fix(objectql): the Archiver resolves its window through P4 governance (#10528) (#10864)

`archiveObject` read `archive.after` — and, since #10347, `ttl.expireAfter` —
straight off the declaration, so for any object declaring `lifecycle.archive`
an operator's settings override was silently ignored, a registered
`LifecycleRetentionFloor` was never evaluated, and per-tenant windows did not
apply.

The cause is structural, not a forgotten call: `reapObject` returns into
`archiveObject` when `archive` is declared, so the three `effectiveWindowMs`
resolutions on the reap path sit on a branch archive-declaring objects skip
entirely. Governance is therefore resolved inside `archiveObject`, where the
#10347 ruling already put the decision about WHICH window is due — resolving it
in the caller would duplicate that selection or split one decision across two
methods, and the per-tenant leg is a pass over this method's own batch loop
either way.

All three legs now run through the same resolver the Reaper uses: the global
override (on the key matching the selected window), the retention floor
(#5195) for both overrides and declarations, and per-tenant windows as one
candidate read per overriding tenant plus a global pass covering NULL-org rows.

#10347's cutoff selection, the retain-first posture, the per-batch abort checks
and the cold-side `archive.keep` prune are unchanged.


Claude-Session: https://claude.ai/code/session_019yDEhPBC3tcGkW9bkce1HM

Co-authored-by: Claude <noreply@anthropic.com>

Author: Elon Musk

.changeset/archiver-governance-windows-and-floors.md

@@ -0,0 +1,38 @@
+---
+"@objectstack/objectql": patch
+---
+
+The Archiver resolves its window through ADR-0057 P4 governance (#10528).
+`LifecycleService.archiveObject` read `archive.after` — and, since #10347,
+`ttl.expireAfter` — straight off the declaration, so for any object declaring
+`lifecycle.archive` an operator's settings override was silently ignored, a
+registered `LifecycleRetentionFloor` was never evaluated, and per-tenant windows
+did not apply.
+
+This was not a forgotten call. `reapObject` **returns** into `archiveObject` for
+any object declaring `archive`, so the three `effectiveWindowMs` resolutions on
+the reap path sat on a branch archive-declaring objects skip entirely — which is
+why the divergence was total rather than partial, and why threading an override
+into the cutoff alone would still have left floors and tenant windows unreached.
+
+All three legs now run, through the same resolver the Reaper uses:
+
+- a per-object `retention_overrides` entry beats the declaration, on the key that
+  matches which window the selection picked — `expireAfter` for a ttl-selected
+  archive, `maxAge` for an age-selected one;
+- an override below a registered floor is rejected (the declared window stands),
+  logged at `error` naming the registrar, consequence and fix, and recorded in
+  `report.floorViolations` — the leg whose absence was *silent*, since an empty
+  `floorViolations` is indistinguishable from a healthy sweep. A *declared*
+  archive window below a floor is reported the same way and still enforced;
+- tenant-scoped windows issue one candidate read per overriding tenant, then one
+  global pass covering everyone else including NULL-org rows — the shape `reap()`
+  already used, with tenant overrides going through the same floor.
+
+Unchanged on purpose: #10347's cutoff **selection** (a declared `ttl` still
+decides which rows move, on `ttl.field`); the retain-first posture (no archive
+datasource ⇒ `archive-pending`, hot-delete only what the cold store took); the
+per-batch abort checks, now the first act of every pass; and the cold-side
+`archive.keep` prune, which bounds the archive rather than the hot store and has
+no settings key. An object with no override and no floor sweeps exactly as
+before, as one pass over exactly the predicate it ran before.