Merge remote-tracking branch 'origin/main' into claude/issue-20929-grid-column-consumers

Author: claude

.changeset/20513-seven-packages-runtime-strings-state-the-decision.md

@@ -0,0 +1,38 @@
+---
+'@objectstack/core': patch
+'@objectstack/driver-memory': patch
+'@objectstack/driver-mongodb': patch
+'@objectstack/formula': patch
+'@objectstack/metadata': patch
+'@objectstack/metadata-core': patch
+'@objectstack/objectql': patch
+'@objectstack/platform-objects': patch
+---
+
+Refusals, log lines and field help in core, the in-memory and MongoDB drivers, formula, metadata, metadata-core, objectql and platform-objects no longer cite tracker numbers; each states the reason in words
+
+Clause-②: no
+
+Many messages these packages show to authors, administrators and operators ended with an issue-tracker
+number where the reason belonged. The number goes, and where the sentence did not already say what was
+decided, it now does. Where an ADR stood beside the number, the ADR stays.
+
+- Refusals and prescriptions: the retired health-check keys, the `IMetadataService.register` refusals
+  (the contract refuses loudly and names the mismatch, never coerces a value into storability), the
+  kernel's plugin-ordering errors (registration order is not a contract), the in-memory and MongoDB
+  filter and aggregation refusals, formula's empty field constraint, the retired `artifact-api`
+  source, and the by-id update and delete refusals. The MongoDB retired-aggregate refusal now says the
+  function left `AggregationFunction` because no SQL backend compiled it; its undeclared-aggregate
+  refusal says the builder used to sum an unrecognised name before this refusal existed.
+- The `findOne` no-predicate refusal loses its citation in `objectql` and in `metadata-core`'s
+  `engineFindOnePredicateRefusalMessage` together, so the two still read byte for byte the same.
+- The in-memory and MongoDB drivers' multi-tenancy refusals (`MEMORY_MULTI_TENANT_UNSUPPORTED`,
+  `MONGODB_MULTI_TENANT_UNSUPPORTED`) no longer end with a `Tracking:` line linking a tracker card;
+  the sentence above it already says the driver refuses rather than run or answer unisolated.
+- Field help and protection text: the `sys_account` token help (and its es-ES, ja-JP and zh-CN
+  translations), the `sys_email` headers help and the SCIM credential store's protection reason.
+- Log lines: the superseded-registration warning, the authz cache posture line, the endpoint matcher's
+  excluded-item error, the metadata history and loader-read failure errors, and the fresh-datastore
+  attestation info lines.
+
+Text only: no error code, field name, status or behaviour changes.

.changeset/20920-use-grouping-form-row.md

@@ -0,0 +1,10 @@
+---
+"@objectstack/spec": minor
+"@objectstack/platform-objects": patch
+---
+
+Clause-②: no
+
+The field form offers `useGrouping` on `number` fields: one plain boolean row beside `scale`, gated to `number` as `scale` is, whose control copies the field form's `allowCreate` row (the same `z.boolean().optional()` node, no default). The key was declared by `FieldSchema` and graded `live` by the liveness ledger once the console's number display began to answer an authored value first, but no form offered it, so an author's only door was the Source tab. The help text follows the key's own description: unset lets the renderer decide, off never groups (a year or an ID), on always groups. It also says that an untouched switch writes nothing, so it reads off even where the renderer groups.
+
+⛔ **No schema accept set moves and no export changes.** What changes is the **form payload** `getMetaTypes()` serves and the translation keys `os i18n extract` walks, hence the regenerated `platform-objects` metadata-form bundles, whose two new leaves are authored in `zh-CN`, `ja-JP` and `es-ES` rather than left as extractor fills.

packages/core/src/health-monitor.test.ts

@@ -543,7 +543,7 @@ describe('PluginHealthMonitor', () => {
 
         const message = caught?.message ?? '';
         expect(message).toContain(`'${key}' was removed`);
-        expect(message).toContain('#12032');
+        expect(message).toContain('in @objectstack/spec 17.3.0 (ADR-0049 enforce-or-remove)');
         expect(message).toContain('ADR-0049');
         expect(message).toContain('Delete the key');
         // The affordance that exists, named in place of the one that did not.

packages/core/src/health-monitor.ts

@@ -82,7 +82,7 @@ const RETIRED_HEALTH_CHECK_KEYS: ReadonlyArray<readonly [string, string]> = [
   [
     'autoRestart',
     "'autoRestart' was removed from PluginHealthCheck in @objectstack/spec 17.3.0 "
-    + '(#12032, ADR-0049 enforce-or-remove) — it never restarted a plugin. '
+    + '(ADR-0049 enforce-or-remove) — it never restarted a plugin. '
     + '`attemptRestart` called `plugin.destroy()` and stopped there, then '
     + "logged 'Plugin restarted' and set status `recovering`, and the periodic "
     + 'checks carried on against the destroyed instance — which the default '
@@ -94,14 +94,14 @@ const RETIRED_HEALTH_CHECK_KEYS: ReadonlyArray<readonly [string, string]> = [
   [
     'maxRestartAttempts',
     "'maxRestartAttempts' was removed from PluginHealthCheck in "
-    + '@objectstack/spec 17.3.0 (#12032, ADR-0049 enforce-or-remove) — it capped a '
+    + '@objectstack/spec 17.3.0 (ADR-0049 enforce-or-remove) — it capped a '
     + 'restart that never happened, so it only counted `destroy()` calls. '
     + 'Delete the key.',
   ],
   [
     'restartBackoff',
     "'restartBackoff' was removed from PluginHealthCheck in @objectstack/spec "
-    + '17.3.0 (#12032, ADR-0049 enforce-or-remove) — it delayed a restart that '
+    + '17.3.0 (ADR-0049 enforce-or-remove) — it delayed a restart that '
     + 'never happened, so it only moved when the `destroy()` landed. Delete '
     + 'the key.',
   ],

packages/core/src/metadata-service-contract.ts

@@ -160,7 +160,7 @@ export function assertMetadataRegisterContract(
         throw registerRefusal(
             `IMetadataService.register('${type}', '${name}'): data is ${shape}, not a metadata document. ` +
                 `register() stores plain-object documents only — accepting a value the service cannot key was measured as ` +
-                `accept-then-drop on document-keyed stores (#7378 row 3: refuse loudly, never coerce into storability). ` +
+                `accept-then-drop on document-keyed stores, so the contract refuses loudly and never coerces a value into storability. ` +
                 `Wrap the value in a document object whose shape the '${type}' type's schema accepts, or store it under a type that declares one.`,
         );
     }
@@ -169,7 +169,7 @@ export function assertMetadataRegisterContract(
         throw registerRefusal(
             `IMetadataService.register('${type}', '${name}'): data.name is '${String(documentName)}', which disagrees with the ` +
                 `name argument '${name}'. A disagreement is almost always an authoring bug, and resolving it silently in either ` +
-                `direction can file the item under a key the caller never wrote (#7378 row 1: refuse loudly, locate the mismatch). ` +
+                `direction can file the item under a key the caller never wrote, so the contract refuses loudly and names the mismatch. ` +
                 `Register under one name: pass the intended key as the argument and make data.name match it, or omit data.name.`,
         );
     }

packages/core/src/plugin-order.ts

@@ -151,7 +151,7 @@ export function validateInitServiceContract<P extends OrderablePlugin>(
 
     if (violations.length > 0) {
         throw new Error(
-            `[Kernel] Plugin ordering contract violated (#4131):\n  - ${violations.join('\n  - ')}`
+            `[Kernel] Plugin ordering contract violated:\n  - ${violations.join('\n  - ')}`
         );
     }
 }
@@ -178,7 +178,7 @@ export function describeInitOrderFault(
         }
     }
     return ` (while plugin '${currentlyInitializing}' was initializing — a composition/` +
-        `ordering fault, #4131.${providerHint})`;
+        `ordering fault; registration order is not a contract.${providerHint})`;
 }
 
 /**
@@ -200,7 +200,7 @@ export function assertInitServiceRequirements(
             `service is registered at this point of the boot. No composed plugin that initializes ` +
             `earlier provides it — compose a provider (and, if it initializes later without declaring ` +
             `'${service}' in providesServices, order it ahead via this plugin's dependencies/` +
-            `optionalDependencies) (#4131).`
+            `optionalDependencies).`
         );
     }
 }

packages/core/src/plugin-registration.ts

@@ -98,7 +98,7 @@ export function describeSupersededRegistration(
         `REPLACED the earlier one (${versionLabel(previous)}). Only the later instance is ` +
         `initialized and started; the earlier one is discarded without ever running init(). ` +
         `Duplicate registration by name is last-one-wins on both kernels by declared contract ` +
-        `(#9864) — register the plugin once if that is not what you meant.`
+        `— register the plugin once if that is not what you meant.`
     );
 }
 

packages/core/src/security/admin-standing-surface.ts

@@ -110,9 +110,9 @@ export const ADMIN_STANDING_SURFACE: Readonly<Record<string, AdminStandingTable>
     reason:
       'The row `admin_full_access` is resolved BY NAME from (§6b) — `platform_admin` is the '
       + "POSITION that row derives, not the row's own name. Renaming it, deleting it or switching "
-      + 'it off (ADR-0049 `active`, read here since #8613) un-makes every GRANT-derived platform '
+      + 'it off (ADR-0049 `active`, which this resolver honours) un-makes every GRANT-derived platform '
       + 'admin at once, with no identity table touched. ⚠️ It does NOT un-make a CONFIG-derived '
-      + 'one (§6b-config, #11970): that route sets the same standing from '
+      + 'one (§6b-config): that route sets the same standing from '
       + "`ADMIN_FULL_ACCESS_CAPABILITIES` in `@objectstack/spec` and matches the caller's own "
       + 'stored `sys_user` row, so it touches an identity table and never reads this one. With '
       + '`OS_PLATFORM_OWNER_EMAIL` unset the first sentence is the whole truth; with it declared, '
@@ -176,7 +176,7 @@ export const ADMIN_STANDING_SURFACE: Readonly<Record<string, AdminStandingTable>
   sys_user: {
     role: 'derives',
     reason:
-      '[#11663 L2] RECLASSIFIED from `reads-only`. This table used to be read only for the '
+      'RECLASSIFIED from `reads-only` when the config anchor landed. This table used to be read only for the '
       + '`current_user.email` RLS fallback and the cloud ADR-0024 `ai_seat` synthesis (§7), and the '
       + 'note here said so: "Neither confers administrator standing." That sentence is now FALSE. '
       + 'The config anchor (§6b-config) matches the row\'s own `email` against the deployment\'s '

packages/core/src/security/authz-cache-posture.test.ts

@@ -64,7 +64,7 @@ describe('#11968 authz cache posture — the loud arm', () => {
     expect(message).toContain('7500ms');
     expect(message).toContain(AUTHZ_GRANTS_CACHE_TTL_ENV);
     expect(message).toMatch(/not an error/i);
-    expect(message).toContain('#4785');
+    expect(message).toContain('a silently-absent invalidation bridge is how a security control gets disabled without anyone noticing.');
   });
 });
 

packages/core/src/security/authz-cache-posture.ts

@@ -123,8 +123,8 @@ export function resolveAuthzCachePosture(
       `another replica is honoured by this one for up to ${ttlMs}ms. That is a ` +
       'supported configuration, not an error: the TTL is the correctness bound ' +
       'and it still holds. It is stated because a silently-absent invalidation ' +
-      'bridge is how a security control gets disabled without anyone noticing ' +
-      `(#4785). To narrow the typical window, configure a remote cluster driver; ` +
+      'bridge is how a security control gets disabled without anyone noticing. ' +
+      `To narrow the typical window, configure a remote cluster driver; ` +
       `to remove it entirely, set ${AUTHZ_GRANTS_CACHE_TTL_ENV}=0.`,
   };
 }