Merge origin/main into claude/issue-14704-single-door-sandbox-wrapper

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016yfqQh2dBgPAymYd7xipza

Author: claude

.changeset/analytics-result-builtin-aggregate.md

@@ -0,0 +1,49 @@
+---
+"@objectstack/spec": minor
+"@objectstack/service-analytics": minor
+---
+
+feat(spec,analytics): `AnalyticsResult.fields[].builtinAggregate` — a closed discriminator for a measure column whose display name is the server's built-in default (#14492)
+
+**What a consumer sees.** `queryDataset()` (and `POST /api/v1/analytics/dataset/query`,
+which relays the result verbatim) now carries an optional
+`fields[].builtinAggregate?: 'count' | 'sum' | 'avg' | 'min' | 'max' | 'count_distinct'`
+on a measure column. It is present exactly when the dataset measure behind the
+column declares an `aggregate` and **no** `label` — the producer then has nothing
+but the aggregate to name the column by, so it says which aggregate that is. It is
+absent whenever the author declared a label (a plain string or an inline locale
+map, even one with no entry for the request locale: an author's text is never
+re-labelled by a consumer), and absent on dimension columns and derived measures.
+The vocabulary is `AggregationFunction` (`data/query.zod.ts`), the one closed
+aggregate enum — no second spelling. `AnalyticsResultResponseSchema`
+(`api/analytics.zod.ts`) mirrors the member, refusing a spelling outside the enum.
+
+**Why.** An AI-built dashboard's "count of customers by status" chart showed the
+English axis title "Count" on a Chinese UI. The renderer (objectui
+`buildChartSeries()` / `labelOf()`) treats `fields[].label` as resolved author
+content and passes it through verbatim — correctly, since a real custom label
+("Tasks") must survive. What it could not tell apart was an author's text from
+the server's built-in default for a bare `count`. Guessing from the label text
+was refused (it would catch an author who really named a field `Count`, and break
+the moment the default is spelled in another language); translating on the
+server was not taken (it copies the front end's language decision into the
+producer and leaves nothing for a per-widget override). The ruling (2026-09-02,
+option B) is a structured discriminator on the contract: the consumer prefers a
+locale lookup keyed by `builtinAggregate` — mirroring its existing
+`report.aggregate.*` keys — and falls back to `label`, then `name`.
+
+**Producer-side changes.**
+
+- `@objectstack/service-analytics` — `queryDataset`'s measure enrichment sets
+  `builtinAggregate` from the dataset measure's own `aggregate` when the measure
+  has no authored `label`. Judged on the authored key, never on the resolved
+  string.
+- `@objectstack/spec` — the `dataset` create seed (`metadata-create-seeds.ts`)
+  drops its hardcoded `label: 'Count'` from the seeded `count` measure, so a
+  dataset created from Studio is a built-in default (wire: `builtinAggregate:
+  'count'`) instead of an authored English literal. `getMeta()` for such a
+  dataset now titles the metric by its name (`count`) rather than `Count`;
+  `CubeMeta.measures[].type` already carried the aggregate there.
+
+Purely additive: no key is removed or renamed, no authorable schema changes shape,
+and a consumer that ignores the member sees exactly the response it saw before.

.changeset/compose-stacks-action-echo.md

@@ -0,0 +1,44 @@
+---
+"@objectstack/spec": patch
+---
+
+fix(spec): `composeStacks` carries each bound standalone action once in the composed object — the second merge no longer re-appends the copy each input's build already made (#14847)
+
+`defineStack` ends with `mergeActionsIntoObjects`: every standalone action
+carrying `objectName` is copied into that object's `actions` on the way out,
+and the standalone stays in `stack.actions`. `composeStacks` concatenates its
+inputs' `actions` and ended with the same merge — so each bound action was
+appended to its object a SECOND time, beside the copy the input's own build had
+put there: two copies for one declaration, three with three stacks under
+`objectConflict: 'override'` / `'merge'`, `manifest: 'preserve'` inheriting it.
+Downstream (the runtime note recorded on #14686): `collectActionDeclarations`
+pushes every embedded entry, so MCP `listActions` listed a composed app's bound
+actions twice and bare-name `resolveActionByName` refused the ambiguity; `os
+build` shipped the doubled entries to `dist/objectstack.json` unremarked,
+because `compile.ts` validates the lowered stack with `safeParse`, not
+`defineStack`.
+
+`mergeActionsIntoObjects` is now idempotent over its own output: a bound action
+the object already carries BY IDENTITY is not appended again. Identity against
+the standalone list, deliberately not equality — the only way an entry of
+`stack.actions` is the very same object as an entry of `object.actions` is that
+a previous merge put it there. A hand-written twin (one action authored in both
+positions) is two objects after the strict parse and is still refused by
+#14686's same-key rule, which runs before the merge and is untouched; a marker
+cannot do this job (`ActionSchema` is strict — an unknown key is refused).
+`collectComposedActionKeyCollisions` (#14854) is untouched too: it runs before
+the merge and counts distinct stacks per key, so its refusals and their wording
+do not move.
+
+Shape change, and only this: a composed object's `actions` is the previous
+output minus the duplicate entries — nothing is reordered, and `order` sorts the
+once-merged set as before. The accept set does not move: nothing that composed
+before is refused now, and nothing refused is accepted. Round trip: a composed
+artifact is still refused by `defineStack` when an input binds an action — a
+built artifact carries each bound action in both positions by #14686's landed
+design (author the source shape, not the artifact) — but with the same
+"declared twice" line a single built input gets, no longer "3 times"; with no
+bound action it parses cleanly, as before. One measured consequence outside
+composition: under `strict: false`, ONE action object placed in both positions
+is now carried once (before: twice) — a single declaration, in the mode that
+opts out of #14686's walk by choice.

.changeset/engine-trigger-kind-from-spec-resolver.md

@@ -0,0 +1,51 @@
+---
+"@objectstack/service-automation": patch
+---
+
+refactor(service-automation): take the trigger KIND from spec's `resolveFlowTriggerKind` instead of a second private copy of the chain (#14328)
+
+No behaviour change and no API change — `patch` because nothing observable moves.
+`resolveTriggerBinding` is `private`, no export is added or removed, no payload
+key changes, and the kind reported for every flow is the kind reported before
+(1,223 `service-automation` cases and 81 `trigger-record-change` cases green
+unchanged, plus new pins across the whole precedence chain). What changes is that
+one rule now has one home.
+
+**The defect.** `AutomationEngine.resolveTriggerBinding` hand-kept the chain that
+decides which trigger a flow asks for — string `record-*` token, array form,
+`timeRelative` descriptor, `schedule` cadence or `type: 'schedule'`, `type: 'api'`
+or `triggerType: 'api'` — in parallel with `@objectstack/spec`'s
+`resolveFlowTriggerKind`, the authoring-time mirror of that same rule. Both
+authoring surfaces already read the spec one: `defineStack`'s trigger-capability
+refusal and `@objectstack/lint`'s `validate-flow-trigger-readiness`. The engine
+did not, and nothing pinned the two together. A branch added to one side leaves
+`defineStack` accepting a stack the runtime leaves inert, or refusing one it would
+arm — the drift the shared resolver was hoisted to prevent, reopened one layer
+down. The two agreed on every string-form flow, so this was an observation rather
+than a live defect; the harm was future drift.
+
+**The shape.** `resolveTriggerBinding` now takes its kind from
+`resolveFlowTriggerKind(flow)` and keeps only the per-kind BINDING construction —
+which start-node fields each trigger needs. `getTriggerBindingAudit` and the boot
+banner therefore name the kind authoring named, by construction.
+
+**The one deliberate divergence is preserved, not unified.** The ARRAY form of
+`triggerType` (`['record-after-create', 'record-after-delete']`) resolves to *no*
+kind in spec — multi-event unions are unsupported (#3457), and reading the shape
+as "asks for a record-change trigger" would have `defineStack` demand a capability
+the flow can never use and would widen the lint rule's auto-triggered set. The
+engine routes it to the record-change trigger anyway, from an explicit pre-check
+that runs BEFORE the resolver, for one reason: so that trigger refuses it LOUDLY
+at bind time (#3481) instead of the flow folding into "manual" and vanishing from
+every surface. Pre-check *ordering* is load-bearing too — array form outranks
+`timeRelative`, which the resolver, blind to the array, would otherwise answer for
+a start node carrying both.
+
+**What now catches the drift.** Two guards, one static and one runtime. The
+per-kind `switch` is exhaustive over `FlowTriggerKind` with a `never` default, so a
+kind added to spec fails this package's type-check until its binding shape is
+written; and a new case asserts every kind in `FLOW_TRIGGER_KINDS` is reachable
+through the real engine. The preserved divergence is pinned on both sides: engine
+routing and pre-check precedence in `service-automation`, and the refusal itself —
+asserted as a refusal, on a binding the real engine produced — end-to-end against
+the real trigger in `@objectstack/trigger-record-change`.

.changeset/listview-canonical-binding-refused.md

@@ -0,0 +1,7 @@
+---
+'@objectstack/lint': patch
+---
+
+`os validate` now refuses a react-page `<ListView>` bound only by the metadata-tier data source instead of accepting it. The react-blocks contract deprecates `objectName` in favour of `data={{ provider: 'object', object }}`, but no renderer reads that spelling yet — so a page written to the contract's own summary validated green and then rendered an empty list with no diagnostic, and the check tightens back to what actually renders. The refusal names `objectName` as the spelling to write, and field-name props (`columns`, `searchableFields`, filter positions, …) again resolve against it, which is also the correct object when a page carries both spellings.
+
+Scoped deliberately: pages binding with `objectName` are unaffected, and so are the `value` and `api` data providers, a plain-array `data`, and a non-static `data` prop — all of those do render. The deprecation warnings on `objectName` and `viewType` remain, with their text corrected; both are still the spellings to write until the renderer folds the canonical data source in. Pages that were green on the canonical spelling alone now fail by design.

.changeset/object-less-action-key-one-predicate.md

@@ -0,0 +1,47 @@
+---
+"@objectstack/runtime": patch
+---
+
+fix(runtime): route the flow param seeder through the single object-less predicate (#14864)
+
+`isObjectLessActionKey` (`@objectstack/objectql`) is the canonical answer to
+"is this routed object the object-less placeholder": the canonical
+`GLOBAL_ACTION_OBJECT_KEY`, the legacy `'*'`, or nothing at all.
+`dispatchFlowAction` asks it directly when it decides whether to hand the
+automation service an `object` at all — and then, three lines later, handed the
+same `objectName` to `seedFlowActionParams`, which answered the same question
+with a second, narrower comparison of its own (`objectName !==
+GLOBAL_ACTION_OBJECT_KEY`).
+
+The two parted on exactly one input, `'*'`. A request routed at the legacy
+wildcard — `POST /actions/*/<action>/<id>`, which resolves today because
+`actionHandlerObjectKeys` deliberately probes `'*'` last so a handler user code
+registered against it still resolves — was object-less to the automation
+envelope (no `object` sent) and object-BOUND to the params bag, which seeded a
+nonsense `'*Id'` key beside `recordId`. Same dispatch, two answers.
+
+The empty-string half was never part of the divergence: the `objectName &&`
+truthiness leg of the old guard already covered it, and `undefined` with it.
+`'*'` was the whole of it.
+
+**Direction.** The guard is widened onto the shared predicate rather than
+`isObjectLessActionKey` being narrowed. `'*'` is *unused today*, not *dead*:
+nothing first-party registers under it, but it is a deliberately-honoured
+legacy read path with its own docblock, reachable through the public
+`engine.registerAction(objectName, …)` surface that user code calls. Retiring
+it is a compatibility decision about someone else's package, not a tidy-up this
+fix is entitled to make.
+
+**Coverage.** Both functions this touches were ablated repo-wide first rather
+than grepped, because a grep scoped to the file you expect a pin in cannot see
+a pin living elsewhere:
+
+- `seedFlowActionParams` gutted → 5 tests red. It was pinned all along,
+  indirectly, through the REST route — but every case there routes at a real
+  object, so the object-LESS leg, where the two predicates actually disagreed,
+  was the unpinned part. Now pinned, over the whole predicate domain.
+- `enforceActionParams` replaced with an unconditional `return null` → 3143
+  passed, 0 failed. The ADR-0104 D2 gate could stop existing with nothing in
+  the repo noticing. Its validator is well pinned in `@objectstack/spec`; the
+  runtime gate around it was not, and that gate is what keeps an AI/MCP
+  caller's plausible-but-wrong bag out of an action body. Now pinned.

.changeset/service-cluster-test-tsc-program.md

@@ -0,0 +1,58 @@
+---
+"@objectstack/service-cluster": patch
+---
+
+fix(service-cluster): put the test layer in front of tsc, and repair the TS2322 it was hiding (#14181)
+
+`packages/services/service-cluster` had **no `typecheck` script at all** — its
+scripts were `build` and `test` — so no tsc program anywhere read this package.
+Turbo/CI typecheck lanes skipped it silently, because a zero-matching filter run
+exits 0. `tsup` transpiles with esbuild and `vitest` runs through esbuild
+type-**stripping**; neither type-checks. The package's own `tsconfig.json` does
+include the tests and always did, so the program that would have read them
+already existed and was simply never invoked.
+
+What that hid was in the worst possible file. `src/memory/memory.contract.test.ts`
+is the package's **contract witness** — type conformance to the `IPubSub` /
+`ILock` / `IKV` / `ICounter` contracts is the entire point of its existence — and
+it did not compile:
+
+```
+src/memory/memory.contract.test.ts(26,46): error TS2322:
+  Type 'number' is not assignable to type 'void | Promise<void>'.
+```
+
+`cluster.pubsub.subscribe('e', (m) => received.push(m.payload))` passes a concise
+arrow body as a `PubSubHandler`, whose contract return type is
+`void | Promise<void>`. The body returns `Array.prototype.push`'s `number`, and
+TypeScript's void-return assignability relaxation does **not** forgive it,
+because the target is a UNION rather than a bare `void`. It is repaired with a
+block body — the handler is side-effect-only by contract, and the returned length
+was an accident of arrow syntax, never intent. The identical shape is what
+`@objectstack/metadata` graduated on (20 of them, `(evt) => arr.push(evt)` in a
+watcher slot).
+
+⛔ The spec contract is untouched: `PubSubHandler` returning `void | Promise<void>`
+is correct and deliberate (the union is what lets a driver `await` an async
+handler). The defect was in the test, so the test is where it is fixed — no
+consumer-side widening, no source signature change.
+
+Wired by the route the `packages/plugins/**` family settled on in #14062: a
+sibling `tsconfig.test.json` that changes **module semantics only** (`esnext` /
+`bundler` / `lib: ES2022`, matching how vitest actually executes these files)
+with **strictness inherited and untouched**, named by a new `typecheck` script
+through the shared `check:test-typecheck` gate. Measured before the repair: 1
+error under build semantics, 1 under the new config — the two readings agree, so
+this package carried no config-tier pile. After: 0 and 0, across a 410-file
+program covering all 7 of its `src/**/*.test.ts`.
+
+No `test-typecheck-debt.json` is added, and its **absence is the zero**: the gate
+reads a missing ledger as `{ entries: {} }`, under which any error in any file
+here is red immediately. The package's `DEBT` entry in
+`scripts/check-type-check-coverage.mjs` (`errors: 1`) is deleted in this PR
+rather than lowered — that is the graduation the ratchet's own invariant
+requires, and it is why the error was fixed rather than ledgered.
+
+No runtime code changes: `src/**` (excluding tests) is byte-identical, so no
+shipped behaviour moves. The `patch` level reflects the published `package.json`
+gaining `typecheck` / `check:test-typecheck` scripts and a `tsx` devDependency.

.claude/launch.json

@@ -18,24 +18,6 @@
         "file:/tmp/showcase-dogfood-3777/data.db"
       ],
       "port": 3777
-    },
-    {
-      "name": "pr3505-attach-3477",
-      "runtimeExecutable": "pnpm",
-      "runtimeArgs": [
-        "-C",
-        "/home/user/objectstack-pr3505/examples/app-showcase",
-        "exec",
-        "objectstack",
-        "dev",
-        "--ui",
-        "--seed-admin",
-        "-p",
-        "3477",
-        "-d",
-        "file:/tmp/pr3505-attach/data.db"
-      ],
-      "port": 3477
     }
   ]
 }

.claude/skills/dogfood-verification/SKILL.md

@@ -35,6 +35,7 @@ dev 工作树、dev-server 端口、preview 浏览器全是**共享的**:并行
       `lsof -nP -iTCP:<port> -sTCP:LISTEN`。在 `.claude/launch.json` 加一条指向**本**
       工作目录的具名配置,例如
       `pnpm -C <abs>/examples/app-showcase exec objectstack dev --ui --seed-admin -p <port> -d file:/tmp/<run>/data.db`。
+      工作树没了就**删掉自己那条** —— 死条目让 `preview_start` 挂在缺失的 `pnpm -C` 上。
 - [ ] **同时导出 `OS_PORT` —— 只给 `-p` 不够。** showcase 的自 ping 连接器读的是*环
       境*(`SHOWCASE_SELF_URL`→`OS_PORT`→`PORT`→3000),于是 `fetch failed` 冒充出口被封。
 - [ ] **自有数据**:`--seed-admin` 在空 DB 上给出 `admin@objectos.ai / admin123`。持

.claude/skills/pm-dispatch/references/contract-review.md

@@ -36,6 +36,10 @@
   隔离的 fable 复核子代理**出第二意见,只喂卡片、既有裁决与 PR 本体,⛔ 不喂派发令与
   派发席自己的结论(污染即失独立性);简报写成**对抗性**(找拒绝理由)。未达档席 ⛔ 不凭
   自述复核,恒走本路径;子代理裁决按转录核验采信(下节),逐字采纳或整体作废。
+- **裁决载独立性对(机读,C4 行比对)**（2026-09-01 裁定 A、2026-09-02 裁定读法 a):产出 diff
+  的身份写 `Implemented-by:` —— `mode:subagent` dev 记其分支(`claude/issue-…`,子代理无自有
+  session),`mode:remote` dev 记 session id;`Reviewed-by:` = 出裁决席位的 session。两者同
+  session ⇒ 报 SELF-REVIEW,⛔ 不作独立复核;两行皆无的历史裁决恒静默(⛔ 缺失永不转红)。
 - **放行 = 清标即落地**（2026-08-25 裁定）:PASS ⇒ 同席同笔剥标(双载体),
   清标评论引 2026-08-31 裁定作 provenance,按
   `landing-operations.md` 走落地前检 → 转 ready → 挂 auto-merge/入队;轮报设**复审清单**专