Merge remote-tracking branch 'origin/main' into claude/issue-5853-category-title-abbreviations

Author: claude

.changeset/analytics-read-scope-compile-failed-500.md

@@ -67,7 +67,12 @@ the disclosure question to be re-decided message by message).
   `@objectstack/service-analytics` (ADR-0112 D3) and typed as
   `RegisteredErrorCode` at the constructor, so an unregistered code is a compile
   error. It is legible on the wire through the sibling `/analytics/query` exit,
-  which puts a thrown `err.code` in `error.details.code` (#3842).
+  which puts a thrown `err.code` at **`error.code`** (#3842) — read it there.
+  `errorResponseBase` only stages the code inside a `details` object;
+  `buildApiError` then runs `splitSemanticCode`, which promotes it into the
+  declared `error.code` field and drops the now-empty `details`, so the key is
+  omitted from the body and `error.details.code` is never present:
+  `{"success":false,"error":{"code":"READ_SCOPE_COMPILE_FAILED","message":"Internal server error","httpStatus":500}}`.
 
 **Which inputs are refused did not change.** No refusal condition moved: nothing
 that used to lower now throws, and nothing that used to throw now lowers. That is

.changeset/lint-visibility-bare-identifier-gate.md

@@ -0,0 +1,58 @@
+---
+"@objectstack/lint": minor
+"@objectstack/formula": minor
+---
+
+feat(lint): view/page 可见性谓词的裸标识符构建期闸门 —— 坏谓词发不出去(#6128)
+
+新增 **error 级** 规则 `visibility-bare-identifier`:view/page 的可见性谓词
+(`visibleWhen` 及其两个已弃用别名 `visibleOn` / `visibility`)里引用了任何绑定根都解析不到的
+顶层标识符时,`os validate` / `os build` / `os lint` 一律拒收。写成 `status == 'active'`
+而不是 `record.status == 'active'` 的谓词,从此发不出去。
+
+按 #5149 维护者 2026-08-06 裁决的构建期半边落地(运行时 warn-once 半边已由 objectui#3541 合入)。
+本仓传统的准确表述是:fail-open 或 fail-closed 都可以裁,**静默不可以**。谓词失败仍然 fail-open
+(已发货 app 行为不变),但坏谓词不再能进入产物。
+
+**为什么现有两道闸都放行**(#5149 Repro 1 实测,已写进规则注释,防后人误并):
+ADR-0032 的标识符闸(`validate-expressions.ts`)解析 record 作用域的裸引用,但它的遍历只覆盖
+objects / flows / actions / sharingRules / hooks,**从不走 views 与 pages**;ADR-0089 D3b
+只判**有根**的谓词根错层(runtime 面的 `data.`、metadata 面的 `record.`),**无根**的谓词两边都不匹配。
+两闸之间正好漏掉「作者按文档示例写了裸字段名 → 谓词永远解析失败 → 控制台 fail-open 静默显示」。
+
+**判定由两个既有 oracle 合成,本包不自建 CEL 环境**(#4812 的教训):声明性判定取
+`@objectstack/formula` 的 `firstUndeclaredReference`(即 `validateExpression` 给 record 作用域
+裸引用定罪的同一个严格环境),AST 取规范入口 `parseCelToAst`。AST 先收集所有处于**接收者位置**
+的标识符(`a.b` / `a?.b` / `a['b']` / `a.exists(…)`)并在检查前声明它们,于是只剩「当作裸值引用」
+的标识符会被判 —— 未知**根**(`my_record.x`)交还给 ADR-0089 D3b,不在本规则射程内。
+
+**与 #4953(全量 vs 稀疏绑定)的边界**:#4953 实测同一求值器在两种绑定下语义相反
+(`has(record.a)` 全量 true / 稀疏 false;`record.a != null` 全量 false / 稀疏 FAULT)。本规则
+**按构造与该分叉无关** —— 它从不追问某个 KEY 在已绑定的根上是否存在,只追问标识符有没有根,
+而无根标识符在两种绑定下都解析不到。`has(record.x)` / `record.x != null` 等守卫写法在本闸门下
+一律绿,无论 #4953 最终怎么裁;已加测试钉住这条边界。
+
+**遍历按实测修正,否则规则生来即死**:`os build` 跑 `examples/app-showcase` 得到的唯一一条
+view 表单谓词落在 `views[0].formViews.edit.sections[0].fields[6].visibleWhen` —— 运行时 app 形状下
+`views[]` 条目是**视图容器**(`ViewSchema` 声明的自有键就是 `list` / `form` / `listViews` /
+`formViews`),`sections` 在下一层。原遍历只读 `views[].sections`,在这份 stack 上报告「干净」。
+现在覆盖容器的 `form` 与每个 `formViews.<key>`,以及仍然直接携带 `sections` 的 `defineForm` 形状;
+pages 改走共享的 `walkPageComponents`(regions、slotted 页的 `slots`、以及 `properties` 里的
+`page:tabs` / `page:accordion` / `page:card` 子树都随之覆盖,source-authored 页按其既有语义跳过)。
+`objects[].views` 明确不读 —— 该键已被 schema 立碑拒绝,读它只会造出一条永不触发的幽灵检查。
+两条既有 ADR-0089 D3b advisory 随遍历一并变得真正可达。
+
+注册表 tier `advisory` → `gating`(#5762 的先例):tier 声明并非自述,
+`authoring-rule-wiring.test.ts` 会读规则源码核对。
+
+已知盲点(已钉测试、方向安全):字段名与 CEL **类型名**相同时(`type` / `int` / `string` / `list`
+/ `map` / `timestamp` …)不判 —— CEL 自身声明这些标识符,`type == 'grid'` 到检查器那里是类型
+overload 错误而非未知变量;改读 overload 消息会误杀合法的 `type(record.x) == string`。语法不通过
+的谓词同样不判,交还给拥有该判定的闸门。两者都是漏判,永远不会变成误红。
+
+仓内 `app-todo` / `app-crm` / `app-showcase` 三个示例 `os validate` 全部通过、零 visibility finding,
+无需修改任何示例内容。
+
+`@objectstack/formula` 侧:公开导出 `firstUndeclaredReference`(理由与既有的
+`collectCelRootIdentifiers` 一致 —— 绑定根集合不同的消费方需要的是同一个答案,替代方案是在消费方
+自建严格 `Environment`,而那正是 #4812 从本包消费方手里拿掉的私有前端)。

.changeset/standalone-stack-libsql-dispatch.md

@@ -0,0 +1,17 @@
+---
+'@objectstack/runtime': minor
+---
+
+**`createStandaloneStack` now dispatches `libsql://` / Turso URLs** instead of refusing them as an unsupported scheme (#5820).
+
+`detectDriverFromUrl()` recognised `memory://`, `postgres://`, `mongodb://` and `file:`, and threw on everything else — while `resolveDatabaseUrl()` listed `TURSO_DATABASE_URL` as one of its URL sources. A host that set it got the URL read in and then rejected on the way out. Since the CLI wired `libsql://` for `os serve` / `os start` (#5602), the same `OS_DATABASE_URL=libsql://…` booted under `os start` and failed under `os migrate`, which comes through this stack.
+
+What changed:
+
+- `libsql://…` and `http(s)://*.turso.…` resolve to the `turso` driver kind — the same two spellings the CLI classifies, kept identical on purpose.
+- `databaseDriver: 'turso'` (and `OS_DATABASE_DRIVER=turso`) is accepted by the config schema.
+- The driver comes from `@objectstack/driver-turso`, an **optional** install: it drags `@libsql/client` and its native bindings, so it is not a dependency of `@objectstack/runtime`. It is loaded lazily, only for a selection that asks for libSQL, and injected through the driver-factory seam `DefaultDatasourcePlugin` already exposes — so the connect path, the `bootCritical` fail-fast verdict, `OS_ALLOW_DRIVER_CONNECT_FAILURE` and the retained Setup → Datasources status are identical to every other kind.
+- Package missing? The boot fails **loudly**, carrying the exact install command (`npm install @objectstack/driver-turso`) as data as well as prose. There is no SQLite fallback: a silent step-down would open an empty local database while your libSQL data stays untouched, and every write — including an `os migrate` DDL — would land in the wrong place (#3276).
+- `databaseAuthToken` is no longer declared-and-ignored: the `turso` kind reads it, falling back to `OS_DATABASE_AUTH_TOKEN` and then the vendor's own `TURSO_AUTH_TOKEN` — the same precedence `os serve` uses.
+
+Unknown schemes still throw, and the message now lists `libsql://` among the supported ones.

.changeset/wild-pugs-clap.md

@@ -0,0 +1,23 @@
+---
+'@objectstack/objectql': patch
+---
+
+写入载荷里的算子对象在标量字段上被响亮拒收(#5922)
+
+**行为变化**:此前静默入库的算子对象现在被拒绝。`update('task', { title: { $in: ['a','b'] } }, …)` 会抛
+`VALIDATION_FAILED`(字段码 `invalid_type`),而不再把 `{"$in":["a","b"]}` 原样交给驱动写进 `title` 列。
+
+原本这条错误的命运取决于字段类型,而不取决于错误本身:`number` 会立刻响亮拒绝(`n must be a number`),
+`text` 则零告警落库,之后以「这行的 title 变成了乱码」的形态在读路径上出现,离原因很远。实测(15 种字段类型,
+记录型 driver 驱动真实引擎)显示放行的远不止 `text`:`textarea`、未声明 `options` 的 `select`、以及
+`lookup` 等引用类(ADR-0104 warn-first)同样放行;而 `select`(有 options)/ `url` / `email` / `phone`
+之所以拒绝,只是因为 `String({ $in: […] })` 是 `"[object Object]"`,恰好过不了它们的正则或选项表 —— 一条
+在 4 种类型上偶然成立、在另外 11 种上不成立的规则,作者无法从元数据预测。
+
+现在的规则只有一条:**声明值是标量的字段,一律不接受算子对象**。判定复用 spec 已导出的算子词表
+(`ALL_OPERATORS` + `RETIRED_FILTER_OPERATORS`),不是第六份手抄的 `startsWith('$')`,所以协议新增算子当天即
+自动收口。消息与 ADR-0104 的形状拒绝同族(同一 `invalid_value_shape` 文案,四语言均已本地化),点名字段、
+点名算子、点名声明类型。
+
+刻意不动的两处:`json` 等结构化 JSON 类继续放行(`{ "$in": [...] }` 存在 `json` 列里是用户数据,不是写错的
+filter);多值字段保留既有的 `invalid_type_array` 拒绝。`insert` 与 `update`(单行与 multi)三个校验入口均已覆盖。

.claude/skills/pm-dispatch/SKILL.md

@@ -1306,18 +1306,35 @@ same environment — its own container and fresh clone, decoupled from the PM
 session's lifetime. Use it when devs need resources/lifetime beyond one
 container, or the maintainer asks for it. Requires the `Claude_Code_Remote`
 MCP tools (available in remote/web sessions; if absent, say so and fall back
-to `mode:subagent`). Per issue:
-
-1. `create_trigger` with `create_new_session_on_fire: true` and no schedule
-   (poke-only), name `pm-dispatch-issue-<n>`, prompt = the dispatch template
-   below **made fully standalone**: the fired session starts with zero
-   conversation context (it does get the repo clone, so it can be told to
-   follow `.claude/agents/os-dev.md`), and — since an independent session
-   cannot return a message to the PM — it must be told to **post the JSON
-   report as a comment on the issue** (prefixed `<!-- os-dev-report -->`)
-   instead of returning it, in addition to opening the draft PR.
-2. `fire_trigger` to launch it, then `delete_trigger` once the report has
-   been collected (step 6) so poke-only triggers don't accumulate.
+to `mode:subagent`).
+
+**一次性云卡用 `create_session`,⛔ 不用 create_trigger+fire**(维护者
+2026-08-07 拍板;trigger 流只保留给**定时/重复**型 —— 座位 Routine 一节)。
+实测三课,#6083 首派一天踩齐,每一条都写进派发动作:
+
+1. **授权面随 source,不随环境。** trigger 拉起的会话**没有仓库授权** ——
+   clone(匿名只读)可用,push / 开 PR / 发评论全 403(`not in this
+   session's authorized repository set`),`permission_mode: auto` 下也没有
+   可弹的授权窗,dev 只能做只读勘察。`create_session` 带 `source_url` 的
+   会话**出生即持推送授权**。同时带 `outcome_branch`(= 认领分支,平台托管
+   推送)与显式 `model`(trigger 流不可指模型 —— sonnet 默认惊吓即此出处)、
+   `title`(客户端卡片名 —— **以车道名开头,⛔ 不叫 os-dev**,维护者
+   2026-08-07 拍板:多车道并行时卡片按车道可扫;形如
+   `⚡ spec #5599 view 身份前置(裁 B)`,即 `⚡ <车道> #<单号> <短语>`)。
+2. **派发词必须带自驱条款(回合终点约束)。** 云会话是对话形态 —— 回合结束
+   就停下等输入,不像 subagent 一口气跑完;不写这条,dev 会在中期汇报或提问
+   处停摆,而 PM 只能靠 poke 唤醒。条款原文形:⛔ 不为提问/中期汇报结束回合;
+   开放选择按裁决与三轴自裁记入终报 open_questions;合法回合终点只有
+   (a) 推送完成 + 终报 JSON 作为最后一条消息,或 (b) 硬阻塞详报。
+3. **交付通道写明降级路径。** 云会话通常没有 GitHub API 工具(连接器不随
+   create_session/trigger 传递),派发词写明:开 PR / 发评论失败 ⛔ 不视为
+   阻塞 —— 推送 outcome branch + 终报作最后一条会话消息,**PM 代开 draft
+   PR、代转录报告**到 issue(权限面不因此放大)。
+
+**监控与转向**:`get_session` 读实时状态(status / model / token 用量;
+IDLE + 分支未推送 = 停摆待 poke);投递消息用**绑定会话的 poke 触发器**
+(`create_trigger` 带 `persistent_session_id` + `fire_trigger` + 用后即
+`delete_trigger`)。收报:巡检主动读会话终报与分支推送,⛔ 不等推送通知。
 
 #### 座位 Routine 化(PM 侧的运行形态,#5472 第 5 点)
 

content/docs/data-modeling/drivers.mdx

@@ -54,8 +54,11 @@ Drivers can be selected in two ways:
 
 <Callout type="info">
 **Turso / libSQL needs one extra install.** `libsql://` and `*.turso.io` URLs *are*
-inferred, but `@objectstack/driver-turso` is an **optional peer dependency** of the
-CLI — it pulls in `@libsql/client`, so it is not part of a default install:
+inferred — by the CLI (`os serve` / `os start` / `os dev`) and by the standalone
+runtime stack the one-shot commands and embedders boot through (`os migrate`,
+`createStandaloneStack`) alike. But `@objectstack/driver-turso` is an **optional**
+install — it pulls in `@libsql/client` plus native bindings, so it is not part of a
+default install:
 
 ```bash
 npm install @objectstack/driver-turso
@@ -76,7 +79,7 @@ libSQL data stayed untouched. Pass the token with `--database-auth-token`
 | **SQLite** | `@objectstack/driver-sql` (peer: `better-sqlite3`) | `SqlDriver` | `sqlite` \| `sql` |
 | **SQLite (WASM)** | `@objectstack/driver-sqlite-wasm` | `SqliteWasmDriver` | `sqlite-wasm` \| `wasm-sqlite` \| `wasm` |
 | **MongoDB** | `@objectstack/driver-mongodb` | `MongoDBDriver` | `mongodb` \| `mongo` (single-tenant only — see [below](#multi-tenancy-not-supported)) |
-| **Turso / libSQL** | `@objectstack/driver-turso` (optional peer of the CLI) | `TursoDriver` | `turso` \| `libsql` |
+| **Turso / libSQL** | `@objectstack/driver-turso` (optional install — see the callout above) | `TursoDriver` | `turso` \| `libsql` |
 | **Memory** | `@objectstack/driver-memory` | `InMemoryDriver` | `memory` |
 
 > All SQL flavours (PostgreSQL / MySQL / SQLite) are served by a single

packages/formula/src/index.ts

@@ -15,6 +15,16 @@ export { celEngine, DEFAULT_LIMITS } from './cel-engine';
 // (approval `expression` approvers): lint and the runtime pre-check share this
 // one helper so what they accept can never drift.
 export { collectCelRootIdentifiers } from './cel-engine';
+// #6128 — the strict-environment "does this identifier resolve?" oracle, the
+// same one `validateExpression` gives its `record`-scoped bare-ref verdict from.
+// Published for the same reason as `collectCelRootIdentifiers` above: a lint
+// rule whose surface declares a DIFFERENT root set (`@objectstack/lint`'s
+// view/page visibility gate binds `current_user` / `page` on top of
+// SCOPE_ROOTS) needs this exact answer, and the alternative — rebuilding a
+// strict `Environment` in the consumer — is the private-front-end mistake
+// #4812 removed from that very package. One oracle, one answer to "what
+// resolves", whichever surface is asking.
+export { firstUndeclaredReference } from './cel-engine';
 // #4812 — the canonical parse-to-AST entry. Any consumer that needs the AST of
 // an authored CEL source takes it from here, so "what parses" has exactly ONE
 // answer across build, lint and runtime. Building a private `new Environment()`

packages/lint/src/authoring-rules.ts

@@ -693,12 +693,20 @@ export const AUTHORING_RULES: readonly AuthoringRule[] = [
     surfaceReason: RUNTIME_NEEDS_FULL_SNAPSHOT,
     run: (stack) => validateSeedStateMachine(stack),
   },
-  // ADR-0089 D3b — deprecated visibility aliases and a mis-layered binding root.
-  // Pre-parse: the schema folds `visibleOn`/`visibility` into `visibleWhen`
-  // during parse, so the alias the author wrote is gone from `result.data`.
+  // ADR-0089 D3b — deprecated visibility aliases and a mis-layered binding root,
+  // plus (#6128) the bare-identifier gate. Pre-parse: the schema folds
+  // `visibleOn`/`visibility` into `visibleWhen` during parse, so the alias the
+  // author wrote is gone from `result.data`.
+  //
+  // `gating` since #6128: `visibility-bare-identifier` emits `error`. The two
+  // ADR-0089 rules stay advisory findings within it — the tier is a property of
+  // the RULE FUNCTION (can it emit `error`?), and the per-finding severity is
+  // what decides whether any given diagnostic gates, exactly as `lintFlowPatterns`
+  // has worked since #3760. The promotion follows the #5762 precedent: a family
+  // that gains an `error` finding moves its registry tier in the same edit.
   {
     name: 'validateVisibilityPredicates',
-    tier: 'advisory',
+    tier: 'gating',
     input: 'normalized',
     commands: ALL,
     source: 'packages/lint/src/validate-visibility-predicates.ts',

packages/lint/src/index.ts

@@ -139,6 +139,7 @@ export {
   validateVisibilityPredicates,
   VISIBILITY_ALIAS_DEPRECATED,
   VISIBILITY_ROOT_MISLAYERED,
+  VISIBILITY_BARE_IDENTIFIER,
 } from './validate-visibility-predicates.js';
 export type {
   VisibilityFinding,