#4243) (#4258)

`sys_migration`（#3617 的部署级迁移标记账本）此前由 service-storage 注册，理由写在对象头注释里：「由第一个消费它的服务注册」。那在只有一个消费者时成立，但账本早已有了与存储无关的消费者——#4235 的 value-shapes 门禁扫的是 lookup/location 值形态，整条路径不碰文件；#4215 的从空创建记账同理。代价是 `data-migration-plugins.ts` 里那个绕过：一个和文件毫无关系的迁移，也得把 StorageServicePlugin 启起来，只为让内核里有这张表。

注册点改为 `PlatformObjectsPlugin`。它通过 manifest 服务注册 `SysMigration`（scope: system），并声明 `optionalDependencies: ['com.objectstack.engine.objectql']`，使两者同在时 init 顺序落在 ObjectQL 的 manifest 服务之后，不在时（纯翻译内核）照常降级。`os serve` 本就自动注入该插件，因此每个被服务的内核都带账本，与是否装了存储无关。

#4215 的从空创建记账随注册一起搬家。它留在 storage 的理由原文是「This service owns the call because it registers sys_migration」——前提搬走，调用跟着走。storage 侧只保留读者（file-references 门禁的 `isDataMigrationVerified`），reap guard 行为不变。

`buildDataMigrationPlugins()` 的耦合随之放松：默认只注册 PlatformObjectsPlugin，账本随之而来；`{ storage: true }` 才追加 settings + storage，且只有 `os migrate files-to-references` 传它，因为只有它真的要对着部署的真实存储树做对账。`os migrate value-shapes` 从此不再为一张表启动整个存储服务——该命令严格只读，`--apply` 只写标记本身。

唯一语义变化面：手工组装 StorageServicePlugin 而不组 PlatformObjectsPlugin 的嵌入式内核不再获得账本。方向安全（fail toward retention），changeset 已写明迁移句；cloud 的宿主内核走 serve 装配，不受影响。

Closes #4243
Closes #4236

The branch was recreated after #4235 merged and neither the PR's opened nor
its reopened event produced a workflow run, while other branches pushed in the
same window did. This empty commit fires `synchronize`; it collapses away on
squash merge.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016zgA8CQMJeJbFEjnbib1Uv

…false (#3438)

The boot line that names an open value-shape gate (#4253) fired on every
deployment there is, and stated something untrue on any deployment that had
already settled the posture with an environment switch. Both are one failure:
an advisory that speaks where it does not apply is exactly how readers learn to
ignore it, and the line's whole value is that a warn-first deployment is told
once, credibly, which command ends warn mode.

Neither defect is reachable from the suite that shipped with the announcement.
`engine.test.ts` mocks `./registry`, and a mocked registry hands the engine
exactly the fields the test wrote — so these cases get a sibling file built on
the genuine `registerApp → registry` path, which is the only way a test sees
what a deployment sees.

`objectHasCoveredValueField` — the dormancy short-circuit meant to spare an
object with no covered field the flag query — tested raw type membership, while
the real registry INJECTS covered-type fields into every object it registers:
`organization_id` and `owner_id` (both `system`), `created_by` and `updated_by`
(both in `SKIP_FIELDS`), four `lookup`s. `validateRecord` skips every one of
them before it reaches the value-shape check, so the short-circuit answered
`true` for literally every object, never fired, and its WeakMap memoized a
constant. It now counts by the validator's own `isScannableValueShapeField` —
the predicate the scanner already imports. Three readings of "a covered field"
drifting by one clause is how a gate ends up governing fields nothing enforces,
which is the shape #4235 argued against.

The announcement also consulted no environment switch, though both postures it
reports on short-circuit ahead of the deployment flag it reads. Under
`OS_DATA_VALUE_SHAPE_STRICT_ENABLED` enforcement is already on for both
classes, so "checked but NOT enforced here" was false; under either opt-out the
operator chose leniency deliberately, so naming a migration that cannot change
what they get is noise. Each gate consults its own pair — `mediaPostureSetByEnv`
and `valueShapePostureSetByEnv`, siblings for the reason `mediaStrictEffective`
and `valueShapeStrictEffective` are siblings, since the opt-outs are per-class
while the opt-in opens both. Cheapest test first, so a kernel with nothing to
say still reaches no flag query.

Enforcement is unchanged: same gates, same flags, same default. The flag read
was already memoized per process, so what this corrects is the property
ADR-0104 states, not a user-visible cost.

Verified: objectql 1345 (7 new), cli 628, spec check:generated 8/8, objectql
build, check:release-notes and check:doc-authoring pass, ESLint clean. One
pre-existing failure on main is untouched by this branch and reproduces with
zero of its source changes: `query-expression-conformance.test.ts` >
"the removed nested-select object form is refused BY NAME", from #4268.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016zgA8CQMJeJbFEjnbib1Uv

…false (#3438)

The boot line that names an open value-shape gate (#4253) fired on every
deployment there is, and stated something untrue on any deployment that had
already settled the posture with an environment switch. Both are one failure:
an advisory that speaks where it does not apply is exactly how readers learn to
ignore it, and the line's whole value is that a warn-first deployment is told
once, credibly, which command ends warn mode.

Neither defect is reachable from the suite that shipped with the announcement.
`engine.test.ts` mocks `./registry`, and a mocked registry hands the engine
exactly the fields the test wrote — so these cases get a sibling file built on
the genuine `registerApp → registry` path, which is the only way a test sees
what a deployment sees.

`objectHasCoveredValueField` — the dormancy short-circuit meant to spare an
object with no covered field the flag query — tested raw type membership, while
the real registry INJECTS covered-type fields into every object it registers:
`organization_id` and `owner_id` (both `system`), `created_by` and `updated_by`
(both in `SKIP_FIELDS`), four `lookup`s. `validateRecord` skips every one of
them before it reaches the value-shape check, so the short-circuit answered
`true` for literally every object, never fired, and its WeakMap memoized a
constant. It now counts by the validator's own `isScannableValueShapeField` —
the predicate the scanner already imports. Three readings of "a covered field"
drifting by one clause is how a gate ends up governing fields nothing enforces,
which is the shape #4235 argued against.

The announcement also consulted no environment switch, though both postures it
reports on short-circuit ahead of the deployment flag it reads. Under
`OS_DATA_VALUE_SHAPE_STRICT_ENABLED` enforcement is already on for both
classes, so "checked but NOT enforced here" was false; under either opt-out the
operator chose leniency deliberately, so naming a migration that cannot change
what they get is noise. Each gate consults its own pair — `mediaPostureSetByEnv`
and `valueShapePostureSetByEnv`, siblings for the reason `mediaStrictEffective`
and `valueShapeStrictEffective` are siblings, since the opt-outs are per-class
while the opt-in opens both. Cheapest test first, so a kernel with nothing to
say still reaches no flag query.

Enforcement is unchanged: same gates, same flags, same default. The flag read
was already memoized per process, so what this corrects is the property
ADR-0104 states, not a user-visible cost.

The predicate fix is pinned by reverting it: with raw-type membership restored,
`stays silent when no object declares a covered field` fails, because a `note`
declaring only text still carries the four injected lookups.

Verified on a full workspace build: objectql 1345 (7 new), cli 628, spec
check:generated 8/8, check:release-notes and check:doc-authoring pass, ESLint
clean.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016zgA8CQMJeJbFEjnbib1Uv

…false (#3438) (#4284)

The boot line that names an open value-shape gate (#4253) fired on every
deployment there is, and stated something untrue on any deployment that had
already settled the posture with an environment switch. Both are one failure:
an advisory that speaks where it does not apply is exactly how readers learn to
ignore it, and the line's whole value is that a warn-first deployment is told
once, credibly, which command ends warn mode.

Neither defect is reachable from the suite that shipped with the announcement.
`engine.test.ts` mocks `./registry`, and a mocked registry hands the engine
exactly the fields the test wrote — so these cases get a sibling file built on
the genuine `registerApp → registry` path, which is the only way a test sees
what a deployment sees.

`objectHasCoveredValueField` — the dormancy short-circuit meant to spare an
object with no covered field the flag query — tested raw type membership, while
the real registry INJECTS covered-type fields into every object it registers:
`organization_id` and `owner_id` (both `system`), `created_by` and `updated_by`
(both in `SKIP_FIELDS`), four `lookup`s. `validateRecord` skips every one of
them before it reaches the value-shape check, so the short-circuit answered
`true` for literally every object, never fired, and its WeakMap memoized a
constant. It now counts by the validator's own `isScannableValueShapeField` —
the predicate the scanner already imports. Three readings of "a covered field"
drifting by one clause is how a gate ends up governing fields nothing enforces,
which is the shape #4235 argued against.

The announcement also consulted no environment switch, though both postures it
reports on short-circuit ahead of the deployment flag it reads. Under
`OS_DATA_VALUE_SHAPE_STRICT_ENABLED` enforcement is already on for both
classes, so "checked but NOT enforced here" was false; under either opt-out the
operator chose leniency deliberately, so naming a migration that cannot change
what they get is noise. Each gate consults its own pair — `mediaPostureSetByEnv`
and `valueShapePostureSetByEnv`, siblings for the reason `mediaStrictEffective`
and `valueShapeStrictEffective` are siblings, since the opt-outs are per-class
while the opt-in opens both. Cheapest test first, so a kernel with nothing to
say still reaches no flag query.

Enforcement is unchanged: same gates, same flags, same default. The flag read
was already memoized per process, so what this corrects is the property
ADR-0104 states, not a user-visible cost.

The predicate fix is pinned by reverting it: with raw-type membership restored,
`stays silent when no object declares a covered field` fails, because a `note`
declaring only text still carries the four injected lookups.

Verified on a full workspace build: objectql 1345 (7 new), cli 628, spec
check:generated 8/8, check:release-notes and check:doc-authoring pass, ESLint
clean.


Claude-Session: https://claude.ai/code/session_016zgA8CQMJeJbFEjnbib1Uv

Co-authored-by: Claude <noreply@anthropic.com>