Merge origin/main into claude/public-form-owner-bypass-ds4orf

Integrates PR #3018 (owner_id anchor guard + bulk write scoping, #3004/#2982).
Conflict: authz-conformance.matrix.ts — kept both sides' new ledger rows
(ownership-anchor-guard, bulk-write-owner-scoping, public-form-managed-anchors).
api-surface.json regenerated post-merge (check passes).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Lr7QwD4Fx9KYkLH1xDMwEo

Author: claude

.changeset/dashboard-filter-spec-pairing.md

@@ -0,0 +1,22 @@
+---
+'@objectstack/spec': minor
+---
+
+Dashboard-level filters spec pairing (framework#2501, objectui#2578) — land the
+two properties the objectui runtime already ships (objectui#2576) so the
+protocol and the renderer agree:
+
+- **`GlobalFilterSchema.name`** (optional string) — stable filter name used as
+  the dashboard-variable key (readable in widget expressions as `page.<name>`)
+  and as the key widgets reference in `filterBindings`. Defaults to `field`;
+  `"dateRange"` is reserved for the built-in dashboard date range.
+- **`DashboardWidgetSchema.filterBindings`** (optional
+  `Record<string, string | false>`) — per-widget binding from a dashboard
+  filter name to one of THIS widget's fields: a string re-targets the filter to
+  that field, `false` opts the widget out, absent falls back to the filter's
+  own `field`.
+
+Purely additive — existing dashboards parse unchanged. The metadata-admin
+dashboard inspector (objectui `dashboard-schema.ts`) derives its form from this
+schema via `z.toJSONSchema`, so both properties surface there automatically
+once objectui picks up this spec version.

.changeset/formview-buttons-defaults.md

@@ -0,0 +1,21 @@
+---
+'@objectstack/spec': minor
+---
+
+feat(spec): structured `buttons` + `defaults` config on `FormViewSchema` (#2998)
+
+`FormViewSchema` gains two optional top-level keys — the spec home for the flat
+renderer-invented form config ObjectUI's `ObjectForm` reads today
+(`showSubmit`/`submitText`/`showCancel`/`cancelText`/`showReset`/`initialValues`,
+objectui#2545), which the strip-mode container silently discards:
+
+- **`buttons`** — structured action-button config: per-button `{ show, label }`
+  for `submit` / `cancel` / `reset` (new exported leaf `FormButtonConfigSchema`,
+  `.strict()` per ADR-0089 D3a so typo'd keys error loudly).
+- **`defaults`** — initial field values for create-mode forms, keyed by field
+  machine name (absorbs ObjectUI's `initialValues`).
+
+Both are marked `[EXPERIMENTAL — NOT ENFORCED]` per ADR-0078's escape hatch
+until the ObjectUI renderer reads them (tracked in objectui#2545); authoring
+them today is declared, not yet honored. Purely additive — no existing key
+changes shape, no tombstone needed.

.changeset/lazy-schema-tojsonschema-identity.md

@@ -0,0 +1,11 @@
+---
+'@objectstack/spec': patch
+---
+
+fix(spec): keep `lazySchema` proxies identity-compatible with `z.toJSONSchema` (objectui#2561)
+
+zod's `toJSONSchema` keys its `seen` map on the node object it traverses — the `lazySchema` Proxy wherever a schema is referenced lazily (`z.lazy(() => X)` recursion getters, direct conversion roots) — while its wrapper-type processors (pipe/lazy/optional/default/…) look themselves up via the REAL instance captured at construction (`inst._zod.processJSONSchema = (ctx, …) => pipeProcessor(inst, …)`). The identity mismatch crashed conversion with `Cannot set properties of undefined (setting 'ref')`.
+
+This stayed latent while lazy-referenced schemas were plain objects (the object processor never looks itself up); ADR-0089 D3a turned `PageComponentSchema` / `FormFieldSchema` into `.strict().transform(…)` **pipes**, which broke ObjectUI Studio's spec-derived Page/View inspector JSONSchema derivation under spec 15.
+
+Fix: the proxy now serves a memoised `_zod` facade that prototype-delegates to the real internals and wraps only `processJSONSchema` to alias the proxy's `seen` entry onto the real instance before delegating. Parse behavior is unchanged; `OS_EAGER_SCHEMAS=1` remains the bypass. Regression tests cover the D3a pipe shape, recursion through `z.lazy(() => proxy)`, mixed proxy+real traversal, and the full `PageSchema` / `ViewSchema` Studio derivation paths.

.changeset/owner-id-anchor-and-bulk-write-scoping.md

@@ -0,0 +1,60 @@
+---
+'@objectstack/plugin-security': patch
+'@objectstack/objectql': patch
+'@objectstack/plugin-sharing': patch
+---
+
+fix(security): guard the `owner_id` ownership anchor and scope bulk writes to owner-visible rows (#3004, #2982)
+
+Two write-path holes on the row-ownership anchor (`owner_id`), the column OWD
+row-level scoping keys off to decide who may update/delete a record.
+
+- **#3004 — client-writable, unguarded `owner_id`.** The anchor is deliberately
+  not `readonly` (ownership is transferable), so the static-readonly strip never
+  covered it and FLS doesn't gate it by default. A non-privileged writer could
+  therefore `insert` a record under someone else's name (forge) or `update` one
+  to a new owner (transfer / disown), evading the owner gate that governs
+  update/delete. The security middleware (plugin-security step 3.5) now treats
+  `owner_id` as system-managed for non-privileged writers: on insert an empty
+  value is auto-stamped to the acting user (batch rows too — previously only the
+  single-record path stamped, leaving bulk-inserted rows NULL-owned and
+  invisible to their creator), and a supplied foreign owner is denied; on update
+  a supplied `owner_id` is a transfer/disown and is denied — the unchanged no-op
+  echo of a form save is tolerated via a pre-image compare, and a bulk
+  change-set carrying `owner_id` fails closed. A non-scalar `owner_id`
+  (array/object) is rejected outright rather than string-coerced, and the
+  change-set membership test uses own-property semantics so a polluted
+  prototype cannot spoof an ownership write. Both require the transfer grant
+  (`allowTransfer`, or `modifyAllRecords` which implies it) to proceed. System
+  context (`ctx.isSystem`) stays fully exempt (OAuth provisioning / cron
+  snapshots / seed claims / migrations), and under delegation both principals
+  must hold the grant (ADR-0090 D10 intersection). Note a REST **import** runs
+  under the importer's own context (not `isSystem`), so a non-privileged user
+  importing a CSV whose `owner_id` column names other users is correctly denied
+  unless they hold the transfer grant — administrators (who carry
+  `modifyAllRecords`) are unaffected.
+
+- **#2982 — bulk writes skipped owner scoping on OWD-`private` objects.** A
+  `update({ multi: true })` / bulk delete rebuilt the driver AST from
+  `options.where` AFTER the middleware chain, discarding the owner/RLS write
+  filter that plugin-sharing (`buildWriteFilter`) and plugin-security compose
+  onto `opCtx.ast` — so a member's bulk write hit every matching row, including
+  peers'. The engine now seeds `opCtx.ast` from the caller's predicate BEFORE the
+  chain (the same seam reads use) and hands the middleware-composed AST to
+  `driver.updateMany` / `driver.deleteMany`, so bulk writes are constrained to the
+  rows the caller may edit — matching single-id write behavior. `delete` now
+  applies the same scalar-`id` guard `update` already had, so an id-list bulk
+  delete (`where: { id: { $in: […] } }, multi: true`) is owner-scoped too, and
+  both multi branches fail CLOSED (throw) rather than silently rebuilding an
+  unscoped predicate if the row-scoping AST is ever absent.
+
+  Consequences of routing bulk writes through the AST: the anti-oracle
+  predicate guard now also applies to bulk `update`/`delete` (a bulk write
+  filtering on an FLS-unreadable field is rejected, as reads already are), and a
+  principal-less (no-`userId`, non-system) bulk write on an owner-scoped object
+  now correctly affects zero rows instead of all of them.
+
+Proven end-to-end on the real showcase app
+(`packages/dogfood/test/owner-anchor-and-bulk-writes.dogfood.test.ts`) and pinned
+in the ADR-0096 authz-conformance ledger (`ownership-anchor-guard`,
+`bulk-write-owner-scoping`).

content/docs/data-modeling/queries.mdx

@@ -367,6 +367,19 @@ Only `query` and `fields` are implemented. The engine expands `search` into a dr
 are always AND-ed regardless of `operator`.
 </Callout>
 
+### Pinyin recall (Chinese deployments)
+
+When pinyin search is enabled (`OS_SEARCH_PINYIN_ENABLED` — auto-on when the stack's
+i18n config lists any `zh-*` locale, see
+[Environment Variables → Search](/docs/deployment/environment-variables#search)), records
+with CJK names are also found by typing their **full pinyin** or **initials**: searching
+`zhangwei` or `zw` matches a record named `张伟`, alongside the normal CJK and latin
+matching. This is transparent to queries and clients — the platform maintains a hidden
+`__search` companion column derived from each object's display/name field and ORs it into
+the expanded filter; `fields` semantics, `searchableFields`, and drivers are unchanged
+(ADR-0097). Relevance ranking and typo tolerance remain Tier-2 (native FTS) and are not
+part of this.
+
 ---
 
 ## Window Functions

content/docs/deployment/environment-variables.mdx

@@ -235,6 +235,26 @@ OS_MCP_SERVER_ENABLED=true os start     # additionally auto-start the stdio tran
 
 ---
 
+## Search
+
+Pinyin recall for `$search` (ADR-0097): with the switch on, every object's
+display/name field gets a hidden, platform-maintained companion column storing
+full pinyin + initials ("张伟" → "zhangwei zw"), so lookup pickers, list
+quick-search and ⌘K match `zhangwei` / `zw` against CJK names — transparently,
+with no client or object changes.
+
+```bash
+os start                                  # auto-on when the stack's i18n config lists any zh-* locale
+OS_SEARCH_PINYIN_ENABLED=true os start    # force on regardless of locales
+OS_SEARCH_PINYIN_ENABLED=false os start   # force off (e.g. a zh-locale stack that doesn't want the extra column)
+```
+
+| Variable | Type | Default | Description |
+|:---|:---|:---|:---|
+| `OS_SEARCH_PINYIN_ENABLED` | boolean | locale-derived | Pinyin search recall. When unset, the default derives from the stack's configured locales (`i18n.defaultLocale` / `supportedLocales` / `fallbackLocale`): any `zh-*` locale turns it on; an explicit value always wins. Gates both the compile-time `__search` companion column and the `plugin-pinyin-search` populate hooks, so there is no half-state. Off ⇒ no extra column, and `pinyin-pro` is never loaded. |
+
+---
+
 ## Marketplace & Metadata
 
 | Variable | Type | Default | Description |

content/docs/references/ui/view.mdx

@@ -16,8 +16,8 @@ Migrated to shared/http.zod.ts. Re-exported here for backward compatibility.
 ## TypeScript Usage
 
 ```typescript
-import { AddRecordConfig, AppearanceConfig, CalendarConfig, ColumnSummary, FormField, FormSection, FormView, GalleryConfig, GanttConfig, GanttQuickFilter, GroupingConfig, GroupingField, KanbanConfig, ListChartConfig, ListColumn, ListView, NavigationConfig, NavigationMode, ObjectListView, ObjectUserFilters, PaginationConfig, RowColorConfig, RowHeight, SelectionConfig, TimelineConfig, TreeConfig, UserActionsConfig, UserFilterField, UserFilters, View, ViewData, ViewFilterRule, ViewItem, ViewItemName, ViewKind, ViewScope, ViewSharing, ViewTab, VisualizationType } from '@objectstack/spec/ui';
-import type { AddRecordConfig, AppearanceConfig, CalendarConfig, ColumnSummary, FormField, FormSection, FormView, GalleryConfig, GanttConfig, GanttQuickFilter, GroupingConfig, GroupingField, KanbanConfig, ListChartConfig, ListColumn, ListView, NavigationConfig, NavigationMode, ObjectListView, ObjectUserFilters, PaginationConfig, RowColorConfig, RowHeight, SelectionConfig, TimelineConfig, TreeConfig, UserActionsConfig, UserFilterField, UserFilters, View, ViewData, ViewFilterRule, ViewItem, ViewItemName, ViewKind, ViewScope, ViewSharing, ViewTab, VisualizationType } from '@objectstack/spec/ui';
+import { AddRecordConfig, AppearanceConfig, CalendarConfig, ColumnSummary, FormButtonConfig, FormField, FormSection, FormView, GalleryConfig, GanttConfig, GanttQuickFilter, GroupingConfig, GroupingField, KanbanConfig, ListChartConfig, ListColumn, ListView, NavigationConfig, NavigationMode, ObjectListView, ObjectUserFilters, PaginationConfig, RowColorConfig, RowHeight, SelectionConfig, TimelineConfig, TreeConfig, UserActionsConfig, UserFilterField, UserFilters, View, ViewData, ViewFilterRule, ViewItem, ViewItemName, ViewKind, ViewScope, ViewSharing, ViewTab, VisualizationType } from '@objectstack/spec/ui';
+import type { AddRecordConfig, AppearanceConfig, CalendarConfig, ColumnSummary, FormButtonConfig, FormField, FormSection, FormView, GalleryConfig, GanttConfig, GanttQuickFilter, GroupingConfig, GroupingField, KanbanConfig, ListChartConfig, ListColumn, ListView, NavigationConfig, NavigationMode, ObjectListView, ObjectUserFilters, PaginationConfig, RowColorConfig, RowHeight, SelectionConfig, TimelineConfig, TreeConfig, UserActionsConfig, UserFilterField, UserFilters, View, ViewData, ViewFilterRule, ViewItem, ViewItemName, ViewKind, ViewScope, ViewSharing, ViewTab, VisualizationType } from '@objectstack/spec/ui';
 
 // Validate data
 const result = AddRecordConfig.parse(data);
@@ -88,6 +88,18 @@ Aggregation function for column footer summary
 * `max`
 
 
+---
+
+## FormButtonConfig
+
+### Properties
+
+| Property | Type | Required | Description |
+| :--- | :--- | :--- | :--- |
+| **show** | `boolean` | optional | Whether the button is rendered (renderer default applies when omitted) |
+| **label** | `string` | optional | Button label (i18n-capable; renderer default when omitted) |
+
+
 ---
 
 ## FormField
@@ -175,6 +187,8 @@ Aggregation function for column footer summary
 | **defaultSort** | `Object[]` | optional | Default sort order for related list views within this form |
 | **sharing** | `Object` | optional | Public sharing configuration for this form |
 | **submitBehavior** | `Object \| Object \| Object \| Object` | optional | Post-submit behavior |
+| **buttons** | `Object` | optional | [EXPERIMENTAL — NOT ENFORCED, #2998] Form action-button visibility & labels. Renderer wiring pending in ObjectUI (objectui#2545). |
+| **defaults** | `Record<string, any>` | optional | [EXPERIMENTAL — NOT ENFORCED, #2998] Initial field values for create-mode forms (spec home for ObjectUI `initialValues`). Renderer wiring pending (objectui#2545). |
 | **aria** | `Object` | optional | ARIA accessibility attributes for the form view |
 
 

content/docs/ui/dashboards.mdx

@@ -302,11 +302,42 @@ Add interactive filter controls that apply to all widgets:
 
 ```typescript
 globalFilters: [
-  { field: 'region', label: 'Region', type: 'select' },
+  { name: 'region', field: 'region', label: 'Region', type: 'select' },
   { field: 'owner', label: 'Sales Rep', type: 'lookup' },
 ]
 ```
 
+Each filter's `name` is its stable identity: the key its value is published
+under as a dashboard-level variable (readable in widget expressions as
+`page.<name>`) and the key widgets reference in `filterBindings`. It defaults
+to `field`; the name `dateRange` is reserved for the built-in date range.
+
+### Per-Widget Filter Bindings
+
+By default a filter applies to its own `field` on every widget (the date
+range defaults to `dateRange.field ?? 'created_at'`). When a widget stores
+the concept under a different field — or should ignore a filter — declare
+`filterBindings` on the widget:
+
+```typescript
+widgets: [
+  // Default binding: dateRange → created_at, region → region.
+  { id: 'invoices_by_status', /* … */ },
+  // This widget's own fields differ — map each filter explicitly.
+  {
+    id: 'accounts_signed',
+    filterBindings: { dateRange: 'signed_at', region: 'sales_region' },
+    /* … */
+  },
+  // Opt out of a filter with `false`.
+  { id: 'total_invoices', filterBindings: { region: false }, /* … */ },
+]
+```
+
+Binding precedence: an explicit `filterBindings` entry (string override or
+`false` opt-out) → the filter's legacy `targetWidgets` allow-list → the
+filter's own `field`.
+
 ## Complete Example
 
 First define the dataset the widgets bind to:

docs/adr/0093-tenancy-mode-and-membership-lifecycle.md

@@ -1,6 +1,6 @@
 # ADR-0093: Tenancy mode as a first-class capability, and a single owner for the user→membership lifecycle
 
-- **Status:** Proposed (implementation in progress)
+- **Status:** Accepted (2026-07-13) — implemented: `tenancy` kernel service (`plugin-auth/src/tenancy-service.ts`), membership reconciler (`reconcile-membership.ts`), locked by `dogfood/test/membership-reconciler.dogfood.test.ts`
 - **Date:** 2026-07-13
 - **Deciders:** ObjectStack Protocol Architects
 - **Implementation:** #2882 (Phase 0 — tactical create-user bind, merged) → this PR (Phases 1–3 — `tenancy` service, fail-fast boot guard, membership reconciler, consumer migration, backfill, docs). One revision from the original plan, ratified in D2: the endpoint-level create-user bind **delegates to the shared reconciler** (one implementation, two call sites) instead of being deleted. Runtime verification confirmed the hook fires for `admin.createUser`, but better-auth *defers* `user.create.after` post-commit (#1881), so the endpoint keeps its delegated call to report `organizationId` / `membershipCreated` deterministically in its response. Cloud-host semantics (personal-org hook precedence, multi-org non-binding, D5 blast radius) verified against `objectstack-ai/cloud` — see D2/D3/D5.

docs/adr/0095-authz-kernel-tenant-layer-and-posture-ladder.md

@@ -1,6 +1,6 @@
 # ADR-0095: Authorization Kernel Chain — Tenant Isolation as Layer 0, a Monotonic Posture Ladder, Capability-Derived Posture
 
-**Status**: Proposed (2026-07-14)
+**Status**: Accepted (2026-07-14) — implemented: D1 tenant Layer 0 (`plugin-security/src/tenant-layer.ts`), D2/D3 posture ladder (`core/src/security/posture-ladder.ts`), locked by `authz-matrix-gate.test.ts` + `posture-ladder.test.ts` (#2920 B1–B4)
 **Deciders**: ObjectStack Protocol Architects
 **Builds on**: [ADR-0002](./0002-environment-database-isolation.md) (environment-per-database), [ADR-0057](./0057-erp-authorization-core-business-units-and-scope-depth.md) (scope depth), [ADR-0066](./0066-unified-authorization-model.md) (unified authz model, superuser bypass), [ADR-0090](./0090-permission-model-v2-concept-convergence.md) (permission model v2), [ADR-0093](./0093-tenancy-mode-and-membership-lifecycle.md) (tenancy service)
 **Scopes**: the "cross-tenant RLS does not exist here" claim in [ADR-0073](./0073-automation-execution-identity.md) (see Context)