docs(configure+changelog): align MCP, batch, and user-import docs with 16.0; add 16.0 changelog entry

mcp (en + zh-Hans):
- new 'The stdio transport (16.0)' section: OS_MCP_STDIO_ENABLED own
  switch (default off; legacy OS_MCP_SERVER_ENABLED=true trigger for
  one release with a deprecation warning) and the mandatory
  OS_MCP_STDIO_API_KEY principal — same verify+authz chain as HTTP,
  RLS/FLS/tenant apply, revocation live, fail-closed boot, no system
  bypass (ADR-0101);
- tool table gains validate_expression (read-only, data:read-scoped,
  fail-closed on sys_*); dev-banner claude mcp add note; new
  troubleshooting row.

api-access (all 7 locales):
- MCP row reflects default-on (disable with =false);
- /api/v1/batch documented as atomic-only with per-op gating before
  the transaction, ids required, {$ref} resolution enforced,
  atomic:false → 400 BATCH_NOT_ATOMIC (#1604); discovery advertises
  capabilities.transactionalBatch (#3298).

users + authentication (en + zh-Hans):
- import-users default passwordPolicy is 'auto' since 16.0 (invite
  deliverable rows; temp password only for unreachable; pass 'none'
  for the old identity-only behavior; rows[].delivery outcomes).

changelog (en + zh-Hans):
- new 16.0 entry in the page's own style (organizationId rename,
  approvals quorum/会签 + metadata-driven inbox, time-relative
  automations, filtered roll-ups, strict widgets, MCP stdio principal,
  enforce-or-remove sweep, engine-owned read-only rows, date-equality
  fix + date-arithmetic build errors, bulk-import auto policy);
  14.x entry no longer claims to be the current train.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012Kj2MJEPXoUXC4LiC3XYJc

Author: claude

content/docs/configure/api-access.de.mdx

@@ -24,7 +24,8 @@ Wichtige Schnittstellen:
 | `/api/v1/auth/*` | Authentifizierung (Anmeldung, Sitzungen, OAuth, OIDC) |
 | `/api/v1/meta/*` | Metadaten-APIs (Objekte, Felder, Ansichten), sofern aktiviert |
 | `/api/v1/keys` | Erzeugt einen nur einmal angezeigten `sys_api_key` für den aufrufenden Benutzer (POST) |
-| `/api/v1/mcp` | Model-Context-Protocol-Server über Streamable HTTP, wenn `OS_MCP_SERVER_ENABLED=true` |
+| `/api/v1/batch` | Transaktionaler objektübergreifender Batch (POST) — ausschließlich atomar, jede Operation pro Objekt geprüft |
+| `/api/v1/mcp` | Model-Context-Protocol-Server über Streamable HTTP — standardmäßig aktiv; deaktivierbar mit `OS_MCP_SERVER_ENABLED=false` |
 | `/api/v1/health` | Liveness-/Readiness-Probe (keine Authentifizierung) |
 
 Das Präfix lautet standardmäßig `/api/v1` (der API-`basePath` von `/api` plus

content/docs/configure/api-access.es.mdx

@@ -24,7 +24,8 @@ Superficies destacadas:
 | `/api/v1/auth/*` | Autenticación (inicio de sesión, sesiones, OAuth, OIDC) |
 | `/api/v1/meta/*` | APIs de metadatos (objetos, campos, vistas) cuando está habilitado |
 | `/api/v1/keys` | Genera un `sys_api_key` de un solo uso para el usuario que llama (POST) |
-| `/api/v1/mcp` | Servidor Model Context Protocol sobre Streamable HTTP, cuando `OS_MCP_SERVER_ENABLED=true` |
+| `/api/v1/batch` | Batch transaccional entre objetos (POST) — solo atómico, cada operación validada por objeto |
+| `/api/v1/mcp` | Servidor Model Context Protocol sobre Streamable HTTP — activo de forma predeterminada; se desactiva con `OS_MCP_SERVER_ENABLED=false` |
 | `/api/v1/health` | Sonda de liveness/readiness (sin autenticación) |
 
 El prefijo es `/api/v1` de forma predeterminada (el `basePath` de la API,

content/docs/configure/api-access.fr.mdx

@@ -24,7 +24,8 @@ Surfaces notables :
 | `/api/v1/auth/*` | Authentification (connexion, sessions, OAuth, OIDC) |
 | `/api/v1/meta/*` | API de métadonnées (objets, champs, vues) lorsqu'elles sont activées |
 | `/api/v1/keys` | Génère une `sys_api_key` affichée une seule fois pour l'utilisateur appelant (POST) |
-| `/api/v1/mcp` | Serveur Model Context Protocol via Streamable HTTP, lorsque `OS_MCP_SERVER_ENABLED=true` |
+| `/api/v1/batch` | Batch transactionnel inter-objets (POST) — atomique uniquement, chaque opération contrôlée par objet |
+| `/api/v1/mcp` | Serveur Model Context Protocol via Streamable HTTP — actif par défaut ; se désactive avec `OS_MCP_SERVER_ENABLED=false` |
 | `/api/v1/health` | Sonde de vivacité/disponibilité (sans authentification) |
 
 Le préfixe est `/api/v1` par défaut (le `basePath` de l'API `/api` plus la

content/docs/configure/api-access.ja.mdx

@@ -23,7 +23,8 @@ https://<project-domain>/api/v1
 | `/api/v1/auth/*` | 認証（サインイン、セッション、OAuth、OIDC） |
 | `/api/v1/meta/*` | 有効化されている場合のメタデータ API（オブジェクト、フィールド、ビュー） |
 | `/api/v1/keys` | 呼び出しユーザー向けに一度だけ表示される `sys_api_key` を発行（POST） |
-| `/api/v1/mcp` | `OS_MCP_SERVER_ENABLED=true` のとき、Streamable HTTP 経由の Model Context Protocol サーバー |
+| `/api/v1/batch` | オブジェクト横断のトランザクショナルバッチ（POST）— アトミックのみ、各操作をオブジェクト単位でゲート |
+| `/api/v1/mcp` | Streamable HTTP 経由の Model Context Protocol サーバー — デフォルトで有効。`OS_MCP_SERVER_ENABLED=false` で無効化 |
 | `/api/v1/health` | 死活／準備状態のプローブ（認証不要） |
 
 プレフィックスのデフォルトは `/api/v1`（API の `basePath` である `/api` と

content/docs/configure/api-access.ko.mdx

@@ -23,7 +23,8 @@ https://<project-domain>/api/v1
 | `/api/v1/auth/*` | 인증 (로그인, 세션, OAuth, OIDC) |
 | `/api/v1/meta/*` | 활성화된 경우 메타데이터 API (오브젝트, 필드, 뷰) |
 | `/api/v1/keys` | 호출 사용자를 위해 한 번만 표시되는 `sys_api_key` 발급 (POST) |
-| `/api/v1/mcp` | `OS_MCP_SERVER_ENABLED=true`일 때 Streamable HTTP를 통한 Model Context Protocol 서버 |
+| `/api/v1/batch` | 오브젝트 간 트랜잭션 배치 (POST) — 원자적 실행만 지원, 모든 작업을 오브젝트별로 게이트 |
+| `/api/v1/mcp` | Streamable HTTP를 통한 Model Context Protocol 서버 — 기본 활성화, `OS_MCP_SERVER_ENABLED=false`로 비활성화 |
 | `/api/v1/health` | 활성/준비 상태 프로브 (인증 없음) |
 
 접두사는 기본적으로 `/api/v1`(API `basePath`인 `/api`에 `version`인 `v1`을

content/docs/configure/api-access.mdx

@@ -23,7 +23,8 @@ Notable surfaces:
 | `/api/v1/auth/*` | Authentication (sign-in, sessions, OAuth, OIDC) |
 | `/api/v1/meta/*` | Metadata APIs (objects, fields, views) when enabled |
 | `/api/v1/keys` | Mint a show-once `sys_api_key` for the calling user (POST) |
-| `/api/v1/mcp` | Model Context Protocol server over Streamable HTTP, when `OS_MCP_SERVER_ENABLED=true` |
+| `/api/v1/batch` | Transactional cross-object batch (POST) — atomic-only, every operation gated per object |
+| `/api/v1/mcp` | Model Context Protocol server over Streamable HTTP — on by default; disable with `OS_MCP_SERVER_ENABLED=false` |
 | `/api/v1/health` | Liveness/readiness probe (no auth) |
 
 The prefix defaults to `/api/v1` (the API `basePath` of `/api` plus the
@@ -41,6 +42,14 @@ API exposure is governed per object in the artifact, not at the gateway:
 Both are enforced at the REST layer — see
 [REST API → Restricting the API surface](/docs/reference/rest-api#restricting-the-api-surface).
 
+The same gates cover the transactional batch route (16.0):
+`POST /api/v1/batch` validates its body, enforces `apiEnabled` /
+`apiMethods` for **every** operation *before* opening the transaction,
+requires ids for update/delete, and rejects unresolvable `{ $ref }`
+parent references. The route is atomic-only — `atomic: false` is
+rejected with `400 BATCH_NOT_ATOMIC`; non-atomic bulk stays on the
+per-object `createMany` / `updateMany` endpoints.
+
 ## Authentication options
 
 Callers can authenticate in four ways:
@@ -151,3 +160,7 @@ when the corresponding capability is included in the image. Customer
 integrations should generate clients from the per-deployment OpenAPI
 document rather than hand-rolling URLs, because object names and
 generated routes follow the deployed artifact.
+
+Discovery also advertises `capabilities.transactionalBatch` (16.0), so
+clients can detect the atomic batch route declaratively at connect time
+instead of probing for `404`/`405`/`501`.

content/docs/configure/api-access.zh-Hans.mdx

@@ -21,7 +21,8 @@ https://<project-domain>/api/v1
 | `/api/v1/auth/*` | 身份验证（登录、会话、OAuth、OIDC） |
 | `/api/v1/meta/*` | 元数据 API（对象、字段、视图），在启用时可用 |
 | `/api/v1/keys` | 为当前调用用户生成只显示一次的 `sys_api_key`（POST） |
-| `/api/v1/mcp` | 当 `OS_MCP_SERVER_ENABLED=true` 时，通过 Streamable HTTP 提供的 Model Context Protocol 服务器 |
+| `/api/v1/batch` | 跨对象事务批量写入（POST）——仅支持原子模式，每个操作都按对象门控 |
+| `/api/v1/mcp` | 通过 Streamable HTTP 提供的 Model Context Protocol 服务器——默认开启；设置 `OS_MCP_SERVER_ENABLED=false` 可关闭 |
 | `/api/v1/health` | 存活/就绪探针（无需身份验证） |
 
 前缀默认为 `/api/v1`（即 API 的 `basePath` `/api` 加上 `version` `v1`），并且可在 ObjectOS stack 上配置。
@@ -36,6 +37,8 @@ API 暴露在 artifact 中按对象逐个治理，而不是在网关层：
 两者都在 REST 层强制执行 —— 参见
 [REST API → 限制 API 暴露面](/docs/reference/rest-api#restricting-the-api-surface)。
 
+同样的闸门也覆盖事务批量路由（16.0）：`POST /api/v1/batch` 会校验请求体，在开启事务*之前*就对**每个**操作强制执行 `apiEnabled` / `apiMethods`，update/delete 必须携带 id，无法解析的 `{ $ref }` 父引用会被拒绝。该路由只支持原子模式——`atomic: false` 会被以 `400 BATCH_NOT_ATOMIC` 拒绝；非原子的批量写入请继续使用按对象的 `createMany` / `updateMany` 端点。
+
 ## 身份验证方式
 
 调用方可以通过四种方式进行身份验证：
@@ -114,3 +117,5 @@ API 密钥仍作为 CI 与无头代理的并行通道——`x-api-key` 和 `Auth
 ## OpenAPI / 发现
 
 当镜像中包含相应能力时，运行时可以为自动生成的 REST API 提供 OpenAPI 文档。客户的集成应基于每个部署的 OpenAPI 文档生成客户端，而不是手写 URL，因为对象名称和生成的路由会跟随已部署的 artifact 而变化。
+
+发现（discovery）还会通告 `capabilities.transactionalBatch`（16.0），客户端可以在连接时以声明方式探知原子批量路由是否可用，而不必靠探测 `404`/`405`/`501`。

content/docs/configure/authentication.mdx

@@ -50,7 +50,14 @@ Platform admins can provision accounts without the email invite flow:
   `PASSWORD_EXPIRED` until changed).
 - `POST /api/v1/auth/admin/import-users` bulk-imports rows / CSV / XLSX
   (max 500 rows per request) with dry-run and upsert-by-email-or-phone
-  modes; existing users never get their passwords reset.
+  modes; existing users never get their passwords reset. Since 16.0 the
+  default `passwordPolicy` is `'auto'`: rows with a deliverable channel
+  (real email + wired email service, or phone + SMS invite path) are
+  **invited**, and only unreachable rows get a temporary password
+  (returned once, `must_change_password`). Callers that relied on the
+  old identity-only default must now pass `passwordPolicy: 'none'`
+  explicitly; per-row outcomes are on `rows[].delivery` with a
+  `summary.delivery` breakdown.
 
 ## Required secret
 

content/docs/configure/authentication.zh-Hans.mdx

@@ -35,7 +35,7 @@ ObjectOS 使用由 Better Auth 驱动的 ObjectStack 认证插件。认证是项
 平台管理员可以不经邮件邀请流程直接开通账户：
 
 - `POST /api/v1/auth/admin/create-user` 直接创建用户，可选生成一次性密码（仅返回一次，不持久化）。`must_change_password` 标志强制首次登录时修改密码（未修改前返回 403 `PASSWORD_EXPIRED`）。
-- `POST /api/v1/auth/admin/import-users` 批量导入行 / CSV / XLSX（每次请求最多 500 行），支持 dry-run 和按邮箱或手机号 upsert；已存在用户的密码永不重置。
+- `POST /api/v1/auth/admin/import-users` 批量导入行 / CSV / XLSX（每次请求最多 500 行），支持 dry-run 和按邮箱或手机号 upsert；已存在用户的密码永不重置。自 16.0 起，默认 `passwordPolicy` 为 `'auto'`：具有可送达通道的行（真实邮箱 + 已接通的邮件服务，或手机号 + 短信邀请通道）会被**邀请**，只有无法触达的行才得到临时密码（仅返回一次，`must_change_password`）。依赖旧的仅建身份默认行为的调用方现在必须显式传入 `passwordPolicy: 'none'`；每行结果在 `rows[].delivery` 上，并附 `summary.delivery` 汇总。
 
 ## 必需的 Secret
 

content/docs/configure/mcp.mdx

@@ -34,6 +34,10 @@ claude mcp add --transport http my-app http://localhost:3000/api/v1/mcp
 claude mcp add --transport http my-app https://your-deployment.example.com/api/v1/mcp
 ```
 
+> On a local dev server you don't even have to type this: since 16.0 the
+> `os dev` startup banner prints the MCP endpoint, the agent-skill URL,
+> and a ready-to-paste `claude mcp add` command.
+
 For headless use (CI, containers) skip OAuth and attach an
 [API key](#headless-api-keys) instead:
 
@@ -91,14 +95,35 @@ For a long-lived integration, bind the key to a dedicated service user
 with a minimal permission set — see
 [Service accounts & API keys](/docs/configure/users#service-accounts--api-keys).
 
+## The stdio transport (16.0)
+
+Besides HTTP, the runtime can serve MCP over **stdio** for hosts that
+spawn the server as a child process. Since 16.0 (ADR-0101) stdio has its
+own switch and always runs under a real identity:
+
+- **`OS_MCP_STDIO_ENABLED=true`** turns stdio auto-start on (default
+  **off**). `OS_MCP_SERVER_ENABLED` now governs only the HTTP surface —
+  the legacy behavior where `OS_MCP_SERVER_ENABLED=true` also started
+  stdio still works for one release, with a deprecation warning.
+- Stdio **requires `OS_MCP_STDIO_API_KEY=osk_...`**. The key is resolved
+  through the same verify + authorization chain as HTTP and REST, so
+  object permissions, record access, field-level security, and tenant
+  scoping apply to stdio calls exactly as on `/api/v1/mcp` — and the key
+  is re-resolved per read, so revoking it takes effect immediately.
+- The transport is **fail-closed**: enabling auto-start without a
+  resolvable key refuses to boot, and there is deliberately no unscoped
+  fallback and no `system` bypass. For full authority, mint the key on a
+  platform-admin or dedicated service identity.
+
 ## What the agent gets
 
-Ten data and action tools, generated from your metadata:
+Eleven data, action, and authoring tools, generated from your metadata:
 
 | Tool | What it does |
 |---|---|
 | `list_objects` / `describe_object` | Discover which objects exist and their fields |
 | `query_records` / `get_record` | Read data (list queries are capped at 50 rows per page by default) |
+| `validate_expression` | Lint a formula against the real object schema *before* saving it (16.0): errors (bare field refs, unknown fields with did-you-mean), warnings (type-soundness, date-equality pitfalls), the in-scope field/function inventory, and the inferred result type. Read-only, `data:read`-scoped, fail-closed on `sys_*` |
 | `aggregate_records` | Grouped aggregation (registered when the active driver supports it) |
 | `create_record` / `update_record` / `delete_record` | Write data |
 | `list_actions` / `run_action` | Discover and invoke your business actions by name |
@@ -157,6 +182,7 @@ fully operational.
 |---|---|
 | `404` on `/api/v1/mcp` | The surface is disabled — unset `OS_MCP_SERVER_ENABLED` (default is on) |
 | `501 Not Implemented` | The MCP plugin isn't part of this build — check your stack's plugins |
+| Boot refuses with stdio enabled | Stdio is fail-closed (16.0) — set `OS_MCP_STDIO_API_KEY` to a resolvable `osk_` key, or turn `OS_MCP_STDIO_ENABLED` off |
 | `401` on every call | Anonymous or invalid credentials. Interactive clients: complete the browser login. Headless: check the `osk_` key and header spelling |
 | `403 insufficient_scope` | The OAuth token lacks the scope for that tool family (e.g. writes without `data:write`) — reconnect and grant the scope |
 | An action is missing from `list_actions` | `ai.exposed` is not `true`, `ai.description` is shorter than 40 characters, the type isn't headless-callable (`url` / `modal` / `form` never appear), it targets a `sys_*` object, or the caller fails its `requiredPermissions` |