Merge remote-tracking branch 'origin/main' into claude/issue-18605-enable-on-install-one-authority

Author: claude

.changeset/18441-translation-target-unknown-contribution-surfaces.md

@@ -0,0 +1,19 @@
+---
+"@objectstack/lint": patch
+---
+
+`translation-target-unknown` no longer reports the locale keys a package ships for what it CONTRIBUTES into metadata another package owns — `objectExtensions[]`-injected fields and validation rules, and the navigation items it contributes into an app it does not declare (#18441, #18442).
+
+Both were `error`, so each one FAILED the run it appeared in, and both carried the orphan remedy — *"Point the key at a declared field, or drop it"*, *"Match the key to an app's `name`, or drop it"* — which deletes a translation the runtime resolves. Measured on the two probe stacks:
+
+- `objects: [crm_lead { name }]` + `objectExtensions: [{ extend: 'crm_lead', fields: { sla_tier } }]` + a `zh-CN` key for `sla_tier` produced one `error` at `translations[0]["zh-CN"].objects.crm_lead.fields.sla_tier`. A genuinely undeclared field on the same stack produced a finding identical but for the name, so **a correct author and a real typo were indistinguishable in the output** — an author who extended an object correctly was told their correct key was wrong, in a run that failed.
+- in `os build`'s per-package leg, a contributor package carrying `navigationContributions` and no apps of its own was told app `crm_enterprise` is one *"which this stack does not define"* — whether or not the app's owner was an entry of the same artifact. Declaring that app is the owning package's job; the contributor cannot do it.
+
+Both folds widen what a key may RESOLVE against and nothing else, so every genuine orphan still reports at `error` with the rule id intact: a typo on an extended object, a `_validations` name no layer declares, an object neither defined nor extended, an app neither defined nor contributed into, and a contributed navigation id nothing contributes are each pinned as a control beside the case they neighbour.
+
+Two bounds worth reading before widening either fold further:
+
+- **The extension fold is exactly two rungs wide because `ObjectExtensionSchema` is.** The declared entry keys are `extend`, `priority`, `fields`, `validations`, `indexes`, `label`, `pluralLabel` and `description`; `views`, `listViews`, `actions`, `fieldGroups`, `sections`, `tabs` and `hooks` are refused BY NAME at the extension level with authoring guidance. So `fields.*` and `_validations.*` are the only rungs of this rule an extension can reach, and a `_views` / `_sections` / `_tabs` / `_actions` key on an extended object is an orphan exactly as before. A new pin asserts that surface against the schema, so the sizing cannot silently stop being true.
+- **An extension target this stack does not DEFINE is rung 2b of the cross-package ladder**: the object key resolves — the extension is proof the stack means that name — and the subtree is skipped WHOLLY, for the reason rung 2 skips a registered platform object's. The owner's field set is not visible from a package that only extends it, and judging the subtree against the injected names alone would report the owner's own field keys as orphans, which is the same defect one level up.
+
+No schema moved, no export moved, and no accept set moved: this is a lint rule's false-positive set narrowing. `Clause-②: no`

.changeset/18550-reference-carrier-residue.md

@@ -0,0 +1,33 @@
+---
+"@objectstack/objectql": minor
+"@objectstack/rest": minor
+"@objectstack/metadata-protocol": minor
+"@objectstack/lint": minor
+"@objectstack/verify": minor
+---
+
+The remaining raw `FieldSchema.reference` readers now **REFUSE** a carrier they cannot read, instead of answering "no target" (#18550). The previous release routed the arbiter (`referenceCarrierOf`) and the lint target readers; these were the measured residue of the same ruling — every reader, not just the arbiter.
+
+`FieldSchema.reference` is `z.string().optional()`, so `ObjectSchema.safeParse` refuses an object- or array-valued carrier at the contract door. These reads are the other door: the one a value reaches only when it never went through parse — a hand-built fixture, a raw `registerObject`, a stored row rehydrated past its schema.
+
+**`@objectstack/objectql`** — both of the delete cascade's carrier reads (`planCascadeAtomicity` and `cascadeDeleteRelations`). This is the one with a measurable runtime consequence, and it is why the level is not `patch`:
+
+```
+before   acct=1 task=1
+delete   RESOLVED true       <- success reported to the caller
+after    acct=0 task=1       <- an ORPHANED master_detail row
+```
+
+An unreadable carrier made the relation invisible to the cascade, so the parent was deleted, the detail row stayed, and the caller was told the delete succeeded — no `restrict` refusal, no `set_null`, nothing logged. It now refuses before any row is touched.
+
+**`@objectstack/rest`** — the public-form lookup picker's field-def fallback. The field def is also hoisted out of the metadata fetch's `catch {}`, so an unreadable carrier is no longer reported as `LOOKUP_TARGET_MISSING`: "no target is declared" and "the declared target cannot be read" want different fixes from whoever owns the metadata.
+
+**`@objectstack/metadata-protocol`** — the seed dependency graph, which also retires an `as string` cast that asserted exactly what its truthiness guard had not checked.
+
+**`@objectstack/lint`** — the four remaining target readers: `masterDetailCount` (`validate-expressions`), the `displayField` consumer edge (`validate-field-consumers`), the field and action-param targets (`validate-object-references`), and `masterOf` (`validate-sharing-rule-enforceability`).
+
+**`@objectstack/verify`** — `relationTarget`, which no longer degrades an unreadable carrier to the generic "has no `reference` target" an object with no relationship metadata at all receives.
+
+`null`, `undefined` and `''` are ABSENCE, not a wrong shape, and still answer `undefined` at every one of these sites — a field is allowed to name no target, and `StrictField` declares `reference` nullable. Each site's absence answer is pinned alongside its refusal.
+
+Upgrading: nothing conformant changes. A non-string `reference` could not be authored, stored or parsed before this release either; what changes is that one now fails loudly at the read instead of being read as an absent target. If a test asserted the old silence, assert the refusal instead.

.changeset/agent-tools-liveness-row-dead.md

@@ -0,0 +1,38 @@
+---
+"@objectstack/spec": patch
+---
+
+fix(spec): the `agent.tools` liveness row is `dead` — it claimed `live` on a key the schema tombstoned
+
+`liveness/agent.json` ships inside this package, and its `tools` row read:
+
+```json
+"tools": { "status": "live", "evidence": "cloud: packages/service-ai/src/agent-runtime.ts", "note": "legacy direct-tool fallback." }
+```
+
+`agent.tools` was removed in protocol 17 (#3894). `src/ai/agent.zod.ts` declares it
+`retiredKey(...)`, which types the key `never` and rejects any authored value with the
+upgrade prescription, and the ADR-0087 conversion `agent-tools-to-skills` deletes it from
+stored rows and built artifacts when the chain is replayed at rehydration. So nothing can
+carry a value for the key and no consumer in any repo can read one — while the ledger's own
+vocabulary defines `live` as "Has a runtime consumer".
+
+The verdict moves `live` -> `dead` with **no key added or removed**: the classified total
+stays at 1094 and the accept set is byte-identical, because a liveness row is a claim about
+the schema rather than the schema. `dead` is the status the ledger's own convention already
+gives this class — of the 40 tombstoned top-level keys across the 36 governed types, 39
+were already `dead` and this was the only outlier — and it is what puts the key on the
+ADR-0049 enforce-or-remove worklist it should have been on since protocol 17. `live-elsewhere`
+is refused rather than left undeclared: that status needs a genuine foreign enforcer, and a
+key nothing can carry a value for has nothing to enforce.
+
+Nothing changes for authors: writing `agent.tools` failed `tsc` and failed the parse before
+this change and fails both after it. What changes is that the ledger, which ships in this
+tarball and is the input to the retirement worklist, no longer certifies a consumer that does
+not exist.
+
+Also in this change: the stale `evidence` pointer is deleted rather than repointed (a `dead`
+row's pointer lives in its `note` by the gate's own design), the ledger's own `_note`
+sentence saying the row was deliberately left unstamped is corrected to record the landed
+re-grade, `liveness/state-counts.md` is regenerated, and a contract test pins the class —
+a `[REMOVED]` tombstone's ledger row says `dead`, on a measured population of 40.

content/docs/permissions/tenant-audit-census.mdx

@@ -71,6 +71,16 @@ as an engine when it declares a write door whose first parameter is named
 `IDataEngine` door signature. Interfaces that extend one inherit it; aliases that
 narrow one (`Partial<Pick<IDataEngine, …>>`) carry it.
 
+**That rule is read off the TYPE, not off the type's name.** The engine type
+index is keyed on declaration names, so a receiver whose declared type is an
+inline type literal has no name to look up — and for two sites, both writing
+under `{ context: { isSystem: true } }`, that alone subtracted a real engine
+write from this population while the census printed the type text and said the
+subtraction was probably wrong. The same door rule is now read off the type text
+itself, so an unnamed type that states a write door places its site. That is
+what moved this page's population from 225 to 227; nothing about the two sites
+changed, only whether this instrument could see them.
+
 **The expensive failure direction is a keyword.** Sites whose receiver the author
 typed `any` have no type to read, and there are 44 of them — just under a fifth
 of the population, concentrated in exactly the seed and bootstrap paths this
@@ -86,7 +96,12 @@ Tenancy itself is enabled *by default* — `isTenancyDisabled()` reads
 `tenancy.enabled === false` and nothing else — so the object registry only has to
 find the opt-outs. Across 117 declared objects — the dated, ⛔ unenforced
 corpus-scale figure below — exactly two opt out (`sys_api_key`,
-`sys_sso_provider`), and no write call site on this surface targets either.
+`sys_sso_provider`), and exactly one write call site on this surface targets
+either — `plugin-auth`'s legacy client-secret migration writes
+`sys_sso_provider` under an elevated context. That is the
+`declares tenancy off` row below reading **1** rather than 0: the object is
+outside this control's reach by its own declaration, not by the census failing
+to see the write.
 
 A **declared object** here is a top-level object declaration in a
 `*.object.ts(x)` file — `export const X = ObjectSchema.create({ name: … })` —
@@ -106,7 +121,7 @@ are reported as `undecidable` rather than assumed either way.
 
 The same holds twice over for the context. An options argument spelled as a
 literal can be read; one spelled `options`, `{ ...opts }`, or handed through a
-forwarding shim cannot, and **67 of the 225 sites are spelled that way**. A
+forwarding shim cannot, and **67 of the 227 sites are spelled that way**. A
 context resolved from an inline literal or a local `const` can be tested for
 `isSystem`; one arriving from a helper call cannot.
 
@@ -140,12 +155,28 @@ direction, on the very figure this page tells other cards to cite. `carries` is
 now three-valued, and an unreadable argument can never contribute to the
 provable count.
 
-⭐ Both are the same shape as the failure this artefact exists for, wearing
-opposite hats: one scored an unread thing as *nothing to report*, the other
-scored an unread thing as *a finding*. `node
-scripts/check-tenant-audit-census.mjs --self-test` pins all of it — 18 classifier
-cases, 6 of which red against the old reading, driven from the gate's own
-self-test rather than from a flag on the generator.
+**A door rule keyed on names read an unnamed door as no door.** Two receivers
+typed with an inline type literal that spells `insert` / `update` with an
+`object: string` first parameter were subtracted from the population — by the
+same instrument that printed their type text on every run and called the
+subtraction probably wrong. Placing them moved the population **225 → 227** and
+the elevated count **106 → 108**. ⭐ It moved the provable yield surface
+(`9`) **not at all**: both sites thread an elevated context, and one of them
+targets a tenancy-opt-out object. The repair is to the denominator and to what
+this page can be read as having examined — ⛔ not to the count anything cites as
+a violation. It is pinned in **both** directions, because a rule that placed
+every inline literal would be the same failure mirrored: an unnamed type that
+states a write door places its site, one that states none is still a subtraction
+that says why, and an indexed type name beside an inline literal still wins and
+reports itself.
+
+⭐ All three are the same shape as the failure this artefact exists for, wearing
+different hats: one scored an unread thing as *nothing to report*, one scored an
+unread thing as *a finding*, and one scored a thing it had read and printed as
+outside its own population. `node
+scripts/check-tenant-audit-census.mjs --self-test` pins the first two — 18
+classifier cases, 6 of which red against the old reading — driven from the
+gate's own self-test rather than from a flag on the generator.
 
 ## ⭐ Deviations from the carried figures, untrimmed
 
@@ -155,10 +186,10 @@ reproduce them. Where it disagrees, it disagrees on the page:
 
 | carried figure | where it survives | this census |
 | :--- | :--- | ---: |
-| 175 write call sites | quoted in the merged changeset | **225** |
+| 175 write call sites | quoted in the merged changeset | **227** |
 | 24 carrying no tenant context | quoted in the merged changeset | **9** provable and tenancy-enabled; **32** more whose options argument is unreadable |
-| 127 of 175 statically decidable, 48 runtime-parameter-name sites | restated on the `isSystem`-scoping card | **149 of 225** decidable, **76** undecidable |
-| 135 (77%) silenced by the `isSystem` guard before the posture gate | the lost issue body — **no surviving corroboration** | **not reproduced**: 106 decidably elevated, 0 decidably not, 102 undecidable |
+| 127 of 175 statically decidable, 48 runtime-parameter-name sites | restated on the `isSystem`-scoping card | **151 of 227** decidable, **76** undecidable |
+| 135 (77%) silenced by the `isSystem` guard before the posture gate | the lost issue body — **no surviving corroboration** | **not reproduced**: 108 decidably elevated, 0 decidably not, 102 undecidable |
 | 141 and 132, two independent re-derivations | the card that filed this work | — |
 
 **The differences are not reconciled, and deliberately so.** The old census's
@@ -169,17 +200,17 @@ at any commit.
 
 Two structural facts do plausibly widen this reading against any hand or regex
 one, and both are counted in the generated tables below: the 44 sites reached
-through an erased (`any`) receiver, and the 40 that name their object through a
+through an erased (`any`) receiver, and the 41 that name their object through a
 `const` rather than inline. An instrument that read either the way a person does
 would report a smaller number and would not say so.
 
 The fourth row is the one worth flagging to anyone citing it. **The 135 / 77%
 figure has no surviving corroboration anywhere in the tree.** This census reads
-106 of 225 (47%) as decidably elevated, with 102 more whose elevation is a
+108 of 227 (48%) as decidably elevated, with 102 more whose elevation is a
 run-time fact — so the claim is neither confirmed nor refuted, and the honest
 answer is that a static reading cannot settle it.
 
-⇒ **Cite `9 / 225`, and say what it is**: the sites whose options argument was
+⇒ **Cite `9 / 227`, and say what it is**: the sites whose options argument was
 READ and holds no tenant context, against a decidably tenancy-enabled object.
 That is the control's provable yield surface. ⛔ Do not cite it as "the sites
 without tenant context" — **32 further sites** have an options argument this
@@ -191,29 +222,29 @@ cannot read, and they are neither in nor out.
 
 | what | count |
 | :--- | ---: |
-| write call sites on the application surface | **225** |
-| …whose object name is statically decidable | 149 |
+| write call sites on the application surface | **227** |
+| …whose object name is statically decidable | 151 |
 | …whose object name is chosen at run time | 76 |
-| …against an object with tenancy ENABLED | 149 |
-| …against an object that declares tenancy off | 0 |
-| threading a tenant context | 141 |
+| …against an object with tenancy ENABLED | 150 |
+| …against an object that declares tenancy off | 1 |
+| threading a tenant context | 143 |
 | PROVABLY carrying none (options read, no context key) | **17** |
 | …of those, against a decidably tenancy-enabled object | **9** |
 | options argument UNREADABLE — may or may not carry one | 67 |
 | …of those, against a decidably tenancy-enabled object | 32 |
-| threading a decidably ELEVATED (`isSystem`) context | 106 |
+| threading a decidably ELEVATED (`isSystem`) context | 108 |
 | threading a context that is decidably NOT elevated | 0 |
 | threading a context whose elevation is a run-time fact | 102 |
 
 | how the instrument reached the site | count |
 | :--- | ---: |
-| receiver carried a readable engine type | 181 |
+| receiver carried a readable engine type | 183 |
 | receiver erased, placed by the object NAME | 18 |
 | receiver erased, placed by an `object: string` PARAMETER | 15 |
 | receiver erased, placed by an `UNTYPED_RECEIVERS` row | 11 |
 
-| object name spelled inline | 109 |
-| object name spelled through a `const` | 40 |
+| object name spelled inline | 110 |
+| object name spelled through a `const` | 41 |
 | object name is an `object: string` parameter | 19 |
 | object name is some other run-time expression | 57 |
 
@@ -232,8 +263,14 @@ must not be spelled the same way as «read it, not an engine».
 
 | what | count |
 | :--- | ---: |
-| write calls subtracted with no defensible reason | **3** |
-| …whose declared type text states an engine door anyway | **2** |
+| write calls subtracted with no defensible reason | **1** |
+| …whose declared type text states an engine door anyway | **0** |
+
+⛔ The second row is **0 by construction**, not a tally that happens to be low.
+An inline type literal stating a write door has no name for the engine type index
+to be keyed on, so the door rule is read off the type text itself and the site is
+PLACED — it is in the population above rather than subtracted here. A non-zero
+value on that row means a door-shaped receiver reached the subtraction anyway.
 
 Every one of them is listed, by receiver and by the type text that could not be
 placed, in [`docs/audits/2026-08-tenant-audit-write-call-sites.counts.md`](https://github.com/objectstack-ai/objectstack/blob/main/docs/audits/2026-08-tenant-audit-write-call-sites.counts.md).
@@ -253,13 +290,13 @@ holds still. They are required to be HERE and to say WHEN they were true;
 their values are not compared. The reasoning, and the measurement behind it,
 are in `scripts/check-tenant-audit-census.mjs`.
 
-Measured on 2026-09-18 at `d4cb05cbf`.
+Measured on 2026-09-18 at `30def652e`.
 
 | corpus scale (not enforced) | count |
 | :--- | ---: |
 | tracked non-test sources scanned | 573 |
 | engine-shaped types recognised | 63 |
 | declared objects in the registry | 117 |
-| same-named calls subtracted as non-engine | 146 |
+| same-named calls subtracted as non-engine | 144 |
 
 {/* END GENERATED: tenant-audit-census */}