Merge remote-tracking branch 'origin/main' into claude/issue-16173-shard-timings-stale-cli

Author: claude

.changeset/attest-fresh-datastore-remedy-register.md

@@ -0,0 +1,28 @@
+---
+'@objectstack/platform-objects': patch
+---
+
+`attestFreshDatastore` looks its `os migrate` remedy up instead of defaulting it
+
+When a fresh datastore's own boot has already admitted a value that contradicts a
+migration's contract, that id is not attested and the operator is told what closes
+the gate on real evidence. The sentence used to be built from a two-way branch: the
+file-references id got `files-to-references`, and **every other id** got
+`value-shapes` by default.
+
+`CREATION_ATTESTED_MIGRATION_IDS` has three members. For the third —
+`adr-0030-notification-event` — that default is a wrong prescription: `os migrate
+value-shapes --apply` neither attests nor clears it, and there is no `os migrate
+notification-event` sub-command to send an operator to at all (that cut-over is an
+operator call with no self-check).
+
+The branch is now an explicit id-to-remedy register, total over the ids a
+value-shape tally can contradict. The loop asks it rather than falling into an arm,
+so an id with no value-shape contract is never-contradictable by that evidence and
+is attested on the birth observation as before. A new member therefore inherits no
+remedy: adding a third arm that happened to be right today would only have moved the
+same defect onto the fourth member.
+
+No behaviour changes for the two ADR-0104 ids, which is where every reachable path
+runs today: the shipped engine keys its admitted-violation tally from a closed
+`'media' | 'value-shape'` union, so it cannot name a third id.

.changeset/dist-freshness-declaration-stamp.md

@@ -0,0 +1,13 @@
+---
+"@objectstack/spec": patch
+---
+
+`check:api-surface` (and every other gate that reads `packages/spec/dist`) no longer refuses a dist that is exactly current because a source file's mtime moved without its bytes changing.
+
+The freshness rule shared by four gates and the pre-commit hook compares `dist/**/*.d.ts` mtimes against `src/**/*.ts` mtimes. That is the right primitive — it is the artifact those gates consume, and it sees the hand-edited dist and the toolchain change no content digest can — but it cannot tell a real edit from a rewrite that left the bytes alone. A `git merge` re-checks-out an unchanged source file and bumps its mtime; the build that follows correctly does not run, because turbo's cache hashes content, so it is a cache hit that rewrites nothing and leaves every `dist/` mtime where the previous build left it. The gate then refused a correct dist, and prescribed a full rebuild — minutes, under the shared verify lock — of an artifact that needed none.
+
+The mtime rule keeps its power to convict and gains one way to be answered. `packages/spec`'s build now records a second stamp beside the existing one, `dist/.build-input-hash-dts`, holding the same build-input digest — but written **only** by a build that actually emitted declarations, so `OS_SKIP_DTS=1` leaves it alone. When that digest equals the sources on disk, the declarations demonstrably describe them and the refusal is cleared. The evidence may only ever **acquit**: a missing, unreadable or mismatched stamp leaves the mtime verdict standing, so nothing that passed before can start failing, and the `OS_SKIP_DTS=1`-on-a-built-tree shape that ruled out `dist/.build-input-hash` for this purpose still fails, because that build never refreshes the new file.
+
+The refusal message was wrong in the same case and is now driven by what was measured: it names a real content change and prints both digests when the stamp disagrees, says plainly that there is nothing to compare against when no stamp exists, and no longer sends every reader after `OS_SKIP_DTS` regardless of cause. It also notes that a repo-wide `pnpm build` may be a cache hit that rewrites nothing, so the remedy names the package build directly.
+
+The published tarball gains one 65-byte file next to the stamp it already shipped.

.changeset/es-ja-dashboard-gap-source-parity.md

@@ -0,0 +1,25 @@
+---
+"@objectstack/platform-objects": patch
+---
+
+fix(platform-objects): the es-ES and ja-JP `dashboard.gap` help text says what its source now says
+
+`metadataForms.dashboard.fields.gap.helpText` read `Separación de cuadrícula (unidades
+Tailwind)` in es-ES and 「グリッド間隔（Tailwind 単位）」 in ja-JP. Both were faithful
+translations of the source they were extracted against, `Grid gap (Tailwind units)` — but
+that source has since been rewritten to `Space between widgets, in steps of 0.25rem
+(4 = 1rem)`, which deliberately drops the CSS framework unit an app author never chose and
+cannot act on, and adds the magnitude the author can size a dashboard with.
+
+Both leaves kept the retired vocabulary and never gained the magnitude, because bundle
+merge fills gaps only: a present-but-stale leaf is not a gap, so no amount of
+re-extraction corrects it. They now read `Espacio entre widgets, en incrementos de 0.25rem
+(4 = 1rem)` and 「ウィジェット間の間隔、0.25rem 刻み（4 = 1rem）」 — the grid framing is gone
+exactly as it is upstream, `widgets` / 「ウィジェット」 is the word each bundle already uses
+for dashboard widgets, and the conversion is carried so a Spanish- or Japanese-reading
+author can size `gap` without reading the English.
+
+Two leaves. `columns` is unchanged upstream, so `Columnas de cuadrícula (predeterminado
+12)` and 「グリッド列（既定 12）」 stay accurate, and the other 13 source-derived prose leaves
+of this subtree (5 section descriptions plus 8 further field help texts) were read against
+the current English and are accurate in both locales.

.changeset/i18n-extract-metadata-forms-flag-independence.md

@@ -0,0 +1,22 @@
+---
+"@objectstack/cli": patch
+---
+
+`os i18n extract --no-metadata-forms` is honoured whatever `--objects-only` is set to, and the Studio metadata-form baseline lands in exactly one module.
+
+The flag gated only the `<locale>.metadata-forms.generated.ts` companion. The stack module's renderer had a third mode, `kind: 'full'`, that serialised the WHOLE `TranslationData` — the baseline included — and `--no-objects-only` selected it. So the two flags stopped being independent the moment the second one was passed, in both directions:
+
+- **`--no-metadata-forms --no-objects-only`** suppressed the companion and wrote the same keys into `<locale>.objects.generated.ts` instead. Driven on a one-object, one-app stack with `i18n.defaultLocale: 'zh-CN'`: the emitted zh-CN module carried **776 leaves, of which 773 were the metadata-form baseline** the flag had just switched off (the stack's own surface is 3). Those 773 are **English** — the default locale is filled from the source labels and the metadata-form registry authors them in English — so a non-English default locale shipped the platform's English Studio strings inside its own application bundle.
+- **`--no-objects-only` alone** wrote those 773 keys **twice**, once in each module.
+
+`--objects-only` picks the stack module's sub-tree; `--metadata-forms` decides whether the baseline is emitted at all, and it is now the only control over it **on both faces**. Both flags keep exactly the meaning their `--help` already gave them, and nothing here picks a winner between them — the overlap was in the emitter, never in the two meanings.
+
+`'full'` is renamed `'stack'` and omits `metadataForms`, so the module a run writes and the baseline companion beside it are disjoint, and under `'stack'` the two together are everything the extractor built (3 + 773 = 776 on the fixture above — the extractor's own count, none dropped, none duplicated). ⚠️ That is a statement about the PAIR a run emits, not about "three kinds partitioning the leaves": `'objects'` is a sub-selection of `'stack'`, not a sibling of it.
+
+`--json`, documented as "output JSON instead of writing files", mirrors that file set: `bundles` is the stack module and a `metadataForms` map is the companion, keyed by the locales whose companion would be written and gated by the same predicate. That map is new. It exists because the first cut of this change stopped the fold on the `--json` face as well and left the baseline with no JSON home at all — measured, `--json --no-objects-only` with the flag ON and with `--no-metadata-forms` returned payloads equal in every field but `duration`, so on that face the flag decided nothing, the mirror image of the defect this card reports. `metadataFormsCounts` reports the baseline's size in every run, as before.
+
+**No bundle in this repository moves.** All nine extract configs run under the default `--objects-only`, whose emitted module, export name and type signature are byte-for-byte unchanged — `pnpm check:i18n` stays green on the committed tree. A stack that DOES pass `--no-objects-only` regenerates a smaller `<locale>.objects.generated.ts`: its export keeps its name and narrows from `TranslationData` to `Omit<TranslationData, 'metadataForms'>`, and the baseline it used to duplicate is in the companion beside it unless `--no-metadata-forms` says it should not be there at all.
+
+**What content moves where.** On the file face nothing published loses content: under the default `--objects-only` the output is byte-identical, and under `--no-objects-only` the baseline moves out of the stack module into the companion the same command already writes — unless `--no-metadata-forms` says it should not exist, which is the ask. On the `--json` face the baseline moves from inside `bundles` to its own top-level key, and under `--no-metadata-forms` it is now absent, which it never was before: that face did not honour the flag at all.
+
+The regression pin spawns the real CLI and takes a group census of the bytes it wrote, and drives `--json` in BOTH flag states. The one-state version of that case could not have failed on the axis that failed here — a pin that exercises only the flag-OFF path can never detect a flag that does nothing. The sibling pin that mirrors the emit rule and checks file NAMES stayed green through all of this: the file set was right in every combination, and only the content was wrong.

.changeset/seed-apply-read-back-decorations.md

@@ -0,0 +1,13 @@
+---
+"@objectstack/runtime": patch
+---
+
+The package-publish door's route-level seed apply can consume the platform's own read-back envelope again.
+
+`POST /packages/:id/publish-drafts` reads each just-published `seed` body back through `protocol.getMetaItem` before handing it to the seed loader. That read exits through `decorateMetadataItem`, which stamps `_diagnostics` on every body whose metadata type has a registered schema — `seed` has one — and `SeedSchema` has been closed since protocol 17. So the door refused the document it had just been served: `unrecognized_keys: ["_diagnostics"]`, minted as a 422 and delivered on a **200** as `seedApplied.error`. Zero rows loaded, and the author was told their seed body failed spec validation when nothing about it was wrong.
+
+The read-back is now passed through `stripReadDecorations` at the unwrap — the same helper, for the same reason, that the dataset query, the cold-boot flow bind and `saveMetaItem`'s verbatim persist already call. `METADATA_READ_DECORATIONS` is the declared list of keys the read path derives from a document and attaches to the *response*, so removing them restores the document the author actually wrote.
+
+Nothing is widened to accept them: `SeedLoaderRequestSchema` stays closed, and the publish response keeps its declared shape. The strip is deliberately **not** a blanket `startsWith('_')` sweep — the ADR-0010 protection envelope (`_packageId`, `_provenance`, …) is not a read decoration, and the metadata schemas allowlist it precisely so a served document keeps its provenance when it is parsed again.
+
+Only protocols that do not self-apply seeds inside `publishPackageDrafts` reach this path; the shipping protocol self-applies and was never affected.

.claude/skills/pm-dispatch/references/lanes/triage.md

@@ -0,0 +1,7 @@
+# 席位章程:分诊席(Triage)
+
+见 SKILL.md 〈分诊座位职责〉;本文是本席的岗位说明,现值状态恒在座位贴,⛔ 不迁入本文。
+
+- 分诊每 fire 只取一个仓,两仓轮替:objectstack、objectui、objectstack……;仓内按最旧优先。
+- 饥饿守卫:轮次开始时任一仓最旧未路由卡超过 4 小时,该仓本轮优先,不论轮到谁。
+- ⛔ 不回退到跨仓全局最旧优先;⛔ 不因积压增设第二分诊席或改 fire 频率。

content/docs/permissions/system-context.mdx

@@ -160,10 +160,10 @@ The largest single consumer — **17 of the 105 sites**.
 | 49 | Action `requiredPermissions` bypassed | runtime | Get: engine self-invocation runs any action | `action-execution.ts:401` |
 | 50 | `manage_metadata` bypassed on metadata writes | runtime, rest | Get: schema writes without the capability | `domains/meta.ts:471`, `:874`, `rest-server.ts:5319`, `:6766`, `:7014`, `:7445`, `:7638` |
 | 51 | The shared metadata-write verdict itself returns `allowed` | metadata-core | Get: the one function all of row 50's doors consult answers yes before any capability is examined | `meta-write-capability.ts:134` |
-| 52 | Anonymous-deny seam satisfied on the domain dispatchers and the package/federation routes | runtime, rest | Get: passes with no `userId` | `domains/actions.ts:421`, `domains/ai.ts:60`, `domains/automation.ts:989`, `domains/meta.ts:232`, `domains/security.ts:78`, `domains/packages.ts:543`, `external-datasource-routes.ts:302`, `package-routes.ts:97` |
+| 52 | Anonymous-deny seam satisfied on the domain dispatchers and the package/federation routes | runtime, rest | Get: passes with no `userId` | `domains/actions.ts:421`, `domains/ai.ts:60`, `domains/automation.ts:989`, `domains/meta.ts:232`, `domains/security.ts:78`, `domains/packages.ts:552`, `external-datasource-routes.ts:302`, `package-routes.ts:97` |
 | 53 | MCP principal check satisfied | runtime | Get: MCP surface reachable with no user | `domains/mcp.ts:61` |
 | 54 | Package REST route capability gate bypassed | rest | Get: package read/write over REST without `manage_metadata` / `studio.access` / `setup.access` | `package-routes.ts:102` |
-| 55 | Package domain capability gates bypassed | runtime | Get: package management and package-inventory reads without the capability | `domains/packages.ts:241`, `:274` |
+| 55 | Package domain capability gates bypassed | runtime | Get: package management and package-inventory reads without the capability | `domains/packages.ts:250`, `:283` |
 | 56 | Activation write / authoring refusals do not fire | runtime | Get: activation artifacts writable and authorable without the activation-authoring capability | `activation-gate.ts:138`, `:189` |
 | 57 | Automation run-state read, flow-authoring write and unrelated-screen read all pass | runtime | Get: run state, flow writes and screen reads with no grant | `domains/automation.ts:254`, `:545`, `:635` |
 | 58 | Audience-binding suggestion recording skipped | plugin-security | Lose: install-time suggestions are not recorded for system callers | `suggested-audience-bindings.ts:703` |

packages/cli/src/commands/i18n/extract.ts

@@ -21,6 +21,7 @@ import {
   extractTranslations,
   renderTranslationModule,
   renderSourceHashModule,
+  stackAuthoredSubtree,
   parseSourceHashModule,
   narrowToCommittedSections,
   type FillStrategy,
@@ -87,13 +88,14 @@ export default class I18nExtract extends Command {
       default: false,
     }),
     'objects-only': Flags.boolean({
-      description: 'Emit only the objects/globalActions subtree (default). Disable to include apps/dashboards.',
+      description:
+        'Emit only the objects/globalActions subtree (default). Disable to include apps/dashboards. Never carries the Studio metadata-form baseline either way — that is --metadata-forms, which writes it to its own file.',
       default: true,
       allowNo: true,
     }),
     'metadata-forms': Flags.boolean({
       description:
-        'Also write <locale>.metadata-forms.generated.ts for the Studio metadata-form baseline (default). Pass --no-metadata-forms in a package that owns only its own objects — that baseline belongs to one package, not every plugin.',
+        'Also write <locale>.metadata-forms.generated.ts for the Studio metadata-form baseline (default). Pass --no-metadata-forms in a package that owns only its own objects — that baseline belongs to one package, not every plugin. This is the only control over it: no other flag emits or suppresses that baseline.',
       default: true,
       allowNo: true,
     }),
@@ -197,6 +199,16 @@ export default class I18nExtract extends Command {
       // only its own objects passes `--no-metadata-forms`; without it, `--check`
       // demands a baseline copy the package deliberately does not commit and
       // fails on a tree that is in fact in sync.
+      //
+      // ⚠️ That orthogonality was a claim this file made and did not keep
+      // (#14894). It held only while `--objects-only` was in effect: under
+      // `--no-objects-only` the renderer's `kind: 'full'` folded the baseline
+      // into the objects module, so `--no-metadata-forms` suppressed a copy
+      // that was still being written next door — and with the flag left on,
+      // both copies were written. This predicate is now the ONLY thing that
+      // decides whether the baseline is emitted, because the stack module no
+      // longer carries it (`stackAuthoredSubtree`). Nothing here picks a winner
+      // between the two flags; there is no longer anything for them to contest.
       const emitsMetadataForms = (locale: string): boolean =>
         flags['metadata-forms'] && (metadataFormsCounts[locale] ?? 0) > 0;
 
@@ -251,9 +263,42 @@ export default class I18nExtract extends Command {
           totalExpected: result.totalExpected,
           counts: result.counts,
           metadataFormsCounts,
-          bundles: objectsOnly
-            ? Object.fromEntries(localesEmitted.map((l) => [l, result.bundles[l].objects ?? {}]))
-            : result.bundles,
+          // `--json` is documented as "output JSON instead of writing files",
+          // so this payload mirrors the FILE SET: `bundles` is the stack
+          // module, `metadataForms` below is the companion (#14894).
+          bundles: Object.fromEntries(
+            localesEmitted.map((l) => [
+              l,
+              objectsOnly ? (result.bundles[l].objects ?? {}) : stackAuthoredSubtree(result.bundles[l]),
+            ]),
+          ),
+          // The baseline's JSON home, gated by {@link emitsMetadataForms} —
+          // the SAME predicate that decides the companion file, deliberately
+          // not a second one.
+          //
+          // ⚠️ Two predicates is what the review of this card's first commit
+          // caught, and the reading is worth keeping: that commit stopped the
+          // `kind: 'full'` fold on this face too, and left the baseline with no
+          // JSON home at all. Driven on a one-object, one-app stack with
+          // `defaultLocale: 'zh-CN'`, `--json --no-objects-only` with the flag
+          // ON and with `--no-metadata-forms` produced payloads that were equal
+          // in every field but `duration` — 3 leaves in `bundles`, no baseline
+          // in either, and `metadataFormsCounts` reporting 773 in both. So on
+          // this face the flag decided NOTHING, in the opposite direction from
+          // the defect the card reported (where it was the fold that ignored
+          // it). A flag that is ignored is a flag that is ignored, whichever
+          // way the output falls.
+          //
+          // Keyed by locale and PRESENT ONLY for the locales whose companion is
+          // written, so the key set here and the `*.metadata-forms.generated.ts`
+          // set are the same set by construction. The map itself is always
+          // emitted — an empty map says "no baseline in this run", which is a
+          // reading; a missing key would be indistinguishable from an older CLI.
+          metadataForms: Object.fromEntries(
+            localesEmitted
+              .filter((l) => emitsMetadataForms(l))
+              .map((l) => [l, result.bundles[l].metadataForms ?? {}]),
+          ),
           duration: timer.elapsed(),
         });
         return;