Merge remote-tracking branch 'origin/main' into claude/tender-torvalds-7b232d

# Conflicts:
#	packages/spec/src/ui/view.test.ts
#	packages/spec/src/ui/view.zod.ts

Author: baozhoutao

.changeset/analytics-datetime-epoch-filter.md

@@ -0,0 +1,11 @@
+---
+"@objectstack/service-analytics": patch
+"@objectstack/driver-sql": patch
+"@objectstack/spec": patch
+---
+
+Fix dashboard time-series charts / "last N months" KPIs that filter or group by a `Field.datetime` column silently returning "No rows".
+
+The analytics `NativeSQLStrategy` compiles dashboard relative-date tokens (`{12_months_ago}`, `{today}`, …) to ISO date strings and binds them directly into raw SQL, bypassing the driver's own filter coercion. Under better-sqlite3 a `Field.datetime` column is stored as an INTEGER epoch (ms), so `assessed_at >= '2025-06-18'` became a TEXT-vs-INTEGER affinity compare that is always false — an empty result even though the rows exist. `Field.date` columns store ISO TEXT and were unaffected.
+
+The strategy now coerces a temporal comparand to the column's on-disk storage form via a new optional `StrategyContext.coerceTemporalFilterValue` hook, wired to the driver's public `SqlDriver.temporalFilterValue` (the single source of truth for the storage convention). Coercion is dialect-correct: SQLite `Field.datetime` → epoch ms; `Field.date` text and native-timestamp dialects (Postgres/MySQL) are left unchanged, so Postgres is never handed an epoch integer. Applied to `gte`/`lte`/`gt`/`lt`/`equals`, `in`/`notIn`, and the `dateRange`/timeDimension `BETWEEN` path.

.changeset/gantt-config-extended-fields.md

@@ -0,0 +1,17 @@
+---
+"@objectstack/spec": patch
+---
+
+fix(spec): declare the extended Gantt config fields the renderer actually reads
+
+`GanttConfigSchema` only declared the 5 core timeline fields as a plain
+`z.object` (no passthrough), so every other field the Gantt renderer consumes —
+`parentField`/`typeField` (two-level summary→step hierarchy), `colorField`,
+`groupByField`, `tooltipFields`, `baselineStartField`/`baselineEndField`,
+`resourceView`/`assigneeField`/`effortField`/`capacity`, `quickFilters`,
+`autoZoomToFilter` — was silently stripped by `.parse()` on both the compile-time
+protocol check and the runtime `GET /api/v1/meta/view/:object` re-validation. With
+the keys gone before render, the Gantt degraded to a flat list (no parent/child
+rows, no summary bars, no expand/collapse). These fields are now declared
+explicitly (with descriptions), so the renderer contract round-trips through the
+spec instead of requiring downstream patches.

.changeset/gantt-config-tree-resource-fields.md

@@ -0,0 +1,5 @@
+---
+"@objectstack/platform-objects": patch
+---
+
+fix(i18n): add view form `end_user_controls` translations for en, es-ES, ja-JP and zh-CN metadata-forms bundles.

.changeset/i18n-view-form-end-user-controls.md

@@ -0,0 +1,19 @@
+---
+"@objectstack/plugin-org-scoping": minor
+---
+
+feat(org-scoping): hand a default org's seeded records to its admin (multi-tenant ownership handoff)
+
+The multi-tenant companion to plugin-security's single-tenant `claimSeedOwnership`.
+Seeded rows land `owner_id` NULL (the author leaves it unset; `cel`os.user.id``
+resolves to NULL at seed time). In multi-tenant mode `claimOrphanOrgRows`
+back-fills their `organization_id`, but `owner_id` stayed NULL — so "My" views,
+owner reports and owner notifications were empty for the org's members.
+
+- New `claimOrgSeedOwnership(ql, organizationId, ownerUserId)` — assigns
+  `owner_id = ownerUserId` to an org's NULL-owned seed rows. Scoped to a single
+  org (never touches another tenant), idempotent, skips `managedBy` / `sys_*`,
+  and requires both `owner_id` and `organization_id` columns.
+- `ensureDefaultOrganization` now calls it after binding the platform admin as
+  the default org's owner, so the default org's demo data is owned by the admin
+  out of the box — symmetric with the single-tenant first-admin handoff.

.changeset/multitenant-seed-ownership.md

@@ -1 +1 @@
-7086bc4bee71ee7c7b91316b2e18ec6cb070f547
+be7c6e9de6363f1001e3749f48c063dece969973

.objectui-sha

@@ -332,3 +332,73 @@ Cron day-boundaries (`sys_job`) need **no change** — already tz-wired via cron
 Every slice is feature-flaggable behind "reference timezone unset → UTC". With no org
 reference timezone configured, the resolver returns `'UTC'` and all compute/render
 paths are byte-for-byte today's behavior — the safe default and the rollback target.
+
+---
+
+## Addendum (2026-06-18) — the analytics raw-SQL filter path and the temporal-coercion contract
+
+> **Status:** first increment landed (commit `6f4cf856e`, branch
+> `fix/analytics-datetime-epoch-filter`). This addendum records a gap ADR-0053 did
+> **not** reach and the contract follow-ups it implies. It extends, and does not
+> revise, the decision above.
+
+### The gap
+
+ADR-0053 fixed the `date`-as-string-vs-instant family (#1874) on the driver CRUD
+path, and Phase 1 explicitly left `Field.datetime` stored as UTC epoch ms
+(`sql-driver.ts:1500`, decision step 4). But analytics has a **second filter
+surface that never touches that coercion**: `NativeSQLStrategy` builds raw SQL and
+runs it via `engine.execute`, bypassing the driver's dialect-aware
+`coerceFilterValue` (`sql-driver.ts:1543`). `buildFilterClause` emits
+`${col} <op> $N` and binds the comparand directly
+(`native-sql-strategy.ts:385-425`); the only type recovery was
+`coerceFilterValueForSql`, which re-derives a type by **regex on the value's
+shape** — no schema type, no date branch (`filter-normalizer.ts:127-140`).
+
+So a dashboard relative-date token resolved to an ISO string (`"2025-06-18"`),
+filtered against a `Field.datetime` column stored as an INTEGER epoch on SQLite,
+compiled to `epoch >= 'ISO'` — a TEXT-vs-INTEGER affinity compare that is **always
+false → 0 rows / empty chart**. This is the `datetime` analogue of the `date`
+equality miss Phase 1 fixed, on the one path 0053 did not address.
+
+### Decisions
+
+**D-A1 — The driver is the single source of dialect truth for filter-value
+coercion; every raw-SQL surface routes through it.** Invariant: any surface that
+binds a filter comparand into raw SQL (analytics `NativeSQLStrategy` today, and any
+future raw-SQL strategy) **must** coerce through the driver's dialect-aware
+temporal coercion, never re-derive a type from the value's textual shape. This
+closes the `datetime` analogue of Phase 1's `date` fix on the path 0053 did not
+reach. The first increment — commit `6f4cf856e` (branch
+`fix/analytics-datetime-epoch-filter`) — exposes the driver's coercion to
+analytics via a new `StrategyContext.coerceTemporalFilterValue(object, field,
+value)` hook delegating to the driver, applied across `gte/lte/gt/lt/equals`,
+`in/notIn`, and the `dateRange`/timeDimension path (`native-sql-strategy.ts:371`,
+`:88-106`). SQLite `datetime` → epoch ms; `date` text and native-timestamp
+dialects (Postgres/MySQL) pass through unchanged. **Record this PR as ledger
+evidence** — the same enforce-resolution pattern D3 uses for the dead schedule
+fields.
+
+**D-A2 — Formalize `temporalFilterValue` onto the `IDataDriver` contract.** The
+hook currently delegates to a **duck-typed** `driver.temporalFilterValue(...)`
+that is not on the driver contract. Promote it to a first-class
+`IDataDriver`-contract method so every consumer relies on a stable surface, and
+**demote the regex-shape `coerceFilterValueForSql` to a last-resort fallback (or
+retire it)** once the contract method is universal. (If an in-flight
+`IDataDriver`-interface change is open, align this with it; do not block on it.)
+
+**D-A3 — Add a temporal conformance matrix as the runtime regression backstop.**
+Cover `field-type {date, datetime} × operator {eq, gte/lte/gt/lt, in, dateRange} ×
+relative-token {today, N_days_ago, N_months_ago, …} × driver {SQLite, Postgres at
+minimum}`, asserting correct **row results** — not just emitted SQL. Analytics has
+been refactored repeatedly; this seam must not silently regress. This complements
+the #1950 build-time lint ADR-0053 already references: the lint warns at author
+time, the matrix proves runtime correctness across drivers.
+
+### Consequences
+
+- The `datetime`-on-raw-SQL filter bug is closed at the driver boundary, mirroring
+  Phase 1's "align the consumer with the driver's existing contract rather than
+  inventing a semantic" stance. No change to Phase 2's reference-timezone plan.
+- Until D-A2 lands, the hook depends on a duck-typed driver method — a known,
+  intentionally-temporary seam tracked here.

docs/adr/0053-date-and-datetime-semantics.md

@@ -0,0 +1,158 @@
+# ADR-0054: A live authorable property must be proven at runtime, not merely have a consumer (prove-it-runs gate)
+
+**Status**: Accepted (2026-06-18)
+**Deciders**: ObjectStack Protocol Architects
+**Builds on**: [ADR-0049](./0049-no-unenforced-security-properties.md) (enforce-or-remove gate), [ADR-0005](./0005-metadata-customization-overlay.md) (artifact vs runtime), [ADR-0053](./0053-date-and-datetime-semantics.md) (the domain of the motivating regression)
+**Consumers**: `@objectstack/spec` (liveness ledger `packages/spec/liveness/<type>.json`), the Spec Liveness Check CI gate (#1919), `@objectstack/dogfood` (the runtime gate, [#2020](https://github.com/objectstack-ai/framework/pull/2020)), spec authors, platform contributors.
+**Surfaced by**: PR [#2018](https://github.com/objectstack-ai/framework/pull/2018) — "organization timezone drives analytics date bucketing" was **green on every static gate** (build, ~900 unit tests, spec-liveness, CodeQL) yet broken end-to-end across three integration seams; and the field-type capability-matrix dogfood ([#2022](https://github.com/objectstack-ai/framework/pull/2022)), which on its first run found `rating`/`slider`/`toggle` reading back wrong-typed.
+
+---
+
+## TL;DR
+
+ObjectStack is a development platform: **third parties have an AI author
+arbitrary metadata**, and the promise is that it works at runtime. ADR-0049
+closed *false compliance* — a property declared but unenforced. The liveness
+ledger (#1919) then made every authorable property declare a status
+(**live / experimental / dead**) with evidence, killing silent dead surface.
+
+But "live" today means only **a static `file:line` pointer to a consumer** —
+proof that *something reads the property*. That is necessary but **not
+sufficient**. A property can be live at every individual layer and still be
+**broken end-to-end**, because the break lives in the *integration* — engine ↔
+driver ↔ service ↔ HTTP ↔ execution-context. #2018 is the proof: `timezone`,
+date bucketing, the analytics strategy, and the REST context were each
+individually correct (and individually unit-tested against mocks); the bucket
+was wrong only when they ran together. Call this gap **unproven liveness**: the
+ledger says "live", the AI is told "you may author this", and it silently
+misbehaves at runtime.
+
+A metadata-driven platform whose authors are AI cannot ship unproven liveness
+for the primitives that matter. The static pointer must be upgradable to a
+**runtime proof** — a [`@objectstack/dogfood`](../../packages/dogfood) test that
+authors the property against the real, in-process stack and asserts the runtime
+result.
+
+**Decision.** Extend the enforce-or-remove gate (ADR-0049) with a third leg —
+**prove-it-runs**. For a defined high-risk class of authorable properties, a
+`live` classification must carry a `proof` (a dogfood test reference), not just a
+consumer pointer. Applied as a **ratchet, not a retrofit**: required for newly
+added/changed high-risk properties and for any property implicated in a shipped
+runtime regression — never as a one-shot demand to prove all 200 live properties.
+
+---
+
+## Context
+
+Three gates already guard the authorable surface, each at a different layer:
+
+| Gate | Question it answers | Where it can be fooled |
+|---|---|---|
+| **AI-authoring guardrails** (build-time lint, broken→error / fragile→warning) | *Is the authored metadata valid?* | Valid ≠ correct at runtime. |
+| **Spec liveness ledger** (ADR-0049 + #1919) | *Does any code read this property?* | A consumer existing ≠ the integrated path being correct. |
+| **Dogfood gate** ([#2020](https://github.com/objectstack-ai/framework/pull/2020)) | *Does authoring it produce correct runtime behavior?* | Coverage is currently incidental — whatever the example apps happen to exercise. |
+
+The liveness ledger's evidence is a static pointer
+(`packages/spec/liveness/<type>.json`, e.g. `field:line`). It is excellent at
+killing *dead* surface (parsed, no consumer). It is **blind to integration
+correctness**: #2018's properties all had valid consumer pointers and were
+classified live, yet the end-to-end result was wrong. The same blindness let
+`rating`/`slider`/`toggle` be live (they persist) while reading back as the
+wrong JS type — found only when [#2022](https://github.com/objectstack-ai/framework/pull/2022)
+wrote one and read it back over the real API.
+
+The cost is asymmetric for *this* platform. When a human authors metadata and it
+misbehaves, they notice and adjust. When an **AI** is told a property is live and
+emits it across the combinatorial space the examples never cover, the
+misbehavior ships silently into a third-party app. "Live" must therefore carry a
+stronger guarantee for the primitives an AI is most likely to combine in ways the
+curated examples don't.
+
+## Decision
+
+### 1. The contract — `live` may be backed by a runtime proof
+
+The liveness ledger gains an optional, stronger evidence form for `live`
+properties: alongside the static consumer pointer, an entry may carry a
+**`proof`** — a reference to a `@objectstack/dogfood` test that authors the
+property against the real in-process stack and asserts the runtime outcome
+(a value, a bucket, a count, a denied write — observable behavior, not "no
+error").
+
+A proof supersedes a static pointer: it subsumes "a consumer exists" and adds
+"the integrated path is correct."
+
+### 2. The ratchet — required for the high-risk class, on change
+
+A `proof` is **required** (CI-enforced via the liveness gate) only for:
+
+- **(a) High-risk authorable classes, on add/change.** The classes whose values
+  cross the engine↔driver↔service↔HTTP boundary and have repeatedly broken in
+  *integration* despite green unit tests:
+  - field types — persistence + read-coercion fidelity (the field-zoo matrix),
+  - analytics dimensions / measures — bucketing, aggregation, timezone,
+  - RLS / sharing — read **and** by-id-write enforcement,
+  - flow nodes — execution + variable wiring,
+  - form layout/section/widget — server-side resolution.
+- **(b) Regression carriers.** Any property implicated in a *shipped* runtime
+  regression: the fix PR must add (or un-quarantine) its dogfood proof — exactly
+  as #2018 added the tz proof, and as the `rating`/`slider`/`toggle` fix must
+  lift the `it.fails` quarantine in the field-zoo matrix.
+
+Properties outside these classes (labels, descriptions, pure presentation hints)
+**do not** require a proof — a static pointer remains sufficient. The ratchet
+grows coverage where silent runtime breakage is plausible, not everywhere.
+
+### 3. Phasing
+
+- **Phase 1 (in progress).** Capability-matrix proofs for the two classes with a
+  demonstrated break: field types ([#2022](https://github.com/objectstack-ai/framework/pull/2022), field-zoo) and analytics ([#2018](https://github.com/objectstack-ai/framework/pull/2018), tz bucketing).
+- **Phase 2.** Extend the matrix to flow nodes, form widgets, and RLS patterns
+  (the member-edit-others by-id-write hole, #1994, is the seed RLS proof — it
+  also drives a multi-user harness capability reused by every later RLS proof).
+- **Phase 3 (deferred, evidence-gated).** A generative pass that emits random
+  valid metadata from the spec's Zod surface and asserts invariants — pursued
+  **only** once the matrix proves the harness scales, and scoped to narrow
+  high-value slices. Generative testing is high-ceiling and high-maintenance; it
+  does not lead.
+- **CI binding lands incrementally.** The liveness gate begins requiring `proof`
+  for class (a) one class at a time as its matrix is populated, and for class (b)
+  immediately. No big-bang demand to backfill all live properties.
+
+### 4. Dogfood is the proof mechanism
+
+A proof is a dogfood test because dogfood is the only gate that boots the real
+stack in-process and exercises a property end-to-end (the thing that caught
+#2018). In-process Hono request-injection keeps a proof at ~2s with no ports, so
+the proof corpus stays CI-cheap as it grows.
+
+## Consequences
+
+- **Positive.** Closes *unproven liveness*: every high-risk authorable primitive
+  an AI can emit carries a runtime guarantee, not just a "someone reads it"
+  pointer. Every shipped regression leaves behind a permanent guard (the fix
+  carries its proof). The three gates compose into one honest chain — *valid*
+  (build) → *has a consumer* (liveness) → *runs correctly* (dogfood).
+- **Negative / cost.** A proof is more work than a static pointer, and the
+  dogfood harness must scale (per-class fixtures, boot cost). Mitigated by
+  in-process inject (~2s/proof) and by scoping the requirement to high-risk
+  classes on change — not a retrofit. Risk that the proof corpus slows CI;
+  bounded by the same scoping and by keeping generative testing deferred.
+- **Follow-up.** (1) Define the authoritative high-risk-class list and add the
+  `proof` field + ratchet to the liveness gate. (2) The field-fidelity fix
+  (`rating`/`slider`/`toggle`) is the first "regression carrier" instance — it
+  must lift the field-zoo quarantine. (3) Seed the RLS proof (#1994) and the
+  multi-user harness capability.
+
+## Non-goals
+
+- **Proving all 200 live properties now.** Trivial static properties don't need
+  runtime proofs; the ratchet targets the high-risk class.
+- **Building the generative tester now.** Deferred to Phase 3, evidence-gated.
+- **Replacing unit tests.** Dogfood proofs add the *integration* dimension; they
+  complement, not replace, layer-level unit tests. A proof must assert something
+  a mocked unit test structurally cannot.
+- **Client-side render proofs.** The backend dogfood harness covers
+  server-reachable behavior. Pure objectui/React render correctness belongs in
+  objectui's own suite; a property whose only failure mode is client render is
+  out of scope for this gate.