[aicayzer]

Summary

Rename a folder's search setting to query across the server, device, CLI, and Swift binding. A query with tier: all writes matching eligible library and feed items as files; a new file uses defaults.tier or falls back to library. Closes #2335.

Changes

• Refuse search and --search without an alias or migration; reject unknown query tiers.
• Reuse the shared item-query schema and validator from 47b64241c, including the same tier shape used by views.
• Carry both tiers through folder hydration and membership while preserving files and server items when their tier leaves the query.
• Update the contract, glossary, generated type catalog, OpenAPI, client schema, command reference, and all folder fixtures. Preserve permanent contract IDs.

Testing

• Observed the new core test, all nine new device cases, and server regression tests fail before implementation; all pass after implementation.
• Passed workspace and Swift-binding clippy with warnings denied, Rust formatting, core/CLI and Swift-binding tests, TypeScript checks, and formatting checks.
• Passed 40 server folder tests and 41 live server compliance tests.
• Passed all 864 folder device tests with MARFA_NO_KEYCHAIN unset and all 29 folder CLI tests.
• Ran pnpm test:changed twice. The first run found a stale shipped-shape digest, which was regenerated and verified. The second run passed 4,967 selected tests, all 1,144 whole-tree tests, and the contract/generator lane, but failed the unchanged sign-in keyboard test's immediate autofocus assertion (sign-in.browser.test.ts:152, empty focus instead of email). That test passed in the first full run and passed its isolated rerun; no sign-in code changed. This intermittent browser-test failure remains separate from the folder change.
• Verified against a live server that both tiers produce files and narrowing to library keeps the feed file unmatched while both server items remain active at their original tiers.
• Rust tests used their default selection; opt-in ignored live tests were not selected. Live coverage came from conformance and the CLI proof above.

Notes for reviewers

Reviewed the whole tree for setting readers and stale names, with particular attention to hydration, single-tier slice refusal, defaults, tier departure, and safe file handover. Corrected the contract qualifications and stale CLI help found in review. This is a breaking rename. Full-text search and permanent contract IDs keep their existing names. The Swift change is the Rust binding in this repository; this pull request does not publish an SDK release.

The companion documentation pull request, withmarfa/docs#606, updates the guides and generated references. Leave both pull requests unmerged.

Checklist

• The title is a scoped Conventional Commit.
• New behavior has a test that was seen failing first, or no test was needed and the reason is above.
• Docs, comments and the contract still say what is true after this change.

[aicayzer]

Reviewed with Codex (one round, full effort, since this decides which files a folder writes): no findings. The rename holds at every door (type, /folders, folder.yaml, CLI), an old search key and an unknown tier are refused, and tier: all never deletes or trashes an item that leaves the query. 40 server, 13 Rust and 149 device conformance tests passed in review; Full CI green.