Merge remote-tracking branch 'origin/main' into claude/issue-11042-executable-plural-meta-calls

# Conflicts:
#	packages/spec/liveness/object.json

Author: claude

.changeset/adr0006-d2-client-environments-namespace.md

@@ -0,0 +1,138 @@
+---
+"@objectstack/client": minor
+"@objectstack/cli": minor
+---
+
+feat(client,cli)!: `client.projects.*` becomes `client.environments.*`, the scoped sub-client becomes `ScopedEnvironmentClient`, and the unwrap keys follow the wire (#12866, #12882, ADR-0006 D2)
+
+<!-- adr-0087: not-required (runtime-interface-only packages/client/src/index.ts#ObjectStackClient) The renamed surface is a member of a published runtime TypeScript class and the response-key shapes it declares inline. There is no Zod schema, no `packages/spec` declaration, no authorable key and no stored representation behind either half — measured 2026-08-28: zero `projects` envelope contracts anywhere in `packages/spec/src`, positive control being that `environments` hits do exist there. So `objectstack migrate meta` has nothing to visit and there is no tombstone to mint. The channel that reaches every affected consumer is the COMPILER, at the call site, which is strictly more precise than a ledger line; the wire half is carried by the paired control-plane release in the same coordinated window. MEASURED CAVEAT, recorded here rather than worked around: this claim is REFUSED by check-adr-0087-registration at step 4, because `packages/spec/src/api/contract.zod.ts` names `ObjectStackClient` in a JSDoc PROSE comment (line 164, describing what `unwrapResponse` keys on) while neither declaring nor importing it, and the predicate does not strip comments before scanning a metadata surface for references. Steps 1-3 pass. The disposition is left stated rather than swapped for `no-migration-prescription`, which would mechanically pass only through a detector blind spot while contradicting the migration table below it — the exact anti-pattern this gate's own header records as #8299. -->
+
+
+**BREAKING** public-API rename on `@objectstack/client`, and a breaking change to
+the `--format json` payload of the `os environments` command family. It lands
+after the v17.0.0 cut, so the lockstep launch-window convention ships it as
+`minor` (`scripts/check-changeset-no-major.mjs`); the version number is not the
+migration signal here, this entry is.
+
+This is the **SDK half** of one coordinated cross-repo rename. The **producer
+half** is the cloud control plane, which renames the same field keys on the same
+endpoints. Neither half ships alone: shipping the SDK half by itself is
+ADR-0006 D3, permanently declined, as is any mapping layer between the two
+spellings.
+
+## Migration
+
+**No aliases exist.** The old namespace is gone, not deprecated — there is no
+`client.projects` getter, no `res.project ?? res.environment` hedge, and none is
+coming (ADR-0006 D3 declined a mapping layer with reasons; the v5.0 rename rule
+「no aliases」 is the standing one). Every call site moves in one edit.
+
+### Method namespace
+
+| before | after |
+| --- | --- |
+| `client.projects.list(…)` | `client.environments.list(…)` |
+| `client.projects.get(id)` | `client.environments.get(id)` |
+| `client.projects.create(req)` | `client.environments.create(req)` |
+| `client.projects.update(id, patch)` | `client.environments.update(id, patch)` |
+| `client.projects.delete(id, opts)` | `client.environments.delete(id, opts)` |
+| `client.projects.activate(id)` | `client.environments.activate(id)` |
+| `client.projects.rotateCredential(…)` | `client.environments.rotateCredential(…)` |
+| `client.projects.updateHostname(…)` | `client.environments.updateHostname(…)` |
+| `client.projects.updateVisibility(…)` | `client.environments.updateVisibility(…)` |
+| `client.projects.listRevisions(…)` | `client.environments.listRevisions(…)` |
+| `client.projects.listBranches(id)` | `client.environments.listBranches(id)` |
+| `client.projects.renameBranch(…)` | `client.environments.renameBranch(…)` |
+| `client.projects.deleteBranch(…)` | `client.environments.deleteBranch(…)` |
+| `client.projects.retryProvisioning(id)` | `client.environments.retryProvisioning(id)` |
+| `client.projects.listDrivers()` | `client.environments.listDrivers()` |
+| `client.projects.packages.*` | `client.environments.packages.*` |
+
+The URL paths are unchanged — they were already on the `environments` spelling
+(`/api/v1/cloud/environments/…`). Only the method namespace and the response
+field keys move.
+
+### Response keys
+
+| before | after | where |
+| --- | --- | --- |
+| `res.projects` | `res.environments` | `list` (the `total` key is unchanged) |
+| `res.project` | `res.environment` | `get`, `update`, `activate`, `updateHostname`, `updateVisibility`, `retryProvisioning` |
+
+The joined blocks on `get` (`database`, `credential`, `membership`,
+`organization`) keep their names, as do every `packages.*` key, the
+`delete`/`listBranches`/`renameBranch`/`deleteBranch` payloads (already
+`environmentId`-keyed), and `listRevisions`.
+
+### Two declarations that were false before this change
+
+Measured 2026-08-28 against the cloud repo's `main`, and corrected here rather
+than carried forward under a new spelling:
+
+- **`create` never answered a `project` key at all.** `POST /api/v1/cloud/environments`
+  has always answered `{ environment, warnings, durationMs, hostnameAssignment? }`.
+  The old `{ project: any; database: any }` declaration was not merely
+  pre-rename, it was wrong against the running control plane — and
+  `os environments create` read `res.project.id` through it, so the default
+  `--activate` silently never activated and the table output printed
+  `undefined`. Both are fixed by this rename.
+- **`create` declares no `database` key.** That route does not send one; the key
+  was declared NON-optional, so `res.database.driver` typechecked and threw. The
+  method that really answers a `database` block is `get`, which keeps it.
+
+The keys `create` does send beside `environment` (`warnings`, `durationMs`,
+`hostnameAssignment`) are deliberately still undeclared — adding them is new
+published surface and a separate decision.
+
+### The environment-scoped sub-client (#12882)
+
+The fourth `project`-spelled surface on the same class, folded in by the same
+maintainer ruling. ADR-0006's D1 census named three surfaces and missed this one;
+it was an oversight, not a deliberate retention.
+
+| before | after |
+| --- | --- |
+| `client.project(id)` | `client.environment(id)` |
+| `ScopedProjectClient` (exported class) | `ScopedEnvironmentClient` |
+
+Same no-alias rule: neither old spelling survives. `client.project(id)` is not a
+deprecated method, it is gone, and the exported class is gone under its old name
+— a `import { ScopedProjectClient }` fails at the import line, which is the
+loudest and most precise channel this change has.
+
+Nothing about the behaviour moves: the scoped client still prefixes
+`/api/v1/environments/:environmentId/...`, still exposes the same `data` / `meta`
+/ `batch` / `packages` shape, and the thrown guard message becomes
+`[ObjectStack] environment(id): environmentId is required`.
+
+**Deliberately NOT renamed, because each is a different surface needing its own
+decision:** `setProjectId` / `getProjectId` on the client — `getProjectId` is a
+cross-package protocol contract that `packages/runtime` and
+`packages/metadata-protocol` both speak, so it is a coordinated rename, not a
+local one — and the REST API config keys `enableProjectScoping` /
+`projectResolution`, which are live keys read by `packages/cli/src/commands/serve.ts`.
+The docblocks that name them are worded so they stay true.
+
+Note for whoever compiles the release notes: four other pending changesets in
+this release describe methods on `ScopedProjectClient` under its old name
+(`client-unannotated-return-erasure`, `client-saveitem-ifmatch-header`,
+`client-meta-saveitem-query-options`, `client-precise-sdk-return-types`). They
+were accurate when written and are deliberately left alone; this entry is the one
+that renames the class.
+
+### JSDoc
+
+The `create` docblock claimed the server delegates to
+`ProjectProvisioningService.provisionProject`. That spelling has zero hits in the
+control plane (measured 2026-08-28). Both this SDK's docblock and
+`os environments create`'s now name the **endpoint** instead, which is the one
+identifier an in-repo reader can verify — the class lives in a repo this one
+never compiles against, so no gate here could ever have caught the rot.
+
+## CLI
+
+`os environments list | show | create | switch | bind` follow the same rename.
+No flag, argument, exit code or command id changes. `--format json` / `--format yaml`
+payloads are `formatOutput(res, …)` straight from the control-plane response, so
+their top-level keys change with the wire: a script reading `.projects` or
+`.project` from those payloads reads `.environments` / `.environment` instead.

.changeset/artifact-registrar-policies-dead-pointer.md

@@ -0,0 +1,41 @@
+---
+"@objectstack/metadata": patch
+"@objectstack/runtime": patch
+---
+
+fix(metadata,runtime): retire the `policies` dead pointer in both artifact registrars, and pin the map that carried it (#12894)
+
+Zero behaviour change, by construction. Both readers of an artifact boot carried
+a `policies` -> `policy` entry — the artifact door's `ARTIFACT_FIELD_TO_TYPE`
+(`packages/metadata/src/plugin.ts`) and `AppPlugin`'s ADR-0057 `SECURITY_FIELDS`
+list (`packages/runtime/src/app-plugin.ts`) — and **neither could ever match**.
+`ObjectStackDefinitionSchema` is a `strictObject` that declares no top-level
+`policies` key, so a definition carrying a `policies` array is refused outright
+by the door's strict parse and reaches neither registry. The word is real but
+lives one level down: on a permission set `policies` is an alias for
+`rowLevelSecurity` (`PERMISSION_SET_KEY_ALIASES`) — a key on an **item**, never a
+collection. Both entries are removed, each leaving in place the note the map
+already writes for a retirement: what it pointed at, and why it could not match.
+
+That was the third entry retired from `ARTIFACT_FIELD_TO_TYPE` for exactly this
+reason (`themes`, then `roles` -> `positions`, which "matched nothing and
+silently dropped compiled positions"). So the deletion ships with the thing the
+two predecessors did not have — a check that fails when the pattern recurs:
+
+- `check:stack-collection-maps` now reconciles **eight** hand-maintained
+  enumerations against the schema, not seven. `SECURITY_FIELDS` is the new
+  eighth, and how it was missing is the finding rather than a footnote: it is
+  the only one of the eight that pairs its keys as `[collection, kind]` tuples,
+  which neither existing extractor could read, so the site was skipped rather
+  than reported. Re-adding `policies` — or any other key the schema does not
+  declare — to **either** registrar now fails the gate with the site named.
+- A new `tupleFirstItems` extractor reads that shape, with a self-test case
+  (13 assertions, up from 12) covering the comment/nesting cases the flat
+  string-array extractor already pins.
+
+The mirror-image half of the same measurement is **carried, not shipped**:
+`capabilities` is a declared top-level collection that `SECURITY_FIELDS`
+registers and the door's map does not, making `AppPlugin` its sole registrar on
+an artifact boot. Adding it to the door changes what an artifact boot registers,
+so it is measured and handed to the route-ownership decision (#12892) instead of
+being smuggled in here. The new waiver row records the asymmetry in place.

.changeset/boolean-aggregands-numeric-min-max.md

@@ -0,0 +1,13 @@
+---
+'@objectstack/spec': patch
+'@objectstack/driver-sql': patch
+'@objectstack/driver-memory': patch
+'@objectstack/driver-mongodb': patch
+'@objectstack/objectql': patch
+---
+
+`min`/`max` over a **boolean** aggregand now answer the numbers `0`/`1` on every face — maintainer ruling 2026-08-28 (#11152, option A), superseding #11249's `false`/`true`: booleans aggregate as numbers, with no per-aggregate exception, so one flag column's `sum`/`avg`/`min`/`max` all answer in one numeric domain.
+
+FROM → TO, per face: `driver-sql` (every dialect, `driver-sqlite-wasm` included via the shared compiler) no longer re-presents `min`/`max` results over a declared boolean as JSON booleans — `false`/`true` → `0`/`1`; row reads (`find()`) still present booleans, and `min`/`max` over an empty window still answer `null`. `driver-memory` (data and analytics faces) and objectql's in-memory fallback compare booleans as the numbers they are worth — `false`/`true` → `0`/`1`; strings, dates and numbers reach the same comparison they always did. `driver-mongodb` wraps `$min`/`$max` in the same boolean-only `$cond` coercion `$sum`/`$avg` use — `false`/`true` → `0`/`1`; null/missing still pass through, so the empty window still answers `null`. A caller reading `min`/`max` over a boolean column as a JSON boolean should read the number (`0` is false-y, `1` truthy, so boolean coercion at the call site keeps working).
+
+The cross-driver aggregation conformance fixture (`AGGREGATION_ROWS`, `@objectstack/spec/data`) now carries the boolean column those rulings are pinned by: `flag` (3 true / 3 false), with cases for `sum`=3, `avg`=0.5, `min`=0, `max`=1, `count`=6, `count_distinct`=2 and a grouped `min` over the deliberately asymmetric groups — the reach gap #11065 and #11151 were both found through (a boolean aggregand no conformance cell could see) is closed.

.changeset/data-engine-syncobjectschema-declared.md

@@ -0,0 +1,6 @@
+---
+'@objectstack/spec': minor
+'@objectstack/service-messaging': patch
+---
+
+`IDataEngine` declares the optional `syncObjectSchema?(objectName: string): Promise<void>` member (#12482) — on-demand single-object physical schema sync: create/alter the object's table, or for a federated (external) object register its DDL-free read metadata (ADR-0015 §18). Additive contract catch-up under the 2026-08-25 #11833 ruling's item-4 precedent as executed by #12248: the member #12010's inventory left "not verified" is verified — implemented on `ObjectQL`, consumed cross-package by two service packages, both until now through consumer-local structural recovery (`service-datasource`'s `ConnectionEngineLike.syncObjectSchema?`, called per bound external object after its driver connects; `service-messaging`'s system-table provisioning via an `as unknown as` cast whose own comment recorded the member "lives on the concrete ObjectQL engine, not the contract"). FROM undeclared (consumers cast or re-declare structurally) TO declared-optional on `IDataEngine` (consumers read `engine.syncObjectSchema` directly and keep their runtime probes). `service-messaging` drops the now-redundant cast (behaviour unchanged). Optional, so existing `IDataEngine` implementers and test doubles are unaffected. No runtime change.

.changeset/entry-nameability-generalized-closure.md

@@ -0,0 +1,5 @@
+---
+"@objectstack/spec": minor
+---
+
+Close the entry-nameability invariant on the four remaining public entries that leaked it (#12414). Generalizing #11350/#11709's `defineStack`-only probe to every public entry found the class was never fully closed: seven (entry, type) pairs across four entries still had a `define*` factory's return type expand to mention a type the entry itself did not re-export — `Book`, `FormField`, `NavigationItem` from the root `@objectstack/spec` entry, `UnknownAuthoringKeyFinding` from `@objectstack/spec/kernel`, `FilterCondition` and `StateNodeConfig` from `@objectstack/spec/ai`, and `FilterCondition` from `@objectstack/spec/ui`. Each is repaired the same way as the prior two rounds: one re-export line on the leaking entry, from the module that already declares the type as public on its own subpath. A consumer writing an un-annotated `export const x = defineBook(...)` (or the `/ui`, `/ai`, `/kernel` equivalent) previously hit TS2883 naming an unaddressable hash-named internal dist chunk and could not build; all seven now declaration-emit cleanly with no annotation required. No runtime change. `packages/spec/entry-nameability.baseline.json`, the shrink-only ledger `check:entry-nameability` (#11986) reads, is now empty — the class it was tracking is closed.

.changeset/form-predicate-root-vocabulary-per-surface.md

@@ -0,0 +1,41 @@
+---
+"@objectstack/metadata-core": patch
+"@objectstack/metadata": patch
+---
+
+fix(metadata-core,metadata): split the form-view predicate root vocabulary per surface, so a field-level `current_user` test is not false-flagged (#12915)
+
+Same-day correction to the unbound-root boot notice. The notice judged **every**
+form-view predicate against one vocabulary (`record` / `previous` / `parent` /
+`data`), sourced faithfully from the contract prose — which, for the field-level
+slot, was stale.
+
+`current_user` and its ADR-0068 alias roots (`user`, `ctx.user`, `os.user`)
+**resolve on a field-level `visibleWhen`** since objectui#6010; three spec text
+sites still said otherwise until #12930 re-measured them, and one of those sites
+was the sentence this policy was written against. A legacy artifact carrying a
+legitimate `current_user.role == "admin"` field predicate was therefore reported
+as faulting open — the cry-wolf failure the notice is explicitly built to avoid,
+and the one that trains operators to ignore the channel.
+
+The vocabulary is now per surface, which is what the contract actually says:
+
+- **Field-level** (`BOUND_FORM_FIELD_PREDICATE_ROOTS`): the shared base plus
+  `current_user`, `user`, `ctx`, `os`. Silent on all of them.
+- **Section-level** (`BOUND_FORM_VIEW_PREDICATE_ROOTS`, unchanged in name and
+  value): the base alone. `current_user` is still flagged there — the section
+  docblock states it is unbound at that level and faults open.
+
+Two limits of the field binding deliberately do **not** change the answer: it is
+a rendering rule rather than authorization (an authoring hazard, not a
+version-drift one), and the scope is empty on the console's public `/f/:slug`
+route (equally true of a freshly built current artifact, so it says nothing
+about the artifact's era — the only thing this notice claims to detect).
+
+The emitted warn line now prints the bound roots **per surface, and only for the
+surfaces the findings implicate**, so an operator is never shown a rule their
+artifact has no instance of. Findings carry a `surface` field.
+
+`unboundRootsInCelSource` takes the vocabulary as an optional second argument;
+its default is unchanged (the stricter base), so existing callers behave exactly
+as before.