chore: ADR-0055 Accepted + changeset; fix pre-existing app-showcase typecheck

- ADR-0055 status → Accepted (implemented in this PR, P0–P2).
- changeset for the controlled-by-parent feature (spec/plugin-security/verify minor).
- fix(app-showcase): task-triage userFilters tabs were missing the now-required
  pinned/isDefault/visible fields (a pre-existing main breakage from #2048 that
  reddened TypeScript Type Check on every PR) — examples typecheck now green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XVdnfUAx85amkerym26vdx

Author: claude

.changeset/master-detail-controlled-by-parent.md

@@ -0,0 +1,15 @@
+---
+"@objectstack/plugin-security": minor
+"@objectstack/spec": minor
+"@objectstack/verify": minor
+---
+
+Master-detail "controlled by parent" permissions (ADR-0055).
+
+A detail object can now declare `sharingModel: 'controlled_by_parent'`: its read/write access is derived from its master record, with no authored RLS.
+
+- `@objectstack/spec`: `controlled_by_parent` added to the authorable `object.sharingModel` enum.
+- `@objectstack/plugin-security`: reads inject `masterFK IN (accessible master ids)` (resolved from the master's own RLS, reusing the existing filter machinery — zero RLS-compiler changes); by-id writes (insert/update/delete) to a detail now require edit access to its master, closing the #1994-class by-id hole for derived access.
+- `@objectstack/verify`: related-record **topological synthesis** — `deriveCrudCases` no longer skips objects with required relations; it builds the object dependency graph, orders it topologically, and threads real target ids, so relationship-dense objects (and the master-detail RLS proof) are verifiable. Honest `blocked` verdicts remain for required-reference cycles and external/missing targets.
+
+v1 limits (per ADR-0055): the accessible-master id set is unbounded (large-tenant scale is a documented future limit), and master-detail chains are single-level (not transitively traversed).

docs/adr/0055-master-detail-controlled-by-parent.md

@@ -1,6 +1,6 @@
 # ADR-0055: Master-detail "controlled by parent" permissions — derived access via pre-resolved master-id membership
 
-**Status**: Proposed (2026-06-19)
+**Status**: Accepted (2026-06-19) — implemented in this PR (P0–P2)
 **Deciders**: ObjectStack Protocol Architects
 **Builds on**: [ADR-0049](./0049-no-unenforced-security-properties.md) (enforce-or-remove), [ADR-0054](./0054-runtime-proof-for-authorable-surface.md) (prove-it-runs)
 **Surfaced by**: an audit of master-detail permission semantics — `OWDModel.controlled_by_parent` is **declared but unenforced** (zero runtime consumers; not reachable through the object's `sharingModel` enum; the RLS compiler is relationship-blind). This is *false compliance* (ADR-0049) and *unproven liveness* (ADR-0054).

examples/app-showcase/src/pages/task-triage.page.ts

@@ -33,10 +33,10 @@ export const TaskTriagePage: Page = {
       element: 'tabs',
       showAllRecords: true,
       tabs: [
-        { name: 'in_progress', label: 'In Progress', filter: [{ field: 'status', operator: 'equals', value: 'in_progress' }] },
-        { name: 'urgent', label: 'Urgent', icon: 'flame', filter: [{ field: 'priority', operator: 'equals', value: 'urgent' }] },
-        { name: 'in_review', label: 'In Review', filter: [{ field: 'status', operator: 'equals', value: 'in_review' }] },
-        { name: 'done', label: 'Done', filter: [{ field: 'status', operator: 'equals', value: 'done' }] },
+        { name: 'in_progress', label: 'In Progress', pinned: false, isDefault: false, visible: true, filter: [{ field: 'status', operator: 'equals', value: 'in_progress' }] },
+        { name: 'urgent', label: 'Urgent', icon: 'flame', pinned: false, isDefault: false, visible: true, filter: [{ field: 'priority', operator: 'equals', value: 'urgent' }] },
+        { name: 'in_review', label: 'In Review', pinned: false, isDefault: false, visible: true, filter: [{ field: 'status', operator: 'equals', value: 'in_review' }] },
+        { name: 'done', label: 'Done', pinned: false, isDefault: false, visible: true, filter: [{ field: 'status', operator: 'equals', value: 'done' }] },
       ],
     },