Merge origin/main into claude/issue-6486-adr0049-retire-sweep (2)

生成物按 os-regen 四步:先取 origin/main 版本落 merge commit,随后整体重生成。
手工消解两处冲突:
- migrations/registry.ts —— 两侧各自在 step17.semantic[] 末尾追加,合并为四条
  (main 的 driver-sql-distinct-bare-filter-typed + 本 sweep 的三条)
- type-alias-convention.pin.test.ts —— 计数三段叙事合并:
  751 →(#6037)754 →(#5933)755 →(本 sweep -7)748

Author: claude

.changeset/aggregation-array-string-agg-removed.md

@@ -0,0 +1,82 @@
+---
+"@objectstack/spec": major
+"@objectstack/objectql": minor
+"@objectstack/service-analytics": patch
+---
+
+refactor(spec)!: retire `array_agg` / `string_agg` from `AggregationFunction` — `count_distinct` deliberately kept (#6188, ADR-0049)
+
+`AggregationFunction` declared eight functions; the SQL family compiles five.
+`SqlDriver.mapAggregateFunc` and the Turso `RemoteTransport.aggregate` each lower
+`count`/`sum`/`avg`/`min`/`max` and route everything else to one refusal, so
+three of the eight were declared-but-unenforced against the backends this
+platform targets — and, worse, the *set* each backend implemented was different,
+so "which aggregations can I use" had no answer an author could read off the
+schema.
+
+What makes these two sharper than an ordinary inert declaration is that another
+package had to carry a denylist for them. `service-analytics` subtracted
+`array_agg` and `string_agg` by name in `UNSUPPORTED_AGGREGATES`, because
+without that subtraction they reached the Cube strategy's `default` and came
+back as `COUNT(*)` — **a row count in place of the value the author asked for**,
+with no error and no log (objectui#2945).
+
+**The three unlowered functions were SPLIT, not retired as a block** (maintainer
+ruling, 2026-08-07):
+
+- **`count_distinct` STAYS** and takes ADR-0049's *enforce* leg. It is a
+  dashboard staple with one portable lowering (`COUNT(DISTINCT x)`), and
+  `service-analytics` lowers it already; the SQL-driver implementation follows
+  on its own card. Its declaration leads its implementation here by decision,
+  not by drift.
+- **`array_agg` / `string_agg` take the *remove* leg.** Display conveniences
+  with no measured pull, and `string_agg` never had one shape to lower to at
+  all: the delimiter is a second argument in PostgreSQL, a `SEPARATOR` clause in
+  MySQL and a differently named function in SQL Server.
+
+FROM → TO, both authoring surfaces:
+
+| Was | Now |
+|:--|:--|
+| `aggregations: [{ function: 'array_agg', field: 'tag', alias: 'tags' }]` | no replacement — read the rows with an ordinary `fields` query and shape them in the caller, or materialise the roll-up as a stored field |
+| `aggregations: [{ function: 'string_agg', field: 'name', alias: 'names' }]` | as above |
+| `measures: [{ name: 'tags', aggregate: 'array_agg', field: 'tag' }]` | delete the measure — `compileDataset` already refused it by name, so it never produced a number |
+
+The retirement kit:
+
+- This is an enum **VALUE** retirement, so there is no `retiredKey()` tombstone:
+  the enum's own error map carries the prescription, keyed on the received value
+  so that only the two spellings which used to be legal are told they "were
+  removed" (the `crypto.hash` / `HookBodyCapability` precedent, #4391). A
+  mis-spelling still gets zod's list of the legal functions. For the same reason
+  nothing lands in `RETIRED_KEYS_BY_MAJOR` and the four surface ratchets are
+  byte-identical — no def and no authorable key changed.
+- **ADR-0087 D2 conversion + D3 chain step**
+  (`dataset-measure-array-string-agg-removed`): `os migrate meta --from 16`
+  drops any `dataset.measures[]` declaring a retired aggregate, plus any derived
+  measure the drop strands, with a notice each. The measure is dropped rather
+  than stripped down because one with neither `aggregate` nor `derived` fails
+  the dataset's own refinement — a conversion whose output cannot parse is worse
+  than none.
+- **D3 semantic entry** (`query-array-string-agg-retired`) for
+  `QueryAST.aggregations[].function`: a request surface, never stored, so there
+  is no source for the chain to rewrite and callers move their own queries.
+- The engine's in-memory fallback (`@objectstack/objectql`) drops its arms for
+  both functions — a `switch` case on a value the enum no longer has does not
+  type-check, and a dead arm is how a retired vocabulary returns by accident.
+- `service-analytics`' `UNSUPPORTED_AGGREGATES` is now **empty and kept**: it is
+  half of an arithmetic the lockstep suite enforces (`SUPPORTED = spec
+  vocabulary − this`), which is what stops the next aggregate added to the spec
+  from silently reaching that `COUNT(*)` default.
+
+**Behaviour that actually changes** — this is the rare narrowing that removes
+reachable behaviour, and it is worth stating plainly: on `driver-mongodb` and on
+the engine's in-memory fallback these two DID compute. A raw QueryAST
+aggregation against those backends returned an array or a joined string and will
+now be refused at parse. That unpredictability is precisely what the ruling
+ended — an aggregation that worked on one backend and failed on another is not a
+capability — and both of those backends are inside the #5499 freeze. Their code
+is untouched; it is simply no longer reachable through a spec-valid request. On
+the dataset path nothing changes: `compileDataset` refused both by name already.
+
+<!-- adr-0087: registered query-array-string-agg-retired, dataset-measure-array-string-agg-removed -->

.changeset/bulk-write-before-hook-per-row-contract.md

@@ -0,0 +1,44 @@
+---
+"@objectstack/spec": minor
+---
+
+feat(spec): 定形 `multi: true` 批量写在 `before*` 阶段的按行 hook 契约(#6462)
+
+#5574 的维护者裁决(2026-08-06,方案 B)把「批量写按行语义为平台契约」(#4800 /
+#4862,after 侧已由 #5038 交付)延伸到 `before` 型 hook,并指定 **contract-first
+拆分:spec 契约子单先行,engine 实现随后**。本次变更是该拆分的 spec 半边 —— 只落
+契约、pin 测试与 ADR 附录,**engine 一行未动**。
+
+**为什么需要这条契约。** 谓词写路径上 `ctx.previous` 在 before 阶段从未被绑定,于是
+每一个按守卫写法写出来的 hook —— `if (ctx.previous?.locked) throw` —— 在批量写上
+静默放行。hotcrm 实测:一次批量编辑绕过全部 15 个守卫 hook,把单行路径会拒绝的
+`readonly: true` 字段写成 `null`。失效方向是 fail-open,而让它静默的可选链正是 AI
+会写出的形状。
+
+**新增契约面** `@objectstack/spec/data` → `bulk-write-hook-conformance.ts`:
+
+- `BULK_WRITE_HOOK_DISPATCH_CONTRACT` —— 四个写事件的按行派发表(before/after ×
+  update/delete),逐条声明 per-row 上下文携带哪些键、载荷作用域,以及 **`delivered`
+  标记**:after 半边由 #5038 交付(`true`),before 半边为已裁未交(`false`,
+  engine 半边 = #5574 engine 卡)。契约先行必须能被读出「尚未交付」,否则它就是一次
+  declared ≠ enforced。
+- `MAX_BULK_PER_ROW_HOOK_ROWS` / `BULK_PER_ROW_HOOK_LIMIT_ERROR_CODE` /
+  `resolveBulkPerRowHookBudget()` —— `assertBulkPerRowHookBudget` 先例的契约级表述:
+  **两个阶段共用一个上限**,超限在**首次按行派发之前**整单拒绝(什么也不写、一个
+  handler 也不跑),永不降级成「整批一次派发」。
+
+**载荷可改写语义(裁决必答项 1)的答案是:载荷仍然只有一份,作用域是整批。** 每个
+per-row 上下文拿到的是**同一个** payload,而不是逐行副本 —— 于是 N 份载荷不可能分叉,
+没有合并步骤,谓词写永远不会被拆成 N 次单行写(仍是一次 `updateMany`、一个受影响行数
+#4639)。逐行副本 + 「一致则合并、分叉则拒绝」这条更显然的路线被实测证据否掉:objectql
+自带的 `sys_stamp_audit_update` 注册在 `'*'` 上,且在**每行**的 stamp 内部读
+`new Date()`,跨毫秒的两行 `updated_at` 天然不同 —— 该规则会非确定性地拒绝正常批量写。
+
+**行为不变。** 本次不改任何 Zod schema 的接受面,不新增可授权键,不动 engine:今天能
+通过校验的元数据,改动后逐字节仍然通过。`hook.zod.ts` 的 `input` 形状表继续描述引擎
+**当前**的构造(由 objectql 对真实派发钉住),只是补了一条指向新契约的前瞻说明 ——
+表与引擎不允许抢跑,这正是 #5273 的教训。
+
+ADR-0058 新增 **Addendum II**,同时收纳裁决指定的 #5748 半边(`data.id` 与
+`where.id` 统一走标量测试,已由 PR #5919 交付),并把 Addendum I 中「`before*` hooks
+are NOT per row」一段标记为 **SUPERSEDED**(原文保留 —— 被推翻的决策本身是记录)。

.changeset/share-link-enforcement-full-envelope.md

@@ -0,0 +1,35 @@
+---
+"@objectstack/spec": minor
+---
+
+feat(spec): share-link enforcement takes the full `ExecutionContext`; the narrow context is route-401 only (#6430, #6206 ruling A)
+
+`IShareLinkService.createLink` / `revokeLink` / `listLinks` now declare their
+context parameter as the complete `ExecutionContext` envelope instead of the
+five-field `ShareLinkExecutionContext`. All three ADJUDICATE access — the
+[Finding-2] visibility re-read on create, the ADR-0111 D8 share-manager probe
+on revoke, the context-scoped listing — so each needs the whole
+`resolveAuthzContext` result, `accessible_org_ids` / `org_user_ids` /
+`systemPermissions` / `posture` / `tabPermissions` included.
+
+The measured failure behind the ruling: the share-link route assembled exactly
+those five fields and handed the result straight to `engine.find` as the
+enforcement context. Under the `group` tenancy posture `accessible_org_ids` IS
+the Layer 0 wall (ADR-0105 D2) and an absent set denies, so link creation
+returned a blanket 403 on a posture that ships. Fail-closed, not a leak — but a
+trimmed envelope feeding enforcement is a bypass-shaped pattern, and ADR-0095
+D2 already rules that posture is resolved once and carried, never re-derived at
+the enforcement site. This was the third assembly site of that family (#5997,
+#6071), so the contract converges on the whole envelope rather than keeping a
+per-site subset.
+
+`ShareLinkExecutionContext` is retained and unchanged in shape — it is the
+route's own "authenticated or 401?" vocabulary — with TSDoc that now states the
+boundary and why TypeScript cannot enforce it (structural subtyping accepts a
+narrow object wherever the wide type is expected, so the declared parameter
+type plus the caller's obligation are what hold the line).
+
+Contract-only, no runtime behaviour change here: existing implementations keep
+compiling (method parameters are bivariant), and the `@objectstack/plugin-sharing`
+consumer that actually threads the envelope through is the follow-up half
+tracked on #6206.

.changeset/shared-filter-verdict-reduction.md

@@ -0,0 +1,45 @@
+---
+"@objectstack/spec": minor
+"@objectstack/driver-sql": patch
+"@objectstack/driver-mongodb": patch
+"@objectstack/driver-memory": patch
+"@objectstack/lint": patch
+---
+
+refactor(spec,drivers,lint): one implementation of the filter identity reduction (#5659)
+
+`{ $and: [] }` matches every row, `{ $or: [] }` matches none, `{}` is a TRUE
+disjunct that absorbs its `$or`, `{ $not: {} }` is FALSE. That is a ruling
+(#5322/#5134) pinned for every backend by the four identity cases in
+`FILTER_LOGIC_CASES` — and it was implemented four times over: `reduceFilterNode`
+in `driver-sql`, the same function again in `driver-mongodb`, the
+`every`/`some`/truthiness algebra of `driver-memory`'s matcher, and nearly a
+fifth hand-written copy inside `@objectstack/lint`, which declined to write one
+and filed this issue instead.
+
+**New in `@objectstack/spec` (`@objectstack/spec/data`): `reduceFilterVerdict`**,
+beside the case table that proves it. It answers `'true' | 'false' | 'clause'`
+for a filter node and never throws on its own; each backend's own refusals — the
+undeclared `$`-combinator and the `undefined` comparand in `driver-sql`, the
+query-level keys and the `$null` comparand in `driver-mongodb` — are passed in as
+`FilterVerdictHooks` and are invoked from exactly the positions they were invoked
+from before. `reduceFilterKeyVerdict` answers the same question for one key, which
+is what both SQL and MongoDB emitters consult while walking a node.
+
+**No behaviour changes in the three drivers.** The move is mechanical: the shared
+algebra replaces each private copy, the refusals stay where they were, and the
+`FILTER_LOGIC_CASES` conformance suites are green on both sides of the change —
+including the SQL-inheriting `driver-sqlite-wasm` and `driver-turso`.
+
+**`@objectstack/lint` gains two warnings it was structurally blind to.** The
+`multi: true` unbounded-bulk-write rule (#5482) asked "does this filter have zero
+keys", so a `delete_record` bounded by `filter: { $and: [] }` or
+`filter: { $or: [{}] }` — a whole-object write by the ruling every driver executes
+— passed silently. It now asks the reduction, and it warns about both while
+staying quiet on `{ $or: [] }` and `{ $not: {} }`, which match nothing. The
+message names the shape it saw (`a filter that REDUCES TO TRUE ({"$and":[]})`)
+rather than calling a non-empty filter "empty".
+
+If you have a flow declaring a bulk write bounded by one of those two shapes, the
+lint will now tell you so — the write was already unbounded at run time; only the
+feedback is new.

.changeset/specifier-value-domain.md

@@ -0,0 +1,59 @@
+---
+"@objectstack/spec": minor
+---
+
+feat(spec): SettingsManifest specifiers can declare a standard `valueDomain` (#5933)
+
+`SpecifierSchema`'s value constraints were `options` / `pattern` / `min` / `max` /
+`minLength` / `maxLength`, and none of them can express "the legal values here are
+whatever the published standard says". `pattern` constrains the *shape* of a string,
+so `^[A-Za-z]{2}$` admits `ZZ` and `Mars/Olympus` is a shape-valid time zone that does
+not exist; `options` is exhaustive (#5131), so completing it would mean checking a
+600-entry tzdb table into a manifest and re-checking it every tzdb release. The
+`localization` manifest hits this on three keys at once — `timezone`, `currency`,
+`default_country` — and `company.country` carries the same two-letter pattern with the
+same hole.
+
+**New optional key: `specifier.valueDomain`**, a closed enum with three members:
+
+- `iana_time_zone`
+- `iso_4217_currency`
+- `iso_3166_alpha2`
+
+Declaring it moves the enforcement boundary: the standard's membership becomes what a
+write is judged against, and `options` degrades to a **UI convenience list** — a curated
+dropdown of values worth suggesting, no longer an exhaustive statement of what is legal.
+A value outside `options` but inside the domain is accepted.
+
+**Nothing changes when it is absent.** `options` stays exhaustive and the save path keeps
+rejecting anything the table does not list, which is the right shape for tables the
+platform itself backs (`mail.provider`, `sms.provider`) where "legal" means "this
+deployment ships an adapter for it". `pattern` / `minLength` / `maxLength` still apply
+alongside a domain and still narrow — shape and membership are independent, and a value
+must satisfy both.
+
+The **enforcement** is not in this release. `packages/spec` declares the domain and
+nothing more (Prime Directive #2); the write-path check lands in `service-settings`
+(#5712, blocked on this). What ships here so both halves agree is the *definition of
+membership* for each domain, pinned by tests rather than left to prose, because for two
+of the three the obvious oracle is the wrong one:
+
+- `iana_time_zone` is the `Intl.DateTimeFormat` probe, not
+  `Intl.supportedValuesOf('timeZone')` — measured on the Node 22 baseline, that list
+  holds 418 CLDR canonical names and omits `UTC` (this platform's own declared default)
+  and `Asia/Kolkata` (a value the shipped localization manifest curates), carrying the
+  latter only under the legacy spelling `Asia/Calcutta`.
+- `iso_4217_currency` **is** `Intl.supportedValuesOf('currency')` — 162 entries,
+  admitting `CHF` and all nine curated options while rejecting `XYZ`.
+- `iso_3166_alpha2` has no standard-library oracle at all:
+  `Intl.DisplayNames(…, { type: 'region' }).of()` returns a distinct name for `ZZ`
+  ("Unknown Region", the exact value this domain exists to reject) and for `UK` (a CLDR
+  alias that is not an ISO 3166-1 code), so the enforcing side must carry an explicit
+  code list.
+
+`bcp47_locale`, the fourth member the proposal listed, is deliberately **not** in the
+vocabulary. Its only candidate key is `localization.locale`, whose options are exactly
+the shipped message catalogs — a registry-backed table, so a domain there would loosen
+it and admit locales with no catalog. And BCP-47 has no membership registry to enforce
+against (`Intl.getCanonicalLocales('xx-YY')` succeeds), so the "domain" would only
+re-check syntax — the weakness `pattern` already has and this key exists to fix.