Merge origin/main into claude/formviewschema-button-defaults-77q7fs

Conflict resolution: content/docs/references/ui/view.mdx (auto-generated)
regenerated via gen:docs on the merged tree; api-surface.json auto-merge
verified identical to regenerated output; json-schema.manifest.json
(disappearance ratchet, #3012, new on main) picks up +ui/FormButtonConfig.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013Ue47V8zZ5QhcYMPiRQDA7

Author: claude

.changeset/adr-0076-honest-capabilities-framework-slice.md

@@ -0,0 +1,42 @@
+---
+'@objectstack/spec': minor
+'@objectstack/runtime': minor
+'@objectstack/metadata-protocol': minor
+'@objectstack/objectql': patch
+'@objectstack/rest': patch
+'@objectstack/plugin-hono-server': patch
+---
+
+feat(discovery): honest capabilities — standardized stub/fallback marker + realtime route honesty (ADR-0076 D12/A1.5 framework slice, #2462)
+
+**Spec** — new service self-description marker for honest discovery
+(ADR-0076 D12): `SERVICE_SELF_INFO_KEY` (`__serviceInfo`),
+`ServiceSelfInfoSchema` / `ServiceSelfInfo`, and `readServiceSelfInfo()`,
+which also normalizes plugin-dev's legacy `_dev: true` flag to
+`{ status: 'stub', handlerReady: false }`. A registered service that is a
+stub / dev fake / degraded fallback self-identifies via this marker; a fully
+real service carries no marker.
+
+**Runtime + metadata-protocol** — both discovery builders
+(`HttpDispatcher.getDiscoveryInfo` and the protocol shim's `getDiscovery`)
+now honor the marker instead of hardcoding `status: 'available',
+handlerReady: true` for every registered service. Dev stubs report `stub`,
+the ObjectQL analytics fallback reports `degraded` (it keeps serving — no
+`/analytics` 404), and consumers can finally trust
+`status === 'available'` / `handlerReady === true`.
+
+**Realtime honesty fix** — discovery no longer advertises a
+`/realtime` route or `websockets: true`: `service-realtime` is an
+in-process pub/sub bus, no dispatcher branch or plugin mounts any
+`/realtime` HTTP surface, so the advertised route always 404'd. The
+registered service now reports `status: 'degraded', handlerReady: false`
+with no route (clients using the SDK are unaffected — it falls back to the
+conventional path, which behaves exactly as before). Also corrects the
+advertised realtime provider from the nonexistent `plugin-realtime` to
+`service-realtime`.
+
+**REST (A1.5)** — the REST layer's protocol dependency is narrowed from the
+`ObjectStackProtocol` god-union to the new `RestProtocol =
+DataProtocol & MetadataProtocol` slice (exported from
+`@objectstack/rest`), per the ADR-0076 D9 incremental narrowing guidance.
+Type-level only; no runtime change.

.changeset/adr-0085-2548-followups.md

@@ -0,0 +1,17 @@
+---
+'@objectstack/lint': patch
+'@objectstack/plugin-audit': patch
+---
+
+ADR-0085 #2548 follow-ups surfaced by the real-backend browser pass:
+
+- **lint**: new `field-group-shadowed` warning in `validate-semantic-roles` — a
+  declared fieldGroup whose every visible member is hoisted into the detail
+  highlight strip (or is the record title) renders on forms but silently never
+  on detail pages (detail bodies hide the first 4 highlightFields). Warning
+  tier, same as the other semantic-role rules.
+- **plugin-audit**: feed/audit summaries ("Created … / Deleted … / Updated …")
+  now name the object by its display label ("Semantic Zoo") instead of its API
+  name ("showcase_semantic_zoo") — these strings render verbatim in the record
+  Discussion feed and Setup dashboards. Falls back to the API name when the
+  object definition isn't resolvable. Existing stored rows are unchanged.

.changeset/adr-0085-pr4-renderviaschema-comment-2548.md

@@ -0,0 +1,14 @@
+---
+'@objectstack/spec': patch
+---
+
+docs(spec): retire the stale `renderViaSchema` forward-reference now that objectui#2546 landed (ADR-0085 PR4 follow-up, #2548)
+
+The `ObjectSchema` source comment forward-referenced `renderViaSchema`
+retiring "together with the legacy monolith render path" — a promise about
+work that had not yet shipped. That path, and the `detail.renderViaSchema`
+kill-switch that was its only steering wheel, were removed in objectui#2546
+(ADR-0085 PR4). The comment now records the completed state with a breadcrumb
+to that PR instead of a forward reference, closing the cleanup #2546 flagged.
+
+Comment-only change; no type, schema, or runtime behavior is affected.

.changeset/adr-0096-openapi-spec-file-path.md

@@ -0,0 +1,36 @@
+---
+'@objectstack/spec': minor
+'@objectstack/service-automation': minor
+'@objectstack/connector-openapi': minor
+'@objectstack/cli': minor
+---
+
+feat(connector-openapi): resolve `providerConfig.spec` from a package-relative file path (#3016, ADR-0096 follow-up)
+
+ADR-0096's canonical example authors an OpenAPI-backed instance as
+`providerConfig: { spec: './billing-openapi.json' }`, but the landed `openapi`
+provider factory only accepted an inline document object or an http(s) URL.
+The spec union is now complete: **inline object | file path | remote URL**.
+
+- **`@objectstack/spec`.** `ConnectorProviderContext` gains an optional
+  host-injected `loadPackageFile(relativePath)` capability (pure type): reads a
+  UTF-8 file resolved against the declaring stack/package root, confined to
+  that root. `undefined` on hosts without a filesystem.
+
+- **`@objectstack/service-automation`.** New `packageRoot` plugin option (the
+  base for relative file refs; defaults to `process.cwd()`) and an exported
+  `createPackageFileLoader(packageRoot)` that implements the confinement
+  guard — absolute paths and `..`-escaping paths are rejected — with lazy
+  `node:fs`/`node:path` imports so non-Node hosts only fail if a file ref is
+  actually dereferenced. The materializer injects the capability into every
+  provider factory's context. Failures follow the existing reconcile policy:
+  **fatal at boot, entry skipped on reload**.
+
+- **`@objectstack/connector-openapi`.** A string `providerConfig.spec` that is
+  not an http(s) URL is now read via `ctx.loadPackageFile` and parsed as an
+  OpenAPI JSON document (clear errors for missing/unreadable files, unparseable
+  JSON, and hosts without package file access).
+
+- **`@objectstack/cli`.** `serve`/`dev` pass the project folder (the
+  `objectstack.config.ts` directory) as the automation service's `packageRoot`,
+  mirroring how the standalone sqlite default is anchored.

.changeset/adr-0096-runtime-rematerialization.md

@@ -0,0 +1,26 @@
+---
+'@objectstack/service-automation': minor
+---
+
+feat(connectors): ADR-0096 runtime re-materialization of declarative connectors (#2977 follow-up)
+
+Provider-bound declarative `connectors:` instances (ADR-0096) previously
+materialized only at boot — a connector published from Studio while the server
+ran did not become dispatchable until a restart. `materializeDeclaredConnectors`
+is now a **reconcile** run both at boot and on `metadata:reloaded`:
+
+- **Add** newly-declared instances, **tear down** removed / newly-`enabled:false`
+  ones (calling their `close`, e.g. an MCP connection), and **re-materialize**
+  only instances whose signature — a stable hash of `provider` + `providerConfig`
+  + `auth` + identity — changed. An unchanged MCP instance is never needlessly
+  reconnected on an unrelated metadata reload.
+- **Boot stays fatal** ("fail loudly"): unknown provider / invalid providerConfig
+  / unresolvable credentialRef / name conflict aborts startup. **Reload is soft**:
+  the same problems are logged and the offending entry skipped, so a bad publish
+  never crashes a running server; a changed instance's old connector keeps
+  serving until its replacement materializes successfully.
+
+Also: `ConnectorDescriptor` (served by `GET /api/v1/automation/connectors`) now
+carries an `origin` field (`'plugin' | 'declarative'`), so a designer can
+distinguish a materialized declarative instance from a plugin-registered
+connector.

.changeset/config.json

@@ -41,6 +41,7 @@
       "@objectstack/plugin-email",
       "@objectstack/plugin-hono-server",
       "@objectstack/mcp",
+      "@objectstack/plugin-pinyin-search",
       "@objectstack/plugin-reports",
       "@objectstack/plugin-security",
       "@objectstack/plugin-sharing",

.changeset/console-092bd859934f.md

@@ -0,0 +1,48 @@
+---
+"@objectstack/console": patch
+---
+
+Console (objectui) refreshed to `092bd859934f`. Frontend changes in this range:
+
+- fix(app-shell): bind current_user.positions into the client predicate scope; align role-gating examples (#1583 / ADR-0058) (#2573)
+- feat(app-shell): CEL lint + field autocomplete for condition predicates (#1582) (#2567)
+- fix(detail): gate related lists on the current user's child-object read permission (#2359) (#2565)
+- feat(flow-designer): connector picker lists dispatchable connectors + marks declarative instances (#2563)
+- feat(app-shell): Studio CEL editor for list-view conditional formatting (#1584 / #1582) (#2558)
+- fix(fields): resolve lookup chip display name via referenced object schema, not the autonumber-prone key heuristic (#2357) (#2551)
+- feat(kanban): accept CEL { condition, style } conditional-formatting rules (#1584 follow-up) (#2550)
+- fix(plugin-grid): sniff CSV encoding in import wizard (GB18030 fallback) (#2557)
+- feat(detail): editable record highlights on the shared inline-edit draft (#2549)
+- fix(spec-bridge/form): #2545 stop dropping spec FormViewSchema keys; normalize legacy groups → sections (#2552)
+- feat(flow-designer): localize palette headings + cloud-sync recents + guide (#2553)
+- fix(studio): refresh builder top-bar name after a package rename (#2554)
+- feat(core): B3 cascading-option guardrail, role-gated demo, ADR + browser e2e (#1583) (#2547)
+- feat(list): unify conditional formatting + row-action visibility onto the CEL engine (#1584) (#2544)
+- feat(detail): record-level inline edit — shared InlineEditContext + one atomic Save (#2542)
+- feat(flow-designer): search box + keyboard nav + recents in the add-node palette (#2543)
+- feat(kanban): default card fields to object highlightFields (ADR-0085, #2162) (#2541)
+- fix(types/plugin-grid): #1763 declare spec-canonical bulkActions on ObjectGridSchema (#2539)
+- fix(attachments): download attachments via authenticated signed URL (framework #2970)
+- feat(studio): spec-driven package create/edit/view form in a modal (#2535)
+- fix(permissions/fields): #2926 ④⑧ — FLS fail-open + lookup display_field (#2537)
+- feat(app-shell): CEL authoring safety for RLS policies — lint, field autocomplete, test-run (#2533)
+- fix(auth): gate DeviceAuthPage on features.deviceAuthorization (framework#2874 / #2513) (#2536)
+- fix(app-shell): close view config panel on discard in edit mode (#2320)
+- feat(metadata-admin): create form-family views through the View create UI (#2531)
+- fix(app-shell): render action's objectName as an object selector (#2325)
+- fix(components): exit inline edit mode for injected cell editors (#2534)
+- fix(attachments): authenticated uploads + friendly denial copy in RecordAttachmentsPanel (#2755) (#2532)
+- feat(components): page:tabs honors item-level visibleWhen — conditional tabs (framework#2606) (#2516)
+- feat(metadata-admin): page variable source is a component picker (#2328) (#2523)
+- fix(studio-design): make object canvas overridable via studio-canvas-preview registry (#2337) (#2527)
+- fix(metadata-admin): seed flow createDefaults with required `type` (#2525)
+- fix(metadata-admin): give hook create form a createSchema so object renders as a ref:object picker (#2521)
+- feat(studio): enforce package namespace prefix at authoring time (framework#2694) (#2524)
+- fix(app-shell): render View create-form Object field as ref:object picker (#2526)
+- feat(components): add `variant === 'primary'` tie-break to action:bar ordering (#2339) (#2519)
+- fix(build): stop TS6059 rootDir errors in dts build across 21 packages (#2520)
+- fix(app-nav): exclude record-detail pages from the 'page' nav picker (#2333) (#2517)
+- fix(plugin-report): stop TS6059 rootDir errors in dts build (#2334) (#2518)
+- feat(flow-designer): add 'position' xRef picker kind for approval approvers / escalateTo (#2778) (#2515)
+
+objectui range: `cc2156841787...092bd859934f`

.changeset/dashboard-filter-spec-pairing.md

@@ -0,0 +1,22 @@
+---
+'@objectstack/spec': minor
+---
+
+Dashboard-level filters spec pairing (framework#2501, objectui#2578) — land the
+two properties the objectui runtime already ships (objectui#2576) so the
+protocol and the renderer agree:
+
+- **`GlobalFilterSchema.name`** (optional string) — stable filter name used as
+  the dashboard-variable key (readable in widget expressions as `page.<name>`)
+  and as the key widgets reference in `filterBindings`. Defaults to `field`;
+  `"dateRange"` is reserved for the built-in dashboard date range.
+- **`DashboardWidgetSchema.filterBindings`** (optional
+  `Record<string, string | false>`) — per-widget binding from a dashboard
+  filter name to one of THIS widget's fields: a string re-targets the filter to
+  that field, `false` opts the widget out, absent falls back to the filter's
+  own `field`.
+
+Purely additive — existing dashboards parse unchanged. The metadata-admin
+dashboard inspector (objectui `dashboard-schema.ts`) derives its form from this
+schema via `z.toJSONSchema`, so both properties surface there automatically
+once objectui picks up this spec version.

.changeset/docs-3003-readonly-server-enforced.md

@@ -0,0 +1,16 @@
+---
+'@objectstack/spec': patch
+---
+
+docs(spec): `readonly` is server-enforced on UPDATE, not a UI-only affordance (#3003)
+
+The `readonly` field property was described as "Read-only in UI", which #3003
+proved to be exactly how integrators read it — approval/status/amount columns
+protected only by `readonly: true` were forged with a direct REST `PATCH`,
+self-approving a multi-stage approval on the released 15.0.0. Since #2948 the
+engine strips caller-supplied writes to statically-readonly fields from every
+non-system UPDATE (single-id and multi-row, symmetric with `readonlyWhen`;
+INSERT may still seed the column). The schema description and the field
+liveness ledger now state the server-side contract, and a dogfood conformance
+proof (`showcase-static-readonly.dogfood.test.ts` + an authz-matrix row) pins
+it end-to-end so it cannot silently regress to renderer-only.

.changeset/graphql-realtime-identity-2992.md

@@ -0,0 +1,38 @@
+---
+'@objectstack/runtime': patch
+'@objectstack/spec': patch
+'@objectstack/service-realtime': patch
+---
+
+fix(security): pre-wiring identity admission for the GraphQL and realtime surfaces (#2992, ADR-0096 D4)
+
+Two latent execution surfaces — neither reachable by a client today — would
+have fallen open the instant a real transport was wired, because both drop or
+lack the caller's identity. Per ADR-0096, the identity story is fixed and
+pinned in CI *before* wiring, not after an adversarial review:
+
+- **GraphQL (surface 1 — latent context-drop, now threaded).**
+  `handleGraphQL` passed only `{ request }` to `kernel.graphql`, dropping the
+  resolved `ExecutionContext` — the moment a real engine resolved objects
+  through ObjectQL it would have run context-less (security middleware falls
+  OPEN on a missing principal = full authority). The entry point now resolves
+  the caller identity even on the direct dispatcher-plugin route and even when
+  `requireAuth` is off, and threads it as `options.context`;
+  `IGraphQLService.execute` documents that implementations MUST forward it to
+  every data-engine call. Unit-proven; the authz conformance matrix pins the
+  threading (`graphql-identity-thread` row) so removing it goes STALE and
+  fails CI.
+
+- **realtime (surface 2 — no per-recipient authz seam, posture registered).**
+  Delivery is a pure fan-out (subscriptions carry no principal,
+  `matchesSubscription` filters only by object+eventTypes, the engine
+  publishes the full `after` row), safe only while every subscriber is
+  server-internal. The posture is now registered as an `experimental` matrix
+  row (`realtime-delivery-authz`) stating the admission requirement
+  (per-recipient RLS/FLS/tenant re-check on delivery, or id-only payload +
+  client re-fetch), and transport TRIPWIRE probes turn any newly wired
+  WebSocket/SSE/subscribe/client transport into an UNCLASSIFIED surface → red
+  CI until the identity story ships with it. The `service-realtime` README —
+  which advertised `authorizeChannel`/`broadcastToUser`/presence auth that do
+  not exist — is rewritten to describe the real, trusted-internal-only
+  surface, and the contract docs carry the admission requirement at the seam.