Merge origin/main into claude/issue-21207-exit-two-keyed-served-hash

Brings in #21432 (one-shot CLI boots read-only), whose exit-1 pin on
audit-metadata-bodies counts every audited table, and the rest of main
since the branch point. Auto-merged; protocol.ts and engine.ts merged
without conflict.

Claude-Session: https://claude.ai/code/session_01VvcEokUG1tvVxkceYfR5XB
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.changeset/20274-agent-memory-contract.md

@@ -0,0 +1,99 @@
+---
+'@objectstack/spec': minor
+'@objectstack/platform-objects': patch
+---
+
+feat(spec)!: an agent's `memory` contract states exactly what the runtime honours — `maxEntries` and `reflectionInterval` are required once long-term memory is enabled, `longTerm.store` is retired, and the block is `live`, enforced by the cloud AI runtime (#20274)
+
+**BREAKING** — `agent.memory` narrows to what the cloud AI runtime, the one runtime
+that executes agents, actually does with it. That runtime recalls the newest
+`maxEntries` distilled notes for the user before the first round, writes one note
+every `reflectionInterval` delivered interactions, evicts notes beyond `maxEntries`,
+and keeps them in its own database store. Before an agent's first turn it refused
+exactly the declarations this spec still accepted, so authoring now refuses them,
+by name, with a prescription (ADR-0049 enforce-or-remove):
+
+- **`longTerm.maxEntries` and `reflectionInterval` are required when
+  `longTerm.enabled` is true.** No default is declared for either: none has a
+  measured basis, and the runtime adds none.
+- **`reflectionInterval` is refused without an enabled `longTerm`** — a reflection
+  writes a long-term note, so with none enabled it would do nothing.
+- **`longTerm.store` is retired as a whole key.** The memory store is platform
+  infrastructure, not agent metadata: the runtime keeps the notes in its own
+  database store, and refused `vector` (the key's default, so what an omitted
+  `store` parsed to) and `redis`. Its old spellings `backend`, `storage` and
+  `provider` under `longTerm` are answered with the same prescription instead of
+  being steered onto `store`.
+
+`longTerm.enabled` is unchanged.
+
+### FROM → TO
+
+| before | what to write instead |
+| --- | --- |
+| `memory.longTerm.store` — any value, `database` included | delete the key; where the notes are kept is the platform's choice. |
+| `longTerm: { enabled: true, … }` without `maxEntries` | add `maxEntries`: how many distilled notes are kept for each user (an integer of at least 1). |
+| `longTerm: { enabled: true, … }` without `memory.reflectionInterval` | add `reflectionInterval`: how many delivered interactions pass between the reflections that write a note (an integer of at least 1). |
+| `memory.reflectionInterval` without `longTerm.enabled: true` | enable long-term memory with both numbers, or delete `reflectionInterval`. |
+
+**The one-line fix: declare `maxEntries` and `reflectionInterval` when `longTerm.enabled`; delete `store`.**
+`os migrate meta --from 17` lists the mechanical edits for existing sources (the
+`store` deletion); the two numbers are the author's to choose.
+
+Each refusal is a parse error at the key's own path, naming the key and the fix, and
+`store` also fails `tsc` (its input type is `never`).
+
+### The retirement kit
+
+- **Tombstone.** `longTerm.store` is a `retiredKey()` carrying the prescription; the
+  three old alias spellings moved from `aliases` to `guidance`, because an alias may
+  not steer an author onto a tombstone.
+- **The contract check** is a refinement on `memory` (`reflectionInterval` is
+  `longTerm`'s sibling), one `custom` issue per missing or misplaced key. A JSON
+  Schema cannot state a value-conditioned requirement in the closed projection list,
+  so the published `ai/Agent` schema (and the four installed-package schemas that
+  embed agents) names the site in `x-dropped-refinements`, recorded in
+  `dropped-refinements.baseline.json`.
+- **D2 conversion `agent-memory-long-term-store-removed`** (step 18, retired from the
+  load path): it deletes `store` from `memory.longTerm`, whatever it holds — the
+  delete is lossless, because no value of it ever chose a backend. Stored
+  `sys_metadata` agent rows and built artifacts replay it; one notice per agent. It
+  supplies neither number.
+- **D3 entry `agent-memory-store-retired-and-limits-required`** carries the judgement
+  the conversion cannot make: the two numbers an enabled `longTerm` now requires.
+- **`RETIRED_KEYS_BY_MAJOR[18]`** registers `ai/Agent:memory.longTerm.store`.
+- **No deprecation window**, per the project's startup-stage posture.
+
+### Describes and the liveness ledger
+
+- `agent.memory` drops `[EXPERIMENTAL — not enforced]`: it states that the cloud AI
+  runtime enforces it and that the open framework edition does not run agents.
+  `longTerm`, `enabled`, `maxEntries` and `reflectionInterval` each state what the
+  runtime does with them.
+- The ledger row moves `experimental` → `live`, citing the cloud reader
+  `agent-runtime.ts#compileAgentMemory` (via `AgentRuntime.resolveTurnGuardrails`),
+  the enforcement in `ai-service.ts` and the store `agent-memory.ts#AgentMemoryStore`,
+  as attested by the cloud seat's reading at cloud `ef5a4344`, `verifiedAt`
+  2026-10-02. `os lint` / `os validate` no longer warn
+  `liveness-experimental-property` on an agent that sets `memory`.
+- ⚠️ **The window, stated.** At `ef5a4344` the cloud reader still reads `store`: it
+  honours `database` only and refuses `vector` and `redis`. Cloud drops `store` in
+  that one reader once this release reaches its pin, and no earlier.
+
+### The agent form's help texts
+
+- The `memory` row's help text on the agent metadata form named short-term memory,
+  a key the schema refuses. It now states what memory does and that `maxEntries`
+  and `reflectionInterval` are required once long-term memory is enabled.
+- The neighbouring `planning` row named a strategy and a replan switch the schema
+  does not declare; it now states the one key it has, the iteration cap.
+- The `platform-objects` metadata-form catalogs follow: the English leaves are
+  regenerated, and the `zh-CN`, `ja-JP` and `es-ES` leaves are authored, not copied.
+
+⚠️ **The out-of-repo consumer population is NOT MEASURED.** `@objectstack/spec` is
+published, and tenant-authored agents were not measured. This repo authors no
+`longTerm` outside `packages/spec`, and no cloud built-in agent declares one.
+
+Clause-②: yes (narrowing)
+
+<!-- adr-0087: registered agent-memory-long-term-store-removed, agent-memory-store-retired-and-limits-required -->

.changeset/20301-lint-list-view-tabs-walk-deleted.md

@@ -0,0 +1,11 @@
+---
+"@objectstack/lint": patch
+---
+
+The list-view field-reference rule no longer walks a list view's own `tabs[].filter`
+
+Clause-②: no
+
+The list view's own `tabs` is a `retiredKey` tombstone on every list-view shape, and this rule judges the parsed stack, so the key could never reach the walk: the parse refuses it first, with its prescription. The dead branch is deleted. The rule still judges `filter` and `userFilters.tabs[].filter` exactly as before.
+
+No finding changes for any stack that `os validate`, `os lint` or `os build` accepts.

.changeset/20301-metadata-protocol-list-view-tabs-walk-deleted.md

@@ -0,0 +1,9 @@
+---
+"@objectstack/metadata-protocol": patch
+---
+
+`computeViewReferenceDiagnostics` no longer walks a list view's own `tabs[].filter`
+
+Clause-②: no
+
+The list view's own `tabs` is a `retiredKey` tombstone on every list-view shape. The write door refuses it, and a stored or artifact-shipped body has it stripped by the conversion replay before it is served, so the read could never see it. A served body that still carries it is already badged by the spec diagnostics (`computeMetadataDiagnostics`), with the tombstone's prescription. The `userFilters.tabs[].filter`, `filterableFields` and `kanban` checks are unchanged.

.changeset/20301-spec-view-container-name-ledger-note.md

@@ -0,0 +1,15 @@
+---
+"@objectstack/spec": patch
+---
+
+Liveness ledger: the view container's body `name` row stays `dead`, and its note now states what the platform actually does with the key
+
+Clause-②: no
+
+- The old note said the body copy was "a copy nobody reads". Measured, the metadata door stamps the save name into every saved view body that has none, containers included (`normalizeViewMetadata` in `@objectstack/metadata-protocol`). Its overlay paths key on that stamped copy: `hydrateOverlayIntoRegistry` registers no body without a `name`, and `mergePackageAwareOverlay` slots an overlay row by it.
+- The verdict is unchanged, because the ledger's `live` means that authoring the key changes runtime behaviour. An authored container `name` only restates the key the container already registers under, or contradicts it. `os validate` and `os lint` keep warning `liveness-dead-property` ("drop it").
+- The note records why the key is kept rather than tombstoned: the door's own saves stamp it, so a tombstone would refuse the platform's own writes. A maintainer ruling also refused a spec-level forbid of a container's `name`.
+- It corrects the old attribution too. Artifact-shipped containers and the metadata-validation sweep author no `name`; what was read as theirs is the door's stamp.
+- The ledger README's `view` cell says the same. The `view.list.tabs` row's note now records that the two author-time walks that still read a list view's own `tabs` are deleted.
+- A comment in `system/i18n-resolver.ts` that still called the list view's own `tabs` a live carrier now says the key is a tombstone and `UserFiltersSchema.tabs` is the one carrier.
+- ⛔ No schema, parse, export, status or accept-set change.

.changeset/21082-cube-member-json-stored-refused.md

@@ -0,0 +1,17 @@
+---
+"@objectstack/lint": minor
+---
+
+fix(lint)!: `os validate`, `os build` and `os lint` refuse an `analyticsCubes` dimension over a JSON-stored column, and a cube `count_distinct` measure over one, which the analytics door already refuses at query time
+
+Clause-②: no (narrowing)
+
+<!-- adr-0087: not-required (no-migration-prescription) a refusal at authoring of two cube member TARGETS the analytics door already refuses with 400 INVALID_FIELD at query time: an analyticsCubes dimension whose sql column is declared structured-JSON (json, composite, repeater, record, location, address, vector) or multi-value (multiselect, checkboxes, tags, or a select, radio, lookup, user, file or image declared multiple: true), and a count_distinct measure whose sql column is either. It is the cube face of the dataset dimension refusal, which declared this category for the same door. No authorable key, spelling, export or stored shape moves: CubeSchema keeps parsing every member, no stored row is read or rewritten, and which scalar part of a document, or which member of a list, an author meant to group on or count is not something a ledger entry can rewrite. The other categories are closed on facts: the package publishes (not unpublished); dataset-measure-aggregate-field-type-refused scopes itself to DatasetMeasureSchema rows and no ADR-0087 id covers a cube member (not already-registered); and the change is a rule verdict, not a declaration (not runtime-interface-only or type-surface-only). -->
+
+**BREAKING**: metadata that passed `os validate`, `os build` and `os lint` can now fail. An authored analytics cube (`defineStack({ analyticsCubes })`) is queried through the same analytics door as a compiled dataset, and that door refuses a query that groups by a JSON-stored column, or counts its distinct values, with `400 INVALID_FIELD` before any SQL is built. So such a member could be declared but never served, and until now no authoring rule read `analyticsCubes` at all. The dataset rule's two ids now judge cube members as well: `dimension-json-stored-field-refused` and `measure-aggregate-field-type-refused` (gating, `error`). It ships as `minor` under the launch-window convention for accept-set narrowings. No export is added or removed.
+
+**What is refused.** On a cube whose `sql` names an object the stack defines: a `dimensions` entry whose `sql` column is declared with a structured-JSON type (`json`, `composite`, `repeater`, `record`, `location`, `address`, `vector`) or a multi-value declaration (`multiselect`, `checkboxes`, `tags`, or a `select`, `radio`, `lookup`, `user`, `file` or `image` declared `multiple: true`); and a `measures` entry of `type: 'count_distinct'` whose `sql` column is either. The column is the member's `sql`: a column of the cube's object, or a relationship path read on the object its last hop reaches (the join the cube declares for that hop, else the lookup field's `reference`). The classes are `@objectstack/spec/data`'s `STRUCTURED_JSON_TYPES`, `isMultiValueField` and the `count_distinct` row of `AGGREGATE_FIELD_TYPE_COMPATIBILITY`, the predicates the door reads.
+
+**What an author sees now.** The finding names the cube, the member, the column, the object that declares it and its declaration, and says the analytics door refuses it with `400 INVALID_FIELD`. It names the route: group by, or count the distinct values of, a field that stores one scalar value; for a multi-value field, filter by one member with `$contains` in a record query. It is located at `analyticsCubes[N].dimensions.KEY.sql` or `analyticsCubes[N].measures.KEY.type`, where `KEY` is the member's key.
+
+**Unchanged.** Every dataset finding, word for word. A cube member over any other column, a single-value `select` or `lookup` included; a `count` measure, and a `sum`, `avg`, `min` or `max` measure, which this check does not judge; the row wildcard `'*'`; a member whose column does not resolve or declares no type; a cube whose `sql` names no object this stack defines. The runtime metadata write door: no authoring rule is dispatched for an `analytics_cube` save, and a `dataset` save's snapshot carries no cubes.

.changeset/21279-record-activity-host-feed-guidance.md

@@ -0,0 +1,12 @@
+---
+'@objectstack/spec': patch
+---
+
+fix(spec): `record:activity`'s props row names `items` / `loading` as the host's feed slot when it refuses them
+
+Clause-②: no
+
+`ComponentPropsMap['record:activity']` (`RecordActivityProps`) refused an authored `properties.items` or `properties.loading` with only the generic "Unrecognized key(s) on this `record:activity`" line. Both are keys the objectui `record:activity` renderer reads, as a feed a host that composes the block in code already owns, so an author copying a TSX composition into a JSON page met no reason for the refusal.
+
+- The refusal now says who reads each key on each mount the row reaches. On a standalone `record:activity`, `items` is the host's data channel and `loading` the host's fetch state for that feed. On a `record:chatter` / `record:discussion` `feed`, which is the same object, nothing reads either. The remedy is the same on both: omit them. The block then presents the record page's discussion feed, and a standalone `record:activity` with no discussion context fetches the record's own `sys_activity` rows. This is the same `guidance` shape `record:history`'s row already uses for `entries` / `loading`.
+- The accept set does not change. Both keys stay refused, through the row and through `record:chatter` / `record:discussion`'s `feed`, which is the same object. Only the message text changes; `record:history` is unchanged.

.changeset/21286-cli-extension-tsdoc-discover.md

@@ -0,0 +1,9 @@
+---
+'@objectstack/spec': patch
+---
+
+The `kernel/cli-extension` module documentation no longer tells plugin authors to run `os plugins install`. Step 2, "Discover", said the plugin is listed in `@objectstack/cli`'s `oclif.plugins` array, or that users install it with `os plugins install`. Neither is true: `@objectstack/cli` declares no `oclif.plugins` and ships no plugin manager, so `os plugins` is not a command. The step now says what loads a plugin: oclif loads a plugin that the CLI's own `package.json` lists in both `oclif.plugins` and `dependencies`. To add a plugin's commands to `os`, build an `os` distribution whose own `package.json` lists the plugin in both places. The generated reference page carries the same text.
+
+Clause-②: no
+
+Documentation only. No schema, export or type changes.