note: model: claude-fable-5 mandatory — authorable-shape narrowing (standing tiering rule).

The work

• The builder path that emits a controlled_by_parent object's master master_detail reference sets/forces required: true (and refuses/corrects an explicit required: false there, loudly).
• ⛔ Runtime untouched: resolveCbpRelation's fallbacks stay (tolerance for existing installs); lint stays warning until the v18 sibling card lands. This slice is the bridge that makes new metadata safe while old metadata stays tolerated.
• The 2026-08-15 survey stands: the shipped surface (examples/**, packages/platform-objects/**) holds exactly 3 controlled_by_parent objects, all already required: true — migration cost measured at zero for first-party.
• Consumer-package fixture triage per standing rule (spec-touching change ⇒ run consumer packages' tests).
• Note for implementer: validate-security-posture.test.ts lives in packages/lint/ (the A controlled_by_parent object may declare its master reference without required, so the master-access guard is the only thing preventing an unreachable orphan detail row #8772 body mis-homed it) and pins runtime resolution, not the builder — it should stay green under this slice.

Re-check before acting

• git grep -n "controlled_by_parent" origin/main -- packages/spec | head
• Confirm the builder currently permits omitting required on that shape (the A controlled_by_parent object may declare its master reference without required, so the master-access guard is the only thing preventing an unreachable orphan detail row #8772 table's row 3).

Refs: #8772 (ruling + measurement) · siblings: guard freeze note (identity, lands first), lint warning→error at v18 (devx).

[os-project-manager]

Triage: domain:spec added (lands in packages/spec's authoring builder; single-producer rule), pm:queue kept, type Task — maintainer-ruled implementation (Direction 2 of #8772, ruling comment linked in the card).

This narrows the authorable accept face (an explicit required: false on that shape becomes a loud refusal), so the card's own model: claude-fable-5 mandatory note is correct under the standing tiering rule — dispatching seat, carry it. Serial: the ruling says the freeze-note slice #9137 (identity) lands before or with this one; honor that ordering. Consumer-package fixture triage applies (spec-touching change).

---

Generated by Claude Code

[os-project-manager]

Claiming for implementation.

• Session: session_01Y26DJEHSBhhAQ6wwfsHNza
• Branch: claude/issue-9138-cbp-master-detail-required

Scope per the #8772 ruling, Direction 2: builder-only — force required: true on the master master_detail reference under a controlled_by_parent object, loud refusal on explicit required: false. Runtime (resolveCbpRelation) and lint severity untouched.

---

Generated by Claude Code

---

Generated by Claude Code