Merge remote-tracking branch 'origin/main' into claude/issue-15341-wide-population-channel

Author: claude

.changeset/references-door-organization-forwarding.md

@@ -0,0 +1,9 @@
+---
+"@objectstack/rest": patch
+---
+
+The admin "Used by" panel no longer clears a delete when the caller's own organization is using the item.
+
+`GET /api/v1/meta/:type/:name/references` backs that panel, whose empty case reads "Nothing in the metadata graph points at this item. Safe to delete." — advice given to an operator about to delete something. The door supplied no organization, so the reference sweep read the environment partition only: an organization-scoped `view` (or `dashboard`, `report`, `translation`, `email_template`) pointing straight at the object being deleted was invisible, and the panel issued a false clearance. It now passes the caller's organization, and those references are returned.
+
+The organization is passed RAW, deliberately, and that is the whole of the change — no new parameter, response field or contract surface. `req.params.type` is the reference TARGET, while the sweep spends the organization on the SOURCES it reads per type; `getMetaItems` applies the `allowOrgOverride` read gate to its own request type, so each source is scoped on its own registry flag. A non-overridable source (`object`, `flow`, `app`, …) is still read environment-wide and no pre-#6190 organization-scoped row is resurrected into a delete clearance. An anonymous or organization-less caller reads exactly what it read before, and no status code or response shape moves.

.claude/hooks/guard-main-checkout.selftest.sh

@@ -15,6 +15,12 @@
 #      edited from this session are guarded too.
 #   3. Resolves the file's nearest EXISTING ancestor dir, so creating a new file in a
 #      new directory can't fail-open past the guard.
+#   4. Reads the path from the key the ROUTED TOOL actually carries — a per-tool table,
+#      not one hard-coded key — and blocks rather than guessing when a routed tool's
+#      payload does not carry it. A guard that learns nothing from the payload and falls
+#      back to judging the session's directory returns a verdict that is constant per
+#      session and wrong in BOTH directions, decided by where the session happens to be
+#      rooted rather than by anything about the edit.
 #
 # Deliberate exception (a human quick-fix that still lands via PR): OS_ALLOW_MAIN_EDITS=1.
 
@@ -23,12 +29,63 @@ set -uo pipefail
 [ "${OS_ALLOW_MAIN_EDITS:-}" = "1" ] && exit 0
 
 input="$(cat 2>/dev/null || true)"
+
+# WHICH tools reach this guard is the matcher's job, in .claude/settings.json; which KEY
+# each of them carries its path in is this table's. The two are one pair, and the pairing
+# is checked rather than assumed: a tool routed here with no row below would be read for a
+# key its payload never carries, so the guard would learn nothing and judge the session
+# instead of the file. The self-test's wiring section reads the line below and reds when
+# the matcher routes a tool that has no row in it. Add the tool AND its row together.
+known_path_keys='Edit=file_path Write=file_path MultiEdit=file_path NotebookEdit=notebook_path'
+
+have_jq=0; command -v jq >/dev/null 2>&1 && have_jq=1
+
+scan() { # scan <key-alternation> -> first "key": "value" a plain text scan finds, no jq.
+  # JSON escapes the quotes of any key name quoted inside a string value, so a payload that
+  # merely TALKS about one of these keys cannot outrank the real one.
+  printf '%s' "$input" | grep -oE "\"($1)\"[[:space:]]*:[[:space:]]*\"[^\"]*\"" | head -1 |
+    sed 's/^.*"\([^"]*\)"$/\1/' || true
+}
+
+tool=""
+[ "$have_jq" = 1 ] && tool="$(printf '%s' "$input" | jq -r '.tool_name // empty' 2>/dev/null || true)"
+[ -n "$tool" ] || tool="$(scan 'tool_name')"
+
+key=""
+for row in $known_path_keys; do
+  case "$row" in "$tool="*) key="${row#*=}" ;; esac
+done
+
 file=""
-if command -v jq >/dev/null 2>&1; then
-  file="$(printf '%s' "$input" | jq -r '.tool_input.file_path // empty' 2>/dev/null || true)"
+if [ -n "$key" ]; then
+  # A tool the table names: read exactly the key that tool is contracted to carry.
+  [ "$have_jq" = 1 ] && file="$(printf '%s' "$input" | jq -r --arg k "$key" '.tool_input[$k] // empty' 2>/dev/null || true)"
+  [ -n "$file" ] || file="$(scan "$key")"
+else
+  # A tool the table does not name is not routed here by the matcher. Judge it by whichever
+  # known key it happens to carry, and fall back to the project dir when it carries none.
+  [ "$have_jq" = 1 ] && file="$(printf '%s' "$input" | jq -r '.tool_input.file_path // .tool_input.notebook_path // empty' 2>/dev/null || true)"
+  [ -n "$file" ] || file="$(scan 'file_path|notebook_path')"
 fi
-if [ -z "$file" ]; then
-  file="$(printf '%s' "$input" | grep -o '"file_path"[[:space:]]*:[[:space:]]*"[^"]*"' | head -1 | sed 's/^.*"\([^"]*\)"$/\1/' || true)"
+
+# A ROUTED tool that carries no path under its own key is schema drift, not a missing path:
+# the contract this guard was written against has moved. Report it instead of guessing.
+if [ -n "$key" ] && [ -z "$file" ]; then
+  cat >&2 <<EOF
+⛔ Blocked: a $tool payload carrying no "$key" — this guard cannot tell which file is being written.
+
+$tool is routed to this guard by .claude/settings.json, and this guard reads that tool's
+path from .tool_input.$key. An absent value means the tool's input schema has moved under
+the guard. Falling back to the session's directory would make the verdict a constant per
+session — right or wrong purely by where the session is rooted, not by the edit — so this
+blocks instead.
+
+Fix the row for $tool in this hook's known_path_keys table, then re-run
+.claude/hooks/guard-main-checkout.selftest.sh.
+
+Deliberate non-task exception: re-run with OS_ALLOW_MAIN_EDITS=1.
+EOF
+  exit 2
 fi
 
 # Judge the checkout at the file's nearest existing ancestor dir (handles new files in

.claude/hooks/guard-main-checkout.sh

@@ -115,7 +115,7 @@ PM 的工作是循环:选卡 → 认领 → 派发 → 收集 → 复核 → 报
 | `pm:retriage` | 等分诊改判:与现行 `pm:*` 并存、⛔ 不摘原标;带本标签的 `pm:queue` 卡跳过派发 |
 | `finding` | 观察类记录,恒 = 待首次定级;定级即离标;不占队列不进收件箱 |
 | `target:<major>` | 发版阻塞:每个 backlog 恰好一个生产者 |
-| `pm:epic`(父单) | 子树已委托 epic PM;其它 PM 不把其 sub-issue 当候选 |
+| `pm:epic`(父单或 sub-issue) | 已由 epic PM 保留;其它 PM 永不取;⛔ 永不与 `pm:queue` 同挂 |
 | `pm:seat` | 座位登记贴:协议载体,不是待分诊的工作 |
 | `priority:p0` | 插队:可超 `batch`、破轮次立即派发;⛔ 不豁免同文件串行与认领协议 |
 | open PR 引用该单 | 已实现,复核中 |
@@ -296,17 +296,17 @@ PM 的工作是循环:选卡 → 认领 → 派发 → 收集 → 复核 → 报
 ## Epic 子树车道
 
 - 大开发(父单 + sub-issue 树)整体委托一个专职 PM 会话:`/pm-dispatch epic:#<n>`。
-- 队列 = 子树 open 未认领 sub-issue,每轮重读不缓存。
 - 委托信号成对落地:父单打 `pm:epic` + 正文写会话 ID 与声明的文件领地。
-- 其它 PM 的候选获取跳过整棵子树。
-- 域座位批次选择时读一次 `label:pm:epic` 索引,避开领地相交。
-- epic PM 不同时持有 `domain:*` 座位;认领纪律全套照做。
-- 触 `packages/spec` 的 sub-issue 照旧转 spec 座位。
-- 衍生问题三分法,判据:不修它,epic 验收过不过得去。
-- in-scope ⇒ 挂父单 sub-issue 下轮自动入队。
-- 触 spec/公共契约 ⇒ 转 spec 座位队列,epic 侧写 `Blocked-by:`。
-- 顺带发现 ⇒ 独立立单进修复落地仓 backlog,查重先行。
-- ⛔ 不借 sub-issue 通道把未分诊的卡塞进池子。
+- epic 立卡挂父单、打 `pm:epic`,⛔ 永不 `pm:queue`;`label:pm:epic` 即父子保留全集,域座位不取。
+- 队列 = 子树 open 未认领 sub-issue,每轮重读不缓存;其它 PM 候选获取跳过整棵子树。
+- 域座位批次选择读一次 `label:pm:epic` 索引,避开领地相交;epic PM 不兼任 `domain:*` 座位。
+- 认领纪律全套照做:先写标签、再 `Claim:`、再全线程重读;认领后 `pm:epic` 留在卡上。
+- 离开子树(交车道或转 spec 座位)同一笔标签写摘 `pm:epic` 加 `pm:queue`。
+- `pm:epic` + `pm:queue` 同卡 = 半状态(保留兼移交);后者即已移交,取回走全套认领协议含重读。
+- 单车道仓(无 `domain:*`)开卡即认领合法;多车道仓域标签前置照旧,子树标记即保留。
+- 衍生问题三分,判据:不修它 epic 验收过不过得去;in-scope ⇒ 挂父单 sub-issue 下轮自动入队。
+- 触 `packages/spec`/公共契约(sub-issue 或衍生)⇒ 照旧转 spec 座位队列,epic 侧写 `Blocked-by:`。
+- 顺带发现 ⇒ 独立立单进修复落地仓,查重先行;⛔ 不借 sub-issue 通道塞未分诊卡进池子。
 - 每次分流留一行审计评论;父单维护 checklist 汇总评论,决策仍锚在具体 sub-issue。
 - 收尾四步、僵尸回收与领地防撞细则见 `references/seat-post-protocol.md`。
 

.claude/skills/pm-dispatch/SKILL.md

@@ -114,7 +114,7 @@ walk 看不见的属性就是 ratchet 管不到的属性。
 
 墓碑条目的 note 模板(house style 原文,如 `liveness/action.json`):
 
-> `REMOVED <date> (#<issue>) — tombstoned at the schema (retiredKey carries the prescription; authoring it is a tsc error and a parse error) and stripped from sources by the protocol-<N> conversion. The entry stays because retiredKey keeps the key in the walked shape (the rls.priority precedent); <what to do instead>.`
+> `REMOVED <date> — tombstoned at the schema (retiredKey carries the prescription; authoring it is a tsc error and a parse error) and stripped from sources by the protocol-<N> conversion. The entry stays because retiredKey keeps the key in the walked shape (the rls.priority precedent); <what to do instead>.`
 
 ### ⚠ 四张 ratchet 的可见性,按路线是**相反**的 —— 拿错对照就会判错
 
@@ -151,7 +151,7 @@ ratchet(#2978)会先开火,要求你**有意删除**对应的 manifest key;删
 五条惯例,树上每个墓碑都遵守 —— 逐点判定归下面那个 pin 测试,不归这段散文:
 
 1. 反引号包着的**全限定**键打头 —— `` `flow.errorHandling.fallbackNodeId` ``,不是裸尾段。
-2. `was removed in @objectstack/spec <version> (#issue[, ADR-XXXX Dn])`。
+2. `was removed in @objectstack/spec <version> (ADR-XXXX[ Dn])`;`#<n>` 归 schema 注释,`check:doc-authoring` 把门。
 3. 一个破折号从句讲**它为何惰性或错误** —— "it never had an effect"、"no renderer ever read it"。
 4. 祈使句修复:改名写 "use `<replacement>`" + "Rename the key; the value (…) is unchanged.";删除写 "Delete
    the key." + **真正生效的机制是什么**。

.claude/skills/spec-property-retirement/SKILL.md

@@ -158,7 +158,7 @@ The largest single consumer — **17 of the 106 sites**.
 |:--|:---|:---|:---|:---|
 | 48 | Object API-exposure gate bypassed (`apiEnabled` / `apiMethods`) | runtime | Get: internal self-writes ignore exposure declarations — these govern **external** exposure, not engine self-writes | `action-execution.ts:138` |
 | 49 | Action `requiredPermissions` bypassed | runtime | Get: engine self-invocation runs any action | `action-execution.ts:401` |
-| 50 | `manage_metadata` bypassed on metadata writes | runtime, rest | Get: schema writes without the capability | `domains/meta.ts:471`, `:874`, `rest-server.ts:5016`, `:6430`, `:6678`, `:7109`, `:7302` |
+| 50 | `manage_metadata` bypassed on metadata writes | runtime, rest | Get: schema writes without the capability | `domains/meta.ts:471`, `:874`, `rest-server.ts:5016`, `:6442`, `:6690`, `:7121`, `:7314` |
 | 51 | The shared metadata-write verdict itself returns `allowed` | metadata-core | Get: the one function all of row 50's doors consult answers yes before any capability is examined | `meta-write-capability.ts:134` |
 | 52 | Anonymous-deny seam satisfied on the domain dispatchers and the package/federation routes | runtime, rest | Get: passes with no `userId` | `domains/actions.ts:421`, `domains/ai.ts:60`, `domains/automation.ts:989`, `domains/meta.ts:232`, `domains/security.ts:78`, `domains/packages.ts:422`, `external-datasource-routes.ts:302`, `package-routes.ts:97` |
 | 53 | MCP principal check satisfied | runtime | Get: MCP surface reachable with no user | `domains/mcp.ts:61` |

content/docs/permissions/system-context.mdx

@@ -309,7 +309,23 @@ describe('[#13160] §1 the production supplier fulfils with `undefined` rather t
 // ---------------------------------------------------------------------------
 
 describe('[#13160] §2 the consumer surface, counted from the tree', () => {
-    it('76 invocation sites, 97 mentions — the thread\'s two control numbers hold', () => {
+    it('77 invocation sites, 98 mentions — the thread\'s two control numbers hold', () => {
+        // [#13753, the `/references` half] 76 → 77 sites / 97 → 98 mentions.
+        // `GET /meta/:type/:name/references` resolved NO identity, so the
+        // reference sweep behind the admin "Used by" panel read the env
+        // partition only and rendered "Nothing in the metadata graph points at
+        // this item. Safe to delete." over an organization it never read. It
+        // joins as a LOCALLY CAUGHT site in the continuation-line spelling, for
+        // the same reason as its siblings: this door does not sit behind the
+        // shared anonymous floor either.
+        //
+        // ⚠️ Here the two numbers moved by the SAME amount (+1 and +1), which
+        // is the third pattern this block has recorded and is not a mistake:
+        // the door's new comment states the memoised resolution in prose
+        // WITHOUT naming the symbol, so the call is the only new mention. A
+        // reader checking the +1/+2 shape of the entries below should read this
+        // as the mention count tracking mentions, not as a lost site.
+        //
         // [#13753] 75 → 76 sites / 95 → 97 mentions. `GET /meta/diagnostics`
         // resolved NO identity, so the Studio governance sweep could not state
         // which organization's partition it was reading and reported clean
@@ -361,11 +377,11 @@ describe('[#13160] §2 the consumer surface, counted from the tree', () => {
         // `enforceAuth` was measured NOT to be the repair). A mention count
         // that tracked the site count exactly would be measuring one thing
         // twice.
-        expect(SITES.length).toBe(76);
-        expect(SOURCE.split('resolveExecCtx').length - 1).toBe(97);
+        expect(SITES.length).toBe(77);
+        expect(SOURCE.split('resolveExecCtx').length - 1).toBe(98);
     });
 
-    it('the split is 23 locally caught / 53 bare — NOT 16 / 53, which does not add to 76', () => {
+    it('the split is 24 locally caught / 53 bare — NOT 16 / 53, which does not add to 77', () => {
         // 16 sites spell the catch on the invocation line; 4 more spell it on
         // the continuation line. A single-line grep sees 16 and the arithmetic
         // silently loses four sites.
@@ -375,12 +391,12 @@ describe('[#13160] §2 the consumer surface, counted from the tree', () => {
         // be the first of its kind and would break the structural claim below.
         const sameLine = CAUGHT.filter((s) => SOURCE.split('\n')[s.line - 1].includes('.catch('));
         expect(sameLine.length).toBe(16);
-        expect(CAUGHT.length).toBe(23);
+        expect(CAUGHT.length).toBe(24);
         expect(BARE.length).toBe(53);
         expect(CAUGHT.length + BARE.length).toBe(SITES.length);
     });
 
-    it('⭐ every one of the 53 bare sites is guarded on the VERY NEXT LINE, and none of the 23 caught ones is', () => {
+    it('⭐ every one of the 53 bare sites is guarded on the VERY NEXT LINE, and none of the 24 caught ones is', () => {
         // This inverts the reason the thread gave for doing the bare sites
         // first ("no local signal that a fault becomes an anonymous subject").
         // The bare sites are bare BECAUSE the shared anonymous floor is the