Merge origin/main (post #3049 squash) into the stdio-gate branch

#3049's squash (4f8c2d1) is content-identical to this branch's base commit,
so this merge only rebases the PR surface — the three-dot diff vs main now
shows the #3055 gate alone.

# Conflicts:
#	docs/adr/0097-declarative-connector-instances.md
#	packages/connectors/connector-mcp/src/mcp-provider.test.ts
#	packages/connectors/connector-mcp/src/mcp-provider.ts

Author: claude

.changeset/console-fb35e4828fdb.md

@@ -0,0 +1,18 @@
+---
+"@objectstack/console": minor
+---
+
+Console (objectui) refreshed to `fb35e4828fdb`. Frontend changes in this range:
+
+- fix(data-objectstack): emit MutationEvents from batchTransaction and bulk so master-detail saves refresh bound views (#2584)
+- feat(dashboard-filters): #2578 item-5 enhancements — nested variable merging, metadata-aware default bindings, server-side optionsFrom distinct (#2590)
+- feat(fields+form+detail): file/image upload cells in inline line-item grids (#2360) (#2585)
+- feat(app-shell): visual filterBindings editor in the dashboard widget inspector (#2578) (#2586)
+- fix(detail): highlight strip lookup editor honors ObjectStack `reference` key (#2407) (#2587)
+- fix(app-shell): guard Studio Access pillar against silently discarding unsaved matrix edits (#2588)
+- feat(dashboard-filters): #2578 follow-ups — catalog examples, guide tutorial, i18n entries, spec-alignment cleanup (#2581)
+- fix(detail+fields+app-shell): ADR-0085 #2548 follow-ups — strip title dedupe, group icon/description, currency channel, approvals Bearer (#2577)
+- feat(dashboard): dashboard-level filters driving multiple charts (framework#2501) (#2576)
+- feat(page-header): metadata-driven multi-button record header (#2361) (#2574)
+
+objectui range: `092bd859934f...fb35e4828fdb`

.changeset/i18n-extract-action-params.md

@@ -0,0 +1,21 @@
+---
+'@objectstack/cli': minor
+'@objectstack/platform-objects': patch
+---
+
+feat(cli): `os i18n extract` now emits action param keys (`o.<object>._actions.<action>.params.<param>.*`) so action-dialog forms are translatable (#3030)
+
+The console client already resolves param labels, help text, placeholders and
+option labels from `o.<object>._actions.<action>.params.*`, but the extractor
+never walked `actions[].params`, so those keys were absent from generated
+bundles and dialogs like Setup → Create User rendered raw English under any
+locale. The extractor now emits:
+
+- inline params → `label` / `helpText` / `placeholder` / `options.<value>`;
+- field-backed params (`{ field: '…' }`) → only when they carry a literal
+  override (field translations already cover them at runtime);
+- both object actions and top-level (global) actions.
+
+`@objectstack/platform-objects` regenerates its en/zh-CN/ja-JP/es-ES bundles
+with the new keys filled (user admin actions, sys_jwks fields, page variable
+forms). Re-running extract with `--merge` stays idempotent.

.changeset/owd-posture-authoring-gate.md

@@ -0,0 +1,6 @@
+---
+'@objectstack/metadata-protocol': minor
+'@objectstack/plugin-security': minor
+---
+
+OWD posture is now enforced on the runtime write path (#3050). `metadata-protocol` gains the ADR-0094-addendum `registerAuthoringGate(type, gate)` seam — an awaited, throwing pre-persistence hook inside `saveMetaItem` (draft and publish-mode saves; environment writes only). `plugin-security` registers the `object` posture gate on it: an environment overlay of a packaged object may only TIGHTEN `sharingModel`/`externalSharingModel` (ADR-0086 D1 — closes the `OS_METADATA_WRITABLE=object` unvalidated-widening hole), and `externalSharingModel ≤ sharingModel` (ADR-0090 D11) is now rejected at save time instead of only by CLI lint. Write-path only — stored metadata keeps loading unchanged.

.changeset/owner-guard-referential-cascade-exemption.md

@@ -0,0 +1,23 @@
+---
+'@objectstack/plugin-security': patch
+'@objectstack/objectql': patch
+---
+
+fix(security): exempt engine referential FK clears from the owner_id transfer guard (#3023)
+
+Follow-up to the #3004 ownership-anchor guard. `owner_id` is a lookup to `sys_user`
+with the default `deleteBehavior: 'set_null'`, so deleting a `sys_user` makes
+`cascadeDeleteRelations` null `owner_id` on every dependent row. That cascade write
+re-entered the write middleware under the deleter's context, where the #3004 guard
+read the `owner_id = null` as a user-initiated disown and denied it — aborting the
+cascade mid-way (no transaction, so partial state) for any deleter without the
+transfer grant on the child object (e.g. a member clearing a `public_read_write`
+child that RLS would otherwise have allowed).
+
+The cascade FK clear is engine-mandated referential integrity consequent to an
+already-authorized parent delete, not a user ownership change. `cascadeDeleteRelations`
+now tags the `set_null` write with a server-derived `__referentialFieldClear` context
+marker (set by the engine, never built from a request — same trust model as
+`__expandRead`), and the ownership-anchor guard skips when that marker is present.
+Ordinary user writes are unaffected; the marker cannot be forged from client input,
+so it can never slip a real ownership transfer past the guard.

.changeset/plugin-audit-summary-i18n-3039.md

@@ -0,0 +1,13 @@
+---
+'@objectstack/plugin-audit': patch
+---
+
+Localize activity summaries to the workspace default locale (#3039). Activity
+writers previously hardcoded English verbs and the object API name
+(`Created person_qualification "OC-00001"`). The writer now resolves the
+ADR-0053 `localization.locale` setting per write (memoized per tenant/user
+scope), renders the verb through new `messages.activityCreated/Updated/Deleted`
+i18n templates (en, zh-CN, ja-JP, es-ES shipped), and names the object by its
+localized label (`objects.{name}.label`) with fallback to the authored def
+label, then the API name. Missing i18n/settings services or bundle keys
+degrade to the previous English summaries.

.changeset/predicate-guard-caller-scope-and-preimage-dedup.md

@@ -0,0 +1,29 @@
+---
+'@objectstack/plugin-security': patch
+---
+
+fix(security): scope the bulk-write predicate guard to the caller's own filter, and dedupe pre-image reads (#3018 review follow-ups)
+
+Two hardening follow-ups from the #3018 adversarial review.
+
+**Predicate guard is now middleware-order-independent for writes.** #2982 made bulk
+`update`/`delete` carry an `opCtx.ast`, which brought them under the step-2.9
+anti-oracle predicate guard for the first time. That guard is documented to run
+against the *caller's own* predicate — RLS / sharing filters legitimately reference
+fields the caller cannot read (e.g. `owner_id`). But for a bulk write it inspected
+`opCtx.ast.where`, which a sibling middleware (`plugin-sharing`) may have already had
+an `owner_id` owner-match composed into — and the two middlewares' registration order
+is not contractually guaranteed. On an object whose `owner_id` is FLS-hidden, that
+could 403 a legitimate bulk write purely because the injected filter named the field.
+The guard now inspects `opCtx.options.where` (the caller's untouched predicate) for
+`update`/`delete`, so it can never mistake an injected owner/RLS filter for a caller
+probe, independent of middleware order. Reads are unchanged (the read seed is the
+caller's query verbatim and the guard runs before this middleware's own injection).
+
+**Pre-image reads deduplicated.** The by-id "read the target row" pattern was inlined
+at ~5 gates with slightly divergent shapes; a single `readRowById` helper (fail-closed:
+missing engine / null id / thrown read → `null`, which always denies) now backs the
+provenance gates, and a memoized `getCallerPreImage` collapses the owner-anchor echo
+check (3.5) and the RLS `check` post-image (3.6) — which read the identical
+`(object, id, caller-context)` row — into one read per operation. No behavior change;
+the read shape can no longer drift across sites.

.changeset/public-form-server-managed-anchors.md

@@ -0,0 +1,42 @@
+---
+'@objectstack/plugin-security': patch
+'@objectstack/rest': patch
+'@objectstack/spec': patch
+---
+
+fix(security): public-form submissions can no longer forge server-managed anchors (#3022)
+
+The anonymous public-form surface (ADR-0056 Option A, `POST /forms/:slug/submit`)
+is authorized by the declaration-derived `publicFormGrant`, which short-circuits
+the security middleware BEFORE every write gate (CRUD, FLS, the owner anchor
+guard, the tenant CHECK). The only field-side defense was the route's
+declared-field allow-list — and a FormView with zero declared section fields
+fell back to merging the raw body wholesale, so an unauthenticated visitor
+could `POST owner_id=<victim>` (or `organization_id`, audit columns, `id`) and
+attach the record to another user or tenant — the #3004 insert-forge, with no
+credentials at all.
+
+Server-managed anchors are now enforced on this surface at BOTH layers, from a
+single shared definition (`PUBLIC_FORM_SERVER_MANAGED_FIELDS`, new in
+`@objectstack/spec/security`):
+
+- **Data layer (authoritative)** — the `publicFormGrant` branch in
+  `@objectstack/plugin-security` strips `id` / `owner_id` / `organization_id` /
+  `tenant_id` / audit columns / soft-delete state / `__search` from every row
+  of a granted insert (batch included) before admitting the write, so the
+  boundary holds no matter what any route lets through. Ownership stays NULL
+  for object hooks / the first-admin bootstrap to assign, as for other
+  anonymous-seeded rows.
+- **Route layer** — the submit allow-list excludes the same set
+  unconditionally: an explicitly declared `owner_id` section field no longer
+  passes, and the zero-declared-sections fallback keeps its documented
+  all-fields behavior for business columns while refusing the managed set.
+  The resolve route (`GET /forms/:slug`) drops the managed fields from the
+  rendered sections and the embedded object schema so a form never collects a
+  value the submit refuses, and `GET /forms/:slug/lookup/:field` refuses a
+  `publicPicker` declared on a managed anchor (which would have opened
+  anonymous `sys_user` search through `owner_id`).
+
+Authenticated writes are unaffected — this is the anonymous-surface rule only;
+`owner_id` transfer semantics for signed-in callers stay governed by the
+transfer grant (#3004 / PR #3018).

.changeset/view-liveness-enrollment.md

@@ -0,0 +1,27 @@
+---
+'@objectstack/spec': minor
+'@objectstack/cli': minor
+---
+
+feat(spec,cli): enroll `view` in the liveness ledger (#2998 Track B)
+
+`view` joins the `GOVERNED` set of the spec property-liveness gate — the
+rollout gap that let the objectui#1763/#2545 class of renderer/spec key drift
+survive undetected. New `packages/spec/liveness/view.json` classifies all 83
+walkable properties (75 ledger entries + framework overlay fields): the `list`
+and `form` containers are drilled one level via `children`.
+
+Seeded from the 2026-06 viewschema audit and **re-verified against objectui
+HEAD** — four audit-era DEAD findings had since gone live and are classified
+from current reads (`form.submitBehavior`, `list.sharing.lockedBy`, list-path
+`ViewData` providers, and the post-ADR-0021 `list.chart` dataset shape — the
+audit's "chart renderers never migrated" headline is resolved). Final tally:
+68 live, 2 experimental (`form.buttons`/`form.defaults`, #2998 Track A
+awaiting objectui#2545), 5 dead (`list.responsive`, `list.performance`,
+`form.data`, `form.defaultSort`, `form.aria`). All misleading dead props
+carry `authorWarn` + `authorHint`.
+
+The CLI's compile-time liveness lint gains `view` coverage
+(`TYPE_COLLECTIONS` + view containers labelled by `object`), so authoring a
+dead prop — e.g. a spec-valid `chart` list view that renders empty — now warns
+at `os build` with a corrective hint.

.objectui-sha

@@ -1 +1 @@
-092bd859934f7bbc2654510aef912062c4c4f3a8
+fb35e4828fdb3b6ecc23761a82e9ec4a13890727

content/docs/data-modeling/queries.mdx

@@ -380,6 +380,17 @@ the expanded filter; `fields` semantics, `searchableFields`, and drivers are unc
 (ADR-0097). Relevance ranking and typo tolerance remain Tier-2 (native FTS) and are not
 part of this.
 
+**Coverage** — every object with a resolvable display/name field gets the companion,
+**including `sys_user`**: the people picker (which sends a plain `$search` against
+`sys_user`) finds users by pinyin with zero per-object or per-field configuration. Users
+created through any write path — sign-up, admin rename, engine writes — are searchable
+immediately.
+
+**Pre-existing rows** are reconciled automatically: the first boot after the switch turns
+on runs a paged, idempotent backfill over every object that carries the companion column.
+For bulk imports that bypassed write hooks at runtime, `rebuildSearchCompanion` (exported
+by `@objectstack/plugin-pinyin-search`) recomputes the column on demand.
+
 ---
 
 ## Window Functions