Merge remote-tracking branch 'origin/main' into claude/issue-15442-filter-orthography-converge

Author: claude

.changeset/approvals-terminal-run-status-exhaustive.md

@@ -0,0 +1,13 @@
+---
+"@objectstack/plugin-approvals": patch
+---
+
+fix(approvals): the dead-run sweep classifies every `ExecutionStatus` member, so a `refused` run releases its pending approval (#16433)
+
+`ApprovalService.releaseDeadRunRequests` guarded on a hand-copied four-member subset of `ExecutionStatus` — `completed`, `failed`, `cancelled`, `timed_out` — written when that enum had eight members. #14945 then appended `refused`, documented on the enum as *"Terminal, never resumed"*, and the subset did not grow with it. A run in `refused` was therefore skipped by the sweep, so a still-pending approval on it read as ALIVE, was never released, and kept its record lock forever.
+
+**Why this is shipped as a fix rather than left alone.** Nothing inside this repo drives a run to `refused` yet — that is #15788 (lane 2 of the #14945 ruling), still open. But `ApprovalService` takes a HOST-supplied automation surface through `attachAutomation`, so a host whose `getRun` already answers with the status the published spec declares sees the corrected behaviour the moment it upgrades, rather than on the day lane 2 lands. That is a real behaviour change in a published package, which is why it carries a bump instead of `skip-changeset`.
+
+The repair is not "add `refused`" — that yields a five-member hand-copy with the identical trap re-armed for the tenth member — and it is not "derive the terminal set from the enum" either, since `running` and `paused` are plainly not terminal and a wholesale derivation would default every future member to terminal, i.e. to releasing approvals out from under LIVE runs. Instead the file now declares a **total map** over `ExecutionStatus`, classifying each member `terminal` or `live`, from which the terminal set is derived. A tenth member fails to compile until someone classifies it, and fails a test as well.
+
+No API change: the classification is module-internal and the package barrel is untouched.

.changeset/artifact-granted-permissions-load-binding.md

@@ -0,0 +1,15 @@
+---
+'@objectstack/runtime': minor
+---
+
+Bind an environment artifact's install-time GRANTED permission set to the packages that artifact materializes.
+
+`EnvironmentArtifactSchema.grantedPermissions` — the consented `{ services, hooks, network, fs }` set the control plane compiles onto the artifact at install-consent time (ADR-0025 §3.5 step 2 / F4) — now reaches `PluginPermissionEnforcer.registerGrantedPermissions` at materialize time, one call per consent record, keyed by the plugin manifest `id`. `AppPlugin.init()` performs the binding, so it happens on every path that turns an artifact into a kernel plugin without either caller changing a line, and the enforcer holding the result is readable as `AppPlugin.permissionEnforcer` (with `AppPlugin.grantBinding` recording what bound).
+
+Absent, `{}` and a consented entry stay three distinct states. An artifact carrying no `grantedPermissions` key allocates no enforcer and registers nothing, so a package with no consent record loads exactly as it did; a per-plugin `{}` is a consent record that consented to nothing and registers a bag that denies every service, hook, host and path. A consent record naming a package the artifact does not carry is reported at `warn` rather than passing in silence.
+
+Fixed alongside, because without it the binding was unreachable: the `{ schemaVersion, metadata }` envelope unwrap in `loadArtifactBundle` handed the kernel `metadata` alone and dropped every key standing beside it, so an envelope artifact reached the kernel with `grantedPermissions` stripped. The loss was silent and indistinguishable from the legitimate absent reading. The unwrap now carries the key across when the envelope declares it, `{}` included, and never invents one.
+
+New exports from `@objectstack/runtime`: `registerArtifactGrantedPermissions`, `resolveArtifactGrantBinding`, `carriedPackageIds`, `ArtifactGrantBinding`.
+
+This is the registration half. Access-time enforcement runs through `SecurePluginContext`, which no production path constructs; that seam is ADR-0025 install-flow work and is unchanged here.

.changeset/client-invite-role-default-member.md

@@ -0,0 +1,24 @@
+---
+"@objectstack/client": patch
+---
+
+fix(client): `organizations.invite` defaults `role` to `'member'`, so the shorter call it declares actually works (#16582)
+
+`organizations.invite` declares `role?` as **optional** and forwarded the caller's object to better-auth verbatim. better-auth 1.7.2's body schema for `POST /organization/invite-member` makes `role` **required**, so the documented-looking minimal call was refused before it reached any ObjectStack code:
+
+```
+client.organizations.invite({ email, organizationId })   ->  400  [body.role] Invalid input   (VALIDATION_ERROR)
+```
+
+Omitting `role` now sends `'member'`. **No published type moves** — `role` stays optional, and a caller who names a role still gets exactly that role on the wire (including `role: undefined`, which is treated as omission rather than dropped).
+
+The default is `'member'` because the sibling `organizations.invitations.resend` has always substituted exactly that over the **same** vendor endpoint. That asymmetry is why the gap stayed invisible: one member of the family papered over the vendor's requirement and the other did not, so only the shorter form ever failed. It is also the least-privileged name in the closed membership vocabulary (ADR-0108 D1 — `orgRoleGrade` floors at `member` and rises only for `owner`/`admin`), and an invitation is a pending row the invitee must still accept, so the implicit choice cannot confer reach the caller did not ask for.
+
+Measured against a real `AuthManager` (better-auth 1.7.2, organization plugin, `teams: { enabled: true }`) over a real `SqlDriver` (better-sqlite3), before and after:
+
+```
+before:  POST /organization/invite-member  ->  400  {"message":"[body.role] Invalid input","code":"VALIDATION_ERROR"}
+after:   POST /organization/invite-member  ->  200  {"role":"member","status":"pending", ...}
+```
+
+No caller had to change: the census found no in-repo or Console caller using the two-argument form, so this repairs a path that was declared and unreachable rather than one that was in use.

.changeset/engine-write-failure-log-level-warn.md

@@ -0,0 +1,37 @@
+---
+"@objectstack/objectql": patch
+---
+
+fix(objectql): a refused write reports at `warn`, not `error` — the caller was already told (#17052)
+
+`insert`, `update` and `delete` each end their `catch` with `throw e`, then
+logged the failure at ERROR one statement earlier. AGENTS.md → *Degradation log
+levels* names that exact shape and forbids it: "a failure handed to the CALLER
+is not a degradation at all … Do not bolt a `logger.error` onto such a site."
+
+**This moves published behaviour**, which is why it is a changeset rather than a
+`skip-changeset`: the level is what an operator greps, and at least one consumer
+reads it structurally. `scripts/publish-smoke.sh` fails a boot on any
+error-level line (`SMOKE_ERROR_LOG_PATTERN`), and that is how the defect was
+found — `@better-auth/oauth-provider` seeds `sys_oauth_resource` in `insertOnly`
+mode and documents its `identifier` UNIQUE constraint AS its race-safety
+mechanism, catching the collision and continuing at `debug`. Our line was
+emitted before that catch ever ran, so a healthy first boot of every fresh
+`create-objectstack` project printed `ERROR Insert operation failed` and red-lit
+`publish-smoke / packed-tarballs` for six consecutive runs on a candidate whose
+auth and CRUD probes were all green.
+
+**Nothing else about the entry moved.** Same message, same `object` meta, same
+redaction (#8682: the bound statement and its values stay cut from `message`
+and `stack`), same subject (#14095: the entry carries the driver's own error —
+a `DuplicateRecordError`'s `cause` — never the envelope, so the failing column,
+MySQL's index name and the driver's frames survive). The `Logger` contract gives
+an `Error` slot to `error`/`fatal` only, so the engine now builds the
+`{ error: { message, stack } }` bag that slot used to build; handing the Error
+to `warn` as meta would have serialised `{}`, because those two fields are
+non-enumerable. The rendered line is byte-identical apart from the level word,
+and that equivalence is pinned rather than asserted.
+
+If you grep your logs for these three messages, keep the message and drop the
+level from the pattern. If you alert on error-level lines from `@objectstack/objectql`,
+a refused write no longer raises one — the write's exception still does.

.changeset/iso-from-valid-date-family-collapse.md

@@ -0,0 +1,108 @@
+---
+"@objectstack/metadata": minor
+"@objectstack/metadata-protocol": patch
+---
+
+fix(metadata): four `isoFromValidDate` call sites collapse onto the shared canonical-ISO spelling; `MetadataHistoryRecord.recordedAt` gets the terminal value it never had (#16422)
+
+## What was wrong
+
+`#14037`/`#14038` landed a narrow per-site helper, `isoFromValidDate`, beside
+the shared `canonicalIsoInstant` spelling. It rewrote exactly one shape — a
+valid JS `Date` becomes ISO text — and handed **every other input back
+untouched**. Four adapter boundaries used it, and each fed a field declared
+`z.string()` or `z.string().datetime()`:
+
+| site | declared as |
+|:--|:--|
+| `SysMetadataRepository.rowToEvent` → `MetadataEvent.ts` | `z.string()` |
+| `DatabaseLoader.rowToRecord` → `MetadataRecord.createdAt` / `.updatedAt` | `z.string().datetime().optional()` |
+| `DatabaseLoader.getHistoryRecord` → `MetadataHistoryRecord.recordedAt` | `z.string().datetime()` — **required** |
+| `DatabaseLoader.queryHistory` → the same field, the other door | `z.string().datetime()` — **required** |
+
+So a `null`, a `number`, an opaque column and an Invalid `Date` all arrived at a
+field declared `string`, each wearing an `as string` / `as string | undefined`
+cast that asserted the opposite. Measured over the seven inputs that
+distinguish the two helpers, the declared schemas refused **21 of 35** produced
+values.
+
+`recordedAt` was the sharp end: a REQUIRED `z.string().datetime()` for which
+none of the three available answers was legal — the visible text
+`"Invalid Date"` fails the refinement, `undefined` fails the required field, and
+the pass-through fed it the `Date` object, which fails both.
+
+## What it does now
+
+Those four sites read `canonicalIsoInstant`, whose return type **is**
+`string | undefined`, so all four casts are deleted rather than restated. Both
+sibling definitions of `isoFromValidDate` are gone. The terminal value is chosen
+per site, from the site's own declared schema:
+
+- `MetadataRecord.createdAt` / `.updatedAt` are `.optional()` → `undefined`, the
+  branch an absent column already took. ⛔ No default is invented for a field the
+  schema lets be absent.
+- `MetadataHistoryRecord.recordedAt` is required → the **epoch**, via a named
+  `recordedAtFallback()` shared by both history doors. ⛔ Not `new Date()`: a
+  `now` stamp is a plausible-looking recording instant nobody measured, and it
+  sorts a version recorded years ago to the top of a newest-first timeline. The
+  epoch invents no fact and sorts to the oldest end. It is also the answer the
+  sibling reader of this same `sys_metadata_history.recorded_at` column already
+  gives (`rowToEvent` and `history()`, both `?? new Date(0).toISOString()`).
+
+Schema refusals over the same seven inputs: **21 → 8**. The eight that remain
+are a `number` and an opaque object at four sites — shapes no driver is measured
+to materialise for these columns. They now arrive as the declared *type* (a
+string) that simply is not a valid datetime, so the producer's bug stays visible
+instead of being papered over.
+
+## One behaviour change worth reading twice — and it is why this is `minor`
+
+`DatabaseLoader.stat()` computes `record.updatedAt ?? record.createdAt`. An
+Invalid `updated_at` used to WIN that `??` — a `Date` is truthy and not nullish —
+so a row with an unreadable `updated_at` and a good `created_at` published
+`new Date()` as its `mtime`. It now folds to `undefined` one step earlier and
+loses the `??`, so the row publishes its `created_at`: a stored instant in place
+of a fabricated one, and exactly the "same `?? DEFAULT` chain an absent column
+takes" that `#14078`'s own ruling text prescribes for the shape.
+
+⚠️ **The old answer was LEGAL.** `new Date().toISOString()` satisfies
+`MetadataStats.mtime`'s `z.string().datetime()` perfectly well, and the
+pre-existing pin asserted exactly that. So this one site is **not** the repair of
+a violation — it is one legal published answer replaced by a different legal
+published answer on a published read verb. Nothing was refused before and is
+permitted now; a consumer simply receives a different instant.
+
+## Why the two levels differ
+
+- **`@objectstack/metadata` — `minor`.** Its four repaired sites, on their own,
+  are the "repairing an implementation that silently violated its own already
+  published declared type" case: the values that changed there are ones
+  `MetadataRecordSchema` / `MetadataHistoryRecordSchema` already refused, and
+  nothing a consumer legitimately received has moved. But this package also
+  carries `stat()`, and that site changes a **legal** published answer, which the
+  paragraph above measures. The level is per package, so the four repaired sites
+  ride along at `minor`.
+- **`@objectstack/metadata-protocol` — `patch`.** Neither of its two sites moves
+  a legal published answer. `rowToEvent` only stops emitting values
+  `MetadataEventSchema` refused (a `Date`, a `number`, an opaque object in a
+  field declared `z.string()`), and `listCommits` is byte-identical on all seven
+  probe inputs.
+
+⛔ No declared type narrowed, no export was added or removed (neither helper was
+ever exported), and no envelope or accept set moved — so this is `minor` by the
+changed-answer row, not a breaking change, and it carries no ADR-0087
+disposition.
+
+## What deliberately did NOT collapse
+
+`listCommits` in `@objectstack/metadata-protocol` keeps its copy. Its docblock
+promises callers the RAW value back for a non-`Date`, and the shared spelling
+rewrites the whole domain: swapping it in would ERASE an Invalid `Date` from the
+response (`undefined` — the one answer ADR-0053 D-F3 refuses, because it silently
+drops a value that is on disk) and hand a `number` or an opaque object to the
+commit-timeline sort as `String(value)` rather than verbatim. Measured, that site
+is byte-identical on all seven inputs before and after this change.
+
+`SqlDriver`'s same-named helper is not part of this family at all: it takes
+`Date` (not `unknown`), both its call sites narrow with `instanceof Date` first,
+and it is the PRODUCER-side fold ADR-0053 D-F3 governs. It is untouched.

.changeset/memory-unique-sticky-tenancy-opt-out.md

@@ -0,0 +1,68 @@
+---
+"@objectstack/driver-memory": minor
+"@objectstack/driver-sql": patch
+"@objectstack/objectql": patch
+---
+
+fix(driver-memory,driver-sql): an explicit `tenancy.enabled: false` opt-out is sticky, so a partial `syncSchema` re-registration no longer flips a platform-global object's UNIQUE partition (#16729)
+
+## What was wrong
+
+`InMemoryDriver.syncSchema` recomputed its uniqueness constraints from whatever
+schema THAT call happened to carry. A second registration without a `tenancy`
+block — the `{ name, fields }` shape — fell through to the implicit
+`organization_id` heuristic, so a `unique` field moved from **one row per
+install** (`scopeField: null`, which is what `tenancy.enabled: false` declares)
+to **one row per organization**. A duplicate the declaration refuses then
+landed. Measured at the driver door on `origin/main` `d61139f1ba`:
+
+| sequence | second `key: 'K'`, different organization |
+|:--|:--|
+| register with `tenancy.enabled: false` | `REFUSED` — `UNIQUE_VIOLATION` / 409 |
+| …then re-register with `{ name, fields }` | **`LANDED`** |
+
+`SqlDriver` running the same sequence refuses in **both** cases: it has kept a
+sticky `tenantOptOutByTable` since #3249. `driver-memory` had mirrored the inner
+`computeTenantField` and not the wrapper that consults the record, so "mirrors
+`computeTenantField` arm for arm" stayed literally true while the pair diverged.
+
+It is silent in both directions — nothing logs the flip, and the refusal names
+the field, never the partition. That is the declared-vs-enforced shape Prime
+Directive #10 forbids, reached by a state change rather than by a missing check.
+
+## What it does now
+
+- **`@objectstack/driver-memory`** gains `computeAndRecordTenantField`, the
+  sticky resolver, and the `TenantOptOutRecord` type for the per-instance record
+  a driver owns. `InMemoryDriver` holds one and resolves through it, handing
+  BOTH declaration surfaces — field-level `unique` and declared `indexes[]` —
+  the same resolved column. `uniqueConstraintsFromFields` and
+  `uniqueConstraintsFromDeclaredIndexes` accept that column as an optional
+  second argument; called with one argument they answer exactly as before.
+  `tenantFieldOf` is unchanged and still a pure function of its argument.
+- **`@objectstack/driver-sql`**: the shard leaf resolved its tenant column with
+  the BARE `computeTenantField`, so a `rotateShards` sweep carrying no `tenancy`
+  block gave a shard an organization key part the base table's index does not
+  have — one object, two partitions, decided by which physical table a row
+  landed in. It now resolves through the record, keyed by the base table.
+- **`@objectstack/objectql`**: `LifecycleObjectLike` declares `tenancy`. The
+  Archiver hands that object straight to `cold.syncSchema`, and the published
+  type refused the key while the driver below read it — so an author writing a
+  fresh literal was pushed into producing exactly the partial re-registration
+  above. Same correction #16711 made where the shard leaf narrowed the key off
+  the object it was handed.
+
+The record is deliberately narrow. Only the explicit OPT-OUT is sticky: a
+declared `tenancy.tenantField` is not recorded, matching `SqlDriver`. An object
+that never declared the opt-out never enters the record, so a genuinely
+org-scoped object keeps its `organization_id` partition across a partial
+re-registration — an implementation answering `null` more often would not be
+stickier, it would be tenant isolation switched off. A carried `tenancy` block
+stays authoritative in both directions and CLEARS a recorded opt-out.
+
+`@objectstack/driver-memory` is `minor` for the two new public-entry exports.
+The behaviour repairs themselves are `patch`: each restores an implementation to
+the `tenancy.enabled: false` contract (`isTenancyDisabled`, ADR-0066) it was
+already declaring, rather than replacing one legal published answer with
+another. The `objectql` entry is a published type WIDENING — a key the interface
+refused is now accepted, and nothing that compiled before stops compiling.