Epic: 11.0 major release — breaking-change batch + GA readiness #2364

Goal: define and ship the next major version (11.0) as a deliberate, batched breaking-change + GA-readiness release.

Why this epic exists

Fixed-group packages are at 10.3.0; the 43 pending changesets are all minor/patch (0 major), so today's release would be 10.4.0. Majors in this project are triggered by breaking changes (e.g. 10.0.0 = ADR-0057 sys_department→sys_business_unit). Nothing currently forces 11.0 — it is a choice to batch the breaking cleanups + close GA gaps. This epic is the cut list. Each breaking item should ship with an additive migration (spec sync / os migrate, per #2186).

Status legend: ☐ todo · ◐ partial · ✅ done (verify & close)

A. Breaking batch — the "definition of 11.0" (core)

Each of these removes or changes an authored/public contract → belongs in a major. Pair each with a migration.

A1. Security "enforce-or-remove" (ADR-0049)

• [P0][security] PolicySchema is 100% dead — enforce or remove #1882 — PolicySchema is 100% dead. Remove from spec (no runtime consumer; plugin-auth hardcodes session/password). Breaking (apps authoring Policy lose a no-op). Deprecation note + migration. (Triaged: STILL-DEAD.)
• [P0][security] Role parent dead — manager-rollup unimplemented #1886 — role.parent enforcement dead. Either implement manager-rollup hierarchy walk in plugin-sharing team-graph.ts or remove role.parent and point hierarchy at sys_business_unit. Breaking if removed. (Triaged: authoring-live, enforcement-dead.)
• [security][立项位] M2 权限生命周期(undelete/purge)功能与 allowRestore/allowPurge RBAC 同批建设(evaluator 已 fail-closed,allowTransfer 已 enforced) #1883 — permission.allow{Transfer,Restore,Purge}. Interim is OK (fail-closed gate exists, ops don't). Decide for 11.0: implement the ops + enforce (additive, non-breaking) or formally keep [experimental]. (Triaged: PARTIAL — not a blocker.)

A2. Dead spec-surface removal (liveness ledger — ADR-0049)

• field: remove aspirational nested configs that are author-facing no-ops — currencyConfig, vectorConfig, encryptionConfig, maskingRule, cached, dataQuality, fileAttachmentConfig (verify each), + naming-drift props (~39 dead of 73).
• object: remove the dead versioning / partitioning / CDC tier props (~17 dead); decide apiEnabled (unenforced).
• action / agent / skill / dataset: remove action.disabled (CEL ignored), action.type:'form' / shortcut / bulkEnabled; agent.access/permissions/visibility (chat route hardcodes); skill.triggerPhrases / skill.permissions; dataset.measures.certified.
• decide experimental: agent.autonomy, tool.inputSchema → implement or mark deprecated-for-removal.

A3. Deprecated alias / API removals (verified still present)

• flow node aliases http_request / http_call / webhook → canonical http (packages/spec/src/automation/flow.zod.ts:33); align FlowNodeAction enum with the live registry.
• ADR-0041 — remove old plugin-trigger-record-change / plugin-trigger-schedule (new @objectstack/trigger-* already shipped).
• client-react legacy query fields select/filters/sort/top/skip → fields/where/orderBy/limit/offset.
• remove HttpDispatcher class (replaced by createDispatcherPlugin()), UIServiceSchema, IDataEngine (→IDataDriver), legacy env-var aliases.
• delete the stale plugin-dev stub still annotated "removed in v4.0.0" (we're at v10).

B. GA functional gaps (triaged — mostly objectui/cloud)

• [P0] detail-page: no inline message composer component — AI-suggested replies are visible but un-sendable #1293 — inline message composer on detail pages (AI-suggested replies are un-sendable). OPEN — real gap (objectui).
• [P0] field-render: LookupCellRenderer hardcodes display-field candidates — related cells show raw IDs unless field is named name #1295 — lookup cell display field: pickRecordDisplayName supports preferredField but LookupCellRenderer call sites never pass the target's displayNameField. OPEN — small fix (objectui).
• [P0] portal: no external-user portal mechanism — customers see the full admin Console chrome #1294 — external-user portal: spec + bootstrap shipped; verify runtime LayoutDispatcher portal routing + auth middleware end-to-end. ◐ verify, then close. Incl. [portal] record detail URL scheme + share-link 协议（GAP-7 of #1294） #1337 (detail URL / share-link), [portal] action 完成后导航策略（onComplete + portal 级默认）（GAP-8 of #1294） #1338 (onComplete nav).
• [P0] notification: no outbound notification channel — every flow's notify node is a no-op #1292 — notify channel: infra built (notify node + MessagingService + email/inbox + outbox); wire into example templates + add an e2e notify→delivery dogfood proof; it degrades to a no-op when MessagingServicePlugin is absent. ◐ wiring + proof.
• [P0] field-type: file field has no upload UI; no attachment_list type — attachments end-to-end blocked #1296 — file field upload: file type + FileField widget (drag-drop/camera/progress) shipped. ✅ verify attachment_list need, then close.

C. Unfinished ADRs

• ADR-0028 — namespace isolation ((namespace,type,name) identity + physical-name derivation): prevents silent table-name collisions across co-installed packages. Identity change is itself breaking → good 11.0 fit.
• ADR-0029 K3/K4 — kernel object decomposition finish + remove migration-era empty barrels (hygiene).
• ADR-0017 has-many — RLS still client-enforced (security gap); backend enforcement before GA.
• High-value, optional: ADR-0025 plugin install/consent loop, ADR-0027 authoring lifecycle orchestrator, ADR-0013 Slack inbound.
• Backend-done / UI-pending (objectui): ADR-0007 Settings UI, ADR-0032 expression builders, ADR-0044 approval send-back designer.

Deferred by design (not blockers): ADR-0039 Track B, ADR-0010 NL→Flow, ADR-0031 BPMN, ADR-0026 client-UI plugins.

D. Release mechanics & quality (healthy)

• changeset hygiene: fixed group (73 pkgs) consistent; cut major cleanly; wait for remote CI green, no --auto (per past tag-race).
• confirm atomic tag push (fix(release): push version tags in one atomic push (avoid commit_refs race) #2195) still in place for the large fixed group.
• quality baseline good: ~6 source TODOs (none blocking), minimal/intentional test skips, field-zoo xfail are deliberate watchdogs.

Cut checklist (Definition of Done for 11.0)

1. A1–A3 breaking items landed, each with an additive migration.
2. B gaps triaged → GA-required subset (likely portal + composer + notify proof) shipped; resolved ones ([P0] field-type: file field has no upload UI; no attachment_list type — attachments end-to-end blocked #1296) closed.
3. ADR-0028 + 0029 K3/K4 + 0017 backend RLS merged.
4. objectui/cloud surface PRs aligned & merged.
5. changesets clean, fixed group consistent, remote CI green → tag 11.0.

Triage source: assessment + two verification passes (functional P0s #1292/#1295/#1296/#1293/#1294; security P0s #1882/#1883/#1886) on 2026-06-27.