-warn-error Propagation Across Dune Library Boundaries

In OCaml projects built with Dune the -warn-error flag promotes selected compiler warnings to errors for the stanza to which it is applied. When a library is consumed by downstream packages the effective warning-enforcement policy does not automatically propagate because Dune lacks a built-in permission boundary that prevents a dependent project from overriding or suppressing the parent library -warn-error settings. Compounding this the default complement of warnings enabled by the OCaml compiler evolves between releases in the 4.x and 5.x series; an explicit -warn-error configuration that succeeds on one OCaml version may silently tolerate new warnings on another producing non-deterministic build failures in continuous integration.

1. Where should the authoritative -warn-error constraint be declared to reliably enforce policy across library boundaries and OCaml version upgrades?
2. Can a dune profile enforce a permission boundary that blocks downstream overrides of inherited -warn-error settings?
3. What explicit warning number sets best guarantee consistent error promotion across library dependencies?