Merge remote-tracking branch 'origin/main' into claude/issue-28816-north-star-english

Author: claude

.changeset/28253-skill-save-notice.md

@@ -0,0 +1,12 @@
+---
+'@objectstack/skills': patch
+---
+
+docs(skills): objectstack-data rules/lifecycle.md teaches the save notice
+
+Clause-②: no
+Metadata-protocol: none
+
+- **Before.** A hook can tell the person who made a create or update what the save set in motion (`ctx.notice(message)`, answered as the create/update `notice`), and a flow a record create/update trigger starts can set the same message with a `save_notice` node, but no published skill taught it, so an AI author writing a save hook from `objectstack-data` kept reaching for a `record:alert` banner.
+- **Now.** `objectstack-data/rules/lifecycle.md` gains *Save Notice — what the save set in motion*: the `ctx.notice` spelling for inline `handler` and sandboxed `body` alike (no capability), info severity and the distinction from validation `warnings` and from a `record:alert` banner, one message per write with the last call winning, the dispatches that carry it, the non-string refusal, and the flow face (`save_notice`, refused outside a create/update record trigger and after an `approval` / `wait`).
+- The file stays under its token ceiling: the new text is paid for by deleting the Decision Tree (which restated the class table and the syntax examples), the telemetry-growth anecdote and a Safety Semantics restatement. No ceiling moves; no schema, key or behaviour changes.

.changeset/28560-field-patch-slot.md

@@ -16,7 +16,7 @@ objectExtensions: [{
     industry: {
       label: 'Sector',
       inlineHelpText: 'The market the account sells into',
-      options: { tech: { label: 'Technology' } },
+      options: { technology: { label: 'Tech' } },
     },
   },
 }]

.changeset/28565-field-patch-applied.md

@@ -17,7 +17,7 @@ ADR-0146 D10's second rule, live. The per-field display patch an object extensio
 objectExtensions: [{
   extend: 'crm_account',
   fieldPatches: {
-    industry: { label: 'Sector', inlineHelpText: 'The market the account sells into', options: { tech: { label: 'Technology' } } },
+    industry: { label: 'Sector', inlineHelpText: 'The market the account sells into', options: { technology: { label: 'Tech' } } },
   },
 }]
 ```

.changeset/28574-object-extension-package-item.md

@@ -0,0 +1,24 @@
+---
+"@objectstack/spec": minor
+"@objectstack/lint": minor
+"@objectstack/objectql": minor
+"@objectstack/metadata-protocol": minor
+"@objectstack/runtime": minor
+"@objectstack/platform-objects": minor
+---
+
+feat(metadata-protocol,objectql): an object extension is an item of a writable package — saved, published and exported through the existing doors
+
+Clause-②: yes (widening)
+Metadata-protocol: added
+
+A package can now add fields and rules to an object another package defines by saving an `object_extension` item through `/api/v1/meta`, the same way it saves any other item. This is what Studio's add-field on a base object writes (ADR-0146 D10): an extension in the base's paired `<base>.custom` package, its fields suffixed `__c`, the base untouched.
+
+- **The type** (`@objectstack/spec/kernel`). `object_extension` joins `MetadataTypeSchema` and the metadata type registry. Its body is `ObjectExtensionSchema` as it stands: it carries `extend` and no `name`. The row is filed under the target object's name, one extension per package per target. `OVERRIDE_TYPE_CLASSIFICATION` lists it as `excluded`: an extension adds to its target, it never replaces a base item, so it never carries `overrides`. That disposition does not close the type to a `.custom` pair.
+- **The doors.** Draft, publish, history restore and delete are the doors every item uses. The save, publish and restore doors refuse, with `VALIDATION_ERROR` / 400 and an issue path: a write bound to no package; `defaultRowScope` or `membershipKeys` in the body (the registry's own sentences); a row filed under a name other than its `extend`; an unregistered target; a target outside the package's dependency closure (with the closure prescription the other save doors print); and a `.custom` field without the `__c` suffix (the existing `__c` judge). A body the schema refuses answers 422 `INVALID_METADATA` with the schema's issues. No error code is added.
+- **The registry** (`@objectstack/objectql`). A published row registers its whole parsed body as the package's `'extend'` contributor (`SchemaRegistry.registerObjectExtension`), so its fields, validations and indexes appear on every read of the object, and a publish adds the column to the target's table. Every stored-row sync re-registers it (boot, write-through, read hydration), and deleting the row or uninstalling the package withdraws it (`SchemaRegistry.withdrawObjectExtension`). What a manifest's `objectExtensions` register is unchanged.
+- **The export** (`@objectstack/runtime`). `GET /packages/:id/export` carries each of the package's extension items as an `objectExtensions` entry that re-installs. A package's `objects` are now only the objects it owns: an object the package extends is no longer exported as an `'own'` object, which re-install refused with `ObjectOwnershipConflictError`.
+- **`@objectstack/platform-objects`**: the metadata-forms translation bundles gain the type's `label` and `description`, authored in zh-CN, ja-JP and es-ES.
+- **`@objectstack/lint/runtime`** exports `closureDependencyRemedy`, the closure prescription the save doors print.
+
+Two costs, both on purpose: `/meta/types` serves no JSON schema for `object_extension`, and a draft carries no `_diagnostics` badge, because the type is not bound in `BUILTIN_METADATA_TYPE_SCHEMAS` (that map requires the ADR-0010 envelope, which would change the schema a manifest's `objectExtensions` parse with).

.changeset/28584-studio-layered-reads-name-owner.md

@@ -0,0 +1,21 @@
+---
+"@object-ui/app-shell": patch
+---
+
+Clause-②: no
+Metadata-protocol: none
+
+fix(app-shell): Studio and Setup read an item's layered view at the package that owns it
+
+The layered view (`GET /meta/:type/:name/layers`) naming no package is refused `409 RESOURCE_CONFLICT` for a name two
+installed packages hold, naming the holders and the `?package=` remedy. Reads in Studio and Setup still asked
+it naming no package, so on such a deployment the list-view inspector, the Interfaces leaf and app, the Data pillar's
+object, the Automations pillar's flow, the package OWD overview, the permission-set matrix, the embedded item editor and
+the item page's reset, publish and discard re-reads failed, and the permission-set matrix read the refusal as "no set
+known".
+
+Each read now names the package the caller already reads and saves at: the Studio pillar's package (a read-only base's
+own package, whose read serves its declared override), the permission matrix's package door, or the owner the edit
+URL names (`?package=`). Where none is known, the read still names no package, and the server's refusal sentence is
+shown as the load's error; the permission matrix no longer reads it as "no set known". No holder is picked on the
+client.

.changeset/28697-refused-first-install-over-tenant.md

@@ -0,0 +1,12 @@
+---
+"@objectstack/objectql": patch
+---
+
+Clause-②: no
+Metadata-protocol: none
+
+fix(objectql): a refused first install leaves nothing of itself, even over a tenant's object
+
+A first install of a package that `ObjectQL.registerApp` refuses part-way now leaves nothing of itself registered in every case, including when the package layers over an object a tenant already holds (with or without the tenant's own overlay), over an overlay with no owner, or over another package's extension of one of its objects. Afterwards there is no package record, object, extension, app, item, picklist extension, namespace, navigation contribution, contributed kind or datasource definition of the package, and the tenant's object, its overlay and the other package's extension read exactly as before the attempt. A persisted "disabled" state for that id still applies to its next install. What is refused, and every refusal's code, status and words, is unchanged.
+
+Every registration is now put back by the registry itself when it is refused, the way a refused upgrade already was. This supersedes the line of the pending `28697-refused-registration-leaves-nothing` changeset saying the engine passes `{ keepBootSeed: true }` to `SchemaRegistry.uninstallPackage`: the engine no longer uninstalls a refused first install. The option itself stays available and unchanged.

.changeset/28730-skill-field-patches.md

@@ -0,0 +1,12 @@
+---
+'@objectstack/skills': patch
+---
+
+docs(skills): objectstack-data teaches an object extension's `fieldPatches` — relabel a vendor field without redeclaring it in `fields`
+
+Clause-②: no
+Metadata-protocol: none
+
+- **Before.** `ObjectExtensionSchema.fieldPatches` is applied by the registry merge and refused at install and by `os validate` when it names nothing, but the published `objectstack-data` skill's *Object Extension Model* taught only `fields` / `priority`, so an agent that wanted a vendor field to read "Sector" instead of "Industry" redeclared the field in `fields` and took it over.
+- **Now.** The section carries one paragraph on `fieldPatches`: display keys only (`BASE_FIELD_DISPLAY_WHITELIST` — `label`, `description`, `inlineHelpText`, `placeholder`, and an option's `label` keyed by its stored `value`), type / values / rules stay the owner's, a tenant's edit wins, the higher `priority` wins between extensions, a patch naming a missing field or option is refused at install and by `os validate`, a `picklist`-bound field's options are not patchable — with the `crm_account.industry` example.
+- The file stays under its token ceiling: the new text is paid for by deleting restatement in the same file (the search section's second refusal paragraph, folded into its first; the index blockquote and the validation type list, each already carried by `rules/indexing.md` / `rules/validation.md`). No ceiling moves, no frontmatter, schema, key or behaviour changes.

.changeset/28776-adopt-orphans-owner-judges.md

@@ -0,0 +1,22 @@
+---
+'@objectstack/metadata-protocol': minor
+---
+
+**BREAKING** fix(metadata-protocol): the adopt-orphans door asks the save door's owner judges, before the `__c` judge (ADR-0029 D9.9, ADR-0086 D3, #28776)
+
+Clause-②: no (narrowing)
+Metadata-protocol: narrowed
+Skills-docs: none — no file under `skills/**` teaches the adopt-orphans door (0 hits for `adopt-orphans` and `reassignOrphanedMetadata`).
+
+<!-- adr-0087: not-required (no-migration-prescription) The narrowing refuses an adoption (`POST /api/v1/packages/:id/adopt-orphans`) that would rebind an active package-less object whose name another package owns in the registry, or an active package-less permission set whose body `packageId` names a package other than the target. Both refusals are the save door's own, asked at one more door with their existing envelopes. No metadata key, accepted value of a key, export or error code is removed or renamed, and no stored shape changes. The remedy is an authoring choice a person makes: bind the object to its owner, delete or rename one of the two rows, or drop or fix the set's `packageId`. There is no mechanical conversion between two metadata versions for `objectstack migrate meta` to apply. Measured at the PR's base: fresh CRM and showcase boots store 0 `sys_metadata` rows, and the 9 sites that seed `sys_metadata` rows in `packages/qa/**` hold 0 adoptable active rows either judge refuses. The other categories are closed on facts: the package publishes (not unpublished); no ADR-0087 id is named or touched (not registered or already-registered); no `packages/spec/**` file is touched, so no schema, type or runtime interface moves (not type-surface-only, not runtime-interface-only); and no export is retired (not runtime-export-retired). -->
+
+`reassignOrphanedMetadata` (REST `POST /api/v1/packages/:id/adopt-orphans`) rebinds every active package-unbound row into the target package. Since #28735 it asks the `__c` judge first. It asked neither owner judge the save door asks before that one, so a package-less row could become a package's own item without them.
+
+The door now asks both, in the save door's order (owner first, then the existing `__c` call), against the TARGET package and before the first storage update. Any refusal refuses the adoption whole: no row moves and nothing is written through to the registry.
+
+- **An active orphan object whose name another package owns** (ADR-0029 D9.9): `422 OBJECT_OVERLAY_PACKAGE_MISMATCH`, the save door's message naming the owner. Adopted, the row was rebound in storage while the registry kept the other owner: two rows for one object. The `sys_metadata` sentinel owner is not judged. An orphan object is the sentinel's own registration, the owner the adoption hands over.
+- **An active orphan permission set whose body `packageId` disagrees with the target** (ADR-0086 D3): `400 VALIDATION_ERROR`, the save door's message, `issues[0].path = 'packageId'`.
+
+An adopted draft is judged by both when it is promoted, as before. The namespace-prefix judge is not asked at this door. Every installed package declares a namespace, so it would refuse nearly every real orphan object. Whether adoption refuses, renames or leaves the prefix unjudged is an open design question. No new error code.
+
+**Migration.** None needed for this repository: 0 rows affected (measured above). An environment whose adoption is refused fixes the named row, as the message says, and adopts again.

.changeset/28778-email-template-override-locale.md

@@ -0,0 +1,11 @@
+---
+'@objectstack/skills': patch
+---
+
+docs(skills): objectstack-platform says an email-template override names a locale its base ships; a new locale carries no `overrides`
+
+Clause-②: no
+Metadata-protocol: none
+
+- **Before.** The ADR-0146 customization paragraph taught that a same-named item in the paired `.custom` package with `overrides` replaces the base's item, and listed `email_template` among the honoured types, but said nothing about the locale. An email template is one item per `(name, locale)`, and the override write gate refuses a declared override of a locale the base does not ship (`declared_package_ships_no_such_item`), so an author following the skill could declare `overrides` on a locale the base never shipped and be refused.
+- **Now.** One sentence in that paragraph: an email template is one item per (name, locale), an override names a locale the base ships, and a locale the base does not ship is added without `overrides`. The file stays at its token ceiling: the sentence is paid for by naming the not-yet-honoured types as the rest of `OVERRIDABLE_METADATA_TYPES` instead of enumerating them, and by dropping four filler intro clauses. No rule is removed, no frontmatter, schema or behaviour changes.

.changeset/28799-two-granularities-one-dimension-refused.md

@@ -0,0 +1,19 @@
+---
+'@objectstack/service-analytics': patch
+---
+
+fix(service-analytics)!: two granularities of one time dimension are refused on every face, not collapsed to the last one
+
+Clause-②: no (narrowing) — `timeDimensions` naming one dimension, spelled the same way, at two granularities (`[{ dimension: 'closed_at', granularity: 'month' }, { dimension: 'closed_at', granularity: 'year' }]`) is now refused `INVALID_QUERY` / 400 on the native strategy, the ObjectQL strategy and the draft preview, with the refusal each already gives one column asked twice under one name (#28765); every face served it as the last granularity's buckets and dropped the other entry. Nothing is widened: no export, public member, answer member, error code or status is added.
+Metadata-protocol: none
+
+<!-- adr-0087: not-required (no-migration-prescription) No key of any schema is added, removed, renamed or re-shaped, and no export or type of the package root changes: a selection that was half served is refused with a refusal already on the wire. There is nothing for a migration to rewrite and no tombstone. -->
+
+**BREAKING** accept-set narrowing on `queryDataset` (`@objectstack/service-analytics`), on every face.
+
+- **Before.** Measured on real SQLite: the pair above answered one `2026` row holding the whole total on all three faces (the `month` entry dropped silently); `year` then `month` answered the months (the `year` entry dropped). Beside the raw dimension `closed_at`, both live faces answered one `1970-01` bucket holding the whole total.
+- **Now.** The ObjectQL strategy's group-key builders keep every granularity a dimension is asked at, so the engine sees both buckets of the one column and answers its duplicate-column refusal, which the native strategy relays for a bucketed selection; the draft preview judges the same keys and gives the same refusal, field for field. This holds beside other dimensions and beside a cross-object dimension.
+- **Unchanged.** One dimension asked twice at the same granularity is one bucket and is served. One bucket per column, and buckets of different columns, are served. No new refusal is added; the existing one now sees the pair.
+- **Who sees it.** A caller sending two granularities for one time dimension: a refusal saying the column is asked twice, instead of a chart missing one of them.
+
+**The remedy.** Ask each time dimension at one granularity.