Merge origin/main into fix/3490-webhook-liveness-flip

Resolve conflicts in webhook.json + lint-liveness-properties.test.ts against
#3494 (feat(spec)!: prune still-dead aspirational config from Webhook), which
deleted body/payloadFields/includeSession/retryPolicy/tags/authentication from
WebhookSchema. With those gone and the #3489 bridge making the rest live, the
webhook ledger is 11 props ALL live — no dead surface, so no authorWarn carrier —
and the lint test asserts an authored webhook is silent (the old `url` carrier is
now live). proof-registry (23) / lint (14) / liveness gate (webhook 11 live) /
webhook-materialization dogfood proof all green post-merge.

Author: os-zhuang

.changeset/adr-0104-d3w2-pr3-file-ownership.md

@@ -0,0 +1,34 @@
+---
+"@objectstack/service-storage": minor
+"@objectstack/spec": minor
+---
+
+feat(storage): exclusive field-reference file ownership — ADR-0104 D3 wave 2 (PR-3)
+
+A `file`/`image`/`avatar`/`video`/`audio` field that holds a `sys_file` id now
+records its owner on the file: `sys_file.ref_object` / `ref_id` / `ref_field`
+name the single `(object, record, field)` slot that references it, maintained on
+the engine write path — claimed on insert, reconciled on update, released when
+the owning record is deleted.
+
+**Field references are exclusive, unlike attachments.** The attachments surface
+deliberately shares one file across many `sys_attachment` join rows; a field
+reference is owned by at most one slot, and writing an already-owned id into a
+second slot **copies the bytes into a fresh `sys_file`** rather than sharing the
+row. That keeps a file's read authorisation derived from exactly one parent
+record instead of the union of every referrer's — so copying a private record's
+file id into a world-readable one cannot silently widen access — and it removes
+reference counting from the lifecycle entirely: a file is released because its
+one owner let go, never because a count came back zero.
+
+**Deletes nothing.** This records and releases ownership; it never tombstones,
+and the `scope === 'attachments'` guardrail that keeps field-referenced files
+out of the reap is untouched. Collection is a separate, gated change that must
+also extend the reap guard's sweep-time re-verify in the same commit.
+
+Also exports `isFileIdToken` from `@objectstack/spec/data` as the single arbiter
+of "is this stored string an opaque file id, or a legacy/external URL?", now
+shared by the read resolver and the write claimer so the two cannot drift.
+
+Dormant until a field actually holds an id token: objects without file-class
+fields, inline-blob values and URL-shaped values all exit before any I/O.

.changeset/adr-0104-d3w2-pr4-governed-download.md

@@ -0,0 +1,52 @@
+---
+"@objectstack/service-storage": minor
+---
+
+feat(storage): governed download for field-owned files — ADR-0104 D3 wave 2 (PR-4)
+
+A file owned by a record's field (`sys_file.ref_object` / `ref_id`, set by
+PR-3) is now authorized on download the same way an attachment is: the caller
+must be able to READ the file's parent record, or be its uploader. Previously
+only `attachments`-scope files were gated and every field file kept an
+anonymous capability URL.
+
+**Parent resolution differs by surface, and that asymmetry is the point.** An
+attachment may hang off many records, so its readable-by set is the union over
+its `sys_attachment` join rows. A field-owned file belongs to exactly one
+record, so its readable-by set is that one record's — nothing more. Under a
+shared reference model the field case would have had to union too, which is
+what makes copying a file id into a more public record silently widen access.
+
+Denials are reported as `FILE_DOWNLOAD_DENIED` (403), distinct from the
+attachments path's `ATTACHMENT_DOWNLOAD_DENIED`, since the file *belongs to* one
+record rather than being *attached to* several.
+
+**`acl: 'public_read'` is the opt-out**, and now an explicit declaration rather
+than the silent default every field file used to get. Genuinely public images —
+anything embedded in an `<img src>`, which cannot carry a bearer token — must
+declare it.
+
+**Dual-mode safe, gates nothing that is open today.** A pre-cutover field holds
+an inline blob or an external URL, never a `sys_file` id, so no existing file
+has an owner recorded and none of them start being gated. The gate engages only
+for files a record's field has actually claimed, and disengages again when
+ownership is released.
+
+---
+
+Also adds `verifyFileReferences()` — the executable form of ADR-0104's R4
+acceptance gate. It compares ground truth (what records' file fields actually
+hold) against recorded ownership, and classifies disagreements by whether they
+could cause data loss once collection is enabled:
+
+- **blocking** — `unowned_reference` (a held file nothing owns), `foreign_owner`
+  (a record holds a file owned by another slot), `shared_reference` (one file
+  held by two slots, i.e. exclusivity was violated). Each would let a later reap
+  delete bytes a record still points at.
+- **advisory** — `stale_owner` (owned but no longer held; fails toward
+  retention) and `unreferenced_file` (storage cost, not a correctness problem).
+
+The scan is read-only — it never writes, tombstones, or deletes. A ledger may
+not be given authority over irreversible deletes until it has been shown to
+agree with reality, so this must report zero blocking discrepancies on real
+tenant data, on consecutive runs, before the gated collection change may merge.

.changeset/expression-approvers-3447-p2.md

@@ -0,0 +1,18 @@
+---
+"@objectstack/spec": minor
+"@objectstack/formula": minor
+"@objectstack/lint": minor
+"@objectstack/service-automation": minor
+"@objectstack/plugin-approvals": minor
+"@objectstack/rest": minor
+---
+
+Dynamic approver routing for approval nodes (#3447 P2) — three new declarative capabilities:
+
+**`expression` approvers.** A new approver type whose CEL expression resolves WHO approves at node entry, over exactly three roots: `current.*` (the record's live state), `trigger.*` (the submit-time snapshot) and `vars.*` (flow variables, incl. upstream node outputs). `record` and bare field names are rejected before evaluation — on this platform `record` always means "the record at event time", which is ambiguous at an approval node — with error messages that prescribe the correct spelling. The optional `resolveAs: 'user' | 'department' | 'position' | 'team'` re-expands each resolved id through the same graph lookups the static types use; with `behavior: 'per_group'` each intermediate value (e.g. each returned department) forms its own sign-off group. A missing key fails the node loudly; only a present-but-empty result counts as an empty slate.
+
+**`onEmptyApprovers` policy.** What an empty resolved slate does, node-level, for all approver types: `admin_rescue` (default — request opens for privileged takeover, the #3424 behaviour), `fail` (node fails), or `auto_approve` (skip the request, continue down the `approve` edge with `output.autoApproved = true`). To support auto-approve, the automation engine now honours `NodeExecutionResult.branchLabel` on the synchronous completion path — the field existed but was only ever consumed via resume signals.
+
+**Decision outputs.** `decide(..., { outputs })` hands structured data from the approver to the flow: the author declares allowed keys on the node (`decisionOutputs`), approvers fill values only, and accepted outputs resume the run as `<nodeId>.<key>` variables — a later approval node's expression can read `vars.<nodeId>.picked_departments`, closing "the previous approver picks the next step's approvers" without a record-field detour. Undeclared keys reject the decision; `decision`/`requestId` are reserved. Multi-approver tallies now always pin to the open-time approver snapshot (previously unanimous re-resolved at each decision against the payload snapshot).
+
+Also: `collectCelRootIdentifiers` is exported from `@objectstack/formula` (shared by the new `os lint` rules and the runtime pre-check, so they can never drift), resolution inputs are audited on the request snapshot as `__resolvedFrom`, and three new lint rules gate expressions, empty-slate policies and reserved output keys at author time.

.changeset/historical-import-audit-docs.md

@@ -0,0 +1,4 @@
+---
+---
+
+docs(objectql): document that `treatAsHistorical` also preserves the original audit timeline (#3493). Docs-only — releases nothing, so this changeset is intentionally empty.

.changeset/i18n-sso-scim-userposition-importjob-coverage.md

@@ -0,0 +1,24 @@
+---
+"@objectstack/platform-objects": patch
+"@objectstack/plugin-security": patch
+---
+
+fix(i18n): translate the SSO / SCIM / user-position / import-job admin objects
+
+Four live, UI-facing system objects were registered but never added to their
+package's i18n extract config, so non-English admins saw raw English `label`
+metadata:
+
+- `sys_sso_provider`, `sys_scim_provider` (platform-objects) — identity-provider
+  admin grids plus the register / verify-domain actions.
+- `sys_user_position` (plugin-security) — delegated position assignment
+  (`userActions` create/edit/delete); its sibling `sys_user_permission_set` was
+  already translated, so this closes an inconsistency.
+- `sys_import_job` (platform-objects) — import history / progress, alongside the
+  already-translated `sys_job` / `sys_job_run`.
+
+Adds each object to its package's `scripts/i18n-extract.config.ts` and supplies
+real zh-CN / ja-JP / es-ES translations across all four locale bundles, and
+extends the bundle-ownership guards' `OWNED_OBJECTS` to cover them. The
+orphan-only guards from #3502 could not catch this "owned-and-live-but-never-
+extracted" gap.

.changeset/notifications-redos-fix.md

@@ -0,0 +1,12 @@
+---
+"@objectstack/runtime": patch
+---
+
+fix(runtime): replace the polynomial-redos trailing-slash regex in the notifications domain with split+filter (CodeQL high, surfaced by #3507)
+
+The legacy `path.replace(/\/+$/, '')` in the notifications handler had
+carried a polynomial-backtracking regex over request-controlled input since
+ADR-0030; the domain extraction (#3507) made the line "changed code" and
+CodeQL flagged it. Same split+filter treatment the security domain already
+uses for the identical pattern. Redundant slashes in the sub-path now
+collapse (`//read//` → `read`), matching the security domain's semantics.

.changeset/prune-aspirational-config-3494.md

@@ -0,0 +1,56 @@
+---
+"@objectstack/spec": minor
+---
+
+feat(spec)!: prune the still-dead aspirational config from Theme / Translation / Webhook (#3494)
+
+Removes the authorable-but-never-consumed props confirmed dead by the 2026-06
+liveness audit (follow-up to #1878/#1893; same treatment as the #2377 and
+#3464 prunes). Authoring any of these was a silent no-op.
+
+## Removed
+
+**Theme** (`ThemeSchema`) — the theme engine (objectui `generateThemeVars`)
+never emitted or consumed them:
+- Props: `spacing`, `breakpoints`, `logo`, `density`, `wcagContrast`, `rtl`,
+  `touchTarget`, `keyboardNavigation`
+- Exports: `SpacingSchema`, `BreakpointsSchema`, `DensityModeSchema` (+
+  deprecated `DensityMode` alias), `WcagContrastLevelSchema` (+ deprecated
+  `WcagContrastLevel` alias), and the `Spacing` / `Breakpoints` /
+  `DensityMode` / `WcagContrastLevel` types
+
+**Translation** (`TranslationConfigSchema`) — no runtime reader; there is no
+ICU engine and interpolation is always simple `{variable}` substitution:
+- Props: `fileOrganization`, `messageFormat`, `lazyLoad`, `cache`
+- Exports: `MessageFormatSchema`, `TranslationFileOrganizationSchema`, and the
+  `MessageFormat` / `TranslationFileOrganization` types
+
+**Webhook** (`WebhookSchema`) — the delivery path always sends its own fixed
+envelope and only applies HMAC signing via `secret`; delivery retries are owned
+by the messaging outbox's fixed schedule:
+- Props: `body`, `payloadFields`, `includeSession`, `authentication`
+  (bearer/basic/api-key were never attached; HMAC via `secret` stays),
+  `retryPolicy`, `tags`
+- Exports: the entire inbound `WebhookReceiverSchema` + `WebhookReceiver` type
+  (never consumed by any runtime)
+
+## Migration
+
+Delete these keys from your configs — they never did anything, so removing
+them changes no behavior. Parsed output no longer contains the previously
+defaulted keys (`includeSession: false`, `fileOrganization: 'per_locale'`,
+`messageFormat: 'simple'`, `lazyLoad: false`, `cache: true`). Webhook HMAC
+signing (`secret`), `headers`, and `timeoutMs` are unaffected. File layout for
+translations remains a pure authoring convention — no config knob needed.
+
+## Deliberately NOT removed
+
+- Translation `supportedLocales` — it has a live reader (pinyin-search
+  capability toggle in `serve.ts`).
+- Job `retryPolicy` / `timeout` — being implemented (built, not pruned) in the
+  #3494 follow-up PR.
+- The materialized webhook props (`name`, `object`, `triggers`, `url`,
+  `method`, `headers`, `timeoutMs`, `secret`, `isActive`, `description`,
+  `label`) — live via the #3489 bridge; ledger flip tracked in #3490.
+
+Refs #3494, #1878, #1893.

.changeset/runtime-domain-extraction-batch3.md

@@ -0,0 +1,16 @@
+---
+"@objectstack/runtime": minor
+---
+
+feat(runtime): extract /keys, /storage and /ui dispatcher domain bodies — ADR-0076 D11 step ③, PR-3 (#2462)
+
+Continues the per-domain decomposition: three more handler bodies move out
+of `HttpDispatcher` into `domains/keys.ts` (incl. the zero-tolerance
+API-key-mint security contract), `domains/storage.ts` and `domains/ui.ts`,
+running on the explicit `DomainHandlerDeps` contract (extended with
+`getObjectQL` for the data-plane domains). The `/keys` legacy branch's
+`'/keys?'` query-string form is reproduced with a second registry entry;
+storage drops its strictly-redundant `kernel.services` index-access fallback
+(dead under Map-shaped services, duplicate under object-shaped ones). Thin
+`handleXxx` delegates remain for direct callers. Zero behavior change —
+locked by the 41-assertion http-conformance suite and 6 new seam tests.

.changeset/runtime-share-links-extraction.md

@@ -0,0 +1,15 @@
+---
+"@objectstack/runtime": minor
+---
+
+feat(runtime): extract the /share-links dispatcher domain body — ADR-0076 D11 step ③, PR-4 (#2462)
+
+The share-link capability-token surface (ADR-0047) moves out of
+`HttpDispatcher` into `domains/share-links.ts`. This is cloud's designed
+primary surface for per-env kernels (`registerShareLinkRoutes: false`, host
+dispatcher serves after kernel swap — the #2462 step-① re-scope finding), so
+the handler keeps working from the registry exactly as from the if-chain.
+`DomainHandlerDeps` grows `getRequestKernelService` (reads off the
+per-request RESOLVED kernel — the engine the shareLinks service is bound to)
+and `routeNotFound` (the shared 404 envelope). Zero behavior change — locked
+by http-conformance (41) and 5 new seam tests incl. token-resolve redaction.

content/docs/automation/approvals.mdx

@@ -143,8 +143,50 @@ one node, no parallel branches needed:
 A single **rejection** always finalizes the node as `rejected` (one veto), in
 every mode. `minApprovals` is clamped to the resolvable approver count / group
 size, so it can never deadlock. A decision may also carry `attachments` (file
-references) recorded on its audit row — e.g. a signed contract. Weighted voting
-and approval-matrix governance are enterprise, not here.
+references) recorded on its audit row — e.g. a signed contract — and, when the
+node declares `decisionOutputs`, structured `outputs` the flow receives as
+`<nodeId>.<key>` variables (see [Dynamic approvers](#dynamic-approvers-3447)
+below). Weighted voting and approval-matrix governance are enterprise, not here.
+
+## Dynamic approvers (#3447) [#dynamic-approvers-3447]
+
+Two approver kinds bind to **live** data at the moment the node is entered —
+not the submit-time snapshot — so a step can route on data produced after
+submit:
+
+- **`field`** reads the record's live field value at node entry. An earlier
+  step (or an earlier step's approver) can write the routing field mid-flow and
+  the next approval node sees it; a multi-select user field fans out into one
+  approver slot per user.
+- **`expression`** computes the slate with a CEL expression over exactly three
+  roots: **`current.*`** (the record's live state at node entry), **`trigger.*`**
+  (the submit-time snapshot — what a flow condition calls `record`), and
+  **`vars.*`** (flow variables, including node outputs and `vars.previous`).
+  `record` and bare field names are deliberately unavailable — at an approval
+  node "the record" is ambiguous between two times, so the expression must say
+  which one; referencing anything else fails the node loudly at entry rather
+  than resolving a silently-empty slate. The optional
+  `resolveAs: 'user' (default) | 'department' | 'position' | 'team'` re-expands
+  each resolved id through the same graph lookups the static types use — and
+  with `behavior: 'per_group'`, each intermediate value (e.g. each returned
+  department) forms its own sign-off group.
+
+A result may legitimately be **empty** (a present-but-empty field or variable);
+the node-level `onEmptyApprovers` policy decides what that means —
+`admin_rescue` (default: the request opens, a privileged admin takes over via
+Reassign), `fail` (the node fails: an empty slate is a config bug), or
+`auto_approve` (skip the request and continue down `approve` with
+`output.autoApproved = true`; opt-in, since it waves the record through). A
+**missing** key (`vars.never_written`) is a loud error instead — guard
+genuinely-optional inputs with `has(vars.x) ? vars.x : []`.
+
+The "previous approver picks the next step's approvers" loop needs no record
+field at all: declare `decisionOutputs: ['next_reviewers']` on node A, have the
+approver decide with `{ outputs: { next_reviewers: ['u2', 'u3'] } }`, and let
+node B's approver be
+`{ type: 'expression', value: 'vars.<nodeA-id>.next_reviewers' }`. The author
+declares output keys, approvers only fill values; undeclared keys reject the
+decision, and `decision` / `requestId` are reserved.
 
 ## The full lifecycle — submit to field change
 
@@ -165,9 +207,12 @@ Only `approvers` is required on the node; everything else has a default
 (`behavior: 'first_response'`, `lockRecord: true`, `maxRevisions: 3`).
 
 Approver entries resolve by kind — `position`, `user`, `field`, `manager`,
-`team`, `department`, `queue`, and `org_membership_level`, described in the
-[callout above](#3-the-approval-node), which is the one that silently resolves
-to nobody when it's mistaken for a business hierarchy. An entry that resolves
+`team`, `department`, `queue`, `org_membership_level`, and `expression`
+(described in the [callout above](#3-the-approval-node) and in
+[Dynamic approvers](#dynamic-approvers-3447)); `org_membership_level` is the
+one that silently resolves to nobody when it's mistaken for a business
+hierarchy. `field`, `manager`, and `expression` resolve against the record's
+**live** state at node entry (#3447). An entry that resolves
 to nobody is not an error: the request opens with an empty `pending_approvers`
 and nothing can move it, so the run parks forever.
 
@@ -246,7 +291,7 @@ continuity levers on the same request. All are `POST
 
 | Verb | Route | Who | Effect |
 |:---|:---|:---|:---|
-| `approve` / `reject` | `/approve` `/reject` | pending approver | Records the decision (finalizes per `behavior`). Accepts `comment`, `attachments`. |
+| `approve` / `reject` | `/approve` `/reject` | pending approver | Records the decision (finalizes per `behavior`). Accepts `comment`, `attachments`, and — when the node declares `decisionOutputs` — structured `outputs` handed to the flow as `<nodeId>.<key>` variables. |
 | `reassign` | `/reassign` | pending approver | Hands one slot to another user (`to`); the request stays pending. |
 | `revise` (send back) | `/revise` | pending approver | Ends this round as **`returned`**, unlocks the record for rework (ADR-0044). |
 | `request-info` | `/request-info` | pending approver | Asks the submitter for more info; the request **stays pending**. `comment` required. |