Merge origin/main into claude/issue-20515-orgless-grants-global-only

Claude-Session: https://claude.ai/code/session_01N8TPEsoJxPsdSdNKGnNGEN
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.changeset/20219-install-body-residual-closed.md

@@ -0,0 +1,34 @@
+---
+'@objectstack/spec': patch
+---
+
+`PackageInstallBodySchema`'s docblock records its measured residual as closed: the install door answers every body the declaration refuses with `400`, not `201`
+
+Clause-②: no
+
+The docblock listed the bodies `POST /api/v1/packages` answered differently
+from the declaration: a manifest with no `type`, unknown keys on either body
+form, a string-typed `enableOnInstall` / `overwrite`, install options spelled on
+the bare form, and (in the other direction) a whitespace-only `id`. It still said
+the door answers `201` to the first four. Since the door parses its whole body
+through `PackageInstallBodySchema` (#20218), it answers each of them `400` /
+`VALIDATION_ERROR` and installs nothing. The whitespace-only `id` was already
+refused by both, because `ManifestSchema.id` carries `MANIFEST_ID_PATTERN`.
+
+The section now records every class as closed, names the door-side pin for
+each, and says what the declaration's parsed value still does not describe:
+the door stores the manifest it was SENT, so parse-time defaults (`scope`,
+`defaultDatasource`) are not stored, and an unknown key nested in a manifest
+block the declaration leaves in strip mode is stored as sent.
+
+Two more sentences are corrected. The bare-form paragraph said the runtime's
+two door drives post a manifest with no `type`; both have carried
+`type: 'app'` since #20218 and parse green. The `enableOnInstall` docblock said
+the door "reads the raw body"; it reads the key off the parsed wrapped request.
+
+⛔ No behaviour changes. No schema, accept set, export or runtime code moves.
+
+**Why this carries a changeset and not `skip-changeset`.** `@objectstack/spec`'s
+`files[]` ships `src/**/*.zod.ts` verbatim, and the `PackageInstallBodySchema`
+docblock is also emitted into `dist/api/index.d.ts` and `dist/api/index.d.mts`.
+The published content changes, even though no line of code does.

.changeset/20233-field-export-api-dataset-hook-metadata-migration-guidance-tracker-free.md

@@ -0,0 +1,28 @@
+---
+'@objectstack/spec': patch
+---
+
+fix(spec): `os migrate meta` guidance for the `field-*`, `export-*`, `api-*`, `dataset-*`, `hook-*` and `metadata-*` migration entries states each lesson in words instead of citing tracker numbers
+
+Clause-②: no
+
+The ADR-0087 semantic entries of the `field-*` family (the runtime `field` write door, the
+`maxLength` / `minLength` / `scale` / `precision` refusals, `scale` on a currency field,
+`multiple` on a type that holds one value, and predicates that read through a reference),
+the `export-*` family (the export permission axis, the eight constraint keys retired from
+`ExportFieldMeta` and the retired export-job API family), the `api-*` family (the runtime `api` write door,
+the split API entry and two duration keys renamed with their unit), the `dataset-*` family
+(the aggregate × field-type refusals and the nested-relation list refused at save), the
+`hook-*` family (the retired hook-session `roles` and the two `registerHook` refusals) and
+the `metadata-*` family (the retired customization protocol, the re-partitioned endpoint
+switches, the metadata-manager cache keys and the retired `additionalTypes`) are printed by
+`os migrate meta` as the header, `why:` and `verify:` lines of a manual change. Their text
+sent the reader to issue-tracker, decision-batch and ruling-record numbers — some of which
+no longer resolve, and some in another repository — for what a ruling, measurement or fix
+had decided; it now says what was decided, in the sentence being read. ADR ids are kept.
+
+Text only: no entry id, `from` / `to`, conversion or matching logic changes, and the chain
+rewrites exactly what it rewrote before. One entry's `surface` (the header line of
+`dataset-measure-aggregate-field-type-refused`) drops the two tracker numbers it carried and
+names nothing else differently. The generated migration registry, `spec-changes.json` and
+the protocol upgrade guide carry the same text.

.changeset/20444-empty-operator-engine-arms.md

@@ -0,0 +1,24 @@
+---
+'@objectstack/driver-sql': minor
+'@objectstack/driver-turso': minor
+'@objectstack/driver-memory': minor
+'@objectstack/driver-mongodb': minor
+'@objectstack/formula': minor
+'@objectstack/objectql': minor
+'@objectstack/spec': minor
+---
+
+feat(drivers,formula,objectql): the engine's filter faces answer the staged `$empty` operator (#20444)
+
+Clause-②: yes (widening)
+
+`$empty: true | false` is declared by `@objectstack/spec` (`FieldOperatorsSchema`) with a per-type meaning: a text-like field is empty when it is null or `''`, a multi-value field (multiselect, checkboxes, tags, or a select / radio / lookup / user / file / image with `multiple: true`) when it is null or `[]`, and every other type only when it is null. `$empty: false` is the exact complement. Until now every face in this list refused it (`INVALID_FILTER` / 400), except `matchesFilterCondition`, which answered `false` for every record. **A driver or evaluator called directly now answers it:**
+
+- **By the field's declared type**, through the spec's one expansion (`expandEmptyOperator`): `driver-sql`'s filter compiler (and so `driver-sqlite-wasm` and `driver-turso`'s local transport, which inherit it), `driver-turso`'s remote transport, `driver-memory`'s query path (`find` / `count` / `update` / `delete`) and `driver-mongodb`'s `translateFilter` (its `find`, its aggregate `$match`). The declaration is the one each driver already receives — `initObjects` / `registerObjectMetadata` / `registerExternalObject` on the SQL family, `syncSchema` on the others. On SQL a multi-value field's empty list is tested as stored JSON per dialect (SQLite `json_array_length` behind a `json_valid` guard, PostgreSQL a `jsonb` comparison, MySQL `JSON_LENGTH`), never as an equality comparand.
+- **By value** — null, a missing value, `''` and `[]` are empty (`isEmptyFilterValue`) — on the faces that read no field declaration: `@objectstack/formula`'s `matchesFilterCondition` (the RLS write-side `check`), `driver-memory`'s reference matcher, and `@objectstack/objectql`'s `having` and per-aggregation `filter`. In `having`, a `count` or `sum` holding `0` is not empty.
+
+**Refused, never guessed** (`INVALID_FILTER` / 400): `$empty` on a field whose declaration the driver does not hold (a table built outside its registration, a builtin column such as `id`, a field with no `type`, or `translateFilter` / `RemoteTransport` used standalone without a declaration), a multi-value field on a SQL dialect the driver does not model, and a flag that is not a boolean. `driver-memory`'s analytics (cube) face refuses `$empty` as an operator it cannot compile, as it does `$null`.
+
+New optional API: `translateFilter(where, temporalKind?, valueShape?)` in `@objectstack/driver-mongodb` takes a declared-value-shape resolver (type `ValueShapeResolver`), and `buildAggregationPipeline` a `valueShape` option; `RemoteTransport.setDeclaredValueShapeResolver` in `@objectstack/driver-turso`, which `TursoDriver` wires. `@objectstack/spec`'s shared `FILTER_LOGIC_CASES` table gains seven `$empty` cases: a backend that runs it answers `$empty` or goes red, and its harness must declare the fixture's columns.
+
+`$empty` stays staged: it is not in `FILTER_OPERATORS`, so the engine's front door still refuses it until the flip card adds it, and the view operators `is_empty` / `is_not_empty` still lower to `$null`.

.changeset/20507-layers-absent-name-oracle.md

@@ -0,0 +1,13 @@
+---
+"@objectstack/rest": patch
+---
+
+**The layered view, `GET /api/v1/meta/:type/:name/layers` and the deprecated `?layers=true` flag, now answers a name with nothing behind it with the plain read's `404 RESOURCE_NOT_FOUND`, the answer it already gave a member for an unpublished app.** Before this release, a name with no layer behind it answered `200` with `code`, `overlay` and `effective` all `null`. A member asking for an unpublished app got `404`, so the difference between the two answers told the member which unpublished apps exist. ADR-0045 §3 declares a hidden app externally unobservable on every surface, and the plain read already kept that promise. This follows triage's grade on #20507.
+
+Clause-②: no
+
+- **What changed:** `createMetaLayeredAnswer`, the one chain both transports call after the store read (`RestServer` and the runtime dispatcher's `/meta` domain), answers a layered read with no layer present as the name's absence, before the per-caller gate runs. Each transport writes that absence in its own envelope, the one it already uses for an unpublished app: `RestServer`'s nested `{ error: { code: "RESOURCE_NOT_FOUND", message } }`, and the dispatcher's `404` error envelope. The flag's `Deprecation` and `Link` headers still ride that answer.
+- **Who it applies to:** every caller. The plain read answers an absent name `404` whoever asks, and so does the layered view now. A builder (`studio.access` or `setup.access`) is still served an unpublished app on both spellings. A `?package=` scope that leaves no layer behind the name is that name's absence too.
+- **Unchanged:** a name with any layer behind it is judged and served exactly as before. An item whose code layer is scoped away by `?package=` but whose overlay row answers is still served, with `code: null`.
+
+A client that read `/layers` for a name that has never been published, and took a `200` with every layer `null` as "not saved yet", now receives `404`. Treat that `404` as the same answer. Studio's metadata client already maps a `404` from this route to every layer `null`, so the designer's "open an item that exists only as a draft" path is unchanged.

.changeset/20508-scoped-layers-link.md

@@ -0,0 +1,25 @@
+---
+'@objectstack/rest': patch
+---
+
+fix(rest): the environment-scoped `?layers=true` answer's successor `Link` names the path the request used, not the route template (#20508)
+
+Clause-②: no
+
+On `RestServer`'s environment-scoped mount (`api.enableProjectScoping`),
+`GET /api/v1/environments/env_1/meta/view/lead_all?layers=true` answered its
+`Deprecation` header with a successor `Link` naming
+`/api/v1/environments/:environmentId/meta/view/lead_all/layers`: the route
+template, with a literal `:environmentId` in it. A client that followed the
+header requested that path. The `Link` now names
+`/api/v1/environments/env_1/meta/view/lead_all/layers`.
+
+`RestServer` builds the `Link` from the request's own path, read the way the
+runtime dispatcher reads its request URL, so both transports name the successor
+the same way. The unscoped mount's `Link` is unchanged for every name that needs
+no percent-encoding. A percent-encoded name now stays encoded in the `Link`
+(`lead%20all`, where the header used to carry a raw space), because the path is
+parsed as a URL path instead of being assembled from decoded route parameters.
+A request that carries no path of its own is still answered `Deprecation: true`,
+and names no successor. The body, the status and the `Deprecation` header are
+unchanged on both mounts.