diff --git a/‎.changeset/lint-per-package-namespace-prefix.md‎
Lines changed: 18 additions & 0 deletions b/‎.changeset/lint-per-package-namespace-prefix.md‎
Lines changed: 18 additions & 0 deletions
diff --git a/‎packages/cli/src/commands/compile.ts‎
Lines changed: 1 addition & 82 deletions b/‎packages/cli/src/commands/compile.ts‎
Lines changed: 1 addition & 82 deletions
@@ -0,0 +1,18 @@
+---
+'@objectstack/cli': patch
+---
+
+`os lint`: evaluate the `naming/namespace-prefix` duplicate advisory per package.
+
+The advisory read one flattened array per collection key with no package boundary, so on a
+composed multi-package project two packages that each legitimately declare the same bare name
+(e.g. `home`) were reported as one package declaring it twice — prescribing a rename of a name
+that was already correct, with the OTHER package's namespace as the suggested prefix, under a
+closing sentence saying distinct packages may reuse a name freely. Both ADR-0130 D4 stack shapes
+were affected (flattened-plus-`packages[]`, and `packages[]`-only).
+
+ADR-0130 D4/D5 registers artifacts per package, so the advisory now runs once per package —
+the same shape `os build` has used for the author-time rule table — and a genuine duplicate
+inside one package still warns, with the suggestion taken from that package's own namespace and
+a path written whole (`packages[1].manifest.apps[1].name`) so it resolves in either shape. A
+single-package project is judged exactly as before.
@@ -16,6 +16,7 @@ import {
 import { loadConfig } from '../utils/config.js';
 import { lowerCallables } from '../utils/lower-callables.js';
 import { authoringRuleUnionStack } from '../utils/stack-collections.js';
+import { artifactPackages, packageBodyAsStack } from '../utils/artifact-packages.js';
 import { buildAccessMatrix, diffAccessMatrix } from '@objectstack/lint';
 import { runAuthoringRules, splitBySeverity, authoringRulesFor } from '@objectstack/lint';
 import { resolveSduiManifest } from '../utils/sdui-manifest.js';
@@ -50,88 +51,6 @@ import { checkProtocolVersionGap } from '../utils/protocol-version-gap.js';
 import { findNavGroupDiagnostics } from '../utils/nav-contribution-groups.js';
 import type { NavContributionGroupDiagnostic } from '@objectstack/objectql';
 
-/**
- * The artifact's package entries, as `{ index, id, body }` (ADR-0130 D4).
- *
- * Reads the PARSED stack, so what is walked here is exactly what the artifact
- * will carry — `ArtifactPackageSchema` has already judged every entry by the
- * time this runs, which is why nothing here re-checks the shape.
- */
-function artifactPackages(parsed: Record<string, unknown>): Array<{
-  index: number;
-  id: string;
-  body: Record<string, unknown>;
-}> {
-  const declared = parsed.packages;
-  if (!Array.isArray(declared)) return [];
-  return declared.map((entry, index) => {
-    const body = (entry as { manifest?: Record<string, unknown> }).manifest ?? {};
-    const id = typeof body.id === 'string' && body.id !== ''
-      ? body.id
-      : (typeof body.name === 'string' ? body.name : `packages[${index}]`);
-    return { index, id, body };
-  });
-}
-
-/**
- * One assembled package body, re-read as the STACK it was assembled from.
- *
- * The author-time rules read a stack: collections at the top level and the
- * package identity under `manifest`. An assembled body is that same content
- * with the manifest fields flattened over the top (`{ ...manifest, ...stack }`
- * — `AppPlugin`'s shape, declared by `AssembledPackageBodySchema`), so undoing
- * the flatten is one key: the body IS its own manifest.
- *
- * ⛔ No key list is transcribed here on purpose. Splitting the body back into
- * "manifest fields" and "collections" would need a second copy of the key set
- * `AssembledPackageBodySchema` derives, and the rules do not need the split —
- * they read collections off the top level (already there) and identity off
- * `manifest`.
- *
- * That `manifest` is a SUPERSET of a real manifest — it is the whole body — and
- * that is safe here for one reason only: nothing parses it. `runAuthoringRules`
- * reads fields off this object and never hands it to a schema. ⛔ Do not start
- * parsing it against `ManifestSchema`, and do not reach for a widened schema to
- * make that possible: `ManifestSchema` is `strictObject` since #14192, so it
- * would REFUSE, by name, every collection key this superset deliberately puts
- * under `manifest` — and re-opening it to stop the refusal would re-open the
- * real manifest surface with it.
- *
- * ## `packages` — the second key, and the only one (#16611)
- *
- * The body carries the collections this package OWNS. Judged with nothing else,
- * a rule that resolves an object NAME concludes that a name a SIBLING package in
- * the same artifact ships exists nowhere: `examples/app-multi-package`'s
- * `crm_order.account` → `crm_account` — a lookup that fixture's README
- * documents as the point of the fixture — is owned by its `core` package and
- * read from its `orders` one. ADR-0130 makes the release artifact the
- * co-ownership boundary, so a per-package pass that cannot see a sibling
- * package's objects is THIS RUN's defect and not the author's; the ruled fix
- * (director seat, decision batch #86) hands the per-package stack the
- * artifact's own `packages[]` as RESOLUTION CONTEXT.
- *
- * Two properties make that safe, and they are the whole design:
- *
- *   1. ⛔ It changes what a rule can RESOLVE, never what it JUDGES. The
- *      collections read off the top level are still this package's alone, so
- *      every per-package finding this leg exists to produce is still produced.
- *      ⛔ This is NOT "skip the site per package" — that would silence the gate
- *      on the one command that ships.
- *   2. A name no entry of `packages[]` provides resolves in neither run, so a
- *      genuinely dangling reference still errors here exactly as it does in the
- *      union run above.
- *
- * The array is passed through verbatim rather than reduced to a name list: the
- * consuming rule owns which of an entry's contents are resolution context, and a
- * set computed here would be a second copy of that decision, free to drift.
- */
-function packageBodyAsStack(
-  body: Record<string, unknown>,
-  artifactPackageEntries: unknown,
-): Record<string, unknown> {
-  return { ...body, manifest: body, packages: artifactPackageEntries };
-}
-
 /** Identity of one finding, for the per-package de-duplication below. */
 const findingKey = (f: { rule: string; where: string; path: string; message: string }): string =>
   `${f.rule}\u0000${f.where}\u0000${f.path}\u0000${f.message}`;