Merge remote-tracking branch 'origin/main' into claude/issue-13263-reexport-doc-block

# Conflicts:
#	skills/objectstack-ui/references/_index.md

Author: claude

.changeset/driver-memory-field-level-uniqueness.md

@@ -0,0 +1,67 @@
+---
+"@objectstack/driver-memory": minor
+"@objectstack/types": patch
+---
+
+fix(driver-memory): enforce field-level `unique`, so a colliding write is refused instead of landing silently (#13197)
+
+`InMemoryDriver` enforced **no uniqueness at all**. `create` was a
+`table.push()` and `syncSchema` allocated an array, so a `unique: true` field
+was declared-and-not-enforced — the ADR-0078 / Prime-Directive-#10 shape the
+platform refuses everywhere else. A colliding write did not fail; it landed, and
+a read returned both rows.
+
+The motivating instance is the worst-shaped one. The engine's
+`createWithAutonumberResync` re-seeds the counter and re-issues a record number
+when the STORE rejects it as a duplicate, so on a store that rejected nothing
+the whole branch was unreachable: an autonumber allocated out of process
+duplicated an existing business identifier with **no error anywhere**. The
+remedy's location was already ruled in-tree at that method — «uniqueness
+enforcement in the driver, NOT a pre-issue existence probe here» — and this is
+that remedy. Nothing in the new code knows what an autonumber is; the defect was
+that the driver constrained nothing.
+
+**The refusal** carries the ADR-0112 envelope the SQL family answers a conflict
+with: `code: 'UNIQUE_VIOLATION'`, `status: 409`, no `[driver-memory]` prefix. So
+a suite that swaps this driver for SQLite sees one envelope — the parity
+`memory-filter-refusal-envelope.test.ts` already states for the filter family,
+now held for the constraint family. It is checked before the row is written, so
+a refused write leaves the table exactly as it found it, and `updateMany`
+prepares and checks the whole batch before mutating any of it.
+
+**The scoping is `driver-sql`'s, measured — not a simpler invention.** Read off
+`uniqueIndexesFromFields` (ADR-0120 D1/D3) and reproduced arm for arm:
+`unique: 'global'` is platform-wide; bare `true` and `'organization'` are
+per-organization (bare `true` is the POSITIONAL spelling of `'organization'` at
+FIELD level — reading it as `'global'` is the #4986 trap and would make two
+organizations' identical values collide on a constraint neither can see); both
+degrade to a single column when the object has no tenant column, and a `unique`
+declaration on the tenant column itself stays single-column. NULL values stay
+NULL-DISTINCT, exactly as under SQL `UNIQUE`. The D3 NULL-organization fold
+needs no `'__global__'` token here — that sentinel is a SQL-expression artefact,
+and a JavaScript key holds `null` directly.
+
+**Not** widened into: object-level declared `indexes[]` (composite uniques),
+primary keys, or row-level tenant isolation. This driver still refuses to boot
+multi-tenant (#6915) and that guard is untouched.
+
+`@objectstack/types` (`patch`): `isUniqueViolationError` now reads the
+platform's own registered `UNIQUE_VIOLATION` code on the `code` channel. Not
+cosmetic — a conflict that predicate does not recognise leaves the autonumber
+resync unable to re-seed, so the counter stays warm and every following insert
+collides too (#5495's PROBE3 storm), i.e. a silent duplicate traded for a
+non-converging insert loop. It is a tautology rather than a widened heuristic
+(the code already MEANS this condition), and no existing in-repo producer's
+classification changes: `@objectstack/rest`'s own response body is the only
+other site carrying that string, and it is downstream of the predicate.
+
+**Grade.** `minor` for the driver, not `patch`: a write that previously
+succeeded is now refused (`409`), which is an accept-set narrowing under the
+repo's launch-window convention for breaking changes, and the package also gains
+public exports (`UNIQUE_VIOLATION_CODE`, `uniqueConstraintsFromFields`,
+`tenantFieldOf`, `uniqueKeyOf`, `assertNoUniqueViolation`,
+`uniqueViolationError`). `patch` for `@objectstack/types`: no API added or
+removed and no in-repo verdict changes — the limb exists to serve the new
+producer. Fixtures that relied on duplicates landing on a declared-unique field
+must stop declaring `unique`, or stop writing the duplicate; the repo's own
+suites were measured and none did.

.changeset/sdui-parser-brace-literal-subset.md

@@ -0,0 +1,29 @@
+---
+'@objectstack/sdui-parser': minor
+---
+
+sdui-parser: `interpretBrace` materializes the JS literal subset, in lockstep with objectui
+
+The html tier's braced attribute values accepted strict JSON only, so the spelling every
+JSX author and every AI author writes — `columns={['name','amount']}` — compiled to the
+deferred `{ $expr }` marker that nothing downstream evaluates, and the author's data
+binding vanished at render. Under the maintainer's ruling on objectui#6614 (Q1-A,
+2026-08-28) `interpretBrace` now materializes the JS **literal subset**: exactly two
+widenings over JSON — single-quoted strings (value position and key position) and unquoted
+identifier object keys.
+
+Everything else JSON refuses is still refused and still becomes `{ $expr }`: trailing
+commas, comments, array holes, spreads, `undefined` / `NaN` / `Infinity`, `+1` / `.5` /
+`1.` / `0x1f`, template literals, and every genuine expression. `JSON.parse` still runs
+first and untouched, so strict-JSON behaviour is invariant by construction, and the subset
+contains no identifier lookup and no operator — the widening moves habitual spellings onto
+the materialized side, it does not move the data/code boundary (ADR-0080: this tier parses,
+never executes).
+
+An authored `__proto__` key is written as an own data property, the way `JSON.parse` gives
+it, never through the prototype setter — a plain assignment in the unquoted-key path would
+hand untrusted page source a prototype-pollution lever the strict-JSON path never had.
+
+The `inert-expression` diagnostic message is reworded to match: the old text advised
+writing the value as JSON with double-quoted strings and keys, which now names a legal
+spelling as the wrong one. Diagnostic **codes** are unchanged.

.changeset/tool-liveness-ledger-reclose.md

@@ -0,0 +1,55 @@
+---
+'@objectstack/spec': patch
+---
+
+liveness ledger: re-close `tool.json` against the real cloud runtime, and repair a `_note` that was false three ways (#13042)
+
+All six entries cited `packages/services/service-ai/…` — a path that exists in
+**neither** repo. The framework has no service-ai tree at all (`git ls-files`
+matches 0 paths containing it; `packages/services/` holds 16 members, none of
+them service-ai), and the cloud repo's real layout is `packages/service-ai/…`
+and `packages/service-ai-studio/…`. Six pointers into thin air, green for as
+long as they existed because `scripts/liveness/evidence.mts` hardcodes exactly
+the wrong spelling in `FOREIGN_PATH_PREFIXES` and so never resolved them.
+
+Re-closed against cloud `origin/main@15f55df` and objectui `origin/main@26896c6`
+— the first pass run from a container with both checkouts in reach, which is the
+executor constraint that parked this card. All six entries are now dated.
+
+- `name`, `description` — confirmed `live`, and both now carry **framework-local
+  anchored** evidence (`packages/mcp/…#registerToolFromDefinition`, the MCP
+  bridge that reads each `AIToolDefinition`) beside the cloud citation. CI can
+  falsify them from this checkout for the first time; the old note's claim that
+  "the OPEN framework edition does not consume them" was false for these two.
+- `parameters` — confirmed `live` on the cloud LLM path. Deliberately *not*
+  co-cited to the MCP bridge: that bridge never forwards the key, while its own
+  docblock says it does (filed as #13271).
+- `label` — confirmed `live` and given its **first evidence pointer ever**; it
+  had carried a bare `live` with no `evidence` field since seeding, the one row
+  the #13003 census could not even call stale.
+- `outputSchema` — stays `experimental`, with the negative half now measured
+  rather than asserted: the key occurs on exactly four non-test lines in the
+  whole cloud repo, and none of them validates anything.
+- `objectName` — stays `live`, but **on a completely different basis**, and the
+  row now says so. Its stated basis is falsified: both cited sites read
+  `action.objectName` (`action.json` carries the identical citation verbatim),
+  and the same-named `AIToolDefinition.objectName` is written and read by
+  nothing, so the key gates, binds and routes nothing. The consumer that does
+  exist is objectui's registered metadata-admin preview, which reads it off the
+  persisted record and renders it as the header's object pill — the #7131
+  display-key rule, and pinned in `ToolPreview.test.tsx` over a comment reading
+  "`objectName` is NOT residue". So: `live` as a **display** key, never as a
+  binding, and explicitly not an ADR-0049 retirement candidate — retiring it
+  would delete a key the renderer deliberately renders and tests.
+
+The `_note`'s fourth false claim is corrected in the same pass: "tool metadata
+is WRITE-ONLY … not metadata read-back" is simply untrue, and it is the reason
+nobody had looked at the renderer. `ToolPreview` reads **all six** props off the
+stored record. The type therefore has two live bases — the `AIToolDefinition`
+surface (behavioural) and the metadata read-back (display) — and each row now
+names which one carries it.
+
+Data-only: no schema, no runtime, no authoring surface changes, and no verdict
+moved, so `state-counts.md` is untouched and still current. `liveness/` is in
+this package's `files` array, so these ledgers ship in the npm tarball and this
+is published data.

.changeset/view-name-grammar-per-body-spelling.md

@@ -0,0 +1,37 @@
+---
+"@objectstack/spec": patch
+---
+
+docs(spec): state the `view` name grammar per body spelling in the view module header (#13134)
+
+`ViewMetadataSchema` is a union over three persisted `view` body spellings, and
+they do not share one `name` grammar. Nothing said so — the rule was
+reconstructible only by reading three schema factories:
+
+| body spelling | `name` is declared as | flat (undotted) name |
+|:---|:---|:---|
+| standalone ViewItem record | `ViewItemNameSchema` — `QUALIFIED_ITEM_NAME_PATTERN`, dot REQUIRED | rejected, located at `["name"]` |
+| flattened runtime overlay | `z.string().optional()` — no grammar | accepted |
+| `defineView` container | `z.string().optional()` — no grammar | accepted, and normally IS flat |
+
+Which grammar applies is decided by the body's shape, which an author never
+names explicitly, so neither failure direction is discoverable from the key
+being written: reading `ViewItemNameSchema` alone suggests the dot is mandatory
+everywhere (it is not — a container's own name is the bare object key under
+ADR-0017 §3.2's dual-read, and an overlay's name is stamped by the write path),
+while reading a flat-named overlay or container row suggests flat is fine
+generally (it is not — the same name on a standalone ViewItem record is
+refused).
+
+**No schema change.** This is documentation: a family-level JSDoc block on
+`ui/view.zod.ts`, three pointer comments at the declaration sites, and the
+regenerated reference page. Every accept/reject decision is byte-for-byte what
+it was — all three spellings were already internally consistent and the
+flat-named rows already parse.
+
+Side effect worth naming for readers of the generated reference: `ui/view.zod.ts`
+had no module description, so `content/docs/references/ui/view.mdx` and the two
+skill reference indexes opened with the doc comment attached to an unrelated
+`HttpRequest` re-export. They now open with the module's own description. The
+`HttpRequest` note is unchanged in the source, where it documents that
+re-export.

.github/workflows/lint.yml

@@ -4637,6 +4637,24 @@ jobs:
       - name: Check docs object examples pass the os validate security posture
         run: pnpm --filter @objectstack/lint run check:doc-security-posture
 
+      # The YAML half of the same surface (#13086, ruled 2026-08-29).
+      # check:skill-examples reads only ts/tsx fences — while metadata
+      # AUTHORING examples are written in YAML, so the format carrying most of
+      # what an author copies was in no gate's population at all
+      # (layout-dsl.mdx taught a phantom field-level `visible` map through two
+      # hand sweeps of the same page, #8251/#8306/#12935). Each ```yaml block
+      # tagged `os:check-yaml <schema>` is safeParsed against the LIVE spec
+      # schema it declares — resolved through the same registry
+      # `PUT /api/v1/meta/:type/:name` validates with — so a rejection here is
+      # the one a runtime save would print, rename hint included. Also prints
+      # the tagged/untagged fence census so opt-in adoption stays visible
+      # rather than becoming a permanent excuse. Reads src/ through tsx (no
+      # dist), so its place in this job is cohesion with the example-gate
+      # cluster above, not a build dependency. Self-tests first, like its
+      # neighbours.
+      - name: Check docs YAML examples parse against live spec schemas
+        run: pnpm --filter @objectstack/spec run check:yaml-examples
+
       # Same anti-drift class as the gates above, for the generated translation
       # bundles in packages/platform-objects/src/apps/translations/. Nothing
       # regenerated them either, so they rotted three ways at once (#3670):

content/docs/data-modeling/drivers.mdx

@@ -841,8 +841,10 @@ pass `persistence: 'auto'` (or `'file'`) explicitly. See
 For tests, prefer in-memory **SQLite** — `SqlDriver` with
 `connection: { filename: ':memory:' }`, or `SqliteWasmDriver({ filename: ':memory:' })`
 when you want no native build. Both give the SQL semantics production runs on;
-mingo does not enforce primary keys, uniqueness, `NOT NULL` or column types, so a
-green run against the memory driver is weaker evidence than it looks. The
+the memory driver enforces **field-level `unique`** (with the same
+per-organization scoping the SQL family applies) and nothing else — no primary
+keys, no `NOT NULL`, no column types and no object-level composite `indexes[]`
+— so a green run against it is still weaker evidence than it looks. The
 framework's own dogfood gate boots on WASM SQLite at `:memory:` for this reason.
 
 The memory driver remains fine where you want no setup at all and the assertions

content/docs/protocol/objectui/layout-dsl.mdx

@@ -224,6 +224,7 @@ All layouts use a responsive grid that divides space into 12 columns.
 
 ### Basic Grid Layout
 
+{/* os:check-yaml FormSectionSchema key=section */}
 ```yaml
 section:
   label: Contact Information
@@ -279,6 +280,7 @@ section:
 
 Grid automatically collapses on smaller screens:
 
+{/* os:check-yaml FormSectionSchema key=section */}
 ```yaml
 section:
   columns: 3  # Desktop: 3 columns, Tablet: 2 columns, Mobile: 1 column
@@ -328,6 +330,7 @@ Sections are collapsible containers for related fields.
 
 ### Basic Section
 
+{/* os:check-yaml FormSectionSchema[] key=sections */}
 ```yaml
 sections:
   - label: Contact Information
@@ -355,6 +358,7 @@ sections:
 Show sections based on field values. The key is **`visibleWhen`** and its value is a
 **CEL predicate string** — never a `{ field, value }` rule object:
 
+{/* os:check-yaml FormSectionSchema[] key=sections */}
 ```yaml
 sections:
   - label: Basic Info
@@ -468,6 +472,7 @@ strip.
 
 ### Basic Tabs
 
+{/* os:check-yaml FormViewSchema */}
 ```yaml
 type: tabbed
 tabPosition: top       # top | bottom | left | right
@@ -550,6 +555,7 @@ Breakpoint-driven show/hide and per-breakpoint layout live one tier up, on a
 ([ADR-0065](https://github.com/objectstack-ai/objectstack/blob/main/docs/adr/0065-sdui-styling-model.md)) — desktop-first buckets compiled to id-scoped CSS at
 render:
 
+{/* os:check-yaml ResponsiveStylesSchema key=responsiveStyles */}
 ```yaml
 # On a page component (*.page.ts) — NOT on a form field or a form section
 responsiveStyles:

content/docs/references/ui/view.mdx

@@ -5,8 +5,51 @@ description: View protocol schemas
 
 {/* ⚠️  AUTO-GENERATED — DO NOT EDIT. Run build-docs.ts to regenerate. Hand-written docs live in the module folders under content/docs/. */}
 
-HTTP Method Enum & HTTP Request Schema
-Migrated to [shared/http.zod.ts](/docs/references/shared/http). Re-exported here for backward compatibility.
+View protocol schemas — the `view` metadata type and its three persisted body spellings.
+
+Covers the authoring surfaces (`defineView`, `defineViewItem`), the wire
+doors Studio and the REST layer write through, and
+`ViewMetadataSchema` — the union every persisted `view` body is judged
+by.
+
+## Name grammar depends on the body spelling
+
+`ViewMetadataSchema` is a union over three persisted body shapes, and
+they do not share one `name` grammar. Which grammar applies is decided by the
+shape of the body — something an author never names explicitly — so neither
+failure direction below is discoverable from the key being written:
+
+| body spelling | recognised by | `name` is declared as | flat (undotted) name |
+|:---|:---|:---|:---|
+| standalone **ViewItem record** | a nested `config` | `ViewItemNameSchema` — `QUALIFIED_ITEM_NAME_PATTERN`, dot REQUIRED | **rejected**, located at `["name"]` |
+| flattened runtime **overlay** | an inline view config; no `config`, no container slot | `z.string().optional()` — no grammar at all | accepted |
+| `defineView` **container** | a container slot (`list` / `form` / `listViews` / `formViews`) | `z.string().optional()` on `ViewSchema` — no grammar at all | accepted, and normally IS flat |
+
+The two permissive rows are deliberate, not gaps left to tighten later:
+
+- A container's own name is the **bare object key**. ADR-0017 §3.2's
+  dual-read loader registers the aggregated container under `<object>` and
+  each expanded item under `<object>.<viewKey>`, so an object-scoped
+  container is named `crm_lead` — a name with no dot to carry.
+- An overlay's name is **stamped by the write path**, not authored:
+  `normalizeViewMetadata` puts it on every view body at the single write
+  chokepoint, and a personalization PUT inherits the identity of the entry it
+  shadows.
+
+So both of the readings an author naturally forms are wrong:
+
+- *"the dot is mandatory on every view row"* — read off
+  `ViewItemNameSchema` alone. It is not: overlay and container rows
+  accept flat names, and rows in this repo legitimately use them
+  (`case_grid`, `cases`, the container row `crm_lead`). Those rows are
+  correct as written, not defects awaiting a dotted rewrite.
+- *"flat names are fine generally"* — read off one of those flat-named rows.
+  It is not: put the same name on a standalone ViewItem record and it is
+  refused, on the one field the flat-named row told you to fill.
+
+This describes what the three shapes already do; it widens and narrows
+nothing. The one item-name grammar itself lives in
+`shared/identifiers.zod.ts` — grammar changes belong there, not here.
 
 <Callout type="info">
 **Source:** `packages/spec/src/ui/view.zod.ts`

packages/drivers/driver-memory/src/index.ts

@@ -22,6 +22,20 @@ export {
 } from './memory-tenancy-guard.js';
 export type { TenancyAwareSchema } from './memory-tenancy-guard.js';
 
+// [#13197] Field-level uniqueness — the refusal's wire identity and the
+// scoping helpers, exported so a consumer can assert the envelope (`code` AND
+// `status`, never merely "it threw") without string-matching the message.
+export {
+  UNIQUE_VIOLATION_CODE,
+  UNIQUE_VIOLATION_STATUS,
+  assertNoUniqueViolation,
+  tenantFieldOf,
+  uniqueConstraintsFromFields,
+  uniqueKeyOf,
+  uniqueViolationError,
+} from './memory-unique-constraint.js';
+export type { MemoryUniqueConstraint, UniqueAwareSchema } from './memory-unique-constraint.js';
+
 export default {
   id: 'com.objectstack.driver.memory',
   version: '1.0.0',