Merge origin/main 88fb5e8 into claude/issue-20595-metadata-core-citations

Claude-Session: https://claude.ai/code/session_01DDZNkDVwPQnevTFcYE47H3
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.changeset/21442-by-name-expanded-view.md

@@ -0,0 +1,12 @@
+---
+'@objectstack/metadata-protocol': patch
+---
+
+fix(metadata-protocol): a view a stored view container expands answers by name what the object door lists, on every kernel and for every container scope
+
+Clause-②: no
+
+- **What changed.** `GET /api/v1/meta/view?object=…` lists the views a stored view container expands, and the by-name read now answers each of those names with the same item. Before, `getMetaItem` expanded no container: it answered such a name only on an unscoped kernel and only for an environment-wide container, where the registry held a hydrated copy. On an environment-scoped kernel, and for an organization-scoped container on any kernel, it answered nothing. Where the name is one a package also ships, such as `<object>.default` under a tenant's overlay of that package's container, it answered the packaged view while the list served the overlay's.
+- **How.** The by-name read selects the stored containers in the caller's scope with the list read's own row selection, and expands them with the list read's own expansion. Nothing is persisted or registered, and a stored row of the name itself still answers first.
+- **Layers, history and diff for such a name.** `getMetaItemLayered` reports the container's own stored row as `overlay`, with the scope it was read from as `overlayScope`, and the expanded view as `effective`. `historyMetaItem` and `diffMetaItem` answer exactly what they answer under the container's own name, and say so: every event's `ref.name` and the diff's `name` are the container's. No history is made up for a name that was never stored.
+- **What does not change.** The container's own name still answers its stored row. The save door is unchanged, including a write by an expanded name. No response shape gains or loses a key.

.changeset/21455-approval-actor-lookups-hold-ids.md

@@ -0,0 +1,26 @@
+---
+'@objectstack/plugin-approvals': patch
+---
+
+Every `sys_user` lookup the approvals plugin writes now holds a user id or nothing: the SLA and dead-run sweeps record no actor instead of a `system:` placeholder, notifications name only the person who acted, and `reassign_from` / `reassign_to` become slot-address text columns; stored placeholders are cleared at the next boot
+
+Clause-②: no
+
+Under ADR-0118 D1 a lookup to `sys_user` holds a user id or null, never a placeholder value. Four writers broke that, and a lookup holding a non-id drops the row from every join and report on it, silently.
+
+**This supersedes the "The SLA sweep keeps its reserved `system:sla` actor for now" sentence of the unreleased `21411-approval-actor-person` changeset.** Both ship in one release; from it, the sweep records no actor.
+
+- **Machine actors record no actor.**
+  - The SLA sweep's `escalate` row, and the `approve` / `reject` an `auto_approve` / `auto_reject` escalation then records, have `actor_id` empty. Before, both held `system:sla`. The `escalate` row's comment still names the configured action.
+  - The dead-run sweep's `recall` row has `actor_id` empty. Before, it held `system:dead-run`. Its comment still names the dead run and its status, and a submitter's own recall still records the submitter.
+- **Notifications name only a person.** The actor the plugin hands to `sys_notification.actor_id` (and so to each `sys_inbox_message.actor_id`) is the user the action's context vouches for, or nothing.
+  - Before, a reassign, reminder, request for information, comment or send-back taken under a named position or email forwarded that address as the actor.
+  - Before, every SLA notification forwarded `system:sla`. It now forwards no actor, as the out-of-office notifications already did.
+- **`reassign_from` / `reassign_to` are slot addresses.** A reassignment moves a pending-approver slot, so both columns hold the slot's address in its stored spelling: a user id, an email, or `position:<name>`. They are now text columns (max 255 characters, like `acted_as`) instead of `sys_user` lookups, which matches what they already stored.
+  - Existing values need no rewrite, and an existing database keeps its columns as they are. On SQLite and PostgreSQL 16, booting the new declaration over a table created by the old one issues no DDL, keeps every stored value, and reports no schema drift for either column. A new database creates them as `text`, as it does `acted_as`.
+  - The action log still resolves `reassign_from_name` / `reassign_to_name` where an address names an account: a user id, or an email an account carries. A position address has no name.
+- **Stored rows.** The boot-time repair that moves slot literals out of `actor_id` now also clears `system:sla` and `system:dead-run` from it, in the same pass and in the same idempotent way. A cleared sentinel gets no `acted_as`, because a sweep takes no slot. The boot log line reports the count as `sentinelsCleared`.
+- **For a report or integration that read these values:**
+  - To find the SLA sweep's actions, read the `escalate` rows, and the decision that directly follows an `escalate` row whose comment names `auto_approve` or `auto_reject`. Do not test `actor_id` for `system:sla`.
+  - To find a dead-run release, read the `recall` row whose comment names the run. Do not test `actor_id` for `system:dead-run`.
+  - Read `reassign_from` / `reassign_to` as slot addresses. Do not expand them as `sys_user` references.

.changeset/21499-verify-never-mints-key.md

@@ -0,0 +1,13 @@
+---
+"@objectstack/verify": patch
+---
+
+`bootStack` (and so `os verify`) no longer creates a data key file in the key home, and no longer seals its fixtures under a key the host already holds (#21499)
+
+Clause-②: no
+
+The harness composed the settings service with no crypto provider and bound the engine to a default `LocalCryptoProvider`. `bootStack` forces a development posture. In that posture, with no `OS_SECRET_KEY`, no `OS_DEV_CRYPTO_KEY` and no key file, both providers wrote a new key file into the key home. So `os verify`, a one-shot command over an in-memory database, left key material behind, and the next development-posture process on that host adopted it. On a host that already had a key, the harness sealed its throwaway fixtures under that real key.
+
+- **What the harness uses now.** One `LocalCryptoProvider` over a random key held in this process's memory only. It never reads `OS_SECRET_KEY`, `OS_DEV_CRYPTO_KEY` or the key file, and it never writes anywhere. The settings service and the engine get the same instance, so `secret` fields and encrypted settings still seal and open on a host with no key at all.
+- **One key per process, not per boot.** Two `bootStack` calls over one `databaseFile` in the same process (the harness's restart) still open each other's secrets.
+- **Unchanged.** `BootOptions` and the rest of the public API, and `os verify`'s stdout and `--json` report. The one stderr line announcing the minted key file is gone.

content/docs/automation/approvals.mdx

@@ -512,7 +512,9 @@ not a pending approver`); a request that isn't pending returns 409
 (`INVALID_STATE`). The decision records two facts on its `sys_approval_action`
 row: `actor_id` is the user who decided, and `acted_as` is the slot the decision
 took, in that slot's stored spelling — the multi-approver tally counts approvals
-by matching `acted_as` against the slate. Always go through
+by matching `acted_as` against the slate. A `reassign` row records the slot it
+moved the same way: `reassign_from` and `reassign_to` hold slot addresses (a
+user id, an email or a position address), not users. Always go through
 these endpoints — never resume the flow run directly, and since #3801 you
 **cannot**: `POST /api/v1/automation/{flow}/runs/{runId}/resume` answers 403 for
 a run parked on an `approval` node (including via a `subflow` pause) and changes
@@ -672,8 +674,9 @@ trace that a slate had been bypassed was the designated approver's later
 reaches a terminal state without a decision — it failed, was cancelled, timed
 out, or the process hosting it crashed — nothing is left to decide the request,
 so a periodic sweep finalizes it as `recalled` and releases the record. The
-audit row records the actor `system:dead-run` and names the run and its status,
-so it reads distinctly from a submitter's own recall.
+audit row records no actor — a sweep is not a user, so `actor_id` is empty,
+never a placeholder value (ADR-0118 D1) — and names the run and its status, so
+it reads distinctly from a submitter's own recall, which records the submitter.
 
 The sweep only ever acts on a run it can positively confirm is terminal: a
 paused run (the normal state of a live approval), an unknown run, or an
@@ -724,7 +727,10 @@ that request's drawer directly instead of a generic list.
 `escalation` is real, not decorative: set `enabled: true` and `timeoutHours`,
 and pick an `action` — `notify` (default), `reassign`, `auto_approve`, or
 `auto_reject`. Auto decisions run through the normal decide path, so the flow
-resumes exactly as if a human had clicked. Every escalation writes an audit row.
+resumes exactly as if a human had clicked. Every escalation writes an audit row
+of kind `escalate` naming the configured action; it, the auto decision that
+follows it, and the escalation's notifications record no actor, because no
+person acted (ADR-0118 D1).
 `timeoutHours` counts **calendar (wall-clock) hours** — nights, weekends and
 holidays included, because the platform ships no business-hours calendar — so a
 request opened at 17:00 on a Friday with `timeoutHours: 4` escalates at 21:00

packages/metadata-protocol/src/get-meta-item-layered-org-read-gate.test.ts

@@ -97,33 +97,40 @@ const storedRow = (
  * The engine double: `findOne` over a row table, plus the registry surface the
  * layered read touches on its way past the overlay.
  *
- * ⛔ No `find` / `insert` / `update` / `delete`, deliberately — the read path
- * under test issues exactly one verb, and a double declaring verbs no case
- * exercises would owe `check:engine-double-contract` a dispatch contract that
- * protects nothing. Same shape the two sibling read-gate pins drive.
+ * `find` is the second verb the read path issues, and only for a `view` name
+ * with no stored row of its own: the read then selects the stored view
+ * containers that might expand that name, through the list read's own row
+ * selection (#21442). It records into `finds` — the same partitions question
+ * asked of that read. ⛔ No `insert` / `update` / `delete`, deliberately — a
+ * double declaring verbs no case exercises would owe
+ * `check:engine-double-contract` a dispatch contract that protects nothing. Same shape the two sibling read-gate pins drive.
  */
 function makeHarness(rows: StoredRow[]) {
     const findOnes: Array<Record<string, unknown>> = [];
+    const finds: Array<Record<string, unknown>> = [];
+    const matching = (where: Record<string, unknown>) => {
+        // `check:where-matcher` — a hand-written matcher with no combinator
+        // branch reads `$and` as a field name and answers the wrong question
+        // rather than failing. Refuse the shape this double does not
+        // implement, matching the sibling doubles' convention.
+        for (const k of Object.keys(where)) {
+            if (k.startsWith('$')) {
+                throw new Error(`[test double] unsupported WHERE combinator '${k}'`);
+            }
+        }
+        return rows.filter((r) =>
+            Object.entries(where).every(([k, v]) => {
+                if (v === undefined) return true;
+                return (r as unknown as Record<string, unknown>)[k] === v;
+            }),
+        );
+    };
     const engine: any = {
         async findOne(table: string, opts?: { where?: Record<string, unknown> }) {
             if (table !== 'sys_metadata') return undefined;
             const where = opts?.where ?? {};
             findOnes.push({ ...where });
-            // `check:where-matcher` — a hand-written matcher with no combinator
-            // branch reads `$and` as a field name and answers the wrong
-            // question rather than failing. Refuse the shape this double does
-            // not implement, matching the sibling doubles' convention.
-            for (const k of Object.keys(where)) {
-                if (k.startsWith('$')) {
-                    throw new Error(`[test double] unsupported WHERE combinator '${k}'`);
-                }
-            }
-            return rows.find((r) =>
-                Object.entries(where).every(([k, v]) => {
-                    if (v === undefined) return true;
-                    return (r as unknown as Record<string, unknown>)[k] === v;
-                }),
-            );
+            return matching(where)[0];
         },
         registry: {
             registerItem: () => undefined,
@@ -137,8 +144,14 @@ function makeHarness(rows: StoredRow[]) {
             applyNavContributions: (app: unknown) => app,
         },
     };
+    engine.find = async (table: string, opts?: { where?: Record<string, unknown> }) => {
+        if (table !== 'sys_metadata') return [];
+        const where = opts?.where ?? {};
+        finds.push({ ...where });
+        return matching(where);
+    };
     const protocol = new ObjectStackProtocolImplementation(engine, () => new Map()) as any;
-    return { protocol, findOnes };
+    return { protocol, findOnes, finds };
 }
 
 /** Every `organization_id` partition the engine was asked for, deduplicated. */
@@ -443,11 +456,14 @@ describe('§5 an already-gating caller receives the same scope it did before', (
         // for `view` gets the org partition read, exactly as before.
         const gated = organizationIdForMetaRead('view', ORG);
         expect(gated).toBe(ORG);
-        const { protocol, findOnes } = makeHarness([]);
+        const { protocol, findOnes, finds } = makeHarness([]);
         await protocol.getMetaItemLayered({
             type: 'view', name: 'probe', organizationId: gated,
         });
         expect(partitions(findOnes)).toEqual([null, ORG]);
+        // [#21442] `probe` has no row of its own, so the read also selects the
+        // stored containers that might expand it — from the same partitions.
+        expect(partitions(finds)).toEqual([null, ORG]);
     });
 });
 

packages/metadata-protocol/src/get-meta-item-org-read-gate.test.ts

@@ -109,33 +109,40 @@ const storedRow = (
  * The engine double: `findOne` over a row table, plus the registry surface the
  * single-item read path touches on its way past the overlay.
  *
- * ⛔ No `find` / `insert` / `update` / `delete`, deliberately — the read path
- * under test issues exactly one verb, and a double declaring verbs no case
- * exercises would owe `check:engine-double-contract` a dispatch contract that
- * protects nothing. Same shape the sibling plural-door pin drives.
+ * `find` is the second verb the read path issues, and only for a `view` name
+ * with no stored row of its own: the read then selects the stored view
+ * containers that might expand that name, through the list read's own row
+ * selection (#21442). It records into `finds` — the same partitions question
+ * asked of that read. ⛔ No `insert` / `update` / `delete`, deliberately — a
+ * double declaring verbs no case exercises would owe
+ * `check:engine-double-contract` a dispatch contract that protects nothing. Same shape the sibling plural-door pin drives.
  */
 function makeHarness(rows: StoredRow[]) {
     const findOnes: Array<Record<string, unknown>> = [];
+    const finds: Array<Record<string, unknown>> = [];
+    const matching = (where: Record<string, unknown>) => {
+        // `check:where-matcher` — a hand-written matcher with no combinator
+        // branch reads `$and` as a field name and answers the wrong question
+        // rather than failing. Refuse the shape this double does not
+        // implement, matching the sibling doubles' convention.
+        for (const k of Object.keys(where)) {
+            if (k.startsWith('$')) {
+                throw new Error(`[test double] unsupported WHERE combinator '${k}'`);
+            }
+        }
+        return rows.filter((r) =>
+            Object.entries(where).every(([k, v]) => {
+                if (v === undefined) return true;
+                return (r as unknown as Record<string, unknown>)[k] === v;
+            }),
+        );
+    };
     const engine: any = {
         async findOne(table: string, opts?: { where?: Record<string, unknown> }) {
             if (table !== 'sys_metadata') return undefined;
             const where = opts?.where ?? {};
             findOnes.push({ ...where });
-            // `check:where-matcher` — a hand-written matcher with no combinator
-            // branch reads `$and` as a field name and answers the wrong
-            // question rather than failing. Refuse the shape this double does
-            // not implement, matching the sibling doubles' convention.
-            for (const k of Object.keys(where)) {
-                if (k.startsWith('$')) {
-                    throw new Error(`[test double] unsupported WHERE combinator '${k}'`);
-                }
-            }
-            return rows.find((r) =>
-                Object.entries(where).every(([k, v]) => {
-                    if (v === undefined) return true;
-                    return (r as unknown as Record<string, unknown>)[k] === v;
-                }),
-            );
+            return matching(where)[0];
         },
         registry: {
             registerItem: () => undefined,
@@ -149,8 +156,14 @@ function makeHarness(rows: StoredRow[]) {
             applyNavContributions: (app: unknown) => app,
         },
     };
+    engine.find = async (table: string, opts?: { where?: Record<string, unknown> }) => {
+        if (table !== 'sys_metadata') return [];
+        const where = opts?.where ?? {};
+        finds.push({ ...where });
+        return matching(where);
+    };
     const protocol = new ObjectStackProtocolImplementation(engine, () => new Map()) as any;
-    return { protocol, findOnes };
+    return { protocol, findOnes, finds };
 }
 
 /** Every `organization_id` partition the engine was asked for, deduplicated. */
@@ -389,9 +402,12 @@ describe('§4 an already-gating caller receives the same scope it did before', (
         // the org partition read, exactly as before this change.
         const gated = organizationIdForMetaRead('view', ORG);
         expect(gated).toBe(ORG);
-        const { protocol, findOnes } = makeHarness([]);
+        const { protocol, findOnes, finds } = makeHarness([]);
         await protocol.getMetaItem({ type: 'view', name: 'probe', organizationId: gated });
         expect(partitions(findOnes)).toEqual([null, ORG]);
+        // [#21442] `probe` has no row of its own, so the read also selects the
+        // stored containers that might expand it — from the same partitions.
+        expect(partitions(finds)).toEqual([null, ORG]);
     });
 });