Explicit owner-driven migration, replacing lazy migrate-on-read/commit-on-write

[cuibonobo]

Summary

Implements #47: replaces the lazy migration model (transform-on-read + commit-on-next-write) with explicit, owner-driven migrateAll(), plus the mechanical fixes the RFC calls out.

• migrateAll() is the only thing that ever changes a record's disk-state typeId. update() no longer silently commits a pending migration as a side effect of an unrelated content edit — it validates the merge-patched content against the record's own current stored type and writes back at the same typeId.
• get()/query() return records exactly as stored by default, fixing the spec/impl divergence where query() never migrated but get() did (the bug that made query({ filter: { typeId } }) silently miss not-yet-migrated records). presentAt: 'latest' is an explicit, never-persisted opt-in supported by both.
• Stale-writer signal: presentAt: 'latest' throws StackMigrationError (replacing a console.warn + raw record) when a record's version can't be reconciled with what this app instance has registered/defined — covering both a stale binary reading a newer record and an app that knows a later type exists but has no migration path to reach it.
• Filter.baseId matches every version of a type family, resolved client-side via listTypes() before hitting the adapter/wire layer — no adapter or wire changes needed.
• Grants match by baseId instead of exact typeId, so a version bump no longer orphans existing grants.
• RecordVersion gains typeId, threaded through sqlite-shared (DDL + row mapper), wire-types, and adapter-api.
• migrateAll() validates each migrated record's content against the target schema before committing, aborting immediately on the first failure rather than partially applying a buggy migration function.

Also updates docs/spec.md's Type migrations, Queries, Grant, and Versions sections, and adds a new "Additive evolution within a version" section capturing the governance rule from the issue's two amendment comments (when a version bump is warranted vs. additive-in-place).

Test plan

• pnpm -r build — all 9 packages build clean
• pnpm -r typecheck — clean
• pnpm -r test — all packages pass (core: 278 tests, including new coverage for presentAt: 'latest', baseId filtering, grant-by-family matching, and migrateAll() abort-on-invalid-migration)
• pnpm -r lint — clean
• pnpm format:check — clean

🤖 Generated with Claude Code

---

Generated by Claude Code