Merge origin/main into claude/project-thread-pr0nu5 (after #29100); keep both sides' tests in package-lifecycle.test.ts

Claude-Session: https://claude.ai/code/session_01ADHkmPi3pqv7Vkx4kymD87
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.changeset/25098-setup-packages-to-studio.md

@@ -0,0 +1,12 @@
+---
+'@objectstack/platform-objects': patch
+---
+
+feat(platform-objects): Setup no longer carries the unfiltered Packages entry; the full package list lives in Studio
+
+Clause-②: no
+Metadata-protocol: none
+
+The full `developer:packages` list is a development surface, so its one unfiltered navigation entry is now Studio's Overview → Packages, which is unchanged. Setup's `group_apps` drops its `nav_packages` entry. Setup keeps the marketplace-filtered "Installed Apps" door (`nav_marketplace_installed`, contributed by `@objectstack/cloud-connection` wherever the marketplace capability is present), so its Apps group reads Browse Marketplace, Installed Apps and Packaged Actions.
+
+The Setup copies of the entry's label (`apps.setup.navigation.nav_packages` in `en`, `zh-CN`, `ja-JP` and `es-ES`) and their recorded source hashes are removed with it; Studio's copies stay. A bookmark to the Packages page keeps working, since the page itself did not move.

.changeset/25467-e1-protocol-host-split.md

@@ -0,0 +1,10 @@
+---
+'@objectstack/metadata-protocol': patch
+---
+
+refactor(metadata-protocol): one `ObjectStackProtocolImplementation` member body moves out of `protocol.ts` through a host object, the shape the rest of the class follows
+
+Clause-②: no
+Metadata-protocol: none
+
+No behaviour change. `tenantAuthoredWriteRefusal` keeps its docblock and signature on the class; its body now lives in `protocol-tenant-authored-write.ts`, reached through `protocol-host.ts`, a per-instance object that forwards to the class's own members (built in the class's static block, so the class gains no member). The moved body differs from the method body only by `this.` reading `host.`. The published `index.d.ts` (ESM and CJS) is byte-identical to the one `main` builds before this change. Nothing to migrate.

.changeset/25467-e2-1a-metadata-list-reads.md

@@ -0,0 +1,10 @@
+---
+'@objectstack/metadata-protocol': patch
+---
+
+refactor(metadata-protocol): the metadata list reads, the audit read and the UI-view read move out of `protocol.ts` through the protocol host
+
+Clause-②: no
+Metadata-protocol: none
+
+No behaviour change. The bodies of `getMetaItems`, `getMetaItemsForExecution`, `getMetaItemsPerPackage`, `readFlattenedMetaItems`, `auditMetaItem` and `getUiView` now live in `protocol-meta-list-reads.ts` and `protocol-meta-audit-ui-view.ts`, reached through the per-instance host (`protocol-host.ts`). Each method keeps its docblock and signature on `ObjectStackProtocolImplementation`, and each moved body differs from the method body only by `this.` reading `host.`. The published `index.d.ts` (ESM and CJS) is byte-identical to the one `main` builds before this change. Nothing to migrate.

.changeset/25467-e2-1b-metadata-item-layered-reads.md

@@ -0,0 +1,10 @@
+---
+'@objectstack/metadata-protocol': patch
+---
+
+refactor(metadata-protocol): the metadata item reads and the layered read move out of `protocol.ts` through the protocol host
+
+Clause-②: no
+Metadata-protocol: none
+
+No behaviour change. The bodies of `getMetaItem`, `getMetaItemForExecution`, `readMetaItem`, `packagelessLayeredReadRefusal` and `getMetaItemLayered` now live in `protocol-meta-item-reads.ts` and `protocol-meta-layered-reads.ts`, reached through the per-instance host (`protocol-host.ts`). Each method keeps its docblock and signature on `ObjectStackProtocolImplementation`, and each moved body differs from the method body only by `this.` reading `host.`. The published `index.d.ts` (ESM and CJS) is byte-identical to the one `main` builds before this change. Nothing to migrate.

.changeset/25921-objectui-testing-guide-fetch-double.md

@@ -0,0 +1,11 @@
+---
+'@objectstack/skills': patch
+---
+
+docs(skills): the objectui testing guide stops teaching msw and shows a fetch double over the real adapter
+
+Clause-②: no
+Metadata-protocol: none
+
+- **Before.** `skills/objectui/guides/testing.md` taught "MSW for API mocking in integration tests" with `import … from 'msw'` and `msw/node`. No package in this stack declares `msw` any more, so a test written from the guide cannot resolve its imports.
+- **Now.** The subsection shows the pattern this repository's own integration tests use: a `vi.fn` passed as the `fetch` of a real `ObjectStackAdapter`, so the adapter and client run and only the wire is faked. It names one real test as the worked example. The guide stays within its token ceiling (3101 of 3101).

.changeset/25921-plugin-designer-dead-collaboration-version-history.md

@@ -0,0 +1,21 @@
+---
+'@object-ui/plugin-designer': patch
+---
+
+refactor(plugin-designer)!: retire `useConfirmDialog` and `VersionHistory` from the entry, and delete the designers' dead collaboration code
+
+Clause-②: no (narrowing)
+Metadata-protocol: none
+
+<!-- adr-0087: not-required (runtime-export-retired @object-ui/plugin-designer#useConfirmDialog, @object-ui/plugin-designer#VersionHistory) the retired operands are a React hook and a React component in a published ui package's entry that nothing in the workspace or in hotcrm imported; no packages/spec schema, registered node type, ADR-0087 conversion surface or stored shape names them, so there is nothing for `objectstack migrate meta` to rewrite -->
+
+**BREAKING** for a host that imports `useConfirmDialog` or `VersionHistory` from `@object-ui/plugin-designer`. Neither had an importer anywhere in the workspace or in hotcrm, so the Console and every `@object-ui/*` package are unaffected.
+
+- The `VersionHistory` timeline module is deleted: nothing in the package rendered it. The `designer.versionHistory` translation key stays in the locale packs for now, with no reader.
+- `useConfirmDialog` stays inside the package, because the designers use it for their delete prompts. Only the entry stops publishing it.
+- The collaboration code that became unreachable once the previous release stopped exporting `CollaborationProvider` is deleted. That covers the provider module, the always-null `useCollaboration()` branches in the page, data model, process and report designers, and their "N users" / "Connected" toolbar chips. Nothing outside the package could mount the provider, so no designer behaves differently.
+
+What leaves, and what to write instead (neither has a replacement export):
+
+- FROM `useConfirmDialog` TO no replacement: render your own confirm prompt with `ConfirmDialog` (still exported) and local `useState`.
+- FROM `VersionHistory` TO no replacement: render the version list in your own component. The designers never showed one.

.changeset/27842-disabled-actions-served.md

@@ -12,4 +12,4 @@ Metadata-protocol: none
 
 - **Served beside the object** (`@objectstack/metadata-protocol`, `@objectstack/rest`). `GET /api/v1/meta/object/:name` serves `disabledActions` beside `item`: the names in `item.actions` that the deployment's activation ledger switches off. `GET /api/v1/meta/object` serves the same answer keyed by object name. The default cached door carries it too, read live on every call and kept out of the ETag, so a read that carries it is answered in full rather than `304 Not Modified`. The key is absent where no ledger answered (no engine, or an engine with no ledger attached), on a draft read, and on every type other than `object`. `item.actions` is unchanged. The protocol reads the engine's `getDisabledActions` through the kernel's service table by name and imports no engine.
 - **The fact it serves** (`@objectstack/objectql`). `ObjectQL.getDisabledActions()` returns the names the engine's activation projection switches off, the same projection both dispatch doors consult before they refuse a call, or `undefined` when no ledger is attached. `listDisabledActions()` is unchanged.
-- **The refusal sentence** (`@objectstack/objectql`, `@objectstack/runtime`). A switched-off action is still refused 409 `ACTION_DISABLED` at the REST and MCP doors, and the message now reads: "This action is turned off for this deployment. An administrator can turn it on again under Setup › Packaged automation, or you can use another action." It no longer names the ledger table or the ADR. The engine writes those, with the code and the action's name, to an `info` log line each time it refuses one.
+- **The refusal sentence** (`@objectstack/objectql`, `@objectstack/runtime`). A switched-off action is still refused 409 `ACTION_DISABLED` at the REST and MCP doors, and the message now reads: "This action is turned off for this deployment. An administrator can turn it on again under Setup › Packaged Actions, or you can use another action." It no longer names the ledger table or the ADR. The engine writes those, with the code and the action's name, to an `info` log line each time it refuses one.

.changeset/27966-flow-disabled-plain-sentence.md

@@ -9,5 +9,5 @@ fix: a flow an administrator switched off is refused with a plain sentence, the
 Clause-②: no
 Metadata-protocol: none
 
-- **The flow refusal** (`@objectstack/service-automation`). A packaged flow switched off under Setup › Packaged automation is still refused `FLOW_DISABLED`, at every door that runs it: its trigger, a direct run, and a parent flow that calls it as a subflow. The message now reads: "This flow is turned off for this deployment. An administrator can turn it on again under Setup › Packaged automation, or copy it there under a new name." It no longer names the ledger table or the ADR. The engine writes those, with the code and the flow's name, to an `info` log line each time it refuses one. A flow disabled by its own status (`obsolete` / `invalid`) still reads "Flow '…' is disabled", so the two reasons stay distinguishable.
-- **One sentence for both** (`@objectstack/types`, `@objectstack/objectql`). `describeTurnedOffPackagedItem('action' | 'flow')` builds the sentence. The action refusal (`ACTION_DISABLED`) reads from it too, and its wording is unchanged. Only the last clause differs: a flow can be copied under a new name, and an action cannot, so the action sentence still offers another action instead.
+- **The flow refusal** (`@objectstack/service-automation`). A packaged flow an administrator switched off is still refused `FLOW_DISABLED`, at every door that runs it: its trigger, a direct run, and a parent flow that calls it as a subflow. The message now reads: "This flow is turned off for this deployment. An administrator can turn it on again in its package's Automations in Studio, or copy it there under a new name." It no longer names the ledger table or the ADR. The engine writes those, with the code and the flow's name, to an `info` log line each time it refuses one. A flow disabled by its own status (`obsolete` / `invalid`) still reads "Flow '…' is disabled", so the two reasons stay distinguishable.
+- **One sentence for both** (`@objectstack/types`, `@objectstack/objectql`). `describeTurnedOffPackagedItem('action' | 'flow')` builds the sentence. The action refusal (`ACTION_DISABLED`) reads from it too, and its wording is unchanged. The two sentences differ in two clauses: where an administrator turns the item back on (an action under Setup › Packaged Actions, a flow in its package's Automations in Studio), and what can be done meanwhile (a flow can be copied under a new name, and an action cannot, so the action sentence offers another action instead).

.changeset/28205-home-amount-both-faults.md

@@ -0,0 +1,10 @@
+---
+'@objectstack/spec': patch
+---
+
+fix(spec): a `currencyConfig.homeAmount` home or rate field that lacks `readonly: true` and declares an `expression` is told both faults in one refusal
+
+Clause-②: no
+Metadata-protocol: none
+
+An object whose `homeAmount.field` or `homeAmount.rateField` names a field that lacks `readonly: true` AND declares an `expression` was refused with only the `readonly` fault, so the author added `readonly: true` and met the `expression` fault on the next parse. The one issue at that pointer now names both faults and both remedies: add `readonly: true` to the field and delete its `expression`. The accept set is unchanged; a field with only one of the two faults is told exactly what it was told before.

.changeset/28522-view-or-group-live.md

@@ -0,0 +1,15 @@
+---
+'@objectstack/spec': patch
+---
+
+docs(spec): the view filter any-of group is described as live, not planned
+
+Clause-②: no
+Metadata-protocol: none
+
+The console now applies a view filter's any-of group `{ or: [rule, ...] }`: the list query lowers it to one `or` node ANDed with the filter's other elements, and the filter builder edits a filter that is exactly one group. Two author-facing texts still said otherwise and are corrected:
+
+- `ViewFilterOrGroupSchema`'s description (what `/meta/types` and the generated reference show) no longer starts with `[PLANNED — not yet rendered]` and no longer says a view that stores a group is refused when it loads.
+- The refusal for a MongoDB-style `$or` on a rule-array `filter` still prescribes the any-of group element, and no longer adds that no console applies it.
+
+Nothing an author can write changes: the schema accepts and refuses exactly what it did.