Merge origin/main into claude/global-actions-unreachable-rw7hpk

Integrates #3987 (ADR-0110 D3 revised): the undeclared-action refusal has no
opt-out — OS_ALLOW_UNDECLARED_ACTIONS is retired. The conflict was this
branch's #3962 single-wrap adjustment inside the old valve test, which #3987
rewrote into "refuses regardless of the retired flag"; main's side taken
verbatim, as the valve semantics the adjustment belonged to no longer exist.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011AvZj6cLX7APd7roh2eK4F

Author: claude

.changeset/adr-0111-verb-boundary-delete.md

@@ -0,0 +1,32 @@
+---
+"@objectstack/spec": minor
+"@objectstack/plugin-sharing": minor
+"@objectstack/plugin-security": minor
+---
+
+fix(sharing)!: an edit-level share no longer grants delete (ADR-0111 D3, the verb boundary)
+
+`update` and `delete` shared one `canEdit` gate, and `canEdit` accepts an
+`edit`-level share — so one "edit" grant silently conferred delete, the
+opposite error from the retired `full` level. A share widens *which rows* a
+principal reaches, never *which verbs* they may use (Salesforce Read/Write
+cannot delete; Dataverse `Delete` is a distinct privilege; Odoo splits
+`write`/`unlink`).
+
+- `ISharingService.canDelete(object, recordId, context)` — ownership (widened
+  by write DEPTH) or the `modifyAllRecords` super-user bypass ONLY; an `edit`
+  or legacy `full` share does not confer it. `canEdit` is unchanged (the
+  update gate, share included).
+- `SharingService.buildWriteFilter` takes a `verb` parameter: a bulk
+  `delete({multi:true})` scopes to the owner/DEPTH set alone (no share
+  widening), while a bulk `update` keeps it.
+- The sharing middleware routes `delete` through `canDelete` and logs a
+  specific fail-closed reason on denial (ADR-0111 D10).
+- `/security/explain` consults `canDelete` for a `delete` operation, so the
+  record-level explanation matches enforcement.
+
+**Breaking**: a caller who could delete a record *only* through an edit-level
+share (and holds object-level delete CRUD) can no longer delete it — delete now
+requires ownership, write depth, or Modify All Data. No new delete access level
+is introduced; a future per-record delete grant would be a capability mask
+AND-ed with object CRUD, not a fourth share level.

.changeset/agents-pd12-shim-retired.md

@@ -0,0 +1,4 @@
+---
+---
+
+docs(agents): PD #12 records the #3796 endgame — all seven flow-node config aliases graduated into the protocol-17 conversion layer and the `readAliasedConfig` shim is deleted; new aliases go straight to conversion entries, never executor shims — releases nothing.

.changeset/console-a136322f8723.md

@@ -0,0 +1,26 @@
+---
+"@objectstack/console": minor
+---
+
+Console (objectui) refreshed to `a136322f8723`. Frontend changes in this range:
+
+- fix(app-shell)!: a modal action is client-side only — drop the server fallthrough (objectstack#3959) (#2973)
+- fix(app-shell)!: the server-action URL identifies an action by `name`, not `target` (ADR-0110 D1) (#2970)
+- fix(form): a server rejection that names fields now marks those fields (#2966)
+- fix(actions): one source for the /actions envelope rule, and redirectUrl finally works (#2967)
+- fix(actions): apply the ADR-0066 D4 capability gate on every action surface (framework#3923) (#2965)
+- fix(detail): multi-value lookup is selectable in inline edit (#2957)
+- fix(actions): a failed server action no longer reports as success (green toast) (#2963)
+- fix(fields): the criteria builder stops calling an empty criteria "All records" (#2962)
+- feat(report): carry a report's `order` into the dataset selection (framework#3916) (#2964)
+- feat(views): the list toolbar speaks one vocabulary — `userActions` (#2890) (#2948)
+
+objectui range: `4a4829d0ef39...a136322f8723`
+
+**Release-critical for v17.** The previous pin (`4a4829d0ef39`) predates the
+ADR-0110 D1 client fix, so the console it builds still posts `action.target`
+to `/api/v1/actions/:object/:action`. Against a v17 server — which resolves
+the declaration by `name` and refuses an unresolvable one (D3) — every
+target-bound script action would return 404 from the shipped console. The
+lockstep the ADR called for is enforced by THIS pin, not by merging the
+objectui PR, so v17 must not ship without this bump.

.changeset/drop-undeclared-actions-valve.md

@@ -0,0 +1,26 @@
+---
+'@objectstack/runtime': major
+---
+
+**[ADR-0110 D3, revised] The undeclared-action refusal has no opt-out —
+`OS_ALLOW_UNDECLARED_ACTIONS` is removed before 17 ships.**
+
+D3 as accepted refused an undeclared handler but shipped
+`OS_ALLOW_UNDECLARED_ACTIONS=1` as a migration valve that ran it anyway,
+"slated for removal in 18". Removed now, for two reasons:
+
+- **It contradicts the ruling it accompanies.** A flag that executes an
+  ungoverned, system-elevated handler *is* the fail-open D3 closes. ADR-0049's
+  trichotomy has no "enforced unless a flag says otherwise" state.
+- **It had no observed users.** A reconciliation sweep across the platform
+  packages, every example and every plugin found the only `engine.registerAction`
+  call sites are `app-todo`'s eight, all declared. The valve would have shipped
+  a documented way to reopen the gate for a population nobody has ever seen.
+
+What it was buying is covered without it: the app still boots, every declared
+action still works, D5's boot inventory names each offender at startup, and the
+404 names the `defineAction` to add. Migration costs a code change rather than
+an env var — the correct price for reopening an authorization gate.
+
+Setting the retired variable has no effect; a regression test pins that, so a
+stale deployment script fails loudly rather than silently re-opening the gate.

.changeset/flow-node-config-alias-graduation.md

@@ -0,0 +1,49 @@
+---
+"@objectstack/spec": minor
+"@objectstack/service-automation": minor
+---
+
+feat(spec,automation): graduate the seven flow-node config key aliases into the conversion layer — the `readAliasedConfig` shim retires with them (#3796)
+
+`FlowNodeSchema.config` is an unconstrained record, so the executors were the
+only statement of which config key is canonical — and seven deprecated aliases
+lived there as tolerance the spec never declared: one behind the
+`readAliasedConfig` deprecation shim (warned, ledgered), six as open-coded
+`??` fallbacks (no warning, no ledger, no retirement path). All seven now
+graduate into the ADR-0087 D2 conversion layer as protocol-17 **live-window**
+entries: a stored flow authored with an alias is rewritten to the canonical
+key at load — `defineStack` / `validate` / `lint` and the
+`AutomationEngine.registerFlow` rehydration seam alike — with a structured
+`ConversionNotice` per rewrite, and the executors read the canonical keys
+only. The shim (`service-automation/src/builtin/config-aliases.ts`) is empty
+and deleted.
+
+FROM → TO (per node type; conversion entry in parentheses):
+
+- `get_record`/`create_record`/`update_record`/`delete_record`:
+  `config.object` → `config.objectName` (`flow-node-crud-object-alias`)
+- `notify`: `config.to` → `config.recipients`, `config.subject` →
+  `config.title`, `config.body` → `config.message`, `config.url` →
+  `config.actionUrl` (`flow-node-notify-config-aliases`)
+- `script`: `config.functionName` → `config.function`, `config.input` →
+  `config.inputs` (`flow-node-script-config-aliases`)
+
+One-line fix: rename the key in your flow source — values are unchanged; `os
+migrate meta --from 16` rewrites all seven mechanically. Until then nothing
+breaks: the protocol-17 loader accepts and converts the old shape (window
+retires in 18).
+
+`actionUrl` (not `url`) is the deliberate canonical of its pair, resolving a
+contradiction where the notify descriptor documented `url` as canonical while
+the executor, tests, and examples preferred `actionUrl`: the whole downstream
+chain already uses that name (`sys_notification.action_url`, the
+channel-dispatch contract, the REST notification read model), and `url`
+elsewhere in the platform means "HTTP endpoint to call" (`http` node,
+webhooks) — a different concept from this in-app click-through target. The
+executor precedence already put `actionUrl` first, so the choice is
+behaviour-preserving; the `notify` descriptor's `configSchema` now documents
+`actionUrl`.
+
+Callers that hand a node config **directly** to an executor (bypassing
+`registerFlow`) no longer get alias resolution — build the config with the
+canonical keys.

.changeset/rls-enabled-enforced-security-audit.md

@@ -0,0 +1,49 @@
+---
+"@objectstack/plugin-security": patch
+"@objectstack/spec": patch
+---
+
+fix(security)!: a disabled RLS policy no longer grants — found by re-verifying the ledger's security subset (#3896 follow-up)
+
+**The fix.** `RowLevelSecurityPolicySchema.enabled` promises, verbatim: *"Disabled
+policies are not evaluated."* Nothing read it — not the collection site, not the
+projection round-trip, not the compiler. Because applicable policies OR-combine
+(any match allows access), a policy an admin switched off **kept contributing its
+grant**: disabling a too-permissive policy silently changed nothing. That is the
+#3896 shape — a documented security control whose real behaviour is wider than
+its contract — one layer up, on RLS instead of sharing rules.
+
+`getApplicablePolicies` now excludes `enabled === false` before any matching, at
+the single choke point both the find path and the analytics path flow through —
+the same place, and the same ADR-0049 enforce-or-remove resolution, as the
+formerly-unenforced `positions` domain. Exact `=== false` on purpose: the schema
+defaults `enabled` to true and projection rows may omit the key, so absent stays
+active. Four tests pin both directions. Access-narrowing only: no policy grants
+MORE after this change, and nothing in-repo authors `enabled: false`.
+
+**The audit that found it.** All 44 entries of the liveness ledger's security
+subset (`permission` 33, `position` 4, `object` sharing/access 7) were
+call-graph-closed by hand and stamped `verifiedAt: 2026-07-30` — the subset's
+first-ever re-verification (previously 4 dated entries repo-wide, and the last
+sweep that cited preview renderers went 10-for-13 wrong). Beyond `enabled`:
+
+- `rowLevelSecurity.priority` → **dead + authorWarn**. Not merely unimplemented:
+  policies OR-combine (the schema's own describe says most-permissive-wins), so
+  the promised "conflict resolution" semantics cannot exist. A REMOVE candidate
+  per the #3715/#3950 precedent while the v17 breaking window is open.
+- `rowLevelSecurity.label` / `description` / `tags` → dead (benign display —
+  no consumer in either repo; deliberately not authorWarn'd).
+- `tabPermissions` was UNDERSTATED: the note said only `'hidden'` is read, but
+  hono's rank merge reads all four visibility values across resolved sets, and
+  the `me-apps-and-everyone-baseline` dogfood test exercises it. Evidence
+  upgraded; noted as a proof-binding candidate.
+- `allowExport` re-verified TRUE against the suspicion that it was
+  projection-only: the export route carries its own caller-level 403 gate
+  (`enforceExportPermission`), fail-closed when the security service cannot
+  answer, separate from the object-level 405.
+- `allowTransfer/Restore/Purge` notes re-confirmed accurate (M2 operations still
+  unshipped; the RBAC gates are pre-mapped fail-closed).
+- `object.ownership` evidence had rotted (line drift) — refreshed; six other
+  object-level security entries re-cited and stamped.
+
+No other runtime behaviour changes.

.changeset/showcase-approver-and-picker-specimens.md

@@ -0,0 +1,4 @@
+---
+---
+
+test(showcase): dogfood specimens for the inline record picker (#3405) and the record-backed approver kinds (#3508) — releases nothing. Both live in `@objectstack/example-showcase`, which is private.

.changeset/temporal-hooks-on-contract.md

@@ -0,0 +1,25 @@
+---
+"@objectstack/spec": minor
+"@objectstack/service-analytics": patch
+---
+
+feat(spec): promote the temporal storage hooks onto the IDataDriver contract (ADR-0053 D-A2)
+
+`temporalFilterValue` and `temporalFilterColumnSql` — the pair that closed
+#3912's storage-form drift — were duck-typed: analytics probed
+`typeof driver.x === 'function'` against a locally-invented interface, and
+nothing at the type level said a driver must implement both or neither. The
+lesson of #3912 is precisely that coercing the comparand without normalising
+the column reintroduces half the bug, so a driver implementing one hook alone
+would silently regress.
+
+Both are now optional members of `IDataDriver`
+(`@objectstack/spec/contracts`), documented as a pair with "absent = identity"
+semantics for drivers whose storage form is the wire form (memory, mongo).
+`SqlDriver implements IDataDriver`, so its signatures are compile-checked from
+here on; analytics derives its driver seam by `Pick`-ing the contract instead
+of a local duck type. Runtime `typeof` guards remain — that is the correct way
+to consume an optional contract member — but the shape they guard now has one
+authoritative definition.
+
+No runtime behaviour change. ADR-0053 D-A2 is recorded as resolved.

.github/workflows/ci.yml

@@ -196,6 +196,126 @@ jobs:
           path: .turbo/cache
           key: ${{ runner.os }}-turbo-${{ github.job }}-${{ github.ref_name }}-${{ github.sha }}
 
+
+  # ── Temporal conformance against live, non-UTC servers (ADR-0053 D-A3) ─────
+  #
+  # The datetime storage work (#3912/#3942) was verified against real servers
+  # because every one of its bugs was invisible on all-UTC infrastructure: a
+  # zone-naive write resolved in the SERVER's zone on Postgres, mysql2 rendered
+  # a Date in the HOST's zone, and a bare YYYY-MM-DD comparand meant a
+  # different midnight per dialect. The committed suites are opt-in
+  # (OS_TEST_POSTGRES_URL / OS_TEST_MYSQL_URL) and skip without a server, so
+  # without this job they would never run in CI and the seam could regress
+  # silently — D-A3's exact concern.
+  #
+  # Every timezone here is deliberately DIFFERENT: servers at +08:00, the Node
+  # process at America/New_York, assertions in UTC. Both suites assert they
+  # are pointed at a non-UTC server, so a mis-provisioned service fails loudly
+  # instead of letting the job pass vacuously.
+  temporal-conformance:
+    name: Temporal Conformance (live PG + MySQL)
+    needs: filter
+    if: needs.filter.outputs.core == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_PASSWORD: postgres
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd="pg_isready -U postgres"
+          --health-interval=5s
+          --health-timeout=5s
+          --health-retries=12
+      mysql:
+        # Real MySQL 8.0. The hands-on verification of #3942 ran on MariaDB
+        # 10.11 — the stricter dialect for datetime literals — so this job is
+        # the other half of the compatibility claim. `-h 127.0.0.1` forces the
+        # ping over TCP: the image's init phase runs mysqld with networking
+        # disabled, so a socket ping would report healthy before init finishes.
+        image: mysql:8.0
+        env:
+          MYSQL_ROOT_PASSWORD: root
+          MYSQL_DATABASE: conformance
+        ports:
+          - 3306:3306
+        options: >-
+          --health-cmd="mysqladmin ping -h 127.0.0.1 -uroot -proot"
+          --health-interval=5s
+          --health-timeout=5s
+          --health-retries=24
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      # Service containers cannot override the image command, so the non-UTC
+      # zones are set post-start through each server's own mechanism. Echoed
+      # back so a provisioning failure is visible in the log — though the
+      # suites' own non-UTC guards are the real gate.
+      - name: Point both servers at a non-UTC timezone
+        run: |
+          docker exec ${{ job.services.postgres.id }} psql -U postgres -c "ALTER SYSTEM SET timezone='Asia/Shanghai'"
+          docker exec ${{ job.services.postgres.id }} psql -U postgres -c "SELECT pg_reload_conf()"
+          docker exec ${{ job.services.postgres.id }} psql -U postgres -tAc "SHOW timezone"
+          docker exec ${{ job.services.mysql.id }} mysql -uroot -proot -e "SET GLOBAL time_zone = '+08:00'"
+          docker exec ${{ job.services.mysql.id }} mysql -uroot -proot -N -e "SELECT @@global.time_zone"
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v7
+        with:
+          node-version: '22'
+
+      - name: Enable Corepack
+        run: corepack enable
+
+      - name: Get pnpm store directory
+        shell: bash
+        run: |
+          echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
+
+      - name: Setup pnpm cache
+        uses: actions/cache@v6
+        with:
+          path: ${{ env.STORE_PATH }}
+          key: ${{ runner.os }}-pnpm-store-v3-${{ hashFiles('**/pnpm-lock.yaml') }}
+          restore-keys: |
+            ${{ runner.os }}-pnpm-store-v3-
+
+      # Restore-only (same policy as every other job); falls back to the Test
+      # Core namespace because that job builds a superset of what this one
+      # needs and its cache is seeded from main.
+      - name: Restore Turbo cache
+        uses: actions/cache/restore@v6
+        with:
+          path: .turbo/cache
+          key: ${{ runner.os }}-turbo-${{ github.job }}-${{ github.ref_name }}-${{ github.sha }}
+          restore-keys: |
+            ${{ runner.os }}-turbo-${{ github.job }}-
+            ${{ runner.os }}-turbo-test-${{ github.ref_name }}-
+            ${{ runner.os }}-turbo-test-
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build driver-sql and its dependencies
+        run: pnpm exec turbo run build --filter=@objectstack/driver-sql... --concurrency=4
+
+      # The whole driver-sql suite runs under the skewed process zone — not
+      # just the live-server files — so a TZ-sensitive assumption anywhere in
+      # the driver's tests fails here before it can ship.
+      - name: Run driver-sql suite against both live servers
+        env:
+          TZ: America/New_York
+          OS_TEST_POSTGRES_URL: postgres://postgres:postgres@127.0.0.1:5432/postgres
+          OS_TEST_MYSQL_URL: mysql://root:root@127.0.0.1:3306/conformance
+        run: pnpm --filter @objectstack/driver-sql test
+
   dogfood:
     # Sharded 2-way: the suite is ~60 independent test files, each booting its
     # own in-process app, and a single 4-vCPU runner needed ~7½ minutes for the

.objectui-sha

@@ -1 +1 @@
-4a4829d0ef3926e9b55757bfb1e369d6dca61ac2
+a136322f872314a74462ac7e7142f424e1124400