Merge origin/main into claude/issue-7277-adr-0029-d9-overlay-layer

一处冲突:`scripts/adr-anchors.json` —— main 的 #7301 把 ADR 锚点注册表
按文件分片(`scripts/adr-anchors/*.json`)并删除了整块 JSON,本分支同时
改了其中两条锚点的内容。按**并集**处置,不是二选一:采用 main 的分片布局,
把两条锚点的新内容移植进对应分片。

- `packages__objectql__src__registry.ts.json` —— invariant 由「D9 是
  DESIGN ONLY,不要实现」改写为已落地的模型
- `packages__metadata-protocol__src__protocol.ts.json` —— 依 D9 §8 加上
  ADR-0029;移植前逐字节校验了 main 侧 ADR-0119 那句未变,确保是并集而非覆盖

生成物 `content/docs/references/**` 取 main 一侧后用 `gen:schema` +
`gen:docs` 重新生成,未手工合并。

其余全部自动合并。main 的 #7260 把**记录**所有权枚举扩成
`user | business_unit | org | none`,与 D9 的**贡献**种类
(`own | extend | overlay`)是两个枚举,两侧改动均完整保留。
main 对 `registry.ts` 的改动是 `applySystemFields` 内的纯注释,与 D9 模型
无交集;`registerObject` / `resolveObject` / `getArtifactItem` / 两个
hydration 缝 / delete heal 均未被 main 触碰。任何钉子都未移动。

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W6bLax4KMrSfnE1ydFU8Dw

Author: claude

.changeset/approvals-nav-points-at-inbox.md

@@ -0,0 +1,31 @@
+---
+'@objectstack/platform-objects': minor
+'@objectstack/plugin-approvals': minor
+---
+
+Point the account app's **Approvals** navigation entry at the Approvals Inbox component, and contribute an **Approvals Inbox** entry to Setup (#7234).
+
+The entry point has not moved — the account menu still shows **Approvals** with the same
+label and icon in every locale. Its destination has. It used to open the raw
+`sys_approval_request` grid, which is an admin/diagnostic view of the engine's own table
+and cannot show an approver a single decision button: every action on that object is gated
+on `record.viewer.can_act || record.viewer.can_override`, and the `viewer` block is
+attached only by the approvals REST path, never by the generic data API the object route
+reads. The result was a correct-looking list of rows nobody could act on. The entry is now
+`{ type: 'component', componentRef: 'approvals:inbox' }`, so it opens the full inbox —
+decision actions, business vocabulary, node progress and the request drawer.
+
+- **Account app**: `nav_account_approvals` becomes a component entry gated by
+  `requiresService: 'approvals'`, so it disappears where `plugin-approvals` is not
+  installed (the previous `requiresObject` gate does not apply to a component entry).
+- **Setup**: `plugin-approvals` contributes a new **Approvals Inbox** entry at the top of
+  **Setup → Approvals**, above the three raw tables, which stay exactly as they were —
+  admin-gated by `manage_platform_settings` and now unambiguously the diagnostic surface.
+  Labels ship in all four locales (zh-CN 审批中心).
+- `sys_approval_request` is no longer surfaced raw to end users anywhere.
+- **Docs**: the approver's queue is documented as the Approvals Inbox, with a snippet for
+  mounting it in any business app — one navigation entry naming the component-registry key
+  `approvals:inbox`, never a console path.
+
+Reaching the inbox end to end in the browser additionally requires the console pin bump,
+tracked separately.

.changeset/audit-tracked-change-summary-locale-and-lookup.md

@@ -0,0 +1,48 @@
+---
+"@objectstack/plugin-audit": patch
+---
+
+fix(plugin-audit): localize the tracked-change activity label and render lookup titles instead of raw ids (#7230)
+
+`sys_activity.summary` is composed at write time and shipped verbatim to every
+feed surface at once — the record discussion feed, console home activity, the
+header inbox, the Setup `sys_activity` list, and mobile/REST/SDUI. Its
+tracked-change branch (ADR-0052 §5b, `"<label>: <old> → <new>"`) was producing
+strings like `Rating Owner: ∅ → oBK25…` at the bottom of an otherwise
+fully-localized page. Two independent causes, both fixed here:
+
+- **The label was never localized.** `renderTrackedChangeSummary` was the one
+  summary branch never handed the locale-bound `translate` its three siblings
+  (`messages.activityCreated` / `messages.activityDeleted` /
+  `messages.activityUpdated`, plus the object label via `displayLabelFor`) all
+  resolve through — an oversight against ADR-0053 / #3039 write-time
+  localization. The field label now resolves through the same translator, on the
+  bundles' own key shape (`objects.<object>.fields.<field>.label`), and falls
+  back to the authored `label`, then the machine key, exactly as before.
+- **A reference value printed its raw id.** `displayFieldValue` resolved
+  select/picklist option labels only, so a `lookup` / `master_detail` / `user`
+  value fell through to `String(value)` — the stored 32-char id. It now renders
+  the referenced record's title, resolved through ADR-0079's
+  `resolveDisplayField` (`nameField` → deprecated `displayNameField` alias →
+  derivation) rather than a local name-guessing heuristic.
+
+The `∅ →` notation is unchanged, and so is every other summary branch. The
+change is restore-invariant: an id that cannot be resolved — a target removed
+out of band, an unregistered object, a failing read — renders exactly as it did
+before.
+
+**Read cost, measured with a counting driver** (the same technique that measured
+#6656 / PR #6977's retirement of the redundant pre-image read from this write
+path, and pinned as cases in `audit-lookup-summary.test.ts`):
+
+- **0 added reads** on every create, every delete, every update that moves no
+  tracked reference field, and every update that moves an *untracked* one —
+  including on rows that do carry references. #6977's counts (1 `findOne` per
+  single-id write, 0 per predicate write) are untouched.
+- **1 read per distinct target object** on an update that does move a tracked
+  reference: both sides of the change are answered by a single
+  `id: { $in: [...] }` selecting only the id and title columns, however many
+  tracked reference fields point at that object.
+
+Historical `sys_activity` rows keep their original write-time composition — only
+new writes improve.

.changeset/autonumber-counter-readback-shared.md

@@ -0,0 +1,48 @@
+---
+'@objectstack/spec': patch
+'@objectstack/objectql': patch
+'@objectstack/driver-sql': patch
+---
+
+refactor(spec,objectql,driver-sql): the autonumber counter readback is one shared pure function, beside the renderer it inverses (#6560)
+
+`packages/spec` gains `readAutonumberCounter(value, prefix, suffix)`, the declared
+inverse of `renderAutonumber`, and both consumers call it instead of holding their
+own copy.
+
+**Why the inverse belongs where the composition already lives.** `renderAutonumber`
+composes `prefix + zero-padded(seq) + suffix` and its file header states it is
+"shared by the ObjectQL engine and the SQL driver so both paths render identical
+record numbers". PR #6553 (#6468) had to teach both seeding paths to read a counter
+back out of a stored value — and landed that reading as two hand-written copies of
+the same four lines, one in `packages/objectql`, one in
+`packages/drivers/driver-sql`. That is the exact shape of the defect those copies
+were fixing: two independent readings of one composition rule had already drifted
+into two *different* wrong answers over one dataset (`001-2026` read as `2026` by
+the engine and `12026` by the driver), so the record-number band a tenant received
+depended on which driver happened to run, and numbers burned that way cannot be
+reclaimed. A cross-package `runtime` parity test caught the drift once; it does not
+force a future single-side edit to run it.
+
+**What moved and what did not.** Only the ANCHORED rule — the one both sides must
+apply identically — is now spec's: the counter is the digit run at the start of
+what follows the rendered `prefix`, after stripping the rendered `suffix` when the
+value carries it (stripped when it matches, never required to match, since one
+counter spans the years a dynamic suffix renders). Out-of-scope values read as
+`undefined`, which also gives the SQL driver back its JS-side re-check of a `LIKE`
+that matched looser than `startsWith` under a case-insensitive collation.
+
+The UNANCHORED case (neither affix declared) stays per-side, because the two sides
+deliberately differ there and #6553 preserved both byte-for-byte: the engine reads
+the last digit run, the driver concatenates every digit. Spec returns `undefined`
+rather than pick one — a shared contract that claimed an agreement which does not
+exist would be worse than no shared contract. Each side documents its own fallback
+at its own call site.
+
+**Zero behaviour change.** Every call site keeps its existing guards and its
+existing result for every input; the `packages/runtime` cross-side parity suite that
+pins the two seeding paths against each other is unmodified and passes as-is, which
+is the evidence the semantics moved without changing. Per the maintainer's ruling on
+#6560 (2026-08-08, twice, re-confirmed 2026-08-10): a non-authorable export — no
+Zod, no new vocabulary, no acceptance-face change — so this is api-surface
+bookkeeping plus two call-site swaps.

.changeset/comment-gate-own-depth-contract.md

@@ -0,0 +1,30 @@
+---
+"@objectstack/spec": patch
+"@objectstack/plugin-audit": patch
+---
+
+docs(spec,plugin-audit): record that the parent-record write gates match ownership at `own` BY DESIGN (#7144)
+
+Documentation only — no gate changes what it returns for any input.
+
+`ISharingService`'s write gates widen ownership "by write DEPTH", but that depth
+is an INPUT the caller supplies: the CRUD middleware resolves it for the object
+of the operation in flight and stamps it on the operation context. The
+`sys_comment` gates (`@objectstack/plugin-audit`) and the `sys_attachment` kit
+(`@objectstack/service-storage`) ask this service about the PARENT record's
+object, so the stamped depth belongs to a different object and is dropped — and
+the owner-match runs at its narrowest, `own`. A caller whose write depth on the
+parent is `unit` / `unit_and_below` / `org` can therefore edit that parent
+directly and is refused when editing a comment or attachment on it.
+
+That divergence is deliberate and runs in the restrictive direction (refusals,
+never a leak). The contract now says so, and — the part that matters for anyone
+tempted to "fix" it — says WHY the alternative is not merely unimplemented:
+`ISecurityService.resolveWriteScope`, the only tool a package outside
+`plugin-security` has for the parent's depth, fails OPEN, because
+`getEffectiveScope` returns `'org'` when no permission set mentions the object
+at all — indistinguishable from a genuine `modifyAllRecords` holder. Handed to a
+write gate as the depth it becomes authoritative on its own and the owner-match
+short-exits `true` for every owned row of that object. Inheriting the parent's
+edit authority starts with a depth primitive that can tell "org depth" from
+"nothing matched", not with these gates.

.changeset/default-agent-value-lint.md

@@ -0,0 +1,26 @@
+---
+"@objectstack/lint": minor
+---
+
+feat(lint): `validate-ai-agent-authoring` 新增 `app.defaultAgent` 取值检查(warning 档,#6041)
+
+`app.defaultAgent` 的 Zod 类型是 `SnakeCaseIdentifierSchema`,任何 snake_case
+字符串都能 parse、build、通过 `os:check` —— 但运行期只解析平台 agent 名单
+(`ask`/`build` 及其历史别名 `data_chat`/`metadata_assistant`,ADR-0063 §2),
+表外的名字会静默回落到平台默认值。#5985 实测:把坏例子
+`defaultAgent: 'sales_copilot'` 放回语料后,`check:skill-examples` 仍 208
+全绿、EXIT=0 —— 现有门禁对这类缺陷结构性失明,这正是坏语料当初得以发布的机制
+(语料本身已由 PR #6030 修复)。
+
+本 PR 是 `validate-ai-agent-authoring` 已有规则(此前只扫描 `stack.agents`
+数组)的取值半边:遍历 `stack.apps[].defaultAgent`,取值不在
+`PLATFORM_AGENT_NAMES`(复用同文件既有名单,未新建重复列表)内即产出一条
+`warning` 级 finding(规则 id `default-agent-outside-roster`),消息中点名
+实际取值与允许集合。维护者裁定(2026-08-07,2026-08-09 重申)为 **A 档**:
+warning 而非 error —— 危害等级是静默回落而非崩溃,且不惩罚存量元数据;
+schema 本身不收窄为 enum(ADR-0063 已经撤回过一次 breaking 的收紧)。
+
+落地前已按裁定要求测量现存 in-repo `app.defaultAgent` 取值:仅
+`packages/platform-objects/src/apps/studio.app.ts` 一处真实赋值
+(`defaultAgent: 'metadata_assistant'`,合法平台别名),对该值实际跑规则
+0 条 finding —— "不惩罚存量" 的前提已验证而非假设。

.changeset/engine-query-options-search-union.md

@@ -0,0 +1,50 @@
+---
+"@objectstack/spec": minor
+"@objectstack/metadata": patch
+---
+
+fix(spec): `EngineQueryOptionsSchema.search` accepts the bare query string ADR-0061 D1 calls canonical (#7178)
+
+Two sibling schemas in `packages/spec` described the same key and disagreed.
+`BaseQuerySchema.search` (`query.zod.ts`, hence `QueryAST`, hence `DriverQuery`)
+has been `z.union([z.string(), FullTextSearchSchema])` since its own drift
+repair, with a doc comment saying why: the bare string **is** the canonical
+Tier-1 contract (ADR-0061 D1 — "the client sends only the query text; the server
+resolves which fields to search from object metadata"), it is what every surface
+sends, and it is what the dogfood HTTP proof pins.
+`EngineQueryOptionsSchema.search` — the options type of `IDataEngine.find` /
+`findOne` — declared the structured `FullTextSearchSchema` **only**.
+
+The runtime never agreed with that narrowing. `expandSearchOnAst`
+(`objectql/src/engine.ts`) reads `search` through `normalizeSearch`, whose first
+line is `if (typeof raw === 'string') return { query: raw }`, and
+`protocol-data.test.ts` asserts the protocol layer hands the engine a bare
+string. So the type forbade what the engine serves, and callers paid the
+standard price: `as any` on the query argument — which does not suppress
+`search` alone, it switches off checking for `where` / `orderBy` / `fields` in
+the same literal. Since this schema is not `.strict()`, an unknown key there is
+**silently dropped**, so the cast this divergence forced was precisely the cast
+`check:query-options-erasure` exists to stop.
+
+This is the same-family drift REPAIR, not a new dialect — the identical fix
+`BaseQuerySchema.search` already carries, for the identical reason. On the query
+side the divergence surfaced as a validation failure the moment #3899 started
+validating request bodies; here it surfaced as a type error, when #6231 retyped
+`DatabaseLoader`'s read helpers to `DriverQuery` and the **engine** branch alone
+refused to compile (TS2345 — `DriverQuery` not assignable to
+`EngineQueryOptionsParsed`, purely because of `search`; nothing else differs).
+
+Consumer census before landing, per the card's own guard: every site that reads
+object-form members off an engine-options `search` already narrows with `typeof`
+— `engine.ts` (`typeof raw === 'object' ? raw?.fields : undefined`),
+`search-filter.ts` `normalizeSearch`, and `metadata-protocol/protocol.ts`'s
+`searchFields` ingress gate. No consumer needed a guard added, and none changes
+behavior: they were all written for the union already. `count` is untouched —
+`EngineCountOptionsSchema` declares no `search` key at all.
+
+With the schemas agreed, the casts the divergence forced are deleted:
+`DatabaseLoader`'s three engine-branch `as any` (`_find` / `_findOne` /
+`_count`), which restores real `where` / `orderBy` / `fields` checking on the
+metadata main read path, and the seven `as any` in
+`engine-findone-contract.test.ts` that were passing the canonical spelling.
+`scripts/query-options-erasure-baseline.json` is ratcheted down accordingly.

.changeset/execution-context-single-assembler.md

@@ -0,0 +1,47 @@
+---
+"@objectstack/core": minor
+"@objectstack/runtime": patch
+"@objectstack/rest": patch
+---
+
+refactor: one shared `ExecutionContext` assembler, two named anonymous entries (#6216)
+
+`resolveAuthzContext` already made AUTHORIZATION resolution single-sourced; the
+step after it — turning the resolved envelope into the `ExecutionContext` that
+reaches enforcement — was still one hand-written copy per transport, and the
+copies drifted twice for real: **#6071** (the REST copy never set
+`principalKind`, so every enforcement judgment reading it was silently
+never-true on that face) and **#6206 / #6551** (a dropped `accessible_org_ids`
+produced real 403s on the share-link faces).
+
+**@objectstack/core** gains the single assembly, with the anonymous divergence
+as named API rather than drift (maintainer ruling 2026-08-08 on #6216, Option
+A):
+
+- `assembleExecutionContext(input)` — the **fail-closed default** entry. No
+  resolved principal → `undefined`, and the surface answers 401.
+- `assembleExecutionContextOrGuest(input)` — the **explicit guest** entry. No
+  resolved principal → a first-class guest envelope (`principalKind: 'guest'`,
+  `positions: ['guest']`), whose consumers are live (`explain-engine`'s
+  guest ⇒ `EXTERNAL` posture floor). Adopted only by a surface whose product
+  semantics serve anonymous principals.
+- The field set is **closed by type**: `ExecutionContextEntryFields` requires a
+  decision for every `ExecutionContext` field that is not explicitly declared
+  non-entry-resolved, so a new field cannot reach one transport and miss
+  another. Also exported: `ENTRY_EXECUTION_CONTEXT_FIELDS`,
+  `EntryExecutionContextField`, `ExecutionContextAssemblyInput`,
+  `OAuthTokenProvenance`, `EntryLocalization`.
+
+**@objectstack/runtime** (`resolveExecutionContext`, the runtime / MCP
+dispatcher) and **@objectstack/rest** (`computeExecCtx`) now assemble through
+that module — the dispatcher via the guest entry, REST via the fail-closed
+default.
+
+**No runtime behaviour change on either surface.** The remaining per-face
+divergences are required inputs rather than silent omissions: REST passes
+`accessToken: undefined` (it has never carried the session bearer on the
+envelope, and `session.accessToken` is a published hook surface) and
+`oauth: undefined` (OAuth bearers are honoured on the `/mcp` door alone). The
+one measurable difference is that a key whose value was `undefined` is now
+omitted rather than spelled — invisible to `ctx.x` reads, to `JSON.stringify`
+and to spreading the envelope.

.changeset/hip-planes-shake.md

@@ -0,0 +1,20 @@
+---
+'@objectstack/plugin-approvals': patch
+---
+
+Unify the approval-status vocabulary across the `sys_approval_request` i18n bundles (#7232).
+
+A request rendered through the generic object surfaces used a different word than the same
+request in the Approvals Inbox and in the account-app navigation. The bundles now say what
+those surfaces already say:
+
+- **zh-CN**: the `status` option `pending` reads 待审批 (was 待处理), and the `my_pending`
+  view reads 待我审批 (was 我的待办), matching the account-app nav entry; the view's
+  empty-state title was aligned to the same wording.
+- **en**: the `status` options are humanized — `Pending` / `Approved` / `Rejected` /
+  `Recalled` / `Returned` — instead of shipping the raw enum values as labels.
+- **ja-JP / es-ES**: the `my_pending` view label now matches the nav wording (承認待ち /
+  Aprobaciones pendientes).
+
+Status **values** are unchanged — this is display wording only, so no stored data, filter,
+or API payload is affected.