Merge remote-tracking branch 'origin/main' into claude/issue-21464-s-metric

Author: claude

.changeset/20299-rls-policy-rows-live.md

@@ -0,0 +1,14 @@
+---
+"@objectstack/spec": patch
+---
+
+Liveness ledger: a permission set's row-level security policy `label` and `description` (`rowLevelSecurity[].label` / `.description`) are now `live`, not `dead`. Studio's permission editor shows both on every policy. Ledger data and its generated count shard only.
+
+Clause-②: no
+
+- **What shows them.** These are display keys, so under the ledger's "Designer previews count as consumers" ruling, being shown to a human is the whole of their claimed effect. The Row-Level Security section of the permission editor (`PermissionAdvancedFacets` in objectui) now heads each policy card with the policy's `label` and, beneath it, its `description`, exactly as written. Both rows cite that reader at the `.objectui-sha` pin `89cad75d557`. The registered permission preview also draws both, but no route mounts it for `permission`, so it is not cited.
+- **Where the values come from.** Each row names its producer: the `permission` edit page registration and the Studio edit route that mounts it, the editor's `GET /api/v1/meta/permission/:name/layers` read, and this repo's shared layered answer (`createMetaLayeredAnswer`), which serves a permission set whole. The showcase's contributor permission set authors both keys on all three of its policies.
+- **Author-facing effect.** `os lint` / `os validate` no longer warn `liveness-dead-property` on a policy that sets `label` or `description`. A warning is not a refusal, so the accept set is unchanged.
+- **Still kept.** The re-grade reverses no ADR-0033 decision. Both rows stay docs-shaped annotation, deliberately kept and not `authorWarn`'d.
+- The regenerated liveness count is the `liveness/state-counts/permission.md` shard: `permission` has 38 live and 4 dead (was 36 and 6). The `view` container's own `label` stays `dead`.
+- ⛔ No schema, parse, `.describe()`, export or accept-set change.

.changeset/21476-public-form-intake-advisory.md

@@ -0,0 +1,15 @@
+---
+'@objectstack/metadata-core': minor
+'@objectstack/metadata-protocol': patch
+'@objectstack/rest': patch
+---
+
+Public forms on a walled tenancy posture: saving or publishing a view whose public form cannot take anonymous intake now tells the author why, on the response.
+
+Clause-②: yes (widening)
+
+On a walled posture (`group` or `isolated` in force), an open public form whose object is walled by an organization column cannot take an anonymous submission: the submission carries no organization, and an insert without one into a walled object is refused. The two anonymous form endpoints already answer such a form as a withdrawn one (`404 FORM_NOT_FOUND`), and the administrator's read of the view (`GET /meta/view/:name`) already states why in `_diagnostics.warnings`.
+
+- **`@objectstack/metadata-protocol`**: saving the view (`PUT /meta/view/:name`) or publishing its draft (`POST /meta/view/:name/publish`, and a package's batch publish) now answers success with one `warning` advisory per such form, under `advisories`, with rule `public-form-intake-unavailable`. It is located at the form's `sharing` (for example `views[0].formViews.contact.sharing`), its `message` is the same text the administrator's read states, and its `hint` is the remedy: if the object's rows belong to no organization, declare `tenancy: { enabled: false }` on it. The write is never refused. The advisory reads the posture in force from the `tenancy` service, which is what the anonymous endpoints read: a single-posture deployment, a deployment whose walled posture is degraded to `single`, a deployment with no tenancy service, and a form bound to a tenancy-disabled object get no advisory, and a draft save is not judged. The publish refusal for an unstamped platform schedule flow still reads the requested posture, as before.
+- **`@objectstack/metadata-core`**: the intake-availability rule moved here from `@objectstack/rest` and is exported, so the anonymous endpoints, the administrator's read and the publish advisory read one answer: `anonymousFormIntakeUnavailability(object, posture, readObjectSchema)` (`null` when the form can take intake, otherwise the object, the posture and the wall column; it judges the object's effective schema, with the injected `organization_id`), `anonymousFormIntakePosture(tenancy)` (the posture in force, as a tenancy service reports it), `anonymousFormIntakeUnavailableMessage` and `anonymousFormIntakeUnavailableRemedy` (the reason and its remedy), `anonymousFormSharingPath` and `anonymousFormObjectName`, and the type `AnonymousFormIntakeUnavailable`.
+- **`@objectstack/rest`**: the anonymous form endpoints and the administrator's read import that rule instead of holding their own copy. Their answers are unchanged.

.changeset/21485-date-bucket-calendar-day.md

@@ -0,0 +1,11 @@
+---
+'@objectstack/driver-sql': patch
+---
+
+A `Field.date` grouped by `day`, `week`, `month`, `quarter` or `year` buckets as its own calendar day on PostgreSQL and MySQL, whatever zone the server or the session is in (#21485).
+
+Clause-②: no
+
+- **What was wrong.** The PostgreSQL bucket cast every column to `timestamptz` and the MySQL bucket passed every column through `convert_tz`. A `date` has no instant, so both invented midnight in the session's zone, and on a session east of UTC the conversion to UTC read the previous day. On PostgreSQL with the server at `Asia/Shanghai`, `2026-06-01` grouped into month `2026-05`, and `2026-01-01` into year `2025`. MySQL did the same once the session zone was `+08:00`; the driver pins its own sessions to UTC, so there it took a host `pool.afterCreate` that sets the session zone.
+- **What it does now.** A declared `Field.date` buckets its calendar day with no zone conversion. A `Field.datetime`, and a column with no declaration, keep the UTC-instant expression, byte for byte. SQLite already bucketed a `date` as its calendar day and is unchanged.
+- **Where it shows.** `aggregate()` with a `dateGranularity` group, and the expression `SqlDriver.dateBucketSql()` renders for the analytics SQL echo, which reads the same expression.

.changeset/21571-unprojected-read-declared-fields.md

@@ -0,0 +1,37 @@
+---
+'@objectstack/objectql': minor
+---
+
+fix(objectql)!: a read with no projection serves the object's declared fields and the platform's system columns, never a column no metadata declares (#21571)
+
+**BREAKING (narrowing)** — what a released read door serves shrinks. A column that
+no metadata declares, typically a field retired in an upgrade whose column additive
+schema sync leaves in the table until `os migrate apply --allow-destructive`, is no
+longer returned by any read through the engine.
+
+| read | before | now |
+| --- | --- | --- |
+| `POST /api/v1/data/:object/query` or `GET /api/v1/data/:object` with no `fields` | every column of the table, retired ones and their values included | the declared fields, the registry's system columns, `id`, `created_at`, `updated_at` |
+| `GET /api/v1/data/:object/:id`, export, search hits, the RPC dispatcher, `expand`ed records | the same whole row | the same declared set |
+| `engine.find` / `engine.findOne` in process (hooks, flows, plugins), no `fields` | the whole row | the declared set |
+| an explicit `fields` naming a declared field whose column does not exist yet (driver-sql retries `select('*')`) | the whole row, retired columns included | the declared set |
+| `POST /api/v1/data/:object/:id/clone` of a record whose table carries a retired column | refused `INVALID_FIELD` (the copy carried the retired column into the insert) | cloned |
+
+**Unchanged:** naming a retired column in `fields` still answers `400 INVALID_FIELD`
+on the data door. Declared fields keep their treatment: `internal: true` omission,
+credential masking, formula evaluation and the hidden `__search` strip run as
+before, and the registry-injected tenant, owner and audit columns are still served.
+No driver changed: the engine shapes the rows any driver returns, so the answer is
+the same on every driver and every door. Writes, and the rows a write returns, are
+not changed by this release.
+
+**If you still read a retired column's values** (for example a one-time conversion
+that copies the old columns into their replacement field): run that conversion
+BEFORE upgrading to this release, while the old field is still declared, or, once
+it lands, read the unmapped columns through the operator-only `os migrate` read
+(objectstack#21573). There is no flag that re-opens undeclared columns on a runtime
+door. An in-process reader that needs a column must declare it as a field.
+
+Clause-②: no (narrowing)
+
+<!-- adr-0087: not-required (no-migration-prescription) No authorable key, spelling, export, config field or stored shape is removed or renamed, and no stored row is read or rewritten: the change narrows which physical columns the engine's read verbs return, to the field map the metadata already declares. A retired column's values stay in the table; what an app does with them is an operator action stated above (convert before upgrading, or the operator-only os migrate read), not a FROM to TO mapping that objectstack migrate meta could apply. The other categories are closed on facts: the package publishes (not unpublished); no ADR-0087 id covers a read projection (not registered / already-registered); and the change is runtime behaviour, not a declaration (not runtime-interface-only / type-surface-only). -->

content/docs/data-modeling/queries.mdx

@@ -285,6 +285,13 @@ pattern the metadata-revision / flow-run / notification list endpoints already u
 }
 ```
 
+Without `fields`, a read returns the object's **declared** fields plus the platform's
+system columns (`id`, `created_at`, `updated_at`, and the tenant, owner and audit columns
+the registry adds). A column no metadata declares is never returned — for example one a
+retired field left in the table until `os migrate apply --allow-destructive` drops it — and
+naming it in `fields` on the data API is refused with `400 INVALID_FIELD`. To read such a column's values
+for a one-time conversion, run the conversion before the field is retired.
+
 ### Nested / Related Fields
 
 {/* os:check */}

content/docs/deployment/validating-metadata.mdx

@@ -478,6 +478,7 @@ orthogonal to both, and no cell here can carry it; it is written out in
 | Declared enforcement that cannot run, **declared on the object being written** — a validation rule's regex / JSON Schema (#4762) and its `format` names (#5178) | ✓ | ✓ | ✓ | ✓ᵒ |
 | Declared enforcement that cannot run, **declared on another collection** — sharing-rule conditions (#4698), row-level-security predicates (#4983) | ✓ | ✓ | ✓ | — |
 | Platform-schedule `create_record` organization (#6285) | — | — | — | ✓ᶠ |
+| Public-form anonymous intake on this deployment's tenancy posture — advisory only (#21476) | — | — | — | ✓ᵛ |
 | Autonumber `{field}` interpolation | ✓ | ✓ | ✓ | ✓ᵒ |
 | View references — form targets, view-key collisions (#2554) | ✓ | ✓ | ✓ | — |
 | Flow authoring anti-patterns (#1874) | ✓ | ✓ | ✓ | ✓ᶠ |
@@ -594,11 +595,17 @@ The fourth door does not weaken that, because it is held to the CLI's verdicts
 rather than to its own: a test fails if a rule runs at the runtime publish gate
 but not on `os build` — the two publish verbs must not disagree. What that
 column narrows is which *types* it judges, never which *verdict* it reaches. The
-one deliberate exception is the platform-schedule row (#6285), runtime-only by ruling:
-both of its inputs are facts about the **deployment** (the organization this
-write lands in, and whether this deployment walls organizations), and a build
-machine's environment is a false signal for them — so `os build` must not judge
-it at all.
+deliberate exceptions are the two rows whose inputs are facts about the
+**deployment**, and a build machine's environment is a false signal for those —
+so `os build` must not judge them at all. The platform-schedule row (#6285) is
+runtime-only by ruling: its inputs are the organization this write lands in and
+whether this deployment walls organizations. The public-form intake row (#21476)
+reads the tenancy posture **in force**: on a walled posture, an open public form
+whose object is walled by an organization column cannot take an anonymous
+submission, so the anonymous form endpoints do not offer it, and a save or
+publish of the view answers success with a `public-form-intake-unavailable`
+warning in `advisories`, located at the form's `sharing`. It never refuses the
+write.
 
 Some rows are deliberately not universal across the three commands, and each is
 one-directional (none lets a stack through a gate another command enforces):

content/docs/ui/forms.mdx

@@ -100,6 +100,7 @@ export default defineView({
 > - Anything not in the `sections[].fields[]` whitelist is silently stripped at submit time. Treat the whitelist as the form's authoritative "what the public is allowed to set" list.
 > - A form whose sections declare **no** fields collects nothing, so the submit is **refused** (`400 VALIDATION_ERROR`) rather than accepting whatever the caller sent (#6920). Its `GET /forms/:slug` publishes no schema either (#6601) — declare the fields and both planes come alive together.
 > - Multiple form views per object are fine — only the one(s) with `sharing.enabled === true` and `sharing.allowAnonymous === true` are exposed.
+> - On a **walled** tenancy posture (`group` or `isolated` in force), a form whose object is walled by an organization column is **not offered**. An anonymous submission carries no organization, and an insert without one into a walled object is refused, so both anonymous endpoints answer the form exactly as they answer a withdrawn one (`404 FORM_NOT_FOUND`). The administrator is told why, at the form's `sharing`: the view's read (`GET /api/v1/meta/view/:name`) carries it in `_diagnostics.warnings`, and a save or publish of the view answers success with a `public-form-intake-unavailable` warning in `advisories`. If the object's rows belong to no organization, declare `tenancy: { enabled: false }` on it and the form is offered again.
 
 ## 2. (Optional) Create the `guest_portal` permission set