Merge origin/main into claude/issue-15374-unlinked-db-boot-check

Author: claude

.changeset/decision-predicate-envelope-refused.md

@@ -0,0 +1,16 @@
+---
+"@objectstack/spec": minor
+"@objectstack/service-automation": minor
+"@objectstack/lint": minor
+---
+
+A flow predicate authored as a CEL envelope is now refused at build time, instead of running unread by either validator.
+
+A `predicate`-role expression slot holds **bare CEL text** — `DecisionConditionSchema.expression` is declared `z.string()`, and so is a screen field's `visibleWhen`. An author who instead wrote the `{ dialect, source }` expression *envelope* there reached a shape nothing could see: a flow node's `config` is an open `z.record(z.unknown())` that no Zod schema is parsed against, the unknown-key walk exempts the schemaless node types on purpose (`decision` publishes no descriptor `configSchema`), and the expression ledger's `predicate` arm skipped every non-string as "a type violation for the schema pass to report" — a schema pass that, for those node types, does not exist. `registerFlow` accepted the flow, `objectstack validate` reported nothing, and the evaluator was the only layer that ever read the predicate.
+
+- `resolveFlowNodeExpressions` now emits a non-string sitting in a `predicate` slot, and the new `predicateSlotRefusal` / `PREDICATE_SLOT_STRING_REFUSAL` say why it is refused — one notion, derived once, read by both validators so build time and author time cannot disagree about the shape. `flow-template` slots keep the old rule: no validator implements that dialect, so a finding there is one nobody could judge.
+- `registerFlow` throws, naming the node, the slot and the index, and attributing the finding to the envelope's own `source`. `objectstack validate` reports the same refusal as a located `error`.
+
+**String predicates are untouched, deliberately.** A whitespace-only string still means "not authored" on both sides, exactly as before; what a non-empty string *says* is still judged by `validateExpression('predicate', …)`, brace trap and all. Only the shape moved.
+
+An app that authored an envelope in one of these slots now fails to register with a message naming the slot; the fix is to write the predicate as bare CEL text (`record.rating >= 4`). The `{ dialect, source }` envelope remains the `value`-role spelling, on the `assignment` node's `assignments` map.

.changeset/lint-eval-throwing-generator-unscorable.md

@@ -0,0 +1,32 @@
+---
+"@objectstack/cli": patch
+---
+
+`os lint --eval` no longer scores a failed generation as a perfect one: a generator that throws now counts 0 toward `meanScore` instead of 100.
+
+The harness has always handled a throwing `--generator` by substituting an empty stack and scoring that. An empty stack is **100 / grade `A` / `valid: true`** — it has nothing wrong with it because it has nothing in it. So a live eval in which every single generation failed reported the best possible headline number:
+
+```
+os lint --eval --json --generator ./throws.mjs
+exit 1 · ok: false · passed: 0 · failed: 5 · meanScore: 100
+every case: score 100 · grade A · valid true · generationError "model unavailable"
+```
+
+`meanScore` is the first number a human scanning that report reads, and it read perfect precisely when the model under test produced nothing.
+
+**What was NOT wrong: `passed`.** It carries its own guard (`!generationError && …`), so the failed cases were reported as failed and `ok` was `false` throughout. A reader who cross-read `ok`/`passed` was safe; a reader who checked the mean and moved on got exactly the wrong impression. That is the whole defect, and nothing about `passed`, `ok`, `total`, `failed` or the exit code changes here.
+
+The repair is the verdict the sibling failure path already used. A generator that *returns* a value nobody can walk was already scored `0 / F / valid: false`, with the reason written into the module: a stack that cannot be walked is not an empty stack, and `valid: true` for one that was never parsed is simply false. A stack that was never produced is not an empty stack either — so both now answer the same:
+
+```json
+{ "id": "invoice_with_line_items",
+  "generationError": "model unavailable",
+  "passed": false,
+  "score": { "score": 0, "grade": "F", "valid": false } }
+```
+
+and the run above now reports `meanScore: 0`.
+
+`meanScore`'s denominator is unchanged and is now stated in the payload's own documentation: the mean is over every case **attempted**, so a failed case contributes its 0 and is counted. The alternative — averaging only over cases that could be scored — is a different metric that would report the quality of the generations that arrived while staying silent about how many never did; a `meanScore` that switched denominators without saying so would be a worse defect than the one being fixed.
+
+No key is added to or removed from the `--json` payload, and nothing a generator can return is newly accepted or rejected: an off-shape stack is still a **scored** case whose schema errors are why it fails, never a generation error.

.changeset/references-door-organization-forwarding.md

@@ -0,0 +1,9 @@
+---
+"@objectstack/rest": patch
+---
+
+The admin "Used by" panel no longer clears a delete when the caller's own organization is using the item.
+
+`GET /api/v1/meta/:type/:name/references` backs that panel, whose empty case reads "Nothing in the metadata graph points at this item. Safe to delete." — advice given to an operator about to delete something. The door supplied no organization, so the reference sweep read the environment partition only: an organization-scoped `view` (or `dashboard`, `report`, `translation`, `email_template`) pointing straight at the object being deleted was invisible, and the panel issued a false clearance. It now passes the caller's organization, and those references are returned.
+
+The organization is passed RAW, deliberately, and that is the whole of the change — no new parameter, response field or contract surface. `req.params.type` is the reference TARGET, while the sweep spends the organization on the SOURCES it reads per type; `getMetaItems` applies the `allowOrgOverride` read gate to its own request type, so each source is scoped on its own registry flag. A non-overridable source (`object`, `flow`, `app`, …) is still read environment-wide and no pre-#6190 organization-scoped row is resurrected into a delete clearance. An anonymous or organization-less caller reads exactly what it read before, and no status code or response shape moves.

.changeset/try-catch-error-value-code-key.md

@@ -0,0 +1,11 @@
+---
+"@objectstack/spec": minor
+---
+
+feat(spec): `TryCatchErrorValueSchema` declares the `code` key the `try_catch` engine binds (#14954)
+
+`TryCatchErrorValue` — the ONE shape the catch region's author, the engine and the run log share for the value a `try_catch` binds to `errorVariable` (default `$error`) — gains an optional `code: string`: the platform-classified error code (ADR-0112) the failing node's own result carried, e.g. `create_record`'s `DUPLICATE_RECORD`. The engine has bound it since `@objectstack/service-automation`'s #14419 change; the schema was a plain `z.object` that did not declare it, so a round-trip through the declared shape silently STRIPPED the key the engine had put there, and the generated reference page documented four keys where the runtime binds five. The `errorVariable` description on `TryCatchConfig` names `code` too, so the authorable surface documents branching on `$error.code`.
+
+Typed as an open `string`, deliberately not `StandardErrorCode` and not the ledger union: ADR-0112 D3/D4 with the #9106 amendment make the code vocabulary `StandardErrorCode` ∪ registered ledger codes ∪ tenant-authored codes, and `NodeExecutor` is third-party-registrable, so a closed type would be false the moment anyone registers an executor that throws its own code. The closed-at-every-door rule governs `ApiErrorSchema.code` at an HTTP door; this value is bound in-process and never crosses one.
+
+Additive and optional: every value that parsed before parses byte-identically, and a binding without a classified code still carries no `code` key — absent means "no classified code", never "nothing failed". Semver: a new optional key on a published schema widens the accept set and the exported `TryCatchErrorValue` type without retiring or renaming anything ⇒ `minor`; no ADR-0087 entry is owed because there is nothing an upgrader must migrate.

.changeset/widget-measures-missing-every-family.md

@@ -0,0 +1,32 @@
+---
+'@objectstack/lint': minor
+---
+
+`widget-measures-missing` — the empty-measure selection is reported on every widget family, not just charts
+
+`chart-measures-missing` (#15462) reported the authoring placeholder only for the chart
+family, but the return that produces it is type-independent. At the `@object-ui` revision
+this repo pins (`.objectui-sha` = `a472b0716`), `packages/plugin-dashboard/src/DatasetWidget.tsx:683`
+reads `if (values.length === 0)` and returns *"Pick measures (values) for this dataset
+widget."* ABOVE `isMetric` (`:423`, over `METRIC_TYPES` at `:343`), `isTable` (`:424`) and
+the chart branch alike. So a `metric`, `kpi`, `gauge`, `solid-gauge`, `bullet`, `table` or
+`pivot` widget that selects no measures renders the same placeholder — the KPI number or
+the table the author declared is not drawn at all — and nothing reported it:
+`table-count-only` requires `values.length > 0` before it looks, and the rules that iterate
+`dimensions[]`/`values[]` are silent on an empty array by construction.
+
+- **New id `widget-measures-missing`** — a NON-chart declared widget type selects no
+  measures. Warning tier, suppressible per widget with
+  `suppressWarnings: ['widget-measures-missing']`, exactly as the chart-family id is. The
+  message states the consequence its family actually has (the single KPI number is not
+  drawn / no table is rendered) and the hint names the dataset's declared measures.
+- **`chart-measures-missing` is unchanged** — same id, same chart-family population, same
+  message and same suppression. The condition split rather than widened because "chart"
+  stops naming it once the population is every family, while the old id is reachable from
+  the package barrel (a public-surface contract) and may already be written into a board's
+  `suppressWarnings`.
+- `chart-dimensions-missing` stays chart-family only: a dimensionless `metric` or `table`
+  is what those families are for.
+
+The two never double-report one widget, in the pin's own order: the measures check runs
+before the dimensions one, and `table-count-only` already skips an empty selection.