diff --git a/.changeset/adr-0067-commit-history.md b/.changeset/adr-0067-commit-history.md
deleted file mode 100644
index a361ee90c9..0000000000
--- a/.changeset/adr-0067-commit-history.md
+++ /dev/null
@@ -1,14 +0,0 @@
----
-'@objectstack/metadata-core': minor
-'@objectstack/objectql': minor
-'@objectstack/runtime': minor
----
-
-Package-scoped commit history & rollback for AI authoring (ADR-0067)
-
-Each authoring apply now lands as one revertible **commit** on a package timeline, on top of `sys_metadata_history`:
-
-- New `sys_metadata_commit` object groups a turn's metadata changes (by `event_seq` range).
-- `publishPackageDrafts` records each publish as one commit (best-effort) with a per-artifact revert plan and an optional `message` / `aiModel`.
-- New protocol methods `listCommits`, `revertCommit`, `rollbackToPackageCommit` (reusing `restoreVersion` + delete; a revert is itself an append-only commit).
-- New REST routes: `GET /packages/:id/commits`, `POST /packages/:id/commits/:commitId/revert`, `POST /packages/:id/rollback`.
diff --git a/.changeset/chart-config-colors-map.md b/.changeset/chart-config-colors-map.md
deleted file mode 100644
index 966ad7cc8e..0000000000
--- a/.changeset/chart-config-colors-map.md
+++ /dev/null
@@ -1,11 +0,0 @@
----
-"@objectstack/spec": patch
----
-
-feat(spec): type ChartConfig `colors` as a palette OR a value→color map
-
-`ChartConfigSchema.colors` now accepts either a positional palette (`string[]`)
-or an explicit value→color map (`Record<value, color>`, kanban-style). A
-value→color map — and a select/lookup dimension's option colors — take
-precedence over the positional palette per category, so semantic charts
-(health, status) paint their own colors instead of the generic palette.
diff --git a/.changeset/dashboard-widget-layout-optional.md b/.changeset/dashboard-widget-layout-optional.md
deleted file mode 100644
index 9f6d1299de..0000000000
--- a/.changeset/dashboard-widget-layout-optional.md
+++ /dev/null
@@ -1,21 +0,0 @@
----
-"@objectstack/spec": patch
----
-
-fix(spec): make dashboard widget `layout` optional (auto-flowed when omitted)
-
-`DashboardWidgetSchema.layout` was required, but the entire runtime treats it as
-optional: the renderer (`DashboardGridLayout`) auto-flows any widget without a
-layout (`x: (i % 4) * 3, y: ⌊i/4⌋ * 4, w: 3, h: 4`), and the Studio dashboard
-designer adds widgets **without** a layout by design.
-
-The mismatch meant every dashboard authored in the Studio designer failed spec
-validation the moment a widget was added — the draft `PUT /meta/dashboard/...`
-returned **422** ("widgets: Invalid type: expected object, received undefined"),
-so the draft never saved and **Publish stayed disabled**, even though the widget
-rendered correctly in the canvas. Found by dogfooding the dashboard designer in
-the browser.
-
-`layout` is now optional; absence means "auto-place". Authors may still pin an
-explicit grid position. Backward-compatible — existing dashboards that specify
-`layout` are unaffected.
diff --git a/.changeset/dataset-authoring-form.md b/.changeset/dataset-authoring-form.md
deleted file mode 100644
index f8bd5ce73e..0000000000
--- a/.changeset/dataset-authoring-form.md
+++ /dev/null
@@ -1,20 +0,0 @@
----
-"@objectstack/spec": minor
----
-
-feat(spec): dataset authoring form + derived measures without a dummy aggregate
-
-`dataset` was the only UI-authorable metadata type without a `defineForm`
-layout, so Studio's create surface fell back to the auto-generated flat layout
-(free-text `object`, no grouping). Adds `dataset.form.ts` (registered in
-`METADATA_FORM_REGISTRY`): sectioned Basics / Source / Dimensions / Measures
-with an `object` picker (`ref:object`) and guidance — matching the sibling
-`report` editor.
-
-Also makes `DatasetMeasureSchema.aggregate` optional. A derived measure
-(`derived: { op, of }`) combines other measures by name and `aggregate` is
-ignored for it at compile time, but the schema still required it — so a derived
-measure failed validation unless you added a meaningless aggregate. `aggregate`
-is now required only for non-derived measures (enforced in the existing
-`superRefine`). Backward compatible: existing measures that carry an aggregate
-stay valid.
diff --git a/.changeset/dataset-join-ambiguous-column.md b/.changeset/dataset-join-ambiguous-column.md
deleted file mode 100644
index e909465afd..0000000000
--- a/.changeset/dataset-join-ambiguous-column.md
+++ /dev/null
@@ -1,13 +0,0 @@
----
-"@objectstack/service-analytics": patch
----
-
-fix(analytics): qualify base-object columns in joined dataset queries
-
-A dataset that joins a related object (`include` + a `relationship.field`
-dimension/measure) emitted BARE base-table columns in SELECT/GROUP BY while the
-joined columns were alias-qualified. When the base and joined tables share a
-column name (e.g. both have `status`), the query failed at runtime with
-"ambiguous column name". `NativeSQLStrategy` now qualifies plain base-column
-identifiers with the base table when the cube has joins; single-object cubes
-are unchanged (byte-for-byte identical SQL).
diff --git a/.changeset/docs-formula-returntype.md b/.changeset/docs-formula-returntype.md
deleted file mode 100644
index 42ba7f3a49..0000000000
--- a/.changeset/docs-formula-returntype.md
+++ /dev/null
@@ -1,4 +0,0 @@
----
----
-
-docs: formula guides declare a formula result type via `returnType` (not the forbidden `type`); CEL source on `expression`.
diff --git a/.changeset/flow-assignment-config-shape.md b/.changeset/flow-assignment-config-shape.md
deleted file mode 100644
index 5feabee84f..0000000000
--- a/.changeset/flow-assignment-config-shape.md
+++ /dev/null
@@ -1,23 +0,0 @@
----
-"@objectstack/service-automation": patch
----
-
-fix(automation): honor the `assignments` wrapper shape on assignment nodes
-
-The built-in `assignment` node executor set each TOP-LEVEL `config` key as a flow
-variable. But the surfaces that author these nodes all emit an `assignments`
-wrapper instead:
-
-- Studio's visual Assignment editor → `config: { assignments: { <var>: <value> } }`
-- bundled example flows (app-crm, showcase) → `config: { assignments: [{ variable, value }] }`
-
-So a node designed in Studio (or any of the shipped examples) silently set a
-single variable literally named `assignments` to the whole map/array and never
-set the intended variables — it passed build and no-oped at run time, leaving
-every downstream reference unresolved.
-
-The executor now normalizes all three shapes (`assignments` map, `assignments`
-array of `{ variable | name | key, value }`, and the legacy flat
-`{ <var>: <value> }`) and interpolates `{var}` templates in the values, matching
-the CRUD / screen nodes. Adds `logic-nodes.test.ts` covering each shape as a
-regression guard.
diff --git a/.changeset/formula-infer-value-type.md b/.changeset/formula-infer-value-type.md
deleted file mode 100644
index 76e4bad288..0000000000
--- a/.changeset/formula-infer-value-type.md
+++ /dev/null
@@ -1,9 +0,0 @@
----
-"@objectstack/formula": minor
-"@objectstack/spec": minor
----
-
-Formula field typing: `inferExpressionType()` + a declared `returnType`.
-
-- `@objectstack/formula`: new `inferExpressionType()` (and lower-level `inferCelType()`) surfaces the cel-js type-checker's result for a CEL value/formula expression, mapped to `number | text | boolean | date | unknown`. Conservative — two `dyn` operands stay `unknown`; typed literals/stdlib returns pin a concrete type.
-- `@objectstack/spec`: `FieldSchema` gains an optional `returnType` (`number|text|boolean|date`) so a formula field can carry its declared value type (the way Salesforce/Airtable do), letting consumers (dataset measures, formatting, validation) read a declared type instead of re-parsing the expression.
diff --git a/.changeset/meta-item-cache-control-no-cache.md b/.changeset/meta-item-cache-control-no-cache.md
deleted file mode 100644
index 2e385c7289..0000000000
--- a/.changeset/meta-item-cache-control-no-cache.md
+++ /dev/null
@@ -1,26 +0,0 @@
----
-"@objectstack/objectql": patch
-"@objectstack/rest": patch
----
-
-fix(objectql,rest): single-item meta reads must revalidate (no `max-age=3600`)
-
-`GET /api/v1/meta/object/:name` (and the other single-item meta reads served by
-the cached path) sent `Cache-Control: public, max-age, max-age=3600`. Two bugs:
-
-1. **Stale metadata for up to an hour.** Object metadata is invalidated by
-   publish, but a one-hour TTL let browsers (and any CDN/proxy) serve a stale
-   schema *without revalidating* — e.g. the AI-build "New" create form kept
-   rendering pre-publish fields until the TTL lapsed. The list endpoint
-   `GET /api/v1/meta/object` is uncached, which is why list views updated but
-   single-object reads didn't. `getMetaItemCached` now returns
-   `directives: ['private', 'no-cache']` with no `maxAge`, so the ETag validator
-   (which already changes on publish) gates freshness: a cheap `304` when
-   unchanged, fresh fields the instant a publish bumps the ETag. `private` also
-   keeps per-tenant metadata out of shared caches.
-
-2. **Malformed header.** The directives array carried a bare `max-age`
-   placeholder *and* the REST layer appended `max-age=3600` from the `maxAge`
-   field, concatenating into `public, max-age, max-age=3600`. The header builder
-   now strips the bare `max-age` token before appending the real value, so a
-   `maxAge` is emitted once as a well-formed `max-age=N`.
diff --git a/.changeset/page-hard-remove-dead-schemas.md b/.changeset/page-hard-remove-dead-schemas.md
deleted file mode 100644
index b81812ea5e..0000000000
--- a/.changeset/page-hard-remove-dead-schemas.md
+++ /dev/null
@@ -1,22 +0,0 @@
----
-"@objectstack/spec": minor
----
-
-chore(spec): hard-remove the dead `blank`/`record_review` page config (enforce-or-remove)
-
-Completes the enforce-or-remove started in framework#2265. The `blank` and
-`record_review` page types were already removed from `PageTypeSchema` (no
-renderer), their fields marked `@deprecated`, and objectui dropped all
-references (objectui#1949). This deletes the now-unreachable surface:
-
-- `BlankPageLayoutSchema`, `BlankPageLayoutItemSchema`, `RecordReviewConfigSchema`
-  (and their inferred types `BlankPageLayout`, `BlankPageLayoutItem`,
-  `RecordReviewConfig`).
-- The `blankLayout` and `recordReview` fields on `PageSchema`.
-- `page-builder.zod.ts` (the `blank`-type drag-drop canvas config:
-  `PageBuilderConfigSchema` / `CanvasSnapSettingsSchema` / `CanvasZoomSettingsSchema`
-  / `ElementPaletteItemSchema` / `InterfaceBuilderConfigSchema` and their types)
-  and its `@objectstack/spec/studio` re-exports — nothing consumed them.
-
-The `page` liveness ledger drops to 15 properties (the 2 `dead` entries are gone).
-No consumers in framework or objectui (objectui#1949 already merged).
diff --git a/.changeset/page-liveness-ledger.md b/.changeset/page-liveness-ledger.md
deleted file mode 100644
index fb1fa82235..0000000000
--- a/.changeset/page-liveness-ledger.md
+++ /dev/null
@@ -1,15 +0,0 @@
----
-"@objectstack/spec": patch
----
-
-chore(liveness): bring `page` under the spec liveness gate
-
-Onboards the `page` metadata type to the ADR-0049/#1919 liveness ledger
-(`packages/spec/liveness/page.json`) and adds it to the governed-types list in
-`check-liveness.mts`. Every authorable PageSchema property now declares a
-status with evidence: 17 properties — 14 `live` (objectui renderer consumers
-cited as prose), 1 `experimental` (`variables` — provider/hook exist, no
-end-to-end consumer), 2 `dead` (`recordReview` / `blankLayout` — their page
-types were removed in framework#2265 and objectui dropped all references in
-objectui#1949; the fields stay @deprecated pending hard-removal). CI now fails
-if a new page property lands unclassified.
diff --git a/.changeset/page-type-enforce-or-remove.md b/.changeset/page-type-enforce-or-remove.md
deleted file mode 100644
index 5c1d1ca5f2..0000000000
--- a/.changeset/page-type-enforce-or-remove.md
+++ /dev/null
@@ -1,22 +0,0 @@
----
-"@objectstack/spec": minor
----
-
-fix(spec): remove unrendered roadmap page types from PageTypeSchema (enforce-or-remove)
-
-`PageTypeSchema` advertised six page types that never shipped a renderer —
-`dashboard`, `form`, `record_detail`, `record_review`, `overview`, `blank`.
-Authoring one passed schema validation but broke at runtime ("Unknown component
-type"), a false affordance that's especially dangerous when templates are
-AI-authored. Per ADR-0049 (enforce-or-remove), the enum is now the *live* set
-(`record`, `home`, `app`, `utility`, `list`) — authoring a removed type now
-fails fast at parse instead of silently at render. The removed types are tracked
-in the new `PAGE_TYPE_ROADMAP` export and re-enter the enum only when a renderer
-ships. A `page-type-liveness` gate test asserts the enum never re-grows a
-roadmap type.
-
-The `recordReview`/`blankLayout` config schemas and fields are retained but
-`@deprecated` (their page types are no longer authorizable) to avoid breaking
-downstream imports; they will be removed in a coordinated follow-up. The
-`variables` page field is documented `@experimental` — its state container is
-wired but no consumer reads/writes it end-to-end yet.
diff --git a/.changeset/page-variables-live.md b/.changeset/page-variables-live.md
deleted file mode 100644
index 54a310715b..0000000000
--- a/.changeset/page-variables-live.md
+++ /dev/null
@@ -1,11 +0,0 @@
----
-'@objectstack/spec': patch
----
-
-Promote `PageSchema.variables` from @experimental to live (ADR-0049)
-
-Page-local state is now wired end-to-end (runtime in objectui#1957: page
-variables are injected into the visible/CEL expression context as `page.<var>`,
-and `element:record_picker` writes a variable via its `source` binding). The
-spec docs are updated to describe the now-live behaviour and the binding
-direction, and the liveness ledger entry is flipped `experimental → live`.
diff --git a/.changeset/setup-advanced-nav-unlistable.md b/.changeset/setup-advanced-nav-unlistable.md
deleted file mode 100644
index 49473e117f..0000000000
--- a/.changeset/setup-advanced-nav-unlistable.md
+++ /dev/null
@@ -1,14 +0,0 @@
----
-"@objectstack/platform-objects": patch
----
-
-fix(setup): drop Advanced nav entries for non-listable objects (sys_verification, sys_device_code)
-
-Dogfooding every Setup menu surfaced two Advanced entries that always render
-"无法加载记录 / failed to load": **Verifications** (`sys_verification`) and
-**Device Codes** (`sys_device_code`). Both objects deliberately omit `list`
-from `apiMethods` (sensitive, ephemeral secrets — verification tokens and OAuth
-device-grant codes are not meant to be browsed), so the generic object/list-view
-menu can only ever 405. Removed both nav entries (and their orphaned zh labels);
-the objects remain reachable by id. Re-adding a browse menu would require
-enabling `list` on the object — a security decision, not a nav fix.
diff --git a/.changeset/setup-firstrun-nav-i18n.md b/.changeset/setup-firstrun-nav-i18n.md
deleted file mode 100644
index 34541a07a7..0000000000
--- a/.changeset/setup-firstrun-nav-i18n.md
+++ /dev/null
@@ -1,13 +0,0 @@
----
-"@objectstack/platform-objects": patch
-"@objectstack/service-settings": patch
-"@objectstack/rest": patch
----
-
-fix(setup): first-run admin polish — pin Company/Localization, gate dashboard widgets by `requiresService`, i18n + settings PUT envelope
-
-Dogfooding the Setup app as a brand-new system administrator surfaced a cluster of small first-run gaps, now fixed:
-
-- **platform-objects**: pin **Localization** and **Company** in the Setup sidebar's Configuration group — both are registered `service-settings` manifests (the two lowest-`order` Workspace settings) but were reachable only via the "All Settings" hub. Translate the previously-English nav labels Cloud Connection (云连接), Datasources (数据源) and Capabilities (能力). Tag the System Overview `widget_organizations` KPI with `requiresService: 'org-scoping'`.
-- **rest**: extend the ADR-0057 D10 server-side visibility gate to **dashboard widgets** — strip widgets whose `requiresService` names an unregistered kernel service (mirrors the existing app-nav gate; `resolveRegisteredServices` now also discovers gates declared on widgets). In a single-tenant runtime this removes the orphan "Organizations" KPI, matching the already-hidden org nav entries.
-- **service-settings**: add the missing zh `help` strings for the Localization manifest (number/currency/first-day-of-week/fiscal-year fields), and accept the `{ values: { … } }` envelope on `PUT /api/settings/:ns` symmetrically with what `GET` returns.
diff --git a/.changeset/slotted-page-no-slots-required.md b/.changeset/slotted-page-no-slots-required.md
deleted file mode 100644
index de9f6514f2..0000000000
--- a/.changeset/slotted-page-no-slots-required.md
+++ /dev/null
@@ -1,12 +0,0 @@
----
-"@objectstack/spec": patch
----
-
-fix(spec): don't require `slots` on slotted pages
-
-`PageSchema`'s superRefine rejected any `kind: 'slotted'` page that didn't
-provide a `slots` map — but a slotted page with no overrides is valid: every
-slot falls through to the synthesized default layout, the natural starting
-point before you add overrides. Requiring `slots` up front made the Studio
-"New Page" form a dead-end the moment you picked "slotted" (the form can't
-author a slot map), the same trap as the old required `regions`.
diff --git a/.changeset/spec-create-seeds.md b/.changeset/spec-create-seeds.md
deleted file mode 100644
index adaed62b8b..0000000000
--- a/.changeset/spec-create-seeds.md
+++ /dev/null
@@ -1,7 +0,0 @@
----
-'@objectstack/spec': minor
----
-
-Add authoritative per-type create seeds (root-cause for the "designer shape ≠ spec" family)
-
-New `metadata-create-seeds.ts`: a single source of truth for the minimal valid create shape of each metadata type (`getMetadataCreateSeed(type)`), co-located with the schemas and asserted valid against each type's schema by `metadata-create-seeds.test.ts`. This anchors the create-form's default shape to the spec so it can't drift — the root cause of the recurring family where a freshly-created item (dashboard without `layout`, script action without `body`, report with stale `objectName`/`columns`) failed validation on save (422) yet passed every other gate. Seeds the 9 core Studio-designer types (dashboard, action, page, view, flow, validation, hook, dataset, object); the test surfaces remaining schema-backed types still needing a seed. (Follow-up: expose `createSeed` via `/meta/types` so the Studio designer consumes it instead of hardcoding `createDefaults`.)
diff --git a/.changeset/studio-page-regions-properties-optional.md b/.changeset/studio-page-regions-properties-optional.md
deleted file mode 100644
index 86eee6429b..0000000000
--- a/.changeset/studio-page-regions-properties-optional.md
+++ /dev/null
@@ -1,15 +0,0 @@
----
-"@objectstack/spec": patch
----
-
-fix(spec): make page `regions` and component `properties` optional
-
-`PageSchema.regions` and `PageComponentSchema.properties` were required, which
-made it impossible to create record/home/app pages in the Studio editor: the
-New Page form has no region editor, and the create-form seeds a record page's
-default layout from `buildDefaultPageSchema`, whose nodes carry props at the top
-level — so every seeded block tripped `regions.N.components.M.properties:
-expected record`. Both are now `.optional().default(...)`; an empty full page
-falls back to the synthesized default layout, slotted pages compose via `slots`,
-list pages ignore regions, and prop-less components (record:activity,
-element:divider) no longer need `properties: {}`.
diff --git a/examples/app-crm/CHANGELOG.md b/examples/app-crm/CHANGELOG.md
index 46420fc23c..3206951180 100644
--- a/examples/app-crm/CHANGELOG.md
+++ b/examples/app-crm/CHANGELOG.md
@@ -1,5 +1,24 @@
 # @objectstack/example-crm
 
+## 4.0.59
+
+### Patch Changes
+
+- Updated dependencies [4d99a5c]
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/runtime@10.4.0
+  - @objectstack/spec@10.4.0
+
 ## 4.0.58
 
 ### Patch Changes
diff --git a/examples/app-crm/package.json b/examples/app-crm/package.json
index 8075b0af34..5e86929bf5 100644
--- a/examples/app-crm/package.json
+++ b/examples/app-crm/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/example-crm",
-  "version": "4.0.58",
+  "version": "4.0.59",
   "description": "Minimal CRM example — a smoke-test workspace that exercises the metadata loading pipeline (objects → views → app → dashboard → hook → flow → seed). For a full-featured enterprise CRM see https://github.com/objectstack-ai/hotcrm.",
   "license": "Apache-2.0",
   "private": true,
diff --git a/examples/app-showcase/CHANGELOG.md b/examples/app-showcase/CHANGELOG.md
index cdeee1d6b7..5c2e047f3a 100644
--- a/examples/app-showcase/CHANGELOG.md
+++ b/examples/app-showcase/CHANGELOG.md
@@ -1,5 +1,28 @@
 # @objectstack/example-showcase
 
+## 0.2.5
+
+### Patch Changes
+
+- Updated dependencies [4d99a5c]
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/runtime@10.4.0
+  - @objectstack/spec@10.4.0
+  - @objectstack/cloud-connection@10.4.0
+  - @objectstack/connector-rest@10.4.0
+  - @objectstack/connector-slack@10.4.0
+  - @objectstack/driver-sql@10.4.0
+
 ## 0.2.4
 
 ### Patch Changes
diff --git a/examples/app-showcase/package.json b/examples/app-showcase/package.json
index 1a9196bc21..1f65f816d1 100644
--- a/examples/app-showcase/package.json
+++ b/examples/app-showcase/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/example-showcase",
-  "version": "0.2.4",
+  "version": "0.2.5",
   "description": "Kitchen-sink showcase workspace — exercises every metadata type, every view type, every chart type, and the major end-to-end capability chains (security, automation, AI). Built for demonstration, debugging, and coverage-driven verification.",
   "license": "Apache-2.0",
   "private": true,
diff --git a/examples/app-todo/CHANGELOG.md b/examples/app-todo/CHANGELOG.md
index 951d08c1ea..2a6c7e5c7b 100644
--- a/examples/app-todo/CHANGELOG.md
+++ b/examples/app-todo/CHANGELOG.md
@@ -1,5 +1,32 @@
 # @objectstack/example-todo
 
+## 4.0.59
+
+### Patch Changes
+
+- Updated dependencies [4d99a5c]
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [359c0aa]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/objectql@10.4.0
+  - @objectstack/runtime@10.4.0
+  - @objectstack/spec@10.4.0
+  - @objectstack/metadata@10.4.0
+  - @objectstack/client@10.4.0
+  - @objectstack/driver-sqlite-wasm@10.4.0
+  - @objectstack/knowledge-memory@10.4.0
+  - @objectstack/service-ai@10.4.0
+  - @objectstack/service-knowledge@10.4.0
+
 ## 4.0.58
 
 ### Patch Changes
diff --git a/examples/app-todo/package.json b/examples/app-todo/package.json
index 7a3c4e8c50..5d1ddb7930 100644
--- a/examples/app-todo/package.json
+++ b/examples/app-todo/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/example-todo",
-  "version": "4.0.58",
+  "version": "4.0.59",
   "description": "Example Todo App using ObjectStack Protocol",
   "license": "Apache-2.0",
   "private": true,
diff --git a/packages/adapters/express/CHANGELOG.md b/packages/adapters/express/CHANGELOG.md
index 858ddda810..679a12d64e 100644
--- a/packages/adapters/express/CHANGELOG.md
+++ b/packages/adapters/express/CHANGELOG.md
@@ -1,5 +1,12 @@
 # @objectstack/express
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [4d99a5c]
+  - @objectstack/runtime@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/adapters/express/package.json b/packages/adapters/express/package.json
index b0896abaef..35281c8aa5 100644
--- a/packages/adapters/express/package.json
+++ b/packages/adapters/express/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/express",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
diff --git a/packages/adapters/fastify/CHANGELOG.md b/packages/adapters/fastify/CHANGELOG.md
index 21e8497f05..204be057e8 100644
--- a/packages/adapters/fastify/CHANGELOG.md
+++ b/packages/adapters/fastify/CHANGELOG.md
@@ -1,5 +1,12 @@
 # @objectstack/fastify
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [4d99a5c]
+  - @objectstack/runtime@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/adapters/fastify/package.json b/packages/adapters/fastify/package.json
index 8f076dbb16..d7570f0233 100644
--- a/packages/adapters/fastify/package.json
+++ b/packages/adapters/fastify/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/fastify",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
diff --git a/packages/adapters/hono/CHANGELOG.md b/packages/adapters/hono/CHANGELOG.md
index 93f0f81adf..6ab1aafa32 100644
--- a/packages/adapters/hono/CHANGELOG.md
+++ b/packages/adapters/hono/CHANGELOG.md
@@ -1,5 +1,14 @@
 # @objectstack/hono
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [4d99a5c]
+  - @objectstack/runtime@10.4.0
+  - @objectstack/plugin-hono-server@10.4.0
+  - @objectstack/types@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/adapters/hono/package.json b/packages/adapters/hono/package.json
index a0d188a230..55226f8224 100644
--- a/packages/adapters/hono/package.json
+++ b/packages/adapters/hono/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/hono",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
diff --git a/packages/adapters/nestjs/CHANGELOG.md b/packages/adapters/nestjs/CHANGELOG.md
index 590bf5c89f..1bf54b73e7 100644
--- a/packages/adapters/nestjs/CHANGELOG.md
+++ b/packages/adapters/nestjs/CHANGELOG.md
@@ -1,5 +1,12 @@
 # @objectstack/nestjs
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [4d99a5c]
+  - @objectstack/runtime@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/adapters/nestjs/package.json b/packages/adapters/nestjs/package.json
index d87a747822..7f77f6ef5c 100644
--- a/packages/adapters/nestjs/package.json
+++ b/packages/adapters/nestjs/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/nestjs",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
diff --git a/packages/adapters/nextjs/CHANGELOG.md b/packages/adapters/nextjs/CHANGELOG.md
index f9cfb8ee90..25fc4535c3 100644
--- a/packages/adapters/nextjs/CHANGELOG.md
+++ b/packages/adapters/nextjs/CHANGELOG.md
@@ -1,5 +1,12 @@
 # @objectstack/nextjs
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [4d99a5c]
+  - @objectstack/runtime@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/adapters/nextjs/package.json b/packages/adapters/nextjs/package.json
index 7966160768..f41f6aaaf9 100644
--- a/packages/adapters/nextjs/package.json
+++ b/packages/adapters/nextjs/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/nextjs",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
diff --git a/packages/adapters/nuxt/CHANGELOG.md b/packages/adapters/nuxt/CHANGELOG.md
index e35dc27ad0..09d40ab755 100644
--- a/packages/adapters/nuxt/CHANGELOG.md
+++ b/packages/adapters/nuxt/CHANGELOG.md
@@ -1,5 +1,12 @@
 # @objectstack/nuxt
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [4d99a5c]
+  - @objectstack/runtime@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/adapters/nuxt/package.json b/packages/adapters/nuxt/package.json
index be148f6f1e..40be81c6f3 100644
--- a/packages/adapters/nuxt/package.json
+++ b/packages/adapters/nuxt/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/nuxt",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
diff --git a/packages/adapters/sveltekit/CHANGELOG.md b/packages/adapters/sveltekit/CHANGELOG.md
index 7337524abd..352f37b2fb 100644
--- a/packages/adapters/sveltekit/CHANGELOG.md
+++ b/packages/adapters/sveltekit/CHANGELOG.md
@@ -1,5 +1,12 @@
 # @objectstack/sveltekit
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [4d99a5c]
+  - @objectstack/runtime@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/adapters/sveltekit/package.json b/packages/adapters/sveltekit/package.json
index a1237ebcc6..e4b127e3ea 100644
--- a/packages/adapters/sveltekit/package.json
+++ b/packages/adapters/sveltekit/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/sveltekit",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
diff --git a/packages/apps/account/CHANGELOG.md b/packages/apps/account/CHANGELOG.md
index 74ee7f0e44..9fa7f58939 100644
--- a/packages/apps/account/CHANGELOG.md
+++ b/packages/apps/account/CHANGELOG.md
@@ -1,5 +1,25 @@
 # @objectstack/account
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [5737261]
+- Updated dependencies [a619a3a]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/spec@10.4.0
+  - @objectstack/platform-objects@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/apps/account/package.json b/packages/apps/account/package.json
index 3cd744b49f..e720587293 100644
--- a/packages/apps/account/package.json
+++ b/packages/apps/account/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/account",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "ObjectStack Account — the end-user account/self-service console app, packaged as its own ObjectStack app package (ADR-0048: one app per package).",
   "main": "dist/index.js",
diff --git a/packages/apps/setup/CHANGELOG.md b/packages/apps/setup/CHANGELOG.md
index abcec83769..824e900a09 100644
--- a/packages/apps/setup/CHANGELOG.md
+++ b/packages/apps/setup/CHANGELOG.md
@@ -1,5 +1,25 @@
 # @objectstack/setup
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [5737261]
+- Updated dependencies [a619a3a]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/spec@10.4.0
+  - @objectstack/platform-objects@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/apps/setup/package.json b/packages/apps/setup/package.json
index 2c374f7fc0..a7cf097bc6 100644
--- a/packages/apps/setup/package.json
+++ b/packages/apps/setup/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/setup",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "ObjectStack Setup — the platform administration app, packaged as its own ObjectStack app package (ADR-0048: one app per package).",
   "main": "dist/index.js",
diff --git a/packages/apps/studio/CHANGELOG.md b/packages/apps/studio/CHANGELOG.md
index cd238c214c..4d10003af6 100644
--- a/packages/apps/studio/CHANGELOG.md
+++ b/packages/apps/studio/CHANGELOG.md
@@ -1,5 +1,25 @@
 # @objectstack/studio
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [5737261]
+- Updated dependencies [a619a3a]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/spec@10.4.0
+  - @objectstack/platform-objects@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/apps/studio/package.json b/packages/apps/studio/package.json
index 13c0f76507..be7906ac25 100644
--- a/packages/apps/studio/package.json
+++ b/packages/apps/studio/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/studio",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "ObjectStack Studio — the metadata builder app, packaged as its own ObjectStack app package (ADR-0048: one app per package).",
   "main": "dist/index.js",
diff --git a/packages/cli/CHANGELOG.md b/packages/cli/CHANGELOG.md
index 716a0dc595..ac7266dfc5 100644
--- a/packages/cli/CHANGELOG.md
+++ b/packages/cli/CHANGELOG.md
@@ -1,5 +1,74 @@
 # @objectstack/cli
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [4d99a5c]
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [715d667]
+- Updated dependencies [b6a4972]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [359c0aa]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [5737261]
+- Updated dependencies [a619a3a]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/objectql@10.4.0
+  - @objectstack/runtime@10.4.0
+  - @objectstack/spec@10.4.0
+  - @objectstack/service-analytics@10.4.0
+  - @objectstack/service-automation@10.4.0
+  - @objectstack/formula@10.4.0
+  - @objectstack/rest@10.4.0
+  - @objectstack/platform-objects@10.4.0
+  - @objectstack/service-settings@10.4.0
+  - @objectstack/plugin-approvals@10.4.0
+  - @objectstack/client@10.4.0
+  - @objectstack/plugin-sharing@10.4.0
+  - @objectstack/trigger-record-change@10.4.0
+  - @objectstack/verify@10.4.0
+  - @objectstack/cloud-connection@10.4.0
+  - @objectstack/account@10.4.0
+  - @objectstack/setup@10.4.0
+  - @objectstack/studio@10.4.0
+  - @objectstack/core@10.4.0
+  - @objectstack/lint@10.4.0
+  - @objectstack/mcp@10.4.0
+  - @objectstack/observability@10.4.0
+  - @objectstack/driver-memory@10.4.0
+  - @objectstack/driver-mongodb@10.4.0
+  - @objectstack/driver-sql@10.4.0
+  - @objectstack/driver-sqlite-wasm@10.4.0
+  - @objectstack/plugin-audit@10.4.0
+  - @objectstack/plugin-auth@10.4.0
+  - @objectstack/plugin-email@10.4.0
+  - @objectstack/plugin-hono-server@10.4.0
+  - @objectstack/plugin-org-scoping@10.4.0
+  - @objectstack/plugin-reports@10.4.0
+  - @objectstack/plugin-security@10.4.0
+  - @objectstack/plugin-webhooks@10.4.0
+  - @objectstack/service-ai@10.4.0
+  - @objectstack/service-cache@10.4.0
+  - @objectstack/service-datasource@10.4.0
+  - @objectstack/service-job@10.4.0
+  - @objectstack/service-messaging@10.4.0
+  - @objectstack/service-package@10.4.0
+  - @objectstack/service-queue@10.4.0
+  - @objectstack/service-realtime@10.4.0
+  - @objectstack/service-storage@10.4.0
+  - @objectstack/trigger-api@10.4.0
+  - @objectstack/trigger-schedule@10.4.0
+  - @objectstack/types@10.4.0
+  - @objectstack/console@10.4.0
+
 ## 10.3.0
 
 ### Minor Changes
diff --git a/packages/cli/package.json b/packages/cli/package.json
index bea40da081..644ed1d5bc 100644
--- a/packages/cli/package.json
+++ b/packages/cli/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/cli",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "description": "Command Line Interface for ObjectStack Protocol",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
diff --git a/packages/client-react/CHANGELOG.md b/packages/client-react/CHANGELOG.md
index bf4ea59850..84314b61bf 100644
--- a/packages/client-react/CHANGELOG.md
+++ b/packages/client-react/CHANGELOG.md
@@ -1,5 +1,24 @@
 # @objectstack/client-react
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/spec@10.4.0
+  - @objectstack/client@10.4.0
+  - @objectstack/core@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/client-react/package.json b/packages/client-react/package.json
index fa80298930..44feddfa7e 100644
--- a/packages/client-react/package.json
+++ b/packages/client-react/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/client-react",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "React hooks for ObjectStack Client SDK",
   "main": "dist/index.js",
diff --git a/packages/client/CHANGELOG.md b/packages/client/CHANGELOG.md
index e1e2c31104..2bba45488d 100644
--- a/packages/client/CHANGELOG.md
+++ b/packages/client/CHANGELOG.md
@@ -1,5 +1,23 @@
 # @objectstack/client
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/spec@10.4.0
+  - @objectstack/core@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/client/package.json b/packages/client/package.json
index 179d7b6ed5..3a16bf65f9 100644
--- a/packages/client/package.json
+++ b/packages/client/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/client",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "Official Client SDK for ObjectStack Protocol",
   "main": "dist/index.js",
diff --git a/packages/cloud-connection/CHANGELOG.md b/packages/cloud-connection/CHANGELOG.md
index 43601e05cf..69fd3444cd 100644
--- a/packages/cloud-connection/CHANGELOG.md
+++ b/packages/cloud-connection/CHANGELOG.md
@@ -1,5 +1,26 @@
 # @objectstack/cloud-connection
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [4d99a5c]
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/runtime@10.4.0
+  - @objectstack/spec@10.4.0
+  - @objectstack/core@10.4.0
+  - @objectstack/types@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/cloud-connection/package.json b/packages/cloud-connection/package.json
index bec3d2b272..d7e3e5d4c6 100644
--- a/packages/cloud-connection/package.json
+++ b/packages/cloud-connection/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/cloud-connection",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "Runtime-side client for an ObjectStack cloud control plane — marketplace browse proxy, install-local, device-code binding, org catalog and installed views, and the /api/v1/runtime/config discovery endpoint. Open mechanism (ADR-0008): the hub service, plan policy, and entitlements stay server-side.",
   "type": "module",
diff --git a/packages/connectors/connector-mcp/CHANGELOG.md b/packages/connectors/connector-mcp/CHANGELOG.md
index 8e4623818e..4af22eb4f6 100644
--- a/packages/connectors/connector-mcp/CHANGELOG.md
+++ b/packages/connectors/connector-mcp/CHANGELOG.md
@@ -1,5 +1,23 @@
 # @objectstack/connector-mcp
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/spec@10.4.0
+  - @objectstack/core@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/connectors/connector-mcp/package.json b/packages/connectors/connector-mcp/package.json
index aceb031bd5..f3f6a9ea31 100644
--- a/packages/connectors/connector-mcp/package.json
+++ b/packages/connectors/connector-mcp/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/connector-mcp",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "Model Context Protocol (MCP) connector for ObjectStack — a generic adapter that turns any MCP server's tools into a connector's actions on the automation engine's connector registry (ADR-0024).",
   "main": "dist/index.js",
diff --git a/packages/connectors/connector-openapi/CHANGELOG.md b/packages/connectors/connector-openapi/CHANGELOG.md
index 2c08cabd1c..5f1a061933 100644
--- a/packages/connectors/connector-openapi/CHANGELOG.md
+++ b/packages/connectors/connector-openapi/CHANGELOG.md
@@ -1,5 +1,23 @@
 # @objectstack/connector-openapi
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/spec@10.4.0
+  - @objectstack/core@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/connectors/connector-openapi/package.json b/packages/connectors/connector-openapi/package.json
index 5aad13e37c..510b759b29 100644
--- a/packages/connectors/connector-openapi/package.json
+++ b/packages/connectors/connector-openapi/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@objectstack/connector-openapi",
-    "version": "10.3.0",
+    "version": "10.4.0",
     "license": "Apache-2.0",
     "description": "OpenAPI 3.x connector generator for ObjectStack — turns a declarative OpenAPI document into connector actions on the automation engine's registry, with a self-contained static-auth HTTP transport (ADR-0023).",
     "main": "dist/index.js",
diff --git a/packages/connectors/connector-rest/CHANGELOG.md b/packages/connectors/connector-rest/CHANGELOG.md
index d6e88d24fe..6d02b3749e 100644
--- a/packages/connectors/connector-rest/CHANGELOG.md
+++ b/packages/connectors/connector-rest/CHANGELOG.md
@@ -1,5 +1,23 @@
 # @objectstack/connector-rest
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/spec@10.4.0
+  - @objectstack/core@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/connectors/connector-rest/package.json b/packages/connectors/connector-rest/package.json
index b80d208464..db3040c78f 100644
--- a/packages/connectors/connector-rest/package.json
+++ b/packages/connectors/connector-rest/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/connector-rest",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "Generic REST connector for ObjectStack — the reference concrete connector that registers a `request` action on the automation engine's connector registry (ADR-0018 §Addendum).",
   "main": "dist/index.js",
diff --git a/packages/connectors/connector-slack/CHANGELOG.md b/packages/connectors/connector-slack/CHANGELOG.md
index ca5746b0f1..dbb8811009 100644
--- a/packages/connectors/connector-slack/CHANGELOG.md
+++ b/packages/connectors/connector-slack/CHANGELOG.md
@@ -1,5 +1,23 @@
 # @objectstack/connector-slack
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/spec@10.4.0
+  - @objectstack/core@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/connectors/connector-slack/package.json b/packages/connectors/connector-slack/package.json
index f1e0be437e..d5aa8062a2 100644
--- a/packages/connectors/connector-slack/package.json
+++ b/packages/connectors/connector-slack/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/connector-slack",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "Slack Web API connector for ObjectStack — registers `chat.postMessage` / `chat.update` / `call` actions on the automation engine's connector registry (ADR-0018 §Addendum, ADR-0022).",
   "main": "dist/index.js",
diff --git a/packages/console/CHANGELOG.md b/packages/console/CHANGELOG.md
index d89b6c18ec..2fcf317f84 100644
--- a/packages/console/CHANGELOG.md
+++ b/packages/console/CHANGELOG.md
@@ -1,5 +1,7 @@
 # @objectstack/console
 
+## 10.4.0
+
 ## 10.3.0
 
 ## 10.2.0
diff --git a/packages/console/package.json b/packages/console/package.json
index 12cc0b64b7..10ad70afa3 100644
--- a/packages/console/package.json
+++ b/packages/console/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/console",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "description": "Prebuilt Console SPA pinned to this @objectstack/framework release. Source of truth: @object-ui/console (https://github.com/objectstack-ai/objectui).",
   "license": "Apache-2.0",
   "homepage": "https://github.com/objectstack-ai/framework/tree/main/packages/console",
diff --git a/packages/core/CHANGELOG.md b/packages/core/CHANGELOG.md
index 81f505b30b..e24d2f5542 100644
--- a/packages/core/CHANGELOG.md
+++ b/packages/core/CHANGELOG.md
@@ -1,5 +1,22 @@
 # @objectstack/core
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/spec@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/core/package.json b/packages/core/package.json
index ce4232dfe3..b8121b7d83 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/core",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "Microkernel Core for ObjectStack",
   "type": "module",
diff --git a/packages/create-objectstack/CHANGELOG.md b/packages/create-objectstack/CHANGELOG.md
index ccdd063e76..f2d8e2d36b 100644
--- a/packages/create-objectstack/CHANGELOG.md
+++ b/packages/create-objectstack/CHANGELOG.md
@@ -1,5 +1,7 @@
 # create-objectstack
 
+## 10.4.0
+
 ## 10.3.0
 
 ## 10.2.0
diff --git a/packages/create-objectstack/package.json b/packages/create-objectstack/package.json
index afdbf506c0..c2b91baa79 100644
--- a/packages/create-objectstack/package.json
+++ b/packages/create-objectstack/package.json
@@ -1,6 +1,6 @@
 {
   "name": "create-objectstack",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "description": "Create a new ObjectStack project — npx create-objectstack",
   "bin": {
     "create-objectstack": "./bin/create-objectstack.js"
diff --git a/packages/dogfood/CHANGELOG.md b/packages/dogfood/CHANGELOG.md
index d5001542e5..538b86b369 100644
--- a/packages/dogfood/CHANGELOG.md
+++ b/packages/dogfood/CHANGELOG.md
@@ -1,5 +1,29 @@
 # @objectstack/dogfood
 
+## 0.0.7
+
+### Patch Changes
+
+- Updated dependencies [4d99a5c]
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [359c0aa]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/objectql@10.4.0
+  - @objectstack/spec@10.4.0
+  - @objectstack/example-showcase@0.2.5
+  - @objectstack/verify@10.4.0
+  - @objectstack/example-crm@4.0.59
+  - @objectstack/plugin-security@10.4.0
+
 ## 0.0.6
 
 ### Patch Changes
diff --git a/packages/dogfood/package.json b/packages/dogfood/package.json
index 2c44bf97cc..3204e20b55 100644
--- a/packages/dogfood/package.json
+++ b/packages/dogfood/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/dogfood",
-  "version": "0.0.6",
+  "version": "0.0.7",
   "private": true,
   "license": "Apache-2.0",
   "description": "Dogfood regression gate — hand-written golden tests that boot real example apps through @objectstack/verify's in-process HTTP stack, pinning historical runtime regressions (#2018 timezone bucketing, #1994 cross-owner RLS, #2004 field fidelity) that static checks miss.",
diff --git a/packages/downstream-contract/CHANGELOG.md b/packages/downstream-contract/CHANGELOG.md
index 91ce234529..8093e9d3b0 100644
--- a/packages/downstream-contract/CHANGELOG.md
+++ b/packages/downstream-contract/CHANGELOG.md
@@ -1,5 +1,22 @@
 # @objectstack/downstream-contract
 
+## 0.0.5
+
+### Patch Changes
+
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/spec@10.4.0
+
 ## 0.0.4
 
 ### Patch Changes
diff --git a/packages/downstream-contract/package.json b/packages/downstream-contract/package.json
index c2bb2436af..16f075a1f8 100644
--- a/packages/downstream-contract/package.json
+++ b/packages/downstream-contract/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/downstream-contract",
-  "version": "0.0.4",
+  "version": "0.0.5",
   "description": "Frozen third-party consumer fixture — a backward-compatibility gate for @objectstack/spec. Authored the way an external project on a published release authors metadata; if a spec change breaks it, that change is breaking (#2035).",
   "license": "Apache-2.0",
   "private": true,
diff --git a/packages/formula/CHANGELOG.md b/packages/formula/CHANGELOG.md
index 04bacacbe6..36f1c6229e 100644
--- a/packages/formula/CHANGELOG.md
+++ b/packages/formula/CHANGELOG.md
@@ -1,5 +1,29 @@
 # @objectstack/formula
 
+## 10.4.0
+
+### Minor Changes
+
+- ef3ed67: Formula field typing: `inferExpressionType()` + a declared `returnType`.
+
+  - `@objectstack/formula`: new `inferExpressionType()` (and lower-level `inferCelType()`) surfaces the cel-js type-checker's result for a CEL value/formula expression, mapped to `number | text | boolean | date | unknown`. Conservative — two `dyn` operands stay `unknown`; typed literals/stdlib returns pin a concrete type.
+  - `@objectstack/spec`: `FieldSchema` gains an optional `returnType` (`number|text|boolean|date`) so a formula field can carry its declared value type (the way Salesforce/Airtable do), letting consumers (dataset measures, formatting, validation) read a declared type instead of re-parsing the expression.
+
+### Patch Changes
+
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/spec@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/formula/package.json b/packages/formula/package.json
index 32b1f1b468..5e398c7de5 100644
--- a/packages/formula/package.json
+++ b/packages/formula/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/formula",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "ObjectStack canonical expression engine — CEL (cel-js) + ObjectStack stdlib + dialect registry",
   "main": "dist/index.js",
diff --git a/packages/lint/CHANGELOG.md b/packages/lint/CHANGELOG.md
index 3a64098eae..590af08ef2 100644
--- a/packages/lint/CHANGELOG.md
+++ b/packages/lint/CHANGELOG.md
@@ -1,5 +1,23 @@
 # @objectstack/lint
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/spec@10.4.0
+  - @objectstack/formula@10.4.0
+
 ## 10.3.0
 
 ### Minor Changes
diff --git a/packages/lint/package.json b/packages/lint/package.json
index b1799fb868..e0e2baff79 100644
--- a/packages/lint/package.json
+++ b/packages/lint/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/lint",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "Static, build-time validation for an ObjectStack metadata graph — dashboard widget bindings, CEL/predicate expressions, and more. Pure (stack) => Issue[] functions shared by the CLI's `os validate` and any other consumer (e.g. AI authoring). Depends on @objectstack/spec; never on a runtime.",
   "type": "module",
diff --git a/packages/mcp/CHANGELOG.md b/packages/mcp/CHANGELOG.md
index 62d9da89ec..a94b07a48a 100644
--- a/packages/mcp/CHANGELOG.md
+++ b/packages/mcp/CHANGELOG.md
@@ -1,5 +1,24 @@
 # @objectstack/plugin-mcp-server
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/spec@10.4.0
+  - @objectstack/core@10.4.0
+  - @objectstack/types@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/mcp/package.json b/packages/mcp/package.json
index 27b90a5603..9280f34c3d 100644
--- a/packages/mcp/package.json
+++ b/packages/mcp/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/mcp",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "ObjectStack as an MCP server — exposes your app's objects (and AI tools) over the Model Context Protocol (stdio + Streamable HTTP)",
   "type": "module",
diff --git a/packages/metadata-core/CHANGELOG.md b/packages/metadata-core/CHANGELOG.md
index fea399d6ad..8a0f668748 100644
--- a/packages/metadata-core/CHANGELOG.md
+++ b/packages/metadata-core/CHANGELOG.md
@@ -1,5 +1,33 @@
 # @objectstack/metadata-core
 
+## 10.4.0
+
+### Minor Changes
+
+- 4d99a5c: Package-scoped commit history & rollback for AI authoring (ADR-0067)
+
+  Each authoring apply now lands as one revertible **commit** on a package timeline, on top of `sys_metadata_history`:
+
+  - New `sys_metadata_commit` object groups a turn's metadata changes (by `event_seq` range).
+  - `publishPackageDrafts` records each publish as one commit (best-effort) with a per-artifact revert plan and an optional `message` / `aiModel`.
+  - New protocol methods `listCommits`, `revertCommit`, `rollbackToPackageCommit` (reusing `restoreVersion` + delete; a revert is itself an append-only commit).
+  - New REST routes: `GET /packages/:id/commits`, `POST /packages/:id/commits/:commitId/revert`, `POST /packages/:id/rollback`.
+
+### Patch Changes
+
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/spec@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/metadata-core/package.json b/packages/metadata-core/package.json
index b3ef2d6617..808e0e3d4c 100644
--- a/packages/metadata-core/package.json
+++ b/packages/metadata-core/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/metadata-core",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "Metadata Repository contracts: types, canonicalization, errors, interface (ADR-0008).",
   "type": "module",
diff --git a/packages/metadata-fs/CHANGELOG.md b/packages/metadata-fs/CHANGELOG.md
index d18df801cf..f76d134f96 100644
--- a/packages/metadata-fs/CHANGELOG.md
+++ b/packages/metadata-fs/CHANGELOG.md
@@ -1,5 +1,12 @@
 # @objectstack/metadata-fs
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [4d99a5c]
+  - @objectstack/metadata-core@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/metadata-fs/package.json b/packages/metadata-fs/package.json
index cc7dd1d704..2a93392a4f 100644
--- a/packages/metadata-fs/package.json
+++ b/packages/metadata-fs/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/metadata-fs",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "FileSystemRepository: Node-only Repository implementation backed by JSON files and a JSONL change log (ADR-0008).",
   "type": "module",
diff --git a/packages/metadata/CHANGELOG.md b/packages/metadata/CHANGELOG.md
index dc3e7035be..9729fd6470 100644
--- a/packages/metadata/CHANGELOG.md
+++ b/packages/metadata/CHANGELOG.md
@@ -1,5 +1,30 @@
 # @objectstack/metadata
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [4d99a5c]
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [5737261]
+- Updated dependencies [a619a3a]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/metadata-core@10.4.0
+  - @objectstack/spec@10.4.0
+  - @objectstack/platform-objects@10.4.0
+  - @objectstack/metadata-fs@10.4.0
+  - @objectstack/core@10.4.0
+  - @objectstack/types@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/metadata/package.json b/packages/metadata/package.json
index 257a261572..a6f56407ea 100644
--- a/packages/metadata/package.json
+++ b/packages/metadata/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/metadata",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "Metadata loading, saving, and persistence for ObjectStack",
   "type": "module",
diff --git a/packages/objectql/CHANGELOG.md b/packages/objectql/CHANGELOG.md
index db60346cb6..391e5e7314 100644
--- a/packages/objectql/CHANGELOG.md
+++ b/packages/objectql/CHANGELOG.md
@@ -1,5 +1,60 @@
 # @objectstack/objectql
 
+## 10.4.0
+
+### Minor Changes
+
+- 4d99a5c: Package-scoped commit history & rollback for AI authoring (ADR-0067)
+
+  Each authoring apply now lands as one revertible **commit** on a package timeline, on top of `sys_metadata_history`:
+
+  - New `sys_metadata_commit` object groups a turn's metadata changes (by `event_seq` range).
+  - `publishPackageDrafts` records each publish as one commit (best-effort) with a per-artifact revert plan and an optional `message` / `aiModel`.
+  - New protocol methods `listCommits`, `revertCommit`, `rollbackToPackageCommit` (reusing `restoreVersion` + delete; a revert is itself an append-only commit).
+  - New REST routes: `GET /packages/:id/commits`, `POST /packages/:id/commits/:commitId/revert`, `POST /packages/:id/rollback`.
+
+### Patch Changes
+
+- 359c0aa: fix(objectql,rest): single-item meta reads must revalidate (no `max-age=3600`)
+
+  `GET /api/v1/meta/object/:name` (and the other single-item meta reads served by
+  the cached path) sent `Cache-Control: public, max-age, max-age=3600`. Two bugs:
+
+  1. **Stale metadata for up to an hour.** Object metadata is invalidated by
+     publish, but a one-hour TTL let browsers (and any CDN/proxy) serve a stale
+     schema _without revalidating_ — e.g. the AI-build "New" create form kept
+     rendering pre-publish fields until the TTL lapsed. The list endpoint
+     `GET /api/v1/meta/object` is uncached, which is why list views updated but
+     single-object reads didn't. `getMetaItemCached` now returns
+     `directives: ['private', 'no-cache']` with no `maxAge`, so the ETag validator
+     (which already changes on publish) gates freshness: a cheap `304` when
+     unchanged, fresh fields the instant a publish bumps the ETag. `private` also
+     keeps per-tenant metadata out of shared caches.
+
+  2. **Malformed header.** The directives array carried a bare `max-age`
+     placeholder _and_ the REST layer appended `max-age=3600` from the `maxAge`
+     field, concatenating into `public, max-age, max-age=3600`. The header builder
+     now strips the bare `max-age` token before appending the real value, so a
+     `maxAge` is emitted once as a well-formed `max-age=N`.
+
+- Updated dependencies [4d99a5c]
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/metadata-core@10.4.0
+  - @objectstack/spec@10.4.0
+  - @objectstack/formula@10.4.0
+  - @objectstack/core@10.4.0
+  - @objectstack/types@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/objectql/package.json b/packages/objectql/package.json
index 32af8e3d44..7168d63d1e 100644
--- a/packages/objectql/package.json
+++ b/packages/objectql/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/objectql",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "Isomorphic ObjectQL Engine for ObjectStack",
   "main": "dist/index.js",
diff --git a/packages/observability/CHANGELOG.md b/packages/observability/CHANGELOG.md
index 8cc8a004ac..830cf7bfd5 100644
--- a/packages/observability/CHANGELOG.md
+++ b/packages/observability/CHANGELOG.md
@@ -1,5 +1,22 @@
 # @objectstack/observability
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/spec@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/observability/package.json b/packages/observability/package.json
index e27aadfc6b..9ad3ff06c8 100644
--- a/packages/observability/package.json
+++ b/packages/observability/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/observability",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "Observability contracts and exporters for ObjectStack — MetricsRegistry, ErrorReporter, Logger plus noop/console/OTLP-HTTP exporters. Deployment-target neutral; runtime and services depend on this so the same instrumentation works on Cloudflare Workers, Node, and self-hosted Kubernetes.",
   "type": "module",
diff --git a/packages/platform-objects/CHANGELOG.md b/packages/platform-objects/CHANGELOG.md
index 2c50263246..a7fb489320 100644
--- a/packages/platform-objects/CHANGELOG.md
+++ b/packages/platform-objects/CHANGELOG.md
@@ -1,5 +1,43 @@
 # @objectstack/platform-objects
 
+## 10.4.0
+
+### Patch Changes
+
+- 5737261: fix(setup): drop Advanced nav entries for non-listable objects (sys_verification, sys_device_code)
+
+  Dogfooding every Setup menu surfaced two Advanced entries that always render
+  "无法加载记录 / failed to load": **Verifications** (`sys_verification`) and
+  **Device Codes** (`sys_device_code`). Both objects deliberately omit `list`
+  from `apiMethods` (sensitive, ephemeral secrets — verification tokens and OAuth
+  device-grant codes are not meant to be browsed), so the generic object/list-view
+  menu can only ever 405. Removed both nav entries (and their orphaned zh labels);
+  the objects remain reachable by id. Re-adding a browse menu would require
+  enabling `list` on the object — a security decision, not a nav fix.
+
+- a619a3a: fix(setup): first-run admin polish — pin Company/Localization, gate dashboard widgets by `requiresService`, i18n + settings PUT envelope
+
+  Dogfooding the Setup app as a brand-new system administrator surfaced a cluster of small first-run gaps, now fixed:
+
+  - **platform-objects**: pin **Localization** and **Company** in the Setup sidebar's Configuration group — both are registered `service-settings` manifests (the two lowest-`order` Workspace settings) but were reachable only via the "All Settings" hub. Translate the previously-English nav labels Cloud Connection (云连接), Datasources (数据源) and Capabilities (能力). Tag the System Overview `widget_organizations` KPI with `requiresService: 'org-scoping'`.
+  - **rest**: extend the ADR-0057 D10 server-side visibility gate to **dashboard widgets** — strip widgets whose `requiresService` names an unregistered kernel service (mirrors the existing app-nav gate; `resolveRegisteredServices` now also discovers gates declared on widgets). In a single-tenant runtime this removes the orphan "Organizations" KPI, matching the already-hidden org nav entries.
+  - **service-settings**: add the missing zh `help` strings for the Localization manifest (number/currency/first-day-of-week/fiscal-year fields), and accept the `{ values: { … } }` envelope on `PUT /api/settings/:ns` symmetrically with what `GET` returns.
+
+- Updated dependencies [4d99a5c]
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/metadata-core@10.4.0
+  - @objectstack/spec@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/platform-objects/package.json b/packages/platform-objects/package.json
index d45a90f1c3..6b57ffdba1 100644
--- a/packages/platform-objects/package.json
+++ b/packages/platform-objects/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/platform-objects",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "Core platform object schemas for ObjectStack — identity, security, audit, tenant, and metadata objects",
   "main": "dist/index.js",
diff --git a/packages/plugins/driver-memory/CHANGELOG.md b/packages/plugins/driver-memory/CHANGELOG.md
index 1c8580bd5c..2fa137b537 100644
--- a/packages/plugins/driver-memory/CHANGELOG.md
+++ b/packages/plugins/driver-memory/CHANGELOG.md
@@ -1,5 +1,23 @@
 # @objectstack/driver-memory
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/spec@10.4.0
+  - @objectstack/core@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/plugins/driver-memory/package.json b/packages/plugins/driver-memory/package.json
index ba6ba2dce1..c46852a72c 100644
--- a/packages/plugins/driver-memory/package.json
+++ b/packages/plugins/driver-memory/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/driver-memory",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "In-Memory Driver for ObjectStack (Reference Implementation)",
   "main": "dist/index.js",
diff --git a/packages/plugins/driver-mongodb/CHANGELOG.md b/packages/plugins/driver-mongodb/CHANGELOG.md
index a82207945f..efea467505 100644
--- a/packages/plugins/driver-mongodb/CHANGELOG.md
+++ b/packages/plugins/driver-mongodb/CHANGELOG.md
@@ -1,5 +1,23 @@
 # @objectstack/driver-mongodb
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/spec@10.4.0
+  - @objectstack/core@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/plugins/driver-mongodb/package.json b/packages/plugins/driver-mongodb/package.json
index 4c8343355a..887d9dc38a 100644
--- a/packages/plugins/driver-mongodb/package.json
+++ b/packages/plugins/driver-mongodb/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/driver-mongodb",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "MongoDB Driver for ObjectStack - Native document database driver via official mongodb client",
   "main": "dist/index.js",
diff --git a/packages/plugins/driver-sql/CHANGELOG.md b/packages/plugins/driver-sql/CHANGELOG.md
index 23c8886a4a..976c0a8db5 100644
--- a/packages/plugins/driver-sql/CHANGELOG.md
+++ b/packages/plugins/driver-sql/CHANGELOG.md
@@ -1,5 +1,23 @@
 # @objectstack/driver-sql
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/spec@10.4.0
+  - @objectstack/core@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/plugins/driver-sql/package.json b/packages/plugins/driver-sql/package.json
index 0231250f95..bf2af846ce 100644
--- a/packages/plugins/driver-sql/package.json
+++ b/packages/plugins/driver-sql/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/driver-sql",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "SQL Driver for ObjectStack - Supports PostgreSQL, MySQL, SQLite via Knex",
   "main": "dist/index.js",
diff --git a/packages/plugins/driver-sqlite-wasm/CHANGELOG.md b/packages/plugins/driver-sqlite-wasm/CHANGELOG.md
index f390ddb94c..560b8cac56 100644
--- a/packages/plugins/driver-sqlite-wasm/CHANGELOG.md
+++ b/packages/plugins/driver-sqlite-wasm/CHANGELOG.md
@@ -1,5 +1,24 @@
 # @objectstack/driver-sqlite-wasm
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/spec@10.4.0
+  - @objectstack/core@10.4.0
+  - @objectstack/driver-sql@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/plugins/driver-sqlite-wasm/package.json b/packages/plugins/driver-sqlite-wasm/package.json
index bc9d1760d1..03964a7217 100644
--- a/packages/plugins/driver-sqlite-wasm/package.json
+++ b/packages/plugins/driver-sqlite-wasm/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/driver-sqlite-wasm",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "WASM SQLite Driver for ObjectStack — runs in browser/WebContainer (StackBlitz) without native bindings",
   "keywords": [
diff --git a/packages/plugins/embedder-openai/CHANGELOG.md b/packages/plugins/embedder-openai/CHANGELOG.md
index 58e23529c3..2099ea19e6 100644
--- a/packages/plugins/embedder-openai/CHANGELOG.md
+++ b/packages/plugins/embedder-openai/CHANGELOG.md
@@ -1,5 +1,22 @@
 # @objectstack/embedder-openai
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/spec@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/plugins/embedder-openai/package.json b/packages/plugins/embedder-openai/package.json
index 1788b970fe..5375deddef 100644
--- a/packages/plugins/embedder-openai/package.json
+++ b/packages/plugins/embedder-openai/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/embedder-openai",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "OpenAI-compatible embedder for ObjectStack — works against OpenAI, 阿里通义 DashScope, 智谱 BigModel, 硅基流动 SiliconFlow, 火山引擎 Doubao, MiniMax, Ollama, and any drop-in OpenAI-shape endpoint.",
   "main": "dist/index.js",
diff --git a/packages/plugins/knowledge-memory/CHANGELOG.md b/packages/plugins/knowledge-memory/CHANGELOG.md
index 228f7635f5..251cd910f9 100644
--- a/packages/plugins/knowledge-memory/CHANGELOG.md
+++ b/packages/plugins/knowledge-memory/CHANGELOG.md
@@ -1,5 +1,24 @@
 # @objectstack/knowledge-memory
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/spec@10.4.0
+  - @objectstack/core@10.4.0
+  - @objectstack/service-knowledge@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/plugins/knowledge-memory/package.json b/packages/plugins/knowledge-memory/package.json
index 419ecf80b2..f1d42dd68e 100644
--- a/packages/plugins/knowledge-memory/package.json
+++ b/packages/plugins/knowledge-memory/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/knowledge-memory",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "In-memory knowledge adapter for ObjectStack (dev / test reference implementation).",
   "main": "dist/index.js",
diff --git a/packages/plugins/knowledge-ragflow/CHANGELOG.md b/packages/plugins/knowledge-ragflow/CHANGELOG.md
index ca5d58522d..2c1ca135dc 100644
--- a/packages/plugins/knowledge-ragflow/CHANGELOG.md
+++ b/packages/plugins/knowledge-ragflow/CHANGELOG.md
@@ -1,5 +1,24 @@
 # @objectstack/knowledge-ragflow
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/spec@10.4.0
+  - @objectstack/core@10.4.0
+  - @objectstack/service-knowledge@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/plugins/knowledge-ragflow/package.json b/packages/plugins/knowledge-ragflow/package.json
index 5b89f3c8e5..d4c59bd34e 100644
--- a/packages/plugins/knowledge-ragflow/package.json
+++ b/packages/plugins/knowledge-ragflow/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/knowledge-ragflow",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "RAGFlow knowledge adapter for ObjectStack — production-grade RAG via the Apache 2.0 RAGFlow REST API.",
   "main": "dist/index.js",
diff --git a/packages/plugins/plugin-approvals/CHANGELOG.md b/packages/plugins/plugin-approvals/CHANGELOG.md
index 4591ba505b..4c33fba0dd 100644
--- a/packages/plugins/plugin-approvals/CHANGELOG.md
+++ b/packages/plugins/plugin-approvals/CHANGELOG.md
@@ -1,5 +1,29 @@
 # @objectstack/plugin-approvals
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [4d99a5c]
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [5737261]
+- Updated dependencies [a619a3a]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/metadata-core@10.4.0
+  - @objectstack/spec@10.4.0
+  - @objectstack/formula@10.4.0
+  - @objectstack/platform-objects@10.4.0
+  - @objectstack/core@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/plugins/plugin-approvals/package.json b/packages/plugins/plugin-approvals/package.json
index c7d84beb86..bf8ab3771e 100644
--- a/packages/plugins/plugin-approvals/package.json
+++ b/packages/plugins/plugin-approvals/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/plugin-approvals",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "Multi-step approval engine for ObjectStack — sys_approval_process + sys_approval_request + sys_approval_action + IApprovalService.",
   "main": "dist/index.js",
diff --git a/packages/plugins/plugin-audit/CHANGELOG.md b/packages/plugins/plugin-audit/CHANGELOG.md
index f0443a7bdb..96691bda65 100644
--- a/packages/plugins/plugin-audit/CHANGELOG.md
+++ b/packages/plugins/plugin-audit/CHANGELOG.md
@@ -1,5 +1,26 @@
 # @objectstack/plugin-audit
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [5737261]
+- Updated dependencies [a619a3a]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/spec@10.4.0
+  - @objectstack/platform-objects@10.4.0
+  - @objectstack/core@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/plugins/plugin-audit/package.json b/packages/plugins/plugin-audit/package.json
index b5619d54fe..4525b60b54 100644
--- a/packages/plugins/plugin-audit/package.json
+++ b/packages/plugins/plugin-audit/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/plugin-audit",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "Audit Plugin for ObjectStack — System audit log object and audit trail",
   "main": "dist/index.js",
diff --git a/packages/plugins/plugin-auth/CHANGELOG.md b/packages/plugins/plugin-auth/CHANGELOG.md
index 6b0f138538..4d125c7291 100644
--- a/packages/plugins/plugin-auth/CHANGELOG.md
+++ b/packages/plugins/plugin-auth/CHANGELOG.md
@@ -1,5 +1,27 @@
 # Changelog
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [5737261]
+- Updated dependencies [a619a3a]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/spec@10.4.0
+  - @objectstack/platform-objects@10.4.0
+  - @objectstack/core@10.4.0
+  - @objectstack/types@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/plugins/plugin-auth/package.json b/packages/plugins/plugin-auth/package.json
index 9df7e2bc84..1627efed92 100644
--- a/packages/plugins/plugin-auth/package.json
+++ b/packages/plugins/plugin-auth/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/plugin-auth",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "Authentication & Identity Plugin for ObjectStack",
   "main": "dist/index.js",
diff --git a/packages/plugins/plugin-dev/CHANGELOG.md b/packages/plugins/plugin-dev/CHANGELOG.md
index e358146bd3..41ff0466ce 100644
--- a/packages/plugins/plugin-dev/CHANGELOG.md
+++ b/packages/plugins/plugin-dev/CHANGELOG.md
@@ -1,5 +1,39 @@
 # @objectstack/plugin-dev
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [4d99a5c]
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [359c0aa]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [a619a3a]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/objectql@10.4.0
+  - @objectstack/runtime@10.4.0
+  - @objectstack/spec@10.4.0
+  - @objectstack/rest@10.4.0
+  - @objectstack/account@10.4.0
+  - @objectstack/setup@10.4.0
+  - @objectstack/studio@10.4.0
+  - @objectstack/core@10.4.0
+  - @objectstack/driver-memory@10.4.0
+  - @objectstack/plugin-auth@10.4.0
+  - @objectstack/plugin-hono-server@10.4.0
+  - @objectstack/plugin-org-scoping@10.4.0
+  - @objectstack/plugin-security@10.4.0
+  - @objectstack/service-i18n@10.4.0
+  - @objectstack/types@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/plugins/plugin-dev/package.json b/packages/plugins/plugin-dev/package.json
index 493dfbcfba..19b3d90bb9 100644
--- a/packages/plugins/plugin-dev/package.json
+++ b/packages/plugins/plugin-dev/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/plugin-dev",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "Development Mode Plugin for ObjectStack — auto-enables all services with in-memory implementations",
   "main": "dist/index.js",
diff --git a/packages/plugins/plugin-email/CHANGELOG.md b/packages/plugins/plugin-email/CHANGELOG.md
index d7eafb85a3..eca71cbe0d 100644
--- a/packages/plugins/plugin-email/CHANGELOG.md
+++ b/packages/plugins/plugin-email/CHANGELOG.md
@@ -1,5 +1,27 @@
 # @objectstack/plugin-email
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [5737261]
+- Updated dependencies [a619a3a]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/spec@10.4.0
+  - @objectstack/formula@10.4.0
+  - @objectstack/platform-objects@10.4.0
+  - @objectstack/core@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/plugins/plugin-email/package.json b/packages/plugins/plugin-email/package.json
index 828172a59f..127e01e887 100644
--- a/packages/plugins/plugin-email/package.json
+++ b/packages/plugins/plugin-email/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/plugin-email",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "Email service plugin for ObjectStack — IEmailService + transport-pluggable outbound delivery with sys_email persistence.",
   "main": "dist/index.js",
diff --git a/packages/plugins/plugin-hono-server/CHANGELOG.md b/packages/plugins/plugin-hono-server/CHANGELOG.md
index e4cc197ae5..75c5869565 100644
--- a/packages/plugins/plugin-hono-server/CHANGELOG.md
+++ b/packages/plugins/plugin-hono-server/CHANGELOG.md
@@ -1,5 +1,24 @@
 # @objectstack/plugin-hono-server
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/spec@10.4.0
+  - @objectstack/core@10.4.0
+  - @objectstack/types@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/plugins/plugin-hono-server/package.json b/packages/plugins/plugin-hono-server/package.json
index e5d207de29..20692a4aff 100644
--- a/packages/plugins/plugin-hono-server/package.json
+++ b/packages/plugins/plugin-hono-server/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/plugin-hono-server",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "Standard Hono Server Adapter for ObjectStack Runtime",
   "main": "dist/index.js",
diff --git a/packages/plugins/plugin-msw/CHANGELOG.md b/packages/plugins/plugin-msw/CHANGELOG.md
index 9a0a2ad2c3..a39ea36fa5 100644
--- a/packages/plugins/plugin-msw/CHANGELOG.md
+++ b/packages/plugins/plugin-msw/CHANGELOG.md
@@ -1,5 +1,28 @@
 # @objectstack/plugin-msw
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [4d99a5c]
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [359c0aa]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/objectql@10.4.0
+  - @objectstack/runtime@10.4.0
+  - @objectstack/spec@10.4.0
+  - @objectstack/core@10.4.0
+  - @objectstack/types@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/plugins/plugin-msw/package.json b/packages/plugins/plugin-msw/package.json
index 83a6c47422..b84581994c 100644
--- a/packages/plugins/plugin-msw/package.json
+++ b/packages/plugins/plugin-msw/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/plugin-msw",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "description": "MSW (Mock Service Worker) Plugin for ObjectStack Runtime",
   "license": "Apache-2.0",
   "main": "dist/index.js",
diff --git a/packages/plugins/plugin-org-scoping/CHANGELOG.md b/packages/plugins/plugin-org-scoping/CHANGELOG.md
index 66c622c4c5..e5f12436b3 100644
--- a/packages/plugins/plugin-org-scoping/CHANGELOG.md
+++ b/packages/plugins/plugin-org-scoping/CHANGELOG.md
@@ -1,5 +1,26 @@
 # @objectstack/plugin-org-scoping
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [5737261]
+- Updated dependencies [a619a3a]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/spec@10.4.0
+  - @objectstack/platform-objects@10.4.0
+  - @objectstack/core@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/plugins/plugin-org-scoping/package.json b/packages/plugins/plugin-org-scoping/package.json
index 19d1a1f0ec..513cec49ae 100644
--- a/packages/plugins/plugin-org-scoping/package.json
+++ b/packages/plugins/plugin-org-scoping/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/plugin-org-scoping",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "Organization-Scoping Plugin for ObjectStack — row-level Organization isolation, per-org seed replay, default-org bootstrap",
   "main": "dist/index.js",
diff --git a/packages/plugins/plugin-reports/CHANGELOG.md b/packages/plugins/plugin-reports/CHANGELOG.md
index c0dc609012..ba8c774907 100644
--- a/packages/plugins/plugin-reports/CHANGELOG.md
+++ b/packages/plugins/plugin-reports/CHANGELOG.md
@@ -1,5 +1,26 @@
 # @objectstack/plugin-reports
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [5737261]
+- Updated dependencies [a619a3a]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/spec@10.4.0
+  - @objectstack/platform-objects@10.4.0
+  - @objectstack/core@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/plugins/plugin-reports/package.json b/packages/plugins/plugin-reports/package.json
index 5829729a64..d836dcb3e6 100644
--- a/packages/plugins/plugin-reports/package.json
+++ b/packages/plugins/plugin-reports/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/plugin-reports",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "Saved reports + scheduled email digests for ObjectStack — sys_saved_report + sys_report_schedule + IReportService.",
   "main": "dist/index.js",
diff --git a/packages/plugins/plugin-security/CHANGELOG.md b/packages/plugins/plugin-security/CHANGELOG.md
index 4693d4e4bd..7d88f652cc 100644
--- a/packages/plugins/plugin-security/CHANGELOG.md
+++ b/packages/plugins/plugin-security/CHANGELOG.md
@@ -1,5 +1,27 @@
 # @objectstack/plugin-security
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [5737261]
+- Updated dependencies [a619a3a]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/spec@10.4.0
+  - @objectstack/formula@10.4.0
+  - @objectstack/platform-objects@10.4.0
+  - @objectstack/core@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/plugins/plugin-security/package.json b/packages/plugins/plugin-security/package.json
index 3706cf4a2a..6525af0082 100644
--- a/packages/plugins/plugin-security/package.json
+++ b/packages/plugins/plugin-security/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/plugin-security",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "Security Plugin for ObjectStack — RBAC, RLS, and Field-Level Security Runtime",
   "main": "dist/index.js",
diff --git a/packages/plugins/plugin-sharing/CHANGELOG.md b/packages/plugins/plugin-sharing/CHANGELOG.md
index e3ef76a105..24a3c46ba9 100644
--- a/packages/plugins/plugin-sharing/CHANGELOG.md
+++ b/packages/plugins/plugin-sharing/CHANGELOG.md
@@ -1,5 +1,30 @@
 # @objectstack/plugin-sharing
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [4d99a5c]
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [359c0aa]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [5737261]
+- Updated dependencies [a619a3a]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/objectql@10.4.0
+  - @objectstack/spec@10.4.0
+  - @objectstack/formula@10.4.0
+  - @objectstack/platform-objects@10.4.0
+  - @objectstack/core@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/plugins/plugin-sharing/package.json b/packages/plugins/plugin-sharing/package.json
index 09aad764fe..2afbe51602 100644
--- a/packages/plugins/plugin-sharing/package.json
+++ b/packages/plugins/plugin-sharing/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/plugin-sharing",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "Record-level sharing for ObjectStack — sys_record_share + middleware that enforces sharingModel + ISharingService.",
   "main": "dist/index.js",
diff --git a/packages/plugins/plugin-webhooks/CHANGELOG.md b/packages/plugins/plugin-webhooks/CHANGELOG.md
index 3d25917899..6af9c02c91 100644
--- a/packages/plugins/plugin-webhooks/CHANGELOG.md
+++ b/packages/plugins/plugin-webhooks/CHANGELOG.md
@@ -1,5 +1,24 @@
 # @objectstack/plugin-webhooks
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/spec@10.4.0
+  - @objectstack/core@10.4.0
+  - @objectstack/service-messaging@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/plugins/plugin-webhooks/package.json b/packages/plugins/plugin-webhooks/package.json
index af3a64f4de..65735a6462 100644
--- a/packages/plugins/plugin-webhooks/package.json
+++ b/packages/plugins/plugin-webhooks/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/plugin-webhooks",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "Persistent, cluster-aware webhook dispatcher. Durable outbox + per-partition cluster.lock for exactly-once-ish delivery across nodes. See content/docs/concepts/webhook-delivery.mdx.",
   "type": "module",
diff --git a/packages/rest/CHANGELOG.md b/packages/rest/CHANGELOG.md
index 45684c9907..e21c4782ee 100644
--- a/packages/rest/CHANGELOG.md
+++ b/packages/rest/CHANGELOG.md
@@ -1,5 +1,54 @@
 # @objectstack/rest
 
+## 10.4.0
+
+### Patch Changes
+
+- 359c0aa: fix(objectql,rest): single-item meta reads must revalidate (no `max-age=3600`)
+
+  `GET /api/v1/meta/object/:name` (and the other single-item meta reads served by
+  the cached path) sent `Cache-Control: public, max-age, max-age=3600`. Two bugs:
+
+  1. **Stale metadata for up to an hour.** Object metadata is invalidated by
+     publish, but a one-hour TTL let browsers (and any CDN/proxy) serve a stale
+     schema _without revalidating_ — e.g. the AI-build "New" create form kept
+     rendering pre-publish fields until the TTL lapsed. The list endpoint
+     `GET /api/v1/meta/object` is uncached, which is why list views updated but
+     single-object reads didn't. `getMetaItemCached` now returns
+     `directives: ['private', 'no-cache']` with no `maxAge`, so the ETag validator
+     (which already changes on publish) gates freshness: a cheap `304` when
+     unchanged, fresh fields the instant a publish bumps the ETag. `private` also
+     keeps per-tenant metadata out of shared caches.
+
+  2. **Malformed header.** The directives array carried a bare `max-age`
+     placeholder _and_ the REST layer appended `max-age=3600` from the `maxAge`
+     field, concatenating into `public, max-age, max-age=3600`. The header builder
+     now strips the bare `max-age` token before appending the real value, so a
+     `maxAge` is emitted once as a well-formed `max-age=N`.
+
+- a619a3a: fix(setup): first-run admin polish — pin Company/Localization, gate dashboard widgets by `requiresService`, i18n + settings PUT envelope
+
+  Dogfooding the Setup app as a brand-new system administrator surfaced a cluster of small first-run gaps, now fixed:
+
+  - **platform-objects**: pin **Localization** and **Company** in the Setup sidebar's Configuration group — both are registered `service-settings` manifests (the two lowest-`order` Workspace settings) but were reachable only via the "All Settings" hub. Translate the previously-English nav labels Cloud Connection (云连接), Datasources (数据源) and Capabilities (能力). Tag the System Overview `widget_organizations` KPI with `requiresService: 'org-scoping'`.
+  - **rest**: extend the ADR-0057 D10 server-side visibility gate to **dashboard widgets** — strip widgets whose `requiresService` names an unregistered kernel service (mirrors the existing app-nav gate; `resolveRegisteredServices` now also discovers gates declared on widgets). In a single-tenant runtime this removes the orphan "Organizations" KPI, matching the already-hidden org nav entries.
+  - **service-settings**: add the missing zh `help` strings for the Localization manifest (number/currency/first-day-of-week/fiscal-year fields), and accept the `{ values: { … } }` envelope on `PUT /api/settings/:ns` symmetrically with what `GET` returns.
+
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/spec@10.4.0
+  - @objectstack/core@10.4.0
+  - @objectstack/service-package@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/rest/package.json b/packages/rest/package.json
index 70d620f35a..e62b6ce432 100644
--- a/packages/rest/package.json
+++ b/packages/rest/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/rest",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "ObjectStack REST API Server - automatic REST endpoint generation from protocol",
   "type": "module",
diff --git a/packages/runtime/CHANGELOG.md b/packages/runtime/CHANGELOG.md
index 7dcb254f47..f9644818a9 100644
--- a/packages/runtime/CHANGELOG.md
+++ b/packages/runtime/CHANGELOG.md
@@ -1,5 +1,52 @@
 # @objectstack/runtime
 
+## 10.4.0
+
+### Minor Changes
+
+- 4d99a5c: Package-scoped commit history & rollback for AI authoring (ADR-0067)
+
+  Each authoring apply now lands as one revertible **commit** on a package timeline, on top of `sys_metadata_history`:
+
+  - New `sys_metadata_commit` object groups a turn's metadata changes (by `event_seq` range).
+  - `publishPackageDrafts` records each publish as one commit (best-effort) with a per-artifact revert plan and an optional `message` / `aiModel`.
+  - New protocol methods `listCommits`, `revertCommit`, `rollbackToPackageCommit` (reusing `restoreVersion` + delete; a revert is itself an append-only commit).
+  - New REST routes: `GET /packages/:id/commits`, `POST /packages/:id/commits/:commitId/revert`, `POST /packages/:id/rollback`.
+
+### Patch Changes
+
+- Updated dependencies [4d99a5c]
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [359c0aa]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [a619a3a]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/objectql@10.4.0
+  - @objectstack/spec@10.4.0
+  - @objectstack/formula@10.4.0
+  - @objectstack/rest@10.4.0
+  - @objectstack/metadata@10.4.0
+  - @objectstack/core@10.4.0
+  - @objectstack/observability@10.4.0
+  - @objectstack/driver-memory@10.4.0
+  - @objectstack/driver-sql@10.4.0
+  - @objectstack/driver-sqlite-wasm@10.4.0
+  - @objectstack/plugin-auth@10.4.0
+  - @objectstack/plugin-org-scoping@10.4.0
+  - @objectstack/plugin-security@10.4.0
+  - @objectstack/service-cluster@10.4.0
+  - @objectstack/service-datasource@10.4.0
+  - @objectstack/service-i18n@10.4.0
+  - @objectstack/types@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/runtime/package.json b/packages/runtime/package.json
index 14de9dd1bf..c72beecb2b 100644
--- a/packages/runtime/package.json
+++ b/packages/runtime/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/runtime",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "ObjectStack Core Runtime & Query Engine",
   "type": "module",
diff --git a/packages/services/service-ai/CHANGELOG.md b/packages/services/service-ai/CHANGELOG.md
index ae5e4b568e..25d7f8cd39 100644
--- a/packages/services/service-ai/CHANGELOG.md
+++ b/packages/services/service-ai/CHANGELOG.md
@@ -1,5 +1,25 @@
 # @objectstack/service-ai
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/spec@10.4.0
+  - @objectstack/formula@10.4.0
+  - @objectstack/core@10.4.0
+  - @objectstack/types@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/services/service-ai/package.json b/packages/services/service-ai/package.json
index 53bd6261e0..60a8ddbd21 100644
--- a/packages/services/service-ai/package.json
+++ b/packages/services/service-ai/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/service-ai",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "AI Service for ObjectStack — implements IAIService with LLM adapter layer, conversation management, tool registry, and REST/SSE routes",
   "type": "module",
diff --git a/packages/services/service-analytics/CHANGELOG.md b/packages/services/service-analytics/CHANGELOG.md
index 1c6d9e3620..8a86323ed2 100644
--- a/packages/services/service-analytics/CHANGELOG.md
+++ b/packages/services/service-analytics/CHANGELOG.md
@@ -1,5 +1,33 @@
 # Changelog — @objectstack/service-analytics
 
+## 10.4.0
+
+### Patch Changes
+
+- 715d667: fix(analytics): qualify base-object columns in joined dataset queries
+
+  A dataset that joins a related object (`include` + a `relationship.field`
+  dimension/measure) emitted BARE base-table columns in SELECT/GROUP BY while the
+  joined columns were alias-qualified. When the base and joined tables share a
+  column name (e.g. both have `status`), the query failed at runtime with
+  "ambiguous column name". `NativeSQLStrategy` now qualifies plain base-column
+  identifiers with the base table when the cube has joins; single-object cubes
+  are unchanged (byte-for-byte identical SQL).
+
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/spec@10.4.0
+  - @objectstack/core@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/services/service-analytics/package.json b/packages/services/service-analytics/package.json
index 85aada6933..996a3aab36 100644
--- a/packages/services/service-analytics/package.json
+++ b/packages/services/service-analytics/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/service-analytics",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "Analytics Service for ObjectStack — implements IAnalyticsService with multi-driver strategy pattern (NativeSQL, ObjectQL, InMemory)",
   "type": "module",
diff --git a/packages/services/service-automation/CHANGELOG.md b/packages/services/service-automation/CHANGELOG.md
index d0d533eb6c..3c2f62eea0 100644
--- a/packages/services/service-automation/CHANGELOG.md
+++ b/packages/services/service-automation/CHANGELOG.md
@@ -1,5 +1,44 @@
 # @objectstack/service-automation
 
+## 10.4.0
+
+### Patch Changes
+
+- b6a4972: fix(automation): honor the `assignments` wrapper shape on assignment nodes
+
+  The built-in `assignment` node executor set each TOP-LEVEL `config` key as a flow
+  variable. But the surfaces that author these nodes all emit an `assignments`
+  wrapper instead:
+
+  - Studio's visual Assignment editor → `config: { assignments: { <var>: <value> } }`
+  - bundled example flows (app-crm, showcase) → `config: { assignments: [{ variable, value }] }`
+
+  So a node designed in Studio (or any of the shipped examples) silently set a
+  single variable literally named `assignments` to the whole map/array and never
+  set the intended variables — it passed build and no-oped at run time, leaving
+  every downstream reference unresolved.
+
+  The executor now normalizes all three shapes (`assignments` map, `assignments`
+  array of `{ variable | name | key, value }`, and the legacy flat
+  `{ <var>: <value> }`) and interpolates `{var}` templates in the values, matching
+  the CRUD / screen nodes. Adds `logic-nodes.test.ts` covering each shape as a
+  regression guard.
+
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/spec@10.4.0
+  - @objectstack/formula@10.4.0
+  - @objectstack/core@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/services/service-automation/package.json b/packages/services/service-automation/package.json
index c7a83605ac..38b4fb4b75 100644
--- a/packages/services/service-automation/package.json
+++ b/packages/services/service-automation/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/service-automation",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "Automation Service for ObjectStack — implements IAutomationService with plugin-based DAG flow execution engine",
   "type": "module",
diff --git a/packages/services/service-cache/CHANGELOG.md b/packages/services/service-cache/CHANGELOG.md
index 912d7a94de..e96f96a38a 100644
--- a/packages/services/service-cache/CHANGELOG.md
+++ b/packages/services/service-cache/CHANGELOG.md
@@ -1,5 +1,24 @@
 # @objectstack/service-cache
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/spec@10.4.0
+  - @objectstack/core@10.4.0
+  - @objectstack/observability@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/services/service-cache/package.json b/packages/services/service-cache/package.json
index 5d93985d15..20ee66e87e 100644
--- a/packages/services/service-cache/package.json
+++ b/packages/services/service-cache/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/service-cache",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "Cache Service for ObjectStack — implements ICacheService with in-memory and Redis adapters",
   "type": "module",
diff --git a/packages/services/service-cluster-redis/CHANGELOG.md b/packages/services/service-cluster-redis/CHANGELOG.md
index aa8844d826..20df09383a 100644
--- a/packages/services/service-cluster-redis/CHANGELOG.md
+++ b/packages/services/service-cluster-redis/CHANGELOG.md
@@ -1,5 +1,23 @@
 # @objectstack/service-cluster-redis
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/spec@10.4.0
+  - @objectstack/service-cluster@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/services/service-cluster-redis/package.json b/packages/services/service-cluster-redis/package.json
index 543b7fbf98..d9da2a2b7d 100644
--- a/packages/services/service-cluster-redis/package.json
+++ b/packages/services/service-cluster-redis/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/service-cluster-redis",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "Redis cluster driver for ObjectStack — implements IPubSub/ILock/IKV/ICounter against Redis using ioredis.",
   "type": "module",
diff --git a/packages/services/service-cluster/CHANGELOG.md b/packages/services/service-cluster/CHANGELOG.md
index d3377ba177..c4276a253a 100644
--- a/packages/services/service-cluster/CHANGELOG.md
+++ b/packages/services/service-cluster/CHANGELOG.md
@@ -1,5 +1,23 @@
 # @objectstack/service-cluster
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/spec@10.4.0
+  - @objectstack/core@10.4.0
+
 ## 10.3.0
 
 ### Minor Changes
diff --git a/packages/services/service-cluster/package.json b/packages/services/service-cluster/package.json
index 8fed5b8dca..baec334269 100644
--- a/packages/services/service-cluster/package.json
+++ b/packages/services/service-cluster/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/service-cluster",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "Cluster Service for ObjectStack — pluggable PubSub/Lock/KV/Counter primitives. Memory driver included; postgres/redis drivers ship separately.",
   "type": "module",
diff --git a/packages/services/service-datasource/CHANGELOG.md b/packages/services/service-datasource/CHANGELOG.md
index 2267065ed9..f3fba59bb4 100644
--- a/packages/services/service-datasource/CHANGELOG.md
+++ b/packages/services/service-datasource/CHANGELOG.md
@@ -1,5 +1,23 @@
 # @objectstack/service-external-datasource
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/spec@10.4.0
+  - @objectstack/core@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/services/service-datasource/package.json b/packages/services/service-datasource/package.json
index 573a350412..ed6ded88d2 100644
--- a/packages/services/service-datasource/package.json
+++ b/packages/services/service-datasource/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/service-datasource",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "The datasource service (ADR-0015): external-table federation (introspect/draft/import/validate) + runtime UI datasource lifecycle (list/test/create/update/remove + REST routes). Open-source mechanism; the tier line falls on which ICryptoProvider / driver factory a host injects.",
   "type": "module",
diff --git a/packages/services/service-i18n/CHANGELOG.md b/packages/services/service-i18n/CHANGELOG.md
index 5d0a752022..6eba84733f 100644
--- a/packages/services/service-i18n/CHANGELOG.md
+++ b/packages/services/service-i18n/CHANGELOG.md
@@ -1,5 +1,23 @@
 # @objectstack/service-i18n
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/spec@10.4.0
+  - @objectstack/core@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/services/service-i18n/package.json b/packages/services/service-i18n/package.json
index 85c7841284..8542318b4a 100644
--- a/packages/services/service-i18n/package.json
+++ b/packages/services/service-i18n/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/service-i18n",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "I18n Service for ObjectStack — implements II18nService with file-based locale loading",
   "type": "module",
diff --git a/packages/services/service-job/CHANGELOG.md b/packages/services/service-job/CHANGELOG.md
index a65f64d904..1de5ad89df 100644
--- a/packages/services/service-job/CHANGELOG.md
+++ b/packages/services/service-job/CHANGELOG.md
@@ -1,5 +1,26 @@
 # @objectstack/service-job
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [5737261]
+- Updated dependencies [a619a3a]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/spec@10.4.0
+  - @objectstack/platform-objects@10.4.0
+  - @objectstack/core@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/services/service-job/package.json b/packages/services/service-job/package.json
index c53d867092..6339d1a270 100644
--- a/packages/services/service-job/package.json
+++ b/packages/services/service-job/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/service-job",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "Job Service for ObjectStack — implements IJobService with setInterval and cron scheduling",
   "type": "module",
diff --git a/packages/services/service-knowledge/CHANGELOG.md b/packages/services/service-knowledge/CHANGELOG.md
index 1eaeeebdeb..d6cdfe5811 100644
--- a/packages/services/service-knowledge/CHANGELOG.md
+++ b/packages/services/service-knowledge/CHANGELOG.md
@@ -1,5 +1,23 @@
 # @objectstack/service-knowledge
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/spec@10.4.0
+  - @objectstack/core@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/services/service-knowledge/package.json b/packages/services/service-knowledge/package.json
index c6994aa3ff..67a9dcfbed 100644
--- a/packages/services/service-knowledge/package.json
+++ b/packages/services/service-knowledge/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/service-knowledge",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "Knowledge Service for ObjectStack — orchestrator implementing IKnowledgeService over pluggable IKnowledgeAdapter backends (RAGFlow, LlamaIndex, Dify, in-memory).",
   "type": "module",
diff --git a/packages/services/service-messaging/CHANGELOG.md b/packages/services/service-messaging/CHANGELOG.md
index 66e80fd5bb..35cf354417 100644
--- a/packages/services/service-messaging/CHANGELOG.md
+++ b/packages/services/service-messaging/CHANGELOG.md
@@ -1,5 +1,23 @@
 # @objectstack/service-messaging
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/spec@10.4.0
+  - @objectstack/core@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/services/service-messaging/package.json b/packages/services/service-messaging/package.json
index 093a24b18e..bd56902843 100644
--- a/packages/services/service-messaging/package.json
+++ b/packages/services/service-messaging/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/service-messaging",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "Messaging Service for ObjectStack — outbound notification dispatch (ADR-0012). Ships the MessagingChannel registry, emit() fan-out, and the always-on inbox channel; other channels (email/webhook/push/IM) plug in.",
   "type": "module",
diff --git a/packages/services/service-package/CHANGELOG.md b/packages/services/service-package/CHANGELOG.md
index c1a3538286..90e49b0593 100644
--- a/packages/services/service-package/CHANGELOG.md
+++ b/packages/services/service-package/CHANGELOG.md
@@ -1,5 +1,23 @@
 # @objectstack/service-package
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/spec@10.4.0
+  - @objectstack/core@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/services/service-package/package.json b/packages/services/service-package/package.json
index 8ec9b19cd3..ab6d58b1b6 100644
--- a/packages/services/service-package/package.json
+++ b/packages/services/service-package/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/service-package",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "Package management service for ObjectStack — publish, install, and manage packages",
   "type": "module",
diff --git a/packages/services/service-queue/CHANGELOG.md b/packages/services/service-queue/CHANGELOG.md
index 0d0dfcf9fb..caa9ced16d 100644
--- a/packages/services/service-queue/CHANGELOG.md
+++ b/packages/services/service-queue/CHANGELOG.md
@@ -1,5 +1,26 @@
 # @objectstack/service-queue
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [5737261]
+- Updated dependencies [a619a3a]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/spec@10.4.0
+  - @objectstack/platform-objects@10.4.0
+  - @objectstack/core@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/services/service-queue/package.json b/packages/services/service-queue/package.json
index d1eb42adfe..f0c282c493 100644
--- a/packages/services/service-queue/package.json
+++ b/packages/services/service-queue/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/service-queue",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "Queue Service for ObjectStack — implements IQueueService with in-memory and durable DB-backed (sys_job_queue) adapters",
   "type": "module",
diff --git a/packages/services/service-realtime/CHANGELOG.md b/packages/services/service-realtime/CHANGELOG.md
index 5fa06fa52b..40ab3627b7 100644
--- a/packages/services/service-realtime/CHANGELOG.md
+++ b/packages/services/service-realtime/CHANGELOG.md
@@ -1,5 +1,26 @@
 # @objectstack/service-realtime
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [5737261]
+- Updated dependencies [a619a3a]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/spec@10.4.0
+  - @objectstack/platform-objects@10.4.0
+  - @objectstack/core@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/services/service-realtime/package.json b/packages/services/service-realtime/package.json
index 2df732b4a9..70ecf123cc 100644
--- a/packages/services/service-realtime/package.json
+++ b/packages/services/service-realtime/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/service-realtime",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "Realtime Service for ObjectStack — implements IRealtimeService with WebSocket and in-memory pub/sub",
   "type": "module",
diff --git a/packages/services/service-settings/CHANGELOG.md b/packages/services/service-settings/CHANGELOG.md
index e6c7706440..885d437b85 100644
--- a/packages/services/service-settings/CHANGELOG.md
+++ b/packages/services/service-settings/CHANGELOG.md
@@ -1,5 +1,35 @@
 # @objectstack/service-settings
 
+## 10.4.0
+
+### Patch Changes
+
+- a619a3a: fix(setup): first-run admin polish — pin Company/Localization, gate dashboard widgets by `requiresService`, i18n + settings PUT envelope
+
+  Dogfooding the Setup app as a brand-new system administrator surfaced a cluster of small first-run gaps, now fixed:
+
+  - **platform-objects**: pin **Localization** and **Company** in the Setup sidebar's Configuration group — both are registered `service-settings` manifests (the two lowest-`order` Workspace settings) but were reachable only via the "All Settings" hub. Translate the previously-English nav labels Cloud Connection (云连接), Datasources (数据源) and Capabilities (能力). Tag the System Overview `widget_organizations` KPI with `requiresService: 'org-scoping'`.
+  - **rest**: extend the ADR-0057 D10 server-side visibility gate to **dashboard widgets** — strip widgets whose `requiresService` names an unregistered kernel service (mirrors the existing app-nav gate; `resolveRegisteredServices` now also discovers gates declared on widgets). In a single-tenant runtime this removes the orphan "Organizations" KPI, matching the already-hidden org nav entries.
+  - **service-settings**: add the missing zh `help` strings for the Localization manifest (number/currency/first-day-of-week/fiscal-year fields), and accept the `{ values: { … } }` envelope on `PUT /api/settings/:ns` symmetrically with what `GET` returns.
+
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [5737261]
+- Updated dependencies [a619a3a]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/spec@10.4.0
+  - @objectstack/platform-objects@10.4.0
+  - @objectstack/core@10.4.0
+  - @objectstack/types@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/services/service-settings/package.json b/packages/services/service-settings/package.json
index 083d43a128..414065a95e 100644
--- a/packages/services/service-settings/package.json
+++ b/packages/services/service-settings/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/service-settings",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "Settings service for ObjectStack — manifest registry + K/V resolver (OS_* env > Tenant > User > Default) + REST routes. See ADR-0007.",
   "type": "module",
diff --git a/packages/services/service-storage/CHANGELOG.md b/packages/services/service-storage/CHANGELOG.md
index e513e42416..630f38571c 100644
--- a/packages/services/service-storage/CHANGELOG.md
+++ b/packages/services/service-storage/CHANGELOG.md
@@ -1,5 +1,27 @@
 # @objectstack/service-storage
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [5737261]
+- Updated dependencies [a619a3a]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/spec@10.4.0
+  - @objectstack/platform-objects@10.4.0
+  - @objectstack/core@10.4.0
+  - @objectstack/observability@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/services/service-storage/package.json b/packages/services/service-storage/package.json
index 61d63b3253..5458dcb3e7 100644
--- a/packages/services/service-storage/package.json
+++ b/packages/services/service-storage/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/service-storage",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "Storage Service for ObjectStack — implements IStorageService with local filesystem and S3 adapter skeleton",
   "type": "module",
diff --git a/packages/spec/CHANGELOG.md b/packages/spec/CHANGELOG.md
index 784921699f..c3daf51836 100644
--- a/packages/spec/CHANGELOG.md
+++ b/packages/spec/CHANGELOG.md
@@ -1,5 +1,142 @@
 # @objectstack/spec
 
+## 10.4.0
+
+### Minor Changes
+
+- 715d667: feat(spec): dataset authoring form + derived measures without a dummy aggregate
+
+  `dataset` was the only UI-authorable metadata type without a `defineForm`
+  layout, so Studio's create surface fell back to the auto-generated flat layout
+  (free-text `object`, no grouping). Adds `dataset.form.ts` (registered in
+  `METADATA_FORM_REGISTRY`): sectioned Basics / Source / Dimensions / Measures
+  with an `object` picker (`ref:object`) and guidance — matching the sibling
+  `report` editor.
+
+  Also makes `DatasetMeasureSchema.aggregate` optional. A derived measure
+  (`derived: { op, of }`) combines other measures by name and `aggregate` is
+  ignored for it at compile time, but the schema still required it — so a derived
+  measure failed validation unless you added a meaningless aggregate. `aggregate`
+  is now required only for non-derived measures (enforced in the existing
+  `superRefine`). Backward compatible: existing measures that carry an aggregate
+  stay valid.
+
+- ef3ed67: Formula field typing: `inferExpressionType()` + a declared `returnType`.
+
+  - `@objectstack/formula`: new `inferExpressionType()` (and lower-level `inferCelType()`) surfaces the cel-js type-checker's result for a CEL value/formula expression, mapped to `number | text | boolean | date | unknown`. Conservative — two `dyn` operands stay `unknown`; typed literals/stdlib returns pin a concrete type.
+  - `@objectstack/spec`: `FieldSchema` gains an optional `returnType` (`number|text|boolean|date`) so a formula field can carry its declared value type (the way Salesforce/Airtable do), letting consumers (dataset measures, formatting, validation) read a declared type instead of re-parsing the expression.
+
+- 7697a0e: chore(spec): hard-remove the dead `blank`/`record_review` page config (enforce-or-remove)
+
+  Completes the enforce-or-remove started in framework#2265. The `blank` and
+  `record_review` page types were already removed from `PageTypeSchema` (no
+  renderer), their fields marked `@deprecated`, and objectui dropped all
+  references (objectui#1949). This deletes the now-unreachable surface:
+
+  - `BlankPageLayoutSchema`, `BlankPageLayoutItemSchema`, `RecordReviewConfigSchema`
+    (and their inferred types `BlankPageLayout`, `BlankPageLayoutItem`,
+    `RecordReviewConfig`).
+  - The `blankLayout` and `recordReview` fields on `PageSchema`.
+  - `page-builder.zod.ts` (the `blank`-type drag-drop canvas config:
+    `PageBuilderConfigSchema` / `CanvasSnapSettingsSchema` / `CanvasZoomSettingsSchema`
+    / `ElementPaletteItemSchema` / `InterfaceBuilderConfigSchema` and their types)
+    and its `@objectstack/spec/studio` re-exports — nothing consumed them.
+
+  The `page` liveness ledger drops to 15 properties (the 2 `dead` entries are gone).
+  No consumers in framework or objectui (objectui#1949 already merged).
+
+- cfd5ac4: fix(spec): remove unrendered roadmap page types from PageTypeSchema (enforce-or-remove)
+
+  `PageTypeSchema` advertised six page types that never shipped a renderer —
+  `dashboard`, `form`, `record_detail`, `record_review`, `overview`, `blank`.
+  Authoring one passed schema validation but broke at runtime ("Unknown component
+  type"), a false affordance that's especially dangerous when templates are
+  AI-authored. Per ADR-0049 (enforce-or-remove), the enum is now the _live_ set
+  (`record`, `home`, `app`, `utility`, `list`) — authoring a removed type now
+  fails fast at parse instead of silently at render. The removed types are tracked
+  in the new `PAGE_TYPE_ROADMAP` export and re-enter the enum only when a renderer
+  ships. A `page-type-liveness` gate test asserts the enum never re-grows a
+  roadmap type.
+
+  The `recordReview`/`blankLayout` config schemas and fields are retained but
+  `@deprecated` (their page types are no longer authorizable) to avoid breaking
+  downstream imports; they will be removed in a coordinated follow-up. The
+  `variables` page field is documented `@experimental` — its state container is
+  wired but no consumer reads/writes it end-to-end yet.
+
+- 3d04e06: Add authoritative per-type create seeds (root-cause for the "designer shape ≠ spec" family)
+
+  New `metadata-create-seeds.ts`: a single source of truth for the minimal valid create shape of each metadata type (`getMetadataCreateSeed(type)`), co-located with the schemas and asserted valid against each type's schema by `metadata-create-seeds.test.ts`. This anchors the create-form's default shape to the spec so it can't drift — the root cause of the recurring family where a freshly-created item (dashboard without `layout`, script action without `body`, report with stale `objectName`/`columns`) failed validation on save (422) yet passed every other gate. Seeds the 9 core Studio-designer types (dashboard, action, page, view, flow, validation, hook, dataset, object); the test surfaces remaining schema-backed types still needing a seed. (Follow-up: expose `createSeed` via `/meta/types` so the Studio designer consumes it instead of hardcoding `createDefaults`.)
+
+### Patch Changes
+
+- c1a754a: feat(spec): type ChartConfig `colors` as a palette OR a value→color map
+
+  `ChartConfigSchema.colors` now accepts either a positional palette (`string[]`)
+  or an explicit value→color map (`Record<value, color>`, kanban-style). A
+  value→color map — and a select/lookup dimension's option colors — take
+  precedence over the positional palette per category, so semantic charts
+  (health, status) paint their own colors instead of the generic palette.
+
+- 6fbe91f: fix(spec): make dashboard widget `layout` optional (auto-flowed when omitted)
+
+  `DashboardWidgetSchema.layout` was required, but the entire runtime treats it as
+  optional: the renderer (`DashboardGridLayout`) auto-flows any widget without a
+  layout (`x: (i % 4) * 3, y: ⌊i/4⌋ * 4, w: 3, h: 4`), and the Studio dashboard
+  designer adds widgets **without** a layout by design.
+
+  The mismatch meant every dashboard authored in the Studio designer failed spec
+  validation the moment a widget was added — the draft `PUT /meta/dashboard/...`
+  returned **422** ("widgets: Invalid type: expected object, received undefined"),
+  so the draft never saved and **Publish stayed disabled**, even though the widget
+  rendered correctly in the canvas. Found by dogfooding the dashboard designer in
+  the browser.
+
+  `layout` is now optional; absence means "auto-place". Authors may still pin an
+  explicit grid position. Backward-compatible — existing dashboards that specify
+  `layout` are unaffected.
+
+- e7e04f1: chore(liveness): bring `page` under the spec liveness gate
+
+  Onboards the `page` metadata type to the ADR-0049/#1919 liveness ledger
+  (`packages/spec/liveness/page.json`) and adds it to the governed-types list in
+  `check-liveness.mts`. Every authorable PageSchema property now declares a
+  status with evidence: 17 properties — 14 `live` (objectui renderer consumers
+  cited as prose), 1 `experimental` (`variables` — provider/hook exist, no
+  end-to-end consumer), 2 `dead` (`recordReview` / `blankLayout` — their page
+  types were removed in framework#2265 and objectui dropped all references in
+  objectui#1949; the fields stay @deprecated pending hard-removal). CI now fails
+  if a new page property lands unclassified.
+
+- 2be5c1f: Promote `PageSchema.variables` from @experimental to live (ADR-0049)
+
+  Page-local state is now wired end-to-end (runtime in objectui#1957: page
+  variables are injected into the visible/CEL expression context as `page.<var>`,
+  and `element:record_picker` writes a variable via its `source` binding). The
+  spec docs are updated to describe the now-live behaviour and the binding
+  direction, and the liveness ledger entry is flipped `experimental → live`.
+
+- 8801c02: fix(spec): don't require `slots` on slotted pages
+
+  `PageSchema`'s superRefine rejected any `kind: 'slotted'` page that didn't
+  provide a `slots` map — but a slotted page with no overrides is valid: every
+  slot falls through to the synthesized default layout, the natural starting
+  point before you add overrides. Requiring `slots` up front made the Studio
+  "New Page" form a dead-end the moment you picked "slotted" (the form can't
+  author a slot map), the same trap as the old required `regions`.
+
+- 4a84c98: fix(spec): make page `regions` and component `properties` optional
+
+  `PageSchema.regions` and `PageComponentSchema.properties` were required, which
+  made it impossible to create record/home/app pages in the Studio editor: the
+  New Page form has no region editor, and the create-form seeds a record page's
+  default layout from `buildDefaultPageSchema`, whose nodes carry props at the top
+  level — so every seeded block tripped `regions.N.components.M.properties:
+expected record`. Both are now `.optional().default(...)`; an empty full page
+  falls back to the synthesized default layout, slotted pages compose via `slots`,
+  list pages ignore regions, and prop-less components (record:activity,
+  element:divider) no longer need `properties: {}`.
+
 ## 10.3.0
 
 ## 10.2.0
diff --git a/packages/spec/package.json b/packages/spec/package.json
index 1e89b37c46..13f7849c7d 100644
--- a/packages/spec/package.json
+++ b/packages/spec/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/spec",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "description": "ObjectStack Protocol & Specification - TypeScript Interfaces, JSON Schemas, and Convention Configurations",
   "license": "Apache-2.0",
   "main": "dist/index.js",
diff --git a/packages/triggers/trigger-api/CHANGELOG.md b/packages/triggers/trigger-api/CHANGELOG.md
index 6860028eb0..adfa3bd09f 100644
--- a/packages/triggers/trigger-api/CHANGELOG.md
+++ b/packages/triggers/trigger-api/CHANGELOG.md
@@ -1,5 +1,23 @@
 # @objectstack/trigger-api
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/spec@10.4.0
+  - @objectstack/core@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/triggers/trigger-api/package.json b/packages/triggers/trigger-api/package.json
index 61faa63e2d..2da0bd73dc 100644
--- a/packages/triggers/trigger-api/package.json
+++ b/packages/triggers/trigger-api/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/trigger-api",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "Inbound HTTP/webhook flow trigger for ObjectStack — per-flow HMAC-verified endpoints with queue-backed ingestion (ADR-0041)",
   "main": "dist/index.js",
diff --git a/packages/triggers/trigger-record-change/CHANGELOG.md b/packages/triggers/trigger-record-change/CHANGELOG.md
index ba502288f2..a3d21c3a19 100644
--- a/packages/triggers/trigger-record-change/CHANGELOG.md
+++ b/packages/triggers/trigger-record-change/CHANGELOG.md
@@ -1,5 +1,23 @@
 # @objectstack/plugin-trigger-record-change
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/spec@10.4.0
+  - @objectstack/core@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/triggers/trigger-record-change/package.json b/packages/triggers/trigger-record-change/package.json
index ec54bc0857..af11b53983 100644
--- a/packages/triggers/trigger-record-change/package.json
+++ b/packages/triggers/trigger-record-change/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/trigger-record-change",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "Record-change flow trigger for ObjectStack — auto-launches flows on object insert/update/delete via ObjectQL lifecycle hooks (ADR-0018)",
   "main": "dist/index.js",
diff --git a/packages/triggers/trigger-schedule/CHANGELOG.md b/packages/triggers/trigger-schedule/CHANGELOG.md
index e1ca462857..e5a668fd6b 100644
--- a/packages/triggers/trigger-schedule/CHANGELOG.md
+++ b/packages/triggers/trigger-schedule/CHANGELOG.md
@@ -1,5 +1,23 @@
 # @objectstack/plugin-trigger-schedule
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/spec@10.4.0
+  - @objectstack/core@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/triggers/trigger-schedule/package.json b/packages/triggers/trigger-schedule/package.json
index d25fb32866..7c9cf6a99d 100644
--- a/packages/triggers/trigger-schedule/package.json
+++ b/packages/triggers/trigger-schedule/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/trigger-schedule",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "Schedule flow trigger for ObjectStack — auto-launches flows on a cron/interval/once schedule via the IJobService (ADR-0018)",
   "main": "dist/index.js",
diff --git a/packages/types/CHANGELOG.md b/packages/types/CHANGELOG.md
index 0913aba2e2..eaadeac80e 100644
--- a/packages/types/CHANGELOG.md
+++ b/packages/types/CHANGELOG.md
@@ -1,5 +1,22 @@
 # @objectstack/types
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/spec@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/types/package.json b/packages/types/package.json
index 265c8b62ab..0b7af98273 100644
--- a/packages/types/package.json
+++ b/packages/types/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/types",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "Shared interfaces describing the ObjectStack Runtime environment",
   "main": "dist/index.js",
diff --git a/packages/verify/CHANGELOG.md b/packages/verify/CHANGELOG.md
index 38e66dde5e..e407446841 100644
--- a/packages/verify/CHANGELOG.md
+++ b/packages/verify/CHANGELOG.md
@@ -1,5 +1,41 @@
 # @objectstack/verify
 
+## 10.4.0
+
+### Patch Changes
+
+- Updated dependencies [4d99a5c]
+- Updated dependencies [c1a754a]
+- Updated dependencies [6fbe91f]
+- Updated dependencies [715d667]
+- Updated dependencies [715d667]
+- Updated dependencies [b6a4972]
+- Updated dependencies [ef3ed67]
+- Updated dependencies [359c0aa]
+- Updated dependencies [7697a0e]
+- Updated dependencies [e7e04f1]
+- Updated dependencies [cfd5ac4]
+- Updated dependencies [2be5c1f]
+- Updated dependencies [a619a3a]
+- Updated dependencies [8801c02]
+- Updated dependencies [3d04e06]
+- Updated dependencies [4a84c98]
+  - @objectstack/objectql@10.4.0
+  - @objectstack/runtime@10.4.0
+  - @objectstack/spec@10.4.0
+  - @objectstack/service-analytics@10.4.0
+  - @objectstack/service-automation@10.4.0
+  - @objectstack/rest@10.4.0
+  - @objectstack/service-settings@10.4.0
+  - @objectstack/plugin-sharing@10.4.0
+  - @objectstack/core@10.4.0
+  - @objectstack/driver-sqlite-wasm@10.4.0
+  - @objectstack/plugin-auth@10.4.0
+  - @objectstack/plugin-hono-server@10.4.0
+  - @objectstack/plugin-org-scoping@10.4.0
+  - @objectstack/plugin-security@10.4.0
+  - @objectstack/service-datasource@10.4.0
+
 ## 10.3.0
 
 ### Patch Changes
diff --git a/packages/verify/package.json b/packages/verify/package.json
index 48605cd542..0b57f998a0 100644
--- a/packages/verify/package.json
+++ b/packages/verify/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/verify",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "license": "Apache-2.0",
   "description": "Boot any ObjectStack app in-process and verify it through the real HTTP stack — auto-derived CRUD round-trip fidelity plus the cross-owner RLS invariant. Catches runtime regressions that static checks miss.",
   "type": "module",
diff --git a/packages/vscode-objectstack/CHANGELOG.md b/packages/vscode-objectstack/CHANGELOG.md
index ec10851fc4..630e7bc858 100644
--- a/packages/vscode-objectstack/CHANGELOG.md
+++ b/packages/vscode-objectstack/CHANGELOG.md
@@ -1,5 +1,7 @@
 # objectstack-vscode
 
+## 10.4.0
+
 ## 10.3.0
 
 ## 10.2.0
diff --git a/packages/vscode-objectstack/package.json b/packages/vscode-objectstack/package.json
index cdabe0b62c..358aa8c0a5 100644
--- a/packages/vscode-objectstack/package.json
+++ b/packages/vscode-objectstack/package.json
@@ -2,7 +2,7 @@
   "name": "objectstack-vscode",
   "displayName": "ObjectStack",
   "description": "ObjectStack Protocol — Autocomplete, validation, and inline diagnostics for .object.ts, .view.ts, and objectstack.config.ts files",
-  "version": "10.3.0",
+  "version": "10.4.0",
   "publisher": "objectstack",
   "license": "Apache-2.0",
   "repository": {