Merge remote-tracking branch 'origin/main' into claude/issue-13799-self-test-roster-floor-b1

Author: claude

.github/workflows/lint.yml

@@ -1963,9 +1963,12 @@ jobs:
       # exact block green, because "has a value" and "the key is present" type
       # identically. Both `skills/**` sites shipped to customers.
       #
-      # Table-driven by the #13582 triage ruling, carrying the `$exists` family
-      # ONLY — each further word (the retired `$regex` spelling, #13532's
-      # `visibleWhen` claims) pays its own baseline on its own card.
+      # Table-driven by the #13582 triage ruling. #13582 shipped the `$exists`
+      # family alone; #13745 added the `(NoSQL)` portability gloss, the retired
+      # `$regex` spelling and #13532's `visibleWhen` claims, each with its own
+      # legitimate-usage survey. Each further word pays its own baseline on its
+      # own card, and the gate's `--self-test` pins the shipped row set as an
+      # exact enumeration.
       #
       # It lives in this job for the reason every other docs guard does
       # (`check:doc-anchors`, `check:docs-audit-scope`, `check:role-word` above):

examples/app-multi-package/README.md

@@ -19,6 +19,12 @@ is one package ASSEMBLED (manifest fields plus the collections that package
 owns), declared by `AssembledPackageBodySchema`. `GET /api/v1/packages` on a
 booted instance lists both rows.
 
-`orders` carries **no `scope` key** on purpose; the App's navigation lives with
-the App package because a package's own navigation may not point at a foreign
-object, while cross-package lookups (which `crm_order.account` is) are accepted.
+Both rows are served with **`scope: "project"`**. `defineStack` parses every
+`packages[]` entry through `ManifestSchema`, whose `scope` defaults to
+`project`, so no package of a compiled artifact is ever scope-less — what marks
+these two read-only is the server's own **`writable: false`** verdict (ADR-0070
+D2), which reads `engine.manifests` before it reads any scope.
+
+The App's navigation lives with the App package because a package's own
+navigation may not point at a foreign object, while cross-package lookups (which
+`crm_order.account` is) are accepted.

examples/app-multi-package/src/packages/orders/index.ts

@@ -12,10 +12,21 @@ import { defineStack } from '@objectstack/spec';
  *  - It declares the **same namespace** as the App package. That is what
  *    ADR-0130 D1 buys: co-ownership of one namespace inside one artifact, so
  *    `crm_order` keeps its name instead of becoming `orders_order`.
- *  - It carries **no `scope` key**. `ManifestSchema.scope` defaults to
- *    `'project'`, so a scope-less module is the row that separates the server's
- *    writability verdict from a client-side `scope !== 'project'` heuristic
- *    (ADR-0070 D2 / ADR-0130 Consequences row 6).
+ *  - Its served row carries **`writable: false`** — the server's OWN verdict
+ *    (ADR-0070 D2 / ADR-0130 Consequences row 6). `isWritablePackage` reads
+ *    `engine.manifests` FIRST, so a package booted from an artifact is
+ *    read-only whatever its `scope` says.
+ *
+ * ⛔ This module is NOT a scope-less row, and no package of a compiled artifact
+ * can be. It authors no `scope` key, but `defineStack` parses every `packages[]`
+ * entry through `ManifestSchema` (`spec/src/stack.zod.ts`,
+ * `ArtifactPackageEntrySchema`), whose `scope` is `.default('project')` — so
+ * `dist/objectstack.json` and every served row carry `scope: 'project'`. A
+ * genuinely scope-less row exists only where a manifest reaches the registry
+ * WITHOUT that parse: a marketplace / offline-imported package (booted, hence
+ * read-only) or a Studio-created base via `POST /api/v1/packages` (writable).
+ * That discriminating pair is pinned in
+ * `packages/runtime/src/domains/packages-writable-verdict.test.ts`, not here.
  *
  * `crm_order.account` looks up an object this package does NOT own. That is
  * legal and is the whole point of the split: cross-package lookups are accepted

packages/qa/dogfood/test/multi-package-artifact.dogfood.test.ts

@@ -94,14 +94,34 @@ describe('dogfood: one artifact, two co-owning packages (ADR-0130 D4)', () => {
     expect(orders?.manifest?.namespace).toBe('crm');
   });
 
+  it('both rows carry the schema default `scope: "project"` — nothing here is scope-less', () => {
+    // [#14597] This file used to document `orders` as being SERVED with no
+    // `scope` key. It authors none, but `defineStack` parses every `packages[]`
+    // entry through `ManifestSchema` (`ArtifactPackageEntrySchema`), whose
+    // `scope` is `.default('project')` — so the default is materialised at
+    // compile time, into `dist/objectstack.json` and into both served rows.
+    // Pinned on a real boot because that is the only place the old claim could
+    // ever have been checked, and it never was: every unit pin around it
+    // asserted a hand-built scope-less manifest instead of this artifact's.
+    const core = rows.find((r) => r.manifest?.id === CORE);
+    const orders = rows.find((r) => r.manifest?.id === ORDERS);
+
+    expect(core?.manifest?.scope).toBe('project');
+    expect(orders?.manifest?.scope).toBe('project');
+  });
+
   it('both rows are read-only — the server\'s own verdict, not a scope heuristic', () => {
     // ADR-0070 D2 / ADR-0130 Consequences row 6: a package booted from an
     // artifact through `registerApp` is read-only whatever its scope says,
-    // because `isWritablePackage` reads `engine.manifests` FIRST. The module is
-    // the row that separates that verdict from Studio's client-side
-    // `scope !== 'project'` heuristic — it is authored with no `scope` key at
-    // all, and a client rule reading the row alone cannot tell it from a
-    // Studio-created writable base.
+    // because `isWritablePackage` reads `engine.manifests` FIRST. That is the
+    // whole content of the verdict here — and it is NOT reproducible from these
+    // rows, which carry `scope: 'project'` (pinned above). ⛔ This fixture is
+    // therefore not the row that separates the server rule from a client-side
+    // `scope !== 'project'` one: the scope-less pair that does (a booted
+    // marketplace import, read-only, vs a Studio-created base, writable) only
+    // arises where a manifest reaches the registry without a `ManifestSchema`
+    // parse, and is pinned in
+    // `packages/runtime/src/domains/packages-writable-verdict.test.ts` (#14597).
     const core = rows.find((r) => r.manifest?.id === CORE);
     const orders = rows.find((r) => r.manifest?.id === ORDERS);
 

scripts/check-i18n-coverage.mjs

@@ -142,6 +142,30 @@
 // addressing only `fix` would have left it splitting; readings belong in
 // `evidence`, which is not keyed. The classified branches (`WORKSPACE_BUILD_FIX` /
 // `INSTALL_THEN_BUILD_FIX`) group byte-for-byte as they did before.
+//
+// #14729 named a class the ratchet itself produces, not a defect in it: PR #14651
+// (#14376) taught this gate to walk three new families, one of them
+// `objects.OBJECT._validations.RULE.message`, and its committed baseline therefore
+// held counts only that branch could compute — on `main` the walk did not exist, so
+// other PRs moved those counts without being able to see that they did. Two PRs did
+// exactly that while it waited to land, each costing a patch round: merge `main`,
+// re-derive, rebuild every number in the PR body. Stated generally, because it is
+// not i18n-specific — type-check debt counts, token ratchets and liveness state
+// counts have the same shape: a PR that widens what a committed ratchet MEASURES
+// races every PR that changes what is MEASURED, for its whole review-and-queue
+// latency — and the race is invisible on `main`, because there the instrument does
+// not exist. The two collisions were not independent draws, either: both were steps
+// of one in-flight campaign moving the examples' authored `validations[].message`
+// onto a shared translation channel, and a campaign that systematically touches
+// exactly the family a PR makes measurable collides on every step it lands. As of
+// `224f8ea`, `app-showcase` has zero untranslated rule messages left — that leg is
+// finished — but the exposure is forward-looking, not closed: `app-crm` (5) and
+// `app-todo` (4) rule messages, plus `bulkActions` (18) and `datasets` (62), are
+// untranslated populations nobody is currently working, and a PR that starts
+// walking any of them will race this gate the same way. It fails safe either
+// direction — the DOWN-direction remedy below is what caught both collisions — so
+// the cost is latency and re-derive rounds, not correctness; that is why the fix
+// here is one sentence in that remedy, not a mechanism.
 import { execFileSync } from 'node:child_process';
 import { readdirSync, readFileSync, writeFileSync, existsSync, openSync, closeSync, unlinkSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
@@ -1338,7 +1362,8 @@ for (const [file, allowed] of Object.entries(baseline)) {
   } else if (now < allowed) {
     errors.push(
       `${file}: untranslated declared strings improved ${allowed} → ${now} — ratchet DOWN: ` +
-        `run \`node scripts/check-i18n-coverage.mjs --update\` and commit the baseline.`,
+        `run \`node scripts/check-i18n-coverage.mjs --update\` and commit the baseline. ` +
+        `If you did not touch this population, merge \`origin/main\` first — the movement is probably not yours.`,
     );
   }
 }