Merge origin/main into claude/issue-20751-services-strings-stage5

Brings in stage 4 of the services lane and the plugin-security changes
landed since the branch was cut. Only the prose-id ledger conflicted; it is
recomputed with --census-ledger on the merged tree (shrink only: the
plugin-security entries go to zero, no other entry moves).

Claude-Session: https://claude.ai/code/session_01DiCSbmJrkzNhuEAier4VoJ
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.changeset/20595-platform-objects-provenance-anchors.md

@@ -0,0 +1,16 @@
+---
+'@objectstack/platform-objects': patch
+---
+
+Provenance comments in `@objectstack/platform-objects` cite the commits that decided them, not tracker numbers that no longer resolve
+
+Clause-②: no
+
+Docblocks and comments across the package cited issue-tracker numbers that now answer 404 on GitHub.
+Each now cites the commit in this repository's history that made the decision it describes, except one
+that cites ADR-0104's 2026-09-05 addendum, the record of that ruling. Some of these docblocks sit on
+exported members, so the reworded text appears in the published declaration files (`apps`, `identity`,
+`metadata-translations` and `system` `index.d.ts` / `index.d.mts`), and the field comments esbuild keeps
+appear in the JavaScript output (`index`, `apps`, `audit`, `identity` and `plugin`, `.js` / `.mjs`).
+
+Comment only: no export, type, error code, status, message text or runtime behaviour changes.

.changeset/20749-lint-strings-stage1-state-the-decision.md

@@ -0,0 +1,18 @@
+---
+'@objectstack/lint': patch
+---
+
+Flow, hook, action, approval and expression rule findings no longer cite tracker numbers; each one states the decision behind it in words
+
+Clause-②: no
+
+Some findings these rules show to authors through `os validate`, `os lint` and `os build`, and the startup-registry findings a plugin author reads, pointed at an issue-tracker number for the reason behind them. The number goes; where the sentence did not already say what was decided, it now does.
+
+- Flow patterns: the record-change date-equality hint and the date-equality filter hint name the declarative alternative, a `schedule` flow whose start node carries a `config.timeRelative` descriptor; the unscoped `runAs` hint says `runAs` is enforced, so a run with no trigger user has its data operations refused rather than run unscoped; the unbounded bulk-write hint says `multi: true` is how a flow declares bulk intent and that the engine admits a whole-object write declared that way; the revise-target hint says the run-resume route continues a pause on a service-owned node type only through the service that owns it; the two interpolation hints say a flow node value is a string template in which only single-brace tokens resolve.
+- Startup-registry findings: the open-vocabulary notes say the engine judges node types only once the vocabulary is sealed at `kernel:bootstrapped`; the prescription describes the lazy cache resolution and the ADR-0104 attestation by what each does; the assertive-wording finding describes its two incidents, and how each was fixed, in words.
+- Expression findings: the field-level `visibleWhen` consequence names the `current_user` binding ADR-0089 D1 gives every runtime record surface; the retired `script` keys finding says spec 17 made `script` a call to a registered function and nothing else.
+- Trigger readiness: the array `triggerType` hint says multi-event arrays are deferred until two independent projects need a combination other than created-or-updated.
+- Body writes, readonly writes and approvals: the discarded `ctx.record` write says the snapshot stays read-only by design and an action writes through `ctx.api`; the `readonlyWhen` write finding says a bulk update strips the field from every matched row once any one of them is locked; the `queue` approver finding says the type was deprecated rather than built; the empty-slate hint says the admin override may act on any pending request, so that one nobody in its slate can decide never stays stuck.
+- The other findings drop a citation the sentence already explained.
+
+Text only: no rule id, severity, condition or finding moves. A tool or test that matches the old text (for example a tracker-number suffix) needs the new spelling.

.changeset/20749-lint-strings-stage2-state-the-decision.md

@@ -0,0 +1,24 @@
+---
+'@objectstack/lint': patch
+---
+
+Data-model, filter, predicate, search, sort, security, seed, view, widget and registry findings no longer cite tracker numbers; each one states the decision behind it in words
+
+Clause-②: no
+
+The remaining `@objectstack/lint` findings that `os validate`, `os lint` and `os build` show to authors, plus the `surfaceReason` texts of the exported `AUTHORING_RULES` registry and one integrity error, pointed at an issue-tracker number for the reason behind them. The number goes; where the sentence did not already say what was decided, it now does.
+
+- Data model: the bare declared `unique: true` warning says that protocol 18 rejects the spelling and that stored metadata still carrying it converts to `unique: 'global'`, which builds the same physical index.
+- Empty filter combinators: the `$and: []`, `$or: []` and empty-node messages say every backend reduces an empty combinator to its boolean identity; the `$or: []` message says an empty disjunction never opens a read scope to the whole table.
+- Null guards: the fail-closed outcome says a predicate that cannot evaluate refuses the write rather than being skipped.
+- Visibility and metadata-form predicates: the fall-open consequence says failing open is the console's settled behaviour; the dotted right-hand-side message says the form evaluator keeps its right-hand side a literal by design and says why only in a development build.
+- Component props: the advisory hint says props are judged at the authoring door as a warning before they become an error.
+- Rule schema formats: the format hint says `rule-validator.ts` registers the default `ajv-formats` set so that a `format` is enforced on every write.
+- Security posture: the unset-OWD message describes the leave_request incident (an object with no `sharingModel` let an ordinary read/write grant read and edit every other user's records); the `controlled_by_parent` message says the write is refused as a metadata defect rather than a permission denial.
+- Seeds and views: the seed state-machine message says a seed records established facts rather than walking the lifecycle; the `views:` container message says the stack schema, the rule and the registration loop hold `views:` to one container-only contract.
+- React pages: the absent-`groupBy` hint states the ruling directly.
+- Liveness: the unrecognised-status integrity error says such a status fails loudly rather than being graded `dead`.
+- `AUTHORING_RULES` `surfaceReason` texts: the full-snapshot, capability-reference and sharing-rule reasons name the runtime publish gate (the Studio, REST and MCP door that runs this registry) in place of a tracker number; the advisory-volume reason says the object door opened to the gating object rules alone; the component-types reason names the crossing discipline the gating object rules went through.
+- The other findings (search fields, sort fields, nav servability, dashboard actions, widget bindings and the remaining predicate and combinator messages) drop a citation the sentence already explained.
+
+Text only: no rule id, severity, condition, finding or registry field moves. A tool or test that matches the old text (for example a tracker-number suffix) needs the new spelling.

.changeset/20751-services-strings-stage4-state-the-decision.md

@@ -0,0 +1,15 @@
+---
+'@objectstack/service-automation': patch
+'@objectstack/plugin-audit': patch
+---
+
+Automation refusals, prescriptions, log lines and run-object field help, and the activity type help, no longer cite tracker numbers; each one states the decision behind it in words
+
+Clause-②: no
+
+Some strings these two packages show to flow authors, operators and administrators pointed at an issue-tracker number for the reason behind them. The number goes; where the sentence did not already say what was decided, it now does.
+
+- `@objectstack/service-automation`: the refusal for a `fieldValues` write map says a runtime alias for it was rejected by design, so the node keeps one strict `fields` key; the refusal for a screen field's `visibleIf` says a predicate under any other key is never read, so the field always shows, and a `required` field meant to stay hidden then blocks the screen from ever being submitted; the undeclared-config-key refusal says the built-in node types were reconciled so that every key their executors read is declared; the unknown-function error in a flow value expression says such a name is refused rather than evaluated to null, which would write the field as undefined; the inert-connector warning says entries without a `provider` are catalog descriptors, while an entry that names a `provider` is a connector instance that provider's installed executor materializes; the `sys_automation_run` field help says the paused node's type decides who may continue a run (an approval pause only through its owning service), that rows written before run history recorded its trigger were not backfilled, and that a finished run's bounded step log keeps its per-node detail across a restart; three bridge debug lines say what each bridge provides. The bulk-intent guidance, the degraded-connector dispatch error and retry lines, the user-less `runAs` warning and refusal, the unclaimed-branch warning, the script-function and node-config refusals and the `sys_flow_dispatch` description drop their citations.
+- `@objectstack/plugin-audit`: the `sys_activity` `type` help, whose English text all four shipped locale bundles carry, says the vocabulary is open by decision, not a gap awaiting enforcement.
+
+Text only: no status, error code, field, route or control flow moves. A client or log filter that matches the old text (for example a tracker-number suffix) needs the new spelling.

.changeset/20871-page-requires-live.md

@@ -0,0 +1,14 @@
+---
+'@objectstack/spec': patch
+'@objectstack/lint': patch
+---
+
+`page.requires` says what the runtime now does with it: refused at save, reported at load (ADR-0080 §5).
+
+Clause-②: no
+
+The key's description used to say the list is "validated at save and load" while the liveness ledger recorded it as not enforced yet. Both are now true and say so. On a server that has the deployment's SDUI component manifest, saving a `kind: 'html'` page compiles its source, refuses a written `requires` that disagrees with it (`422 INVALID_METADATA`, `page-requires-disagrees-with-source`; a draft at its publish) and stores the derived list. At load, a stored page whose list names a plugin no manifest component carries is reported and still served. A server with no manifest checks neither and says so once at boot. Omit `requires`: it is derived from the source. The liveness row moves from `planned` to `live`, and the generated page reference carries the new description.
+
+`validateJsxPages`' reason for staying off the runtime publish gate no longer says it parses through `typescript`/`sucrase`. It parses with the dependency-free `@objectstack/sdui-parser`, and it stays CLI-only because the save door already runs that compiler on every html page. The `ui-html-page-div-refused` upgrade-guide entry now names that save door too: on a server with a manifest, a `div` page saved from Studio or through the metadata API is refused under the same rule ids.
+
+No schema accepts or refuses anything it did not before, and no runtime behaviour changes.

.changeset/21000-analytics-metric-type-verdict.md

@@ -0,0 +1,45 @@
+---
+'@objectstack/service-analytics': minor
+---
+
+fix(service-analytics)!: both analytics strategies refuse a cube measure whose `type` names no aggregate, in the spec's words — the custom-SQL `EXPRESSION_METRIC_TYPES` partition is gone with the three types it named (#21000)
+
+**BREAKING** — `@objectstack/spec` retired the cube metric types `number`, `string`
+and `boolean` from `AggregationMetricType` (a measure's `sql` is a column reference,
+so they had nothing left to compute). Every door that parses a cube refuses them;
+this release removes the runtime branches that still served them for a cube that
+reached the analytics service WITHOUT meeting that parse — one a host registers
+in-process from a literal, through `AnalyticsServicePlugin({ cubes })` or
+`AnalyticsService({ cubes })` (the registry never parses).
+
+| | before | now |
+| --- | --- | --- |
+| `NativeSQLStrategy`, a measure typed `number` / `string` / `boolean` | served: the column emitted UNAGGREGATED in the statement (`amount AS "m"` beside `GROUP BY`) | refused, nothing executed |
+| `ObjectQLStrategy`, the same measure | refused `INVALID_FIELD` / 400 | refused, nothing executed |
+| either strategy, a type the spec never declared (`median`) | native: refused; ObjectQL: forwarded to `executeAggregate` as the method (the auto-bridge refused it; a host's own executor received it), and `/analytics/sql` echoed `MEDIAN(amount)` | refused, nothing executed |
+
+**The one refusal** is `aggregateOfMeasure`'s, shared by both strategies and both
+doors (`POST /analytics/query` and `POST /analytics/sql`): it names the measure and
+the cube, then quotes the spec's own verdict on the type — for a retired type the
+retirement prescription (the six aggregates to choose from, and where a per-row or
+derived value goes instead), for anything else zod's message listing the six. It is
+a bare `Error`, the undeclared-500 tier this package assigns to a cube that never
+met the parse, so the HTTP answer is `500` with the message readable in the body
+(measured through the dispatcher's analytics route), never a caller-blaming `400`.
+The ObjectQL envelope for the three retired types therefore moves from
+`INVALID_FIELD` / 400 to that tier.
+
+**The fix:** give the measure one of the six aggregate types — `count`, `sum`,
+`avg`, `min`, `max`, `count_distinct` — or parse the cube through `CubeSchema`
+before registering it, which refuses the same types with the same prescription.
+
+**Removed export:** `EXPRESSION_METRIC_TYPES` from
+`strategies/native-sql-strategy.ts` (internal to the package; not re-exported from
+its entry point). **Unchanged:** every aggregate measure on both strategies, the
+auto-bridge's own parse of an engine method (still pinned, driven directly), and
+`GET /analytics/meta`, which keeps publishing each registered measure's `type` as
+registered.
+
+Clause-②: no (narrowing)
+
+<!-- adr-0087: registered cube-metric-expression-types-retired -->

.changeset/21000-cube-metric-expression-types-retired.md

@@ -0,0 +1,69 @@
+---
+'@objectstack/spec': minor
+---
+
+feat(spec)!: retire the cube metric types `number`, `string` and `boolean` — a measure's `sql` is a column reference, so the custom-SQL-expression types had nothing left to compute (#21000)
+
+**BREAKING** — three members leave `AggregationMetricType`, so a cube measure's
+`measures.<metric>.type` no longer accepts `number`, `string` or `boolean`. ADR-0049
+enforce-or-remove. They declared "a custom SQL expression returning a number /
+string / boolean": the measure's `sql` was the whole computation. A cube member's
+`sql` is a column reference since `cube-member-sql-expression-retired` (#20943), so
+the three were left naming nothing: measured before this change, the raw-SQL
+analytics path returned the referenced column UNAGGREGATED (a bare column in a
+grouped statement — by SQL's own rules an error on PostgreSQL and an arbitrary row's
+value on SQLite), and the ObjectQL path refused the measure. The six aggregates — `count`, `sum`,
+`avg`, `min`, `max`, `count_distinct` — are unchanged and are now the whole
+vocabulary.
+
+### FROM → TO
+
+| removed | what to write instead |
+| --- | --- |
+| `measures.<metric>.type: 'number'`, `'string'` or `'boolean'` | the aggregate the measure means: `sum`, `avg`, `min` or `max` over the column; `count` (over `'*'` for a row count, or over a column for its non-null values); or `count_distinct`. |
+| a measure whose old expression computed a value per row | keep that value as a field of the object (a stored or formula field) and aggregate the field. |
+| a measure whose old expression combined measures (a ratio, a difference) | `derived: { op, of: [...] }` on an ADR-0021 dataset over the same object. |
+
+**The one-line fix: give the measure an aggregate type.** There is no mechanical
+rewrite — the column alone does not say whether `amount` meant its sum, its average
+or its largest value — so `os migrate meta` lists nothing for this change.
+
+Each retired member is refused at parse with a prescription naming the six
+aggregates, at the measure's `type`, and in `tsc` (the members are gone from the
+`AggregationMetricType` type). A value the enum never declared keeps zod's own
+message.
+
+### The retirement kit
+
+- **Value-level retirement.** `AggregationMetricType` is declared through
+  `enumWithRetiredValues` (`shared/retired-key.ts`), with the prescriptions
+  module-private. No authorable KEY and no def changed, so nothing lands in
+  `RETIRED_KEYS_BY_MAJOR`, and the four surface ratchets (`api-surface`,
+  `authorable-surface`, `json-schema.manifest`, `api-surface-signatures`) are
+  byte-identical.
+- **No D2 conversion, by design.** A stored or built cube that still carries one of
+  the three is REFUSED, never rewritten or dropped: the boot door
+  (`ObjectStackDefinitionSchema`, which a built artifact is parsed through), the
+  `analytics_cube` write door and `defineStack` refuse it with the prescription, and
+  the rehydration seam replays no conversion over it.
+- **D3 entry `cube-metric-expression-types-retired`**, with its step-18 rationale
+  fragment, carries the judgement the upgrader owes: which aggregate each measure
+  meant.
+- **Liveness.** The `analytics_cube` row `measures.type` stays `live`, re-verified
+  2026-10-02, with the narrowing recorded.
+- **Docs.** The `data/analytics` reference page is regenerated.
+- **No deprecation window**, per the project's startup-stage posture.
+
+### Reach, measured
+
+- This repository authors no cube measure of the three types outside tests:
+  `examples/**`, `packages/**` (the platform objects included) and the skills and
+  docs carry none. The showcase cube's `type: 'string'` entries are dimensions,
+  whose `DimensionType` is a separate enum and is unchanged.
+- objectui at its pinned commit carries no `AggregationMetricType` mirror and no
+  cube measure of the three types.
+- Out-of-repo authored cubes: NOT MEASURED.
+
+Clause-②: no (narrowing)
+
+<!-- adr-0087: registered cube-metric-expression-types-retired -->