Merge remote-tracking branch 'origin/main' into claude/issue-16608-insert-check-post-image

Author: claude

.changeset/empty-generator-refusal-separator.md

@@ -0,0 +1,20 @@
+---
+'@objectstack/cli': patch
+---
+
+`os lint --eval --generator ""` no longer prints a double space in its refusal.
+
+`bundle-require` composes its own refusal as `<filepath> is not a valid JS file`, so an
+empty filepath contributes no characters and that fragment arrives with a leading space —
+which landed against the space in our own `": "` separator:
+
+```
+Failed to load generator "":  is not a valid JS file      # before, both faces
+Failed to load generator "": is not a valid JS file       # after
+```
+
+The composed message now drops leading spaces from the detail, so the separator carries
+exactly one. The empty string still answers through the same door an unresolvable path
+answers through — same `catch`, same exit code 1, same one-key `{error}` document on the
+`--json` face — and every refusal whose detail does not open with a space is byte-identical,
+the unresolvable-path case included.

.changeset/i18n-extract-companion-accompanies-a-module.md

@@ -0,0 +1,14 @@
+---
+"@objectstack/cli": patch
+---
+
+`os i18n extract --source-hashes` no longer writes a provenance companion with no bundle module beside it, and names the sections it commits from the payloads those modules hold instead of from two literals.
+
+The command narrows the provenance table to "the sections this run commits" before writing `<locale>.source-hashes.generated.ts`. The half that decided WHICH modules were emitted already read the emitted set; the half that named them pushed the string `'objects'` or `'metadataForms'`.
+
+- **A zero-record orphan is no longer written.** With no module emitted for a locale — a stack whose only surface is apps, under the default `--objects-only` with `--no-metadata-forms` — the committed-section list is empty, `narrowToCommittedSections` returns `{}`, and `{}` is truthy at the emit gate. The run therefore wrote one file holding an empty table, describing nothing, with no bundle module beside it for it to be about. Because `--check` compares the companion by bytes like any other emitted file, that orphan once committed is a file the gate demands forever: deleting it made `--check` report `missing` and exit 1. Such a run now writes nothing, and reports `Generated 0 file(s)`.
+- **The section list is derived.** `translationModuleSections(bundle, kind)` sits beside `translationModulePayload` and is switched on the same `kind`, so what a module holds and which sections it commits are one decision rather than two. Under `kind: 'stack'` the module holds every group the stack authors and the caller now names all of them; a group added later needs no edit, and a further aggregate kind fails to compile at that one site rather than silently committing its own name as a section.
+
+**No provenance record changes in this repository, and none is restored.** The generated tables only ever carry the two sections `collectFilledFromHashes` walks (`objects` and `metadataForms`), so `'objects'` was the right name for both stack sub-tree modes — the old list was correct by coincidence, not by construction. In particular an `apps.*` record is not restored by this change: no such record is built, so none was being filtered out.
+
+**Already committed an empty companion?** Nothing needs doing and nothing is deleted. `--check` compares only the files a run writes and reports `missing` / `stale` over that set, so a leftover empty companion is in neither category — it is tolerated where it sits, and is inert to the next extract, which reads it back as an empty record set exactly as it would read its absence. Delete it at your convenience.

.changeset/ready-signal-reports-degraded-boot.md

@@ -0,0 +1,12 @@
+---
+"@objectstack/core": patch
+"@objectstack/cli": patch
+---
+
+The `Server is ready` line now reports the degraded boot it is standing on, instead of printing a green `✓` over it.
+
+`✓ Server is ready` and the kernel's `System started with degraded capabilities. Missing core services: …` were two statements about one boot, produced by two packages — the banner in `@objectstack/cli`, the conclusion in `@objectstack/core` — with **no data path between them**. So the ready signal did not depend on the thing that broke, and therefore could not report it. Measured twice within a day, from unrelated causes: an objectui CI boot where the auth plugin failed and not one `sys_*` table existed, and this repo's own weekly registry canary on the published `npx create-objectstack@latest` on-ramp, where the tick printed directly **above** four boot warnings. In the second case the ready line carried no weight in the job's verdict at all — it was present, green, wrong, and believed by nobody.
+
+- **The data path.** `ObjectKernel.validateSystemRequirements()` now publishes the list it had already computed — the same array behind its own warning — on the kernel's service registry, which is the seam boot facts already cross to reach the banner (`serve` reads `auth` and `seed-summary` off it the same way). No member and no type is added to `@objectstack/core`'s public surface, and nothing re-derives which services count as `core`: that judgement stays in `ServiceRequirementDef` alone.
+- **The line.** On a degraded boot the banner prints `⚠ Server is ready — DEGRADED: missing core services: <names>`, naming exactly what the kernel found missing. On a healthy boot the ready block is byte-for-byte unchanged, so an ordinary boot's output does not move.
+- **Readiness is NOT made strict.** Nothing about what boots, binds, or exits changes. A machine deliberately running without auth still starts, still prints ready, and still exits 0 — the line just says what state it is ready in.

.changeset/stack-refusal-envelopes.md

@@ -25,4 +25,4 @@ Not narrowed: `defineStack` accepts and refuses exactly the inputs it did before
 
 **Why `minor`, not the `patch` the #14552 precedent took.** Six new `STACK_*` spellings ship in `packages/spec/dist/index.js` and `dist/index.mjs`; nothing reaches `.d.ts`, but once shipped a consumer's `catch (e) { switch (e.code) … }` depends on them and they cannot be renamed without breaking it. That is a purely additive widening of a published package's public surface, and the maintainer ruling of 2026-09-04 (decision batch #35, on #15294) requires at least `minor` for it: the commit type may raise a bump but never lower it below what the act requires, so a `fix(` that widens the surface is `minor`. The `patch` precedent is pre-rule; this level is required by that ruling, not chosen by taste.
 
-`@objectstack/runtime` carries one classification row per new code in the dispatcher error-code vocabulary (`door: 'none'`, `verdict: 'boot-refusal'` — the measured verdict), which `pnpm check:dispatcher-error-vocabulary` enforces in both directions.
+`@objectstack/runtime` carried one classification row per new code in the dispatcher error-code vocabulary (`door: 'none'`, `verdict: 'boot-refusal'` — the measured verdict) when this changeset was written, and carries none now: the same #16449 (PR #16652) landing that registered the seven codes ratcheted all seven rows back out of `packages/runtime/src/dispatcher-error-vocabulary.ts`, because a registered code drops out of that gate's scan and the reachability each row recorded now lives on its ledger row. `pnpm check:dispatcher-error-vocabulary` still reconciles sites and rows in both directions, and under the same ruling it now refuses any verdict but `foreign-vocabulary` / `runtime-pinned` for a stamp site under `packages/spec/src/**` — so these seven cannot take a `boot-refusal` row again.

.github/workflows/ci.yml

@@ -464,6 +464,70 @@ jobs:
           echo 'Items on this shard (a package name, or a package plus a k/n file-level slice):'
           cat "$RUNNER_TEMP/shard-packages.txt"
 
+      # ⛔ A FILE-LEVEL SLICE BUILDS ITS DEPENDENCY CLOSURE HERE, IN A RUN THAT
+      # CARRIES NO PASSTHROUGH, so that the sharded run in the next step can be
+      # `--only` (#16395).
+      #
+      # Turbo folds a run-level passthrough into the hash of EVERY task in the
+      # run, not only the task that receives it -- and `-- "--shard=k/n"` is the
+      # whole reason a slice gets its own invocation at all (the next step's
+      # comment says why it cannot ride the shared run). Measured on turbo
+      # 2.10.10, `--filter=@objectstack/cli`, `turbo run test ... --dry=json`
+      # (60 tasks: 59 `build` + 1 `test`):
+      #
+      #   plain vs plain             60 identical,  0 changed   <- control, fires
+      #   plain vs -- --shard=1/2     0 identical, 60 changed
+      #   --shard=1/2 vs 2/2          0 identical, 60 changed
+      #
+      # So the sliced leg could hit NEITHER the main-seeded Turbo cache restored
+      # above NOR the builds the shared leg ran seconds earlier in the SAME job:
+      # it re-executed the closure every run, and shards 5/6 and 6/6 -- the two
+      # that carry a slice -- paid that closure twice per job. Live reading,
+      # `Test Core (5/6)` of run 34193080219 (a `packages/spec` PR, so the
+      # affected set reaches cli): the slice leg reported
+      # `Cached: 2 cached, 58 total` / `Time: 9m18.941s` while
+      # `@objectstack/cli:test` itself measured `Duration 187.49s` -- six of those
+      # nine minutes were the duplicate rebuild, on a job that was then standing
+      # against a 30-minute wall (#16395's measurement).
+      #
+      # `turbo run build --filter=$PKG` is that closure and nothing more:
+      # measured 59 build tasks, all 59 hash-IDENTICAL to the ones in the
+      # passthrough-free test plan (0 differing, 0 extra, and 0 missing against
+      # the test's own `^build` closure), so they REPLAY rather than re-execute.
+      # `--filter=...^$PKG` was measured too and schedules 12 packages this
+      # closure does not need. Locally, back-to-back invocations of this exact
+      # command measured `57 cached, 57 total` / `Time: 153ms >>> FULL TURBO` on
+      # the second, against `5 cached, 57 total` / `3m45.918s` on the first.
+      #
+      # ⚠ THIS IS ITS OWN STEP, not a second guarded run inside the step below,
+      # because a guarded SITE is the triple (file, job, step) --
+      # `measure-stall-guard-headroom` REFUSES to report a verdict when two
+      # guarded runs share one, and refusing is right: the two would be judged
+      # against the worst reading of their union. `pnpm check:stall-guard-budget`
+      # and `pnpm check:stall-guard-headroom` both read this step, so it keeps
+      # its own `--stall-minutes` and its own headroom row.
+      #
+      # A shard with no slice runs zero iterations here; every shard still
+      # reaches the step, so its name is a stable site for those two gates.
+      - name: Build the sliced package's dependency closure
+        env:
+          NODE_OPTIONS: --report-on-signal --report-signal=SIGUSR2 --report-directory=${{ runner.temp }}/stall-reports
+        run: |
+          if [ ! -s "$RUNNER_TEMP/shard-packages.txt" ]; then
+            echo "No packages on this shard — nothing to build."
+            exit 0
+          fi
+          mkdir -p "$RUNNER_TEMP/stall-reports"
+          while read -r PKG SLICE; do
+            [ -n "$PKG" ] || continue
+            [ -n "$SLICE" ] || continue
+            echo "Slice $PKG=$SLICE — building its dependency closure with no passthrough."
+            LOG="$RUNNER_TEMP/test-core-slice-build-$(printf '%s' "$PKG" | tr -c 'A-Za-z0-9' '-').log"
+            node scripts/run-with-stall-guard.mjs --log "$LOG" --stall-minutes 10 \
+              --report-dir "$RUNNER_TEMP/stall-reports" -- \
+              pnpm turbo run build "--filter=$PKG" --concurrency=4 --log-order=stream
+          done < "$RUNNER_TEMP/shard-packages.txt"
+
       # --concurrency=4: turbo's default (10) oversubscribes the 4-vCPU
       # hosted runner; matching the core count bounds peak memory and the
       # job is CPU-bound anyway.
@@ -571,7 +635,15 @@ jobs:
               PKG="${LEG%%=*}"
               SLICE="${LEG#*=}"
               LOG="$RUNNER_TEMP/test-core-slice-$(printf '%s' "$PKG" | tr -c 'A-Za-z0-9' '-').log"
-              set -- pnpm turbo run test "--filter=$PKG" --concurrency=4 --summarize --log-order=stream -- "--shard=$SLICE"
+              # `--only` (#16395): the step above already built this slice's
+              # dependency closure in a passthrough-free run, so this run must
+              # schedule the ONE task the passthrough is for. Without it turbo
+              # re-hashes the whole `^build` closure under `--shard=k/n` and
+              # rebuilds it -- that comment carries the measurement. ⚠ The build
+              # step is load-bearing for this flag: a sliced package whose build
+              # never ran fails LOUDLY here (its imports resolve to a missing
+              # dist), never as a silent green.
+              set -- pnpm turbo run test "--filter=$PKG" --only --concurrency=4 --summarize --log-order=stream -- "--shard=$SLICE"
             fi
             LOGS="$LOGS $LOG"
             node scripts/run-with-stall-guard.mjs --log "$LOG" --stall-minutes 10 \

packages/cli/src/commands/i18n/extract.ts

@@ -24,6 +24,7 @@ import {
   parseSourceHashModule,
   narrowToCommittedSections,
   translationModulePayload,
+  translationModuleSections,
   countTranslationLeaves,
   type FillStrategy,
   type TranslationModuleKind,
@@ -448,15 +449,44 @@ export default class I18nExtract extends Command {
        * bundle files — {@link emittedModules} — never by a second rule. A set that commits both —
        * `platform-objects` is the one today — keeps every record it had. The
        * narrowing itself is `narrowToCommittedSections`, a pure function in the
-       * extractor's utils so it can be pinned without driving oclif; this layer
-       * contributes only the two booleans it alone knows.
+       * extractor's utils so it can be pinned without driving oclif.
+       *
+       * ⭐ And the sections are read off the PAYLOADS those modules hold
+       * (`translationModuleSections`), not written here as literals. This layer
+       * used to push `'objects'` and `'metadataForms'` — the emitted-module half
+       * already read `emittedModules`, but what it pushed was a hand-copied
+       * name, so under `kind: 'stack'` it named one of the several groups the
+       * module actually commits. Nothing in this repository's provenance tables
+       * is filtered by that mismatch today, because the tables only ever carry
+       * the two GENERATED sections (`GENERATED_SECTIONS` in
+       * `@objectstack/platform-objects`), and `'objects'` is the right name for
+       * both stack kinds — the list was correct by COINCIDENCE, not by
+       * construction, and a third generated section would have broken it
+       * silently. It is now derived.
+       *
+       * ⭐ Returning `undefined` when nothing is committed is the second half,
+       * and it is a file-set decision rather than a narrowing one:
+       * `narrowToCommittedSections` returns `{}` for an empty section set, `{}`
+       * is truthy at the emit site, and the run therefore wrote a zero-record
+       * companion with NO bundle module beside it for it to be about. `--check`
+       * compares the companion by bytes like any other emitted file, so that
+       * orphan, once committed, is a file the gate demands forever.
        */
       const committedSourceHashes = (locale: string): Record<string, string> | undefined => {
         const table = result.sourceHashes[locale];
         if (!table) return undefined;
-        const committed: string[] = [];
-        if (emittedModules(locale).some((m) => m.kind !== 'metadataForms')) committed.push('objects');
-        if (emittedModules(locale).some((m) => m.kind === 'metadataForms')) committed.push('metadataForms');
+        const committed = new Set<string>();
+        for (const mod of emittedModules(locale)) {
+          for (const section of translationModuleSections(result.bundles[locale], mod.kind)) {
+            committed.add(section);
+          }
+        }
+        // No module is committed for this locale, so there is nothing beside a
+        // companion for it to be ABOUT — and an orphan is worse than nothing:
+        // `--check` compares by bytes against the emitted list, so a zero-record
+        // companion written once is a file the gate demands forever. `{}` is
+        // truthy, so returning the narrowed table here wrote exactly that.
+        if (committed.size === 0) return undefined;
         return narrowToCommittedSections(table, committed);
       };
 

packages/cli/src/commands/lint.ts

@@ -1022,7 +1022,34 @@ export default class Lint extends Command {
         }
         generate = fn;
       } catch (error: any) {
-        const msg = `Failed to load generator "${flags.generator}": ${error?.message || error}`;
+        // [#16359] Our separator `": "` already carries the ONE space between
+        // the quoted value and the reason; the detail must not bring a second.
+        // `bundle-require` composes its own refusal as
+        // `${filepath} is not a valid JS file`, so an EMPTY filepath
+        // contributes no characters and that fragment arrives with a LEADING
+        // space, which lands against ours. Re-driven at 923caede80 through
+        // `od -c`, both faces, `bin/run-dev.js`, `NO_COLOR=1`:
+        //
+        //   os lint --eval        --generator ""   -> `generator "":  is not a valid JS file`
+        //   os lint --eval --json --generator ""   -> the same two spaces inside `{error}`
+        //   os lint --eval [--json] --generator <unresolvable path>  -> ONE space
+        //
+        // ⛔ This is NOT a branch on the empty value. #16161 ruled that the
+        // empty string must answer through the door an unresolvable path
+        // already answers through, and a bespoke message for it would be the
+        // second refusal shape that card exists to avoid. The normalisation
+        // below reads the SEAM and never `flags.generator`, and applies to
+        // every detail alike — so both inputs still reach this one `catch`,
+        // this one composition, this one envelope and this one exit code, and
+        // every detail that does not open with a space is byte-identical.
+        //
+        // Leading SPACES only, deliberately not `trimStart()`: a detail that
+        // opens with a newline is a different shape (our space then a line
+        // break), not a doubled separator, and stays exactly as it prints
+        // today. `test/lint-eval-generator-refusal-separator.test.ts` pins the
+        // bytes on both faces, with the unresolvable path as the control.
+        const detail = `${error?.message || error}`.replace(/^ +/, '');
+        const msg = `Failed to load generator "${flags.generator}": ${detail}`;
         // [#15549] The ADR-0112 carriers, spread from the SAME helper the
         // project-lint catch-all in `run()` uses — not a second shape invented
         // here. Before this, the `catch` built `msg` and DISCARDED `error`, so