Merge remote-tracking branch 'origin/main' into claude/issue-14849-approval-error-wire-code-pins

Author: claude

.changeset/advisory-boot-path-aggregation.md

@@ -0,0 +1,16 @@
+---
+"@objectstack/core": minor
+"@objectstack/objectql": minor
+"@objectstack/metadata-protocol": minor
+---
+
+Advisory validation rules no longer flood the startup log, and no longer count a row twice on a clean first boot.
+
+A `severity: 'warning'` (or `'info'`) validation rule is advisory: it never blocks a write, and its message is written for a person filling in a form. Evaluated across a seed load it produced one `WARN` line per row, so a clean-database first boot opened with a wall of form hints re-cast as boot diagnostics — and an app could reach "zero warnings" only by bending its data or deleting the rule.
+
+Two changes, and neither moves what a rule evaluates to:
+
+- **Aggregated reporting on the seed/boot path.** `SeedLoaderService.load()` now runs inside an advisory aggregation scope, and reports one summary line per rule — the rule, the object, the row count, the rule's own message and example rows — instead of one line per row. Off that path (an ordinary interactive write) nothing changes: the same per-write line is emitted verbatim. The new scope is `runWithAdvisoryAggregation` / `recordAdvisoryHit` in `@objectstack/core`.
+- **Advisory rules are counted by row, not by write.** An `update` whose payload touches only platform-injected system columns — the shape `claimSeedOwnership` writes when it hands seeded rows to the first admin, `{ owner_id }` — changes no business field, so it no longer re-evaluates the object's advisory rules. Previously a seeded row rang once on insert and again when the claim scan rewrote `owner_id`, so anyone counting startup warnings over-estimated by the number of claimed objects.
+
+`error`-severity rules are untouched by both changes: an invariant is still enforced on every write, whoever issued it and however little it moved. Membership of the "system column" set is resolved per object by `resolveInjectedSystemColumns`, so an object that declares `ownership: 'org'` (no `owner_id`) or `systemFields: false` is judged on its own columns rather than a fixed list.

.changeset/assembled-package-body-plugins-envelope.md

@@ -0,0 +1,59 @@
+---
+"@objectstack/spec": minor
+---
+
+feat(spec)!: `plugins` / `devPlugins` are artifact envelope keys — excluded from the assembled package body and refused inside `packages[]` (#15219)
+
+<!-- adr-0087: registered assembled-package-body-plugins-envelope -->
+
+**BREAKING** accept-set narrowing on `AssembledPackageBodySchema` — the body
+under `packages[i].manifest` of a release artifact (ADR-0130 D4): a body that
+carries `plugins` or `devPlugins` is now **refused** at the manifest's strict
+close (`unrecognized_keys`, naming the key), where it used to parse. Shipped as
+`minor` under the repo's launch-window convention for breaking changes; the
+hand-migration prescription is registered under protocol major 18. Maintainer
+ruling 2026-09-04 on #15219 (director decision batch #32, verbatim 「同意」):
+option A for both keys.
+
+`plugins` and `devPlugins` were members of the assembled-body key set by the
+same derivation every other collection uses (`COMPOSE_KEY_DISPOSITIONS` gives
+both `concat`). They are the only members whose values are **runtime assembly
+instructions** rather than serialisable metadata: `plugins` holds what a host
+hands to `kernel.use()` — live plugin instances, manifests or package names —
+and `devPlugins` is the `os dev` load list. Inside an artifact a package body
+is inert JSON, so a plugin under `packages[i].manifest` could never be
+constructed by a loader; every reader reads the top level. The classification
+is corrected rather than special-cased: an artifact carries metadata, a host
+assembles plugins.
+
+**What changes** (`packages/spec/src/stack.zod.ts`):
+
+- `plugins` / `devPlugins` are **envelope keys** — top level only, never inside
+  `packages[]`. `ASSEMBLED_PACKAGE_BODY_ENVELOPE_KEYS` (`packages`, `plugins`,
+  `devPlugins`) is declared once and feeds both the `AssembledPackageBodyKey`
+  derivation and `assembledPackageBodyShape()`.
+- Both keys stay `concat`: a live stack still concatenates its plugins to the
+  top level under `composeStacks`, and `manifest: 'preserve'` no longer folds
+  them into any package body.
+- The two declarations on the stack schema are unchanged.
+
+**What does NOT change:** `os serve` / `os migrate` / `os dev` keep reading the
+top level (now correct by construction); no CLI, core or runtime code moves.
+
+## FROM → TO
+
+```ts
+// before — a package body inside an artifact could carry plugins nobody could load
+{ packages: [{ manifest: { id: 'com.example.crm', /* … */ plugins: [{ name: 'plugin.x' }] } }] }
+
+// after — plugins live on the artifact envelope only; the body above is refused:
+//   packages.0.manifest: unrecognized_keys ['plugins']
+{ plugins: [new CrmPlugin()], packages: [{ manifest: { id: 'com.example.crm', /* … */ } }] }
+```
+
+**Migration.** Declare `plugins` / `devPlugins` at the stack top level and
+delete them from every `packages[i].manifest`. An existing multi-package
+artifact that carries `packages[i].manifest.plugins` (if `os build` ever wrote
+one — not directly measured) is refused on load after this change and must be
+rebuilt from source; a hand-written `packages[]` entry drops the keys. Stacks
+that only ever declared the two keys at the top level parse byte-identically.

.changeset/flow-action-record-load-signal.md

@@ -0,0 +1,43 @@
+---
+"@objectstack/runtime": minor
+"@objectstack/spec": patch
+---
+
+feat(runtime): a flow action's run context now carries `recordLoadDenied` (#15168)
+
+The previous release declared `AutomationContext.recordLoadDenied?: true` and
+said so plainly: **declared, not yet populated on the flow face.** The
+script/body face of both action doors emitted the signal, but
+`dispatchFlowAction` handed `automation.execute` a context without it, so a
+`runAs: 'system'` flow that guarded on the documented key was inert — never
+`true`, never wrong, and indistinguishable from a flow whose caller could read
+the row.
+
+**This release populates it, on both doors in one stroke** — REST
+`POST /api/v1/actions/...` and the MCP `run_action` bridge:
+
+```js
+// a runAs:'system' flow, guarding before it acts on the subject row
+if (context.recordLoadDenied === true) { /* the invoker cannot read this row */ }
+```
+
+- **The exact producer shape, unchanged.** The one shared producer
+  (`loadActionSubjectRecord` → `actionRecordLoadSignal`) already returns
+  `{ recordLoadDenied?: true }`, and the flow door now spreads it as a
+  **sibling of `record`** — never a key on the record, and **absent**, never
+  `false`, when nothing was refused. So a flow reads it exactly as a handler
+  does, `recordLoadDenied === true`.
+- **Both doors, structurally.** `dispatchFlowAction`'s wiring now takes the
+  load OUTCOME (`subject`) instead of a bare `record`, and derives both the
+  record and the signal from it. A caller can no longer forward the row while
+  dropping the verdict that says the caller could not read it — the omission is
+  a compile error rather than a guard silently inert one door over, which is
+  the defect the handler-face signal was filed for.
+- **Purely additive.** Nothing is refused that was not refused before, no
+  existing key changes value, and the `recordId` stamp is deliberately kept:
+  `record.id` still arrives exactly as it did, which is why the flag — and not
+  `record.id` — is the authorization predicate. Whether the automation engine
+  *acts* on the key (a flow-level refusal, a step condition) is a separate
+  decision and is deliberately not part of this change.
+- **`@objectstack/spec` (docs only).** The contract's "not yet populated on the
+  flow face" sentence is retired; no type changes.

.changeset/objectql-boot-loop-refuses-divergent-view-name.md

@@ -0,0 +1,48 @@
+---
+"@objectstack/objectql": minor
+---
+
+fix(objectql): the boot loop refuses a view container whose `name` disagrees with the object it binds to, instead of silently rewriting the author's field (#14666)
+
+**BREAKING** accept-set narrowing on the ObjectQL boot loop's SOURCE registrar
+(`registerMetadataCollections`), shipped as `minor` under the repo's
+launch-window convention for breaking changes. Ruled on #14666 (2026-09-03,
+direction 2).
+
+An aggregated `defineView` container is keyed by the OBJECT it binds to, not
+by its own row identity, and `ViewSchema` declares an optional `name` whose
+own description says that for an object-scoped container it *is* the object
+name. Nothing enforced that. A container written as
+`{ name: 'lead_views', object: 'crm_lead', list: { ... } }` therefore reached
+the two SOURCE registrars and got opposite answers: this boot loop overwrote
+`name` with the derived key `crm_lead` and registered it, discarding the
+author's field with no diagnostic, while the artifact/HMR loader
+(`MetadataPlugin._parseAndRegisterArtifact`) refused the whole artifact load
+through `assertMetadataRegisterContract` (#7378 row 1, `VALIDATION_ERROR` /
+400). Same document, and whether it loaded at all depended on how the package
+was loaded.
+
+The boot loop now **refuses loudly**, with the same `VALIDATION_ERROR` / 400
+envelope the artifact door raises, naming the container's own `name`, the
+object key it derived, and both remedies: drop `name`, or set it to that
+derived key. #7378 row 1 already ruled that resolving such a disagreement
+silently, in either direction, files the item under a key the caller never
+wrote, so the two registrars converge on the refusal rather than on the
+rewrite; the artifact door is unchanged.
+
+**Refused shape**, precisely: an aggregated view container in a stack `views:`
+collection that carries a non-empty top-level `name` AND derives a different
+object key from its own `object` (or, failing that, `list.data.object` /
+`form.data.object`).
+
+Scope, which the ruling names as this change's main risk. A container with no
+`name` is untouched, and still registers under its derived key. So is a
+container whose `name` already equals that key, and one that declares no
+binding anywhere else, since the derivation then falls back to that same
+`name` and cannot disagree with itself. No other metadata kind changes
+behaviour: the refusal is gated inside the `views` branch of the generic
+registration loop. Standalone ViewItems and flattened overlays travelling in
+the assembled `viewItems:` channel are untouched, because a container cannot
+reach that channel at all. Every one of these has a control test.
+
+<!-- adr-0087: not-required (no-migration-prescription) A validity narrowing over an existing optional key: `ViewSchema.name` is neither removed, renamed nor re-shaped, and forbidding it on object-scoped containers in spec was the direction the ruling explicitly refused, so there is no tombstone and nothing mechanical for `objectstack migrate meta` to rewrite. Which of the three repairs an affected container wants is authoring intent no migration entry can decide: the author may have meant the container name to go, may have meant it to become the object key, or may have mistyped `object` and want THAT corrected instead, and the stored document carries no evidence of which. The refusal is the channel that reaches the author, at the registration site, naming both values and both remedies. Measured in-repo population of affected sources is zero: no `views:` collection reaching this seam carries a divergent container `name` (the three engine-booting fixtures with inline containers are in `packages/objectql`, and the example apps' `.view.ts` containers declare no top-level `name` at all). -->

content/docs/data-modeling/validation.mdx

@@ -83,9 +83,11 @@ All validation types share these base properties:
 | Severity | Behavior |
 | :--- | :--- |
 | `error` | Prevents the record from being saved |
-| `warning` | Shows a warning but allows save |
+| `warning` | Allows the save; advisory only — logged server-side, not returned to the caller |
 | `info` | Informational message, no blocking |
 
+Advisory rules (`warning` / `info`) are reported, never enforced: on an ordinary write each hit is logged as it happens; on a seed/boot load a run's hits are folded into **one summary line per rule**; and an `update` touching only platform-injected system columns does not re-evaluate them at all, so a row is reported once rather than once per write (#13889).
+
 ## Validation Types
 
 ### Script Validation
@@ -112,7 +114,8 @@ fix it. Until protocol 17 such a rule was logged at WARN and *skipped*, so the w
 went through while the rule stayed declared and enforced nothing; a validation exists
 to reject a write, and "the rule could not be checked" must never resolve to
 "allowed" (#4649). `severity` still governs blocking — an unevaluable `warning` /
-`info` rule is logged and does not throw.
+`info` rule is logged and does not throw, on the writes where advisory rules are
+evaluated at all (see above).
 
 The record a predicate reads is the stored row overlaid with this write's payload,
 **total over the object's declared fields** (`null` for a declared field present in

content/docs/permissions/system-context.mdx

@@ -109,18 +109,18 @@ that silently does not happen.
 
 | # | Behaviour when `isSystem` | Package | What you get / what you lose | Anchor |
 |:--|:---|:---|:---|:---|
-| 18 | **`readonly` strip bypassed — UPDATE, single row** | objectql | Get: a `readonly` field CAN be written. Lose: the protection that stops a caller seeding e.g. `approval_status` | `objectql/src/engine.ts:11373` |
-| 19 | **`readonly` strip bypassed — UPDATE, bulk/predicate** | objectql | Same, on the multi-row path | `objectql/src/engine.ts:11556` |
-| 20 | **`readonly` strip bypassed — INSERT (engine pass)** | objectql | Same, on create | `objectql/src/engine.ts:10106` |
+| 18 | **`readonly` strip bypassed — UPDATE, single row** | objectql | Get: a `readonly` field CAN be written. Lose: the protection that stops a caller seeding e.g. `approval_status` | `objectql/src/engine.ts:11450` |
+| 19 | **`readonly` strip bypassed — UPDATE, bulk/predicate** | objectql | Same, on the multi-row path | `objectql/src/engine.ts:11633` |
+| 20 | **`readonly` strip bypassed — INSERT (engine pass)** | objectql | Same, on create | `objectql/src/engine.ts:10183` |
 | 21 | **`readonly` strip bypassed — INSERT (protocol ingress)** | metadata-protocol | `isSystem` is the **only** exemption here. `preserveAudit` is deliberately not read on this path (#6640) — a non-system historical import is still stripped on create | `metadata-protocol/src/protocol.ts:1795` |
-| 22 | Strict-drop refusal never fires | objectql | Lose: a caller that opted into loud refusal gets **silence** — strict refuses exactly what the strip would have taken, and the strip took nothing | `objectql/src/engine.ts:10154`, `readonly-strict-errors.ts:66` |
-| 23 | **Referential-integrity check skipped** | objectql | Get: writes proceed against unreachable/unresolvable targets. Lose: an `isSystem` caller can write a **dangling reference** | `objectql/src/engine.ts:5973` |
+| 22 | Strict-drop refusal never fires | objectql | Lose: a caller that opted into loud refusal gets **silence** — strict refuses exactly what the strip would have taken, and the strip took nothing | `objectql/src/engine.ts:10231`, `readonly-strict-errors.ts:66` |
+| 23 | **Referential-integrity check skipped** | objectql | Get: writes proceed against unreachable/unresolvable targets. Lose: an `isSystem` caller can write a **dangling reference** | `objectql/src/engine.ts:6050` |
 | 24 | Tenant-audit warning silenced; `bypassTenantAudit` threaded to the driver | objectql | Get: unscoped system writes stop warning. Lose: the signal that would flag a genuine user-path scoping bug | `objectql/src/engine.ts:3799`, `:3809`, `:3836` |
 | 25 | Engine-owned / append-only write guard bypassed | plugin-security | Get: generic writes to `managedBy` engine-owned objects | `system-write-guard.ts:96`, `:120` |
 | 26 | Identity write guard bypassed (ADR-0092) | plugin-auth | Get: direct writes to identity tables through the generic data path | `identity-write-guard.ts:99` |
-| 27 | Search-companion column **kept** in a read's rows when it was explicitly requested | objectql | Get: the internal companion column is readable. Lose: nothing for app code — this is the engine reading its own index | `objectql/src/engine.ts:6671` |
-| 28 | Dependent-count disclosure on a blocked delete | objectql | Get: the count of blocking children. Nothing was elevated past the caller, so nothing is withheld | `objectql/src/engine.ts:12172` |
-| 29 | Reference-cleanup log attributes the write to `'system'` | objectql | Get: an honest actor label instead of `anonymous` when the context carries neither `userId` nor `actor` | `objectql/src/engine.ts:12101` |
+| 27 | Search-companion column **kept** in a read's rows when it was explicitly requested | objectql | Get: the internal companion column is readable. Lose: nothing for app code — this is the engine reading its own index | `objectql/src/engine.ts:6748` |
+| 28 | Dependent-count disclosure on a blocked delete | objectql | Get: the count of blocking children. Nothing was elevated past the caller, so nothing is withheld | `objectql/src/engine.ts:12249` |
+| 29 | Reference-cleanup log attributes the write to `'system'` | objectql | Get: an honest actor label instead of `anonymous` when the context carries neither `userId` nor `actor` | `objectql/src/engine.ts:12178` |
 
 ### 3. Sharing (`plugin-sharing`)
 
@@ -180,7 +180,7 @@ a reader tracing where elevation travels needs them.
 | # | Site | Package | What it does |
 |:--|:---|:---|:---|
 | 62 | `objectql/src/engine.ts:3606` | objectql | Propagates `isSystem` into the hook session so hooks can tell engine self-writes from user writes |
-| 63 | `objectql/src/engine.ts:14616` | objectql | `ScopedContext.isSystem` getter — re-exposes the underlying execution context's flag |
+| 63 | `objectql/src/engine.ts:14693` | objectql | `ScopedContext.isSystem` getter — re-exposes the underlying execution context's flag |
 | 64 | `plugin-reports/src/report-service.ts:556` | plugin-reports | Threads the flag into the engine call that runs a report |
 | 65 | `body-runner.ts:279` | runtime | Rebuilds an `ExecutionContext` from a hook session, carrying the flag across |
 
@@ -193,9 +193,9 @@ assuming `isSystem` covers it is a documented source of bugs.
 
 | Assumption | Reality | Anchor |
 |:---|:---|:---|
-| "It suppresses triggers / record-change automation" | **No.** Only `skipTriggers` does. A bare `{ isSystem: true }` on a seed write re-fired automation on freshly seeded rows and wedged first boot | `metadata-protocol/src/seed-loader.ts:1971` (rationale at `:1881`–`1883`, #3760), `flow.zod.ts:702` |
+| "It suppresses triggers / record-change automation" | **No.** Only `skipTriggers` does. A bare `{ isSystem: true }` on a seed write re-fired automation on freshly seeded rows and wedged first boot | `metadata-protocol/src/seed-loader.ts:2032` (rationale at `:1942`–`1944`, #3760), `flow.zod.ts:702` |
 | "It skips the state machine" | **No.** That is `skipStateMachine`, carried by seed replay and by `treatAsHistorical` imports | `objectql/src/engine.ts` FSM gate; see [State Machine](/docs/protocol/objectql/state-machine) |
-| "It skips validation rules" | **No.** Field shape, `format`, `script` and the rest still run. The `readonly` strip runs *before* validation precisely so a discarded value is not judged | `objectql/src/engine.ts:10089`–`10106` |
+| "It skips validation rules" | **No.** Field shape, `format`, `script` and the rest still run. The `readonly` strip runs *before* validation precisely so a discarded value is not judged | `objectql/src/engine.ts:10166`–`10183` |
 | "It preserves a supplied `updated_at` / `updated_by`" | **No.** That is `preserveAudit`, a separate opt-in — and an UPDATE-path exemption only | `field.zod.ts:1580` (#3493 / #6640) |
 | "It stamps `created_by`" | **No.** Audit stamping reads `userId` from the context. A user-less system write stamps nothing — that is today's behaviour, not an error | `runtime-identity.ts:280`–`281` |
 | "It bypasses every guard" | **No.** The last-admin guard applies to **every** context, `isSystem` included — the deprovision path that actually locks an org out is the system one | `last-admin-guard.ts:299` |