diff --git a/.changeset/action-bar-member-declared-visible-gate-3823.md b/.changeset/action-bar-member-declared-visible-gate-3823.md
deleted file mode 100644
index 18e5625900..0000000000
--- a/.changeset/action-bar-member-declared-visible-gate-3823.md
+++ /dev/null
@@ -1,47 +0,0 @@
----
-"@object-ui/components": patch
----
-
-`action:bar` member actions declaring `visible: false` are now hidden instead of rendered
-
-`action:button` and `action:icon` carried the same truthiness gate objectui#3812
-removed from the member-action leaves — `if (schema.visible && !isVisible)
-return null` — so `visible: false`, the most explicit way an author can say
-"never show this", fell into the "no gate declared" branch and the action
-rendered anyway.
-
-objectui#3812's triage judged the five component-level `schema.visible` gates a
-dormant defensive layer, because `packages/react`'s `SchemaRenderer` evaluates
-`newSchema.visible !== undefined` and hides the node before the component ever
-mounts. Two of the five are not dormant, and this is the difference:
-
-`action:bar` does not route through `SchemaRenderer`. It resolves each member's
-renderer from the `ComponentRegistry` itself and spreads the whole member action
-onto that renderer's schema, so an author's `visible` on a member arrives as the
-child's own `schema.visible` and lands on the child's gate. `action:bar` is also
-the only gate on that path by design — its `filteredActions` deliberately
-filters on `requiredPermissions` and `actionRendersAt` only, leaving `visible` to
-the member renderer. The path is reachable end-to-end and is now pinned that way
-(registry-mounted `action:bar`, member declaring `visible: false`), so the
-reachability does not have to be argued again.
-
-Both gates now read the same named definition as the rest of the family,
-`hasDeclaredVisibilityGate` (`!= null && !== ''`) — the invariant objectui#3492
-established for the selection bar and objectui#3758 applied to the row-action
-surfaces. The evaluation entry is untouched and already short-circuits a boolean
-rather than handing it to the CEL engine, which `actionPredicate.parity` pins for
-both the engine and the renderer path.
-
-Behaviour change surface, deliberately narrow: only an `action:button` /
-`action:icon` whose `visible` is the literal boolean `false` (or another falsy
-non-empty value) changes — from rendered to hidden, which is what the
-declaration asked for. `visible: true` still renders, `''` and an absent
-`visible` are still no gate at all, and no expression-valued `visible` changes
-verdict. `ActionSchema.visible` is `ExpressionInputSchema` with no boolean
-member, so `objectstack build` cannot emit this shape; hand-written view JSON and
-in-process callers constructing action defs can.
-
-The remaining three component-level gates (`action:group`, `action:menu`,
-`action:bar`'s own) stay as they are — they only ever mount through
-`SchemaRenderer`, which resolves `visible` first, and the overflow `action:menu`
-that `action:bar` synthesizes carries no `visible` at all.
diff --git a/.changeset/action-declared-disabled-gate-3842.md b/.changeset/action-declared-disabled-gate-3842.md
deleted file mode 100644
index 57d743d7c7..0000000000
--- a/.changeset/action-declared-disabled-gate-3842.md
+++ /dev/null
@@ -1,52 +0,0 @@
----
-"@object-ui/app-shell": patch
-"@object-ui/components": patch
----
-
-An action declaring `disabled: ''` is no longer greyed out forever (objectui#3842)
-
-The "is a `disabled` gate declared?" test stopped at `!= null`, missing the
-`!== ''` half of the invariant the `visible` family converged on
-(`hasDeclaredVisibilityGate`, objectui#3492 / #3758 / #3812 / #3823 / #3835). So
-`disabled: ''` counted as a declared gate, and the verdict went to the evaluation
-entry — which reads an empty predicate as "no condition → `true`"
-(`toPredicateInput('')` is `undefined`, `evaluateCondition(undefined)` is `true`).
-
-The direction is why this half is a defect and the `visible` half was not. On
-`visible`, that `true` means SHOW, so an over-broad "declared" test and a
-permissive empty predicate cancel out and `visible: ''` renders either way. On
-`disabled`, the same `true` means DISABLE — the two mistakes compound, and an
-empty predicate stopped meaning "no gate" and started meaning "permanently
-greyed out". One empty predicate, opposite treatment under two keys.
-
-Two gates now ask the shared definition instead:
-
-- `@object-ui/app-shell`'s `DeclaredActionsBar` — the hot one. Its actions are
-  SERVER-declared (`objectDef.actions[]`) and its hosts are the approvals inbox's
-  record sections, so a `disabled: ''` arriving from metadata (an authoring form
-  left empty, a template that rendered to an empty string) produced an Approve /
-  Reject button nobody could click, indistinguishable from deliberate metadata.
-  objectui#3835 was this same surface failing the other way.
-- `@object-ui/components`' `action:button` — verified to be the same shape before
-  it was changed (the issue inferred it from the identical spelling but did not
-  probe it): with `disabled: ''` the rendered button carried `disabled=""`.
-
-**Behaviour change surface, deliberately narrow.** Only `disabled: ''` changes —
-from disabled to clickable, which is what "no predicate" asked for. `disabled:
-true` still disables, `disabled: false` and an absent `disabled` still do not, and
-no expression-valued `disabled` changes verdict. One consequence worth naming: on
-`action:button`, an empty `disabled` now falls THROUGH to the legacy non-spec
-`enabled` fallback instead of short-circuiting on the empty predicate, so an
-action spelling both (`disabled: ''` + `enabled: true`) becomes clickable.
-
-The legacy `enabled` leg of `action:button` was routed through the same
-definition for consistency, and that part is behaviour-preserving by derivation
-rather than a fix: the leg is negated (`disabled = !isEnabled`), so an empty
-predicate's `true` already arrived as "not disabled" — the same verdict "no gate"
-produces. All four shapes are identical under either test; the derivation table
-and the reason no test can distinguish them are written down next to the pins.
-
-`hasDeclaredVisibilityGate` keeps its historic name at both call sites (the
-objectui#3842 dispatch ruling): the predicate is key-neutral, and one
-implementation behind two names is how a repo grows dialects. Each call site says
-so in a comment.
diff --git a/.changeset/action-member-declared-disabled-gate-3849.md b/.changeset/action-member-declared-disabled-gate-3849.md
deleted file mode 100644
index f66b66875c..0000000000
--- a/.changeset/action-member-declared-disabled-gate-3849.md
+++ /dev/null
@@ -1,50 +0,0 @@
----
-"@object-ui/components": patch
-"@object-ui/plugin-detail": patch
----
-
-`disabled: ''` no longer greys out the remaining five action surfaces (objectui#3849)
-
-objectui#3842 / PR #3851 fixed the "is a `disabled` gate DECLARED?" test on
-`action:button` and app-shell's `DeclaredActionsBar`. Five same-shaped sites were
-outside that PR's scope and stayed on `!= null`, so within one component the
-`visible` gate asked `hasDeclaredVisibilityGate` while the `disabled` gate on the
-next line asked `!= null` — two spellings of one question:
-
-- `@object-ui/components` — `action:icon`, `action:group`'s inline button
-  (`InlineActionButton`) and dropdown item (`DropdownActionItem`), and
-  `action:menu`'s item (`ActionMenuItem`).
-- `@object-ui/plugin-detail` — `record:quick_actions`' `QuickActionButton`.
-
-Why the missing `!== ''` half is a defect on this key and not on `visible`:
-`toPredicateInput('')` is `undefined` and `evaluateCondition(undefined)` is
-`true`. On `visible` that `true` means SHOW, so an over-broad "declared" test and
-a permissive empty predicate cancel out. On `disabled` it means DISABLE, so they
-compound — `disabled: ''` (an empty predicate: nothing declared) rendered a
-permanently greyed-out control, with nothing the author could write to un-grey
-it. Unlike #3842's approvals inbox, these five are the general action face
-(toolbars, dropdowns, record quick actions), so the reach is wider even though no
-single high-value host owns them.
-
-**Behaviour change surface, deliberately narrow.** Only `disabled: ''` changes —
-from disabled to clickable, which is what "no predicate" asked for. `disabled:
-true` still disables, `disabled: false` and an absent `disabled` still do not, and
-no expression-valued `disabled` changes verdict. On the four sites that also carry
-the legacy non-spec `enabled` fallback, one consequence follows: an empty
-`disabled` now falls THROUGH to that leg instead of short-circuiting on the empty
-predicate, so an action spelling both (`disabled: ''` + `enabled: true`) becomes
-clickable. `record:quick_actions` has no `enabled` leg, so its chain is the single
-gate.
-
-Routing those legacy `enabled` legs through the same definition is
-behaviour-preserving by derivation rather than a fix: the leg is negated
-(`disabled = !isEnabled`), so an empty predicate's `true` already arrived as "not
-disabled" — the verdict "no gate declared" produces. #3842's four-shape derivation
-table is reproduced next to the new pins, together with the statement that no
-`enabled` case can go red by reverting that leg.
-
-`hasDeclaredVisibilityGate` keeps its historic name (the objectui#3842 ruling): the
-predicate is key-neutral, and one implementation behind two names is how a repo
-grows dialects. The three `@object-ui/components` sites import it relatively;
-`record:quick_actions` takes it from the package barrel, the cross-package route
-objectui#3835 opened. Every call site says so in a comment.
diff --git a/.changeset/action-member-declared-visible-gate-3812.md b/.changeset/action-member-declared-visible-gate-3812.md
deleted file mode 100644
index e0de1e891c..0000000000
--- a/.changeset/action-member-declared-visible-gate-3812.md
+++ /dev/null
@@ -1,37 +0,0 @@
----
-"@object-ui/components": patch
----
-
-Action-face member actions declaring `visible: false` are now hidden instead of rendered
-
-The three member-action gates on the action face asked truthiness —
-`if (action.visible && !isVisible) return null` — so `visible: false`, the most
-explicit way an author can say "never show this", fell into the "no gate
-declared" branch and the action rendered anyway:
-
-- `action:group` in `display: 'inline'` mode (`InlineActionButton`);
-- `action:group` in `display: 'dropdown'` mode (`DropdownActionItem`);
-- `action:menu`'s items (`ActionMenuItem`).
-
-These leaves `.map()` the component's own `actions` array, so neither
-`SchemaRenderer`'s node-level `visible` handling nor
-`ActionEngine.getActionsForLocation` (whose boolean `visible` was always
-correct) is in the path — the truthy gate was the only gate.
-
-All three now read one named definition, `hasDeclaredVisibilityGate`
-(`!= null && !== ''`), and let the declaration itself decide. This is not a new
-decision: objectui#3492 established the invariant for the selection bar, whose
-`hasVisibilityGate` spells out why truthiness cannot answer the question, and
-objectui#3758 applied it to both row-action surfaces. The evaluation entry is
-untouched and already short-circuits a boolean rather than handing it to the CEL
-engine, which `actionPredicate.parity` pins for both the engine and the renderer
-path.
-
-Behaviour change surface, deliberately narrow: only a member action whose
-`visible` is the literal boolean `false` (or another falsy non-empty value)
-changes — from rendered to hidden, which is what the declaration asked for.
-`visible: true` still renders, `''` and an absent `visible` are still no gate at
-all, and no expression-valued `visible` changes verdict.
-`ActionSchema.visible` is `ExpressionInputSchema` with no boolean member, so
-`objectstack build` cannot emit this shape; hand-written view JSON and
-in-process callers constructing action defs can.
diff --git a/.changeset/action-param-datetime-zoned-instant-os5061.md b/.changeset/action-param-datetime-zoned-instant-os5061.md
deleted file mode 100644
index f916e31a90..0000000000
--- a/.changeset/action-param-datetime-zoned-instant-os5061.md
+++ /dev/null
@@ -1,55 +0,0 @@
----
-"@object-ui/app-shell": patch
----
-
-`datetime` action params are usable in the Console for the first time — the dialog now POSTs the zoned ISO instant the platform requires instead of a shape the validator rejects
-
-An action declaring a `type: 'datetime'` param was unusable from the UI: **no
-value a user could pick could pass validation**. The dialog rendered the param
-as `datetime-local` (which is zone-less by nature) and then serialized on
-submit back to that control's own naive wall clock, e.g. `2026-08-10T15:00`.
-Since 17.0 the dispatcher validates a params bag against the action's
-declaration before the handler runs (ADR-0104 D2, `validateActionParams` →
-`InstantValueSchema`), and that contract is an ISO-8601 instant with an
-explicit zone. Every submission earned:
-
-```
-HTTP 400 VALIDATION_ERROR
-Action param "start" (datetime): expected an ISO-8601 instant with explicit
-zone (e.g. 2026-03-15T14:30:00.000Z)
-```
-
-The renderer and the validator wanted disjoint shapes, and an app author had no
-seam between them — declaring a `datetime` param doomed the action in the UI,
-whatever the app. Found in a hotcrm dogfood run (objectstack#5061), reproduced
-from two separate entry points (list-view row menu and record header).
-
-The fix is a removal, not a conversion. `DateTimeField` has been ISO-canonical
-on both sides since objectui#3127/#3565 — it takes the record's ISO instant in
-and hands an ISO instant back out, seconds, milliseconds and zone included — so
-the widget's own value already satisfies the contract. #3565 added the
-back-conversion to keep the wire shape byte-identical while it fixed a display
-bug, and named the follow-up in its own commit message: moving action params
-onto ISO is a contract change of its own. This is that change.
-`serializeParamValues` now passes `datetime` values through untouched, which
-makes it idempotent for a value that already carries a zone (a `+08:00` offset
-survives byte-for-byte rather than being re-derived and re-cut to the minute)
-and leaves an empty or unfilled param alone.
-
-Deliberately still rejected: an authored `defaultValue` written as a zone-less
-wall clock. That value is ambiguous metadata — whose zone? — and coercing it in
-the renderer would make it "work" in the UI while the identical literal kept
-400ing from REST and MCP, which is the worst split to debug. It stays loud
-until the spec validates a param default against the param's own value
-contract, filed as objectstack#6970 (the same hole lets a `number` param
-default to `'abc'`, so it is not datetime-specific).
-
-The render proof that pinned the old shape was replaced rather than re-spelled:
-it asserted `2026-07-20T14:30` and was green while the feature was 100% broken,
-because the shape it pinned is the one shape nothing accepts. It now drives the
-real widget and asks the real `validateActionParams` — the exact function that
-produced the 400 — whether the resolved bag is acceptable. The datetime
-assertions are written to hold in every timezone (verified under
-`Asia/Shanghai`, `UTC` and `America/Los_Angeles`), since a zone-shaped test that
-only holds in UTC goes green on CI while the defect is live for every user east
-or west of it.
diff --git a/.changeset/action-record-predicate-root-4075.md b/.changeset/action-record-predicate-root-4075.md
deleted file mode 100644
index a84eeef146..0000000000
--- a/.changeset/action-record-predicate-root-4075.md
+++ /dev/null
@@ -1,60 +0,0 @@
----
-"@object-ui/components": patch
-"@object-ui/react": patch
----
-
-Action-face predicates written against the canonical `record.` root now evaluate
-
-`action:button`, `action:icon`, `action:menu` and `action:group` gated their
-actions on `useCondition(pred, context)`, which evaluates on
-`new ExpressionEvaluator({ ...scope, ...context })` — and the context each of
-them passed was the row spread flat, or nothing at all. Only the shorthand
-spelling resolved:
-
-| predicate | verdict, before |
-|---|---|
-| `status == "pending"` | evaluates (`action:button` only) |
-| `record.status == "pending"` | throws `record is not defined` |
-| `data.status == "pending"` | throws `data is not defined` |
-
-`record.` is not a mistaken spelling — it is the canonical one. It is what
-`ExpressionEvaluator`'s CEL path binds (`bag.record` as the record namespace),
-what `evalRowPredicate` binds on the record header, list rows, the row kebab
-and conditional formatting (`record.status` / bare `status` / `data.status`),
-and what the server enforces with. A `visible` that fails CLOSED turns the throw
-into "hidden", so a correctly-authored predicate deleted its own button —
-indistinguishable from the gate having said no. On the fail-soft legs the same
-throw lands the other way: `disabled` greyed a control out for everyone.
-
-Live rather than theoretical: every declared action on framework's
-`sys_approval_request` gates on `record.viewer.*`, so the whole server-declared
-approval decision set was invisible wherever the declared-action bar rendered
-until objectui#4077 fixed that bar. These four generic renderers carried the
-same binding.
-
-What changed:
-
-- all four bind the row the three canonical ways, through one named helper
-  (`usePredicateRecordContext`, exported from `@object-ui/react` beside
-  `useCondition`), so the action face and the row surfaces answer an author's
-  `visible:` the same way;
-- `action:icon` reads the row at all. It evaluated against an empty bag, so not
-  even the bare-field shorthand resolved — and its `data` prop was landing in
-  the props spread onto the DOM button;
-- `action:menu`'s items and `action:group`'s two leaves receive the row from
-  their host, which they previously never got;
-- `action:bar` forwards the row into the overflow menu it builds, not just to
-  its inline members. An action's predicate had been answering a different
-  question purely because it spilled past `maxVisible` — which on mobile
-  defaults to 1, making the verdict a function of the viewport.
-
-Deliberately unchanged: the evaluation entry and each site's error policy. A
-predicate that genuinely faults still fails closed on `action:button` /
-`action:menu` `visible` and still fails soft on the other legs, exactly as
-before; `toPredicateInput`, `hasDeclaredVisibilityGate` and the empty-predicate
-rules keep their pinned semantics. Binding the row is a separate question from
-what to do when the predicate faults.
-
-A surface with no row of its own binds nothing rather than an empty record, so
-a host that supplies the row through the ambient predicate scope is not blanked
-out; a row passed explicitly still wins over the scope.
diff --git a/.changeset/action-runner-declared-condition-gate-3872.md b/.changeset/action-runner-declared-condition-gate-3872.md
deleted file mode 100644
index 74393aa77f..0000000000
--- a/.changeset/action-runner-declared-condition-gate-3872.md
+++ /dev/null
@@ -1,59 +0,0 @@
----
-"@object-ui/core": patch
----
-
-`condition: false` now actually prevents the action from executing (objectui#3872)
-
-`ActionRunner.execute` — the engine's public execution entry, shared by every
-action surface — gated conditional execution on `if (action.condition)`, i.e. on
-the raw value's TRUTHINESS. Truthiness cannot answer the question the gate needs
-answered ("did the author declare a condition?"), and on this key it answered in
-the over-permissive direction: `condition: false` fell on `if (false)`, so the
-whole block was skipped, `evaluateCondition` was never consulted, and the action
-executed. Measured with a call-counting handler:
-
-- `condition: false` — handler ran: **true**, result `{ success: true }`
-- `condition: { dialect: 'cel', source: 'false' }` — handler ran: false, result `{ success: false, error: 'Action condition not met' }`
-
-Two spellings of the same statement, opposite outcomes. `false` is the most
-explicit "never execute this" metadata can carry — and what a template that
-switches an action off emits — so the direction matters: the action really ran,
-possibly writing. This is the over-permission half of the objectui#3492 family
-(the `disabled` gate one line below is objectui#3848, whose defect pointed the
-other way).
-
-The gate now asks whether a `condition` gate is DECLARED before evaluating.
-"Nothing to evaluate" is read from core's single predicate normalizer
-(`toPredicateInput`, which maps `''`, `null`, an empty-`source` envelope and
-non-predicate values to `undefined`), plus the whitespace-only string, which the
-normalizer wraps rather than collapses — objectui#3850's ruling on the scope of
-"empty predicate", the same one the `disabled` gate already applies. Once the
-door asks the right question the verdict needs no boolean branch of its own:
-`evaluateCondition` returns a boolean argument verbatim.
-
-**Behaviour change surface, deliberately one-directional and one row wide.**
-Exactly one shape changes verdict — a declared boolean `false`, from executing to
-refused (`{ success: false, error: 'Action condition not met' }`, the message the
-key already used). Everything else is byte-identical: `condition: true`, an
-absent `condition`, and truthy expressions/envelopes still execute; falsy
-expressions, falsy CEL envelopes and falsy `${…}` templates are still refused,
-as before; the three empty predicates (`''`, whitespace-only, an empty-`source`
-envelope) still execute, now because nothing was declared rather than because
-`if ('')` happened to be falsy; and non-predicate junk (`0`, `{}`) still
-executes — a value that is not a predicate must not decide an action's fate,
-which is the fail-open posture this module already committed to for `disabled`.
-So this change can only start refusing execution, never start allowing it — the
-mirror image of objectui#3848's fix.
-
-`ActionDef.condition` is widened to `string | boolean` to match what the gate now
-honours (and the `disabled` key beside it). This is not a lenient consumer
-alias: the boolean was always accepted at runtime through the interface's index
-signature, it was simply ignored.
-
-The value handed to the evaluator is deliberately left RAW rather than normalized
-first, for the same reason as objectui#3848 with the sign flipped:
-`toPredicateInput` wraps unconditionally, so an already-templated `'${x}'`
-becomes `'${${x}}'`, fails to parse, returns verbatim and coerces to a constant
-`true` — on `disabled` that blocks everything, on `condition` it would EXECUTE
-everything. That normalizer defect is objectui#3871; a tripwire next to the new
-pins goes red the day it is fixed.
diff --git a/.changeset/action-runner-declared-disabled-gate-3848.md b/.changeset/action-runner-declared-disabled-gate-3848.md
deleted file mode 100644
index 3690491dd6..0000000000
--- a/.changeset/action-runner-declared-disabled-gate-3848.md
+++ /dev/null
@@ -1,54 +0,0 @@
----
-"@object-ui/core": patch
----
-
-An empty `disabled` predicate no longer refuses to run the action (objectui#3848)
-
-`ActionRunner.execute` — the engine's public execution entry, shared by every
-action surface — gated on `action.disabled != null && action.disabled !== false`
-and handed the value straight to `evaluateCondition`. That function documents one
-default for "there is no condition here": return `true`, meaning
-*visible/enabled*. On `disabled`, `true` means BLOCKED. So every empty predicate
-was read as "disabled": the handler was never invoked and the caller got
-`{ success: false, error: 'Action is disabled' }` — a state the metadata never
-declared. Measured with a call-counting handler:
-
-- `disabled: ''` — handler ran: false
-- `disabled: '   '` (whitespace only) — handler ran: false
-- `disabled: { dialect: 'cel', source: '' }` (the empty envelope `objectstack build` can emit) — handler ran: false
-
-After objectui#3842 / objectui#3849 fixed the renderer halves, this was live
-user-visible behaviour: the button became clickable and clicking it returned
-`Action is disabled` — the renderer and the execution entry disagreeing about one
-predicate value, the shape objectui#3314 already paid for once.
-
-The gate now asks whether a `disabled` gate is DECLARED — whether there is a
-condition to reach a verdict on — before evaluating. "Nothing to evaluate" is
-read from core's single predicate normalizer (`toPredicateInput`, which maps
-`''`, `null`, an empty-`source` envelope and non-predicate values to
-`undefined`), plus the whitespace-only string, which the normalizer wraps rather
-than collapses and which `evaluateCondition` itself calls "no condition"
-(`evalRowPredicate` applies the same blank-source rule).
-
-**Behaviour change surface, deliberately one-directional.** Only values with
-nothing to evaluate change, and only from blocked to allowed: `''`,
-whitespace-only, an empty-`source` envelope, and non-predicate junk (`0`, `{}`,
-which previously coerced to "disabled"). `disabled: true`, a truthy expression
-and a truthy CEL envelope still block; `disabled: false` and an absent `disabled`
-still run; no expression- or envelope-valued predicate changes verdict. The
-existing `catch { isDisabled = false }` fail-open posture is untouched, and this
-change can only stop blocking things, never start.
-
-The value handed to the evaluator is deliberately left RAW rather than normalized
-first. `evaluateCondition(toPredicateInput(x))` is not interchangeable with
-`evaluateCondition(x)` for a string that is already a `${…}` template:
-`toPredicateInput` assumes a bare expression and wraps unconditionally, so
-`'${x}'` becomes `'${${x}}'`, fails to parse, returns verbatim, and coerces to a
-constant `true` — a template-spelled predicate evaluated that way is ALWAYS
-"disabled", whatever it says. That normalizer defect is filed as objectui#3871
-(it is live at the action renderers and `ActionEngine`, while `SchemaRenderer` and
-`page:header` evaluate the raw value and pin the correct verdict); a tripwire next
-to the new pins goes red the day it is fixed. Two rows therefore still differ
-between the execution and renderer paths, each recorded with its owning issue:
-the empty envelope (objectui#3850 owns the renderer half's scope ruling) and the
-`${…}` spelling (objectui#3871).
diff --git a/.changeset/actionparamdialog-boolean-host-id-3962.md b/.changeset/actionparamdialog-boolean-host-id-3962.md
deleted file mode 100644
index 317015767d..0000000000
--- a/.changeset/actionparamdialog-boolean-host-id-3962.md
+++ /dev/null
@@ -1,30 +0,0 @@
----
-"@object-ui/app-shell": patch
----
-
-`ActionParamDialog` boolean params: the dialog now owns the control id, so the checkbox is named once instead of twice
-
-The boolean branch rendered `<Label htmlFor={param.name}>` beside the control but
-passed the widget no `id`, unlike its own generic branch a few dozen lines below,
-which has always passed `id={param.name}`. Measured on a real dialog render, a
-`boolean` param labelled "Confirm This" produced TWO label elements pointing at
-one control — the dialog's visible one and a `sr-only` copy the widget emitted —
-so the checkbox's accessible name was the two concatenated: screen readers
-announced "Confirm This Confirm This".
-
-Two distinct problems, one line apart:
-
-- The association was IMPLICIT. It resolved only because `BooleanField`'s id
-  fallback chain reaches `config.name`, which `paramToField` seeds from
-  `param.name`, so both sides landed on the same string by coincidence of
-  another package's internals. A host that renders `htmlFor` must emit the id it
-  names; that is what the declared `id` key of the widget contract is for.
-- The duplicate `sr-only` label. objectui#3952 / PR #3959 made `BooleanField`
-  suppress its own label whenever a host supplies the id — precisely because a
-  host that supplies an id is a host that renders a label. Receiving no id, this
-  branch never triggered that suppression.
-
-Both `for` targets resolved, so unlike objectui#3341 and objectui#3952 this was
-never a dangling label: clicking the row's text already toggled the control, and
-still does. What changes is the announced name, which is now the single
-"Confirm This" the author declared. The generic branch is untouched.
diff --git a/.changeset/address-field-postal-code-os5143.md b/.changeset/address-field-postal-code-os5143.md
deleted file mode 100644
index 208f7d8963..0000000000
--- a/.changeset/address-field-postal-code-os5143.md
+++ /dev/null
@@ -1,31 +0,0 @@
----
-"@object-ui/fields": patch
----
-
-`address` widget: the ZIP box now reads and writes `postalCode`, the part name the platform stores
-
-`AddressField` bound its ZIP input to `zipCode` — a part name that appears
-nowhere in `@objectstack/spec`. The stored value uses `postalCode`, which
-`AddressValueSchema` declares and enforces with `$strip` semantics, so the two
-sides never met:
-
-- opening a stored address showed an **empty** ZIP box (no input read
-  `postalCode`), while street / city / state / country all populated — four of
-  five parts working is what let this survive review;
-- anything the user then typed into that box was written back as `zipCode` and
-  **stripped at the contract boundary**. On a new record the postal code was
-  lost outright; on an existing one the correction was silently discarded and
-  the stale stored code remained, with no error anywhere.
-
-The widget now uses `postalCode` throughout — state key, sub-input id, the
-`onChange` part name and the read-only formatter. Data written by the previous
-builds is still **read** through `zipCode` as a compatibility limb, and the
-first edit of any part normalizes such a record onto `postalCode` rather than
-writing the split shape back out. Nothing writes `zipCode` any more, and it is
-deliberately not part of the exported `AddressValue` type, so authoring code
-cannot spell it.
-
-`AddressValue` is otherwise unchanged in shape; consumers that referenced
-`AddressValue['zipCode']` must read `postalCode`.
-
-Fixes objectstack-ai/objectstack#5143.
diff --git a/.changeset/appcontent-route-test-headers-3749.md b/.changeset/appcontent-route-test-headers-3749.md
deleted file mode 100644
index a799d3bebe..0000000000
--- a/.changeset/appcontent-route-test-headers-3749.md
+++ /dev/null
@@ -1,30 +0,0 @@
----
----
-
-Comment-only change, no behaviour and no authoring-surface change (objectui#3749).
-
-Three docblock passages in the zero-app console routing tests enumerated
-`sys-datasources` / `sys-objects` in the present tense as the producers of
-`…/component/metadata/resource?type=datasource` and `…/system/metadata/object`.
-Both entries were re-pointed at the metadata-admin engine's canonical
-`…/metadata/:type` routes — `sys-datasources` by objectui#3660,
-`sys-objects` (and the home QuickActions "Manage Objects" card) by
-objectui#3739 — so the narration described a producer surface that no longer
-exists, while the assertions underneath it stayed correct and green.
-
-Rewritten as "history + current state" per objectui#3666: what was true at
-objectui#3610, then what is true now, with the current-state half stating
-positively what the two spellings are today (arrivals for bookmarks, external
-links and the host's own alias route) rather than denying where they used to
-point. The two `it` titles move off the producer names onto what they actually
-measure — each alias still resolving out of the zero-app branch in exactly one
-hop, named by its rewriter (`shell alias` / `host alias`).
-
-No package is declared because nothing published changed: `AppContent.tsx` is a
-JSX-comment edit with both `LegacyMetadataRedirect` route declarations and every
-other line of code untouched, and the two test files keep their assertions and
-case count byte for byte (43 passed before, 43 passed after). The reason this is
-worth a commit at all is that the same comment family has gone stale once before
-at a measured cost — objectui#3661 / #3669, where a transcription that had
-drifted left two cases silently measuring a redirect chain production had
-stopped emitting.
diff --git a/.changeset/approvals-inbox-component-ref-os7231.md b/.changeset/approvals-inbox-component-ref-os7231.md
deleted file mode 100644
index a9e57532a0..0000000000
--- a/.changeset/approvals-inbox-component-ref-os7231.md
+++ /dev/null
@@ -1,13 +0,0 @@
----
-'@object-ui/app-shell': patch
-'@object-ui/console': patch
----
-
-Register `approvals:inbox` as a component ref, and stop sending Home's "pending approvals" card into the setup app (objectstack#7231).
-
-The Approvals Inbox had no addressable identity: nothing in any app's navigation metadata pointed at it, and every entry to it was a hardcoded path. `HomePage`'s action-center card spelled `/apps/setup/system/approvals`. That path is not wrong about the page — `system/approvals` is mounted as both `extraRoutes` and `extraRoutesNoApp`, so `/apps/{any app}/system/approvals` has always resolved — it is wrong about the app. A business user with approvals waiting but no access to `setup` followed the only entry Home offers them into the shell's "App not available" guard.
-
-Two changes, one additive and one corrective:
-
-- `approvals:inbox` now resolves in the component registry to the Approvals Inbox page, so a `{ type: 'component', componentRef: 'approvals:inbox' }` nav item renders the full inbox at `/apps/{app}/component/approvals/inbox` — tabs, drawer, decision actions and record deep links all scoped to `{app}`. Both mount paths are relative routes under `/apps/:appName/*`, so the page reads the same `:appName` and the same `?request={id}` deep link either way. The standalone `system/approvals` route is untouched and stays the target of server notification and email links; the registry key is purely additive indirection, so the approval surface can be rebuilt later behind the same key without any navigation metadata changing.
-- The Home card now navigates within the app the user last had open, re-checked against their live active-app list so a remembered app that has since been deactivated is not resurrected as a dead link, falling back to their first available app. `setup` survives only as the last resort for an app carrying no addressable segment at all — the zero-app workspace never reaches this producer, because Home returns its welcome empty state before the action center exists.
diff --git a/.changeset/auth-family-locale-keys-3546-slice3.md b/.changeset/auth-family-locale-keys-3546-slice3.md
deleted file mode 100644
index 557649cc0b..0000000000
--- a/.changeset/auth-family-locale-keys-3546-slice3.md
+++ /dev/null
@@ -1,50 +0,0 @@
----
-"@object-ui/i18n": patch
----
-
-Backfill the auth family's 54 missing locale keys — `auth` 26 + `oauth` 16 + `acceptInvitation` 12 (objectui#3546, slice three)
-
-`scripts/check-i18n-call-site-keys.mjs` (objectui#3530) measured 54 keys that a
-`t()` call site asks for and that **no locale pack defined** — 54 distinct keys at
-54 call sites across the console's six auth pages. All 54 carried an inline
-`t(key, { defaultValue: 'English' })`, which is exactly the objectui#3517 class:
-English rendered correctly, and **all ten languages were stuck on it** for
-months. Nothing here rendered a raw key — slice one (PR #3583) held those sites.
-
-What that meant on the page: a `zh` user reaching `/login` and switching to the
-phone/SMS branch got "Email or phone number", "Get code", "Resend in {seconds}s"
-and "Sign in with password instead" in English; the whole `/oauth/consent` screen
-— including the four scope sentences describing what a third-party client is
-about to be granted — was English-only; so was the `/accept-invitation` page and
-the device-authorization dead end.
-
-- **`packages/i18n/src/locales/en.ts`** gains the 54 keys. `oauth.consent.*` and
-  `acceptInvitation.*` are new top-level namespaces; the other 26 extend
-  `auth.login`, `auth.forgotPassword`, `auth.device` and `auth.verifyEmail`.
-  Every one of the 52 keys whose call site carries a **string** `defaultValue`
-  gets that exact string, byte for byte (52/52, script-compared), so the pack
-  path and the inline-default path cannot diverge. The two remaining keys —
-  `oauth.consent.title` / `oauth.consent.request` — have **template**
-  defaultValues, where byte identity is structurally impossible (JS `${…}` vs
-  i18next `{{…}}`); both take the interpolation contract the call site actually
-  declares in its options.
-- **The nine other packs** get real translations, each evidenced against a
-  neighbour key in the same pack (fr's space before `?`/`:`, de's en dash, ru's
-  ё, ar's verb-first placement so an RTL sentence does not open on a Latin
-  client name, zh's full-width punctuation). The one string all ten packs share
-  is `phonePlaceholder` — the E.164 example number, treated like the
-  `name@example.com` the packs already keep untranslated.
-- **`scripts/i18n-call-site-key-baseline.json`** loses exactly those 54 entries
-  (163 → 109). The file is a ratchet: an unfixed key missing from it fails the
-  build, and a fixed key still listed fails it too.
-- **No component changed.** An AST sweep of all 122 call sites in these three
-  namespaces found zero dead `t(key) || 'English'` fallbacks (the construct
-  slice one had to delete from `ObjectView.tsx`, where i18next's key-as-value
-  return made `||` unreachable).
-
-Two holes here are **not** i18next's and must survive translation intact:
-`resendOtpCountdownText` carries `{seconds}` in single braces because
-`packages/auth/src/LoginForm.tsx` and `ForgotPasswordForm.tsx` substitute it with
-a literal `.replace()`, and `oauth.consent.request`'s `{{suffix}}` arrives
-pre-formatted from the page. Both are pinned in
-`packages/i18n/src/__tests__/auth-namespace-3546.test.tsx`, in both directions.
diff --git a/.changeset/block-config-placeholder-i18n-3979.md b/.changeset/block-config-placeholder-i18n-3979.md
deleted file mode 100644
index 62fb6d25d8..0000000000
--- a/.changeset/block-config-placeholder-i18n-3979.md
+++ /dev/null
@@ -1,46 +0,0 @@
----
-"@object-ui/app-shell": patch
----
-
-Page block inspector: the input hints inside the properties panel follow the session's language
-
-objectui#3913 turned `block-config.ts`'s `label` / `addLabel` / option labels into
-translation keys and stopped at the column next to them. The 8 `placeholder`
-values that are prose stayed display text, so a zh-CN admin opening `page:header`
-read 「图标」 over a box hinting `lucide icon name`, and `record:details`'
-「名称（i18n 键）」 over `snake_case, e.g. contact_info` — in the panel #3913 and
-objectui#3963 had just finished translating. Those 8 are now keys under
-`engine.inspector.pageBlock.placeholder.<blockType>.<field path>`, resolved by
-`PageBlockInspector` at render, with en-US and zh-CN both defined. The en-US text
-is byte-identical to the literals it replaces, ellipsis included, so an English
-admin sees no change.
-
-The column could not simply follow `label`, and that is the design half of this
-change: it is a MIXED surface. Of the 18 placeholders, 10 are example VALUES — a
-row count `20`, `https://…`, the inline-action sample
-`{ "type": "url", "target": "/environments" }` — and translating those would be a
-defect, not a courtesy. A localized JSON sample is metadata `InlineActionSchema`
-rejects, and a "translated" default row count means nothing at all.
-
-So which kind a placeholder is, is declared in the type rather than left to a
-convention plus a list of exceptions:
-
-    placeholder?: { key: string } | { literal: string }
-
-A bare `placeholder: 'lucide icon name'` — the shape this file used until now,
-and the first thing anything generating a new field reaches for — no longer
-compiles. That matters more than the eight strings: `type-check` runs in every
-lane and in the editor, so the mistake is caught where it is made instead of
-becoming an English box in a Chinese panel that waits for a reviewer to notice.
-`addLabel` was made required for the same reason in #3913; `placeholder` stays
-optional, because a field with no hint is legitimate.
-
-The keyed half joins the derivation pin
-(`previews/__tests__/block-config-i18n.test.ts`) as a fifth key family, so a new
-prose placeholder without a translation is red rather than shipping. The literal
-half is pinned as an inventory with a reason per entry, because "finish
-translating the other ten" is the plausible next edit and it needs to argue with
-a test first. `block-config.test.ts`'s snake_case assertion moved from the raw
-placeholder to the RESOLVED hint in both locales, which is now the stronger
-statement: the `snake_case` token has to survive translation, not merely exist in
-English.
diff --git a/.changeset/boolean-field-host-owns-control-id.md b/.changeset/boolean-field-host-owns-control-id.md
deleted file mode 100644
index 12e78072a1..0000000000
--- a/.changeset/boolean-field-host-owns-control-id.md
+++ /dev/null
@@ -1,9 +0,0 @@
----
-'@object-ui/fields': patch
----
-
-fix(fields): `BooleanField` uses the control id its host hands down, so a boolean field's visible label is really associated with the switch
-
-A `boolean` / `checkbox` field inside a form emitted **two** labels with the same text, and the visible one pointed at nothing. `<FormControl>` (a Radix `Slot`) hands the control the id its `<FormLabel htmlFor>` already references, and the widget replaced it with the field name — so `label for="_r_3_-form-item"` had no target while the switch carried `id="notifications"`. Clicking the visible label, the normal affordance for a switch/checkbox row, toggled nothing on every generated form in every app; the accessible name survived only through the widget's own `sr-only` label.
-
-The widget now honours the id it was handed (`id` is a declared key of the widget contract, forwarded by `toDomProps`) and stops emitting its own label when a host supplied one. Standalone rendering is unchanged: with no host id the id still falls back to the field name and then to `useId()`, and the `sr-only` label — the only accessible name the inline grid editor and the console's action-param dialog have — is still emitted.
diff --git a/.changeset/builtin-select-host-id-3976.md b/.changeset/builtin-select-host-id-3976.md
deleted file mode 100644
index 7c223640c6..0000000000
--- a/.changeset/builtin-select-host-id-3976.md
+++ /dev/null
@@ -1,35 +0,0 @@
----
-"@object-ui/components": patch
----
-
-Built-in `select` fields: the form's label, validation message and required state now reach the control
-
-A hand-written form field `{ name: 'status', label: 'Status', type: 'select', options: [...] }`
-rendered a visible "Status" label that pointed at nothing. Measured before the fix:
-`<label for="…-form-item">` resolved to no element at all, `getByLabelText(/status/i)`
-found zero matches, and the trigger button carried no `id`, no `aria-describedby`, no
-`aria-invalid` and no `aria-required`. Clicking the label did nothing and a screen reader
-announced an anonymous combobox with no field name, no error link and no required state.
-
-Cause: the built-in `select` branch spread its whole DOM pass-through onto Radix's
-`Select.Root`. Root renders no DOM element of its own, so everything it does not
-recognise is silently dropped — and that is exactly where `<FormControl>`'s Slot puts the
-field's `id` / `aria-describedby` / `aria-invalid` and the renderer puts `aria-required`.
-The pass-through now lands on `SelectTrigger`, the focusable `button[role=combobox]` the
-user and their assistive tech actually operate, with the same two keys deliberately kept
-on Root as in the widget-side fix: `name` (the one key Root consumes — it forwards it to
-the hidden native `select` that takes part in form submission) and `disabled` (Root
-disables trigger, items and hidden select together, so the raw prop must not gain a second
-author). `ref` rides the pass-through too, so react-hook-form can finally focus a built-in
-select.
-
-This is the built-in half of the same mechanism objectui#3306 fixed on the widget side.
-The two halves diverged because `'select'` is a `BUILTIN_FIELD_TYPES` member: an
-object-driven `field:select` resolves to the registered `SelectField` (fixed since #3306),
-while a hand-written bare `type: 'select'` never consults the registry and kept the
-defect. Both paths are now pinned side by side — the registered path as a positive control
-— so they cannot drift apart again. Which component renders a bare `select` is unchanged;
-only where its host props land.
-
-Authored `className` on a built-in `select` now reaches the trigger (it previously reached
-no element), composed with the branch's touch-target height rather than replacing it.
diff --git a/.changeset/bulk-action-param-options-open-3309.md b/.changeset/bulk-action-param-options-open-3309.md
deleted file mode 100644
index 7bf97f9edf..0000000000
--- a/.changeset/bulk-action-param-options-open-3309.md
+++ /dev/null
@@ -1,25 +0,0 @@
----
-"@object-ui/types": patch
----
-
-`BulkActionParam.options` entries now accept the widget config the renderer already forwards
-
-The entry type was a closed `{ label, value }`, and it was the only layer in the
-path that said so. `bulkParamToField` spreads each entry into the metadata it
-hands the field widget (`{ ...o, value: String(o.value) }`), so extra keys
-survive; the destination shape `SelectOptionMetadata` declares `color` / `icon` /
-`disabled` / `visibleWhen` and `@object-ui/fields` genuinely reads them; and
-`@objectstack/spec`'s `BulkActionParamSchema` makes the same entry
-`.passthrough()`, so the server accepts them. Writing
-`options: [{ label: 'Purple', value: 'purple', color: '#8B5CF6' }]` therefore
-produced a TypeScript excess-property error on a configuration the renderer
-honours — the type rejected working metadata, which is the most expensive
-direction for an author (an AI author especially) that trusts it absolutely.
-
-The entry now carries a `[key: string]: unknown` catch-all, matching the one its
-parent `BulkActionParam` has had all along and the idiom `ActionParamOption`
-settled one interface over. `label` and `value` stay required and keep their
-exact types: open is not optional, and the catch-all is not an invitation to
-author new option keys — the authoring gate remains the spec's strict
-`SelectOptionSchema`. No runtime behaviour changes; the widening is
-backward-compatible for consumers.
diff --git a/.changeset/bulkactiondialog-required-aria-3967.md b/.changeset/bulkactiondialog-required-aria-3967.md
deleted file mode 100644
index 23a310a95f..0000000000
--- a/.changeset/bulkactiondialog-required-aria-3967.md
+++ /dev/null
@@ -1,31 +0,0 @@
----
-"@object-ui/plugin-grid": patch
----
-
-`BulkActionDialog` required params: the control now announces the required state, and the visual `*` stays out of its accessible name
-
-`ParamField` renders each bulk param's label with a `*` marker when
-`param.required`, inside a `<Label htmlFor>` that points at the control. Two
-conventions the app-shell `ActionParamDialog` has carried since objectui#3299 /
-objectui#3290 were missing at this site:
-
-- The `*` span had no `aria-hidden="true"`. Accname folds a referencing label's
-  text into the control's name, so every required bulk param announced as
-  "Notify owner asterisk" — a decorative glyph read aloud as part of the label.
-- No `aria-required` was passed to the widget. `param.required` is otherwise
-  live — the dialog's own pre-submit gate reads it to keep Next disabled — but
-  nothing carried the state to the control, and no widget derives it from
-  `field.required` (`toDomProps` forwards `aria-*` by prefix; it invents
-  nothing). So the only channel that could announce requiredness was empty
-  while the only thing present was the glyph.
-
-The required state now rides the state channel to the control, deliberately as
-`aria-required` and not the native `required` attribute — per the objectui#3290
-ruling, the native attribute would arm the browser's constraint-validation
-bubble alongside this dialog's own gating, giving one field two validators.
-`|| undefined` keeps an optional param free of the attribute entirely rather
-than carrying `aria-required="false"`, matching `ActionParamDialog`.
-
-The marker remains visible; only its participation in the accessible name
-changes. `id` ownership at this site was already correct and is untouched, as
-is `ActionParamDialog`.
diff --git a/.changeset/capability-multiselect-widget-retired-3308.md b/.changeset/capability-multiselect-widget-retired-3308.md
deleted file mode 100644
index 7fd72e7da6..0000000000
--- a/.changeset/capability-multiselect-widget-retired-3308.md
+++ /dev/null
@@ -1,23 +0,0 @@
----
-"@object-ui/fields": minor
-"@object-ui/plugin-detail": minor
-"@object-ui/components": minor
-"@object-ui/plugin-form": minor
----
-
-Retire the `capability-multiselect` field widget name, which existed only on the docs-site registration path and which nothing ever stamped (objectui#3308, ADR-0049 enforce-or-remove)
-
-`field:capability-multiselect` was registered by `registerFields()` and only there. That function's sole caller is the docs site, so the key never existed on the live path (`registerAllFields()`, run at module import, iterates `fieldWidgetMap` — which never listed it). A field authored with `widget: 'capability-multiselect'` therefore resolved to nothing in every real application, while the comment above the registration described it as usable from a record form: a code comment promising a capability that does not exist, which is the worst direction for a metadata renderer AI-authored apps read as authority.
-
-Nothing stamped the hint either. ADR-0056 P1 stamps `permission-facet-link` on all six `sys_permission_set` facets — `system_permissions` included — through the single `ObjectStackAdapter.getObjectSchema` choke point, and P2 put the capability editor in Studio. The widget name was a leftover from an intermediate iteration of that rollout.
-
-Removed, with a tombstone at each site:
-
-- `@object-ui/fields` — the `field:capability-multiselect` registration and the comment that advertised it. **Breaking in name only**: the key was unreachable outside the docs site, so no application could have resolved it. A field still carrying the hint now degrades to its declared `type` renderer, the defined behavior for an unregistered widget.
-- `@object-ui/plugin-detail` — `InlineFieldInput`'s `widget === 'capability-multiselect'` branch, the hint's last honoring surface. Leaving one consumer for a name no producer emits and no form resolves is the same declared-vs-enforced split, inverted. The sibling `permission-facet-link` branch is untouched and pinned.
-- `@object-ui/components` — the dead `capability-multiselect` entry in the form renderer's `DATA_SOURCE_FIELD_TYPES` set, which could never match a resolvable widget.
-- `@object-ui/plugin-form` — a comment naming `capability-multiselect` as the widget stamped onto `sys_permission_set.system_permissions`; it names `permission-facet-link` now, which is what is actually stamped.
-
-`CapabilityMultiSelectField` itself is **unchanged and still exported**: Studio's `PermissionMatrixEditor` imports and renders it directly, which is ADR-0056 P2's design. Only the widget name is retired — the component is not a registry field widget and its doc comment now says so.
-
-`registerFields()` is also **kept**, with its `@deprecated Use registerAllFields() instead` note corrected. The two are not interchangeable: it registers `createFieldRenderer(widget)`, which synthesizes the label, description and the local `value`/`onChange` state that lets a bare field node (`{ type: 'currency', label: 'Amount' }`) render standalone in the docs demos. Retiring it needs a decision about where that demo chrome goes; the note now records that instead of implying a drop-in replacement.
diff --git a/.changeset/chart-container-min-size-style-merge-os7026.md b/.changeset/chart-container-min-size-style-merge-os7026.md
deleted file mode 100644
index 00a78fd594..0000000000
--- a/.changeset/chart-container-min-size-style-merge-os7026.md
+++ /dev/null
@@ -1,49 +0,0 @@
----
-"@object-ui/plugin-charts": patch
----
-
-`ChartContainer`'s min-size fallback survives a consumer-supplied `style` (objectstack#7026)
-
-The container wrote `style={{ minHeight: 280, minWidth: 0, ...props.style }}` and
-then spread `{...props}` on the line BELOW it. `props` is the rest of
-`ComponentProps< "div" >` — only `id`, `className`, `children`, `config` and
-`disableSettleRemount` are destructured out of it — so it still carried the
-consumer's `style`, and a later JSX attribute of the same name replaces an earlier
-one outright. Any caller that passed a `style` therefore replaced the whole object:
-both `minHeight` and `minWidth` vanished, and the `...props.style` merge written
-inside it never executed even once. It was dead code that read, to anyone auditing
-the file, as if the fallback were guaranteed.
-
-That fallback is not decorative. It exists so Recharts' `ResponsiveContainer`
-always has a non-zero box to measure: a dashboard widget that overrides the
-container's `h-[350px]` class and wraps the chart in flex/grid without an explicit
-child height leaves the box at 0, Recharts measures `width/height = -1`, and the
-chart renders invisibly — the exact failure the guard was added for.
-
-`style` is now destructured out of the rest props and merged explicitly, so which
-side wins is stated in code instead of being decided by JSX attribute order, and
-`{...props}` can no longer reach `style` at all.
-
-Precedence: **an author's explicit size wins.** Simply spreading `{...props}`
-first and merging unconditionally would have traded this bug for its mirror image
-— `minHeight: 280` injected next to an authored `height: 100` floors that 100 to
-280, silently overriding the author. So each half of the fallback applies only
-when the consumer style declares neither of its own keys: `height`/`minHeight`
-gate the height half, `width`/`minWidth` gate the width half, and a key present
-but set to `undefined`/`null` counts as not declared. Every other consumer style
-key passes through untouched.
-
-Behaviour change surface, deliberately narrow. A caller that supplies no `style`
-is byte-for-byte unchanged. A caller whose `style` declares a height — which today
-is the only shape in the tree, `AdvancedChartImpl`'s `containerProps` forwarding
-`ChartConfig.height` — keeps exactly the height it authored, also unchanged, and
-additionally regains the `minWidth: 0` half. What changes is the case the issue
-was filed for: a `style` carrying no size key (a margin, a padding, an
-aspect-ratio, any future container-level presentation prop routed through the same
-`containerProps` path) now keeps the min-size fallback instead of silently
-stripping it.
-
-Pinned in both directions, since a one-sided pin would have been satisfied by the
-mirror-image fix: a non-size `style` keeps `min-height: 280` / `min-width: 0`
-(red before this change), and an explicit `height: 100` renders as 100 with no
-`min-height` floor (red under the unconditional-merge alternative).
diff --git a/.changeset/cli-app-generator-manifest-3827.md b/.changeset/cli-app-generator-manifest-3827.md
deleted file mode 100644
index a875fa9471..0000000000
--- a/.changeset/cli-app-generator-manifest-3827.md
+++ /dev/null
@@ -1,69 +0,0 @@
----
-"@object-ui/cli": patch
----
-
-Generated temp apps now declare every package they import, at ranges anchored to this repo
-
-`objectui dev` / `serve` / `build` write a throwaway app into `<cwd>/.objectui-tmp`,
-and the `package.json` they wrote named neither `lucide-react` nor any of the seven
-`@object-ui/plugin-*` packages the generated sources import — while pinning
-`@object-ui/react` and `@object-ui/components` at `^0.1.0`, a range that resolves to
-nothing at all for packages published at 17.x (the registry has no 0.1.0). Outside
-this workspace that manifest could not install; inside it, hoisting to the root
-`node_modules` satisfied every missing name, so nothing was ever red.
-
-**`lucide-react` is now declared** (objectui#3827). Both of its imports in the
-generated layout are live — `import * as LucideIcons` feeds a `DynamicIcon` lookup
-and four `LucideIcons.*` icons, and the named `{ Moon, Sun }` renders the theme
-toggle — so this is the opposite disposition from the sibling generator, where
-objectui#3755 removed an equivalent declaration precisely because nothing imported
-it. Anchored to `^1.28.0`, the range all 23 in-repo manifests that import lucide
-agree on. `commands/dev.ts` had been covering the gap in the consumer, aliasing
-`lucide-react` to a path resolved out of `packages/components` "to avoid dependency
-not found in temp app" — but only in monorepo mode, leaving every other path with an
-unsatisfiable import. The declaration belongs at the producer; the alias is now a
-workspace convenience rather than the only thing holding the import up.
-
-**The seven plugin packages are now declared too**, in both generators. Measuring
-the reported defect turned up that `src/App.tsx` side-effect-imports
-`@object-ui/plugin-charts`, `-editor`, `-kanban`, `-markdown`, `-form`, `-grid` and
-`-view` to register their components, and no manifest ever named them: the
-undeclared set was eight packages, not the one the issue reported.
-
-**`@object-ui/*` ranges are derived from this CLI's own version** instead of being
-written out as literals. `.changeset/config.json` puts `@object-ui/cli` in the same
-`fixed` group as every platform package a generated app depends on, so they always
-publish at one version — which makes `^<own version>` both current and guaranteed to
-exist on the registry. A literal here is not merely a fossil risk but a fossil
-generator: that group re-versions on every release, so any hard-coded range is stale
-the next day. This is how `^0.1.0` survived to sit 16 majors behind.
-
-**The toolchain ranges are anchored to in-repo manifests**, the discipline
-objectui#3742/objectui#3754 established: `vite ^5.0.0` → `^8.2.0`, `typescript
-~5.7.3` → `^6.0.3`, `@vitejs/plugin-react ^4.2.1` → `^6.0.5`, `react`/`react-dom`
-`^18.3.1` → `19.2.8` with `@types/*` to match, `react-router-dom ^7.12.0` →
-`^7.18.2`, `postcss ^8.5.6` → `^8.5.26`, `autoprefixer ^10.4.23` → `^10.5.4`. React
-quotes the root's installed version rather than the wider `^18 || ^19` the platform
-packages accept as a peer: the peer says what can work, the root says what the
-generated code has actually run against, and inside this workspace the temp app
-resolves React by hoisting to the root.
-
-`tailwindcss` is deliberately left at `^3.4.19`. This repo is on Tailwind 4 and
-`@object-ui/components` peers `^4.2.1`, so the range is not merely behind — it
-conflicts. But re-anchoring it is not a version edit: the generated `index.css` uses
-v3 directives, the generated `postcss.config.js` names the plugin key v4 moved to
-`@tailwindcss/postcss`, and the generated `tailwind.config.js` is a v3 config. Raising
-the range without rewriting those three files yields an app that installs and renders
-unstyled, which looks fixed and is worse. Filed separately as objectui#3852; kept
-internally consistent at v3 until then, and pinned as a deliberate deferral rather
-than left to read as drift.
-
-The generators now build their output as a file map that the writers spill to disk,
-so tests assert over the same artifact the CLI writes. Three structural gates port
-the ones the sibling generator grew: every bare import must be declared, no versioned
-runtime dependency may be declared that nothing imports, and no generated `src/**`
-file may be unreachable from `src/main.tsx` — the one module `index.html` loads. Each
-is paired with a self-test that plants the defect back. Note for the next port: the
-`create-plugin` import scanner matches single-quoted specifiers only, and these
-templates mix quote styles, so a verbatim copy would have been blind to
-`from "lucide-react"` — one of the two lines this issue reports.
diff --git a/.changeset/cli-generated-app-tailwind-v4-3852.md b/.changeset/cli-generated-app-tailwind-v4-3852.md
deleted file mode 100644
index 49f0828ce2..0000000000
--- a/.changeset/cli-generated-app-tailwind-v4-3852.md
+++ /dev/null
@@ -1,17 +0,0 @@
----
-'@object-ui/cli': patch
----
-
-修复 `objectui dev` 生成的临时 app 的 CSS 管线:整套从 Tailwind 3 迁到 Tailwind 4
-
-生成器写出的样式面此前是完整的 v3 三件套 —— `src/index.css` 用 `@tailwind base/components/utilities` 指令、`postcss.config.js` 写 v3 的 `tailwindcss: {}` 插件键、外加一份 `tailwind.config.js` —— 而仓内与 `@object-ui/components` 都已在 v4(components 的 peer 是 `tailwindcss ^4.2.1`)。两个后果都是真的:
-
-- **仓内 `objectui dev` 今天不出样式。** `commands/dev.ts` 的 monorepo 分支把 `require('tailwindcss')(configPath)` 当 PostCSS 插件调用,v4 下这条路径只会抛 "moved to `@tailwindcss/postcss`",而该异常被 `try/catch` 吞成一行黄字警告;`css.postcss` 因此没被设上,Vite 退回去搜配置文件,`/src/index.css` 请求最终 500(实测:`Failed to load PostCSS config … Cannot find module '@tailwindcss/postcss'`),浏览器里一条样式都没有。
-- **仓外一次干净安装会 ERESOLVE。** 生成清单声明 `tailwindcss ^3.4.19`,与它依赖的 `@object-ui/components` 的 v4 peer 冲突。
-
-改动:
-
-- `src/index.css` 改为仓内惯用的 v4 CSS-first 写法(`@import 'tailwindcss'` + `@custom-variant dark` + `@source` + `@theme`),`@theme` 的 token 集与 `packages/components/src/index.css` 逐条对齐 —— 包含 v3 config 一直缺、而生成的 `src/Layout.tsx` 自己就在用的 8 个 `sidebar-*` token。
-- `postcss.config.js` 改写 `'@tailwindcss/postcss': {}`;`tailwind.config.js` 不再生成(v4 下没有 `@config` 指向它时它就是死文件,仓内本身也零个 `tailwind.config.*`),v3 的 `content` 扫描面等价迁为 `@source`。
-- 清单:`tailwindcss` 抬到 `^4.3.3` 并新增 `@tailwindcss/postcss ^4.3.3`,两者都锚回仓内(#3827 记的 `TAILWIND_V3_DEFERRED` 记账钉随之翻转)。
-- `commands/dev.ts` 改用 `@tailwindcss/postcss`,并由 `@object-ui/cli` 自己声明这两个插件包;加载失败不再吞成警告,而是带修法响亮报错 —— 静默无样式正是这个缺陷能潜伏这么久的原因。
diff --git a/.changeset/compareto-kind-convergence.md b/.changeset/compareto-kind-convergence.md
deleted file mode 100644
index df1b8fa176..0000000000
--- a/.changeset/compareto-kind-convergence.md
+++ /dev/null
@@ -1,14 +0,0 @@
----
-"@object-ui/core": patch
-"@object-ui/plugin-dashboard": patch
-"@object-ui/plugin-charts": patch
----
-
-Converge dashboard widget `compareTo` on the executor's `{ kind, dimension? }` contract, and make the dataset path actually render a comparison
-
-`CompareToConfig` was a three-branch union (`'previousPeriod' | 'previousYear' | { offset }`). `@objectstack/spec` collapsed it to the shape the analytics executor already implements — `DatasetCompareTo`, a plain strict object `{ kind: 'previousPeriod' | 'previousYear'; dimension?: string }` (objectstack#5011) — so this renderer now reads that one shape:
-
-- `shiftFilterByCompareTo` / `compareToTrendLabelKey` dispatch on `compareTo.kind`. The `{ offset }` duration shift is gone: `{ offset: '1y' }` is `kind: 'previousYear'`, while `'7d'` / `'1M'` have no faithful target and are restated by the author on the widget's own `filter` plus `kind: 'previousPeriod'`. No trend label key is retired — the offset arm resolved to `vsPreviousPeriod`, which survives as the `previousPeriod` fallback.
-- `DatasetWidget` no longer discards part of `compareTo`. It used to forward only the object form because the two string forms had no meaning downstream; with one shape there is nothing to discard, and a stale string is now invalid metadata rejected where it is authored rather than silently reinterpreted here.
-- **The comparison now actually runs on the dataset path.** A widget states its window in its own `filter` (a date macro, or the dashboard date-range filter merged in), but the executor shifts a `timeDimensions` entry carrying a `dateRange` — so a dataset widget asking for a comparison got "compareTo needs a dated window to shift" and rendered none. When (and only when) a comparison is requested, the resolved filter's bounded date windows are lowered into `selection.timeDimensions[].dateRange` and moved out of `runtimeFilter` (a copy left behind would intersect the shifted window with the current one and empty every comparison column). Which dimension gets shifted stays the executor's decision: every window found is lowered under the name the author wrote, and zero or two candidates surfaces the executor's own error, listing them.
-- The `<measure>__compare` columns that come back are now shown: a delta + window label on KPI widgets, a comparison column on tables, and a `variant: 'comparison'` overlay series on charts — the same treatment and the same `dashboard.trend.*` labels the inline object-provider widgets already use.
diff --git a/.changeset/components-export-declared-visibility-gate-3835.md b/.changeset/components-export-declared-visibility-gate-3835.md
deleted file mode 100644
index 99678ebc49..0000000000
--- a/.changeset/components-export-declared-visibility-gate-3835.md
+++ /dev/null
@@ -1,21 +0,0 @@
----
-"@object-ui/components": patch
----
-
-Export `hasDeclaredVisibilityGate` from the package barrel (objectui#3835)
-
-`hasDeclaredVisibilityGate(visible)` — "did this action DECLARE a visibility gate
-at all?", i.e. `!= null && !== ''`, with the verdict left to the evaluation entry
-— is the single definition objectui#3492 established and PR #3816 / #3825 / #3836
-applied to every member-action gate in this package and in `@object-ui/plugin-grid`.
-It lived module-private in `src/renderers/action/visibility-gate.ts`.
-
-The family turned out to have a member outside these packages:
-`@object-ui/app-shell`'s `DeclaredActionsBar` gates server-declared actions with
-the same question and had the same truthiness bug (objectui#3835). Exporting the
-one definition is what keeps that fix from becoming a fifth hand-spelled copy of
-it — the drift shape objectui#3142 already had to unpick for `locations` in these
-same files.
-
-Additive only: one `export` line, no behaviour change in this package. The
-function is pure and dependency-free.
diff --git a/.changeset/components-readme-setup-tailwind-3780.md b/.changeset/components-readme-setup-tailwind-3780.md
deleted file mode 100644
index eae6b7a9f4..0000000000
--- a/.changeset/components-readme-setup-tailwind-3780.md
+++ /dev/null
@@ -1,54 +0,0 @@
----
----
-
-`packages/components/README.md` §Setup drops the Tailwind 3 configuration step and
-corrects the stylesheet specifier (objectui#3780).
-
-Step 1 told readers to write a `tailwind.config.js` with a `content` array covering
-`./node_modules/@object-ui/components/**`. This package is Tailwind 4: it has no such
-file, `postcss.config.js` loads `@tailwindcss/postcss`, and `src/index.css` opens with
-`@import 'tailwindcss'` plus `@theme` / `@custom-variant` / `@source`. Tailwind 4 does not
-load a config file unless the CSS opts in with `@config`, so a reader who followed step 1
-created a file nothing reads. objectui#3750 had already narrowed the peer line two lines
-above it from `^3.0.0` to `^4.2.1`; the prose underneath did not move with it.
-
-Measured against the built package rather than translated on sight, because the step's
-premise turned out to be unreachable in Tailwind 4 and not merely misspelled. Four
-consumer-shaped CSS entries, one Tailwind 4.3.3 PostCSS run each, against the real
-`@object-ui/components` install:
-
-| consumer entry | consumer's own class | library shape utilities | library theme utilities |
-| --- | --- | --- | --- |
-| step 1 verbatim (config file, no `@config`) | present | absent | absent |
-| `@source` into the installed package | present | present | absent |
-| step 1 plus an explicit `@config` opt-in | present | present | absent |
-| the prebuilt stylesheet | not its job | present | present |
-
-Neither faithful translation of step 1 reaches what step 1 was for. `bg-primary`,
-`bg-background`, `border-input` and `ring-ring` — the whole Shadcn palette — exist only
-where the `@theme` block that declares their tokens is compiled, and that block is in
-`src/index.css`, which `files` does not publish. Scanning the published files therefore
-regenerates the shape-only utilities (`inline-flex`, `rounded-md`, `h-9`) and can never
-recover the themed ones, so a rewritten `@source` step would have been a new wrong
-instruction rather than a fixed one. The step is deleted, and the paragraph that replaces
-it says why the `@source` line a reader might reach for next is not the answer either.
-
-What the prebuilt stylesheet covers was measured the same way instead of assumed: every
-class-shaped token in `dist/index.js` + `dist/index.umd.cjs` — the entire surface a
-`node_modules` glob could ever see — was compiled against this package's own theme, and
-all 1331 rules that produces are already among the 1410 in the shipped `dist/index.css`.
-Zero missing. The prebuilt stylesheet is a strict superset of what scanning could add.
-
-The surviving import step also had the wrong specifier. It read
-`@object-ui/components/dist/style.css`, a subpath the manifest's `exports` map does not
-define — Node resolves it to `ERR_PACKAGE_PATH_NOT_EXPORTED`, and no such file is built
-(`dist/index.css` is). The exported spelling is `@object-ui/components/style.css`, which is
-what the three package demos, `content/docs/guide/quick-start.md` and the comment in
-`src/index.ts` that points readers at this README have all used the whole time. It is now
-what the README says too, shown together with the `@import 'tailwindcss'` line above it so
-the order that makes the theme tokens win is visible.
-
-No package is declared: nothing published changes shape, no version literal moves, and the
-corrected README ships with the group's next release. The peer-line block two lines above
-§Setup is untouched, so `doc-version-claims.test.ts`'s restatement assertion keeps reading
-the same line against the same manifest.
diff --git a/.changeset/composite-group-label-association-3961.md b/.changeset/composite-group-label-association-3961.md
deleted file mode 100644
index ec4a38c110..0000000000
--- a/.changeset/composite-group-label-association-3961.md
+++ /dev/null
@@ -1,32 +0,0 @@
----
-'@object-ui/core': minor
-'@object-ui/components': patch
-'@object-ui/fields': patch
----
-
-Give composite and grouped field widgets a real accessible name: the form renderer now associates its label by IDREF for widgets that declare `labelling: 'group'`, instead of emitting a `<label for>` that nothing labelable answers (objectui#3961).
-
-Six widgets rendered a visible group label that named **nothing** in the accessibility tree. Measured in a real form, one field per row, reading each label's `for` against the DOM:
-
-```
-address      for=…-form-item -> MISSING            byLabelText=0   role+name=0
-geolocation  for=…-form-item -> MISSING            byLabelText=0   role+name=0
-checkboxes   for=…-form-item -> div                byLabelText=0   role+name=0
-radio        for=…-form-item -> div[radiogroup]    byLabelText=0   role+name=0
-rating       for=…-form-item -> div                byLabelText=0   role+name=0
-file         for=…-form-item -> div[role=button]   byLabelText=0   role+name=0
-```
-
-Two shapes, one outcome. `address` / `geolocation` spread the host's id onto their first sub-input and then replaced it with that input's own unique id (objectui#3343, correct in itself), so the `for` named an id no element carried — clicking "Shipping Address" did nothing and the group label was absent from the accessibility tree entirely. `checkboxes` / `radio` / `rating` / `file` kept the id, but on a `div`: a `<label for>` on a non-labelable element is inert HTML — `HTMLLabelElement.control` is `null`, so it activates nothing and contributes no name. A screen reader heard "Street Address", "City", "Alpha", "Beta" — never which group they belonged to.
-
-The fix is the WAI-ARIA group pattern, driven by a DECLARATION rather than by the host guessing at widget DOM:
-
-- `@object-ui/core` — `ComponentMeta` gains `labelling?: 'control' | 'group'`. Additive and optional; absent means `'control'`, which is every existing component's behaviour.
-- `@object-ui/components` — the form renderer reads it. For a `'group'` field the `<FormLabel>` publishes an `id` and drops its `for`, and the widget receives `aria-labelledby`. The single-control path is unchanged down to the attribute: no id on the label, no `aria-labelledby` key on the widget, so no field acquires a second naming channel. `ui/form.tsx` is untouched (Shadcn no-touch) — both halves travel as ordinary props, since `<FormLabel>` spreads props after its own `htmlFor`.
-- `@object-ui/fields` — the six audited widgets declare `labelling: 'group'`. `address` / `geolocation` move the host id (and only the id) from their first sub-input to the group container; `checkboxes` / `rating` answer a host-supplied `aria-labelledby` with `role="group"`; `radio` keeps Radix's more specific `radiogroup`; `file` takes the name on its dropzone with no invented group layer, because it has exactly one control that merely happens not to be labelable.
-
-No new key in the widget props contract: `aria-*` is already declared on it and forwarded by `toDomProps`, the same channel `aria-required` (objectui#3290) travels.
-
-Deliberately unchanged: sub-labels keep naming their own inputs (`aria-labelledby` overrides `<label for>`, so putting the group name on the first sub-input would have replaced "Street Address" with the field name — the concatenated-name outcome this issue rejected), `aria-describedby` stays on the first focusable sub-input where focus can reach it (objectui#3318), the sub-input ids of objectui#3343 do not move, and standalone rendering — the inline grid editor, a bare SDUI node, where nobody hands down an id and there is no host label to point at — emits no role and no IDREF at all.
-
-A widget that does not declare itself keeps the old `for`, which the label-association tests report as an association resolving to a non-labelable element. Silence was the failure mode being fixed; the default path stays loud.
diff --git a/.changeset/console-locale-keys-3546-slice4.md b/.changeset/console-locale-keys-3546-slice4.md
deleted file mode 100644
index b007ed766f..0000000000
--- a/.changeset/console-locale-keys-3546-slice4.md
+++ /dev/null
@@ -1,67 +0,0 @@
----
-"@object-ui/i18n": patch
----
-
-Backfill the `console` namespace's 41 missing locale keys plus the `console.ai.group.` template family (objectui#3546, slice four)
-
-`scripts/check-i18n-call-site-keys.mjs` (objectui#3530) measured **41 distinct
-keys at 47 call sites** under `console.*` that a `t()` call site asks for and
-that **no locale pack defined** — five of those keys have more than one site
-(`console.ai.dock.maximize` has three), which is why the denominator is measured
-and never counted by hand. All 47 carried an inline
-`t(key, { defaultValue: 'English' })`, so this is the objectui#3517 class:
-English rendered correctly, and **all ten languages were stuck on it**. Nothing
-here rendered a raw key — slice one (PR #3583) held those sites.
-
-What that meant on the page: a `zh` user opening `/ai` got "Waiting for
-server…", "Still working…" and "Connection lost — reconnecting…" in the
-connection banner, all ten "Designing your app…" progress hints in English, and
-"Built" / "Not yet built" / "Published" / "Publish failed" on the plan card; the
-ChatDock's whole chrome (title, resize handle, collapse, "Open full page") was
-English including two `aria-label`s; the conversation sidebar's date headers read
-"Today" / "Yesterday" / "Previous 7 days"; a mistyped URL produced an English
-"Page not found"; and the `?` shortcuts dialog's AI group was English inside an
-otherwise translated table. Two of these strings ("Not yet built", "TODAY") are
-named in objectui#2458's mixed-language list.
-
-- **`packages/i18n/src/locales/en.ts`** gains 46 keys: the 41 measured ones plus
-  the five members of the `console.ai.group.` family. `console.notFound` is a new
-  sub-namespace; the rest extend `console.shortcuts` and `console.ai` (with new
-  `console.ai.dock`, `console.ai.designingPlanHint` and `console.ai.group`
-  objects). Every one of the 41 measured keys takes its call site's inline
-  `defaultValue` **byte for byte** (46/47 sites, script-compared), so the pack
-  path and the inline-default path cannot diverge.
-  - The one site that cannot match is `ChatDock.tsx:563`, where a single key
-    (`console.ai.dock.open`) carries two different English strings: the
-    `aria-label` says `Open assistant` and the `title` says
-    `Open assistant (⌘⇧I)`. A key can hold one value, so `en` takes the
-    `aria-label` spelling — an accessible name must not carry a glyph run that
-    screen readers announce as symbols, and `⌘` is a mac-only glyph that a
-    *language* pack cannot vary per platform. The tooltip therefore stops
-    advertising the shortcut; recorded on objectui#3810 (whose class this
-    divergence joins) rather than papered over.
-
-- **`console.ai.group.` leaves the ratchet's `missingPrefixes` (4 → 3).** It is a
-  template key — ``t(`console.ai.group.${group.key}`)`` in
-  `ConversationsSidebar.tsx:277` — whose static head matched no `en` key, so every
-  expansion missed. Its value surface is the **closed** `ConversationGroupKey`
-  union, so the repair is an enumeration of all five members, not a wildcard; a
-  test reads the component's own union and label map and fails if a sixth bucket
-  is ever added without a key.
-
-- **The nine other packs** get real translations, each evidenced against its own
-  `console` neighbours: `zh` full-width punctuation and the pack's single-em-dash
-  status-line style, `ja`/`ko` the pack's `AI ` spacing, `de` formal *Sie* and
-  its `Wird …` progressive, `fr` straight apostrophes, `es` *usted* (as the
-  `console.ai` neighbourhood already uses), `pt` the pack's `off-line` spelling,
-  `ru` ё orthography, `ar` verb-first phrasing that never opens an RTL sentence
-  with a Latin token. Where `en` repeats a string the packs already translate
-  (`Go back`, `Publish failed`, `Try again`, `Back to home`, `Assistant`,
-  `Today`, `Yesterday`), the existing neighbour's wording is reused rather than
-  re-invented.
-
-- **`scripts/i18n-call-site-key-baseline.json`** shrinks by exactly 42 entries
-  (41 keys + 1 prefix family): 109 → 68 keys, 4 → 3 prefixes.
-
-No component changed: an AST sweep of all 308 `console.*` call sites in the repo
-found zero dead `t(key) || 'English'` fallbacks among this slice's keys.
diff --git a/.changeset/context-selector-auto-select-race-os6979.md b/.changeset/context-selector-auto-select-race-os6979.md
deleted file mode 100644
index 301298163b..0000000000
--- a/.changeset/context-selector-auto-select-race-os6979.md
+++ /dev/null
@@ -1,35 +0,0 @@
----
-"@object-ui/app-shell": patch
----
-
-Context selectors: picking an option the instant the dropdown fills no longer snaps back to the first one
-
-A context selector is a *mandatory* scope, so `SelectorControl` auto-selects
-`options[0]` as soon as the option list resolves and nothing concrete is
-selected yet. That repair ran in a passive effect — a task AFTER the commit that
-rendered the option rows — which left a gap in which the dropdown was already
-rendered and clickable while no selection had been made. A pick delivered inside
-that gap was applied and then immediately undone: the queued auto-select fired
-second, carrying a closure from before the pick (`hasConcrete` still `false`,
-and the search string it wrote from still the pre-pick one), so the user's
-choice was replaced by the first row — silently, and for a `persist: 'query'`
-selector with a URL rewrite behind it.
-
-The gap is widest exactly where it matters: a slow options endpoint, a loaded
-machine, or a low-end device, i.e. the cases where a user is most likely to be
-already reaching for the option they want. The repair is now a layout effect, so
-it lands in the same synchronous flush as the options it reacts to — no event
-can be delivered in between, and the control is never painted with an empty
-value while options exist.
-
-Nothing else about the behaviour moves: same trigger, same deps, same one write
-per medium. A scope that a later param-less nav link drops is still
-re-established from the first option (the re-selection objectstack#5994 relied
-on when it deleted the storage-to-URL bridge), which is pinned alongside the two
-medium cases in `ContextSelectors.autoSelectRace.test.tsx`.
-
-Found as a CI flake in `ContextSelectors.persist.test.tsx`
-(objectstack#6979): under load the test's own pick lost the same race, twice,
-with `expected 'billing' to be 'crm_core'`. Those cases now settle the
-auto-select before picking, which also pins a fact none of them pinned before —
-a user's pick overrides the auto-selected first option.
diff --git a/.changeset/create-form-required-runtime-default-4069.md b/.changeset/create-form-required-runtime-default-4069.md
deleted file mode 100644
index 231303ad41..0000000000
--- a/.changeset/create-form-required-runtime-default-4069.md
+++ /dev/null
@@ -1,60 +0,0 @@
----
-"@object-ui/plugin-form": patch
----
-
-A required field whose `defaultValue` is a runtime token is submittable from a create form
-
-`@objectstack/spec` lets a field's `defaultValue` be a runtime *instruction*
-rather than a value — the `DEFAULT_VALUE_TOKENS` family (`'NOW()'`,
-`'current_user'`) or a CEL Expression envelope. The server resolves those per
-insert, in `ObjectQL.applyFieldDefaults`, for any field that arrives absent or
-null, which is why a create form must leave them empty: seeding the literal text
-`NOW()` into a datetime input and submitting it suppresses the very resolution
-the declaration asked for.
-
-Correct for an optional field. Combined with `required: true` it deadlocked:
-
-```ts
-remind_at: Field.datetime({ required: true, defaultValue: 'NOW()' }),
-```
-
-the control opened empty, the client-side required rule refused the submit, and
-there was nothing sensible for the user to type — the declaration had already
-said what the value is, and omitting the field is exactly what makes the server
-supply it. Same shape as the `required` + static-default case, one layer down.
-
-In **create** mode a runtime `defaultValue` now suppresses the client-side
-`required` rule, and the field is omitted from the payload. The producer
-guarantees the value at insert, so the field is not "missing" — it is
-server-owned. `required: true` alongside a runtime default is coherent authoring
-(storage-level required, producer-guaranteed), not an authoring error.
-
-Both halves matter. Suppressing the rule alone would have been half an answer: a
-rendered control registers with the form whether or not anything seeded it, so
-an untouched runtime-default field still reached the payload as `undefined` — or
-as `''` once anything focused it. `undefined` is invisible to a
-`JSON.stringify` inspection while remaining a KEY a data source may translate
-into an explicit column write, and `''` is neither absent nor null, so it stores
-a blank and defeats the declaration outright.
-
-Three boundaries came with it, each pinned in both directions:
-
-- **Create only.** An edit form shows a persisted row, where the token was
-  resolved at insert; blanking a required column there is a real removal and is
-  still refused.
-- **Runtime defaults only.** A static literal default *is* seeded into the
-  control, so if the user clears it they have removed a value that was really
-  there — `required` still fires.
-- **The rule, not the field.** A value the user does type is submitted normally
-  and outranks the declared default. Only the "must not be empty" check is
-  suppressed.
-
-Seeding and this rule read ONE predicate (`isRuntimeDefault`), so a form can
-never seed a field it also refuses to submit. The suppression also drops the
-required marker and `aria-required` for that field in create mode, since both
-are driven by the same boolean — the honest reading, as the user really is not
-required to provide the value. Surfacing what the server *will* supply, as a
-non-authoritative preview, is a separate follow-up.
-
-Not extended to `requiredWhen` (the conditional-required CEL rule), which is
-resolved downstream in the form renderer against the live record.
diff --git a/.changeset/create-form-seeds-declared-defaults-4047.md b/.changeset/create-form-seeds-declared-defaults-4047.md
deleted file mode 100644
index 372bb7beec..0000000000
--- a/.changeset/create-form-seeds-declared-defaults-4047.md
+++ /dev/null
@@ -1,45 +0,0 @@
----
-"@object-ui/plugin-form": patch
----
-
-Create forms now open with the object schema's declared `defaultValue`s
-
-A field declared `required: true, defaultValue: 'draft'` opened the console's
-create dialog with an empty select and a required marker: the user had to pick a
-value the system already knew, with every neighbouring option — some with side
-effects — one click away. `defaultValue` + `required` produced the worst create
-experience of any modelling choice, strictly worse than declaring no default.
-
-The server was never the problem. Omitting the field from a create request
-stores the declared default, because `ObjectQL.applyFieldDefaults` resolves it on
-insert. The gap was container-side: `ObjectForm` seeded its opening values from
-the object schema, and the five other object-form containers did not — their
-create branch set the form data to `initialData || initialValues || {}` and never
-looked at the schema. The console's create dialog is the global `<ModalForm>`,
-one of those five. Modal, Drawer, Tabbed, Split and Wizard now seed through one
-shared module (`schemaDefaults`), so a create form opens preselected and
-submittable.
-
-Three boundaries came with it, each pinned in both directions:
-
-- **Create only.** An edit form shows a persisted row as the server holds it.
-  `ObjectForm`'s pass had been running in every mode, so a column the record
-  leaves unset showed the default — arming a silent write of a value the user
-  never chose on the next save of any other field. It is now gated on the same
-  "no persisted record" test the data-fetch effect uses.
-- **Static defaults only.** A `defaultValue` may be an instruction the server
-  resolves per insert — the `NOW()` / `current_user` runtime tokens
-  (`DEFAULT_VALUE_TOKENS`) or a CEL Expression envelope. `ObjectForm` had been
-  seeding those verbatim, which put the literal text `NOW()` into a datetime
-  input and then submitted it as the field's value, suppressing the very
-  resolution the declaration asked for (`applyFieldDefaults` only fills fields
-  that arrive empty). Those are now left empty for the server.
-- **Callers still win.** `initialData` / `initialValues` outrank a schema
-  default — a lookup prefill or a duplicate-record seed is the more specific
-  instruction.
-
-Only the field-level `defaultValue` is honoured, not a select option's
-`default: true`, even though `@objectstack/spec`'s `SelectOptionSchema` declares
-that key: the insert path resolves `defaultValue` and nothing else, so seeding
-from option-level `default` would preselect values the server would never have
-applied — a UI-only second default contract.
diff --git a/.changeset/create-plugin-build-deps-anchored-3742.md b/.changeset/create-plugin-build-deps-anchored-3742.md
deleted file mode 100644
index 7230cd8d7e..0000000000
--- a/.changeset/create-plugin-build-deps-anchored-3742.md
+++ /dev/null
@@ -1,15 +0,0 @@
----
-"@object-ui/create-plugin": patch
----
-
-Anchor the scaffold's build-side `devDependencies` to this repo's real toolchain, and pin the whole generated manifest against drift
-
-A freshly scaffolded plugin declared a build stack one to two majors behind the one this monorepo actually builds and tests every in-tree plugin with: `vite ^7.3.1` against the repo's `^8.2.0`, `@vitejs/plugin-react ^4.2.1` against `^6.0.5`, `vite-plugin-dts ^4.5.4` against `^5.0.3`, `typescript ^5.9.3` against `^6.0.3`, `vitest ^4.0.18` against `^4.1.10`. Those five ranges were never sourced from anything — objectui#3716's end-to-end run of the generated artifact only ever exercised the versions installed in this repo, so the declared ranges were not the ones under test. All five now quote an in-repo anchor, the same way the three testing ranges already did.
-
-Two anchors, because the root manifest does not declare everything. `create-plugin` writes into `<cwd>/packages/plugin-<name>`, so a generated plugin is a literal sibling of `packages/plugin-*`; those manifests anchor the two build-only tools the root omits (`@vitejs/plugin-react`, `vite-plugin-dts`), and the root anchors the rest.
-
-The parity test now covers **every** entry of the generated `devDependencies` rather than the three testing ones, including a completeness check that fails when a dependency is added without naming its anchor — the five build ranges drifted precisely because nothing pinned them. It also asserts the two anchors agree wherever both declare a dependency, so which one is read cannot hide a drift.
-
-The generated `vite.config.ts` resolves its library entry from `import.meta.dirname` instead of `__dirname`. vite 8 still defines `__dirname` under its default `bundle` config loader but warns on it ("unsupported by `configLoader: 'native'`, which is planned to become the default in a future major version of Vite ... Use `import.meta.dirname` instead"), and under `native` — which imports the config with Node's own ESM loader, where no `__dirname` exists — the generated config failed to load outright. `apps/console/vite.config.ts` was converted for the same reason in objectui#3384.
-
-Not a peer-dependency fix: `@vitejs/plugin-react ^4.2.1` resolved to 4.7.0, whose vite peer had widened to `^4.2.0 || ^5.0.0 || ^6.0.0 || ^7.0.0` and accepted the declared `vite ^7.3.1`, so the old manifest installed cleanly. The cost was a scaffold lagging its own monorepo, not a failing install.
diff --git a/.changeset/create-plugin-runnable-test-stack.md b/.changeset/create-plugin-runnable-test-stack.md
deleted file mode 100644
index 6061410631..0000000000
--- a/.changeset/create-plugin-runnable-test-stack.md
+++ /dev/null
@@ -1,19 +0,0 @@
----
-'@object-ui/create-plugin': patch
----
-
-create-plugin: make the scaffolded plugin's own test suite runnable
-
-The generator wrote an example test importing `@testing-library/react` and
-asserting with `toBeInTheDocument()`, plus a `test: 'vitest run'` script, while
-declaring neither library and giving Vitest no DOM environment — so `pnpm test`
-in a freshly scaffolded plugin failed on the very first run, at import
-resolution.
-
-The generated `package.json` now declares `@testing-library/react`,
-`@testing-library/jest-dom` and `jsdom` (each range copied from this
-monorepo's own manifest), the generated `vite.config.ts` gains a `test` block
-with `environment: 'jsdom'`, `globals: true` and `setupFiles`, and a
-`vitest.setup.ts` registering the jest-dom matchers is written alongside it.
-The templates moved to `src/templates.ts` so the generated artifacts can be
-pinned by unit tests without executing the CLI.
diff --git a/.changeset/create-plugin-scaffold-dead-artifacts-3755-3759.md b/.changeset/create-plugin-scaffold-dead-artifacts-3755-3759.md
deleted file mode 100644
index d9166c86a8..0000000000
--- a/.changeset/create-plugin-scaffold-dead-artifacts-3755-3759.md
+++ /dev/null
@@ -1,46 +0,0 @@
----
-"@object-ui/create-plugin": patch
----
-
-Remove the scaffold's unused pinned icon dependency, and make its generated schema interface reachable
-
-Two declared-but-unreachable artifacts in the generated plugin, both on the blind side of
-the import gate objectui#3733 added — that gate rejects an import nothing declares, and
-never looked for a declaration nothing imports.
-
-**The generated `dependencies` no longer pin `lucide-react`** (objectui#3755). It was
-declared at `^0.563.0` and imported by no generated source file, so every freshly
-scaffolded plugin really installed lucide 0.563.x for code that never referenced it — two
-majors behind the 23 in-repo declarations, all `^1.28.0`. Worse than ordinary caret drift:
-a `0.x` caret does not cross minors, so `^0.563.0` is `>=0.563.0 <0.564.0` and could not
-float even within `0.x`. It is removed rather than re-anchored because this repo declares
-an icon library where it imports one — of the 24 manifests mentioning `lucide-react`, 23
-import it, and none pre-declares it for code not yet written. An author who wants icons
-runs `pnpm add lucide-react` and lands the current version by construction, with no anchor
-table to maintain for an unused entry. The generated `dependencies` is now exactly the four
-`workspace:*` platform packages, which cannot drift at all.
-
-**The generated `src/index.tsx` now re-exports the schema interface** from `src/types.ts`
-(objectui#3759). The generated `exports` map exposes exactly one key — `.` — so the entry
-is a consumer's only door, and nothing walked through it to `src/types.ts`: no generated
-source imported it, and the deep paths that would have reached it (`<pkg>/types`,
-`<pkg>/dist/types`) are closed by that same map. The interface in it is the plugin's schema
-contract, and it shipped dead — while the generator's own documentation page told authors to
-"export your schema types … make it importable rather than internal". A named type-only
-re-export, matching the four in-repo plugins that ship a `src/types.ts` and the worked
-example in the plugin-development guide.
-
-**That interface now extends `BaseSchema` from `@object-ui/types`** instead of re-declaring
-a subset of the base node. Unreachable, a hand-rolled `{ type; id?; className? }` was only
-dead weight; published, it would be a second dialect of a node the protocol already defines,
-silently missing everything else `BaseSchema` carries (`name`, `label`, `visible`, …). Only
-the `type` literal is narrowed locally, the same shape every in-repo plugin uses. This also
-makes the generated `@object-ui/types` dependency a used declaration.
-
-Both halves are pinned structurally rather than by string match, so the next dead artifact
-fails a test instead of shipping: no versioned runtime dependency may be declared that no
-generated source imports (`workspace:*` exempt — it cannot drift), and no generated `src/**`
-module may be unreachable from the single entry the `exports` map exposes. Each of those
-gates passes over an empty result on today's templates, so each is paired with a self-test
-that plants the removed defect back and asserts the rule names it — a gate that is green
-because it produces nothing is not a gate.
diff --git a/.changeset/data-table-row-menu-empty-guard.md b/.changeset/data-table-row-menu-empty-guard.md
deleted file mode 100644
index a36ae5dbc6..0000000000
--- a/.changeset/data-table-row-menu-empty-guard.md
+++ /dev/null
@@ -1,18 +0,0 @@
----
-'@object-ui/components': patch
----
-
-fix(data-table): don't render a row overflow ("⋮") trigger that opens an empty menu
-
-The row overflow trigger was gated on whether row-action **handlers** were
-supplied (`onRowEdit` / `onRowDelete` / `rowActionDefs`), while the menu's items
-were filtered a second time — per item, per record — against
-`rowEditPredicates` / `rowDeletePredicates` and a custom action's `visible`. On a
-row where every item was predicate-suppressed the trigger still rendered and
-opened an empty box, which reads as a broken page.
-
-The trigger is now decided by the items that will actually render for that row,
-resolved through the same visibility rule the items gate themselves on, so the
-two cannot disagree. The decision is per row: within one table a row that keeps
-an action keeps its trigger while a row with nothing left renders none. The
-actions cell itself is unchanged, so the column stays aligned with its header.
diff --git a/.changeset/dataset-drill-ranges-passthrough-3813.md b/.changeset/dataset-drill-ranges-passthrough-3813.md
deleted file mode 100644
index b9c3a13709..0000000000
--- a/.changeset/dataset-drill-ranges-passthrough-3813.md
+++ /dev/null
@@ -1,43 +0,0 @@
----
-'@object-ui/data-objectstack': patch
----
-
-data-objectstack: pass the server's `drillRanges` date-bucket drill scope through `queryDataset` (restores date drill-through)
-
-`queryDataset` rebuilds its result by **hand-picking** keys off the REST payload,
-and `drillRanges` was never in the list — so the analytics service's date-range
-drill sidecar (framework#1752) was dropped by the only real adapter in this repo,
-while five consumer call sites were already reading it (`DatasetWidget.tsx:471`
-and `:593`, `DatasetReportRenderer.tsx:316`, `:431`, `:855`).
-
-The user-visible effect was not a degraded drill but a missing one. A
-`dateGranularity` dimension groups a **span** of records into one bucket, which
-equality filters cannot express, so `service-analytics` deliberately excludes
-date dimensions from `dimensionFields`/`drillRawRows` and sends a parallel
-half-open `[gte, lt)` range per row instead. For a chart or report grouped **only
-by time** that makes `drillRanges` the *only* thing that can make
-`canDrill = !!object && (drillDims.length > 0 || !!drillRanges?.length)` true —
-with the key dropped, the entire drill entry point disappeared. A mixed
-date + non-date grouping kept its drill but built a filter with no time bound, so
-clicking June's bar opened every month (a superset).
-
-Neither side's tests could see it: the dashboard and report tests mock their own
-data source and feed `drillRanges` in directly, and the adapter's own suite never
-asserted the key. The new adapter-level tests therefore mock the **envelope the
-server actually sends** — bare (`res.json(result)`, no `{ success, data }`
-wrapper), carrying `sql`, and for a date-only grouping carrying `object` +
-`drillRanges` and *no* `dimensionFields`/`drillRawRows` — then assert the key
-arrives verbatim and row-aligned, that the consumers' own `canDrill` predicate is
-true, and that `buildDatasetDrillFilter` (the shared builder both surfaces call)
-scopes the drilled list to the clicked bucket.
-
-The declared entry type is `@object-ui/core`'s `DatasetDrillRange` **by
-reference**, per the objectui#3613/#3752 discipline: it is the single in-repo
-declaration of this shape (what the filter builder accepts and what both
-renderers type their state with), and nothing in `@objectstack/spec` owns it yet,
-so restating `{ field, gte, lt }` locally would create a third dialect of it.
-
-`drillRawTotals` (the totals-row companion, framework#3214) is deliberately
-**not** added: it has zero consumers in this repo, so passing it through would
-add a declared-but-unexercised return key with no user-facing effect — it belongs
-in the change that lands a totals-row drill and can test it.
diff --git a/.changeset/dataset-result-fields-spec-type-3752.md b/.changeset/dataset-result-fields-spec-type-3752.md
deleted file mode 100644
index 88f8a368ee..0000000000
--- a/.changeset/dataset-result-fields-spec-type-3752.md
+++ /dev/null
@@ -1,38 +0,0 @@
----
-'@object-ui/data-objectstack': patch
----
-
-data-objectstack: type `queryDataset`'s result `fields[]` as the spec's `AnalyticsResult.fields[]` element instead of a hand-written copy
-
-The return-value half of the drift objectui#3613 fixed on the parameter side. The
-adapter hand-listed five keys for a result column
-(`name`/`type`/`label`/`format`/`currency`) and, like every restatement, stopped
-at the contract of the day it was written: it never grew **`percentScale`**,
-which `@objectstack/spec@17.0.0-rc.5` carries on
-`AnalyticsResult.fields[]` and documents as mandatory reading for renderers —
-"renderers that receive it must scale by it instead of guessing from the value"
-(objectui#3136).
-
-That omission was not cosmetic. `percentScale` is the server's answer to a
-question a `%` format string cannot express (is the stored number a 0–1 fraction,
-or already percentage points?), and objectui#3136 exists because guessing from
-the value's magnitude printed a ratio of exactly `1` as "1.0%". Three in-repo
-consumers read the field through their own local types
-(`DatasetResultField` in `@object-ui/core`), so nothing was red here — but any
-author reading columns through the adapter's **declared** return type got
-`Property 'percentScale' does not exist`, i.e. the declaration actively steered
-them back to the guess the spec bans.
-
-`fields` is now the spec type by reference, so there is nothing left to re-sync;
-the change is additive for existing consumers (one more optional key).
-`queryDataset.test.ts` pins structural identity with the spec element, pins
-`percentScale` as the `'fraction' | 'whole'` union rather than a widened
-`string`, keeps a negative pin against the five-key shape, and adds a runtime
-test that reads `percentScale` off a result column **through the declared type**.
-
-The rest of the envelope stays locally declared, deliberately. It is the REST
-envelope, not an `AnalyticsResult`: the route adds ADR-0021 D2 drill metadata
-(`object` / `dimensionFields` / `drillRawRows`) on top of the spec result, and
-this method rebuilds its own object from the payload without copying `sql` — so
-declaring the envelope as `AnalyticsResult & { … }` would advertise a key the
-adapter structurally cannot return. A pin records that too.
diff --git a/.changeset/dataset-selection-spec-type-3613.md b/.changeset/dataset-selection-spec-type-3613.md
deleted file mode 100644
index 1690d31b53..0000000000
--- a/.changeset/dataset-selection-spec-type-3613.md
+++ /dev/null
@@ -1,38 +0,0 @@
----
-'@object-ui/data-objectstack': patch
----
-
-data-objectstack: type `queryDataset(selection)` as the spec's `DatasetSelection` instead of a hand-written copy
-
-The adapter restated the selection contract inline, field by field, and the copy
-had drifted three ways from the pinned `@objectstack/spec@17.0.0-rc.5`:
-
-- **`compareTo.dimension` was required.** It has been optional since
-  objectstack#5011, *because the executor resolves it*: exactly one time
-  dimension carrying a `dateRange` is the one shifted, and zero or several
-  raises a loud error naming the candidates. Requiring it made the compiler
-  demand from every typed caller precisely the consumer-side dimension guess
-  that change forbids — trading a loud executor error for a silently wrong
-  comparison window. No runtime path hit this yet (the dashboard's
-  `DatasetWidget` passes `selection` as `unknown`), but a declaration is a live
-  instruction to anyone calling this client from TypeScript.
-- **`timeDimensions` was widened to `unknown[]`**, erasing the very entry shape
-  the executor's resolution reads (`{ dimension, granularity?, dateRange? }`),
-  and **`runtimeFilter` to `Record<string, unknown>`**, erasing the
-  `$and`/`$or`/`$not` vocabulary the server parses.
-- **`dateGranularity` was missing entirely** — the copy had simply stopped at
-  whatever the contract looked like the day it was written, so a typed caller
-  could not bucket a trend by month at all.
-
-The parameter is now the spec type by reference, so there is nothing left to
-re-sync. The fix is the removal of the dialect rather than a correction to it:
-restating a contract owned elsewhere creates a second de-facto dialect of it, and
-drift is then only a matter of time (AGENTS.md #0/#0.1). `queryDataset.test.ts`
-pins structural identity with `DatasetSelection` plus each of the three drifts
-individually, checked by this package's `tsc --noEmit`; a runtime test pins that
-a dimension-less `compareTo` reaches the server untouched, so the adapter can
-never start guessing on the executor's behalf.
-
-The response type is deliberately left alone — it is the REST envelope
-(`object` / `dimensionFields` / `drillRawRows`), not a restatement of
-`AnalyticsResult`.
diff --git a/.changeset/dataset-widget-chartconfig-presentation-os7016.md b/.changeset/dataset-widget-chartconfig-presentation-os7016.md
deleted file mode 100644
index a4c8f6071c..0000000000
--- a/.changeset/dataset-widget-chartconfig-presentation-os7016.md
+++ /dev/null
@@ -1,51 +0,0 @@
----
-"@object-ui/plugin-dashboard": patch
----
-
-Dashboard metadata's `chartConfig` presentation keys now take effect for the first time
-
-`DashboardWidgetSchema.chartConfig` is declared as the full spec
-`ChartConfigSchema`, but the ADR-0021 dataset path lowered exactly one key onto
-the chart renderer: `showLegend` (objectui#3135). Everything else an author wrote
-there — the chart's own `title`/`subtitle`, the accessibility `description`, an
-explicit plot `height`, a `colors` palette or per-category colour map,
-`showDataLabels`, `annotations`, `interaction` — parsed as valid metadata,
-reached `DatasetWidget`, and was dropped before the chart schema was built. The
-underlying chart block draws all of them; only the dashboard's hand-off was
-missing.
-
-`DatasetWidget` now lowers each of those keys, on two mechanical criteria, both
-of which have to hold:
-
-1. **The chart block draws it end to end on this path.** `{ type: 'chart' }`
-   resolves to `ChartRenderer` → `AdvancedChartImpl`, which draws
-   `title`/`subtitle` above the plot, turns `description` into the chart
-   container's `role="img"` + `aria-label`, applies `height` as that container's
-   inline height, paints `colors`, prints `showDataLabels` as per-point labels,
-   draws `annotations` as reference lines/bands and honours `interaction` as the
-   tooltip toggle plus the range selector. Each is pinned at the DOM level, so a
-   key is never forwarded to a prop that ignores it.
-2. **It does not fight the dataset derivation.** `xAxis`, `yAxis` and `series`
-   are derived from the widget's dataset selection, so an authored one would
-   shadow the derived binding and blank the chart; they stay unforwarded, as does
-   `type` (the widget's own `type` already picks the chart family). `aria` stays
-   unforwarded too, for the other reason: nothing on this path reads it.
-
-`colors` is split the way the react tier already splits it, because the two arms
-reach the renderer through different props: a `string[]` is the positional
-palette, a `{ value: color }` record is a per-category map merged over the
-category dimension's own option colours.
-
-**Behaviour-opening surface.** A dashboard that already wrote any of these keys
-goes from having them ignored to having them applied — the point of the change,
-but visible: a widget that declared `chartConfig.title` now shows that title
-inside the plot area (in addition to the widget card's own `title`, which is a
-separate key), one that declared `height` no longer fills its card, one that
-declared `colors` stops using the theme palette, and `showDataLabels`,
-`annotations` and `interaction.brush` start drawing. Widgets with no
-`chartConfig`, or with only `showLegend`, render exactly as before: undeclared
-keys are never emitted, so the renderer's own defaults stay in charge.
-
-Part of objectstack#5175 (the enforce half); the narrowing half — what to do
-about `aria`, and about `xAxis`/`yAxis`/`series` being declared on a surface that
-derives them — is still open there.
diff --git a/.changeset/dataset-widget-colorvariant-3359.md b/.changeset/dataset-widget-colorvariant-3359.md
deleted file mode 100644
index 64c42b3f98..0000000000
--- a/.changeset/dataset-widget-colorvariant-3359.md
+++ /dev/null
@@ -1,45 +0,0 @@
----
-"@object-ui/plugin-dashboard": patch
----
-
-Dataset-bound metric cards honour their declared `colorVariant` (objectui#3359, objectstack#5010 ruling B)
-
-`DashboardWidgetSchema.widgets[].colorVariant` has been spec-declared, offered by
-every authoring surface (the widget inspector, the dashboard editor, the config
-panel) and authored **16 times** in shipped metadata — `system_overview` ×7 in
-`platform-objects`, app-showcase's `ops-dashboard` / `revenue-pulse` ×9 — with
-every one of those a `type: 'metric'` widget bound to a dataset. None of them
-ever rendered a colour.
-
-The reason is structural rather than a missing branch: `dataset` is **required**
-on `DashboardWidgetSchema`, so every legal widget reaches `DatasetWidget` through
-one of `DashboardRenderer`'s two dispatch sites, and `DatasetWidget` read the key
-nowhere. Only the inline (`object` + `valueField`) path had a colour affordance,
-via the `...options` spread into `MetricWidget` — a path the current schema
-cannot produce. Declared, authored, offered in the designer, and inert: the
-renderer painted all sixteen the same.
-
-The metric card now maps the declaration onto the accent system this package
-already has, instead of a second one:
-
-- the vocabulary is the spec's `WidgetColorVariantSchema` enum, read from the
-  spec **in a test** rather than restated in prose — `default`, `blue`, `teal`,
-  `orange`, `purple`, `success`, `warning`, `danger`;
-- the accent lands on the big number, the way `MetricWidget`'s chrome-less
-  `bare` layout carries it, because a dataset-bound metric renders no icon chip
-  and no card of its own. A dataset-bound KPI and an inline `bare` KPI declaring
-  the same variant now read the same;
-- the two class tables both layouts use moved into one shared module
-  (`colorVariants.ts`) rather than being copied — the designer's swatch picker
-  already calls itself a mirror of "the renderer's colorVariant tokens", and a
-  second copy of a palette is how a declared-but-unenforced key becomes the
-  harder bug: a key declared two disagreeing ways.
-
-Nothing changes for a widget that declares no `colorVariant`: its markup is
-pinned byte-for-byte against the pre-change render, as is the enum's own
-`'default'` (its name for "no accent"). Off-spec tokens — including the swatch
-picker's three display-only aliases `green` / `red` / `amber`, which exist so a
-legacy stored value can still be drawn as a swatch — get no accent and no
-aliasing here: the spec enum rejects them where metadata is authored and
-published, and teaching the renderer a second spelling would hand AI-authored
-metadata a dialect the contract does not have.
diff --git a/.changeset/de-approvals-inbox-quotes-3919.md b/.changeset/de-approvals-inbox-quotes-3919.md
deleted file mode 100644
index 310104594c..0000000000
--- a/.changeset/de-approvals-inbox-quotes-3919.md
+++ /dev/null
@@ -1,41 +0,0 @@
----
-"@object-ui/i18n": patch
----
-
-`de` approvals inbox no longer shows two quote typographies on one screen
-
-Three `approvalsInbox` values quoted the record title with ASCII straight quotes
-on **both** sides while their own sibling `approvalsInbox.approveOneTitle` used
-the correct German pair (U+201E low-9 opener, U+201C closer):
-
-| key | before | after |
-| --- | --- | --- |
-| `approvalsInbox.rejectOneTitle` | `"{{title}}" ablehnen?` | `„{{title}}“ ablehnen?` |
-| `approvalsInbox.inlineApproved` | `"{{title}}" genehmigt` | `„{{title}}“ genehmigt` |
-| `approvalsInbox.inlineRejected` | `"{{title}}" abgelehnt` | `„{{title}}“ abgelehnt` |
-
-A German approver therefore met both typographies in a single screen and inside a
-single operation pair — German quotes on the approve confirmation, typewriter
-quotes on the reject confirmation and on both inline toasts. `„…“` is the pack's
-own majority (50 paired spans) and DUDEN R11, so the three values were the
-outlier. Keys and the `{{title}}` placeholder are unchanged; this is a
-value-domain typography fix, and `en` (ASCII on both sides by design) is
-untouched.
-
-This is a **different defect shape** from objectui#3876, which paired a German
-opener with an ASCII closer. Because these three were ASCII on both sides they
-were self-consistent, so the pairing invariant objectui#3876 left behind could
-not see them — it scans forward from each `„`, and there was no `„` in them to
-scan from. The pack's straight-quote census being empty now lets that pin become
-strictly stronger: `de-quote-pairing-3876.test.ts` asserted an explicit
-three-key allowlist and now asserts that **no `de` value holds a U+0022 at all**,
-which covers both defect shapes and needs no per-key maintenance as new values
-land. The pack census moves from `„` 47 / `“` 47 / `”` 0 / `"` 6 to
-`„` 50 / `“` 50 / `”` 0 / `"` 0.
-
-None of the three i18n gates could have caught this: `all-locales-key-parity`
-compares key sets and placeholder shapes, `check-i18n-call-site-keys.mjs` only
-asks whether a key resolves, and `check-i18n-en-drift.mjs` fires on `en` value
-changes — these values were wrong from the day they landed, so no drift event
-ever existed. All three are value-blind by design, which is why the invariant
-lives in a test.
diff --git a/.changeset/de-quote-pairing-3876.md b/.changeset/de-quote-pairing-3876.md
deleted file mode 100644
index bd888ef026..0000000000
--- a/.changeset/de-quote-pairing-3876.md
+++ /dev/null
@@ -1,57 +0,0 @@
----
-"@object-ui/i18n": patch
----
-
-German pack: the 20 values that closed the German opening quote with an ASCII straight quote now close it with `“`
-
-`packages/i18n/src/locales/de.ts` opened a quoted span with the German low-9
-quote `„` (U+201E) and closed it with the ASCII typewriter quote `"` (U+0022) in
-20 keys, so a German user read `Registerkarte „Alle Datensätze" anzeigen` — a
-mismatched pair. `search.resultsCount` showed it most plainly: the value ended
-`„{{query}}""`, the mismatched closer immediately followed by the TS string
-terminator.
-
-This was never a pack convention. Measured on `main@2937bcf7d` before the fix,
-the same file already spelled 23 spans the correct German way, `„…“` — the two
-styles sat side by side, in sibling keys of the same namespace. Every mismatched
-closer is now `“` (U+201C), which is what German orthography (DUDEN R11) and the
-majority of the file already used. Affected surfaces: the four empty states
-(object / page / dashboard / report not found), the search results header, the
-lookup "create named" action, four `console.objectView` strings, the home
-getting-started hint, the six `navigationSync` toasts, the local marketplace
-install toast, and the preview not-ready title.
-
-No other language pack and no `en` value changed — the counts are unchanged for
-every other locale, and the mismatch was measured only in `de`.
-
-### Counted at landing, in two units
-
-The card reported "20 values" and the triage re-scan reported "22 mismatched
-pairs"; both are correct about different units, and the difference is now
-recorded rather than left to the next reader. 20 keys carried a mismatch;
-22 mismatch occurrences lived in them, because `navigationSync.renamedPage` and
-`navigationSync.renamedDashboard` each quote two names in one sentence
-("Seite „alt“ in „neu“ umbenannt") and so contribute two each. Full-file counts
-before → after: `„` 45 → 45, `“` 25 → 47, `”` 2 → 2, `"` 28 → 6.
-
-### The durable half, and why it is not the count equality the card proposed
-
-Three i18n gates run over these packs and none can see a wrong quote:
-`all-locales-key-parity` compares key sets and placeholder shapes,
-`check-i18n-call-site-keys.mjs` only asks whether a key resolves, and
-`check-i18n-en-drift.mjs` fires on `en` **value changes** — these values were
-wrong from the day they landed, so no drift event ever existed. Without a
-value-domain assertion the next backfill copies the mismatch from a neighbour
-again, which is exactly how these 20 accumulated.
-
-The card proposed asserting `count(„) === count(“)`. That is **false on the
-correctly fixed file** (45 vs 47) and would have sent the next reader hunting a
-bug that is not there: two values in this pack, `grid.import.savedMappingHint`
-and `grid.import.savedMappingPreviewNote`, are still untranslated English prose
-and quote in the English style `“…”`, so their two `“` are legitimate *openers*.
-The invariant that is pinned instead is the pairing itself — for every `„`, the
-first quote character that follows must be `“` — backed by the arithmetic
-identity `count(“) === count(„) + count(”)`, which stays true if those two values
-are later translated (47 === 47 + 0) and breaks the moment a mismatch returns.
-Both carry a presence guard so a broken import cannot make them pass by scanning
-nothing.
diff --git a/.changeset/declared-actions-bar-visible-gate-3835.md b/.changeset/declared-actions-bar-visible-gate-3835.md
deleted file mode 100644
index 93d3ce6711..0000000000
--- a/.changeset/declared-actions-bar-visible-gate-3835.md
+++ /dev/null
@@ -1,58 +0,0 @@
----
-"@object-ui/app-shell": patch
----
-
-Server-declared actions declaring `visible: false` are now hidden instead of rendered as live buttons (objectui#3835)
-
-`DeclaredActionsBar` — the bar that renders an object's SERVER-declared actions
-for one record at a `location`, with no per-action host code — asked truthiness
-on the gate: `if (action.visible && !isVisible) return null`. `false && …` is
-falsy, so `visible: false`, the most explicit way an author can say "never show
-this", fell into the "no gate declared" branch, the verdict was never consulted,
-and the action rendered for everyone.
-
-What that means on the page: the bar's host is the approvals inbox's
-record-section toolbar (`apps/console/src/pages/system/ApprovalsInboxPage.tsx`),
-so an approval action the metadata had switched off with `visible: false`
-rendered as a live Approve / Reject / Reassign button — and this component's own
-click handler is what POSTs the decision. One click was a real approve/reject
-call on a request the declaration said not to offer a decision on.
-
-This is the fifth and last member of the objectui#3492 family (after
-objectui#3758 / PR #3816 for the row-action surfaces and objectui#3812 / #3823
-for the action face), and the one whose two family-wide mitigations both fail:
-
-- The action defs are **server-declared** (`objectDef.actions[]`,
-  `sys_approval_request`), not hand-written view JSON. "`ActionSchema.visible` is
-  `ExpressionInputSchema` with no boolean member, so `objectstack build` cannot
-  emit this shape" does not apply on this path — the def arrives from server
-  metadata and in-process construction, where a boolean is the natural spelling.
-- The bar is mounted as **plain JSX** by its hosts, so `packages/react`'s
-  `SchemaRenderer` — which evaluates a node's `visible` and hides it before the
-  component mounts, and which is why objectui#3812 judged the component-level
-  gates a dormant defensive layer — is not on this path at all. This gate was the
-  only one there.
-
-The gate now reads the family's one named definition,
-`hasDeclaredVisibilityGate` (`!= null && !== ''`), imported from
-`@object-ui/components` rather than re-spelled: five gates in three packages
-asking one question must not drift into five answers. The evaluation entry is
-untouched — `toPredicateInput` passes a boolean through and `useCondition`
-short-circuits it instead of calling the expression engine — so a declared
-`false` resolves to `false`, and every expression-valued `visible` keeps exactly
-the verdict it had.
-
-Behaviour change surface, deliberately narrow: only a declared action whose
-`visible` is the literal boolean `false` (or another falsy non-empty value)
-changes, from rendered to hidden, which is what the declaration asked for.
-`visible: true` still renders, `''` and an absent `visible` are still no gate at
-all, and the bar still renders no chrome when its located set is empty.
-
-The suite that covered this component could not have caught it: it stubbed the
-whole predicate entry constant-true (`useCondition: () => true`), with a comment
-saying the test actions omit `visible` "so this is unused" — which made the gate
-unreachable from the only tests that mount this component (the objectstack#4984
-family, where a fixture keeps a broken rule green). That stub is gone; the suite
-now runs the real `useCondition` / `toPredicateInput` and doubles only the action
-dispatch, so all four shapes (`false` hides / `true` renders / undeclared renders
-/ `''` is not a gate) are judged by the shipped evaluation semantics.
diff --git a/.changeset/default-list-view-identity-3770.md b/.changeset/default-list-view-identity-3770.md
deleted file mode 100644
index ef7d3fe8f4..0000000000
--- a/.changeset/default-list-view-identity-3770.md
+++ /dev/null
@@ -1,12 +0,0 @@
----
-"@object-ui/app-shell": patch
----
-
-Ask the view composer for a container's view identities instead of deriving `list.name || 'list'`, so the default list view's translated label resolves
-
-A `defineView` container declares its default list under the `list` key. That key is a slot in the authoring document, not the view's identity: `expandViewContainer` — the same composer the framework's loader and the i18n extractor call — registers an unnamed default list as `<object>.default`. This renderer derived `list.name || 'list'` instead, a third spelling no producer emits, so a default-list-only object probed `objects.<object>._views.list.label`, missed the published `_views.default.label` key (objectstack#5164 ruling A, migrated in objectstack#6124) and fell back to the English metadata label — for the view's description and empty state too.
-
-- `MetadataProvider.mergeViewsIntoObjects` now expands a stack-packaged container through `expandViewContainer` and routes the result through the same code path as first-class ViewItems. Both authoring gates therefore key `listViews` / `formViews` by the canonical `<object>.<key>` identity, and the container inherits the composer's folding (a `listViews` entry that merely restates `list` collapses into one view) and collision renaming instead of restating them locally.
-- `ObjectView` resolves the primary view's id through the new `defaultListViewId` helper — one derivation shared by the view-override lookup and the view-switcher promotion, with no literal fallback.
-
-The renamed id is also the key a view override is persisted under (`updateViewConfig(object, viewId, …)` writes a `view` metadata record named by the id). Nothing is orphaned: the retired `'list'` spelling is not a representable view identity at all — `ViewItemNameSchema` requires a dotted `<object>.<key>` name — while the record-gate path, which real backends serve, already used the qualified id. Stale `/view/list` links fall back to the object's default view, which is the same view they named.
diff --git a/.changeset/div-deprecation-warn-once.md b/.changeset/div-deprecation-warn-once.md
deleted file mode 100644
index 60992a7348..0000000000
--- a/.changeset/div-deprecation-warn-once.md
+++ /dev/null
@@ -1,18 +0,0 @@
----
-"@object-ui/components": patch
----
-
-The `div` deprecation notice is now reported once per module load, not once per render (objectui#3965)
-
-`DivRenderer` called `console.warn` on every render. That is invisible on a page
-with one `div` and destructive on a page with many: the docs schema-catalog index
-renders 400+ example thumbnails and emitted ~190 byte-identical notices, burying
-the page's real console errors underneath — the two nested-button errors fixed in
-objectui#3903 / PR #3964 had to be fished out of that flood, and it cost a
-browser-verification run its signal twice.
-
-The deprecation itself is unchanged: dev builds still report it, the message and
-its migration guidance are byte-identical, and production builds are still
-silent. Only the repetition is gone. The guard is a module-level `Set` keyed by
-type, and the production early-return happens *before* the set is marked, so a
-production render cannot suppress a later dev-build notice.
diff --git a/.changeset/doctor-tailwind4-diagnostics-3891.md b/.changeset/doctor-tailwind4-diagnostics-3891.md
deleted file mode 100644
index 66896e875b..0000000000
--- a/.changeset/doctor-tailwind4-diagnostics-3891.md
+++ /dev/null
@@ -1,56 +0,0 @@
----
-"@object-ui/cli": patch
----
-
-`objectui doctor` now diagnoses Tailwind 4 instead of Tailwind 3
-
-The Tailwind section of `objectui doctor` was written against v3 and got every
-question backwards on a v4 project — which is every project this repo ships.
-
-**It counted a missing `tailwind.config.js` as an issue.** In v4 that file is not
-part of the setup: the engine reads CSS-first configuration (`@import
-'tailwindcss'`, `@theme`, `@source`) and only loads a JS config when a stylesheet
-opts in with `@config`. So the command reported a problem that did not exist and
-pushed the reader toward creating a file Tailwind would never read. Measured on
-`examples/console-starter`, a correct v4 app: before, `Found 1 issue(s)` —
-`⚠️ tailwind.config.js not found`; after, `Everything looks good! ✨`. The repo's
-own root reproduced it identically.
-
-**It then graded that file on its `content` array**, the v3 key `@source`
-replaced. The two `tailwind.config.*` files still tracked here are exactly that
-trap: `apps/console` and `examples/byo-backend-console` both declare a `content`
-array, no stylesheet in the repo contains `@config`, so both files are inert —
-and the old check answered `✓ Tailwind content paths configured` for them. A
-false green on a dead file. `apps/console` before: `Everything looks good! ✨`;
-after: one finding saying the config is inert and what to do about it.
-
-**It never checked `@tailwindcss/postcss`**, the one dependency a v4 build cannot
-start without — v4 moved the PostCSS plugin out of `tailwindcss` into that
-package, and naming the old `tailwindcss` key in a PostCSS config resolves to a
-shim whose only job is to throw. That is the failure form objectui#3852 measured
-on the generated app, and doctor printed `✓ Tailwind CSS installed` straight
-through it.
-
-The checks are now the v4 contract, matching what `objectui init` scaffolds:
-`@tailwindcss/postcss` declared or installed, a PostCSS config naming it rather
-than the v3 `tailwindcss` key, and a CSS entry running `@import 'tailwindcss'`
-(with `@source` acknowledged when present). The declared `tailwindcss` major is
-read too, so a v3 range is named as migration debt instead of passing as
-`✓ installed`.
-
-Two deliberate silences, because objectui#3891 is about doctor asserting things
-it cannot see. A **missing** `tailwind.config.*` produces no finding of any level
-— only a *present* one does, and only when nothing opts into it via `@config`.
-And when no recognised CSS entry exists at all (a monorepo root, a bespoke
-layout), the CSS verdicts are skipped rather than guessed.
-
-A v3-tolerant dual path — branching on the declared major and running two sets of
-checks — was considered and deliberately not built: it widens the product surface
-past this repo's v4-only posture. v3 spellings are diagnosed as migration debt,
-not supported as a second mode.
-
-Internally `runDiagnostics(cwd)` now returns structured findings carrying a
-stable `id`, and `doctor()` only renders and counts them. That split is what
-makes the matrix testable against real fixture directories instead of scraped
-console output; the tests pin verdicts by `id`, so wording can improve without
-the coverage evaporating.
diff --git a/.changeset/draftbar-es-register-3844.md b/.changeset/draftbar-es-register-3844.md
deleted file mode 100644
index 8de293522d..0000000000
--- a/.changeset/draftbar-es-register-3844.md
+++ /dev/null
@@ -1,65 +0,0 @@
----
-'@object-ui/i18n': patch
----
-
-`preview.draftBar` speaks one second person in `es` — the draft-preview banner no
-longer switches from tú to usted when a Spanish user publishes (#3844)
-
-`DraftPreviewBar` renders two mutually exclusive sentences in the same strip of
-the same banner: `message` while there are unpublished changes, `messageClean`
-once there are none. In `es` the two disagreed on register — `message` was tú
-(`estás viendo`, `publiques`) while `messageClean` (`ve`) and `sampleDataBody`
-(`Está`, `su`, `Publíquela`) were usted. So a Spanish user who pressed Publish
-watched the banner change person: same component, same position, same session.
-
-This is a third defect class in the value-domain blind spot behind #3582 and
-#3625, and no gate in the repo can see it. Both `es` values are correct
-translations of their `en` sentences — nothing is missing, nothing is stale, and
-nothing holds English. The inconsistency is *internal to one pack, on one UI
-surface*: `scripts/check-i18n-call-site-keys.mjs` only asks whether a key exists
-in `en`, `all-locales-key-parity` compares key sets and placeholder shapes and
-never reads values, and `scripts/check-i18n-en-drift.mjs` only fires when an `en`
-value moves — these two `en` values never moved.
-
-`message` is the value that changes, because usted is what the pack already says
-everywhere around it: the `es` pack censuses 102 usted markers to 30 tú (tú being
-the marked exception, concentrated in the auth, report-editor and organizations
-neighbourhoods that #3546 slice two deliberately ruled informal); the other three
-strings of this same object were already usted; and #3546 slice five gave the 19
-new `preview.unpublishedBar.*` / `preview.history.*` keys usted on the strength
-of `home.pendingDrafts.published` ("¡Publicado! Sus cambios están activos."). Two
-smaller divergences inside the same sentence are closed with it, so the banner's
-two halves stop disagreeing about wording as well as person:
-
-- **`—` instead of `:`** in `messageClean`, matching `en`, where both sentences
-  open `Draft preview — `. That is the whole of `messageClean`'s diff.
-- **`activo` instead of `en producción`** for "live". The pack spells this concept
-  `activo` in four neighbouring places including `publishCta` in this very object
-  ("Publicar para verlo activo"), and it reserves *producción* for the actual
-  production environment (`environment.entitlement.planLockedBody`), so the
-  outlier was ambiguous as well as inconsistent.
-- **`Vista previa del borrador`** as the shared opening, `del` being the form
-  `messageClean` already used.
-
-No `en` value changes (the en-drift gate reports 0), no key is added or removed
-(so `all-locales-key-parity` is untouched by construction), and the nine other
-packs are not touched. The diff is two values in one file.
-
-Re-voicing the whole `preview` namespace to tú was considered and rejected — a
-much larger change that would collide with the adjacent `marketplace.*` (9:0
-usted) and `console.ai.*`. `preview.empty.notReadyDescription` therefore stays tú
-here, since #3844's ruling is this banner only; it is filed as #3875 rather than
-waved through, because `PreviewDraftEmptyState` renders *underneath*
-`DraftPreviewBar` and so those two show usted and tú on screen at the same time.
-After this change the `preview` namespace is 23 usted to that 1 tú.
-
-A gate that checks "one register per namespace" is deliberately **not** here:
-recognising usted vs tú needs real morphology, and token matching demonstrably
-cannot — in this pack the token `revisa` is usted in `console.ai.empty.build`
-(es.ts:1365, "…y usted revisa y publica.") and tú in
-`auth.forgotPassword.successTitle` (es.ts:1918, "Revisa tu correo electrónico"),
-the same eight letters in opposite registers. The neighbourhood boundary such a
-gate would police is human judgement anyway — #3546 slice two's "same rule,
-different answer". A new `draftBar-es-register-3844.test.ts` pins the four `es`
-values byte for byte instead, plus the `en` literals, so a future reword of
-either `en` sentence fails in the same PR that reworded it.
diff --git a/.changeset/element-datasource-block-wiring-os6953.md b/.changeset/element-datasource-block-wiring-os6953.md
deleted file mode 100644
index 20ffdc0cb5..0000000000
--- a/.changeset/element-datasource-block-wiring-os6953.md
+++ /dev/null
@@ -1,58 +0,0 @@
----
-"@object-ui/react": minor
-"@object-ui/components": patch
-"@object-ui/plugin-grid": patch
-"@object-ui/plugin-form": patch
-"@object-ui/plugin-kanban": patch
-"@object-ui/plugin-calendar": patch
-"@object-ui/plugin-charts": patch
-"@object-ui/plugin-dashboard": patch
-"@object-ui/plugin-detail": patch
----
-
-`PageComponentSchema.dataSource` now reaches every object-bound block, not just
-`list-view` — and `element:record_picker` stops discarding `view`
-(objectstack#6953).
-
-objectstack#5576 wired the spec's per-element data binding
-(`dataSource: { object, view?, filter?, sort?, limit? }`) to `list-view` and left
-the same declaration inert on every other page component. Two gaps remained, and
-both were silent:
-
-- **`element:record_picker` read four of the five keys and dropped `view`.** So
-  `dataSource: { object: 'account', view: 'hot' }` — the spec's own example —
-  built a picker over EVERY account instead of the rows the saved view selects.
-  Nothing threw and nothing rendered an error; the option list was simply wider
-  than what was authored, which also means a user could select a record the page
-  said was out of scope.
-- **`object-grid` / `object-form` / `object-kanban` / `object-calendar` /
-  `object-chart` / `object-metric` / `record:related_list` read none of it.**
-  Each gates its fetch on its own `objectName`, and nothing mapped
-  `dataSource.object` onto it, so a page written the way the spec documents
-  rendered an empty grid / a field-less form / a board with no cards / an empty
-  month / an empty chart / a static metric number — with no request and no
-  diagnostic anywhere. Spec-valid metadata rendering nothing is the
-  objectstack#4413 shape.
-
-Composition follows objectstack#5576's landed semantics unchanged on every block:
-a named saved view supplies the baseline, a key written on the component itself
-overrides it, an explicit binding key overrides both, `filter` AND-combines
-("additional filter criteria" — a binding can narrow a view, never widen it), and
-a `view` name that does not resolve renders a configuration error instead of
-degrading to the object's full scope.
-
-- `@object-ui/react` — new `useElementDataSourceSchema(schema, mapping, dataSource?)`
-  and `ElementDataSourceGate` apply a resolved binding to the schema keys a given
-  block reads, plus `ElementDataSourceErrorPanel` / `ElementDataSourceLoadingPanel`
-  for the two non-final states. One precedence table for all blocks rather than
-  one copy per block — that copy is how "additional filter criteria" would have
-  become two dialects.
-- A mapping names **only** keys its block genuinely reads. A composed value
-  written onto a key the block ignores would be accepted and dropped, which is
-  the defect being removed, one layer deeper — so a kanban's swimlane `columns`
-  never receive a view's field list, and a block with no row cap leaves `limit`
-  unmapped. The per-block coverage table, including two residual gaps that are
-  named rather than papered over, is in `content/docs/guide/data-source.md`.
-
-No behaviour changes for a block that carries no `dataSource`: the binding-free
-path returns the schema by reference, so nothing remounts and nothing refetches.
diff --git a/.changeset/element-datasource-remaining-blocks-os7121.md b/.changeset/element-datasource-remaining-blocks-os7121.md
deleted file mode 100644
index ef1a8d1d1c..0000000000
--- a/.changeset/element-datasource-remaining-blocks-os7121.md
+++ /dev/null
@@ -1,54 +0,0 @@
----
-"@object-ui/plugin-gantt": patch
-"@object-ui/plugin-timeline": patch
-"@object-ui/plugin-map": patch
-"@object-ui/plugin-dashboard": patch
-"@object-ui/plugin-form": patch
----
-
-`PageComponentSchema.dataSource` now reaches the remaining object-bound public
-blocks: `object-gantt` / `object-timeline` / `object-map` / `object-pivot` /
-`object-master-detail-form` / `embeddable-form` / `record:line_items`
-(objectstack#7121).
-
-objectstack#6953 wired the spec's per-element data binding
-(`dataSource: { object, view?, filter?, sort?, limit? }`) to the eight blocks it
-named and left the same declaration inert on these seven. Each gates its fetch on
-its own object key and nothing mapped `dataSource.object` onto it, so a page
-written the way the spec documents rendered an empty gantt / an empty timeline
-rail / a map with no markers / an empty cross-tab / a field-less form — with no
-request and no diagnostic anywhere. Spec-valid metadata rendering nothing is the
-objectstack#4413 shape.
-
-Composition follows objectstack#5576's landed semantics unchanged, through the
-shared `ElementDataSourceGate` (no change to it or to the resolution layer): a
-named saved view supplies the baseline, a key written on the component itself
-overrides it, an explicit binding key overrides both, `filter` AND-combines
-("additional filter criteria" — a binding can narrow a view, never widen it), and
-a `view` name that does not resolve renders a configuration error on every one of
-these blocks instead of degrading to the object's full scope.
-
-Each block maps **only** the keys it genuinely reads, which for this batch means
-several keys stay deliberately unmapped rather than being parked somewhere
-plausible:
-
-- `object-gantt` and `object-map` take `object` / `filter` / `sort`; neither has a
-  row cap or a field-list read site.
-- `object-pivot` takes `object` / `filter`; a cross-tab orders itself by its own
-  row/column grouping and cannot be computed over a truncated page.
-- `object-timeline` takes `object` only — its fetch is
-  `find(objectName, { options: { $top: 100 } })`, with no filter/sort read site
-  at all, so a named view is error-checked and then contributes nothing.
-- `embeddable-form` and `object-master-detail-form` take `object` only (the
-  parent object, in the master-detail case); a form that writes one record has no
-  collection query for `filter` / `sort` / `limit` to narrow.
-- `record:line_items` takes `object` onto **`childObject`** — the collection it
-  actually lists — and nothing else: its query is the parent FK plus a fixed
-  `$top: 500`, and its `columns` are editable `GridColumn` objects rather than a
-  field-name projection a view could supply.
-
-The per-block coverage table, including every residual gap named above, is in
-`content/docs/guide/data-source.md`.
-
-No behaviour change for a block that carries no `dataSource`: the binding-free
-path returns the schema by reference, so nothing remounts and nothing refetches.
diff --git a/.changeset/element-datasource-view-os5576.md b/.changeset/element-datasource-view-os5576.md
deleted file mode 100644
index 7a33cede18..0000000000
--- a/.changeset/element-datasource-view-os5576.md
+++ /dev/null
@@ -1,49 +0,0 @@
----
-"@object-ui/core": patch
-"@object-ui/react": patch
-"@object-ui/plugin-list": patch
-"@object-ui/app-shell": patch
----
-
-`PageComponentSchema.dataSource` is now consumed instead of discarded — a
-`list-view` page component can reference a **saved view by name** for the first
-time, and writing the binding no longer breaks the component
-(objectstack#5576).
-
-The spec declares a per-element data binding on every page component —
-`dataSource: { object, view?, filter?, sort?, limit? }` — and objectui read none
-of it. `ViewDataProvider.resolveElementDataSource` forwarded
-`filter`/`sort`/`limit` and dropped `view` entirely, and had no caller outside its
-own test; nothing mapped `object` onto the `objectName` a list actually reads. So
-"reference a saved view by name" was published, validated and inert, and every
-page that wanted a saved view's columns/filter/sort had to inline a second copy of
-them — the drift the binding exists to remove.
-
-Writing the binding also **broke** the block, for a reason unrelated to `view`:
-`SchemaRenderer` spread the schema's `dataSource` metadata onto the component as a
-React prop, and that is the prop name the host uses to inject the data-source
-ADAPTER. The plain `{ object, view }` object shadowed the adapter, so the first
-`dataSource.find(…)` threw `dataSource.find is not a function` and `list-view`
-rendered "Couldn't load records" — a spec-compliant component failing next to
-identical ones that omitted the binding.
-
-- `@object-ui/react` — `SchemaRenderer` no longer spreads `schema.dataSource` as a
-  prop (it is metadata, like `visibleWhen`); renderers read it off `schema`. An
-  explicit React `dataSource` prop is unaffected. New
-  `useElementDataSource(schema, dataSource?)` hook resolves a binding, fetching
-  the named saved view from the object definition's `listViews` and the metadata
-  overlay's `listViews()`.
-- `@object-ui/core` — new `isElementDataSourceConfig` / `collectSavedViews` /
-  `resolveSavedView` / `composeElementDataSource`, and `resolveElementDataSource`
-  now honours `view` through an optional `DataFetcher.fetchViews`, reporting an
-  unresolvable view as an error instead of silently returning every record.
-  `resolveViewId` moved here from `@object-ui/app-shell` (re-exported there) so
-  one matcher serves both the object page and a page component.
-- `@object-ui/plugin-list` — `list-view` maps the binding onto the props
-  `ListView` reads. `dataSource.*` keys are authoritative, view-supplied values
-  are a baseline the component's own keys override, and `filter` AND-combines at
-  every level (the spec calls the binding's filter "additional criteria"), so a
-  binding can narrow a saved view but never widen it. A `view` name that does not
-  resolve renders a configuration error naming the object's actual views and
-  issues no query — it never falls back to the object's default view, because that
-  turns a typo into a silently wider answer.
diff --git a/.changeset/empty-predicate-declared-gate-3850-3862.md b/.changeset/empty-predicate-declared-gate-3850-3862.md
deleted file mode 100644
index bdeac72435..0000000000
--- a/.changeset/empty-predicate-declared-gate-3850-3862.md
+++ /dev/null
@@ -1,74 +0,0 @@
----
-"@object-ui/core": patch
-"@object-ui/components": patch
-"@object-ui/react": patch
----
-
-An empty predicate is no longer a declared gate anywhere (objectui#3850, objectui#3862)
-
-"Is a gate DECLARED on this key — is there a condition to reach a verdict on?" was
-answered three times in this repo, with three different scopes, and the widest
-answers sat on `disabled`, where the mistake is not benign:
-
-- `hasDeclaredVisibilityGate` (the action face) asked `!= null && !== ''`, so every
-  OBJECT counted — including `{ dialect: 'cel', source: '' }`. That envelope is not
-  a hand-written curiosity: `@objectstack/spec`'s `ExpressionInputSchema` normalizes
-  every authored predicate into one, so "the author left the predicate empty"
-  compiles to exactly it. The verdict path normalized the same value back to
-  `undefined`, and `evaluateCondition(undefined)` answers `true` — "no condition, so
-  visible/enabled". On `visible` that `true` means SHOW, so the two mistakes
-  cancelled; on `disabled` it means GREY, so they compounded: a button disabled
-  forever that no author asked to disable (objectui#3850, the residue objectui#3842
-  left behind).
-- `SchemaRenderer` asked `disabled !== undefined` inline, one notch wider again, so
-  `disabled: null` greyed out too — on the GENERIC rendering path, since that block
-  runs for every node type, and not as an internal flag either: `_disabled` is
-  forwarded to the component as a real `disabled` prop (objectui#3862).
-- `ActionRunner`'s execution gates asked "does this normalize to something
-  evaluable?" — the scope that turned out to be right (objectui#3848 / objectui#3872).
-
-There is now ONE definition, `hasDeclaredPredicate`, exported from
-`@object-ui/core` (`evaluator/declaredPredicate.ts`, beside the `toPredicateInput`
-normalizer it is derived from): a gate is declared when normalization still leaves a
-condition to evaluate. `''`, a whitespace-only string, an empty-`source` envelope
-and any non-predicate value (`0`, `{}`) are NOT declared; `false` IS (a verdict is
-not a missing gate — objectui#3812). `hasDeclaredVisibilityGate` keeps its name as a
-re-export of it, so the five member-action renderer call sites, `DeclaredActionsBar`
-and `record-quick-actions` are unchanged and inherit the scope;
-`SchemaRenderer`'s `disabled` / `disabledOn` chain and `ActionRunner`'s two gates
-read the same function. No consumer got a local "and also check for empty" test —
-that fourth dialect is what objectui#3842 / objectui#3849 spent two PRs merging away.
-
-Measured behaviour change, `action:button` and the generic path, before → after:
-
-| value | `visible` | `disabled` | `enabled` | `SchemaRenderer` `disabled` prop |
-|---|---|---|---|---|
-| `''` | shown → shown | on → on | on → on | forwarded → absent |
-| `null` | shown → shown | on → on | on → on | forwarded → absent |
-| `{ dialect: 'cel', source: '' }` | shown → shown | GREY → on | on → on | forwarded → absent |
-| `{ source: '' }` | shown → shown | GREY → on | on → on | forwarded → absent |
-| `'   '` (whitespace) | HIDDEN → shown | on → on | GREY → on | forwarded → absent |
-| `0` / `{}` (not predicates) | shown → shown | GREY → on | on → on | forwarded → absent |
-| `true` / `false` / bare CEL / `${…}` / non-empty envelope | unchanged | unchanged | unchanged | unchanged |
-
-Every row moves toward "there is no gate here", never away from it, and no value
-that HAS a verdict changes it — the verdict is still read from the raw value, only
-the gate in front of it narrowed. Two rows are behaviour changes rather than the
-equivalence the ruling expected, and are pinned as such: the whitespace string moves
-on `visible` / `enabled` (it used to normalize to `'${   }'`, which evaluates falsy,
-so a predicate that says nothing HID the action from everyone), and non-predicate
-junk stops greying controls out (fail-open, the posture `ActionRunner` already
-committed to).
-
-One blank spelling is knowingly still outside the scope: an envelope whose `source`
-is blank but not EMPTY (`{ dialect: 'cel', source: '   ' }`) — the normalizer folds a
-`source` of `''` and does not trim, so the string spelling of a blank predicate is
-trimmed and the envelope spelling is not, and `disabled` still greys out for that one
-value. The ruling enumerated three empty spellings; this is a fourth, measured and
-filed as objectui#3960 rather than widened in here.
-
-One chain is deliberately untouched: `SchemaRenderer`'s `visible` / `visibleWhen` /
-`visibleOn` / `visibility` / `hidden` / `hiddenOn` legs keep `!== undefined`, because
-narrowing them would change ALIAS PRECEDENCE, not just emptiness. The `hidden` legs
-are not negated and therefore carry this same defect with the polarity that makes the
-node vanish — measured, out of this ruling's scope, filed as objectui#3955.
diff --git a/.changeset/environment-create-cta-loading-skeleton-3482.md b/.changeset/environment-create-cta-loading-skeleton-3482.md
deleted file mode 100644
index fa98382098..0000000000
--- a/.changeset/environment-create-cta-loading-skeleton-3482.md
+++ /dev/null
@@ -1,24 +0,0 @@
----
-"@object-ui/app-shell": patch
----
-
-console: hold the environment list's create CTA with a skeleton until entitlements
-resolve, instead of showing a label that is about to be overwritten (objectui#3482,
-part of cloud#1049).
-
-`EnvironmentListToolbar` presents a state-aware create affordance — "Set up your
-production environment" / "Add development environment" / an upgrade prompt — decided
-from `GET /cloud/environment-entitlements`. While that request was in flight the
-toolbar rendered the action's metadata label, so the button visibly changed its
-wording the moment the response landed. The two texts are owned by different
-packages (the cloud translation bundle vs this repo's locale packs), which made the
-swap read as an inconsistency rather than a load.
-
-The in-flight state now renders a `Skeleton` sized like the button it stands in for,
-matching the adjacent `cloud:onboarding-next` welcome CTA. Only the create action is
-withheld — other toolbar actions never re-label, so they keep rendering — and a
-toolbar without a create action gets no skeleton at all. The skeleton is never
-terminal: when both entitlement signals fail, the resolution settles as
-`{ ready: false, source: 'unknown' }` and the neutral metadata label is shown, which
-remains the honest text for a state where "which create is this?" is genuinely
-unknown.
diff --git a/.changeset/fieldrules-readonly-failopen-server-parity-3828.md b/.changeset/fieldrules-readonly-failopen-server-parity-3828.md
deleted file mode 100644
index 192ca020dc..0000000000
--- a/.changeset/fieldrules-readonly-failopen-server-parity-3828.md
+++ /dev/null
@@ -1,34 +0,0 @@
----
----
-
-Comment-only change, no behaviour and no authoring-surface change (objectui#3828).
-
-The module head of `packages/core/src/evaluator/fieldRules.ts` described the
-client's readonly fail-open as "matching the server, which logs and allows the
-change through". That was true when it was written and has not been true for one
-whole fault class since objectstack#4889: a `readonlyWhen` predicate that faults
-because it names a scope ROOT the write never bound (`parent.status == 'paid'`
-with no master-detail header in hand) is fail-CLOSED on the server —
-`isReadonlyWhenLocked` warns and returns TRUE (LOCKED), and
-`stripReadonlyWhenFields` / `stripReadonlyWhenFieldsMulti` then delete that key
-from the UPDATE payload. The client, correctly, keeps the same fault fail-OPEN.
-
-So the two ends point in OPPOSITE directions for that class, and the comment
-described them as agreeing — which points a reader the wrong way on the one
-symptom the divergence produces: the form renders the field editable, the save
-reports success, and the value silently never lands. The narrowed text names the
-divergence, cites the framework's ADR-0057 D10 (server enforces, client is
-courtesy) as the reason the client does NOT follow the server here, and tells the
-caller which end to debug (the server's `treating the field as LOCKED` warning
-and the write response's `droppedFields`, not the client predicate).
-
-The `requiredWhen` half stays as it was, re-verified accurate: objectstack#4977
-bound the `parent` scope for those predicates and deliberately kept the fail-open
-semantics, so an unevaluable requirement is skipped on both ends. Field-level
-`visibleWhen` likewise — the server does not evaluate it at all. The "log and
-allow" quote further down the docblock is now marked as the GENERIC-fault
-message, so the narrowing is not undone two paragraphs later.
-
-No package is declared because nothing published changed: the diff is a docblock
-only, every line of code untouched, and `packages/core/src/evaluator`'s tests keep
-their count byte for byte (289 passed before, 289 passed after).
diff --git a/.changeset/fields-catalog-form-hosted-3910.md b/.changeset/fields-catalog-form-hosted-3910.md
deleted file mode 100644
index 90fa635b38..0000000000
--- a/.changeset/fields-catalog-form-hosted-3910.md
+++ /dev/null
@@ -1,16 +0,0 @@
----
-"@object-ui/fields": minor
----
-
-fields: remove the docs-demo registration path (`registerFields` + `createFieldRenderer`), and host the docs field examples in a real form
-
-**Breaking (shipped as `minor` per AGENTS.md §版本号策略 — objectui's major tracks `@objectstack`, so the repo's own breaking changes are `minor` with the break spelled out here):** two public exports are removed from `@object-ui/fields`:
-
-- `registerFields()` — registered every widget under the same `field:<type>` keys as `registerAllFields()`, but wrapped in a demo-only renderer. Two paths writing the same registry keys meant whoever ran LAST won it for every consumer sharing the registry.
-- `createFieldRenderer()` — that wrapper. It synthesized a `label`, a description, and a local `useState`/`onChange` around a widget.
-
-**Migration:** there is nothing to migrate for an application. `registerAllFields()` runs on import of `@object-ui/fields` and is the one registration seam (`registerField(type)` for a single type); no shipped application ever called the removed pair — the docs site was the only caller. Code that rendered a **bare field node** standalone (`{ type: 'currency', label: 'Amount' }`) and relied on the wrapper for label and value state must host the field in a form instead: `{ type: 'form', fields: [{ name: 'amount', label: 'Amount', type: 'currency' }] }`. Seed values through the form's `defaultValues`, not a field-level `value`.
-
-**Why the removal rather than a relocation** (ruling B of objectui#3798, confirmed by the maintainer; objectui#3308 is the origin, PR #3793 the safety net that first corrected the misleading `@deprecated` note): the wrapper existed only so the documentation could render a bare field node as a labelled, editable input. No application produces that rendering — on the live path a bare field node has no host for its label or its value. So the field docs, which are a first-hand transcription source for AI authors, were teaching a shape that does not work, and an author copying it got a node with neither label nor `onChange`. Relocating the wrapper into the docs site would have preserved that divergence under a new owner. Hosting the examples in a real form removes the reason for the wrapper to exist: the form renderer already owns label and value state, so the docs can only show what an application actually renders.
-
-The 74 bare-node examples under `examples/schema-catalog/src/schemas/fields-*` are now form-hosted (the other 2 already were). A field's `value` moved to the form's `defaultValues`, because the form renderer spreads react-hook-form's state after the schema props and a field-level `value` is therefore ignored — a catalog guard now pins that so a dead `value` cannot come back.
diff --git a/.changeset/fields-readonly-group-label-idref-3990.md b/.changeset/fields-readonly-group-label-idref-3990.md
deleted file mode 100644
index 25bff04cf5..0000000000
--- a/.changeset/fields-readonly-group-label-idref-3990.md
+++ /dev/null
@@ -1,57 +0,0 @@
----
-"@object-ui/fields": patch
----
-
-Group-labelled field widgets now consume the host label's IDREF in their readonly and zero-option states, so the visible label names something there too
-
-A field declared `labelling: 'group'` (objectui#3961) is named by IDREF: the form
-renderer publishes its `<FormLabel>`'s own `id`, drops the inert `for`, and hands
-the widget `aria-labelledby` plus the host control `id`. All seven such widgets
-consumed that pair on their editable surface only. A field-level
-`readonly: true`, and an option list that resolved to zero offered options, take
-early returns that render before the container doing the consuming — so the label
-published an id that no element in the document referenced.
-
-Measured on the previous `main`, one field per row in a real form, counting the
-elements that reference the host label's published id:
-
-```
-                             consumers  byLabelText  named group
-multiselect  readonly+value      0           0           0
-multiselect  readonly+empty      0           0           0
-multiselect  zeroOptions         0           0           0
-multiselect  editable            1           1           1
-```
-
-All seven measured identically in every readonly state; each is 1 now. The
-user-visible effect is the one objectui#3961 fixed for editable fields: the
-visible label was the accessible name of NOTHING, so a readonly "Tags" or
-"Shipping Address" was announced as loose text next to unattributed values. It is
-not a regression of #3961 or objectui#3975 — before them these same states
-emitted a `for` pointing at an id no element carried, which named nothing either.
-The shape changed from a dangling `for` to an unconsumed IDREF; the defect did
-not.
-
-Each readonly surface now carries exactly two keys — the host `id` and
-`aria-labelledby` — plus the `role="group"` that makes them meaningful, in one
-shared spelling (`toHostGroupProps`). The narrow pair is deliberate: a readonly
-display has no focusable control, so `aria-describedby` / `aria-required` /
-`disabled` / the focus handlers have nothing to announce on, and `name` on a
-`div` is exactly the DOM leak objectui#3291 sweeps for.
-
-Two widgets answer with a different role than they do while editable, because
-they render a different surface: `radio` (editable `radiogroup`) shows the chosen
-option's label as text with no radios in it, and `file` (editable `button`, the
-dropzone) shows file names with no dropzone. `role="group"` is also what the
-shared "no options available" box now answers with for `checkboxes` / `radio` /
-`multiselect`; the single `select` is not group-labelled, keeps its working
-`for`, and that box emits nothing new for it.
-
-Standalone rendering is untouched. The grid's inline cell editor and bare SDUI
-nodes hand down neither key, so nothing is emitted and the markup stays
-byte-identical — including the `EmptyValue` placeholder, which keeps its own
-`aria-label` and gains no role. Hosted-and-empty, that placeholder is the whole
-readonly surface, so it carries the group props: its `aria-label` ("No value") is
-then outranked by `aria-labelledby` per accname, which is the intended outcome —
-on the `generic` role that span carries, an author name is prohibited and was
-never exposed, so the choice was between the field's name and no name.
diff --git a/.changeset/fields-style-css-build.md b/.changeset/fields-style-css-build.md
deleted file mode 100644
index f8e4ac618b..0000000000
--- a/.changeset/fields-style-css-build.md
+++ /dev/null
@@ -1,19 +0,0 @@
----
-'@object-ui/fields': minor
----
-
-Build and publish `@object-ui/fields/style.css` — the subpath the package has always declared and never shipped
-
-`packages/fields/package.json` has declared `"./style.css": "./dist/index.css"` for the package's entire life, while its build was `tsc && vite build` and the package contained no `.css` file for Vite to extract. **No published version up to and including 17.3.0 contains a stylesheet** — the `@object-ui/fields@17.3.0` tarball has zero `.css` files in it. The subpath did not merely render badly, it failed to resolve: a consumer writing the `@import '@object-ui/fields/style.css'` that the quick-start guide taught got a build error. This release is the first one where that import works, so it is a new capability rather than a repair of a working one, and no existing consumer can be relying on the old behaviour — an import that never resolved has no working callers.
-
-Removing the export was the cheaper option and was rejected on a measurement: fields' class surface is not a subset of what `@object-ui/components` publishes. 155 classes exist only here, and 17 of them (`hover:bg-accent/30`, `ring-destructive/50`, `bg-primary/20`, …) resolve `@theme` tokens declared in unpublished package source, so no consumer-side Tailwind configuration can generate them. Dropping the export would have made the field widgets permanently under-styled with no supported remedy.
-
-The new sheet is a **supplement, not a replacement** — it is compiled against the components theme and then has every rule that package's sheet already ships subtracted from it, so it is ~22 kB rather than another ~180 kB of near-duplicate CSS. Import it after the components sheet:
-
-```css
-@import 'tailwindcss';
-@import '@object-ui/components/style.css';
-@import '@object-ui/fields/style.css';
-```
-
-Also adds a workspace-wide guard (`scripts/__tests__/package-files-exist.test.ts`) that fails when any package exports a subpath its published tarball cannot contain, so a stylesheet export with nothing building it cannot recur silently.
diff --git a/.changeset/filter-operator-parity-discrimination-3641.md b/.changeset/filter-operator-parity-discrimination-3641.md
deleted file mode 100644
index 8e7920d477..0000000000
--- a/.changeset/filter-operator-parity-discrimination-3641.md
+++ /dev/null
@@ -1,42 +0,0 @@
----
----
-
-Test-only change, no behaviour and no authoring-surface change (objectui#3641).
-
-Two filter-operator parity tests had lost their discriminating power to upstream
-vocabulary growth. Both rested on the same pivot — is this operator a member of
-`VALID_AST_OPERATORS`? — and that set is derived upstream from `AST_OPERATOR_MAP`
-(`new Set(Object.keys(...))`). It grew until it spelled all 19 canonical
-`VIEW_FILTER_OPERATORS` verbatim, `before` and `after` among them, which are the
-exact pair whose missing bridge entries caused the silent full-table read these
-tests were written for (objectstack#3948). Measured on the workspace's resolved
-`@objectstack/spec@17.0.0-rc.5`: 19 view operators, 51 AST operators, 0 view
-operators absent from the AST set.
-
-With that overlap complete, both guards were satisfiable by doing nothing:
-
-- `packages/plugin-list` — `mapOperator` degraded to the identity function kept
-  every assertion in the file green, because each view spelling is itself
-  AST-valid.
-- `packages/data-objectstack` — the coverage sweep mirrored production's
-  `?? op` tail, so a missing row fell back to the raw view spelling, which is now
-  always AST-valid. Emptying `FILTER_OPERATOR_ALIASES` entirely left it green —
-  precisely what that file's own header warns is "not a validation failure, it is
-  an unfiltered query".
-
-Re-anchored on pivots that vocabulary growth cannot cancel. plugin-list now pins
-`mapOperator`'s **output** per canonical view operator against an explicit
-19-row table read off the switch in `ListView.tsx` (not captured from its output,
-which would fossilise a bug), with a totality ratchet failing in both directions
-when the pinned rows and the spec vocabulary stop lining up — so a spec addition
-lands red instead of as quiet slack, and so does a retirement (#3628 / #3601, the
-mirror image). data-objectstack asserts the mapping row **exists**, with no
-fallback. The membership and `isFilterAST()` sweeps are kept as a secondary
-check: they still name why a wrong target matters, they are just no longer what
-gives the files their teeth. The stale header claim that "8 of the 19 canonical
-view operators are absent from the AST set" is replaced with what the guarantee
-now rests on, stated without any count of the overlap — a hand-written number
-beside a vocabulary that moves is what rotted here in the first place.
-
-No production code changed: `mapOperator` and `FILTER_OPERATOR_ALIASES` are byte
-for byte as they were on `main`.
diff --git a/.changeset/forward-bodyshape-os6938.md b/.changeset/forward-bodyshape-os6938.md
deleted file mode 100644
index da9998066f..0000000000
--- a/.changeset/forward-bodyshape-os6938.md
+++ /dev/null
@@ -1,30 +0,0 @@
----
-'@object-ui/components': patch
-'@object-ui/core': patch
-'@object-ui/types': patch
----
-
-fix(actions): forward `bodyShape` end-to-end so a declared body wrap is honoured
-
-Sibling of the `bodyExtra` fix, same failure shape one key over. `bodyShape` is
-the spec's body-WRAPPING declaration for a `type: 'api'` action — `'flat'` (the
-default) or `{ wrap: key }` to nest the collected params under `key`, the shape
-better-auth's `organization/update` needs. The console `apiHandler` read it
-unconditionally while **no** action renderer forwarded it, so an author who
-declared `bodyShape: { wrap: 'data' }` on an `action:button` / `:group` / `:icon`
-/ `:menu` action got a FLAT body on the wire: the endpoint received the params at
-the top level, and the declaration read as honoured because it parsed and
-published.
-
-The four declared-action renderers now forward the key, and `ActionSchema`
-declares it (typed by derivation from the spec, so the union cannot drift).
-`ActionRunner.executeAPI` — the fallback path taken when no host registered an
-`api` handler — now reads it too, closing a second asymmetry in which the same
-action changed body shape depending on which host executed it. The wrap covers
-the collected params only; `bodyExtra` and other top-level keys stay flat, which
-is the spec's own wording for the key and what both console read-sites already
-did.
-
-`element:button` deliberately does **not** forward it: its whitelist mirrors
-spec's `InlineActionSchema` pick list field for field, and that pick list does
-not include `bodyShape` — it is not inline vocabulary.
diff --git a/.changeset/grid-datetime-time-columns.md b/.changeset/grid-datetime-time-columns.md
deleted file mode 100644
index eca9172f58..0000000000
--- a/.changeset/grid-datetime-time-columns.md
+++ /dev/null
@@ -1,18 +0,0 @@
----
-"@object-ui/fields": minor
-"@object-ui/plugin-form": minor
----
-
-fix(fields,plugin-form): stop the inline child grid from collapsing `datetime`/`time` columns onto the `date` control
-
-`deriveMasterDetail`'s `fieldTypeToColumnType` mapped `date`, `datetime` and `time` onto the single `date` grid column type, and `GridField` renders that as `<input type="date">`. The consequence was not cosmetic: that control emits a bare `YYYY-MM-DD` on change, so a user who merely re-picked the **day** of a `datetime` cell silently wrote the record's time component out of existence — a `14:30` became midnight with no warning and no undo.
-
-`GridColumn['type']` now carries `'datetime'` and `'time'` alongside `'date'`, and each renders its own control with its own read/write adapter:
-
-- `datetime` → `<input type="datetime-local">`, read through `toDateTimeInputValue` and written back through `fromDateTimeInputValue`, so the stored shape stays ISO-8601 and read and write share one basis (the contract `DateTimeField` already follows, objectui#3127).
-- `time` → `<input type="time">`, round-tripping the stored zone-less `HH:mm[:ss]` verbatim.
-- `date` → unchanged.
-
-The read-only surfaces are fixed with it. `displayText()` and the read-only table both fell through to `String(value)` and printed the raw stored ISO on screen (`2026-06-17T00:00:00.000Z`); each temporal type now formats as itself — a day for `date`, day + local time for `datetime`, the wall clock for `time`. That could not be fixed before the type collapse was undone, because with one column type the renderer had no way to know which of the two to show.
-
-Authors writing explicit grid `columns` can now declare `type: 'datetime'` / `type: 'time'`; previously those spellings were not part of the exported union.
diff --git a/.changeset/grid-filter-input-spelling-4041.md b/.changeset/grid-filter-input-spelling-4041.md
deleted file mode 100644
index 4572265ed5..0000000000
--- a/.changeset/grid-filter-input-spelling-4041.md
+++ /dev/null
@@ -1,54 +0,0 @@
----
-"@object-ui/plugin-grid": patch
----
-
-`object-grid` publishes the filter key it actually reads: `filter`, singular (objectui#4041)
-
-The registration declared plural `filters` while `ObjectGrid` reads singular
-`schema.filter`, and `schema.filters` had **zero** read points anywhere in the
-renderer. Both halves of that mismatch were silent, in opposite directions:
-
-- An author following the published vocabulary wrote `filters: [...]`. The save
-  gate accepted it — `sdui-parser/src/validate.ts` walks a node's props against
-  the block's `inputs`, and `filters` was there — the renderer never read it, and
-  the grid answered with **the whole table**. No error at authoring time, none at
-  runtime, and a wider answer is not visibly wrong.
-- The spelling that actually worked, `filter`, was undeclared, so writing it was
-  reported as `unknown-prop`.
-
-Published word and runtime read pointed at opposite keys, on a shipped authoring
-surface. `list-view` — the sibling block, same family — has always declared the
-singular and read the singular.
-
-**The plural is removed, not taught to the renderer** (maintainer ruling
-2026-08-10, option A). It has no read point on any ref, so no working grid can
-depend on it: this deletes a key with no users rather than a contract. Teaching
-the renderer to read `filters` too was the rejected alternative — it would have
-hardened a misspelling into a second de-facto contract for the same concept.
-
-`patch` rather than `minor`/`major` on that same fact. The removed key never
-reached the query on any released version, so nothing that worked stops working;
-what changes is that a filter written under the published name now takes effect.
-
-**The read point now lowers through `toFilterNode`**, which is what makes the
-newly-reachable key honest rather than merely reachable. Until now the only value
-that could arrive at `schema.filter` was an ObjectQL AST synthesized by
-`ElementDataSourceGate`, and copying that onto `$filter` verbatim was correct. An
-author writes the spec's view vocabulary instead — `ViewFilterRule[]`,
-`[{ field, operator, value }]` — and that shape byte-copied onto `$filter` is
-refused on the wire: `isFilterAST` is false for an array of objects and the data
-API answers `400 INVALID_FILTER` (measured against a real backend in
-objectui#3431). Declaring the key without this hop would have traded a silent
-wrong answer for a guaranteed failure, which is not a fix. `toFilterNode` is the
-repo's single lowering hop before the wire and every other consumer on this chain
-already went through it — `plugin-list`'s `buildEffectiveFilter`, `plugin-view`'s
-`ObjectView`, `plugin-detail`'s `RelatedList`; this read point was the last one
-that did not.
-
-Two behaviour changes ride along at that read point, both narrow and both toward
-the shared sink's documented contract: a MongoDB-style object `filter` is now
-converted instead of silently dropped (the old `Array.isArray` guard read false
-for it, and the grid returned every record — the same defect `buildEffectiveFilter`
-fixed one package over), and a declared-but-empty `filter: []` now skips `$filter`
-rather than sending an empty one. The fetch and the server-side export read the
-same lowered value, so the downloaded file cannot disagree with the screen.
diff --git a/.changeset/grid-import-saved-mapping-i18n-3920.md b/.changeset/grid-import-saved-mapping-i18n-3920.md
deleted file mode 100644
index 36995b16aa..0000000000
--- a/.changeset/grid-import-saved-mapping-i18n-3920.md
+++ /dev/null
@@ -1,61 +0,0 @@
----
-"@object-ui/i18n": patch
----
-
-`grid.import` saved-mapping copy is now translated in ko / de / fr / es / pt / ru / ar instead of served as English
-
-Five keys — `grid.import.savedMapping`, `chooseSavedMapping`, `manualMapping`,
-`savedMappingHint` and `savedMappingPreviewNote` — were **byte-identical to `en`**
-in seven of the nine non-`en` packs, 35 values in all. Only zh and ja had been
-translated, and two of the five are multi-clause explanatory sentences rather
-than placeholders or proper nouns, so this was not a deliberately untranslated
-term: a German, French, Spanish, Portuguese, Russian, Korean or Arabic user
-picking a saved mapping in the import wizard read English.
-
-None of the three i18n gates could see it. `all-locales-key-parity` compares key
-sets and placeholder shapes, so English passed perfectly; the call-site gate only
-asks whether a key resolves; `check-i18n-en-drift.mjs` fires on an `en` **value
-change** and these keys arrived in the packs already English, so no drift event
-ever existed. objectui#3920 also proposed a general "no non-`en` value may be
-byte-equal to `en`" gate; that is deliberately not part of this change, because
-values like `auth.*.emailPlaceholder` (`name@example.com`),
-`fields.image.counter` (`{{current}} / {{total}}`) and
-`grid.import.templateFileName` are byte-equal across packs correctly, and
-objectui#3880 records the other face of the family. The five keys are pinned by
-name instead.
-
-Each translation reuses vocabulary its own pack already ships rather than
-inventing a second word for the same concept: `stepMapping` for "mapping"
-(Zuordnung / Correspondance / Asignación / Mapeamento / Сопоставление / تعيين /
-매핑), `legacyFallbackNotice` for "type coercion" (Typkonvertierung / conversion
-de type / conversión de tipos / conversão de tipos / приведение типов / تحويل
-الأنواع / 형 변환), `view.readonlyTooltip` for "read-only", and `validateHint`
-for "on the server". `es` follows the usted ruling objectui#3844 measured for
-this pack; `pt` is the pack's own pt-BR (mapeamento / salvo / no servidor);
-`ru` keeps its ё; `fr` keeps the straight apostrophe and the space before colon
-and semicolon; `ar` punctuates with U+060C and U+061B; `ko` uses the 은(는) /
-이(가) spelling its `fields.file.exceedsMaxSize` already uses for a placeholder
-whose particle cannot be resolved at authoring time.
-
-The quote around `{{name}}` follows each pack's measured majority for wrapping a
-placeholder — de `„…“` (38 spans against 3 ASCII), fr `« … »` with an ASCII
-space (25 against 18), ru `«…»` (23 against 18), and ASCII `"…"` for ko (38:0),
-pt (39:0), es (22:19) and ar (27:15). The card cited
-`residue-namespaces-3546.test.tsx` as pinning "the rest ASCII", but that line
-pins the `empty.*` family only and its own comment scopes the rule to "the
-sibling value in the SAME pack"; `grid.import` has no other quoted span, so the
-census one ring out decides.
-
-Germanising the two `de` sentences also closes the 45/47 gap
-`de-quote-pairing-3876.test.ts` documented: that pack's census moves from
-`„` 45 / `“` 47 / `”` 2 to `„` 47 / `“` 47 / `”` 0, exactly as that file's header
-predicted, and its `count(“) === count(„) + count(”)` identity still holds. The
-three literal counts in it were updated and the two keys are now pinned by name
-there, so `rdqKeys === []` cannot become an assertion that passes because nothing
-is produced.
-
-`en`, `zh` and `ja` are untouched, and `grid.import.transform` — the sixth key in
-the same block, English in the same seven packs, and the third column header of
-the very table this hint sits above — is deliberately left alone, filed as
-objectui#3938 and pinned as still-English so the number cannot drift while that
-issue waits its turn.
diff --git a/.changeset/grid-import-transform-i18n-3938.md b/.changeset/grid-import-transform-i18n-3938.md
deleted file mode 100644
index 7e1a30ee51..0000000000
--- a/.changeset/grid-import-transform-i18n-3938.md
+++ /dev/null
@@ -1,47 +0,0 @@
----
-"@object-ui/i18n": patch
----
-
-`grid.import.transform` is now translated in ko / de / fr / es / pt / ru / ar instead of served as English
-
-The third column header of the import wizard's saved-mapping summary was
-**byte-identical to `en`** — the literal string `Transform` — in seven of the
-nine non-`en` packs. zh (`转换`) and ja (`変換`) had translated it, which is what
-rules out the "deliberately untranslated term" reading; this is the sixth key of
-the same six-line block objectui#3920 / PR #3936 fixed the other five of, and it
-was left out of that card only to keep its 5-keys / 35-values census verifiable.
-
-| pack | before | after | the pack's own anchor |
-|------|--------|-------|----------------------|
-| ko | `Transform` | `변환` | `savedMappingHint` "이름 변경 + 변환 + 형 변환" |
-| de | `Transform` | `Transformation` | `savedMappingHint` "Umbenennung + Transformationen + Typkonvertierung" |
-| fr | `Transform` | `Transformation` | `savedMappingHint` "le renommage + les transformations + la conversion de type" |
-| es | `Transform` | `Transformación` | `savedMappingHint` "el cambio de nombre + las transformaciones + la conversión de tipos" |
-| pt | `Transform` | `Transformação` | `savedMappingHint` "renomeação + transformações + conversão de tipos" |
-| ru | `Transform` | `Преобразование` | `savedMappingHint` "переименование + преобразования + приведение типов" |
-| ar | `Transform` | `التحويل` | `savedMappingHint` "إعادة التسمية + التحويلات + تحويل الأنواع" |
-
-Each value is the **singular of the word the pack already uses** for `en`'s
-plural "transforms" in `grid.import.savedMappingHint` — the sentence
-`SavedMappingSummary` renders directly above this header. That is the anchor
-rather than `legacyFallbackNotice`'s term, because `en`'s own sentence lists
-"transforms" and "type coercion" as two different server-side operations and
-`legacyFallbackNotice` is about the second: reusing de "Typkonvertierung", ko
-"형 변환" or ar "تحويل الأنواع" for this header would name the wrong operation.
-
-Why it was worth a card of its own rather than waiting for a general gate: this
-value is not a hidden string. It is the third `TableHead` of
-`SavedMappingSummary`, sitting in one row with `csvColumn` and `mapsTo`, which
-were always translated — so a German user read `Spalte` / `Zugeordnet zu` /
-`Transform`, two languages in a single header row, directly under the German
-hint PR #3936 had just landed. Before that PR the whole panel was English and
-therefore at least self-consistent.
-
-The three i18n gates are value-blind here exactly as they were for
-objectui#3920: `all-locales-key-parity` compares key sets and placeholder shapes
-(the key was present with no placeholder, so English passed perfectly), the
-call-site gate only asks whether a key resolves, and `check-i18n-en-drift.mjs`
-fires on an `en` **value change** — this value entered the seven packs already
-English, so no drift event ever existed. `en`, zh and ja are untouched, and the
-pin PR #3936 left in `gridImportSavedMapping-i18n-3920.test.ts` asserting these
-seven were "still English" has been replaced by the translated pin it asked for.
diff --git a/.changeset/header-action-predicates-speak-cel-3521.md b/.changeset/header-action-predicates-speak-cel-3521.md
deleted file mode 100644
index 5d28cdeeb4..0000000000
--- a/.changeset/header-action-predicates-speak-cel-3521.md
+++ /dev/null
@@ -1,32 +0,0 @@
----
-"@object-ui/components": patch
----
-
-Record page header action predicates now speak CEL, like every other action surface
-
-`visible` / `hidden` / `disabled` on a `page:header` action were handed to
-ObjectUI's legacy JS evaluator, while the row kebab, the selection bar and
-conditional formatting have evaluated the identical metadata on the canonical
-CEL engine since objectui#1584 / ADR-0058. Every construct that exists only in
-CEL therefore worked in a list row and threw on the record page — where the
-throw fail-closed hid the button, leaving nothing on screen to notice:
-
-- method calls — `record.f_tags.size() > 0`, `record.f_textarea.contains("x")`
-- the `in` operator — `'"red" in record.f_multiselect'` (a parse error)
-- stdlib functions — `record.f_date < today()` (`today is not a function`)
-
-Both header evaluation sites now go through `evalRowPredicate`: the same entry,
-the same bindings (`record.*` + bare field names + `data.*` + the host scope,
-with relations bound as the stored foreign key), and the same fail-closed +
-warn-once semantics as the row surfaces. One predicate on one record now reaches
-the same show/hide verdict in the row menu, the selection bar and the record
-header.
-
-Legacy-dialect strings are unaffected: `${…}`, `===`/`!==`, `?.`, `??` and
-JS-only methods such as `.includes()` still route to the legacy evaluator (with
-its existing one-time deprecation warning), so authored pages keep working. A
-`${…}` template predicate, which the header previously could not evaluate at
-all, now resolves through that fallback instead of hiding the button. A
-predicate that genuinely cannot be evaluated still hides its action, and now
-reports itself once in the same words the other surfaces use, naming the
-surface, the action and the predicate.
diff --git a/.changeset/highlights-readonly-authoring-surface-3407.md b/.changeset/highlights-readonly-authoring-surface-3407.md
deleted file mode 100644
index d4fb034540..0000000000
--- a/.changeset/highlights-readonly-authoring-surface-3407.md
+++ /dev/null
@@ -1,35 +0,0 @@
----
-"@object-ui/plugin-detail": patch
----
-
-`record:highlights` publishes the `readonly` entry key, so an AI author can discover it from the manifest
-
-`readonly` on a `fields[]` entry has been enforced for a while — the renderer copies it
-through normalization and `HeaderHighlight`'s editability gate refuses inline editing on a
-chip carrying it (objectstack#5077) — and `@objectstack/spec` declares it on
-`RecordHighlightsField` (objectstack#5176 / PR #5607). The block's own published authoring
-surface never mentioned it: the `fields` input still spelled the entry shape
-`{name,label?,icon?,type?}`, and since the registry `inputs` are what
-`gen-manifest.ts` serializes into `sdui.manifest.json`, an author reading the manifest was
-told the key did not exist. The `fields` description now states the full entry shape and
-what `readonly` does, which is the discoverability the manifest is for.
-
-`readonly` is documented **inside** the `fields` description rather than declared as an
-input of its own, because that is where the contract puts it. The spec's
-`RecordHighlightsProps` has exactly three top-level keys (`fields`, `layout`, `aria`) and
-carries `readonly` per ENTRY. A top-level `{ name: 'readonly', type: 'boolean' }` input
-would publish a key the platform silently discards: the generated `sdui.manifest.json` and
-`sdui-intrinsics.d.ts` would advertise a `readonly` prop, the manifest gate validates
-top-level props only and would raise no diagnostic, `RecordHighlightsProps` is a plain
-`z.object` so the unknown key is stripped on parse without error, and the renderer — which
-reads `field.readonly` per entry — would never see it. An author who trusted that surface
-would be left with the machine-owned column still hand-editable and no diagnostic anywhere
-explaining why. `ComponentInput` is flat by design, so an array-of-objects input publishes
-its member keys in prose, as `record:path.stages` and `record:alert.action` already do.
-
-A new spec-parity test derives both directions from `@objectstack/spec` at runtime instead
-of restating today's key list: every key of `RecordHighlightsField`'s object arm must be
-named in the `fields` description, and the block must declare no top-level input that
-`RecordHighlightsProps` does not accept. Nothing previously cross-checked the registry
-`inputs` against the spec, so both drift directions were silent. No runtime behaviour
-changes.
diff --git a/.changeset/hitl-decision-outcomes-spec-derived-3783.md b/.changeset/hitl-decision-outcomes-spec-derived-3783.md
deleted file mode 100644
index 827aa22d15..0000000000
--- a/.changeset/hitl-decision-outcomes-spec-derived-3783.md
+++ /dev/null
@@ -1,43 +0,0 @@
----
-"@object-ui/plugin-chatbot": minor
----
-
-`ApproveOutcome` / `RejectOutcome` are now derived from `@objectstack/spec`
-instead of hand-transcribed (objectui#3783). Same failure class #3220 cleared
-from the same file for `PendingActionRow` / `PendingActionStatus` — but this pair
-wore local names rather than spec names, so `check-spec-symbol-derivation.mjs`,
-which fires on a spec export name being occupied, had no handle on it. A renamed
-hand copy is invisible to a name-based guard by construction.
-
-Both types now re-export the spec's decision responses
-(`ApproveAiPendingActionResponse` / `RejectAiPendingActionResponse` from
-`@objectstack/spec/api` — the same schemas `@objectstack/client`'s
-`ai.pendingActions.approve()` / `.reject()` type their returns with). The public
-export names do not change. The shapes do, in three ways:
-
-- **`ApproveOutcome` no longer declares `id`.** The approve response has never
-  carried one — `id` is on the *reject* response. This was the one drift that
-  was not dormant: `useHitlInChat`'s public `onDecided` callback promised
-  consumers `id: string` and handed them `undefined` at runtime, with nothing
-  in the compiler to say so. **If you read `outcome.id` after an approve, that
-  read was already `undefined` and now fails to compile** — take the id from
-  `ContinueContext.pendingActionId` or from the row you decided on.
-- **`status` is closed.** `'executed' | 'failed' | string` and
-  `'rejected' | string` were both just `string`: a union with `string` absorbs
-  the literals, so neither annotation carried any information. They are now
-  `'executed' | 'failed'` and `'rejected'`.
-- **The `[k: string]: unknown` index signature on `ApproveOutcome` is gone.** The
-  objectstack#4075 mechanism: with it, any structural comparison against the
-  spec answers "identical" however far the copy has drifted, so a parity test
-  bolted onto the old type would have been green from its first day.
-
-**Breaking at the type level for importers of `@object-ui/plugin-chatbot`** —
-narrowing a published type is a break even when the old type was lying, which is
-why it is spelled out here. Shipped as `minor` per AGENTS.md §版本号策略: the
-family's `major` tracks `@objectstack`'s, and objectui's own breaking changes go
-out as `minor` with the break named in the changeset.
-
-Runtime behaviour is unchanged — including the hook's decision handling for a
-status outside the spec vocabulary, and the locally synthesized failure envelope
-on a non-2xx, both now pinned by tests. The consumer-side tolerances that remain
-in `useHitlInChat` are recorded in objectui#3790 for a maintainer decision.
diff --git a/.changeset/home-administration-group-3609.md b/.changeset/home-administration-group-3609.md
deleted file mode 100644
index 13d892160c..0000000000
--- a/.changeset/home-administration-group-3609.md
+++ /dev/null
@@ -1,9 +0,0 @@
----
-'@object-ui/app-shell': patch
----
-
-Render the `/home` Administration group as a real group, so its nine system-administration entries are reachable (objectui#3609).
-
-`UnifiedSidebar` picks its renderer with one ternary on `context === 'app' && activeApp`. Only the app arm rendered `NavigationRenderer`, the component that descends into `type: 'group'` children; the home arm hand-rolled `homeNavigation.map(item => <Link to={item.url || '/home'}>)` with no recursion. Since home navigation is the only navigation that groups, the whole nine-entry Administration cluster collapsed into one row — and a group carries no `url` of its own, so `|| '/home'` pointed that row back at the page the user was already on. System Settings, Applications, App Marketplace, Object Manager, Datasources, Users, Organizations, Roles and Configuration never reached the DOM. `resolveLandingPath([])` sends a fresh-deployment admin to `/home`, and `HomePage` had deliberately dropped its own System card on the grounds that the sidebar already carried those entries, so the net effect was an admin with no route into system administration at all.
-
-The home arm now renders through the same `NavigationRenderer` as the app arm rather than growing a second renderer that recurses: the group becomes a Collapsible and every entry passes the same item-level `visible` / `requiredPermissions` / runtime-capability guards. Hrefs are unchanged — home entries are all `type: 'url'`, whose resolution is verbatim. The group states `expanded: true` so it opens by default: the renderer's unauthored default collapses groups of eight or more children, a heuristic for one long section among many, whereas on `/home` this group *is* the navigation. Pinning and drag-reorder stay off in the home context, where their persistence key resolves to the first app rather than to home. Non-admins are unaffected — the cluster is still built behind the `isWorkspaceAdmin` gate and is absent from their item tree.
diff --git a/.changeset/host-redirect-canonical-metadata-3639.md b/.changeset/host-redirect-canonical-metadata-3639.md
deleted file mode 100644
index 88615c1c75..0000000000
--- a/.changeset/host-redirect-canonical-metadata-3639.md
+++ /dev/null
@@ -1,12 +0,0 @@
----
-'@object-ui/console': patch
-'@object-ui/app-shell': patch
----
-
-Send the console host's legacy URL redirects straight to the canonical metadata-admin routes instead of routing them through the deprecated `component/metadata/resource` alias (objectui#3639).
-
-`apps/console`'s `ObjectRedirect` and `MetadataRedirect` rewrote `system/objects[/:name]` and `system/metadata[/:type[/:name]]` onto `…/component/metadata/resource[/:name]?type=:type`. app-shell declares that spelling as a legacy *alias*, not a page: its route element is `LegacyMetadataRedirect`, which immediately navigates on to `…/metadata/:type[/:name]`. Every one of those URLs therefore took two `<Navigate>` hops (plus a re-render) to reach a destination the host could name directly — and it was this indirection that carried `sys-objects` into the zero-app blank screen fixed in objectui#3610, since the alias was the leg that branch did not recognise.
-
-Both redirects now construct `…/metadata/:type[/:name]` (and `…/metadata` for the typeless directory arm) themselves. The endpoints are unchanged, byte for byte, including the alias hop's own percent-encoding of `:type` and its verbatim pass-through of `:name`; only the intermediate hop is gone. The alias routes stay declared exactly as they were — bookmarks, external links and the setup left-nav still arrive on them and are still forwarded — this change only stops the console feeding its own traffic through them.
-
-Also corrects four docblocks that described the alias as "the engine route", in `apps/console`'s two redirects and in app-shell's `datasource` resource registration and page. That wording is not merely stale: the objectui#3610 dispatch read this chain and concluded `component/metadata/resource` was the canonical spelling, which is the exact opposite of what the route table says.
diff --git a/.changeset/inbox-bell-badge-breakdown-os7233.md b/.changeset/inbox-bell-badge-breakdown-os7233.md
deleted file mode 100644
index 4037f6dea5..0000000000
--- a/.changeset/inbox-bell-badge-breakdown-os7233.md
+++ /dev/null
@@ -1,30 +0,0 @@
----
-"@object-ui/app-shell": patch
-"@object-ui/i18n": patch
----
-
-The inbox popover now spells out what the bell badge is made of
-
-The bell badge is `unread notification topics + pending approvals`, clamped to
-"9+" above nine. As one number it is unexplainable: objectstack#7213 measured
-Home's "pending approvals" card saying 8 while the bell said "9+", and read that
-as the two counts disagreeing — they never did, the bell was simply carrying a
-second addend the user could not see.
-
-The popover already tabs the two streams and puts a count pill on each tab, so
-the split was partly visible — but those pills clamp at "9+" too. A loaded
-console therefore showed three "9+"s that reconcile to nothing, which is why
-sectioning alone did not close this.
-
-A breakdown line under the popover header now states the exact, unclamped
-addends beside the exact total — `15 total · 12 notifications + 3 pending
-approvals`. The approvals half is the same `pendingApprovalsCount` the Home card
-and the Approvals Inbox tab read, so the number a user reconciles against is
-literally the one they see elsewhere.
-
-The badge formula, the counting APIs and the "9+" clamp on the badge itself are
-unchanged — this is a display fix. Three new keys
-(`notifications.badgeTotal` / `badgeNotifications` / `badgeApprovals`) land in
-all ten locale packs. They interpolate named placeholders (`{{total}}`,
-`{{unread}}`, `{{approvals}}`) rather than i18next's `{{count}}`, which would
-additionally drive plural-key resolution these packs carry no forms for.
diff --git a/.changeset/init-scaffold-registry-and-styles.md b/.changeset/init-scaffold-registry-and-styles.md
deleted file mode 100644
index e8b94ccd6c..0000000000
--- a/.changeset/init-scaffold-registry-and-styles.md
+++ /dev/null
@@ -1,11 +0,0 @@
----
-'@object-ui/cli': patch
----
-
-Fix `objectui init` scaffolding an app that renders neither components nor styles.
-
-The generated `src/App.tsx` imported only `SchemaRenderer` from `@object-ui/react`, which does not depend on `@object-ui/components` — and registration is a side effect of importing that package. The component registry was therefore empty in every scaffolded project, and each node of all three templates (`simple`, `form`, `dashboard`) rendered "Unknown component type". The manifest already declared `@object-ui/components`; it was declared and never imported. The generated `src/App.tsx` now performs the side-effect import.
-
-The generated `src/index.css` was a bare `@import 'tailwindcss';` and never loaded the library's published stylesheet, so the theme utilities the templates lean on had no tokens behind them. It now also does `@import '@object-ui/components/style.css';`, matching what the quick-start guide teaches hand-rolled consumers.
-
-`objectui init` is unchanged in every other respect: the same eleven files, byte for byte, apart from these two lines.
diff --git a/.changeset/inputs-reverse-parity-3808.md b/.changeset/inputs-reverse-parity-3808.md
deleted file mode 100644
index 05aafc1fdf..0000000000
--- a/.changeset/inputs-reverse-parity-3808.md
+++ /dev/null
@@ -1,53 +0,0 @@
----
-"@object-ui/plugin-detail": patch
-"@object-ui/components": patch
----
-
-Four spec keys the renderers already honoured are now discoverable from the published `inputs`
-
-`record:details.hideFields`, `record:related_list.relationshipValueField`,
-`record:related_list.add` and `element:text_input.defaultValue` were declared by
-`@objectstack/spec` and read by their renderers, while the registry `inputs` —
-the surface `gen-manifest.ts` serializes into `sdui.manifest.json` and
-`sdui-intrinsics.d.ts` — never mentioned them. Nothing anywhere reported the
-mismatch, and every layer that reads a manifest said the opposite of the
-runtime: the keys were in no designer panel and no generated `.d.ts`,
-`sdui-parser`'s prop walk returned `unknown-prop` for an author who wrote one,
-and the renderer honoured it regardless. That is objectui#3407's original
-complaint (`readonly` was enforced and honoured, the description just never said
-so) on four more keys.
-
-Each description is derived from what the renderer actually does, not from
-restating the spec's one-liner, because the two can differ and the published
-text is what an AI author reads:
-
-- `hideFields` documents bare field names only — the renderer tolerates
-  `{name}` / `{field}` entries but the spec is `z.array(z.string())` and rejects
-  them, so teaching that spelling would publish a dialect the contract refuses;
-- `relationshipValueField` publishes the renderer's `'id'` default and says that
-  the resolved value drives the list filter, the Add-picker link value and the
-  pre-filled create form together;
-- `add` publishes its member shape in prose (`ComponentInput` is flat and has no
-  member-shape slot) with each default taken from the renderer — including
-  `picker.labelField`, where the renderer defaults to `name` while the spec's
-  own wording says "the object title field". It also names `picker.filter` as a
-  KNOWN GAP rather than documenting it as a restriction: the spec declares it
-  and nothing reads it, so an author would otherwise believe their picker is
-  scoped when it offers every record (objectui#3831);
-- `defaultValue` distinguishes the two behaviours an author can get — seeding a
-  bound page variable once while it is still empty, versus the native
-  uncontrolled initial value with no variable bound.
-
-`element:text_input` is not in the public tier, so its gap was not in
-`sdui.manifest.json` at all — it was in the JSX-page compiler's prop whitelist,
-which `renderers/layout/page.tsx` builds from `getKnownTypes()` plus these same
-`inputs`, making the undeclared `defaultValue` a live `unknown-prop` warning.
-
-The repo-wide parity gate now runs in both directions over one covered set and
-one exemption discipline, so neither direction can be forgotten again the way
-the reverse half was after PR #3806. Nine spec keys stay deliberately
-unpublished, each with a written reason and a tracking issue: two the renderers
-do not read at all (objectui#3829), three retired upstream by ADR-0087
-tombstones, `page:tabs.type` (a carrier collision, objectstack#6776), two
-`targetVariable` declarative hints (objectui#3834), and
-`element:record_picker.filter` (objectui#3830).
diff --git a/.changeset/inspector-combo-field-label-3997.md b/.changeset/inspector-combo-field-label-3997.md
deleted file mode 100644
index a50a70cdc0..0000000000
--- a/.changeset/inspector-combo-field-label-3997.md
+++ /dev/null
@@ -1,19 +0,0 @@
----
-'@object-ui/app-shell': patch
----
-
-Name the `InspectorComboField` trigger: the visible label now owns it, and an anonymous combo no longer compiles (objectui#3997).
-
-This is the fourth inspector field atom with the shape PR #3996 fixed for the three in `_shared.tsx` — a `Label` rendered as a plain sibling of the control, with no `htmlFor`, no `id` and no `aria-label`. It lives in its own module, so it stayed broken after the other three were closed. The label and the `button[role=combobox]` were adjacent only visually: assistive tech announced an anonymous combobox with the field name floating above it as unowned text, `getByLabelText` could not reach it, and clicking the visible label did nothing. It renders at eighteen call sites across the object-field, dataset, dashboard-widget, app-nav and view-variant inspectors (lookup display/description fields, `lookupFilters` rows, summary aggregates, dataset dimensions and measures, nav targets), so it is on screen the moment any of those panels opens.
-
-The labelled branch closes the pair the same way the other atoms do: `React.useId()` mints the id inside the atom, `Label` gets the `htmlFor`, and the id lands on the trigger `Button` that `PopoverTrigger asChild` renders. Never on `Popover` — Radix's `Popover.Root` is a context provider that renders no DOM element, so an id handed to it is dropped silently and the `for` dangles, which is the objectui#3976 / #3994 mistake this repo has now paid for twice.
-
-`label` was optional, and the un-labelled branch was the same defect one notch worse: a combobox with no name at all. Five of the eighteen call sites had authored exactly that. Rather than adding a lenient fallback (synthesising a name from the placeholder would have produced "Select…" as the announced name), naming became a type-level requirement of exactly one of three channels:
-
-- `label` — the atom renders the visible label and owns the association. Unchanged for the thirteen call sites that already passed one.
-- `ariaLabel` — for repeated rows where no visible label exists and one would break the grid: an app-nav URL filter's `field = value` pair, a dataset's list of joined relationships, the dependent-lookup "add a field" picker.
-- `id` — for when an external `Label htmlFor` already owns the naming. `DashboardWidgetInspector` wraps its controls in a `Field` that renders `Label htmlFor={id}` and hands the same id to the control; every other field honoured it (`Input id`, `SelectTrigger id`) but the dataset combo could not, because the atom accepted no id. That `for` pointed at an id nothing carried — a dangling IDREF, worse than an unnamed control, because tooling reports an association that resolves to nothing.
-
-Zero channels and two channels are now both unauthorable: zero is anonymous, and two is the double-announcement failure objectui#3961/#3978 exists to avoid. Neither has a runtime symptom the component could detect and report — an unnamed combobox renders, lays out and commits values perfectly, and is wrong only for the users who cannot see it — so the check is compile-time or nothing. It is pinned in `InspectorComboField.naming.types.test.tsx`, listed in `tsconfig.typetests.json` so a compiler actually reads it.
-
-One new pair of strings (`engine.inspector.widget.filterBindingField`, en-US + zh-CN) names the per-filter binding combo in the dashboard widget inspector, which sits under a heading that captions its whole row rather than the combo alone.
diff --git a/.changeset/inspector-shared-field-labels-3994.md b/.changeset/inspector-shared-field-labels-3994.md
deleted file mode 100644
index ebfdbb3766..0000000000
--- a/.changeset/inspector-shared-field-labels-3994.md
+++ /dev/null
@@ -1,41 +0,0 @@
----
-"@object-ui/app-shell": patch
----
-
-Metadata-admin inspectors: the shared text / number / select field labels now name their control
-
-The three generic field atoms of every scoped inspector — `InspectorTextField`,
-`InspectorNumberField`, `InspectorSelectField` — rendered a `Label` as a plain sibling of
-their control, with no `htmlFor`, no `id` and no `aria-label` fallback. Label and control
-were adjacent only visually: assistive tech announced an anonymous "edit box" / "combobox"
-while the visible field name sat above it as unowned text, and clicking the label did
-nothing. Measured before the fix, `getByLabelText('Group')` — the same `for`→id chain a
-screen reader walks — found zero matches for all three.
-
-These atoms are consumed by 16 non-test modules (page-block, flow-node, report, dataset,
-permission and object-field inspectors, plus the object-group inspector in Studio design),
-so every inspector panel rendered nameless inputs the moment it opened.
-
-Each atom now mints its own id with `React.useId()` and closes the pair. The id is minted
-inside the atom rather than taken as a prop deliberately: these atoms render in loops over
-array items (`record:details.sections[i]`, `page:tabs.items[i]`) where every item repeats
-the same label, which is precisely where a caller-supplied id collides — and a collision is
-invisible, because both labels would still resolve, to the first control. `useId()` cannot
-collide by construction; per-instance uniqueness is pinned rather than assumed.
-
-For the select the id lands on `SelectTrigger`, never on `Select`: Radix's `Select.Root`
-renders no DOM element of its own, so an id handed to it is silently dropped and the
-label's `for` dangles — the same mechanism objectui#3976 fixed one directory over. The
-trigger renders the real `button[role=combobox]`, a labelable element, so one `for`/`id`
-pair names it with no second `aria-labelledby` channel. `disabled` stays on Root (single
-authority over trigger, items and the hidden native mirror) and a disabled select is still
-named.
-
-`InspectorCheckboxField` was already correct — it uses a wrapping `label`, a valid
-association that needs no id — and is untouched, serving as the positive control in the
-tests.
-
-Follow-on for test authors: `PageBlockInspector.sectionName.test.tsx` located its section
-name boxes by placeholder *because* `getByLabelText` could not reach them. That workaround
-is gone; the boxes are located by their label, and the `snake_case` placeholder convention
-keeps its own dedicated assertion.
diff --git a/.changeset/layout-inputs-declaration-3972.md b/.changeset/layout-inputs-declaration-3972.md
deleted file mode 100644
index bb81db34e0..0000000000
--- a/.changeset/layout-inputs-declaration-3972.md
+++ /dev/null
@@ -1,38 +0,0 @@
----
-"@object-ui/layout": patch
----
-
-`registerLayout()` 的 `inputs` 声明面与渲染器实现对齐 —— 校验器不再对正确写法报假诊断
-
-`inputs` 是**作者面**:`sdui-parser/src/validate.ts` 拿一个节点的顶层属性逐个比对
-`comp.inputs`,不在其中的报 `unknown-prop`,类型不符的报 `type-mismatch`;设计器面板、
-`sdui.manifest.json`、生成的 JSX 类型也都由它派生。所以声明面写错的代价不是"文档不全",
-而是**校验器对着能正常渲染的 schema 说谎**(objectui#3972,与 objectui#3900 同族、换到属性面)。
-
-两处修正,都是按渲染器**实际读点**审计出来的:
-
-- **`page-header` 补声明 `icon` 与 `actions`。** 两个键三面齐全:渲染器真读
-  (`PageHeader.tsx:117` 取参 `:224-226` 渲染 icon;`:119` 取参 `:192-196` 把 actions
-  委派给 `record:quick_actions`)、`@objectstack/spec/ui` 的 `PageHeaderProps` 声明、
-  `ManifestInputType` 表达得了(`string` / `array`)。`content/docs/layout/page-header.mdx`
-  的 Component Props 段落也把两者写成公开契约,而该文档页**唯一**的 live demo
-  (`layout-page-header/pageheader-with-actions`)就写着 `"icon": "users"` —— 于是仓内
-  自己的文档示例每次过 manifest 门都收到一条 `unknown-prop: page-header has no prop "icon"`。
-  `actions` 的类型与 canonical 的 `page:header` 逐字一致(`type: 'array'`),一个概念一个键
-  一种类型。
-- **`navigation-renderer` 的 `items` 由 `type: 'object'` 改为 `'array'`。**
-  `NavigationRendererProps.items` 是 `NavigationItem[]`(`NavigationRenderer.tsx:108`),
-  而 `checkType` 对 `'object'` 判 `typeof value === 'object' && !Array.isArray(value)`、
-  对 `'array'` 判 `Array.isArray`(`validate.ts:124-129`)—— 两者互斥。所以旧声明对这个
-  渲染器**唯一能渲染的形状**报 `type-mismatch ... expected an object`,而对真会让它崩的
-  对象形状一言不发。这不是 objectui#3832 的表达力问题:`ManifestInputType` 本来就有
-  `'array'`,只是声明写错了一个表达得了的类型。
-
-**刻意不声明**的键同样被钉住,因为"照抄 spec 的 shape"是这条修复最容易滑进去的反向缺陷:
-`breadcrumb`(spec 有、这个渲染器零读点 —— 声明它就是 objectui#3829 的缺陷方向)、
-`showBack` / `action` / `description`(渲染器读、spec 无此键 —— 声明任一个就是在开第二套
-方言,正是 objectui#3226 收窄要防的事)、`aria`(每个 block 都因同一理由省略的可访问性逃逸口)。
-
-渲染输出逐字节不变:渲染路径从不读 `inputs`。变化只在校验/设计器/清单这一侧,且两个方向
-都钉了 —— 正确写法放行的同时,`description` 这类刻意不声明的键仍报 `unknown-prop`、
-`items` 写成对象仍报 `type-mismatch`(诊断没有被弄哑)。
diff --git a/.changeset/layout-sideeffects-registration-3899.md b/.changeset/layout-sideeffects-registration-3899.md
deleted file mode 100644
index fc84e0a184..0000000000
--- a/.changeset/layout-sideeffects-registration-3899.md
+++ /dev/null
@@ -1,65 +0,0 @@
----
-"@object-ui/layout": patch
----
-
-`@object-ui/layout` no longer tells bundlers it has no side effects while registering components at load time (objectui#3899)
-
-The published manifest declared `"sideEffects": false` — a promise that no module
-in the package does anything on evaluation, so any module whose exports go unused
-may be dropped whole. But `src/index.ts` ends with a bare
-`try { registerLayout(); } catch {}`, and that call is the only thing that puts
-`page-header`, `page:card`, `app-shell`, `responsive-grid`,
-`navigation-renderer` and `app-schema-renderer` into the `ComponentRegistry`.
-
-Both statements cannot be true, and a bundler that believes the manifest is
-right to delete the registration. Measured with the repo's own bundler by
-building `import '@object-ui/layout';` — the side-effect-only import, i.e. the
-documented "import it to register" pattern:
-
-- `sideEffects: false` — the bundle is **0 bytes**. Zero registrations, exit
-  code 0, no warning.
-- after this change — the bundle keeps all six `ComponentRegistry.register`
-  calls.
-
-A dropped registration does not fail where it happened. It surfaces later as a
-red `Unknown component type` panel (OBJUI-001) on a fully green build, with
-nothing in the build log to connect the two. Nobody had been bitten yet only
-because every consumer today ALSO imports a named export, which forces the module
-to be evaluated regardless — coincidence, not design. objectui#3787 met the
-hazard and routed around it by calling `registerLayout()` explicitly.
-
-`sideEffects` is now the narrowest honest answer: an array naming the modules
-that actually register, rather than `true`, which would be honest but would hand
-the whole package to every bundler as unshakeable.
-
-```json
-"sideEffects": ["./dist/index.js", "./dist/index.umd.cjs", "./src/index.ts"]
-```
-
-All three are load-bearing, and the set is derived from the manifest rather than
-guessed:
-
-- `./dist/index.js` and `./dist/index.umd.cjs` are every JS file the manifest's
-  own entry fields point at (`module` / `main` / `exports` import+require). The
-  library build inlines everything into those two files, so there is no third
-  chunk to name.
-- `./src/index.ts` is not published (`files` ships `dist` only) but is bundled
-  for real: `apps/console` and `examples/console-starter` both alias the
-  specifier straight at `packages/layout/src`, and a bundler reads this same
-  manifest for those files. With only the published paths declared, the console's
-  alias shape still produced a 0-byte bundle.
-
-What deliberately did NOT change: the load-time `registerLayout()` itself.
-Replacing it with an explicit registration API is the opposite direction — it
-eliminates the side effect instead of declaring it, and it is breaking for any
-consumer relying on automatic registration. objectui#3899 leaves that call to the
-maintainer, and the two steps do not conflict: once the manifest tells the truth,
-the migration to explicit registration can happen whenever it is wanted.
-
-A new pin (`packages/layout/src/__tests__/side-effects-manifest.test.ts`) runs a
-real bundler build per entry form and asserts the registrations survive a
-side-effect-only import, with a `sideEffects: false` control per form asserting
-they are dropped — so the pin cannot pass because the bundler stopped shaking
-anything. The required set is derived from the manifest's own entry fields, so a
-renamed build output or a new `exports` subpath fails as a missing declaration
-instead of drifting silently.
diff --git a/.changeset/login-meta-401-noise-4042.md b/.changeset/login-meta-401-noise-4042.md
deleted file mode 100644
index c1a69158bf..0000000000
--- a/.changeset/login-meta-401-noise-4042.md
+++ /dev/null
@@ -1,67 +0,0 @@
----
-"@object-ui/app-shell": patch
-"@object-ui/data-objectstack": patch
----
-
-The console no longer reads `/meta/*` before it knows whether it has a session, and a failed request now says which request failed
-
-Opening a logged-out console painted ~30 red `HTTP request failed` lines before
-the login form was drawn. Two independent causes, fixed independently
-(objectui#4042).
-
-**1. Requests fired before the session was known.** `ConnectedShellInner` now
-withholds the metadata tree until `GET /auth/get-session` resolves, so
-`meta/object` / `meta/view` / `meta/app` are never issued blind. `useAuth()`
-outside an `AuthProvider` reports `isLoading: false`, so an embed with no auth
-provider is unaffected, and every protected route already sat behind an
-`AuthGuard` that resolves auth first — the signed-in data flow is unchanged.
-
-The console's landing route (`<Route path="/">`) was the actual entry point for
-the burst: it mounted `ConnectedShell` with no guard above it, so simply opening
-`/_console/` mounted the whole data layer as an anonymous visitor. It is now
-guarded, which also means an unauthenticated visitor reaches `/login` without a
-single doomed request. `examples/console-starter` had the same shape and got the
-same fix.
-
-**2. Two requests per type, per mount — not an unauthenticated artefact.**
-Consumers read metadata during the FIRST render (`useActionModal` reads
-`objects`, whose getter kicks `ensureType('object')` and `ensureType('view')`
-from the render phase), before any effect runs. `MetadataProvider`'s preview-mode
-effect then cleared the whole cache on mount, discarding those two entries while
-their requests were in flight; the next render found them `idle` and refetched
-both. The effect now skips its mount run — on mount the cache is empty and there
-was never anything to drop; it only ever meant something on a later
-`previewDrafts` change. That halved `meta/object` and `meta/view` on **every**
-mount, signed in included.
-
-A second duplicate only appeared once a read had failed: `entry.promise`
-collapses callers that arrive while a request is in flight, but callers arriving
-just after a failure each started a fresh attempt. A failed type now stays
-un-retried for ~1s, which collapses one mount's burst of callers into a single
-attempt. This is deliberately not the 5-minute `ttlMs` — later callers still
-retry on their own, and `refresh()` / `invalidate()` retry immediately and
-unconditionally, so no explicit recovery path changes.
-
-**3. `HTTP request failed` now identifies the request.** `@objectstack/client`
-reports every non-2xx as
-`logger.error("HTTP request failed", undefined, { method, url, status, error })`,
-and the console's logger forwarded that verbatim — so the identifying fields
-lived only in the third argument, and anything that flattens a console record to
-text rendered them `[object Object]` / `Object`. A screenful of failures could
-not tell you a single URL or status. The message string now carries them:
-
-```text
-HTTP request failed: GET /api/v1/meta/object -> 401 [UNAUTHORIZED]
-```
-
-The structured bag is still passed alongside for DevTools to expand — text for
-the flatteners, object for the inspectors, neither at the other's expense. The
-formatter is exported as `formatHttpFailureMessage`, and `createQuietHttpLogger`
-is now exported too so an app wiring its own `ObjectStackClient` gets the same
-identified failures.
-
-Nothing is newly silenced. The only demotion remains 404-on-an-optional-
-collection (`sys_presence`, `sys_activity`), which is an expected outcome of a
-request we still mean to make; a 401 that survives the session gate — a
-mid-session expiry, say — stays a visible, fully-identified error. The cure for
-doomed requests is not issuing them, never hiding them once issued.
diff --git a/.changeset/lucky-pears-translate.md b/.changeset/lucky-pears-translate.md
deleted file mode 100644
index 3a446c8ad9..0000000000
--- a/.changeset/lucky-pears-translate.md
+++ /dev/null
@@ -1,18 +0,0 @@
----
-'@object-ui/i18n': patch
----
-
-回填 `perm` + `home` 两命名空间 14 个缺失语言 key,十个语言包补齐(#3546 切片六)
-
-`scripts/check-i18n-call-site-keys.mjs` 实测:14 个不重复 key / 14 个调用点(1:1),分布在权限集
-记录的授权面摘要(`PermissionFacetLink`,ADR-0056 P1)与"一键发布全部草稿"的其余几条 toast
-(`usePublishAllDrafts`:ADR-0038 L3 探针健康、示例数据健康、ADR-0066 ⑨ 能力引用巡检)。
-
-这 14 处都带内联 `defaultValue`,所以英文一直正常渲染,**十种语言都翻不了** —— 修的是这一半。
-英文字串一字未改:9 处静态 `defaultValue` 与 en 逐字节相同;另外 4 个计数标签(对象 / 字段规则 /
-RLS 策略 / 标签页规则)的 `defaultValue` 是带英文单复数分支的模板串,改用 i18next 复数族
-(`key` + `key_one`)后逐个计数渲染结果与模板串一致。
-
-复数族刻意带**基础 key** 而不是只写 `_one`/`_other`:i18next 只按语言的 CLDR 类别取一个后缀,
-取不到就沿 fallback 链落到 `en`。ru(few 2-4、many 5-20)与 ar(two、few 3-10、many 11-99)
-恰好在用户最先遇到的计数上会因此显示英文;基础 key 让这些类别落回**本语言**。
diff --git a/.changeset/lucky-pugs-attack.md b/.changeset/lucky-pugs-attack.md
deleted file mode 100644
index f7f826bf12..0000000000
--- a/.changeset/lucky-pugs-attack.md
+++ /dev/null
@@ -1,7 +0,0 @@
----
----
-
-Test-only change to `@object-ui/plugin-detail`'s DetailView suites: the record-level
-explain probe (`useRecordEditable`) is now answered by an injected test double instead
-of escaping to the real network, and its request shape is asserted. No published
-behaviour changes.
diff --git a/.changeset/lucky-pugs-shave.md b/.changeset/lucky-pugs-shave.md
deleted file mode 100644
index 9f19fccdba..0000000000
--- a/.changeset/lucky-pugs-shave.md
+++ /dev/null
@@ -1,28 +0,0 @@
----
-"@object-ui/app-shell": patch
----
-
-metadata-admin: name the offending key when only one union member ever read the value
-
-A union with no discriminant reports its failure as one collapsed issue, and the
-member diagnostics that would name the problem are buried inside it. PR #3677
-started unpacking those for `config.columns` by reading the value's own content,
-but deliberately declined every union where some member had rejected the value's
-type outright — which left `config.sort` (`string | ColumnSort[]`) collapsed even
-though only one of its two members had read the value at all.
-
-When exactly one member accepted the value's type, naming it is a fact rather
-than a preference: it is the only member whose complaint can be about what the
-author wrote. So `sort: [{ field: 'n', order: 'bogus' }]` now reports
-`config.sort.0.order` with the spec's own `expected one of "asc" | "desc"`
-instead of `config.sort` / `Invalid input`, and the same holds for a sort row
-that is not an object, a `columns[].summary` written as a bad enum string, a form
-`sections[].fields[]` entry missing its `field`, and an array `filter[].value`
-whose offending element is now addressed directly.
-
-Where two or more members read the value, or where none did, nothing changes:
-the previous message is kept rather than inventing a preference between members
-that objected equally. Both gates — create and edit — continue to report
-identically, and validation verdicts are untouched: the accept/reject decision is
-still made by the one gate, and this only changes how an already-failed draft is
-presented.
diff --git a/.changeset/marketplace-preview-locale-keys-3546-slice5.md b/.changeset/marketplace-preview-locale-keys-3546-slice5.md
deleted file mode 100644
index f2fa4531c2..0000000000
--- a/.changeset/marketplace-preview-locale-keys-3546-slice5.md
+++ /dev/null
@@ -1,46 +0,0 @@
----
-"@object-ui/i18n": patch
----
-
-Backfill the `marketplace` and `preview` namespaces' 37 missing locale keys plus the `marketplace.disclosure.runtime.` template-key family (objectui#3546, slice five)
-
-`scripts/check-i18n-call-site-keys.mjs` (objectui#3530) measured 37 keys that a
-`t()` call site asks for and that **no locale pack defined** — 37 distinct keys at
-37 call sites across five console components — plus one `missing-prefix` family
-whose static head matched no `en` key at all, so every expansion missed. All 37
-carried an inline `t(key, { defaultValue: 'English' })`, which is exactly the
-objectui#3517 class: English rendered correctly, and **all ten languages were
-stuck on it** for months. Nothing here rendered a raw key — slice one (PR #3583)
-held those sites.
-
-What that meant on the page for a `zh` (or `ja`, `de`, `ar`, …) user: the
-marketplace's "Your organization" strip, its Install / Installing… / Installed
-buttons and the version-update affordances were English; the whole ADR-0025 PD4
-**pre-install permission disclosure** was English — "This package contains code",
-the trust-tier badge, "Reviewed & approved" / "Not yet reviewed" / "Signed", the
-four permission group labels (platform services, lifecycle hooks, network,
-filesystem) and the consent checkbox the user ticks to accept them; the ADR-0045
-unpublished-app banner and its publish toasts were English; and the entire
-ADR-0067 build-history sheet — title, description, the per-commit labels, the
-Revert button and both of its result toasts — was English.
-
-`marketplace.disclosure.runtime.` is repaired as an **enumeration, not a
-wildcard**: its value surface is the closed trust-tier enum
-(`PluginRuntimeSchema` = `z.enum(['node', 'sandbox', 'worker'])`, ADR-0025 §3.6),
-so all three members are backfilled and the family leaves the ratchet's
-`missingPrefixes` (3 → 2). A test reads the component's own fallback map and
-fails if a fourth tier is ever added without a key — the job the prefix entry
-used to do.
-
-Each `en` value is byte-identical to the inline `defaultValue` it replaces (36 of
-36 literal sites; the 37th's `defaultValue` is a template literal whose
-`${pkg.display_name}` becomes the `{{name}}` hole its call site already passes),
-so no English string a user sees today changes. The nine translations follow each
-pack's own neighbourhood — including two namespaces that legitimately take
-**different** second persons in `zh` (`marketplace` 你, `preview` 您) — and reuse
-an existing neighbour's translation wherever the `en` string already existed
-verbatim, so one English string never renders as two different sentences in the
-same language.
-
-No component changed: an AST sweep of the whole `marketplace.*`/`preview.*`
-call-site surface found the slice's own dead-`||`-fallback count to be zero.
diff --git a/.changeset/metadata-admin-predicate-unresolved-path-fail-open-os6936.md b/.changeset/metadata-admin-predicate-unresolved-path-fail-open-os6936.md
deleted file mode 100644
index 5eda6c47dd..0000000000
--- a/.changeset/metadata-admin-predicate-unresolved-path-fail-open-os6936.md
+++ /dev/null
@@ -1,61 +0,0 @@
----
-"@object-ui/app-shell": patch
----
-
-metadata-admin: an unresolvable visibility-predicate path now fails OPEN, loudly (objectstack#6936)
-
-`views/metadata-admin/predicate.ts` promised fail-open in its own header — "on any
-parse error → returns `true`: better to show a field than to silently hide it" —
-and delivered it only for *thrown* errors. A path whose root identifier did not
-exist in the evaluation scope took a quieter route: `resolveValue` returned
-`undefined`, and then every comparison judged it false —
-`['text','number'].includes(undefined)`, `undefined === 'text'` — so a predicate
-referencing a name that is not there **hid** the field. Fail-CLOSED, the opposite
-of the documented promise, with nothing in the console.
-
-The bite case is a version-skew window, measured in objectui#3923: `@objectstack/spec`
-≤ 17.0.0-rc.5 spells the `objectForm` sub-field predicates bare (`type in ['text',…]`,
-16 of them) while this engine evaluates them against a `{ data: draftRow }` scope. A
-console upgraded ahead of its backend resolved `type` to nothing, and all 16
-type-conditional Studio sub-fields — Min / Max / Precision / Scale / Max Length /
-Min Length / reference / deleteBehavior / expression / returnType /
-autonumberFormat / language … — disappeared for every row type at once. The symptom
-users saw was "the config items are gone", indistinguishable from a permission
-problem or an unsupported field type.
-
-Per the maintainer ruling on objectstack#6936 (option C):
-
-- **An unresolvable path evaluates `true`.** The field stays visible instead of
-  vanishing, honouring what the header always claimed.
-- **Dev mode says so**, naming the unresolved path *and* the predicate that
-  carried it, warn-once per (path, predicate) pair — the shape
-  `warnOnUnknownActionKeys` established in `@object-ui/core`. Keying the memo on
-  the path alone would have reported the first of the 16 skewed predicates and
-  stayed silent about the other fifteen.
-
-**The boundary, which is the load-bearing half.** "Unresolvable" means the path's
-ROOT identifier is not a name the scope declares (`type`, `record.status`,
-`page.selectedId` against a scope whose only name is `data`). It does *not* mean
-"the value came out undefined": `data.type == 'text'` on a draft that has no
-`type` yet resolves its root fine, the draft simply carries no value there — that
-comparison is still false and the field stays hidden, silently, exactly as before.
-A draft is allowed to be empty; widening fail-open to any absent value would light
-up every type-conditional sub-field at once on a fresh row. A typo one segment
-deep (`data.tpye`) is indistinguishable from an unfilled draft field *without the
-schema*, which this evaluator does not have — catching that belongs to
-publish-time validation of predicate path references at the producer (filed
-separately), not to a renderer heuristic (Commandment #0.1).
-
-The signal is a thrown internal error, deliberately not a sentinel value: fail-open
-is a property of the whole predicate, not of the sub-expression that failed. A
-sentinel would have to be threaded through `!`, `&&`, `||`, `in` and `==` by hand,
-and the first operator that missed it would invert the verdict — `!unresolvedPath`
-would resolve the inner path to "true-ish" and negate it straight back to false,
-i.e. fail-CLOSED again by another route. Throwing routes every failure to the one
-fail-open gate that already existed; `!unresolvedPath` is pinned true.
-
-Unchanged, and pinned: the pre-existing parse-error fail-open (still silent — the
-path resolved, reading it blew up, a different fact); CEL-order absorption, where
-`false && unresolvable` is false and `true || unresolvable` is true with no
-warning because the unresolvable half was short-circuited away; and CEL-style loose
-nullish equality (`data.type == null` on an empty draft is still true).
diff --git a/.changeset/multiselect-group-label-3975.md b/.changeset/multiselect-group-label-3975.md
deleted file mode 100644
index f11b53501b..0000000000
--- a/.changeset/multiselect-group-label-3975.md
+++ /dev/null
@@ -1,31 +0,0 @@
----
-'@object-ui/fields': patch
----
-
-A form-hosted `multiselect` field is now NAMED by its visible label. It was the
-residual of objectui#3961: that issue's probe audited six widgets and fixed
-them, and re-running the same probe over the whole widget map afterwards put
-`multiselect` on the byte-identical failure shape as `checkboxes` — the host's
-`id` kept, but on the chip row's wrapper `div`, where a `<label for>` is inert
-HTML (`HTMLLabelElement.control` is `null`, so it activates nothing and
-contributes no accessible name). Measured on the tree that already carried
-#3961's fix, one field per row:
-
-```
-checkboxes   for=(none) ownId=…-group-label   byLabelText=1(div[role=group])
-multiselect  for=…-form-item ownId=(none)     byLabelText=0
-```
-
-Visually the field had a "Tags" label; a screen reader heard only "Alpha" /
-"Beta" and nothing about what the set of chips was for.
-
-No new mechanism — #3961's declaration, applied to one more widget:
-`multiselect` declares `labelling: 'group'` at the registration boundary, so
-the form renderer publishes its label's `id` and drops the dead `for`, and the
-chip row answers with `role="group"` + the handed-down `aria-labelledby`.
-
-Unchanged on purpose: each chip keeps its own accessible name from its text
-content (the group name sits one level up and does not override it), and
-STANDALONE rendering — the grid's inline cell editor, a bare SDUI node, where
-nobody hands an id and there is no host label to point at — emits no role and
-no IDREF, exactly as before.
diff --git a/.changeset/nav-canonical-metadata-routes-3660.md b/.changeset/nav-canonical-metadata-routes-3660.md
deleted file mode 100644
index ab423eaee3..0000000000
--- a/.changeset/nav-canonical-metadata-routes-3660.md
+++ /dev/null
@@ -1,12 +0,0 @@
----
-'@object-ui/console': patch
-'@object-ui/app-shell': patch
----
-
-Point the last four navigation producers at the canonical metadata-admin routes instead of the deprecated `component/metadata` alias, removing a redirect hop from each (objectui#3660).
-
-The System hub's "Metadata" and "Datasources" cards aimed at `…/component/metadata/directory` and `…/component/metadata/resource?type=datasource`, and the `sys-datasources` entry in both `AppSidebar.systemFallbackNavigation` and `UnifiedSidebar.homeNavigation` spelled the latter too. app-shell declares those spellings as legacy *aliases*, not pages: their route element is `LegacyMetadataRedirect`, which immediately navigates on to `…/metadata` and `…/metadata/datasource`. Every click on any of the four therefore paid a redundant hop plus a re-render to reach a destination the navigation could name directly. All four now name it.
-
-The landing pages are unchanged, byte for byte — the new URLs are exactly what the alias hop was already computing (`datasource` percent-encodes to itself, and neither producer carried a query or hash beyond the `?type=` the alias itself consumed). Only the intermediate hop is gone.
-
-The alias routes stay declared in both `AppContent` branches, untouched: bookmarks and external links still arrive on them and are still forwarded. This completes objectui#3639, which corrected the console host's two redirects and enumerated these four as the remainder.
diff --git a/.changeset/nav-sys-objects-canonical-route-3739.md b/.changeset/nav-sys-objects-canonical-route-3739.md
deleted file mode 100644
index 0f95492737..0000000000
--- a/.changeset/nav-sys-objects-canonical-route-3739.md
+++ /dev/null
@@ -1,13 +0,0 @@
----
-'@object-ui/app-shell': patch
----
-
-Point the `sys-objects` navigation entries at the canonical metadata-admin route instead of the `system/metadata/object` alias, removing a redirect hop from each click (objectui#3739).
-
-`AppSidebar.systemFallbackNavigation`, `UnifiedSidebar.homeNavigation` and `console/home/QuickActions` all spelled this target `/apps/setup/system/metadata/object`. That is not a page: `apps/console`'s host fragment declares `system/metadata/:metadataType` with `MetadataRedirect` as its element, which immediately navigates on to `/apps/setup/metadata/object` — the engine's real route (`metadata/:type`, `MetadataResourceListPage`). Every click therefore paid a redundant hop plus a re-render to reach a destination the navigation could name directly. All three now name it.
-
-This is the same defect objectui#3660 fixed for `sys-datasources`, declared on the line immediately below `sys-objects` in both sidebar arrays. It was missed there because the two entries reached their aliases through different route tables — `sys-datasources` through app-shell's own `component/metadata/resource` alias, `sys-objects` through the host's `system/metadata/:type` rewrite.
-
-The landing page is unchanged, byte for byte: the new URL is exactly what the alias hop was already computing (`object` percent-encodes to itself, and no producer carried a query or hash). Only the intermediate hop is gone. Of the three producers, the two sidebars are live; `QuickActions` has no JSX call site today, so its change is a guard against the dead link returning with the component.
-
-The alias routes stay declared and untouched: bookmarks and external links still arrive on them and are still forwarded.
diff --git a/.changeset/navigation-items-required-3987.md b/.changeset/navigation-items-required-3987.md
deleted file mode 100644
index 6281a5e876..0000000000
--- a/.changeset/navigation-items-required-3987.md
+++ /dev/null
@@ -1,30 +0,0 @@
----
-"@object-ui/layout": patch
----
-
-`navigation-renderer` 的 `items` 声明为 `required: true` —— 校验器不再放过必崩的节点
-
-`items` 在组件侧是**非可选**的 `NavigationItem[]`(`NavigationRendererProps.items`,无 `?`),
-渲染器也不给默认值,而注册声明一直没写 `required`。`sdui-parser` 只在 `input.required` 为真时
-报 `missing-required-prop`(`validate.ts:55-64`),于是 `{ "type": "navigation-renderer" }`
-这个节点**校验零诊断、渲染直接抛**:第一处无守卫的读点是 `pinnedItems` memo 里的
-`collectPinnedItems(filteredItems)`(`NavigationRenderer.tsx:1242` → `:1410` 的
-`for (const item of items)`),实测 `TypeError: items is not iterable`。
-(`resolveActiveNavItem` memo 挡得住 —— 它的 `visit` 首行是 `if (!nodes) return`;
-`:1247` 的 `filteredItems.slice()` 同样会抛,但根本走不到。)
-
-这是 objectui#3972(键的**存在**与**类型**三面对齐)的第四面:**可选性**。#3972 与
-objectui#3900 都是删除假诊断,这一条相反——它是**收紧**。
-
-**blast radius:** 今天省略 `items` 写 `navigation-renderer` 的 schema,会新增一条
-**error** 级 `missing-required-prop`。受影响面是仓外按 `inputs` / `packages/layout/README.md`
-做 schema 驱动的消费者(仓内没有任何 JSON 元数据把它当 schema 节点写,React 调用侧的必填由
-TS 兜住;`examples/schema-catalog` 的 `not-a-container` 对照节点补了 `items: []`,使它只剩
-那一处故意植入的缺陷)。而这条诊断新拦下的形状,**恰好等于渲染必然崩溃的形状** —— 让作者
-(尤其是 AI 作者)在发布期就听到运行期注定要发生的失败,正是 `missing-required-prop` 存在
-的理由。若某个消费者确实想要"缺 items 就渲染空导航",那是给组件加 `= []` 默认值的另一条路
-(objectui#3987 里记了,与本改动不互斥),而不是让校验器继续沉默。
-
-`basePath` **保持可选**并被钉成对照:渲染器真的给了它默认值(`basePath = ''`)。`required`
-是逐个属性从组件读出的事实,不是一刀切——否则这道门会开始拒绝完全能渲染的 schema,作者就会
-学着无视 `missing-required-prop`,正如 #3972 里他们被教着无视 `type-mismatch`。
diff --git a/.changeset/no-app-component-metadata-routes-3610.md b/.changeset/no-app-component-metadata-routes-3610.md
deleted file mode 100644
index 47c9263c9c..0000000000
--- a/.changeset/no-app-component-metadata-routes-3610.md
+++ /dev/null
@@ -1,9 +0,0 @@
----
-'@object-ui/app-shell': patch
----
-
-Make the zero-app console's "Object Manager" / "Datasources" entries resolve, and give that branch a not-found screen instead of a blank one (objectui#3610).
-
-On a deployment with no published apps, the system fallback navigation sends `sys-datasources` to `/apps/setup/component/metadata/resource?type=datasource` and `sys-objects` to `/apps/setup/system/metadata/object` (rewritten by the console host onto the same legacy alias). `isMetadataRoute` is a substring test on `/metadata`, so both URLs pass the "No Apps Configured" guard and enter `AppContent`'s no-`activeApp` route table — which declared no `component/…` route at all and, unlike the with-`activeApp` table, carried no trailing catch-all. A `<Routes>` with no match renders `null`, so an admin building their first object got a fully blank screen: no 404, no error, no empty state.
-
-Both halves are fixed on the routing side, with no navigation URL changed. The two legacy metadata aliases (`component/metadata/directory`, `component/metadata/resource/*`) are now declared in the no-`activeApp` branch too, mirroring the with-`activeApp` branch — they are redirects, not a second copy of the page, so they forward onto the canonical `metadata/:type` routes that branch already declared. And the branch now ends in the same `path="*"` → "Page not found" screen the with-app branch has always had, so the next unresolved URL in a zero-app console is reportable rather than invisible.
diff --git a/.changeset/no-apps-create-first-app-cta-3573.md b/.changeset/no-apps-create-first-app-cta-3573.md
deleted file mode 100644
index 6ae29a41cf..0000000000
--- a/.changeset/no-apps-create-first-app-cta-3573.md
+++ /dev/null
@@ -1,26 +0,0 @@
----
-'@object-ui/app-shell': patch
----
-
-The no-apps empty state's "Create Your First App" CTA now opens the app-creation
-flow instead of silently bouncing the user back to the landing page. It called
-`navigate('/create-app')` — an ABSOLUTE path, so it resolved against the HOST's
-root route tree, which declares no `/create-app`; the reference host's trailing
-`<Route path="*">` therefore replaced it with `/`. The `create-app` route is
-declared by `AppContent` itself, inside the `/apps/:appName/*` subtree (both the
-no-active-app branch and the with-app router), so the CTA now builds the
-app-scoped `/apps/<segment>/create-app` — the platform's canonical app URL
-(ADR-0048) and the same target the sidebar's add-app entry already links to. On
-a fresh zero-app deployment this was the first screen's only route into app
-creation, and it read as a button that does nothing (#3573).
-
-A plain relative `navigate('create-app')` is deliberately NOT the fix, and the
-new routing test pins why: under the installed react-router 7,
-`getResolveToMatches` resolves a relative target against the LEAF match's full
-`pathname` with the splat INCLUDED (in v6 this was the `v7_relativeSplatPath`
-future flag; v7 hardcodes it). The empty state renders across a whole URL family
-— `/apps/setup` and any deeper `/apps/setup/<segment>` — so the relative form is
-right only at the shallowest of them and builds
-`/apps/setup/<segment>/create-app` elsewhere, which matches no route and renders
-a blank screen instead of the bounce. The sibling "System Settings" CTA is
-unchanged.
diff --git a/.changeset/no-apps-go-to-settings-target-3590.md b/.changeset/no-apps-go-to-settings-target-3590.md
deleted file mode 100644
index 4d4d4cafa2..0000000000
--- a/.changeset/no-apps-go-to-settings-target-3590.md
+++ /dev/null
@@ -1,7 +0,0 @@
----
-'@object-ui/app-shell': patch
----
-
-Point the "System Settings" entries at the system hub `/apps/setup/system` instead of the bare `/apps/setup` (objectui#3590).
-
-`AppContent` mounts the system hub only under `isSystemRoute`, which keys on a `/system` path segment. A bare `/apps/setup` therefore matched no pseudo-route except `isSetupRoute` and fell back into the "No Apps Configured" guard — i.e. on a zero-app deployment it *is* that empty state's own URL, so the empty state's `go-to-settings-btn` re-rendered the very screen it sits on. Retargeted three call sites: the empty state's CTA, `AppSidebar`'s no-active-app `sys-settings` fallback entry, and `UnifiedSidebar`'s `/home` Administration `sys-settings` entry. Every sibling entry in both clusters already spelled `/apps/setup/system/...`.
diff --git a/.changeset/objectstack-family-rc5-refresh.md b/.changeset/objectstack-family-rc5-refresh.md
deleted file mode 100644
index a8f04af1bf..0000000000
--- a/.changeset/objectstack-family-rc5-refresh.md
+++ /dev/null
@@ -1,105 +0,0 @@
----
-"@object-ui/types": minor
-"@object-ui/core": minor
-"@object-ui/react": minor
-"@object-ui/mobile": minor
-"@object-ui/data-objectstack": minor
----
-
-Track the `@objectstack` family at `17.0.0-rc.5` (objectui#3560).
-
-The pin moves from `^17.0.0-rc.2` to `^17.0.0-rc.5` across all 37 declarations in
-30 `package.json` files, and the sibling `@objectstack/*` packages (`client` /
-`formula` / `lint`) move with it — they pin `@objectstack/spec` **exactly**, so
-leaving them behind would keep a second copy of the spec in the tree and have
-`@objectstack/lint` validating against schemas that still accept the keys rc.3–rc.5
-retire. `pnpm-lock.yaml` now resolves one copy of each of the six family packages
-(`spec` / `client` / `core` / `formula` / `lint` / `sdui-parser`), all at rc.5.
-
-Bumping the pin and repairing the fallout cannot be split: the pin alone reddens
-CI, and the code alone targets a shape that is not in effect yet.
-
-## A live bug this upgrade fixes
-
-**`ObjectStackDataSource.delete()` never emitted its mutation event, and resolved
-`undefined` instead of a boolean.** `@objectstack/client`'s `DeleteDataResult`
-declared a key called `deleted` — a key no schema has ever declared and no server
-path has ever returned on `DELETE /data/:object/:id`. So `result.deleted`
-compiled and read `undefined` at runtime: the guard never fired, a successful
-delete notified no subscriber, and every consumer's cache stayed stale.
-objectstack#5638 corrected the interface to the schema's `success`; following the
-rename is what restores both behaviours. Nothing in this repo had to change shape
-for it — the code was already asking the right question of the wrong key.
-
-## Breaking, in FROM → TO form
-
-- **The five `@objectstack/spec/ui` interaction-config modules are gone** —
-  touch / dnd / keyboard / animation / offline, 32 defs and 64 exports
-  (objectstack#4988, PR objectstack#5321). None of them had an authoring door: no
-  metadata document could ever carry one of these blocks, so a stack that parsed
-  before the retirement parses byte-for-byte the same after it. `@object-ui/types`
-  drops the 32 `export type` re-exports. The vocabulary each one's only real
-  consumer needs is now declared by that consumer, which is the remedy the spec's
-  own retirement ledger prescribes ("declare that union locally — it is your
-  client's policy, not the platform's"):
-  - `@object-ui/react`'s `useOffline` owns `OfflineStrategy`, `ConflictResolution`,
-    `PersistStorageType`, `EvictionPolicyType`, `OfflineConfig`,
-    `OfflineCacheConfig`, `OfflineSyncConfig`;
-  - `@object-ui/core`'s `DndProtocol` / `KeyboardProtocol` own `DndConfig`,
-    `DragItem`, `DropZone`, `DragConstraint`, `DragHandle`, `DropEffect`,
-    `KeyboardNavigationConfig`, `KeyboardShortcut`, `FocusManagement`,
-    `FocusTrapConfig`;
-  - `@object-ui/types`' `mobile` module owns `SpecGestureConfig`,
-    `SwipeGestureConfig`, `PinchGestureConfig`, `LongPressGestureConfig`,
-    `TouchTargetConfig`, `TouchInteraction` (plus a new `SPEC_GESTURE_TYPES`
-    runtime tuple), so `@object-ui/mobile`'s import paths are unchanged.
-
-  Every shape is moved verbatim — same keys, same members, same optionality — so
-  no hook or bridge changes behaviour. Consumers importing these names from
-  `@object-ui/types` must import them from the owning package instead. Note the
-  spec's *surviving* `ConnectorConflictResolution` (`/integration`, connector sync)
-  and `ConflictResolutionStrategy` (`/api`, route merge policy) are **different
-  concepts** — do not re-point at them.
-- **`@object-ui/types` no longer re-exports `NotificationAction` or `EmbedConfig`**
-  (objectstack#5015, PR objectstack#5300). Both were published `ui` vocabulary with
-  no authoring door; no notification action was ever parsed from metadata and no
-  iframe route ever read an embed config. The presentation enums
-  (`NotificationType` / `NotificationSeverity` / `NotificationPosition`) and
-  `SharingConfig` **survive** and are untouched — public form sharing still gates
-  the anonymous endpoints on `allowAnonymous` + `publicLink`.
-  `@object-ui/core`'s `SharingProtocol` keeps `resolveEmbedConfig` /
-  `generateEmbedCode` against a locally declared `EmbedConfig`, so its surface is
-  unchanged.
-- **`ThemeEngine` stops emitting nine retired CSS variable groups**
-  (objectstack#5021 option 2, PR objectstack#5289). `theme.animation`,
-  `theme.zIndex` and five typography groups (`fontSize` / `fontWeight` /
-  `lineHeight` / `letterSpacing`, plus `fontFamily.heading` / `fontFamily.mono`)
-  are tombstones the schema now rejects by name, so `--duration-*`, `--timing-*`,
-  `--z-*`, `--font-size-*`, `--font-weight-*`, `--line-height-*`,
-  `--letter-spacing-*`, `--font-heading` and `--font-mono` had become structurally
-  dead code — no author could produce the input that reached them.
-  `generateAnimationVars` and `generateZIndexVars` are removed from
-  `@object-ui/core`, and `@object-ui/types` drops `Animation` / `ZIndex` /
-  `AnimationSchema` / `ZIndexSchema`. **`theme.customVars` is the declared — and
-  since #5021 the only — door**: each entry is emitted verbatim as
-  `--<key>: <value>`, so a `--z-modal` or a `--duration-fast` goes there now.
-  LIVE emission is untouched byte for byte: `colors`, `borderRadius`, `shadows`,
-  `typography.fontFamily.base` (→ `--font-sans`) and `customVars`.
-- **`@object-ui/types`' `HttpMethodSchema` now binds the spec's
-  `HttpMethodSubsetSchema`, and `HttpMethod` binds `HttpMethodSubset`**
-  (objectstack#5832, PR objectstack#5976 — objectui#3499). The spec renamed its
-  5-value UI subset because `schemaNameFromExportKey` strips the `Schema` suffix,
-  so the 5-value and 7-value enums both published as `shared/HttpMethod` and the
-  later write won — the emitted JSON Schema and reference page described only one
-  of them. **The runtime domain is unchanged and this repo's exported names are
-  unchanged**; this follows the rename without touching cross-package semantics.
-  Deliberately NOT re-pointed at the spec's bare `HttpMethod`: that is the 7-value
-  enum, and widening to it would let `method: 'HEAD'` compile and then throw in
-  `HttpRequestSchema.parse()`.
-- **`dashboard.widgets[].actionUrl` / `actionType` / `actionIcon` / `aria` are
-  refused, not stripped** (objectstack#5010, ADR-0049 enforce-or-remove). A
-  dashboard widget has no action button and never had one — every action the
-  dashboard dispatches comes from `header.actions[]` — and no renderer ever applied
-  the widget `aria`, so it promised accessibility compliance it did not deliver.
-  A stale dashboard now gets a named error telling it where the affordance moved,
-  instead of silently losing it. Run `os migrate meta --from 16` to rewrite.
diff --git a/.changeset/objectview-value-language-3582.md b/.changeset/objectview-value-language-3582.md
deleted file mode 100644
index 61127c4bb7..0000000000
--- a/.changeset/objectview-value-language-3582.md
+++ /dev/null
@@ -1,43 +0,0 @@
----
-'@object-ui/i18n': patch
----
-
-`console.objectView.systemViewReadonly` and `console.objectView.expandToPage`
-are translated in the eight packs that stored English for them, so a Japanese,
-Korean, German, French, Spanish, Portuguese, Russian or Arabic session reads
-the system-view hint and the expand affordance in its own language (#3582).
-
-This is a different defect class from #3546's ledger, and no gate in the repo
-could see it. There the key was *missing* from a pack and `fallbackLng: 'en'`
-rendered English; here the key was **present in all ten** and eight of them
-stored English as the value. `all-locales-key-parity` compares key *sets* and
-placeholder *shape* — identical before and after this change, and neither key
-interpolates anything. `scripts/check-i18n-call-site-keys.mjs` and its baseline
-ratchet ask whether a `t()` key exists in `en`; it did, so these two were never
-in the 258.
-
-`systemViewReadonly` carried the sharper half: the eight packs did not hold
-`en`'s sentence, they held one `en` had already abandoned. `en` says the view
-is read-only; the eight said `System view defined in code - duplicate to
-customize.` — pointing eight locales at a duplicate-to-customize path the
-product no longer presents. They are translated against `en`'s **current**
-read-only meaning, not against the stale English they replaced.
-
-Each value is built from terminology the same pack already uses rather than
-invented: `view.readonlyTooltip` supplies "system view" and
-`console.objectView.cannotEditMetaView` (landed in #3583) supplies "defined in
-code", so the new hint agrees with the copy beside it in every pack. For
-`expandToPage`, `detail.openAsFullPage` is the identical English sentence one
-namespace over and was already translated everywhere — `en` and `zh` hold their
-two byte-identical to each other, so the eight now do too, and one locale
-cannot end up with two different words for one action.
-
-`en` and `zh` are unchanged, byte for byte. No key is added or removed —
-the diff is 16 values in 8 files. A new
-`objectView-value-language-3582.test.ts` pins the `en` literal (so the next
-rewording of `en` fails loudly instead of silently orphaning nine
-translations), asserts that no pack but `en` serves either English spelling,
-and requires the zh/ja/ko/ru/ar values to contain characters of their own
-script. The repo-wide "no ASCII English sentence in a non-Latin pack" gate that
-#3582 also sketched is deliberately **not** here; it is a separate, lands-green
-change.
diff --git a/.changeset/olive-donkeys-repeat.md b/.changeset/olive-donkeys-repeat.md
deleted file mode 100644
index 034859b3bc..0000000000
--- a/.changeset/olive-donkeys-repeat.md
+++ /dev/null
@@ -1,27 +0,0 @@
----
-"@object-ui/app-shell": patch
----
-
-metadata-admin: name the offending column when `config.columns` is rejected
-
-`config.columns` is `string[] | ColumnDef[]` — a union with no discriminant — so
-Zod reported every rejection as one collapsed issue on the field itself:
-`config.columns` / `Invalid input`, on the create gate and the edit gate alike.
-The field was reachable, but nothing said which column was wrong, which key, or
-what was expected.
-
-The union member is now chosen by the value's own first element — a list of
-field names or a list of column objects — and that member's real diagnostics are
-reported at their draft-absolute path. A mis-typed key reports
-`config.columns.0.field` with `expected string, received number`; a stray number
-in a list of field names reports the element that broke it rather than every
-element of the shape the author never chose. The aggregated container reaches
-the same union as `list.columns.…`, and both gates now report identically.
-
-Only unions that really are "an array of A or an array of B" are read this way,
-so neighbours such as `config.sort` (`string | ColumnSort[]`) are untouched.
-Where the content elects nothing — a first element that is neither a string nor
-an object — the previous message is kept rather than guessing.
-
-Validation verdicts are unchanged: the accept/reject decision is still made by
-the one gate, and this only changes how an already-failed draft is presented.
diff --git a/.changeset/organization-namespace-slice-two.md b/.changeset/organization-namespace-slice-two.md
deleted file mode 100644
index 242ec036c7..0000000000
--- a/.changeset/organization-namespace-slice-two.md
+++ /dev/null
@@ -1,33 +0,0 @@
----
-'@object-ui/i18n': patch
----
-
-The organization-management console is translatable. The 90 keys under
-`organization.*` — the org layout and its tabs, the members list, the whole
-invitation flow, organization settings including the leave and delete
-confirmations, the accept-invitation page, and the workspace switcher — are now
-defined in all ten locale packs, so a non-English session reads the org admin
-surface in its own language instead of English (part of #3546).
-
-`scripts/check-i18n-call-site-keys.mjs` measured 258 keys that a `t()` call site
-asks for and no pack defines. `organization.*` was the largest namespace in that
-tally at 90 keys across 93 call sites in seven components. Every one of them
-carried an inline `t(key, { defaultValue: 'English' })`, which is why nothing
-looked broken: English rendered correctly at each site and all ten languages
-were pinned to it. That is the #3517 class, not the raw-key class slice one
-(#3583) held — no organization site rendered an identifier, and none had a dead
-`||` fallback to remove, which was measured before deciding not to touch the
-components.
-
-Adding a `defaultValue` is deliberately not the fix; it is the mechanism that
-kept these invisible for months. The existing defaults stay where they are, and
-each `en` value is byte-identical to the default at its call site so the two
-paths cannot render different text.
-
-`organization` is a new top-level namespace, sitting next to — and distinct
-from — `organizations`: the singular one is the management surface, the plural
-one the org picker. The ratchet in `scripts/i18n-call-site-key-baseline.json`
-shrinks by exactly these 90 entries, from 253 to 163. The
-`organization.invitations.status.*` template-key family is untouched and still
-baselined: enumerating an invitation status set is a different repair from
-backfilling literal keys.
diff --git a/.changeset/os5994-context-selector-persist-enforce.md b/.changeset/os5994-context-selector-persist-enforce.md
deleted file mode 100644
index 9207beaac0..0000000000
--- a/.changeset/os5994-context-selector-persist-enforce.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"@object-ui/app-shell": patch
----
-
-Honour all three `AppContextSelectorSchema.persist` values in app context selectors: `'query'` (the default) writes and reads the URL query parameter only, `'session'` writes and reads `sessionStorage` only, and `'none'` writes neither — the pick stays in memory for that mount. Previously every selector was mirrored into both stores and read back as `URL ?? storage`, so `'session'` and `'query'` were indistinguishable and `'none'` persisted anyway. Selectors on the `'query'` default (including Studio's package scope) no longer write `objectui-ctx-*` storage, and a scope dropped by a param-less nav link is re-established by auto-select-first instead of from a store the author never declared.
diff --git a/.changeset/outbound-agent-conversation-language-3896.md b/.changeset/outbound-agent-conversation-language-3896.md
deleted file mode 100644
index 96ea865971..0000000000
--- a/.changeset/outbound-agent-conversation-language-3896.md
+++ /dev/null
@@ -1,46 +0,0 @@
----
-"@object-ui/app-shell": patch
----
-
-The AI plan / confirm cards send the agent text in the CONVERSATION's language, not the console UI's (objectui#3896)
-
-#772 / #2884 established the rule and `AiChatPage` states it at the gate:
-outbound text follows the conversation, rendered labels follow the UI locale.
-Only half of it was implemented. Three of the four outbound messages read
-
-    convZh ? '<Chinese literal>' : t('console.ai.…')
-
-and `t()` is the **UI pack**, so the "not Chinese" branch answered with the UI
-locale rather than with English. The fourth, `planAnswerMessage`, had no gate at
-all.
-
-Two measured consequences, one in each direction:
-
-- **A zh console holding an English conversation sent Chinese.** The `zh` pack
-  defines all four keys, so the `t()` lookup HIT instead of falling through to
-  its English default: clicking "Build it" put `确认，开始搭建。` into an English
-  thread. Cloud's confirm gate (`service-ai-studio` `confirm-gate.ts`
-  `APPROVAL_RE`) recognises both languages, so the build ran — and the agent
-  switched the rest of the thread to Chinese. That is objectui#2884's symptom
-  with the trigger reversed.
-- **The answer chip sent the UI locale in both directions.** Ungated, it put
-  `For "…", go with: …` into a Chinese thread — objectui#772's opening complaint
-  verbatim — and a Chinese sentence into an English one under a zh console.
-
-All four sites now go through one resolver,
-`packages/app-shell/src/console/ai/outboundAgentText.ts`: a Chinese conversation
-gets the `zh` pack's value, every other conversation gets the `en` pack's value,
-and the UI pack is never consulted. The three console AI surfaces (`/ai` page,
-chat dock, Studio copilot) all mount the same `ChatPane`, so all three change
-together.
-
-Reading the two packs directly rather than `t(key, { lng })` is deliberate: an
-i18next lookup's answer depends on which bundles the host app loaded and on
-`fallbackLng`, and a `zh` lookup silently falling back to `en` is exactly the
-wrong-language bug above. The per-language fallback table in the resolver is
-pinned byte-identical to both packs, so a Chinese conversation falls back to
-Chinese — never to English — if a pack ever stops defining a key.
-
-Labels are untouched: they still follow the UI locale, and the pin that fails
-when a `*Label` drifts into the conversation gate (objectui#3837) now also fails
-when an outbound `*Message` is read back out of the UI pack.
diff --git a/.changeset/page-block-inspector-chrome-i18n.md b/.changeset/page-block-inspector-chrome-i18n.md
deleted file mode 100644
index 3d864b2797..0000000000
--- a/.changeset/page-block-inspector-chrome-i18n.md
+++ /dev/null
@@ -1,15 +0,0 @@
----
-'@object-ui/app-shell': patch
----
-
-fix(metadata-admin): page block inspector chrome follows the locale
-
-`PageBlockInspector`'s own JSX carried hardcoded English that no translation
-table could reach: the row-adder of every field list (`Add`), the per-row and
-per-item remove `aria-label`s (`Remove` / `Remove item`), and the free-text
-fallback placeholders of the object picker and the field list. All now resolve
-through `engine.inspector.pageBlock.*` keys defined in both en-US and zh-CN.
-The JSON editor's parse error reuses the catalog's existing
-`engine.form.invalidJson` instead of its own literal, and holds the parse
-failure as state so the message follows a later locale switch. English is
-unchanged.
diff --git a/.changeset/page-block-inspector-curated-label-i18n-3913.md b/.changeset/page-block-inspector-curated-label-i18n-3913.md
deleted file mode 100644
index 5ef3d668e1..0000000000
--- a/.changeset/page-block-inspector-curated-label-i18n-3913.md
+++ /dev/null
@@ -1,41 +0,0 @@
----
-"@object-ui/app-shell": patch
----
-
-Page block inspector: the PROPERTIES panel's curated field labels now follow the session locale instead of always rendering English
-
-`PageBlockInspector`'s chrome went through the translation table from the start —
-`t('engine.inspector.pageBlock.properties')` and its siblings — while the panel's
-CONTENTS did not. Every `label` in `previews/block-config.ts` was an English
-literal handed straight to the field components, so a zh-CN admin opening any
-page block read 「属性」 over a stack of English field names: two languages in one
-panel, reproducible on any block with no special data.
-
-All 157 label literals (152 field/option labels + 5 `addLabel`s) are now
-translation keys resolved through `t(key, locale)` at render, with 154 distinct
-keys added to both the `en-US` and `zh-CN` sides of
-`views/metadata-admin/i18n.ts`. The English text is unchanged: every key's `en`
-value is the literal it replaced, verified by substituting all 157 keys back and
-diffing the result byte-for-byte against the pre-change file.
-
-The key is a function of the label's POSITION in `BLOCK_CONFIG`
-(`engine.inspector.pageBlock.field.<blockType>.<name>`, `.add.<blockType>.<name>`,
-`.option.<fieldName>.<value>`), and a test re-derives all three shapes from the
-table's own structure. That is what makes the realistic mistake visible: these
-keys differ by one segment, so adding a block by copy-pasting a neighbour's key
-yields a key that EXISTS in both locales and renders a plausible label belonging
-to a different property — an existence-only check is green for it. Positional
-keys also let one English word take different Chinese per block, which the panel
-needs: `element:button.label` is a button caption 「按钮文字」 while
-`page:tabs.items.label` is a tab title 「标签」, and `Add section` is 「添加分区」
-here but stays 「添加分组」 in the form-layout canvas.
-
-`addLabel` is now REQUIRED on the `array` field variant. It was optional and the
-inspector fell back to a bare English `'Add'` — an untranslatable literal no
-locale table could reach. Requiring it deletes the fallback instead of
-translating it, so a new array field cannot compile without naming its
-add-button key.
-
-Option labels are translated too, including the ones `ColorVariantPicker` renders
-only as `aria-label`/`title`, where an untranslated string is invisible to a text
-query.
diff --git a/.changeset/page-container-authorable-children-4027.md b/.changeset/page-container-authorable-children-4027.md
deleted file mode 100644
index 880e6a3174..0000000000
--- a/.changeset/page-container-authorable-children-4027.md
+++ /dev/null
@@ -1,40 +0,0 @@
----
-"@object-ui/components": patch
----
-
-`page:card` publishes `children` instead of the retired `body`, and `page:section` / `page:footer` / `page:sidebar` publish the `children` slot they render
-
-`inputs` is the published authoring surface, not documentation: the Studio block
-designer builds its panel from it, `sdui-parser`'s `gen-manifest.ts` serializes
-it into `sdui.manifest.json` and `sdui-intrinsics.d.ts`, and the JSX-page
-compiler builds its prop whitelist from it. Two of the `page:*` containers had
-drifted from the contract in opposite directions.
-
-`page:card` published `{ name: 'body', type: 'slot' }`. `@objectstack/spec`
-retired `PageCardProps.body` in objectstack#5775 (PR objectstack#6281, merged
-2026-08-07, ADR-0087 D2) and declared `children` in its place — one composition
-slot with one spelling, the same one `grid`, `flex`, `page:section` and
-`page:tabs` items already use. The designer was teaching a key the contract now
-rejects by name.
-
-`page:section`, `page:footer` and `page:sidebar` declared no `inputs` at all, so
-the designer could not authorize the child list those three components exist to
-render. The same upstream PR replaced their `EmptyProps` declaration with the
-shared `PageContainerProps`, whose single key is `children`; all three now
-publish that one slot from one shared literal, mirroring the spec's own single
-definition.
-
-Rendering is unchanged in both directions. `PageCardRenderer` still READS `body`
-first (`schema?.body ?? schema?.children`) and the three thin containers still
-read `schema?.children || schema?.body`, so documents stored under the old
-contract keep rendering until the ADR-0087 D2 conversion rewrites the key at
-load time — a back-compat read is not a second authorable spelling, the same
-split the `page-header-subtitle-alias` sequencing established. No validation
-verdict moves either: `children` is already in `sdui-parser`'s `BASE_PROPS` (so
-it was never an `unknown-prop`), `isContainer: true` was already set on all
-four, and `codegen.ts` filters `slot` inputs out of the generated `.d.ts` where
-`SduiBaseProps.children` types it.
-
-What changes for an author is the designer surface: `body` is no longer offered
-on `page:card`, `children` is, and the three thin containers gained an
-authorable content slot.
diff --git a/.changeset/page-header-is-container-3900.md b/.changeset/page-header-is-container-3900.md
deleted file mode 100644
index 948a689968..0000000000
--- a/.changeset/page-header-is-container-3900.md
+++ /dev/null
@@ -1,36 +0,0 @@
----
-"@object-ui/layout": patch
----
-
-`page-header` 注册补 `isContainer: true` —— 校验器不再对文档承诺的 children 写法报 `not-a-container`
-
-`PageHeader` 一直**有意**把 `schema.children` 渲染进右侧动作槽(`PageHeader.tsx:182`,
-`record:quick_actions` 嵌在 `page:header.children` 下就是靠它),
-`content/docs/layout/page-header.mdx` 把该槽的优先级(`action` → React `children` →
-`actions` → schema children)写成公开契约,该文档页唯一的 live demo
-(`layout-page-header/pageheader-with-actions`)正是这个形状且实测正常渲染。但
-`packages/layout/src/index.ts` 的注册漏了 `isContainer: true`。
-
-漏这个 flag 从来没有挡住任何渲染 —— 渲染路径根本不读它(`SchemaRenderer` 把
-`children` 从 React props 里剥掉当元数据,而始终把整个节点作为 `schema` 传下去,
-`PageHeader` 自己再把 `schema.children` 放回槽里)。它的消费者在别处:`sdui-parser`
-的 `not-a-container` 诊断、Studio 调色板元数据、react-page 标签表。所以真正的后果是
-**校验器在说谎**:作者照文档写出能正常渲染的 schema,却拿到一条
-"`page-header` does not accept children" 的 warning;信了这条 warning 去掉 children,
-右槽就空掉。而会说谎的 warning 比缺一条 warning 更贵 —— 它训练作者(尤其 AI 作者)
-连真实的 `not-a-container`(那些确实不收子节点的组件)一起无视。
-
-这不是在 spec 之外新开作者面:`children` 是 objectui JSON 协议里**每个节点**的基础属性
-(`sdui-parser/src/validate.ts` 的 `BASE_PROPS` 把它和 `type`/`id`/`className` 并列),
-不是 `PageHeaderProps` 的键。所以这个 flag 回答的是协议层面的"该节点是否接受子节点列表",
-而对这个组件,答案一直是"是"。维护者 2026-08-09 就 objectui#3900 的 A/B 分叉裁定 A 案,
-理由同上。
-
-行为面变化极窄:注册元数据一个布尔位。渲染输出逐字节不变(渲染路径不读该 flag);
-`sdui-parser` 对带 children 的 `page-header` 少报一条 warning;设计器把它当容器对待
-(即它本来的样子)。canonical 的 `page:header`(`@object-ui/components`)不在此列且刻意不动
-—— 那个渲染器完全不读 `schema.children`,所以它没有 `isContainer` 是正确的。
-
-两个方向都已钉住:文档 demo 走应用真实构建的 manifest 后不再产生 `not-a-container`,
-而一个真正不收子节点的组件(`navigation-renderer`)带 children 时诊断照旧触发 ——
-后者是前者的对照,保证这条修复不是把诊断弄哑了。
diff --git a/.changeset/percent-cell-value-over-bar-os5066.md b/.changeset/percent-cell-value-over-bar-os5066.md
deleted file mode 100644
index bea632bcd6..0000000000
--- a/.changeset/percent-cell-value-over-bar-os5066.md
+++ /dev/null
@@ -1,33 +0,0 @@
----
-"@object-ui/fields": patch
----
-
-`percent` / `progress` cells now give the NUMBER shrink priority over the decorative bar (objectstack#5066)
-
-In a narrow clipping container the percent display renderer sacrificed the wrong
-half of itself. It emitted a `w-16 shrink-0` bar in front of a shrinkable value
-span, so in a `record:highlights` chip — `basis-[9rem]`, shrinking toward
-`min-w-[7rem]` as chips are added, clipping with `truncate` — the 64px bar plus
-the 8px gap consumed the content box and `truncate` removed what was left of the
-value. A stored `33.33` carried `33%` in the DOM and read as `3` on screen
-(measured: 79px clip box, 32px text node, 25px overflow), with no ellipsis and
-nothing in the accessible name to signal the loss: a silently smaller, plausible
-number rather than a cosmetic glitch. Downstream the app had to override the
-highlight's render type to `number` to get its digits back, losing the `%` glyph
-and the bar entirely.
-
-The priority is now inverted, on the principle that the number is the CONTENT and
-the bar is DECORATION: the value span is `shrink-0` and the bar carries
-`min-w-0 shrink`, keeping `w-16` only as its PREFERRED width, so a squeezed
-container eats the bar and the digits survive intact.
-
-The bar is deliberately NOT `flex-1`. `flex-1` would let it GROW as well as
-shrink, stretching the bar across every wide grid cell and changing a surface
-that has no bug; `w-16` stays the upper bound, so wide containers render exactly
-as before and only the shrink direction changed. Below roughly 40px of content
-the bar has collapsed to nothing and the value clips like any other single-line
-cell — same floor as the plain number renderer, which is as far as a
-self-contained renderer fix reaches (the chip's own width is a function of how
-many chips the record has, so the strip's `@container` cannot see it).
-
-The neighbouring `number` renderer is untouched.
diff --git a/.changeset/permission-facets-rls-priority-retired-7130.md b/.changeset/permission-facets-rls-priority-retired-7130.md
deleted file mode 100644
index 5cc76da7f7..0000000000
--- a/.changeset/permission-facets-rls-priority-retired-7130.md
+++ /dev/null
@@ -1,39 +0,0 @@
----
-"@object-ui/app-shell": patch
----
-
-The Studio RLS editor no longer authors the retired `rowLevelSecurity[].priority` key (objectstack#7130)
-
-`rowLevelSecurity[].priority` was removed in `@objectstack/spec` 17.0.0
-(objectstack#3896) and left as a `retiredKey` tombstone in
-`packages/spec/src/security/rls.zod.ts` — an authored value is REJECTED at parse
-time with the upgrade prescription, not ignored. It promised "conflict
-resolution" that cannot exist: applicable policies OR-combine (most permissive
-wins), so there is no conflict to order.
-
-`PermissionAdvancedFacets` — the structured RLS editor on the Studio permission
-matrix — was still typing the key and seeding `priority: 0` on every policy its
-"Add policy" button created. Its docblock described the shapes as mirroring the
-framework spec, but that mirror was sampled before the removal. Nothing on the
-save path removed the key: `doSave` sends the draft verbatim, and at package
-scope `mergePermissionSlice` copies `rowLevelSecurity` from the freshly-read
-base while taking only `objects`/`fields` from the edit — so at environment
-scope (the only scope where these facets are persisted) the seeded key went
-straight into the saved permission set. A user who added an RLS policy through
-the editor therefore wrote a permission set the parser refuses.
-
-Three changes, all editor-side:
-
-- the local `RlsPolicy` shape drops `priority`;
-- the Add-policy seed drops `priority: 0` — it now authors exactly
-  `{name,object,operation,using,enabled}`;
-- policies are stripped of the retired key as they are read out of the draft, so
-  a permission set already carrying `priority` (written by this editor before
-  this fix) comes out clean the moment any RLS edit re-emits the list. This is
-  editor hygiene, not a data migration: a set nobody opens is untouched, and the
-  strip is keyed to the named tombstone rather than being a blanket unknown-key
-  purge, so every live key the editor does not itself render survives a
-  round-trip.
-
-The docblock stops claiming the shapes are "sampled from live data" — that
-sampling is exactly how a removed key stayed in the editor for ten days.
diff --git a/.changeset/pivot-compare-stacking-3614.md b/.changeset/pivot-compare-stacking-3614.md
deleted file mode 100644
index eb1120e0d7..0000000000
--- a/.changeset/pivot-compare-stacking-3614.md
+++ /dev/null
@@ -1,16 +0,0 @@
----
-"@object-ui/plugin-dashboard": patch
----
-
-Show the `compareTo` comparison in a dataset pivot cross-tab instead of dropping it
-
-A dataset widget with `type: 'pivot'` and two or more `dimensions` renders a true cross-tab, and that branch was the one render path the `compareTo` work left out (objectui#3614, following objectui#3337 / PR #3612). It laid out its columns as `bucket × measure` and never admitted the `<measure>__compare` columns the executor returns — so a pivot with a bounded date window and a `compareTo` ran a correct comparison query, received correct comparison data, and displayed none of it: headers, cells and all three subtotals were silent.
-
-The comparison is now **stacked inside the cell** — current value on top, comparison value and its delta percentage beneath in smaller type:
-
-- The pivot's column structure is unchanged. Giving the comparison a column of its own would turn `bucket × measure` into `bucket × measure × window`, doubling the width and adding a third header level on the widget family whose width is already the scarce resource.
-- **Row, column and grand subtotals stack it the same way.** A Total that alone showed no comparison would read as "this row has none", which is a different and false statement.
-- One caption names the comparison window ("vs last year") for the whole table, from the same `dashboard.trend.*` vocabulary the KPI and flat-table paths use, and the delta comes from the same helper — so a KPI and a cross-tab cell comparing the same two windows agree on sign and rounding.
-- **CSV export stays data-shaped.** The cross-tab now exports a flat `<measure>__compare` column per compared measure, with bare numbers in the cells: a spreadsheet can compute on the export, and no stacked display string ("$120 $100 20%") ever reaches it.
-
-Presence is detected from the returned data, as on every other path, so there is no new option to set — and a pivot the executor sent no comparison for renders exactly as it did before.
diff --git a/.changeset/plan-building-label-ui-locale-3837.md b/.changeset/plan-building-label-ui-locale-3837.md
deleted file mode 100644
index 23e52be6af..0000000000
--- a/.changeset/plan-building-label-ui-locale-3837.md
+++ /dev/null
@@ -1,40 +0,0 @@
----
-"@object-ui/app-shell": patch
----
-
-The plan card's "Building…" badge follows the console UI locale, like every other label on it (objectui#3837)
-
-`AiChatPage` gates four strings on `convZh` — the language of the CONVERSATION,
-not of the UI — because the cloud confirm gate (`service-ai-studio`
-`confirm-gate.ts` `APPROVAL_RE`) recognises Chinese and English only, so what the
-confirm cards SEND has to match the thread it is sent into (objectui#772 /
-objectui#2884). The file's own comment above that gate ends with the other half
-of the rule: "button LABELS stay on the UI locale."
-
-`planBuildingLabel` (objectui#2632) had drifted onto the wrong side of it, and
-handed back a hard-coded `正在搭建…` for any Chinese thread. Two consequences,
-both measured:
-
-- **A mixed-language card.** Under an English console, a Chinese thread's plan
-  card rendered `Proposed plan` / `Build it` / `Built` / `Not yet built` in
-  English with one Chinese badge in the middle. objectui#2458 item 4 recorded the
-  reverse direction of the same disease.
-- **A dead translation.** A Chinese conversation always took the literal, so the
-  zh value of `console.ai.planBuilding` was unreachable for Chinese readers —
-  re-wording the pack changed nothing for them. objectui#3546 slice four had just
-  backfilled that key into all ten packs (PR #3839) and could only contain the
-  defect, by making the zh value byte-identical to the literal and pinning the two
-  together.
-
-The badge now reads `t('console.ai.planBuilding', …)` like its twelve neighbours,
-so all ten packs are reachable — a German console with a Chinese thread renders
-`Wird erstellt…` — and the zh pack is the single source of the Chinese wording
-(unchanged: `正在搭建…`, so no Chinese reader sees a different string than before).
-
-The three OUTBOUND strings (`planApproveMessage`,
-`planApproveDefaultsMessage`, `changesConfirmMessage`) are untouched and still
-follow the conversation: each is passed to `onSendMessage` and read by the gate,
-which is the class the `convZh` branch exists for. The slice-four containment pin
-in `packages/i18n/src/__tests__/console-namespace-3546.test.tsx` is flipped in the
-same change — it now fails if a gate reappears over that label, or if any future
-`convZh` read feeds something rendered instead of something sent.
diff --git a/.changeset/plugin-map-drop-module-scope-console-log-7139.md b/.changeset/plugin-map-drop-module-scope-console-log-7139.md
deleted file mode 100644
index 41c992d14e..0000000000
--- a/.changeset/plugin-map-drop-module-scope-console-log-7139.md
+++ /dev/null
@@ -1,27 +0,0 @@
----
-"@object-ui/plugin-map": patch
----
-
-`plugin-map` 加载时不再向控制台打印 `Registering object-map...`
-
-`packages/plugin-map/src/index.tsx` 的注册调用之前留着一句调试输出
-`console.log('Registering object-map...')`。它位于**模块作用域**,所以不是「渲染地图时打一行」,
-而是**只要这个 plugin 被 import 就打一行**:console 应用的 `register-plugins` 一加载即触发,
-单元测试里跟着刷,生产 bundle 同样保留 —— 使用者控制台里凭空多出一行来源不明的噪音。
-
-同仓其余 18 个 plugin 的 `src/index.tsx` 注册处都没有这类输出,这一句是孤例
-(`plugin-editor` 里唯一的 `console.log` 命中是 `defaultProps.value` 示例代码字符串,
-不是会执行的语句)。纯噪音,不涉及任何行为:注册本身、`ObjectMap` 的渲染与取数都不读它。
-
-顺带记一条搜索时确认的背景:仓库的 eslint 配置没有开 `no-console` 规则,所以这类遗留
-调试输出没有任何自动化拦网 —— 这次是靠人工发现的。是否全仓开 `no-console`(以及
-`ObjectMap.tsx` 里三处**有意**保留的 `console.warn`/`console.error` 诊断如何豁免)是一个
-影响多个包的策略决定,已另行开单,不混进本 PR。
-
-回潮钉在 `src/index.registration.test.tsx`:spy 掉 `console.log`/`info`/`debug` 后
-`vi.resetModules()` 再 `import('./index')`,断言零输出。钉子刻意只覆盖这三个「噪音通道」,
-不含 `warn`/`error` —— `ComponentRegistry.register()` 在缺 namespace、以及裸名 fallback
-覆盖冲突时**按设计**会 `console.warn`(`packages/core/src/registry/Registry.ts`),
-一刀切断言「零 console 输出」等于把 Registry 的诊断契约钉在这里,将来会因与「遗留调试输出」
-无关的原因变红。钉子里还有一条非空断言:import 后校验 `object-map`/`map` 两个注册确实进了
-registry,免得模块缓存导致 import 未真正执行、于是「没有输出」是因为**什么都没发生**而假绿。
diff --git a/.changeset/plugin-report-react-19-peer-3690.md b/.changeset/plugin-report-react-19-peer-3690.md
deleted file mode 100644
index 2a49f59fe0..0000000000
--- a/.changeset/plugin-report-react-19-peer-3690.md
+++ /dev/null
@@ -1,11 +0,0 @@
----
-'@object-ui/plugin-report': patch
----
-
-Accept React 19 in `@object-ui/plugin-report`'s peer range, the last UI package still declaring React 18 alone (objectui#3690).
-
-`peerDependencies.react` and `peerDependencies.react-dom` widen from `^18.0.0` to `^18.0.0 || ^19.0.0`, matching the other 29 packages in the fixed version group. With npm 7+ resolving peers strictly, a React 19 consumer installing this published package hit an `ERESOLVE` on first install while every sibling installed clean — and the package's own README already documented the wider range, so the manifest was the half that was wrong.
-
-The narrow range was never a constraint anyone stated. `packages/plugin-report/package.json` was hand-authored on 2026-02-06 (`1e557cbda`), by which point nineteen sibling packages already carried `^18.0.0 || ^19.0.0` and every package created afterwards was born with it; the one other package born narrow, `plugin-dashboard`, was corrected on 2026-05-08 (`d2b6ecec6`) in a build fix that touched only itself. No commit in the file's 172-commit history ever revisited the peer line, and no commit message mentions a React 18 requirement.
-
-Nothing in the package needs React 18. Its entire React surface is `React.FC`, `useState`, `useEffect`, `useMemo`, `useReducer`, `useContext`, `Fragment`, `ComponentType`, `CSSProperties` and `ReactNode` — all unchanged in React 19 — with zero uses of anything React 19 removed (`ReactDOM.render`, `unmountComponentAtNode`, `findDOMNode`, legacy context, string refs, `defaultProps` / `propTypes` on function components, `createFactory`, `useFormState`, `react-dom/test-utils`). `react-dom` is not imported by the source at all; it appears only as a UMD global name in the Vite externals config. The workspace pins `react` to 19.2.8 via a root `pnpm.overrides`, so this package's 78 tests have been running against React 19 the whole time it declared it did not support it.
diff --git a/.changeset/predicate-input-template-double-wrap-3871.md b/.changeset/predicate-input-template-double-wrap-3871.md
deleted file mode 100644
index 2fd57f78b8..0000000000
--- a/.changeset/predicate-input-template-double-wrap-3871.md
+++ /dev/null
@@ -1,43 +0,0 @@
----
-'@object-ui/core': patch
----
-
-fix(core): stop re-wrapping an already-`${…}` predicate, so action-face `visible` / `disabled` finally honour it (objectui#3871)
-
-`toPredicateInput` — the one normalizer every action surface and the action
-engine share — wrapped **every** string as `${string}`, assuming a bare
-expression. But `${…}` is a spelling this repo documents for a predicate
-(AGENTS.md §4) and one the normalizer's own output type lists as valid, so an
-already-normalized value was wrapped a second time: `'${x}'` became `'${${x}}'`,
-which cannot match the evaluator's single-template fast path and does not parse.
-The author's expression then decided nothing, and which constant came back
-depended on the caller's error policy:
-
-- **fail-soft** legs (every `disabled` / `enabled` leg; `visible` on
-  `action:icon`, `action:group` and the related-list toolbar) got the unparsed
-  string back, so `Boolean(…)` was a constant `true`: `disabled: '${…}'` greyed
-  the action out permanently, `visible: '${…}'` showed one the author had gated
-  away, and `enabled: '${…}'` never disabled anything.
-- **fail-closed** legs (`throwOnError: true` — `visible` on `action:button`,
-  `action:bar`, `action:menu`, `DeclaredActionsBar`, and
-  `ActionEngine.getActionsForLocation`) got a **throw**, which each site turns
-  into "hidden": an action gated with a template predicate was invisible even
-  while its gate held, and the fail-closed warning blamed the author's
-  expression.
-
-A string that already carries `${` is now returned untouched (the same guard
-covers the envelope branch, where an unwrapped `source` reaches the identical
-wrap), which makes the normalizer idempotent. Every affected surface goes from a
-constant verdict to the predicate's real one — converging the action face with
-`SchemaRenderer` and `page:header`, which read the raw value and have always
-been right about this spelling (objectui#3314's shape). Bare expressions and
-`{ dialect: 'cel' }` envelopes are untouched.
-
-`ActionRunner`'s two execution gates already read the raw value and are
-unchanged; the objectui#3871 tripwires they carried have been replaced by pins
-of the now-converged behaviour.
-
-Whether `${…}` should be *authorable* on an action predicate at all is a
-separate, spec-side question (`@objectstack/spec`'s `PredicateInput` models a
-bare string and a dialect envelope): if it is to be rejected, that belongs in
-publish-time validation, not in a consumer that silently invents a verdict.
diff --git a/.changeset/predicate-scope-converge-3955-3957-3960.md b/.changeset/predicate-scope-converge-3955-3957-3960.md
deleted file mode 100644
index 09c22ccc7c..0000000000
--- a/.changeset/predicate-scope-converge-3955-3957-3960.md
+++ /dev/null
@@ -1,73 +0,0 @@
----
-"@object-ui/core": patch
-"@object-ui/react": patch
----
-
-Blank predicates and non-predicate values are no longer gates, at the last three entries that still judged them (objectui#3955, objectui#3957, objectui#3960)
-
-objectui#3850 sank "is a predicate gate DECLARED here?" into one definition,
-`@object-ui/core`'s `hasDeclaredPredicate`. Three places were left out of that
-ruling's placement clause, each with the same shape of defect: the evaluator's
-single default for "there is nothing here to evaluate" is `true`, meaning
-*visible/enabled*, and wherever a too-wide "declared" test hands it an empty
-predicate on an INVERTED key, that `true` turns a control off for a value the
-metadata never used to say anything.
-
-**`SchemaRenderer`'s `hidden` / `hiddenOn` legs (objectui#3955)** asked
-`!== undefined` and did NOT negate the verdict, so an empty predicate meant HIDE
-and the node disappeared — on the generic rendering path, since that block runs
-for every schema type. Harder to diagnose than the `disabled` twin objectui#3862
-fixed: a greyed-out control is still on screen, while a node that never rendered
-is indistinguishable from metadata that meant to hide it. Both legs now read the
-shared definition.
-
-**The "blank" criterion now covers the envelope spelling (objectui#3960).** The
-definition trimmed a whitespace-only STRING and not an envelope's whitespace-only
-`source`, because `toPredicateInput` folds a `source` of `''` and does not trim.
-So `{ dialect: 'cel', source: '   ' }` was a declared gate whose verdict came from
-core's own CEL entry calling that exact value "no predicate" (`if (!source.trim())
-return true`) — `disabled` greyed out forever and `ActionRunner.execute` answered
-`{ success: false, error: 'Action is disabled' }` with the handler never invoked.
-Blankness is now decided once for both spellings, at the definition. The
-NORMALIZER's contract is deliberately unchanged: "what shape does the evaluator
-accept" is not the same question as "is there a condition", and moving the trim
-there would have flipped verdicts for every
-`useCondition(toPredicateInput(…))` call site, including container-level `visible`
-reads that never asked this question at all.
-
-**`ActionEngine.getActionsForLocation`'s `visible` filter (objectui#3957)** was the
-last consumer answering the question with a range of its own — three empty
-spellings folded by hand, everything else coerced with `Boolean(raw)`. It now reads
-the shared definition and the coercion branch is gone, so one value no longer gets
-two answers depending on whether an action was surfaced by the engine or rendered
-standalone (the invariant objectui#3314 established). Its fail-CLOSED posture on a
-predicate that THROWS is untouched (`throwOnError: true` + `warnHiddenPredicate`):
-"the predicate faulted" and "there is no predicate" are different facts.
-
-Behaviour changes, before → after. Observation-class: each needs an author to write
-an empty/blank predicate or a non-predicate value, and there is no known user path
-today.
-
-| value | `ActionEngine` `visible` | `SchemaRenderer` `hidden` | `disabled` (action face + generic path) | `ActionRunner.execute` `disabled` |
-|---|---|---|---|---|
-| `''` / `null` | shown → shown | HIDDEN → rendered | unchanged | unchanged |
-| `'   '` (blank text) | HIDDEN → shown | HIDDEN → rendered | unchanged | unchanged |
-| `0` / `NaN` | HIDDEN → shown | HIDDEN → rendered | unchanged | unchanged |
-| `{}` / `[]` | shown → shown | HIDDEN → rendered | unchanged | unchanged |
-| `{ dialect: 'cel', source: '' }` | shown → shown | HIDDEN → rendered | unchanged | unchanged |
-| `{ dialect: 'cel', source: '   ' }` | shown → shown | HIDDEN → rendered | GREY → on | refused → runs |
-| `{ source: '   ' }` (no dialect) | HIDDEN → shown | HIDDEN → rendered | GREY → on | refused → runs |
-| `true` / `false` / bare CEL / `${…}` / a non-blank envelope | unchanged | unchanged | unchanged | unchanged |
-
-Every row moves toward "there is no gate here", never away from it, and no value
-that HAS a verdict changes it — a declared `false` is still a verdict, not a
-missing gate (objectui#3812), and blankness is `trim()`, not "short": `{ dialect:
-'cel', source: ' x ' }` is a predicate. One alias precedence changes with the
-`hidden` legs and is pinned rather than claimed as an equivalence: an undeclared
-`hidden` no longer short-circuits the chain, so a declared `hiddenOn` is finally
-consulted.
-
-`SchemaRenderer`'s four `visible*` legs keep `!== undefined` deliberately, as
-objectui#3850 ruled: their `true` is negated, so an empty predicate already lands
-on "shown", and narrowing them would change alias precedence rather than fix
-anything.
diff --git a/.changeset/pseudo-route-segment-flags-3638.md b/.changeset/pseudo-route-segment-flags-3638.md
deleted file mode 100644
index 4d475a7504..0000000000
--- a/.changeset/pseudo-route-segment-flags-3638.md
+++ /dev/null
@@ -1,9 +0,0 @@
----
-'@object-ui/app-shell': patch
----
-
-Match the built-in pseudo-routes on whole path segments, so a mistyped app name can no longer render a different app (objectui#3638).
-
-`AppContent` decides whether a URL is a built-in pseudo-route (`create-app`, `system/*`, `metadata/*`, `setup`) before it decides which app to render, and two of those switches were substring tests: `pathname.includes('/system')` and `pathname.includes('/metadata')`. Both are true for any segment that merely *starts* with the word — `system_log`, `system_setting`, `systems`, `metadata_import`, `metadata-export`. `isSpecialRoute` feeds `requestedAppMissing`, so visiting `/apps/<mistyped-app>/system_log` marked the URL as a pseudo-route, suppressed the "App not available" guard, fell back to the default app and rendered **that** app's shell with `system_log` taken as its object name — the exact "must NOT silently render a DIFFERENT app" case the fallback's own comment exists to prevent, with no indication that the requested app does not exist.
-
-The two flags now test path *segments* (`pathname.split('/').includes('system' | 'metadata')`); `isCreateAppRoute`'s `endsWith('/create-app')` is unchanged. Every real pseudo-route spells the word as a whole segment — `system/marketplace{,/installed,/:packageId}`, the host's `system/{apps,profile,approvals,ai-approvals,audit-log,settings,objects,metadata/…}`, `metadata/{,_diagnostics,:type,…}` and the legacy `component/metadata/{directory,resource/*}` aliases — so all of them stay special, including in the zero-app branch that keys on these flags directly (objectui#3590 / #3610). Knock-on, in a zero-app console only: a `system`-prefixed near-miss such as `/apps/setup/system_log` now reaches the same "No Apps Configured" screen every other unresolved URL there reaches, instead of the pseudo-route branch's "Page not found".
diff --git a/.changeset/quiet-doors-forward-bodyextra.md b/.changeset/quiet-doors-forward-bodyextra.md
deleted file mode 100644
index 546a985d84..0000000000
--- a/.changeset/quiet-doors-forward-bodyextra.md
+++ /dev/null
@@ -1,23 +0,0 @@
----
-'@object-ui/components': patch
-'@object-ui/core': patch
-'@object-ui/types': patch
----
-
-fix(actions): forward `bodyExtra` end-to-end through the action chain
-
-An action's static request body (`bodyExtra`) was dropped one hop before the
-`ActionRunner`: every action renderer forwards an explicit whitelist of keys, and
-none of them listed `bodyExtra`. Since `@objectstack/spec` 17 made it the only way
-a `type: 'api'` action can carry a payload (`params` keeps its single meaning as
-the parameter definition array), and the ADR-0087
-`inline-action-api-params-to-body-extra` conversion rewrites older object-form
-`params` pages onto it at load, a previously-working published page validated,
-published and then POSTed an empty body.
-
-`element:button`, `action:button`, `action:group`, `action:icon` and `action:menu`
-now forward the key; `ActionRunner.executeAPI` merges it into the request body
-**last** (so a constant always overrides a same-named user param, matching the
-console `apiHandler`); `ActionSchema` declares it; and a non-array `params` on a
-`type: 'api'` action keeps working for one version window with a dev-mode
-deprecation warning naming `bodyExtra`.
diff --git a/.changeset/quiet-moons-inherit.md b/.changeset/quiet-moons-inherit.md
deleted file mode 100644
index 812da90a35..0000000000
--- a/.changeset/quiet-moons-inherit.md
+++ /dev/null
@@ -1,26 +0,0 @@
----
-"@object-ui/app-shell": patch
-"@object-ui/core": patch
----
-
-Action params that inherit a field's options now keep the keys that field declared
-
-A field-backed action param (`{ field: 'tier' }`) had its inherited option list
-rebuilt entry by entry as `{ label, value }`, which silently dropped every other
-key the field's options declared — most consequentially the per-option
-`visibleWhen` predicate (ADR-0058). A select field whose options narrow by
-predicate in an object form therefore offered the FULL list in an action dialog,
-including the entries the predicate exists to hide, with no diagnostic on either
-side; `color` / `icon` / `disabled` were lost the same way. Options authored
-inline on the param were never affected — they always passed through verbatim,
-which is the asymmetry this restores.
-
-The resolver now preserves each inherited entry and only does its two real jobs:
-expanding bare strings into label/value pairs and translating the label through
-`fieldOptionLabel`. The option widgets already filter on `visibleWhen`, so a
-role-gated option (`'admin' in current_user.positions`) inherited by a dialog
-param now narrows the offered set and clears a seeded value the predicate hides.
-
-`ActionParamDef.options` (`@object-ui/core`) and the resolver's `RawActionParam`
-are widened to match: `ActionParamOption` names the two keys the param layer
-reads and carries the rest of a field's option vocabulary through.
diff --git a/.changeset/quota-error-envelope-3491.md b/.changeset/quota-error-envelope-3491.md
deleted file mode 100644
index a77ff447c3..0000000000
--- a/.changeset/quota-error-envelope-3491.md
+++ /dev/null
@@ -1,24 +0,0 @@
----
-'@object-ui/plugin-chatbot': patch
----
-
-`parseAiQuotaError` now reads the AI quota refusal code from all three shapes the
-cloud 429 producers use, instead of only the flat `error`-holds-the-code dialect.
-
-The two live producers fill the same `error` key in opposite ways — the token
-guardrail puts the **code** there, `service-ai` puts the **message** there and the
-code in a `code` sibling — while ADR-0112 declares a third shape both are
-converging on: `{ success: false, error: { code, message } }`. The consumer had to
-learn the declared shape **first**, or the producers' convergence would silently
-turn every quota refusal back into a generic "Response failed" banner (the same
-consumer-first sequencing as objectui#2992).
-
-- Code lookup order is a total order — declared envelope, then the flat guardrail
-  code, then the `code` sibling — so a transitional producer that double-emits the
-  new envelope alongside the legacy top-level keys has one defined outcome.
-- Only the code's **location** widens. The recognized code set is unchanged, and
-  any unrecognized shape still degrades to today's behavior (`null`), so no
-  non-quota error is newly captured by the quota CTA.
-- Companion fields (`upgrade`, `topUp`, `messageEn`) keep their established
-  top-level read; their position inside the declared envelope is deliberately not
-  presumed, and is aligned once the producer PR fixes the real shape.
diff --git a/.changeset/raw-key-call-sites-slice-one.md b/.changeset/raw-key-call-sites-slice-one.md
deleted file mode 100644
index 47ad4c8332..0000000000
--- a/.changeset/raw-key-call-sites-slice-one.md
+++ /dev/null
@@ -1,17 +0,0 @@
----
-'@object-ui/i18n': patch
-'@object-ui/app-shell': patch
-'@object-ui/plugin-detail': patch
-'@object-ui/plugin-gantt': patch
-'@object-ui/plugin-form': patch
----
-
-The five locale keys behind #3546's eight no-fallback `t()` call sites are now defined in all ten packs, so the built-in-view toasts, the activity-timeline source link, the wizard's required-field toast and the Gantt refresh button's accessible name are translated instead of falling back to English — or, on two surfaces, to the key itself (part of #3546).
-
-`scripts/check-i18n-call-site-keys.mjs` measured 258 keys that a `t()` call site asks for and no pack defines. These five were the subset with no working inline default: `console.objectView.cannotEditMetaView`, `console.objectView.cannotDeleteMetaView`, `detail.viewSource`, `gantt.toolbar.refresh` and `wizard.missingRequired`. Adding a `defaultValue` is deliberately not the fix — that mechanism is what kept all 258 invisible for months.
-
-**Two of the eight sites really did render the raw key**, and both go through a binding with nothing in front of i18next. `ObjectView.tsx` calls `useObjectTranslation()` directly, so five toasts read `console.objectView.cannotEditMetaView` / `cannotDeleteMetaView` on screen; the `|| 'Built-in views cannot be renamed.'` guards next to them were dead on every path, because i18next answers a miss with the key itself and a non-empty string never falls through `||`. Those four unreachable English strings are removed rather than repaired: one key served four call sites (rename / pin / set-as-default / configure), so the pack copy covers any change to a built-in view instead of naming one operation. `RecordActivityTimeline.tsx` fails the same way for a subtler reason — `useDetailTranslation` is `createSafeTranslation(..., 'detail.back')`, and because `detail.back` does resolve, the probe hands back i18next's `t` for every key and bypasses the defaults map wholesale, so `detail.viewSource` reached the user verbatim.
-
-**The other two sites were not rendering a raw key**, contrary to the issue's description, and are fixed here as the milder "English in all ten languages" class. `wizard.missingRequired` is its own hook's probe key, so the probe failed and `createSafeTranslation` correctly served its English default. `gantt.toolbar.refresh` goes through `useGanttTranslation`, which deliberately does not use `createSafeTranslation` and falls back per key — so the refresh button's `aria-label` was "Refresh", in English, never the key. Screen-reader users heard an English word rather than an identifier; a `zh` session now hears 刷新.
-
-Regression cover is provider-mounted on purpose: with no `I18nProvider` the defaults maps answer every one of these keys and the assertions pass while the console is broken, which is precisely the false-green the issue documents. For the two sites whose English output was already correct, `en` cannot discriminate before from after — the `zh` assertions are the ones that pin the fix.
diff --git a/.changeset/react-runtime-peer-upper-bound-3741.md b/.changeset/react-runtime-peer-upper-bound-3741.md
deleted file mode 100644
index a38a7ef875..0000000000
--- a/.changeset/react-runtime-peer-upper-bound-3741.md
+++ /dev/null
@@ -1,13 +0,0 @@
----
-'@object-ui/react-runtime': patch
----
-
-Give `@object-ui/react-runtime`'s React peer range an upper bound: `peerDependencies.react` narrows from `>=18` to `^18.0.0 || ^19.0.0`, the spelling the other 30 react peers in the fixed version group already declare (objectui#3741).
-
-An unbounded range is a promise that grows on its own. `>=18` satisfies React 20 the day React 20 is published — a major this package has never been built against, let alone tested — and it makes that claim from an already-published manifest, with no commit and no review to point at. This package is the least appropriate place in the workspace for such a promise: it vendors react-runner and evaluates author-supplied JSX against the *host's* React, so a host on an untested major does not fail at this package's boundary, it fails somewhere inside the page it rendered.
-
-Nothing in the package wanted the wider range. Its entire React surface is `Component`, `createElement`, `isValidElement`, `ReactElement` and `ReactNode`, all unchanged in React 19 and none of them touching anything React 19 removed. The range was never a stated constraint either: `>=18` was written when the package was created on 2026-06-30 (`d23d6ebfa`, PR #2105) and no commit since revisited the line. The workspace pins React to `19.2.8` through the root `pnpm.overrides`, so 19 is the only major this package's tests have ever exercised — the unbounded upper end was untested by construction.
-
-The README sentence restating the range moves with it, and the doc gate that compares the two (`doc-version-claims.test.ts`, objectui#3717) keeps them in step from here.
-
-A new pin, `scripts/__tests__/react-peer-range-norm-3741.test.ts`, now asserts the norm across every workspace manifest, because this was the third package born off-norm and the first two were each corrected in isolation: `plugin-dashboard` was born narrow and fixed on 2026-05-08 (`d2b6ecec6`), `plugin-report` was born narrow and fixed in objectui#3690 (PR #3727) after a React 19 consumer hit `ERESOLVE` on install, and this one was born unbounded. The existing doc gate could not have caught any of them — it checks a README against its own manifest, and react-runtime's two sides agreed with each other while both said `>=18`.
diff --git a/.changeset/reclaim-natural-gesture-names-3363.md b/.changeset/reclaim-natural-gesture-names-3363.md
deleted file mode 100644
index 2b9da77a1a..0000000000
--- a/.changeset/reclaim-natural-gesture-names-3363.md
+++ /dev/null
@@ -1,58 +0,0 @@
----
-"@object-ui/types": minor
-"@object-ui/mobile": minor
----
-
-Reclaim the natural names `GestureType` and `GestureConfig` (objectui#3363).
-
-`@objectstack/spec` 17.0.0-rc.3 deleted the whole `ui/touch` module
-(objectstack#4988, PR objectstack#5321), vacating three names objectui had
-renamed **away from** in objectstack#4115 purely to avoid a collision. Two of
-those workarounds have now outlived their reason and are undone.
-
-## Breaking, in FROM → TO form
-
-- `TouchGestureType` → **`GestureType`** — objectui's direction-fused recogniser
-  vocabulary (`tap`, `swipe-left`, `swipe-up`, …).
-- `TouchGestureConfig` → **`GestureConfig`** — the flat gesture→`action` handler
-  binding.
-
-Both are exported from `@object-ui/types` and re-exported by `@object-ui/mobile`.
-Nothing about either shape changed: same members, same optionality. Consumers
-import the new name; there is no other edit.
-
-**The old names are gone, not deprecated.** This follows the precedent set by the
-objectstack#4115 rename batch that introduced them, whose own migration note reads:
-"an alias would preserve exactly the ambiguity being removed". A deprecated alias
-would be worse here than in the general case, because the ambiguity these renames
-exist to prevent is between two same-named types — leaving `TouchGestureType`
-alive next to `GestureType` restores the two-spellings-one-concept problem while
-claiming to retire it.
-
-The retired spec vocabulary that used to hold these names still lives in
-`@object-ui/types`' `mobile` module under its deliberate `Spec…` prefix
-(`SpecGestureType`, `SpecGestureConfig`, `SwipeGestureConfig`, …), and that prefix
-is untouched — it is now the only thing distinguishing the two contracts, so
-`useSpecGesture` still maps one onto the other exactly as before.
-
-## `PWAOfflineConfig` is deliberately NOT reclaimed
-
-The spec vacated `OfflineConfig` in the same retirement, but the spec was never
-its only claimant: that rename was a **cross-package arbitration between two
-objectui packages**, and `@object-ui/react` won it. `useOffline`'s config is the
-offline data/sync model key for key, so it holds the bare `OfflineConfig`, while
-this package's service-worker route cache stays `PWAOfflineConfig`
-(objectui#3156 / objectui#3159).
-
-Before objectui#3560 that name reached `@object-ui/react` from the spec, so the
-spec-side tripwire covered it by accident. Since the retirement it is declared
-locally in `packages/react/src/hooks/useOffline.ts`, which means the spec's
-vacancy no longer says anything about whether the name is free — it is not.
-Reclaiming it would put two different `OfflineConfig` shapes on the public
-surface of two packages that are routinely imported together, which is the exact
-ambiguity objectstack#4115 renamed it away from.
-
-`page-nav-misc-spec-parity.test.ts` now pins that reason directly instead of
-leaving it as prose: it asserts `@object-ui/react` still declares
-`OfflineConfig`, and its failure message tells the next reader that the reclaim
-has become available if it ever stops.
diff --git a/.changeset/record-details-sections-description-3807.md b/.changeset/record-details-sections-description-3807.md
deleted file mode 100644
index 8fd00b1ef4..0000000000
--- a/.changeset/record-details-sections-description-3807.md
+++ /dev/null
@@ -1,32 +0,0 @@
----
-"@object-ui/plugin-detail": patch
----
-
-`record:details` 的 `sections` 输入说明改为从 spec 形状派生的对象形,不再教已被退役的「Section IDs」
-
-`inputs` 不是文档,而是发布出去的编写契约:`gen-manifest.ts` 把它序列化进
-`sdui.manifest.json`(保存门 + parser 白名单)和 `sdui-intrinsics.d.ts`。而
-`record:details.sections` 的说明写的是 `Section IDs to show (required when layout
-is "custom")` —— 那是 17.x 以前的形状。pin 版 `@objectstack/spec@17.0.0-rc.5` 的
-`RecordDetailsProps.sections` 是对象数组 `{ name?, label?, columns?, fields }`,
-objectstack#5611 把 `z.array(z.string())` 那条拼法**删掉**而不是 union 进来(既无
-producer 也无 consumer,一种形状而不是两套事实契约)。
-
-照旧说明写 `sections: ['contact_info', 'address']` 的作者,在四层之间拿不到任何
-诊断:`['a','b']` 对 manifest 门是合法 `array`(门只看顶层键名 + 粗类型),上游
-`validateComponentProps` 是 advisory 级,spec 只在真的走 parse 的路径上才拒,而
-`RecordDetailsRenderer` 对每个条目读 `s.name` / `s.label` / `s.fields` —— 字符串上
-三者全 `undefined`,该 section 一个字段都不渲染。`layout: 'custom'` 时 sections 是
-详情页正文的唯一来源,所以结果是一张没有报错的空白详情页。
-
-新说明逐键派生自 spec 各成员的 `.describe()` 与渲染器实读:`fields` 必填、按序渲染;
-`label` 是标题(省略即无标题、无边框);`name` 是 snake_case 稳定标识与 i18n 锚点
-(标题走 `objects.{object}._sections.{name}.label`);`columns`(1-4)是本 section 的
-字段栅格宽度,省略则由渲染器推导;并明确写出字符串条目不被接受。渲染器另外还认的
-`title` / `showBorder` / `hideEmpty` **故意不写进说明** —— spec 的 section 对象没有
-声明它们,parse 时会被静默剥掉,发布它们等于教作者写契约丢弃的键。
-
-同时新增 `recordDetailsInputs.spec-parity.test.ts`:两个方向的断言都在运行时从 spec
-schema 派生(每个 spec 成员键都能从说明里发现;本 block 不声明 spec 不接受的顶层
-input),所以下一次 spec 变形会先让测试红,而不是又一次静默张开。仅说明文本变化,无
-运行时行为改动。
diff --git a/.changeset/record-details-sections-name-anchor-3819.md b/.changeset/record-details-sections-name-anchor-3819.md
deleted file mode 100644
index 96c6a5f658..0000000000
--- a/.changeset/record-details-sections-name-anchor-3819.md
+++ /dev/null
@@ -1,56 +0,0 @@
----
-"@object-ui/app-shell": patch
----
-
-`record:details` section editor now offers the `name` i18n anchor
-
-The page block inspector's `record:details` → Sections editor exposed
-`label` / `columns` / `fields` and silently omitted `name`. That key is not
-decoration: it is the section heading's i18n anchor. `plugin-detail`'s
-`record-details` renderer resolves the heading through
-`objects.<object>._sections.<name>.label` and falls back to the authored string
-whenever `name` is absent —
-
-```
-const translatedTitle = s.name && objectName
-  ? sectionLabel(objectName, s.name, rawTitle ?? s.name)
-  : rawTitle;
-```
-
-— so every section built in Studio was untranslatable by construction: one
-authored string in every locale, plus an upstream
-`translation-section-name-missing` diagnostic the author had no control to
-clear. The key was reachable only by hand-editing source, which is precisely
-what a designer exists to avoid.
-
-The new `Name (i18n key)` text box sits first in each section entry, matching
-`page:tabs` / `page:accordion` where the stable identifier precedes the human
-label. Its placeholder carries the snake_case convention, because
-`BlockPropField` has no description or pattern affordance — the same reason the
-suite already requires every `json` field to carry a shape placeholder.
-
-Two authoring decisions, both deliberate and both pinned:
-
-**The anchor is never derived from `label`.** `InspectorTextField` does expose an
-`onBlur` hook for deriving a dependent field, and the block-config renderer
-deliberately leaves it unwired here. A label may already be localized prose — or
-an inline `{ en, 'zh-CN' }` map, which `record-details` runs through
-`pickLocalized` — and seeding an anchor from it freezes one locale's text into
-the one value that must stay locale-independent. Worse, it would be invisible:
-the renderer falls back to the authored label when a translation misses, so a
-wrongly-derived anchor renders exactly like the bug it was meant to fix, until
-someone adds a second locale.
-
-**Sections authored before this field existed are not backfilled.** They open
-with the anchor box empty and their `label` untouched; nothing is written until
-the author types. This needs no code — the inspector is read-through, writing
-only from a commit handler — and the alternative would mark an untouched page
-dirty merely for being opened.
-
-No validation was added. `BlockPropField` has no pattern/validate capability,
-and inventing one for a single field is out of scope; the placeholder states the
-convention and the upstream lint rule remains the enforcement point.
-
-Coverage for this block's section entry is now derived from the spec's own
-`RecordDetailsProps` shape rather than hand-listed, so the next section key the
-spec grows fails loudly here instead of quietly never reaching the designer.
diff --git a/.changeset/record-header-manual-refresh-3460.md b/.changeset/record-header-manual-refresh-3460.md
deleted file mode 100644
index fbca14bf6b..0000000000
--- a/.changeset/record-header-manual-refresh-3460.md
+++ /dev/null
@@ -1,17 +0,0 @@
----
-"@object-ui/app-shell": patch
-"@object-ui/components": patch
-"@object-ui/plugin-detail": patch
----
-
-Record detail pages: a header ⟳ that refreshes the record, its related lists and its tab counts in place — no browser reload
-
-Concurrent-editing scenario from the shop floor (MES work orders): operator A sits on a record's detail page while operator B starts or reports the same order. A had no way to see the new state except F5, which throws away the open tab, the scroll position and any in-progress inline edit along with the stale data.
-
-The pipeline for this already existed — the objectui#2269 invalidation bus refetches every mounted reader in place, and `RecordContext.refresh` had been declared for it — but nothing produced that field and no UI reached for it. Three changes give it a trigger:
-
-- **`RecordDetailView` produces `RecordContext.refresh`**, publishing `notifyDataChanged({ objectName: '*' })`. The wildcard is deliberate: a user reaches for refresh because of a write made by SOMEONE ELSE, which this client never saw and therefore cannot attribute to particular objects. `'*'` marks everything mounted as stale, so the main record, every related child list and the tab-count badges all refetch — no remount, so tab / scroll / draft state survive. First phase covers the standalone record route; embedded hosts (list drawer, split-pane preview) keep their existing chrome unchanged.
-- **`page:header` renders the ⟳** at the far end of the header row when — and only when — the host provides `refresh`. It is page chrome rather than a header action, so its position is the same on every record page regardless of which business actions the object declares, and it can never be collapsed into the `⋯` overflow. Styled as that `⋯` trigger's twin so the row reads as one button family. Its accessible name and tooltip come from the existing `common.refresh` key, so the icon-only button is not English-only in the other nine locales. The icon spins for a short floor after a click, because the bus is fire-and-forget and a warm backend would otherwise finish before the click looked like it landed.
-- **`RelatedList` accepts the `'*'` wildcard** on the legacy `objectui:related-changed` event, matching what `dataChangeMatches` already does for the bus's own readers. This listener compared the payload's object name to its own, so a wildcard invalidation reached everything on the page except the related lists — a concrete foreign object name is still ignored.
-
-Hosts that provide no `refresh` render exactly as before.
diff --git a/.changeset/record-page-declared-approval-actions-3055.md b/.changeset/record-page-declared-approval-actions-3055.md
deleted file mode 100644
index 045571c809..0000000000
--- a/.changeset/record-page-declared-approval-actions-3055.md
+++ /dev/null
@@ -1,16 +0,0 @@
----
-'@object-ui/app-shell': patch
----
-
-Run `sys_approval_request`'s server-declared decision actions on the business record page, and retire the hard-coded two-button approval path (objectui#3055).
-
-A record with an approval pending on it showed exactly two buttons — Approve and Reject — hand-written into the record header behind a bespoke `type:'approval'` handler and a client-side approver test. The approvals list, looking at the same request over the same nine REST routes, offered five decisions plus the submitter's levers and took decision attachments. On a business record, **reassign / send back / request info had no entry point at all**, a decision could not carry a file, and the copy on the two surfaces was maintained separately.
-
-The record page now renders the object's own declared actions through the shared declared-action bar — the same metadata, the same action runtime, the same param dialogs the approvals list uses. Approve, Reject, Reassign, Send back and Request info reach a business record, with their declared params (comment, attachments, the new approver picker) and the per-request decision outputs an approval node declares. Remind stays with the approvals panel, which owns a richer, throttle-aware version of it. Adding a tenth decision action is now a metadata change with no console work.
-
-Two behaviour changes come with it:
-
-- **Who sees a decision is the server's answer, not the console's.** Visibility was `pending_approvers.includes(currentUserId)` evaluated in the browser; it is now each action's declared `visible` predicate over the server-computed `viewer` block (`can_act` / `is_submitter` / `can_override`) — the same block that gates the approvals list, computed by the same service that authorizes the decision. A platform or tenant admin's override levers, the recovery path for a request routed to an unstaffed position, now reach the record page for the first time. On a backend too old to send `viewer`, the predicate cannot be evaluated and no decision is offered rather than one whose precondition is unknown.
-- **A declared `visible` written against the canonical `record.` root now evaluates.** The declared-action bar passed the row in as the bare predicate scope, so only the shorthand spelling (`status == "pending"`) resolved; `record.viewer.can_act` raised `record is not defined`, and the fail-closed gate turned that into "hidden". Every declared action on `sys_approval_request` gates on `record.viewer.*`, so the whole server-declared decision set was invisible on every surface this bar renders, the approvals inbox included. The row now binds the three ways the record header and list rows bind it — `record.status`, bare `status`, `data.status` — so both spellings reach a verdict.
-
-`useRecordApprovals` keeps only its read half (status, `lock_record`, the request rows). Its `canDecide` / `approve` / `reject` members and its `currentUserId` parameter are gone: deciding is the declared action's POST, and every remaining question about the viewer is answered on the row by the server.
diff --git a/.changeset/registry-inputs-spec-parity-gate-3797.md b/.changeset/registry-inputs-spec-parity-gate-3797.md
deleted file mode 100644
index 91a29c4934..0000000000
--- a/.changeset/registry-inputs-spec-parity-gate-3797.md
+++ /dev/null
@@ -1,25 +0,0 @@
----
----
-
-Internal test-only gate, no behaviour or authoring-surface change (objectui#3797).
-
-Generalizes PR #3795's single-block `record:highlights` parity check to every
-`@objectstack/spec` `ComponentPropsMap` entry this repo registers with a
-non-empty `inputs`: a block may not DECLARE a top-level input the spec's props
-schema does not accept, with the expectation derived from the spec's own shape at
-runtime and every current divergence registered in an explicit exemption list
-that carries a reason and a tracking issue per entry.
-
-No package is declared because no published behaviour changed: the four blocks
-objectui#3797 flagged (`page:header`, `page:tabs`, `page:accordion`,
-`element:record_picker`) keep their `inputs` byte for byte. Per-block verdicts
-came out on the spec side, not this one — the keys are read by the renderers and
-reachable by authors, so the fix is upstream declaration (objectstack#6776) or,
-for `element:record_picker`, already landed upstream in objectstack#5775 and
-merely awaiting a `@objectstack/spec` pin bump here. Narrowing them locally would
-have deleted live configuration; widening the spec is not this repo's to do
-(AGENTS.md #0 / #0.1).
-
-The exemptions expire by themselves: the gate fails on any entry whose key the
-spec has since declared, so the pin bump and the upstream landing each force
-their own cleanup instead of leaving a permanent allowlist.
diff --git a/.changeset/related-list-add-picker-filter-3831.md b/.changeset/related-list-add-picker-filter-3831.md
deleted file mode 100644
index 8a5189fae2..0000000000
--- a/.changeset/related-list-add-picker-filter-3831.md
+++ /dev/null
@@ -1,17 +0,0 @@
----
-"@object-ui/fields": patch
-"@object-ui/plugin-detail": patch
----
-
-相关列表 Add 选择器兑现 `add.picker.filter`:作者限定的候选范围现在真的生效
-
-`record:related_list.add.picker.filter` 被 spec 声明为「Restrict which records the picker offers」,但渲染器从未读过它 —— 挂 `RecordPickerDialog` 时不传任何 filter,对话框照样提供 `picker.object` 的全部记录,选中即建链接行或改父,`os validate` / `os build` 全绿、运行时零诊断。作者写下「只允许指派 active 的岗位」「只允许挂未过期的许可」,得到的是完整候选列表。
-
-现在它按原样传给 `RecordPickerDialog` 的 `baseFilter` —— 不是 `lookupFilters`,后者会把条件渲染成用户可编辑的筛选栏行,等于把作者的硬性限制降级成建议。
-
-`baseFilter` 因此接受两种形状,按结构判别(`Array.isArray`):
-
-- **`QueryParams.$filter` 记录形式**(依赖型 lookup 链)保持原有的键覆盖语义逐字节不变 —— 级联父值必须**替换**同字段上过期的 `lookupFilters` 条目,而不是与之求交。
-- **spec 的 `ViewFilterRule[]`** 经 `mergeFilterNodes`(仓内唯一的 filter 下沉口)下沉,19 个 operator 全部无损到达服务端,包括记录形式没有 `$op` 可用的 `before` / `after` / `is_empty` / `is_not_empty`。此处**不新增**第二份 operator 词汇表。
-
-槽位类型同时从 `Record<string, any>` 收紧为 `unknown`:前者会接受规则数组(数组满足 `any` 的字符串索引),旧的对象展开再把它压成 `{"0": {...}}`,于是查询去过滤名为 `0` 的列 —— 类型全绿、查询错误、无任何诊断。
diff --git a/.changeset/related-list-add-picker-guard-3838.md b/.changeset/related-list-add-picker-guard-3838.md
deleted file mode 100644
index d450a8e6c7..0000000000
--- a/.changeset/related-list-add-picker-guard-3838.md
+++ /dev/null
@@ -1,7 +0,0 @@
----
-'@object-ui/plugin-detail': patch
----
-
-`record:related_list`: an `add` without `add.picker` no longer takes the whole related list down.
-
-The Add-picker gate compared only `add` for truthiness and then read `add.picker.object` bare, so page metadata declaring `add` but omitting the (spec-required) `picker` threw during render and `SchemaRenderer` replaced the entire related list with a "Component failed to render" card whose message never mentioned `picker`. Both the Add button and the picker dialog now gate on the resolved `add.picker.object` — the list body renders as usual, only the unconfigured Add affordance is withheld, and a console hint names the missing key. Off-spec `add` still does nothing, so no lenient second dialect is introduced; producing-side validation of page metadata is tracked separately.
diff --git a/.changeset/related-list-filter-and-add-gate.md b/.changeset/related-list-filter-and-add-gate.md
deleted file mode 100644
index 2b7a8c157e..0000000000
--- a/.changeset/related-list-filter-and-add-gate.md
+++ /dev/null
@@ -1,25 +0,0 @@
----
-'@object-ui/plugin-detail': patch
----
-
-`record:related_list` — the declared `filter` reaches the query, and the Add button answers to the same gate as its dialog
-
-- **`filter` is consumed** (objectstack#7118). The spec declares
-  `RecordRelatedListProps.filter` ("additional filter criteria") and this repo
-  published it as a registry input, but nothing read it: `RelatedList` built its
-  query from `{ [relationshipField]: parentId }` alone, so an authored filter was
-  accepted by every gate and silently dropped — the list answered with every child
-  of the parent. It is now AND-combined with the parent condition (never
-  substituted for it, so an additional criterion can only narrow), lowered through
-  the repo's single filter sink so the spec's `[{ field, operator, value }]`
-  vocabulary and a composed `dataSource` binding both work. With nothing authored
-  the query is unchanged. As a consequence a saved view named through
-  `dataSource: { object, view }` no longer contributes its columns/sort/limit while
-  its filter is discarded — the list can no longer be wider than the view it names.
-  On the legacy raw-URL fallback path, which cannot express an operator, a declared
-  filter is refused with a console explanation instead of dropped.
-- **The Add button now requires `dataSource`** (objectui#3895), matching the picker
-  dialog and the add callback. In hosts that supply no `RecordContext` — Studio
-  designer previews, context-free embeds — the button rendered and did nothing at
-  all when clicked; the affordance is now withheld where the capability behind it
-  is absent.
diff --git a/.changeset/remaining-setup-links-3611.md b/.changeset/remaining-setup-links-3611.md
deleted file mode 100644
index 0ad340074c..0000000000
--- a/.changeset/remaining-setup-links-3611.md
+++ /dev/null
@@ -1,15 +0,0 @@
----
-'@object-ui/app-shell': patch
----
-
-Point the four remaining "Settings" senders at the system hub `/apps/setup/system` instead of the bare `/apps/setup` (objectui#3611).
-
-Same root cause as objectui#3590, which fixed the three call sites inside its declared file surface: `AppContent` mounts the system hub only under `isSystemRoute`, which keys on a `/system` path segment, so on a zero-app deployment the bare `/apps/setup` *is* the "No Apps Configured" empty state's own URL and every entry spelling it looped in place.
-
-Three of the four are live defects, all reachable on a zero-app deployment today:
-
-- `AppSidebar`'s no-active-app sidebar header (`system-sidebar-header`) — the sharpest of them, since it renders *only* when there is no active app, i.e. it was unreachable except in exactly the state where its target was broken.
-- `AppSidebar`'s user-menu "Settings" entry.
-- `SystemRedirect`'s bare `/system` legacy bookmark. This forwarder was already half right — every *suffixed* bookmark (`/system/users`) was correctly rewritten to `/apps/setup/system/users`, and only the bare one dropped the `system` segment. The bare branch now agrees with the suffixed branch beside it; no new logic.
-
-The fourth, `QuickActions`' "System Settings" card, is dormant — the component has zero JSX call sites repo-wide, so no user can reach it today. It is corrected in the same pass so the dead link cannot return with the component if it is ever remounted.
diff --git a/.changeset/residue-locale-keys-3546-slice7.md b/.changeset/residue-locale-keys-3546-slice7.md
deleted file mode 100644
index be9bcf7b5e..0000000000
--- a/.changeset/residue-locale-keys-3546-slice7.md
+++ /dev/null
@@ -1,63 +0,0 @@
----
-"@object-ui/i18n": patch
----
-
-Backfill the last 17 missing locale keys and both remaining template-key families, emptying the call-site key ratchet (objectui#3546, slice seven — final)
-
-`scripts/check-i18n-call-site-keys.mjs` (objectui#3530) opened this backlog with
-**258 keys and 4 template-key families** that a `t()` call site asks for and that
-**no locale pack defined**. Seven slices later the last of it is paid: this change
-takes the ratchet from 17 keys to **zero** and from 2 prefix families to **zero**,
-and the gate now reports every one of the **2320** literal call-site keys
-resolving against `en`.
-
-The residue was the long tail — nine namespaces across `app-shell`,
-`plugin-detail`, `plugin-dashboard`, `plugin-kanban` and `plugin-gantt`, none of
-them big enough to have been its own slice. 17 distinct keys at **23** call sites
-(five keys are used at more than one site) plus **3** call sites behind the two
-families.
-
-What that meant on the page for a `zh` (or `ja`, `de`, `ar`, …) user: the "App not
-available" empty state a user lands on when an app is still publishing, including
-its whole explanation and its Retry button; the interface page's "source is not
-available" message; the system navigation's **Administration** group header,
-**Datasources** and **Documentation** entries; the "creating new organizations is
-disabled on this instance" guard in the workspace dialog; the invitation list's
-five status labels (All / Pending / Accepted / Rejected / Canceled) on both the
-filter tabs and every invitation badge; the Gantt dependency-drag hint that names
-which endpoint the drop will link (`start` / `end`); the record detail's Add,
-"Record deleted", "No history yet" and the concurrent-update dialog's "this
-record"; the kanban empty board's column count; the dashboard widget's screen
-reader "Loading…"; and the page editor's "Edit in studio" tooltip and accessible
-name. All of it rendered English, in every one of the ten languages.
-
-Nothing here rendered a raw key — slice one (PR #3583) held those sites, and the
-three keys the issue body named as unprotected (`detail.viewSource`,
-`wizard.missingRequired`, `gantt.toolbar.refresh`) have resolved in `en` since.
-
-Both families are repaired as **enumerations, not wildcards**, and the assertion
-that used to live in the ratchet's `missingPrefixes` moves into a test that fails
-if either union grows a member without a key:
-
-- `gantt.linkEnd.` — the closed union `'start' | 'end'`, declared by GanttView's
-  own `linkDrag` state.
-- `organization.invitations.status.` — `StatusFilter`
-  (`all | pending | accepted | rejected | canceled`), declared by InvitationsPage.
-
-Every `en` value is byte-identical to the English the call site rendered before,
-so no string a user sees today changes: 16 keys match an inline
-`t(key, { defaultValue: … })`; `dashboard.loading` matches `useSafeTranslate`'s
-positional fallback `tt(key, 'Loading…')`; `gantt.linkEnd.*` match
-`useGanttTranslation`'s per-key fallback map; and the five status labels match the
-CSS-capitalised wire value each badge and tab showed. The nine translations follow
-each pack's own neighbourhood and reuse an existing neighbour's row wherever the
-`en` string already existed verbatim **and** that row is grammatical here — the
-four invitation adjectives are deliberately not reused from the approvals family,
-because those agree with each pack's word for "request" (`ru` masculine `Отклонён`)
-while an invitation needs its own agreement (`ru` neuter `Отклонено`).
-
-`scripts/i18n-call-site-key-baseline.json` is kept rather than deleted: empty is
-its terminal, load-bearing state — against an empty baseline any NEW unresolved
-call-site key is unexpected and fails the build.
-
-No component changed.
diff --git a/.changeset/row-action-declared-visible-gate-3758.md b/.changeset/row-action-declared-visible-gate-3758.md
deleted file mode 100644
index 4de3afb389..0000000000
--- a/.changeset/row-action-declared-visible-gate-3758.md
+++ /dev/null
@@ -1,33 +0,0 @@
----
-"@object-ui/plugin-grid": patch
-"@object-ui/components": patch
----
-
-Row actions declaring `visible: false` are now hidden instead of rendered
-
-A custom row action's visibility **gate** was detected by truthiness, so
-`visible: false` — the most explicit way an author can say "never show this" —
-fell into the "no gate declared" branch and the action rendered for every row.
-Both surfaces of the ObjectGrid row cell (the "⋮" overflow item and the inline
-`variant:'primary'` button) and the data-table's row overflow menu read the same
-gate, so all three rendered it; the `#3562` emptiness guard counts with that same
-gate, so a row whose only action was `visible: false` also grew a "⋮" it could
-not fill.
-
-The gate now detects a **declared** gate by `!= null && !== ''` and lets the
-declaration itself decide — a boolean short-circuits to its own verdict rather
-than being handed to the CEL engine. This is the invariant objectui#3492 already
-established for the selection bar, whose `hasVisibilityGate` spells out why
-truthiness cannot answer the question, and the same `!= null` posture the
-built-in `visibleWhen` gate has always had. `visible: true` still renders,
-`''` and an absent `visible` are still no gate at all, and no expression-valued
-`visible` changes verdict.
-
-Behaviour change surface, deliberately narrow: only an action whose `visible` is
-the literal boolean `false` (or another falsy non-empty value) changes — it goes
-from rendered to hidden, which is what the declaration asked for.
-`ActionSchema.visible` is `ExpressionInputSchema` with no boolean member, so
-`objectstack build` cannot emit this shape; hand-written view JSON and
-in-process callers constructing defs can, and did. The three row surfaces now
-reach the same verdict as the selection bar and the record page header for every
-non-expression shape, which `predicate-surface-parity` pins.
diff --git a/.changeset/row-action-inline-slot-survivors-3762.md b/.changeset/row-action-inline-slot-survivors-3762.md
deleted file mode 100644
index b831dd67ad..0000000000
--- a/.changeset/row-action-inline-slot-survivors-3762.md
+++ /dev/null
@@ -1,39 +0,0 @@
----
-"@object-ui/plugin-grid": patch
----
-
-Grid row actions: the inline button budget is now spent on the primaries that actually render
-
-`RowActionMenu` allocated its inline slots on the **declared** row actions, before
-any `visible` predicate ran:
-
-```ts
-const primaryDefs = gatedActionDefs.filter(d => d.variant === 'primary');
-const inlineDefs = primaryDefs.slice(0, Math.max(0, maxInlineActions));
-```
-
-So on a row where the *leading* `variant: 'primary'` action was suppressed by its
-own `visible`, that action still held the slot — `RowActionInlineButton` returned
-`null` into it — while the next primary, the one that *did* survive the row's
-predicates, had already been sliced into the overflow list. The row then rendered
-**no inline button and a "⋮" hiding its main CTA**, even though exactly one primary
-was visible and `maxInlineActions` (default 1) allowed exactly one inline button.
-
-Slot allocation now happens inside `planRowActionMenu`, after visibility, so the
-budget is only ever spent on a primary that renders. `maxInlineActions` is
-unchanged in meaning and default — it is a width budget for real buttons, and
-counting an invisible action against it protected no layout.
-
-Behaviour change surface, deliberately narrow:
-
-- a row with 2 or more primaries where a *leading* one is suppressed for that row —
-  the surviving primary moves from the "⋮" menu to an inline button, and the "⋮"
-  disappears if nothing else is left to fold;
-- unchanged: how many primaries may go inline, the menu order (folded primaries
-  above secondaries), which items render at all, the ADR-0066 D4 capability gate
-  (still applied once to the declared set, upstream of this decision), and the
-  #3562 empty-menu guard — a row with nothing renderable still grows no trigger.
-
-Rows whose primaries are all ungated (the `sys_environment` Open + Upgrade Plan
-shape that motivated `maxInlineActions`) are bit-for-bit unaffected: declared order
-and surviving order coincide.
diff --git a/.changeset/row-crud-permission-gate-4096.md b/.changeset/row-crud-permission-gate-4096.md
deleted file mode 100644
index 45ef19aa4c..0000000000
--- a/.changeset/row-crud-permission-gate-4096.md
+++ /dev/null
@@ -1,54 +0,0 @@
----
-"@object-ui/plugin-grid": patch
-"@object-ui/plugin-list": patch
-"@object-ui/app-shell": patch
----
-
-List row Edit/Delete, bulk delete and related-list CRUD now run the caller's own permission, not just the object's API exposure (objectui#4096)
-
-The row kebab's built-in Edit/Delete rendered for every account, including ones
-the server answers `403 PERMISSION_DENIED` on. Clicking Edit opened a fully
-prefilled dialog that could only fail on save; Delete — a destructive entry —
-sat one click away from users who could never perform it.
-
-The gate intersected the object's resolved CRUD affordance with the server's
-effective API operation set (`/me/permissions` `apiOperations`, objectui#3720),
-and nothing else. `apiOperations` is the object's **API exposure surface** —
-"which verbs does this object publish" — and the spec's own describe text says
-so. It is principal-independent: the report measured two accounts with opposite
-`allowEdit`, 30 shared objects, and **30/30 identical** `apiOperations`. A gate
-made only of object-scoped layers therefore fails OPEN for every unprivileged
-caller, which is why the same screen carried three different answers to "may
-this user write this object": the toolbar's New was correctly hidden
-(`affordances.create && can(obj, 'create')`), the record header's Edit/Delete
-were correctly hidden (per-record write probe), and the row kebab was not.
-
-Four surfaces now AND the principal's own verdict — `can(obj, 'update' |
-'delete')`, i.e. `/me/permissions` `allowEdit` / `allowDelete`, the toolbar's
-source — on top of the layers they already had:
-
-- the grid row kebab's built-in Edit/Delete (`resolveRowCrudAffordances` gained
-  `permissionUpdate` / `permissionDelete`, filled at the `ObjectGrid` call site);
-- the grid's bulk-delete bar, which rides the same object-level delete verdict,
-  so the row gate and the more destructive bulk entry move together;
-- the non-grid (kanban / calendar / gallery) bulk bar `ListView` renders itself;
-- the related-list Create/Edit/Delete on a child object
-  (`RelatedRecordActionsBridge`), which had the same object-only gate.
-
-**This is a tightening of the intersection, not a swap.** Every existing layer
-stays: the ADR-0103 lifecycle bucket, `userActions.edit` / `delete`, and
-`apiOperations`. A permission grant cannot re-open what any of them closed, and
-none of them survives a permission denial.
-
-Fail-open is preserved where it is the deliberate contract: `usePermissions()`
-with no `PermissionProvider` answers `can: () => true`, so standalone embeds and
-hosts that ship no permission source keep their Edit/Delete exactly as before.
-Under `MePermissionsProvider` the semantics are the toolbar's, unchanged and now
-shared: an authenticated principal whose object is absent from
-`/me/permissions.objects` resolves fail-closed (objectui#2926 ④), an anonymous
-session keeps the permissive default, and children never render while the
-permission set is loading. Per-key absence is still permissive — an object entry
-without `allowEdit` reads as allowed.
-
-Server-side enforcement was already hard (403, DB unchanged), so this closes a
-UI-affordance gap rather than an authorization hole.
diff --git a/.changeset/row-predicate-fault-reason-and-record-pin-3792-3796.md b/.changeset/row-predicate-fault-reason-and-record-pin-3792-3796.md
deleted file mode 100644
index 70a2379648..0000000000
--- a/.changeset/row-predicate-fault-reason-and-record-pin-3792-3796.md
+++ /dev/null
@@ -1,61 +0,0 @@
----
-"@object-ui/core": patch
----
-
-`evalRowPredicate`: the fail-closed report now names the engine's failure reason, and the ROW always wins over host scope (objectui#3792, objectui#3796)
-
-Two defects in one function, `packages/core/src/evaluator/listConditional.ts`,
-shared by every surface that gates on a row predicate: the row kebab, the bulk
-selection bar, kanban conditional formatting, and — since objectui#3521 — the
-record page header.
-
-**The safest path said the least (objectui#3792).** `evalRowPredicate` has two
-diagnostic routes, and their information content was inverted. The single-eval
-fast route lets the canonical helper warn, so it prints the engine's own reason
-(`Reason: [runtime] No such key: owner_id`). The `warnOnError: true` route — the
-fail-CLOSED one, taken by every caller that makes a button disappear — runs
-`evalFieldPredicate` twice with `{ warn: false }` to tell a fault from a genuine
-`false`, and that silence discarded the reason along with the duplicate warning.
-So the more decisively a surface hid a control, the less it said about why: the
-console line named the predicate but not the defect, and `No such key: owner_id`
-or `no such overload: string == null` is usually the whole answer.
-
-`FieldPredicateDiagnostic` gains an optional `onFault(reason)` passback:
-`evalFieldPredicate` hands out the engine's verbatim text (kind tag, message and
-source excerpt — the exact string it prints after `Reason:`) even when its own
-warning is suppressed. It fires per fault, deliberately independent of the
-once-per-predicate warning dedupe, so a caller doing its own warn-once
-bookkeeping keeps control of it; the verdict is unaffected, and callers that pass
-nothing are unchanged. `evalRowPredicate` threads that reason into its labelled
-warning, and the legacy-dialect route does the same with the message its engine
-throws (`Reason: [legacy] …`), so both dialect paths report a fault the same way.
-Warn-once semantics are unchanged — the reason is deliberately not part of the
-dedupe key.
-
-**Wording: not a list function, and not for a long time.** The same message
-called every caller a "**list** conditional predicate". A hidden button on a
-record page header reporting "a list conditional predicate" sends its author to
-the list view to look for a control that was never there. Both messages this
-module emits (evaluation failure and the legacy-dialect deprecation) now read
-"conditional predicate".
-
-**The row is the subject — on both dialect paths (objectui#3796).** The scope
-merge pinned `data` after the host-scope spread but not `record`, leaving
-`record` to each engine's own binding — and the two engines disagreed. The legacy
-evaluator re-pinned `record` to the row (row won); the CEL engine takes its
-`extra` bag over its `record` binding, so a host scope carrying a `record` key
-won there instead. One function, one predicate text, two subjects — selected by
-whether the string happens to contain `===` or `${…}`, the dialect-routing
-markers, which no author picks deliberately. `record` is now pinned after the
-spread exactly as `data` is, which fixes both paths at the merge site rather than
-relying on either engine's precedence.
-
-No host injects a `record` key today — `ExpressionProvider` binds
-`current_user` / `user` / `ctx` / `os` / `app` / `data` / `features` — so nothing
-observable changes for existing apps; this closes the edge before a host adds one
-(`ctx.record` already exists, which is exactly how it would arrive). A row FIELD
-named `record` is likewise no longer able to become the row root; it stays
-addressable as `data.record`.
-
-Shipped as a patch: no new exported symbol, one optional field added to an
-already-exported options interface, and no existing call signature changed.
diff --git a/.changeset/rowactionmenu-empty-guard.md b/.changeset/rowactionmenu-empty-guard.md
deleted file mode 100644
index 8292fd3f6f..0000000000
--- a/.changeset/rowactionmenu-empty-guard.md
+++ /dev/null
@@ -1,25 +0,0 @@
----
-'@object-ui/plugin-grid': patch
----
-
-fix(plugin-grid): don't render a row "⋮" trigger that opens an empty menu
-
-The object list's row overflow trigger was gated on whether row-action
-**handlers** were wired and how many actions were **declared**
-(`(canEdit && onEdit) || (canDelete && onDelete) || menuDefs.length > 0 || rowActions.length > 0`),
-while the menu's items were filtered a second time — per item, per record —
-against `visibleWhen` / `visible`. On a row where every item was
-predicate-suppressed the trigger still rendered and opened an empty box, which
-reads as a broken page: a platform object whose row actions are gated for one
-role showed a "⋮" on every row for everyone else, with nothing inside it.
-
-The trigger is now decided by the items that will actually render for that row,
-resolved through the same visibility functions the items gate themselves on, so
-the two cannot disagree. The decision is per row: within one grid a row that
-keeps an action keeps its trigger while a row with nothing left renders none. The
-inline `variant: 'primary'` button reads that same shared rule. The actions
-column is table-level and unchanged, so a row with nothing to offer renders an
-empty cell and every row keeps the same cell count.
-
-Which items render is untouched — only whether the trigger renders when none of
-them survive.
diff --git a/.changeset/runner-preserve-query-on-navigate.md b/.changeset/runner-preserve-query-on-navigate.md
deleted file mode 100644
index ee60632f95..0000000000
--- a/.changeset/runner-preserve-query-on-navigate.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-'@object-ui/runner': patch
----
-
-Runner in-app navigation now carries the current query string across to the pushed URL instead of `pushState`-ing a bare path. Opening the Runner with `?api=<base>` and clicking a sidebar entry no longer drops the parameter from the address bar, so reloading or sharing the resulting URL still reaches the same backend rather than silently falling back to the (normally empty) `LocalBundleLoader` and rendering `Page not found`. The whole query string is preserved, not just `api` — `@object-ui/core`'s `?__debug…` flags survive navigation for the same reason. A navigation target that spells out its own query keeps it and wins on collision, with the remaining current parameters merged in behind it (#3578).
diff --git a/.changeset/runner-vite-alias-transitive-closure.md b/.changeset/runner-vite-alias-transitive-closure.md
deleted file mode 100644
index a4bc9864c6..0000000000
--- a/.changeset/runner-vite-alias-transitive-closure.md
+++ /dev/null
@@ -1,29 +0,0 @@
----
-"@object-ui/runner": patch
----
-
-Complete `packages/runner/vite.config.ts`'s workspace alias table to the full
-transitive import closure, so `@object-ui/runner` boots and builds from the
-monorepo sources without a prior `pnpm -w build` (objectui#3575).
-
-The table aliased 7 `@object-ui/*` specifiers to `packages/*/src`, but those
-`src` trees import 8 more workspace packages that were not aliased. Those fell
-back to Node resolution and landed on `packages/<pkg>/dist`, which does not
-exist in a fresh install-only checkout — so the "From Source" flow documented in
-`content/docs/utilities/runner.mdx` (`pnpm install` then `pnpm dev`, no build
-step) failed with "Failed to run dependency scan" and served HTTP 500 for every
-module on the chain. `pnpm --filter @object-ui/runner build` failed the same way.
-
-Newly aliased: `i18n`, `sdui-parser`, `react-runtime`, `fields`, `plugin-detail`
-(first layer), `providers` and `permissions` (only reachable once the first layer
-resolves to src), and `data-objectstack` (a type-only import that esbuild erases,
-so the dependency scan never reported it).
-
-This is user-visible in the published artifact, because the alias table is not
-scoped by `command` and therefore applies to `vite build` as well. Bundling the
-newly aliased packages from src stops the per-icon `lucide-react/dynamic.mjs`
-chunks from being inlined, so the build now emits ~1.7k lazy icon micro-chunks
-like `apps/console` does. `build.modulePreload` is disabled to match console, so
-those chunks are not all preloaded on first paint: the measured initial eager
-payload drops from 4231003 to 591795 bytes, while total `dist` size grows about
-5.5% because the previously inlined icons are now separate files.
diff --git a/.changeset/schemaform-visiblewhen-os6331.md b/.changeset/schemaform-visiblewhen-os6331.md
deleted file mode 100644
index 2e25eec395..0000000000
--- a/.changeset/schemaform-visiblewhen-os6331.md
+++ /dev/null
@@ -1,48 +0,0 @@
----
-"@object-ui/app-shell": patch
----
-
-Make metadata-form visibility predicates work again in the Setup/Studio admin
-engine: `SchemaForm` now reads the canonical `visibleWhen` key, falling back to
-the deprecated `visibleOn` alias (objectstack#6331).
-
-ADR-0089 renamed the FormView predicate `visibleOn` → `visibleWhen`, and the
-spec's normaliser REWRITES the alias rather than keeping both — a parsed
-`FormView` carries `visibleWhen` and no `visibleOn` at all. All five predicate
-read sites in `SchemaForm.tsx` looked at `visibleOn` only, so every spec-served
-predicate read as absent and each guard short-circuited to "visible". Every
-conditional field, section and tab in every metadata form rendered
-unconditionally.
-
-Measured over the bundled `@objectstack/spec@17`: `objectForm` carries 16
-sub-field predicates, `viewForm` 7, `actionForm` 6, `pageForm` 4 — all spelled
-`visibleWhen`, none spelled `visibleOn`. Every one of them was inert.
-
-Fixed sites: the flat per-property path, section-level, section field-level,
-the tabbed path's field probe, and `type: 'record'` row sub-fields. Spelling and
-precedence mirror the runtime record-form adapter (`@object-ui/plugin-form`
-`sectionFields.ts`) and the spec bridge (`@object-ui/react` `form-view.ts`),
-which already read `visibleWhen ?? visibleOn` — one dialect across the repo,
-canonical wins. `FormSectionSpec` / `FormFieldSpec` declare both keys, the alias
-marked `@deprecated`.
-
-**Visible behaviour change** — these predicates have never taken effect in a
-shipped build, so they switch on for the first time here:
-
-- Studio's object field list now shows only the type-relevant row sub-fields: a
-  `currency` field shows Min / Max / Precision / Scale, a `text` field shows Max
-  Length / Min Length, instead of all of them at once.
-- Page authoring hides Data Context / Layout / Template on a `list` page and
-  shows the Interface section, and the mirror for a record page. View, Action and
-  Report authoring forms gain their type-conditional sections and fields.
-
-Predicates authored with the deprecated alias keep working, including this app's
-own create schemas, which set `visibleOn` directly on raw JSONSchema properties
-(`view-create-body.ts`, `anchors.ts`) and never pass through the spec normaliser.
-
-Note for the rollout: the predicates must be `data.`-scoped to evaluate against
-the draft (objectstack#6254 corrected 16 bare spellings in `object.form.ts`). A
-backend still serving the pre-#6254 bare spelling now yields the opposite
-symptom — those sub-fields stay hidden rather than always shown — because the
-admin engine's evaluator resolves an unscoped identifier to `undefined` and the
-predicate goes false.
diff --git a/.changeset/select-multiple-widget-mapping-3986.md b/.changeset/select-multiple-widget-mapping-3986.md
deleted file mode 100644
index b3b5681dd2..0000000000
--- a/.changeset/select-multiple-widget-mapping-3986.md
+++ /dev/null
@@ -1,16 +0,0 @@
----
-'@object-ui/fields': patch
-'@object-ui/plugin-form': patch
----
-
-Resolve a `select` field declared `multiple: true` to the `field:multiselect` widget, so the object form's visible label actually names the chip picker it renders (objectui#3986).
-
-`mapFieldTypeToFormType` keyed the widget id on the field's `type` string alone, so an object-schema `{ type: 'select', multiple: true }` picklist — a spec-legal, entirely ordinary shape — became `field:select`. `SelectField` then delegated to `MultiSelectField` on `config.multiple`, so the component that RENDERED was the chip picker while everything keyed on the widget id still answered for the single-value combobox. Above all the label-association declaration (`ComponentMeta.labelling`, objectui#3961), which the form renderer resolves per widget id: the host emitted `<label for>` at the chip row's wrapper `div`, where a `for` is inert — `HTMLLabelElement.control` returns `null`. Visually the field had a label; in the accessibility tree that label named nothing. Measured on the object-form path, `role=group` + accessible name went from 1 for a `multiselect`-typed field (fixed in objectui#3975) to 0 for this one.
-
-Declaring `select` itself `labelling: 'group'` was not available: a single-value select's trigger is a labelable `button[role=combobox]` whose `for` association works, and a bare `select` is a builtin the renderer resolves without consulting the registry at all. The fix is therefore at the producer — the widget id now carries the arity, so one place decides which widget renders and the declaration can no longer be addressed to a widget that is not rendering.
-
-- `mapFieldTypeToFormType(fieldType, config?)` takes an optional second argument — the rest of the field definition, of which only `multiple` is read. Existing single-argument calls are unchanged, and so is every type outside the new table: `select` is the only one whose `multiple` form is a different WIDGET. The spec's multi-capable set is larger (select / lookup / file / image, with `radio` on the select branch and `user` storing like `lookup`), but `LookupField`, `FileField` and `ImageField` each render both arities themselves, so their id — and their labelling declaration — is already right for either.
-- The four object-form producers pass the pair: `ObjectForm`, `DrawerForm`, `ModalForm`, and `sectionFields` (Tabbed / Wizard / Split / Drawer / Modal). In `sectionFields` the id is now computed once from the EFFECTIVE pair, after view-level overrides have merged, because `multiple` is itself a spec `FormField` key: a view restating only `multiple: true` over a single-value object field moves the widget too, and `multiple: false` moves it back.
-- `SelectField`'s `multiple` delegation is KEPT, not retired. Measured, it stays reachable from three entrances that never consult the alias map: the inline grid editor (`FieldEditWidget` finds `select` in its own table first), `ActionParamDialog` (`resolveFormWidgetType` returns `select` from `fieldWidgetMap` first), and hand-written SDUI addressing `field:select` by name with `multiple` on its metadata.
-
-Read-only rendering of these widgets is untouched (objectui#4005), as is the built-in `Select` branch (objectui#3976).
diff --git a/.changeset/sour-clouds-yawn.md b/.changeset/sour-clouds-yawn.md
deleted file mode 100644
index c3f4457453..0000000000
--- a/.changeset/sour-clouds-yawn.md
+++ /dev/null
@@ -1,22 +0,0 @@
----
-"@object-ui/app-shell": patch
----
-
-metadata-admin: restore per-field diagnostics when editing an invalid stored `view`
-
-Editing a stored `view` is judged by the wire gate `ViewMetadataSchema`, which is a
-union. Zod reports a union failure as a single root issue — no path, message
-`Invalid input` — so every field-level diagnostic collapsed into one message that
-pointed at nothing: `SchemaForm` had no field to highlight and Monaco had no
-position to jump to, and the guided messages the spec writes for these rejections
-never reached the editor.
-
-Failures are now expanded to the union member the draft's own `viewKind`
-discriminant selects, so a bad stored view reports `config.type` with the list of
-valid layouts, a mis-typed filter reports `config.filter.0.operator`, and a
-container key that belongs to a single view gets the spec's full
-`defineView(...)` guidance back. Only the selected member's issues are shown, so
-the other members' rejections do not become noise.
-
-Validation verdicts are unchanged: the accept/reject decision is still made by the
-one gate, and this only changes how an already-failed draft is presented.
diff --git a/.changeset/system-hub-count-error-state-3679.md b/.changeset/system-hub-count-error-state-3679.md
deleted file mode 100644
index b879e87f14..0000000000
--- a/.changeset/system-hub-count-error-state-3679.md
+++ /dev/null
@@ -1,23 +0,0 @@
----
-'@object-ui/console': patch
----
-
-System Hub: a card count that failed to load no longer renders as `0`
-
-Each count on the System Hub fetched one object and caught its own failure with
-an empty page, so a 500, a 401, a 403 or a dropped connection all produced the
-same confident `0` as a table that really is empty — no error, no retry, and no
-way to tell the two apart. The most reachable case was a permission denial on a
-single object: an administrator who may open the hub but cannot read
-`sys_audit_log` was shown "0 entries" rather than being told anything at all.
-
-A failed lookup now leaves that card's count unknown, and the badge — which
-already renders only for a known count — is omitted, so the card shows no
-number instead of a wrong one. The catch stays on each call rather than around
-the batch, so one object's failure blanks only its own card and the cards beside
-it keep the real numbers they received.
-
-Unchanged: an object the backend does not have still counts `0`. The adapter
-resolves an unregistered object as an empty page by design (callers read empty
-as "feature unavailable"), so that never was an error and is not treated as one
-here.
diff --git a/.changeset/system-hub-org-count-3670.md b/.changeset/system-hub-org-count-3670.md
deleted file mode 100644
index 6dbf163173..0000000000
--- a/.changeset/system-hub-org-count-3670.md
+++ /dev/null
@@ -1,11 +0,0 @@
----
-'@object-ui/console': patch
----
-
-Count System Hub's Organizations card through `sys_organization`, the object the framework actually registers — it asked for `sys_org`, which does not exist, so the card read `0` on every deployment (objectui#3670).
-
-The failure was silent by construction. A missing object answers `404 OBJECT_NOT_FOUND`, and `ObjectStackAdapter.find()` absorbs that on purpose — it caches the name in `missingResources` and resolves `{ data: [], total: 0 }` so callers can treat an uninstalled collection as "no rows". The hub renders `data.length`, so a name the framework never had produced a perfectly ordinary `0`, indistinguishable from a workspace that genuinely has no organizations — which no single-org deployment ever is, since `sys_organization` always holds at least one row. The `.catch` on each call never even saw the 404; it only ever covered non-404 rejections.
-
-The other three counted names were checked against the framework's object registry and are correct as spelled: `sys_user`, `sys_position`, `sys_audit_log`.
-
-The Permissions card is **not** fixed here and still reads `0`. Its query names `sys_permission`, which the framework also does not have — it splits that surface into `sys_capability` (lineage: its own docblock says "named `sys_capability`, not `sys_permission`") and `sys_permission_set` (function: the admin-managed grant container). Both would render, so choosing one would silently bind the card to a surface nobody picked; that decision is open on objectui#3655. Until it lands the gap is held visible by a MEASUREMENT case in the page's test rather than quietly re-aimed.
diff --git a/.changeset/system-hub-permissions-leg-3655.md b/.changeset/system-hub-permissions-leg-3655.md
deleted file mode 100644
index 98bf93d178..0000000000
--- a/.changeset/system-hub-permissions-leg-3655.md
+++ /dev/null
@@ -1,17 +0,0 @@
----
-'@object-ui/console': patch
----
-
-Point System Hub's Permissions card — both its link and its count — at `sys_permission_set`, closing the last of the five `system/*` navigation targets (objectui#3655).
-
-Four of those URLs became redirects in an earlier change; `system/permissions` was deliberately held back, and so was the count beside it, because the framework splits what this console calls "Permissions" into two Setup entries and picking one would have silently bound every click, bookmark and badge to a surface nobody chose:
-
-- `sys_capability` — ADR-0066 layer 1, the definition registry of "what can be done". Its own docblock notes it is what the ADR "loosely floats" as `sys_permission`, which is the name the retired page and the count query both used, so lineage pointed here.
-- `sys_permission_set` — ADR-0066 layer 2, the grant container the permissions docs call "the only capability container" (object CRUD, field security, access depth, system capabilities), so function pointed here.
-
-It is decided as `sys_permission_set`: the card reads "Manage permission rules and assignments", and rules-and-assignments is layer 2 — a capability is what a permission set references by name, not what an administrator is assigned. Two user-visible consequences:
-
-- `/apps/:app/system/permissions` now forwards in one hop to `/apps/:app/sys_permission_set` instead of being rewritten to `…/system/record/permissions` and rendering a record detail page for an object literally named `system` — a dead link that read as a backend fault.
-- The Permissions card's badge shows the real number of permission sets. It previously counted `sys_permission`, an object the framework does not register; the adapter absorbs that `404` into an empty page on purpose, so the card printed a confident `0` no administrator could tell apart from "there really are none".
-
-Recorded as a transitional alias. Retiring this hand-written card wall along with the hub (already `@deprecated` in favour of the metadata-driven navigation) remains open and does not conflict — a redirect keeps old bookmarks resolving either way.
diff --git a/.changeset/system-hub-routes-3655.md b/.changeset/system-hub-routes-3655.md
deleted file mode 100644
index c8fb1e866d..0000000000
--- a/.changeset/system-hub-routes-3655.md
+++ /dev/null
@@ -1,14 +0,0 @@
----
-'@object-ui/console': patch
----
-
-Declare the retired `system/{users,organizations,roles,positions}` console URLs as redirects onto the framework-owned system objects (objectui#3655).
-
-`SystemHubPage`'s cards and both sidebars' `sys-*` cluster emit five `/apps/setup/system/…` targets. Four of them were real routes until `apps/console` was slimmed for third-party customisation, which deleted the bespoke wrapper pages because "these objects are now contributed by framework plugins … and resolved via the generic `/apps/setup/<object_name>` route" — but the producers were never retargeted and nothing redeclared the URLs. All five fell through to app-shell's tail, where the failure they got depended on how long the word was, because `ShorthandRecordRedirect` treats any URL-safe segment of 6+ characters as a record id:
-
-- `users` (5) and `roles` (5) rendered "Page not found".
-- `organizations` (13) and `positions` (9) were rewritten to `…/system/record/<word>` and rendered a record detail page for an object literally named `system` — the worse of the two, because it reads as a backend/data problem rather than a dead link.
-
-Each now forwards in one hop to the object the framework's own Setup navigation names: `sys_user`, `sys_organization` (the list entry — the record-scoped one needs a runtime `{current_org_id}` a static redirect cannot resolve), and `sys_position` for both `roles` and `positions` (ADR-0090 D3 renamed `sys_role` to `sys_position`, so the sidebar's "Roles" and the hub's "Positions" are one surface in two vocabularies). Same shape as the `system/objects` and `system/metadata` redirects beside them: the URL is translated, the deleted page is not resurrected, and the navigation producers are untouched.
-
-`system/permissions` is deliberately left as it was. The framework splits what this console calls "Permissions" into two Setup entries — `sys_capability` and `sys_permission_set` — and picking one here would silently commit every click and bookmark to a surface nobody chose. Its unchanged landing is pinned in the tests so the gap stays visible.
diff --git a/.changeset/template-dep-ranges-follow-dependabot.md b/.changeset/template-dep-ranges-follow-dependabot.md
deleted file mode 100644
index f8f744e54f..0000000000
--- a/.changeset/template-dep-ranges-follow-dependabot.md
+++ /dev/null
@@ -1,17 +0,0 @@
----
-'@object-ui/create-plugin': patch
-'@object-ui/cli': patch
----
-
-Move the generator templates' dependency ranges onto the repo's current ones
-
-The dependabot wave of 2026-08-10 bumped `lucide-react` to `1.29.0` and `vite`
-to `8.2.1` in this repo's own manifests, but the ranges hard-coded in the
-scaffold generators do not move with it — dependabot does not know the
-templates exist. A project scaffolded by `objectui init` / `objectui dev` or by
-`create-plugin` therefore declared a range the repo itself had already moved
-past.
-
-Three ranges are re-anchored: `lucide-react` `^1.28.0` → `^1.29.0` in the routed
-app generator, and `vite` `^8.2.0` → `^8.2.1` in both the shared CLI scaffold
-devDependencies and the create-plugin template.
diff --git a/.changeset/tidy-cameras-shake.md b/.changeset/tidy-cameras-shake.md
deleted file mode 100644
index f900f0229a..0000000000
--- a/.changeset/tidy-cameras-shake.md
+++ /dev/null
@@ -1,27 +0,0 @@
----
-'@object-ui/app-shell': patch
----
-
-metadata-admin: wire client-side Zod validation for `sharing_rule`, `translation` and `connector` (objectui#3561)
-
-These three metadata types opted out of live client-side validation on recorded
-reasons that no longer held against the resolved `@objectstack/spec` 17.0.0-rc.5:
-`SharingRuleSchema` was described as having an empty shape (it is a `.strict()`
-object of nine keys), `translation` was judged by `TranslationBundleSchema` (the
-bundle map, not the kind's schema — it rejects a valid translation item), and
-`connector` was blocked on a required `id` field that does not exist in
-`ConnectorSchema`.
-
-Each loader now names the schema the platform actually binds — `SharingRuleSchema`,
-`TranslationItemSchema` and `DeclarativeConnectorEntrySchema`. Behaviour change:
-drafts of these types are now rejected in the editor before save, through the same
-diagnostics banner every other wired type already uses. Most notably a `connector`
-draft that inlines credentials or authors provider-derived `actions` is caught at
-authoring time by the ADR-0097 rules the bare `ConnectorSchema` does not carry.
-
-`sharing_rule` is gated on the **create** door only: its schema is `.strict()` and
-declares none of the ADR-0010 envelope keys that a stored body carries, so judging
-a stored body with it would make the client stricter than the server.
-`hasClientValidator(type, mode)` takes the door as a second argument for that
-reason — without it the editor would have read a type with no gate on the edit
-path as "clean" and suppressed the server's own diagnostics.
diff --git a/.changeset/tidy-scaffolds-anchor-init.md b/.changeset/tidy-scaffolds-anchor-init.md
deleted file mode 100644
index d46724d2d7..0000000000
--- a/.changeset/tidy-scaffolds-anchor-init.md
+++ /dev/null
@@ -1,9 +0,0 @@
----
-'@object-ui/cli': patch
----
-
-`objectui init` now versions the project it scaffolds against the CLI that wrote it, and stops writing a `tailwind.config.js` Tailwind 4 never reads.
-
-The generated `package.json` asked for `@object-ui/components` and `@object-ui/react` at `^2.0.0` while those packages publish at 17.x, so `npm install` in a fresh scaffold resolved a major unrelated to the CLI that produced it. Both ranges are now derived from the CLI's own version, which is sound because `.changeset/config.json` releases the CLI and every platform package from one `fixed` group. The scaffold's toolchain ranges had drifted the same way — vite `^7.3.1` against the repo's `^8.2.0`, typescript `^5.9.3` against `^6.0.3`, and seven more — and now read from the same table the temp-app generators use rather than from literals of their own.
-
-The scaffold's CSS pipeline was already Tailwind 4 (`@tailwindcss/postcss`, `@import 'tailwindcss'`), and v4 reads a JS config only when a stylesheet points `@config` at one. The `tailwind.config.js` written beside it was therefore inert — an authoritative-looking `content` list nothing consumed — and is no longer written.
diff --git a/.changeset/timeline-binds-to-the-calendar-date-axis.md b/.changeset/timeline-binds-to-the-calendar-date-axis.md
deleted file mode 100644
index 2a6c1ade7e..0000000000
--- a/.changeset/timeline-binds-to-the-calendar-date-axis.md
+++ /dev/null
@@ -1,29 +0,0 @@
----
-"@object-ui/plugin-list": minor
-"@object-ui/app-shell": minor
----
-
-fix(timeline): the timeline binds to the date axis the view actually declares (#3129)
-
-A view whose date axis is bound under `calendar` was **offered** the Timeline
-visualization and then bucketed every record into "No date" — while the calendar
-rendered the very same field correctly. Two read-sites disagreed about what
-counts as a timeline binding:
-
-- `ListView`'s capability gate accepted `options.calendar.startDateField` as a
-  timeline-resolvable axis; the render branch never read calendar config at all,
-  so it fell through to its `created_at` last resort.
-- `app-shell`'s object page emitted `startDateField: 'due_date'` into
-  `options.timeline` for **every** object view, declared or not. Downstream that
-  is indistinguishable from a real binding, and because it is always present it
-  shadowed the fallback entirely.
-
-`ListView` now resolves the axis once — `resolveTimelineDateBinding`, consumed by
-the capability gate and the render branch alike, reading spec key before legacy
-alias and `timeline` before `calendar` in both nestings — and the object page
-forwards only what the view declared. A declared `timeline.startDateField` still
-wins wherever both appear, and a view that declares no date axis anywhere keeps
-the historical `created_at` fallback.
-
-Observable rendering change (records move out of "No date" into real date
-buckets), hence `minor`.
diff --git a/.changeset/timeline-line-items-filter-sort-limit-7137.md b/.changeset/timeline-line-items-filter-sort-limit-7137.md
deleted file mode 100644
index cc20afde5e..0000000000
--- a/.changeset/timeline-line-items-filter-sort-limit-7137.md
+++ /dev/null
@@ -1,57 +0,0 @@
----
-"@object-ui/plugin-timeline": patch
-"@object-ui/plugin-form": patch
-"@object-ui/core": patch
----
-
-`object-timeline` and `record:line_items` now apply the filter / sort / row cap they are given, so a named `dataSource.view` narrows them instead of contributing nothing
-
-These were the two residual gaps in objectstack#7121's per-block coverage table
-(objectstack#7137). Both blocks are object-bound lists, both accepted the spec's
-per-element `dataSource` binding, and neither had a read site for `filter` or
-`sort` anywhere in its fetch:
-
-- `object-timeline`'s entire query was
-  `find(objectName, { options: { $top: 100 } })`.
-- `record:line_items`' was the parent FK plus a fixed `$top: 500`.
-
-So `dataSource: { object, view: 'hot' }` resolved the view — a typo still reported
-a configuration error, it never degraded into an unfiltered query — and then
-dropped everything the view said. The rendered rows could be **wider than the view
-they named**, silently, which is exactly the class of mistake AI-authored metadata
-hides best: the page looks like it works. objectstack#7121 deliberately left the
-keys unmapped and recorded the gap rather than writing composed values onto schema
-keys nobody read; this closes it at the fetch instead.
-
-What each block now reads:
-
-- **`object-timeline`** — `$filter: schema.filter`,
-  `$orderby: convertSortToQueryParams(schema.sort)`, and
-  `$top: schema.limit ?? 100`, matching the form `object-gantt` / `object-map` /
-  `object-calendar` already use. Its registry mapping gains
-  `filter` / `sort` / `limit`; `columns` stays unmapped, because a timeline
-  projects the fields its `timeline` config names.
-- **`record:line_items`** — the composed filter is **AND-combined** with the parent
-  relationship condition through `mergeFilterNodes`, never substituted for it, the
-  same way `record:related_list` composes its own since objectstack#7118: a
-  line-items panel is always scoped to the record it sits on, so an *additional*
-  criterion can only narrow this parent's children and can never surface another
-  parent's rows. `sort` becomes the load order and `limit` the row cap (default
-  500). `columns` stays unmapped — here they are `GridColumn[]` driving an editable
-  grid, not a field-name projection, so a view's column list would be the wrong
-  *shape* rather than merely a wider answer.
-
-**Behaviour change worth knowing about:** the timeline's default window is now a
-real cap. `{ options: { $top: 100 } }` nested the limit under a key that is not a
-`QueryParams` field and that no adapter in this repo reads (`convertQueryParams`
-maps `params.$top`), so the intended window never reached the wire and a timeline
-over a large object fetched whatever the server chose to return. It is now sent as
-`$top`, and authorable via `limit` or a view's `pagination.pageSize`.
-
-`@object-ui/core` gains `convertSortToQueryParams`, the sort→`$orderby` lowering
-the three sibling blocks each inline privately. It is shared rather than copied
-twice more, and is slightly more faithful to the declared contract than those
-copies: a sort entry that omits `order` means ascending instead of being dropped
-(the string spelling `"amount"` already meant ascending in the same copies), and
-nothing orderable yields `undefined` rather than a truthy empty `{}`. Migrating
-the three existing copies onto it is objectstack#7148 and is not done here.
diff --git a/.changeset/user-filters-button-type-os6952.md b/.changeset/user-filters-button-type-os6952.md
deleted file mode 100644
index 3503987de4..0000000000
--- a/.changeset/user-filters-button-type-os6952.md
+++ /dev/null
@@ -1,32 +0,0 @@
----
-"@object-ui/plugin-list": patch
----
-
-`UserFilters` preset tab buttons no longer submit an enclosing form; all six buttons declare `type="button"`
-
-An HTML `<button>` defaults to `type="submit"` inside a `<form>`, so a preset
-filter tab (`filter-tab-*`, tabs mode) submitted the enclosing form on every
-click. The three buttons objectstack#6952 named now declare `type="button"`
-explicitly — the dropdown chip trigger (`filter-badge-*`), the overflow trigger
-(`user-filters-more`) and the preset tab — joining the session-tab buttons that
-objectstack#5236 already declared it on.
-
-Only one of the three was actually at risk, and the difference is measured
-rather than assumed. The chip and the overflow trigger are
-`PopoverTrigger asChild` children, and Radix's `PopoverTrigger` renders
-`Primitive.button type="button"`; its Slot merges that onto a child declaring no
-`type` of its own, so both already rendered as `button`. Reverting the change
-confirms it: those two keep reading `button`, the plain preset tab button reads
-`null`. For the two triggers this therefore moves a contract out of an upstream
-implementation detail and into local source — the same reasoning objectui#3344
-wrote onto the Combobox trigger — while the preset tab is a real fix.
-
-Dormant rather than live: the only mount point today is `ListView`'s toolbar,
-which is not inside a form, so no shipped screen submitted anything. The new
-tests pin every rendered `UserFilters` button, in both modes, so a future button
-cannot land at the submit default and an upstream Radix change surfaces in this
-package's tests instead of in a user's form.
-
-The in-file comment claiming "a Radix trigger keeps the HTML default of `submit`"
-is corrected in passing — it is the inaccuracy that propagated into
-objectstack#6952's premise.
diff --git a/.changeset/userfilters-allowaddtab-session-tabs-os5236.md b/.changeset/userfilters-allowaddtab-session-tabs-os5236.md
deleted file mode 100644
index 2de0eda4fe..0000000000
--- a/.changeset/userfilters-allowaddtab-session-tabs-os5236.md
+++ /dev/null
@@ -1,13 +0,0 @@
----
-'@object-ui/plugin-list': patch
----
-
-`userFilters` tabs: the `allowAddTab` button now adds a tab instead of doing nothing (objectstack#5236)
-
-The affordance `allowAddTab` renders had hover styling and `title="Add filter tab"` but no `onClick`, and `TabFilters` took no add-tab callback at all — a control that looked fully clickable and did nothing, which disguises "not implemented" as "a bug where clicking does nothing". That mattered more once objectstack#5073 promoted `allowAddTab` into the spec's `UserFiltersSchema`: the key became discoverable through JSON Schema, the Studio SchemaForm and the reference docs, so an author writing `allowAddTab: true` gets a declaration the runtime did not honour.
-
-Clicking it now opens a small naming popover (the same Popover primitive the filter chips and the "More" overflow already use). Confirming a name adds a tab to the same bar as the presets, carrying a snapshot of the conditions applied at that moment, and selects it. Session tabs also carry a remove affordance; authored presets deliberately do not, since those are metadata. Removing the active session tab re-selects the author's default with the same precedence the initial mount uses, so the bar is never left with no active tab while the removed tab's conditions stay applied.
-
-The new tab is **session-scoped, held in component state** — no `sys_metadata` write, no API call, no web storage, per ADR-0047 ("an end user's filter choices are session-scoped and never become metadata"). `sessionStorage` was available and deliberately not used: `UserFilters` receives no object or view identity, so any storage key it could invent would be shared by every list in the browser tab, surfacing one list's ad-hoc tabs on another's bar. Persistence beyond the mount, if ever wanted, belongs to the host that already owns the session channel for filter selections (`onSelectionsChange` mirrored into `uf_*` URL params) and can key it by view. The synthetic tab id is reported through `onSelectionsChange` like any other tab switch, so a host mirroring it into the URL hands it back on the next mount, where the existing id check finds no such tab and falls back to the author's default.
-
-No public API change: `UserFiltersProps` is untouched, and `allowAddTab: false` / an omitted `allowAddTab` still render no affordance at all.
diff --git a/.changeset/view-edit-wire-gate-5316.md b/.changeset/view-edit-wire-gate-5316.md
deleted file mode 100644
index 2195175fde..0000000000
--- a/.changeset/view-edit-wire-gate-5316.md
+++ /dev/null
@@ -1,30 +0,0 @@
----
-'@object-ui/app-shell': patch
----
-
-metadata-admin no longer false-rejects a stored `view` that has been pinned or
-reordered. The editor's live client-side validation judged BOTH the create and
-the edit draft with the AUTHORING schema (`ViewItemSchema` via
-`viewSchemaForDraft`). That is right for create and wrong for edit: the editor
-opens a body that came back out of `sys_metadata`, and the platform itself
-writes keys into stored view bodies — `isPinned` from the view switcher's pin
-action, `sortOrder` from the reorder write, and a per-row `id` that the console
-filter/sort builders stamp on `config.filter[]` for React. `updateView` GETs the
-stored item and PUTs `{ ...current, ...partial }`, and `saveMetaItem` persists
-the accepted body verbatim, so those keys are in storage by design.
-
-Before the authoring schemas were tightened these keys were silently stripped
-and the draft passed. Once the gate became strict, opening a pinned view in the
-editor reported unrecognized keys — while the SERVER accepted the very same body,
-because it validates against `ViewMetadataSchema`. The client was strictly
-stricter than the server; the direction was inverted.
-
-`validateMetadataDraft` now takes an optional `{ mode: 'create' | 'edit' }`.
-Create keeps the authoring gate unchanged. Edit is judged by
-`ViewMetadataSchema` — the schema the `view` metadata type registers, i.e. the
-same one the server runs — so the client and the server accept the same set by
-construction. `mode` defaults to `'create'`, the strict gate, so a caller that
-omits it can only ever over-report, never silently widen the door.
-
-The edit gate keeps its teeth: a wrong `config.type` and a container carrying an
-unknown key are both still rejected.
diff --git a/.changeset/view-overrides-readback.md b/.changeset/view-overrides-readback.md
deleted file mode 100644
index b70a20d7fa..0000000000
--- a/.changeset/view-overrides-readback.md
+++ /dev/null
@@ -1,13 +0,0 @@
----
-"@object-ui/data-objectstack": patch
-"@object-ui/app-shell": patch
-"@object-ui/types": patch
----
-
-Fix saved list-view preferences never reading back (density, column widths, sort, hidden columns, inline edit)
-
-`listViewOverrides` in the ObjectStack adapter enumerated `GET /api/v1/meta/{objectName}` — putting the object name in the metadata **type** slot — while `updateViewConfig` persists under `type='view'`. The two key spaces are disjoint, so the batch map came back empty for every object and every personalization a user saved on a list view was written to the server but never read back, showing up as "the setting didn't save".
-
-The read now enumerates `type='view'` once and narrows to the object client-side, through the same accessor `listViews()` uses over the same rows — the metadata index is name-only, so there is no server-side `?object=` filter to push it into.
-
-Second half: the batch read no longer swallows its own failures into an empty map. An empty map is an authoritative "this object has no overrides" and callers may still trust it and skip the per-view reads (the batch optimization is intact), but a transport failure now rejects, so the per-view `getView` fallback it was silently disabling becomes reachable again. `DataSource.listViewOverrides` documents both terms so other adapters implement the same contract.
diff --git a/.changeset/view-readonly-tooltip-semantics-3625.md b/.changeset/view-readonly-tooltip-semantics-3625.md
deleted file mode 100644
index 787ba81d36..0000000000
--- a/.changeset/view-readonly-tooltip-semantics-3625.md
+++ /dev/null
@@ -1,41 +0,0 @@
----
-'@object-ui/i18n': patch
----
-
-`view.readonlyTooltip` — the tooltip on a view tab's read-only lock — is
-retranslated in the eight packs (ja/ko/de/fr/es/pt/ru/ar) that still described
-the retired "duplicate to customize" workflow, so a Japanese, Korean, German,
-French, Spanish, Portuguese, Russian or Arabic session is told the view is
-defined in code and read-only, which is what `en` says and what the product
-does (#3625).
-
-This is the same stale sentence #3582 fixed one namespace over, but it hid
-behind a much better disguise. In #3582 the eight packs stored the **English**
-string, so two cheap criteria could see it: "value equals `en`" and "a
-non-Latin pack holds pure ASCII". Neither can see this key. Its eight values
-were **idiomatic translations** — real Japanese, real Cyrillic, real Arabic —
-of a sentence `en` itself had already abandoned. Nothing about their form was
-wrong; only their meaning was. Key sets were complete, so
-`all-locales-key-parity` was green; the key exists in `en`, so the call-site
-guard and its ratchet were green; the values are distinct and in their own
-scripts, so every heuristic #3582 sketched would have been green too. Eight
-locales spent those releases pointing users at a path the product no longer
-offers, with every gate reporting success.
-
-Each value is translated against `en`'s **current** meaning and built from
-words the same pack already uses — "read-only" from its own `view.readOnly` /
-`view.readonlyAriaLabel`, "defined in code" from
-`console.objectView.systemViewReadonly` / `cannotEditMetaView` — so the tooltip
-agrees with the copy beside it instead of introducing a ninth way to say
-read-only. Nothing is rewritten from the stale text.
-
-`en` and `zh` are unchanged, byte for byte, and no key is added or removed —
-the diff is eight values in eight files. A new
-`viewReadonlyTooltip-semantics-3625.test.ts` tests **meaning** rather than
-form, in both directions: no pack may name the duplicate/copy workflow in its
-own language, and every pack must positively carry all three pieces of the
-sentence ("system view", "defined in code", "read-only") so the negative check
-cannot pass on a gutted string. It also pins the `en` literal, so the next
-rewording of `en` fails in the PR that does the rewording rather than orphaning
-nine translations for another release — which is the invariant this family of
-defects has actually been missing.
diff --git a/.changeset/view-translation-keys-bare-only-3502.md b/.changeset/view-translation-keys-bare-only-3502.md
deleted file mode 100644
index 5cce40db9a..0000000000
--- a/.changeset/view-translation-keys-bare-only-3502.md
+++ /dev/null
@@ -1,15 +0,0 @@
----
-"@object-ui/i18n": patch
----
-
-Resolve `_views` translation keys by the bare view name only — the prefixed full name is no longer a second candidate
-
-`useObjectLabel().viewLabel` / `viewDescription` / `viewEmptyState` build their key by stripping the object prefix off the runtime view id (`crm_opportunity.pipeline_kanban` → `objects.crm_opportunity._views.pipeline_kanban.<tail>`). Until now, if that bare key missed, the resolver **also** tried the prefixed full name — `objects.crm_opportunity._views.crm_opportunity.pipeline_kanban.<tail>` — so a bundle authored against the prefixed spelling resolved too.
-
-**Behavior change:** it no longer does. A `_views` entry keyed by the prefixed full name is not read at all; the label falls back to the metadata default, exactly as it would if no translation had been written. Bundles keyed by the bare view name — the only spelling the extractor emits and `os lint` accepts — are unaffected.
-
-This closes an asymmetry, not a feature. The server-side resolver reads the one bare key (objectstack#5165), so a prefixed-key bundle produced a **translated label in the Console and English everywhere else**: the REST boundary, mobile, plain HTTP and SDUI consumers do not run this second resolution pass. The half-success was harder to notice than a clean miss, and it fossilized a second de-facto spelling of a key the platform has now converged on: per the objectstack#5164 ruling (2026-08-06, option A), the canonical `_views` key is the runtime view identity's bare name, with the i18n extractor deriving it from the view composer (objectstack#6124) and `packages/lint` enforcing that single spelling (objectstack#6038). This is the third and last leg of that convergence.
-
-The object-name axis is untouched: a bundle written against the short object name (`objects.opportunity._views.…`) still resolves when the runtime presents the namespaced name (`crm__opportunity`).
-
-**If a label stopped translating after this upgrade,** its `_views` key is written with the object prefix. Drop the prefix — `_views.crm_opportunity.pipeline_kanban.label` becomes `_views.pipeline_kanban.label`. `os lint` names these for you: a prefixed key is reported as `translation-target-unknown`, because no view of the object declares it.
diff --git a/.changeset/widget-config-panel-retired-action-keys-os7129.md b/.changeset/widget-config-panel-retired-action-keys-os7129.md
deleted file mode 100644
index 633510acff..0000000000
--- a/.changeset/widget-config-panel-retired-action-keys-os7129.md
+++ /dev/null
@@ -1,40 +0,0 @@
----
-"@object-ui/plugin-dashboard": patch
-"@object-ui/types": patch
----
-
-Studio's widget config panel no longer authors the retired `actionUrl` widget key
-
-`actionUrl` / `actionType` / `actionIcon` were retired at the WIDGET level in
-`@objectstack/spec` 17.0.0-rc.3 (objectstack#5010, ADR-0049 D2). They are
-`retiredKey` tombstones: `DashboardWidgetSchema` types them `never` and refuses
-any value, so authoring one is a tsc error and a parse error. Two producers in
-`plugin-dashboard` were still emitting the widget-level key anyway
-(objectstack#7129):
-
-- `WidgetConfigPanel` offered a Behavior-group field labelled "Click-through
-  URL", bound to `actionUrl`. That control was inert twice over: no dashboard
-  widget renderer has ever read `widget.actionUrl`, so a URL typed there never
-  navigated anywhere, and the value it wrote was refused by the spec.
-- `DashboardWithConfig` seeded `actionUrl: widget.actionUrl ?? ''` into every
-  widget config handed to the panel. Because the ADR-0021 save scrub only knew
-  the dataset-shape keys, that seed rode through to `onWidgetSave` on EVERY
-  save — so a Studio author who merely renamed a widget still persisted
-  `actionUrl: ''` into stored metadata, a key the spec then refuses. This is
-  the wider half of the defect: it did not require anyone to use the field.
-
-The Behavior group and the seed are both gone, and `sanitizeDraftForType` now
-scrubs all three keys as a second line of defence, for stored widgets that
-already carry them and for hosts that drive `WidgetConfigPanel` directly.
-
-Behaviour change surface: the widget config panel loses its Behavior section
-(that section contained only this one field). Nothing that rendered before stops
-rendering — the field had no consumer. `header.actions[]` keeps its own,
-unrelated and still-live `actionUrl`; only the widget-level key is a tombstone.
-
-Also corrects the `DashboardWidgetSchema` docblock in `@object-ui/types`, which
-listed the three retired keys among those that "flow in from the spec" next to
-live keys like `colorVariant`. They do flow in — as `?: never`. The docblock now
-says so, and notes that while authoring one is a tsc error, *reading* one still
-type-checks (`never | undefined`), which is exactly how these producers survived
-the 2026-08-04 sweep that removed the renderer-side reads.
diff --git a/apps/console/CHANGELOG.md b/apps/console/CHANGELOG.md
index fffdca657e..2ecae05e69 100644
--- a/apps/console/CHANGELOG.md
+++ b/apps/console/CHANGELOG.md
@@ -1,5 +1,91 @@
 # @object-ui/console
 
+## 17.4.0
+
+### Patch Changes
+
+- 28c3856: Register `approvals:inbox` as a component ref, and stop sending Home's "pending approvals" card into the setup app (objectstack#7231).
+
+  The Approvals Inbox had no addressable identity: nothing in any app's navigation metadata pointed at it, and every entry to it was a hardcoded path. `HomePage`'s action-center card spelled `/apps/setup/system/approvals`. That path is not wrong about the page — `system/approvals` is mounted as both `extraRoutes` and `extraRoutesNoApp`, so `/apps/{any app}/system/approvals` has always resolved — it is wrong about the app. A business user with approvals waiting but no access to `setup` followed the only entry Home offers them into the shell's "App not available" guard.
+
+  Two changes, one additive and one corrective:
+
+  - `approvals:inbox` now resolves in the component registry to the Approvals Inbox page, so a `{ type: 'component', componentRef: 'approvals:inbox' }` nav item renders the full inbox at `/apps/{app}/component/approvals/inbox` — tabs, drawer, decision actions and record deep links all scoped to `{app}`. Both mount paths are relative routes under `/apps/:appName/*`, so the page reads the same `:appName` and the same `?request={id}` deep link either way. The standalone `system/approvals` route is untouched and stays the target of server notification and email links; the registry key is purely additive indirection, so the approval surface can be rebuilt later behind the same key without any navigation metadata changing.
+  - The Home card now navigates within the app the user last had open, re-checked against their live active-app list so a remembered app that has since been deactivated is not resurrected as a dead link, falling back to their first available app. `setup` survives only as the last resort for an app carrying no addressable segment at all — the zero-app workspace never reaches this producer, because Home returns its welcome empty state before the action center exists.
+
+- 7883c02: Send the console host's legacy URL redirects straight to the canonical metadata-admin routes instead of routing them through the deprecated `component/metadata/resource` alias (objectui#3639).
+
+  `apps/console`'s `ObjectRedirect` and `MetadataRedirect` rewrote `system/objects[/:name]` and `system/metadata[/:type[/:name]]` onto `…/component/metadata/resource[/:name]?type=:type`. app-shell declares that spelling as a legacy _alias_, not a page: its route element is `LegacyMetadataRedirect`, which immediately navigates on to `…/metadata/:type[/:name]`. Every one of those URLs therefore took two `<Navigate>` hops (plus a re-render) to reach a destination the host could name directly — and it was this indirection that carried `sys-objects` into the zero-app blank screen fixed in objectui#3610, since the alias was the leg that branch did not recognise.
+
+  Both redirects now construct `…/metadata/:type[/:name]` (and `…/metadata` for the typeless directory arm) themselves. The endpoints are unchanged, byte for byte, including the alias hop's own percent-encoding of `:type` and its verbatim pass-through of `:name`; only the intermediate hop is gone. The alias routes stay declared exactly as they were — bookmarks, external links and the setup left-nav still arrive on them and are still forwarded — this change only stops the console feeding its own traffic through them.
+
+  Also corrects four docblocks that described the alias as "the engine route", in `apps/console`'s two redirects and in app-shell's `datasource` resource registration and page. That wording is not merely stale: the objectui#3610 dispatch read this chain and concluded `component/metadata/resource` was the canonical spelling, which is the exact opposite of what the route table says.
+
+- d2fd044: Point the last four navigation producers at the canonical metadata-admin routes instead of the deprecated `component/metadata` alias, removing a redirect hop from each (objectui#3660).
+
+  The System hub's "Metadata" and "Datasources" cards aimed at `…/component/metadata/directory` and `…/component/metadata/resource?type=datasource`, and the `sys-datasources` entry in both `AppSidebar.systemFallbackNavigation` and `UnifiedSidebar.homeNavigation` spelled the latter too. app-shell declares those spellings as legacy _aliases_, not pages: their route element is `LegacyMetadataRedirect`, which immediately navigates on to `…/metadata` and `…/metadata/datasource`. Every click on any of the four therefore paid a redundant hop plus a re-render to reach a destination the navigation could name directly. All four now name it.
+
+  The landing pages are unchanged, byte for byte — the new URLs are exactly what the alias hop was already computing (`datasource` percent-encodes to itself, and neither producer carried a query or hash beyond the `?type=` the alias itself consumed). Only the intermediate hop is gone.
+
+  The alias routes stay declared in both `AppContent` branches, untouched: bookmarks and external links still arrive on them and are still forwarded. This completes objectui#3639, which corrected the console host's two redirects and enumerated these four as the remainder.
+
+- c1a18ed: System Hub: a card count that failed to load no longer renders as `0`
+
+  Each count on the System Hub fetched one object and caught its own failure with
+  an empty page, so a 500, a 401, a 403 or a dropped connection all produced the
+  same confident `0` as a table that really is empty — no error, no retry, and no
+  way to tell the two apart. The most reachable case was a permission denial on a
+  single object: an administrator who may open the hub but cannot read
+  `sys_audit_log` was shown "0 entries" rather than being told anything at all.
+
+  A failed lookup now leaves that card's count unknown, and the badge — which
+  already renders only for a known count — is omitted, so the card shows no
+  number instead of a wrong one. The catch stays on each call rather than around
+  the batch, so one object's failure blanks only its own card and the cards beside
+  it keep the real numbers they received.
+
+  Unchanged: an object the backend does not have still counts `0`. The adapter
+  resolves an unregistered object as an empty page by design (callers read empty
+  as "feature unavailable"), so that never was an error and is not treated as one
+  here.
+
+- 278f57c: Count System Hub's Organizations card through `sys_organization`, the object the framework actually registers — it asked for `sys_org`, which does not exist, so the card read `0` on every deployment (objectui#3670).
+
+  The failure was silent by construction. A missing object answers `404 OBJECT_NOT_FOUND`, and `ObjectStackAdapter.find()` absorbs that on purpose — it caches the name in `missingResources` and resolves `{ data: [], total: 0 }` so callers can treat an uninstalled collection as "no rows". The hub renders `data.length`, so a name the framework never had produced a perfectly ordinary `0`, indistinguishable from a workspace that genuinely has no organizations — which no single-org deployment ever is, since `sys_organization` always holds at least one row. The `.catch` on each call never even saw the 404; it only ever covered non-404 rejections.
+
+  The other three counted names were checked against the framework's object registry and are correct as spelled: `sys_user`, `sys_position`, `sys_audit_log`.
+
+  The Permissions card is **not** fixed here and still reads `0`. Its query names `sys_permission`, which the framework also does not have — it splits that surface into `sys_capability` (lineage: its own docblock says "named `sys_capability`, not `sys_permission`") and `sys_permission_set` (function: the admin-managed grant container). Both would render, so choosing one would silently bind the card to a surface nobody picked; that decision is open on objectui#3655. Until it lands the gap is held visible by a MEASUREMENT case in the page's test rather than quietly re-aimed.
+
+- cc95c2c: Point System Hub's Permissions card — both its link and its count — at `sys_permission_set`, closing the last of the five `system/*` navigation targets (objectui#3655).
+
+  Four of those URLs became redirects in an earlier change; `system/permissions` was deliberately held back, and so was the count beside it, because the framework splits what this console calls "Permissions" into two Setup entries and picking one would have silently bound every click, bookmark and badge to a surface nobody chose:
+
+  - `sys_capability` — ADR-0066 layer 1, the definition registry of "what can be done". Its own docblock notes it is what the ADR "loosely floats" as `sys_permission`, which is the name the retired page and the count query both used, so lineage pointed here.
+  - `sys_permission_set` — ADR-0066 layer 2, the grant container the permissions docs call "the only capability container" (object CRUD, field security, access depth, system capabilities), so function pointed here.
+
+  It is decided as `sys_permission_set`: the card reads "Manage permission rules and assignments", and rules-and-assignments is layer 2 — a capability is what a permission set references by name, not what an administrator is assigned. Two user-visible consequences:
+
+  - `/apps/:app/system/permissions` now forwards in one hop to `/apps/:app/sys_permission_set` instead of being rewritten to `…/system/record/permissions` and rendering a record detail page for an object literally named `system` — a dead link that read as a backend fault.
+  - The Permissions card's badge shows the real number of permission sets. It previously counted `sys_permission`, an object the framework does not register; the adapter absorbs that `404` into an empty page on purpose, so the card printed a confident `0` no administrator could tell apart from "there really are none".
+
+  Recorded as a transitional alias. Retiring this hand-written card wall along with the hub (already `@deprecated` in favour of the metadata-driven navigation) remains open and does not conflict — a redirect keeps old bookmarks resolving either way.
+
+- 9961df2: Declare the retired `system/{users,organizations,roles,positions}` console URLs as redirects onto the framework-owned system objects (objectui#3655).
+
+  `SystemHubPage`'s cards and both sidebars' `sys-*` cluster emit five `/apps/setup/system/…` targets. Four of them were real routes until `apps/console` was slimmed for third-party customisation, which deleted the bespoke wrapper pages because "these objects are now contributed by framework plugins … and resolved via the generic `/apps/setup/<object_name>` route" — but the producers were never retargeted and nothing redeclared the URLs. All five fell through to app-shell's tail, where the failure they got depended on how long the word was, because `ShorthandRecordRedirect` treats any URL-safe segment of 6+ characters as a record id:
+
+  - `users` (5) and `roles` (5) rendered "Page not found".
+  - `organizations` (13) and `positions` (9) were rewritten to `…/system/record/<word>` and rendered a record detail page for an object literally named `system` — the worse of the two, because it reads as a backend/data problem rather than a dead link.
+
+  Each now forwards in one hop to the object the framework's own Setup navigation names: `sys_user`, `sys_organization` (the list entry — the record-scoped one needs a runtime `{current_org_id}` a static redirect cannot resolve), and `sys_position` for both `roles` and `positions` (ADR-0090 D3 renamed `sys_role` to `sys_position`, so the sidebar's "Roles" and the hub's "Positions" are one surface in two vocabularies). Same shape as the `system/objects` and `system/metadata` redirects beside them: the URL is translated, the deleted page is not resurrected, and the navigation producers are untouched.
+
+  `system/permissions` is deliberately left as it was. The framework splits what this console calls "Permissions" into two Setup entries — `sys_capability` and `sys_permission_set` — and picking one here would silently commit every click and bookmark to a surface nobody chose. Its unchanged landing is pinned in the tests so the gap stays visible.
+
+- Updated dependencies [d11996e]
+  - @object-ui/react-runtime@17.4.0
+  - @object-ui/sdui-parser@17.4.0
+
 ## 17.3.0
 
 ### Minor Changes
@@ -110,6 +196,7 @@
     `severity` were dropped and the toast read the bare HTTP status text.
 
   ## What changed
+
   - `jsonOrThrow` unwraps the envelope with the exact predicate
     `ObjectStackClient.unwrapResponse` uses — `success` is a boolean **and**
     `data` is present. Requiring both is what keeps error envelopes
@@ -303,7 +390,7 @@
 
 ### Patch Changes
 
-- 752e18f: fix(console,app-shell): readable reassign hand-off + "System" label for svc:* audit actors — objectstack#4365 / objectstack#4366
+- 752e18f: fix(console,app-shell): readable reassign hand-off + "System" label for svc:\* audit actors — objectstack#4365 / objectstack#4366
 
   - **Approvals inbox** (`ApprovalsInboxPage`): a reassign timeline entry now
     renders "from A to B" from the structured
@@ -871,6 +958,7 @@
   is byte-identical, it just comes from the pack now.
 
   Adds two guards, both mutation-verified:
+
   - `en` ↔ `zh` full key parity, asserted in both directions. The other eight
     packs are still ~357 keys behind and are tracked separately (objectui#2872
     part a), so they are deliberately not asserted yet.
@@ -926,6 +1014,7 @@
   all four of its failure modes, and re-introducing the `maplibre-gl` import turns
   the job red again, as does a fresh error injected into `plugin-ai` — a package
   that had no type checking whatsoever before this change.
+
   - @object-ui/react-runtime@17.0.0
   - @object-ui/sdui-parser@17.0.0
 
@@ -979,6 +1068,7 @@
   `record.viewer.*` — and correctly recognizes position/team-addressed approvers
   that the client heuristic couldn't resolve. The heuristic remains as a fallback
   for a backend that predates `viewer`.
+
   - @object-ui/react-runtime@16.1.0
   - @object-ui/sdui-parser@16.1.0
 
@@ -1110,6 +1200,7 @@
   - **Permission matrix OWD badges**: every object row now shows its record-level baseline (`OWD Public read`, `Ext Private`, or `OWD Private (default)` for the D1 fail-closed unset case) so grant edits carry their record-reach context.
 
   The flow designer's approval assignee `role` kind is intentionally unchanged — spec 13 keeps it as the sole D3 exception (better-auth `sys_member.role` org-membership tier).
+
   - @object-ui/react-runtime@13.0.0
   - @object-ui/sdui-parser@13.0.0
 
@@ -1424,6 +1515,7 @@
 - efb4c00: feat(observability): Sentry integration + bundle splitting for production launch
 
   **Sentry (opt-in via `VITE_SENTRY_DSN`)**
+
   - New `initSentry()` / `captureError()` / `setSentryUser()` / `getSentry()`
     helpers exported from `@object-ui/app-shell`.
   - Dynamic-import design: when `VITE_SENTRY_DSN` is unset, `@sentry/react`
@@ -1441,6 +1533,7 @@
     stripped from breadcrumb URLs before send.
 
   **Bundle splitting**
+
   - `plugin-dashboard` (8 component types) now lazy-registered via
     `ComponentRegistry.registerLazy()` — only loads on dashboard pages.
   - `plugin-dashboard` and `plugin-report` each get their own chunk
@@ -1537,6 +1630,7 @@ CONCURRENT_UPDATE` response shape with `currentVersion` /
   detail view (`TypeError: titleFormat.replace is not a function`) and printed
   `Failed to evaluate expression: ${[object Object]}` for every action visibility
   predicate.
+
   - `@object-ui/core`: `ExpressionEvaluator.evaluate` / `evaluateCondition` now
     unwrap Expression envelopes transparently.
   - `@object-ui/react`: new `toPredicateInput()` helper to safely normalize
diff --git a/apps/console/package.json b/apps/console/package.json
index 31e5ae8840..bfe7e8aa01 100644
--- a/apps/console/package.json
+++ b/apps/console/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/console",
-  "version": "17.3.0",
+  "version": "17.4.0",
   "description": "ObjectStack Console — opinionated, fork-ready runtime console built on @object-ui/app-shell with the full plugin set wired up. Ships as a Hono UI plugin serving a pre-built SPA.",
   "license": "MIT",
   "type": "module",
diff --git a/packages/app-shell/CHANGELOG.md b/packages/app-shell/CHANGELOG.md
index 4b79dd45e7..4b91dfdced 100644
--- a/packages/app-shell/CHANGELOG.md
+++ b/packages/app-shell/CHANGELOG.md
@@ -1,5 +1,1239 @@
 # @object-ui/app-shell — Changelog
 
+## 17.4.0
+
+### Minor Changes
+
+- bd863fe: fix(timeline): the timeline binds to the date axis the view actually declares (#3129)
+
+  A view whose date axis is bound under `calendar` was **offered** the Timeline
+  visualization and then bucketed every record into "No date" — while the calendar
+  rendered the very same field correctly. Two read-sites disagreed about what
+  counts as a timeline binding:
+
+  - `ListView`'s capability gate accepted `options.calendar.startDateField` as a
+    timeline-resolvable axis; the render branch never read calendar config at all,
+    so it fell through to its `created_at` last resort.
+  - `app-shell`'s object page emitted `startDateField: 'due_date'` into
+    `options.timeline` for **every** object view, declared or not. Downstream that
+    is indistinguishable from a real binding, and because it is always present it
+    shadowed the fallback entirely.
+
+  `ListView` now resolves the axis once — `resolveTimelineDateBinding`, consumed by
+  the capability gate and the render branch alike, reading spec key before legacy
+  alias and `timeline` before `calendar` in both nestings — and the object page
+  forwards only what the view declared. A declared `timeline.startDateField` still
+  wins wherever both appear, and a view that declares no date axis anywhere keeps
+  the historical `created_at` fallback.
+
+  Observable rendering change (records move out of "No date" into real date
+  buckets), hence `minor`.
+
+### Patch Changes
+
+- 993336f: An action declaring `disabled: ''` is no longer greyed out forever (objectui#3842)
+
+  The "is a `disabled` gate declared?" test stopped at `!= null`, missing the
+  `!== ''` half of the invariant the `visible` family converged on
+  (`hasDeclaredVisibilityGate`, objectui#3492 / #3758 / #3812 / #3823 / #3835). So
+  `disabled: ''` counted as a declared gate, and the verdict went to the evaluation
+  entry — which reads an empty predicate as "no condition → `true`"
+  (`toPredicateInput('')` is `undefined`, `evaluateCondition(undefined)` is `true`).
+
+  The direction is why this half is a defect and the `visible` half was not. On
+  `visible`, that `true` means SHOW, so an over-broad "declared" test and a
+  permissive empty predicate cancel out and `visible: ''` renders either way. On
+  `disabled`, the same `true` means DISABLE — the two mistakes compound, and an
+  empty predicate stopped meaning "no gate" and started meaning "permanently
+  greyed out". One empty predicate, opposite treatment under two keys.
+
+  Two gates now ask the shared definition instead:
+
+  - `@object-ui/app-shell`'s `DeclaredActionsBar` — the hot one. Its actions are
+    SERVER-declared (`objectDef.actions[]`) and its hosts are the approvals inbox's
+    record sections, so a `disabled: ''` arriving from metadata (an authoring form
+    left empty, a template that rendered to an empty string) produced an Approve /
+    Reject button nobody could click, indistinguishable from deliberate metadata.
+    objectui#3835 was this same surface failing the other way.
+  - `@object-ui/components`' `action:button` — verified to be the same shape before
+    it was changed (the issue inferred it from the identical spelling but did not
+    probe it): with `disabled: ''` the rendered button carried `disabled=""`.
+
+  **Behaviour change surface, deliberately narrow.** Only `disabled: ''` changes —
+  from disabled to clickable, which is what "no predicate" asked for. `disabled:
+true` still disables, `disabled: false` and an absent `disabled` still do not, and
+  no expression-valued `disabled` changes verdict. One consequence worth naming: on
+  `action:button`, an empty `disabled` now falls THROUGH to the legacy non-spec
+  `enabled` fallback instead of short-circuiting on the empty predicate, so an
+  action spelling both (`disabled: ''` + `enabled: true`) becomes clickable.
+
+  The legacy `enabled` leg of `action:button` was routed through the same
+  definition for consistency, and that part is behaviour-preserving by derivation
+  rather than a fix: the leg is negated (`disabled = !isEnabled`), so an empty
+  predicate's `true` already arrived as "not disabled" — the same verdict "no gate"
+  produces. All four shapes are identical under either test; the derivation table
+  and the reason no test can distinguish them are written down next to the pins.
+
+  `hasDeclaredVisibilityGate` keeps its historic name at both call sites (the
+  objectui#3842 dispatch ruling): the predicate is key-neutral, and one
+  implementation behind two names is how a repo grows dialects. Each call site says
+  so in a comment.
+
+- d518a90: `datetime` action params are usable in the Console for the first time — the dialog now POSTs the zoned ISO instant the platform requires instead of a shape the validator rejects
+
+  An action declaring a `type: 'datetime'` param was unusable from the UI: **no
+  value a user could pick could pass validation**. The dialog rendered the param
+  as `datetime-local` (which is zone-less by nature) and then serialized on
+  submit back to that control's own naive wall clock, e.g. `2026-08-10T15:00`.
+  Since 17.0 the dispatcher validates a params bag against the action's
+  declaration before the handler runs (ADR-0104 D2, `validateActionParams` →
+  `InstantValueSchema`), and that contract is an ISO-8601 instant with an
+  explicit zone. Every submission earned:
+
+  ```
+  HTTP 400 VALIDATION_ERROR
+  Action param "start" (datetime): expected an ISO-8601 instant with explicit
+  zone (e.g. 2026-03-15T14:30:00.000Z)
+  ```
+
+  The renderer and the validator wanted disjoint shapes, and an app author had no
+  seam between them — declaring a `datetime` param doomed the action in the UI,
+  whatever the app. Found in a hotcrm dogfood run (objectstack#5061), reproduced
+  from two separate entry points (list-view row menu and record header).
+
+  The fix is a removal, not a conversion. `DateTimeField` has been ISO-canonical
+  on both sides since objectui#3127/#3565 — it takes the record's ISO instant in
+  and hands an ISO instant back out, seconds, milliseconds and zone included — so
+  the widget's own value already satisfies the contract. #3565 added the
+  back-conversion to keep the wire shape byte-identical while it fixed a display
+  bug, and named the follow-up in its own commit message: moving action params
+  onto ISO is a contract change of its own. This is that change.
+  `serializeParamValues` now passes `datetime` values through untouched, which
+  makes it idempotent for a value that already carries a zone (a `+08:00` offset
+  survives byte-for-byte rather than being re-derived and re-cut to the minute)
+  and leaves an empty or unfilled param alone.
+
+  Deliberately still rejected: an authored `defaultValue` written as a zone-less
+  wall clock. That value is ambiguous metadata — whose zone? — and coercing it in
+  the renderer would make it "work" in the UI while the identical literal kept
+  400ing from REST and MCP, which is the worst split to debug. It stays loud
+  until the spec validates a param default against the param's own value
+  contract, filed as objectstack#6970 (the same hole lets a `number` param
+  default to `'abc'`, so it is not datetime-specific).
+
+  The render proof that pinned the old shape was replaced rather than re-spelled:
+  it asserted `2026-07-20T14:30` and was green while the feature was 100% broken,
+  because the shape it pinned is the one shape nothing accepts. It now drives the
+  real widget and asks the real `validateActionParams` — the exact function that
+  produced the 400 — whether the resolved bag is acceptable. The datetime
+  assertions are written to hold in every timezone (verified under
+  `Asia/Shanghai`, `UTC` and `America/Los_Angeles`), since a zone-shaped test that
+  only holds in UTC goes green on CI while the defect is live for every user east
+  or west of it.
+
+- cdc0e44: `ActionParamDialog` boolean params: the dialog now owns the control id, so the checkbox is named once instead of twice
+
+  The boolean branch rendered `<Label htmlFor={param.name}>` beside the control but
+  passed the widget no `id`, unlike its own generic branch a few dozen lines below,
+  which has always passed `id={param.name}`. Measured on a real dialog render, a
+  `boolean` param labelled "Confirm This" produced TWO label elements pointing at
+  one control — the dialog's visible one and a `sr-only` copy the widget emitted —
+  so the checkbox's accessible name was the two concatenated: screen readers
+  announced "Confirm This Confirm This".
+
+  Two distinct problems, one line apart:
+
+  - The association was IMPLICIT. It resolved only because `BooleanField`'s id
+    fallback chain reaches `config.name`, which `paramToField` seeds from
+    `param.name`, so both sides landed on the same string by coincidence of
+    another package's internals. A host that renders `htmlFor` must emit the id it
+    names; that is what the declared `id` key of the widget contract is for.
+  - The duplicate `sr-only` label. objectui#3952 / PR #3959 made `BooleanField`
+    suppress its own label whenever a host supplies the id — precisely because a
+    host that supplies an id is a host that renders a label. Receiving no id, this
+    branch never triggered that suppression.
+
+  Both `for` targets resolved, so unlike objectui#3341 and objectui#3952 this was
+  never a dangling label: clicking the row's text already toggled the control, and
+  still does. What changes is the announced name, which is now the single
+  "Confirm This" the author declared. The generic branch is untouched.
+
+- 28c3856: Register `approvals:inbox` as a component ref, and stop sending Home's "pending approvals" card into the setup app (objectstack#7231).
+
+  The Approvals Inbox had no addressable identity: nothing in any app's navigation metadata pointed at it, and every entry to it was a hardcoded path. `HomePage`'s action-center card spelled `/apps/setup/system/approvals`. That path is not wrong about the page — `system/approvals` is mounted as both `extraRoutes` and `extraRoutesNoApp`, so `/apps/{any app}/system/approvals` has always resolved — it is wrong about the app. A business user with approvals waiting but no access to `setup` followed the only entry Home offers them into the shell's "App not available" guard.
+
+  Two changes, one additive and one corrective:
+
+  - `approvals:inbox` now resolves in the component registry to the Approvals Inbox page, so a `{ type: 'component', componentRef: 'approvals:inbox' }` nav item renders the full inbox at `/apps/{app}/component/approvals/inbox` — tabs, drawer, decision actions and record deep links all scoped to `{app}`. Both mount paths are relative routes under `/apps/:appName/*`, so the page reads the same `:appName` and the same `?request={id}` deep link either way. The standalone `system/approvals` route is untouched and stays the target of server notification and email links; the registry key is purely additive indirection, so the approval surface can be rebuilt later behind the same key without any navigation metadata changing.
+  - The Home card now navigates within the app the user last had open, re-checked against their live active-app list so a remembered app that has since been deactivated is not resurrected as a dead link, falling back to their first available app. `setup` survives only as the last resort for an app carrying no addressable segment at all — the zero-app workspace never reaches this producer, because Home returns its welcome empty state before the action center exists.
+
+- 65d6c07: Page block inspector: the input hints inside the properties panel follow the session's language
+
+  objectui#3913 turned `block-config.ts`'s `label` / `addLabel` / option labels into
+  translation keys and stopped at the column next to them. The 8 `placeholder`
+  values that are prose stayed display text, so a zh-CN admin opening `page:header`
+  read 「图标」 over a box hinting `lucide icon name`, and `record:details`'
+  「名称（i18n 键）」 over `snake_case, e.g. contact_info` — in the panel #3913 and
+  objectui#3963 had just finished translating. Those 8 are now keys under
+  `engine.inspector.pageBlock.placeholder.<blockType>.<field path>`, resolved by
+  `PageBlockInspector` at render, with en-US and zh-CN both defined. The en-US text
+  is byte-identical to the literals it replaces, ellipsis included, so an English
+  admin sees no change.
+
+  The column could not simply follow `label`, and that is the design half of this
+  change: it is a MIXED surface. Of the 18 placeholders, 10 are example VALUES — a
+  row count `20`, `https://…`, the inline-action sample
+  `{ "type": "url", "target": "/environments" }` — and translating those would be a
+  defect, not a courtesy. A localized JSON sample is metadata `InlineActionSchema`
+  rejects, and a "translated" default row count means nothing at all.
+
+  So which kind a placeholder is, is declared in the type rather than left to a
+  convention plus a list of exceptions:
+
+      placeholder?: { key: string } | { literal: string }
+
+  A bare `placeholder: 'lucide icon name'` — the shape this file used until now,
+  and the first thing anything generating a new field reaches for — no longer
+  compiles. That matters more than the eight strings: `type-check` runs in every
+  lane and in the editor, so the mistake is caught where it is made instead of
+  becoming an English box in a Chinese panel that waits for a reviewer to notice.
+  `addLabel` was made required for the same reason in #3913; `placeholder` stays
+  optional, because a field with no hint is legitimate.
+
+  The keyed half joins the derivation pin
+  (`previews/__tests__/block-config-i18n.test.ts`) as a fifth key family, so a new
+  prose placeholder without a translation is red rather than shipping. The literal
+  half is pinned as an inventory with a reason per entry, because "finish
+  translating the other ten" is the plausible next edit and it needs to argue with
+  a test first. `block-config.test.ts`'s snake_case assertion moved from the raw
+  placeholder to the RESOLVED hint in both locales, which is now the stronger
+  statement: the `snake_case` token has to survive translation, not merely exist in
+  English.
+
+- 2c632d9: Context selectors: picking an option the instant the dropdown fills no longer snaps back to the first one
+
+  A context selector is a _mandatory_ scope, so `SelectorControl` auto-selects
+  `options[0]` as soon as the option list resolves and nothing concrete is
+  selected yet. That repair ran in a passive effect — a task AFTER the commit that
+  rendered the option rows — which left a gap in which the dropdown was already
+  rendered and clickable while no selection had been made. A pick delivered inside
+  that gap was applied and then immediately undone: the queued auto-select fired
+  second, carrying a closure from before the pick (`hasConcrete` still `false`,
+  and the search string it wrote from still the pre-pick one), so the user's
+  choice was replaced by the first row — silently, and for a `persist: 'query'`
+  selector with a URL rewrite behind it.
+
+  The gap is widest exactly where it matters: a slow options endpoint, a loaded
+  machine, or a low-end device, i.e. the cases where a user is most likely to be
+  already reaching for the option they want. The repair is now a layout effect, so
+  it lands in the same synchronous flush as the options it reacts to — no event
+  can be delivered in between, and the control is never painted with an empty
+  value while options exist.
+
+  Nothing else about the behaviour moves: same trigger, same deps, same one write
+  per medium. A scope that a later param-less nav link drops is still
+  re-established from the first option (the re-selection objectstack#5994 relied
+  on when it deleted the storage-to-URL bridge), which is pinned alongside the two
+  medium cases in `ContextSelectors.autoSelectRace.test.tsx`.
+
+  Found as a CI flake in `ContextSelectors.persist.test.tsx`
+  (objectstack#6979): under load the test's own pick lost the same race, twice,
+  with `expected 'billing' to be 'crm_core'`. Those cases now settle the
+  auto-select before picking, which also pins a fact none of them pinned before —
+  a user's pick overrides the auto-selected first option.
+
+- d3e738a: Server-declared actions declaring `visible: false` are now hidden instead of rendered as live buttons (objectui#3835)
+
+  `DeclaredActionsBar` — the bar that renders an object's SERVER-declared actions
+  for one record at a `location`, with no per-action host code — asked truthiness
+  on the gate: `if (action.visible && !isVisible) return null`. `false && …` is
+  falsy, so `visible: false`, the most explicit way an author can say "never show
+  this", fell into the "no gate declared" branch, the verdict was never consulted,
+  and the action rendered for everyone.
+
+  What that means on the page: the bar's host is the approvals inbox's
+  record-section toolbar (`apps/console/src/pages/system/ApprovalsInboxPage.tsx`),
+  so an approval action the metadata had switched off with `visible: false`
+  rendered as a live Approve / Reject / Reassign button — and this component's own
+  click handler is what POSTs the decision. One click was a real approve/reject
+  call on a request the declaration said not to offer a decision on.
+
+  This is the fifth and last member of the objectui#3492 family (after
+  objectui#3758 / PR #3816 for the row-action surfaces and objectui#3812 / #3823
+  for the action face), and the one whose two family-wide mitigations both fail:
+
+  - The action defs are **server-declared** (`objectDef.actions[]`,
+    `sys_approval_request`), not hand-written view JSON. "`ActionSchema.visible` is
+    `ExpressionInputSchema` with no boolean member, so `objectstack build` cannot
+    emit this shape" does not apply on this path — the def arrives from server
+    metadata and in-process construction, where a boolean is the natural spelling.
+  - The bar is mounted as **plain JSX** by its hosts, so `packages/react`'s
+    `SchemaRenderer` — which evaluates a node's `visible` and hides it before the
+    component mounts, and which is why objectui#3812 judged the component-level
+    gates a dormant defensive layer — is not on this path at all. This gate was the
+    only one there.
+
+  The gate now reads the family's one named definition,
+  `hasDeclaredVisibilityGate` (`!= null && !== ''`), imported from
+  `@object-ui/components` rather than re-spelled: five gates in three packages
+  asking one question must not drift into five answers. The evaluation entry is
+  untouched — `toPredicateInput` passes a boolean through and `useCondition`
+  short-circuits it instead of calling the expression engine — so a declared
+  `false` resolves to `false`, and every expression-valued `visible` keeps exactly
+  the verdict it had.
+
+  Behaviour change surface, deliberately narrow: only a declared action whose
+  `visible` is the literal boolean `false` (or another falsy non-empty value)
+  changes, from rendered to hidden, which is what the declaration asked for.
+  `visible: true` still renders, `''` and an absent `visible` are still no gate at
+  all, and the bar still renders no chrome when its located set is empty.
+
+  The suite that covered this component could not have caught it: it stubbed the
+  whole predicate entry constant-true (`useCondition: () => true`), with a comment
+  saying the test actions omit `visible` "so this is unused" — which made the gate
+  unreachable from the only tests that mount this component (the objectstack#4984
+  family, where a fixture keeps a broken rule green). That stub is gone; the suite
+  now runs the real `useCondition` / `toPredicateInput` and doubles only the action
+  dispatch, so all four shapes (`false` hides / `true` renders / undeclared renders
+  / `''` is not a gate) are judged by the shipped evaluation semantics.
+
+- b691f06: Ask the view composer for a container's view identities instead of deriving `list.name || 'list'`, so the default list view's translated label resolves
+
+  A `defineView` container declares its default list under the `list` key. That key is a slot in the authoring document, not the view's identity: `expandViewContainer` — the same composer the framework's loader and the i18n extractor call — registers an unnamed default list as `<object>.default`. This renderer derived `list.name || 'list'` instead, a third spelling no producer emits, so a default-list-only object probed `objects.<object>._views.list.label`, missed the published `_views.default.label` key (objectstack#5164 ruling A, migrated in objectstack#6124) and fell back to the English metadata label — for the view's description and empty state too.
+
+  - `MetadataProvider.mergeViewsIntoObjects` now expands a stack-packaged container through `expandViewContainer` and routes the result through the same code path as first-class ViewItems. Both authoring gates therefore key `listViews` / `formViews` by the canonical `<object>.<key>` identity, and the container inherits the composer's folding (a `listViews` entry that merely restates `list` collapses into one view) and collision renaming instead of restating them locally.
+  - `ObjectView` resolves the primary view's id through the new `defaultListViewId` helper — one derivation shared by the view-override lookup and the view-switcher promotion, with no literal fallback.
+
+  The renamed id is also the key a view override is persisted under (`updateViewConfig(object, viewId, …)` writes a `view` metadata record named by the id). Nothing is orphaned: the retired `'list'` spelling is not a representable view identity at all — `ViewItemNameSchema` requires a dotted `<object>.<key>` name — while the record-gate path, which real backends serve, already used the qualified id. Stale `/view/list` links fall back to the object's default view, which is the same view they named.
+
+- e06810e: `PageComponentSchema.dataSource` is now consumed instead of discarded — a
+  `list-view` page component can reference a **saved view by name** for the first
+  time, and writing the binding no longer breaks the component
+  (objectstack#5576).
+
+  The spec declares a per-element data binding on every page component —
+  `dataSource: { object, view?, filter?, sort?, limit? }` — and objectui read none
+  of it. `ViewDataProvider.resolveElementDataSource` forwarded
+  `filter`/`sort`/`limit` and dropped `view` entirely, and had no caller outside its
+  own test; nothing mapped `object` onto the `objectName` a list actually reads. So
+  "reference a saved view by name" was published, validated and inert, and every
+  page that wanted a saved view's columns/filter/sort had to inline a second copy of
+  them — the drift the binding exists to remove.
+
+  Writing the binding also **broke** the block, for a reason unrelated to `view`:
+  `SchemaRenderer` spread the schema's `dataSource` metadata onto the component as a
+  React prop, and that is the prop name the host uses to inject the data-source
+  ADAPTER. The plain `{ object, view }` object shadowed the adapter, so the first
+  `dataSource.find(…)` threw `dataSource.find is not a function` and `list-view`
+  rendered "Couldn't load records" — a spec-compliant component failing next to
+  identical ones that omitted the binding.
+
+  - `@object-ui/react` — `SchemaRenderer` no longer spreads `schema.dataSource` as a
+    prop (it is metadata, like `visibleWhen`); renderers read it off `schema`. An
+    explicit React `dataSource` prop is unaffected. New
+    `useElementDataSource(schema, dataSource?)` hook resolves a binding, fetching
+    the named saved view from the object definition's `listViews` and the metadata
+    overlay's `listViews()`.
+  - `@object-ui/core` — new `isElementDataSourceConfig` / `collectSavedViews` /
+    `resolveSavedView` / `composeElementDataSource`, and `resolveElementDataSource`
+    now honours `view` through an optional `DataFetcher.fetchViews`, reporting an
+    unresolvable view as an error instead of silently returning every record.
+    `resolveViewId` moved here from `@object-ui/app-shell` (re-exported there) so
+    one matcher serves both the object page and a page component.
+  - `@object-ui/plugin-list` — `list-view` maps the binding onto the props
+    `ListView` reads. `dataSource.*` keys are authoritative, view-supplied values
+    are a baseline the component's own keys override, and `filter` AND-combines at
+    every level (the spec calls the binding's filter "additional criteria"), so a
+    binding can narrow a saved view but never widen it. A `view` name that does not
+    resolve renders a configuration error naming the object's actual views and
+    issues no query — it never falls back to the object's default view, because that
+    turns a typo into a silently wider answer.
+
+- 0ef94ca: console: hold the environment list's create CTA with a skeleton until entitlements
+  resolve, instead of showing a label that is about to be overwritten (objectui#3482,
+  part of cloud#1049).
+
+  `EnvironmentListToolbar` presents a state-aware create affordance — "Set up your
+  production environment" / "Add development environment" / an upgrade prompt — decided
+  from `GET /cloud/environment-entitlements`. While that request was in flight the
+  toolbar rendered the action's metadata label, so the button visibly changed its
+  wording the moment the response landed. The two texts are owned by different
+  packages (the cloud translation bundle vs this repo's locale packs), which made the
+  swap read as an inconsistency rather than a load.
+
+  The in-flight state now renders a `Skeleton` sized like the button it stands in for,
+  matching the adjacent `cloud:onboarding-next` welcome CTA. Only the create action is
+  withheld — other toolbar actions never re-label, so they keep rendering — and a
+  toolbar without a create action gets no skeleton at all. The skeleton is never
+  terminal: when both entitlement signals fail, the resolution settles as
+  `{ ready: false, source: 'unknown' }` and the neutral metadata label is shown, which
+  remains the honest text for a state where "which create is this?" is genuinely
+  unknown.
+
+- 13b72c7: Render the `/home` Administration group as a real group, so its nine system-administration entries are reachable (objectui#3609).
+
+  `UnifiedSidebar` picks its renderer with one ternary on `context === 'app' && activeApp`. Only the app arm rendered `NavigationRenderer`, the component that descends into `type: 'group'` children; the home arm hand-rolled `homeNavigation.map(item => <Link to={item.url || '/home'}>)` with no recursion. Since home navigation is the only navigation that groups, the whole nine-entry Administration cluster collapsed into one row — and a group carries no `url` of its own, so `|| '/home'` pointed that row back at the page the user was already on. System Settings, Applications, App Marketplace, Object Manager, Datasources, Users, Organizations, Roles and Configuration never reached the DOM. `resolveLandingPath([])` sends a fresh-deployment admin to `/home`, and `HomePage` had deliberately dropped its own System card on the grounds that the sidebar already carried those entries, so the net effect was an admin with no route into system administration at all.
+
+  The home arm now renders through the same `NavigationRenderer` as the app arm rather than growing a second renderer that recurses: the group becomes a Collapsible and every entry passes the same item-level `visible` / `requiredPermissions` / runtime-capability guards. Hrefs are unchanged — home entries are all `type: 'url'`, whose resolution is verbatim. The group states `expanded: true` so it opens by default: the renderer's unauthored default collapses groups of eight or more children, a heuristic for one long section among many, whereas on `/home` this group _is_ the navigation. Pinning and drag-reorder stay off in the home context, where their persistence key resolves to the first app rather than to home. Non-admins are unaffected — the cluster is still built behind the `isWorkspaceAdmin` gate and is absent from their item tree.
+
+- 7883c02: Send the console host's legacy URL redirects straight to the canonical metadata-admin routes instead of routing them through the deprecated `component/metadata/resource` alias (objectui#3639).
+
+  `apps/console`'s `ObjectRedirect` and `MetadataRedirect` rewrote `system/objects[/:name]` and `system/metadata[/:type[/:name]]` onto `…/component/metadata/resource[/:name]?type=:type`. app-shell declares that spelling as a legacy _alias_, not a page: its route element is `LegacyMetadataRedirect`, which immediately navigates on to `…/metadata/:type[/:name]`. Every one of those URLs therefore took two `<Navigate>` hops (plus a re-render) to reach a destination the host could name directly — and it was this indirection that carried `sys-objects` into the zero-app blank screen fixed in objectui#3610, since the alias was the leg that branch did not recognise.
+
+  Both redirects now construct `…/metadata/:type[/:name]` (and `…/metadata` for the typeless directory arm) themselves. The endpoints are unchanged, byte for byte, including the alias hop's own percent-encoding of `:type` and its verbatim pass-through of `:name`; only the intermediate hop is gone. The alias routes stay declared exactly as they were — bookmarks, external links and the setup left-nav still arrive on them and are still forwarded — this change only stops the console feeding its own traffic through them.
+
+  Also corrects four docblocks that described the alias as "the engine route", in `apps/console`'s two redirects and in app-shell's `datasource` resource registration and page. That wording is not merely stale: the objectui#3610 dispatch read this chain and concluded `component/metadata/resource` was the canonical spelling, which is the exact opposite of what the route table says.
+
+- 8c60819: The inbox popover now spells out what the bell badge is made of
+
+  The bell badge is `unread notification topics + pending approvals`, clamped to
+  "9+" above nine. As one number it is unexplainable: objectstack#7213 measured
+  Home's "pending approvals" card saying 8 while the bell said "9+", and read that
+  as the two counts disagreeing — they never did, the bell was simply carrying a
+  second addend the user could not see.
+
+  The popover already tabs the two streams and puts a count pill on each tab, so
+  the split was partly visible — but those pills clamp at "9+" too. A loaded
+  console therefore showed three "9+"s that reconcile to nothing, which is why
+  sectioning alone did not close this.
+
+  A breakdown line under the popover header now states the exact, unclamped
+  addends beside the exact total — `15 total · 12 notifications + 3 pending
+approvals`. The approvals half is the same `pendingApprovalsCount` the Home card
+  and the Approvals Inbox tab read, so the number a user reconciles against is
+  literally the one they see elsewhere.
+
+  The badge formula, the counting APIs and the "9+" clamp on the badge itself are
+  unchanged — this is a display fix. Three new keys
+  (`notifications.badgeTotal` / `badgeNotifications` / `badgeApprovals`) land in
+  all ten locale packs. They interpolate named placeholders (`{{total}}`,
+  `{{unread}}`, `{{approvals}}`) rather than i18next's `{{count}}`, which would
+  additionally drive plural-key resolution these packs carry no forms for.
+
+- 1037e1a: Name the `InspectorComboField` trigger: the visible label now owns it, and an anonymous combo no longer compiles (objectui#3997).
+
+  This is the fourth inspector field atom with the shape PR #3996 fixed for the three in `_shared.tsx` — a `Label` rendered as a plain sibling of the control, with no `htmlFor`, no `id` and no `aria-label`. It lives in its own module, so it stayed broken after the other three were closed. The label and the `button[role=combobox]` were adjacent only visually: assistive tech announced an anonymous combobox with the field name floating above it as unowned text, `getByLabelText` could not reach it, and clicking the visible label did nothing. It renders at eighteen call sites across the object-field, dataset, dashboard-widget, app-nav and view-variant inspectors (lookup display/description fields, `lookupFilters` rows, summary aggregates, dataset dimensions and measures, nav targets), so it is on screen the moment any of those panels opens.
+
+  The labelled branch closes the pair the same way the other atoms do: `React.useId()` mints the id inside the atom, `Label` gets the `htmlFor`, and the id lands on the trigger `Button` that `PopoverTrigger asChild` renders. Never on `Popover` — Radix's `Popover.Root` is a context provider that renders no DOM element, so an id handed to it is dropped silently and the `for` dangles, which is the objectui#3976 / #3994 mistake this repo has now paid for twice.
+
+  `label` was optional, and the un-labelled branch was the same defect one notch worse: a combobox with no name at all. Five of the eighteen call sites had authored exactly that. Rather than adding a lenient fallback (synthesising a name from the placeholder would have produced "Select…" as the announced name), naming became a type-level requirement of exactly one of three channels:
+
+  - `label` — the atom renders the visible label and owns the association. Unchanged for the thirteen call sites that already passed one.
+  - `ariaLabel` — for repeated rows where no visible label exists and one would break the grid: an app-nav URL filter's `field = value` pair, a dataset's list of joined relationships, the dependent-lookup "add a field" picker.
+  - `id` — for when an external `Label htmlFor` already owns the naming. `DashboardWidgetInspector` wraps its controls in a `Field` that renders `Label htmlFor={id}` and hands the same id to the control; every other field honoured it (`Input id`, `SelectTrigger id`) but the dataset combo could not, because the atom accepted no id. That `for` pointed at an id nothing carried — a dangling IDREF, worse than an unnamed control, because tooling reports an association that resolves to nothing.
+
+  Zero channels and two channels are now both unauthorable: zero is anonymous, and two is the double-announcement failure objectui#3961/#3978 exists to avoid. Neither has a runtime symptom the component could detect and report — an unnamed combobox renders, lays out and commits values perfectly, and is wrong only for the users who cannot see it — so the check is compile-time or nothing. It is pinned in `InspectorComboField.naming.types.test.tsx`, listed in `tsconfig.typetests.json` so a compiler actually reads it.
+
+  One new pair of strings (`engine.inspector.widget.filterBindingField`, en-US + zh-CN) names the per-filter binding combo in the dashboard widget inspector, which sits under a heading that captions its whole row rather than the combo alone.
+
+- dffeeef: Metadata-admin inspectors: the shared text / number / select field labels now name their control
+
+  The three generic field atoms of every scoped inspector — `InspectorTextField`,
+  `InspectorNumberField`, `InspectorSelectField` — rendered a `Label` as a plain sibling of
+  their control, with no `htmlFor`, no `id` and no `aria-label` fallback. Label and control
+  were adjacent only visually: assistive tech announced an anonymous "edit box" / "combobox"
+  while the visible field name sat above it as unowned text, and clicking the label did
+  nothing. Measured before the fix, `getByLabelText('Group')` — the same `for`→id chain a
+  screen reader walks — found zero matches for all three.
+
+  These atoms are consumed by 16 non-test modules (page-block, flow-node, report, dataset,
+  permission and object-field inspectors, plus the object-group inspector in Studio design),
+  so every inspector panel rendered nameless inputs the moment it opened.
+
+  Each atom now mints its own id with `React.useId()` and closes the pair. The id is minted
+  inside the atom rather than taken as a prop deliberately: these atoms render in loops over
+  array items (`record:details.sections[i]`, `page:tabs.items[i]`) where every item repeats
+  the same label, which is precisely where a caller-supplied id collides — and a collision is
+  invisible, because both labels would still resolve, to the first control. `useId()` cannot
+  collide by construction; per-instance uniqueness is pinned rather than assumed.
+
+  For the select the id lands on `SelectTrigger`, never on `Select`: Radix's `Select.Root`
+  renders no DOM element of its own, so an id handed to it is silently dropped and the
+  label's `for` dangles — the same mechanism objectui#3976 fixed one directory over. The
+  trigger renders the real `button[role=combobox]`, a labelable element, so one `for`/`id`
+  pair names it with no second `aria-labelledby` channel. `disabled` stays on Root (single
+  authority over trigger, items and the hidden native mirror) and a disabled select is still
+  named.
+
+  `InspectorCheckboxField` was already correct — it uses a wrapping `label`, a valid
+  association that needs no id — and is untouched, serving as the positive control in the
+  tests.
+
+  Follow-on for test authors: `PageBlockInspector.sectionName.test.tsx` located its section
+  name boxes by placeholder _because_ `getByLabelText` could not reach them. That workaround
+  is gone; the boxes are located by their label, and the `snake_case` placeholder convention
+  keeps its own dedicated assertion.
+
+- 41d6022: The console no longer reads `/meta/*` before it knows whether it has a session, and a failed request now says which request failed
+
+  Opening a logged-out console painted ~30 red `HTTP request failed` lines before
+  the login form was drawn. Two independent causes, fixed independently
+  (objectui#4042).
+
+  **1. Requests fired before the session was known.** `ConnectedShellInner` now
+  withholds the metadata tree until `GET /auth/get-session` resolves, so
+  `meta/object` / `meta/view` / `meta/app` are never issued blind. `useAuth()`
+  outside an `AuthProvider` reports `isLoading: false`, so an embed with no auth
+  provider is unaffected, and every protected route already sat behind an
+  `AuthGuard` that resolves auth first — the signed-in data flow is unchanged.
+
+  The console's landing route (`<Route path="/">`) was the actual entry point for
+  the burst: it mounted `ConnectedShell` with no guard above it, so simply opening
+  `/_console/` mounted the whole data layer as an anonymous visitor. It is now
+  guarded, which also means an unauthenticated visitor reaches `/login` without a
+  single doomed request. `examples/console-starter` had the same shape and got the
+  same fix.
+
+  **2. Two requests per type, per mount — not an unauthenticated artefact.**
+  Consumers read metadata during the FIRST render (`useActionModal` reads
+  `objects`, whose getter kicks `ensureType('object')` and `ensureType('view')`
+  from the render phase), before any effect runs. `MetadataProvider`'s preview-mode
+  effect then cleared the whole cache on mount, discarding those two entries while
+  their requests were in flight; the next render found them `idle` and refetched
+  both. The effect now skips its mount run — on mount the cache is empty and there
+  was never anything to drop; it only ever meant something on a later
+  `previewDrafts` change. That halved `meta/object` and `meta/view` on **every**
+  mount, signed in included.
+
+  A second duplicate only appeared once a read had failed: `entry.promise`
+  collapses callers that arrive while a request is in flight, but callers arriving
+  just after a failure each started a fresh attempt. A failed type now stays
+  un-retried for ~1s, which collapses one mount's burst of callers into a single
+  attempt. This is deliberately not the 5-minute `ttlMs` — later callers still
+  retry on their own, and `refresh()` / `invalidate()` retry immediately and
+  unconditionally, so no explicit recovery path changes.
+
+  **3. `HTTP request failed` now identifies the request.** `@objectstack/client`
+  reports every non-2xx as
+  `logger.error("HTTP request failed", undefined, { method, url, status, error })`,
+  and the console's logger forwarded that verbatim — so the identifying fields
+  lived only in the third argument, and anything that flattens a console record to
+  text rendered them `[object Object]` / `Object`. A screenful of failures could
+  not tell you a single URL or status. The message string now carries them:
+
+  ```text
+  HTTP request failed: GET /api/v1/meta/object -> 401 [UNAUTHORIZED]
+  ```
+
+  The structured bag is still passed alongside for DevTools to expand — text for
+  the flatteners, object for the inspectors, neither at the other's expense. The
+  formatter is exported as `formatHttpFailureMessage`, and `createQuietHttpLogger`
+  is now exported too so an app wiring its own `ObjectStackClient` gets the same
+  identified failures.
+
+  Nothing is newly silenced. The only demotion remains 404-on-an-optional-
+  collection (`sys_presence`, `sys_activity`), which is an expected outcome of a
+  request we still mean to make; a 401 that survives the session gate — a
+  mid-session expiry, say — stays a visible, fully-identified error. The cure for
+  doomed requests is not issuing them, never hiding them once issued.
+
+- be9cd38: metadata-admin: name the offending key when only one union member ever read the value
+
+  A union with no discriminant reports its failure as one collapsed issue, and the
+  member diagnostics that would name the problem are buried inside it. PR #3677
+  started unpacking those for `config.columns` by reading the value's own content,
+  but deliberately declined every union where some member had rejected the value's
+  type outright — which left `config.sort` (`string | ColumnSort[]`) collapsed even
+  though only one of its two members had read the value at all.
+
+  When exactly one member accepted the value's type, naming it is a fact rather
+  than a preference: it is the only member whose complaint can be about what the
+  author wrote. So `sort: [{ field: 'n', order: 'bogus' }]` now reports
+  `config.sort.0.order` with the spec's own `expected one of "asc" | "desc"`
+  instead of `config.sort` / `Invalid input`, and the same holds for a sort row
+  that is not an object, a `columns[].summary` written as a bad enum string, a form
+  `sections[].fields[]` entry missing its `field`, and an array `filter[].value`
+  whose offending element is now addressed directly.
+
+  Where two or more members read the value, or where none did, nothing changes:
+  the previous message is kept rather than inventing a preference between members
+  that objected equally. Both gates — create and edit — continue to report
+  identically, and validation verdicts are untouched: the accept/reject decision is
+  still made by the one gate, and this only changes how an already-failed draft is
+  presented.
+
+- ebb579d: metadata-admin: an unresolvable visibility-predicate path now fails OPEN, loudly (objectstack#6936)
+
+  `views/metadata-admin/predicate.ts` promised fail-open in its own header — "on any
+  parse error → returns `true`: better to show a field than to silently hide it" —
+  and delivered it only for _thrown_ errors. A path whose root identifier did not
+  exist in the evaluation scope took a quieter route: `resolveValue` returned
+  `undefined`, and then every comparison judged it false —
+  `['text','number'].includes(undefined)`, `undefined === 'text'` — so a predicate
+  referencing a name that is not there **hid** the field. Fail-CLOSED, the opposite
+  of the documented promise, with nothing in the console.
+
+  The bite case is a version-skew window, measured in objectui#3923: `@objectstack/spec`
+  ≤ 17.0.0-rc.5 spells the `objectForm` sub-field predicates bare (`type in ['text',…]`,
+  16 of them) while this engine evaluates them against a `{ data: draftRow }` scope. A
+  console upgraded ahead of its backend resolved `type` to nothing, and all 16
+  type-conditional Studio sub-fields — Min / Max / Precision / Scale / Max Length /
+  Min Length / reference / deleteBehavior / expression / returnType /
+  autonumberFormat / language … — disappeared for every row type at once. The symptom
+  users saw was "the config items are gone", indistinguishable from a permission
+  problem or an unsupported field type.
+
+  Per the maintainer ruling on objectstack#6936 (option C):
+
+  - **An unresolvable path evaluates `true`.** The field stays visible instead of
+    vanishing, honouring what the header always claimed.
+  - **Dev mode says so**, naming the unresolved path _and_ the predicate that
+    carried it, warn-once per (path, predicate) pair — the shape
+    `warnOnUnknownActionKeys` established in `@object-ui/core`. Keying the memo on
+    the path alone would have reported the first of the 16 skewed predicates and
+    stayed silent about the other fifteen.
+
+  **The boundary, which is the load-bearing half.** "Unresolvable" means the path's
+  ROOT identifier is not a name the scope declares (`type`, `record.status`,
+  `page.selectedId` against a scope whose only name is `data`). It does _not_ mean
+  "the value came out undefined": `data.type == 'text'` on a draft that has no
+  `type` yet resolves its root fine, the draft simply carries no value there — that
+  comparison is still false and the field stays hidden, silently, exactly as before.
+  A draft is allowed to be empty; widening fail-open to any absent value would light
+  up every type-conditional sub-field at once on a fresh row. A typo one segment
+  deep (`data.tpye`) is indistinguishable from an unfilled draft field _without the
+  schema_, which this evaluator does not have — catching that belongs to
+  publish-time validation of predicate path references at the producer (filed
+  separately), not to a renderer heuristic (Commandment #0.1).
+
+  The signal is a thrown internal error, deliberately not a sentinel value: fail-open
+  is a property of the whole predicate, not of the sub-expression that failed. A
+  sentinel would have to be threaded through `!`, `&&`, `||`, `in` and `==` by hand,
+  and the first operator that missed it would invert the verdict — `!unresolvedPath`
+  would resolve the inner path to "true-ish" and negate it straight back to false,
+  i.e. fail-CLOSED again by another route. Throwing routes every failure to the one
+  fail-open gate that already existed; `!unresolvedPath` is pinned true.
+
+  Unchanged, and pinned: the pre-existing parse-error fail-open (still silent — the
+  path resolved, reading it blew up, a different fact); CEL-order absorption, where
+  `false && unresolvable` is false and `true || unresolvable` is true with no
+  warning because the unresolvable half was short-circuited away; and CEL-style loose
+  nullish equality (`data.type == null` on an empty draft is still true).
+
+- d2fd044: Point the last four navigation producers at the canonical metadata-admin routes instead of the deprecated `component/metadata` alias, removing a redirect hop from each (objectui#3660).
+
+  The System hub's "Metadata" and "Datasources" cards aimed at `…/component/metadata/directory` and `…/component/metadata/resource?type=datasource`, and the `sys-datasources` entry in both `AppSidebar.systemFallbackNavigation` and `UnifiedSidebar.homeNavigation` spelled the latter too. app-shell declares those spellings as legacy _aliases_, not pages: their route element is `LegacyMetadataRedirect`, which immediately navigates on to `…/metadata` and `…/metadata/datasource`. Every click on any of the four therefore paid a redundant hop plus a re-render to reach a destination the navigation could name directly. All four now name it.
+
+  The landing pages are unchanged, byte for byte — the new URLs are exactly what the alias hop was already computing (`datasource` percent-encodes to itself, and neither producer carried a query or hash beyond the `?type=` the alias itself consumed). Only the intermediate hop is gone.
+
+  The alias routes stay declared in both `AppContent` branches, untouched: bookmarks and external links still arrive on them and are still forwarded. This completes objectui#3639, which corrected the console host's two redirects and enumerated these four as the remainder.
+
+- b7b05da: Point the `sys-objects` navigation entries at the canonical metadata-admin route instead of the `system/metadata/object` alias, removing a redirect hop from each click (objectui#3739).
+
+  `AppSidebar.systemFallbackNavigation`, `UnifiedSidebar.homeNavigation` and `console/home/QuickActions` all spelled this target `/apps/setup/system/metadata/object`. That is not a page: `apps/console`'s host fragment declares `system/metadata/:metadataType` with `MetadataRedirect` as its element, which immediately navigates on to `/apps/setup/metadata/object` — the engine's real route (`metadata/:type`, `MetadataResourceListPage`). Every click therefore paid a redundant hop plus a re-render to reach a destination the navigation could name directly. All three now name it.
+
+  This is the same defect objectui#3660 fixed for `sys-datasources`, declared on the line immediately below `sys-objects` in both sidebar arrays. It was missed there because the two entries reached their aliases through different route tables — `sys-datasources` through app-shell's own `component/metadata/resource` alias, `sys-objects` through the host's `system/metadata/:type` rewrite.
+
+  The landing page is unchanged, byte for byte: the new URL is exactly what the alias hop was already computing (`object` percent-encodes to itself, and no producer carried a query or hash). Only the intermediate hop is gone. Of the three producers, the two sidebars are live; `QuickActions` has no JSX call site today, so its change is a guard against the dead link returning with the component.
+
+  The alias routes stay declared and untouched: bookmarks and external links still arrive on them and are still forwarded.
+
+- fa3ba5b: Make the zero-app console's "Object Manager" / "Datasources" entries resolve, and give that branch a not-found screen instead of a blank one (objectui#3610).
+
+  On a deployment with no published apps, the system fallback navigation sends `sys-datasources` to `/apps/setup/component/metadata/resource?type=datasource` and `sys-objects` to `/apps/setup/system/metadata/object` (rewritten by the console host onto the same legacy alias). `isMetadataRoute` is a substring test on `/metadata`, so both URLs pass the "No Apps Configured" guard and enter `AppContent`'s no-`activeApp` route table — which declared no `component/…` route at all and, unlike the with-`activeApp` table, carried no trailing catch-all. A `<Routes>` with no match renders `null`, so an admin building their first object got a fully blank screen: no 404, no error, no empty state.
+
+  Both halves are fixed on the routing side, with no navigation URL changed. The two legacy metadata aliases (`component/metadata/directory`, `component/metadata/resource/*`) are now declared in the no-`activeApp` branch too, mirroring the with-`activeApp` branch — they are redirects, not a second copy of the page, so they forward onto the canonical `metadata/:type` routes that branch already declared. And the branch now ends in the same `path="*"` → "Page not found" screen the with-app branch has always had, so the next unresolved URL in a zero-app console is reportable rather than invisible.
+
+- 9089d85: The no-apps empty state's "Create Your First App" CTA now opens the app-creation
+  flow instead of silently bouncing the user back to the landing page. It called
+  `navigate('/create-app')` — an ABSOLUTE path, so it resolved against the HOST's
+  root route tree, which declares no `/create-app`; the reference host's trailing
+  `<Route path="*">` therefore replaced it with `/`. The `create-app` route is
+  declared by `AppContent` itself, inside the `/apps/:appName/*` subtree (both the
+  no-active-app branch and the with-app router), so the CTA now builds the
+  app-scoped `/apps/<segment>/create-app` — the platform's canonical app URL
+  (ADR-0048) and the same target the sidebar's add-app entry already links to. On
+  a fresh zero-app deployment this was the first screen's only route into app
+  creation, and it read as a button that does nothing (#3573).
+
+  A plain relative `navigate('create-app')` is deliberately NOT the fix, and the
+  new routing test pins why: under the installed react-router 7,
+  `getResolveToMatches` resolves a relative target against the LEAF match's full
+  `pathname` with the splat INCLUDED (in v6 this was the `v7_relativeSplatPath`
+  future flag; v7 hardcodes it). The empty state renders across a whole URL family
+  — `/apps/setup` and any deeper `/apps/setup/<segment>` — so the relative form is
+  right only at the shallowest of them and builds
+  `/apps/setup/<segment>/create-app` elsewhere, which matches no route and renders
+  a blank screen instead of the bounce. The sibling "System Settings" CTA is
+  unchanged.
+
+- d1be436: Point the "System Settings" entries at the system hub `/apps/setup/system` instead of the bare `/apps/setup` (objectui#3590).
+
+  `AppContent` mounts the system hub only under `isSystemRoute`, which keys on a `/system` path segment. A bare `/apps/setup` therefore matched no pseudo-route except `isSetupRoute` and fell back into the "No Apps Configured" guard — i.e. on a zero-app deployment it _is_ that empty state's own URL, so the empty state's `go-to-settings-btn` re-rendered the very screen it sits on. Retargeted three call sites: the empty state's CTA, `AppSidebar`'s no-active-app `sys-settings` fallback entry, and `UnifiedSidebar`'s `/home` Administration `sys-settings` entry. Every sibling entry in both clusters already spelled `/apps/setup/system/...`.
+
+- 949b2f1: metadata-admin: name the offending column when `config.columns` is rejected
+
+  `config.columns` is `string[] | ColumnDef[]` — a union with no discriminant — so
+  Zod reported every rejection as one collapsed issue on the field itself:
+  `config.columns` / `Invalid input`, on the create gate and the edit gate alike.
+  The field was reachable, but nothing said which column was wrong, which key, or
+  what was expected.
+
+  The union member is now chosen by the value's own first element — a list of
+  field names or a list of column objects — and that member's real diagnostics are
+  reported at their draft-absolute path. A mis-typed key reports
+  `config.columns.0.field` with `expected string, received number`; a stray number
+  in a list of field names reports the element that broke it rather than every
+  element of the shape the author never chose. The aggregated container reaches
+  the same union as `list.columns.…`, and both gates now report identically.
+
+  Only unions that really are "an array of A or an array of B" are read this way,
+  so neighbours such as `config.sort` (`string | ColumnSort[]`) are untouched.
+  Where the content elects nothing — a first element that is neither a string nor
+  an object — the previous message is kept rather than guessing.
+
+  Validation verdicts are unchanged: the accept/reject decision is still made by
+  the one gate, and this only changes how an already-failed draft is presented.
+
+- d86b41c: Honour all three `AppContextSelectorSchema.persist` values in app context selectors: `'query'` (the default) writes and reads the URL query parameter only, `'session'` writes and reads `sessionStorage` only, and `'none'` writes neither — the pick stays in memory for that mount. Previously every selector was mirrored into both stores and read back as `URL ?? storage`, so `'session'` and `'query'` were indistinguishable and `'none'` persisted anyway. Selectors on the `'query'` default (including Studio's package scope) no longer write `objectui-ctx-*` storage, and a scope dropped by a param-less nav link is re-established by auto-select-first instead of from a store the author never declared.
+- 99ba5fb: The AI plan / confirm cards send the agent text in the CONVERSATION's language, not the console UI's (objectui#3896)
+
+  #772 / #2884 established the rule and `AiChatPage` states it at the gate:
+  outbound text follows the conversation, rendered labels follow the UI locale.
+  Only half of it was implemented. Three of the four outbound messages read
+
+      convZh ? '<Chinese literal>' : t('console.ai.…')
+
+  and `t()` is the **UI pack**, so the "not Chinese" branch answered with the UI
+  locale rather than with English. The fourth, `planAnswerMessage`, had no gate at
+  all.
+
+  Two measured consequences, one in each direction:
+
+  - **A zh console holding an English conversation sent Chinese.** The `zh` pack
+    defines all four keys, so the `t()` lookup HIT instead of falling through to
+    its English default: clicking "Build it" put `确认，开始搭建。` into an English
+    thread. Cloud's confirm gate (`service-ai-studio` `confirm-gate.ts`
+    `APPROVAL_RE`) recognises both languages, so the build ran — and the agent
+    switched the rest of the thread to Chinese. That is objectui#2884's symptom
+    with the trigger reversed.
+  - **The answer chip sent the UI locale in both directions.** Ungated, it put
+    `For "…", go with: …` into a Chinese thread — objectui#772's opening complaint
+    verbatim — and a Chinese sentence into an English one under a zh console.
+
+  All four sites now go through one resolver,
+  `packages/app-shell/src/console/ai/outboundAgentText.ts`: a Chinese conversation
+  gets the `zh` pack's value, every other conversation gets the `en` pack's value,
+  and the UI pack is never consulted. The three console AI surfaces (`/ai` page,
+  chat dock, Studio copilot) all mount the same `ChatPane`, so all three change
+  together.
+
+  Reading the two packs directly rather than `t(key, { lng })` is deliberate: an
+  i18next lookup's answer depends on which bundles the host app loaded and on
+  `fallbackLng`, and a `zh` lookup silently falling back to `en` is exactly the
+  wrong-language bug above. The per-language fallback table in the resolver is
+  pinned byte-identical to both packs, so a Chinese conversation falls back to
+  Chinese — never to English — if a pack ever stops defining a key.
+
+  Labels are untouched: they still follow the UI locale, and the pin that fails
+  when a `*Label` drifts into the conversation gate (objectui#3837) now also fails
+  when an outbound `*Message` is read back out of the UI pack.
+
+- 708aaf8: fix(metadata-admin): page block inspector chrome follows the locale
+
+  `PageBlockInspector`'s own JSX carried hardcoded English that no translation
+  table could reach: the row-adder of every field list (`Add`), the per-row and
+  per-item remove `aria-label`s (`Remove` / `Remove item`), and the free-text
+  fallback placeholders of the object picker and the field list. All now resolve
+  through `engine.inspector.pageBlock.*` keys defined in both en-US and zh-CN.
+  The JSON editor's parse error reuses the catalog's existing
+  `engine.form.invalidJson` instead of its own literal, and holds the parse
+  failure as state so the message follows a later locale switch. English is
+  unchanged.
+
+- 62c6441: Page block inspector: the PROPERTIES panel's curated field labels now follow the session locale instead of always rendering English
+
+  `PageBlockInspector`'s chrome went through the translation table from the start —
+  `t('engine.inspector.pageBlock.properties')` and its siblings — while the panel's
+  CONTENTS did not. Every `label` in `previews/block-config.ts` was an English
+  literal handed straight to the field components, so a zh-CN admin opening any
+  page block read 「属性」 over a stack of English field names: two languages in one
+  panel, reproducible on any block with no special data.
+
+  All 157 label literals (152 field/option labels + 5 `addLabel`s) are now
+  translation keys resolved through `t(key, locale)` at render, with 154 distinct
+  keys added to both the `en-US` and `zh-CN` sides of
+  `views/metadata-admin/i18n.ts`. The English text is unchanged: every key's `en`
+  value is the literal it replaced, verified by substituting all 157 keys back and
+  diffing the result byte-for-byte against the pre-change file.
+
+  The key is a function of the label's POSITION in `BLOCK_CONFIG`
+  (`engine.inspector.pageBlock.field.<blockType>.<name>`, `.add.<blockType>.<name>`,
+  `.option.<fieldName>.<value>`), and a test re-derives all three shapes from the
+  table's own structure. That is what makes the realistic mistake visible: these
+  keys differ by one segment, so adding a block by copy-pasting a neighbour's key
+  yields a key that EXISTS in both locales and renders a plausible label belonging
+  to a different property — an existence-only check is green for it. Positional
+  keys also let one English word take different Chinese per block, which the panel
+  needs: `element:button.label` is a button caption 「按钮文字」 while
+  `page:tabs.items.label` is a tab title 「标签」, and `Add section` is 「添加分区」
+  here but stays 「添加分组」 in the form-layout canvas.
+
+  `addLabel` is now REQUIRED on the `array` field variant. It was optional and the
+  inspector fell back to a bare English `'Add'` — an untranslatable literal no
+  locale table could reach. Requiring it deletes the fallback instead of
+  translating it, so a new array field cannot compile without naming its
+  add-button key.
+
+  Option labels are translated too, including the ones `ColorVariantPicker` renders
+  only as `aria-label`/`title`, where an untranslated string is invisible to a text
+  query.
+
+- 5419f55: The Studio RLS editor no longer authors the retired `rowLevelSecurity[].priority` key (objectstack#7130)
+
+  `rowLevelSecurity[].priority` was removed in `@objectstack/spec` 17.0.0
+  (objectstack#3896) and left as a `retiredKey` tombstone in
+  `packages/spec/src/security/rls.zod.ts` — an authored value is REJECTED at parse
+  time with the upgrade prescription, not ignored. It promised "conflict
+  resolution" that cannot exist: applicable policies OR-combine (most permissive
+  wins), so there is no conflict to order.
+
+  `PermissionAdvancedFacets` — the structured RLS editor on the Studio permission
+  matrix — was still typing the key and seeding `priority: 0` on every policy its
+  "Add policy" button created. Its docblock described the shapes as mirroring the
+  framework spec, but that mirror was sampled before the removal. Nothing on the
+  save path removed the key: `doSave` sends the draft verbatim, and at package
+  scope `mergePermissionSlice` copies `rowLevelSecurity` from the freshly-read
+  base while taking only `objects`/`fields` from the edit — so at environment
+  scope (the only scope where these facets are persisted) the seeded key went
+  straight into the saved permission set. A user who added an RLS policy through
+  the editor therefore wrote a permission set the parser refuses.
+
+  Three changes, all editor-side:
+
+  - the local `RlsPolicy` shape drops `priority`;
+  - the Add-policy seed drops `priority: 0` — it now authors exactly
+    `{name,object,operation,using,enabled}`;
+  - policies are stripped of the retired key as they are read out of the draft, so
+    a permission set already carrying `priority` (written by this editor before
+    this fix) comes out clean the moment any RLS edit re-emits the list. This is
+    editor hygiene, not a data migration: a set nobody opens is untouched, and the
+    strip is keyed to the named tombstone rather than being a blanket unknown-key
+    purge, so every live key the editor does not itself render survives a
+    round-trip.
+
+  The docblock stops claiming the shapes are "sampled from live data" — that
+  sampling is exactly how a removed key stayed in the editor for ten days.
+
+- b3439f4: The plan card's "Building…" badge follows the console UI locale, like every other label on it (objectui#3837)
+
+  `AiChatPage` gates four strings on `convZh` — the language of the CONVERSATION,
+  not of the UI — because the cloud confirm gate (`service-ai-studio`
+  `confirm-gate.ts` `APPROVAL_RE`) recognises Chinese and English only, so what the
+  confirm cards SEND has to match the thread it is sent into (objectui#772 /
+  objectui#2884). The file's own comment above that gate ends with the other half
+  of the rule: "button LABELS stay on the UI locale."
+
+  `planBuildingLabel` (objectui#2632) had drifted onto the wrong side of it, and
+  handed back a hard-coded `正在搭建…` for any Chinese thread. Two consequences,
+  both measured:
+
+  - **A mixed-language card.** Under an English console, a Chinese thread's plan
+    card rendered `Proposed plan` / `Build it` / `Built` / `Not yet built` in
+    English with one Chinese badge in the middle. objectui#2458 item 4 recorded the
+    reverse direction of the same disease.
+  - **A dead translation.** A Chinese conversation always took the literal, so the
+    zh value of `console.ai.planBuilding` was unreachable for Chinese readers —
+    re-wording the pack changed nothing for them. objectui#3546 slice four had just
+    backfilled that key into all ten packs (PR #3839) and could only contain the
+    defect, by making the zh value byte-identical to the literal and pinning the two
+    together.
+
+  The badge now reads `t('console.ai.planBuilding', …)` like its twelve neighbours,
+  so all ten packs are reachable — a German console with a Chinese thread renders
+  `Wird erstellt…` — and the zh pack is the single source of the Chinese wording
+  (unchanged: `正在搭建…`, so no Chinese reader sees a different string than before).
+
+  The three OUTBOUND strings (`planApproveMessage`,
+  `planApproveDefaultsMessage`, `changesConfirmMessage`) are untouched and still
+  follow the conversation: each is passed to `onSendMessage` and read by the gate,
+  which is the class the `convZh` branch exists for. The slice-four containment pin
+  in `packages/i18n/src/__tests__/console-namespace-3546.test.tsx` is flipped in the
+  same change — it now fails if a gate reappears over that label, or if any future
+  `convZh` read feeds something rendered instead of something sent.
+
+- 5f752a0: Match the built-in pseudo-routes on whole path segments, so a mistyped app name can no longer render a different app (objectui#3638).
+
+  `AppContent` decides whether a URL is a built-in pseudo-route (`create-app`, `system/*`, `metadata/*`, `setup`) before it decides which app to render, and two of those switches were substring tests: `pathname.includes('/system')` and `pathname.includes('/metadata')`. Both are true for any segment that merely _starts_ with the word — `system_log`, `system_setting`, `systems`, `metadata_import`, `metadata-export`. `isSpecialRoute` feeds `requestedAppMissing`, so visiting `/apps/<mistyped-app>/system_log` marked the URL as a pseudo-route, suppressed the "App not available" guard, fell back to the default app and rendered **that** app's shell with `system_log` taken as its object name — the exact "must NOT silently render a DIFFERENT app" case the fallback's own comment exists to prevent, with no indication that the requested app does not exist.
+
+  The two flags now test path _segments_ (`pathname.split('/').includes('system' | 'metadata')`); `isCreateAppRoute`'s `endsWith('/create-app')` is unchanged. Every real pseudo-route spells the word as a whole segment — `system/marketplace{,/installed,/:packageId}`, the host's `system/{apps,profile,approvals,ai-approvals,audit-log,settings,objects,metadata/…}`, `metadata/{,_diagnostics,:type,…}` and the legacy `component/metadata/{directory,resource/*}` aliases — so all of them stay special, including in the zero-app branch that keys on these flags directly (objectui#3590 / #3610). Knock-on, in a zero-app console only: a `system`-prefixed near-miss such as `/apps/setup/system_log` now reaches the same "No Apps Configured" screen every other unresolved URL there reaches, instead of the pseudo-route branch's "Page not found".
+
+- fbc23e0: Action params that inherit a field's options now keep the keys that field declared
+
+  A field-backed action param (`{ field: 'tier' }`) had its inherited option list
+  rebuilt entry by entry as `{ label, value }`, which silently dropped every other
+  key the field's options declared — most consequentially the per-option
+  `visibleWhen` predicate (ADR-0058). A select field whose options narrow by
+  predicate in an object form therefore offered the FULL list in an action dialog,
+  including the entries the predicate exists to hide, with no diagnostic on either
+  side; `color` / `icon` / `disabled` were lost the same way. Options authored
+  inline on the param were never affected — they always passed through verbatim,
+  which is the asymmetry this restores.
+
+  The resolver now preserves each inherited entry and only does its two real jobs:
+  expanding bare strings into label/value pairs and translating the label through
+  `fieldOptionLabel`. The option widgets already filter on `visibleWhen`, so a
+  role-gated option (`'admin' in current_user.positions`) inherited by a dialog
+  param now narrows the offered set and clears a seeded value the predicate hides.
+
+  `ActionParamDef.options` (`@object-ui/core`) and the resolver's `RawActionParam`
+  are widened to match: `ActionParamOption` names the two keys the param layer
+  reads and carries the rest of a field's option vocabulary through.
+
+- 6d762da: The five locale keys behind #3546's eight no-fallback `t()` call sites are now defined in all ten packs, so the built-in-view toasts, the activity-timeline source link, the wizard's required-field toast and the Gantt refresh button's accessible name are translated instead of falling back to English — or, on two surfaces, to the key itself (part of #3546).
+
+  `scripts/check-i18n-call-site-keys.mjs` measured 258 keys that a `t()` call site asks for and no pack defines. These five were the subset with no working inline default: `console.objectView.cannotEditMetaView`, `console.objectView.cannotDeleteMetaView`, `detail.viewSource`, `gantt.toolbar.refresh` and `wizard.missingRequired`. Adding a `defaultValue` is deliberately not the fix — that mechanism is what kept all 258 invisible for months.
+
+  **Two of the eight sites really did render the raw key**, and both go through a binding with nothing in front of i18next. `ObjectView.tsx` calls `useObjectTranslation()` directly, so five toasts read `console.objectView.cannotEditMetaView` / `cannotDeleteMetaView` on screen; the `|| 'Built-in views cannot be renamed.'` guards next to them were dead on every path, because i18next answers a miss with the key itself and a non-empty string never falls through `||`. Those four unreachable English strings are removed rather than repaired: one key served four call sites (rename / pin / set-as-default / configure), so the pack copy covers any change to a built-in view instead of naming one operation. `RecordActivityTimeline.tsx` fails the same way for a subtler reason — `useDetailTranslation` is `createSafeTranslation(..., 'detail.back')`, and because `detail.back` does resolve, the probe hands back i18next's `t` for every key and bypasses the defaults map wholesale, so `detail.viewSource` reached the user verbatim.
+
+  **The other two sites were not rendering a raw key**, contrary to the issue's description, and are fixed here as the milder "English in all ten languages" class. `wizard.missingRequired` is its own hook's probe key, so the probe failed and `createSafeTranslation` correctly served its English default. `gantt.toolbar.refresh` goes through `useGanttTranslation`, which deliberately does not use `createSafeTranslation` and falls back per key — so the refresh button's `aria-label` was "Refresh", in English, never the key. Screen-reader users heard an English word rather than an identifier; a `zh` session now hears 刷新.
+
+  Regression cover is provider-mounted on purpose: with no `I18nProvider` the defaults maps answer every one of these keys and the assertions pass while the console is broken, which is precisely the false-green the issue documents. For the two sites whose English output was already correct, `en` cannot discriminate before from after — the `zh` assertions are the ones that pin the fix.
+
+- 2937bcf: `record:details` section editor now offers the `name` i18n anchor
+
+  The page block inspector's `record:details` → Sections editor exposed
+  `label` / `columns` / `fields` and silently omitted `name`. That key is not
+  decoration: it is the section heading's i18n anchor. `plugin-detail`'s
+  `record-details` renderer resolves the heading through
+  `objects.<object>._sections.<name>.label` and falls back to the authored string
+  whenever `name` is absent —
+
+  ```
+  const translatedTitle = s.name && objectName
+    ? sectionLabel(objectName, s.name, rawTitle ?? s.name)
+    : rawTitle;
+  ```
+
+  — so every section built in Studio was untranslatable by construction: one
+  authored string in every locale, plus an upstream
+  `translation-section-name-missing` diagnostic the author had no control to
+  clear. The key was reachable only by hand-editing source, which is precisely
+  what a designer exists to avoid.
+
+  The new `Name (i18n key)` text box sits first in each section entry, matching
+  `page:tabs` / `page:accordion` where the stable identifier precedes the human
+  label. Its placeholder carries the snake_case convention, because
+  `BlockPropField` has no description or pattern affordance — the same reason the
+  suite already requires every `json` field to carry a shape placeholder.
+
+  Two authoring decisions, both deliberate and both pinned:
+
+  **The anchor is never derived from `label`.** `InspectorTextField` does expose an
+  `onBlur` hook for deriving a dependent field, and the block-config renderer
+  deliberately leaves it unwired here. A label may already be localized prose — or
+  an inline `{ en, 'zh-CN' }` map, which `record-details` runs through
+  `pickLocalized` — and seeding an anchor from it freezes one locale's text into
+  the one value that must stay locale-independent. Worse, it would be invisible:
+  the renderer falls back to the authored label when a translation misses, so a
+  wrongly-derived anchor renders exactly like the bug it was meant to fix, until
+  someone adds a second locale.
+
+  **Sections authored before this field existed are not backfilled.** They open
+  with the anchor box empty and their `label` untouched; nothing is written until
+  the author types. This needs no code — the inspector is read-through, writing
+  only from a commit handler — and the alternative would mark an untouched page
+  dirty merely for being opened.
+
+  No validation was added. `BlockPropField` has no pattern/validate capability,
+  and inventing one for a single field is out of scope; the placeholder states the
+  convention and the upstream lint rule remains the enforcement point.
+
+  Coverage for this block's section entry is now derived from the spec's own
+  `RecordDetailsProps` shape rather than hand-listed, so the next section key the
+  spec grows fails loudly here instead of quietly never reaching the designer.
+
+- 54233b1: Record detail pages: a header ⟳ that refreshes the record, its related lists and its tab counts in place — no browser reload
+
+  Concurrent-editing scenario from the shop floor (MES work orders): operator A sits on a record's detail page while operator B starts or reports the same order. A had no way to see the new state except F5, which throws away the open tab, the scroll position and any in-progress inline edit along with the stale data.
+
+  The pipeline for this already existed — the objectui#2269 invalidation bus refetches every mounted reader in place, and `RecordContext.refresh` had been declared for it — but nothing produced that field and no UI reached for it. Three changes give it a trigger:
+
+  - **`RecordDetailView` produces `RecordContext.refresh`**, publishing `notifyDataChanged({ objectName: '*' })`. The wildcard is deliberate: a user reaches for refresh because of a write made by SOMEONE ELSE, which this client never saw and therefore cannot attribute to particular objects. `'*'` marks everything mounted as stale, so the main record, every related child list and the tab-count badges all refetch — no remount, so tab / scroll / draft state survive. First phase covers the standalone record route; embedded hosts (list drawer, split-pane preview) keep their existing chrome unchanged.
+  - **`page:header` renders the ⟳** at the far end of the header row when — and only when — the host provides `refresh`. It is page chrome rather than a header action, so its position is the same on every record page regardless of which business actions the object declares, and it can never be collapsed into the `⋯` overflow. Styled as that `⋯` trigger's twin so the row reads as one button family. Its accessible name and tooltip come from the existing `common.refresh` key, so the icon-only button is not English-only in the other nine locales. The icon spins for a short floor after a click, because the bus is fire-and-forget and a warm backend would otherwise finish before the click looked like it landed.
+  - **`RelatedList` accepts the `'*'` wildcard** on the legacy `objectui:related-changed` event, matching what `dataChangeMatches` already does for the bus's own readers. This listener compared the payload's object name to its own, so a wildcard invalidation reached everything on the page except the related lists — a concrete foreign object name is still ignored.
+
+  Hosts that provide no `refresh` render exactly as before.
+
+- 99782f9: Run `sys_approval_request`'s server-declared decision actions on the business record page, and retire the hard-coded two-button approval path (objectui#3055).
+
+  A record with an approval pending on it showed exactly two buttons — Approve and Reject — hand-written into the record header behind a bespoke `type:'approval'` handler and a client-side approver test. The approvals list, looking at the same request over the same nine REST routes, offered five decisions plus the submitter's levers and took decision attachments. On a business record, **reassign / send back / request info had no entry point at all**, a decision could not carry a file, and the copy on the two surfaces was maintained separately.
+
+  The record page now renders the object's own declared actions through the shared declared-action bar — the same metadata, the same action runtime, the same param dialogs the approvals list uses. Approve, Reject, Reassign, Send back and Request info reach a business record, with their declared params (comment, attachments, the new approver picker) and the per-request decision outputs an approval node declares. Remind stays with the approvals panel, which owns a richer, throttle-aware version of it. Adding a tenth decision action is now a metadata change with no console work.
+
+  Two behaviour changes come with it:
+
+  - **Who sees a decision is the server's answer, not the console's.** Visibility was `pending_approvers.includes(currentUserId)` evaluated in the browser; it is now each action's declared `visible` predicate over the server-computed `viewer` block (`can_act` / `is_submitter` / `can_override`) — the same block that gates the approvals list, computed by the same service that authorizes the decision. A platform or tenant admin's override levers, the recovery path for a request routed to an unstaffed position, now reach the record page for the first time. On a backend too old to send `viewer`, the predicate cannot be evaluated and no decision is offered rather than one whose precondition is unknown.
+  - **A declared `visible` written against the canonical `record.` root now evaluates.** The declared-action bar passed the row in as the bare predicate scope, so only the shorthand spelling (`status == "pending"`) resolved; `record.viewer.can_act` raised `record is not defined`, and the fail-closed gate turned that into "hidden". Every declared action on `sys_approval_request` gates on `record.viewer.*`, so the whole server-declared decision set was invisible on every surface this bar renders, the approvals inbox included. The row now binds the three ways the record header and list rows bind it — `record.status`, bare `status`, `data.status` — so both spellings reach a verdict.
+
+  `useRecordApprovals` keeps only its read half (status, `lock_record`, the request rows). Its `canDecide` / `approve` / `reject` members and its `currentUserId` parameter are gone: deciding is the declared action's POST, and every remaining question about the viewer is answered on the row by the server.
+
+- 6b3d47b: Point the four remaining "Settings" senders at the system hub `/apps/setup/system` instead of the bare `/apps/setup` (objectui#3611).
+
+  Same root cause as objectui#3590, which fixed the three call sites inside its declared file surface: `AppContent` mounts the system hub only under `isSystemRoute`, which keys on a `/system` path segment, so on a zero-app deployment the bare `/apps/setup` _is_ the "No Apps Configured" empty state's own URL and every entry spelling it looped in place.
+
+  Three of the four are live defects, all reachable on a zero-app deployment today:
+
+  - `AppSidebar`'s no-active-app sidebar header (`system-sidebar-header`) — the sharpest of them, since it renders _only_ when there is no active app, i.e. it was unreachable except in exactly the state where its target was broken.
+  - `AppSidebar`'s user-menu "Settings" entry.
+  - `SystemRedirect`'s bare `/system` legacy bookmark. This forwarder was already half right — every _suffixed_ bookmark (`/system/users`) was correctly rewritten to `/apps/setup/system/users`, and only the bare one dropped the `system` segment. The bare branch now agrees with the suffixed branch beside it; no new logic.
+
+  The fourth, `QuickActions`' "System Settings" card, is dormant — the component has zero JSX call sites repo-wide, so no user can reach it today. It is corrected in the same pass so the dead link cannot return with the component if it is ever remounted.
+
+- aeb8424: List row Edit/Delete, bulk delete and related-list CRUD now run the caller's own permission, not just the object's API exposure (objectui#4096)
+
+  The row kebab's built-in Edit/Delete rendered for every account, including ones
+  the server answers `403 PERMISSION_DENIED` on. Clicking Edit opened a fully
+  prefilled dialog that could only fail on save; Delete — a destructive entry —
+  sat one click away from users who could never perform it.
+
+  The gate intersected the object's resolved CRUD affordance with the server's
+  effective API operation set (`/me/permissions` `apiOperations`, objectui#3720),
+  and nothing else. `apiOperations` is the object's **API exposure surface** —
+  "which verbs does this object publish" — and the spec's own describe text says
+  so. It is principal-independent: the report measured two accounts with opposite
+  `allowEdit`, 30 shared objects, and **30/30 identical** `apiOperations`. A gate
+  made only of object-scoped layers therefore fails OPEN for every unprivileged
+  caller, which is why the same screen carried three different answers to "may
+  this user write this object": the toolbar's New was correctly hidden
+  (`affordances.create && can(obj, 'create')`), the record header's Edit/Delete
+  were correctly hidden (per-record write probe), and the row kebab was not.
+
+  Four surfaces now AND the principal's own verdict — `can(obj, 'update' |
+'delete')`, i.e. `/me/permissions` `allowEdit` / `allowDelete`, the toolbar's
+  source — on top of the layers they already had:
+
+  - the grid row kebab's built-in Edit/Delete (`resolveRowCrudAffordances` gained
+    `permissionUpdate` / `permissionDelete`, filled at the `ObjectGrid` call site);
+  - the grid's bulk-delete bar, which rides the same object-level delete verdict,
+    so the row gate and the more destructive bulk entry move together;
+  - the non-grid (kanban / calendar / gallery) bulk bar `ListView` renders itself;
+  - the related-list Create/Edit/Delete on a child object
+    (`RelatedRecordActionsBridge`), which had the same object-only gate.
+
+  **This is a tightening of the intersection, not a swap.** Every existing layer
+  stays: the ADR-0103 lifecycle bucket, `userActions.edit` / `delete`, and
+  `apiOperations`. A permission grant cannot re-open what any of them closed, and
+  none of them survives a permission denial.
+
+  Fail-open is preserved where it is the deliberate contract: `usePermissions()`
+  with no `PermissionProvider` answers `can: () => true`, so standalone embeds and
+  hosts that ship no permission source keep their Edit/Delete exactly as before.
+  Under `MePermissionsProvider` the semantics are the toolbar's, unchanged and now
+  shared: an authenticated principal whose object is absent from
+  `/me/permissions.objects` resolves fail-closed (objectui#2926 ④), an anonymous
+  session keeps the permissive default, and children never render while the
+  permission set is loading. Per-key absence is still permissive — an object entry
+  without `allowEdit` reads as allowed.
+
+  Server-side enforcement was already hard (403, DB unchanged), so this closes a
+  UI-affordance gap rather than an authorization hole.
+
+- 7a197e7: Make metadata-form visibility predicates work again in the Setup/Studio admin
+  engine: `SchemaForm` now reads the canonical `visibleWhen` key, falling back to
+  the deprecated `visibleOn` alias (objectstack#6331).
+
+  ADR-0089 renamed the FormView predicate `visibleOn` → `visibleWhen`, and the
+  spec's normaliser REWRITES the alias rather than keeping both — a parsed
+  `FormView` carries `visibleWhen` and no `visibleOn` at all. All five predicate
+  read sites in `SchemaForm.tsx` looked at `visibleOn` only, so every spec-served
+  predicate read as absent and each guard short-circuited to "visible". Every
+  conditional field, section and tab in every metadata form rendered
+  unconditionally.
+
+  Measured over the bundled `@objectstack/spec@17`: `objectForm` carries 16
+  sub-field predicates, `viewForm` 7, `actionForm` 6, `pageForm` 4 — all spelled
+  `visibleWhen`, none spelled `visibleOn`. Every one of them was inert.
+
+  Fixed sites: the flat per-property path, section-level, section field-level,
+  the tabbed path's field probe, and `type: 'record'` row sub-fields. Spelling and
+  precedence mirror the runtime record-form adapter (`@object-ui/plugin-form`
+  `sectionFields.ts`) and the spec bridge (`@object-ui/react` `form-view.ts`),
+  which already read `visibleWhen ?? visibleOn` — one dialect across the repo,
+  canonical wins. `FormSectionSpec` / `FormFieldSpec` declare both keys, the alias
+  marked `@deprecated`.
+
+  **Visible behaviour change** — these predicates have never taken effect in a
+  shipped build, so they switch on for the first time here:
+
+  - Studio's object field list now shows only the type-relevant row sub-fields: a
+    `currency` field shows Min / Max / Precision / Scale, a `text` field shows Max
+    Length / Min Length, instead of all of them at once.
+  - Page authoring hides Data Context / Layout / Template on a `list` page and
+    shows the Interface section, and the mirror for a record page. View, Action and
+    Report authoring forms gain their type-conditional sections and fields.
+
+  Predicates authored with the deprecated alias keep working, including this app's
+  own create schemas, which set `visibleOn` directly on raw JSONSchema properties
+  (`view-create-body.ts`, `anchors.ts`) and never pass through the spec normaliser.
+
+  Note for the rollout: the predicates must be `data.`-scoped to evaluate against
+  the draft (objectstack#6254 corrected 16 bare spellings in `object.form.ts`). A
+  backend still serving the pre-#6254 bare spelling now yields the opposite
+  symptom — those sub-fields stay hidden rather than always shown — because the
+  admin engine's evaluator resolves an unscoped identifier to `undefined` and the
+  predicate goes false.
+
+- c993ff2: metadata-admin: restore per-field diagnostics when editing an invalid stored `view`
+
+  Editing a stored `view` is judged by the wire gate `ViewMetadataSchema`, which is a
+  union. Zod reports a union failure as a single root issue — no path, message
+  `Invalid input` — so every field-level diagnostic collapsed into one message that
+  pointed at nothing: `SchemaForm` had no field to highlight and Monaco had no
+  position to jump to, and the guided messages the spec writes for these rejections
+  never reached the editor.
+
+  Failures are now expanded to the union member the draft's own `viewKind`
+  discriminant selects, so a bad stored view reports `config.type` with the list of
+  valid layouts, a mis-typed filter reports `config.filter.0.operator`, and a
+  container key that belongs to a single view gets the spec's full
+  `defineView(...)` guidance back. Only the selected member's issues are shown, so
+  the other members' rejections do not become noise.
+
+  Validation verdicts are unchanged: the accept/reject decision is still made by the
+  one gate, and this only changes how an already-failed draft is presented.
+
+- 877385a: metadata-admin: wire client-side Zod validation for `sharing_rule`, `translation` and `connector` (objectui#3561)
+
+  These three metadata types opted out of live client-side validation on recorded
+  reasons that no longer held against the resolved `@objectstack/spec` 17.0.0-rc.5:
+  `SharingRuleSchema` was described as having an empty shape (it is a `.strict()`
+  object of nine keys), `translation` was judged by `TranslationBundleSchema` (the
+  bundle map, not the kind's schema — it rejects a valid translation item), and
+  `connector` was blocked on a required `id` field that does not exist in
+  `ConnectorSchema`.
+
+  Each loader now names the schema the platform actually binds — `SharingRuleSchema`,
+  `TranslationItemSchema` and `DeclarativeConnectorEntrySchema`. Behaviour change:
+  drafts of these types are now rejected in the editor before save, through the same
+  diagnostics banner every other wired type already uses. Most notably a `connector`
+  draft that inlines credentials or authors provider-derived `actions` is caught at
+  authoring time by the ADR-0097 rules the bare `ConnectorSchema` does not carry.
+
+  `sharing_rule` is gated on the **create** door only: its schema is `.strict()` and
+  declares none of the ADR-0010 envelope keys that a stored body carries, so judging
+  a stored body with it would make the client stricter than the server.
+  `hasClientValidator(type, mode)` takes the door as a second argument for that
+  reason — without it the editor would have read a type with no gate on the edit
+  path as "clean" and suppressed the server's own diagnostics.
+
+- 4cf76ce: metadata-admin no longer false-rejects a stored `view` that has been pinned or
+  reordered. The editor's live client-side validation judged BOTH the create and
+  the edit draft with the AUTHORING schema (`ViewItemSchema` via
+  `viewSchemaForDraft`). That is right for create and wrong for edit: the editor
+  opens a body that came back out of `sys_metadata`, and the platform itself
+  writes keys into stored view bodies — `isPinned` from the view switcher's pin
+  action, `sortOrder` from the reorder write, and a per-row `id` that the console
+  filter/sort builders stamp on `config.filter[]` for React. `updateView` GETs the
+  stored item and PUTs `{ ...current, ...partial }`, and `saveMetaItem` persists
+  the accepted body verbatim, so those keys are in storage by design.
+
+  Before the authoring schemas were tightened these keys were silently stripped
+  and the draft passed. Once the gate became strict, opening a pinned view in the
+  editor reported unrecognized keys — while the SERVER accepted the very same body,
+  because it validates against `ViewMetadataSchema`. The client was strictly
+  stricter than the server; the direction was inverted.
+
+  `validateMetadataDraft` now takes an optional `{ mode: 'create' | 'edit' }`.
+  Create keeps the authoring gate unchanged. Edit is judged by
+  `ViewMetadataSchema` — the schema the `view` metadata type registers, i.e. the
+  same one the server runs — so the client and the server accept the same set by
+  construction. `mode` defaults to `'create'`, the strict gate, so a caller that
+  omits it can only ever over-report, never silently widen the door.
+
+  The edit gate keeps its teeth: a wrong `config.type` and a container carrying an
+  unknown key are both still rejected.
+
+- 7e2b7e9: Fix saved list-view preferences never reading back (density, column widths, sort, hidden columns, inline edit)
+
+  `listViewOverrides` in the ObjectStack adapter enumerated `GET /api/v1/meta/{objectName}` — putting the object name in the metadata **type** slot — while `updateViewConfig` persists under `type='view'`. The two key spaces are disjoint, so the batch map came back empty for every object and every personalization a user saved on a list view was written to the server but never read back, showing up as "the setting didn't save".
+
+  The read now enumerates `type='view'` once and narrows to the object client-side, through the same accessor `listViews()` uses over the same rows — the metadata index is name-only, so there is no server-side `?object=` filter to push it into.
+
+  Second half: the batch read no longer swallows its own failures into an empty map. An empty map is an authoritative "this object has no overrides" and callers may still trust it and skip the per-view reads (the batch optimization is intact), but a transport failure now rejects, so the per-view `getView` fallback it was silently disabling becomes reachable again. `DataSource.listViewOverrides` documents both terms so other adapters implement the same contract.
+
+- Updated dependencies [794c497]
+- Updated dependencies [993336f]
+- Updated dependencies [f0a625a]
+- Updated dependencies [b5980f4]
+- Updated dependencies [8aad9fd]
+- Updated dependencies [6719877]
+- Updated dependencies [56ff091]
+- Updated dependencies [0186cdc]
+- Updated dependencies [7864f03]
+- Updated dependencies [ea41a59]
+- Updated dependencies [0cbdca8]
+- Updated dependencies [d229dfa]
+- Updated dependencies [ecae400]
+- Updated dependencies [4bc6c23]
+- Updated dependencies [d3e738a]
+- Updated dependencies [c3b01a7]
+- Updated dependencies [f5f8744]
+- Updated dependencies [7ed3360]
+- Updated dependencies [3765678]
+- Updated dependencies [d83f6b3]
+- Updated dependencies [5f08c05]
+- Updated dependencies [69becd2]
+- Updated dependencies [5e52495]
+- Updated dependencies [0fa5e4d]
+- Updated dependencies [b750823]
+- Updated dependencies [5bfaabd]
+- Updated dependencies [e06810e]
+- Updated dependencies [ab3ad4f]
+- Updated dependencies [65bb513]
+- Updated dependencies [c97a45e]
+- Updated dependencies [b19162d]
+- Updated dependencies [c2fd122]
+- Updated dependencies [1bd6faa]
+- Updated dependencies [ac2139c]
+- Updated dependencies [b14ab3a]
+- Updated dependencies [e24d767]
+- Updated dependencies [8c60819]
+- Updated dependencies [aca561a]
+- Updated dependencies [6bd6a4d]
+- Updated dependencies [876e3f7]
+- Updated dependencies [41d6022]
+- Updated dependencies [e64a52e]
+- Updated dependencies [844d17f]
+- Updated dependencies [d8a0be4]
+- Updated dependencies [f3b2874]
+- Updated dependencies [48132f7]
+- Updated dependencies [4dcd52a]
+- Updated dependencies [42ae5c6]
+- Updated dependencies [0ef9dfd]
+- Updated dependencies [82f8dff]
+- Updated dependencies [f4b97c8]
+- Updated dependencies [1d723e3]
+- Updated dependencies [0109f54]
+- Updated dependencies [7e5bb5d]
+- Updated dependencies [fbc23e0]
+- Updated dependencies [6d762da]
+- Updated dependencies [e6fdbdc]
+- Updated dependencies [54233b1]
+- Updated dependencies [c2ecbae]
+- Updated dependencies [f9faa7d]
+- Updated dependencies [97b63d7]
+- Updated dependencies [6bb454a]
+- Updated dependencies [11c1e71]
+- Updated dependencies [523be48]
+- Updated dependencies [7e2b7e9]
+- Updated dependencies [33526fd]
+- Updated dependencies [32413ec]
+- Updated dependencies [c1e1e6b]
+  - @object-ui/components@17.4.0
+  - @object-ui/react@17.4.0
+  - @object-ui/core@17.4.0
+  - @object-ui/fields@17.4.0
+  - @object-ui/i18n@17.4.0
+  - @object-ui/types@17.4.0
+  - @object-ui/data-objectstack@17.4.0
+  - @object-ui/layout@17.4.0
+  - @object-ui/plugin-editor@17.4.0
+  - @object-ui/collaboration@17.4.0
+  - @object-ui/auth@17.4.0
+  - @object-ui/permissions@17.4.0
+  - @object-ui/providers@17.4.0
+
 ## 17.3.0
 
 ### Minor Changes
@@ -19,6 +1253,7 @@
   moves the producer there.
 
   ## What changed
+
   - All entitlement context is read from `error.details.<key>` and **nowhere
     else**. `code` and `message` are declared `ApiErrorSchema` fields and stay on
     `error` itself.
@@ -178,6 +1413,7 @@
   auto-activated, landing the user on an empty sidebar.
 
   ## What changed
+
   - **Shared predicate, not a second implementation.** Both switchers now call
     `hasVisibleNavigationItems` from `@object-ui/layout` — the exact guards
     `NavigationRenderer` applies per item — so the switcher can never disagree
@@ -257,6 +1493,7 @@
   ten packs missing it identically kept parity fully green.
 
   ## What changed
+
   - `createTargetOrg` is backfilled into `en` as `Creates in {{org}}`, which makes
     the parity gate demand it from the other nine; each is translated to its pack's
     existing `form`-section tone rather than copied or machine-filled.
@@ -2226,7 +3463,7 @@ VALIDATION_FAILED` means _this adapter_ sent an off-contract body. Degrading
   `AnalyticsQueryRejectedError`, `isAnalyticsNotInstalledError`,
   `classifyAnalyticsFailure`.
 
-- 752e18f: fix(console,app-shell): readable reassign hand-off + "System" label for svc:* audit actors — objectstack#4365 / objectstack#4366
+- 752e18f: fix(console,app-shell): readable reassign hand-off + "System" label for svc:\* audit actors — objectstack#4365 / objectstack#4366
 
   - **Approvals inbox** (`ApprovalsInboxPage`): a reassign timeline entry now
     renders "from A to B" from the structured
@@ -5708,6 +6945,7 @@ unauthenticated` in the token-based console, while the runtime data adapter's
   objects+fields were editable in Studio; this reworks both surfaces.
 
   **Setup (assign + read-only):**
+
   - The six facets (`object_permissions`, `field_permissions`, `system_permissions`,
     `row_level_security`, `tab_permissions`, `admin_scope`) now render read-only on
     the `sys_permission_set` record page as a compact summary (counts, or capability
@@ -5722,6 +6960,7 @@ unauthenticated` in the token-based console, while the runtime data adapter's
 
   **Studio (design every facet):** the permission matrix editor gains structured
   editors for the facets that were JSON-only —
+
   - **System Capabilities**: a multi-select over the live `sys_capability` registry
     (scope-grouped, labelled chips).
   - **Row-Level Security**: per-policy rows (object · operation · enabled) with CEL
@@ -6325,7 +7564,7 @@ unauthenticated` in the token-based console, while the runtime data adapter's
     the "new set" creator both call `client.save(..., { mode: 'draft', packageId })`
     — the framework stamps the draft with the package, and the top-bar **Publish**
     promotes it atomically (materialized into `sys_permission_set` by the framework
-    side, ADR-0086 P2 块1). The **environment-admin** door (no `packageId`) is
+    side, ADR-0086 P2 块 1). The **environment-admin** door (no `packageId`) is
     unchanged: it stays **live** (config), per D7.
   - Reads are draft-aware: the editor loads any pending draft over the published
     baseline, and the pillar rail merges published ∪ draft sets — so a set created
@@ -7074,6 +8313,7 @@ unauthenticated` in the token-based console, while the runtime data adapter's
 
   `PackageDetailSheet` gains the user-facing affordances for the package-as-
   lifecycle-unit work:
+
   - **Duplicate** → `POST /packages/:id/duplicate` (clone a base into a new
     writable package; D4).
   - **Adopt loose items** → `POST /packages/:id/adopt-orphans` (migrate every
@@ -7990,6 +9230,7 @@ unauthenticated` in the token-based console, while the runtime data adapter's
     `recordId`.
 
   Pairs with the framework screen-flow runtime (`@objectstack/service-automation`
+
   - `@objectstack/runtime`). Verified in-browser: showcase task row → "Reassign…"
     → form → submit → the task is reassigned.
 
@@ -8583,6 +9824,7 @@ formViews }`) and ignored `viewKind` entirely. As a result a form-family view
   the Setup app → _All Metadata Types_.
 
   ### New: `@object-ui/app-shell` views/metadata-admin
+
   - **`MetadataDirectoryPage`** — auto-grouped tile directory by domain, with
     free-text search, domain chips, and a _Writable only_ filter.
   - **`MetadataResourceListPage` / `MetadataResourceEditPage` / `…CreatePage` / `…HistoryPage`** —
@@ -8606,6 +9848,7 @@ formViews }`) and ignored `viewKind` entirely. As a result a form-family view
     `t(key)` helper.
 
   ### New routing variant
+
   - App nav now supports `{ type: 'component', componentRef, params? }` items.
     `AppContent` resolves them through the existing `ComponentRegistry`.
   - Built-in components registered: `metadata:directory`, `metadata:resource`,
@@ -8614,6 +9857,7 @@ formViews }`) and ignored `viewKind` entirely. As a result a form-family view
     / page.
 
   ### Plugin-designer
+
   - Lazy-exported `ObjectManager`, `FieldDesigner`, `ObjectViewConfigurator`,
     `DashboardEditor`, `PageCanvasEditor`, `MetadataObjectsPage`, and
     `MetadataFieldsPage` so the engine can mount them on demand.
@@ -8622,6 +9866,7 @@ formViews }`) and ignored `viewKind` entirely. As a result a form-family view
   through the new component routes.
 
 - ca685ab: Add ChatGPT-style AI chat history surface at `/ai` and `/ai/:conversationId`.
+
   - New `DefaultAiChatPage` with conversations sidebar (list, create, select, delete) and chat pane on the right.
   - New `ConversationsSidebar` component and `useConversationList` hook for listing and managing `ai_conversations`.
   - `useChatConversation` now accepts an optional `activeId` to hydrate a specific conversation (bypassing the localStorage cache), and guards against duplicate conversation creation when sibling state (e.g. selected agent / scope) changes during the same visit.
@@ -8633,6 +9878,7 @@ formViews }`) and ignored `viewKind` entirely. As a result a form-family view
 - 0335ec4: Polish the AI chat surface based on real-world dogfooding feedback.
 
   **`@object-ui/plugin-chatbot`** — new display helpers shared by `ChatbotEnhanced`:
+
   - `unwrapToolResult(value)` peels the MCP-style `{ type: 'text', value: '<json>' }`
     envelope that backend tools emit (`@objectstack/service-ai`'s data/metadata
     tools, in particular), and JSON-parses the inner payload. The result panel
@@ -8653,6 +9899,7 @@ formViews }`) and ignored `viewKind` entirely. As a result a form-family view
   so wrappers can compose richer titles.
 
   **`@object-ui/app-shell`** — `AiChatPage`:
+
   - Removes the fake "Hello! I'm X" assistant welcome bubble so the empty-state
     suggestion chips can actually render.
   - Adds per-agent default suggestion sets (`data_chat`, `metadata_assistant`)
@@ -8933,6 +10180,7 @@ Assistant…  (try "系统里有多少个用户？")`).
 - efb4c00: feat(observability): Sentry integration + bundle splitting for production launch
 
   **Sentry (opt-in via `VITE_SENTRY_DSN`)**
+
   - New `initSentry()` / `captureError()` / `setSentryUser()` / `getSentry()`
     helpers exported from `@object-ui/app-shell`.
   - Dynamic-import design: when `VITE_SENTRY_DSN` is unset, `@sentry/react`
@@ -8950,6 +10198,7 @@ Assistant…  (try "系统里有多少个用户？")`).
     stripped from breadcrumb URLs before send.
 
   **Bundle splitting**
+
   - `plugin-dashboard` (8 component types) now lazy-registered via
     `ComponentRegistry.registerLazy()` — only loads on dashboard pages.
   - `plugin-dashboard` and `plugin-report` each get their own chunk
@@ -8983,6 +10232,7 @@ Assistant…  (try "系统里有多少个用户？")`).
 
   Resolves 8 moderate-severity GHSA advisories against the transitive
   `dompurify@3.2.7` pulled in by `monaco-editor`. Vulnerabilities covered:
+
   - SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode
   - FORBID_TAGS bypassed by function-based ADD_TAGS predicate
   - Prototype Pollution to XSS via CUSTOM_ELEMENT_HANDLING fallback
@@ -8993,6 +10243,7 @@ Assistant…  (try "系统里有多少个用户？")`).
   - Generic XSS vector
 
   No API changes; override is transparent to consumers.
+
   - @object-ui/types@5.2.1
   - @object-ui/core@5.2.1
   - @object-ui/i18n@5.2.1
@@ -9015,12 +10266,14 @@ Assistant…  (try "系统里有多少个用户？")`).
   wired by `RecentItemsProvider` + `useTrackRouteAsRecent` +
   `RecordDetailView`). Multi-device by construction: open a record on
   laptop, see it in `⌘K → Recently viewed` on phone.
+
   - Group renders only when input is empty (no competition with search).
   - Limited to the 5 most recent record-type entries.
   - New i18n key `console.commandPalette.recentRecords` (en + zh seeded;
     other locales fall back to `defaultValue: "Recently viewed"`).
 
 - b2d1704: feat(cmdk): record search across objects in the Command Palette
+
   - New `useRecordSearch` hook in `@object-ui/react` debounces a query, fans out
     to `dataSource.find(name, { $search, $top })` across candidate objects, and
     aggregates hits. Race-safe via a monotonic runId; per-object 404s are
@@ -9045,6 +10298,7 @@ Assistant…  (try "系统里有多少个用户？")`).
 
   Three related fixes that all addressed the same UX: a user follows a URL
   shaped `/{object}/{recordId}` and sees a completely blank content area.
+
   1. **`useNavigationOverlay` produced the broken URL itself.** When
      middle-click / Cmd-click opened a gallery card in a new tab and no
      `onNavigate` was provided, the hook built `/{object}/{id}` — a URL
@@ -9086,6 +10340,7 @@ Assistant…  (try "系统里有多少个用户？")`).
 
   When `useRecordSearch` is mid-flight (debounced fetch across objects
   hasn't returned yet), the palette now surfaces a subtle visual:
+
   - A small pulsing primary-coloured dot next to the **Records** group
     heading, so the user sees that more results may still appear.
   - A `Searching…` placeholder inside the empty state when the user has
@@ -9098,6 +10353,7 @@ Assistant…  (try "系统里有多少个用户？")`).
 
   `ConsoleToaster` now ships UX-positive defaults that match the Linear
   / Notion pattern users expect from an enterprise console:
+
   - `position="top-right"` — keeps the user's primary work area (centre
     - bottom) unobstructed.
   - `closeButton` — every toast has an explicit X so users can dismiss
@@ -9112,6 +10368,7 @@ Assistant…  (try "系统里有多少个用户？")`).
   All of these are still overridable via `<ConsoleToaster …>` props.
 
 - 5425608: CRM UX polish pass — calmer enterprise look across detail + kanban.
+
   - **plugin-kanban**: column headers now use a 2px muted accent stripe with
     neutral foreground titles + a quiet grey count pill instead of full
     rainbow gradient + colored title + colored count. Pipeline boards
@@ -9136,6 +10393,7 @@ Assistant…  (try "系统里有多少个用户？")`).
 - 710fbe6: feat(app-shell): notification center animation polish
 
   InboxPopover now animates every signal that matters for "noticing":
+
   - Bell button **bounces once** when total pressure increases (new
     notification or approval arrives). Tracks previous total via a ref
     so the very first render — when the server-side counts hydrate —
@@ -9169,6 +10427,7 @@ pending approvals`) fade in instead of popping in.
   unknown @-tokens. 9 unit tests.
 
   `@object-ui/app-shell` `RecordDetailView` now:
+
   1. Serializes the resolved mention ids into `sys_comment.mentions`
      (previously hard-coded `'[]'`, so servers had no idea who was being
      pinged).
@@ -9195,6 +10454,7 @@ pending approvals`) fade in instead of popping in.
   are merged in automatically when available.
 
 - 54e3dfb: Remove unused stub renderers from `@object-ui/app-shell`:
+
   - `ObjectRenderer` / `ObjectRendererProps`
   - `DashboardRenderer` / `DashboardRendererProps`
   - `PageRenderer` / `PageRendererProps`
@@ -9210,6 +10470,7 @@ pending approvals`) fade in instead of popping in.
   If you were importing one of the removed stubs (and somehow got past
   the "TODO" placeholder render), the real renderers ship from the
   respective plugin packages:
+
   - Dashboard → `@object-ui/plugin-dashboard` (`DashboardRenderer`)
   - Page / Object / Form → `@object-ui/react` (`SchemaRenderer`) +
     `@object-ui/plugin-form` / `@object-ui/plugin-grid` etc.
@@ -9273,6 +10534,7 @@ pending approvals`) fade in instead of popping in.
 - d1ec6a2: Fold inline-edit into the page-header overflow menu (HubSpot/Lightning
   pattern) and remove the orphan "Edit fields" toolbar row that previously
   floated between the tab strip and the first detail section.
+
   - `@object-ui/app-shell` `RecordDetailView`: injects a new `sys_inline_edit`
     system action that appears in the ⋯ overflow menu and dispatches a
     `objectui:record:inline-edit-toggle` window CustomEvent (filtered by
@@ -9289,6 +10551,7 @@ pending approvals`) fade in instead of popping in.
     in `page:accordion` / `page:tabs` items.
 
 - cf30cc2: Polish Lightning record detail page layout.
+
   - `record:details` sections now render with Card chrome by default when a `title` is present, restoring visual grouping that was missing on pages like the opportunity detail page.
   - Section labels can be translated via the `{ns}.objects.{objectName}._sections.{name}.label` convention. Author each section with a stable `name` (e.g. `info`, `forecast`) and the renderer picks up the locale-specific label automatically. Falls back to the literal `label` when no translation exists.
   - The `page:header` action toolbar now collapses into a `⋯` overflow menu when more than two actions are present. The first business action stays inline; secondary system actions (Edit / Share / Delete) move into the menu, with destructive styling applied to Delete.
@@ -9305,6 +10568,7 @@ pending approvals`) fade in instead of popping in.
 ### Patch Changes
 
 - d51a577: feat(platform): Discussion attachments + @mention directory + Reference Rail aside
+
   - **Discussion attachments** — `RichTextCommentInput` now accepts an `extraSlot`
     and a `canSubmitEmpty` flag so hosts can mount the existing
     `CommentAttachment` composer beneath the editor without forking the toolbar.
@@ -9324,6 +10588,7 @@ pending approvals`) fade in instead of popping in.
 - 1976691: Fix the drawer "Open as full page" (maximize) button on the record drawer
   which threw `TypeError: name.indexOf is not a function` and prevented
   navigation to the dedicated detail page.
+
   - `@object-ui/app-shell` `ObjectView`: pass `objectDef.name` (string) — not
     the whole `objectDef` — into `viewLabel(...)` when computing the
     `originState.from.label` for both drawer-navigate and list-navigate
@@ -9339,6 +10604,7 @@ pending approvals`) fade in instead of popping in.
   custom `Page`. Catalog-style objects (Product, Task) ship with the rail
   off by default; hub objects (Account, Opportunity, Contact, Case) keep it
   on.
+
   - `RecordDetailView` now reads `(objectDef as any)?.detail?.hideReferenceRail`
     and `…?.hideRelatedTab` and threads them to `buildDefaultPageSchema`.
   - The Reference Rail renderer also accepts entries authored as either a
@@ -9446,6 +10712,7 @@ pending approvals`) fade in instead of popping in.
   default detail view. They were missing cross-cutting affordances and
   shipped with English-only tab labels and heavy bordered section cards
   even when the host locale was Chinese. Track 1 closes the visible gap:
+
   - **app-shell `RecordDetailView`**: the `assignedPage` branch now wears
     the same chrome as the default branch — lifecycle managed-by badge
     and presence avatars in the top-right, `MetadataPanel` debug panel,
@@ -9518,6 +10785,7 @@ pending approvals`) fade in instead of popping in.
   page so the two renderers share state.
 
 - 74962b0: feat(detail): record:discussion schema component + flush accordion variant
+
   - New `record:discussion` schema type lets authors place the record
     chatter feed anywhere in a custom Page schema. Wired through a
     shared `DiscussionContext` provider on the `assignedPage` branch
@@ -9544,6 +10812,7 @@ pending approvals`) fade in instead of popping in.
   accordion, discussion slot) that custom Lightning pages already enjoy.
 
   Changes:
+
   - `buildDefaultPageSchema` now emits `page:tabs.items` (correct shape
     for the renderer) rather than `tabs`.
   - `PageHeaderRenderer.resolvedTitle` honors `objectSchema.primaryField`
@@ -9567,6 +10836,7 @@ pending approvals`) fade in instead of popping in.
   customize the header or one tab.
 
   **Slot menu (v1):**
+
   - `header` — replaces `page:header`
   - `actions` — replaces the `record:quick_actions` action bar
   - `highlights` — replaces the chips + chevron path strip
@@ -9594,6 +10864,7 @@ pending approvals`) fade in instead of popping in.
   ```
 
   **API changes:**
+
   - `PageSchema` (in `@object-ui/types`): adds `kind?: 'full' | 'slotted'`
     (default `'full'`) and `slots?: PageSlotMap`.
   - `usePageAssignment` (in `@object-ui/react`): result now exposes a
@@ -9603,6 +10874,7 @@ pending approvals`) fade in instead of popping in.
     `options.slots` map that overrides individual regions at synthesis time.
 
 - 34b66bf: feat(detail): synthesize Related / Activity / History tabs + record:quick_actions header (Track 3 Phase G slice 4)
+
   - `buildDefaultPageSchema` now accepts `headerActions`, `related`,
     `showActivity`, and `history` options. When provided, the synthesizer
     emits a `record:quick_actions` node after `page:header` and appends
@@ -9631,6 +10903,7 @@ pending approvals`) fade in instead of popping in.
   their settings.
 
   The adapter now defaults to:
+
   - `resource`: `sys_user_preference`
   - field shape: `(user_id, key, value)` instead of `(user_id, kind, payload)`
   - option name: **`key`** instead of `kind`
@@ -9675,6 +10948,7 @@ pending approvals`) fade in instead of popping in.
 
   This patch injects gated system actions into `synthHeaderActions` for
   both the synth and slotted paths:
+
   - `sys_edit` — visible when `affordances.edit`. Calls the existing
     `onEdit` prop, opening the same form modal as before.
   - `sys_share` — always visible. Uses `navigator.share` when available;
@@ -9746,6 +11020,7 @@ pending approvals`) fade in instead of popping in.
   chrome on phones: title + 1 primary action, plus content. We were
   shipping ~5 rows of toolbars + chips + tabs above the data. This commit
   hides the desktop-only chrome at the `<sm` breakpoint:
+
   - **ListView**: TabBar (view switcher), UserFilters chip row, quick-filters
     chip row, Sort button, list-scoped Search popover, and the
     (newly-added) mobile-only ViewSettingsPopover gear are all hidden on
@@ -9767,6 +11042,7 @@ pending approvals`) fade in instead of popping in.
 
   Refactor mobile object-view layout to match the Airtable Interface
   pattern:
+
   - **AppHeader**: the mobile topbar's static page label is now a
     view-switcher dropdown (`<viewName> ▾`). Tapping opens a list of
     available views with icons + active-state checkmark. Falls back to
@@ -9796,6 +11072,7 @@ pending approvals`) fade in instead of popping in.
 - 7feed12: Mobile UX: Home affordance + chrome reduction
 
   Two fixes that match what users actually need on a 390px viewport:
+
   - **Add Home link to mobile sidebar.** When inside an app, the sidebar
     drawer previously listed only the current app's nav groups, with no
     way back to the home page (the desktop topbar's logo and AppSwitcher
@@ -9822,6 +11099,7 @@ pending approvals`) fade in instead of popping in.
   with the FAB and chat-bubble stack at the bottom-right corner.
 
   Net effect:
+
   - Drawer remains the single source of in-app navigation.
   - ~52px reclaimed for list/kanban content on every mobile screen.
   - FAB and chat-bubble keep their existing offsets (no overlap;
@@ -9891,6 +11169,7 @@ pending approvals`) fade in instead of popping in.
 - d714e85: Lookup display-name resolution now falls back through a Salesforce-style chain
   when an `$expand`'d reference object lacks a top-level `name`/`label`/
   `display_name`/`title` field:
+
   1. Standard display fields (existing behaviour)
   2. `salutation first_name last_name` composite — handles person records that
      only carry first/last name parts
@@ -9948,6 +11227,7 @@ Lin` and no `name` field now renders as `Bob Lin` everywhere — instead of
   foreign-key id.
 
 - 2bd45af: feat(shell): main becomes the scroll container; record tabs are sticky
+
   - `AppShell`'s SidebarProvider wrapper is now constrained to viewport
     height (`h-svh overflow-hidden`) instead of expanding with content via
     the default `min-h-svh`. This makes the inner `<main>` (which is
@@ -10231,6 +11511,7 @@ Lin` and no `name` field now renders as `Bob Lin` everywhere — instead of
   no visible effect — the user/session were nulled but the UI stayed authenticated.
 
   Changes:
+
   - **`@object-ui/auth`** — added `isAuthEnabled: boolean` to `AuthContextValue`
     (`true` only when real auth is in use, `false` for guest/preview modes).
   - **`@object-ui/app-shell`** — `AppHeader` and `AppSidebar` now hide the "Log out"
@@ -10278,6 +11559,7 @@ Lin` and no `name` field now renders as `Bob Lin` everywhere — instead of
   detail view (`TypeError: titleFormat.replace is not a function`) and printed
   `Failed to evaluate expression: ${[object Object]}` for every action visibility
   predicate.
+
   - `@object-ui/core`: `ExpressionEvaluator.evaluate` / `evaluateCondition` now
     unwrap Expression envelopes transparently.
   - `@object-ui/react`: new `toPredicateInput()` helper to safely normalize
@@ -10296,6 +11578,7 @@ Lin` and no `name` field now renders as `Bob Lin` everywhere — instead of
 - fd15918: Comprehensive i18n refactor + CI test fix.
 
   **i18n (`@object-ui/i18n`)**
+
   - Added ~130 new keys under 12 new top-level namespaces: `layout`, `search`,
     `empty`, `renderer`, `actionDialog`, `rowAction`, `navigationSync`,
     `objectActions`, `objectViewActions`, `dashboardActions`, `recordDetail`,
@@ -10307,6 +11590,7 @@ Lin` and no `name` field now renders as `Bob Lin` everywhere — instead of
 
   **App shell (`@object-ui/app-shell`)** — replaced hardcoded English in 14
   files with `useObjectTranslation`:
+
   - Layout: `AppSidebar`, `ActivityFeed` (locale-aware relative time),
     `MetadataInspector`.
   - Views: `SearchResultsPage`, `ActionParamDialog`, `RecordFormPage`,
@@ -10318,12 +11602,14 @@ Lin` and no `name` field now renders as `Bob Lin` everywhere — instead of
     `useObjectActions` (delete confirm + success / failure toasts).
 
   **Plugin grid (`@object-ui/plugin-grid`)**
+
   - `ObjectGrid` record-detail panel now translates Empty / Yes / No / System
     via the existing `useGridTranslation` safe-fallback wrapper.
   - `RowActionMenu` adopts a local safe-fallback i18n wrapper for
     `Open menu` / `Edit` / `Delete`, preserving standalone-usage guarantees.
 
   **CLI test fix (`@object-ui/cli`)**
+
   - `cli-bin.test.ts` auto-builds the package on first run when `dist/cli.js`
     is missing, instead of throwing. This unbreaks `pnpm test:coverage` in CI
     (root vitest run does not honor turbo's `^build` deps) and removes the
@@ -10503,6 +11789,7 @@ Lin` and no `name` field now renders as `Bob Lin` everywhere — instead of
   full-screen create/edit experience by setting `editMode: 'page'` on the
   object metadata (default remains `'modal'`). When opted in, the
   console mounts two new routes under `/apps/:appName/`:
+
   - `:objectName/new` for create
   - `:objectName/record/:recordId/edit` for edit
 
@@ -10514,6 +11801,7 @@ Lin` and no `name` field now renders as `Bob Lin` everywhere — instead of
   …) works without changes.
 
   Two declarative actions expose the routes for `<action:button>` JSON:
+
   - `{ "action": "navigate_create", "params": { "objectName": "..." } }`
   - `{ "action": "navigate_edit", "params": { "objectName": "...", "recordId": "..." } }`
 
@@ -10521,6 +11809,7 @@ Lin` and no `name` field now renders as `Bob Lin` everywhere — instead of
   the action context, so it can be omitted from the params.
 
   See `content/docs/guide/record-edit-modes.md` for a walkthrough.
+
   - New view: `packages/app-shell/src/views/RecordFormPage.tsx`
   - New helpers: `resolveRecordFormTarget`, `resolveNavigateCreateUrl`,
     `resolveNavigateEditUrl` in
diff --git a/packages/app-shell/package.json b/packages/app-shell/package.json
index 40b00bc021..e533fdde8a 100644
--- a/packages/app-shell/package.json
+++ b/packages/app-shell/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/app-shell",
-  "version": "17.3.0",
+  "version": "17.4.0",
   "type": "module",
   "license": "MIT",
   "description": "Minimal application shell for ObjectUI - framework-agnostic rendering engine",
diff --git a/packages/auth/CHANGELOG.md b/packages/auth/CHANGELOG.md
index c183a8bb63..f61225fa45 100644
--- a/packages/auth/CHANGELOG.md
+++ b/packages/auth/CHANGELOG.md
@@ -1,5 +1,18 @@
 # @object-ui/auth
 
+## 17.4.0
+
+### Patch Changes
+
+- Updated dependencies [d229dfa]
+- Updated dependencies [c2fd122]
+- Updated dependencies [48132f7]
+- Updated dependencies [7e5bb5d]
+- Updated dependencies [e6fdbdc]
+- Updated dependencies [7e2b7e9]
+- Updated dependencies [c1e1e6b]
+  - @object-ui/types@17.4.0
+
 ## 17.3.0
 
 ### Patch Changes
@@ -868,6 +881,7 @@
   no visible effect — the user/session were nulled but the UI stayed authenticated.
 
   Changes:
+
   - **`@object-ui/auth`** — added `isAuthEnabled: boolean` to `AuthContextValue`
     (`true` only when real auth is in use, `false` for guest/preview modes).
   - **`@object-ui/app-shell`** — `AppHeader` and `AppSidebar` now hide the "Log out"
diff --git a/packages/auth/package.json b/packages/auth/package.json
index 68ba478b80..e2b9b7f2fe 100644
--- a/packages/auth/package.json
+++ b/packages/auth/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/auth",
-  "version": "17.3.0",
+  "version": "17.4.0",
   "type": "module",
   "license": "MIT",
   "description": "Authentication system for Object UI with AuthProvider, useAuth hook, AuthGuard, and form components.",
diff --git a/packages/cli/CHANGELOG.md b/packages/cli/CHANGELOG.md
index 87a790f592..29096f89f7 100644
--- a/packages/cli/CHANGELOG.md
+++ b/packages/cli/CHANGELOG.md
@@ -1,5 +1,200 @@
 # @object-ui/cli
 
+## 17.4.0
+
+### Patch Changes
+
+- c32323e: Generated temp apps now declare every package they import, at ranges anchored to this repo
+
+  `objectui dev` / `serve` / `build` write a throwaway app into `<cwd>/.objectui-tmp`,
+  and the `package.json` they wrote named neither `lucide-react` nor any of the seven
+  `@object-ui/plugin-*` packages the generated sources import — while pinning
+  `@object-ui/react` and `@object-ui/components` at `^0.1.0`, a range that resolves to
+  nothing at all for packages published at 17.x (the registry has no 0.1.0). Outside
+  this workspace that manifest could not install; inside it, hoisting to the root
+  `node_modules` satisfied every missing name, so nothing was ever red.
+
+  **`lucide-react` is now declared** (objectui#3827). Both of its imports in the
+  generated layout are live — `import * as LucideIcons` feeds a `DynamicIcon` lookup
+  and four `LucideIcons.*` icons, and the named `{ Moon, Sun }` renders the theme
+  toggle — so this is the opposite disposition from the sibling generator, where
+  objectui#3755 removed an equivalent declaration precisely because nothing imported
+  it. Anchored to `^1.28.0`, the range all 23 in-repo manifests that import lucide
+  agree on. `commands/dev.ts` had been covering the gap in the consumer, aliasing
+  `lucide-react` to a path resolved out of `packages/components` "to avoid dependency
+  not found in temp app" — but only in monorepo mode, leaving every other path with an
+  unsatisfiable import. The declaration belongs at the producer; the alias is now a
+  workspace convenience rather than the only thing holding the import up.
+
+  **The seven plugin packages are now declared too**, in both generators. Measuring
+  the reported defect turned up that `src/App.tsx` side-effect-imports
+  `@object-ui/plugin-charts`, `-editor`, `-kanban`, `-markdown`, `-form`, `-grid` and
+  `-view` to register their components, and no manifest ever named them: the
+  undeclared set was eight packages, not the one the issue reported.
+
+  **`@object-ui/*` ranges are derived from this CLI's own version** instead of being
+  written out as literals. `.changeset/config.json` puts `@object-ui/cli` in the same
+  `fixed` group as every platform package a generated app depends on, so they always
+  publish at one version — which makes `^<own version>` both current and guaranteed to
+  exist on the registry. A literal here is not merely a fossil risk but a fossil
+  generator: that group re-versions on every release, so any hard-coded range is stale
+  the next day. This is how `^0.1.0` survived to sit 16 majors behind.
+
+  **The toolchain ranges are anchored to in-repo manifests**, the discipline
+  objectui#3742/objectui#3754 established: `vite ^5.0.0` → `^8.2.0`, `typescript
+~5.7.3` → `^6.0.3`, `@vitejs/plugin-react ^4.2.1` → `^6.0.5`, `react`/`react-dom`
+  `^18.3.1` → `19.2.8` with `@types/*` to match, `react-router-dom ^7.12.0` →
+  `^7.18.2`, `postcss ^8.5.6` → `^8.5.26`, `autoprefixer ^10.4.23` → `^10.5.4`. React
+  quotes the root's installed version rather than the wider `^18 || ^19` the platform
+  packages accept as a peer: the peer says what can work, the root says what the
+  generated code has actually run against, and inside this workspace the temp app
+  resolves React by hoisting to the root.
+
+  `tailwindcss` is deliberately left at `^3.4.19`. This repo is on Tailwind 4 and
+  `@object-ui/components` peers `^4.2.1`, so the range is not merely behind — it
+  conflicts. But re-anchoring it is not a version edit: the generated `index.css` uses
+  v3 directives, the generated `postcss.config.js` names the plugin key v4 moved to
+  `@tailwindcss/postcss`, and the generated `tailwind.config.js` is a v3 config. Raising
+  the range without rewriting those three files yields an app that installs and renders
+  unstyled, which looks fixed and is worse. Filed separately as objectui#3852; kept
+  internally consistent at v3 until then, and pinned as a deliberate deferral rather
+  than left to read as drift.
+
+  The generators now build their output as a file map that the writers spill to disk,
+  so tests assert over the same artifact the CLI writes. Three structural gates port
+  the ones the sibling generator grew: every bare import must be declared, no versioned
+  runtime dependency may be declared that nothing imports, and no generated `src/**`
+  file may be unreachable from `src/main.tsx` — the one module `index.html` loads. Each
+  is paired with a self-test that plants the defect back. Note for the next port: the
+  `create-plugin` import scanner matches single-quoted specifiers only, and these
+  templates mix quote styles, so a verbatim copy would have been blind to
+  `from "lucide-react"` — one of the two lines this issue reports.
+
+- 8277053: 修复 `objectui dev` 生成的临时 app 的 CSS 管线:整套从 Tailwind 3 迁到 Tailwind 4
+
+  生成器写出的样式面此前是完整的 v3 三件套 —— `src/index.css` 用 `@tailwind base/components/utilities` 指令、`postcss.config.js` 写 v3 的 `tailwindcss: {}` 插件键、外加一份 `tailwind.config.js` —— 而仓内与 `@object-ui/components` 都已在 v4(components 的 peer 是 `tailwindcss ^4.2.1`)。两个后果都是真的:
+
+  - **仓内 `objectui dev` 今天不出样式。** `commands/dev.ts` 的 monorepo 分支把 `require('tailwindcss')(configPath)` 当 PostCSS 插件调用,v4 下这条路径只会抛 "moved to `@tailwindcss/postcss`",而该异常被 `try/catch` 吞成一行黄字警告;`css.postcss` 因此没被设上,Vite 退回去搜配置文件,`/src/index.css` 请求最终 500(实测:`Failed to load PostCSS config … Cannot find module '@tailwindcss/postcss'`),浏览器里一条样式都没有。
+  - **仓外一次干净安装会 ERESOLVE。** 生成清单声明 `tailwindcss ^3.4.19`,与它依赖的 `@object-ui/components` 的 v4 peer 冲突。
+
+  改动:
+
+  - `src/index.css` 改为仓内惯用的 v4 CSS-first 写法(`@import 'tailwindcss'` + `@custom-variant dark` + `@source` + `@theme`),`@theme` 的 token 集与 `packages/components/src/index.css` 逐条对齐 —— 包含 v3 config 一直缺、而生成的 `src/Layout.tsx` 自己就在用的 8 个 `sidebar-*` token。
+  - `postcss.config.js` 改写 `'@tailwindcss/postcss': {}`;`tailwind.config.js` 不再生成(v4 下没有 `@config` 指向它时它就是死文件,仓内本身也零个 `tailwind.config.*`),v3 的 `content` 扫描面等价迁为 `@source`。
+  - 清单:`tailwindcss` 抬到 `^4.3.3` 并新增 `@tailwindcss/postcss ^4.3.3`,两者都锚回仓内(#3827 记的 `TAILWIND_V3_DEFERRED` 记账钉随之翻转)。
+  - `commands/dev.ts` 改用 `@tailwindcss/postcss`,并由 `@object-ui/cli` 自己声明这两个插件包;加载失败不再吞成警告,而是带修法响亮报错 —— 静默无样式正是这个缺陷能潜伏这么久的原因。
+
+- 59df371: `objectui doctor` now diagnoses Tailwind 4 instead of Tailwind 3
+
+  The Tailwind section of `objectui doctor` was written against v3 and got every
+  question backwards on a v4 project — which is every project this repo ships.
+
+  **It counted a missing `tailwind.config.js` as an issue.** In v4 that file is not
+  part of the setup: the engine reads CSS-first configuration (`@import
+'tailwindcss'`, `@theme`, `@source`) and only loads a JS config when a stylesheet
+  opts in with `@config`. So the command reported a problem that did not exist and
+  pushed the reader toward creating a file Tailwind would never read. Measured on
+  `examples/console-starter`, a correct v4 app: before, `Found 1 issue(s)` —
+  `⚠️ tailwind.config.js not found`; after, `Everything looks good! ✨`. The repo's
+  own root reproduced it identically.
+
+  **It then graded that file on its `content` array**, the v3 key `@source`
+  replaced. The two `tailwind.config.*` files still tracked here are exactly that
+  trap: `apps/console` and `examples/byo-backend-console` both declare a `content`
+  array, no stylesheet in the repo contains `@config`, so both files are inert —
+  and the old check answered `✓ Tailwind content paths configured` for them. A
+  false green on a dead file. `apps/console` before: `Everything looks good! ✨`;
+  after: one finding saying the config is inert and what to do about it.
+
+  **It never checked `@tailwindcss/postcss`**, the one dependency a v4 build cannot
+  start without — v4 moved the PostCSS plugin out of `tailwindcss` into that
+  package, and naming the old `tailwindcss` key in a PostCSS config resolves to a
+  shim whose only job is to throw. That is the failure form objectui#3852 measured
+  on the generated app, and doctor printed `✓ Tailwind CSS installed` straight
+  through it.
+
+  The checks are now the v4 contract, matching what `objectui init` scaffolds:
+  `@tailwindcss/postcss` declared or installed, a PostCSS config naming it rather
+  than the v3 `tailwindcss` key, and a CSS entry running `@import 'tailwindcss'`
+  (with `@source` acknowledged when present). The declared `tailwindcss` major is
+  read too, so a v3 range is named as migration debt instead of passing as
+  `✓ installed`.
+
+  Two deliberate silences, because objectui#3891 is about doctor asserting things
+  it cannot see. A **missing** `tailwind.config.*` produces no finding of any level
+  — only a _present_ one does, and only when nothing opts into it via `@config`.
+  And when no recognised CSS entry exists at all (a monorepo root, a bespoke
+  layout), the CSS verdicts are skipped rather than guessed.
+
+  A v3-tolerant dual path — branching on the declared major and running two sets of
+  checks — was considered and deliberately not built: it widens the product surface
+  past this repo's v4-only posture. v3 spellings are diagnosed as migration debt,
+  not supported as a second mode.
+
+  Internally `runDiagnostics(cwd)` now returns structured findings carrying a
+  stable `id`, and `doctor()` only renders and counts them. That split is what
+  makes the matrix testable against real fixture directories instead of scraped
+  console output; the tests pin verdicts by `id`, so wording can improve without
+  the coverage evaporating.
+
+- 85fb95b: Fix `objectui init` scaffolding an app that renders neither components nor styles.
+
+  The generated `src/App.tsx` imported only `SchemaRenderer` from `@object-ui/react`, which does not depend on `@object-ui/components` — and registration is a side effect of importing that package. The component registry was therefore empty in every scaffolded project, and each node of all three templates (`simple`, `form`, `dashboard`) rendered "Unknown component type". The manifest already declared `@object-ui/components`; it was declared and never imported. The generated `src/App.tsx` now performs the side-effect import.
+
+  The generated `src/index.css` was a bare `@import 'tailwindcss';` and never loaded the library's published stylesheet, so the theme utilities the templates lean on had no tokens behind them. It now also does `@import '@object-ui/components/style.css';`, matching what the quick-start guide teaches hand-rolled consumers.
+
+  `objectui init` is unchanged in every other respect: the same eleven files, byte for byte, apart from these two lines.
+
+- c29ceff: Move the generator templates' dependency ranges onto the repo's current ones
+
+  The dependabot wave of 2026-08-10 bumped `lucide-react` to `1.29.0` and `vite`
+  to `8.2.1` in this repo's own manifests, but the ranges hard-coded in the
+  scaffold generators do not move with it — dependabot does not know the
+  templates exist. A project scaffolded by `objectui init` / `objectui dev` or by
+  `create-plugin` therefore declared a range the repo itself had already moved
+  past.
+
+  Three ranges are re-anchored: `lucide-react` `^1.28.0` → `^1.29.0` in the routed
+  app generator, and `vite` `^8.2.0` → `^8.2.1` in both the shared CLI scaffold
+  devDependencies and the create-plugin template.
+
+- 0a09793: `objectui init` now versions the project it scaffolds against the CLI that wrote it, and stops writing a `tailwind.config.js` Tailwind 4 never reads.
+
+  The generated `package.json` asked for `@object-ui/components` and `@object-ui/react` at `^2.0.0` while those packages publish at 17.x, so `npm install` in a fresh scaffold resolved a major unrelated to the CLI that produced it. Both ranges are now derived from the CLI's own version, which is sound because `.changeset/config.json` releases the CLI and every platform package from one `fixed` group. The scaffold's toolchain ranges had drifted the same way — vite `^7.3.1` against the repo's `^8.2.0`, typescript `^5.9.3` against `^6.0.3`, and seven more — and now read from the same table the temp-app generators use rather than from literals of their own.
+
+  The scaffold's CSS pipeline was already Tailwind 4 (`@tailwindcss/postcss`, `@import 'tailwindcss'`), and v4 reads a JS config only when a stylesheet points `@config` at one. The `tailwind.config.js` written beside it was therefore inert — an authoritative-looking `content` list nothing consumed — and is no longer written.
+
+- Updated dependencies [794c497]
+- Updated dependencies [993336f]
+- Updated dependencies [f0a625a]
+- Updated dependencies [b5980f4]
+- Updated dependencies [8aad9fd]
+- Updated dependencies [0cbdca8]
+- Updated dependencies [d229dfa]
+- Updated dependencies [ecae400]
+- Updated dependencies [d3e738a]
+- Updated dependencies [c3b01a7]
+- Updated dependencies [7ed3360]
+- Updated dependencies [0fa5e4d]
+- Updated dependencies [5bfaabd]
+- Updated dependencies [e06810e]
+- Updated dependencies [ab3ad4f]
+- Updated dependencies [c2fd122]
+- Updated dependencies [e24d767]
+- Updated dependencies [aca561a]
+- Updated dependencies [48132f7]
+- Updated dependencies [0ef9dfd]
+- Updated dependencies [0109f54]
+- Updated dependencies [7e5bb5d]
+- Updated dependencies [e6fdbdc]
+- Updated dependencies [54233b1]
+- Updated dependencies [97b63d7]
+- Updated dependencies [7e2b7e9]
+- Updated dependencies [c1e1e6b]
+  - @object-ui/components@17.4.0
+  - @object-ui/react@17.4.0
+  - @object-ui/types@17.4.0
+
 ## 17.3.0
 
 ### Patch Changes
@@ -864,6 +1059,7 @@ undefined` — swallowing the very errors the command exists to print. Now reads
 - fd15918: Comprehensive i18n refactor + CI test fix.
 
   **i18n (`@object-ui/i18n`)**
+
   - Added ~130 new keys under 12 new top-level namespaces: `layout`, `search`,
     `empty`, `renderer`, `actionDialog`, `rowAction`, `navigationSync`,
     `objectActions`, `objectViewActions`, `dashboardActions`, `recordDetail`,
@@ -875,6 +1071,7 @@ undefined` — swallowing the very errors the command exists to print. Now reads
 
   **App shell (`@object-ui/app-shell`)** — replaced hardcoded English in 14
   files with `useObjectTranslation`:
+
   - Layout: `AppSidebar`, `ActivityFeed` (locale-aware relative time),
     `MetadataInspector`.
   - Views: `SearchResultsPage`, `ActionParamDialog`, `RecordFormPage`,
@@ -886,12 +1083,14 @@ undefined` — swallowing the very errors the command exists to print. Now reads
     `useObjectActions` (delete confirm + success / failure toasts).
 
   **Plugin grid (`@object-ui/plugin-grid`)**
+
   - `ObjectGrid` record-detail panel now translates Empty / Yes / No / System
     via the existing `useGridTranslation` safe-fallback wrapper.
   - `RowActionMenu` adopts a local safe-fallback i18n wrapper for
     `Open menu` / `Edit` / `Delete`, preserving standalone-usage guarantees.
 
   **CLI test fix (`@object-ui/cli`)**
+
   - `cli-bin.test.ts` auto-builds the package on first run when `dist/cli.js`
     is missing, instead of throwing. This unbreaks `pnpm test:coverage` in CI
     (root vitest run does not honor turbo's `^build` deps) and removes the
@@ -1142,6 +1341,7 @@ undefined` — swallowing the very errors the command exists to print. Now reads
 - New plugin-object and ObjectQL SDK updates
 
   **Added:**
+
   - New Plugin: @object-ui/plugin-object - ObjectQL plugin for automatic table and form generation
     - ObjectTable: Auto-generates tables from ObjectQL object schemas
     - ObjectForm: Auto-generates forms from ObjectQL object schemas with create/edit/view modes
@@ -1150,6 +1350,7 @@ undefined` — swallowing the very errors the command exists to print. Now reads
   - ObjectQL Integration: Enhanced ObjectQLDataSource with getObjectSchema() method using MetadataApiClient
 
   **Changed:**
+
   - Updated @objectql/sdk from ^1.8.3 to ^1.9.1
   - Updated @objectql/types from ^1.8.3 to ^1.9.1
 
@@ -1164,6 +1365,7 @@ undefined` — swallowing the very errors the command exists to print. Now reads
 - Patch release: Add automated changeset workflow and CI/CD improvements
 
   This release includes infrastructure improvements:
+
   - Added changeset-based version management
   - Enhanced CI/CD workflows with GitHub Actions
   - Improved documentation for contributing and releasing
diff --git a/packages/cli/package.json b/packages/cli/package.json
index eb43bf3462..e3f3da81d4 100644
--- a/packages/cli/package.json
+++ b/packages/cli/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/cli",
-  "version": "17.3.0",
+  "version": "17.4.0",
   "description": "Standalone CLI for Object UI — scaffold, develop, build and validate JSON/YAML schema-driven applications.",
   "type": "module",
   "homepage": "https://www.objectui.org/docs/utilities/cli",
diff --git a/packages/collaboration/CHANGELOG.md b/packages/collaboration/CHANGELOG.md
index 3afadff13d..92844d5e2f 100644
--- a/packages/collaboration/CHANGELOG.md
+++ b/packages/collaboration/CHANGELOG.md
@@ -1,5 +1,35 @@
 # @object-ui/collaboration
 
+## 17.4.0
+
+### Patch Changes
+
+- Updated dependencies [7864f03]
+- Updated dependencies [d229dfa]
+- Updated dependencies [f5f8744]
+- Updated dependencies [69becd2]
+- Updated dependencies [5e52495]
+- Updated dependencies [b750823]
+- Updated dependencies [c2fd122]
+- Updated dependencies [ac2139c]
+- Updated dependencies [b14ab3a]
+- Updated dependencies [8c60819]
+- Updated dependencies [e64a52e]
+- Updated dependencies [844d17f]
+- Updated dependencies [48132f7]
+- Updated dependencies [4dcd52a]
+- Updated dependencies [42ae5c6]
+- Updated dependencies [7e5bb5d]
+- Updated dependencies [6d762da]
+- Updated dependencies [e6fdbdc]
+- Updated dependencies [f9faa7d]
+- Updated dependencies [7e2b7e9]
+- Updated dependencies [33526fd]
+- Updated dependencies [32413ec]
+- Updated dependencies [c1e1e6b]
+  - @object-ui/i18n@17.4.0
+  - @object-ui/types@17.4.0
+
 ## 17.3.0
 
 ### Patch Changes
diff --git a/packages/collaboration/package.json b/packages/collaboration/package.json
index f9e8dec4a5..50814228d3 100644
--- a/packages/collaboration/package.json
+++ b/packages/collaboration/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/collaboration",
-  "version": "17.3.0",
+  "version": "17.4.0",
   "type": "module",
   "license": "MIT",
   "description": "Real-time collaboration for Object UI with presence tracking, live cursors, conflict resolution, and comment threads.",
diff --git a/packages/components/CHANGELOG.md b/packages/components/CHANGELOG.md
index adb4271624..ffaaa7c47c 100644
--- a/packages/components/CHANGELOG.md
+++ b/packages/components/CHANGELOG.md
@@ -1,5 +1,722 @@
 # @object-ui/components
 
+## 17.4.0
+
+### Minor Changes
+
+- ecae400: Retire the `capability-multiselect` field widget name, which existed only on the docs-site registration path and which nothing ever stamped (objectui#3308, ADR-0049 enforce-or-remove)
+
+  `field:capability-multiselect` was registered by `registerFields()` and only there. That function's sole caller is the docs site, so the key never existed on the live path (`registerAllFields()`, run at module import, iterates `fieldWidgetMap` — which never listed it). A field authored with `widget: 'capability-multiselect'` therefore resolved to nothing in every real application, while the comment above the registration described it as usable from a record form: a code comment promising a capability that does not exist, which is the worst direction for a metadata renderer AI-authored apps read as authority.
+
+  Nothing stamped the hint either. ADR-0056 P1 stamps `permission-facet-link` on all six `sys_permission_set` facets — `system_permissions` included — through the single `ObjectStackAdapter.getObjectSchema` choke point, and P2 put the capability editor in Studio. The widget name was a leftover from an intermediate iteration of that rollout.
+
+  Removed, with a tombstone at each site:
+
+  - `@object-ui/fields` — the `field:capability-multiselect` registration and the comment that advertised it. **Breaking in name only**: the key was unreachable outside the docs site, so no application could have resolved it. A field still carrying the hint now degrades to its declared `type` renderer, the defined behavior for an unregistered widget.
+  - `@object-ui/plugin-detail` — `InlineFieldInput`'s `widget === 'capability-multiselect'` branch, the hint's last honoring surface. Leaving one consumer for a name no producer emits and no form resolves is the same declared-vs-enforced split, inverted. The sibling `permission-facet-link` branch is untouched and pinned.
+  - `@object-ui/components` — the dead `capability-multiselect` entry in the form renderer's `DATA_SOURCE_FIELD_TYPES` set, which could never match a resolvable widget.
+  - `@object-ui/plugin-form` — a comment naming `capability-multiselect` as the widget stamped onto `sys_permission_set.system_permissions`; it names `permission-facet-link` now, which is what is actually stamped.
+
+  `CapabilityMultiSelectField` itself is **unchanged and still exported**: Studio's `PermissionMatrixEditor` imports and renders it directly, which is ADR-0056 P2's design. Only the widget name is retired — the component is not a registry field widget and its doc comment now says so.
+
+  `registerFields()` is also **kept**, with its `@deprecated Use registerAllFields() instead` note corrected. The two are not interchangeable: it registers `createFieldRenderer(widget)`, which synthesizes the label, description and the local `value`/`onChange` state that lets a bare field node (`{ type: 'currency', label: 'Amount' }`) render standalone in the docs demos. Retiring it needs a decision about where that demo chrome goes; the note now records that instead of implying a drop-in replacement.
+
+### Patch Changes
+
+- 794c497: `action:bar` member actions declaring `visible: false` are now hidden instead of rendered
+
+  `action:button` and `action:icon` carried the same truthiness gate objectui#3812
+  removed from the member-action leaves — `if (schema.visible && !isVisible)
+return null` — so `visible: false`, the most explicit way an author can say
+  "never show this", fell into the "no gate declared" branch and the action
+  rendered anyway.
+
+  objectui#3812's triage judged the five component-level `schema.visible` gates a
+  dormant defensive layer, because `packages/react`'s `SchemaRenderer` evaluates
+  `newSchema.visible !== undefined` and hides the node before the component ever
+  mounts. Two of the five are not dormant, and this is the difference:
+
+  `action:bar` does not route through `SchemaRenderer`. It resolves each member's
+  renderer from the `ComponentRegistry` itself and spreads the whole member action
+  onto that renderer's schema, so an author's `visible` on a member arrives as the
+  child's own `schema.visible` and lands on the child's gate. `action:bar` is also
+  the only gate on that path by design — its `filteredActions` deliberately
+  filters on `requiredPermissions` and `actionRendersAt` only, leaving `visible` to
+  the member renderer. The path is reachable end-to-end and is now pinned that way
+  (registry-mounted `action:bar`, member declaring `visible: false`), so the
+  reachability does not have to be argued again.
+
+  Both gates now read the same named definition as the rest of the family,
+  `hasDeclaredVisibilityGate` (`!= null && !== ''`) — the invariant objectui#3492
+  established for the selection bar and objectui#3758 applied to the row-action
+  surfaces. The evaluation entry is untouched and already short-circuits a boolean
+  rather than handing it to the CEL engine, which `actionPredicate.parity` pins for
+  both the engine and the renderer path.
+
+  Behaviour change surface, deliberately narrow: only an `action:button` /
+  `action:icon` whose `visible` is the literal boolean `false` (or another falsy
+  non-empty value) changes — from rendered to hidden, which is what the
+  declaration asked for. `visible: true` still renders, `''` and an absent
+  `visible` are still no gate at all, and no expression-valued `visible` changes
+  verdict. `ActionSchema.visible` is `ExpressionInputSchema` with no boolean
+  member, so `objectstack build` cannot emit this shape; hand-written view JSON and
+  in-process callers constructing action defs can.
+
+  The remaining three component-level gates (`action:group`, `action:menu`,
+  `action:bar`'s own) stay as they are — they only ever mount through
+  `SchemaRenderer`, which resolves `visible` first, and the overflow `action:menu`
+  that `action:bar` synthesizes carries no `visible` at all.
+
+- 993336f: An action declaring `disabled: ''` is no longer greyed out forever (objectui#3842)
+
+  The "is a `disabled` gate declared?" test stopped at `!= null`, missing the
+  `!== ''` half of the invariant the `visible` family converged on
+  (`hasDeclaredVisibilityGate`, objectui#3492 / #3758 / #3812 / #3823 / #3835). So
+  `disabled: ''` counted as a declared gate, and the verdict went to the evaluation
+  entry — which reads an empty predicate as "no condition → `true`"
+  (`toPredicateInput('')` is `undefined`, `evaluateCondition(undefined)` is `true`).
+
+  The direction is why this half is a defect and the `visible` half was not. On
+  `visible`, that `true` means SHOW, so an over-broad "declared" test and a
+  permissive empty predicate cancel out and `visible: ''` renders either way. On
+  `disabled`, the same `true` means DISABLE — the two mistakes compound, and an
+  empty predicate stopped meaning "no gate" and started meaning "permanently
+  greyed out". One empty predicate, opposite treatment under two keys.
+
+  Two gates now ask the shared definition instead:
+
+  - `@object-ui/app-shell`'s `DeclaredActionsBar` — the hot one. Its actions are
+    SERVER-declared (`objectDef.actions[]`) and its hosts are the approvals inbox's
+    record sections, so a `disabled: ''` arriving from metadata (an authoring form
+    left empty, a template that rendered to an empty string) produced an Approve /
+    Reject button nobody could click, indistinguishable from deliberate metadata.
+    objectui#3835 was this same surface failing the other way.
+  - `@object-ui/components`' `action:button` — verified to be the same shape before
+    it was changed (the issue inferred it from the identical spelling but did not
+    probe it): with `disabled: ''` the rendered button carried `disabled=""`.
+
+  **Behaviour change surface, deliberately narrow.** Only `disabled: ''` changes —
+  from disabled to clickable, which is what "no predicate" asked for. `disabled:
+true` still disables, `disabled: false` and an absent `disabled` still do not, and
+  no expression-valued `disabled` changes verdict. One consequence worth naming: on
+  `action:button`, an empty `disabled` now falls THROUGH to the legacy non-spec
+  `enabled` fallback instead of short-circuiting on the empty predicate, so an
+  action spelling both (`disabled: ''` + `enabled: true`) becomes clickable.
+
+  The legacy `enabled` leg of `action:button` was routed through the same
+  definition for consistency, and that part is behaviour-preserving by derivation
+  rather than a fix: the leg is negated (`disabled = !isEnabled`), so an empty
+  predicate's `true` already arrived as "not disabled" — the same verdict "no gate"
+  produces. All four shapes are identical under either test; the derivation table
+  and the reason no test can distinguish them are written down next to the pins.
+
+  `hasDeclaredVisibilityGate` keeps its historic name at both call sites (the
+  objectui#3842 dispatch ruling): the predicate is key-neutral, and one
+  implementation behind two names is how a repo grows dialects. Each call site says
+  so in a comment.
+
+- f0a625a: `disabled: ''` no longer greys out the remaining five action surfaces (objectui#3849)
+
+  objectui#3842 / PR #3851 fixed the "is a `disabled` gate DECLARED?" test on
+  `action:button` and app-shell's `DeclaredActionsBar`. Five same-shaped sites were
+  outside that PR's scope and stayed on `!= null`, so within one component the
+  `visible` gate asked `hasDeclaredVisibilityGate` while the `disabled` gate on the
+  next line asked `!= null` — two spellings of one question:
+
+  - `@object-ui/components` — `action:icon`, `action:group`'s inline button
+    (`InlineActionButton`) and dropdown item (`DropdownActionItem`), and
+    `action:menu`'s item (`ActionMenuItem`).
+  - `@object-ui/plugin-detail` — `record:quick_actions`' `QuickActionButton`.
+
+  Why the missing `!== ''` half is a defect on this key and not on `visible`:
+  `toPredicateInput('')` is `undefined` and `evaluateCondition(undefined)` is
+  `true`. On `visible` that `true` means SHOW, so an over-broad "declared" test and
+  a permissive empty predicate cancel out. On `disabled` it means DISABLE, so they
+  compound — `disabled: ''` (an empty predicate: nothing declared) rendered a
+  permanently greyed-out control, with nothing the author could write to un-grey
+  it. Unlike #3842's approvals inbox, these five are the general action face
+  (toolbars, dropdowns, record quick actions), so the reach is wider even though no
+  single high-value host owns them.
+
+  **Behaviour change surface, deliberately narrow.** Only `disabled: ''` changes —
+  from disabled to clickable, which is what "no predicate" asked for. `disabled:
+true` still disables, `disabled: false` and an absent `disabled` still do not, and
+  no expression-valued `disabled` changes verdict. On the four sites that also carry
+  the legacy non-spec `enabled` fallback, one consequence follows: an empty
+  `disabled` now falls THROUGH to that leg instead of short-circuiting on the empty
+  predicate, so an action spelling both (`disabled: ''` + `enabled: true`) becomes
+  clickable. `record:quick_actions` has no `enabled` leg, so its chain is the single
+  gate.
+
+  Routing those legacy `enabled` legs through the same definition is
+  behaviour-preserving by derivation rather than a fix: the leg is negated
+  (`disabled = !isEnabled`), so an empty predicate's `true` already arrived as "not
+  disabled" — the verdict "no gate declared" produces. #3842's four-shape derivation
+  table is reproduced next to the new pins, together with the statement that no
+  `enabled` case can go red by reverting that leg.
+
+  `hasDeclaredVisibilityGate` keeps its historic name (the objectui#3842 ruling): the
+  predicate is key-neutral, and one implementation behind two names is how a repo
+  grows dialects. The three `@object-ui/components` sites import it relatively;
+  `record:quick_actions` takes it from the package barrel, the cross-package route
+  objectui#3835 opened. Every call site says so in a comment.
+
+- b5980f4: Action-face member actions declaring `visible: false` are now hidden instead of rendered
+
+  The three member-action gates on the action face asked truthiness —
+  `if (action.visible && !isVisible) return null` — so `visible: false`, the most
+  explicit way an author can say "never show this", fell into the "no gate
+  declared" branch and the action rendered anyway:
+
+  - `action:group` in `display: 'inline'` mode (`InlineActionButton`);
+  - `action:group` in `display: 'dropdown'` mode (`DropdownActionItem`);
+  - `action:menu`'s items (`ActionMenuItem`).
+
+  These leaves `.map()` the component's own `actions` array, so neither
+  `SchemaRenderer`'s node-level `visible` handling nor
+  `ActionEngine.getActionsForLocation` (whose boolean `visible` was always
+  correct) is in the path — the truthy gate was the only gate.
+
+  All three now read one named definition, `hasDeclaredVisibilityGate`
+  (`!= null && !== ''`), and let the declaration itself decide. This is not a new
+  decision: objectui#3492 established the invariant for the selection bar, whose
+  `hasVisibilityGate` spells out why truthiness cannot answer the question, and
+  objectui#3758 applied it to both row-action surfaces. The evaluation entry is
+  untouched and already short-circuits a boolean rather than handing it to the CEL
+  engine, which `actionPredicate.parity` pins for both the engine and the renderer
+  path.
+
+  Behaviour change surface, deliberately narrow: only a member action whose
+  `visible` is the literal boolean `false` (or another falsy non-empty value)
+  changes — from rendered to hidden, which is what the declaration asked for.
+  `visible: true` still renders, `''` and an absent `visible` are still no gate at
+  all, and no expression-valued `visible` changes verdict.
+  `ActionSchema.visible` is `ExpressionInputSchema` with no boolean member, so
+  `objectstack build` cannot emit this shape; hand-written view JSON and
+  in-process callers constructing action defs can.
+
+- 8aad9fd: Action-face predicates written against the canonical `record.` root now evaluate
+
+  `action:button`, `action:icon`, `action:menu` and `action:group` gated their
+  actions on `useCondition(pred, context)`, which evaluates on
+  `new ExpressionEvaluator({ ...scope, ...context })` — and the context each of
+  them passed was the row spread flat, or nothing at all. Only the shorthand
+  spelling resolved:
+
+  | predicate                    | verdict, before                  |
+  | ---------------------------- | -------------------------------- |
+  | `status == "pending"`        | evaluates (`action:button` only) |
+  | `record.status == "pending"` | throws `record is not defined`   |
+  | `data.status == "pending"`   | throws `data is not defined`     |
+
+  `record.` is not a mistaken spelling — it is the canonical one. It is what
+  `ExpressionEvaluator`'s CEL path binds (`bag.record` as the record namespace),
+  what `evalRowPredicate` binds on the record header, list rows, the row kebab
+  and conditional formatting (`record.status` / bare `status` / `data.status`),
+  and what the server enforces with. A `visible` that fails CLOSED turns the throw
+  into "hidden", so a correctly-authored predicate deleted its own button —
+  indistinguishable from the gate having said no. On the fail-soft legs the same
+  throw lands the other way: `disabled` greyed a control out for everyone.
+
+  Live rather than theoretical: every declared action on framework's
+  `sys_approval_request` gates on `record.viewer.*`, so the whole server-declared
+  approval decision set was invisible wherever the declared-action bar rendered
+  until objectui#4077 fixed that bar. These four generic renderers carried the
+  same binding.
+
+  What changed:
+
+  - all four bind the row the three canonical ways, through one named helper
+    (`usePredicateRecordContext`, exported from `@object-ui/react` beside
+    `useCondition`), so the action face and the row surfaces answer an author's
+    `visible:` the same way;
+  - `action:icon` reads the row at all. It evaluated against an empty bag, so not
+    even the bare-field shorthand resolved — and its `data` prop was landing in
+    the props spread onto the DOM button;
+  - `action:menu`'s items and `action:group`'s two leaves receive the row from
+    their host, which they previously never got;
+  - `action:bar` forwards the row into the overflow menu it builds, not just to
+    its inline members. An action's predicate had been answering a different
+    question purely because it spilled past `maxVisible` — which on mobile
+    defaults to 1, making the verdict a function of the viewport.
+
+  Deliberately unchanged: the evaluation entry and each site's error policy. A
+  predicate that genuinely faults still fails closed on `action:button` /
+  `action:menu` `visible` and still fails soft on the other legs, exactly as
+  before; `toPredicateInput`, `hasDeclaredVisibilityGate` and the empty-predicate
+  rules keep their pinned semantics. Binding the row is a separate question from
+  what to do when the predicate faults.
+
+  A surface with no row of its own binds nothing rather than an empty record, so
+  a host that supplies the row through the ambient predicate scope is not blanked
+  out; a row passed explicitly still wins over the scope.
+
+- 0cbdca8: Built-in `select` fields: the form's label, validation message and required state now reach the control
+
+  A hand-written form field `{ name: 'status', label: 'Status', type: 'select', options: [...] }`
+  rendered a visible "Status" label that pointed at nothing. Measured before the fix:
+  `<label for="…-form-item">` resolved to no element at all, `getByLabelText(/status/i)`
+  found zero matches, and the trigger button carried no `id`, no `aria-describedby`, no
+  `aria-invalid` and no `aria-required`. Clicking the label did nothing and a screen reader
+  announced an anonymous combobox with no field name, no error link and no required state.
+
+  Cause: the built-in `select` branch spread its whole DOM pass-through onto Radix's
+  `Select.Root`. Root renders no DOM element of its own, so everything it does not
+  recognise is silently dropped — and that is exactly where `<FormControl>`'s Slot puts the
+  field's `id` / `aria-describedby` / `aria-invalid` and the renderer puts `aria-required`.
+  The pass-through now lands on `SelectTrigger`, the focusable `button[role=combobox]` the
+  user and their assistive tech actually operate, with the same two keys deliberately kept
+  on Root as in the widget-side fix: `name` (the one key Root consumes — it forwards it to
+  the hidden native `select` that takes part in form submission) and `disabled` (Root
+  disables trigger, items and hidden select together, so the raw prop must not gain a second
+  author). `ref` rides the pass-through too, so react-hook-form can finally focus a built-in
+  select.
+
+  This is the built-in half of the same mechanism objectui#3306 fixed on the widget side.
+  The two halves diverged because `'select'` is a `BUILTIN_FIELD_TYPES` member: an
+  object-driven `field:select` resolves to the registered `SelectField` (fixed since #3306),
+  while a hand-written bare `type: 'select'` never consults the registry and kept the
+  defect. Both paths are now pinned side by side — the registered path as a positive control
+  — so they cannot drift apart again. Which component renders a bare `select` is unchanged;
+  only where its host props land.
+
+  Authored `className` on a built-in `select` now reaches the trigger (it previously reached
+  no element), composed with the branch's touch-target height rather than replacing it.
+
+- d3e738a: Export `hasDeclaredVisibilityGate` from the package barrel (objectui#3835)
+
+  `hasDeclaredVisibilityGate(visible)` — "did this action DECLARE a visibility gate
+  at all?", i.e. `!= null && !== ''`, with the verdict left to the evaluation entry
+  — is the single definition objectui#3492 established and PR #3816 / #3825 / #3836
+  applied to every member-action gate in this package and in `@object-ui/plugin-grid`.
+  It lived module-private in `src/renderers/action/visibility-gate.ts`.
+
+  The family turned out to have a member outside these packages:
+  `@object-ui/app-shell`'s `DeclaredActionsBar` gates server-declared actions with
+  the same question and had the same truthiness bug (objectui#3835). Exporting the
+  one definition is what keeps that fix from becoming a fifth hand-spelled copy of
+  it — the drift shape objectui#3142 already had to unpick for `locations` in these
+  same files.
+
+  Additive only: one `export` line, no behaviour change in this package. The
+  function is pure and dependency-free.
+
+- c3b01a7: Give composite and grouped field widgets a real accessible name: the form renderer now associates its label by IDREF for widgets that declare `labelling: 'group'`, instead of emitting a `<label for>` that nothing labelable answers (objectui#3961).
+
+  Six widgets rendered a visible group label that named **nothing** in the accessibility tree. Measured in a real form, one field per row, reading each label's `for` against the DOM:
+
+  ```
+  address      for=…-form-item -> MISSING            byLabelText=0   role+name=0
+  geolocation  for=…-form-item -> MISSING            byLabelText=0   role+name=0
+  checkboxes   for=…-form-item -> div                byLabelText=0   role+name=0
+  radio        for=…-form-item -> div[radiogroup]    byLabelText=0   role+name=0
+  rating       for=…-form-item -> div                byLabelText=0   role+name=0
+  file         for=…-form-item -> div[role=button]   byLabelText=0   role+name=0
+  ```
+
+  Two shapes, one outcome. `address` / `geolocation` spread the host's id onto their first sub-input and then replaced it with that input's own unique id (objectui#3343, correct in itself), so the `for` named an id no element carried — clicking "Shipping Address" did nothing and the group label was absent from the accessibility tree entirely. `checkboxes` / `radio` / `rating` / `file` kept the id, but on a `div`: a `<label for>` on a non-labelable element is inert HTML — `HTMLLabelElement.control` is `null`, so it activates nothing and contributes no name. A screen reader heard "Street Address", "City", "Alpha", "Beta" — never which group they belonged to.
+
+  The fix is the WAI-ARIA group pattern, driven by a DECLARATION rather than by the host guessing at widget DOM:
+
+  - `@object-ui/core` — `ComponentMeta` gains `labelling?: 'control' | 'group'`. Additive and optional; absent means `'control'`, which is every existing component's behaviour.
+  - `@object-ui/components` — the form renderer reads it. For a `'group'` field the `<FormLabel>` publishes an `id` and drops its `for`, and the widget receives `aria-labelledby`. The single-control path is unchanged down to the attribute: no id on the label, no `aria-labelledby` key on the widget, so no field acquires a second naming channel. `ui/form.tsx` is untouched (Shadcn no-touch) — both halves travel as ordinary props, since `<FormLabel>` spreads props after its own `htmlFor`.
+  - `@object-ui/fields` — the six audited widgets declare `labelling: 'group'`. `address` / `geolocation` move the host id (and only the id) from their first sub-input to the group container; `checkboxes` / `rating` answer a host-supplied `aria-labelledby` with `role="group"`; `radio` keeps Radix's more specific `radiogroup`; `file` takes the name on its dropzone with no invented group layer, because it has exactly one control that merely happens not to be labelable.
+
+  No new key in the widget props contract: `aria-*` is already declared on it and forwarded by `toDomProps`, the same channel `aria-required` (objectui#3290) travels.
+
+  Deliberately unchanged: sub-labels keep naming their own inputs (`aria-labelledby` overrides `<label for>`, so putting the group name on the first sub-input would have replaced "Street Address" with the field name — the concatenated-name outcome this issue rejected), `aria-describedby` stays on the first focusable sub-input where focus can reach it (objectui#3318), the sub-input ids of objectui#3343 do not move, and standalone rendering — the inline grid editor, a bare SDUI node, where nobody hands down an id and there is no host label to point at — emits no role and no IDREF at all.
+
+  A widget that does not declare itself keeps the old `for`, which the label-association tests report as an association resolving to a non-labelable element. Silence was the failure mode being fixed; the default path stays loud.
+
+- 7ed3360: fix(data-table): don't render a row overflow ("⋮") trigger that opens an empty menu
+
+  The row overflow trigger was gated on whether row-action **handlers** were
+  supplied (`onRowEdit` / `onRowDelete` / `rowActionDefs`), while the menu's items
+  were filtered a second time — per item, per record — against
+  `rowEditPredicates` / `rowDeletePredicates` and a custom action's `visible`. On a
+  row where every item was predicate-suppressed the trigger still rendered and
+  opened an empty box, which reads as a broken page.
+
+  The trigger is now decided by the items that will actually render for that row,
+  resolved through the same visibility rule the items gate themselves on, so the
+  two cannot disagree. The decision is per row: within one table a row that keeps
+  an action keeps its trigger while a row with nothing left renders none. The
+  actions cell itself is unchanged, so the column stays aligned with its header.
+
+- 0fa5e4d: The `div` deprecation notice is now reported once per module load, not once per render (objectui#3965)
+
+  `DivRenderer` called `console.warn` on every render. That is invisible on a page
+  with one `div` and destructive on a page with many: the docs schema-catalog index
+  renders 400+ example thumbnails and emitted ~190 byte-identical notices, burying
+  the page's real console errors underneath — the two nested-button errors fixed in
+  objectui#3903 / PR #3964 had to be fished out of that flood, and it cost a
+  browser-verification run its signal twice.
+
+  The deprecation itself is unchanged: dev builds still report it, the message and
+  its migration guidance are byte-identical, and production builds are still
+  silent. Only the repetition is gone. The guard is a module-level `Set` keyed by
+  type, and the production early-return happens _before_ the set is marked, so a
+  production render cannot suppress a later dev-build notice.
+
+- 5bfaabd: `PageComponentSchema.dataSource` now reaches every object-bound block, not just
+  `list-view` — and `element:record_picker` stops discarding `view`
+  (objectstack#6953).
+
+  objectstack#5576 wired the spec's per-element data binding
+  (`dataSource: { object, view?, filter?, sort?, limit? }`) to `list-view` and left
+  the same declaration inert on every other page component. Two gaps remained, and
+  both were silent:
+
+  - **`element:record_picker` read four of the five keys and dropped `view`.** So
+    `dataSource: { object: 'account', view: 'hot' }` — the spec's own example —
+    built a picker over EVERY account instead of the rows the saved view selects.
+    Nothing threw and nothing rendered an error; the option list was simply wider
+    than what was authored, which also means a user could select a record the page
+    said was out of scope.
+  - **`object-grid` / `object-form` / `object-kanban` / `object-calendar` /
+    `object-chart` / `object-metric` / `record:related_list` read none of it.**
+    Each gates its fetch on its own `objectName`, and nothing mapped
+    `dataSource.object` onto it, so a page written the way the spec documents
+    rendered an empty grid / a field-less form / a board with no cards / an empty
+    month / an empty chart / a static metric number — with no request and no
+    diagnostic anywhere. Spec-valid metadata rendering nothing is the
+    objectstack#4413 shape.
+
+  Composition follows objectstack#5576's landed semantics unchanged on every block:
+  a named saved view supplies the baseline, a key written on the component itself
+  overrides it, an explicit binding key overrides both, `filter` AND-combines
+  ("additional filter criteria" — a binding can narrow a view, never widen it), and
+  a `view` name that does not resolve renders a configuration error instead of
+  degrading to the object's full scope.
+
+  - `@object-ui/react` — new `useElementDataSourceSchema(schema, mapping, dataSource?)`
+    and `ElementDataSourceGate` apply a resolved binding to the schema keys a given
+    block reads, plus `ElementDataSourceErrorPanel` / `ElementDataSourceLoadingPanel`
+    for the two non-final states. One precedence table for all blocks rather than
+    one copy per block — that copy is how "additional filter criteria" would have
+    become two dialects.
+  - A mapping names **only** keys its block genuinely reads. A composed value
+    written onto a key the block ignores would be accepted and dropped, which is
+    the defect being removed, one layer deeper — so a kanban's swimlane `columns`
+    never receive a view's field list, and a block with no row cap leaves `limit`
+    unmapped. The per-block coverage table, including two residual gaps that are
+    named rather than papered over, is in `content/docs/guide/data-source.md`.
+
+  No behaviour changes for a block that carries no `dataSource`: the binding-free
+  path returns the schema by reference, so nothing remounts and nothing refetches.
+
+- ab3ad4f: An empty predicate is no longer a declared gate anywhere (objectui#3850, objectui#3862)
+
+  "Is a gate DECLARED on this key — is there a condition to reach a verdict on?" was
+  answered three times in this repo, with three different scopes, and the widest
+  answers sat on `disabled`, where the mistake is not benign:
+
+  - `hasDeclaredVisibilityGate` (the action face) asked `!= null && !== ''`, so every
+    OBJECT counted — including `{ dialect: 'cel', source: '' }`. That envelope is not
+    a hand-written curiosity: `@objectstack/spec`'s `ExpressionInputSchema` normalizes
+    every authored predicate into one, so "the author left the predicate empty"
+    compiles to exactly it. The verdict path normalized the same value back to
+    `undefined`, and `evaluateCondition(undefined)` answers `true` — "no condition, so
+    visible/enabled". On `visible` that `true` means SHOW, so the two mistakes
+    cancelled; on `disabled` it means GREY, so they compounded: a button disabled
+    forever that no author asked to disable (objectui#3850, the residue objectui#3842
+    left behind).
+  - `SchemaRenderer` asked `disabled !== undefined` inline, one notch wider again, so
+    `disabled: null` greyed out too — on the GENERIC rendering path, since that block
+    runs for every node type, and not as an internal flag either: `_disabled` is
+    forwarded to the component as a real `disabled` prop (objectui#3862).
+  - `ActionRunner`'s execution gates asked "does this normalize to something
+    evaluable?" — the scope that turned out to be right (objectui#3848 / objectui#3872).
+
+  There is now ONE definition, `hasDeclaredPredicate`, exported from
+  `@object-ui/core` (`evaluator/declaredPredicate.ts`, beside the `toPredicateInput`
+  normalizer it is derived from): a gate is declared when normalization still leaves a
+  condition to evaluate. `''`, a whitespace-only string, an empty-`source` envelope
+  and any non-predicate value (`0`, `{}`) are NOT declared; `false` IS (a verdict is
+  not a missing gate — objectui#3812). `hasDeclaredVisibilityGate` keeps its name as a
+  re-export of it, so the five member-action renderer call sites, `DeclaredActionsBar`
+  and `record-quick-actions` are unchanged and inherit the scope;
+  `SchemaRenderer`'s `disabled` / `disabledOn` chain and `ActionRunner`'s two gates
+  read the same function. No consumer got a local "and also check for empty" test —
+  that fourth dialect is what objectui#3842 / objectui#3849 spent two PRs merging away.
+
+  Measured behaviour change, `action:button` and the generic path, before → after:
+
+  | value                                                     | `visible`      | `disabled` | `enabled` | `SchemaRenderer` `disabled` prop |
+  | --------------------------------------------------------- | -------------- | ---------- | --------- | -------------------------------- |
+  | `''`                                                      | shown → shown  | on → on    | on → on   | forwarded → absent               |
+  | `null`                                                    | shown → shown  | on → on    | on → on   | forwarded → absent               |
+  | `{ dialect: 'cel', source: '' }`                          | shown → shown  | GREY → on  | on → on   | forwarded → absent               |
+  | `{ source: '' }`                                          | shown → shown  | GREY → on  | on → on   | forwarded → absent               |
+  | `'   '` (whitespace)                                      | HIDDEN → shown | on → on    | GREY → on | forwarded → absent               |
+  | `0` / `{}` (not predicates)                               | shown → shown  | GREY → on  | on → on   | forwarded → absent               |
+  | `true` / `false` / bare CEL / `${…}` / non-empty envelope | unchanged      | unchanged  | unchanged | unchanged                        |
+
+  Every row moves toward "there is no gate here", never away from it, and no value
+  that HAS a verdict changes it — the verdict is still read from the raw value, only
+  the gate in front of it narrowed. Two rows are behaviour changes rather than the
+  equivalence the ruling expected, and are pinned as such: the whitespace string moves
+  on `visible` / `enabled` (it used to normalize to `'${   }'`, which evaluates falsy,
+  so a predicate that says nothing HID the action from everyone), and non-predicate
+  junk stops greying controls out (fail-open, the posture `ActionRunner` already
+  committed to).
+
+  One blank spelling is knowingly still outside the scope: an envelope whose `source`
+  is blank but not EMPTY (`{ dialect: 'cel', source: '   ' }`) — the normalizer folds a
+  `source` of `''` and does not trim, so the string spelling of a blank predicate is
+  trimmed and the envelope spelling is not, and `disabled` still greys out for that one
+  value. The ruling enumerated three empty spellings; this is a fourth, measured and
+  filed as objectui#3960 rather than widened in here.
+
+  One chain is deliberately untouched: `SchemaRenderer`'s `visible` / `visibleWhen` /
+  `visibleOn` / `visibility` / `hidden` / `hiddenOn` legs keep `!== undefined`, because
+  narrowing them would change ALIAS PRECEDENCE, not just emptiness. The `hidden` legs
+  are not negated and therefore carry this same defect with the polarity that makes the
+  node vanish — measured, out of this ruling's scope, filed as objectui#3955.
+
+- c2fd122: fix(actions): forward `bodyShape` end-to-end so a declared body wrap is honoured
+
+  Sibling of the `bodyExtra` fix, same failure shape one key over. `bodyShape` is
+  the spec's body-WRAPPING declaration for a `type: 'api'` action — `'flat'` (the
+  default) or `{ wrap: key }` to nest the collected params under `key`, the shape
+  better-auth's `organization/update` needs. The console `apiHandler` read it
+  unconditionally while **no** action renderer forwarded it, so an author who
+  declared `bodyShape: { wrap: 'data' }` on an `action:button` / `:group` / `:icon`
+  / `:menu` action got a FLAT body on the wire: the endpoint received the params at
+  the top level, and the declaration read as honoured because it parsed and
+  published.
+
+  The four declared-action renderers now forward the key, and `ActionSchema`
+  declares it (typed by derivation from the spec, so the union cannot drift).
+  `ActionRunner.executeAPI` — the fallback path taken when no host registered an
+  `api` handler — now reads it too, closing a second asymmetry in which the same
+  action changed body shape depending on which host executed it. The wrap covers
+  the collected params only; `bodyExtra` and other top-level keys stay flat, which
+  is the spec's own wording for the key and what both console read-sites already
+  did.
+
+  `element:button` deliberately does **not** forward it: its whitelist mirrors
+  spec's `InlineActionSchema` pick list field for field, and that pick list does
+  not include `bodyShape` — it is not inline vocabulary.
+
+- e24d767: Record page header action predicates now speak CEL, like every other action surface
+
+  `visible` / `hidden` / `disabled` on a `page:header` action were handed to
+  ObjectUI's legacy JS evaluator, while the row kebab, the selection bar and
+  conditional formatting have evaluated the identical metadata on the canonical
+  CEL engine since objectui#1584 / ADR-0058. Every construct that exists only in
+  CEL therefore worked in a list row and threw on the record page — where the
+  throw fail-closed hid the button, leaving nothing on screen to notice:
+
+  - method calls — `record.f_tags.size() > 0`, `record.f_textarea.contains("x")`
+  - the `in` operator — `'"red" in record.f_multiselect'` (a parse error)
+  - stdlib functions — `record.f_date < today()` (`today is not a function`)
+
+  Both header evaluation sites now go through `evalRowPredicate`: the same entry,
+  the same bindings (`record.*` + bare field names + `data.*` + the host scope,
+  with relations bound as the stored foreign key), and the same fail-closed +
+  warn-once semantics as the row surfaces. One predicate on one record now reaches
+  the same show/hide verdict in the row menu, the selection bar and the record
+  header.
+
+  Legacy-dialect strings are unaffected: `${…}`, `===`/`!==`, `?.`, `??` and
+  JS-only methods such as `.includes()` still route to the legacy evaluator (with
+  its existing one-time deprecation warning), so authored pages keep working. A
+  `${…}` template predicate, which the header previously could not evaluate at
+  all, now resolves through that fallback instead of hiding the button. A
+  predicate that genuinely cannot be evaluated still hides its action, and now
+  reports itself once in the same words the other surfaces use, naming the
+  surface, the action and the predicate.
+
+- aca561a: Four spec keys the renderers already honoured are now discoverable from the published `inputs`
+
+  `record:details.hideFields`, `record:related_list.relationshipValueField`,
+  `record:related_list.add` and `element:text_input.defaultValue` were declared by
+  `@objectstack/spec` and read by their renderers, while the registry `inputs` —
+  the surface `gen-manifest.ts` serializes into `sdui.manifest.json` and
+  `sdui-intrinsics.d.ts` — never mentioned them. Nothing anywhere reported the
+  mismatch, and every layer that reads a manifest said the opposite of the
+  runtime: the keys were in no designer panel and no generated `.d.ts`,
+  `sdui-parser`'s prop walk returned `unknown-prop` for an author who wrote one,
+  and the renderer honoured it regardless. That is objectui#3407's original
+  complaint (`readonly` was enforced and honoured, the description just never said
+  so) on four more keys.
+
+  Each description is derived from what the renderer actually does, not from
+  restating the spec's one-liner, because the two can differ and the published
+  text is what an AI author reads:
+
+  - `hideFields` documents bare field names only — the renderer tolerates
+    `{name}` / `{field}` entries but the spec is `z.array(z.string())` and rejects
+    them, so teaching that spelling would publish a dialect the contract refuses;
+  - `relationshipValueField` publishes the renderer's `'id'` default and says that
+    the resolved value drives the list filter, the Add-picker link value and the
+    pre-filled create form together;
+  - `add` publishes its member shape in prose (`ComponentInput` is flat and has no
+    member-shape slot) with each default taken from the renderer — including
+    `picker.labelField`, where the renderer defaults to `name` while the spec's
+    own wording says "the object title field". It also names `picker.filter` as a
+    KNOWN GAP rather than documenting it as a restriction: the spec declares it
+    and nothing reads it, so an author would otherwise believe their picker is
+    scoped when it offers every record (objectui#3831);
+  - `defaultValue` distinguishes the two behaviours an author can get — seeding a
+    bound page variable once while it is still empty, versus the native
+    uncontrolled initial value with no variable bound.
+
+  `element:text_input` is not in the public tier, so its gap was not in
+  `sdui.manifest.json` at all — it was in the JSX-page compiler's prop whitelist,
+  which `renderers/layout/page.tsx` builds from `getKnownTypes()` plus these same
+  `inputs`, making the undeclared `defaultValue` a live `unknown-prop` warning.
+
+  The repo-wide parity gate now runs in both directions over one covered set and
+  one exemption discipline, so neither direction can be forgotten again the way
+  the reverse half was after PR #3806. Nine spec keys stay deliberately
+  unpublished, each with a written reason and a tracking issue: two the renderers
+  do not read at all (objectui#3829), three retired upstream by ADR-0087
+  tombstones, `page:tabs.type` (a carrier collision, objectstack#6776), two
+  `targetVariable` declarative hints (objectui#3834), and
+  `element:record_picker.filter` (objectui#3830).
+
+- 0ef9dfd: `page:card` publishes `children` instead of the retired `body`, and `page:section` / `page:footer` / `page:sidebar` publish the `children` slot they render
+
+  `inputs` is the published authoring surface, not documentation: the Studio block
+  designer builds its panel from it, `sdui-parser`'s `gen-manifest.ts` serializes
+  it into `sdui.manifest.json` and `sdui-intrinsics.d.ts`, and the JSX-page
+  compiler builds its prop whitelist from it. Two of the `page:*` containers had
+  drifted from the contract in opposite directions.
+
+  `page:card` published `{ name: 'body', type: 'slot' }`. `@objectstack/spec`
+  retired `PageCardProps.body` in objectstack#5775 (PR objectstack#6281, merged
+  2026-08-07, ADR-0087 D2) and declared `children` in its place — one composition
+  slot with one spelling, the same one `grid`, `flex`, `page:section` and
+  `page:tabs` items already use. The designer was teaching a key the contract now
+  rejects by name.
+
+  `page:section`, `page:footer` and `page:sidebar` declared no `inputs` at all, so
+  the designer could not authorize the child list those three components exist to
+  render. The same upstream PR replaced their `EmptyProps` declaration with the
+  shared `PageContainerProps`, whose single key is `children`; all three now
+  publish that one slot from one shared literal, mirroring the spec's own single
+  definition.
+
+  Rendering is unchanged in both directions. `PageCardRenderer` still READS `body`
+  first (`schema?.body ?? schema?.children`) and the three thin containers still
+  read `schema?.children || schema?.body`, so documents stored under the old
+  contract keep rendering until the ADR-0087 D2 conversion rewrites the key at
+  load time — a back-compat read is not a second authorable spelling, the same
+  split the `page-header-subtitle-alias` sequencing established. No validation
+  verdict moves either: `children` is already in `sdui-parser`'s `BASE_PROPS` (so
+  it was never an `unknown-prop`), `isContainer: true` was already set on all
+  four, and `codegen.ts` filters `slot` inputs out of the generated `.d.ts` where
+  `SduiBaseProps.children` types it.
+
+  What changes for an author is the designer surface: `body` is no longer offered
+  on `page:card`, `children` is, and the three thin containers gained an
+  authorable content slot.
+
+- 7e5bb5d: fix(actions): forward `bodyExtra` end-to-end through the action chain
+
+  An action's static request body (`bodyExtra`) was dropped one hop before the
+  `ActionRunner`: every action renderer forwards an explicit whitelist of keys, and
+  none of them listed `bodyExtra`. Since `@objectstack/spec` 17 made it the only way
+  a `type: 'api'` action can carry a payload (`params` keeps its single meaning as
+  the parameter definition array), and the ADR-0087
+  `inline-action-api-params-to-body-extra` conversion rewrites older object-form
+  `params` pages onto it at load, a previously-working published page validated,
+  published and then POSTed an empty body.
+
+  `element:button`, `action:button`, `action:group`, `action:icon` and `action:menu`
+  now forward the key; `ActionRunner.executeAPI` merges it into the request body
+  **last** (so a constant always overrides a same-named user param, matching the
+  console `apiHandler`); `ActionSchema` declares it; and a non-array `params` on a
+  `type: 'api'` action keeps working for one version window with a dev-mode
+  deprecation warning naming `bodyExtra`.
+
+- 54233b1: Record detail pages: a header ⟳ that refreshes the record, its related lists and its tab counts in place — no browser reload
+
+  Concurrent-editing scenario from the shop floor (MES work orders): operator A sits on a record's detail page while operator B starts or reports the same order. A had no way to see the new state except F5, which throws away the open tab, the scroll position and any in-progress inline edit along with the stale data.
+
+  The pipeline for this already existed — the objectui#2269 invalidation bus refetches every mounted reader in place, and `RecordContext.refresh` had been declared for it — but nothing produced that field and no UI reached for it. Three changes give it a trigger:
+
+  - **`RecordDetailView` produces `RecordContext.refresh`**, publishing `notifyDataChanged({ objectName: '*' })`. The wildcard is deliberate: a user reaches for refresh because of a write made by SOMEONE ELSE, which this client never saw and therefore cannot attribute to particular objects. `'*'` marks everything mounted as stale, so the main record, every related child list and the tab-count badges all refetch — no remount, so tab / scroll / draft state survive. First phase covers the standalone record route; embedded hosts (list drawer, split-pane preview) keep their existing chrome unchanged.
+  - **`page:header` renders the ⟳** at the far end of the header row when — and only when — the host provides `refresh`. It is page chrome rather than a header action, so its position is the same on every record page regardless of which business actions the object declares, and it can never be collapsed into the `⋯` overflow. Styled as that `⋯` trigger's twin so the row reads as one button family. Its accessible name and tooltip come from the existing `common.refresh` key, so the icon-only button is not English-only in the other nine locales. The icon spins for a short floor after a click, because the bus is fire-and-forget and a warm backend would otherwise finish before the click looked like it landed.
+  - **`RelatedList` accepts the `'*'` wildcard** on the legacy `objectui:related-changed` event, matching what `dataChangeMatches` already does for the bus's own readers. This listener compared the payload's object name to its own, so a wildcard invalidation reached everything on the page except the related lists — a concrete foreign object name is still ignored.
+
+  Hosts that provide no `refresh` render exactly as before.
+
+- 97b63d7: Row actions declaring `visible: false` are now hidden instead of rendered
+
+  A custom row action's visibility **gate** was detected by truthiness, so
+  `visible: false` — the most explicit way an author can say "never show this" —
+  fell into the "no gate declared" branch and the action rendered for every row.
+  Both surfaces of the ObjectGrid row cell (the "⋮" overflow item and the inline
+  `variant:'primary'` button) and the data-table's row overflow menu read the same
+  gate, so all three rendered it; the `#3562` emptiness guard counts with that same
+  gate, so a row whose only action was `visible: false` also grew a "⋮" it could
+  not fill.
+
+  The gate now detects a **declared** gate by `!= null && !== ''` and lets the
+  declaration itself decide — a boolean short-circuits to its own verdict rather
+  than being handed to the CEL engine. This is the invariant objectui#3492 already
+  established for the selection bar, whose `hasVisibilityGate` spells out why
+  truthiness cannot answer the question, and the same `!= null` posture the
+  built-in `visibleWhen` gate has always had. `visible: true` still renders,
+  `''` and an absent `visible` are still no gate at all, and no expression-valued
+  `visible` changes verdict.
+
+  Behaviour change surface, deliberately narrow: only an action whose `visible` is
+  the literal boolean `false` (or another falsy non-empty value) changes — it goes
+  from rendered to hidden, which is what the declaration asked for.
+  `ActionSchema.visible` is `ExpressionInputSchema` with no boolean member, so
+  `objectstack build` cannot emit this shape; hand-written view JSON and
+  in-process callers constructing defs can, and did. The three row surfaces now
+  reach the same verdict as the selection bar and the record page header for every
+  non-expression shape, which `predicate-surface-parity` pins.
+
+- Updated dependencies [8aad9fd]
+- Updated dependencies [6719877]
+- Updated dependencies [56ff091]
+- Updated dependencies [7864f03]
+- Updated dependencies [d229dfa]
+- Updated dependencies [4bc6c23]
+- Updated dependencies [c3b01a7]
+- Updated dependencies [f5f8744]
+- Updated dependencies [69becd2]
+- Updated dependencies [5e52495]
+- Updated dependencies [b750823]
+- Updated dependencies [5bfaabd]
+- Updated dependencies [e06810e]
+- Updated dependencies [ab3ad4f]
+- Updated dependencies [c2fd122]
+- Updated dependencies [ac2139c]
+- Updated dependencies [b14ab3a]
+- Updated dependencies [8c60819]
+- Updated dependencies [e64a52e]
+- Updated dependencies [844d17f]
+- Updated dependencies [48132f7]
+- Updated dependencies [4dcd52a]
+- Updated dependencies [42ae5c6]
+- Updated dependencies [1d723e3]
+- Updated dependencies [0109f54]
+- Updated dependencies [7e5bb5d]
+- Updated dependencies [fbc23e0]
+- Updated dependencies [6d762da]
+- Updated dependencies [d11996e]
+- Updated dependencies [e6fdbdc]
+- Updated dependencies [f9faa7d]
+- Updated dependencies [6bb454a]
+- Updated dependencies [523be48]
+- Updated dependencies [7e2b7e9]
+- Updated dependencies [33526fd]
+- Updated dependencies [32413ec]
+- Updated dependencies [c1e1e6b]
+  - @object-ui/react@17.4.0
+  - @object-ui/core@17.4.0
+  - @object-ui/i18n@17.4.0
+  - @object-ui/types@17.4.0
+  - @object-ui/react-runtime@17.4.0
+  - @object-ui/sdui-parser@17.4.0
+
 ## 17.3.0
 
 ### Minor Changes
@@ -159,6 +876,7 @@ props}` _alongside_ `field`. The predictable result was ~30 widgets resolving
   compile time rather than work under one host and not another.
 
   ## What did NOT change
+
   - **Host metadata (SDUI JSON) is untouched.** No authored schema changes; this is
     a change to how widgets are _written_, not to what apps declare.
   - **`schema` is still the universal SDUI prop** every registered component
@@ -210,6 +928,7 @@ props}` _alongside_ `field`. The predictable result was ~30 widgets resolving
     the flip where a name cannot.
 
   ## What changed
+
   - Every field control — built-in (`input` / `textarea` / `checkbox` / `switch` /
     `select`) and registered widget alike — now receives `aria-required="true"`
     when the field resolves required, and **no attribute at all** when it does
@@ -253,7 +972,7 @@ AriaAttributes`) and every widget forwards its leftover props to the control it
   half-translated in a way a user could see inside one widget: the dependency-gate
   sentence next to it already went through `t()`
   (`fields.options.selectFirst`), so under a `zh` session a gated select read
-  "请先选择Country" and the same select — one keystroke later, when the parent
+  "请先选择 Country" and the same select — one keystroke later, when the parent
   value matched no option — flipped to English.
 
   `fields.options.empty` is added to `useSafeFormTranslation`'s defaults map, the
@@ -357,6 +1076,7 @@ AriaAttributes`) and every widget forwards its leftover props to the control it
   - 展开按钮的无障碍名永远插值通用名词，一张有三个长文本字段的表单上三个按钮读屏完全一样。读屏用户无法判断自己要展开的是哪个字段，这是可达性缺陷而不是观感问题。
 
   ## 改了什么
+
   - 调用点显式转发 `label`（与 `placeholder` / `emptyHint` 同法），这是唯一的行为改动。
   - `label` 属于 renderer-only：`stripRendererOnlyProps` 与 `stripRegisteredFieldProps` 各加一条丢弃项，所以它既不会变成 DOM 上的 `label="备注"` 杂属性（每个内置分支都会把剩余 props 直接摊到 DOM 节点上），也不会成为注册型 widget 新收到的 prop——自 v17 起 `field` 是它们唯一的元数据载体（objectui#3233），label 一直在那里读。
   - 内置 `textarea` 分支里那句 `const { label: _label, ...rest }` 随之删除。它本想拦住 label 落到 DOM，但既然从来没有 label 送进来，它拦的是不存在的东西（ESLint 一直报着 `'_label' is assigned a value but never used`），而且只护住了这一个分支。现在这件事由 strip 统一负责，所有分支同等受护。
@@ -2659,6 +3379,7 @@ overflow-auto` region (bottom on-screen, within the viewport) and the table can
   objects+fields were editable in Studio; this reworks both surfaces.
 
   **Setup (assign + read-only):**
+
   - The six facets (`object_permissions`, `field_permissions`, `system_permissions`,
     `row_level_security`, `tab_permissions`, `admin_scope`) now render read-only on
     the `sys_permission_set` record page as a compact summary (counts, or capability
@@ -2673,6 +3394,7 @@ overflow-auto` region (bottom on-screen, within the viewport) and the table can
 
   **Studio (design every facet):** the permission matrix editor gains structured
   editors for the facets that were JSON-only —
+
   - **System Capabilities**: a multi-select over the live `sys_capability` registry
     (scope-grouped, labelled chips).
   - **Row-Level Security**: per-policy rows (object · operation · enabled) with CEL
@@ -3409,6 +4131,7 @@ overflow-auto` region (bottom on-screen, within the viewport) and the table can
   platform primitive for "no records / no data" states. Two new props
   keep it flexible enough to absorb the hand-rolled variants that lived
   in `plugin-list`, `plugin-kanban`, and `plugin-dashboard`:
+
   - `showIcon?: boolean` — drops the icon container entirely. Used by the
     kanban board-level empty banner, which is a status banner rather than
     a true empty-state.
@@ -3417,6 +4140,7 @@ overflow-auto` region (bottom on-screen, within the viewport) and the table can
     empty state, which uses a large standalone glyph).
 
   Adopters:
+
   - `plugin-list` (`ListView` grid empty-state) — preserves the existing
     large icon, title, message, add-record button and `data-testid`s,
     but delegates the structural markup to `DataEmptyState`.
@@ -3479,6 +4203,7 @@ overflow-auto` region (bottom on-screen, within the viewport) and the table can
   The renderer now passes `schema.action` through `SchemaRenderer` to turn it
   into a real React element, and explicitly strips `action`/`icon` from the
   spread so schema-shaped objects don't reach DOM attributes.
+
   - @object-ui/types@5.1.1
   - @object-ui/core@5.1.1
   - @object-ui/i18n@5.1.1
@@ -3501,17 +4226,20 @@ overflow-auto` region (bottom on-screen, within the viewport) and the table can
 - bd8447d: Three platform-wide detail polish items.
 
   **Tighter page rhythm**
+
   - Outer `PageRenderer` padding `p-4 md:p-6 lg:p-8` → `p-3 md:p-4 lg:p-6`
     and outer body wrap `space-y-8` → `space-y-6` so list / detail / home
     pages share the same edge rhythm. Cuts ~16px of edge slack on lg.
 
   **Highlights KPI treatment**
+
   - `HeaderHighlight` now renders numeric / currency / percent / decimal
     values as KPI numbers (`text-xl md:text-2xl font-semibold tabular-nums`)
     instead of the uniform `text-sm font-semibold`, so amount / probability
     / count fields read as headline stats — Salesforce-style key facts.
 
   **Discussion footer upgrade**
+
   - `RecordActivityTimeline` now uses `RichTextCommentInput` (bold / italic /
     list / code, `@`-mention autocomplete, preview toggle, Send) instead of
     a bare `<textarea>`.
@@ -3526,6 +4254,7 @@ overflow-auto` region (bottom on-screen, within the viewport) and the table can
   accordion in flush mode dropped all per-item borders so the collapsed
   "Quotes / Products / Open Tasks" triggers stacked with zero visual
   separation.
+
   - `@object-ui/plugin-detail` `DetailSection`: override the `CardTitle`
     className to `text-base font-semibold tracking-tight`, slim down
     `CardHeader` padding (`py-3 px-4 sm:py-4 sm:px-6`) and `CardContent`
@@ -3540,6 +4269,7 @@ hover:no-underline` (Shadcn's hover-underline default looks busy on
     CRM-style related-list lists).
 
 - d51a577: feat(platform): Discussion attachments + @mention directory + Reference Rail aside
+
   - **Discussion attachments** — `RichTextCommentInput` now accepts an `extraSlot`
     and a `canSubmitEmpty` flag so hosts can mount the existing
     `CommentAttachment` composer beneath the editor without forking the toolbar.
@@ -3559,6 +4289,7 @@ hover:no-underline` (Shadcn's hover-underline default looks busy on
 - d1ec6a2: Fold inline-edit into the page-header overflow menu (HubSpot/Lightning
   pattern) and remove the orphan "Edit fields" toolbar row that previously
   floated between the tab strip and the first detail section.
+
   - `@object-ui/app-shell` `RecordDetailView`: injects a new `sys_inline_edit`
     system action that appears in the ⋯ overflow menu and dispatches a
     `objectui:record:inline-edit-toggle` window CustomEvent (filtered by
@@ -3575,6 +4306,7 @@ hover:no-underline` (Shadcn's hover-underline default looks busy on
     in `page:accordion` / `page:tabs` items.
 
 - d548d6b: Unify empty-state visuals across timeline + registered `empty` renderer.
+
   - `RecordActivityTimeline` and `ActivityTimeline` now use `DataEmptyState`
     instead of a bare `<p>` so empty timelines match list/related-list visuals
     (muted icon badge + centered copy).
@@ -3625,6 +4357,7 @@ hover:no-underline` (Shadcn's hover-underline default looks busy on
   not only contacts of that account).
 
   Two coupled fixes:
+
   1. `RelatedList` now requires `parentId` + `referenceField` to auto-
      fetch. When both are present it calls `dataSource.find(api,
 { $filter: { [referenceField]: parentId } })`. When either is
@@ -3653,6 +4386,7 @@ hover:no-underline` (Shadcn's hover-underline default looks busy on
   default detail view. They were missing cross-cutting affordances and
   shipped with English-only tab labels and heavy bordered section cards
   even when the host locale was Chinese. Track 1 closes the visible gap:
+
   - **app-shell `RecordDetailView`**: the `assignedPage` branch now wears
     the same chrome as the default branch — lifecycle managed-by badge
     and presence avatars in the top-right, `MetadataPanel` debug panel,
@@ -3681,6 +4415,7 @@ hover:no-underline` (Shadcn's hover-underline default looks busy on
   record detail page (lead, opportunity, future account/contact/case).
   Before this change it had two problems that bled into every custom
   page across the product:
+
   1. **Quadruple registration**: `@object-ui/layout` registered both
      `page-header` and `page:header`, and `@object-ui/components`
      independently registered `page:header` (and `page:section`).
@@ -3691,6 +4426,7 @@ hover:no-underline` (Shadcn's hover-underline default looks busy on
      than the default detail view it was meant to supersede.
 
   This commit:
+
   - Removes the `@object-ui/layout` `page:header` registration. The
     layout package keeps the legacy kebab-cased `page-header` alias only.
     The canonical renderer now lives in `@object-ui/components` and is
@@ -3716,6 +4452,7 @@ hover:no-underline` (Shadcn's hover-underline default looks busy on
   opportunity highlights strip looks coherent with the chip above it.
 
 - ddb08a7: feat(page:header,page:tabs): title fallback + single-tab strip auto-hide (Phase G slice 3 polish)
+
   - `page:header.resolvedTitle` now honors `objectSchema.titleFormat`
     (e.g. `{first_name} {last_name}`) and falls back through `name →
 full_name → title → subject → display_name → label` before degrading
@@ -3762,6 +4499,7 @@ full_name → title → subject → display_name → label` before degrading
   muted badge on every empty Activity/History tab).
 
 - b14fe09: Phase P.0 + P.5: tighten record-detail header chrome.
+
   - `RecordTitleChip` collapses the title row to a single baseline-aligned line — H1, eyebrow object label, copy-id, favorite star — instead of the previous two-row title + subtitle layout.
   - `record:details` extends the highlight-field dedup set to also exclude the title field resolved from `objectSchema.primaryField` (or the standard `name`/`full_name`/`title`/`subject`/`display_name`/`label` fallbacks). Removes the duplicate row that previously echoed the H1 (e.g. "客户名称: Acme Corporation") inside the field grid.
 
@@ -3778,6 +4516,7 @@ full_name → title → subject → display_name → label` before degrading
   underline when active. 'card' and 'pill' variants are unchanged.
 
 - 74962b0: feat(detail): record:discussion schema component + flush accordion variant
+
   - New `record:discussion` schema type lets authors place the record
     chatter feed anywhere in a custom Page schema. Wired through a
     shared `DiscussionContext` provider on the `assignedPage` branch
@@ -3804,6 +4543,7 @@ full_name → title → subject → display_name → label` before degrading
   accordion, discussion slot) that custom Lightning pages already enjoy.
 
   Changes:
+
   - `buildDefaultPageSchema` now emits `page:tabs.items` (correct shape
     for the renderer) rather than `tabs`.
   - `PageHeaderRenderer.resolvedTitle` honors `objectSchema.primaryField`
@@ -3917,6 +4657,7 @@ full_name → title → subject → display_name → label` before degrading
   For every tab item whose `count` is not set explicitly, the renderer walks the tab's children (depth-first) to find the first `record:related_list` schema node and issues a `limit:1` find through the active `dataSource` to read the matching `total`. The badge appears in the tab strip without spec authors having to wire counts manually.
 
   Behavior:
+
   - Explicit `count` in the spec always wins.
   - Probe is filtered by the parent record id via `relationshipField` when present (skipped until the parent record is loaded).
   - Best-effort: a failed probe just omits the badge — no error surface.
@@ -3957,6 +4698,7 @@ full_name → title → subject → display_name → label` before degrading
 ### Patch Changes
 
 - 6b683c8: fix(detail): clean up record page rendering
+
   - Drop `ai:chat_window` from the protocol-component placeholder list. The
     floating chat overlay (plugin-chatbot) is the canonical AI entry point;
     inline page schemas that still reference `ai:chat_window` now surface
@@ -3984,6 +4726,7 @@ full_name → title → subject → display_name → label` before degrading
   The report configuration panel is now safe to open on any spec-shape `Report` and only exposes fields that are actually persisted by `@objectstack/spec`.
 
   `@object-ui/plugin-report`:
+
   - Add a bidirectional `SpecFilterAdapter` so `ReportConfigPanel` can edit
     spec `FilterCondition` filters (`{field: value}`, `{field: {$op: value}}`,
     top-level `$and`/`$or`). Complex / nested filters fall back to a
@@ -4005,15 +4748,18 @@ full_name → title → subject → display_name → label` before degrading
   - 18 new unit tests cover the filter adapter round-trip.
 
   `@object-ui/components`:
+
   - `FilterBuilder` now guards against malformed external `value` props.
     Previously a spec-shape filter (`{is_active: true}`) would crash the
     component on first render; the builder now falls back to an empty
     AND group whenever `value` is not a valid `FilterGroup`.
 
   `@object-ui/i18n`:
+
   - Add `report.editor.*` strings to `en` and `zh`.
 
 - 8442c05: Improve report editor panel usability based on real-user browser testing:
+
   - **Wider config panel** — the report editor now defaults to a `--config-panel-width`
     of 440px (up from 280px), driven by a new optional `style` prop on
     `ConfigPanelRenderer`. Long field labels, report titles, type labels, and filter
@@ -4136,6 +4882,7 @@ full_name → title → subject → display_name → label` before degrading
   detail view (`TypeError: titleFormat.replace is not a function`) and printed
   `Failed to evaluate expression: ${[object Object]}` for every action visibility
   predicate.
+
   - `@object-ui/core`: `ExpressionEvaluator.evaluate` / `evaluateCondition` now
     unwrap Expression envelopes transparently.
   - `@object-ui/react`: new `toPredicateInput()` helper to safely normalize
@@ -4218,6 +4965,7 @@ full_name → title → subject → display_name → label` before degrading
   plugin-designer, plugin-detail, plugin-editor, plugin-form, plugin-gantt,
   plugin-grid, plugin-kanban, plugin-list, plugin-map, plugin-markdown,
   plugin-report, plugin-timeline, plugin-view, plugin-workflow.
+
   - @object-ui/types@4.0.5
   - @object-ui/core@4.0.5
   - @object-ui/i18n@4.0.5
@@ -4232,6 +4980,7 @@ full_name → title → subject → display_name → label` before degrading
   Library builds (vite lib mode) now externalize every non-relative import instead of bundling third-party CJS dependencies into the published dist. This avoids inlined `require("react")` / `require("react-dom")` calls that cause `Calling \`require\` for "react" in an environment that doesn't expose the \`require\` function` runtime errors when consumer apps re-bundle the published dist.
 
   Specifically fixes:
+
   - `@object-ui/plugin-dashboard` no longer inlines `react-grid-layout` (and its transitive `react-draggable` / `react-resizable` CJS bundles). `react-grid-layout` is now declared as a peer dependency so consumers install a single ESM-friendly copy.
   - `@object-ui/components`, `@object-ui/plugin-calendar`, `@object-ui/plugin-charts`, `@object-ui/plugin-designer` no longer inline `react-i18next` / `i18next` / `use-sync-external-store` CJS shims.
   - All plugin packages now use a unified `external: (id) => !/^[./]/.test(id) && !id.startsWith(__dirname)` rule, ensuring future additions of CJS deps are automatically externalized.
@@ -4288,6 +5037,7 @@ full_name → title → subject → display_name → label` before degrading
   contract through the renderer end-to-end:
 
   **`@object-ui/types`** — `DataSource` gains four optional methods:
+
   - `createExportJob(resource, request)` → `{ jobId, status, estimatedRecords, createdAt }`
   - `getExportJobProgress(jobId)` → `{ status, processedRecords, totalRecords, percentComplete, downloadUrl, … }`
   - `cancelExportJob(jobId)` (optional)
@@ -4297,6 +5047,7 @@ full_name → title → subject → display_name → label` before degrading
   remain dependency-free.
 
   **`@object-ui/components`** — new public API:
+
   - `useExportJob({ dataSource, pollIntervalMs, onComplete, onError })` — owns the
     full polling loop, terminal-state handling, cancel, and download.
   - `<ExportProgressDialog open onOpenChange job filename closeAfterDownloadMs />` —
@@ -4315,24 +5066,29 @@ full_name → title → subject → display_name → label` before degrading
 - a2d7023: End-user feature batch — forms, designer history, import/export, and PWA offline sync.
 
   **Forms (`@object-ui/fields`, `@object-ui/providers`)**
+
   - `FileField`: native `<input capture="environment">` camera capture for mobile devices, plus a uploading-progress indicator driven by `UploadProvider`.
   - `ImageField`: per-image inline crop/rotate via the lazy-loaded `ImageCropperDialog` (canvas-based, zero new deps).
   - New `UploadProvider` in `@object-ui/providers` with pluggable adapters for S3 and Azure Blob (plus the default object-URL adapter for local previews). XHR-based with progress, abort, and retry.
   - `LookupField`: `lookup.dependsOn: string | string[]` to chain dependent lookups (e.g. State depends on Country); the trigger is gated until parent values are present and the OData `$filter` is built automatically.
 
   **Container-aware widget widths (`@object-ui/components`)**
+
   - New `useResizeObserver(ref)` hook exposing `{ width, height }` of any element. SSR-safe; reads the initial size via `getBoundingClientRect`.
   - `plugin-gantt` and `plugin-kanban` now react to their container size instead of `window.innerWidth`, so they behave correctly inside split panels and dashboards.
 
   **Designer history (`@object-ui/plugin-designer`)**
+
   - `useUndoRedo` (and therefore `useDesignerHistory`) gains `persistKey` + `storage` options to round-trip the undo/redo stack through `sessionStorage`, plus a `clearPersisted()` cleanup helper. Drafts now survive accidental tab refreshes.
   - New `<HistoryPanel>` component renders the timeline visually with one-click jump-to-checkpoint via the new `jumpTo(index)` API.
 
   **Import wizard (`@object-ui/plugin-grid`)**
+
   - Saved column-mapping templates: name, save, re-apply, and delete via a new template bar in the mapping step. Persisted under `objectui:import-templates:${objectName}` (override via `templateStorageKey` / `templateStorage`).
   - Inline validation correction: cells with errors in the preview step are now editable; corrections feed straight into the import without requiring a re-upload, with green-bar status indicators for fixed rows.
 
   **PWA offline sync (`@object-ui/mobile`)**
+
   - New `MemoryOfflineQueue` / `IndexedDbOfflineQueue` (`createOfflineQueue()` picks the best backend) backed by IndexedDB.
   - `createOfflineDataSource(inner, { queue })` wraps any DataSource so mutations issued while offline (or that fail with a network-style error) are queued and replayed in order on reconnect. Includes `replay()`, `drop()`, `clear()`, `pending()`, an `onChange` notifier, and an opt-in `resolveConflict` hook for stale-write conflicts.
   - New `useOfflineSync(source)` hook exposes `{ isOnline, pending, isReplaying, replay, drop, clear }` and auto-replays on the browser's `online` event.
@@ -4360,11 +5116,13 @@ full_name → title → subject → display_name → label` before degrading
   `FormSchema.mobileStickyActions` (new) is the lower-level escape hatch — applied automatically when `mobile.stickyActions` is set on `ObjectFormSchema`.
 
   **`@object-ui/plugin-form`** — `ObjectForm` now:
+
   - propagates `mobile.fullscreenLongText` to every textarea/markdown/html field as `mobile_fullscreen: true`,
   - sets `mobileStickyActions` on the inner form schema and adds `pb-20` padding so content isn't covered by the fixed bar,
   - when `mobile.stepper === true` (or `'auto'` + `useIsMobile()` + > `stepperMinFields` fields), routes the flat field list through the existing `WizardForm` with synthetic single-field "steps" — keeping per-step validation and the existing `Next`/`Back`/`Submit` flow.
 
   **`@object-ui/components`** — the registered `form` renderer adds:
+
   - a `mobileStickyActions` opt-in that turns the action row into a `position: sticky; bottom: 0` bar on small viewports, and
   - an inline `FullscreenTextarea` wrapper used when no field-package widget is registered, providing the same expand-button + edit-dialog UX so the feature works even in lighter setups.
 
@@ -4403,6 +5161,7 @@ full_name → title → subject → display_name → label` before degrading
   `@object-ui/app-shell` and `@object-ui/components` have been updated to
   point at the new paths; no runtime behaviour changed. A new
   `examples/README.md` provides a "which example should I use?" selector.
+
   - @object-ui/types@3.3.1
   - @object-ui/core@3.3.1
   - @object-ui/i18n@3.3.1
@@ -4547,6 +5306,7 @@ full_name → title → subject → display_name → label` before degrading
 - New plugin-object and ObjectQL SDK updates
 
   **Added:**
+
   - New Plugin: @object-ui/plugin-object - ObjectQL plugin for automatic table and form generation
     - ObjectTable: Auto-generates tables from ObjectQL object schemas
     - ObjectForm: Auto-generates forms from ObjectQL object schemas with create/edit/view modes
@@ -4555,6 +5315,7 @@ full_name → title → subject → display_name → label` before degrading
   - ObjectQL Integration: Enhanced ObjectQLDataSource with getObjectSchema() method using MetadataApiClient
 
   **Changed:**
+
   - Updated @objectql/sdk from ^1.8.3 to ^1.9.1
   - Updated @objectql/types from ^1.8.3 to ^1.9.1
 
@@ -4570,6 +5331,7 @@ full_name → title → subject → display_name → label` before degrading
 - Patch release: Add automated changeset workflow and CI/CD improvements
 
   This release includes infrastructure improvements:
+
   - Added changeset-based version management
   - Enhanced CI/CD workflows with GitHub Actions
   - Improved documentation for contributing and releasing
diff --git a/packages/components/package.json b/packages/components/package.json
index 6079588292..16fcff4251 100644
--- a/packages/components/package.json
+++ b/packages/components/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/components",
-  "version": "17.3.0",
+  "version": "17.4.0",
   "type": "module",
   "license": "MIT",
   "description": "Standard UI component library for Object UI, built with Shadcn UI + Tailwind CSS",
diff --git a/packages/core/CHANGELOG.md b/packages/core/CHANGELOG.md
index be3c33cd11..06f062ea57 100644
--- a/packages/core/CHANGELOG.md
+++ b/packages/core/CHANGELOG.md
@@ -1,5 +1,659 @@
 # @object-ui/core
 
+## 17.4.0
+
+### Minor Changes
+
+- c3b01a7: Give composite and grouped field widgets a real accessible name: the form renderer now associates its label by IDREF for widgets that declare `labelling: 'group'`, instead of emitting a `<label for>` that nothing labelable answers (objectui#3961).
+
+  Six widgets rendered a visible group label that named **nothing** in the accessibility tree. Measured in a real form, one field per row, reading each label's `for` against the DOM:
+
+  ```
+  address      for=…-form-item -> MISSING            byLabelText=0   role+name=0
+  geolocation  for=…-form-item -> MISSING            byLabelText=0   role+name=0
+  checkboxes   for=…-form-item -> div                byLabelText=0   role+name=0
+  radio        for=…-form-item -> div[radiogroup]    byLabelText=0   role+name=0
+  rating       for=…-form-item -> div                byLabelText=0   role+name=0
+  file         for=…-form-item -> div[role=button]   byLabelText=0   role+name=0
+  ```
+
+  Two shapes, one outcome. `address` / `geolocation` spread the host's id onto their first sub-input and then replaced it with that input's own unique id (objectui#3343, correct in itself), so the `for` named an id no element carried — clicking "Shipping Address" did nothing and the group label was absent from the accessibility tree entirely. `checkboxes` / `radio` / `rating` / `file` kept the id, but on a `div`: a `<label for>` on a non-labelable element is inert HTML — `HTMLLabelElement.control` is `null`, so it activates nothing and contributes no name. A screen reader heard "Street Address", "City", "Alpha", "Beta" — never which group they belonged to.
+
+  The fix is the WAI-ARIA group pattern, driven by a DECLARATION rather than by the host guessing at widget DOM:
+
+  - `@object-ui/core` — `ComponentMeta` gains `labelling?: 'control' | 'group'`. Additive and optional; absent means `'control'`, which is every existing component's behaviour.
+  - `@object-ui/components` — the form renderer reads it. For a `'group'` field the `<FormLabel>` publishes an `id` and drops its `for`, and the widget receives `aria-labelledby`. The single-control path is unchanged down to the attribute: no id on the label, no `aria-labelledby` key on the widget, so no field acquires a second naming channel. `ui/form.tsx` is untouched (Shadcn no-touch) — both halves travel as ordinary props, since `<FormLabel>` spreads props after its own `htmlFor`.
+  - `@object-ui/fields` — the six audited widgets declare `labelling: 'group'`. `address` / `geolocation` move the host id (and only the id) from their first sub-input to the group container; `checkboxes` / `rating` answer a host-supplied `aria-labelledby` with `role="group"`; `radio` keeps Radix's more specific `radiogroup`; `file` takes the name on its dropzone with no invented group layer, because it has exactly one control that merely happens not to be labelable.
+
+  No new key in the widget props contract: `aria-*` is already declared on it and forwarded by `toDomProps`, the same channel `aria-required` (objectui#3290) travels.
+
+  Deliberately unchanged: sub-labels keep naming their own inputs (`aria-labelledby` overrides `<label for>`, so putting the group name on the first sub-input would have replaced "Street Address" with the field name — the concatenated-name outcome this issue rejected), `aria-describedby` stays on the first focusable sub-input where focus can reach it (objectui#3318), the sub-input ids of objectui#3343 do not move, and standalone rendering — the inline grid editor, a bare SDUI node, where nobody hands down an id and there is no host label to point at — emits no role and no IDREF at all.
+
+  A widget that does not declare itself keeps the old `for`, which the label-association tests report as an association resolving to a non-labelable element. Silence was the failure mode being fixed; the default path stays loud.
+
+- 48132f7: Track the `@objectstack` family at `17.0.0-rc.5` (objectui#3560).
+
+  The pin moves from `^17.0.0-rc.2` to `^17.0.0-rc.5` across all 37 declarations in
+  30 `package.json` files, and the sibling `@objectstack/*` packages (`client` /
+  `formula` / `lint`) move with it — they pin `@objectstack/spec` **exactly**, so
+  leaving them behind would keep a second copy of the spec in the tree and have
+  `@objectstack/lint` validating against schemas that still accept the keys rc.3–rc.5
+  retire. `pnpm-lock.yaml` now resolves one copy of each of the six family packages
+  (`spec` / `client` / `core` / `formula` / `lint` / `sdui-parser`), all at rc.5.
+
+  Bumping the pin and repairing the fallout cannot be split: the pin alone reddens
+  CI, and the code alone targets a shape that is not in effect yet.
+
+  ## A live bug this upgrade fixes
+
+  **`ObjectStackDataSource.delete()` never emitted its mutation event, and resolved
+  `undefined` instead of a boolean.** `@objectstack/client`'s `DeleteDataResult`
+  declared a key called `deleted` — a key no schema has ever declared and no server
+  path has ever returned on `DELETE /data/:object/:id`. So `result.deleted`
+  compiled and read `undefined` at runtime: the guard never fired, a successful
+  delete notified no subscriber, and every consumer's cache stayed stale.
+  objectstack#5638 corrected the interface to the schema's `success`; following the
+  rename is what restores both behaviours. Nothing in this repo had to change shape
+  for it — the code was already asking the right question of the wrong key.
+
+  ## Breaking, in FROM → TO form
+
+  - **The five `@objectstack/spec/ui` interaction-config modules are gone** —
+    touch / dnd / keyboard / animation / offline, 32 defs and 64 exports
+    (objectstack#4988, PR objectstack#5321). None of them had an authoring door: no
+    metadata document could ever carry one of these blocks, so a stack that parsed
+    before the retirement parses byte-for-byte the same after it. `@object-ui/types`
+    drops the 32 `export type` re-exports. The vocabulary each one's only real
+    consumer needs is now declared by that consumer, which is the remedy the spec's
+    own retirement ledger prescribes ("declare that union locally — it is your
+    client's policy, not the platform's"):
+
+    - `@object-ui/react`'s `useOffline` owns `OfflineStrategy`, `ConflictResolution`,
+      `PersistStorageType`, `EvictionPolicyType`, `OfflineConfig`,
+      `OfflineCacheConfig`, `OfflineSyncConfig`;
+    - `@object-ui/core`'s `DndProtocol` / `KeyboardProtocol` own `DndConfig`,
+      `DragItem`, `DropZone`, `DragConstraint`, `DragHandle`, `DropEffect`,
+      `KeyboardNavigationConfig`, `KeyboardShortcut`, `FocusManagement`,
+      `FocusTrapConfig`;
+    - `@object-ui/types`' `mobile` module owns `SpecGestureConfig`,
+      `SwipeGestureConfig`, `PinchGestureConfig`, `LongPressGestureConfig`,
+      `TouchTargetConfig`, `TouchInteraction` (plus a new `SPEC_GESTURE_TYPES`
+      runtime tuple), so `@object-ui/mobile`'s import paths are unchanged.
+
+    Every shape is moved verbatim — same keys, same members, same optionality — so
+    no hook or bridge changes behaviour. Consumers importing these names from
+    `@object-ui/types` must import them from the owning package instead. Note the
+    spec's _surviving_ `ConnectorConflictResolution` (`/integration`, connector sync)
+    and `ConflictResolutionStrategy` (`/api`, route merge policy) are **different
+    concepts** — do not re-point at them.
+
+  - **`@object-ui/types` no longer re-exports `NotificationAction` or `EmbedConfig`**
+    (objectstack#5015, PR objectstack#5300). Both were published `ui` vocabulary with
+    no authoring door; no notification action was ever parsed from metadata and no
+    iframe route ever read an embed config. The presentation enums
+    (`NotificationType` / `NotificationSeverity` / `NotificationPosition`) and
+    `SharingConfig` **survive** and are untouched — public form sharing still gates
+    the anonymous endpoints on `allowAnonymous` + `publicLink`.
+    `@object-ui/core`'s `SharingProtocol` keeps `resolveEmbedConfig` /
+    `generateEmbedCode` against a locally declared `EmbedConfig`, so its surface is
+    unchanged.
+  - **`ThemeEngine` stops emitting nine retired CSS variable groups**
+    (objectstack#5021 option 2, PR objectstack#5289). `theme.animation`,
+    `theme.zIndex` and five typography groups (`fontSize` / `fontWeight` /
+    `lineHeight` / `letterSpacing`, plus `fontFamily.heading` / `fontFamily.mono`)
+    are tombstones the schema now rejects by name, so `--duration-*`, `--timing-*`,
+    `--z-*`, `--font-size-*`, `--font-weight-*`, `--line-height-*`,
+    `--letter-spacing-*`, `--font-heading` and `--font-mono` had become structurally
+    dead code — no author could produce the input that reached them.
+    `generateAnimationVars` and `generateZIndexVars` are removed from
+    `@object-ui/core`, and `@object-ui/types` drops `Animation` / `ZIndex` /
+    `AnimationSchema` / `ZIndexSchema`. **`theme.customVars` is the declared — and
+    since #5021 the only — door**: each entry is emitted verbatim as
+    `--<key>: <value>`, so a `--z-modal` or a `--duration-fast` goes there now.
+    LIVE emission is untouched byte for byte: `colors`, `borderRadius`, `shadows`,
+    `typography.fontFamily.base` (→ `--font-sans`) and `customVars`.
+  - **`@object-ui/types`' `HttpMethodSchema` now binds the spec's
+    `HttpMethodSubsetSchema`, and `HttpMethod` binds `HttpMethodSubset`**
+    (objectstack#5832, PR objectstack#5976 — objectui#3499). The spec renamed its
+    5-value UI subset because `schemaNameFromExportKey` strips the `Schema` suffix,
+    so the 5-value and 7-value enums both published as `shared/HttpMethod` and the
+    later write won — the emitted JSON Schema and reference page described only one
+    of them. **The runtime domain is unchanged and this repo's exported names are
+    unchanged**; this follows the rename without touching cross-package semantics.
+    Deliberately NOT re-pointed at the spec's bare `HttpMethod`: that is the 7-value
+    enum, and widening to it would let `method: 'HEAD'` compile and then throw in
+    `HttpRequestSchema.parse()`.
+  - **`dashboard.widgets[].actionUrl` / `actionType` / `actionIcon` / `aria` are
+    refused, not stripped** (objectstack#5010, ADR-0049 enforce-or-remove). A
+    dashboard widget has no action button and never had one — every action the
+    dashboard dispatches comes from `header.actions[]` — and no renderer ever applied
+    the widget `aria`, so it promised accessibility compliance it did not deliver.
+    A stale dashboard now gets a named error telling it where the affordance moved,
+    instead of silently losing it. Run `os migrate meta --from 16` to rewrite.
+
+### Patch Changes
+
+- 6719877: `condition: false` now actually prevents the action from executing (objectui#3872)
+
+  `ActionRunner.execute` — the engine's public execution entry, shared by every
+  action surface — gated conditional execution on `if (action.condition)`, i.e. on
+  the raw value's TRUTHINESS. Truthiness cannot answer the question the gate needs
+  answered ("did the author declare a condition?"), and on this key it answered in
+  the over-permissive direction: `condition: false` fell on `if (false)`, so the
+  whole block was skipped, `evaluateCondition` was never consulted, and the action
+  executed. Measured with a call-counting handler:
+
+  - `condition: false` — handler ran: **true**, result `{ success: true }`
+  - `condition: { dialect: 'cel', source: 'false' }` — handler ran: false, result `{ success: false, error: 'Action condition not met' }`
+
+  Two spellings of the same statement, opposite outcomes. `false` is the most
+  explicit "never execute this" metadata can carry — and what a template that
+  switches an action off emits — so the direction matters: the action really ran,
+  possibly writing. This is the over-permission half of the objectui#3492 family
+  (the `disabled` gate one line below is objectui#3848, whose defect pointed the
+  other way).
+
+  The gate now asks whether a `condition` gate is DECLARED before evaluating.
+  "Nothing to evaluate" is read from core's single predicate normalizer
+  (`toPredicateInput`, which maps `''`, `null`, an empty-`source` envelope and
+  non-predicate values to `undefined`), plus the whitespace-only string, which the
+  normalizer wraps rather than collapses — objectui#3850's ruling on the scope of
+  "empty predicate", the same one the `disabled` gate already applies. Once the
+  door asks the right question the verdict needs no boolean branch of its own:
+  `evaluateCondition` returns a boolean argument verbatim.
+
+  **Behaviour change surface, deliberately one-directional and one row wide.**
+  Exactly one shape changes verdict — a declared boolean `false`, from executing to
+  refused (`{ success: false, error: 'Action condition not met' }`, the message the
+  key already used). Everything else is byte-identical: `condition: true`, an
+  absent `condition`, and truthy expressions/envelopes still execute; falsy
+  expressions, falsy CEL envelopes and falsy `${…}` templates are still refused,
+  as before; the three empty predicates (`''`, whitespace-only, an empty-`source`
+  envelope) still execute, now because nothing was declared rather than because
+  `if ('')` happened to be falsy; and non-predicate junk (`0`, `{}`) still
+  executes — a value that is not a predicate must not decide an action's fate,
+  which is the fail-open posture this module already committed to for `disabled`.
+  So this change can only start refusing execution, never start allowing it — the
+  mirror image of objectui#3848's fix.
+
+  `ActionDef.condition` is widened to `string | boolean` to match what the gate now
+  honours (and the `disabled` key beside it). This is not a lenient consumer
+  alias: the boolean was always accepted at runtime through the interface's index
+  signature, it was simply ignored.
+
+  The value handed to the evaluator is deliberately left RAW rather than normalized
+  first, for the same reason as objectui#3848 with the sign flipped:
+  `toPredicateInput` wraps unconditionally, so an already-templated `'${x}'`
+  becomes `'${${x}}'`, fails to parse, returns verbatim and coerces to a constant
+  `true` — on `disabled` that blocks everything, on `condition` it would EXECUTE
+  everything. That normalizer defect is objectui#3871; a tripwire next to the new
+  pins goes red the day it is fixed.
+
+- 56ff091: An empty `disabled` predicate no longer refuses to run the action (objectui#3848)
+
+  `ActionRunner.execute` — the engine's public execution entry, shared by every
+  action surface — gated on `action.disabled != null && action.disabled !== false`
+  and handed the value straight to `evaluateCondition`. That function documents one
+  default for "there is no condition here": return `true`, meaning
+  _visible/enabled_. On `disabled`, `true` means BLOCKED. So every empty predicate
+  was read as "disabled": the handler was never invoked and the caller got
+  `{ success: false, error: 'Action is disabled' }` — a state the metadata never
+  declared. Measured with a call-counting handler:
+
+  - `disabled: ''` — handler ran: false
+  - `disabled: '   '` (whitespace only) — handler ran: false
+  - `disabled: { dialect: 'cel', source: '' }` (the empty envelope `objectstack build` can emit) — handler ran: false
+
+  After objectui#3842 / objectui#3849 fixed the renderer halves, this was live
+  user-visible behaviour: the button became clickable and clicking it returned
+  `Action is disabled` — the renderer and the execution entry disagreeing about one
+  predicate value, the shape objectui#3314 already paid for once.
+
+  The gate now asks whether a `disabled` gate is DECLARED — whether there is a
+  condition to reach a verdict on — before evaluating. "Nothing to evaluate" is
+  read from core's single predicate normalizer (`toPredicateInput`, which maps
+  `''`, `null`, an empty-`source` envelope and non-predicate values to
+  `undefined`), plus the whitespace-only string, which the normalizer wraps rather
+  than collapses and which `evaluateCondition` itself calls "no condition"
+  (`evalRowPredicate` applies the same blank-source rule).
+
+  **Behaviour change surface, deliberately one-directional.** Only values with
+  nothing to evaluate change, and only from blocked to allowed: `''`,
+  whitespace-only, an empty-`source` envelope, and non-predicate junk (`0`, `{}`,
+  which previously coerced to "disabled"). `disabled: true`, a truthy expression
+  and a truthy CEL envelope still block; `disabled: false` and an absent `disabled`
+  still run; no expression- or envelope-valued predicate changes verdict. The
+  existing `catch { isDisabled = false }` fail-open posture is untouched, and this
+  change can only stop blocking things, never start.
+
+  The value handed to the evaluator is deliberately left RAW rather than normalized
+  first. `evaluateCondition(toPredicateInput(x))` is not interchangeable with
+  `evaluateCondition(x)` for a string that is already a `${…}` template:
+  `toPredicateInput` assumes a bare expression and wraps unconditionally, so
+  `'${x}'` becomes `'${${x}}'`, fails to parse, returns verbatim, and coerces to a
+  constant `true` — a template-spelled predicate evaluated that way is ALWAYS
+  "disabled", whatever it says. That normalizer defect is filed as objectui#3871
+  (it is live at the action renderers and `ActionEngine`, while `SchemaRenderer` and
+  `page:header` evaluate the raw value and pin the correct verdict); a tripwire next
+  to the new pins goes red the day it is fixed. Two rows therefore still differ
+  between the execution and renderer paths, each recorded with its owning issue:
+  the empty envelope (objectui#3850 owns the renderer half's scope ruling) and the
+  `${…}` spelling (objectui#3871).
+
+- 4bc6c23: Converge dashboard widget `compareTo` on the executor's `{ kind, dimension? }` contract, and make the dataset path actually render a comparison
+
+  `CompareToConfig` was a three-branch union (`'previousPeriod' | 'previousYear' | { offset }`). `@objectstack/spec` collapsed it to the shape the analytics executor already implements — `DatasetCompareTo`, a plain strict object `{ kind: 'previousPeriod' | 'previousYear'; dimension?: string }` (objectstack#5011) — so this renderer now reads that one shape:
+
+  - `shiftFilterByCompareTo` / `compareToTrendLabelKey` dispatch on `compareTo.kind`. The `{ offset }` duration shift is gone: `{ offset: '1y' }` is `kind: 'previousYear'`, while `'7d'` / `'1M'` have no faithful target and are restated by the author on the widget's own `filter` plus `kind: 'previousPeriod'`. No trend label key is retired — the offset arm resolved to `vsPreviousPeriod`, which survives as the `previousPeriod` fallback.
+  - `DatasetWidget` no longer discards part of `compareTo`. It used to forward only the object form because the two string forms had no meaning downstream; with one shape there is nothing to discard, and a stale string is now invalid metadata rejected where it is authored rather than silently reinterpreted here.
+  - **The comparison now actually runs on the dataset path.** A widget states its window in its own `filter` (a date macro, or the dashboard date-range filter merged in), but the executor shifts a `timeDimensions` entry carrying a `dateRange` — so a dataset widget asking for a comparison got "compareTo needs a dated window to shift" and rendered none. When (and only when) a comparison is requested, the resolved filter's bounded date windows are lowered into `selection.timeDimensions[].dateRange` and moved out of `runtimeFilter` (a copy left behind would intersect the shifted window with the current one and empty every comparison column). Which dimension gets shifted stays the executor's decision: every window found is lowered under the name the author wrote, and zero or two candidates surfaces the executor's own error, listing them.
+  - The `<measure>__compare` columns that come back are now shown: a delta + window label on KPI widgets, a comparison column on tables, and a `variant: 'comparison'` overlay series on charts — the same treatment and the same `dashboard.trend.*` labels the inline object-provider widgets already use.
+
+- e06810e: `PageComponentSchema.dataSource` is now consumed instead of discarded — a
+  `list-view` page component can reference a **saved view by name** for the first
+  time, and writing the binding no longer breaks the component
+  (objectstack#5576).
+
+  The spec declares a per-element data binding on every page component —
+  `dataSource: { object, view?, filter?, sort?, limit? }` — and objectui read none
+  of it. `ViewDataProvider.resolveElementDataSource` forwarded
+  `filter`/`sort`/`limit` and dropped `view` entirely, and had no caller outside its
+  own test; nothing mapped `object` onto the `objectName` a list actually reads. So
+  "reference a saved view by name" was published, validated and inert, and every
+  page that wanted a saved view's columns/filter/sort had to inline a second copy of
+  them — the drift the binding exists to remove.
+
+  Writing the binding also **broke** the block, for a reason unrelated to `view`:
+  `SchemaRenderer` spread the schema's `dataSource` metadata onto the component as a
+  React prop, and that is the prop name the host uses to inject the data-source
+  ADAPTER. The plain `{ object, view }` object shadowed the adapter, so the first
+  `dataSource.find(…)` threw `dataSource.find is not a function` and `list-view`
+  rendered "Couldn't load records" — a spec-compliant component failing next to
+  identical ones that omitted the binding.
+
+  - `@object-ui/react` — `SchemaRenderer` no longer spreads `schema.dataSource` as a
+    prop (it is metadata, like `visibleWhen`); renderers read it off `schema`. An
+    explicit React `dataSource` prop is unaffected. New
+    `useElementDataSource(schema, dataSource?)` hook resolves a binding, fetching
+    the named saved view from the object definition's `listViews` and the metadata
+    overlay's `listViews()`.
+  - `@object-ui/core` — new `isElementDataSourceConfig` / `collectSavedViews` /
+    `resolveSavedView` / `composeElementDataSource`, and `resolveElementDataSource`
+    now honours `view` through an optional `DataFetcher.fetchViews`, reporting an
+    unresolvable view as an error instead of silently returning every record.
+    `resolveViewId` moved here from `@object-ui/app-shell` (re-exported there) so
+    one matcher serves both the object page and a page component.
+  - `@object-ui/plugin-list` — `list-view` maps the binding onto the props
+    `ListView` reads. `dataSource.*` keys are authoritative, view-supplied values
+    are a baseline the component's own keys override, and `filter` AND-combines at
+    every level (the spec calls the binding's filter "additional criteria"), so a
+    binding can narrow a saved view but never widen it. A `view` name that does not
+    resolve renders a configuration error naming the object's actual views and
+    issues no query — it never falls back to the object's default view, because that
+    turns a typo into a silently wider answer.
+
+- ab3ad4f: An empty predicate is no longer a declared gate anywhere (objectui#3850, objectui#3862)
+
+  "Is a gate DECLARED on this key — is there a condition to reach a verdict on?" was
+  answered three times in this repo, with three different scopes, and the widest
+  answers sat on `disabled`, where the mistake is not benign:
+
+  - `hasDeclaredVisibilityGate` (the action face) asked `!= null && !== ''`, so every
+    OBJECT counted — including `{ dialect: 'cel', source: '' }`. That envelope is not
+    a hand-written curiosity: `@objectstack/spec`'s `ExpressionInputSchema` normalizes
+    every authored predicate into one, so "the author left the predicate empty"
+    compiles to exactly it. The verdict path normalized the same value back to
+    `undefined`, and `evaluateCondition(undefined)` answers `true` — "no condition, so
+    visible/enabled". On `visible` that `true` means SHOW, so the two mistakes
+    cancelled; on `disabled` it means GREY, so they compounded: a button disabled
+    forever that no author asked to disable (objectui#3850, the residue objectui#3842
+    left behind).
+  - `SchemaRenderer` asked `disabled !== undefined` inline, one notch wider again, so
+    `disabled: null` greyed out too — on the GENERIC rendering path, since that block
+    runs for every node type, and not as an internal flag either: `_disabled` is
+    forwarded to the component as a real `disabled` prop (objectui#3862).
+  - `ActionRunner`'s execution gates asked "does this normalize to something
+    evaluable?" — the scope that turned out to be right (objectui#3848 / objectui#3872).
+
+  There is now ONE definition, `hasDeclaredPredicate`, exported from
+  `@object-ui/core` (`evaluator/declaredPredicate.ts`, beside the `toPredicateInput`
+  normalizer it is derived from): a gate is declared when normalization still leaves a
+  condition to evaluate. `''`, a whitespace-only string, an empty-`source` envelope
+  and any non-predicate value (`0`, `{}`) are NOT declared; `false` IS (a verdict is
+  not a missing gate — objectui#3812). `hasDeclaredVisibilityGate` keeps its name as a
+  re-export of it, so the five member-action renderer call sites, `DeclaredActionsBar`
+  and `record-quick-actions` are unchanged and inherit the scope;
+  `SchemaRenderer`'s `disabled` / `disabledOn` chain and `ActionRunner`'s two gates
+  read the same function. No consumer got a local "and also check for empty" test —
+  that fourth dialect is what objectui#3842 / objectui#3849 spent two PRs merging away.
+
+  Measured behaviour change, `action:button` and the generic path, before → after:
+
+  | value                                                     | `visible`      | `disabled` | `enabled` | `SchemaRenderer` `disabled` prop |
+  | --------------------------------------------------------- | -------------- | ---------- | --------- | -------------------------------- |
+  | `''`                                                      | shown → shown  | on → on    | on → on   | forwarded → absent               |
+  | `null`                                                    | shown → shown  | on → on    | on → on   | forwarded → absent               |
+  | `{ dialect: 'cel', source: '' }`                          | shown → shown  | GREY → on  | on → on   | forwarded → absent               |
+  | `{ source: '' }`                                          | shown → shown  | GREY → on  | on → on   | forwarded → absent               |
+  | `'   '` (whitespace)                                      | HIDDEN → shown | on → on    | GREY → on | forwarded → absent               |
+  | `0` / `{}` (not predicates)                               | shown → shown  | GREY → on  | on → on   | forwarded → absent               |
+  | `true` / `false` / bare CEL / `${…}` / non-empty envelope | unchanged      | unchanged  | unchanged | unchanged                        |
+
+  Every row moves toward "there is no gate here", never away from it, and no value
+  that HAS a verdict changes it — the verdict is still read from the raw value, only
+  the gate in front of it narrowed. Two rows are behaviour changes rather than the
+  equivalence the ruling expected, and are pinned as such: the whitespace string moves
+  on `visible` / `enabled` (it used to normalize to `'${   }'`, which evaluates falsy,
+  so a predicate that says nothing HID the action from everyone), and non-predicate
+  junk stops greying controls out (fail-open, the posture `ActionRunner` already
+  committed to).
+
+  One blank spelling is knowingly still outside the scope: an envelope whose `source`
+  is blank but not EMPTY (`{ dialect: 'cel', source: '   ' }`) — the normalizer folds a
+  `source` of `''` and does not trim, so the string spelling of a blank predicate is
+  trimmed and the envelope spelling is not, and `disabled` still greys out for that one
+  value. The ruling enumerated three empty spellings; this is a fourth, measured and
+  filed as objectui#3960 rather than widened in here.
+
+  One chain is deliberately untouched: `SchemaRenderer`'s `visible` / `visibleWhen` /
+  `visibleOn` / `visibility` / `hidden` / `hiddenOn` legs keep `!== undefined`, because
+  narrowing them would change ALIAS PRECEDENCE, not just emptiness. The `hidden` legs
+  are not negated and therefore carry this same defect with the polarity that makes the
+  node vanish — measured, out of this ruling's scope, filed as objectui#3955.
+
+- c2fd122: fix(actions): forward `bodyShape` end-to-end so a declared body wrap is honoured
+
+  Sibling of the `bodyExtra` fix, same failure shape one key over. `bodyShape` is
+  the spec's body-WRAPPING declaration for a `type: 'api'` action — `'flat'` (the
+  default) or `{ wrap: key }` to nest the collected params under `key`, the shape
+  better-auth's `organization/update` needs. The console `apiHandler` read it
+  unconditionally while **no** action renderer forwarded it, so an author who
+  declared `bodyShape: { wrap: 'data' }` on an `action:button` / `:group` / `:icon`
+  / `:menu` action got a FLAT body on the wire: the endpoint received the params at
+  the top level, and the declaration read as honoured because it parsed and
+  published.
+
+  The four declared-action renderers now forward the key, and `ActionSchema`
+  declares it (typed by derivation from the spec, so the union cannot drift).
+  `ActionRunner.executeAPI` — the fallback path taken when no host registered an
+  `api` handler — now reads it too, closing a second asymmetry in which the same
+  action changed body shape depending on which host executed it. The wrap covers
+  the collected params only; `bodyExtra` and other top-level keys stay flat, which
+  is the spec's own wording for the key and what both console read-sites already
+  did.
+
+  `element:button` deliberately does **not** forward it: its whitelist mirrors
+  spec's `InlineActionSchema` pick list field for field, and that pick list does
+  not include `bodyShape` — it is not inline vocabulary.
+
+- 1d723e3: fix(core): stop re-wrapping an already-`${…}` predicate, so action-face `visible` / `disabled` finally honour it (objectui#3871)
+
+  `toPredicateInput` — the one normalizer every action surface and the action
+  engine share — wrapped **every** string as `${string}`, assuming a bare
+  expression. But `${…}` is a spelling this repo documents for a predicate
+  (AGENTS.md §4) and one the normalizer's own output type lists as valid, so an
+  already-normalized value was wrapped a second time: `'${x}'` became `'${${x}}'`,
+  which cannot match the evaluator's single-template fast path and does not parse.
+  The author's expression then decided nothing, and which constant came back
+  depended on the caller's error policy:
+
+  - **fail-soft** legs (every `disabled` / `enabled` leg; `visible` on
+    `action:icon`, `action:group` and the related-list toolbar) got the unparsed
+    string back, so `Boolean(…)` was a constant `true`: `disabled: '${…}'` greyed
+    the action out permanently, `visible: '${…}'` showed one the author had gated
+    away, and `enabled: '${…}'` never disabled anything.
+  - **fail-closed** legs (`throwOnError: true` — `visible` on `action:button`,
+    `action:bar`, `action:menu`, `DeclaredActionsBar`, and
+    `ActionEngine.getActionsForLocation`) got a **throw**, which each site turns
+    into "hidden": an action gated with a template predicate was invisible even
+    while its gate held, and the fail-closed warning blamed the author's
+    expression.
+
+  A string that already carries `${` is now returned untouched (the same guard
+  covers the envelope branch, where an unwrapped `source` reaches the identical
+  wrap), which makes the normalizer idempotent. Every affected surface goes from a
+  constant verdict to the predicate's real one — converging the action face with
+  `SchemaRenderer` and `page:header`, which read the raw value and have always
+  been right about this spelling (objectui#3314's shape). Bare expressions and
+  `{ dialect: 'cel' }` envelopes are untouched.
+
+  `ActionRunner`'s two execution gates already read the raw value and are
+  unchanged; the objectui#3871 tripwires they carried have been replaced by pins
+  of the now-converged behaviour.
+
+  Whether `${…}` should be _authorable_ on an action predicate at all is a
+  separate, spec-side question (`@objectstack/spec`'s `PredicateInput` models a
+  bare string and a dialect envelope): if it is to be rejected, that belongs in
+  publish-time validation, not in a consumer that silently invents a verdict.
+
+- 0109f54: Blank predicates and non-predicate values are no longer gates, at the last three entries that still judged them (objectui#3955, objectui#3957, objectui#3960)
+
+  objectui#3850 sank "is a predicate gate DECLARED here?" into one definition,
+  `@object-ui/core`'s `hasDeclaredPredicate`. Three places were left out of that
+  ruling's placement clause, each with the same shape of defect: the evaluator's
+  single default for "there is nothing here to evaluate" is `true`, meaning
+  _visible/enabled_, and wherever a too-wide "declared" test hands it an empty
+  predicate on an INVERTED key, that `true` turns a control off for a value the
+  metadata never used to say anything.
+
+  **`SchemaRenderer`'s `hidden` / `hiddenOn` legs (objectui#3955)** asked
+  `!== undefined` and did NOT negate the verdict, so an empty predicate meant HIDE
+  and the node disappeared — on the generic rendering path, since that block runs
+  for every schema type. Harder to diagnose than the `disabled` twin objectui#3862
+  fixed: a greyed-out control is still on screen, while a node that never rendered
+  is indistinguishable from metadata that meant to hide it. Both legs now read the
+  shared definition.
+
+  **The "blank" criterion now covers the envelope spelling (objectui#3960).** The
+  definition trimmed a whitespace-only STRING and not an envelope's whitespace-only
+  `source`, because `toPredicateInput` folds a `source` of `''` and does not trim.
+  So `{ dialect: 'cel', source: '   ' }` was a declared gate whose verdict came from
+  core's own CEL entry calling that exact value "no predicate" (`if (!source.trim())
+return true`) — `disabled` greyed out forever and `ActionRunner.execute` answered
+  `{ success: false, error: 'Action is disabled' }` with the handler never invoked.
+  Blankness is now decided once for both spellings, at the definition. The
+  NORMALIZER's contract is deliberately unchanged: "what shape does the evaluator
+  accept" is not the same question as "is there a condition", and moving the trim
+  there would have flipped verdicts for every
+  `useCondition(toPredicateInput(…))` call site, including container-level `visible`
+  reads that never asked this question at all.
+
+  **`ActionEngine.getActionsForLocation`'s `visible` filter (objectui#3957)** was the
+  last consumer answering the question with a range of its own — three empty
+  spellings folded by hand, everything else coerced with `Boolean(raw)`. It now reads
+  the shared definition and the coercion branch is gone, so one value no longer gets
+  two answers depending on whether an action was surfaced by the engine or rendered
+  standalone (the invariant objectui#3314 established). Its fail-CLOSED posture on a
+  predicate that THROWS is untouched (`throwOnError: true` + `warnHiddenPredicate`):
+  "the predicate faulted" and "there is no predicate" are different facts.
+
+  Behaviour changes, before → after. Observation-class: each needs an author to write
+  an empty/blank predicate or a non-predicate value, and there is no known user path
+  today.
+
+  | value                                                       | `ActionEngine` `visible` | `SchemaRenderer` `hidden` | `disabled` (action face + generic path) | `ActionRunner.execute` `disabled` |
+  | ----------------------------------------------------------- | ------------------------ | ------------------------- | --------------------------------------- | --------------------------------- |
+  | `''` / `null`                                               | shown → shown            | HIDDEN → rendered         | unchanged                               | unchanged                         |
+  | `'   '` (blank text)                                        | HIDDEN → shown           | HIDDEN → rendered         | unchanged                               | unchanged                         |
+  | `0` / `NaN`                                                 | HIDDEN → shown           | HIDDEN → rendered         | unchanged                               | unchanged                         |
+  | `{}` / `[]`                                                 | shown → shown            | HIDDEN → rendered         | unchanged                               | unchanged                         |
+  | `{ dialect: 'cel', source: '' }`                            | shown → shown            | HIDDEN → rendered         | unchanged                               | unchanged                         |
+  | `{ dialect: 'cel', source: '   ' }`                         | shown → shown            | HIDDEN → rendered         | GREY → on                               | refused → runs                    |
+  | `{ source: '   ' }` (no dialect)                            | HIDDEN → shown           | HIDDEN → rendered         | GREY → on                               | refused → runs                    |
+  | `true` / `false` / bare CEL / `${…}` / a non-blank envelope | unchanged                | unchanged                 | unchanged                               | unchanged                         |
+
+  Every row moves toward "there is no gate here", never away from it, and no value
+  that HAS a verdict changes it — a declared `false` is still a verdict, not a
+  missing gate (objectui#3812), and blankness is `trim()`, not "short": `{ dialect:
+'cel', source: ' x ' }` is a predicate. One alias precedence changes with the
+  `hidden` legs and is pinned rather than claimed as an equivalence: an undeclared
+  `hidden` no longer short-circuits the chain, so a declared `hiddenOn` is finally
+  consulted.
+
+  `SchemaRenderer`'s four `visible*` legs keep `!== undefined` deliberately, as
+  objectui#3850 ruled: their `true` is negated, so an empty predicate already lands
+  on "shown", and narrowing them would change alias precedence rather than fix
+  anything.
+
+- 7e5bb5d: fix(actions): forward `bodyExtra` end-to-end through the action chain
+
+  An action's static request body (`bodyExtra`) was dropped one hop before the
+  `ActionRunner`: every action renderer forwards an explicit whitelist of keys, and
+  none of them listed `bodyExtra`. Since `@objectstack/spec` 17 made it the only way
+  a `type: 'api'` action can carry a payload (`params` keeps its single meaning as
+  the parameter definition array), and the ADR-0087
+  `inline-action-api-params-to-body-extra` conversion rewrites older object-form
+  `params` pages onto it at load, a previously-working published page validated,
+  published and then POSTed an empty body.
+
+  `element:button`, `action:button`, `action:group`, `action:icon` and `action:menu`
+  now forward the key; `ActionRunner.executeAPI` merges it into the request body
+  **last** (so a constant always overrides a same-named user param, matching the
+  console `apiHandler`); `ActionSchema` declares it; and a non-array `params` on a
+  `type: 'api'` action keeps working for one version window with a dev-mode
+  deprecation warning naming `bodyExtra`.
+
+- fbc23e0: Action params that inherit a field's options now keep the keys that field declared
+
+  A field-backed action param (`{ field: 'tier' }`) had its inherited option list
+  rebuilt entry by entry as `{ label, value }`, which silently dropped every other
+  key the field's options declared — most consequentially the per-option
+  `visibleWhen` predicate (ADR-0058). A select field whose options narrow by
+  predicate in an object form therefore offered the FULL list in an action dialog,
+  including the entries the predicate exists to hide, with no diagnostic on either
+  side; `color` / `icon` / `disabled` were lost the same way. Options authored
+  inline on the param were never affected — they always passed through verbatim,
+  which is the asymmetry this restores.
+
+  The resolver now preserves each inherited entry and only does its two real jobs:
+  expanding bare strings into label/value pairs and translating the label through
+  `fieldOptionLabel`. The option widgets already filter on `visibleWhen`, so a
+  role-gated option (`'admin' in current_user.positions`) inherited by a dialog
+  param now narrows the offered set and clears a seeded value the predicate hides.
+
+  `ActionParamDef.options` (`@object-ui/core`) and the resolver's `RawActionParam`
+  are widened to match: `ActionParamOption` names the two keys the param layer
+  reads and carries the rest of a field's option vocabulary through.
+
+- 6bb454a: `evalRowPredicate`: the fail-closed report now names the engine's failure reason, and the ROW always wins over host scope (objectui#3792, objectui#3796)
+
+  Two defects in one function, `packages/core/src/evaluator/listConditional.ts`,
+  shared by every surface that gates on a row predicate: the row kebab, the bulk
+  selection bar, kanban conditional formatting, and — since objectui#3521 — the
+  record page header.
+
+  **The safest path said the least (objectui#3792).** `evalRowPredicate` has two
+  diagnostic routes, and their information content was inverted. The single-eval
+  fast route lets the canonical helper warn, so it prints the engine's own reason
+  (`Reason: [runtime] No such key: owner_id`). The `warnOnError: true` route — the
+  fail-CLOSED one, taken by every caller that makes a button disappear — runs
+  `evalFieldPredicate` twice with `{ warn: false }` to tell a fault from a genuine
+  `false`, and that silence discarded the reason along with the duplicate warning.
+  So the more decisively a surface hid a control, the less it said about why: the
+  console line named the predicate but not the defect, and `No such key: owner_id`
+  or `no such overload: string == null` is usually the whole answer.
+
+  `FieldPredicateDiagnostic` gains an optional `onFault(reason)` passback:
+  `evalFieldPredicate` hands out the engine's verbatim text (kind tag, message and
+  source excerpt — the exact string it prints after `Reason:`) even when its own
+  warning is suppressed. It fires per fault, deliberately independent of the
+  once-per-predicate warning dedupe, so a caller doing its own warn-once
+  bookkeeping keeps control of it; the verdict is unaffected, and callers that pass
+  nothing are unchanged. `evalRowPredicate` threads that reason into its labelled
+  warning, and the legacy-dialect route does the same with the message its engine
+  throws (`Reason: [legacy] …`), so both dialect paths report a fault the same way.
+  Warn-once semantics are unchanged — the reason is deliberately not part of the
+  dedupe key.
+
+  **Wording: not a list function, and not for a long time.** The same message
+  called every caller a "**list** conditional predicate". A hidden button on a
+  record page header reporting "a list conditional predicate" sends its author to
+  the list view to look for a control that was never there. Both messages this
+  module emits (evaluation failure and the legacy-dialect deprecation) now read
+  "conditional predicate".
+
+  **The row is the subject — on both dialect paths (objectui#3796).** The scope
+  merge pinned `data` after the host-scope spread but not `record`, leaving
+  `record` to each engine's own binding — and the two engines disagreed. The legacy
+  evaluator re-pinned `record` to the row (row won); the CEL engine takes its
+  `extra` bag over its `record` binding, so a host scope carrying a `record` key
+  won there instead. One function, one predicate text, two subjects — selected by
+  whether the string happens to contain `===` or `${…}`, the dialect-routing
+  markers, which no author picks deliberately. `record` is now pinned after the
+  spread exactly as `data` is, which fixes both paths at the merge site rather than
+  relying on either engine's precedence.
+
+  No host injects a `record` key today — `ExpressionProvider` binds
+  `current_user` / `user` / `ctx` / `os` / `app` / `data` / `features` — so nothing
+  observable changes for existing apps; this closes the edge before a host adds one
+  (`ctx.record` already exists, which is exactly how it would arrive). A row FIELD
+  named `record` is likewise no longer able to become the row root; it stays
+  addressable as `data.record`.
+
+  Shipped as a patch: no new exported symbol, one optional field added to an
+  already-exported options interface, and no existing call signature changed.
+
+- 523be48: `object-timeline` and `record:line_items` now apply the filter / sort / row cap they are given, so a named `dataSource.view` narrows them instead of contributing nothing
+
+  These were the two residual gaps in objectstack#7121's per-block coverage table
+  (objectstack#7137). Both blocks are object-bound lists, both accepted the spec's
+  per-element `dataSource` binding, and neither had a read site for `filter` or
+  `sort` anywhere in its fetch:
+
+  - `object-timeline`'s entire query was
+    `find(objectName, { options: { $top: 100 } })`.
+  - `record:line_items`' was the parent FK plus a fixed `$top: 500`.
+
+  So `dataSource: { object, view: 'hot' }` resolved the view — a typo still reported
+  a configuration error, it never degraded into an unfiltered query — and then
+  dropped everything the view said. The rendered rows could be **wider than the view
+  they named**, silently, which is exactly the class of mistake AI-authored metadata
+  hides best: the page looks like it works. objectstack#7121 deliberately left the
+  keys unmapped and recorded the gap rather than writing composed values onto schema
+  keys nobody read; this closes it at the fetch instead.
+
+  What each block now reads:
+
+  - **`object-timeline`** — `$filter: schema.filter`,
+    `$orderby: convertSortToQueryParams(schema.sort)`, and
+    `$top: schema.limit ?? 100`, matching the form `object-gantt` / `object-map` /
+    `object-calendar` already use. Its registry mapping gains
+    `filter` / `sort` / `limit`; `columns` stays unmapped, because a timeline
+    projects the fields its `timeline` config names.
+  - **`record:line_items`** — the composed filter is **AND-combined** with the parent
+    relationship condition through `mergeFilterNodes`, never substituted for it, the
+    same way `record:related_list` composes its own since objectstack#7118: a
+    line-items panel is always scoped to the record it sits on, so an _additional_
+    criterion can only narrow this parent's children and can never surface another
+    parent's rows. `sort` becomes the load order and `limit` the row cap (default
+    500). `columns` stays unmapped — here they are `GridColumn[]` driving an editable
+    grid, not a field-name projection, so a view's column list would be the wrong
+    _shape_ rather than merely a wider answer.
+
+  **Behaviour change worth knowing about:** the timeline's default window is now a
+  real cap. `{ options: { $top: 100 } }` nested the limit under a key that is not a
+  `QueryParams` field and that no adapter in this repo reads (`convertQueryParams`
+  maps `params.$top`), so the intended window never reached the wire and a timeline
+  over a large object fetched whatever the server chose to return. It is now sent as
+  `$top`, and authorable via `limit` or a view's `pagination.pageSize`.
+
+  `@object-ui/core` gains `convertSortToQueryParams`, the sort→`$orderby` lowering
+  the three sibling blocks each inline privately. It is shared rather than copied
+  twice more, and is slightly more faithful to the declared contract than those
+  copies: a sort entry that omits `order` means ascending instead of being dropped
+  (the string spelling `"amount"` already meant ascending in the same copies), and
+  nothing orderable yields `undefined` rather than a truthy empty `{}`. Migrating
+  the three existing copies onto it is objectstack#7148 and is not done here.
+
+- Updated dependencies [d229dfa]
+- Updated dependencies [c2fd122]
+- Updated dependencies [48132f7]
+- Updated dependencies [7e5bb5d]
+- Updated dependencies [e6fdbdc]
+- Updated dependencies [7e2b7e9]
+- Updated dependencies [c1e1e6b]
+  - @object-ui/types@17.4.0
+
 ## 17.3.0
 
 ### Minor Changes
@@ -2641,6 +3295,7 @@ pi-TgoJ4_DM55Fqz` — untranslated, and leaking the object's machine name and th
   project `health`) painted its categories from the generic `--chart-1..5`
   palette — the same gap the chart view (`object-chart`) had before #1932. It now
   resolves the dimension field's option colors (using the dataset's base `object`
+
   - dimension→field map the query already returns) and threads them to the
     renderer as a per-category `categoryColors` map, so health green/red/yellow
     paints semantically.
@@ -2883,6 +3538,7 @@ pi-TgoJ4_DM55Fqz` — untranslated, and leaking the object's machine name and th
 - 991b62d: Add `compareTo` field to dashboard widgets for period-over-period
   comparison. Supports `'previousPeriod'`, `'previousYear'`, and
   `{ offset: '7d' | '4w' | '1M' | '1y' }`.
+
   - **Metric / gauge widgets** now compute a delta percentage when `compareTo`
     is set and surface it as a derived `trend` (auto-labelled via
     `dashboard.trend.vsLast*` i18n keys sniffed from the filter macros).
@@ -2985,6 +3641,7 @@ pi-TgoJ4_DM55Fqz` — untranslated, and leaking the object's machine name and th
 
   Extract the bulk-vs-per-row decision into a reusable
   `executeBulkBatch(input, ops)` helper in `@object-ui/core`:
+
   - Single decision tree shared by both update and delete fast paths.
   - Bulk success → no per-row pass.
   - Bulk partial-count → aggregate batch error.
@@ -3029,6 +3686,7 @@ pi-TgoJ4_DM55Fqz` — untranslated, and leaking the object's machine name and th
   multi-user editing scenarios.
 
   **`@object-ui/data-objectstack`**
+
   - Exports `ConcurrentUpdateError` (carries `currentVersion` and
     `currentRecord`) and `isConcurrentUpdateError()` type guard.
   - `update()` / `delete()` accept `opts.ifMatch` and forward it via the
@@ -3041,6 +3699,7 @@ pi-TgoJ4_DM55Fqz` — untranslated, and leaking the object's machine name and th
     from conflicts without parsing the wire format.
 
   **`@object-ui/core`**
+
   - `ApiDataSource.update()` and `.delete()` accept `opts.ifMatch` and emit
     the `If-Match` HTTP header.
 
@@ -3176,6 +3835,7 @@ pi-TgoJ4_DM55Fqz` — untranslated, and leaking the object's machine name and th
   detail view (`TypeError: titleFormat.replace is not a function`) and printed
   `Failed to evaluate expression: ${[object Object]}` for every action visibility
   predicate.
+
   - `@object-ui/core`: `ExpressionEvaluator.evaluate` / `evaluateCondition` now
     unwrap Expression envelopes transparently.
   - `@object-ui/react`: new `toPredicateInput()` helper to safely normalize
@@ -3190,6 +3850,7 @@ pi-TgoJ4_DM55Fqz` — untranslated, and leaking the object's machine name and th
     the new `{ source }` envelope.
 
   All changes are backward-compatible — legacy bare strings continue to work.
+
   - @object-ui/types@4.0.7
 
 ## 4.0.6
@@ -3368,6 +4029,7 @@ pi-TgoJ4_DM55Fqz` — untranslated, and leaking the object's machine name and th
 - New plugin-object and ObjectQL SDK updates
 
   **Added:**
+
   - New Plugin: @object-ui/plugin-object - ObjectQL plugin for automatic table and form generation
     - ObjectTable: Auto-generates tables from ObjectQL object schemas
     - ObjectForm: Auto-generates forms from ObjectQL object schemas with create/edit/view modes
@@ -3376,6 +4038,7 @@ pi-TgoJ4_DM55Fqz` — untranslated, and leaking the object's machine name and th
   - ObjectQL Integration: Enhanced ObjectQLDataSource with getObjectSchema() method using MetadataApiClient
 
   **Changed:**
+
   - Updated @objectql/sdk from ^1.8.3 to ^1.9.1
   - Updated @objectql/types from ^1.8.3 to ^1.9.1
 
@@ -3389,6 +4052,7 @@ pi-TgoJ4_DM55Fqz` — untranslated, and leaking the object's machine name and th
 - Patch release: Add automated changeset workflow and CI/CD improvements
 
   This release includes infrastructure improvements:
+
   - Added changeset-based version management
   - Enhanced CI/CD workflows with GitHub Actions
   - Improved documentation for contributing and releasing
diff --git a/packages/core/package.json b/packages/core/package.json
index a43723a62c..0ded91dd00 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/core",
-  "version": "17.3.0",
+  "version": "17.4.0",
   "type": "module",
   "sideEffects": false,
   "license": "MIT",
diff --git a/packages/create-plugin/CHANGELOG.md b/packages/create-plugin/CHANGELOG.md
index 7f0e0fd384..5be14aa2d8 100644
--- a/packages/create-plugin/CHANGELOG.md
+++ b/packages/create-plugin/CHANGELOG.md
@@ -1,5 +1,93 @@
 # @object-ui/create-plugin
 
+## 17.4.0
+
+### Patch Changes
+
+- e473b6c: Anchor the scaffold's build-side `devDependencies` to this repo's real toolchain, and pin the whole generated manifest against drift
+
+  A freshly scaffolded plugin declared a build stack one to two majors behind the one this monorepo actually builds and tests every in-tree plugin with: `vite ^7.3.1` against the repo's `^8.2.0`, `@vitejs/plugin-react ^4.2.1` against `^6.0.5`, `vite-plugin-dts ^4.5.4` against `^5.0.3`, `typescript ^5.9.3` against `^6.0.3`, `vitest ^4.0.18` against `^4.1.10`. Those five ranges were never sourced from anything — objectui#3716's end-to-end run of the generated artifact only ever exercised the versions installed in this repo, so the declared ranges were not the ones under test. All five now quote an in-repo anchor, the same way the three testing ranges already did.
+
+  Two anchors, because the root manifest does not declare everything. `create-plugin` writes into `<cwd>/packages/plugin-<name>`, so a generated plugin is a literal sibling of `packages/plugin-*`; those manifests anchor the two build-only tools the root omits (`@vitejs/plugin-react`, `vite-plugin-dts`), and the root anchors the rest.
+
+  The parity test now covers **every** entry of the generated `devDependencies` rather than the three testing ones, including a completeness check that fails when a dependency is added without naming its anchor — the five build ranges drifted precisely because nothing pinned them. It also asserts the two anchors agree wherever both declare a dependency, so which one is read cannot hide a drift.
+
+  The generated `vite.config.ts` resolves its library entry from `import.meta.dirname` instead of `__dirname`. vite 8 still defines `__dirname` under its default `bundle` config loader but warns on it ("unsupported by `configLoader: 'native'`, which is planned to become the default in a future major version of Vite ... Use `import.meta.dirname` instead"), and under `native` — which imports the config with Node's own ESM loader, where no `__dirname` exists — the generated config failed to load outright. `apps/console/vite.config.ts` was converted for the same reason in objectui#3384.
+
+  Not a peer-dependency fix: `@vitejs/plugin-react ^4.2.1` resolved to 4.7.0, whose vite peer had widened to `^4.2.0 || ^5.0.0 || ^6.0.0 || ^7.0.0` and accepted the declared `vite ^7.3.1`, so the old manifest installed cleanly. The cost was a scaffold lagging its own monorepo, not a failing install.
+
+- f4f42b4: create-plugin: make the scaffolded plugin's own test suite runnable
+
+  The generator wrote an example test importing `@testing-library/react` and
+  asserting with `toBeInTheDocument()`, plus a `test: 'vitest run'` script, while
+  declaring neither library and giving Vitest no DOM environment — so `pnpm test`
+  in a freshly scaffolded plugin failed on the very first run, at import
+  resolution.
+
+  The generated `package.json` now declares `@testing-library/react`,
+  `@testing-library/jest-dom` and `jsdom` (each range copied from this
+  monorepo's own manifest), the generated `vite.config.ts` gains a `test` block
+  with `environment: 'jsdom'`, `globals: true` and `setupFiles`, and a
+  `vitest.setup.ts` registering the jest-dom matchers is written alongside it.
+  The templates moved to `src/templates.ts` so the generated artifacts can be
+  pinned by unit tests without executing the CLI.
+
+- c852682: Remove the scaffold's unused pinned icon dependency, and make its generated schema interface reachable
+
+  Two declared-but-unreachable artifacts in the generated plugin, both on the blind side of
+  the import gate objectui#3733 added — that gate rejects an import nothing declares, and
+  never looked for a declaration nothing imports.
+
+  **The generated `dependencies` no longer pin `lucide-react`** (objectui#3755). It was
+  declared at `^0.563.0` and imported by no generated source file, so every freshly
+  scaffolded plugin really installed lucide 0.563.x for code that never referenced it — two
+  majors behind the 23 in-repo declarations, all `^1.28.0`. Worse than ordinary caret drift:
+  a `0.x` caret does not cross minors, so `^0.563.0` is `>=0.563.0 <0.564.0` and could not
+  float even within `0.x`. It is removed rather than re-anchored because this repo declares
+  an icon library where it imports one — of the 24 manifests mentioning `lucide-react`, 23
+  import it, and none pre-declares it for code not yet written. An author who wants icons
+  runs `pnpm add lucide-react` and lands the current version by construction, with no anchor
+  table to maintain for an unused entry. The generated `dependencies` is now exactly the four
+  `workspace:*` platform packages, which cannot drift at all.
+
+  **The generated `src/index.tsx` now re-exports the schema interface** from `src/types.ts`
+  (objectui#3759). The generated `exports` map exposes exactly one key — `.` — so the entry
+  is a consumer's only door, and nothing walked through it to `src/types.ts`: no generated
+  source imported it, and the deep paths that would have reached it (`<pkg>/types`,
+  `<pkg>/dist/types`) are closed by that same map. The interface in it is the plugin's schema
+  contract, and it shipped dead — while the generator's own documentation page told authors to
+  "export your schema types … make it importable rather than internal". A named type-only
+  re-export, matching the four in-repo plugins that ship a `src/types.ts` and the worked
+  example in the plugin-development guide.
+
+  **That interface now extends `BaseSchema` from `@object-ui/types`** instead of re-declaring
+  a subset of the base node. Unreachable, a hand-rolled `{ type; id?; className? }` was only
+  dead weight; published, it would be a second dialect of a node the protocol already defines,
+  silently missing everything else `BaseSchema` carries (`name`, `label`, `visible`, …). Only
+  the `type` literal is narrowed locally, the same shape every in-repo plugin uses. This also
+  makes the generated `@object-ui/types` dependency a used declaration.
+
+  Both halves are pinned structurally rather than by string match, so the next dead artifact
+  fails a test instead of shipping: no versioned runtime dependency may be declared that no
+  generated source imports (`workspace:*` exempt — it cannot drift), and no generated `src/**`
+  module may be unreachable from the single entry the `exports` map exposes. Each of those
+  gates passes over an empty result on today's templates, so each is paired with a self-test
+  that plants the removed defect back and asserts the rule names it — a gate that is green
+  because it produces nothing is not a gate.
+
+- c29ceff: Move the generator templates' dependency ranges onto the repo's current ones
+
+  The dependabot wave of 2026-08-10 bumped `lucide-react` to `1.29.0` and `vite`
+  to `8.2.1` in this repo's own manifests, but the ranges hard-coded in the
+  scaffold generators do not move with it — dependabot does not know the
+  templates exist. A project scaffolded by `objectui init` / `objectui dev` or by
+  `create-plugin` therefore declared a range the repo itself had already moved
+  past.
+
+  Three ranges are re-anchored: `lucide-react` `^1.28.0` → `^1.29.0` in the routed
+  app generator, and `vite` `^8.2.0` → `^8.2.1` in both the shared CLI scaffold
+  devDependencies and the create-plugin template.
+
 ## 17.3.0
 
 ## 17.2.0
diff --git a/packages/create-plugin/package.json b/packages/create-plugin/package.json
index 2590c92998..c6f588f62b 100644
--- a/packages/create-plugin/package.json
+++ b/packages/create-plugin/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/create-plugin",
-  "version": "17.3.0",
+  "version": "17.4.0",
   "description": "CLI tool to scaffold ObjectUI plugins",
   "type": "module",
   "license": "MIT",
diff --git a/packages/data-objectstack/CHANGELOG.md b/packages/data-objectstack/CHANGELOG.md
index 1c2c2f0c66..36169c9515 100644
--- a/packages/data-objectstack/CHANGELOG.md
+++ b/packages/data-objectstack/CHANGELOG.md
@@ -1,5 +1,313 @@
 # @object-ui/data-objectstack
 
+## 17.4.0
+
+### Minor Changes
+
+- 48132f7: Track the `@objectstack` family at `17.0.0-rc.5` (objectui#3560).
+
+  The pin moves from `^17.0.0-rc.2` to `^17.0.0-rc.5` across all 37 declarations in
+  30 `package.json` files, and the sibling `@objectstack/*` packages (`client` /
+  `formula` / `lint`) move with it — they pin `@objectstack/spec` **exactly**, so
+  leaving them behind would keep a second copy of the spec in the tree and have
+  `@objectstack/lint` validating against schemas that still accept the keys rc.3–rc.5
+  retire. `pnpm-lock.yaml` now resolves one copy of each of the six family packages
+  (`spec` / `client` / `core` / `formula` / `lint` / `sdui-parser`), all at rc.5.
+
+  Bumping the pin and repairing the fallout cannot be split: the pin alone reddens
+  CI, and the code alone targets a shape that is not in effect yet.
+
+  ## A live bug this upgrade fixes
+
+  **`ObjectStackDataSource.delete()` never emitted its mutation event, and resolved
+  `undefined` instead of a boolean.** `@objectstack/client`'s `DeleteDataResult`
+  declared a key called `deleted` — a key no schema has ever declared and no server
+  path has ever returned on `DELETE /data/:object/:id`. So `result.deleted`
+  compiled and read `undefined` at runtime: the guard never fired, a successful
+  delete notified no subscriber, and every consumer's cache stayed stale.
+  objectstack#5638 corrected the interface to the schema's `success`; following the
+  rename is what restores both behaviours. Nothing in this repo had to change shape
+  for it — the code was already asking the right question of the wrong key.
+
+  ## Breaking, in FROM → TO form
+
+  - **The five `@objectstack/spec/ui` interaction-config modules are gone** —
+    touch / dnd / keyboard / animation / offline, 32 defs and 64 exports
+    (objectstack#4988, PR objectstack#5321). None of them had an authoring door: no
+    metadata document could ever carry one of these blocks, so a stack that parsed
+    before the retirement parses byte-for-byte the same after it. `@object-ui/types`
+    drops the 32 `export type` re-exports. The vocabulary each one's only real
+    consumer needs is now declared by that consumer, which is the remedy the spec's
+    own retirement ledger prescribes ("declare that union locally — it is your
+    client's policy, not the platform's"):
+
+    - `@object-ui/react`'s `useOffline` owns `OfflineStrategy`, `ConflictResolution`,
+      `PersistStorageType`, `EvictionPolicyType`, `OfflineConfig`,
+      `OfflineCacheConfig`, `OfflineSyncConfig`;
+    - `@object-ui/core`'s `DndProtocol` / `KeyboardProtocol` own `DndConfig`,
+      `DragItem`, `DropZone`, `DragConstraint`, `DragHandle`, `DropEffect`,
+      `KeyboardNavigationConfig`, `KeyboardShortcut`, `FocusManagement`,
+      `FocusTrapConfig`;
+    - `@object-ui/types`' `mobile` module owns `SpecGestureConfig`,
+      `SwipeGestureConfig`, `PinchGestureConfig`, `LongPressGestureConfig`,
+      `TouchTargetConfig`, `TouchInteraction` (plus a new `SPEC_GESTURE_TYPES`
+      runtime tuple), so `@object-ui/mobile`'s import paths are unchanged.
+
+    Every shape is moved verbatim — same keys, same members, same optionality — so
+    no hook or bridge changes behaviour. Consumers importing these names from
+    `@object-ui/types` must import them from the owning package instead. Note the
+    spec's _surviving_ `ConnectorConflictResolution` (`/integration`, connector sync)
+    and `ConflictResolutionStrategy` (`/api`, route merge policy) are **different
+    concepts** — do not re-point at them.
+
+  - **`@object-ui/types` no longer re-exports `NotificationAction` or `EmbedConfig`**
+    (objectstack#5015, PR objectstack#5300). Both were published `ui` vocabulary with
+    no authoring door; no notification action was ever parsed from metadata and no
+    iframe route ever read an embed config. The presentation enums
+    (`NotificationType` / `NotificationSeverity` / `NotificationPosition`) and
+    `SharingConfig` **survive** and are untouched — public form sharing still gates
+    the anonymous endpoints on `allowAnonymous` + `publicLink`.
+    `@object-ui/core`'s `SharingProtocol` keeps `resolveEmbedConfig` /
+    `generateEmbedCode` against a locally declared `EmbedConfig`, so its surface is
+    unchanged.
+  - **`ThemeEngine` stops emitting nine retired CSS variable groups**
+    (objectstack#5021 option 2, PR objectstack#5289). `theme.animation`,
+    `theme.zIndex` and five typography groups (`fontSize` / `fontWeight` /
+    `lineHeight` / `letterSpacing`, plus `fontFamily.heading` / `fontFamily.mono`)
+    are tombstones the schema now rejects by name, so `--duration-*`, `--timing-*`,
+    `--z-*`, `--font-size-*`, `--font-weight-*`, `--line-height-*`,
+    `--letter-spacing-*`, `--font-heading` and `--font-mono` had become structurally
+    dead code — no author could produce the input that reached them.
+    `generateAnimationVars` and `generateZIndexVars` are removed from
+    `@object-ui/core`, and `@object-ui/types` drops `Animation` / `ZIndex` /
+    `AnimationSchema` / `ZIndexSchema`. **`theme.customVars` is the declared — and
+    since #5021 the only — door**: each entry is emitted verbatim as
+    `--<key>: <value>`, so a `--z-modal` or a `--duration-fast` goes there now.
+    LIVE emission is untouched byte for byte: `colors`, `borderRadius`, `shadows`,
+    `typography.fontFamily.base` (→ `--font-sans`) and `customVars`.
+  - **`@object-ui/types`' `HttpMethodSchema` now binds the spec's
+    `HttpMethodSubsetSchema`, and `HttpMethod` binds `HttpMethodSubset`**
+    (objectstack#5832, PR objectstack#5976 — objectui#3499). The spec renamed its
+    5-value UI subset because `schemaNameFromExportKey` strips the `Schema` suffix,
+    so the 5-value and 7-value enums both published as `shared/HttpMethod` and the
+    later write won — the emitted JSON Schema and reference page described only one
+    of them. **The runtime domain is unchanged and this repo's exported names are
+    unchanged**; this follows the rename without touching cross-package semantics.
+    Deliberately NOT re-pointed at the spec's bare `HttpMethod`: that is the 7-value
+    enum, and widening to it would let `method: 'HEAD'` compile and then throw in
+    `HttpRequestSchema.parse()`.
+  - **`dashboard.widgets[].actionUrl` / `actionType` / `actionIcon` / `aria` are
+    refused, not stripped** (objectstack#5010, ADR-0049 enforce-or-remove). A
+    dashboard widget has no action button and never had one — every action the
+    dashboard dispatches comes from `header.actions[]` — and no renderer ever applied
+    the widget `aria`, so it promised accessibility compliance it did not deliver.
+    A stale dashboard now gets a named error telling it where the affordance moved,
+    instead of silently losing it. Run `os migrate meta --from 16` to rewrite.
+
+### Patch Changes
+
+- 3765678: data-objectstack: pass the server's `drillRanges` date-bucket drill scope through `queryDataset` (restores date drill-through)
+
+  `queryDataset` rebuilds its result by **hand-picking** keys off the REST payload,
+  and `drillRanges` was never in the list — so the analytics service's date-range
+  drill sidecar (framework#1752) was dropped by the only real adapter in this repo,
+  while five consumer call sites were already reading it (`DatasetWidget.tsx:471`
+  and `:593`, `DatasetReportRenderer.tsx:316`, `:431`, `:855`).
+
+  The user-visible effect was not a degraded drill but a missing one. A
+  `dateGranularity` dimension groups a **span** of records into one bucket, which
+  equality filters cannot express, so `service-analytics` deliberately excludes
+  date dimensions from `dimensionFields`/`drillRawRows` and sends a parallel
+  half-open `[gte, lt)` range per row instead. For a chart or report grouped **only
+  by time** that makes `drillRanges` the _only_ thing that can make
+  `canDrill = !!object && (drillDims.length > 0 || !!drillRanges?.length)` true —
+  with the key dropped, the entire drill entry point disappeared. A mixed
+  date + non-date grouping kept its drill but built a filter with no time bound, so
+  clicking June's bar opened every month (a superset).
+
+  Neither side's tests could see it: the dashboard and report tests mock their own
+  data source and feed `drillRanges` in directly, and the adapter's own suite never
+  asserted the key. The new adapter-level tests therefore mock the **envelope the
+  server actually sends** — bare (`res.json(result)`, no `{ success, data }`
+  wrapper), carrying `sql`, and for a date-only grouping carrying `object` +
+  `drillRanges` and _no_ `dimensionFields`/`drillRawRows` — then assert the key
+  arrives verbatim and row-aligned, that the consumers' own `canDrill` predicate is
+  true, and that `buildDatasetDrillFilter` (the shared builder both surfaces call)
+  scopes the drilled list to the clicked bucket.
+
+  The declared entry type is `@object-ui/core`'s `DatasetDrillRange` **by
+  reference**, per the objectui#3613/#3752 discipline: it is the single in-repo
+  declaration of this shape (what the filter builder accepts and what both
+  renderers type their state with), and nothing in `@objectstack/spec` owns it yet,
+  so restating `{ field, gte, lt }` locally would create a third dialect of it.
+
+  `drillRawTotals` (the totals-row companion, framework#3214) is deliberately
+  **not** added: it has zero consumers in this repo, so passing it through would
+  add a declared-but-unexercised return key with no user-facing effect — it belongs
+  in the change that lands a totals-row drill and can test it.
+
+- d83f6b3: data-objectstack: type `queryDataset`'s result `fields[]` as the spec's `AnalyticsResult.fields[]` element instead of a hand-written copy
+
+  The return-value half of the drift objectui#3613 fixed on the parameter side. The
+  adapter hand-listed five keys for a result column
+  (`name`/`type`/`label`/`format`/`currency`) and, like every restatement, stopped
+  at the contract of the day it was written: it never grew **`percentScale`**,
+  which `@objectstack/spec@17.0.0-rc.5` carries on
+  `AnalyticsResult.fields[]` and documents as mandatory reading for renderers —
+  "renderers that receive it must scale by it instead of guessing from the value"
+  (objectui#3136).
+
+  That omission was not cosmetic. `percentScale` is the server's answer to a
+  question a `%` format string cannot express (is the stored number a 0–1 fraction,
+  or already percentage points?), and objectui#3136 exists because guessing from
+  the value's magnitude printed a ratio of exactly `1` as "1.0%". Three in-repo
+  consumers read the field through their own local types
+  (`DatasetResultField` in `@object-ui/core`), so nothing was red here — but any
+  author reading columns through the adapter's **declared** return type got
+  `Property 'percentScale' does not exist`, i.e. the declaration actively steered
+  them back to the guess the spec bans.
+
+  `fields` is now the spec type by reference, so there is nothing left to re-sync;
+  the change is additive for existing consumers (one more optional key).
+  `queryDataset.test.ts` pins structural identity with the spec element, pins
+  `percentScale` as the `'fraction' | 'whole'` union rather than a widened
+  `string`, keeps a negative pin against the five-key shape, and adds a runtime
+  test that reads `percentScale` off a result column **through the declared type**.
+
+  The rest of the envelope stays locally declared, deliberately. It is the REST
+  envelope, not an `AnalyticsResult`: the route adds ADR-0021 D2 drill metadata
+  (`object` / `dimensionFields` / `drillRawRows`) on top of the spec result, and
+  this method rebuilds its own object from the payload without copying `sql` — so
+  declaring the envelope as `AnalyticsResult & { … }` would advertise a key the
+  adapter structurally cannot return. A pin records that too.
+
+- 5f08c05: data-objectstack: type `queryDataset(selection)` as the spec's `DatasetSelection` instead of a hand-written copy
+
+  The adapter restated the selection contract inline, field by field, and the copy
+  had drifted three ways from the pinned `@objectstack/spec@17.0.0-rc.5`:
+
+  - **`compareTo.dimension` was required.** It has been optional since
+    objectstack#5011, _because the executor resolves it_: exactly one time
+    dimension carrying a `dateRange` is the one shifted, and zero or several
+    raises a loud error naming the candidates. Requiring it made the compiler
+    demand from every typed caller precisely the consumer-side dimension guess
+    that change forbids — trading a loud executor error for a silently wrong
+    comparison window. No runtime path hit this yet (the dashboard's
+    `DatasetWidget` passes `selection` as `unknown`), but a declaration is a live
+    instruction to anyone calling this client from TypeScript.
+  - **`timeDimensions` was widened to `unknown[]`**, erasing the very entry shape
+    the executor's resolution reads (`{ dimension, granularity?, dateRange? }`),
+    and **`runtimeFilter` to `Record<string, unknown>`**, erasing the
+    `$and`/`$or`/`$not` vocabulary the server parses.
+  - **`dateGranularity` was missing entirely** — the copy had simply stopped at
+    whatever the contract looked like the day it was written, so a typed caller
+    could not bucket a trend by month at all.
+
+  The parameter is now the spec type by reference, so there is nothing left to
+  re-sync. The fix is the removal of the dialect rather than a correction to it:
+  restating a contract owned elsewhere creates a second de-facto dialect of it, and
+  drift is then only a matter of time (AGENTS.md #0/#0.1). `queryDataset.test.ts`
+  pins structural identity with `DatasetSelection` plus each of the three drifts
+  individually, checked by this package's `tsc --noEmit`; a runtime test pins that
+  a dimension-less `compareTo` reaches the server untouched, so the adapter can
+  never start guessing on the executor's behalf.
+
+  The response type is deliberately left alone — it is the REST envelope
+  (`object` / `dimensionFields` / `drillRawRows`), not a restatement of
+  `AnalyticsResult`.
+
+- 41d6022: The console no longer reads `/meta/*` before it knows whether it has a session, and a failed request now says which request failed
+
+  Opening a logged-out console painted ~30 red `HTTP request failed` lines before
+  the login form was drawn. Two independent causes, fixed independently
+  (objectui#4042).
+
+  **1. Requests fired before the session was known.** `ConnectedShellInner` now
+  withholds the metadata tree until `GET /auth/get-session` resolves, so
+  `meta/object` / `meta/view` / `meta/app` are never issued blind. `useAuth()`
+  outside an `AuthProvider` reports `isLoading: false`, so an embed with no auth
+  provider is unaffected, and every protected route already sat behind an
+  `AuthGuard` that resolves auth first — the signed-in data flow is unchanged.
+
+  The console's landing route (`<Route path="/">`) was the actual entry point for
+  the burst: it mounted `ConnectedShell` with no guard above it, so simply opening
+  `/_console/` mounted the whole data layer as an anonymous visitor. It is now
+  guarded, which also means an unauthenticated visitor reaches `/login` without a
+  single doomed request. `examples/console-starter` had the same shape and got the
+  same fix.
+
+  **2. Two requests per type, per mount — not an unauthenticated artefact.**
+  Consumers read metadata during the FIRST render (`useActionModal` reads
+  `objects`, whose getter kicks `ensureType('object')` and `ensureType('view')`
+  from the render phase), before any effect runs. `MetadataProvider`'s preview-mode
+  effect then cleared the whole cache on mount, discarding those two entries while
+  their requests were in flight; the next render found them `idle` and refetched
+  both. The effect now skips its mount run — on mount the cache is empty and there
+  was never anything to drop; it only ever meant something on a later
+  `previewDrafts` change. That halved `meta/object` and `meta/view` on **every**
+  mount, signed in included.
+
+  A second duplicate only appeared once a read had failed: `entry.promise`
+  collapses callers that arrive while a request is in flight, but callers arriving
+  just after a failure each started a fresh attempt. A failed type now stays
+  un-retried for ~1s, which collapses one mount's burst of callers into a single
+  attempt. This is deliberately not the 5-minute `ttlMs` — later callers still
+  retry on their own, and `refresh()` / `invalidate()` retry immediately and
+  unconditionally, so no explicit recovery path changes.
+
+  **3. `HTTP request failed` now identifies the request.** `@objectstack/client`
+  reports every non-2xx as
+  `logger.error("HTTP request failed", undefined, { method, url, status, error })`,
+  and the console's logger forwarded that verbatim — so the identifying fields
+  lived only in the third argument, and anything that flattens a console record to
+  text rendered them `[object Object]` / `Object`. A screenful of failures could
+  not tell you a single URL or status. The message string now carries them:
+
+  ```text
+  HTTP request failed: GET /api/v1/meta/object -> 401 [UNAUTHORIZED]
+  ```
+
+  The structured bag is still passed alongside for DevTools to expand — text for
+  the flatteners, object for the inspectors, neither at the other's expense. The
+  formatter is exported as `formatHttpFailureMessage`, and `createQuietHttpLogger`
+  is now exported too so an app wiring its own `ObjectStackClient` gets the same
+  identified failures.
+
+  Nothing is newly silenced. The only demotion remains 404-on-an-optional-
+  collection (`sys_presence`, `sys_activity`), which is an expected outcome of a
+  request we still mean to make; a 401 that survives the session gate — a
+  mid-session expiry, say — stays a visible, fully-identified error. The cure for
+  doomed requests is not issuing them, never hiding them once issued.
+
+- 7e2b7e9: Fix saved list-view preferences never reading back (density, column widths, sort, hidden columns, inline edit)
+
+  `listViewOverrides` in the ObjectStack adapter enumerated `GET /api/v1/meta/{objectName}` — putting the object name in the metadata **type** slot — while `updateViewConfig` persists under `type='view'`. The two key spaces are disjoint, so the batch map came back empty for every object and every personalization a user saved on a list view was written to the server but never read back, showing up as "the setting didn't save".
+
+  The read now enumerates `type='view'` once and narrows to the object client-side, through the same accessor `listViews()` uses over the same rows — the metadata index is name-only, so there is no server-side `?object=` filter to push it into.
+
+  Second half: the batch read no longer swallows its own failures into an empty map. An empty map is an authoritative "this object has no overrides" and callers may still trust it and skip the per-view reads (the batch optimization is intact), but a transport failure now rejects, so the per-view `getView` fallback it was silently disabling becomes reachable again. `DataSource.listViewOverrides` documents both terms so other adapters implement the same contract.
+
+- Updated dependencies [6719877]
+- Updated dependencies [56ff091]
+- Updated dependencies [d229dfa]
+- Updated dependencies [4bc6c23]
+- Updated dependencies [c3b01a7]
+- Updated dependencies [e06810e]
+- Updated dependencies [ab3ad4f]
+- Updated dependencies [c2fd122]
+- Updated dependencies [48132f7]
+- Updated dependencies [1d723e3]
+- Updated dependencies [0109f54]
+- Updated dependencies [7e5bb5d]
+- Updated dependencies [fbc23e0]
+- Updated dependencies [e6fdbdc]
+- Updated dependencies [6bb454a]
+- Updated dependencies [523be48]
+- Updated dependencies [7e2b7e9]
+- Updated dependencies [c1e1e6b]
+  - @object-ui/core@17.4.0
+  - @object-ui/types@17.4.0
+
 ## 17.3.0
 
 ### Minor Changes
@@ -1022,6 +1330,7 @@ ${order}"` is exactly the shape `ObjectGrid` builds from its view metadata's
   objects+fields were editable in Studio; this reworks both surfaces.
 
   **Setup (assign + read-only):**
+
   - The six facets (`object_permissions`, `field_permissions`, `system_permissions`,
     `row_level_security`, `tab_permissions`, `admin_scope`) now render read-only on
     the `sys_permission_set` record page as a compact summary (counts, or capability
@@ -1036,6 +1345,7 @@ ${order}"` is exactly the shape `ObjectGrid` builds from its view metadata's
 
   **Studio (design every facet):** the permission matrix editor gains structured
   editors for the facets that were JSON-only —
+
   - **System Capabilities**: a multi-select over the live `sys_capability` registry
     (scope-grouped, labelled chips).
   - **Row-Level Security**: per-policy rows (object · operation · enabled) with CEL
@@ -1052,6 +1362,7 @@ ${order}"` is exactly the shape `ObjectGrid` builds from its view metadata's
   record the Setup summary reads, so a fresh Studio edit isn’t reflected in Setup’s
   read-only view until the projection refreshes — tracked as a framework follow-up
   (enforcement reads the authoritative metadata).
+
   - @object-ui/types@13.2.0
   - @object-ui/core@13.2.0
 
@@ -1359,6 +1670,7 @@ ${order}"` is exactly the shape `ObjectGrid` builds from its view metadata's
 
   **`@object-ui/plugin-designer`** — two new route-ready pages that
   together close the "Data Model" management loop in the Setup app:
+
   - `MetadataObjectsPage` — lists every object schema (via
     `MetadataClient.list('object')`), renders the existing
     `ObjectManager`, and persists edits/deletes through PUT/DELETE on
@@ -1389,6 +1701,7 @@ ${order}"` is exactly the shape `ObjectGrid` builds from its view metadata's
   the Setup app → _All Metadata Types_.
 
   ### New: `@object-ui/app-shell` views/metadata-admin
+
   - **`MetadataDirectoryPage`** — auto-grouped tile directory by domain, with
     free-text search, domain chips, and a _Writable only_ filter.
   - **`MetadataResourceListPage` / `MetadataResourceEditPage` / `…CreatePage` / `…HistoryPage`** —
@@ -1412,6 +1725,7 @@ ${order}"` is exactly the shape `ObjectGrid` builds from its view metadata's
     `t(key)` helper.
 
   ### New routing variant
+
   - App nav now supports `{ type: 'component', componentRef, params? }` items.
     `AppContent` resolves them through the existing `ComponentRegistry`.
   - Built-in components registered: `metadata:directory`, `metadata:resource`,
@@ -1420,12 +1734,14 @@ ${order}"` is exactly the shape `ObjectGrid` builds from its view metadata's
     / page.
 
   ### Plugin-designer
+
   - Lazy-exported `ObjectManager`, `FieldDesigner`, `ObjectViewConfigurator`,
     `DashboardEditor`, `PageCanvasEditor`, `MetadataObjectsPage`, and
     `MetadataFieldsPage` so the engine can mount them on demand.
 
   The temporary `/dev/meta` route is removed. Setup app navigation flows
   through the new component routes.
+
   - @object-ui/types@6.2.0
   - @object-ui/core@6.2.0
 
@@ -1533,6 +1849,7 @@ ${order}"` is exactly the shape `ObjectGrid` builds from its view metadata's
 
   Extract the bulk-vs-per-row decision into a reusable
   `executeBulkBatch(input, ops)` helper in `@object-ui/core`:
+
   - Single decision tree shared by both update and delete fast paths.
   - Bulk success → no per-row pass.
   - Bulk partial-count → aggregate batch error.
@@ -1576,6 +1893,7 @@ ${order}"` is exactly the shape `ObjectGrid` builds from its view metadata's
   multi-user editing scenarios.
 
   **`@object-ui/data-objectstack`**
+
   - Exports `ConcurrentUpdateError` (carries `currentVersion` and
     `currentRecord`) and `isConcurrentUpdateError()` type guard.
   - `update()` / `delete()` accept `opts.ifMatch` and forward it via the
@@ -1588,6 +1906,7 @@ ${order}"` is exactly the shape `ObjectGrid` builds from its view metadata's
     from conflicts without parsing the wire format.
 
   **`@object-ui/core`**
+
   - `ApiDataSource.update()` and `.delete()` accept `opts.ifMatch` and emit
     the `If-Match` HTTP header.
 
@@ -1630,6 +1949,7 @@ ${order}"` is exactly the shape `ObjectGrid` builds from its view metadata's
   their settings.
 
   The adapter now defaults to:
+
   - `resource`: `sys_user_preference`
   - field shape: `(user_id, key, value)` instead of `(user_id, kind, payload)`
   - option name: **`key`** instead of `kind`
diff --git a/packages/data-objectstack/package.json b/packages/data-objectstack/package.json
index bd6d51fc3c..176c4e6b43 100644
--- a/packages/data-objectstack/package.json
+++ b/packages/data-objectstack/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/data-objectstack",
-  "version": "17.3.0",
+  "version": "17.4.0",
   "description": "ObjectStack Data Adapter for Object UI",
   "license": "MIT",
   "type": "module",
diff --git a/packages/fields/CHANGELOG.md b/packages/fields/CHANGELOG.md
index 2486c27540..cc718314e7 100644
--- a/packages/fields/CHANGELOG.md
+++ b/packages/fields/CHANGELOG.md
@@ -1,5 +1,326 @@
 # @object-ui/fields
 
+## 17.4.0
+
+### Minor Changes
+
+- ecae400: Retire the `capability-multiselect` field widget name, which existed only on the docs-site registration path and which nothing ever stamped (objectui#3308, ADR-0049 enforce-or-remove)
+
+  `field:capability-multiselect` was registered by `registerFields()` and only there. That function's sole caller is the docs site, so the key never existed on the live path (`registerAllFields()`, run at module import, iterates `fieldWidgetMap` — which never listed it). A field authored with `widget: 'capability-multiselect'` therefore resolved to nothing in every real application, while the comment above the registration described it as usable from a record form: a code comment promising a capability that does not exist, which is the worst direction for a metadata renderer AI-authored apps read as authority.
+
+  Nothing stamped the hint either. ADR-0056 P1 stamps `permission-facet-link` on all six `sys_permission_set` facets — `system_permissions` included — through the single `ObjectStackAdapter.getObjectSchema` choke point, and P2 put the capability editor in Studio. The widget name was a leftover from an intermediate iteration of that rollout.
+
+  Removed, with a tombstone at each site:
+
+  - `@object-ui/fields` — the `field:capability-multiselect` registration and the comment that advertised it. **Breaking in name only**: the key was unreachable outside the docs site, so no application could have resolved it. A field still carrying the hint now degrades to its declared `type` renderer, the defined behavior for an unregistered widget.
+  - `@object-ui/plugin-detail` — `InlineFieldInput`'s `widget === 'capability-multiselect'` branch, the hint's last honoring surface. Leaving one consumer for a name no producer emits and no form resolves is the same declared-vs-enforced split, inverted. The sibling `permission-facet-link` branch is untouched and pinned.
+  - `@object-ui/components` — the dead `capability-multiselect` entry in the form renderer's `DATA_SOURCE_FIELD_TYPES` set, which could never match a resolvable widget.
+  - `@object-ui/plugin-form` — a comment naming `capability-multiselect` as the widget stamped onto `sys_permission_set.system_permissions`; it names `permission-facet-link` now, which is what is actually stamped.
+
+  `CapabilityMultiSelectField` itself is **unchanged and still exported**: Studio's `PermissionMatrixEditor` imports and renders it directly, which is ADR-0056 P2's design. Only the widget name is retired — the component is not a registry field widget and its doc comment now says so.
+
+  `registerFields()` is also **kept**, with its `@deprecated Use registerAllFields() instead` note corrected. The two are not interchangeable: it registers `createFieldRenderer(widget)`, which synthesizes the label, description and the local `value`/`onChange` state that lets a bare field node (`{ type: 'currency', label: 'Amount' }`) render standalone in the docs demos. Retiring it needs a decision about where that demo chrome goes; the note now records that instead of implying a drop-in replacement.
+
+- 65bb513: fields: remove the docs-demo registration path (`registerFields` + `createFieldRenderer`), and host the docs field examples in a real form
+
+  **Breaking (shipped as `minor` per AGENTS.md §版本号策略 — objectui's major tracks `@objectstack`, so the repo's own breaking changes are `minor` with the break spelled out here):** two public exports are removed from `@object-ui/fields`:
+
+  - `registerFields()` — registered every widget under the same `field:<type>` keys as `registerAllFields()`, but wrapped in a demo-only renderer. Two paths writing the same registry keys meant whoever ran LAST won it for every consumer sharing the registry.
+  - `createFieldRenderer()` — that wrapper. It synthesized a `label`, a description, and a local `useState`/`onChange` around a widget.
+
+  **Migration:** there is nothing to migrate for an application. `registerAllFields()` runs on import of `@object-ui/fields` and is the one registration seam (`registerField(type)` for a single type); no shipped application ever called the removed pair — the docs site was the only caller. Code that rendered a **bare field node** standalone (`{ type: 'currency', label: 'Amount' }`) and relied on the wrapper for label and value state must host the field in a form instead: `{ type: 'form', fields: [{ name: 'amount', label: 'Amount', type: 'currency' }] }`. Seed values through the form's `defaultValues`, not a field-level `value`.
+
+  **Why the removal rather than a relocation** (ruling B of objectui#3798, confirmed by the maintainer; objectui#3308 is the origin, PR #3793 the safety net that first corrected the misleading `@deprecated` note): the wrapper existed only so the documentation could render a bare field node as a labelled, editable input. No application produces that rendering — on the live path a bare field node has no host for its label or its value. So the field docs, which are a first-hand transcription source for AI authors, were teaching a shape that does not work, and an author copying it got a node with neither label nor `onChange`. Relocating the wrapper into the docs site would have preserved that divergence under a new owner. Hosting the examples in a real form removes the reason for the wrapper to exist: the form renderer already owns label and value state, so the docs can only show what an application actually renders.
+
+  The 74 bare-node examples under `examples/schema-catalog/src/schemas/fields-*` are now form-hosted (the other 2 already were). A field's `value` moved to the form's `defaultValues`, because the form renderer spreads react-hook-form's state after the schema props and a field-level `value` is therefore ignored — a catalog guard now pins that so a dead `value` cannot come back.
+
+- b19162d: Build and publish `@object-ui/fields/style.css` — the subpath the package has always declared and never shipped
+
+  `packages/fields/package.json` has declared `"./style.css": "./dist/index.css"` for the package's entire life, while its build was `tsc && vite build` and the package contained no `.css` file for Vite to extract. **No published version up to and including 17.3.0 contains a stylesheet** — the `@object-ui/fields@17.3.0` tarball has zero `.css` files in it. The subpath did not merely render badly, it failed to resolve: a consumer writing the `@import '@object-ui/fields/style.css'` that the quick-start guide taught got a build error. This release is the first one where that import works, so it is a new capability rather than a repair of a working one, and no existing consumer can be relying on the old behaviour — an import that never resolved has no working callers.
+
+  Removing the export was the cheaper option and was rejected on a measurement: fields' class surface is not a subset of what `@object-ui/components` publishes. 155 classes exist only here, and 17 of them (`hover:bg-accent/30`, `ring-destructive/50`, `bg-primary/20`, …) resolve `@theme` tokens declared in unpublished package source, so no consumer-side Tailwind configuration can generate them. Dropping the export would have made the field widgets permanently under-styled with no supported remedy.
+
+  The new sheet is a **supplement, not a replacement** — it is compiled against the components theme and then has every rule that package's sheet already ships subtracted from it, so it is ~22 kB rather than another ~180 kB of near-duplicate CSS. Import it after the components sheet:
+
+  ```css
+  @import "tailwindcss";
+  @import "@object-ui/components/style.css";
+  @import "@object-ui/fields/style.css";
+  ```
+
+  Also adds a workspace-wide guard (`scripts/__tests__/package-files-exist.test.ts`) that fails when any package exports a subpath its published tarball cannot contain, so a stylesheet export with nothing building it cannot recur silently.
+
+- 1bd6faa: fix(fields,plugin-form): stop the inline child grid from collapsing `datetime`/`time` columns onto the `date` control
+
+  `deriveMasterDetail`'s `fieldTypeToColumnType` mapped `date`, `datetime` and `time` onto the single `date` grid column type, and `GridField` renders that as `<input type="date">`. The consequence was not cosmetic: that control emits a bare `YYYY-MM-DD` on change, so a user who merely re-picked the **day** of a `datetime` cell silently wrote the record's time component out of existence — a `14:30` became midnight with no warning and no undo.
+
+  `GridColumn['type']` now carries `'datetime'` and `'time'` alongside `'date'`, and each renders its own control with its own read/write adapter:
+
+  - `datetime` → `<input type="datetime-local">`, read through `toDateTimeInputValue` and written back through `fromDateTimeInputValue`, so the stored shape stays ISO-8601 and read and write share one basis (the contract `DateTimeField` already follows, objectui#3127).
+  - `time` → `<input type="time">`, round-tripping the stored zone-less `HH:mm[:ss]` verbatim.
+  - `date` → unchanged.
+
+  The read-only surfaces are fixed with it. `displayText()` and the read-only table both fell through to `String(value)` and printed the raw stored ISO on screen (`2026-06-17T00:00:00.000Z`); each temporal type now formats as itself — a day for `date`, day + local time for `datetime`, the wall clock for `time`. That could not be fixed before the type collapse was undone, because with one column type the renderer had no way to know which of the two to show.
+
+  Authors writing explicit grid `columns` can now declare `type: 'datetime'` / `type: 'time'`; previously those spellings were not part of the exported union.
+
+### Patch Changes
+
+- 0186cdc: `address` widget: the ZIP box now reads and writes `postalCode`, the part name the platform stores
+
+  `AddressField` bound its ZIP input to `zipCode` — a part name that appears
+  nowhere in `@objectstack/spec`. The stored value uses `postalCode`, which
+  `AddressValueSchema` declares and enforces with `$strip` semantics, so the two
+  sides never met:
+
+  - opening a stored address showed an **empty** ZIP box (no input read
+    `postalCode`), while street / city / state / country all populated — four of
+    five parts working is what let this survive review;
+  - anything the user then typed into that box was written back as `zipCode` and
+    **stripped at the contract boundary**. On a new record the postal code was
+    lost outright; on an existing one the correction was silently discarded and
+    the stale stored code remained, with no error anywhere.
+
+  The widget now uses `postalCode` throughout — state key, sub-input id, the
+  `onChange` part name and the read-only formatter. Data written by the previous
+  builds is still **read** through `zipCode` as a compatibility limb, and the
+  first edit of any part normalizes such a record onto `postalCode` rather than
+  writing the split shape back out. Nothing writes `zipCode` any more, and it is
+  deliberately not part of the exported `AddressValue` type, so authoring code
+  cannot spell it.
+
+  `AddressValue` is otherwise unchanged in shape; consumers that referenced
+  `AddressValue['zipCode']` must read `postalCode`.
+
+  Fixes objectstack-ai/objectstack#5143.
+
+- ea41a59: fix(fields): `BooleanField` uses the control id its host hands down, so a boolean field's visible label is really associated with the switch
+
+  A `boolean` / `checkbox` field inside a form emitted **two** labels with the same text, and the visible one pointed at nothing. `<FormControl>` (a Radix `Slot`) hands the control the id its `<FormLabel htmlFor>` already references, and the widget replaced it with the field name — so `label for="_r_3_-form-item"` had no target while the switch carried `id="notifications"`. Clicking the visible label, the normal affordance for a switch/checkbox row, toggled nothing on every generated form in every app; the accessible name survived only through the widget's own `sr-only` label.
+
+  The widget now honours the id it was handed (`id` is a declared key of the widget contract, forwarded by `toDomProps`) and stops emitting its own label when a host supplied one. Standalone rendering is unchanged: with no host id the id still falls back to the field name and then to `useId()`, and the `sr-only` label — the only accessible name the inline grid editor and the console's action-param dialog have — is still emitted.
+
+- c3b01a7: Give composite and grouped field widgets a real accessible name: the form renderer now associates its label by IDREF for widgets that declare `labelling: 'group'`, instead of emitting a `<label for>` that nothing labelable answers (objectui#3961).
+
+  Six widgets rendered a visible group label that named **nothing** in the accessibility tree. Measured in a real form, one field per row, reading each label's `for` against the DOM:
+
+  ```
+  address      for=…-form-item -> MISSING            byLabelText=0   role+name=0
+  geolocation  for=…-form-item -> MISSING            byLabelText=0   role+name=0
+  checkboxes   for=…-form-item -> div                byLabelText=0   role+name=0
+  radio        for=…-form-item -> div[radiogroup]    byLabelText=0   role+name=0
+  rating       for=…-form-item -> div                byLabelText=0   role+name=0
+  file         for=…-form-item -> div[role=button]   byLabelText=0   role+name=0
+  ```
+
+  Two shapes, one outcome. `address` / `geolocation` spread the host's id onto their first sub-input and then replaced it with that input's own unique id (objectui#3343, correct in itself), so the `for` named an id no element carried — clicking "Shipping Address" did nothing and the group label was absent from the accessibility tree entirely. `checkboxes` / `radio` / `rating` / `file` kept the id, but on a `div`: a `<label for>` on a non-labelable element is inert HTML — `HTMLLabelElement.control` is `null`, so it activates nothing and contributes no name. A screen reader heard "Street Address", "City", "Alpha", "Beta" — never which group they belonged to.
+
+  The fix is the WAI-ARIA group pattern, driven by a DECLARATION rather than by the host guessing at widget DOM:
+
+  - `@object-ui/core` — `ComponentMeta` gains `labelling?: 'control' | 'group'`. Additive and optional; absent means `'control'`, which is every existing component's behaviour.
+  - `@object-ui/components` — the form renderer reads it. For a `'group'` field the `<FormLabel>` publishes an `id` and drops its `for`, and the widget receives `aria-labelledby`. The single-control path is unchanged down to the attribute: no id on the label, no `aria-labelledby` key on the widget, so no field acquires a second naming channel. `ui/form.tsx` is untouched (Shadcn no-touch) — both halves travel as ordinary props, since `<FormLabel>` spreads props after its own `htmlFor`.
+  - `@object-ui/fields` — the six audited widgets declare `labelling: 'group'`. `address` / `geolocation` move the host id (and only the id) from their first sub-input to the group container; `checkboxes` / `rating` answer a host-supplied `aria-labelledby` with `role="group"`; `radio` keeps Radix's more specific `radiogroup`; `file` takes the name on its dropzone with no invented group layer, because it has exactly one control that merely happens not to be labelable.
+
+  No new key in the widget props contract: `aria-*` is already declared on it and forwarded by `toDomProps`, the same channel `aria-required` (objectui#3290) travels.
+
+  Deliberately unchanged: sub-labels keep naming their own inputs (`aria-labelledby` overrides `<label for>`, so putting the group name on the first sub-input would have replaced "Street Address" with the field name — the concatenated-name outcome this issue rejected), `aria-describedby` stays on the first focusable sub-input where focus can reach it (objectui#3318), the sub-input ids of objectui#3343 do not move, and standalone rendering — the inline grid editor, a bare SDUI node, where nobody hands down an id and there is no host label to point at — emits no role and no IDREF at all.
+
+  A widget that does not declare itself keeps the old `for`, which the label-association tests report as an association resolving to a non-labelable element. Silence was the failure mode being fixed; the default path stays loud.
+
+- c97a45e: Group-labelled field widgets now consume the host label's IDREF in their readonly and zero-option states, so the visible label names something there too
+
+  A field declared `labelling: 'group'` (objectui#3961) is named by IDREF: the form
+  renderer publishes its `<FormLabel>`'s own `id`, drops the inert `for`, and hands
+  the widget `aria-labelledby` plus the host control `id`. All seven such widgets
+  consumed that pair on their editable surface only. A field-level
+  `readonly: true`, and an option list that resolved to zero offered options, take
+  early returns that render before the container doing the consuming — so the label
+  published an id that no element in the document referenced.
+
+  Measured on the previous `main`, one field per row in a real form, counting the
+  elements that reference the host label's published id:
+
+  ```
+                               consumers  byLabelText  named group
+  multiselect  readonly+value      0           0           0
+  multiselect  readonly+empty      0           0           0
+  multiselect  zeroOptions         0           0           0
+  multiselect  editable            1           1           1
+  ```
+
+  All seven measured identically in every readonly state; each is 1 now. The
+  user-visible effect is the one objectui#3961 fixed for editable fields: the
+  visible label was the accessible name of NOTHING, so a readonly "Tags" or
+  "Shipping Address" was announced as loose text next to unattributed values. It is
+  not a regression of #3961 or objectui#3975 — before them these same states
+  emitted a `for` pointing at an id no element carried, which named nothing either.
+  The shape changed from a dangling `for` to an unconsumed IDREF; the defect did
+  not.
+
+  Each readonly surface now carries exactly two keys — the host `id` and
+  `aria-labelledby` — plus the `role="group"` that makes them meaningful, in one
+  shared spelling (`toHostGroupProps`). The narrow pair is deliberate: a readonly
+  display has no focusable control, so `aria-describedby` / `aria-required` /
+  `disabled` / the focus handlers have nothing to announce on, and `name` on a
+  `div` is exactly the DOM leak objectui#3291 sweeps for.
+
+  Two widgets answer with a different role than they do while editable, because
+  they render a different surface: `radio` (editable `radiogroup`) shows the chosen
+  option's label as text with no radios in it, and `file` (editable `button`, the
+  dropzone) shows file names with no dropzone. `role="group"` is also what the
+  shared "no options available" box now answers with for `checkboxes` / `radio` /
+  `multiselect`; the single `select` is not group-labelled, keeps its working
+  `for`, and that box emits nothing new for it.
+
+  Standalone rendering is untouched. The grid's inline cell editor and bare SDUI
+  nodes hand down neither key, so nothing is emitted and the markup stays
+  byte-identical — including the `EmptyValue` placeholder, which keeps its own
+  `aria-label` and gains no role. Hosted-and-empty, that placeholder is the whole
+  readonly surface, so it carries the group props: its `aria-label` ("No value") is
+  then outranked by `aria-labelledby` per accname, which is the intended outcome —
+  on the `generic` role that span carries, an author name is prohibited and was
+  never exposed, so the choice was between the field's name and no name.
+
+- d8a0be4: A form-hosted `multiselect` field is now NAMED by its visible label. It was the
+  residual of objectui#3961: that issue's probe audited six widgets and fixed
+  them, and re-running the same probe over the whole widget map afterwards put
+  `multiselect` on the byte-identical failure shape as `checkboxes` — the host's
+  `id` kept, but on the chip row's wrapper `div`, where a `<label for>` is inert
+  HTML (`HTMLLabelElement.control` is `null`, so it activates nothing and
+  contributes no accessible name). Measured on the tree that already carried
+  #3961's fix, one field per row:
+
+  ```
+  checkboxes   for=(none) ownId=…-group-label   byLabelText=1(div[role=group])
+  multiselect  for=…-form-item ownId=(none)     byLabelText=0
+  ```
+
+  Visually the field had a "Tags" label; a screen reader heard only "Alpha" /
+  "Beta" and nothing about what the set of chips was for.
+
+  No new mechanism — #3961's declaration, applied to one more widget:
+  `multiselect` declares `labelling: 'group'` at the registration boundary, so
+  the form renderer publishes its label's `id` and drops the dead `for`, and the
+  chip row answers with `role="group"` + the handed-down `aria-labelledby`.
+
+  Unchanged on purpose: each chip keeps its own accessible name from its text
+  content (the group name sits one level up and does not override it), and
+  STANDALONE rendering — the grid's inline cell editor, a bare SDUI node, where
+  nobody hands an id and there is no host label to point at — emits no role and
+  no IDREF, exactly as before.
+
+- f4b97c8: `percent` / `progress` cells now give the NUMBER shrink priority over the decorative bar (objectstack#5066)
+
+  In a narrow clipping container the percent display renderer sacrificed the wrong
+  half of itself. It emitted a `w-16 shrink-0` bar in front of a shrinkable value
+  span, so in a `record:highlights` chip — `basis-[9rem]`, shrinking toward
+  `min-w-[7rem]` as chips are added, clipping with `truncate` — the 64px bar plus
+  the 8px gap consumed the content box and `truncate` removed what was left of the
+  value. A stored `33.33` carried `33%` in the DOM and read as `3` on screen
+  (measured: 79px clip box, 32px text node, 25px overflow), with no ellipsis and
+  nothing in the accessible name to signal the loss: a silently smaller, plausible
+  number rather than a cosmetic glitch. Downstream the app had to override the
+  highlight's render type to `number` to get its digits back, losing the `%` glyph
+  and the bar entirely.
+
+  The priority is now inverted, on the principle that the number is the CONTENT and
+  the bar is DECORATION: the value span is `shrink-0` and the bar carries
+  `min-w-0 shrink`, keeping `w-16` only as its PREFERRED width, so a squeezed
+  container eats the bar and the digits survive intact.
+
+  The bar is deliberately NOT `flex-1`. `flex-1` would let it GROW as well as
+  shrink, stretching the bar across every wide grid cell and changing a surface
+  that has no bug; `w-16` stays the upper bound, so wide containers render exactly
+  as before and only the shrink direction changed. Below roughly 40px of content
+  the bar has collapsed to nothing and the value clips like any other single-line
+  cell — same floor as the plain number renderer, which is as far as a
+  self-contained renderer fix reaches (the chip's own width is a function of how
+  many chips the record has, so the strip's `@container` cannot see it).
+
+  The neighbouring `number` renderer is untouched.
+
+- c2ecbae: 相关列表 Add 选择器兑现 `add.picker.filter`:作者限定的候选范围现在真的生效
+
+  `record:related_list.add.picker.filter` 被 spec 声明为「Restrict which records the picker offers」,但渲染器从未读过它 —— 挂 `RecordPickerDialog` 时不传任何 filter,对话框照样提供 `picker.object` 的全部记录,选中即建链接行或改父,`os validate` / `os build` 全绿、运行时零诊断。作者写下「只允许指派 active 的岗位」「只允许挂未过期的许可」,得到的是完整候选列表。
+
+  现在它按原样传给 `RecordPickerDialog` 的 `baseFilter` —— 不是 `lookupFilters`,后者会把条件渲染成用户可编辑的筛选栏行,等于把作者的硬性限制降级成建议。
+
+  `baseFilter` 因此接受两种形状,按结构判别(`Array.isArray`):
+
+  - **`QueryParams.$filter` 记录形式**(依赖型 lookup 链)保持原有的键覆盖语义逐字节不变 —— 级联父值必须**替换**同字段上过期的 `lookupFilters` 条目,而不是与之求交。
+  - **spec 的 `ViewFilterRule[]`** 经 `mergeFilterNodes`(仓内唯一的 filter 下沉口)下沉,19 个 operator 全部无损到达服务端,包括记录形式没有 `$op` 可用的 `before` / `after` / `is_empty` / `is_not_empty`。此处**不新增**第二份 operator 词汇表。
+
+  槽位类型同时从 `Record<string, any>` 收紧为 `unknown`:前者会接受规则数组(数组满足 `any` 的字符串索引),旧的对象展开再把它压成 `{"0": {...}}`,于是查询去过滤名为 `0` 的列 —— 类型全绿、查询错误、无任何诊断。
+
+- 11c1e71: Resolve a `select` field declared `multiple: true` to the `field:multiselect` widget, so the object form's visible label actually names the chip picker it renders (objectui#3986).
+
+  `mapFieldTypeToFormType` keyed the widget id on the field's `type` string alone, so an object-schema `{ type: 'select', multiple: true }` picklist — a spec-legal, entirely ordinary shape — became `field:select`. `SelectField` then delegated to `MultiSelectField` on `config.multiple`, so the component that RENDERED was the chip picker while everything keyed on the widget id still answered for the single-value combobox. Above all the label-association declaration (`ComponentMeta.labelling`, objectui#3961), which the form renderer resolves per widget id: the host emitted `<label for>` at the chip row's wrapper `div`, where a `for` is inert — `HTMLLabelElement.control` returns `null`. Visually the field had a label; in the accessibility tree that label named nothing. Measured on the object-form path, `role=group` + accessible name went from 1 for a `multiselect`-typed field (fixed in objectui#3975) to 0 for this one.
+
+  Declaring `select` itself `labelling: 'group'` was not available: a single-value select's trigger is a labelable `button[role=combobox]` whose `for` association works, and a bare `select` is a builtin the renderer resolves without consulting the registry at all. The fix is therefore at the producer — the widget id now carries the arity, so one place decides which widget renders and the declaration can no longer be addressed to a widget that is not rendering.
+
+  - `mapFieldTypeToFormType(fieldType, config?)` takes an optional second argument — the rest of the field definition, of which only `multiple` is read. Existing single-argument calls are unchanged, and so is every type outside the new table: `select` is the only one whose `multiple` form is a different WIDGET. The spec's multi-capable set is larger (select / lookup / file / image, with `radio` on the select branch and `user` storing like `lookup`), but `LookupField`, `FileField` and `ImageField` each render both arities themselves, so their id — and their labelling declaration — is already right for either.
+  - The four object-form producers pass the pair: `ObjectForm`, `DrawerForm`, `ModalForm`, and `sectionFields` (Tabbed / Wizard / Split / Drawer / Modal). In `sectionFields` the id is now computed once from the EFFECTIVE pair, after view-level overrides have merged, because `multiple` is itself a spec `FormField` key: a view restating only `multiple: true` over a single-value object field moves the widget too, and `multiple: false` moves it back.
+  - `SelectField`'s `multiple` delegation is KEPT, not retired. Measured, it stays reachable from three entrances that never consult the alias map: the inline grid editor (`FieldEditWidget` finds `select` in its own table first), `ActionParamDialog` (`resolveFormWidgetType` returns `select` from `fieldWidgetMap` first), and hand-written SDUI addressing `field:select` by name with `multiple` on its metadata.
+
+  Read-only rendering of these widgets is untouched (objectui#4005), as is the built-in `Select` branch (objectui#3976).
+
+- Updated dependencies [794c497]
+- Updated dependencies [993336f]
+- Updated dependencies [f0a625a]
+- Updated dependencies [b5980f4]
+- Updated dependencies [8aad9fd]
+- Updated dependencies [6719877]
+- Updated dependencies [56ff091]
+- Updated dependencies [7864f03]
+- Updated dependencies [0cbdca8]
+- Updated dependencies [d229dfa]
+- Updated dependencies [ecae400]
+- Updated dependencies [4bc6c23]
+- Updated dependencies [d3e738a]
+- Updated dependencies [c3b01a7]
+- Updated dependencies [f5f8744]
+- Updated dependencies [7ed3360]
+- Updated dependencies [69becd2]
+- Updated dependencies [5e52495]
+- Updated dependencies [0fa5e4d]
+- Updated dependencies [b750823]
+- Updated dependencies [5bfaabd]
+- Updated dependencies [e06810e]
+- Updated dependencies [ab3ad4f]
+- Updated dependencies [c2fd122]
+- Updated dependencies [ac2139c]
+- Updated dependencies [b14ab3a]
+- Updated dependencies [e24d767]
+- Updated dependencies [8c60819]
+- Updated dependencies [aca561a]
+- Updated dependencies [e64a52e]
+- Updated dependencies [844d17f]
+- Updated dependencies [48132f7]
+- Updated dependencies [4dcd52a]
+- Updated dependencies [42ae5c6]
+- Updated dependencies [0ef9dfd]
+- Updated dependencies [1d723e3]
+- Updated dependencies [0109f54]
+- Updated dependencies [7e5bb5d]
+- Updated dependencies [fbc23e0]
+- Updated dependencies [6d762da]
+- Updated dependencies [e6fdbdc]
+- Updated dependencies [54233b1]
+- Updated dependencies [f9faa7d]
+- Updated dependencies [97b63d7]
+- Updated dependencies [6bb454a]
+- Updated dependencies [523be48]
+- Updated dependencies [7e2b7e9]
+- Updated dependencies [33526fd]
+- Updated dependencies [32413ec]
+- Updated dependencies [c1e1e6b]
+  - @object-ui/components@17.4.0
+  - @object-ui/react@17.4.0
+  - @object-ui/core@17.4.0
+  - @object-ui/i18n@17.4.0
+  - @object-ui/types@17.4.0
+  - @object-ui/providers@17.4.0
+
 ## 17.3.0
 
 ### Minor Changes
@@ -60,6 +381,7 @@ first`. The form renderer passes a new `dependsOnLabels` widget prop (the
   so that line filtered nothing — the comment actively misled. It is gone.
 
   ## What changed
+
   - New `toDomProps(props)`, exported from `@object-ui/fields`. It keeps only
     what may legitimately become a DOM attribute and drops the rest.
   - The 14 field widgets that spread onto a host element now go through it:
@@ -245,6 +567,7 @@ props}` _alongside_ `field`. The predictable result was ~30 widgets resolving
   compile time rather than work under one host and not another.
 
   ## What did NOT change
+
   - **Host metadata (SDUI JSON) is untouched.** No authored schema changes; this is
     a change to how widgets are _written_, not to what apps declare.
   - **`schema` is still the universal SDUI prop** every registered component
@@ -1666,6 +1989,7 @@ pi-TgoJ4_DM55Fqz` — untranslated, and leaking the object's machine name and th
   objects+fields were editable in Studio; this reworks both surfaces.
 
   **Setup (assign + read-only):**
+
   - The six facets (`object_permissions`, `field_permissions`, `system_permissions`,
     `row_level_security`, `tab_permissions`, `admin_scope`) now render read-only on
     the `sys_permission_set` record page as a compact summary (counts, or capability
@@ -1680,6 +2004,7 @@ pi-TgoJ4_DM55Fqz` — untranslated, and leaking the object's machine name and th
 
   **Studio (design every facet):** the permission matrix editor gains structured
   editors for the facets that were JSON-only —
+
   - **System Capabilities**: a multi-select over the live `sys_capability` registry
     (scope-grouped, labelled chips).
   - **Row-Level Security**: per-policy rows (object · operation · enabled) with CEL
@@ -2455,6 +2780,7 @@ pi-TgoJ4_DM55Fqz` — untranslated, and leaking the object's machine name and th
   assuming USD.
 
 - d912a60: CRM polish — denser kanban cards, smarter currency, calmer dates.
+
   - **plugin-kanban card body**: drop the verbose `Label: value` two-column
     grid in favor of a single-column dense list (values only, with the
     field label preserved as a hover `title` for accessibility). Pipeline
@@ -2483,6 +2809,7 @@ pi-TgoJ4_DM55Fqz` — untranslated, and leaking the object's machine name and th
   `defaultCurrency` is set on the field/column, formatting is unchanged.
 
   Fixed call sites:
+
   - `@object-ui/fields`: `formatCurrency`, `formatCompactCurrency`, and
     `CurrencyCellRenderer` no longer default-param `'USD'`.
   - `@object-ui/i18n`: `formatCurrency()` falls back to `formatNumber`
@@ -2643,6 +2970,7 @@ pi-TgoJ4_DM55Fqz` — untranslated, and leaking the object's machine name and th
 - d714e85: Lookup display-name resolution now falls back through a Salesforce-style chain
   when an `$expand`'d reference object lacks a top-level `name`/`label`/
   `display_name`/`title` field:
+
   1. Standard display fields (existing behaviour)
   2. `salutation first_name last_name` composite — handles person records that
      only carry first/last name parts
@@ -2832,6 +3160,7 @@ Lin` and no `name` field now renders as `Bob Lin` everywhere — instead of
 ### Patch Changes
 
 - 89ae109: Fix click navigation and required-FK form rendering
+
   - **plugin-grid**: ObjectGrid's `getSelectFields()` now always includes `id` in
     the SELECT projection. Previously, when a view configured `columns` without
     `id`, the SQL driver stripped it from results, and row-click handlers silently
@@ -2845,6 +3174,7 @@ Lin` and no `name` field now renders as `Bob Lin` everywhere — instead of
     to create child records.
 
 - 1b6dc64: fix: complete Tailwind v3→v4 migration cleanup
+
   - Rename deprecated `flex-shrink-0` → `shrink-0` and `flex-grow-N` →
     `grow-N` (Tailwind v4 dropped the long-form aliases). Affects
     data-table, fields/index, FileField, ChatbotEnhanced,
@@ -2909,6 +3239,7 @@ Lin` and no `name` field now renders as `Bob Lin` everywhere — instead of
   Library builds (vite lib mode) now externalize every non-relative import instead of bundling third-party CJS dependencies into the published dist. This avoids inlined `require("react")` / `require("react-dom")` calls that cause `Calling \`require\` for "react" in an environment that doesn't expose the \`require\` function` runtime errors when consumer apps re-bundle the published dist.
 
   Specifically fixes:
+
   - `@object-ui/plugin-dashboard` no longer inlines `react-grid-layout` (and its transitive `react-draggable` / `react-resizable` CJS bundles). `react-grid-layout` is now declared as a peer dependency so consumers install a single ESM-friendly copy.
   - `@object-ui/components`, `@object-ui/plugin-calendar`, `@object-ui/plugin-charts`, `@object-ui/plugin-designer` no longer inline `react-i18next` / `i18next` / `use-sync-external-store` CJS shims.
   - All plugin packages now use a unified `external: (id) => !/^[./]/.test(id) && !id.startsWith(__dirname)` rule, ensuring future additions of CJS deps are automatically externalized.
@@ -2971,24 +3302,29 @@ Lin` and no `name` field now renders as `Bob Lin` everywhere — instead of
 - a2d7023: End-user feature batch — forms, designer history, import/export, and PWA offline sync.
 
   **Forms (`@object-ui/fields`, `@object-ui/providers`)**
+
   - `FileField`: native `<input capture="environment">` camera capture for mobile devices, plus a uploading-progress indicator driven by `UploadProvider`.
   - `ImageField`: per-image inline crop/rotate via the lazy-loaded `ImageCropperDialog` (canvas-based, zero new deps).
   - New `UploadProvider` in `@object-ui/providers` with pluggable adapters for S3 and Azure Blob (plus the default object-URL adapter for local previews). XHR-based with progress, abort, and retry.
   - `LookupField`: `lookup.dependsOn: string | string[]` to chain dependent lookups (e.g. State depends on Country); the trigger is gated until parent values are present and the OData `$filter` is built automatically.
 
   **Container-aware widget widths (`@object-ui/components`)**
+
   - New `useResizeObserver(ref)` hook exposing `{ width, height }` of any element. SSR-safe; reads the initial size via `getBoundingClientRect`.
   - `plugin-gantt` and `plugin-kanban` now react to their container size instead of `window.innerWidth`, so they behave correctly inside split panels and dashboards.
 
   **Designer history (`@object-ui/plugin-designer`)**
+
   - `useUndoRedo` (and therefore `useDesignerHistory`) gains `persistKey` + `storage` options to round-trip the undo/redo stack through `sessionStorage`, plus a `clearPersisted()` cleanup helper. Drafts now survive accidental tab refreshes.
   - New `<HistoryPanel>` component renders the timeline visually with one-click jump-to-checkpoint via the new `jumpTo(index)` API.
 
   **Import wizard (`@object-ui/plugin-grid`)**
+
   - Saved column-mapping templates: name, save, re-apply, and delete via a new template bar in the mapping step. Persisted under `objectui:import-templates:${objectName}` (override via `templateStorageKey` / `templateStorage`).
   - Inline validation correction: cells with errors in the preview step are now editable; corrections feed straight into the import without requiring a re-upload, with green-bar status indicators for fixed rows.
 
   **PWA offline sync (`@object-ui/mobile`)**
+
   - New `MemoryOfflineQueue` / `IndexedDbOfflineQueue` (`createOfflineQueue()` picks the best backend) backed by IndexedDB.
   - `createOfflineDataSource(inner, { queue })` wraps any DataSource so mutations issued while offline (or that fail with a network-style error) are queued and replayed in order on reconnect. Includes `replay()`, `drop()`, `clear()`, `pending()`, an `onChange` notifier, and an opt-in `resolveConflict` hook for stale-write conflicts.
   - New `useOfflineSync(source)` hook exposes `{ isOnline, pending, isReplaying, replay, drop, clear }` and auto-replays on the browser's `online` event.
@@ -3016,11 +3352,13 @@ Lin` and no `name` field now renders as `Bob Lin` everywhere — instead of
   `FormSchema.mobileStickyActions` (new) is the lower-level escape hatch — applied automatically when `mobile.stickyActions` is set on `ObjectFormSchema`.
 
   **`@object-ui/plugin-form`** — `ObjectForm` now:
+
   - propagates `mobile.fullscreenLongText` to every textarea/markdown/html field as `mobile_fullscreen: true`,
   - sets `mobileStickyActions` on the inner form schema and adds `pb-20` padding so content isn't covered by the fixed bar,
   - when `mobile.stepper === true` (or `'auto'` + `useIsMobile()` + > `stepperMinFields` fields), routes the flat field list through the existing `WizardForm` with synthetic single-field "steps" — keeping per-step validation and the existing `Next`/`Back`/`Submit` flow.
 
   **`@object-ui/components`** — the registered `form` renderer adds:
+
   - a `mobileStickyActions` opt-in that turns the action row into a `position: sticky; bottom: 0` bar on small viewports, and
   - an inline `FullscreenTextarea` wrapper used when no field-package widget is registered, providing the same expand-button + edit-dialog UX so the feature works even in lighter setups.
 
diff --git a/packages/fields/package.json b/packages/fields/package.json
index c1a453d9a6..1a75f4dc61 100644
--- a/packages/fields/package.json
+++ b/packages/fields/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/fields",
-  "version": "17.3.0",
+  "version": "17.4.0",
   "description": "Field renderers and registry for Object UI",
   "license": "MIT",
   "type": "module",
diff --git a/packages/i18n/CHANGELOG.md b/packages/i18n/CHANGELOG.md
index 449dc151c7..8b94e715ae 100644
--- a/packages/i18n/CHANGELOG.md
+++ b/packages/i18n/CHANGELOG.md
@@ -1,5 +1,651 @@
 # @object-ui/i18n
 
+## 17.4.0
+
+### Patch Changes
+
+- 7864f03: Backfill the auth family's 54 missing locale keys — `auth` 26 + `oauth` 16 + `acceptInvitation` 12 (objectui#3546, slice three)
+
+  `scripts/check-i18n-call-site-keys.mjs` (objectui#3530) measured 54 keys that a
+  `t()` call site asks for and that **no locale pack defined** — 54 distinct keys at
+  54 call sites across the console's six auth pages. All 54 carried an inline
+  `t(key, { defaultValue: 'English' })`, which is exactly the objectui#3517 class:
+  English rendered correctly, and **all ten languages were stuck on it** for
+  months. Nothing here rendered a raw key — slice one (PR #3583) held those sites.
+
+  What that meant on the page: a `zh` user reaching `/login` and switching to the
+  phone/SMS branch got "Email or phone number", "Get code", "Resend in {seconds}s"
+  and "Sign in with password instead" in English; the whole `/oauth/consent` screen
+  — including the four scope sentences describing what a third-party client is
+  about to be granted — was English-only; so was the `/accept-invitation` page and
+  the device-authorization dead end.
+
+  - **`packages/i18n/src/locales/en.ts`** gains the 54 keys. `oauth.consent.*` and
+    `acceptInvitation.*` are new top-level namespaces; the other 26 extend
+    `auth.login`, `auth.forgotPassword`, `auth.device` and `auth.verifyEmail`.
+    Every one of the 52 keys whose call site carries a **string** `defaultValue`
+    gets that exact string, byte for byte (52/52, script-compared), so the pack
+    path and the inline-default path cannot diverge. The two remaining keys —
+    `oauth.consent.title` / `oauth.consent.request` — have **template**
+    defaultValues, where byte identity is structurally impossible (JS `${…}` vs
+    i18next `{{…}}`); both take the interpolation contract the call site actually
+    declares in its options.
+  - **The nine other packs** get real translations, each evidenced against a
+    neighbour key in the same pack (fr's space before `?`/`:`, de's en dash, ru's
+    ё, ar's verb-first placement so an RTL sentence does not open on a Latin
+    client name, zh's full-width punctuation). The one string all ten packs share
+    is `phonePlaceholder` — the E.164 example number, treated like the
+    `name@example.com` the packs already keep untranslated.
+  - **`scripts/i18n-call-site-key-baseline.json`** loses exactly those 54 entries
+    (163 → 109). The file is a ratchet: an unfixed key missing from it fails the
+    build, and a fixed key still listed fails it too.
+  - **No component changed.** An AST sweep of all 122 call sites in these three
+    namespaces found zero dead `t(key) || 'English'` fallbacks (the construct
+    slice one had to delete from `ObjectView.tsx`, where i18next's key-as-value
+    return made `||` unreachable).
+
+  Two holes here are **not** i18next's and must survive translation intact:
+  `resendOtpCountdownText` carries `{seconds}` in single braces because
+  `packages/auth/src/LoginForm.tsx` and `ForgotPasswordForm.tsx` substitute it with
+  a literal `.replace()`, and `oauth.consent.request`'s `{{suffix}}` arrives
+  pre-formatted from the page. Both are pinned in
+  `packages/i18n/src/__tests__/auth-namespace-3546.test.tsx`, in both directions.
+
+- f5f8744: Backfill the `console` namespace's 41 missing locale keys plus the `console.ai.group.` template family (objectui#3546, slice four)
+
+  `scripts/check-i18n-call-site-keys.mjs` (objectui#3530) measured **41 distinct
+  keys at 47 call sites** under `console.*` that a `t()` call site asks for and
+  that **no locale pack defined** — five of those keys have more than one site
+  (`console.ai.dock.maximize` has three), which is why the denominator is measured
+  and never counted by hand. All 47 carried an inline
+  `t(key, { defaultValue: 'English' })`, so this is the objectui#3517 class:
+  English rendered correctly, and **all ten languages were stuck on it**. Nothing
+  here rendered a raw key — slice one (PR #3583) held those sites.
+
+  What that meant on the page: a `zh` user opening `/ai` got "Waiting for
+  server…", "Still working…" and "Connection lost — reconnecting…" in the
+  connection banner, all ten "Designing your app…" progress hints in English, and
+  "Built" / "Not yet built" / "Published" / "Publish failed" on the plan card; the
+  ChatDock's whole chrome (title, resize handle, collapse, "Open full page") was
+  English including two `aria-label`s; the conversation sidebar's date headers read
+  "Today" / "Yesterday" / "Previous 7 days"; a mistyped URL produced an English
+  "Page not found"; and the `?` shortcuts dialog's AI group was English inside an
+  otherwise translated table. Two of these strings ("Not yet built", "TODAY") are
+  named in objectui#2458's mixed-language list.
+
+  - **`packages/i18n/src/locales/en.ts`** gains 46 keys: the 41 measured ones plus
+    the five members of the `console.ai.group.` family. `console.notFound` is a new
+    sub-namespace; the rest extend `console.shortcuts` and `console.ai` (with new
+    `console.ai.dock`, `console.ai.designingPlanHint` and `console.ai.group`
+    objects). Every one of the 41 measured keys takes its call site's inline
+    `defaultValue` **byte for byte** (46/47 sites, script-compared), so the pack
+    path and the inline-default path cannot diverge.
+
+    - The one site that cannot match is `ChatDock.tsx:563`, where a single key
+      (`console.ai.dock.open`) carries two different English strings: the
+      `aria-label` says `Open assistant` and the `title` says
+      `Open assistant (⌘⇧I)`. A key can hold one value, so `en` takes the
+      `aria-label` spelling — an accessible name must not carry a glyph run that
+      screen readers announce as symbols, and `⌘` is a mac-only glyph that a
+      _language_ pack cannot vary per platform. The tooltip therefore stops
+      advertising the shortcut; recorded on objectui#3810 (whose class this
+      divergence joins) rather than papered over.
+
+  - **`console.ai.group.` leaves the ratchet's `missingPrefixes` (4 → 3).** It is a
+    template key — `` t(`console.ai.group.${group.key}`) `` in
+    `ConversationsSidebar.tsx:277` — whose static head matched no `en` key, so every
+    expansion missed. Its value surface is the **closed** `ConversationGroupKey`
+    union, so the repair is an enumeration of all five members, not a wildcard; a
+    test reads the component's own union and label map and fails if a sixth bucket
+    is ever added without a key.
+
+  - **The nine other packs** get real translations, each evidenced against its own
+    `console` neighbours: `zh` full-width punctuation and the pack's single-em-dash
+    status-line style, `ja`/`ko` the pack's `AI ` spacing, `de` formal _Sie_ and
+    its `Wird …` progressive, `fr` straight apostrophes, `es` _usted_ (as the
+    `console.ai` neighbourhood already uses), `pt` the pack's `off-line` spelling,
+    `ru` ё orthography, `ar` verb-first phrasing that never opens an RTL sentence
+    with a Latin token. Where `en` repeats a string the packs already translate
+    (`Go back`, `Publish failed`, `Try again`, `Back to home`, `Assistant`,
+    `Today`, `Yesterday`), the existing neighbour's wording is reused rather than
+    re-invented.
+
+  - **`scripts/i18n-call-site-key-baseline.json`** shrinks by exactly 42 entries
+    (41 keys + 1 prefix family): 109 → 68 keys, 4 → 3 prefixes.
+
+  No component changed: an AST sweep of all 308 `console.*` call sites in the repo
+  found zero dead `t(key) || 'English'` fallbacks among this slice's keys.
+
+- 69becd2: `de` approvals inbox no longer shows two quote typographies on one screen
+
+  Three `approvalsInbox` values quoted the record title with ASCII straight quotes
+  on **both** sides while their own sibling `approvalsInbox.approveOneTitle` used
+  the correct German pair (U+201E low-9 opener, U+201C closer):
+
+  | key                             | before                  | after                   |
+  | ------------------------------- | ----------------------- | ----------------------- |
+  | `approvalsInbox.rejectOneTitle` | `"{{title}}" ablehnen?` | `„{{title}}“ ablehnen?` |
+  | `approvalsInbox.inlineApproved` | `"{{title}}" genehmigt` | `„{{title}}“ genehmigt` |
+  | `approvalsInbox.inlineRejected` | `"{{title}}" abgelehnt` | `„{{title}}“ abgelehnt` |
+
+  A German approver therefore met both typographies in a single screen and inside a
+  single operation pair — German quotes on the approve confirmation, typewriter
+  quotes on the reject confirmation and on both inline toasts. `„…“` is the pack's
+  own majority (50 paired spans) and DUDEN R11, so the three values were the
+  outlier. Keys and the `{{title}}` placeholder are unchanged; this is a
+  value-domain typography fix, and `en` (ASCII on both sides by design) is
+  untouched.
+
+  This is a **different defect shape** from objectui#3876, which paired a German
+  opener with an ASCII closer. Because these three were ASCII on both sides they
+  were self-consistent, so the pairing invariant objectui#3876 left behind could
+  not see them — it scans forward from each `„`, and there was no `„` in them to
+  scan from. The pack's straight-quote census being empty now lets that pin become
+  strictly stronger: `de-quote-pairing-3876.test.ts` asserted an explicit
+  three-key allowlist and now asserts that **no `de` value holds a U+0022 at all**,
+  which covers both defect shapes and needs no per-key maintenance as new values
+  land. The pack census moves from `„` 47 / `“` 47 / `”` 0 / `"` 6 to
+  `„` 50 / `“` 50 / `”` 0 / `"` 0.
+
+  None of the three i18n gates could have caught this: `all-locales-key-parity`
+  compares key sets and placeholder shapes, `check-i18n-call-site-keys.mjs` only
+  asks whether a key resolves, and `check-i18n-en-drift.mjs` fires on `en` value
+  changes — these values were wrong from the day they landed, so no drift event
+  ever existed. All three are value-blind by design, which is why the invariant
+  lives in a test.
+
+- 5e52495: German pack: the 20 values that closed the German opening quote with an ASCII straight quote now close it with `“`
+
+  `packages/i18n/src/locales/de.ts` opened a quoted span with the German low-9
+  quote `„` (U+201E) and closed it with the ASCII typewriter quote `"` (U+0022) in
+  20 keys, so a German user read `Registerkarte „Alle Datensätze" anzeigen` — a
+  mismatched pair. `search.resultsCount` showed it most plainly: the value ended
+  `„{{query}}""`, the mismatched closer immediately followed by the TS string
+  terminator.
+
+  This was never a pack convention. Measured on `main@2937bcf7d` before the fix,
+  the same file already spelled 23 spans the correct German way, `„…“` — the two
+  styles sat side by side, in sibling keys of the same namespace. Every mismatched
+  closer is now `“` (U+201C), which is what German orthography (DUDEN R11) and the
+  majority of the file already used. Affected surfaces: the four empty states
+  (object / page / dashboard / report not found), the search results header, the
+  lookup "create named" action, four `console.objectView` strings, the home
+  getting-started hint, the six `navigationSync` toasts, the local marketplace
+  install toast, and the preview not-ready title.
+
+  No other language pack and no `en` value changed — the counts are unchanged for
+  every other locale, and the mismatch was measured only in `de`.
+
+  ### Counted at landing, in two units
+
+  The card reported "20 values" and the triage re-scan reported "22 mismatched
+  pairs"; both are correct about different units, and the difference is now
+  recorded rather than left to the next reader. 20 keys carried a mismatch;
+  22 mismatch occurrences lived in them, because `navigationSync.renamedPage` and
+  `navigationSync.renamedDashboard` each quote two names in one sentence
+  ("Seite „alt“ in „neu“ umbenannt") and so contribute two each. Full-file counts
+  before → after: `„` 45 → 45, `“` 25 → 47, `”` 2 → 2, `"` 28 → 6.
+
+  ### The durable half, and why it is not the count equality the card proposed
+
+  Three i18n gates run over these packs and none can see a wrong quote:
+  `all-locales-key-parity` compares key sets and placeholder shapes,
+  `check-i18n-call-site-keys.mjs` only asks whether a key resolves, and
+  `check-i18n-en-drift.mjs` fires on `en` **value changes** — these values were
+  wrong from the day they landed, so no drift event ever existed. Without a
+  value-domain assertion the next backfill copies the mismatch from a neighbour
+  again, which is exactly how these 20 accumulated.
+
+  The card proposed asserting `count(„) === count(“)`. That is **false on the
+  correctly fixed file** (45 vs 47) and would have sent the next reader hunting a
+  bug that is not there: two values in this pack, `grid.import.savedMappingHint`
+  and `grid.import.savedMappingPreviewNote`, are still untranslated English prose
+  and quote in the English style `“…”`, so their two `“` are legitimate _openers_.
+  The invariant that is pinned instead is the pairing itself — for every `„`, the
+  first quote character that follows must be `“` — backed by the arithmetic
+  identity `count(“) === count(„) + count(”)`, which stays true if those two values
+  are later translated (47 === 47 + 0) and breaks the moment a mismatch returns.
+  Both carry a presence guard so a broken import cannot make them pass by scanning
+  nothing.
+
+- b750823: `preview.draftBar` speaks one second person in `es` — the draft-preview banner no
+  longer switches from tú to usted when a Spanish user publishes (#3844)
+
+  `DraftPreviewBar` renders two mutually exclusive sentences in the same strip of
+  the same banner: `message` while there are unpublished changes, `messageClean`
+  once there are none. In `es` the two disagreed on register — `message` was tú
+  (`estás viendo`, `publiques`) while `messageClean` (`ve`) and `sampleDataBody`
+  (`Está`, `su`, `Publíquela`) were usted. So a Spanish user who pressed Publish
+  watched the banner change person: same component, same position, same session.
+
+  This is a third defect class in the value-domain blind spot behind #3582 and
+  #3625, and no gate in the repo can see it. Both `es` values are correct
+  translations of their `en` sentences — nothing is missing, nothing is stale, and
+  nothing holds English. The inconsistency is _internal to one pack, on one UI
+  surface_: `scripts/check-i18n-call-site-keys.mjs` only asks whether a key exists
+  in `en`, `all-locales-key-parity` compares key sets and placeholder shapes and
+  never reads values, and `scripts/check-i18n-en-drift.mjs` only fires when an `en`
+  value moves — these two `en` values never moved.
+
+  `message` is the value that changes, because usted is what the pack already says
+  everywhere around it: the `es` pack censuses 102 usted markers to 30 tú (tú being
+  the marked exception, concentrated in the auth, report-editor and organizations
+  neighbourhoods that #3546 slice two deliberately ruled informal); the other three
+  strings of this same object were already usted; and #3546 slice five gave the 19
+  new `preview.unpublishedBar.*` / `preview.history.*` keys usted on the strength
+  of `home.pendingDrafts.published` ("¡Publicado! Sus cambios están activos."). Two
+  smaller divergences inside the same sentence are closed with it, so the banner's
+  two halves stop disagreeing about wording as well as person:
+
+  - **`—` instead of `:`** in `messageClean`, matching `en`, where both sentences
+    open `Draft preview — `. That is the whole of `messageClean`'s diff.
+  - **`activo` instead of `en producción`** for "live". The pack spells this concept
+    `activo` in four neighbouring places including `publishCta` in this very object
+    ("Publicar para verlo activo"), and it reserves _producción_ for the actual
+    production environment (`environment.entitlement.planLockedBody`), so the
+    outlier was ambiguous as well as inconsistent.
+  - **`Vista previa del borrador`** as the shared opening, `del` being the form
+    `messageClean` already used.
+
+  No `en` value changes (the en-drift gate reports 0), no key is added or removed
+  (so `all-locales-key-parity` is untouched by construction), and the nine other
+  packs are not touched. The diff is two values in one file.
+
+  Re-voicing the whole `preview` namespace to tú was considered and rejected — a
+  much larger change that would collide with the adjacent `marketplace.*` (9:0
+  usted) and `console.ai.*`. `preview.empty.notReadyDescription` therefore stays tú
+  here, since #3844's ruling is this banner only; it is filed as #3875 rather than
+  waved through, because `PreviewDraftEmptyState` renders _underneath_
+  `DraftPreviewBar` and so those two show usted and tú on screen at the same time.
+  After this change the `preview` namespace is 23 usted to that 1 tú.
+
+  A gate that checks "one register per namespace" is deliberately **not** here:
+  recognising usted vs tú needs real morphology, and token matching demonstrably
+  cannot — in this pack the token `revisa` is usted in `console.ai.empty.build`
+  (es.ts:1365, "…y usted revisa y publica.") and tú in
+  `auth.forgotPassword.successTitle` (es.ts:1918, "Revisa tu correo electrónico"),
+  the same eight letters in opposite registers. The neighbourhood boundary such a
+  gate would police is human judgement anyway — #3546 slice two's "same rule,
+  different answer". A new `draftBar-es-register-3844.test.ts` pins the four `es`
+  values byte for byte instead, plus the `en` literals, so a future reword of
+  either `en` sentence fails in the same PR that reworded it.
+
+- ac2139c: `grid.import` saved-mapping copy is now translated in ko / de / fr / es / pt / ru / ar instead of served as English
+
+  Five keys — `grid.import.savedMapping`, `chooseSavedMapping`, `manualMapping`,
+  `savedMappingHint` and `savedMappingPreviewNote` — were **byte-identical to `en`**
+  in seven of the nine non-`en` packs, 35 values in all. Only zh and ja had been
+  translated, and two of the five are multi-clause explanatory sentences rather
+  than placeholders or proper nouns, so this was not a deliberately untranslated
+  term: a German, French, Spanish, Portuguese, Russian, Korean or Arabic user
+  picking a saved mapping in the import wizard read English.
+
+  None of the three i18n gates could see it. `all-locales-key-parity` compares key
+  sets and placeholder shapes, so English passed perfectly; the call-site gate only
+  asks whether a key resolves; `check-i18n-en-drift.mjs` fires on an `en` **value
+  change** and these keys arrived in the packs already English, so no drift event
+  ever existed. objectui#3920 also proposed a general "no non-`en` value may be
+  byte-equal to `en`" gate; that is deliberately not part of this change, because
+  values like `auth.*.emailPlaceholder` (`name@example.com`),
+  `fields.image.counter` (`{{current}} / {{total}}`) and
+  `grid.import.templateFileName` are byte-equal across packs correctly, and
+  objectui#3880 records the other face of the family. The five keys are pinned by
+  name instead.
+
+  Each translation reuses vocabulary its own pack already ships rather than
+  inventing a second word for the same concept: `stepMapping` for "mapping"
+  (Zuordnung / Correspondance / Asignación / Mapeamento / Сопоставление / تعيين /
+  매핑), `legacyFallbackNotice` for "type coercion" (Typkonvertierung / conversion
+  de type / conversión de tipos / conversão de tipos / приведение типов / تحويل
+  الأنواع / 형 변환), `view.readonlyTooltip` for "read-only", and `validateHint`
+  for "on the server". `es` follows the usted ruling objectui#3844 measured for
+  this pack; `pt` is the pack's own pt-BR (mapeamento / salvo / no servidor);
+  `ru` keeps its ё; `fr` keeps the straight apostrophe and the space before colon
+  and semicolon; `ar` punctuates with U+060C and U+061B; `ko` uses the 은(는) /
+  이(가) spelling its `fields.file.exceedsMaxSize` already uses for a placeholder
+  whose particle cannot be resolved at authoring time.
+
+  The quote around `{{name}}` follows each pack's measured majority for wrapping a
+  placeholder — de `„…“` (38 spans against 3 ASCII), fr `« … »` with an ASCII
+  space (25 against 18), ru `«…»` (23 against 18), and ASCII `"…"` for ko (38:0),
+  pt (39:0), es (22:19) and ar (27:15). The card cited
+  `residue-namespaces-3546.test.tsx` as pinning "the rest ASCII", but that line
+  pins the `empty.*` family only and its own comment scopes the rule to "the
+  sibling value in the SAME pack"; `grid.import` has no other quoted span, so the
+  census one ring out decides.
+
+  Germanising the two `de` sentences also closes the 45/47 gap
+  `de-quote-pairing-3876.test.ts` documented: that pack's census moves from
+  `„` 45 / `“` 47 / `”` 2 to `„` 47 / `“` 47 / `”` 0, exactly as that file's header
+  predicted, and its `count(“) === count(„) + count(”)` identity still holds. The
+  three literal counts in it were updated and the two keys are now pinned by name
+  there, so `rdqKeys === []` cannot become an assertion that passes because nothing
+  is produced.
+
+  `en`, `zh` and `ja` are untouched, and `grid.import.transform` — the sixth key in
+  the same block, English in the same seven packs, and the third column header of
+  the very table this hint sits above — is deliberately left alone, filed as
+  objectui#3938 and pinned as still-English so the number cannot drift while that
+  issue waits its turn.
+
+- b14ab3a: `grid.import.transform` is now translated in ko / de / fr / es / pt / ru / ar instead of served as English
+
+  The third column header of the import wizard's saved-mapping summary was
+  **byte-identical to `en`** — the literal string `Transform` — in seven of the
+  nine non-`en` packs. zh (`转换`) and ja (`変換`) had translated it, which is what
+  rules out the "deliberately untranslated term" reading; this is the sixth key of
+  the same six-line block objectui#3920 / PR #3936 fixed the other five of, and it
+  was left out of that card only to keep its 5-keys / 35-values census verifiable.
+
+  | pack | before      | after            | the pack's own anchor                                                                    |
+  | ---- | ----------- | ---------------- | ---------------------------------------------------------------------------------------- |
+  | ko   | `Transform` | `변환`           | `savedMappingHint` "이름 변경 + 변환 + 형 변환"                                          |
+  | de   | `Transform` | `Transformation` | `savedMappingHint` "Umbenennung + Transformationen + Typkonvertierung"                   |
+  | fr   | `Transform` | `Transformation` | `savedMappingHint` "le renommage + les transformations + la conversion de type"          |
+  | es   | `Transform` | `Transformación` | `savedMappingHint` "el cambio de nombre + las transformaciones + la conversión de tipos" |
+  | pt   | `Transform` | `Transformação`  | `savedMappingHint` "renomeação + transformações + conversão de tipos"                    |
+  | ru   | `Transform` | `Преобразование` | `savedMappingHint` "переименование + преобразования + приведение типов"                  |
+  | ar   | `Transform` | `التحويل`        | `savedMappingHint` "إعادة التسمية + التحويلات + تحويل الأنواع"                           |
+
+  Each value is the **singular of the word the pack already uses** for `en`'s
+  plural "transforms" in `grid.import.savedMappingHint` — the sentence
+  `SavedMappingSummary` renders directly above this header. That is the anchor
+  rather than `legacyFallbackNotice`'s term, because `en`'s own sentence lists
+  "transforms" and "type coercion" as two different server-side operations and
+  `legacyFallbackNotice` is about the second: reusing de "Typkonvertierung", ko
+  "형 변환" or ar "تحويل الأنواع" for this header would name the wrong operation.
+
+  Why it was worth a card of its own rather than waiting for a general gate: this
+  value is not a hidden string. It is the third `TableHead` of
+  `SavedMappingSummary`, sitting in one row with `csvColumn` and `mapsTo`, which
+  were always translated — so a German user read `Spalte` / `Zugeordnet zu` /
+  `Transform`, two languages in a single header row, directly under the German
+  hint PR #3936 had just landed. Before that PR the whole panel was English and
+  therefore at least self-consistent.
+
+  The three i18n gates are value-blind here exactly as they were for
+  objectui#3920: `all-locales-key-parity` compares key sets and placeholder shapes
+  (the key was present with no placeholder, so English passed perfectly), the
+  call-site gate only asks whether a key resolves, and `check-i18n-en-drift.mjs`
+  fires on an `en` **value change** — this value entered the seven packs already
+  English, so no drift event ever existed. `en`, zh and ja are untouched, and the
+  pin PR #3936 left in `gridImportSavedMapping-i18n-3920.test.ts` asserting these
+  seven were "still English" has been replaced by the translated pin it asked for.
+
+- 8c60819: The inbox popover now spells out what the bell badge is made of
+
+  The bell badge is `unread notification topics + pending approvals`, clamped to
+  "9+" above nine. As one number it is unexplainable: objectstack#7213 measured
+  Home's "pending approvals" card saying 8 while the bell said "9+", and read that
+  as the two counts disagreeing — they never did, the bell was simply carrying a
+  second addend the user could not see.
+
+  The popover already tabs the two streams and puts a count pill on each tab, so
+  the split was partly visible — but those pills clamp at "9+" too. A loaded
+  console therefore showed three "9+"s that reconcile to nothing, which is why
+  sectioning alone did not close this.
+
+  A breakdown line under the popover header now states the exact, unclamped
+  addends beside the exact total — `15 total · 12 notifications + 3 pending
+approvals`. The approvals half is the same `pendingApprovalsCount` the Home card
+  and the Approvals Inbox tab read, so the number a user reconciles against is
+  literally the one they see elsewhere.
+
+  The badge formula, the counting APIs and the "9+" clamp on the badge itself are
+  unchanged — this is a display fix. Three new keys
+  (`notifications.badgeTotal` / `badgeNotifications` / `badgeApprovals`) land in
+  all ten locale packs. They interpolate named placeholders (`{{total}}`,
+  `{{unread}}`, `{{approvals}}`) rather than i18next's `{{count}}`, which would
+  additionally drive plural-key resolution these packs carry no forms for.
+
+- e64a52e: 回填 `perm` + `home` 两命名空间 14 个缺失语言 key,十个语言包补齐(#3546 切片六)
+
+  `scripts/check-i18n-call-site-keys.mjs` 实测:14 个不重复 key / 14 个调用点(1:1),分布在权限集
+  记录的授权面摘要(`PermissionFacetLink`,ADR-0056 P1)与"一键发布全部草稿"的其余几条 toast
+  (`usePublishAllDrafts`:ADR-0038 L3 探针健康、示例数据健康、ADR-0066 ⑨ 能力引用巡检)。
+
+  这 14 处都带内联 `defaultValue`,所以英文一直正常渲染,**十种语言都翻不了** —— 修的是这一半。
+  英文字串一字未改:9 处静态 `defaultValue` 与 en 逐字节相同;另外 4 个计数标签(对象 / 字段规则 /
+  RLS 策略 / 标签页规则)的 `defaultValue` 是带英文单复数分支的模板串,改用 i18next 复数族
+  (`key` + `key_one`)后逐个计数渲染结果与模板串一致。
+
+  复数族刻意带**基础 key** 而不是只写 `_one`/`_other`:i18next 只按语言的 CLDR 类别取一个后缀,
+  取不到就沿 fallback 链落到 `en`。ru(few 2-4、many 5-20)与 ar(two、few 3-10、many 11-99)
+  恰好在用户最先遇到的计数上会因此显示英文;基础 key 让这些类别落回**本语言**。
+
+- 844d17f: Backfill the `marketplace` and `preview` namespaces' 37 missing locale keys plus the `marketplace.disclosure.runtime.` template-key family (objectui#3546, slice five)
+
+  `scripts/check-i18n-call-site-keys.mjs` (objectui#3530) measured 37 keys that a
+  `t()` call site asks for and that **no locale pack defined** — 37 distinct keys at
+  37 call sites across five console components — plus one `missing-prefix` family
+  whose static head matched no `en` key at all, so every expansion missed. All 37
+  carried an inline `t(key, { defaultValue: 'English' })`, which is exactly the
+  objectui#3517 class: English rendered correctly, and **all ten languages were
+  stuck on it** for months. Nothing here rendered a raw key — slice one (PR #3583)
+  held those sites.
+
+  What that meant on the page for a `zh` (or `ja`, `de`, `ar`, …) user: the
+  marketplace's "Your organization" strip, its Install / Installing… / Installed
+  buttons and the version-update affordances were English; the whole ADR-0025 PD4
+  **pre-install permission disclosure** was English — "This package contains code",
+  the trust-tier badge, "Reviewed & approved" / "Not yet reviewed" / "Signed", the
+  four permission group labels (platform services, lifecycle hooks, network,
+  filesystem) and the consent checkbox the user ticks to accept them; the ADR-0045
+  unpublished-app banner and its publish toasts were English; and the entire
+  ADR-0067 build-history sheet — title, description, the per-commit labels, the
+  Revert button and both of its result toasts — was English.
+
+  `marketplace.disclosure.runtime.` is repaired as an **enumeration, not a
+  wildcard**: its value surface is the closed trust-tier enum
+  (`PluginRuntimeSchema` = `z.enum(['node', 'sandbox', 'worker'])`, ADR-0025 §3.6),
+  so all three members are backfilled and the family leaves the ratchet's
+  `missingPrefixes` (3 → 2). A test reads the component's own fallback map and
+  fails if a fourth tier is ever added without a key — the job the prefix entry
+  used to do.
+
+  Each `en` value is byte-identical to the inline `defaultValue` it replaces (36 of
+  36 literal sites; the 37th's `defaultValue` is a template literal whose
+  `${pkg.display_name}` becomes the `{{name}}` hole its call site already passes),
+  so no English string a user sees today changes. The nine translations follow each
+  pack's own neighbourhood — including two namespaces that legitimately take
+  **different** second persons in `zh` (`marketplace` 你, `preview` 您) — and reuse
+  an existing neighbour's translation wherever the `en` string already existed
+  verbatim, so one English string never renders as two different sentences in the
+  same language.
+
+  No component changed: an AST sweep of the whole `marketplace.*`/`preview.*`
+  call-site surface found the slice's own dead-`||`-fallback count to be zero.
+
+- 4dcd52a: `console.objectView.systemViewReadonly` and `console.objectView.expandToPage`
+  are translated in the eight packs that stored English for them, so a Japanese,
+  Korean, German, French, Spanish, Portuguese, Russian or Arabic session reads
+  the system-view hint and the expand affordance in its own language (#3582).
+
+  This is a different defect class from #3546's ledger, and no gate in the repo
+  could see it. There the key was _missing_ from a pack and `fallbackLng: 'en'`
+  rendered English; here the key was **present in all ten** and eight of them
+  stored English as the value. `all-locales-key-parity` compares key _sets_ and
+  placeholder _shape_ — identical before and after this change, and neither key
+  interpolates anything. `scripts/check-i18n-call-site-keys.mjs` and its baseline
+  ratchet ask whether a `t()` key exists in `en`; it did, so these two were never
+  in the 258.
+
+  `systemViewReadonly` carried the sharper half: the eight packs did not hold
+  `en`'s sentence, they held one `en` had already abandoned. `en` says the view
+  is read-only; the eight said `System view defined in code - duplicate to
+customize.` — pointing eight locales at a duplicate-to-customize path the
+  product no longer presents. They are translated against `en`'s **current**
+  read-only meaning, not against the stale English they replaced.
+
+  Each value is built from terminology the same pack already uses rather than
+  invented: `view.readonlyTooltip` supplies "system view" and
+  `console.objectView.cannotEditMetaView` (landed in #3583) supplies "defined in
+  code", so the new hint agrees with the copy beside it in every pack. For
+  `expandToPage`, `detail.openAsFullPage` is the identical English sentence one
+  namespace over and was already translated everywhere — `en` and `zh` hold their
+  two byte-identical to each other, so the eight now do too, and one locale
+  cannot end up with two different words for one action.
+
+  `en` and `zh` are unchanged, byte for byte. No key is added or removed —
+  the diff is 16 values in 8 files. A new
+  `objectView-value-language-3582.test.ts` pins the `en` literal (so the next
+  rewording of `en` fails loudly instead of silently orphaning nine
+  translations), asserts that no pack but `en` serves either English spelling,
+  and requires the zh/ja/ko/ru/ar values to contain characters of their own
+  script. The repo-wide "no ASCII English sentence in a non-Latin pack" gate that
+  #3582 also sketched is deliberately **not** here; it is a separate, lands-green
+  change.
+
+- 42ae5c6: The organization-management console is translatable. The 90 keys under
+  `organization.*` — the org layout and its tabs, the members list, the whole
+  invitation flow, organization settings including the leave and delete
+  confirmations, the accept-invitation page, and the workspace switcher — are now
+  defined in all ten locale packs, so a non-English session reads the org admin
+  surface in its own language instead of English (part of #3546).
+
+  `scripts/check-i18n-call-site-keys.mjs` measured 258 keys that a `t()` call site
+  asks for and no pack defines. `organization.*` was the largest namespace in that
+  tally at 90 keys across 93 call sites in seven components. Every one of them
+  carried an inline `t(key, { defaultValue: 'English' })`, which is why nothing
+  looked broken: English rendered correctly at each site and all ten languages
+  were pinned to it. That is the #3517 class, not the raw-key class slice one
+  (#3583) held — no organization site rendered an identifier, and none had a dead
+  `||` fallback to remove, which was measured before deciding not to touch the
+  components.
+
+  Adding a `defaultValue` is deliberately not the fix; it is the mechanism that
+  kept these invisible for months. The existing defaults stay where they are, and
+  each `en` value is byte-identical to the default at its call site so the two
+  paths cannot render different text.
+
+  `organization` is a new top-level namespace, sitting next to — and distinct
+  from — `organizations`: the singular one is the management surface, the plural
+  one the org picker. The ratchet in `scripts/i18n-call-site-key-baseline.json`
+  shrinks by exactly these 90 entries, from 253 to 163. The
+  `organization.invitations.status.*` template-key family is untouched and still
+  baselined: enumerating an invitation status set is a different repair from
+  backfilling literal keys.
+
+- 6d762da: The five locale keys behind #3546's eight no-fallback `t()` call sites are now defined in all ten packs, so the built-in-view toasts, the activity-timeline source link, the wizard's required-field toast and the Gantt refresh button's accessible name are translated instead of falling back to English — or, on two surfaces, to the key itself (part of #3546).
+
+  `scripts/check-i18n-call-site-keys.mjs` measured 258 keys that a `t()` call site asks for and no pack defines. These five were the subset with no working inline default: `console.objectView.cannotEditMetaView`, `console.objectView.cannotDeleteMetaView`, `detail.viewSource`, `gantt.toolbar.refresh` and `wizard.missingRequired`. Adding a `defaultValue` is deliberately not the fix — that mechanism is what kept all 258 invisible for months.
+
+  **Two of the eight sites really did render the raw key**, and both go through a binding with nothing in front of i18next. `ObjectView.tsx` calls `useObjectTranslation()` directly, so five toasts read `console.objectView.cannotEditMetaView` / `cannotDeleteMetaView` on screen; the `|| 'Built-in views cannot be renamed.'` guards next to them were dead on every path, because i18next answers a miss with the key itself and a non-empty string never falls through `||`. Those four unreachable English strings are removed rather than repaired: one key served four call sites (rename / pin / set-as-default / configure), so the pack copy covers any change to a built-in view instead of naming one operation. `RecordActivityTimeline.tsx` fails the same way for a subtler reason — `useDetailTranslation` is `createSafeTranslation(..., 'detail.back')`, and because `detail.back` does resolve, the probe hands back i18next's `t` for every key and bypasses the defaults map wholesale, so `detail.viewSource` reached the user verbatim.
+
+  **The other two sites were not rendering a raw key**, contrary to the issue's description, and are fixed here as the milder "English in all ten languages" class. `wizard.missingRequired` is its own hook's probe key, so the probe failed and `createSafeTranslation` correctly served its English default. `gantt.toolbar.refresh` goes through `useGanttTranslation`, which deliberately does not use `createSafeTranslation` and falls back per key — so the refresh button's `aria-label` was "Refresh", in English, never the key. Screen-reader users heard an English word rather than an identifier; a `zh` session now hears 刷新.
+
+  Regression cover is provider-mounted on purpose: with no `I18nProvider` the defaults maps answer every one of these keys and the assertions pass while the console is broken, which is precisely the false-green the issue documents. For the two sites whose English output was already correct, `en` cannot discriminate before from after — the `zh` assertions are the ones that pin the fix.
+
+- f9faa7d: Backfill the last 17 missing locale keys and both remaining template-key families, emptying the call-site key ratchet (objectui#3546, slice seven — final)
+
+  `scripts/check-i18n-call-site-keys.mjs` (objectui#3530) opened this backlog with
+  **258 keys and 4 template-key families** that a `t()` call site asks for and that
+  **no locale pack defined**. Seven slices later the last of it is paid: this change
+  takes the ratchet from 17 keys to **zero** and from 2 prefix families to **zero**,
+  and the gate now reports every one of the **2320** literal call-site keys
+  resolving against `en`.
+
+  The residue was the long tail — nine namespaces across `app-shell`,
+  `plugin-detail`, `plugin-dashboard`, `plugin-kanban` and `plugin-gantt`, none of
+  them big enough to have been its own slice. 17 distinct keys at **23** call sites
+  (five keys are used at more than one site) plus **3** call sites behind the two
+  families.
+
+  What that meant on the page for a `zh` (or `ja`, `de`, `ar`, …) user: the "App not
+  available" empty state a user lands on when an app is still publishing, including
+  its whole explanation and its Retry button; the interface page's "source is not
+  available" message; the system navigation's **Administration** group header,
+  **Datasources** and **Documentation** entries; the "creating new organizations is
+  disabled on this instance" guard in the workspace dialog; the invitation list's
+  five status labels (All / Pending / Accepted / Rejected / Canceled) on both the
+  filter tabs and every invitation badge; the Gantt dependency-drag hint that names
+  which endpoint the drop will link (`start` / `end`); the record detail's Add,
+  "Record deleted", "No history yet" and the concurrent-update dialog's "this
+  record"; the kanban empty board's column count; the dashboard widget's screen
+  reader "Loading…"; and the page editor's "Edit in studio" tooltip and accessible
+  name. All of it rendered English, in every one of the ten languages.
+
+  Nothing here rendered a raw key — slice one (PR #3583) held those sites, and the
+  three keys the issue body named as unprotected (`detail.viewSource`,
+  `wizard.missingRequired`, `gantt.toolbar.refresh`) have resolved in `en` since.
+
+  Both families are repaired as **enumerations, not wildcards**, and the assertion
+  that used to live in the ratchet's `missingPrefixes` moves into a test that fails
+  if either union grows a member without a key:
+
+  - `gantt.linkEnd.` — the closed union `'start' | 'end'`, declared by GanttView's
+    own `linkDrag` state.
+  - `organization.invitations.status.` — `StatusFilter`
+    (`all | pending | accepted | rejected | canceled`), declared by InvitationsPage.
+
+  Every `en` value is byte-identical to the English the call site rendered before,
+  so no string a user sees today changes: 16 keys match an inline
+  `t(key, { defaultValue: … })`; `dashboard.loading` matches `useSafeTranslate`'s
+  positional fallback `tt(key, 'Loading…')`; `gantt.linkEnd.*` match
+  `useGanttTranslation`'s per-key fallback map; and the five status labels match the
+  CSS-capitalised wire value each badge and tab showed. The nine translations follow
+  each pack's own neighbourhood and reuse an existing neighbour's row wherever the
+  `en` string already existed verbatim **and** that row is grammatical here — the
+  four invitation adjectives are deliberately not reused from the approvals family,
+  because those agree with each pack's word for "request" (`ru` masculine `Отклонён`)
+  while an invitation needs its own agreement (`ru` neuter `Отклонено`).
+
+  `scripts/i18n-call-site-key-baseline.json` is kept rather than deleted: empty is
+  its terminal, load-bearing state — against an empty baseline any NEW unresolved
+  call-site key is unexpected and fails the build.
+
+  No component changed.
+
+- 33526fd: `view.readonlyTooltip` — the tooltip on a view tab's read-only lock — is
+  retranslated in the eight packs (ja/ko/de/fr/es/pt/ru/ar) that still described
+  the retired "duplicate to customize" workflow, so a Japanese, Korean, German,
+  French, Spanish, Portuguese, Russian or Arabic session is told the view is
+  defined in code and read-only, which is what `en` says and what the product
+  does (#3625).
+
+  This is the same stale sentence #3582 fixed one namespace over, but it hid
+  behind a much better disguise. In #3582 the eight packs stored the **English**
+  string, so two cheap criteria could see it: "value equals `en`" and "a
+  non-Latin pack holds pure ASCII". Neither can see this key. Its eight values
+  were **idiomatic translations** — real Japanese, real Cyrillic, real Arabic —
+  of a sentence `en` itself had already abandoned. Nothing about their form was
+  wrong; only their meaning was. Key sets were complete, so
+  `all-locales-key-parity` was green; the key exists in `en`, so the call-site
+  guard and its ratchet were green; the values are distinct and in their own
+  scripts, so every heuristic #3582 sketched would have been green too. Eight
+  locales spent those releases pointing users at a path the product no longer
+  offers, with every gate reporting success.
+
+  Each value is translated against `en`'s **current** meaning and built from
+  words the same pack already uses — "read-only" from its own `view.readOnly` /
+  `view.readonlyAriaLabel`, "defined in code" from
+  `console.objectView.systemViewReadonly` / `cannotEditMetaView` — so the tooltip
+  agrees with the copy beside it instead of introducing a ninth way to say
+  read-only. Nothing is rewritten from the stale text.
+
+  `en` and `zh` are unchanged, byte for byte, and no key is added or removed —
+  the diff is eight values in eight files. A new
+  `viewReadonlyTooltip-semantics-3625.test.ts` tests **meaning** rather than
+  form, in both directions: no pack may name the duplicate/copy workflow in its
+  own language, and every pack must positively carry all three pieces of the
+  sentence ("system view", "defined in code", "read-only") so the negative check
+  cannot pass on a gutted string. It also pins the `en` literal, so the next
+  rewording of `en` fails in the PR that does the rewording rather than orphaning
+  nine translations for another release — which is the invariant this family of
+  defects has actually been missing.
+
+- 32413ec: Resolve `_views` translation keys by the bare view name only — the prefixed full name is no longer a second candidate
+
+  `useObjectLabel().viewLabel` / `viewDescription` / `viewEmptyState` build their key by stripping the object prefix off the runtime view id (`crm_opportunity.pipeline_kanban` → `objects.crm_opportunity._views.pipeline_kanban.<tail>`). Until now, if that bare key missed, the resolver **also** tried the prefixed full name — `objects.crm_opportunity._views.crm_opportunity.pipeline_kanban.<tail>` — so a bundle authored against the prefixed spelling resolved too.
+
+  **Behavior change:** it no longer does. A `_views` entry keyed by the prefixed full name is not read at all; the label falls back to the metadata default, exactly as it would if no translation had been written. Bundles keyed by the bare view name — the only spelling the extractor emits and `os lint` accepts — are unaffected.
+
+  This closes an asymmetry, not a feature. The server-side resolver reads the one bare key (objectstack#5165), so a prefixed-key bundle produced a **translated label in the Console and English everywhere else**: the REST boundary, mobile, plain HTTP and SDUI consumers do not run this second resolution pass. The half-success was harder to notice than a clean miss, and it fossilized a second de-facto spelling of a key the platform has now converged on: per the objectstack#5164 ruling (2026-08-06, option A), the canonical `_views` key is the runtime view identity's bare name, with the i18n extractor deriving it from the view composer (objectstack#6124) and `packages/lint` enforcing that single spelling (objectstack#6038). This is the third and last leg of that convergence.
+
+  The object-name axis is untouched: a bundle written against the short object name (`objects.opportunity._views.…`) still resolves when the runtime presents the namespaced name (`crm__opportunity`).
+
+  **If a label stopped translating after this upgrade,** its `_views` key is written with the object prefix. Drop the prefix — `_views.crm_opportunity.pipeline_kanban.label` becomes `_views.pipeline_kanban.label`. `os lint` names these for you: a prefixed key is reported as `translation-target-unknown`, because no view of the object declares it.
+
 ## 17.3.0
 
 ### Minor Changes
@@ -249,6 +895,7 @@ first`. The form renderer passes a new `dependsOnLabels` widget prop (the
   ten packs missing it identically kept parity fully green.
 
   ## What changed
+
   - `createTargetOrg` is backfilled into `en` as `Creates in {{org}}`, which makes
     the parity gate demand it from the other nine; each is translated to its pack's
     existing `form`-section tone rather than copied or machine-filled.
@@ -711,7 +1358,7 @@ plan` sentence users reported (cloud#959). Both spec builders now take a transla
 
 ### Patch Changes
 
-- 752e18f: fix(console,app-shell): readable reassign hand-off + "System" label for svc:* audit actors — objectstack#4365 / objectstack#4366
+- 752e18f: fix(console,app-shell): readable reassign hand-off + "System" label for svc:\* audit actors — objectstack#4365 / objectstack#4366
 
   - **Approvals inbox** (`ApprovalsInboxPage`): a reassign timeline entry now
     renders "from A to B" from the structured
@@ -1423,6 +2070,7 @@ os_tianshun_ehr_position — use a unique value or the record id` — with the f
   is byte-identical, it just comes from the pack now.
 
   Adds two guards, both mutation-verified:
+
   - `en` ↔ `zh` full key parity, asserted in both directions. The other eight
     packs are still ~357 keys behind and are tracked separately (objectui#2872
     part a), so they are deliberately not asserted yet.
@@ -2357,6 +3005,7 @@ actionName, spec)`: overlays translated `title` / `description` /
   wired by `RecentItemsProvider` + `useTrackRouteAsRecent` +
   `RecordDetailView`). Multi-device by construction: open a record on
   laptop, see it in `⌘K → Recently viewed` on phone.
+
   - Group renders only when input is empty (no competition with search).
   - Limited to the 5 most recent record-type entries.
   - New i18n key `console.commandPalette.recentRecords` (en + zh seeded;
@@ -2366,6 +3015,7 @@ actionName, spec)`: overlays translated `title` / `description` /
 
   When `useRecordSearch` is mid-flight (debounced fetch across objects
   hasn't returned yet), the palette now surfaces a subtle visual:
+
   - A small pulsing primary-coloured dot next to the **Records** group
     heading, so the user sees that more results may still appear.
   - A `Searching…` placeholder inside the empty state when the user has
@@ -2379,6 +3029,7 @@ actionName, spec)`: overlays translated `title` / `description` /
   - Stage chevron (`record:path`): bump completed-stage contrast (emerald-800 text on emerald-500/15, was 700 on /10) and future-stage text from `foreground/70` to `foreground/85` for legibility.
   - i18n: add `notifications.emptyUnread`, `notifications.filterUnread`, `notifications.filterAll` (en + zh) so the InboxPopover Unread/All sub-filter renders in the active locale.
 - 5425608: CRM UX polish pass — calmer enterprise look across detail + kanban.
+
   - **plugin-kanban**: column headers now use a 2px muted accent stripe with
     neutral foreground titles + a quiet grey count pill instead of full
     rainbow gradient + colored title + colored count. Pipeline boards
@@ -2410,6 +3061,7 @@ actionName, spec)`: overlays translated `title` / `description` /
   `defaultCurrency` is set on the field/column, formatting is unchanged.
 
   Fixed call sites:
+
   - `@object-ui/fields`: `formatCurrency`, `formatCompactCurrency`, and
     `CurrencyCellRenderer` no longer default-param `'USD'`.
   - `@object-ui/i18n`: `formatCurrency()` falls back to `formatNumber`
@@ -2433,6 +3085,7 @@ actionName, spec)`: overlays translated `title` / `description` /
 ### Minor Changes
 
 - 49b1760: Polish the ConcurrentUpdateDialog and add i18n.
+
   - Internationalise all dialog strings (title, body, button labels, "your edit" / "current value" headings, audit-trail line) through `useDetailTranslation`. Locale strings added to `@object-ui/i18n` for English and Chinese.
   - Replace the plain dialog header with an amber warning badge + `AlertTriangle` icon to communicate that this is a conflict, not a routine confirmation.
   - Visually differentiate the two value blocks: amber tint for the user's pending edit, sky tint for the server's current value. Both wrap long values cleanly.
@@ -2498,6 +3151,7 @@ actionName, spec)`: overlays translated `title` / `description` /
   default detail view. They were missing cross-cutting affordances and
   shipped with English-only tab labels and heavy bordered section cards
   even when the host locale was Chinese. Track 1 closes the visible gap:
+
   - **app-shell `RecordDetailView`**: the `assignedPage` branch now wears
     the same chrome as the default branch — lifecycle managed-by badge
     and presence avatars in the top-right, `MetadataPanel` debug panel,
@@ -2553,6 +3207,7 @@ actionName, spec)`: overlays translated `title` / `description` /
   The matrix/summary "Group by" (rows) and "Columns axis" (cols) sections now
   share the same searchable popup picker as the columns section, with a
   commit-on-select single-pick mode wired through `FieldPickerDialog`.
+
   - Per-row field buttons display the human-readable field label and open a
     dialog scoped to swap that single field (already-used fields filtered out)
   - "Add grouping" trigger uses the same dialog
@@ -2562,6 +3217,7 @@ actionName, spec)`: overlays translated `title` / `description` /
   - Bigger row spacing (h-7 / text-xs) — the old `text-[10px]` was unreadable
 
   `FieldPickerDialog` gains:
+
   - `commitOnSelect`: hides the Confirm/Cancel footer; clicking a row commits
     - closes immediately (intended for `singleSelect` flows)
   - `trigger`: custom trigger element override (used by the per-row field button)
@@ -2590,6 +3246,7 @@ actionName, spec)`: overlays translated `title` / `description` /
   in the spec.
 
   New exports from `@object-ui/plugin-report`:
+
   - `JoinedBlocksEditor` — standalone component for embedding the
     block editor anywhere.
   - `validateJoinedBlocks` — pure helper returning translated
@@ -2621,6 +3278,7 @@ actionName, spec)`: overlays translated `title` / `description` /
   The report configuration panel is now safe to open on any spec-shape `Report` and only exposes fields that are actually persisted by `@objectstack/spec`.
 
   `@object-ui/plugin-report`:
+
   - Add a bidirectional `SpecFilterAdapter` so `ReportConfigPanel` can edit
     spec `FilterCondition` filters (`{field: value}`, `{field: {$op: value}}`,
     top-level `$and`/`$or`). Complex / nested filters fall back to a
@@ -2642,12 +3300,14 @@ actionName, spec)`: overlays translated `title` / `description` /
   - 18 new unit tests cover the filter adapter round-trip.
 
   `@object-ui/components`:
+
   - `FilterBuilder` now guards against malformed external `value` props.
     Previously a spec-shape filter (`{is_active: true}`) would crash the
     component on first render; the builder now falls back to an empty
     AND group whenever `value` is not a valid `FilterGroup`.
 
   `@object-ui/i18n`:
+
   - Add `report.editor.*` strings to `en` and `zh`.
 
 - 8442c05: Improve report editor panel usability based on real-user browser testing:
@@ -2727,6 +3387,7 @@ actionName, spec)`: overlays translated `title` / `description` /
   no visible effect — the user/session were nulled but the UI stayed authenticated.
 
   Changes:
+
   - **`@object-ui/auth`** — added `isAuthEnabled: boolean` to `AuthContextValue`
     (`true` only when real auth is in use, `false` for guest/preview modes).
   - **`@object-ui/app-shell`** — `AppHeader` and `AppSidebar` now hide the "Log out"
@@ -2744,6 +3405,7 @@ actionName, spec)`: overlays translated `title` / `description` /
 - fd15918: Comprehensive i18n refactor + CI test fix.
 
   **i18n (`@object-ui/i18n`)**
+
   - Added ~130 new keys under 12 new top-level namespaces: `layout`, `search`,
     `empty`, `renderer`, `actionDialog`, `rowAction`, `navigationSync`,
     `objectActions`, `objectViewActions`, `dashboardActions`, `recordDetail`,
@@ -2755,6 +3417,7 @@ actionName, spec)`: overlays translated `title` / `description` /
 
   **App shell (`@object-ui/app-shell`)** — replaced hardcoded English in 14
   files with `useObjectTranslation`:
+
   - Layout: `AppSidebar`, `ActivityFeed` (locale-aware relative time),
     `MetadataInspector`.
   - Views: `SearchResultsPage`, `ActionParamDialog`, `RecordFormPage`,
@@ -2766,12 +3429,14 @@ actionName, spec)`: overlays translated `title` / `description` /
     `useObjectActions` (delete confirm + success / failure toasts).
 
   **Plugin grid (`@object-ui/plugin-grid`)**
+
   - `ObjectGrid` record-detail panel now translates Empty / Yes / No / System
     via the existing `useGridTranslation` safe-fallback wrapper.
   - `RowActionMenu` adopts a local safe-fallback i18n wrapper for
     `Open menu` / `Edit` / `Delete`, preserving standalone-usage guarantees.
 
   **CLI test fix (`@object-ui/cli`)**
+
   - `cli-bin.test.ts` auto-builds the package on first run when `dist/cli.js`
     is missing, instead of throwing. This unbreaks `pnpm test:coverage` in CI
     (root vitest run does not honor turbo's `^build` deps) and removes the
diff --git a/packages/i18n/package.json b/packages/i18n/package.json
index bd8a86bc19..bf8ff6519d 100644
--- a/packages/i18n/package.json
+++ b/packages/i18n/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/i18n",
-  "version": "17.3.0",
+  "version": "17.4.0",
   "type": "module",
   "sideEffects": false,
   "license": "MIT",
diff --git a/packages/layout/CHANGELOG.md b/packages/layout/CHANGELOG.md
index 8074b5df19..60df063ad9 100644
--- a/packages/layout/CHANGELOG.md
+++ b/packages/layout/CHANGELOG.md
@@ -1,5 +1,205 @@
 # @object-ui/layout
 
+## 17.4.0
+
+### Patch Changes
+
+- 6bd6a4d: `registerLayout()` 的 `inputs` 声明面与渲染器实现对齐 —— 校验器不再对正确写法报假诊断
+
+  `inputs` 是**作者面**:`sdui-parser/src/validate.ts` 拿一个节点的顶层属性逐个比对
+  `comp.inputs`,不在其中的报 `unknown-prop`,类型不符的报 `type-mismatch`;设计器面板、
+  `sdui.manifest.json`、生成的 JSX 类型也都由它派生。所以声明面写错的代价不是"文档不全",
+  而是**校验器对着能正常渲染的 schema 说谎**(objectui#3972,与 objectui#3900 同族、换到属性面)。
+
+  两处修正,都是按渲染器**实际读点**审计出来的:
+
+  - **`page-header` 补声明 `icon` 与 `actions`。** 两个键三面齐全:渲染器真读
+    (`PageHeader.tsx:117` 取参 `:224-226` 渲染 icon;`:119` 取参 `:192-196` 把 actions
+    委派给 `record:quick_actions`)、`@objectstack/spec/ui` 的 `PageHeaderProps` 声明、
+    `ManifestInputType` 表达得了(`string` / `array`)。`content/docs/layout/page-header.mdx`
+    的 Component Props 段落也把两者写成公开契约,而该文档页**唯一**的 live demo
+    (`layout-page-header/pageheader-with-actions`)就写着 `"icon": "users"` —— 于是仓内
+    自己的文档示例每次过 manifest 门都收到一条 `unknown-prop: page-header has no prop "icon"`。
+    `actions` 的类型与 canonical 的 `page:header` 逐字一致(`type: 'array'`),一个概念一个键
+    一种类型。
+  - **`navigation-renderer` 的 `items` 由 `type: 'object'` 改为 `'array'`。**
+    `NavigationRendererProps.items` 是 `NavigationItem[]`(`NavigationRenderer.tsx:108`),
+    而 `checkType` 对 `'object'` 判 `typeof value === 'object' && !Array.isArray(value)`、
+    对 `'array'` 判 `Array.isArray`(`validate.ts:124-129`)—— 两者互斥。所以旧声明对这个
+    渲染器**唯一能渲染的形状**报 `type-mismatch ... expected an object`,而对真会让它崩的
+    对象形状一言不发。这不是 objectui#3832 的表达力问题:`ManifestInputType` 本来就有
+    `'array'`,只是声明写错了一个表达得了的类型。
+
+  **刻意不声明**的键同样被钉住,因为"照抄 spec 的 shape"是这条修复最容易滑进去的反向缺陷:
+  `breadcrumb`(spec 有、这个渲染器零读点 —— 声明它就是 objectui#3829 的缺陷方向)、
+  `showBack` / `action` / `description`(渲染器读、spec 无此键 —— 声明任一个就是在开第二套
+  方言,正是 objectui#3226 收窄要防的事)、`aria`(每个 block 都因同一理由省略的可访问性逃逸口)。
+
+  渲染输出逐字节不变:渲染路径从不读 `inputs`。变化只在校验/设计器/清单这一侧,且两个方向
+  都钉了 —— 正确写法放行的同时,`description` 这类刻意不声明的键仍报 `unknown-prop`、
+  `items` 写成对象仍报 `type-mismatch`(诊断没有被弄哑)。
+
+- 876e3f7: `@object-ui/layout` no longer tells bundlers it has no side effects while registering components at load time (objectui#3899)
+
+  The published manifest declared `"sideEffects": false` — a promise that no module
+  in the package does anything on evaluation, so any module whose exports go unused
+  may be dropped whole. But `src/index.ts` ends with a bare
+  `try { registerLayout(); } catch {}`, and that call is the only thing that puts
+  `page-header`, `page:card`, `app-shell`, `responsive-grid`,
+  `navigation-renderer` and `app-schema-renderer` into the `ComponentRegistry`.
+
+  Both statements cannot be true, and a bundler that believes the manifest is
+  right to delete the registration. Measured with the repo's own bundler by
+  building `import '@object-ui/layout';` — the side-effect-only import, i.e. the
+  documented "import it to register" pattern:
+
+  - `sideEffects: false` — the bundle is **0 bytes**. Zero registrations, exit
+    code 0, no warning.
+  - after this change — the bundle keeps all six `ComponentRegistry.register`
+    calls.
+
+  A dropped registration does not fail where it happened. It surfaces later as a
+  red `Unknown component type` panel (OBJUI-001) on a fully green build, with
+  nothing in the build log to connect the two. Nobody had been bitten yet only
+  because every consumer today ALSO imports a named export, which forces the module
+  to be evaluated regardless — coincidence, not design. objectui#3787 met the
+  hazard and routed around it by calling `registerLayout()` explicitly.
+
+  `sideEffects` is now the narrowest honest answer: an array naming the modules
+  that actually register, rather than `true`, which would be honest but would hand
+  the whole package to every bundler as unshakeable.
+
+  ```json
+  "sideEffects": ["./dist/index.js", "./dist/index.umd.cjs", "./src/index.ts"]
+  ```
+
+  All three are load-bearing, and the set is derived from the manifest rather than
+  guessed:
+
+  - `./dist/index.js` and `./dist/index.umd.cjs` are every JS file the manifest's
+    own entry fields point at (`module` / `main` / `exports` import+require). The
+    library build inlines everything into those two files, so there is no third
+    chunk to name.
+  - `./src/index.ts` is not published (`files` ships `dist` only) but is bundled
+    for real: `apps/console` and `examples/console-starter` both alias the
+    specifier straight at `packages/layout/src`, and a bundler reads this same
+    manifest for those files. With only the published paths declared, the console's
+    alias shape still produced a 0-byte bundle.
+
+  What deliberately did NOT change: the load-time `registerLayout()` itself.
+  Replacing it with an explicit registration API is the opposite direction — it
+  eliminates the side effect instead of declaring it, and it is breaking for any
+  consumer relying on automatic registration. objectui#3899 leaves that call to the
+  maintainer, and the two steps do not conflict: once the manifest tells the truth,
+  the migration to explicit registration can happen whenever it is wanted.
+
+  A new pin (`packages/layout/src/__tests__/side-effects-manifest.test.ts`) runs a
+  real bundler build per entry form and asserts the registrations survive a
+  side-effect-only import, with a `sideEffects: false` control per form asserting
+  they are dropped — so the pin cannot pass because the bundler stopped shaking
+  anything. The required set is derived from the manifest's own entry fields, so a
+  renamed build output or a new `exports` subpath fails as a missing declaration
+  instead of drifting silently.
+
+- f3b2874: `navigation-renderer` 的 `items` 声明为 `required: true` —— 校验器不再放过必崩的节点
+
+  `items` 在组件侧是**非可选**的 `NavigationItem[]`(`NavigationRendererProps.items`,无 `?`),
+  渲染器也不给默认值,而注册声明一直没写 `required`。`sdui-parser` 只在 `input.required` 为真时
+  报 `missing-required-prop`(`validate.ts:55-64`),于是 `{ "type": "navigation-renderer" }`
+  这个节点**校验零诊断、渲染直接抛**:第一处无守卫的读点是 `pinnedItems` memo 里的
+  `collectPinnedItems(filteredItems)`(`NavigationRenderer.tsx:1242` → `:1410` 的
+  `for (const item of items)`),实测 `TypeError: items is not iterable`。
+  (`resolveActiveNavItem` memo 挡得住 —— 它的 `visit` 首行是 `if (!nodes) return`;
+  `:1247` 的 `filteredItems.slice()` 同样会抛,但根本走不到。)
+
+  这是 objectui#3972(键的**存在**与**类型**三面对齐)的第四面:**可选性**。#3972 与
+  objectui#3900 都是删除假诊断,这一条相反——它是**收紧**。
+
+  **blast radius:** 今天省略 `items` 写 `navigation-renderer` 的 schema,会新增一条
+  **error** 级 `missing-required-prop`。受影响面是仓外按 `inputs` / `packages/layout/README.md`
+  做 schema 驱动的消费者(仓内没有任何 JSON 元数据把它当 schema 节点写,React 调用侧的必填由
+  TS 兜住;`examples/schema-catalog` 的 `not-a-container` 对照节点补了 `items: []`,使它只剩
+  那一处故意植入的缺陷)。而这条诊断新拦下的形状,**恰好等于渲染必然崩溃的形状** —— 让作者
+  (尤其是 AI 作者)在发布期就听到运行期注定要发生的失败,正是 `missing-required-prop` 存在
+  的理由。若某个消费者确实想要"缺 items 就渲染空导航",那是给组件加 `= []` 默认值的另一条路
+  (objectui#3987 里记了,与本改动不互斥),而不是让校验器继续沉默。
+
+  `basePath` **保持可选**并被钉成对照:渲染器真的给了它默认值(`basePath = ''`)。`required`
+  是逐个属性从组件读出的事实,不是一刀切——否则这道门会开始拒绝完全能渲染的 schema,作者就会
+  学着无视 `missing-required-prop`,正如 #3972 里他们被教着无视 `type-mismatch`。
+
+- 82f8dff: `page-header` 注册补 `isContainer: true` —— 校验器不再对文档承诺的 children 写法报 `not-a-container`
+
+  `PageHeader` 一直**有意**把 `schema.children` 渲染进右侧动作槽(`PageHeader.tsx:182`,
+  `record:quick_actions` 嵌在 `page:header.children` 下就是靠它),
+  `content/docs/layout/page-header.mdx` 把该槽的优先级(`action` → React `children` →
+  `actions` → schema children)写成公开契约,该文档页唯一的 live demo
+  (`layout-page-header/pageheader-with-actions`)正是这个形状且实测正常渲染。但
+  `packages/layout/src/index.ts` 的注册漏了 `isContainer: true`。
+
+  漏这个 flag 从来没有挡住任何渲染 —— 渲染路径根本不读它(`SchemaRenderer` 把
+  `children` 从 React props 里剥掉当元数据,而始终把整个节点作为 `schema` 传下去,
+  `PageHeader` 自己再把 `schema.children` 放回槽里)。它的消费者在别处:`sdui-parser`
+  的 `not-a-container` 诊断、Studio 调色板元数据、react-page 标签表。所以真正的后果是
+  **校验器在说谎**:作者照文档写出能正常渲染的 schema,却拿到一条
+  "`page-header` does not accept children" 的 warning;信了这条 warning 去掉 children,
+  右槽就空掉。而会说谎的 warning 比缺一条 warning 更贵 —— 它训练作者(尤其 AI 作者)
+  连真实的 `not-a-container`(那些确实不收子节点的组件)一起无视。
+
+  这不是在 spec 之外新开作者面:`children` 是 objectui JSON 协议里**每个节点**的基础属性
+  (`sdui-parser/src/validate.ts` 的 `BASE_PROPS` 把它和 `type`/`id`/`className` 并列),
+  不是 `PageHeaderProps` 的键。所以这个 flag 回答的是协议层面的"该节点是否接受子节点列表",
+  而对这个组件,答案一直是"是"。维护者 2026-08-09 就 objectui#3900 的 A/B 分叉裁定 A 案,
+  理由同上。
+
+  行为面变化极窄:注册元数据一个布尔位。渲染输出逐字节不变(渲染路径不读该 flag);
+  `sdui-parser` 对带 children 的 `page-header` 少报一条 warning;设计器把它当容器对待
+  (即它本来的样子)。canonical 的 `page:header`(`@object-ui/components`)不在此列且刻意不动
+  —— 那个渲染器完全不读 `schema.children`,所以它没有 `isContainer` 是正确的。
+
+  两个方向都已钉住:文档 demo 走应用真实构建的 manifest 后不再产生 `not-a-container`,
+  而一个真正不收子节点的组件(`navigation-renderer`)带 children 时诊断照旧触发 ——
+  后者是前者的对照,保证这条修复不是把诊断弄哑了。
+
+- Updated dependencies [794c497]
+- Updated dependencies [993336f]
+- Updated dependencies [f0a625a]
+- Updated dependencies [b5980f4]
+- Updated dependencies [8aad9fd]
+- Updated dependencies [6719877]
+- Updated dependencies [56ff091]
+- Updated dependencies [0cbdca8]
+- Updated dependencies [d229dfa]
+- Updated dependencies [ecae400]
+- Updated dependencies [4bc6c23]
+- Updated dependencies [d3e738a]
+- Updated dependencies [c3b01a7]
+- Updated dependencies [7ed3360]
+- Updated dependencies [0fa5e4d]
+- Updated dependencies [5bfaabd]
+- Updated dependencies [e06810e]
+- Updated dependencies [ab3ad4f]
+- Updated dependencies [c2fd122]
+- Updated dependencies [e24d767]
+- Updated dependencies [aca561a]
+- Updated dependencies [48132f7]
+- Updated dependencies [0ef9dfd]
+- Updated dependencies [1d723e3]
+- Updated dependencies [0109f54]
+- Updated dependencies [7e5bb5d]
+- Updated dependencies [fbc23e0]
+- Updated dependencies [e6fdbdc]
+- Updated dependencies [54233b1]
+- Updated dependencies [97b63d7]
+- Updated dependencies [6bb454a]
+- Updated dependencies [523be48]
+- Updated dependencies [7e2b7e9]
+- Updated dependencies [c1e1e6b]
+  - @object-ui/components@17.4.0
+  - @object-ui/react@17.4.0
+  - @object-ui/core@17.4.0
+  - @object-ui/types@17.4.0
+
 ## 17.3.0
 
 ### Minor Changes
@@ -17,6 +217,7 @@
   the switcher and instead rendered as a selectable, empty area.
 
   ## What changed
+
   - **Area visibility is now derived, not authored.** An area appears in the
     switcher iff at least one of its navigation items survives the exact
     item-level guards `NavigationRenderer` applies: the `visible` expression,
@@ -1012,6 +1213,7 @@
 - b703480: feat(layout): smoother sidebar transitions
 
   `SidebarNav` now animates the previously-instant state changes:
+
   - Active-state colour swap on `SidebarMenuButton` /
     `SidebarMenuSubButton` is wrapped in `transition-colors duration-150`
     so navigating between rows glides rather than snaps.
@@ -1091,6 +1293,7 @@
   record detail page (lead, opportunity, future account/contact/case).
   Before this change it had two problems that bled into every custom
   page across the product:
+
   1. **Quadruple registration**: `@object-ui/layout` registered both
      `page-header` and `page:header`, and `@object-ui/components`
      independently registered `page:header` (and `page:section`).
@@ -1101,6 +1304,7 @@
      than the default detail view it was meant to supersede.
 
   This commit:
+
   - Removes the `@object-ui/layout` `page:header` registration. The
     layout package keeps the legacy kebab-cased `page-header` alias only.
     The canonical renderer now lives in `@object-ui/components` and is
@@ -1179,6 +1383,7 @@
 - d714e85: Lookup display-name resolution now falls back through a Salesforce-style chain
   when an `$expand`'d reference object lacks a top-level `name`/`label`/
   `display_name`/`title` field:
+
   1. Standard display fields (existing behaviour)
   2. `salutation first_name last_name` composite — handles person records that
      only carry first/last name parts
@@ -1237,6 +1442,7 @@ Lin` and no `name` field now renders as `Bob Lin` everywhere — instead of
   pages without a record context are unaffected.
 
 - 2bd45af: feat(shell): main becomes the scroll container; record tabs are sticky
+
   - `AppShell`'s SidebarProvider wrapper is now constrained to viewport
     height (`h-svh overflow-hidden`) instead of expanding with content via
     the default `min-h-svh`. This makes the inner `<main>` (which is
@@ -1259,6 +1465,7 @@ Lin` and no `name` field now renders as `Bob Lin` everywhere — instead of
 ### Patch Changes
 
 - 6b683c8: fix(detail): clean up record page rendering
+
   - Drop `ai:chat_window` from the protocol-component placeholder list. The
     floating chat overlay (plugin-chatbot) is the canonical AI entry point;
     inline page schemas that still reference `ai:chat_window` now surface
@@ -1272,6 +1479,7 @@ Lin` and no `name` field now renders as `Bob Lin` everywhere — instead of
     as a fallback so both inlined and raw-bag schema shapes are supported.
 
 - 0d8eb98: feat(detail): Salesforce-style record header + section field grid
+
   - `page:header` now renders an icon chip (resolves Lucide names via
     `LazyIcon`) plus subtitle, so detail pages can show
     "Name / Company" without an extra component.
@@ -1430,6 +1638,7 @@ Lin` and no `name` field now renders as `Bob Lin` everywhere — instead of
   Library builds (vite lib mode) now externalize every non-relative import instead of bundling third-party CJS dependencies into the published dist. This avoids inlined `require("react")` / `require("react-dom")` calls that cause `Calling \`require\` for "react" in an environment that doesn't expose the \`require\` function` runtime errors when consumer apps re-bundle the published dist.
 
   Specifically fixes:
+
   - `@object-ui/plugin-dashboard` no longer inlines `react-grid-layout` (and its transitive `react-draggable` / `react-resizable` CJS bundles). `react-grid-layout` is now declared as a peer dependency so consumers install a single ESM-friendly copy.
   - `@object-ui/components`, `@object-ui/plugin-calendar`, `@object-ui/plugin-charts`, `@object-ui/plugin-designer` no longer inline `react-i18next` / `i18next` / `use-sync-external-store` CJS shims.
   - All plugin packages now use a unified `external: (id) => !/^[./]/.test(id) && !id.startsWith(__dirname)` rule, ensuring future additions of CJS deps are automatically externalized.
diff --git a/packages/layout/package.json b/packages/layout/package.json
index fd23bfdbf2..0fc6ccbb58 100644
--- a/packages/layout/package.json
+++ b/packages/layout/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/layout",
-  "version": "17.3.0",
+  "version": "17.4.0",
   "type": "module",
   "sideEffects": [
     "./dist/index.js",
diff --git a/packages/mobile/CHANGELOG.md b/packages/mobile/CHANGELOG.md
index a37cc84485..9c926a3d15 100644
--- a/packages/mobile/CHANGELOG.md
+++ b/packages/mobile/CHANGELOG.md
@@ -1,5 +1,174 @@
 # @object-ui/mobile
 
+## 17.4.0
+
+### Minor Changes
+
+- 48132f7: Track the `@objectstack` family at `17.0.0-rc.5` (objectui#3560).
+
+  The pin moves from `^17.0.0-rc.2` to `^17.0.0-rc.5` across all 37 declarations in
+  30 `package.json` files, and the sibling `@objectstack/*` packages (`client` /
+  `formula` / `lint`) move with it — they pin `@objectstack/spec` **exactly**, so
+  leaving them behind would keep a second copy of the spec in the tree and have
+  `@objectstack/lint` validating against schemas that still accept the keys rc.3–rc.5
+  retire. `pnpm-lock.yaml` now resolves one copy of each of the six family packages
+  (`spec` / `client` / `core` / `formula` / `lint` / `sdui-parser`), all at rc.5.
+
+  Bumping the pin and repairing the fallout cannot be split: the pin alone reddens
+  CI, and the code alone targets a shape that is not in effect yet.
+
+  ## A live bug this upgrade fixes
+
+  **`ObjectStackDataSource.delete()` never emitted its mutation event, and resolved
+  `undefined` instead of a boolean.** `@objectstack/client`'s `DeleteDataResult`
+  declared a key called `deleted` — a key no schema has ever declared and no server
+  path has ever returned on `DELETE /data/:object/:id`. So `result.deleted`
+  compiled and read `undefined` at runtime: the guard never fired, a successful
+  delete notified no subscriber, and every consumer's cache stayed stale.
+  objectstack#5638 corrected the interface to the schema's `success`; following the
+  rename is what restores both behaviours. Nothing in this repo had to change shape
+  for it — the code was already asking the right question of the wrong key.
+
+  ## Breaking, in FROM → TO form
+
+  - **The five `@objectstack/spec/ui` interaction-config modules are gone** —
+    touch / dnd / keyboard / animation / offline, 32 defs and 64 exports
+    (objectstack#4988, PR objectstack#5321). None of them had an authoring door: no
+    metadata document could ever carry one of these blocks, so a stack that parsed
+    before the retirement parses byte-for-byte the same after it. `@object-ui/types`
+    drops the 32 `export type` re-exports. The vocabulary each one's only real
+    consumer needs is now declared by that consumer, which is the remedy the spec's
+    own retirement ledger prescribes ("declare that union locally — it is your
+    client's policy, not the platform's"):
+
+    - `@object-ui/react`'s `useOffline` owns `OfflineStrategy`, `ConflictResolution`,
+      `PersistStorageType`, `EvictionPolicyType`, `OfflineConfig`,
+      `OfflineCacheConfig`, `OfflineSyncConfig`;
+    - `@object-ui/core`'s `DndProtocol` / `KeyboardProtocol` own `DndConfig`,
+      `DragItem`, `DropZone`, `DragConstraint`, `DragHandle`, `DropEffect`,
+      `KeyboardNavigationConfig`, `KeyboardShortcut`, `FocusManagement`,
+      `FocusTrapConfig`;
+    - `@object-ui/types`' `mobile` module owns `SpecGestureConfig`,
+      `SwipeGestureConfig`, `PinchGestureConfig`, `LongPressGestureConfig`,
+      `TouchTargetConfig`, `TouchInteraction` (plus a new `SPEC_GESTURE_TYPES`
+      runtime tuple), so `@object-ui/mobile`'s import paths are unchanged.
+
+    Every shape is moved verbatim — same keys, same members, same optionality — so
+    no hook or bridge changes behaviour. Consumers importing these names from
+    `@object-ui/types` must import them from the owning package instead. Note the
+    spec's _surviving_ `ConnectorConflictResolution` (`/integration`, connector sync)
+    and `ConflictResolutionStrategy` (`/api`, route merge policy) are **different
+    concepts** — do not re-point at them.
+
+  - **`@object-ui/types` no longer re-exports `NotificationAction` or `EmbedConfig`**
+    (objectstack#5015, PR objectstack#5300). Both were published `ui` vocabulary with
+    no authoring door; no notification action was ever parsed from metadata and no
+    iframe route ever read an embed config. The presentation enums
+    (`NotificationType` / `NotificationSeverity` / `NotificationPosition`) and
+    `SharingConfig` **survive** and are untouched — public form sharing still gates
+    the anonymous endpoints on `allowAnonymous` + `publicLink`.
+    `@object-ui/core`'s `SharingProtocol` keeps `resolveEmbedConfig` /
+    `generateEmbedCode` against a locally declared `EmbedConfig`, so its surface is
+    unchanged.
+  - **`ThemeEngine` stops emitting nine retired CSS variable groups**
+    (objectstack#5021 option 2, PR objectstack#5289). `theme.animation`,
+    `theme.zIndex` and five typography groups (`fontSize` / `fontWeight` /
+    `lineHeight` / `letterSpacing`, plus `fontFamily.heading` / `fontFamily.mono`)
+    are tombstones the schema now rejects by name, so `--duration-*`, `--timing-*`,
+    `--z-*`, `--font-size-*`, `--font-weight-*`, `--line-height-*`,
+    `--letter-spacing-*`, `--font-heading` and `--font-mono` had become structurally
+    dead code — no author could produce the input that reached them.
+    `generateAnimationVars` and `generateZIndexVars` are removed from
+    `@object-ui/core`, and `@object-ui/types` drops `Animation` / `ZIndex` /
+    `AnimationSchema` / `ZIndexSchema`. **`theme.customVars` is the declared — and
+    since #5021 the only — door**: each entry is emitted verbatim as
+    `--<key>: <value>`, so a `--z-modal` or a `--duration-fast` goes there now.
+    LIVE emission is untouched byte for byte: `colors`, `borderRadius`, `shadows`,
+    `typography.fontFamily.base` (→ `--font-sans`) and `customVars`.
+  - **`@object-ui/types`' `HttpMethodSchema` now binds the spec's
+    `HttpMethodSubsetSchema`, and `HttpMethod` binds `HttpMethodSubset`**
+    (objectstack#5832, PR objectstack#5976 — objectui#3499). The spec renamed its
+    5-value UI subset because `schemaNameFromExportKey` strips the `Schema` suffix,
+    so the 5-value and 7-value enums both published as `shared/HttpMethod` and the
+    later write won — the emitted JSON Schema and reference page described only one
+    of them. **The runtime domain is unchanged and this repo's exported names are
+    unchanged**; this follows the rename without touching cross-package semantics.
+    Deliberately NOT re-pointed at the spec's bare `HttpMethod`: that is the 7-value
+    enum, and widening to it would let `method: 'HEAD'` compile and then throw in
+    `HttpRequestSchema.parse()`.
+  - **`dashboard.widgets[].actionUrl` / `actionType` / `actionIcon` / `aria` are
+    refused, not stripped** (objectstack#5010, ADR-0049 enforce-or-remove). A
+    dashboard widget has no action button and never had one — every action the
+    dashboard dispatches comes from `header.actions[]` — and no renderer ever applied
+    the widget `aria`, so it promised accessibility compliance it did not deliver.
+    A stale dashboard now gets a named error telling it where the affordance moved,
+    instead of silently losing it. Run `os migrate meta --from 16` to rewrite.
+
+- e6fdbdc: Reclaim the natural names `GestureType` and `GestureConfig` (objectui#3363).
+
+  `@objectstack/spec` 17.0.0-rc.3 deleted the whole `ui/touch` module
+  (objectstack#4988, PR objectstack#5321), vacating three names objectui had
+  renamed **away from** in objectstack#4115 purely to avoid a collision. Two of
+  those workarounds have now outlived their reason and are undone.
+
+  ## Breaking, in FROM → TO form
+
+  - `TouchGestureType` → **`GestureType`** — objectui's direction-fused recogniser
+    vocabulary (`tap`, `swipe-left`, `swipe-up`, …).
+  - `TouchGestureConfig` → **`GestureConfig`** — the flat gesture→`action` handler
+    binding.
+
+  Both are exported from `@object-ui/types` and re-exported by `@object-ui/mobile`.
+  Nothing about either shape changed: same members, same optionality. Consumers
+  import the new name; there is no other edit.
+
+  **The old names are gone, not deprecated.** This follows the precedent set by the
+  objectstack#4115 rename batch that introduced them, whose own migration note reads:
+  "an alias would preserve exactly the ambiguity being removed". A deprecated alias
+  would be worse here than in the general case, because the ambiguity these renames
+  exist to prevent is between two same-named types — leaving `TouchGestureType`
+  alive next to `GestureType` restores the two-spellings-one-concept problem while
+  claiming to retire it.
+
+  The retired spec vocabulary that used to hold these names still lives in
+  `@object-ui/types`' `mobile` module under its deliberate `Spec…` prefix
+  (`SpecGestureType`, `SpecGestureConfig`, `SwipeGestureConfig`, …), and that prefix
+  is untouched — it is now the only thing distinguishing the two contracts, so
+  `useSpecGesture` still maps one onto the other exactly as before.
+
+  ## `PWAOfflineConfig` is deliberately NOT reclaimed
+
+  The spec vacated `OfflineConfig` in the same retirement, but the spec was never
+  its only claimant: that rename was a **cross-package arbitration between two
+  objectui packages**, and `@object-ui/react` won it. `useOffline`'s config is the
+  offline data/sync model key for key, so it holds the bare `OfflineConfig`, while
+  this package's service-worker route cache stays `PWAOfflineConfig`
+  (objectui#3156 / objectui#3159).
+
+  Before objectui#3560 that name reached `@object-ui/react` from the spec, so the
+  spec-side tripwire covered it by accident. Since the retirement it is declared
+  locally in `packages/react/src/hooks/useOffline.ts`, which means the spec's
+  vacancy no longer says anything about whether the name is free — it is not.
+  Reclaiming it would put two different `OfflineConfig` shapes on the public
+  surface of two packages that are routinely imported together, which is the exact
+  ambiguity objectstack#4115 renamed it away from.
+
+  `page-nav-misc-spec-parity.test.ts` now pins that reason directly instead of
+  leaving it as prose: it asserts `@object-ui/react` still declares
+  `OfflineConfig`, and its failure message tells the next reader that the reclaim
+  has become available if it ever stops.
+
+### Patch Changes
+
+- Updated dependencies [d229dfa]
+- Updated dependencies [c2fd122]
+- Updated dependencies [48132f7]
+- Updated dependencies [7e5bb5d]
+- Updated dependencies [e6fdbdc]
+- Updated dependencies [7e2b7e9]
+- Updated dependencies [c1e1e6b]
+  - @object-ui/types@17.4.0
+
 ## 17.3.0
 
 ### Patch Changes
@@ -594,24 +763,29 @@
 - a2d7023: End-user feature batch — forms, designer history, import/export, and PWA offline sync.
 
   **Forms (`@object-ui/fields`, `@object-ui/providers`)**
+
   - `FileField`: native `<input capture="environment">` camera capture for mobile devices, plus a uploading-progress indicator driven by `UploadProvider`.
   - `ImageField`: per-image inline crop/rotate via the lazy-loaded `ImageCropperDialog` (canvas-based, zero new deps).
   - New `UploadProvider` in `@object-ui/providers` with pluggable adapters for S3 and Azure Blob (plus the default object-URL adapter for local previews). XHR-based with progress, abort, and retry.
   - `LookupField`: `lookup.dependsOn: string | string[]` to chain dependent lookups (e.g. State depends on Country); the trigger is gated until parent values are present and the OData `$filter` is built automatically.
 
   **Container-aware widget widths (`@object-ui/components`)**
+
   - New `useResizeObserver(ref)` hook exposing `{ width, height }` of any element. SSR-safe; reads the initial size via `getBoundingClientRect`.
   - `plugin-gantt` and `plugin-kanban` now react to their container size instead of `window.innerWidth`, so they behave correctly inside split panels and dashboards.
 
   **Designer history (`@object-ui/plugin-designer`)**
+
   - `useUndoRedo` (and therefore `useDesignerHistory`) gains `persistKey` + `storage` options to round-trip the undo/redo stack through `sessionStorage`, plus a `clearPersisted()` cleanup helper. Drafts now survive accidental tab refreshes.
   - New `<HistoryPanel>` component renders the timeline visually with one-click jump-to-checkpoint via the new `jumpTo(index)` API.
 
   **Import wizard (`@object-ui/plugin-grid`)**
+
   - Saved column-mapping templates: name, save, re-apply, and delete via a new template bar in the mapping step. Persisted under `objectui:import-templates:${objectName}` (override via `templateStorageKey` / `templateStorage`).
   - Inline validation correction: cells with errors in the preview step are now editable; corrections feed straight into the import without requiring a re-upload, with green-bar status indicators for fixed rows.
 
   **PWA offline sync (`@object-ui/mobile`)**
+
   - New `MemoryOfflineQueue` / `IndexedDbOfflineQueue` (`createOfflineQueue()` picks the best backend) backed by IndexedDB.
   - `createOfflineDataSource(inner, { queue })` wraps any DataSource so mutations issued while offline (or that fail with a network-style error) are queued and replayed in order on reconnect. Includes `replay()`, `drop()`, `clear()`, `pending()`, an `onChange` notifier, and an opt-in `resolveConflict` hook for stale-write conflicts.
   - New `useOfflineSync(source)` hook exposes `{ isOnline, pending, isReplaying, replay, drop, clear }` and auto-replays on the browser's `online` event.
diff --git a/packages/mobile/package.json b/packages/mobile/package.json
index da4cf9b6df..498b988acf 100644
--- a/packages/mobile/package.json
+++ b/packages/mobile/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/mobile",
-  "version": "17.3.0",
+  "version": "17.4.0",
   "type": "module",
   "license": "MIT",
   "description": "Mobile optimization for Object UI with responsive components, PWA support, and touch gesture handling.",
diff --git a/packages/permissions/CHANGELOG.md b/packages/permissions/CHANGELOG.md
index 83e81cef9e..9f255c0f82 100644
--- a/packages/permissions/CHANGELOG.md
+++ b/packages/permissions/CHANGELOG.md
@@ -1,5 +1,18 @@
 # @object-ui/permissions
 
+## 17.4.0
+
+### Patch Changes
+
+- Updated dependencies [d229dfa]
+- Updated dependencies [c2fd122]
+- Updated dependencies [48132f7]
+- Updated dependencies [7e5bb5d]
+- Updated dependencies [e6fdbdc]
+- Updated dependencies [7e2b7e9]
+- Updated dependencies [c1e1e6b]
+  - @object-ui/types@17.4.0
+
 ## 17.3.0
 
 ### Patch Changes
diff --git a/packages/permissions/package.json b/packages/permissions/package.json
index 5ee0bc860f..e4574d41e5 100644
--- a/packages/permissions/package.json
+++ b/packages/permissions/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/permissions",
-  "version": "17.3.0",
+  "version": "17.4.0",
   "type": "module",
   "license": "MIT",
   "description": "RBAC permission system for Object UI with object/field/row-level access control, permission guards, and hooks.",
diff --git a/packages/plugin-ai/CHANGELOG.md b/packages/plugin-ai/CHANGELOG.md
index 29dfb69748..d8b946c564 100644
--- a/packages/plugin-ai/CHANGELOG.md
+++ b/packages/plugin-ai/CHANGELOG.md
@@ -1,5 +1,48 @@
 # @object-ui/plugin-ai
 
+## 17.4.0
+
+### Patch Changes
+
+- Updated dependencies [794c497]
+- Updated dependencies [993336f]
+- Updated dependencies [f0a625a]
+- Updated dependencies [b5980f4]
+- Updated dependencies [8aad9fd]
+- Updated dependencies [6719877]
+- Updated dependencies [56ff091]
+- Updated dependencies [0cbdca8]
+- Updated dependencies [d229dfa]
+- Updated dependencies [ecae400]
+- Updated dependencies [4bc6c23]
+- Updated dependencies [d3e738a]
+- Updated dependencies [c3b01a7]
+- Updated dependencies [7ed3360]
+- Updated dependencies [0fa5e4d]
+- Updated dependencies [5bfaabd]
+- Updated dependencies [e06810e]
+- Updated dependencies [ab3ad4f]
+- Updated dependencies [c2fd122]
+- Updated dependencies [e24d767]
+- Updated dependencies [aca561a]
+- Updated dependencies [48132f7]
+- Updated dependencies [0ef9dfd]
+- Updated dependencies [1d723e3]
+- Updated dependencies [0109f54]
+- Updated dependencies [7e5bb5d]
+- Updated dependencies [fbc23e0]
+- Updated dependencies [e6fdbdc]
+- Updated dependencies [54233b1]
+- Updated dependencies [97b63d7]
+- Updated dependencies [6bb454a]
+- Updated dependencies [523be48]
+- Updated dependencies [7e2b7e9]
+- Updated dependencies [c1e1e6b]
+  - @object-ui/components@17.4.0
+  - @object-ui/react@17.4.0
+  - @object-ui/core@17.4.0
+  - @object-ui/types@17.4.0
+
 ## 17.3.0
 
 ### Patch Changes
@@ -952,6 +995,7 @@
   Library builds (vite lib mode) now externalize every non-relative import instead of bundling third-party CJS dependencies into the published dist. This avoids inlined `require("react")` / `require("react-dom")` calls that cause `Calling \`require\` for "react" in an environment that doesn't expose the \`require\` function` runtime errors when consumer apps re-bundle the published dist.
 
   Specifically fixes:
+
   - `@object-ui/plugin-dashboard` no longer inlines `react-grid-layout` (and its transitive `react-draggable` / `react-resizable` CJS bundles). `react-grid-layout` is now declared as a peer dependency so consumers install a single ESM-friendly copy.
   - `@object-ui/components`, `@object-ui/plugin-calendar`, `@object-ui/plugin-charts`, `@object-ui/plugin-designer` no longer inline `react-i18next` / `i18next` / `use-sync-external-store` CJS shims.
   - All plugin packages now use a unified `external: (id) => !/^[./]/.test(id) && !id.startsWith(__dirname)` rule, ensuring future additions of CJS deps are automatically externalized.
diff --git a/packages/plugin-ai/package.json b/packages/plugin-ai/package.json
index 6eb0ea05ab..0b1c7709ff 100644
--- a/packages/plugin-ai/package.json
+++ b/packages/plugin-ai/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/plugin-ai",
-  "version": "17.3.0",
+  "version": "17.4.0",
   "type": "module",
   "main": "dist/index.umd.cjs",
   "module": "dist/index.js",
diff --git a/packages/plugin-calendar/CHANGELOG.md b/packages/plugin-calendar/CHANGELOG.md
index 11a44d818b..045741752f 100644
--- a/packages/plugin-calendar/CHANGELOG.md
+++ b/packages/plugin-calendar/CHANGELOG.md
@@ -1,5 +1,129 @@
 # @object-ui/plugin-calendar
 
+## 17.4.0
+
+### Patch Changes
+
+- 5bfaabd: `PageComponentSchema.dataSource` now reaches every object-bound block, not just
+  `list-view` — and `element:record_picker` stops discarding `view`
+  (objectstack#6953).
+
+  objectstack#5576 wired the spec's per-element data binding
+  (`dataSource: { object, view?, filter?, sort?, limit? }`) to `list-view` and left
+  the same declaration inert on every other page component. Two gaps remained, and
+  both were silent:
+
+  - **`element:record_picker` read four of the five keys and dropped `view`.** So
+    `dataSource: { object: 'account', view: 'hot' }` — the spec's own example —
+    built a picker over EVERY account instead of the rows the saved view selects.
+    Nothing threw and nothing rendered an error; the option list was simply wider
+    than what was authored, which also means a user could select a record the page
+    said was out of scope.
+  - **`object-grid` / `object-form` / `object-kanban` / `object-calendar` /
+    `object-chart` / `object-metric` / `record:related_list` read none of it.**
+    Each gates its fetch on its own `objectName`, and nothing mapped
+    `dataSource.object` onto it, so a page written the way the spec documents
+    rendered an empty grid / a field-less form / a board with no cards / an empty
+    month / an empty chart / a static metric number — with no request and no
+    diagnostic anywhere. Spec-valid metadata rendering nothing is the
+    objectstack#4413 shape.
+
+  Composition follows objectstack#5576's landed semantics unchanged on every block:
+  a named saved view supplies the baseline, a key written on the component itself
+  overrides it, an explicit binding key overrides both, `filter` AND-combines
+  ("additional filter criteria" — a binding can narrow a view, never widen it), and
+  a `view` name that does not resolve renders a configuration error instead of
+  degrading to the object's full scope.
+
+  - `@object-ui/react` — new `useElementDataSourceSchema(schema, mapping, dataSource?)`
+    and `ElementDataSourceGate` apply a resolved binding to the schema keys a given
+    block reads, plus `ElementDataSourceErrorPanel` / `ElementDataSourceLoadingPanel`
+    for the two non-final states. One precedence table for all blocks rather than
+    one copy per block — that copy is how "additional filter criteria" would have
+    become two dialects.
+  - A mapping names **only** keys its block genuinely reads. A composed value
+    written onto a key the block ignores would be accepted and dropped, which is
+    the defect being removed, one layer deeper — so a kanban's swimlane `columns`
+    never receive a view's field list, and a block with no row cap leaves `limit`
+    unmapped. The per-block coverage table, including two residual gaps that are
+    named rather than papered over, is in `content/docs/guide/data-source.md`.
+
+  No behaviour changes for a block that carries no `dataSource`: the binding-free
+  path returns the schema by reference, so nothing remounts and nothing refetches.
+
+- Updated dependencies [794c497]
+- Updated dependencies [993336f]
+- Updated dependencies [f0a625a]
+- Updated dependencies [b5980f4]
+- Updated dependencies [8aad9fd]
+- Updated dependencies [6719877]
+- Updated dependencies [56ff091]
+- Updated dependencies [0186cdc]
+- Updated dependencies [7864f03]
+- Updated dependencies [ea41a59]
+- Updated dependencies [0cbdca8]
+- Updated dependencies [d229dfa]
+- Updated dependencies [ecae400]
+- Updated dependencies [4bc6c23]
+- Updated dependencies [d3e738a]
+- Updated dependencies [c3b01a7]
+- Updated dependencies [f5f8744]
+- Updated dependencies [7ed3360]
+- Updated dependencies [69becd2]
+- Updated dependencies [5e52495]
+- Updated dependencies [0fa5e4d]
+- Updated dependencies [b750823]
+- Updated dependencies [5bfaabd]
+- Updated dependencies [e06810e]
+- Updated dependencies [ab3ad4f]
+- Updated dependencies [65bb513]
+- Updated dependencies [c97a45e]
+- Updated dependencies [b19162d]
+- Updated dependencies [c2fd122]
+- Updated dependencies [1bd6faa]
+- Updated dependencies [ac2139c]
+- Updated dependencies [b14ab3a]
+- Updated dependencies [e24d767]
+- Updated dependencies [7b3e048]
+- Updated dependencies [8c60819]
+- Updated dependencies [aca561a]
+- Updated dependencies [e64a52e]
+- Updated dependencies [844d17f]
+- Updated dependencies [d8a0be4]
+- Updated dependencies [48132f7]
+- Updated dependencies [4dcd52a]
+- Updated dependencies [42ae5c6]
+- Updated dependencies [0ef9dfd]
+- Updated dependencies [f4b97c8]
+- Updated dependencies [1d723e3]
+- Updated dependencies [0109f54]
+- Updated dependencies [7e5bb5d]
+- Updated dependencies [fbc23e0]
+- Updated dependencies [6d762da]
+- Updated dependencies [e6fdbdc]
+- Updated dependencies [4178d5a]
+- Updated dependencies [54233b1]
+- Updated dependencies [c2ecbae]
+- Updated dependencies [acc34c5]
+- Updated dependencies [c4768a7]
+- Updated dependencies [f9faa7d]
+- Updated dependencies [97b63d7]
+- Updated dependencies [6bb454a]
+- Updated dependencies [11c1e71]
+- Updated dependencies [523be48]
+- Updated dependencies [7e2b7e9]
+- Updated dependencies [33526fd]
+- Updated dependencies [32413ec]
+- Updated dependencies [c1e1e6b]
+  - @object-ui/components@17.4.0
+  - @object-ui/plugin-detail@17.4.0
+  - @object-ui/react@17.4.0
+  - @object-ui/core@17.4.0
+  - @object-ui/fields@17.4.0
+  - @object-ui/i18n@17.4.0
+  - @object-ui/types@17.4.0
+  - @object-ui/mobile@17.4.0
+
 ## 17.3.0
 
 ### Patch Changes
@@ -1346,6 +1470,7 @@
   detail view (`TypeError: titleFormat.replace is not a function`) and printed
   `Failed to evaluate expression: ${[object Object]}` for every action visibility
   predicate.
+
   - `@object-ui/core`: `ExpressionEvaluator.evaluate` / `evaluateCondition` now
     unwrap Expression envelopes transparently.
   - `@object-ui/react`: new `toPredicateInput()` helper to safely normalize
@@ -1429,6 +1554,7 @@
   Library builds (vite lib mode) now externalize every non-relative import instead of bundling third-party CJS dependencies into the published dist. This avoids inlined `require("react")` / `require("react-dom")` calls that cause `Calling \`require\` for "react" in an environment that doesn't expose the \`require\` function` runtime errors when consumer apps re-bundle the published dist.
 
   Specifically fixes:
+
   - `@object-ui/plugin-dashboard` no longer inlines `react-grid-layout` (and its transitive `react-draggable` / `react-resizable` CJS bundles). `react-grid-layout` is now declared as a peer dependency so consumers install a single ESM-friendly copy.
   - `@object-ui/components`, `@object-ui/plugin-calendar`, `@object-ui/plugin-charts`, `@object-ui/plugin-designer` no longer inline `react-i18next` / `i18next` / `use-sync-external-store` CJS shims.
   - All plugin packages now use a unified `external: (id) => !/^[./]/.test(id) && !id.startsWith(__dirname)` rule, ensuring future additions of CJS deps are automatically externalized.
@@ -1495,15 +1621,18 @@
 - b2be122: fix(mobile): round 2 — kanban readability, calendar default view, timeline dot clipping
 
   **Kanban**
+
   - Remove `font-mono` from card titles, descriptions, column headers, and empty-state labels — CRM cards no longer render in a monospace font.
   - Constrain column body height (`max-h-full min-h-0` + `h-full` on the layout root) so `ScrollArea` activates and cards don't bleed past the viewport bottom.
   - Opportunistically derive `description` (e.g. `$60K · Acme Corp · @owner`) and up to two `badges` (priority/severity/industry/rating) in `ObjectKanban` when the schema/source omits them, giving mobile cards more context at a glance.
 
   **Calendar**
+
   - `ObjectCalendar` previously hardcoded `view={schema.defaultView ?? 'month'}`, making the view-selector dropdown a no-op. Wire the `view` state through to the `<Calendar>` prop so user selection is respected.
   - On mobile (viewport < 768 px) coerce `day` defaults to `month` via a synchronous lazy initialiser and a resize/orientation effect — avoids the useless 24-hour empty-hour grid for date-only events.
 
   **Timeline**
+
   - Add `ml-3` to the `<Timeline>` `<ol>` so the `absolute -left-3` marker dots are no longer clipped at the scroll-container edge.
 
 - Updated dependencies [a2d7023]
diff --git a/packages/plugin-calendar/package.json b/packages/plugin-calendar/package.json
index b873c9460c..817c3ba1fd 100644
--- a/packages/plugin-calendar/package.json
+++ b/packages/plugin-calendar/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/plugin-calendar",
-  "version": "17.3.0",
+  "version": "17.4.0",
   "type": "module",
   "license": "MIT",
   "description": "Calendar view plugins for Object UI - includes both ObjectQL-integrated and standalone calendar components",
diff --git a/packages/plugin-charts/CHANGELOG.md b/packages/plugin-charts/CHANGELOG.md
index 0d9ec840f5..cf02e7f50f 100644
--- a/packages/plugin-charts/CHANGELOG.md
+++ b/packages/plugin-charts/CHANGELOG.md
@@ -1,5 +1,167 @@
 # @object-ui/plugin-charts
 
+## 17.4.0
+
+### Patch Changes
+
+- a7e39a8: `ChartContainer`'s min-size fallback survives a consumer-supplied `style` (objectstack#7026)
+
+  The container wrote `style={{ minHeight: 280, minWidth: 0, ...props.style }}` and
+  then spread `{...props}` on the line BELOW it. `props` is the rest of
+  `ComponentProps< "div" >` — only `id`, `className`, `children`, `config` and
+  `disableSettleRemount` are destructured out of it — so it still carried the
+  consumer's `style`, and a later JSX attribute of the same name replaces an earlier
+  one outright. Any caller that passed a `style` therefore replaced the whole object:
+  both `minHeight` and `minWidth` vanished, and the `...props.style` merge written
+  inside it never executed even once. It was dead code that read, to anyone auditing
+  the file, as if the fallback were guaranteed.
+
+  That fallback is not decorative. It exists so Recharts' `ResponsiveContainer`
+  always has a non-zero box to measure: a dashboard widget that overrides the
+  container's `h-[350px]` class and wraps the chart in flex/grid without an explicit
+  child height leaves the box at 0, Recharts measures `width/height = -1`, and the
+  chart renders invisibly — the exact failure the guard was added for.
+
+  `style` is now destructured out of the rest props and merged explicitly, so which
+  side wins is stated in code instead of being decided by JSX attribute order, and
+  `{...props}` can no longer reach `style` at all.
+
+  Precedence: **an author's explicit size wins.** Simply spreading `{...props}`
+  first and merging unconditionally would have traded this bug for its mirror image
+  — `minHeight: 280` injected next to an authored `height: 100` floors that 100 to
+  280, silently overriding the author. So each half of the fallback applies only
+  when the consumer style declares neither of its own keys: `height`/`minHeight`
+  gate the height half, `width`/`minWidth` gate the width half, and a key present
+  but set to `undefined`/`null` counts as not declared. Every other consumer style
+  key passes through untouched.
+
+  Behaviour change surface, deliberately narrow. A caller that supplies no `style`
+  is byte-for-byte unchanged. A caller whose `style` declares a height — which today
+  is the only shape in the tree, `AdvancedChartImpl`'s `containerProps` forwarding
+  `ChartConfig.height` — keeps exactly the height it authored, also unchanged, and
+  additionally regains the `minWidth: 0` half. What changes is the case the issue
+  was filed for: a `style` carrying no size key (a margin, a padding, an
+  aspect-ratio, any future container-level presentation prop routed through the same
+  `containerProps` path) now keeps the min-size fallback instead of silently
+  stripping it.
+
+  Pinned in both directions, since a one-sided pin would have been satisfied by the
+  mirror-image fix: a non-size `style` keeps `min-height: 280` / `min-width: 0`
+  (red before this change), and an explicit `height: 100` renders as 100 with no
+  `min-height` floor (red under the unconditional-merge alternative).
+
+- 4bc6c23: Converge dashboard widget `compareTo` on the executor's `{ kind, dimension? }` contract, and make the dataset path actually render a comparison
+
+  `CompareToConfig` was a three-branch union (`'previousPeriod' | 'previousYear' | { offset }`). `@objectstack/spec` collapsed it to the shape the analytics executor already implements — `DatasetCompareTo`, a plain strict object `{ kind: 'previousPeriod' | 'previousYear'; dimension?: string }` (objectstack#5011) — so this renderer now reads that one shape:
+
+  - `shiftFilterByCompareTo` / `compareToTrendLabelKey` dispatch on `compareTo.kind`. The `{ offset }` duration shift is gone: `{ offset: '1y' }` is `kind: 'previousYear'`, while `'7d'` / `'1M'` have no faithful target and are restated by the author on the widget's own `filter` plus `kind: 'previousPeriod'`. No trend label key is retired — the offset arm resolved to `vsPreviousPeriod`, which survives as the `previousPeriod` fallback.
+  - `DatasetWidget` no longer discards part of `compareTo`. It used to forward only the object form because the two string forms had no meaning downstream; with one shape there is nothing to discard, and a stale string is now invalid metadata rejected where it is authored rather than silently reinterpreted here.
+  - **The comparison now actually runs on the dataset path.** A widget states its window in its own `filter` (a date macro, or the dashboard date-range filter merged in), but the executor shifts a `timeDimensions` entry carrying a `dateRange` — so a dataset widget asking for a comparison got "compareTo needs a dated window to shift" and rendered none. When (and only when) a comparison is requested, the resolved filter's bounded date windows are lowered into `selection.timeDimensions[].dateRange` and moved out of `runtimeFilter` (a copy left behind would intersect the shifted window with the current one and empty every comparison column). Which dimension gets shifted stays the executor's decision: every window found is lowered under the name the author wrote, and zero or two candidates surfaces the executor's own error, listing them.
+  - The `<measure>__compare` columns that come back are now shown: a delta + window label on KPI widgets, a comparison column on tables, and a `variant: 'comparison'` overlay series on charts — the same treatment and the same `dashboard.trend.*` labels the inline object-provider widgets already use.
+
+- 5bfaabd: `PageComponentSchema.dataSource` now reaches every object-bound block, not just
+  `list-view` — and `element:record_picker` stops discarding `view`
+  (objectstack#6953).
+
+  objectstack#5576 wired the spec's per-element data binding
+  (`dataSource: { object, view?, filter?, sort?, limit? }`) to `list-view` and left
+  the same declaration inert on every other page component. Two gaps remained, and
+  both were silent:
+
+  - **`element:record_picker` read four of the five keys and dropped `view`.** So
+    `dataSource: { object: 'account', view: 'hot' }` — the spec's own example —
+    built a picker over EVERY account instead of the rows the saved view selects.
+    Nothing threw and nothing rendered an error; the option list was simply wider
+    than what was authored, which also means a user could select a record the page
+    said was out of scope.
+  - **`object-grid` / `object-form` / `object-kanban` / `object-calendar` /
+    `object-chart` / `object-metric` / `record:related_list` read none of it.**
+    Each gates its fetch on its own `objectName`, and nothing mapped
+    `dataSource.object` onto it, so a page written the way the spec documents
+    rendered an empty grid / a field-less form / a board with no cards / an empty
+    month / an empty chart / a static metric number — with no request and no
+    diagnostic anywhere. Spec-valid metadata rendering nothing is the
+    objectstack#4413 shape.
+
+  Composition follows objectstack#5576's landed semantics unchanged on every block:
+  a named saved view supplies the baseline, a key written on the component itself
+  overrides it, an explicit binding key overrides both, `filter` AND-combines
+  ("additional filter criteria" — a binding can narrow a view, never widen it), and
+  a `view` name that does not resolve renders a configuration error instead of
+  degrading to the object's full scope.
+
+  - `@object-ui/react` — new `useElementDataSourceSchema(schema, mapping, dataSource?)`
+    and `ElementDataSourceGate` apply a resolved binding to the schema keys a given
+    block reads, plus `ElementDataSourceErrorPanel` / `ElementDataSourceLoadingPanel`
+    for the two non-final states. One precedence table for all blocks rather than
+    one copy per block — that copy is how "additional filter criteria" would have
+    become two dialects.
+  - A mapping names **only** keys its block genuinely reads. A composed value
+    written onto a key the block ignores would be accepted and dropped, which is
+    the defect being removed, one layer deeper — so a kanban's swimlane `columns`
+    never receive a view's field list, and a block with no row cap leaves `limit`
+    unmapped. The per-block coverage table, including two residual gaps that are
+    named rather than papered over, is in `content/docs/guide/data-source.md`.
+
+  No behaviour changes for a block that carries no `dataSource`: the binding-free
+  path returns the schema by reference, so nothing remounts and nothing refetches.
+
+- Updated dependencies [794c497]
+- Updated dependencies [993336f]
+- Updated dependencies [f0a625a]
+- Updated dependencies [b5980f4]
+- Updated dependencies [8aad9fd]
+- Updated dependencies [6719877]
+- Updated dependencies [56ff091]
+- Updated dependencies [7864f03]
+- Updated dependencies [0cbdca8]
+- Updated dependencies [d229dfa]
+- Updated dependencies [ecae400]
+- Updated dependencies [4bc6c23]
+- Updated dependencies [d3e738a]
+- Updated dependencies [c3b01a7]
+- Updated dependencies [f5f8744]
+- Updated dependencies [7ed3360]
+- Updated dependencies [69becd2]
+- Updated dependencies [5e52495]
+- Updated dependencies [0fa5e4d]
+- Updated dependencies [b750823]
+- Updated dependencies [5bfaabd]
+- Updated dependencies [e06810e]
+- Updated dependencies [ab3ad4f]
+- Updated dependencies [c2fd122]
+- Updated dependencies [ac2139c]
+- Updated dependencies [b14ab3a]
+- Updated dependencies [e24d767]
+- Updated dependencies [8c60819]
+- Updated dependencies [aca561a]
+- Updated dependencies [e64a52e]
+- Updated dependencies [844d17f]
+- Updated dependencies [48132f7]
+- Updated dependencies [4dcd52a]
+- Updated dependencies [42ae5c6]
+- Updated dependencies [0ef9dfd]
+- Updated dependencies [1d723e3]
+- Updated dependencies [0109f54]
+- Updated dependencies [7e5bb5d]
+- Updated dependencies [fbc23e0]
+- Updated dependencies [6d762da]
+- Updated dependencies [e6fdbdc]
+- Updated dependencies [54233b1]
+- Updated dependencies [f9faa7d]
+- Updated dependencies [97b63d7]
+- Updated dependencies [6bb454a]
+- Updated dependencies [523be48]
+- Updated dependencies [7e2b7e9]
+- Updated dependencies [33526fd]
+- Updated dependencies [32413ec]
+- Updated dependencies [c1e1e6b]
+  - @object-ui/components@17.4.0
+  - @object-ui/react@17.4.0
+  - @object-ui/core@17.4.0
+  - @object-ui/i18n@17.4.0
+  - @object-ui/types@17.4.0
+
 ## 17.3.0
 
 ### Minor Changes
@@ -872,6 +1034,7 @@
   project `health`) painted its categories from the generic `--chart-1..5`
   palette — the same gap the chart view (`object-chart`) had before #1932. It now
   resolves the dimension field's option colors (using the dataset's base `object`
+
   - dimension→field map the query already returns) and threads them to the
     renderer as a per-category `categoryColors` map, so health green/red/yellow
     paints semantically.
@@ -1078,6 +1241,7 @@
 - 991b62d: Add `compareTo` field to dashboard widgets for period-over-period
   comparison. Supports `'previousPeriod'`, `'previousYear'`, and
   `{ offset: '7d' | '4w' | '1M' | '1y' }`.
+
   - **Metric / gauge widgets** now compute a delta percentage when `compareTo`
     is set and surface it as a derived `trend` (auto-labelled via
     `dashboard.trend.vsLast*` i18n keys sniffed from the filter macros).
@@ -1562,6 +1726,7 @@
   Library builds (vite lib mode) now externalize every non-relative import instead of bundling third-party CJS dependencies into the published dist. This avoids inlined `require("react")` / `require("react-dom")` calls that cause `Calling \`require\` for "react" in an environment that doesn't expose the \`require\` function` runtime errors when consumer apps re-bundle the published dist.
 
   Specifically fixes:
+
   - `@object-ui/plugin-dashboard` no longer inlines `react-grid-layout` (and its transitive `react-draggable` / `react-resizable` CJS bundles). `react-grid-layout` is now declared as a peer dependency so consumers install a single ESM-friendly copy.
   - `@object-ui/components`, `@object-ui/plugin-calendar`, `@object-ui/plugin-charts`, `@object-ui/plugin-designer` no longer inline `react-i18next` / `i18next` / `use-sync-external-store` CJS shims.
   - All plugin packages now use a unified `external: (id) => !/^[./]/.test(id) && !id.startsWith(__dirname)` rule, ensuring future additions of CJS deps are automatically externalized.
@@ -1795,6 +1960,7 @@
 - New plugin-object and ObjectQL SDK updates
 
   **Added:**
+
   - New Plugin: @object-ui/plugin-object - ObjectQL plugin for automatic table and form generation
     - ObjectTable: Auto-generates tables from ObjectQL object schemas
     - ObjectForm: Auto-generates forms from ObjectQL object schemas with create/edit/view modes
@@ -1803,6 +1969,7 @@
   - ObjectQL Integration: Enhanced ObjectQLDataSource with getObjectSchema() method using MetadataApiClient
 
   **Changed:**
+
   - Updated @objectql/sdk from ^1.8.3 to ^1.9.1
   - Updated @objectql/types from ^1.8.3 to ^1.9.1
 
@@ -1819,6 +1986,7 @@
 - Patch release: Add automated changeset workflow and CI/CD improvements
 
   This release includes infrastructure improvements:
+
   - Added changeset-based version management
   - Enhanced CI/CD workflows with GitHub Actions
   - Improved documentation for contributing and releasing
diff --git a/packages/plugin-charts/package.json b/packages/plugin-charts/package.json
index f4ff38f11a..35355a4547 100644
--- a/packages/plugin-charts/package.json
+++ b/packages/plugin-charts/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/plugin-charts",
-  "version": "17.3.0",
+  "version": "17.4.0",
   "type": "module",
   "license": "MIT",
   "description": "Chart components plugin for Object UI, powered by Recharts",
diff --git a/packages/plugin-chatbot/CHANGELOG.md b/packages/plugin-chatbot/CHANGELOG.md
index 28d2ea0791..29354f0bfa 100644
--- a/packages/plugin-chatbot/CHANGELOG.md
+++ b/packages/plugin-chatbot/CHANGELOG.md
@@ -1,5 +1,128 @@
 # @object-ui/plugin-chatbot
 
+## 17.4.0
+
+### Minor Changes
+
+- d9ce385: `ApproveOutcome` / `RejectOutcome` are now derived from `@objectstack/spec`
+  instead of hand-transcribed (objectui#3783). Same failure class #3220 cleared
+  from the same file for `PendingActionRow` / `PendingActionStatus` — but this pair
+  wore local names rather than spec names, so `check-spec-symbol-derivation.mjs`,
+  which fires on a spec export name being occupied, had no handle on it. A renamed
+  hand copy is invisible to a name-based guard by construction.
+
+  Both types now re-export the spec's decision responses
+  (`ApproveAiPendingActionResponse` / `RejectAiPendingActionResponse` from
+  `@objectstack/spec/api` — the same schemas `@objectstack/client`'s
+  `ai.pendingActions.approve()` / `.reject()` type their returns with). The public
+  export names do not change. The shapes do, in three ways:
+
+  - **`ApproveOutcome` no longer declares `id`.** The approve response has never
+    carried one — `id` is on the _reject_ response. This was the one drift that
+    was not dormant: `useHitlInChat`'s public `onDecided` callback promised
+    consumers `id: string` and handed them `undefined` at runtime, with nothing
+    in the compiler to say so. **If you read `outcome.id` after an approve, that
+    read was already `undefined` and now fails to compile** — take the id from
+    `ContinueContext.pendingActionId` or from the row you decided on.
+  - **`status` is closed.** `'executed' | 'failed' | string` and
+    `'rejected' | string` were both just `string`: a union with `string` absorbs
+    the literals, so neither annotation carried any information. They are now
+    `'executed' | 'failed'` and `'rejected'`.
+  - **The `[k: string]: unknown` index signature on `ApproveOutcome` is gone.** The
+    objectstack#4075 mechanism: with it, any structural comparison against the
+    spec answers "identical" however far the copy has drifted, so a parity test
+    bolted onto the old type would have been green from its first day.
+
+  **Breaking at the type level for importers of `@object-ui/plugin-chatbot`** —
+  narrowing a published type is a break even when the old type was lying, which is
+  why it is spelled out here. Shipped as `minor` per AGENTS.md §版本号策略: the
+  family's `major` tracks `@objectstack`'s, and objectui's own breaking changes go
+  out as `minor` with the break named in the changeset.
+
+  Runtime behaviour is unchanged — including the hook's decision handling for a
+  status outside the spec vocabulary, and the locally synthesized failure envelope
+  on a non-2xx, both now pinned by tests. The consumer-side tolerances that remain
+  in `useHitlInChat` are recorded in objectui#3790 for a maintainer decision.
+
+### Patch Changes
+
+- 2a54e86: `parseAiQuotaError` now reads the AI quota refusal code from all three shapes the
+  cloud 429 producers use, instead of only the flat `error`-holds-the-code dialect.
+
+  The two live producers fill the same `error` key in opposite ways — the token
+  guardrail puts the **code** there, `service-ai` puts the **message** there and the
+  code in a `code` sibling — while ADR-0112 declares a third shape both are
+  converging on: `{ success: false, error: { code, message } }`. The consumer had to
+  learn the declared shape **first**, or the producers' convergence would silently
+  turn every quota refusal back into a generic "Response failed" banner (the same
+  consumer-first sequencing as objectui#2992).
+
+  - Code lookup order is a total order — declared envelope, then the flat guardrail
+    code, then the `code` sibling — so a transitional producer that double-emits the
+    new envelope alongside the legacy top-level keys has one defined outcome.
+  - Only the code's **location** widens. The recognized code set is unchanged, and
+    any unrecognized shape still degrades to today's behavior (`null`), so no
+    non-quota error is newly captured by the quota CTA.
+  - Companion fields (`upgrade`, `topUp`, `messageEn`) keep their established
+    top-level read; their position inside the declared envelope is deliberately not
+    presumed, and is aligned once the producer PR fixes the real shape.
+
+- Updated dependencies [794c497]
+- Updated dependencies [993336f]
+- Updated dependencies [f0a625a]
+- Updated dependencies [b5980f4]
+- Updated dependencies [8aad9fd]
+- Updated dependencies [6719877]
+- Updated dependencies [56ff091]
+- Updated dependencies [7864f03]
+- Updated dependencies [0cbdca8]
+- Updated dependencies [d229dfa]
+- Updated dependencies [ecae400]
+- Updated dependencies [4bc6c23]
+- Updated dependencies [d3e738a]
+- Updated dependencies [c3b01a7]
+- Updated dependencies [f5f8744]
+- Updated dependencies [7ed3360]
+- Updated dependencies [69becd2]
+- Updated dependencies [5e52495]
+- Updated dependencies [0fa5e4d]
+- Updated dependencies [b750823]
+- Updated dependencies [5bfaabd]
+- Updated dependencies [e06810e]
+- Updated dependencies [ab3ad4f]
+- Updated dependencies [c2fd122]
+- Updated dependencies [ac2139c]
+- Updated dependencies [b14ab3a]
+- Updated dependencies [e24d767]
+- Updated dependencies [8c60819]
+- Updated dependencies [aca561a]
+- Updated dependencies [e64a52e]
+- Updated dependencies [844d17f]
+- Updated dependencies [48132f7]
+- Updated dependencies [4dcd52a]
+- Updated dependencies [42ae5c6]
+- Updated dependencies [0ef9dfd]
+- Updated dependencies [1d723e3]
+- Updated dependencies [0109f54]
+- Updated dependencies [7e5bb5d]
+- Updated dependencies [fbc23e0]
+- Updated dependencies [6d762da]
+- Updated dependencies [e6fdbdc]
+- Updated dependencies [54233b1]
+- Updated dependencies [f9faa7d]
+- Updated dependencies [97b63d7]
+- Updated dependencies [6bb454a]
+- Updated dependencies [523be48]
+- Updated dependencies [7e2b7e9]
+- Updated dependencies [33526fd]
+- Updated dependencies [32413ec]
+- Updated dependencies [c1e1e6b]
+  - @object-ui/components@17.4.0
+  - @object-ui/react@17.4.0
+  - @object-ui/core@17.4.0
+  - @object-ui/i18n@17.4.0
+  - @object-ui/types@17.4.0
+
 ## 17.3.0
 
 ### Patch Changes
@@ -1000,6 +1123,7 @@ type:'chart', … }}/>` (decoupled — no hard dep on `plugin-charts`), giving t
 - 0335ec4: Polish the AI chat surface based on real-world dogfooding feedback.
 
   **`@object-ui/plugin-chatbot`** — new display helpers shared by `ChatbotEnhanced`:
+
   - `unwrapToolResult(value)` peels the MCP-style `{ type: 'text', value: '<json>' }`
     envelope that backend tools emit (`@objectstack/service-ai`'s data/metadata
     tools, in particular), and JSON-parses the inner payload. The result panel
@@ -1020,6 +1144,7 @@ type:'chart', … }}/>` (decoupled — no hard dep on `plugin-charts`), giving t
   so wrappers can compose richer titles.
 
   **`@object-ui/app-shell`** — `AiChatPage`:
+
   - Removes the fake "Hello! I'm X" assistant welcome bubble so the empty-state
     suggestion chips can actually render.
   - Adds per-agent default suggestion sets (`data_chat`, `metadata_assistant`)
@@ -1472,6 +1597,7 @@ Assistant…  (try "系统里有多少个用户？")`).
 ### Patch Changes
 
 - 1b6dc64: fix: complete Tailwind v3→v4 migration cleanup
+
   - Rename deprecated `flex-shrink-0` → `shrink-0` and `flex-grow-N` →
     `grow-N` (Tailwind v4 dropped the long-form aliases). Affects
     data-table, fields/index, FileField, ChatbotEnhanced,
@@ -1532,6 +1658,7 @@ Assistant…  (try "系统里有多少个用户？")`).
   Library builds (vite lib mode) now externalize every non-relative import instead of bundling third-party CJS dependencies into the published dist. This avoids inlined `require("react")` / `require("react-dom")` calls that cause `Calling \`require\` for "react" in an environment that doesn't expose the \`require\` function` runtime errors when consumer apps re-bundle the published dist.
 
   Specifically fixes:
+
   - `@object-ui/plugin-dashboard` no longer inlines `react-grid-layout` (and its transitive `react-draggable` / `react-resizable` CJS bundles). `react-grid-layout` is now declared as a peer dependency so consumers install a single ESM-friendly copy.
   - `@object-ui/components`, `@object-ui/plugin-calendar`, `@object-ui/plugin-charts`, `@object-ui/plugin-designer` no longer inline `react-i18next` / `i18next` / `use-sync-external-store` CJS shims.
   - All plugin packages now use a unified `external: (id) => !/^[./]/.test(id) && !id.startsWith(__dirname)` rule, ensuring future additions of CJS deps are automatically externalized.
diff --git a/packages/plugin-chatbot/package.json b/packages/plugin-chatbot/package.json
index d6462cf615..5f67079a6c 100644
--- a/packages/plugin-chatbot/package.json
+++ b/packages/plugin-chatbot/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/plugin-chatbot",
-  "version": "17.3.0",
+  "version": "17.4.0",
   "type": "module",
   "license": "MIT",
   "description": "Chatbot interface plugin for Object UI",
diff --git a/packages/plugin-dashboard/CHANGELOG.md b/packages/plugin-dashboard/CHANGELOG.md
index 25d879c37f..b5fe89d7d9 100644
--- a/packages/plugin-dashboard/CHANGELOG.md
+++ b/packages/plugin-dashboard/CHANGELOG.md
@@ -1,5 +1,318 @@
 # @object-ui/plugin-dashboard
 
+## 17.4.0
+
+### Patch Changes
+
+- 4bc6c23: Converge dashboard widget `compareTo` on the executor's `{ kind, dimension? }` contract, and make the dataset path actually render a comparison
+
+  `CompareToConfig` was a three-branch union (`'previousPeriod' | 'previousYear' | { offset }`). `@objectstack/spec` collapsed it to the shape the analytics executor already implements — `DatasetCompareTo`, a plain strict object `{ kind: 'previousPeriod' | 'previousYear'; dimension?: string }` (objectstack#5011) — so this renderer now reads that one shape:
+
+  - `shiftFilterByCompareTo` / `compareToTrendLabelKey` dispatch on `compareTo.kind`. The `{ offset }` duration shift is gone: `{ offset: '1y' }` is `kind: 'previousYear'`, while `'7d'` / `'1M'` have no faithful target and are restated by the author on the widget's own `filter` plus `kind: 'previousPeriod'`. No trend label key is retired — the offset arm resolved to `vsPreviousPeriod`, which survives as the `previousPeriod` fallback.
+  - `DatasetWidget` no longer discards part of `compareTo`. It used to forward only the object form because the two string forms had no meaning downstream; with one shape there is nothing to discard, and a stale string is now invalid metadata rejected where it is authored rather than silently reinterpreted here.
+  - **The comparison now actually runs on the dataset path.** A widget states its window in its own `filter` (a date macro, or the dashboard date-range filter merged in), but the executor shifts a `timeDimensions` entry carrying a `dateRange` — so a dataset widget asking for a comparison got "compareTo needs a dated window to shift" and rendered none. When (and only when) a comparison is requested, the resolved filter's bounded date windows are lowered into `selection.timeDimensions[].dateRange` and moved out of `runtimeFilter` (a copy left behind would intersect the shifted window with the current one and empty every comparison column). Which dimension gets shifted stays the executor's decision: every window found is lowered under the name the author wrote, and zero or two candidates surfaces the executor's own error, listing them.
+  - The `<measure>__compare` columns that come back are now shown: a delta + window label on KPI widgets, a comparison column on tables, and a `variant: 'comparison'` overlay series on charts — the same treatment and the same `dashboard.trend.*` labels the inline object-provider widgets already use.
+
+- 230ffd8: Dashboard metadata's `chartConfig` presentation keys now take effect for the first time
+
+  `DashboardWidgetSchema.chartConfig` is declared as the full spec
+  `ChartConfigSchema`, but the ADR-0021 dataset path lowered exactly one key onto
+  the chart renderer: `showLegend` (objectui#3135). Everything else an author wrote
+  there — the chart's own `title`/`subtitle`, the accessibility `description`, an
+  explicit plot `height`, a `colors` palette or per-category colour map,
+  `showDataLabels`, `annotations`, `interaction` — parsed as valid metadata,
+  reached `DatasetWidget`, and was dropped before the chart schema was built. The
+  underlying chart block draws all of them; only the dashboard's hand-off was
+  missing.
+
+  `DatasetWidget` now lowers each of those keys, on two mechanical criteria, both
+  of which have to hold:
+
+  1. **The chart block draws it end to end on this path.** `{ type: 'chart' }`
+     resolves to `ChartRenderer` → `AdvancedChartImpl`, which draws
+     `title`/`subtitle` above the plot, turns `description` into the chart
+     container's `role="img"` + `aria-label`, applies `height` as that container's
+     inline height, paints `colors`, prints `showDataLabels` as per-point labels,
+     draws `annotations` as reference lines/bands and honours `interaction` as the
+     tooltip toggle plus the range selector. Each is pinned at the DOM level, so a
+     key is never forwarded to a prop that ignores it.
+  2. **It does not fight the dataset derivation.** `xAxis`, `yAxis` and `series`
+     are derived from the widget's dataset selection, so an authored one would
+     shadow the derived binding and blank the chart; they stay unforwarded, as does
+     `type` (the widget's own `type` already picks the chart family). `aria` stays
+     unforwarded too, for the other reason: nothing on this path reads it.
+
+  `colors` is split the way the react tier already splits it, because the two arms
+  reach the renderer through different props: a `string[]` is the positional
+  palette, a `{ value: color }` record is a per-category map merged over the
+  category dimension's own option colours.
+
+  **Behaviour-opening surface.** A dashboard that already wrote any of these keys
+  goes from having them ignored to having them applied — the point of the change,
+  but visible: a widget that declared `chartConfig.title` now shows that title
+  inside the plot area (in addition to the widget card's own `title`, which is a
+  separate key), one that declared `height` no longer fills its card, one that
+  declared `colors` stops using the theme palette, and `showDataLabels`,
+  `annotations` and `interaction.brush` start drawing. Widgets with no
+  `chartConfig`, or with only `showLegend`, render exactly as before: undeclared
+  keys are never emitted, so the renderer's own defaults stay in charge.
+
+  Part of objectstack#5175 (the enforce half); the narrowing half — what to do
+  about `aria`, and about `xAxis`/`yAxis`/`series` being declared on a surface that
+  derives them — is still open there.
+
+- c4c0ac8: Dataset-bound metric cards honour their declared `colorVariant` (objectui#3359, objectstack#5010 ruling B)
+
+  `DashboardWidgetSchema.widgets[].colorVariant` has been spec-declared, offered by
+  every authoring surface (the widget inspector, the dashboard editor, the config
+  panel) and authored **16 times** in shipped metadata — `system_overview` ×7 in
+  `platform-objects`, app-showcase's `ops-dashboard` / `revenue-pulse` ×9 — with
+  every one of those a `type: 'metric'` widget bound to a dataset. None of them
+  ever rendered a colour.
+
+  The reason is structural rather than a missing branch: `dataset` is **required**
+  on `DashboardWidgetSchema`, so every legal widget reaches `DatasetWidget` through
+  one of `DashboardRenderer`'s two dispatch sites, and `DatasetWidget` read the key
+  nowhere. Only the inline (`object` + `valueField`) path had a colour affordance,
+  via the `...options` spread into `MetricWidget` — a path the current schema
+  cannot produce. Declared, authored, offered in the designer, and inert: the
+  renderer painted all sixteen the same.
+
+  The metric card now maps the declaration onto the accent system this package
+  already has, instead of a second one:
+
+  - the vocabulary is the spec's `WidgetColorVariantSchema` enum, read from the
+    spec **in a test** rather than restated in prose — `default`, `blue`, `teal`,
+    `orange`, `purple`, `success`, `warning`, `danger`;
+  - the accent lands on the big number, the way `MetricWidget`'s chrome-less
+    `bare` layout carries it, because a dataset-bound metric renders no icon chip
+    and no card of its own. A dataset-bound KPI and an inline `bare` KPI declaring
+    the same variant now read the same;
+  - the two class tables both layouts use moved into one shared module
+    (`colorVariants.ts`) rather than being copied — the designer's swatch picker
+    already calls itself a mirror of "the renderer's colorVariant tokens", and a
+    second copy of a palette is how a declared-but-unenforced key becomes the
+    harder bug: a key declared two disagreeing ways.
+
+  Nothing changes for a widget that declares no `colorVariant`: its markup is
+  pinned byte-for-byte against the pre-change render, as is the enum's own
+  `'default'` (its name for "no accent"). Off-spec tokens — including the swatch
+  picker's three display-only aliases `green` / `red` / `amber`, which exist so a
+  legacy stored value can still be drawn as a swatch — get no accent and no
+  aliasing here: the spec enum rejects them where metadata is authored and
+  published, and teaching the renderer a second spelling would hand AI-authored
+  metadata a dialect the contract does not have.
+
+- 5bfaabd: `PageComponentSchema.dataSource` now reaches every object-bound block, not just
+  `list-view` — and `element:record_picker` stops discarding `view`
+  (objectstack#6953).
+
+  objectstack#5576 wired the spec's per-element data binding
+  (`dataSource: { object, view?, filter?, sort?, limit? }`) to `list-view` and left
+  the same declaration inert on every other page component. Two gaps remained, and
+  both were silent:
+
+  - **`element:record_picker` read four of the five keys and dropped `view`.** So
+    `dataSource: { object: 'account', view: 'hot' }` — the spec's own example —
+    built a picker over EVERY account instead of the rows the saved view selects.
+    Nothing threw and nothing rendered an error; the option list was simply wider
+    than what was authored, which also means a user could select a record the page
+    said was out of scope.
+  - **`object-grid` / `object-form` / `object-kanban` / `object-calendar` /
+    `object-chart` / `object-metric` / `record:related_list` read none of it.**
+    Each gates its fetch on its own `objectName`, and nothing mapped
+    `dataSource.object` onto it, so a page written the way the spec documents
+    rendered an empty grid / a field-less form / a board with no cards / an empty
+    month / an empty chart / a static metric number — with no request and no
+    diagnostic anywhere. Spec-valid metadata rendering nothing is the
+    objectstack#4413 shape.
+
+  Composition follows objectstack#5576's landed semantics unchanged on every block:
+  a named saved view supplies the baseline, a key written on the component itself
+  overrides it, an explicit binding key overrides both, `filter` AND-combines
+  ("additional filter criteria" — a binding can narrow a view, never widen it), and
+  a `view` name that does not resolve renders a configuration error instead of
+  degrading to the object's full scope.
+
+  - `@object-ui/react` — new `useElementDataSourceSchema(schema, mapping, dataSource?)`
+    and `ElementDataSourceGate` apply a resolved binding to the schema keys a given
+    block reads, plus `ElementDataSourceErrorPanel` / `ElementDataSourceLoadingPanel`
+    for the two non-final states. One precedence table for all blocks rather than
+    one copy per block — that copy is how "additional filter criteria" would have
+    become two dialects.
+  - A mapping names **only** keys its block genuinely reads. A composed value
+    written onto a key the block ignores would be accepted and dropped, which is
+    the defect being removed, one layer deeper — so a kanban's swimlane `columns`
+    never receive a view's field list, and a block with no row cap leaves `limit`
+    unmapped. The per-block coverage table, including two residual gaps that are
+    named rather than papered over, is in `content/docs/guide/data-source.md`.
+
+  No behaviour changes for a block that carries no `dataSource`: the binding-free
+  path returns the schema by reference, so nothing remounts and nothing refetches.
+
+- 022002a: `PageComponentSchema.dataSource` now reaches the remaining object-bound public
+  blocks: `object-gantt` / `object-timeline` / `object-map` / `object-pivot` /
+  `object-master-detail-form` / `embeddable-form` / `record:line_items`
+  (objectstack#7121).
+
+  objectstack#6953 wired the spec's per-element data binding
+  (`dataSource: { object, view?, filter?, sort?, limit? }`) to the eight blocks it
+  named and left the same declaration inert on these seven. Each gates its fetch on
+  its own object key and nothing mapped `dataSource.object` onto it, so a page
+  written the way the spec documents rendered an empty gantt / an empty timeline
+  rail / a map with no markers / an empty cross-tab / a field-less form — with no
+  request and no diagnostic anywhere. Spec-valid metadata rendering nothing is the
+  objectstack#4413 shape.
+
+  Composition follows objectstack#5576's landed semantics unchanged, through the
+  shared `ElementDataSourceGate` (no change to it or to the resolution layer): a
+  named saved view supplies the baseline, a key written on the component itself
+  overrides it, an explicit binding key overrides both, `filter` AND-combines
+  ("additional filter criteria" — a binding can narrow a view, never widen it), and
+  a `view` name that does not resolve renders a configuration error on every one of
+  these blocks instead of degrading to the object's full scope.
+
+  Each block maps **only** the keys it genuinely reads, which for this batch means
+  several keys stay deliberately unmapped rather than being parked somewhere
+  plausible:
+
+  - `object-gantt` and `object-map` take `object` / `filter` / `sort`; neither has a
+    row cap or a field-list read site.
+  - `object-pivot` takes `object` / `filter`; a cross-tab orders itself by its own
+    row/column grouping and cannot be computed over a truncated page.
+  - `object-timeline` takes `object` only — its fetch is
+    `find(objectName, { options: { $top: 100 } })`, with no filter/sort read site
+    at all, so a named view is error-checked and then contributes nothing.
+  - `embeddable-form` and `object-master-detail-form` take `object` only (the
+    parent object, in the master-detail case); a form that writes one record has no
+    collection query for `filter` / `sort` / `limit` to narrow.
+  - `record:line_items` takes `object` onto **`childObject`** — the collection it
+    actually lists — and nothing else: its query is the parent FK plus a fixed
+    `$top: 500`, and its `columns` are editable `GridColumn` objects rather than a
+    field-name projection a view could supply.
+
+  The per-block coverage table, including every residual gap named above, is in
+  `content/docs/guide/data-source.md`.
+
+  No behaviour change for a block that carries no `dataSource`: the binding-free
+  path returns the schema by reference, so nothing remounts and nothing refetches.
+
+- 02eb444: Show the `compareTo` comparison in a dataset pivot cross-tab instead of dropping it
+
+  A dataset widget with `type: 'pivot'` and two or more `dimensions` renders a true cross-tab, and that branch was the one render path the `compareTo` work left out (objectui#3614, following objectui#3337 / PR #3612). It laid out its columns as `bucket × measure` and never admitted the `<measure>__compare` columns the executor returns — so a pivot with a bounded date window and a `compareTo` ran a correct comparison query, received correct comparison data, and displayed none of it: headers, cells and all three subtotals were silent.
+
+  The comparison is now **stacked inside the cell** — current value on top, comparison value and its delta percentage beneath in smaller type:
+
+  - The pivot's column structure is unchanged. Giving the comparison a column of its own would turn `bucket × measure` into `bucket × measure × window`, doubling the width and adding a third header level on the widget family whose width is already the scarce resource.
+  - **Row, column and grand subtotals stack it the same way.** A Total that alone showed no comparison would read as "this row has none", which is a different and false statement.
+  - One caption names the comparison window ("vs last year") for the whole table, from the same `dashboard.trend.*` vocabulary the KPI and flat-table paths use, and the delta comes from the same helper — so a KPI and a cross-tab cell comparing the same two windows agree on sign and rounding.
+  - **CSV export stays data-shaped.** The cross-tab now exports a flat `<measure>__compare` column per compared measure, with bare numbers in the cells: a spreadsheet can compute on the export, and no stacked display string ("$120 $100 20%") ever reaches it.
+
+  Presence is detected from the returned data, as on every other path, so there is no new option to set — and a pivot the executor sent no comparison for renders exactly as it did before.
+
+- c1e1e6b: Studio's widget config panel no longer authors the retired `actionUrl` widget key
+
+  `actionUrl` / `actionType` / `actionIcon` were retired at the WIDGET level in
+  `@objectstack/spec` 17.0.0-rc.3 (objectstack#5010, ADR-0049 D2). They are
+  `retiredKey` tombstones: `DashboardWidgetSchema` types them `never` and refuses
+  any value, so authoring one is a tsc error and a parse error. Two producers in
+  `plugin-dashboard` were still emitting the widget-level key anyway
+  (objectstack#7129):
+
+  - `WidgetConfigPanel` offered a Behavior-group field labelled "Click-through
+    URL", bound to `actionUrl`. That control was inert twice over: no dashboard
+    widget renderer has ever read `widget.actionUrl`, so a URL typed there never
+    navigated anywhere, and the value it wrote was refused by the spec.
+  - `DashboardWithConfig` seeded `actionUrl: widget.actionUrl ?? ''` into every
+    widget config handed to the panel. Because the ADR-0021 save scrub only knew
+    the dataset-shape keys, that seed rode through to `onWidgetSave` on EVERY
+    save — so a Studio author who merely renamed a widget still persisted
+    `actionUrl: ''` into stored metadata, a key the spec then refuses. This is
+    the wider half of the defect: it did not require anyone to use the field.
+
+  The Behavior group and the seed are both gone, and `sanitizeDraftForType` now
+  scrubs all three keys as a second line of defence, for stored widgets that
+  already carry them and for hosts that drive `WidgetConfigPanel` directly.
+
+  Behaviour change surface: the widget config panel loses its Behavior section
+  (that section contained only this one field). Nothing that rendered before stops
+  rendering — the field had no consumer. `header.actions[]` keeps its own,
+  unrelated and still-live `actionUrl`; only the widget-level key is a tombstone.
+
+  Also corrects the `DashboardWidgetSchema` docblock in `@object-ui/types`, which
+  listed the three retired keys among those that "flow in from the spec" next to
+  live keys like `colorVariant`. They do flow in — as `?: never`. The docblock now
+  says so, and notes that while authoring one is a tsc error, _reading_ one still
+  type-checks (`never | undefined`), which is exactly how these producers survived
+  the 2026-08-04 sweep that removed the renderer-side reads.
+
+- Updated dependencies [794c497]
+- Updated dependencies [993336f]
+- Updated dependencies [f0a625a]
+- Updated dependencies [b5980f4]
+- Updated dependencies [8aad9fd]
+- Updated dependencies [6719877]
+- Updated dependencies [56ff091]
+- Updated dependencies [0186cdc]
+- Updated dependencies [7864f03]
+- Updated dependencies [ea41a59]
+- Updated dependencies [0cbdca8]
+- Updated dependencies [d229dfa]
+- Updated dependencies [ecae400]
+- Updated dependencies [4bc6c23]
+- Updated dependencies [d3e738a]
+- Updated dependencies [c3b01a7]
+- Updated dependencies [f5f8744]
+- Updated dependencies [7ed3360]
+- Updated dependencies [69becd2]
+- Updated dependencies [5e52495]
+- Updated dependencies [0fa5e4d]
+- Updated dependencies [b750823]
+- Updated dependencies [5bfaabd]
+- Updated dependencies [e06810e]
+- Updated dependencies [ab3ad4f]
+- Updated dependencies [65bb513]
+- Updated dependencies [c97a45e]
+- Updated dependencies [b19162d]
+- Updated dependencies [c2fd122]
+- Updated dependencies [1bd6faa]
+- Updated dependencies [ac2139c]
+- Updated dependencies [b14ab3a]
+- Updated dependencies [e24d767]
+- Updated dependencies [8c60819]
+- Updated dependencies [aca561a]
+- Updated dependencies [e64a52e]
+- Updated dependencies [844d17f]
+- Updated dependencies [d8a0be4]
+- Updated dependencies [48132f7]
+- Updated dependencies [4dcd52a]
+- Updated dependencies [42ae5c6]
+- Updated dependencies [0ef9dfd]
+- Updated dependencies [f4b97c8]
+- Updated dependencies [1d723e3]
+- Updated dependencies [0109f54]
+- Updated dependencies [7e5bb5d]
+- Updated dependencies [fbc23e0]
+- Updated dependencies [6d762da]
+- Updated dependencies [e6fdbdc]
+- Updated dependencies [54233b1]
+- Updated dependencies [c2ecbae]
+- Updated dependencies [f9faa7d]
+- Updated dependencies [97b63d7]
+- Updated dependencies [6bb454a]
+- Updated dependencies [11c1e71]
+- Updated dependencies [523be48]
+- Updated dependencies [7e2b7e9]
+- Updated dependencies [33526fd]
+- Updated dependencies [32413ec]
+- Updated dependencies [c1e1e6b]
+  - @object-ui/components@17.4.0
+  - @object-ui/react@17.4.0
+  - @object-ui/core@17.4.0
+  - @object-ui/fields@17.4.0
+  - @object-ui/i18n@17.4.0
+  - @object-ui/types@17.4.0
+
 ## 17.3.0
 
 ### Patch Changes
@@ -1031,6 +1344,7 @@
   project `health`) painted its categories from the generic `--chart-1..5`
   palette — the same gap the chart view (`object-chart`) had before #1932. It now
   resolves the dimension field's option colors (using the dataset's base `object`
+
   - dimension→field map the query already returns) and threads them to the
     renderer as a per-category `categoryColors` map, so health green/red/yellow
     paints semantically.
@@ -1282,6 +1596,7 @@
 - 991b62d: Add `compareTo` field to dashboard widgets for period-over-period
   comparison. Supports `'previousPeriod'`, `'previousYear'`, and
   `{ offset: '7d' | '4w' | '1M' | '1y' }`.
+
   - **Metric / gauge widgets** now compute a delta percentage when `compareTo`
     is set and surface it as a derived `trend` (auto-labelled via
     `dashboard.trend.vsLast*` i18n keys sniffed from the filter macros).
@@ -1446,6 +1761,7 @@
   platform primitive for "no records / no data" states. Two new props
   keep it flexible enough to absorb the hand-rolled variants that lived
   in `plugin-list`, `plugin-kanban`, and `plugin-dashboard`:
+
   - `showIcon?: boolean` — drops the icon container entirely. Used by the
     kanban board-level empty banner, which is a status banner rather than
     a true empty-state.
@@ -1454,6 +1770,7 @@
     empty state, which uses a large standalone glyph).
 
   Adopters:
+
   - `plugin-list` (`ListView` grid empty-state) — preserves the existing
     large icon, title, message, add-record button and `data-testid`s,
     but delegates the structural markup to `DataEmptyState`.
@@ -1476,6 +1793,7 @@
   `defaultCurrency` is set on the field/column, formatting is unchanged.
 
   Fixed call sites:
+
   - `@object-ui/fields`: `formatCurrency`, `formatCompactCurrency`, and
     `CurrencyCellRenderer` no longer default-param `'USD'`.
   - `@object-ui/i18n`: `formatCurrency()` falls back to `formatNumber`
@@ -1857,6 +2175,7 @@
   Library builds (vite lib mode) now externalize every non-relative import instead of bundling third-party CJS dependencies into the published dist. This avoids inlined `require("react")` / `require("react-dom")` calls that cause `Calling \`require\` for "react" in an environment that doesn't expose the \`require\` function` runtime errors when consumer apps re-bundle the published dist.
 
   Specifically fixes:
+
   - `@object-ui/plugin-dashboard` no longer inlines `react-grid-layout` (and its transitive `react-draggable` / `react-resizable` CJS bundles). `react-grid-layout` is now declared as a peer dependency so consumers install a single ESM-friendly copy.
   - `@object-ui/components`, `@object-ui/plugin-calendar`, `@object-ui/plugin-charts`, `@object-ui/plugin-designer` no longer inline `react-i18next` / `i18next` / `use-sync-external-store` CJS shims.
   - All plugin packages now use a unified `external: (id) => !/^[./]/.test(id) && !id.startsWith(__dirname)` rule, ensuring future additions of CJS deps are automatically externalized.
diff --git a/packages/plugin-dashboard/package.json b/packages/plugin-dashboard/package.json
index 7bd81e764f..b44b7c022f 100644
--- a/packages/plugin-dashboard/package.json
+++ b/packages/plugin-dashboard/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/plugin-dashboard",
-  "version": "17.3.0",
+  "version": "17.4.0",
   "type": "module",
   "license": "MIT",
   "description": "Dashboard plugin for Object UI",
diff --git a/packages/plugin-designer/CHANGELOG.md b/packages/plugin-designer/CHANGELOG.md
index 4648a9ae2c..f40784f9eb 100644
--- a/packages/plugin-designer/CHANGELOG.md
+++ b/packages/plugin-designer/CHANGELOG.md
@@ -1,5 +1,91 @@
 # @object-ui/plugin-designer
 
+## 17.4.0
+
+### Patch Changes
+
+- Updated dependencies [794c497]
+- Updated dependencies [993336f]
+- Updated dependencies [f0a625a]
+- Updated dependencies [b5980f4]
+- Updated dependencies [8aad9fd]
+- Updated dependencies [6719877]
+- Updated dependencies [56ff091]
+- Updated dependencies [0186cdc]
+- Updated dependencies [7864f03]
+- Updated dependencies [ea41a59]
+- Updated dependencies [0cbdca8]
+- Updated dependencies [d229dfa]
+- Updated dependencies [18c42c6]
+- Updated dependencies [ecae400]
+- Updated dependencies [4bc6c23]
+- Updated dependencies [d3e738a]
+- Updated dependencies [c3b01a7]
+- Updated dependencies [f5f8744]
+- Updated dependencies [8497579]
+- Updated dependencies [f0c9a90]
+- Updated dependencies [7ed3360]
+- Updated dependencies [3765678]
+- Updated dependencies [d83f6b3]
+- Updated dependencies [5f08c05]
+- Updated dependencies [69becd2]
+- Updated dependencies [5e52495]
+- Updated dependencies [0fa5e4d]
+- Updated dependencies [b750823]
+- Updated dependencies [5bfaabd]
+- Updated dependencies [022002a]
+- Updated dependencies [e06810e]
+- Updated dependencies [ab3ad4f]
+- Updated dependencies [65bb513]
+- Updated dependencies [c97a45e]
+- Updated dependencies [b19162d]
+- Updated dependencies [c2fd122]
+- Updated dependencies [1bd6faa]
+- Updated dependencies [9154d9e]
+- Updated dependencies [ac2139c]
+- Updated dependencies [b14ab3a]
+- Updated dependencies [e24d767]
+- Updated dependencies [8c60819]
+- Updated dependencies [aca561a]
+- Updated dependencies [41d6022]
+- Updated dependencies [e64a52e]
+- Updated dependencies [844d17f]
+- Updated dependencies [d8a0be4]
+- Updated dependencies [48132f7]
+- Updated dependencies [4dcd52a]
+- Updated dependencies [42ae5c6]
+- Updated dependencies [0ef9dfd]
+- Updated dependencies [f4b97c8]
+- Updated dependencies [1d723e3]
+- Updated dependencies [0109f54]
+- Updated dependencies [7e5bb5d]
+- Updated dependencies [fbc23e0]
+- Updated dependencies [6d762da]
+- Updated dependencies [e6fdbdc]
+- Updated dependencies [54233b1]
+- Updated dependencies [c2ecbae]
+- Updated dependencies [f9faa7d]
+- Updated dependencies [97b63d7]
+- Updated dependencies [14c59c0]
+- Updated dependencies [aeb8424]
+- Updated dependencies [6bb454a]
+- Updated dependencies [1a33b1a]
+- Updated dependencies [11c1e71]
+- Updated dependencies [523be48]
+- Updated dependencies [7e2b7e9]
+- Updated dependencies [33526fd]
+- Updated dependencies [32413ec]
+- Updated dependencies [c1e1e6b]
+  - @object-ui/components@17.4.0
+  - @object-ui/react@17.4.0
+  - @object-ui/core@17.4.0
+  - @object-ui/fields@17.4.0
+  - @object-ui/i18n@17.4.0
+  - @object-ui/types@17.4.0
+  - @object-ui/plugin-grid@17.4.0
+  - @object-ui/plugin-form@17.4.0
+  - @object-ui/data-objectstack@17.4.0
+
 ## 17.3.0
 
 ### Patch Changes
@@ -1022,6 +1108,7 @@ undefined` — swallowing the very errors the command exists to print. Now reads
   the Setup app → _All Metadata Types_.
 
   ### New: `@object-ui/app-shell` views/metadata-admin
+
   - **`MetadataDirectoryPage`** — auto-grouped tile directory by domain, with
     free-text search, domain chips, and a _Writable only_ filter.
   - **`MetadataResourceListPage` / `MetadataResourceEditPage` / `…CreatePage` / `…HistoryPage`** —
@@ -1045,6 +1132,7 @@ undefined` — swallowing the very errors the command exists to print. Now reads
     `t(key)` helper.
 
   ### New routing variant
+
   - App nav now supports `{ type: 'component', componentRef, params? }` items.
     `AppContent` resolves them through the existing `ComponentRegistry`.
   - Built-in components registered: `metadata:directory`, `metadata:resource`,
@@ -1053,6 +1141,7 @@ undefined` — swallowing the very errors the command exists to print. Now reads
     / page.
 
   ### Plugin-designer
+
   - Lazy-exported `ObjectManager`, `FieldDesigner`, `ObjectViewConfigurator`,
     `DashboardEditor`, `PageCanvasEditor`, `MetadataObjectsPage`, and
     `MetadataFieldsPage` so the engine can mount them on demand.
@@ -1073,6 +1162,7 @@ undefined` — swallowing the very errors the command exists to print. Now reads
 
   **`@object-ui/plugin-designer`** — two new route-ready pages that
   together close the "Data Model" management loop in the Setup app:
+
   - `MetadataObjectsPage` — lists every object schema (via
     `MetadataClient.list('object')`), renders the existing
     `ObjectManager`, and persists edits/deletes through PUT/DELETE on
@@ -1643,6 +1733,7 @@ undefined` — swallowing the very errors the command exists to print. Now reads
 ### Patch Changes
 
 - 1b6dc64: fix: complete Tailwind v3→v4 migration cleanup
+
   - Rename deprecated `flex-shrink-0` → `shrink-0` and `flex-grow-N` →
     `grow-N` (Tailwind v4 dropped the long-form aliases). Affects
     data-table, fields/index, FileField, ChatbotEnhanced,
@@ -1712,6 +1803,7 @@ undefined` — swallowing the very errors the command exists to print. Now reads
   Library builds (vite lib mode) now externalize every non-relative import instead of bundling third-party CJS dependencies into the published dist. This avoids inlined `require("react")` / `require("react-dom")` calls that cause `Calling \`require\` for "react" in an environment that doesn't expose the \`require\` function` runtime errors when consumer apps re-bundle the published dist.
 
   Specifically fixes:
+
   - `@object-ui/plugin-dashboard` no longer inlines `react-grid-layout` (and its transitive `react-draggable` / `react-resizable` CJS bundles). `react-grid-layout` is now declared as a peer dependency so consumers install a single ESM-friendly copy.
   - `@object-ui/components`, `@object-ui/plugin-calendar`, `@object-ui/plugin-charts`, `@object-ui/plugin-designer` no longer inline `react-i18next` / `i18next` / `use-sync-external-store` CJS shims.
   - All plugin packages now use a unified `external: (id) => !/^[./]/.test(id) && !id.startsWith(__dirname)` rule, ensuring future additions of CJS deps are automatically externalized.
@@ -1782,24 +1874,29 @@ undefined` — swallowing the very errors the command exists to print. Now reads
 - a2d7023: End-user feature batch — forms, designer history, import/export, and PWA offline sync.
 
   **Forms (`@object-ui/fields`, `@object-ui/providers`)**
+
   - `FileField`: native `<input capture="environment">` camera capture for mobile devices, plus a uploading-progress indicator driven by `UploadProvider`.
   - `ImageField`: per-image inline crop/rotate via the lazy-loaded `ImageCropperDialog` (canvas-based, zero new deps).
   - New `UploadProvider` in `@object-ui/providers` with pluggable adapters for S3 and Azure Blob (plus the default object-URL adapter for local previews). XHR-based with progress, abort, and retry.
   - `LookupField`: `lookup.dependsOn: string | string[]` to chain dependent lookups (e.g. State depends on Country); the trigger is gated until parent values are present and the OData `$filter` is built automatically.
 
   **Container-aware widget widths (`@object-ui/components`)**
+
   - New `useResizeObserver(ref)` hook exposing `{ width, height }` of any element. SSR-safe; reads the initial size via `getBoundingClientRect`.
   - `plugin-gantt` and `plugin-kanban` now react to their container size instead of `window.innerWidth`, so they behave correctly inside split panels and dashboards.
 
   **Designer history (`@object-ui/plugin-designer`)**
+
   - `useUndoRedo` (and therefore `useDesignerHistory`) gains `persistKey` + `storage` options to round-trip the undo/redo stack through `sessionStorage`, plus a `clearPersisted()` cleanup helper. Drafts now survive accidental tab refreshes.
   - New `<HistoryPanel>` component renders the timeline visually with one-click jump-to-checkpoint via the new `jumpTo(index)` API.
 
   **Import wizard (`@object-ui/plugin-grid`)**
+
   - Saved column-mapping templates: name, save, re-apply, and delete via a new template bar in the mapping step. Persisted under `objectui:import-templates:${objectName}` (override via `templateStorageKey` / `templateStorage`).
   - Inline validation correction: cells with errors in the preview step are now editable; corrections feed straight into the import without requiring a re-upload, with green-bar status indicators for fixed rows.
 
   **PWA offline sync (`@object-ui/mobile`)**
+
   - New `MemoryOfflineQueue` / `IndexedDbOfflineQueue` (`createOfflineQueue()` picks the best backend) backed by IndexedDB.
   - `createOfflineDataSource(inner, { queue })` wraps any DataSource so mutations issued while offline (or that fail with a network-style error) are queued and replayed in order on reconnect. Includes `replay()`, `drop()`, `clear()`, `pending()`, an `onChange` notifier, and an opt-in `resolveConflict` hook for stale-write conflicts.
   - New `useOfflineSync(source)` hook exposes `{ isOnline, pending, isReplaying, replay, drop, clear }` and auto-replays on the browser's `online` event.
diff --git a/packages/plugin-designer/package.json b/packages/plugin-designer/package.json
index 68a886bf43..b251fe3c91 100644
--- a/packages/plugin-designer/package.json
+++ b/packages/plugin-designer/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/plugin-designer",
-  "version": "17.3.0",
+  "version": "17.4.0",
   "type": "module",
   "license": "MIT",
   "description": "Visual designer plugin for Object UI with page, data model, process, and report designers plus collaborative editing.",
diff --git a/packages/plugin-detail/CHANGELOG.md b/packages/plugin-detail/CHANGELOG.md
index 345a8af509..ea8f126c3e 100644
--- a/packages/plugin-detail/CHANGELOG.md
+++ b/packages/plugin-detail/CHANGELOG.md
@@ -1,5 +1,310 @@
 # @object-ui/plugin-detail
 
+## 17.4.0
+
+### Minor Changes
+
+- ecae400: Retire the `capability-multiselect` field widget name, which existed only on the docs-site registration path and which nothing ever stamped (objectui#3308, ADR-0049 enforce-or-remove)
+
+  `field:capability-multiselect` was registered by `registerFields()` and only there. That function's sole caller is the docs site, so the key never existed on the live path (`registerAllFields()`, run at module import, iterates `fieldWidgetMap` — which never listed it). A field authored with `widget: 'capability-multiselect'` therefore resolved to nothing in every real application, while the comment above the registration described it as usable from a record form: a code comment promising a capability that does not exist, which is the worst direction for a metadata renderer AI-authored apps read as authority.
+
+  Nothing stamped the hint either. ADR-0056 P1 stamps `permission-facet-link` on all six `sys_permission_set` facets — `system_permissions` included — through the single `ObjectStackAdapter.getObjectSchema` choke point, and P2 put the capability editor in Studio. The widget name was a leftover from an intermediate iteration of that rollout.
+
+  Removed, with a tombstone at each site:
+
+  - `@object-ui/fields` — the `field:capability-multiselect` registration and the comment that advertised it. **Breaking in name only**: the key was unreachable outside the docs site, so no application could have resolved it. A field still carrying the hint now degrades to its declared `type` renderer, the defined behavior for an unregistered widget.
+  - `@object-ui/plugin-detail` — `InlineFieldInput`'s `widget === 'capability-multiselect'` branch, the hint's last honoring surface. Leaving one consumer for a name no producer emits and no form resolves is the same declared-vs-enforced split, inverted. The sibling `permission-facet-link` branch is untouched and pinned.
+  - `@object-ui/components` — the dead `capability-multiselect` entry in the form renderer's `DATA_SOURCE_FIELD_TYPES` set, which could never match a resolvable widget.
+  - `@object-ui/plugin-form` — a comment naming `capability-multiselect` as the widget stamped onto `sys_permission_set.system_permissions`; it names `permission-facet-link` now, which is what is actually stamped.
+
+  `CapabilityMultiSelectField` itself is **unchanged and still exported**: Studio's `PermissionMatrixEditor` imports and renders it directly, which is ADR-0056 P2's design. Only the widget name is retired — the component is not a registry field widget and its doc comment now says so.
+
+  `registerFields()` is also **kept**, with its `@deprecated Use registerAllFields() instead` note corrected. The two are not interchangeable: it registers `createFieldRenderer(widget)`, which synthesizes the label, description and the local `value`/`onChange` state that lets a bare field node (`{ type: 'currency', label: 'Amount' }`) render standalone in the docs demos. Retiring it needs a decision about where that demo chrome goes; the note now records that instead of implying a drop-in replacement.
+
+### Patch Changes
+
+- f0a625a: `disabled: ''` no longer greys out the remaining five action surfaces (objectui#3849)
+
+  objectui#3842 / PR #3851 fixed the "is a `disabled` gate DECLARED?" test on
+  `action:button` and app-shell's `DeclaredActionsBar`. Five same-shaped sites were
+  outside that PR's scope and stayed on `!= null`, so within one component the
+  `visible` gate asked `hasDeclaredVisibilityGate` while the `disabled` gate on the
+  next line asked `!= null` — two spellings of one question:
+
+  - `@object-ui/components` — `action:icon`, `action:group`'s inline button
+    (`InlineActionButton`) and dropdown item (`DropdownActionItem`), and
+    `action:menu`'s item (`ActionMenuItem`).
+  - `@object-ui/plugin-detail` — `record:quick_actions`' `QuickActionButton`.
+
+  Why the missing `!== ''` half is a defect on this key and not on `visible`:
+  `toPredicateInput('')` is `undefined` and `evaluateCondition(undefined)` is
+  `true`. On `visible` that `true` means SHOW, so an over-broad "declared" test and
+  a permissive empty predicate cancel out. On `disabled` it means DISABLE, so they
+  compound — `disabled: ''` (an empty predicate: nothing declared) rendered a
+  permanently greyed-out control, with nothing the author could write to un-grey
+  it. Unlike #3842's approvals inbox, these five are the general action face
+  (toolbars, dropdowns, record quick actions), so the reach is wider even though no
+  single high-value host owns them.
+
+  **Behaviour change surface, deliberately narrow.** Only `disabled: ''` changes —
+  from disabled to clickable, which is what "no predicate" asked for. `disabled:
+true` still disables, `disabled: false` and an absent `disabled` still do not, and
+  no expression-valued `disabled` changes verdict. On the four sites that also carry
+  the legacy non-spec `enabled` fallback, one consequence follows: an empty
+  `disabled` now falls THROUGH to that leg instead of short-circuiting on the empty
+  predicate, so an action spelling both (`disabled: ''` + `enabled: true`) becomes
+  clickable. `record:quick_actions` has no `enabled` leg, so its chain is the single
+  gate.
+
+  Routing those legacy `enabled` legs through the same definition is
+  behaviour-preserving by derivation rather than a fix: the leg is negated
+  (`disabled = !isEnabled`), so an empty predicate's `true` already arrived as "not
+  disabled" — the verdict "no gate declared" produces. #3842's four-shape derivation
+  table is reproduced next to the new pins, together with the statement that no
+  `enabled` case can go red by reverting that leg.
+
+  `hasDeclaredVisibilityGate` keeps its historic name (the objectui#3842 ruling): the
+  predicate is key-neutral, and one implementation behind two names is how a repo
+  grows dialects. The three `@object-ui/components` sites import it relatively;
+  `record:quick_actions` takes it from the package barrel, the cross-package route
+  objectui#3835 opened. Every call site says so in a comment.
+
+- 5bfaabd: `PageComponentSchema.dataSource` now reaches every object-bound block, not just
+  `list-view` — and `element:record_picker` stops discarding `view`
+  (objectstack#6953).
+
+  objectstack#5576 wired the spec's per-element data binding
+  (`dataSource: { object, view?, filter?, sort?, limit? }`) to `list-view` and left
+  the same declaration inert on every other page component. Two gaps remained, and
+  both were silent:
+
+  - **`element:record_picker` read four of the five keys and dropped `view`.** So
+    `dataSource: { object: 'account', view: 'hot' }` — the spec's own example —
+    built a picker over EVERY account instead of the rows the saved view selects.
+    Nothing threw and nothing rendered an error; the option list was simply wider
+    than what was authored, which also means a user could select a record the page
+    said was out of scope.
+  - **`object-grid` / `object-form` / `object-kanban` / `object-calendar` /
+    `object-chart` / `object-metric` / `record:related_list` read none of it.**
+    Each gates its fetch on its own `objectName`, and nothing mapped
+    `dataSource.object` onto it, so a page written the way the spec documents
+    rendered an empty grid / a field-less form / a board with no cards / an empty
+    month / an empty chart / a static metric number — with no request and no
+    diagnostic anywhere. Spec-valid metadata rendering nothing is the
+    objectstack#4413 shape.
+
+  Composition follows objectstack#5576's landed semantics unchanged on every block:
+  a named saved view supplies the baseline, a key written on the component itself
+  overrides it, an explicit binding key overrides both, `filter` AND-combines
+  ("additional filter criteria" — a binding can narrow a view, never widen it), and
+  a `view` name that does not resolve renders a configuration error instead of
+  degrading to the object's full scope.
+
+  - `@object-ui/react` — new `useElementDataSourceSchema(schema, mapping, dataSource?)`
+    and `ElementDataSourceGate` apply a resolved binding to the schema keys a given
+    block reads, plus `ElementDataSourceErrorPanel` / `ElementDataSourceLoadingPanel`
+    for the two non-final states. One precedence table for all blocks rather than
+    one copy per block — that copy is how "additional filter criteria" would have
+    become two dialects.
+  - A mapping names **only** keys its block genuinely reads. A composed value
+    written onto a key the block ignores would be accepted and dropped, which is
+    the defect being removed, one layer deeper — so a kanban's swimlane `columns`
+    never receive a view's field list, and a block with no row cap leaves `limit`
+    unmapped. The per-block coverage table, including two residual gaps that are
+    named rather than papered over, is in `content/docs/guide/data-source.md`.
+
+  No behaviour changes for a block that carries no `dataSource`: the binding-free
+  path returns the schema by reference, so nothing remounts and nothing refetches.
+
+- 7b3e048: `record:highlights` publishes the `readonly` entry key, so an AI author can discover it from the manifest
+
+  `readonly` on a `fields[]` entry has been enforced for a while — the renderer copies it
+  through normalization and `HeaderHighlight`'s editability gate refuses inline editing on a
+  chip carrying it (objectstack#5077) — and `@objectstack/spec` declares it on
+  `RecordHighlightsField` (objectstack#5176 / PR #5607). The block's own published authoring
+  surface never mentioned it: the `fields` input still spelled the entry shape
+  `{name,label?,icon?,type?}`, and since the registry `inputs` are what
+  `gen-manifest.ts` serializes into `sdui.manifest.json`, an author reading the manifest was
+  told the key did not exist. The `fields` description now states the full entry shape and
+  what `readonly` does, which is the discoverability the manifest is for.
+
+  `readonly` is documented **inside** the `fields` description rather than declared as an
+  input of its own, because that is where the contract puts it. The spec's
+  `RecordHighlightsProps` has exactly three top-level keys (`fields`, `layout`, `aria`) and
+  carries `readonly` per ENTRY. A top-level `{ name: 'readonly', type: 'boolean' }` input
+  would publish a key the platform silently discards: the generated `sdui.manifest.json` and
+  `sdui-intrinsics.d.ts` would advertise a `readonly` prop, the manifest gate validates
+  top-level props only and would raise no diagnostic, `RecordHighlightsProps` is a plain
+  `z.object` so the unknown key is stripped on parse without error, and the renderer — which
+  reads `field.readonly` per entry — would never see it. An author who trusted that surface
+  would be left with the machine-owned column still hand-editable and no diagnostic anywhere
+  explaining why. `ComponentInput` is flat by design, so an array-of-objects input publishes
+  its member keys in prose, as `record:path.stages` and `record:alert.action` already do.
+
+  A new spec-parity test derives both directions from `@objectstack/spec` at runtime instead
+  of restating today's key list: every key of `RecordHighlightsField`'s object arm must be
+  named in the `fields` description, and the block must declare no top-level input that
+  `RecordHighlightsProps` does not accept. Nothing previously cross-checked the registry
+  `inputs` against the spec, so both drift directions were silent. No runtime behaviour
+  changes.
+
+- aca561a: Four spec keys the renderers already honoured are now discoverable from the published `inputs`
+
+  `record:details.hideFields`, `record:related_list.relationshipValueField`,
+  `record:related_list.add` and `element:text_input.defaultValue` were declared by
+  `@objectstack/spec` and read by their renderers, while the registry `inputs` —
+  the surface `gen-manifest.ts` serializes into `sdui.manifest.json` and
+  `sdui-intrinsics.d.ts` — never mentioned them. Nothing anywhere reported the
+  mismatch, and every layer that reads a manifest said the opposite of the
+  runtime: the keys were in no designer panel and no generated `.d.ts`,
+  `sdui-parser`'s prop walk returned `unknown-prop` for an author who wrote one,
+  and the renderer honoured it regardless. That is objectui#3407's original
+  complaint (`readonly` was enforced and honoured, the description just never said
+  so) on four more keys.
+
+  Each description is derived from what the renderer actually does, not from
+  restating the spec's one-liner, because the two can differ and the published
+  text is what an AI author reads:
+
+  - `hideFields` documents bare field names only — the renderer tolerates
+    `{name}` / `{field}` entries but the spec is `z.array(z.string())` and rejects
+    them, so teaching that spelling would publish a dialect the contract refuses;
+  - `relationshipValueField` publishes the renderer's `'id'` default and says that
+    the resolved value drives the list filter, the Add-picker link value and the
+    pre-filled create form together;
+  - `add` publishes its member shape in prose (`ComponentInput` is flat and has no
+    member-shape slot) with each default taken from the renderer — including
+    `picker.labelField`, where the renderer defaults to `name` while the spec's
+    own wording says "the object title field". It also names `picker.filter` as a
+    KNOWN GAP rather than documenting it as a restriction: the spec declares it
+    and nothing reads it, so an author would otherwise believe their picker is
+    scoped when it offers every record (objectui#3831);
+  - `defaultValue` distinguishes the two behaviours an author can get — seeding a
+    bound page variable once while it is still empty, versus the native
+    uncontrolled initial value with no variable bound.
+
+  `element:text_input` is not in the public tier, so its gap was not in
+  `sdui.manifest.json` at all — it was in the JSX-page compiler's prop whitelist,
+  which `renderers/layout/page.tsx` builds from `getKnownTypes()` plus these same
+  `inputs`, making the undeclared `defaultValue` a live `unknown-prop` warning.
+
+  The repo-wide parity gate now runs in both directions over one covered set and
+  one exemption discipline, so neither direction can be forgotten again the way
+  the reverse half was after PR #3806. Nine spec keys stay deliberately
+  unpublished, each with a written reason and a tracking issue: two the renderers
+  do not read at all (objectui#3829), three retired upstream by ADR-0087
+  tombstones, `page:tabs.type` (a carrier collision, objectstack#6776), two
+  `targetVariable` declarative hints (objectui#3834), and
+  `element:record_picker.filter` (objectui#3830).
+
+- 6d762da: The five locale keys behind #3546's eight no-fallback `t()` call sites are now defined in all ten packs, so the built-in-view toasts, the activity-timeline source link, the wizard's required-field toast and the Gantt refresh button's accessible name are translated instead of falling back to English — or, on two surfaces, to the key itself (part of #3546).
+
+  `scripts/check-i18n-call-site-keys.mjs` measured 258 keys that a `t()` call site asks for and no pack defines. These five were the subset with no working inline default: `console.objectView.cannotEditMetaView`, `console.objectView.cannotDeleteMetaView`, `detail.viewSource`, `gantt.toolbar.refresh` and `wizard.missingRequired`. Adding a `defaultValue` is deliberately not the fix — that mechanism is what kept all 258 invisible for months.
+
+  **Two of the eight sites really did render the raw key**, and both go through a binding with nothing in front of i18next. `ObjectView.tsx` calls `useObjectTranslation()` directly, so five toasts read `console.objectView.cannotEditMetaView` / `cannotDeleteMetaView` on screen; the `|| 'Built-in views cannot be renamed.'` guards next to them were dead on every path, because i18next answers a miss with the key itself and a non-empty string never falls through `||`. Those four unreachable English strings are removed rather than repaired: one key served four call sites (rename / pin / set-as-default / configure), so the pack copy covers any change to a built-in view instead of naming one operation. `RecordActivityTimeline.tsx` fails the same way for a subtler reason — `useDetailTranslation` is `createSafeTranslation(..., 'detail.back')`, and because `detail.back` does resolve, the probe hands back i18next's `t` for every key and bypasses the defaults map wholesale, so `detail.viewSource` reached the user verbatim.
+
+  **The other two sites were not rendering a raw key**, contrary to the issue's description, and are fixed here as the milder "English in all ten languages" class. `wizard.missingRequired` is its own hook's probe key, so the probe failed and `createSafeTranslation` correctly served its English default. `gantt.toolbar.refresh` goes through `useGanttTranslation`, which deliberately does not use `createSafeTranslation` and falls back per key — so the refresh button's `aria-label` was "Refresh", in English, never the key. Screen-reader users heard an English word rather than an identifier; a `zh` session now hears 刷新.
+
+  Regression cover is provider-mounted on purpose: with no `I18nProvider` the defaults maps answer every one of these keys and the assertions pass while the console is broken, which is precisely the false-green the issue documents. For the two sites whose English output was already correct, `en` cannot discriminate before from after — the `zh` assertions are the ones that pin the fix.
+
+- 4178d5a: `record:details` 的 `sections` 输入说明改为从 spec 形状派生的对象形,不再教已被退役的「Section IDs」
+
+  `inputs` 不是文档,而是发布出去的编写契约:`gen-manifest.ts` 把它序列化进
+  `sdui.manifest.json`(保存门 + parser 白名单)和 `sdui-intrinsics.d.ts`。而
+  `record:details.sections` 的说明写的是 `Section IDs to show (required when layout
+is "custom")` —— 那是 17.x 以前的形状。pin 版 `@objectstack/spec@17.0.0-rc.5` 的
+  `RecordDetailsProps.sections` 是对象数组 `{ name?, label?, columns?, fields }`,
+  objectstack#5611 把 `z.array(z.string())` 那条拼法**删掉**而不是 union 进来(既无
+  producer 也无 consumer,一种形状而不是两套事实契约)。
+
+  照旧说明写 `sections: ['contact_info', 'address']` 的作者,在四层之间拿不到任何
+  诊断:`['a','b']` 对 manifest 门是合法 `array`(门只看顶层键名 + 粗类型),上游
+  `validateComponentProps` 是 advisory 级,spec 只在真的走 parse 的路径上才拒,而
+  `RecordDetailsRenderer` 对每个条目读 `s.name` / `s.label` / `s.fields` —— 字符串上
+  三者全 `undefined`,该 section 一个字段都不渲染。`layout: 'custom'` 时 sections 是
+  详情页正文的唯一来源,所以结果是一张没有报错的空白详情页。
+
+  新说明逐键派生自 spec 各成员的 `.describe()` 与渲染器实读:`fields` 必填、按序渲染;
+  `label` 是标题(省略即无标题、无边框);`name` 是 snake_case 稳定标识与 i18n 锚点
+  (标题走 `objects.{object}._sections.{name}.label`);`columns`(1-4)是本 section 的
+  字段栅格宽度,省略则由渲染器推导;并明确写出字符串条目不被接受。渲染器另外还认的
+  `title` / `showBorder` / `hideEmpty` **故意不写进说明** —— spec 的 section 对象没有
+  声明它们,parse 时会被静默剥掉,发布它们等于教作者写契约丢弃的键。
+
+  同时新增 `recordDetailsInputs.spec-parity.test.ts`:两个方向的断言都在运行时从 spec
+  schema 派生(每个 spec 成员键都能从说明里发现;本 block 不声明 spec 不接受的顶层
+  input),所以下一次 spec 变形会先让测试红,而不是又一次静默张开。仅说明文本变化,无
+  运行时行为改动。
+
+- 54233b1: Record detail pages: a header ⟳ that refreshes the record, its related lists and its tab counts in place — no browser reload
+
+  Concurrent-editing scenario from the shop floor (MES work orders): operator A sits on a record's detail page while operator B starts or reports the same order. A had no way to see the new state except F5, which throws away the open tab, the scroll position and any in-progress inline edit along with the stale data.
+
+  The pipeline for this already existed — the objectui#2269 invalidation bus refetches every mounted reader in place, and `RecordContext.refresh` had been declared for it — but nothing produced that field and no UI reached for it. Three changes give it a trigger:
+
+  - **`RecordDetailView` produces `RecordContext.refresh`**, publishing `notifyDataChanged({ objectName: '*' })`. The wildcard is deliberate: a user reaches for refresh because of a write made by SOMEONE ELSE, which this client never saw and therefore cannot attribute to particular objects. `'*'` marks everything mounted as stale, so the main record, every related child list and the tab-count badges all refetch — no remount, so tab / scroll / draft state survive. First phase covers the standalone record route; embedded hosts (list drawer, split-pane preview) keep their existing chrome unchanged.
+  - **`page:header` renders the ⟳** at the far end of the header row when — and only when — the host provides `refresh`. It is page chrome rather than a header action, so its position is the same on every record page regardless of which business actions the object declares, and it can never be collapsed into the `⋯` overflow. Styled as that `⋯` trigger's twin so the row reads as one button family. Its accessible name and tooltip come from the existing `common.refresh` key, so the icon-only button is not English-only in the other nine locales. The icon spins for a short floor after a click, because the bus is fire-and-forget and a warm backend would otherwise finish before the click looked like it landed.
+  - **`RelatedList` accepts the `'*'` wildcard** on the legacy `objectui:related-changed` event, matching what `dataChangeMatches` already does for the bus's own readers. This listener compared the payload's object name to its own, so a wildcard invalidation reached everything on the page except the related lists — a concrete foreign object name is still ignored.
+
+  Hosts that provide no `refresh` render exactly as before.
+
+- c2ecbae: 相关列表 Add 选择器兑现 `add.picker.filter`:作者限定的候选范围现在真的生效
+
+  `record:related_list.add.picker.filter` 被 spec 声明为「Restrict which records the picker offers」,但渲染器从未读过它 —— 挂 `RecordPickerDialog` 时不传任何 filter,对话框照样提供 `picker.object` 的全部记录,选中即建链接行或改父,`os validate` / `os build` 全绿、运行时零诊断。作者写下「只允许指派 active 的岗位」「只允许挂未过期的许可」,得到的是完整候选列表。
+
+  现在它按原样传给 `RecordPickerDialog` 的 `baseFilter` —— 不是 `lookupFilters`,后者会把条件渲染成用户可编辑的筛选栏行,等于把作者的硬性限制降级成建议。
+
+  `baseFilter` 因此接受两种形状,按结构判别(`Array.isArray`):
+
+  - **`QueryParams.$filter` 记录形式**(依赖型 lookup 链)保持原有的键覆盖语义逐字节不变 —— 级联父值必须**替换**同字段上过期的 `lookupFilters` 条目,而不是与之求交。
+  - **spec 的 `ViewFilterRule[]`** 经 `mergeFilterNodes`(仓内唯一的 filter 下沉口)下沉,19 个 operator 全部无损到达服务端,包括记录形式没有 `$op` 可用的 `before` / `after` / `is_empty` / `is_not_empty`。此处**不新增**第二份 operator 词汇表。
+
+  槽位类型同时从 `Record<string, any>` 收紧为 `unknown`:前者会接受规则数组(数组满足 `any` 的字符串索引),旧的对象展开再把它压成 `{"0": {...}}`,于是查询去过滤名为 `0` 的列 —— 类型全绿、查询错误、无任何诊断。
+
+- acc34c5: `record:related_list`: an `add` without `add.picker` no longer takes the whole related list down.
+
+  The Add-picker gate compared only `add` for truthiness and then read `add.picker.object` bare, so page metadata declaring `add` but omitting the (spec-required) `picker` threw during render and `SchemaRenderer` replaced the entire related list with a "Component failed to render" card whose message never mentioned `picker`. Both the Add button and the picker dialog now gate on the resolved `add.picker.object` — the list body renders as usual, only the unconfigured Add affordance is withheld, and a console hint names the missing key. Off-spec `add` still does nothing, so no lenient second dialect is introduced; producing-side validation of page metadata is tracked separately.
+
+- c4768a7: `record:related_list` — the declared `filter` reaches the query, and the Add button answers to the same gate as its dialog
+
+  - **`filter` is consumed** (objectstack#7118). The spec declares
+    `RecordRelatedListProps.filter` ("additional filter criteria") and this repo
+    published it as a registry input, but nothing read it: `RelatedList` built its
+    query from `{ [relationshipField]: parentId }` alone, so an authored filter was
+    accepted by every gate and silently dropped — the list answered with every child
+    of the parent. It is now AND-combined with the parent condition (never
+    substituted for it, so an additional criterion can only narrow), lowered through
+    the repo's single filter sink so the spec's `[{ field, operator, value }]`
+    vocabulary and a composed `dataSource` binding both work. With nothing authored
+    the query is unchanged. As a consequence a saved view named through
+    `dataSource: { object, view }` no longer contributes its columns/sort/limit while
+    its filter is discarded — the list can no longer be wider than the view it names.
+    On the legacy raw-URL fallback path, which cannot express an operator, a declared
+    filter is refused with a console explanation instead of dropped.
+  - **The Add button now requires `dataSource`** (objectui#3895), matching the picker
+    dialog and the add callback. In hosts that supply no `RecordContext` — Studio
+    designer previews, context-free embeds — the button rendered and did nothing at
+    all when clicked; the affordance is now withheld where the capability behind it
+    is absent.
+
+- Updated dependencies [7864f03]
+- Updated dependencies [f5f8744]
+- Updated dependencies [69becd2]
+- Updated dependencies [5e52495]
+- Updated dependencies [b750823]
+- Updated dependencies [ac2139c]
+- Updated dependencies [b14ab3a]
+- Updated dependencies [8c60819]
+- Updated dependencies [e64a52e]
+- Updated dependencies [844d17f]
+- Updated dependencies [4dcd52a]
+- Updated dependencies [42ae5c6]
+- Updated dependencies [6d762da]
+- Updated dependencies [f9faa7d]
+- Updated dependencies [33526fd]
+- Updated dependencies [32413ec]
+  - @object-ui/i18n@17.4.0
+
 ## 17.3.0
 
 ### Minor Changes
@@ -1544,6 +1849,7 @@ pi-TgoJ4_DM55Fqz` — untranslated, and leaking the object's machine name and th
   objects+fields were editable in Studio; this reworks both surfaces.
 
   **Setup (assign + read-only):**
+
   - The six facets (`object_permissions`, `field_permissions`, `system_permissions`,
     `row_level_security`, `tab_permissions`, `admin_scope`) now render read-only on
     the `sys_permission_set` record page as a compact summary (counts, or capability
@@ -1558,6 +1864,7 @@ pi-TgoJ4_DM55Fqz` — untranslated, and leaking the object's machine name and th
 
   **Studio (design every facet):** the permission matrix editor gains structured
   editors for the facets that were JSON-only —
+
   - **System Capabilities**: a multi-select over the live `sys_capability` registry
     (scope-grouped, labelled chips).
   - **Row-Level Security**: per-policy rows (object · operation · enabled) with CEL
@@ -1992,6 +2299,7 @@ pi-TgoJ4_DM55Fqz` — untranslated, and leaking the object's machine name and th
   unknown @-tokens. 9 unit tests.
 
   `@object-ui/app-shell` `RecordDetailView` now:
+
   1. Serializes the resolved mention ids into `sys_comment.mentions`
      (previously hard-coded `'[]'`, so servers had no idea who was being
      pinged).
@@ -2012,6 +2320,7 @@ pi-TgoJ4_DM55Fqz` — untranslated, and leaking the object's machine name and th
   and the renderer also falls back to a value/label heuristic (matches
   `closed_lost`, `lost`, `failed`, `cancelled`, `失败`, `流失`, `丢单`, etc.)
   so existing CRM-style picklists get the treatment without migration.
+
   - **Lost** stages render in a visually separated group with a left
     border, destructive (red) tint, pill shape, and `✗` glyph — mirroring
     the Salesforce / HubSpot alt-terminus pattern that signals "this
@@ -2041,6 +2350,7 @@ pi-TgoJ4_DM55Fqz` — untranslated, and leaking the object's machine name and th
   - Stage chevron (`record:path`): bump completed-stage contrast (emerald-800 text on emerald-500/15, was 700 on /10) and future-stage text from `foreground/70` to `foreground/85` for legibility.
   - i18n: add `notifications.emptyUnread`, `notifications.filterUnread`, `notifications.filterAll` (en + zh) so the InboxPopover Unread/All sub-filter renders in the active locale.
 - 5425608: CRM UX polish pass — calmer enterprise look across detail + kanban.
+
   - **plugin-kanban**: column headers now use a 2px muted accent stripe with
     neutral foreground titles + a quiet grey count pill instead of full
     rainbow gradient + colored title + colored count. Pipeline boards
@@ -2065,12 +2375,14 @@ pi-TgoJ4_DM55Fqz` — untranslated, and leaking the object's machine name and th
 - 5633edd: feat(detail,grid): tab + selection motion polish
 
   **plugin-detail**
+
   - `DetailTabs` and the auto-tabs path in `DetailView` (5 inline
     `<TabsContent>` instances: details, related, activity, discussion,
     history) now fade in when their tab becomes active, eliminating
     the harsh flash when switching tabs.
 
   **plugin-grid**
+
   - `BulkActionBar` slides in from the bottom + fades in when a
     selection is made, instead of popping into existence.
   - The "N items selected" counter re-animates on every count change
@@ -2099,6 +2411,7 @@ pi-TgoJ4_DM55Fqz` — untranslated, and leaking the object's machine name and th
   `defaultCurrency` is set on the field/column, formatting is unchanged.
 
   Fixed call sites:
+
   - `@object-ui/fields`: `formatCurrency`, `formatCompactCurrency`, and
     `CurrencyCellRenderer` no longer default-param `'USD'`.
   - `@object-ui/i18n`: `formatCurrency()` falls back to `formatNumber`
@@ -2120,6 +2433,7 @@ pi-TgoJ4_DM55Fqz` — untranslated, and leaking the object's machine name and th
 - d1ec6a2: Fold inline-edit into the page-header overflow menu (HubSpot/Lightning
   pattern) and remove the orphan "Edit fields" toolbar row that previously
   floated between the tab strip and the first detail section.
+
   - `@object-ui/app-shell` `RecordDetailView`: injects a new `sys_inline_edit`
     system action that appears in the ⋯ overflow menu and dispatches a
     `objectui:record:inline-edit-toggle` window CustomEvent (filtered by
@@ -2136,6 +2450,7 @@ pi-TgoJ4_DM55Fqz` — untranslated, and leaking the object's machine name and th
     in `page:accordion` / `page:tabs` items.
 
 - cf30cc2: Polish Lightning record detail page layout.
+
   - `record:details` sections now render with Card chrome by default when a `title` is present, restoring visual grouping that was missing on pages like the opportunity detail page.
   - Section labels can be translated via the `{ns}.objects.{objectName}._sections.{name}.label` convention. Author each section with a stable `name` (e.g. `info`, `forecast`) and the renderer picks up the locale-specific label automatically. Falls back to the literal `label` when no translation exists.
   - The `page:header` action toolbar now collapses into a `⋯` overflow menu when more than two actions are present. The first business action stays inline; secondary system actions (Edit / Share / Delete) move into the menu, with destructive styling applied to Delete.
@@ -2150,6 +2465,7 @@ pi-TgoJ4_DM55Fqz` — untranslated, and leaking the object's machine name and th
   `CONCURRENT_UPDATE`). `RecordDetailsRenderer` catches it and opens a
   new `<ConcurrentUpdateDialog>` showing the user's pending value next
   to the server's current value, with three resolution paths:
+
   - **Reload latest** — discard the pending edit and refetch.
   - **Overwrite anyway** — retry against the server's freshest version
     (still OCC-checked, but acknowledges "I've seen the newer version").
@@ -2165,6 +2481,7 @@ pi-TgoJ4_DM55Fqz` — untranslated, and leaking the object's machine name and th
   backend support in `@objectstack/rest@>=4.2.0`.
 
 - 49b1760: Polish the ConcurrentUpdateDialog and add i18n.
+
   - Internationalise all dialog strings (title, body, button labels, "your edit" / "current value" headings, audit-trail line) through `useDetailTranslation`. Locale strings added to `@object-ui/i18n` for English and Chinese.
   - Replace the plain dialog header with an amber warning badge + `AlertTriangle` icon to communicate that this is a conflict, not a routine confirmation.
   - Visually differentiate the two value blocks: amber tint for the user's pending edit, sky tint for the server's current value. Both wrap long values cleanly.
@@ -2180,17 +2497,20 @@ pi-TgoJ4_DM55Fqz` — untranslated, and leaking the object's machine name and th
 - bd8447d: Three platform-wide detail polish items.
 
   **Tighter page rhythm**
+
   - Outer `PageRenderer` padding `p-4 md:p-6 lg:p-8` → `p-3 md:p-4 lg:p-6`
     and outer body wrap `space-y-8` → `space-y-6` so list / detail / home
     pages share the same edge rhythm. Cuts ~16px of edge slack on lg.
 
   **Highlights KPI treatment**
+
   - `HeaderHighlight` now renders numeric / currency / percent / decimal
     values as KPI numbers (`text-xl md:text-2xl font-semibold tabular-nums`)
     instead of the uniform `text-sm font-semibold`, so amount / probability
     / count fields read as headline stats — Salesforce-style key facts.
 
   **Discussion footer upgrade**
+
   - `RecordActivityTimeline` now uses `RichTextCommentInput` (bold / italic /
     list / code, `@`-mention autocomplete, preview toggle, Send) instead of
     a bare `<textarea>`.
@@ -2205,6 +2525,7 @@ pi-TgoJ4_DM55Fqz` — untranslated, and leaking the object's machine name and th
   accordion in flush mode dropped all per-item borders so the collapsed
   "Quotes / Products / Open Tasks" triggers stacked with zero visual
   separation.
+
   - `@object-ui/plugin-detail` `DetailSection`: override the `CardTitle`
     className to `text-base font-semibold tracking-tight`, slim down
     `CardHeader` padding (`py-3 px-4 sm:py-4 sm:px-6`) and `CardContent`
@@ -2219,6 +2540,7 @@ hover:no-underline` (Shadcn's hover-underline default looks busy on
     CRM-style related-list lists).
 
 - d51a577: feat(platform): Discussion attachments + @mention directory + Reference Rail aside
+
   - **Discussion attachments** — `RichTextCommentInput` now accepts an `extraSlot`
     and a `canSubmitEmpty` flag so hosts can mount the existing
     `CommentAttachment` composer beneath the editor without forking the toolbar.
@@ -2242,6 +2564,7 @@ hover:no-underline` (Shadcn's hover-underline default looks busy on
   custom `Page`. Catalog-style objects (Product, Task) ship with the rail
   off by default; hub objects (Account, Opportunity, Contact, Case) keep it
   on.
+
   - `RecordDetailView` now reads `(objectDef as any)?.detail?.hideReferenceRail`
     and `…?.hideRelatedTab` and threads them to `buildDefaultPageSchema`.
   - The Reference Rail renderer also accepts entries authored as either a
@@ -2292,6 +2615,7 @@ hover:no-underline` (Shadcn's hover-underline default looks busy on
   not only contacts of that account).
 
   Two coupled fixes:
+
   1. `RelatedList` now requires `parentId` + `referenceField` to auto-
      fetch. When both are present it calls `dataSource.find(api,
 { $filter: { [referenceField]: parentId } })`. When either is
@@ -2337,6 +2661,7 @@ hover:no-underline` (Shadcn's hover-underline default looks busy on
   default detail view. They were missing cross-cutting affordances and
   shipped with English-only tab labels and heavy bordered section cards
   even when the host locale was Chinese. Track 1 closes the visible gap:
+
   - **app-shell `RecordDetailView`**: the `assignedPage` branch now wears
     the same chrome as the default branch — lifecycle managed-by badge
     and presence avatars in the top-right, `MetadataPanel` debug panel,
@@ -2439,6 +2764,7 @@ hover:no-underline` (Shadcn's hover-underline default looks busy on
   layout — only the auto-inference default changed.
 
 - b14fe09: Phase P.0 + P.5: tighten record-detail header chrome.
+
   - `RecordTitleChip` collapses the title row to a single baseline-aligned line — H1, eyebrow object label, copy-id, favorite star — instead of the previous two-row title + subtitle layout.
   - `record:details` extends the highlight-field dedup set to also exclude the title field resolved from `objectSchema.primaryField` (or the standard `name`/`full_name`/`title`/`subject`/`display_name`/`label` fallbacks). Removes the duplicate row that previously echoed the H1 (e.g. "客户名称: Acme Corporation") inside the field grid.
 
@@ -2481,6 +2807,7 @@ populated` disclosure that expands on click. The expanded view shows
   result was visually noisy ("有的下划线，有的有边框，有的没边框").
 
   This change commits to a single design language:
+
   - **Highlights** (`HeaderHighlight`): drop the `Card`/`CardContent`
     wrapper. Render as a borderless `<section>` of stat cells with a
     subtle `border-b` separator. The tab strip below now carries the
@@ -2501,6 +2828,7 @@ populated` disclosure that expands on click. The expanded view shows
   by their tabular content. No internal package APIs changed.
 
 - 74962b0: feat(detail): record:discussion schema component + flush accordion variant
+
   - New `record:discussion` schema type lets authors place the record
     chatter feed anywhere in a custom Page schema. Wired through a
     shared `DiscussionContext` provider on the `assignedPage` branch
@@ -2514,6 +2842,7 @@ populated` disclosure that expands on click. The expanded view shows
     or `和` (e.g. `Notes & Attachments` → `备注与附件`).
 
 - 8b850b5: feat(detail): record:path chevron stepper + record:highlights surface refresh (Phase E)
+
   - `record:path` now renders Salesforce Lightning-style chevron segments
     (clip-path arrows + overlap) with a primary glow on the current step
     and a check mark on completed steps. On mobile (`<sm`) it falls back
@@ -2538,6 +2867,7 @@ populated` disclosure that expands on click. The expanded view shows
   accordion, discussion slot) that custom Lightning pages already enjoy.
 
   Changes:
+
   - `buildDefaultPageSchema` now emits `page:tabs.items` (correct shape
     for the renderer) rather than `tabs`.
   - `PageHeaderRenderer.resolvedTitle` honors `objectSchema.primaryField`
@@ -2561,6 +2891,7 @@ populated` disclosure that expands on click. The expanded view shows
   customize the header or one tab.
 
   **Slot menu (v1):**
+
   - `header` — replaces `page:header`
   - `actions` — replaces the `record:quick_actions` action bar
   - `highlights` — replaces the chips + chevron path strip
@@ -2588,6 +2919,7 @@ populated` disclosure that expands on click. The expanded view shows
   ```
 
   **API changes:**
+
   - `PageSchema` (in `@object-ui/types`): adds `kind?: 'full' | 'slotted'`
     (default `'full'`) and `slots?: PageSlotMap`.
   - `usePageAssignment` (in `@object-ui/react`): result now exposes a
@@ -2597,6 +2929,7 @@ populated` disclosure that expands on click. The expanded view shows
     `options.slots` map that overrides individual regions at synthesis time.
 
 - 34b66bf: feat(detail): synthesize Related / Activity / History tabs + record:quick_actions header (Track 3 Phase G slice 4)
+
   - `buildDefaultPageSchema` now accepts `headerActions`, `related`,
     `showActivity`, and `history` options. When provided, the synthesizer
     emits a `record:quick_actions` node after `page:header` and appends
@@ -2621,6 +2954,7 @@ populated` disclosure that expands on click. The expanded view shows
 
   Two regression fixes surfaced by the Phase J browser canary across CRM
   record detail pages:
+
   1. **`record:path` now localizes stage labels.** The renderer threads
      `useSafeFieldLabel().translateOptions` against the record-context's
      `objectName` + the schema's `statusField`, so picklist labels match the
@@ -2697,6 +3031,7 @@ populated` disclosure that expands on click. The expanded view shows
 - d714e85: Lookup display-name resolution now falls back through a Salesforce-style chain
   when an `$expand`'d reference object lacks a top-level `name`/`label`/
   `display_name`/`title` field:
+
   1. Standard display fields (existing behaviour)
   2. `salutation first_name last_name` composite — handles person records that
      only carry first/last name parts
@@ -2732,6 +3067,7 @@ Lin` and no `name` field now renders as `Bob Lin` everywhere — instead of
 ### Patch Changes
 
 - 0d8eb98: feat(detail): Salesforce-style record header + section field grid
+
   - `page:header` now renders an icon chip (resolves Lucide names via
     `LazyIcon`) plus subtitle, so detail pages can show
     "Name / Company" without an extra component.
@@ -2780,6 +3116,7 @@ Lin` and no `name` field now renders as `Bob Lin` everywhere — instead of
   detail view (`TypeError: titleFormat.replace is not a function`) and printed
   `Failed to evaluate expression: ${[object Object]}` for every action visibility
   predicate.
+
   - `@object-ui/core`: `ExpressionEvaluator.evaluate` / `evaluateCondition` now
     unwrap Expression envelopes transparently.
   - `@object-ui/react`: new `toPredicateInput()` helper to safely normalize
@@ -2831,6 +3168,7 @@ Lin` and no `name` field now renders as `Bob Lin` everywhere — instead of
   Library builds (vite lib mode) now externalize every non-relative import instead of bundling third-party CJS dependencies into the published dist. This avoids inlined `require("react")` / `require("react-dom")` calls that cause `Calling \`require\` for "react" in an environment that doesn't expose the \`require\` function` runtime errors when consumer apps re-bundle the published dist.
 
   Specifically fixes:
+
   - `@object-ui/plugin-dashboard` no longer inlines `react-grid-layout` (and its transitive `react-draggable` / `react-resizable` CJS bundles). `react-grid-layout` is now declared as a peer dependency so consumers install a single ESM-friendly copy.
   - `@object-ui/components`, `@object-ui/plugin-calendar`, `@object-ui/plugin-charts`, `@object-ui/plugin-designer` no longer inline `react-i18next` / `i18next` / `use-sync-external-store` CJS shims.
   - All plugin packages now use a unified `external: (id) => !/^[./]/.test(id) && !id.startsWith(__dirname)` rule, ensuring future additions of CJS deps are automatically externalized.
diff --git a/packages/plugin-detail/package.json b/packages/plugin-detail/package.json
index e6f2554f83..9ca27ce13c 100644
--- a/packages/plugin-detail/package.json
+++ b/packages/plugin-detail/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/plugin-detail",
-  "version": "17.3.0",
+  "version": "17.4.0",
   "type": "module",
   "license": "MIT",
   "description": "DetailView plugin for Object UI - comprehensive detail page with sections, tabs, and related lists",
diff --git a/packages/plugin-editor/CHANGELOG.md b/packages/plugin-editor/CHANGELOG.md
index 8c5286e74d..c6b179977f 100644
--- a/packages/plugin-editor/CHANGELOG.md
+++ b/packages/plugin-editor/CHANGELOG.md
@@ -1,5 +1,48 @@
 # @object-ui/plugin-editor
 
+## 17.4.0
+
+### Patch Changes
+
+- Updated dependencies [794c497]
+- Updated dependencies [993336f]
+- Updated dependencies [f0a625a]
+- Updated dependencies [b5980f4]
+- Updated dependencies [8aad9fd]
+- Updated dependencies [6719877]
+- Updated dependencies [56ff091]
+- Updated dependencies [0cbdca8]
+- Updated dependencies [d229dfa]
+- Updated dependencies [ecae400]
+- Updated dependencies [4bc6c23]
+- Updated dependencies [d3e738a]
+- Updated dependencies [c3b01a7]
+- Updated dependencies [7ed3360]
+- Updated dependencies [0fa5e4d]
+- Updated dependencies [5bfaabd]
+- Updated dependencies [e06810e]
+- Updated dependencies [ab3ad4f]
+- Updated dependencies [c2fd122]
+- Updated dependencies [e24d767]
+- Updated dependencies [aca561a]
+- Updated dependencies [48132f7]
+- Updated dependencies [0ef9dfd]
+- Updated dependencies [1d723e3]
+- Updated dependencies [0109f54]
+- Updated dependencies [7e5bb5d]
+- Updated dependencies [fbc23e0]
+- Updated dependencies [e6fdbdc]
+- Updated dependencies [54233b1]
+- Updated dependencies [97b63d7]
+- Updated dependencies [6bb454a]
+- Updated dependencies [523be48]
+- Updated dependencies [7e2b7e9]
+- Updated dependencies [c1e1e6b]
+  - @object-ui/components@17.4.0
+  - @object-ui/react@17.4.0
+  - @object-ui/core@17.4.0
+  - @object-ui/types@17.4.0
+
 ## 17.3.0
 
 ### Patch Changes
@@ -901,6 +944,7 @@
   Library builds (vite lib mode) now externalize every non-relative import instead of bundling third-party CJS dependencies into the published dist. This avoids inlined `require("react")` / `require("react-dom")` calls that cause `Calling \`require\` for "react" in an environment that doesn't expose the \`require\` function` runtime errors when consumer apps re-bundle the published dist.
 
   Specifically fixes:
+
   - `@object-ui/plugin-dashboard` no longer inlines `react-grid-layout` (and its transitive `react-draggable` / `react-resizable` CJS bundles). `react-grid-layout` is now declared as a peer dependency so consumers install a single ESM-friendly copy.
   - `@object-ui/components`, `@object-ui/plugin-calendar`, `@object-ui/plugin-charts`, `@object-ui/plugin-designer` no longer inline `react-i18next` / `i18next` / `use-sync-external-store` CJS shims.
   - All plugin packages now use a unified `external: (id) => !/^[./]/.test(id) && !id.startsWith(__dirname)` rule, ensuring future additions of CJS deps are automatically externalized.
@@ -1129,6 +1173,7 @@
 - New plugin-object and ObjectQL SDK updates
 
   **Added:**
+
   - New Plugin: @object-ui/plugin-object - ObjectQL plugin for automatic table and form generation
     - ObjectTable: Auto-generates tables from ObjectQL object schemas
     - ObjectForm: Auto-generates forms from ObjectQL object schemas with create/edit/view modes
@@ -1137,6 +1182,7 @@
   - ObjectQL Integration: Enhanced ObjectQLDataSource with getObjectSchema() method using MetadataApiClient
 
   **Changed:**
+
   - Updated @objectql/sdk from ^1.8.3 to ^1.9.1
   - Updated @objectql/types from ^1.8.3 to ^1.9.1
 
@@ -1153,6 +1199,7 @@
 - Patch release: Add automated changeset workflow and CI/CD improvements
 
   This release includes infrastructure improvements:
+
   - Added changeset-based version management
   - Enhanced CI/CD workflows with GitHub Actions
   - Improved documentation for contributing and releasing
diff --git a/packages/plugin-editor/package.json b/packages/plugin-editor/package.json
index 5f76e4fccf..d986f21aa1 100644
--- a/packages/plugin-editor/package.json
+++ b/packages/plugin-editor/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/plugin-editor",
-  "version": "17.3.0",
+  "version": "17.4.0",
   "type": "module",
   "license": "MIT",
   "description": "Rich text editor plugin for Object UI, powered by Monaco Editor",
diff --git a/packages/plugin-form/CHANGELOG.md b/packages/plugin-form/CHANGELOG.md
index 52b0620d4a..ca50027fd6 100644
--- a/packages/plugin-form/CHANGELOG.md
+++ b/packages/plugin-form/CHANGELOG.md
@@ -1,5 +1,377 @@
 # @object-ui/plugin-form
 
+## 17.4.0
+
+### Minor Changes
+
+- ecae400: Retire the `capability-multiselect` field widget name, which existed only on the docs-site registration path and which nothing ever stamped (objectui#3308, ADR-0049 enforce-or-remove)
+
+  `field:capability-multiselect` was registered by `registerFields()` and only there. That function's sole caller is the docs site, so the key never existed on the live path (`registerAllFields()`, run at module import, iterates `fieldWidgetMap` — which never listed it). A field authored with `widget: 'capability-multiselect'` therefore resolved to nothing in every real application, while the comment above the registration described it as usable from a record form: a code comment promising a capability that does not exist, which is the worst direction for a metadata renderer AI-authored apps read as authority.
+
+  Nothing stamped the hint either. ADR-0056 P1 stamps `permission-facet-link` on all six `sys_permission_set` facets — `system_permissions` included — through the single `ObjectStackAdapter.getObjectSchema` choke point, and P2 put the capability editor in Studio. The widget name was a leftover from an intermediate iteration of that rollout.
+
+  Removed, with a tombstone at each site:
+
+  - `@object-ui/fields` — the `field:capability-multiselect` registration and the comment that advertised it. **Breaking in name only**: the key was unreachable outside the docs site, so no application could have resolved it. A field still carrying the hint now degrades to its declared `type` renderer, the defined behavior for an unregistered widget.
+  - `@object-ui/plugin-detail` — `InlineFieldInput`'s `widget === 'capability-multiselect'` branch, the hint's last honoring surface. Leaving one consumer for a name no producer emits and no form resolves is the same declared-vs-enforced split, inverted. The sibling `permission-facet-link` branch is untouched and pinned.
+  - `@object-ui/components` — the dead `capability-multiselect` entry in the form renderer's `DATA_SOURCE_FIELD_TYPES` set, which could never match a resolvable widget.
+  - `@object-ui/plugin-form` — a comment naming `capability-multiselect` as the widget stamped onto `sys_permission_set.system_permissions`; it names `permission-facet-link` now, which is what is actually stamped.
+
+  `CapabilityMultiSelectField` itself is **unchanged and still exported**: Studio's `PermissionMatrixEditor` imports and renders it directly, which is ADR-0056 P2's design. Only the widget name is retired — the component is not a registry field widget and its doc comment now says so.
+
+  `registerFields()` is also **kept**, with its `@deprecated Use registerAllFields() instead` note corrected. The two are not interchangeable: it registers `createFieldRenderer(widget)`, which synthesizes the label, description and the local `value`/`onChange` state that lets a bare field node (`{ type: 'currency', label: 'Amount' }`) render standalone in the docs demos. Retiring it needs a decision about where that demo chrome goes; the note now records that instead of implying a drop-in replacement.
+
+- 1bd6faa: fix(fields,plugin-form): stop the inline child grid from collapsing `datetime`/`time` columns onto the `date` control
+
+  `deriveMasterDetail`'s `fieldTypeToColumnType` mapped `date`, `datetime` and `time` onto the single `date` grid column type, and `GridField` renders that as `<input type="date">`. The consequence was not cosmetic: that control emits a bare `YYYY-MM-DD` on change, so a user who merely re-picked the **day** of a `datetime` cell silently wrote the record's time component out of existence — a `14:30` became midnight with no warning and no undo.
+
+  `GridColumn['type']` now carries `'datetime'` and `'time'` alongside `'date'`, and each renders its own control with its own read/write adapter:
+
+  - `datetime` → `<input type="datetime-local">`, read through `toDateTimeInputValue` and written back through `fromDateTimeInputValue`, so the stored shape stays ISO-8601 and read and write share one basis (the contract `DateTimeField` already follows, objectui#3127).
+  - `time` → `<input type="time">`, round-tripping the stored zone-less `HH:mm[:ss]` verbatim.
+  - `date` → unchanged.
+
+  The read-only surfaces are fixed with it. `displayText()` and the read-only table both fell through to `String(value)` and printed the raw stored ISO on screen (`2026-06-17T00:00:00.000Z`); each temporal type now formats as itself — a day for `date`, day + local time for `datetime`, the wall clock for `time`. That could not be fixed before the type collapse was undone, because with one column type the renderer had no way to know which of the two to show.
+
+  Authors writing explicit grid `columns` can now declare `type: 'datetime'` / `type: 'time'`; previously those spellings were not part of the exported union.
+
+### Patch Changes
+
+- 8497579: A required field whose `defaultValue` is a runtime token is submittable from a create form
+
+  `@objectstack/spec` lets a field's `defaultValue` be a runtime _instruction_
+  rather than a value — the `DEFAULT_VALUE_TOKENS` family (`'NOW()'`,
+  `'current_user'`) or a CEL Expression envelope. The server resolves those per
+  insert, in `ObjectQL.applyFieldDefaults`, for any field that arrives absent or
+  null, which is why a create form must leave them empty: seeding the literal text
+  `NOW()` into a datetime input and submitting it suppresses the very resolution
+  the declaration asked for.
+
+  Correct for an optional field. Combined with `required: true` it deadlocked:
+
+  ```ts
+  remind_at: Field.datetime({ required: true, defaultValue: 'NOW()' }),
+  ```
+
+  the control opened empty, the client-side required rule refused the submit, and
+  there was nothing sensible for the user to type — the declaration had already
+  said what the value is, and omitting the field is exactly what makes the server
+  supply it. Same shape as the `required` + static-default case, one layer down.
+
+  In **create** mode a runtime `defaultValue` now suppresses the client-side
+  `required` rule, and the field is omitted from the payload. The producer
+  guarantees the value at insert, so the field is not "missing" — it is
+  server-owned. `required: true` alongside a runtime default is coherent authoring
+  (storage-level required, producer-guaranteed), not an authoring error.
+
+  Both halves matter. Suppressing the rule alone would have been half an answer: a
+  rendered control registers with the form whether or not anything seeded it, so
+  an untouched runtime-default field still reached the payload as `undefined` — or
+  as `''` once anything focused it. `undefined` is invisible to a
+  `JSON.stringify` inspection while remaining a KEY a data source may translate
+  into an explicit column write, and `''` is neither absent nor null, so it stores
+  a blank and defeats the declaration outright.
+
+  Three boundaries came with it, each pinned in both directions:
+
+  - **Create only.** An edit form shows a persisted row, where the token was
+    resolved at insert; blanking a required column there is a real removal and is
+    still refused.
+  - **Runtime defaults only.** A static literal default _is_ seeded into the
+    control, so if the user clears it they have removed a value that was really
+    there — `required` still fires.
+  - **The rule, not the field.** A value the user does type is submitted normally
+    and outranks the declared default. Only the "must not be empty" check is
+    suppressed.
+
+  Seeding and this rule read ONE predicate (`isRuntimeDefault`), so a form can
+  never seed a field it also refuses to submit. The suppression also drops the
+  required marker and `aria-required` for that field in create mode, since both
+  are driven by the same boolean — the honest reading, as the user really is not
+  required to provide the value. Surfacing what the server _will_ supply, as a
+  non-authoritative preview, is a separate follow-up.
+
+  Not extended to `requiredWhen` (the conditional-required CEL rule), which is
+  resolved downstream in the form renderer against the live record.
+
+- f0c9a90: Create forms now open with the object schema's declared `defaultValue`s
+
+  A field declared `required: true, defaultValue: 'draft'` opened the console's
+  create dialog with an empty select and a required marker: the user had to pick a
+  value the system already knew, with every neighbouring option — some with side
+  effects — one click away. `defaultValue` + `required` produced the worst create
+  experience of any modelling choice, strictly worse than declaring no default.
+
+  The server was never the problem. Omitting the field from a create request
+  stores the declared default, because `ObjectQL.applyFieldDefaults` resolves it on
+  insert. The gap was container-side: `ObjectForm` seeded its opening values from
+  the object schema, and the five other object-form containers did not — their
+  create branch set the form data to `initialData || initialValues || {}` and never
+  looked at the schema. The console's create dialog is the global `<ModalForm>`,
+  one of those five. Modal, Drawer, Tabbed, Split and Wizard now seed through one
+  shared module (`schemaDefaults`), so a create form opens preselected and
+  submittable.
+
+  Three boundaries came with it, each pinned in both directions:
+
+  - **Create only.** An edit form shows a persisted row as the server holds it.
+    `ObjectForm`'s pass had been running in every mode, so a column the record
+    leaves unset showed the default — arming a silent write of a value the user
+    never chose on the next save of any other field. It is now gated on the same
+    "no persisted record" test the data-fetch effect uses.
+  - **Static defaults only.** A `defaultValue` may be an instruction the server
+    resolves per insert — the `NOW()` / `current_user` runtime tokens
+    (`DEFAULT_VALUE_TOKENS`) or a CEL Expression envelope. `ObjectForm` had been
+    seeding those verbatim, which put the literal text `NOW()` into a datetime
+    input and then submitted it as the field's value, suppressing the very
+    resolution the declaration asked for (`applyFieldDefaults` only fills fields
+    that arrive empty). Those are now left empty for the server.
+  - **Callers still win.** `initialData` / `initialValues` outrank a schema
+    default — a lookup prefill or a duplicate-record seed is the more specific
+    instruction.
+
+  Only the field-level `defaultValue` is honoured, not a select option's
+  `default: true`, even though `@objectstack/spec`'s `SelectOptionSchema` declares
+  that key: the insert path resolves `defaultValue` and nothing else, so seeding
+  from option-level `default` would preselect values the server would never have
+  applied — a UI-only second default contract.
+
+- 5bfaabd: `PageComponentSchema.dataSource` now reaches every object-bound block, not just
+  `list-view` — and `element:record_picker` stops discarding `view`
+  (objectstack#6953).
+
+  objectstack#5576 wired the spec's per-element data binding
+  (`dataSource: { object, view?, filter?, sort?, limit? }`) to `list-view` and left
+  the same declaration inert on every other page component. Two gaps remained, and
+  both were silent:
+
+  - **`element:record_picker` read four of the five keys and dropped `view`.** So
+    `dataSource: { object: 'account', view: 'hot' }` — the spec's own example —
+    built a picker over EVERY account instead of the rows the saved view selects.
+    Nothing threw and nothing rendered an error; the option list was simply wider
+    than what was authored, which also means a user could select a record the page
+    said was out of scope.
+  - **`object-grid` / `object-form` / `object-kanban` / `object-calendar` /
+    `object-chart` / `object-metric` / `record:related_list` read none of it.**
+    Each gates its fetch on its own `objectName`, and nothing mapped
+    `dataSource.object` onto it, so a page written the way the spec documents
+    rendered an empty grid / a field-less form / a board with no cards / an empty
+    month / an empty chart / a static metric number — with no request and no
+    diagnostic anywhere. Spec-valid metadata rendering nothing is the
+    objectstack#4413 shape.
+
+  Composition follows objectstack#5576's landed semantics unchanged on every block:
+  a named saved view supplies the baseline, a key written on the component itself
+  overrides it, an explicit binding key overrides both, `filter` AND-combines
+  ("additional filter criteria" — a binding can narrow a view, never widen it), and
+  a `view` name that does not resolve renders a configuration error instead of
+  degrading to the object's full scope.
+
+  - `@object-ui/react` — new `useElementDataSourceSchema(schema, mapping, dataSource?)`
+    and `ElementDataSourceGate` apply a resolved binding to the schema keys a given
+    block reads, plus `ElementDataSourceErrorPanel` / `ElementDataSourceLoadingPanel`
+    for the two non-final states. One precedence table for all blocks rather than
+    one copy per block — that copy is how "additional filter criteria" would have
+    become two dialects.
+  - A mapping names **only** keys its block genuinely reads. A composed value
+    written onto a key the block ignores would be accepted and dropped, which is
+    the defect being removed, one layer deeper — so a kanban's swimlane `columns`
+    never receive a view's field list, and a block with no row cap leaves `limit`
+    unmapped. The per-block coverage table, including two residual gaps that are
+    named rather than papered over, is in `content/docs/guide/data-source.md`.
+
+  No behaviour changes for a block that carries no `dataSource`: the binding-free
+  path returns the schema by reference, so nothing remounts and nothing refetches.
+
+- 022002a: `PageComponentSchema.dataSource` now reaches the remaining object-bound public
+  blocks: `object-gantt` / `object-timeline` / `object-map` / `object-pivot` /
+  `object-master-detail-form` / `embeddable-form` / `record:line_items`
+  (objectstack#7121).
+
+  objectstack#6953 wired the spec's per-element data binding
+  (`dataSource: { object, view?, filter?, sort?, limit? }`) to the eight blocks it
+  named and left the same declaration inert on these seven. Each gates its fetch on
+  its own object key and nothing mapped `dataSource.object` onto it, so a page
+  written the way the spec documents rendered an empty gantt / an empty timeline
+  rail / a map with no markers / an empty cross-tab / a field-less form — with no
+  request and no diagnostic anywhere. Spec-valid metadata rendering nothing is the
+  objectstack#4413 shape.
+
+  Composition follows objectstack#5576's landed semantics unchanged, through the
+  shared `ElementDataSourceGate` (no change to it or to the resolution layer): a
+  named saved view supplies the baseline, a key written on the component itself
+  overrides it, an explicit binding key overrides both, `filter` AND-combines
+  ("additional filter criteria" — a binding can narrow a view, never widen it), and
+  a `view` name that does not resolve renders a configuration error on every one of
+  these blocks instead of degrading to the object's full scope.
+
+  Each block maps **only** the keys it genuinely reads, which for this batch means
+  several keys stay deliberately unmapped rather than being parked somewhere
+  plausible:
+
+  - `object-gantt` and `object-map` take `object` / `filter` / `sort`; neither has a
+    row cap or a field-list read site.
+  - `object-pivot` takes `object` / `filter`; a cross-tab orders itself by its own
+    row/column grouping and cannot be computed over a truncated page.
+  - `object-timeline` takes `object` only — its fetch is
+    `find(objectName, { options: { $top: 100 } })`, with no filter/sort read site
+    at all, so a named view is error-checked and then contributes nothing.
+  - `embeddable-form` and `object-master-detail-form` take `object` only (the
+    parent object, in the master-detail case); a form that writes one record has no
+    collection query for `filter` / `sort` / `limit` to narrow.
+  - `record:line_items` takes `object` onto **`childObject`** — the collection it
+    actually lists — and nothing else: its query is the parent FK plus a fixed
+    `$top: 500`, and its `columns` are editable `GridColumn` objects rather than a
+    field-name projection a view could supply.
+
+  The per-block coverage table, including every residual gap named above, is in
+  `content/docs/guide/data-source.md`.
+
+  No behaviour change for a block that carries no `dataSource`: the binding-free
+  path returns the schema by reference, so nothing remounts and nothing refetches.
+
+- 6d762da: The five locale keys behind #3546's eight no-fallback `t()` call sites are now defined in all ten packs, so the built-in-view toasts, the activity-timeline source link, the wizard's required-field toast and the Gantt refresh button's accessible name are translated instead of falling back to English — or, on two surfaces, to the key itself (part of #3546).
+
+  `scripts/check-i18n-call-site-keys.mjs` measured 258 keys that a `t()` call site asks for and no pack defines. These five were the subset with no working inline default: `console.objectView.cannotEditMetaView`, `console.objectView.cannotDeleteMetaView`, `detail.viewSource`, `gantt.toolbar.refresh` and `wizard.missingRequired`. Adding a `defaultValue` is deliberately not the fix — that mechanism is what kept all 258 invisible for months.
+
+  **Two of the eight sites really did render the raw key**, and both go through a binding with nothing in front of i18next. `ObjectView.tsx` calls `useObjectTranslation()` directly, so five toasts read `console.objectView.cannotEditMetaView` / `cannotDeleteMetaView` on screen; the `|| 'Built-in views cannot be renamed.'` guards next to them were dead on every path, because i18next answers a miss with the key itself and a non-empty string never falls through `||`. Those four unreachable English strings are removed rather than repaired: one key served four call sites (rename / pin / set-as-default / configure), so the pack copy covers any change to a built-in view instead of naming one operation. `RecordActivityTimeline.tsx` fails the same way for a subtler reason — `useDetailTranslation` is `createSafeTranslation(..., 'detail.back')`, and because `detail.back` does resolve, the probe hands back i18next's `t` for every key and bypasses the defaults map wholesale, so `detail.viewSource` reached the user verbatim.
+
+  **The other two sites were not rendering a raw key**, contrary to the issue's description, and are fixed here as the milder "English in all ten languages" class. `wizard.missingRequired` is its own hook's probe key, so the probe failed and `createSafeTranslation` correctly served its English default. `gantt.toolbar.refresh` goes through `useGanttTranslation`, which deliberately does not use `createSafeTranslation` and falls back per key — so the refresh button's `aria-label` was "Refresh", in English, never the key. Screen-reader users heard an English word rather than an identifier; a `zh` session now hears 刷新.
+
+  Regression cover is provider-mounted on purpose: with no `I18nProvider` the defaults maps answer every one of these keys and the assertions pass while the console is broken, which is precisely the false-green the issue documents. For the two sites whose English output was already correct, `en` cannot discriminate before from after — the `zh` assertions are the ones that pin the fix.
+
+- 11c1e71: Resolve a `select` field declared `multiple: true` to the `field:multiselect` widget, so the object form's visible label actually names the chip picker it renders (objectui#3986).
+
+  `mapFieldTypeToFormType` keyed the widget id on the field's `type` string alone, so an object-schema `{ type: 'select', multiple: true }` picklist — a spec-legal, entirely ordinary shape — became `field:select`. `SelectField` then delegated to `MultiSelectField` on `config.multiple`, so the component that RENDERED was the chip picker while everything keyed on the widget id still answered for the single-value combobox. Above all the label-association declaration (`ComponentMeta.labelling`, objectui#3961), which the form renderer resolves per widget id: the host emitted `<label for>` at the chip row's wrapper `div`, where a `for` is inert — `HTMLLabelElement.control` returns `null`. Visually the field had a label; in the accessibility tree that label named nothing. Measured on the object-form path, `role=group` + accessible name went from 1 for a `multiselect`-typed field (fixed in objectui#3975) to 0 for this one.
+
+  Declaring `select` itself `labelling: 'group'` was not available: a single-value select's trigger is a labelable `button[role=combobox]` whose `for` association works, and a bare `select` is a builtin the renderer resolves without consulting the registry at all. The fix is therefore at the producer — the widget id now carries the arity, so one place decides which widget renders and the declaration can no longer be addressed to a widget that is not rendering.
+
+  - `mapFieldTypeToFormType(fieldType, config?)` takes an optional second argument — the rest of the field definition, of which only `multiple` is read. Existing single-argument calls are unchanged, and so is every type outside the new table: `select` is the only one whose `multiple` form is a different WIDGET. The spec's multi-capable set is larger (select / lookup / file / image, with `radio` on the select branch and `user` storing like `lookup`), but `LookupField`, `FileField` and `ImageField` each render both arities themselves, so their id — and their labelling declaration — is already right for either.
+  - The four object-form producers pass the pair: `ObjectForm`, `DrawerForm`, `ModalForm`, and `sectionFields` (Tabbed / Wizard / Split / Drawer / Modal). In `sectionFields` the id is now computed once from the EFFECTIVE pair, after view-level overrides have merged, because `multiple` is itself a spec `FormField` key: a view restating only `multiple: true` over a single-value object field moves the widget too, and `multiple: false` moves it back.
+  - `SelectField`'s `multiple` delegation is KEPT, not retired. Measured, it stays reachable from three entrances that never consult the alias map: the inline grid editor (`FieldEditWidget` finds `select` in its own table first), `ActionParamDialog` (`resolveFormWidgetType` returns `select` from `fieldWidgetMap` first), and hand-written SDUI addressing `field:select` by name with `multiple` on its metadata.
+
+  Read-only rendering of these widgets is untouched (objectui#4005), as is the built-in `Select` branch (objectui#3976).
+
+- 523be48: `object-timeline` and `record:line_items` now apply the filter / sort / row cap they are given, so a named `dataSource.view` narrows them instead of contributing nothing
+
+  These were the two residual gaps in objectstack#7121's per-block coverage table
+  (objectstack#7137). Both blocks are object-bound lists, both accepted the spec's
+  per-element `dataSource` binding, and neither had a read site for `filter` or
+  `sort` anywhere in its fetch:
+
+  - `object-timeline`'s entire query was
+    `find(objectName, { options: { $top: 100 } })`.
+  - `record:line_items`' was the parent FK plus a fixed `$top: 500`.
+
+  So `dataSource: { object, view: 'hot' }` resolved the view — a typo still reported
+  a configuration error, it never degraded into an unfiltered query — and then
+  dropped everything the view said. The rendered rows could be **wider than the view
+  they named**, silently, which is exactly the class of mistake AI-authored metadata
+  hides best: the page looks like it works. objectstack#7121 deliberately left the
+  keys unmapped and recorded the gap rather than writing composed values onto schema
+  keys nobody read; this closes it at the fetch instead.
+
+  What each block now reads:
+
+  - **`object-timeline`** — `$filter: schema.filter`,
+    `$orderby: convertSortToQueryParams(schema.sort)`, and
+    `$top: schema.limit ?? 100`, matching the form `object-gantt` / `object-map` /
+    `object-calendar` already use. Its registry mapping gains
+    `filter` / `sort` / `limit`; `columns` stays unmapped, because a timeline
+    projects the fields its `timeline` config names.
+  - **`record:line_items`** — the composed filter is **AND-combined** with the parent
+    relationship condition through `mergeFilterNodes`, never substituted for it, the
+    same way `record:related_list` composes its own since objectstack#7118: a
+    line-items panel is always scoped to the record it sits on, so an _additional_
+    criterion can only narrow this parent's children and can never surface another
+    parent's rows. `sort` becomes the load order and `limit` the row cap (default
+    500). `columns` stays unmapped — here they are `GridColumn[]` driving an editable
+    grid, not a field-name projection, so a view's column list would be the wrong
+    _shape_ rather than merely a wider answer.
+
+  **Behaviour change worth knowing about:** the timeline's default window is now a
+  real cap. `{ options: { $top: 100 } }` nested the limit under a key that is not a
+  `QueryParams` field and that no adapter in this repo reads (`convertQueryParams`
+  maps `params.$top`), so the intended window never reached the wire and a timeline
+  over a large object fetched whatever the server chose to return. It is now sent as
+  `$top`, and authorable via `limit` or a view's `pagination.pageSize`.
+
+  `@object-ui/core` gains `convertSortToQueryParams`, the sort→`$orderby` lowering
+  the three sibling blocks each inline privately. It is shared rather than copied
+  twice more, and is slightly more faithful to the declared contract than those
+  copies: a sort entry that omits `order` means ascending instead of being dropped
+  (the string spelling `"amount"` already meant ascending in the same copies), and
+  nothing orderable yields `undefined` rather than a truthy empty `{}`. Migrating
+  the three existing copies onto it is objectstack#7148 and is not done here.
+
+- Updated dependencies [794c497]
+- Updated dependencies [993336f]
+- Updated dependencies [f0a625a]
+- Updated dependencies [b5980f4]
+- Updated dependencies [8aad9fd]
+- Updated dependencies [6719877]
+- Updated dependencies [56ff091]
+- Updated dependencies [0186cdc]
+- Updated dependencies [7864f03]
+- Updated dependencies [ea41a59]
+- Updated dependencies [0cbdca8]
+- Updated dependencies [d229dfa]
+- Updated dependencies [ecae400]
+- Updated dependencies [4bc6c23]
+- Updated dependencies [d3e738a]
+- Updated dependencies [c3b01a7]
+- Updated dependencies [f5f8744]
+- Updated dependencies [7ed3360]
+- Updated dependencies [69becd2]
+- Updated dependencies [5e52495]
+- Updated dependencies [0fa5e4d]
+- Updated dependencies [b750823]
+- Updated dependencies [5bfaabd]
+- Updated dependencies [e06810e]
+- Updated dependencies [ab3ad4f]
+- Updated dependencies [65bb513]
+- Updated dependencies [c97a45e]
+- Updated dependencies [b19162d]
+- Updated dependencies [c2fd122]
+- Updated dependencies [1bd6faa]
+- Updated dependencies [ac2139c]
+- Updated dependencies [b14ab3a]
+- Updated dependencies [e24d767]
+- Updated dependencies [8c60819]
+- Updated dependencies [aca561a]
+- Updated dependencies [e64a52e]
+- Updated dependencies [844d17f]
+- Updated dependencies [d8a0be4]
+- Updated dependencies [48132f7]
+- Updated dependencies [4dcd52a]
+- Updated dependencies [42ae5c6]
+- Updated dependencies [0ef9dfd]
+- Updated dependencies [f4b97c8]
+- Updated dependencies [1d723e3]
+- Updated dependencies [0109f54]
+- Updated dependencies [7e5bb5d]
+- Updated dependencies [fbc23e0]
+- Updated dependencies [6d762da]
+- Updated dependencies [e6fdbdc]
+- Updated dependencies [54233b1]
+- Updated dependencies [c2ecbae]
+- Updated dependencies [f9faa7d]
+- Updated dependencies [97b63d7]
+- Updated dependencies [6bb454a]
+- Updated dependencies [11c1e71]
+- Updated dependencies [523be48]
+- Updated dependencies [7e2b7e9]
+- Updated dependencies [33526fd]
+- Updated dependencies [32413ec]
+- Updated dependencies [c1e1e6b]
+  - @object-ui/components@17.4.0
+  - @object-ui/react@17.4.0
+  - @object-ui/core@17.4.0
+  - @object-ui/fields@17.4.0
+  - @object-ui/i18n@17.4.0
+  - @object-ui/types@17.4.0
+  - @object-ui/permissions@17.4.0
+
 ## 17.3.0
 
 ### Minor Changes
@@ -1268,6 +1640,7 @@ undefined` — swallowing the very errors the command exists to print. Now reads
   objects+fields were editable in Studio; this reworks both surfaces.
 
   **Setup (assign + read-only):**
+
   - The six facets (`object_permissions`, `field_permissions`, `system_permissions`,
     `row_level_security`, `tab_permissions`, `admin_scope`) now render read-only on
     the `sys_permission_set` record page as a compact summary (counts, or capability
@@ -1282,6 +1655,7 @@ undefined` — swallowing the very errors the command exists to print. Now reads
 
   **Studio (design every facet):** the permission matrix editor gains structured
   editors for the facets that were JSON-only —
+
   - **System Capabilities**: a multi-select over the live `sys_capability` registry
     (scope-grouped, labelled chips).
   - **Row-Level Security**: per-policy rows (object · operation · enabled) with CEL
@@ -2459,6 +2833,7 @@ parentData, details)` — emits a parent `update` op (index 0) then diffs each
 ### Patch Changes
 
 - 89ae109: Fix click navigation and required-FK form rendering
+
   - **plugin-grid**: ObjectGrid's `getSelectFields()` now always includes `id` in
     the SELECT projection. Previously, when a view configured `columns` without
     `id`, the SQL driver stripped it from results, and row-click handlers silently
@@ -2521,6 +2896,7 @@ parentData, details)` — emits a parent `update` op (index 0) then diffs each
   Library builds (vite lib mode) now externalize every non-relative import instead of bundling third-party CJS dependencies into the published dist. This avoids inlined `require("react")` / `require("react-dom")` calls that cause `Calling \`require\` for "react" in an environment that doesn't expose the \`require\` function` runtime errors when consumer apps re-bundle the published dist.
 
   Specifically fixes:
+
   - `@object-ui/plugin-dashboard` no longer inlines `react-grid-layout` (and its transitive `react-draggable` / `react-resizable` CJS bundles). `react-grid-layout` is now declared as a peer dependency so consumers install a single ESM-friendly copy.
   - `@object-ui/components`, `@object-ui/plugin-calendar`, `@object-ui/plugin-charts`, `@object-ui/plugin-designer` no longer inline `react-i18next` / `i18next` / `use-sync-external-store` CJS shims.
   - All plugin packages now use a unified `external: (id) => !/^[./]/.test(id) && !id.startsWith(__dirname)` rule, ensuring future additions of CJS deps are automatically externalized.
@@ -2598,11 +2974,13 @@ parentData, details)` — emits a parent `update` op (index 0) then diffs each
   `FormSchema.mobileStickyActions` (new) is the lower-level escape hatch — applied automatically when `mobile.stickyActions` is set on `ObjectFormSchema`.
 
   **`@object-ui/plugin-form`** — `ObjectForm` now:
+
   - propagates `mobile.fullscreenLongText` to every textarea/markdown/html field as `mobile_fullscreen: true`,
   - sets `mobileStickyActions` on the inner form schema and adds `pb-20` padding so content isn't covered by the fixed bar,
   - when `mobile.stepper === true` (or `'auto'` + `useIsMobile()` + > `stepperMinFields` fields), routes the flat field list through the existing `WizardForm` with synthetic single-field "steps" — keeping per-step validation and the existing `Next`/`Back`/`Submit` flow.
 
   **`@object-ui/components`** — the registered `form` renderer adds:
+
   - a `mobileStickyActions` opt-in that turns the action row into a `position: sticky; bottom: 0` bar on small viewports, and
   - an inline `FullscreenTextarea` wrapper used when no field-package widget is registered, providing the same expand-button + edit-dialog UX so the feature works even in lighter setups.
 
diff --git a/packages/plugin-form/package.json b/packages/plugin-form/package.json
index 3f4e3683d5..9dfeb7efec 100644
--- a/packages/plugin-form/package.json
+++ b/packages/plugin-form/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/plugin-form",
-  "version": "17.3.0",
+  "version": "17.4.0",
   "type": "module",
   "license": "MIT",
   "description": "Form plugin for Object UI",
diff --git a/packages/plugin-gantt/CHANGELOG.md b/packages/plugin-gantt/CHANGELOG.md
index fca7d97c58..05306688ff 100644
--- a/packages/plugin-gantt/CHANGELOG.md
+++ b/packages/plugin-gantt/CHANGELOG.md
@@ -1,5 +1,138 @@
 # @object-ui/plugin-gantt
 
+## 17.4.0
+
+### Patch Changes
+
+- 022002a: `PageComponentSchema.dataSource` now reaches the remaining object-bound public
+  blocks: `object-gantt` / `object-timeline` / `object-map` / `object-pivot` /
+  `object-master-detail-form` / `embeddable-form` / `record:line_items`
+  (objectstack#7121).
+
+  objectstack#6953 wired the spec's per-element data binding
+  (`dataSource: { object, view?, filter?, sort?, limit? }`) to the eight blocks it
+  named and left the same declaration inert on these seven. Each gates its fetch on
+  its own object key and nothing mapped `dataSource.object` onto it, so a page
+  written the way the spec documents rendered an empty gantt / an empty timeline
+  rail / a map with no markers / an empty cross-tab / a field-less form — with no
+  request and no diagnostic anywhere. Spec-valid metadata rendering nothing is the
+  objectstack#4413 shape.
+
+  Composition follows objectstack#5576's landed semantics unchanged, through the
+  shared `ElementDataSourceGate` (no change to it or to the resolution layer): a
+  named saved view supplies the baseline, a key written on the component itself
+  overrides it, an explicit binding key overrides both, `filter` AND-combines
+  ("additional filter criteria" — a binding can narrow a view, never widen it), and
+  a `view` name that does not resolve renders a configuration error on every one of
+  these blocks instead of degrading to the object's full scope.
+
+  Each block maps **only** the keys it genuinely reads, which for this batch means
+  several keys stay deliberately unmapped rather than being parked somewhere
+  plausible:
+
+  - `object-gantt` and `object-map` take `object` / `filter` / `sort`; neither has a
+    row cap or a field-list read site.
+  - `object-pivot` takes `object` / `filter`; a cross-tab orders itself by its own
+    row/column grouping and cannot be computed over a truncated page.
+  - `object-timeline` takes `object` only — its fetch is
+    `find(objectName, { options: { $top: 100 } })`, with no filter/sort read site
+    at all, so a named view is error-checked and then contributes nothing.
+  - `embeddable-form` and `object-master-detail-form` take `object` only (the
+    parent object, in the master-detail case); a form that writes one record has no
+    collection query for `filter` / `sort` / `limit` to narrow.
+  - `record:line_items` takes `object` onto **`childObject`** — the collection it
+    actually lists — and nothing else: its query is the parent FK plus a fixed
+    `$top: 500`, and its `columns` are editable `GridColumn` objects rather than a
+    field-name projection a view could supply.
+
+  The per-block coverage table, including every residual gap named above, is in
+  `content/docs/guide/data-source.md`.
+
+  No behaviour change for a block that carries no `dataSource`: the binding-free
+  path returns the schema by reference, so nothing remounts and nothing refetches.
+
+- 6d762da: The five locale keys behind #3546's eight no-fallback `t()` call sites are now defined in all ten packs, so the built-in-view toasts, the activity-timeline source link, the wizard's required-field toast and the Gantt refresh button's accessible name are translated instead of falling back to English — or, on two surfaces, to the key itself (part of #3546).
+
+  `scripts/check-i18n-call-site-keys.mjs` measured 258 keys that a `t()` call site asks for and no pack defines. These five were the subset with no working inline default: `console.objectView.cannotEditMetaView`, `console.objectView.cannotDeleteMetaView`, `detail.viewSource`, `gantt.toolbar.refresh` and `wizard.missingRequired`. Adding a `defaultValue` is deliberately not the fix — that mechanism is what kept all 258 invisible for months.
+
+  **Two of the eight sites really did render the raw key**, and both go through a binding with nothing in front of i18next. `ObjectView.tsx` calls `useObjectTranslation()` directly, so five toasts read `console.objectView.cannotEditMetaView` / `cannotDeleteMetaView` on screen; the `|| 'Built-in views cannot be renamed.'` guards next to them were dead on every path, because i18next answers a miss with the key itself and a non-empty string never falls through `||`. Those four unreachable English strings are removed rather than repaired: one key served four call sites (rename / pin / set-as-default / configure), so the pack copy covers any change to a built-in view instead of naming one operation. `RecordActivityTimeline.tsx` fails the same way for a subtler reason — `useDetailTranslation` is `createSafeTranslation(..., 'detail.back')`, and because `detail.back` does resolve, the probe hands back i18next's `t` for every key and bypasses the defaults map wholesale, so `detail.viewSource` reached the user verbatim.
+
+  **The other two sites were not rendering a raw key**, contrary to the issue's description, and are fixed here as the milder "English in all ten languages" class. `wizard.missingRequired` is its own hook's probe key, so the probe failed and `createSafeTranslation` correctly served its English default. `gantt.toolbar.refresh` goes through `useGanttTranslation`, which deliberately does not use `createSafeTranslation` and falls back per key — so the refresh button's `aria-label` was "Refresh", in English, never the key. Screen-reader users heard an English word rather than an identifier; a `zh` session now hears 刷新.
+
+  Regression cover is provider-mounted on purpose: with no `I18nProvider` the defaults maps answer every one of these keys and the assertions pass while the console is broken, which is precisely the false-green the issue documents. For the two sites whose English output was already correct, `en` cannot discriminate before from after — the `zh` assertions are the ones that pin the fix.
+
+- Updated dependencies [794c497]
+- Updated dependencies [993336f]
+- Updated dependencies [f0a625a]
+- Updated dependencies [b5980f4]
+- Updated dependencies [8aad9fd]
+- Updated dependencies [6719877]
+- Updated dependencies [56ff091]
+- Updated dependencies [0186cdc]
+- Updated dependencies [7864f03]
+- Updated dependencies [ea41a59]
+- Updated dependencies [0cbdca8]
+- Updated dependencies [d229dfa]
+- Updated dependencies [ecae400]
+- Updated dependencies [4bc6c23]
+- Updated dependencies [d3e738a]
+- Updated dependencies [c3b01a7]
+- Updated dependencies [f5f8744]
+- Updated dependencies [7ed3360]
+- Updated dependencies [69becd2]
+- Updated dependencies [5e52495]
+- Updated dependencies [0fa5e4d]
+- Updated dependencies [b750823]
+- Updated dependencies [5bfaabd]
+- Updated dependencies [e06810e]
+- Updated dependencies [ab3ad4f]
+- Updated dependencies [65bb513]
+- Updated dependencies [c97a45e]
+- Updated dependencies [b19162d]
+- Updated dependencies [c2fd122]
+- Updated dependencies [1bd6faa]
+- Updated dependencies [ac2139c]
+- Updated dependencies [b14ab3a]
+- Updated dependencies [e24d767]
+- Updated dependencies [7b3e048]
+- Updated dependencies [8c60819]
+- Updated dependencies [aca561a]
+- Updated dependencies [e64a52e]
+- Updated dependencies [844d17f]
+- Updated dependencies [d8a0be4]
+- Updated dependencies [48132f7]
+- Updated dependencies [4dcd52a]
+- Updated dependencies [42ae5c6]
+- Updated dependencies [0ef9dfd]
+- Updated dependencies [f4b97c8]
+- Updated dependencies [1d723e3]
+- Updated dependencies [0109f54]
+- Updated dependencies [7e5bb5d]
+- Updated dependencies [fbc23e0]
+- Updated dependencies [6d762da]
+- Updated dependencies [e6fdbdc]
+- Updated dependencies [4178d5a]
+- Updated dependencies [54233b1]
+- Updated dependencies [c2ecbae]
+- Updated dependencies [acc34c5]
+- Updated dependencies [c4768a7]
+- Updated dependencies [f9faa7d]
+- Updated dependencies [97b63d7]
+- Updated dependencies [6bb454a]
+- Updated dependencies [11c1e71]
+- Updated dependencies [523be48]
+- Updated dependencies [7e2b7e9]
+- Updated dependencies [33526fd]
+- Updated dependencies [32413ec]
+- Updated dependencies [c1e1e6b]
+  - @object-ui/components@17.4.0
+  - @object-ui/plugin-detail@17.4.0
+  - @object-ui/react@17.4.0
+  - @object-ui/core@17.4.0
+  - @object-ui/fields@17.4.0
+  - @object-ui/i18n@17.4.0
+  - @object-ui/types@17.4.0
+
 ## 17.3.0
 
 ### Patch Changes
@@ -1188,6 +1321,7 @@ fields` formatters) and feeds `GanttView` a `task.fields` array that replaces
   non-en/zh locales) and the `common.addToFavorites` /
   `common.removeFromFavorites` keys across all ten built-in locales so
   the `builtInLocales` parity tests pass.
+
   - @object-ui/components@5.0.2
   - @object-ui/fields@5.0.2
   - @object-ui/react@5.0.2
@@ -1487,6 +1621,7 @@ fields` formatters) and feeds `GanttView` a `task.fields` array that replaces
   Library builds (vite lib mode) now externalize every non-relative import instead of bundling third-party CJS dependencies into the published dist. This avoids inlined `require("react")` / `require("react-dom")` calls that cause `Calling \`require\` for "react" in an environment that doesn't expose the \`require\` function` runtime errors when consumer apps re-bundle the published dist.
 
   Specifically fixes:
+
   - `@object-ui/plugin-dashboard` no longer inlines `react-grid-layout` (and its transitive `react-draggable` / `react-resizable` CJS bundles). `react-grid-layout` is now declared as a peer dependency so consumers install a single ESM-friendly copy.
   - `@object-ui/components`, `@object-ui/plugin-calendar`, `@object-ui/plugin-charts`, `@object-ui/plugin-designer` no longer inline `react-i18next` / `i18next` / `use-sync-external-store` CJS shims.
   - All plugin packages now use a unified `external: (id) => !/^[./]/.test(id) && !id.startsWith(__dirname)` rule, ensuring future additions of CJS deps are automatically externalized.
@@ -1545,24 +1680,29 @@ fields` formatters) and feeds `GanttView` a `task.fields` array that replaces
 - a2d7023: End-user feature batch — forms, designer history, import/export, and PWA offline sync.
 
   **Forms (`@object-ui/fields`, `@object-ui/providers`)**
+
   - `FileField`: native `<input capture="environment">` camera capture for mobile devices, plus a uploading-progress indicator driven by `UploadProvider`.
   - `ImageField`: per-image inline crop/rotate via the lazy-loaded `ImageCropperDialog` (canvas-based, zero new deps).
   - New `UploadProvider` in `@object-ui/providers` with pluggable adapters for S3 and Azure Blob (plus the default object-URL adapter for local previews). XHR-based with progress, abort, and retry.
   - `LookupField`: `lookup.dependsOn: string | string[]` to chain dependent lookups (e.g. State depends on Country); the trigger is gated until parent values are present and the OData `$filter` is built automatically.
 
   **Container-aware widget widths (`@object-ui/components`)**
+
   - New `useResizeObserver(ref)` hook exposing `{ width, height }` of any element. SSR-safe; reads the initial size via `getBoundingClientRect`.
   - `plugin-gantt` and `plugin-kanban` now react to their container size instead of `window.innerWidth`, so they behave correctly inside split panels and dashboards.
 
   **Designer history (`@object-ui/plugin-designer`)**
+
   - `useUndoRedo` (and therefore `useDesignerHistory`) gains `persistKey` + `storage` options to round-trip the undo/redo stack through `sessionStorage`, plus a `clearPersisted()` cleanup helper. Drafts now survive accidental tab refreshes.
   - New `<HistoryPanel>` component renders the timeline visually with one-click jump-to-checkpoint via the new `jumpTo(index)` API.
 
   **Import wizard (`@object-ui/plugin-grid`)**
+
   - Saved column-mapping templates: name, save, re-apply, and delete via a new template bar in the mapping step. Persisted under `objectui:import-templates:${objectName}` (override via `templateStorageKey` / `templateStorage`).
   - Inline validation correction: cells with errors in the preview step are now editable; corrections feed straight into the import without requiring a re-upload, with green-bar status indicators for fixed rows.
 
   **PWA offline sync (`@object-ui/mobile`)**
+
   - New `MemoryOfflineQueue` / `IndexedDbOfflineQueue` (`createOfflineQueue()` picks the best backend) backed by IndexedDB.
   - `createOfflineDataSource(inner, { queue })` wraps any DataSource so mutations issued while offline (or that fail with a network-style error) are queued and replayed in order on reconnect. Includes `replay()`, `drop()`, `clear()`, `pending()`, an `onChange` notifier, and an opt-in `resolveConflict` hook for stale-write conflicts.
   - New `useOfflineSync(source)` hook exposes `{ isOnline, pending, isReplaying, replay, drop, clear }` and auto-replays on the browser's `online` event.
@@ -1571,11 +1711,13 @@ fields` formatters) and feeds `GanttView` a `task.fields` array that replaces
 - e93fe35: Mobile UX round 3 — Gantt and Map
 
   **@object-ui/plugin-gantt**
+
   - Added a sticky vertical "Today" marker on the timeline plus a one-tap **Jump to Today** toolbar button so on-call users can re-orient the view instantly on small screens.
   - Added a **collapsible task list** (toolbar toggle + auto-collapse on the first narrow render) so the timeline area gets the full viewport on phones.
   - Added **pinch-to-zoom** touch gestures on the timeline; wired `columnWidthOverride` state so the existing zoom buttons also respond (previously a no-op).
 
   **@object-ui/plugin-map**
+
   - Added a **geolocate button** with the standard `navigator.geolocation.getCurrentPosition` permission flow, an inline error banner, a busy state, and a **user-location marker** (blue dot) the map flies to on success.
   - **Cluster tap-through**: tapping a cluster now flies the map in (zoom + 2, capped at 20) instead of just sitting there.
   - On mobile, the desktop popup is replaced by a **bottom-sheet record card** with safe-area padding and an explicit close button. Desktop continues to use the popup.
diff --git a/packages/plugin-gantt/package.json b/packages/plugin-gantt/package.json
index 23fe5f1d18..9f38fe7369 100644
--- a/packages/plugin-gantt/package.json
+++ b/packages/plugin-gantt/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/plugin-gantt",
-  "version": "17.3.0",
+  "version": "17.4.0",
   "type": "module",
   "license": "MIT",
   "description": "Gantt chart plugin for Object UI",
diff --git a/packages/plugin-grid/CHANGELOG.md b/packages/plugin-grid/CHANGELOG.md
index 7d060ed8ac..c36c7c5735 100644
--- a/packages/plugin-grid/CHANGELOG.md
+++ b/packages/plugin-grid/CHANGELOG.md
@@ -1,5 +1,340 @@
 # @object-ui/plugin-grid
 
+## 17.4.0
+
+### Patch Changes
+
+- 18c42c6: `BulkActionDialog` required params: the control now announces the required state, and the visual `*` stays out of its accessible name
+
+  `ParamField` renders each bulk param's label with a `*` marker when
+  `param.required`, inside a `<Label htmlFor>` that points at the control. Two
+  conventions the app-shell `ActionParamDialog` has carried since objectui#3299 /
+  objectui#3290 were missing at this site:
+
+  - The `*` span had no `aria-hidden="true"`. Accname folds a referencing label's
+    text into the control's name, so every required bulk param announced as
+    "Notify owner asterisk" — a decorative glyph read aloud as part of the label.
+  - No `aria-required` was passed to the widget. `param.required` is otherwise
+    live — the dialog's own pre-submit gate reads it to keep Next disabled — but
+    nothing carried the state to the control, and no widget derives it from
+    `field.required` (`toDomProps` forwards `aria-*` by prefix; it invents
+    nothing). So the only channel that could announce requiredness was empty
+    while the only thing present was the glyph.
+
+  The required state now rides the state channel to the control, deliberately as
+  `aria-required` and not the native `required` attribute — per the objectui#3290
+  ruling, the native attribute would arm the browser's constraint-validation
+  bubble alongside this dialog's own gating, giving one field two validators.
+  `|| undefined` keeps an optional param free of the attribute entirely rather
+  than carrying `aria-required="false"`, matching `ActionParamDialog`.
+
+  The marker remains visible; only its participation in the accessible name
+  changes. `id` ownership at this site was already correct and is untouched, as
+  is `ActionParamDialog`.
+
+- 5bfaabd: `PageComponentSchema.dataSource` now reaches every object-bound block, not just
+  `list-view` — and `element:record_picker` stops discarding `view`
+  (objectstack#6953).
+
+  objectstack#5576 wired the spec's per-element data binding
+  (`dataSource: { object, view?, filter?, sort?, limit? }`) to `list-view` and left
+  the same declaration inert on every other page component. Two gaps remained, and
+  both were silent:
+
+  - **`element:record_picker` read four of the five keys and dropped `view`.** So
+    `dataSource: { object: 'account', view: 'hot' }` — the spec's own example —
+    built a picker over EVERY account instead of the rows the saved view selects.
+    Nothing threw and nothing rendered an error; the option list was simply wider
+    than what was authored, which also means a user could select a record the page
+    said was out of scope.
+  - **`object-grid` / `object-form` / `object-kanban` / `object-calendar` /
+    `object-chart` / `object-metric` / `record:related_list` read none of it.**
+    Each gates its fetch on its own `objectName`, and nothing mapped
+    `dataSource.object` onto it, so a page written the way the spec documents
+    rendered an empty grid / a field-less form / a board with no cards / an empty
+    month / an empty chart / a static metric number — with no request and no
+    diagnostic anywhere. Spec-valid metadata rendering nothing is the
+    objectstack#4413 shape.
+
+  Composition follows objectstack#5576's landed semantics unchanged on every block:
+  a named saved view supplies the baseline, a key written on the component itself
+  overrides it, an explicit binding key overrides both, `filter` AND-combines
+  ("additional filter criteria" — a binding can narrow a view, never widen it), and
+  a `view` name that does not resolve renders a configuration error instead of
+  degrading to the object's full scope.
+
+  - `@object-ui/react` — new `useElementDataSourceSchema(schema, mapping, dataSource?)`
+    and `ElementDataSourceGate` apply a resolved binding to the schema keys a given
+    block reads, plus `ElementDataSourceErrorPanel` / `ElementDataSourceLoadingPanel`
+    for the two non-final states. One precedence table for all blocks rather than
+    one copy per block — that copy is how "additional filter criteria" would have
+    become two dialects.
+  - A mapping names **only** keys its block genuinely reads. A composed value
+    written onto a key the block ignores would be accepted and dropped, which is
+    the defect being removed, one layer deeper — so a kanban's swimlane `columns`
+    never receive a view's field list, and a block with no row cap leaves `limit`
+    unmapped. The per-block coverage table, including two residual gaps that are
+    named rather than papered over, is in `content/docs/guide/data-source.md`.
+
+  No behaviour changes for a block that carries no `dataSource`: the binding-free
+  path returns the schema by reference, so nothing remounts and nothing refetches.
+
+- 9154d9e: `object-grid` publishes the filter key it actually reads: `filter`, singular (objectui#4041)
+
+  The registration declared plural `filters` while `ObjectGrid` reads singular
+  `schema.filter`, and `schema.filters` had **zero** read points anywhere in the
+  renderer. Both halves of that mismatch were silent, in opposite directions:
+
+  - An author following the published vocabulary wrote `filters: [...]`. The save
+    gate accepted it — `sdui-parser/src/validate.ts` walks a node's props against
+    the block's `inputs`, and `filters` was there — the renderer never read it, and
+    the grid answered with **the whole table**. No error at authoring time, none at
+    runtime, and a wider answer is not visibly wrong.
+  - The spelling that actually worked, `filter`, was undeclared, so writing it was
+    reported as `unknown-prop`.
+
+  Published word and runtime read pointed at opposite keys, on a shipped authoring
+  surface. `list-view` — the sibling block, same family — has always declared the
+  singular and read the singular.
+
+  **The plural is removed, not taught to the renderer** (maintainer ruling
+  2026-08-10, option A). It has no read point on any ref, so no working grid can
+  depend on it: this deletes a key with no users rather than a contract. Teaching
+  the renderer to read `filters` too was the rejected alternative — it would have
+  hardened a misspelling into a second de-facto contract for the same concept.
+
+  `patch` rather than `minor`/`major` on that same fact. The removed key never
+  reached the query on any released version, so nothing that worked stops working;
+  what changes is that a filter written under the published name now takes effect.
+
+  **The read point now lowers through `toFilterNode`**, which is what makes the
+  newly-reachable key honest rather than merely reachable. Until now the only value
+  that could arrive at `schema.filter` was an ObjectQL AST synthesized by
+  `ElementDataSourceGate`, and copying that onto `$filter` verbatim was correct. An
+  author writes the spec's view vocabulary instead — `ViewFilterRule[]`,
+  `[{ field, operator, value }]` — and that shape byte-copied onto `$filter` is
+  refused on the wire: `isFilterAST` is false for an array of objects and the data
+  API answers `400 INVALID_FILTER` (measured against a real backend in
+  objectui#3431). Declaring the key without this hop would have traded a silent
+  wrong answer for a guaranteed failure, which is not a fix. `toFilterNode` is the
+  repo's single lowering hop before the wire and every other consumer on this chain
+  already went through it — `plugin-list`'s `buildEffectiveFilter`, `plugin-view`'s
+  `ObjectView`, `plugin-detail`'s `RelatedList`; this read point was the last one
+  that did not.
+
+  Two behaviour changes ride along at that read point, both narrow and both toward
+  the shared sink's documented contract: a MongoDB-style object `filter` is now
+  converted instead of silently dropped (the old `Array.isArray` guard read false
+  for it, and the grid returned every record — the same defect `buildEffectiveFilter`
+  fixed one package over), and a declared-but-empty `filter: []` now skips `$filter`
+  rather than sending an empty one. The fetch and the server-side export read the
+  same lowered value, so the downloaded file cannot disagree with the screen.
+
+- 97b63d7: Row actions declaring `visible: false` are now hidden instead of rendered
+
+  A custom row action's visibility **gate** was detected by truthiness, so
+  `visible: false` — the most explicit way an author can say "never show this" —
+  fell into the "no gate declared" branch and the action rendered for every row.
+  Both surfaces of the ObjectGrid row cell (the "⋮" overflow item and the inline
+  `variant:'primary'` button) and the data-table's row overflow menu read the same
+  gate, so all three rendered it; the `#3562` emptiness guard counts with that same
+  gate, so a row whose only action was `visible: false` also grew a "⋮" it could
+  not fill.
+
+  The gate now detects a **declared** gate by `!= null && !== ''` and lets the
+  declaration itself decide — a boolean short-circuits to its own verdict rather
+  than being handed to the CEL engine. This is the invariant objectui#3492 already
+  established for the selection bar, whose `hasVisibilityGate` spells out why
+  truthiness cannot answer the question, and the same `!= null` posture the
+  built-in `visibleWhen` gate has always had. `visible: true` still renders,
+  `''` and an absent `visible` are still no gate at all, and no expression-valued
+  `visible` changes verdict.
+
+  Behaviour change surface, deliberately narrow: only an action whose `visible` is
+  the literal boolean `false` (or another falsy non-empty value) changes — it goes
+  from rendered to hidden, which is what the declaration asked for.
+  `ActionSchema.visible` is `ExpressionInputSchema` with no boolean member, so
+  `objectstack build` cannot emit this shape; hand-written view JSON and
+  in-process callers constructing defs can, and did. The three row surfaces now
+  reach the same verdict as the selection bar and the record page header for every
+  non-expression shape, which `predicate-surface-parity` pins.
+
+- 14c59c0: Grid row actions: the inline button budget is now spent on the primaries that actually render
+
+  `RowActionMenu` allocated its inline slots on the **declared** row actions, before
+  any `visible` predicate ran:
+
+  ```ts
+  const primaryDefs = gatedActionDefs.filter((d) => d.variant === "primary");
+  const inlineDefs = primaryDefs.slice(0, Math.max(0, maxInlineActions));
+  ```
+
+  So on a row where the _leading_ `variant: 'primary'` action was suppressed by its
+  own `visible`, that action still held the slot — `RowActionInlineButton` returned
+  `null` into it — while the next primary, the one that _did_ survive the row's
+  predicates, had already been sliced into the overflow list. The row then rendered
+  **no inline button and a "⋮" hiding its main CTA**, even though exactly one primary
+  was visible and `maxInlineActions` (default 1) allowed exactly one inline button.
+
+  Slot allocation now happens inside `planRowActionMenu`, after visibility, so the
+  budget is only ever spent on a primary that renders. `maxInlineActions` is
+  unchanged in meaning and default — it is a width budget for real buttons, and
+  counting an invisible action against it protected no layout.
+
+  Behaviour change surface, deliberately narrow:
+
+  - a row with 2 or more primaries where a _leading_ one is suppressed for that row —
+    the surviving primary moves from the "⋮" menu to an inline button, and the "⋮"
+    disappears if nothing else is left to fold;
+  - unchanged: how many primaries may go inline, the menu order (folded primaries
+    above secondaries), which items render at all, the ADR-0066 D4 capability gate
+    (still applied once to the declared set, upstream of this decision), and the
+    #3562 empty-menu guard — a row with nothing renderable still grows no trigger.
+
+  Rows whose primaries are all ungated (the `sys_environment` Open + Upgrade Plan
+  shape that motivated `maxInlineActions`) are bit-for-bit unaffected: declared order
+  and surviving order coincide.
+
+- aeb8424: List row Edit/Delete, bulk delete and related-list CRUD now run the caller's own permission, not just the object's API exposure (objectui#4096)
+
+  The row kebab's built-in Edit/Delete rendered for every account, including ones
+  the server answers `403 PERMISSION_DENIED` on. Clicking Edit opened a fully
+  prefilled dialog that could only fail on save; Delete — a destructive entry —
+  sat one click away from users who could never perform it.
+
+  The gate intersected the object's resolved CRUD affordance with the server's
+  effective API operation set (`/me/permissions` `apiOperations`, objectui#3720),
+  and nothing else. `apiOperations` is the object's **API exposure surface** —
+  "which verbs does this object publish" — and the spec's own describe text says
+  so. It is principal-independent: the report measured two accounts with opposite
+  `allowEdit`, 30 shared objects, and **30/30 identical** `apiOperations`. A gate
+  made only of object-scoped layers therefore fails OPEN for every unprivileged
+  caller, which is why the same screen carried three different answers to "may
+  this user write this object": the toolbar's New was correctly hidden
+  (`affordances.create && can(obj, 'create')`), the record header's Edit/Delete
+  were correctly hidden (per-record write probe), and the row kebab was not.
+
+  Four surfaces now AND the principal's own verdict — `can(obj, 'update' |
+'delete')`, i.e. `/me/permissions` `allowEdit` / `allowDelete`, the toolbar's
+  source — on top of the layers they already had:
+
+  - the grid row kebab's built-in Edit/Delete (`resolveRowCrudAffordances` gained
+    `permissionUpdate` / `permissionDelete`, filled at the `ObjectGrid` call site);
+  - the grid's bulk-delete bar, which rides the same object-level delete verdict,
+    so the row gate and the more destructive bulk entry move together;
+  - the non-grid (kanban / calendar / gallery) bulk bar `ListView` renders itself;
+  - the related-list Create/Edit/Delete on a child object
+    (`RelatedRecordActionsBridge`), which had the same object-only gate.
+
+  **This is a tightening of the intersection, not a swap.** Every existing layer
+  stays: the ADR-0103 lifecycle bucket, `userActions.edit` / `delete`, and
+  `apiOperations`. A permission grant cannot re-open what any of them closed, and
+  none of them survives a permission denial.
+
+  Fail-open is preserved where it is the deliberate contract: `usePermissions()`
+  with no `PermissionProvider` answers `can: () => true`, so standalone embeds and
+  hosts that ship no permission source keep their Edit/Delete exactly as before.
+  Under `MePermissionsProvider` the semantics are the toolbar's, unchanged and now
+  shared: an authenticated principal whose object is absent from
+  `/me/permissions.objects` resolves fail-closed (objectui#2926 ④), an anonymous
+  session keeps the permissive default, and children never render while the
+  permission set is loading. Per-key absence is still permissive — an object entry
+  without `allowEdit` reads as allowed.
+
+  Server-side enforcement was already hard (403, DB unchanged), so this closes a
+  UI-affordance gap rather than an authorization hole.
+
+- 1a33b1a: fix(plugin-grid): don't render a row "⋮" trigger that opens an empty menu
+
+  The object list's row overflow trigger was gated on whether row-action
+  **handlers** were wired and how many actions were **declared**
+  (`(canEdit && onEdit) || (canDelete && onDelete) || menuDefs.length > 0 || rowActions.length > 0`),
+  while the menu's items were filtered a second time — per item, per record —
+  against `visibleWhen` / `visible`. On a row where every item was
+  predicate-suppressed the trigger still rendered and opened an empty box, which
+  reads as a broken page: a platform object whose row actions are gated for one
+  role showed a "⋮" on every row for everyone else, with nothing inside it.
+
+  The trigger is now decided by the items that will actually render for that row,
+  resolved through the same visibility functions the items gate themselves on, so
+  the two cannot disagree. The decision is per row: within one grid a row that
+  keeps an action keeps its trigger while a row with nothing left renders none. The
+  inline `variant: 'primary'` button reads that same shared rule. The actions
+  column is table-level and unchanged, so a row with nothing to offer renders an
+  empty cell and every row keeps the same cell count.
+
+  Which items render is untouched — only whether the trigger renders when none of
+  them survive.
+
+- Updated dependencies [794c497]
+- Updated dependencies [993336f]
+- Updated dependencies [f0a625a]
+- Updated dependencies [b5980f4]
+- Updated dependencies [8aad9fd]
+- Updated dependencies [6719877]
+- Updated dependencies [56ff091]
+- Updated dependencies [0186cdc]
+- Updated dependencies [7864f03]
+- Updated dependencies [ea41a59]
+- Updated dependencies [0cbdca8]
+- Updated dependencies [d229dfa]
+- Updated dependencies [ecae400]
+- Updated dependencies [4bc6c23]
+- Updated dependencies [d3e738a]
+- Updated dependencies [c3b01a7]
+- Updated dependencies [f5f8744]
+- Updated dependencies [7ed3360]
+- Updated dependencies [69becd2]
+- Updated dependencies [5e52495]
+- Updated dependencies [0fa5e4d]
+- Updated dependencies [b750823]
+- Updated dependencies [5bfaabd]
+- Updated dependencies [e06810e]
+- Updated dependencies [ab3ad4f]
+- Updated dependencies [65bb513]
+- Updated dependencies [c97a45e]
+- Updated dependencies [b19162d]
+- Updated dependencies [c2fd122]
+- Updated dependencies [1bd6faa]
+- Updated dependencies [ac2139c]
+- Updated dependencies [b14ab3a]
+- Updated dependencies [e24d767]
+- Updated dependencies [8c60819]
+- Updated dependencies [aca561a]
+- Updated dependencies [e64a52e]
+- Updated dependencies [844d17f]
+- Updated dependencies [d8a0be4]
+- Updated dependencies [48132f7]
+- Updated dependencies [4dcd52a]
+- Updated dependencies [42ae5c6]
+- Updated dependencies [0ef9dfd]
+- Updated dependencies [f4b97c8]
+- Updated dependencies [1d723e3]
+- Updated dependencies [0109f54]
+- Updated dependencies [7e5bb5d]
+- Updated dependencies [fbc23e0]
+- Updated dependencies [6d762da]
+- Updated dependencies [e6fdbdc]
+- Updated dependencies [54233b1]
+- Updated dependencies [c2ecbae]
+- Updated dependencies [f9faa7d]
+- Updated dependencies [97b63d7]
+- Updated dependencies [6bb454a]
+- Updated dependencies [11c1e71]
+- Updated dependencies [523be48]
+- Updated dependencies [7e2b7e9]
+- Updated dependencies [33526fd]
+- Updated dependencies [32413ec]
+- Updated dependencies [c1e1e6b]
+  - @object-ui/components@17.4.0
+  - @object-ui/react@17.4.0
+  - @object-ui/core@17.4.0
+  - @object-ui/fields@17.4.0
+  - @object-ui/i18n@17.4.0
+  - @object-ui/types@17.4.0
+  - @object-ui/mobile@17.4.0
+  - @object-ui/permissions@17.4.0
+
 ## 17.3.0
 
 ### Patch Changes
@@ -1000,6 +1335,7 @@ os_tianshun_ehr_position — use a unique value or the record id` — with the f
   is byte-identical, it just comes from the pack now.
 
   Adds two guards, both mutation-verified:
+
   - `en` ↔ `zh` full key parity, asserted in both directions. The other eight
     packs are still ~357 keys behind and are tracked separately (objectui#2872
     part a), so they are deliberately not asserted yet.
@@ -2183,6 +2519,7 @@ undefined` — swallowing the very errors the command exists to print. Now reads
 
   Extract the bulk-vs-per-row decision into a reusable
   `executeBulkBatch(input, ops)` helper in `@object-ui/core`:
+
   - Single decision tree shared by both update and delete fast paths.
   - Bulk success → no per-row pass.
   - Bulk partial-count → aggregate batch error.
@@ -2195,12 +2532,14 @@ undefined` — swallowing the very errors the command exists to print. Now reads
 - 5633edd: feat(detail,grid): tab + selection motion polish
 
   **plugin-detail**
+
   - `DetailTabs` and the auto-tabs path in `DetailView` (5 inline
     `<TabsContent>` instances: details, related, activity, discussion,
     history) now fade in when their tab becomes active, eliminating
     the harsh flash when switching tabs.
 
   **plugin-grid**
+
   - `BulkActionBar` slides in from the bottom + fades in when a
     selection is made, instead of popping into existence.
   - The "N items selected" counter re-animates on every count change
@@ -2229,6 +2568,7 @@ undefined` — swallowing the very errors the command exists to print. Now reads
   `defaultCurrency` is set on the field/column, formatting is unchanged.
 
   Fixed call sites:
+
   - `@object-ui/fields`: `formatCurrency`, `formatCompactCurrency`, and
     `CurrencyCellRenderer` no longer default-param `'USD'`.
   - `@object-ui/i18n`: `formatCurrency()` falls back to `formatNumber`
@@ -2318,6 +2658,7 @@ undefined` — swallowing the very errors the command exists to print. Now reads
   non-en/zh locales) and the `common.addToFavorites` /
   `common.removeFromFavorites` keys across all ten built-in locales so
   the `builtInLocales` parity tests pass.
+
   - @object-ui/components@5.0.2
   - @object-ui/fields@5.0.2
   - @object-ui/react@5.0.2
@@ -2390,6 +2731,7 @@ undefined` — swallowing the very errors the command exists to print. Now reads
 - 9aacced: **Bulk actions (Phase 2): cross-page select-all.**
 
   When the user selects every row on the current page and there are more matching records off-screen, the `BulkActionBar` now surfaces a banner with a "Select all N matching" affordance (Gmail / Salesforce convention). Opting in flips the bar into "all matches" mode and the bulk dispatcher transparently expands the record set by re-issuing the active find against `dataSource` (paged at 500/request, hard-capped at 5000) before handing it to the executor or the consumer's `onBulkDelete` callback.
+
   - `BulkActionBar` gains `pageSize`, `totalMatching`, `allMatchingSelected`, and `onSelectAllMatching` props.
   - `ObjectGrid` captures `total` + the last find params from `dataSource.find` and resets the cross-page flag whenever the underlying query changes.
   - 7 new `BulkActionBar.test.tsx` cases cover the affordance + Clear interaction.
@@ -2397,10 +2739,12 @@ undefined` — swallowing the very errors the command exists to print. Now reads
 - 9661d86: **Bulk actions (Phase 2): undo last batch + per-row error inspector.**
 
   `useBulkExecutor` now snapshots the pre-mutation values for every successful row in an `update` run (limited to keys actually touched by the patch). The dialog's result step exposes:
+
   - **Undo** — a one-shot button that replays the snapshot through `dataSource.update`, restoring the prior values. Available only for `update` operations where at least one row landed; consumed after a single click so a sticky toast can't double-revert.
   - **Per-row error inspector** — failed rows are listed with an inline **Retry** affordance that re-attempts the original op + params for that record and drops the row from the error list on success.
 
   Notes:
+
   - `delete` and `custom` operations never accumulate a snapshot — undoing a delete from the client would silently miss server-side cascades, so the button is hidden up-front.
   - The CSV export of all errors is unchanged.
   - 5 new tests in `useBulkExecutor.test.ts` cover snapshot capture, failure filtering, undo replay, delete no-op, and retry-clears-error.
@@ -2575,6 +2919,7 @@ undefined` — swallowing the very errors the command exists to print. Now reads
 - fd15918: Comprehensive i18n refactor + CI test fix.
 
   **i18n (`@object-ui/i18n`)**
+
   - Added ~130 new keys under 12 new top-level namespaces: `layout`, `search`,
     `empty`, `renderer`, `actionDialog`, `rowAction`, `navigationSync`,
     `objectActions`, `objectViewActions`, `dashboardActions`, `recordDetail`,
@@ -2586,6 +2931,7 @@ undefined` — swallowing the very errors the command exists to print. Now reads
 
   **App shell (`@object-ui/app-shell`)** — replaced hardcoded English in 14
   files with `useObjectTranslation`:
+
   - Layout: `AppSidebar`, `ActivityFeed` (locale-aware relative time),
     `MetadataInspector`.
   - Views: `SearchResultsPage`, `ActionParamDialog`, `RecordFormPage`,
@@ -2597,12 +2943,14 @@ undefined` — swallowing the very errors the command exists to print. Now reads
     `useObjectActions` (delete confirm + success / failure toasts).
 
   **Plugin grid (`@object-ui/plugin-grid`)**
+
   - `ObjectGrid` record-detail panel now translates Empty / Yes / No / System
     via the existing `useGridTranslation` safe-fallback wrapper.
   - `RowActionMenu` adopts a local safe-fallback i18n wrapper for
     `Open menu` / `Edit` / `Delete`, preserving standalone-usage guarantees.
 
   **CLI test fix (`@object-ui/cli`)**
+
   - `cli-bin.test.ts` auto-builds the package on first run when `dist/cli.js`
     is missing, instead of throwing. This unbreaks `pnpm test:coverage` in CI
     (root vitest run does not honor turbo's `^build` deps) and removes the
@@ -2621,6 +2969,7 @@ undefined` — swallowing the very errors the command exists to print. Now reads
 ### Patch Changes
 
 - 89ae109: Fix click navigation and required-FK form rendering
+
   - **plugin-grid**: ObjectGrid's `getSelectFields()` now always includes `id` in
     the SELECT projection. Previously, when a view configured `columns` without
     `id`, the SQL driver stripped it from results, and row-click handlers silently
@@ -2685,6 +3034,7 @@ undefined` — swallowing the very errors the command exists to print. Now reads
   Library builds (vite lib mode) now externalize every non-relative import instead of bundling third-party CJS dependencies into the published dist. This avoids inlined `require("react")` / `require("react-dom")` calls that cause `Calling \`require\` for "react" in an environment that doesn't expose the \`require\` function` runtime errors when consumer apps re-bundle the published dist.
 
   Specifically fixes:
+
   - `@object-ui/plugin-dashboard` no longer inlines `react-grid-layout` (and its transitive `react-draggable` / `react-resizable` CJS bundles). `react-grid-layout` is now declared as a peer dependency so consumers install a single ESM-friendly copy.
   - `@object-ui/components`, `@object-ui/plugin-calendar`, `@object-ui/plugin-charts`, `@object-ui/plugin-designer` no longer inline `react-i18next` / `i18next` / `use-sync-external-store` CJS shims.
   - All plugin packages now use a unified `external: (id) => !/^[./]/.test(id) && !id.startsWith(__dirname)` rule, ensuring future additions of CJS deps are automatically externalized.
@@ -2751,6 +3101,7 @@ undefined` — swallowing the very errors the command exists to print. Now reads
   contract through the renderer end-to-end:
 
   **`@object-ui/types`** — `DataSource` gains four optional methods:
+
   - `createExportJob(resource, request)` → `{ jobId, status, estimatedRecords, createdAt }`
   - `getExportJobProgress(jobId)` → `{ status, processedRecords, totalRecords, percentComplete, downloadUrl, … }`
   - `cancelExportJob(jobId)` (optional)
@@ -2760,6 +3111,7 @@ undefined` — swallowing the very errors the command exists to print. Now reads
   remain dependency-free.
 
   **`@object-ui/components`** — new public API:
+
   - `useExportJob({ dataSource, pollIntervalMs, onComplete, onError })` — owns the
     full polling loop, terminal-state handling, cancel, and download.
   - `<ExportProgressDialog open onOpenChange job filename closeAfterDownloadMs />` —
@@ -2778,24 +3130,29 @@ undefined` — swallowing the very errors the command exists to print. Now reads
 - a2d7023: End-user feature batch — forms, designer history, import/export, and PWA offline sync.
 
   **Forms (`@object-ui/fields`, `@object-ui/providers`)**
+
   - `FileField`: native `<input capture="environment">` camera capture for mobile devices, plus a uploading-progress indicator driven by `UploadProvider`.
   - `ImageField`: per-image inline crop/rotate via the lazy-loaded `ImageCropperDialog` (canvas-based, zero new deps).
   - New `UploadProvider` in `@object-ui/providers` with pluggable adapters for S3 and Azure Blob (plus the default object-URL adapter for local previews). XHR-based with progress, abort, and retry.
   - `LookupField`: `lookup.dependsOn: string | string[]` to chain dependent lookups (e.g. State depends on Country); the trigger is gated until parent values are present and the OData `$filter` is built automatically.
 
   **Container-aware widget widths (`@object-ui/components`)**
+
   - New `useResizeObserver(ref)` hook exposing `{ width, height }` of any element. SSR-safe; reads the initial size via `getBoundingClientRect`.
   - `plugin-gantt` and `plugin-kanban` now react to their container size instead of `window.innerWidth`, so they behave correctly inside split panels and dashboards.
 
   **Designer history (`@object-ui/plugin-designer`)**
+
   - `useUndoRedo` (and therefore `useDesignerHistory`) gains `persistKey` + `storage` options to round-trip the undo/redo stack through `sessionStorage`, plus a `clearPersisted()` cleanup helper. Drafts now survive accidental tab refreshes.
   - New `<HistoryPanel>` component renders the timeline visually with one-click jump-to-checkpoint via the new `jumpTo(index)` API.
 
   **Import wizard (`@object-ui/plugin-grid`)**
+
   - Saved column-mapping templates: name, save, re-apply, and delete via a new template bar in the mapping step. Persisted under `objectui:import-templates:${objectName}` (override via `templateStorageKey` / `templateStorage`).
   - Inline validation correction: cells with errors in the preview step are now editable; corrections feed straight into the import without requiring a re-upload, with green-bar status indicators for fixed rows.
 
   **PWA offline sync (`@object-ui/mobile`)**
+
   - New `MemoryOfflineQueue` / `IndexedDbOfflineQueue` (`createOfflineQueue()` picks the best backend) backed by IndexedDB.
   - `createOfflineDataSource(inner, { queue })` wraps any DataSource so mutations issued while offline (or that fail with a network-style error) are queued and replayed in order on reconnect. Includes `replay()`, `drop()`, `clear()`, `pending()`, an `onChange` notifier, and an opt-in `resolveConflict` hook for stale-write conflicts.
   - New `useOfflineSync(source)` hook exposes `{ isOnline, pending, isReplaying, replay, drop, clear }` and auto-replays on the browser's `online` event.
diff --git a/packages/plugin-grid/package.json b/packages/plugin-grid/package.json
index 2fe448fcd8..d265529c26 100644
--- a/packages/plugin-grid/package.json
+++ b/packages/plugin-grid/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/plugin-grid",
-  "version": "17.3.0",
+  "version": "17.4.0",
   "type": "module",
   "license": "MIT",
   "description": "Grid plugin for Object UI",
diff --git a/packages/plugin-kanban/CHANGELOG.md b/packages/plugin-kanban/CHANGELOG.md
index 5f149ce0c5..52b809bca4 100644
--- a/packages/plugin-kanban/CHANGELOG.md
+++ b/packages/plugin-kanban/CHANGELOG.md
@@ -1,5 +1,128 @@
 # @object-ui/plugin-kanban
 
+## 17.4.0
+
+### Patch Changes
+
+- 5bfaabd: `PageComponentSchema.dataSource` now reaches every object-bound block, not just
+  `list-view` — and `element:record_picker` stops discarding `view`
+  (objectstack#6953).
+
+  objectstack#5576 wired the spec's per-element data binding
+  (`dataSource: { object, view?, filter?, sort?, limit? }`) to `list-view` and left
+  the same declaration inert on every other page component. Two gaps remained, and
+  both were silent:
+
+  - **`element:record_picker` read four of the five keys and dropped `view`.** So
+    `dataSource: { object: 'account', view: 'hot' }` — the spec's own example —
+    built a picker over EVERY account instead of the rows the saved view selects.
+    Nothing threw and nothing rendered an error; the option list was simply wider
+    than what was authored, which also means a user could select a record the page
+    said was out of scope.
+  - **`object-grid` / `object-form` / `object-kanban` / `object-calendar` /
+    `object-chart` / `object-metric` / `record:related_list` read none of it.**
+    Each gates its fetch on its own `objectName`, and nothing mapped
+    `dataSource.object` onto it, so a page written the way the spec documents
+    rendered an empty grid / a field-less form / a board with no cards / an empty
+    month / an empty chart / a static metric number — with no request and no
+    diagnostic anywhere. Spec-valid metadata rendering nothing is the
+    objectstack#4413 shape.
+
+  Composition follows objectstack#5576's landed semantics unchanged on every block:
+  a named saved view supplies the baseline, a key written on the component itself
+  overrides it, an explicit binding key overrides both, `filter` AND-combines
+  ("additional filter criteria" — a binding can narrow a view, never widen it), and
+  a `view` name that does not resolve renders a configuration error instead of
+  degrading to the object's full scope.
+
+  - `@object-ui/react` — new `useElementDataSourceSchema(schema, mapping, dataSource?)`
+    and `ElementDataSourceGate` apply a resolved binding to the schema keys a given
+    block reads, plus `ElementDataSourceErrorPanel` / `ElementDataSourceLoadingPanel`
+    for the two non-final states. One precedence table for all blocks rather than
+    one copy per block — that copy is how "additional filter criteria" would have
+    become two dialects.
+  - A mapping names **only** keys its block genuinely reads. A composed value
+    written onto a key the block ignores would be accepted and dropped, which is
+    the defect being removed, one layer deeper — so a kanban's swimlane `columns`
+    never receive a view's field list, and a block with no row cap leaves `limit`
+    unmapped. The per-block coverage table, including two residual gaps that are
+    named rather than papered over, is in `content/docs/guide/data-source.md`.
+
+  No behaviour changes for a block that carries no `dataSource`: the binding-free
+  path returns the schema by reference, so nothing remounts and nothing refetches.
+
+- Updated dependencies [794c497]
+- Updated dependencies [993336f]
+- Updated dependencies [f0a625a]
+- Updated dependencies [b5980f4]
+- Updated dependencies [8aad9fd]
+- Updated dependencies [6719877]
+- Updated dependencies [56ff091]
+- Updated dependencies [0186cdc]
+- Updated dependencies [7864f03]
+- Updated dependencies [ea41a59]
+- Updated dependencies [0cbdca8]
+- Updated dependencies [d229dfa]
+- Updated dependencies [ecae400]
+- Updated dependencies [4bc6c23]
+- Updated dependencies [d3e738a]
+- Updated dependencies [c3b01a7]
+- Updated dependencies [f5f8744]
+- Updated dependencies [7ed3360]
+- Updated dependencies [69becd2]
+- Updated dependencies [5e52495]
+- Updated dependencies [0fa5e4d]
+- Updated dependencies [b750823]
+- Updated dependencies [5bfaabd]
+- Updated dependencies [e06810e]
+- Updated dependencies [ab3ad4f]
+- Updated dependencies [65bb513]
+- Updated dependencies [c97a45e]
+- Updated dependencies [b19162d]
+- Updated dependencies [c2fd122]
+- Updated dependencies [1bd6faa]
+- Updated dependencies [ac2139c]
+- Updated dependencies [b14ab3a]
+- Updated dependencies [e24d767]
+- Updated dependencies [7b3e048]
+- Updated dependencies [8c60819]
+- Updated dependencies [aca561a]
+- Updated dependencies [e64a52e]
+- Updated dependencies [844d17f]
+- Updated dependencies [d8a0be4]
+- Updated dependencies [48132f7]
+- Updated dependencies [4dcd52a]
+- Updated dependencies [42ae5c6]
+- Updated dependencies [0ef9dfd]
+- Updated dependencies [f4b97c8]
+- Updated dependencies [1d723e3]
+- Updated dependencies [0109f54]
+- Updated dependencies [7e5bb5d]
+- Updated dependencies [fbc23e0]
+- Updated dependencies [6d762da]
+- Updated dependencies [e6fdbdc]
+- Updated dependencies [4178d5a]
+- Updated dependencies [54233b1]
+- Updated dependencies [c2ecbae]
+- Updated dependencies [acc34c5]
+- Updated dependencies [c4768a7]
+- Updated dependencies [f9faa7d]
+- Updated dependencies [97b63d7]
+- Updated dependencies [6bb454a]
+- Updated dependencies [11c1e71]
+- Updated dependencies [523be48]
+- Updated dependencies [7e2b7e9]
+- Updated dependencies [33526fd]
+- Updated dependencies [32413ec]
+- Updated dependencies [c1e1e6b]
+  - @object-ui/components@17.4.0
+  - @object-ui/plugin-detail@17.4.0
+  - @object-ui/react@17.4.0
+  - @object-ui/core@17.4.0
+  - @object-ui/fields@17.4.0
+  - @object-ui/i18n@17.4.0
+  - @object-ui/types@17.4.0
+
 ## 17.3.0
 
 ### Patch Changes
@@ -1052,6 +1175,7 @@
   - Stage chevron (`record:path`): bump completed-stage contrast (emerald-800 text on emerald-500/15, was 700 on /10) and future-stage text from `foreground/70` to `foreground/85` for legibility.
   - i18n: add `notifications.emptyUnread`, `notifications.filterUnread`, `notifications.filterAll` (en + zh) so the InboxPopover Unread/All sub-filter renders in the active locale.
 - 5425608: CRM UX polish pass — calmer enterprise look across detail + kanban.
+
   - **plugin-kanban**: column headers now use a 2px muted accent stripe with
     neutral foreground titles + a quiet grey count pill instead of full
     rainbow gradient + colored title + colored count. Pipeline boards
@@ -1074,6 +1198,7 @@
     `empty.recordNotFound{,Description}` keys (en + zh).
 
 - d912a60: CRM polish — denser kanban cards, smarter currency, calmer dates.
+
   - **plugin-kanban card body**: drop the verbose `Label: value` two-column
     grid in favor of a single-column dense list (values only, with the
     field label preserved as a hover `title` for accessibility). Pipeline
@@ -1096,6 +1221,7 @@
   platform primitive for "no records / no data" states. Two new props
   keep it flexible enough to absorb the hand-rolled variants that lived
   in `plugin-list`, `plugin-kanban`, and `plugin-dashboard`:
+
   - `showIcon?: boolean` — drops the icon container entirely. Used by the
     kanban board-level empty banner, which is a status banner rather than
     a true empty-state.
@@ -1104,6 +1230,7 @@
     empty state, which uses a large standalone glyph).
 
   Adopters:
+
   - `plugin-list` (`ListView` grid empty-state) — preserves the existing
     large icon, title, message, add-record button and `data-testid`s,
     but delegates the structural markup to `DataEmptyState`.
@@ -1254,6 +1381,7 @@
   chrome on phones: title + 1 primary action, plus content. We were
   shipping ~5 rows of toolbars + chips + tabs above the data. This commit
   hides the desktop-only chrome at the `<sm` breakpoint:
+
   - **ListView**: TabBar (view switcher), UserFilters chip row, quick-filters
     chip row, Sort button, list-scoped Search popover, and the
     (newly-added) mobile-only ViewSettingsPopover gear are all hidden on
@@ -1490,6 +1618,7 @@
   detail view (`TypeError: titleFormat.replace is not a function`) and printed
   `Failed to evaluate expression: ${[object Object]}` for every action visibility
   predicate.
+
   - `@object-ui/core`: `ExpressionEvaluator.evaluate` / `evaluateCondition` now
     unwrap Expression envelopes transparently.
   - `@object-ui/react`: new `toPredicateInput()` helper to safely normalize
@@ -1516,6 +1645,7 @@
 ### Patch Changes
 
 - 1b6dc64: fix: complete Tailwind v3→v4 migration cleanup
+
   - Rename deprecated `flex-shrink-0` → `shrink-0` and `flex-grow-N` →
     `grow-N` (Tailwind v4 dropped the long-form aliases). Affects
     data-table, fields/index, FileField, ChatbotEnhanced,
@@ -1576,6 +1706,7 @@
   Library builds (vite lib mode) now externalize every non-relative import instead of bundling third-party CJS dependencies into the published dist. This avoids inlined `require("react")` / `require("react-dom")` calls that cause `Calling \`require\` for "react" in an environment that doesn't expose the \`require\` function` runtime errors when consumer apps re-bundle the published dist.
 
   Specifically fixes:
+
   - `@object-ui/plugin-dashboard` no longer inlines `react-grid-layout` (and its transitive `react-draggable` / `react-resizable` CJS bundles). `react-grid-layout` is now declared as a peer dependency so consumers install a single ESM-friendly copy.
   - `@object-ui/components`, `@object-ui/plugin-calendar`, `@object-ui/plugin-charts`, `@object-ui/plugin-designer` no longer inline `react-i18next` / `i18next` / `use-sync-external-store` CJS shims.
   - All plugin packages now use a unified `external: (id) => !/^[./]/.test(id) && !id.startsWith(__dirname)` rule, ensuring future additions of CJS deps are automatically externalized.
@@ -1630,24 +1761,29 @@
 - a2d7023: End-user feature batch — forms, designer history, import/export, and PWA offline sync.
 
   **Forms (`@object-ui/fields`, `@object-ui/providers`)**
+
   - `FileField`: native `<input capture="environment">` camera capture for mobile devices, plus a uploading-progress indicator driven by `UploadProvider`.
   - `ImageField`: per-image inline crop/rotate via the lazy-loaded `ImageCropperDialog` (canvas-based, zero new deps).
   - New `UploadProvider` in `@object-ui/providers` with pluggable adapters for S3 and Azure Blob (plus the default object-URL adapter for local previews). XHR-based with progress, abort, and retry.
   - `LookupField`: `lookup.dependsOn: string | string[]` to chain dependent lookups (e.g. State depends on Country); the trigger is gated until parent values are present and the OData `$filter` is built automatically.
 
   **Container-aware widget widths (`@object-ui/components`)**
+
   - New `useResizeObserver(ref)` hook exposing `{ width, height }` of any element. SSR-safe; reads the initial size via `getBoundingClientRect`.
   - `plugin-gantt` and `plugin-kanban` now react to their container size instead of `window.innerWidth`, so they behave correctly inside split panels and dashboards.
 
   **Designer history (`@object-ui/plugin-designer`)**
+
   - `useUndoRedo` (and therefore `useDesignerHistory`) gains `persistKey` + `storage` options to round-trip the undo/redo stack through `sessionStorage`, plus a `clearPersisted()` cleanup helper. Drafts now survive accidental tab refreshes.
   - New `<HistoryPanel>` component renders the timeline visually with one-click jump-to-checkpoint via the new `jumpTo(index)` API.
 
   **Import wizard (`@object-ui/plugin-grid`)**
+
   - Saved column-mapping templates: name, save, re-apply, and delete via a new template bar in the mapping step. Persisted under `objectui:import-templates:${objectName}` (override via `templateStorageKey` / `templateStorage`).
   - Inline validation correction: cells with errors in the preview step are now editable; corrections feed straight into the import without requiring a re-upload, with green-bar status indicators for fixed rows.
 
   **PWA offline sync (`@object-ui/mobile`)**
+
   - New `MemoryOfflineQueue` / `IndexedDbOfflineQueue` (`createOfflineQueue()` picks the best backend) backed by IndexedDB.
   - `createOfflineDataSource(inner, { queue })` wraps any DataSource so mutations issued while offline (or that fail with a network-style error) are queued and replayed in order on reconnect. Includes `replay()`, `drop()`, `clear()`, `pending()`, an `onChange` notifier, and an opt-in `resolveConflict` hook for stale-write conflicts.
   - New `useOfflineSync(source)` hook exposes `{ isOnline, pending, isReplaying, replay, drop, clear }` and auto-replays on the browser's `online` event.
@@ -1656,15 +1792,18 @@
 - b2be122: fix(mobile): round 2 — kanban readability, calendar default view, timeline dot clipping
 
   **Kanban**
+
   - Remove `font-mono` from card titles, descriptions, column headers, and empty-state labels — CRM cards no longer render in a monospace font.
   - Constrain column body height (`max-h-full min-h-0` + `h-full` on the layout root) so `ScrollArea` activates and cards don't bleed past the viewport bottom.
   - Opportunistically derive `description` (e.g. `$60K · Acme Corp · @owner`) and up to two `badges` (priority/severity/industry/rating) in `ObjectKanban` when the schema/source omits them, giving mobile cards more context at a glance.
 
   **Calendar**
+
   - `ObjectCalendar` previously hardcoded `view={schema.defaultView ?? 'month'}`, making the view-selector dropdown a no-op. Wire the `view` state through to the `<Calendar>` prop so user selection is respected.
   - On mobile (viewport < 768 px) coerce `day` defaults to `month` via a synchronous lazy initialiser and a resize/orientation effect — avoids the useless 24-hour empty-hour grid for date-only events.
 
   **Timeline**
+
   - Add `ml-3` to the `<Timeline>` `<ol>` so the `absolute -left-3` marker dots are no longer clipped at the scroll-container edge.
 
 - Updated dependencies [a2d7023]
@@ -1844,6 +1983,7 @@
 - New plugin-object and ObjectQL SDK updates
 
   **Added:**
+
   - New Plugin: @object-ui/plugin-object - ObjectQL plugin for automatic table and form generation
     - ObjectTable: Auto-generates tables from ObjectQL object schemas
     - ObjectForm: Auto-generates forms from ObjectQL object schemas with create/edit/view modes
@@ -1852,6 +1992,7 @@
   - ObjectQL Integration: Enhanced ObjectQLDataSource with getObjectSchema() method using MetadataApiClient
 
   **Changed:**
+
   - Updated @objectql/sdk from ^1.8.3 to ^1.9.1
   - Updated @objectql/types from ^1.8.3 to ^1.9.1
 
@@ -1868,6 +2009,7 @@
 - Patch release: Add automated changeset workflow and CI/CD improvements
 
   This release includes infrastructure improvements:
+
   - Added changeset-based version management
   - Enhanced CI/CD workflows with GitHub Actions
   - Improved documentation for contributing and releasing
diff --git a/packages/plugin-kanban/package.json b/packages/plugin-kanban/package.json
index ce43c795e5..10bd7f9f1b 100644
--- a/packages/plugin-kanban/package.json
+++ b/packages/plugin-kanban/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/plugin-kanban",
-  "version": "17.3.0",
+  "version": "17.4.0",
   "type": "module",
   "license": "MIT",
   "description": "Kanban board plugin for Object UI, powered by dnd-kit",
diff --git a/packages/plugin-list/CHANGELOG.md b/packages/plugin-list/CHANGELOG.md
index bc444d13be..20faebf550 100644
--- a/packages/plugin-list/CHANGELOG.md
+++ b/packages/plugin-list/CHANGELOG.md
@@ -1,5 +1,167 @@
 # @object-ui/plugin-list
 
+## 17.4.0
+
+### Minor Changes
+
+- bd863fe: fix(timeline): the timeline binds to the date axis the view actually declares (#3129)
+
+  A view whose date axis is bound under `calendar` was **offered** the Timeline
+  visualization and then bucketed every record into "No date" — while the calendar
+  rendered the very same field correctly. Two read-sites disagreed about what
+  counts as a timeline binding:
+
+  - `ListView`'s capability gate accepted `options.calendar.startDateField` as a
+    timeline-resolvable axis; the render branch never read calendar config at all,
+    so it fell through to its `created_at` last resort.
+  - `app-shell`'s object page emitted `startDateField: 'due_date'` into
+    `options.timeline` for **every** object view, declared or not. Downstream that
+    is indistinguishable from a real binding, and because it is always present it
+    shadowed the fallback entirely.
+
+  `ListView` now resolves the axis once — `resolveTimelineDateBinding`, consumed by
+  the capability gate and the render branch alike, reading spec key before legacy
+  alias and `timeline` before `calendar` in both nestings — and the object page
+  forwards only what the view declared. A declared `timeline.startDateField` still
+  wins wherever both appear, and a view that declares no date axis anywhere keeps
+  the historical `created_at` fallback.
+
+  Observable rendering change (records move out of "No date" into real date
+  buckets), hence `minor`.
+
+### Patch Changes
+
+- e06810e: `PageComponentSchema.dataSource` is now consumed instead of discarded — a
+  `list-view` page component can reference a **saved view by name** for the first
+  time, and writing the binding no longer breaks the component
+  (objectstack#5576).
+
+  The spec declares a per-element data binding on every page component —
+  `dataSource: { object, view?, filter?, sort?, limit? }` — and objectui read none
+  of it. `ViewDataProvider.resolveElementDataSource` forwarded
+  `filter`/`sort`/`limit` and dropped `view` entirely, and had no caller outside its
+  own test; nothing mapped `object` onto the `objectName` a list actually reads. So
+  "reference a saved view by name" was published, validated and inert, and every
+  page that wanted a saved view's columns/filter/sort had to inline a second copy of
+  them — the drift the binding exists to remove.
+
+  Writing the binding also **broke** the block, for a reason unrelated to `view`:
+  `SchemaRenderer` spread the schema's `dataSource` metadata onto the component as a
+  React prop, and that is the prop name the host uses to inject the data-source
+  ADAPTER. The plain `{ object, view }` object shadowed the adapter, so the first
+  `dataSource.find(…)` threw `dataSource.find is not a function` and `list-view`
+  rendered "Couldn't load records" — a spec-compliant component failing next to
+  identical ones that omitted the binding.
+
+  - `@object-ui/react` — `SchemaRenderer` no longer spreads `schema.dataSource` as a
+    prop (it is metadata, like `visibleWhen`); renderers read it off `schema`. An
+    explicit React `dataSource` prop is unaffected. New
+    `useElementDataSource(schema, dataSource?)` hook resolves a binding, fetching
+    the named saved view from the object definition's `listViews` and the metadata
+    overlay's `listViews()`.
+  - `@object-ui/core` — new `isElementDataSourceConfig` / `collectSavedViews` /
+    `resolveSavedView` / `composeElementDataSource`, and `resolveElementDataSource`
+    now honours `view` through an optional `DataFetcher.fetchViews`, reporting an
+    unresolvable view as an error instead of silently returning every record.
+    `resolveViewId` moved here from `@object-ui/app-shell` (re-exported there) so
+    one matcher serves both the object page and a page component.
+  - `@object-ui/plugin-list` — `list-view` maps the binding onto the props
+    `ListView` reads. `dataSource.*` keys are authoritative, view-supplied values
+    are a baseline the component's own keys override, and `filter` AND-combines at
+    every level (the spec calls the binding's filter "additional criteria"), so a
+    binding can narrow a saved view but never widen it. A `view` name that does not
+    resolve renders a configuration error naming the object's actual views and
+    issues no query — it never falls back to the object's default view, because that
+    turns a typo into a silently wider answer.
+
+- aeb8424: List row Edit/Delete, bulk delete and related-list CRUD now run the caller's own permission, not just the object's API exposure (objectui#4096)
+
+  The row kebab's built-in Edit/Delete rendered for every account, including ones
+  the server answers `403 PERMISSION_DENIED` on. Clicking Edit opened a fully
+  prefilled dialog that could only fail on save; Delete — a destructive entry —
+  sat one click away from users who could never perform it.
+
+  The gate intersected the object's resolved CRUD affordance with the server's
+  effective API operation set (`/me/permissions` `apiOperations`, objectui#3720),
+  and nothing else. `apiOperations` is the object's **API exposure surface** —
+  "which verbs does this object publish" — and the spec's own describe text says
+  so. It is principal-independent: the report measured two accounts with opposite
+  `allowEdit`, 30 shared objects, and **30/30 identical** `apiOperations`. A gate
+  made only of object-scoped layers therefore fails OPEN for every unprivileged
+  caller, which is why the same screen carried three different answers to "may
+  this user write this object": the toolbar's New was correctly hidden
+  (`affordances.create && can(obj, 'create')`), the record header's Edit/Delete
+  were correctly hidden (per-record write probe), and the row kebab was not.
+
+  Four surfaces now AND the principal's own verdict — `can(obj, 'update' |
+'delete')`, i.e. `/me/permissions` `allowEdit` / `allowDelete`, the toolbar's
+  source — on top of the layers they already had:
+
+  - the grid row kebab's built-in Edit/Delete (`resolveRowCrudAffordances` gained
+    `permissionUpdate` / `permissionDelete`, filled at the `ObjectGrid` call site);
+  - the grid's bulk-delete bar, which rides the same object-level delete verdict,
+    so the row gate and the more destructive bulk entry move together;
+  - the non-grid (kanban / calendar / gallery) bulk bar `ListView` renders itself;
+  - the related-list Create/Edit/Delete on a child object
+    (`RelatedRecordActionsBridge`), which had the same object-only gate.
+
+  **This is a tightening of the intersection, not a swap.** Every existing layer
+  stays: the ADR-0103 lifecycle bucket, `userActions.edit` / `delete`, and
+  `apiOperations`. A permission grant cannot re-open what any of them closed, and
+  none of them survives a permission denial.
+
+  Fail-open is preserved where it is the deliberate contract: `usePermissions()`
+  with no `PermissionProvider` answers `can: () => true`, so standalone embeds and
+  hosts that ship no permission source keep their Edit/Delete exactly as before.
+  Under `MePermissionsProvider` the semantics are the toolbar's, unchanged and now
+  shared: an authenticated principal whose object is absent from
+  `/me/permissions.objects` resolves fail-closed (objectui#2926 ④), an anonymous
+  session keeps the permissive default, and children never render while the
+  permission set is loading. Per-key absence is still permissive — an object entry
+  without `allowEdit` reads as allowed.
+
+  Server-side enforcement was already hard (403, DB unchanged), so this closes a
+  UI-affordance gap rather than an authorization hole.
+
+- cb5e32d: `UserFilters` preset tab buttons no longer submit an enclosing form; all six buttons declare `type="button"`
+
+  An HTML `<button>` defaults to `type="submit"` inside a `<form>`, so a preset
+  filter tab (`filter-tab-*`, tabs mode) submitted the enclosing form on every
+  click. The three buttons objectstack#6952 named now declare `type="button"`
+  explicitly — the dropdown chip trigger (`filter-badge-*`), the overflow trigger
+  (`user-filters-more`) and the preset tab — joining the session-tab buttons that
+  objectstack#5236 already declared it on.
+
+  Only one of the three was actually at risk, and the difference is measured
+  rather than assumed. The chip and the overflow trigger are
+  `PopoverTrigger asChild` children, and Radix's `PopoverTrigger` renders
+  `Primitive.button type="button"`; its Slot merges that onto a child declaring no
+  `type` of its own, so both already rendered as `button`. Reverting the change
+  confirms it: those two keep reading `button`, the plain preset tab button reads
+  `null`. For the two triggers this therefore moves a contract out of an upstream
+  implementation detail and into local source — the same reasoning objectui#3344
+  wrote onto the Combobox trigger — while the preset tab is a real fix.
+
+  Dormant rather than live: the only mount point today is `ListView`'s toolbar,
+  which is not inside a form, so no shipped screen submitted anything. The new
+  tests pin every rendered `UserFilters` button, in both modes, so a future button
+  cannot land at the submit default and an upstream Radix change surfaces in this
+  package's tests instead of in a user's form.
+
+  The in-file comment claiming "a Radix trigger keeps the HTML default of `submit`"
+  is corrected in passing — it is the inaccuracy that propagated into
+  objectstack#6952's premise.
+
+- cf5be4e: `userFilters` tabs: the `allowAddTab` button now adds a tab instead of doing nothing (objectstack#5236)
+
+  The affordance `allowAddTab` renders had hover styling and `title="Add filter tab"` but no `onClick`, and `TabFilters` took no add-tab callback at all — a control that looked fully clickable and did nothing, which disguises "not implemented" as "a bug where clicking does nothing". That mattered more once objectstack#5073 promoted `allowAddTab` into the spec's `UserFiltersSchema`: the key became discoverable through JSON Schema, the Studio SchemaForm and the reference docs, so an author writing `allowAddTab: true` gets a declaration the runtime did not honour.
+
+  Clicking it now opens a small naming popover (the same Popover primitive the filter chips and the "More" overflow already use). Confirming a name adds a tab to the same bar as the presets, carrying a snapshot of the conditions applied at that moment, and selects it. Session tabs also carry a remove affordance; authored presets deliberately do not, since those are metadata. Removing the active session tab re-selects the author's default with the same precedence the initial mount uses, so the bar is never left with no active tab while the removed tab's conditions stay applied.
+
+  The new tab is **session-scoped, held in component state** — no `sys_metadata` write, no API call, no web storage, per ADR-0047 ("an end user's filter choices are session-scoped and never become metadata"). `sessionStorage` was available and deliberately not used: `UserFilters` receives no object or view identity, so any storage key it could invent would be shared by every list in the browser tab, surfacing one list's ad-hoc tabs on another's bar. Persistence beyond the mount, if ever wanted, belongs to the host that already owns the session channel for filter selections (`onSelectionsChange` mirrored into `uf_*` URL params) and can key it by view. The synthetic tab id is reported through `onSelectionsChange` like any other tab switch, so a host mirroring it into the URL hands it back on the next mount, where the existing id check finds no such tab and falls back to the author's default.
+
+  No public API change: `UserFiltersProps` is untouched, and `allowAddTab: false` / an omitted `allowAddTab` still render no affordance at all.
+
 ## 17.3.0
 
 ### Patch Changes
@@ -19,6 +181,7 @@
   stayed invisible.
 
   ## What changed
+
   - Both reads now share one `resolveCoverUrl`, so the "does anything have a
     cover?" predicate and the per-card render can no longer disagree — that
     disagreement is what collapsed the area for records that did have a cover.
@@ -1383,6 +1546,7 @@ colorField, scale }` arrived with only `titleField` and an axis pinned to the
   platform primitive for "no records / no data" states. Two new props
   keep it flexible enough to absorb the hand-rolled variants that lived
   in `plugin-list`, `plugin-kanban`, and `plugin-dashboard`:
+
   - `showIcon?: boolean` — drops the icon container entirely. Used by the
     kanban board-level empty banner, which is a status banner rather than
     a true empty-state.
@@ -1391,6 +1555,7 @@ colorField, scale }` arrived with only `titleField` and an axis pinned to the
     empty state, which uses a large standalone glyph).
 
   Adopters:
+
   - `plugin-list` (`ListView` grid empty-state) — preserves the existing
     large icon, title, message, add-record button and `data-testid`s,
     but delegates the structural markup to `DataEmptyState`.
@@ -1467,6 +1632,7 @@ colorField, scale }` arrived with only `titleField` and an axis pinned to the
   chrome on phones: title + 1 primary action, plus content. We were
   shipping ~5 rows of toolbars + chips + tabs above the data. This commit
   hides the desktop-only chrome at the `<sm` breakpoint:
+
   - **ListView**: TabBar (view switcher), UserFilters chip row, quick-filters
     chip row, Sort button, list-scoped Search popover, and the
     (newly-added) mobile-only ViewSettingsPopover gear are all hidden on
@@ -1488,6 +1654,7 @@ colorField, scale }` arrived with only `titleField` and an axis pinned to the
 
   Refactor mobile object-view layout to match the Airtable Interface
   pattern:
+
   - **AppHeader**: the mobile topbar's static page label is now a
     view-switcher dropdown (`<viewName> ▾`). Tapping opens a list of
     available views with icons + active-state checkmark. Falls back to
@@ -1618,6 +1785,7 @@ colorField, scale }` arrived with only `titleField` and an axis pinned to the
   Library builds (vite lib mode) now externalize every non-relative import instead of bundling third-party CJS dependencies into the published dist. This avoids inlined `require("react")` / `require("react-dom")` calls that cause `Calling \`require\` for "react" in an environment that doesn't expose the \`require\` function` runtime errors when consumer apps re-bundle the published dist.
 
   Specifically fixes:
+
   - `@object-ui/plugin-dashboard` no longer inlines `react-grid-layout` (and its transitive `react-draggable` / `react-resizable` CJS bundles). `react-grid-layout` is now declared as a peer dependency so consumers install a single ESM-friendly copy.
   - `@object-ui/components`, `@object-ui/plugin-calendar`, `@object-ui/plugin-charts`, `@object-ui/plugin-designer` no longer inline `react-i18next` / `i18next` / `use-sync-external-store` CJS shims.
   - All plugin packages now use a unified `external: (id) => !/^[./]/.test(id) && !id.startsWith(__dirname)` rule, ensuring future additions of CJS deps are automatically externalized.
diff --git a/packages/plugin-list/package.json b/packages/plugin-list/package.json
index 2e811765fd..d21556228c 100644
--- a/packages/plugin-list/package.json
+++ b/packages/plugin-list/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/plugin-list",
-  "version": "17.3.0",
+  "version": "17.4.0",
   "type": "module",
   "license": "MIT",
   "description": "ListView plugin for Object UI - unified view component with view type switching",
diff --git a/packages/plugin-map/CHANGELOG.md b/packages/plugin-map/CHANGELOG.md
index 796b66bc49..60a9daf511 100644
--- a/packages/plugin-map/CHANGELOG.md
+++ b/packages/plugin-map/CHANGELOG.md
@@ -1,5 +1,119 @@
 # @object-ui/plugin-map
 
+## 17.4.0
+
+### Patch Changes
+
+- 022002a: `PageComponentSchema.dataSource` now reaches the remaining object-bound public
+  blocks: `object-gantt` / `object-timeline` / `object-map` / `object-pivot` /
+  `object-master-detail-form` / `embeddable-form` / `record:line_items`
+  (objectstack#7121).
+
+  objectstack#6953 wired the spec's per-element data binding
+  (`dataSource: { object, view?, filter?, sort?, limit? }`) to the eight blocks it
+  named and left the same declaration inert on these seven. Each gates its fetch on
+  its own object key and nothing mapped `dataSource.object` onto it, so a page
+  written the way the spec documents rendered an empty gantt / an empty timeline
+  rail / a map with no markers / an empty cross-tab / a field-less form — with no
+  request and no diagnostic anywhere. Spec-valid metadata rendering nothing is the
+  objectstack#4413 shape.
+
+  Composition follows objectstack#5576's landed semantics unchanged, through the
+  shared `ElementDataSourceGate` (no change to it or to the resolution layer): a
+  named saved view supplies the baseline, a key written on the component itself
+  overrides it, an explicit binding key overrides both, `filter` AND-combines
+  ("additional filter criteria" — a binding can narrow a view, never widen it), and
+  a `view` name that does not resolve renders a configuration error on every one of
+  these blocks instead of degrading to the object's full scope.
+
+  Each block maps **only** the keys it genuinely reads, which for this batch means
+  several keys stay deliberately unmapped rather than being parked somewhere
+  plausible:
+
+  - `object-gantt` and `object-map` take `object` / `filter` / `sort`; neither has a
+    row cap or a field-list read site.
+  - `object-pivot` takes `object` / `filter`; a cross-tab orders itself by its own
+    row/column grouping and cannot be computed over a truncated page.
+  - `object-timeline` takes `object` only — its fetch is
+    `find(objectName, { options: { $top: 100 } })`, with no filter/sort read site
+    at all, so a named view is error-checked and then contributes nothing.
+  - `embeddable-form` and `object-master-detail-form` take `object` only (the
+    parent object, in the master-detail case); a form that writes one record has no
+    collection query for `filter` / `sort` / `limit` to narrow.
+  - `record:line_items` takes `object` onto **`childObject`** — the collection it
+    actually lists — and nothing else: its query is the parent FK plus a fixed
+    `$top: 500`, and its `columns` are editable `GridColumn` objects rather than a
+    field-name projection a view could supply.
+
+  The per-block coverage table, including every residual gap named above, is in
+  `content/docs/guide/data-source.md`.
+
+  No behaviour change for a block that carries no `dataSource`: the binding-free
+  path returns the schema by reference, so nothing remounts and nothing refetches.
+
+- 9ad21b6: `plugin-map` 加载时不再向控制台打印 `Registering object-map...`
+
+  `packages/plugin-map/src/index.tsx` 的注册调用之前留着一句调试输出
+  `console.log('Registering object-map...')`。它位于**模块作用域**,所以不是「渲染地图时打一行」,
+  而是**只要这个 plugin 被 import 就打一行**:console 应用的 `register-plugins` 一加载即触发,
+  单元测试里跟着刷,生产 bundle 同样保留 —— 使用者控制台里凭空多出一行来源不明的噪音。
+
+  同仓其余 18 个 plugin 的 `src/index.tsx` 注册处都没有这类输出,这一句是孤例
+  (`plugin-editor` 里唯一的 `console.log` 命中是 `defaultProps.value` 示例代码字符串,
+  不是会执行的语句)。纯噪音,不涉及任何行为:注册本身、`ObjectMap` 的渲染与取数都不读它。
+
+  顺带记一条搜索时确认的背景:仓库的 eslint 配置没有开 `no-console` 规则,所以这类遗留
+  调试输出没有任何自动化拦网 —— 这次是靠人工发现的。是否全仓开 `no-console`(以及
+  `ObjectMap.tsx` 里三处**有意**保留的 `console.warn`/`console.error` 诊断如何豁免)是一个
+  影响多个包的策略决定,已另行开单,不混进本 PR。
+
+  回潮钉在 `src/index.registration.test.tsx`:spy 掉 `console.log`/`info`/`debug` 后
+  `vi.resetModules()` 再 `import('./index')`,断言零输出。钉子刻意只覆盖这三个「噪音通道」,
+  不含 `warn`/`error` —— `ComponentRegistry.register()` 在缺 namespace、以及裸名 fallback
+  覆盖冲突时**按设计**会 `console.warn`(`packages/core/src/registry/Registry.ts`),
+  一刀切断言「零 console 输出」等于把 Registry 的诊断契约钉在这里,将来会因与「遗留调试输出」
+  无关的原因变红。钉子里还有一条非空断言:import 后校验 `object-map`/`map` 两个注册确实进了
+  registry,免得模块缓存导致 import 未真正执行、于是「没有输出」是因为**什么都没发生**而假绿。
+
+- Updated dependencies [794c497]
+- Updated dependencies [993336f]
+- Updated dependencies [f0a625a]
+- Updated dependencies [b5980f4]
+- Updated dependencies [8aad9fd]
+- Updated dependencies [6719877]
+- Updated dependencies [56ff091]
+- Updated dependencies [0cbdca8]
+- Updated dependencies [d229dfa]
+- Updated dependencies [ecae400]
+- Updated dependencies [4bc6c23]
+- Updated dependencies [d3e738a]
+- Updated dependencies [c3b01a7]
+- Updated dependencies [7ed3360]
+- Updated dependencies [0fa5e4d]
+- Updated dependencies [5bfaabd]
+- Updated dependencies [e06810e]
+- Updated dependencies [ab3ad4f]
+- Updated dependencies [c2fd122]
+- Updated dependencies [e24d767]
+- Updated dependencies [aca561a]
+- Updated dependencies [48132f7]
+- Updated dependencies [0ef9dfd]
+- Updated dependencies [1d723e3]
+- Updated dependencies [0109f54]
+- Updated dependencies [7e5bb5d]
+- Updated dependencies [fbc23e0]
+- Updated dependencies [e6fdbdc]
+- Updated dependencies [54233b1]
+- Updated dependencies [97b63d7]
+- Updated dependencies [6bb454a]
+- Updated dependencies [523be48]
+- Updated dependencies [7e2b7e9]
+- Updated dependencies [c1e1e6b]
+  - @object-ui/components@17.4.0
+  - @object-ui/react@17.4.0
+  - @object-ui/core@17.4.0
+  - @object-ui/types@17.4.0
+
 ## 17.3.0
 
 ### Patch Changes
@@ -1001,6 +1115,7 @@
   Library builds (vite lib mode) now externalize every non-relative import instead of bundling third-party CJS dependencies into the published dist. This avoids inlined `require("react")` / `require("react-dom")` calls that cause `Calling \`require\` for "react" in an environment that doesn't expose the \`require\` function` runtime errors when consumer apps re-bundle the published dist.
 
   Specifically fixes:
+
   - `@object-ui/plugin-dashboard` no longer inlines `react-grid-layout` (and its transitive `react-draggable` / `react-resizable` CJS bundles). `react-grid-layout` is now declared as a peer dependency so consumers install a single ESM-friendly copy.
   - `@object-ui/components`, `@object-ui/plugin-calendar`, `@object-ui/plugin-charts`, `@object-ui/plugin-designer` no longer inline `react-i18next` / `i18next` / `use-sync-external-store` CJS shims.
   - All plugin packages now use a unified `external: (id) => !/^[./]/.test(id) && !id.startsWith(__dirname)` rule, ensuring future additions of CJS deps are automatically externalized.
@@ -1055,11 +1170,13 @@
 - e93fe35: Mobile UX round 3 — Gantt and Map
 
   **@object-ui/plugin-gantt**
+
   - Added a sticky vertical "Today" marker on the timeline plus a one-tap **Jump to Today** toolbar button so on-call users can re-orient the view instantly on small screens.
   - Added a **collapsible task list** (toolbar toggle + auto-collapse on the first narrow render) so the timeline area gets the full viewport on phones.
   - Added **pinch-to-zoom** touch gestures on the timeline; wired `columnWidthOverride` state so the existing zoom buttons also respond (previously a no-op).
 
   **@object-ui/plugin-map**
+
   - Added a **geolocate button** with the standard `navigator.geolocation.getCurrentPosition` permission flow, an inline error banner, a busy state, and a **user-location marker** (blue dot) the map flies to on success.
   - **Cluster tap-through**: tapping a cluster now flies the map in (zoom + 2, capped at 20) instead of just sitting there.
   - On mobile, the desktop popup is replaced by a **bottom-sheet record card** with safe-area padding and an explicit close button. Desktop continues to use the popup.
diff --git a/packages/plugin-map/package.json b/packages/plugin-map/package.json
index f090b0e96d..0b575bd7e3 100644
--- a/packages/plugin-map/package.json
+++ b/packages/plugin-map/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/plugin-map",
-  "version": "17.3.0",
+  "version": "17.4.0",
   "type": "module",
   "license": "MIT",
   "description": "Map visualization plugin for Object UI",
diff --git a/packages/plugin-markdown/CHANGELOG.md b/packages/plugin-markdown/CHANGELOG.md
index 671ef2824c..ecec7d908e 100644
--- a/packages/plugin-markdown/CHANGELOG.md
+++ b/packages/plugin-markdown/CHANGELOG.md
@@ -1,5 +1,48 @@
 # @object-ui/plugin-markdown
 
+## 17.4.0
+
+### Patch Changes
+
+- Updated dependencies [794c497]
+- Updated dependencies [993336f]
+- Updated dependencies [f0a625a]
+- Updated dependencies [b5980f4]
+- Updated dependencies [8aad9fd]
+- Updated dependencies [6719877]
+- Updated dependencies [56ff091]
+- Updated dependencies [0cbdca8]
+- Updated dependencies [d229dfa]
+- Updated dependencies [ecae400]
+- Updated dependencies [4bc6c23]
+- Updated dependencies [d3e738a]
+- Updated dependencies [c3b01a7]
+- Updated dependencies [7ed3360]
+- Updated dependencies [0fa5e4d]
+- Updated dependencies [5bfaabd]
+- Updated dependencies [e06810e]
+- Updated dependencies [ab3ad4f]
+- Updated dependencies [c2fd122]
+- Updated dependencies [e24d767]
+- Updated dependencies [aca561a]
+- Updated dependencies [48132f7]
+- Updated dependencies [0ef9dfd]
+- Updated dependencies [1d723e3]
+- Updated dependencies [0109f54]
+- Updated dependencies [7e5bb5d]
+- Updated dependencies [fbc23e0]
+- Updated dependencies [e6fdbdc]
+- Updated dependencies [54233b1]
+- Updated dependencies [97b63d7]
+- Updated dependencies [6bb454a]
+- Updated dependencies [523be48]
+- Updated dependencies [7e2b7e9]
+- Updated dependencies [c1e1e6b]
+  - @object-ui/components@17.4.0
+  - @object-ui/react@17.4.0
+  - @object-ui/core@17.4.0
+  - @object-ui/types@17.4.0
+
 ## 17.3.0
 
 ### Patch Changes
@@ -947,6 +990,7 @@
   Library builds (vite lib mode) now externalize every non-relative import instead of bundling third-party CJS dependencies into the published dist. This avoids inlined `require("react")` / `require("react-dom")` calls that cause `Calling \`require\` for "react" in an environment that doesn't expose the \`require\` function` runtime errors when consumer apps re-bundle the published dist.
 
   Specifically fixes:
+
   - `@object-ui/plugin-dashboard` no longer inlines `react-grid-layout` (and its transitive `react-draggable` / `react-resizable` CJS bundles). `react-grid-layout` is now declared as a peer dependency so consumers install a single ESM-friendly copy.
   - `@object-ui/components`, `@object-ui/plugin-calendar`, `@object-ui/plugin-charts`, `@object-ui/plugin-designer` no longer inline `react-i18next` / `i18next` / `use-sync-external-store` CJS shims.
   - All plugin packages now use a unified `external: (id) => !/^[./]/.test(id) && !id.startsWith(__dirname)` rule, ensuring future additions of CJS deps are automatically externalized.
@@ -1175,6 +1219,7 @@
 - New plugin-object and ObjectQL SDK updates
 
   **Added:**
+
   - New Plugin: @object-ui/plugin-object - ObjectQL plugin for automatic table and form generation
     - ObjectTable: Auto-generates tables from ObjectQL object schemas
     - ObjectForm: Auto-generates forms from ObjectQL object schemas with create/edit/view modes
@@ -1183,6 +1228,7 @@
   - ObjectQL Integration: Enhanced ObjectQLDataSource with getObjectSchema() method using MetadataApiClient
 
   **Changed:**
+
   - Updated @objectql/sdk from ^1.8.3 to ^1.9.1
   - Updated @objectql/types from ^1.8.3 to ^1.9.1
 
@@ -1199,6 +1245,7 @@
 - Patch release: Add automated changeset workflow and CI/CD improvements
 
   This release includes infrastructure improvements:
+
   - Added changeset-based version management
   - Enhanced CI/CD workflows with GitHub Actions
   - Improved documentation for contributing and releasing
diff --git a/packages/plugin-markdown/package.json b/packages/plugin-markdown/package.json
index 01ebbbb318..dd8c3503ac 100644
--- a/packages/plugin-markdown/package.json
+++ b/packages/plugin-markdown/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/plugin-markdown",
-  "version": "17.3.0",
+  "version": "17.4.0",
   "type": "module",
   "license": "MIT",
   "description": "Markdown rendering plugin for Object UI, powered by react-markdown",
diff --git a/packages/plugin-report/CHANGELOG.md b/packages/plugin-report/CHANGELOG.md
index 106b453681..5367c1ed84 100644
--- a/packages/plugin-report/CHANGELOG.md
+++ b/packages/plugin-report/CHANGELOG.md
@@ -1,5 +1,90 @@
 # @object-ui/plugin-report
 
+## 17.4.0
+
+### Patch Changes
+
+- 3b1f888: Accept React 19 in `@object-ui/plugin-report`'s peer range, the last UI package still declaring React 18 alone (objectui#3690).
+
+  `peerDependencies.react` and `peerDependencies.react-dom` widen from `^18.0.0` to `^18.0.0 || ^19.0.0`, matching the other 29 packages in the fixed version group. With npm 7+ resolving peers strictly, a React 19 consumer installing this published package hit an `ERESOLVE` on first install while every sibling installed clean — and the package's own README already documented the wider range, so the manifest was the half that was wrong.
+
+  The narrow range was never a constraint anyone stated. `packages/plugin-report/package.json` was hand-authored on 2026-02-06 (`1e557cbda`), by which point nineteen sibling packages already carried `^18.0.0 || ^19.0.0` and every package created afterwards was born with it; the one other package born narrow, `plugin-dashboard`, was corrected on 2026-05-08 (`d2b6ecec6`) in a build fix that touched only itself. No commit in the file's 172-commit history ever revisited the peer line, and no commit message mentions a React 18 requirement.
+
+  Nothing in the package needs React 18. Its entire React surface is `React.FC`, `useState`, `useEffect`, `useMemo`, `useReducer`, `useContext`, `Fragment`, `ComponentType`, `CSSProperties` and `ReactNode` — all unchanged in React 19 — with zero uses of anything React 19 removed (`ReactDOM.render`, `unmountComponentAtNode`, `findDOMNode`, legacy context, string refs, `defaultProps` / `propTypes` on function components, `createFactory`, `useFormState`, `react-dom/test-utils`). `react-dom` is not imported by the source at all; it appears only as a UMD global name in the Vite externals config. The workspace pins `react` to 19.2.8 via a root `pnpm.overrides`, so this package's 78 tests have been running against React 19 the whole time it declared it did not support it.
+
+- Updated dependencies [794c497]
+- Updated dependencies [993336f]
+- Updated dependencies [f0a625a]
+- Updated dependencies [b5980f4]
+- Updated dependencies [8aad9fd]
+- Updated dependencies [6719877]
+- Updated dependencies [56ff091]
+- Updated dependencies [0186cdc]
+- Updated dependencies [7864f03]
+- Updated dependencies [ea41a59]
+- Updated dependencies [0cbdca8]
+- Updated dependencies [d229dfa]
+- Updated dependencies [18c42c6]
+- Updated dependencies [ecae400]
+- Updated dependencies [4bc6c23]
+- Updated dependencies [d3e738a]
+- Updated dependencies [c3b01a7]
+- Updated dependencies [f5f8744]
+- Updated dependencies [7ed3360]
+- Updated dependencies [69becd2]
+- Updated dependencies [5e52495]
+- Updated dependencies [0fa5e4d]
+- Updated dependencies [b750823]
+- Updated dependencies [5bfaabd]
+- Updated dependencies [e06810e]
+- Updated dependencies [ab3ad4f]
+- Updated dependencies [65bb513]
+- Updated dependencies [c97a45e]
+- Updated dependencies [b19162d]
+- Updated dependencies [c2fd122]
+- Updated dependencies [1bd6faa]
+- Updated dependencies [9154d9e]
+- Updated dependencies [ac2139c]
+- Updated dependencies [b14ab3a]
+- Updated dependencies [e24d767]
+- Updated dependencies [8c60819]
+- Updated dependencies [aca561a]
+- Updated dependencies [e64a52e]
+- Updated dependencies [844d17f]
+- Updated dependencies [d8a0be4]
+- Updated dependencies [48132f7]
+- Updated dependencies [4dcd52a]
+- Updated dependencies [42ae5c6]
+- Updated dependencies [0ef9dfd]
+- Updated dependencies [f4b97c8]
+- Updated dependencies [1d723e3]
+- Updated dependencies [0109f54]
+- Updated dependencies [7e5bb5d]
+- Updated dependencies [fbc23e0]
+- Updated dependencies [6d762da]
+- Updated dependencies [e6fdbdc]
+- Updated dependencies [54233b1]
+- Updated dependencies [c2ecbae]
+- Updated dependencies [f9faa7d]
+- Updated dependencies [97b63d7]
+- Updated dependencies [14c59c0]
+- Updated dependencies [aeb8424]
+- Updated dependencies [6bb454a]
+- Updated dependencies [1a33b1a]
+- Updated dependencies [11c1e71]
+- Updated dependencies [523be48]
+- Updated dependencies [7e2b7e9]
+- Updated dependencies [33526fd]
+- Updated dependencies [32413ec]
+- Updated dependencies [c1e1e6b]
+  - @object-ui/components@17.4.0
+  - @object-ui/react@17.4.0
+  - @object-ui/core@17.4.0
+  - @object-ui/fields@17.4.0
+  - @object-ui/i18n@17.4.0
+  - @object-ui/types@17.4.0
+  - @object-ui/plugin-grid@17.4.0
+
 ## 17.3.0
 
 ### Patch Changes
@@ -1425,6 +1510,7 @@
   The matrix/summary "Group by" (rows) and "Columns axis" (cols) sections now
   share the same searchable popup picker as the columns section, with a
   commit-on-select single-pick mode wired through `FieldPickerDialog`.
+
   - Per-row field buttons display the human-readable field label and open a
     dialog scoped to swap that single field (already-used fields filtered out)
   - "Add grouping" trigger uses the same dialog
@@ -1434,6 +1520,7 @@
   - Bigger row spacing (h-7 / text-xs) — the old `text-[10px]` was unreadable
 
   `FieldPickerDialog` gains:
+
   - `commitOnSelect`: hides the Confirm/Cancel footer; clicking a row commits
     - closes immediately (intended for `singleSelect` flows)
   - `trigger`: custom trigger element override (used by the per-row field button)
@@ -1483,6 +1570,7 @@
   in the spec.
 
   New exports from `@object-ui/plugin-report`:
+
   - `JoinedBlocksEditor` — standalone component for embedding the
     block editor anywhere.
   - `validateJoinedBlocks` — pure helper returning translated
@@ -1513,6 +1601,7 @@
   The report configuration panel is now safe to open on any spec-shape `Report` and only exposes fields that are actually persisted by `@objectstack/spec`.
 
   `@object-ui/plugin-report`:
+
   - Add a bidirectional `SpecFilterAdapter` so `ReportConfigPanel` can edit
     spec `FilterCondition` filters (`{field: value}`, `{field: {$op: value}}`,
     top-level `$and`/`$or`). Complex / nested filters fall back to a
@@ -1534,12 +1623,14 @@
   - 18 new unit tests cover the filter adapter round-trip.
 
   `@object-ui/components`:
+
   - `FilterBuilder` now guards against malformed external `value` props.
     Previously a spec-shape filter (`{is_active: true}`) would crash the
     component on first render; the builder now falls back to an empty
     AND group whenever `value` is not a valid `FilterGroup`.
 
   `@object-ui/i18n`:
+
   - Add `report.editor.*` strings to `en` and `zh`.
 
 - 8442c05: Improve report editor panel usability based on real-user browser testing:
@@ -1600,6 +1691,7 @@
 
 - 650392e: MatrixRenderer now displays i18n-translated labels for picklist (`select` / `status`) groupings instead of raw values (e.g. `Best Case` / `Commit` / `Pipeline` instead of `best_case` / `commit` / `pipeline`). Field labels in the corner cell, row/column total labels, and the `(Empty)` / `(All)` placeholders are also fully translated. Adds `report.*` keys to `en` and `zh` locale bundles.
 - 26f5fce: Simplify report identity: replace the dashboard-style KPI grid with a compact "Totals" strip so reports look like reports (table-first with a grand total), not like mini-dashboards.
+
   - `SpecReportGrid` now renders one inline `Totals: Label1: value Label2: value …` strip above the chart and table, styled as a muted single-line band — clearly subordinate to the data grid below.
   - The Totals strip is now also shown for `tabular` reports when they declare aggregating columns (matches Salesforce's "Grand Total" convention).
   - Drop the duplicate chart title `<div>`: the chart component already renders its own title from `report.chart.title`.
@@ -1627,6 +1719,7 @@
 ### Minor Changes
 
 - b4ce9e2: Fix summary reports: render chart + KPIs, correct empty-table on server-aggregated data.
+
   - `plugin-report`: `SpecReportGrid` now renders a KPI strip (per aggregating column) and a chart section above the grid for `summary` reports. KPI section auto-hides when no aggregating columns. New `buildChartData()` adapter buckets aggregated `ReportRow[]` to chart-ready data, auto-sorts pie/funnel descending, and falls back to row count when the chart `yAxis` points at a non-numeric column. When the data is server-aggregated, the grid switches columns to `[groupings, ${field}__${agg}]` so cells aren't empty against a raw-row column schema.
   - `plugin-charts`: register `'column'` as an alias of `'bar'` in `ChartRenderer` / `AdvancedChartImpl` (Recharts only has `BarChart`).
   - `app-shell`: `ReportView` now routes any object-backed report (matrix/joined/summary/tabular/columns/groupingsAcross) through the spec `ReportRenderer`; fully-legacy `fields`+`data` schemas still use `ReportViewer`.
@@ -1770,6 +1863,7 @@
   Library builds (vite lib mode) now externalize every non-relative import instead of bundling third-party CJS dependencies into the published dist. This avoids inlined `require("react")` / `require("react-dom")` calls that cause `Calling \`require\` for "react" in an environment that doesn't expose the \`require\` function` runtime errors when consumer apps re-bundle the published dist.
 
   Specifically fixes:
+
   - `@object-ui/plugin-dashboard` no longer inlines `react-grid-layout` (and its transitive `react-draggable` / `react-resizable` CJS bundles). `react-grid-layout` is now declared as a peer dependency so consumers install a single ESM-friendly copy.
   - `@object-ui/components`, `@object-ui/plugin-calendar`, `@object-ui/plugin-charts`, `@object-ui/plugin-designer` no longer inline `react-i18next` / `i18next` / `use-sync-external-store` CJS shims.
   - All plugin packages now use a unified `external: (id) => !/^[./]/.test(id) && !id.startsWith(__dirname)` rule, ensuring future additions of CJS deps are automatically externalized.
diff --git a/packages/plugin-report/package.json b/packages/plugin-report/package.json
index aff4b63bda..6158f6e033 100644
--- a/packages/plugin-report/package.json
+++ b/packages/plugin-report/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/plugin-report",
-  "version": "17.3.0",
+  "version": "17.4.0",
   "type": "module",
   "main": "dist/index.umd.cjs",
   "module": "dist/index.js",
diff --git a/packages/plugin-timeline/CHANGELOG.md b/packages/plugin-timeline/CHANGELOG.md
index d98e9edb3d..c19bd426e0 100644
--- a/packages/plugin-timeline/CHANGELOG.md
+++ b/packages/plugin-timeline/CHANGELOG.md
@@ -1,5 +1,165 @@
 # @object-ui/plugin-timeline
 
+## 17.4.0
+
+### Patch Changes
+
+- 022002a: `PageComponentSchema.dataSource` now reaches the remaining object-bound public
+  blocks: `object-gantt` / `object-timeline` / `object-map` / `object-pivot` /
+  `object-master-detail-form` / `embeddable-form` / `record:line_items`
+  (objectstack#7121).
+
+  objectstack#6953 wired the spec's per-element data binding
+  (`dataSource: { object, view?, filter?, sort?, limit? }`) to the eight blocks it
+  named and left the same declaration inert on these seven. Each gates its fetch on
+  its own object key and nothing mapped `dataSource.object` onto it, so a page
+  written the way the spec documents rendered an empty gantt / an empty timeline
+  rail / a map with no markers / an empty cross-tab / a field-less form — with no
+  request and no diagnostic anywhere. Spec-valid metadata rendering nothing is the
+  objectstack#4413 shape.
+
+  Composition follows objectstack#5576's landed semantics unchanged, through the
+  shared `ElementDataSourceGate` (no change to it or to the resolution layer): a
+  named saved view supplies the baseline, a key written on the component itself
+  overrides it, an explicit binding key overrides both, `filter` AND-combines
+  ("additional filter criteria" — a binding can narrow a view, never widen it), and
+  a `view` name that does not resolve renders a configuration error on every one of
+  these blocks instead of degrading to the object's full scope.
+
+  Each block maps **only** the keys it genuinely reads, which for this batch means
+  several keys stay deliberately unmapped rather than being parked somewhere
+  plausible:
+
+  - `object-gantt` and `object-map` take `object` / `filter` / `sort`; neither has a
+    row cap or a field-list read site.
+  - `object-pivot` takes `object` / `filter`; a cross-tab orders itself by its own
+    row/column grouping and cannot be computed over a truncated page.
+  - `object-timeline` takes `object` only — its fetch is
+    `find(objectName, { options: { $top: 100 } })`, with no filter/sort read site
+    at all, so a named view is error-checked and then contributes nothing.
+  - `embeddable-form` and `object-master-detail-form` take `object` only (the
+    parent object, in the master-detail case); a form that writes one record has no
+    collection query for `filter` / `sort` / `limit` to narrow.
+  - `record:line_items` takes `object` onto **`childObject`** — the collection it
+    actually lists — and nothing else: its query is the parent FK plus a fixed
+    `$top: 500`, and its `columns` are editable `GridColumn` objects rather than a
+    field-name projection a view could supply.
+
+  The per-block coverage table, including every residual gap named above, is in
+  `content/docs/guide/data-source.md`.
+
+  No behaviour change for a block that carries no `dataSource`: the binding-free
+  path returns the schema by reference, so nothing remounts and nothing refetches.
+
+- 523be48: `object-timeline` and `record:line_items` now apply the filter / sort / row cap they are given, so a named `dataSource.view` narrows them instead of contributing nothing
+
+  These were the two residual gaps in objectstack#7121's per-block coverage table
+  (objectstack#7137). Both blocks are object-bound lists, both accepted the spec's
+  per-element `dataSource` binding, and neither had a read site for `filter` or
+  `sort` anywhere in its fetch:
+
+  - `object-timeline`'s entire query was
+    `find(objectName, { options: { $top: 100 } })`.
+  - `record:line_items`' was the parent FK plus a fixed `$top: 500`.
+
+  So `dataSource: { object, view: 'hot' }` resolved the view — a typo still reported
+  a configuration error, it never degraded into an unfiltered query — and then
+  dropped everything the view said. The rendered rows could be **wider than the view
+  they named**, silently, which is exactly the class of mistake AI-authored metadata
+  hides best: the page looks like it works. objectstack#7121 deliberately left the
+  keys unmapped and recorded the gap rather than writing composed values onto schema
+  keys nobody read; this closes it at the fetch instead.
+
+  What each block now reads:
+
+  - **`object-timeline`** — `$filter: schema.filter`,
+    `$orderby: convertSortToQueryParams(schema.sort)`, and
+    `$top: schema.limit ?? 100`, matching the form `object-gantt` / `object-map` /
+    `object-calendar` already use. Its registry mapping gains
+    `filter` / `sort` / `limit`; `columns` stays unmapped, because a timeline
+    projects the fields its `timeline` config names.
+  - **`record:line_items`** — the composed filter is **AND-combined** with the parent
+    relationship condition through `mergeFilterNodes`, never substituted for it, the
+    same way `record:related_list` composes its own since objectstack#7118: a
+    line-items panel is always scoped to the record it sits on, so an _additional_
+    criterion can only narrow this parent's children and can never surface another
+    parent's rows. `sort` becomes the load order and `limit` the row cap (default
+    500). `columns` stays unmapped — here they are `GridColumn[]` driving an editable
+    grid, not a field-name projection, so a view's column list would be the wrong
+    _shape_ rather than merely a wider answer.
+
+  **Behaviour change worth knowing about:** the timeline's default window is now a
+  real cap. `{ options: { $top: 100 } }` nested the limit under a key that is not a
+  `QueryParams` field and that no adapter in this repo reads (`convertQueryParams`
+  maps `params.$top`), so the intended window never reached the wire and a timeline
+  over a large object fetched whatever the server chose to return. It is now sent as
+  `$top`, and authorable via `limit` or a view's `pagination.pageSize`.
+
+  `@object-ui/core` gains `convertSortToQueryParams`, the sort→`$orderby` lowering
+  the three sibling blocks each inline privately. It is shared rather than copied
+  twice more, and is slightly more faithful to the declared contract than those
+  copies: a sort entry that omits `order` means ascending instead of being dropped
+  (the string spelling `"amount"` already meant ascending in the same copies), and
+  nothing orderable yields `undefined` rather than a truthy empty `{}`. Migrating
+  the three existing copies onto it is objectstack#7148 and is not done here.
+
+- Updated dependencies [794c497]
+- Updated dependencies [993336f]
+- Updated dependencies [f0a625a]
+- Updated dependencies [b5980f4]
+- Updated dependencies [8aad9fd]
+- Updated dependencies [6719877]
+- Updated dependencies [56ff091]
+- Updated dependencies [7864f03]
+- Updated dependencies [0cbdca8]
+- Updated dependencies [d229dfa]
+- Updated dependencies [ecae400]
+- Updated dependencies [4bc6c23]
+- Updated dependencies [d3e738a]
+- Updated dependencies [c3b01a7]
+- Updated dependencies [f5f8744]
+- Updated dependencies [7ed3360]
+- Updated dependencies [69becd2]
+- Updated dependencies [5e52495]
+- Updated dependencies [0fa5e4d]
+- Updated dependencies [b750823]
+- Updated dependencies [5bfaabd]
+- Updated dependencies [e06810e]
+- Updated dependencies [ab3ad4f]
+- Updated dependencies [c2fd122]
+- Updated dependencies [ac2139c]
+- Updated dependencies [b14ab3a]
+- Updated dependencies [e24d767]
+- Updated dependencies [8c60819]
+- Updated dependencies [aca561a]
+- Updated dependencies [e64a52e]
+- Updated dependencies [844d17f]
+- Updated dependencies [48132f7]
+- Updated dependencies [4dcd52a]
+- Updated dependencies [42ae5c6]
+- Updated dependencies [0ef9dfd]
+- Updated dependencies [1d723e3]
+- Updated dependencies [0109f54]
+- Updated dependencies [7e5bb5d]
+- Updated dependencies [fbc23e0]
+- Updated dependencies [6d762da]
+- Updated dependencies [e6fdbdc]
+- Updated dependencies [54233b1]
+- Updated dependencies [f9faa7d]
+- Updated dependencies [97b63d7]
+- Updated dependencies [6bb454a]
+- Updated dependencies [523be48]
+- Updated dependencies [7e2b7e9]
+- Updated dependencies [33526fd]
+- Updated dependencies [32413ec]
+- Updated dependencies [c1e1e6b]
+  - @object-ui/components@17.4.0
+  - @object-ui/react@17.4.0
+  - @object-ui/core@17.4.0
+  - @object-ui/i18n@17.4.0
+  - @object-ui/types@17.4.0
+  - @object-ui/mobile@17.4.0
+
 ## 17.3.0
 
 ### Patch Changes
@@ -1078,6 +1238,7 @@
 ### Patch Changes
 
 - 1b6dc64: fix: complete Tailwind v3→v4 migration cleanup
+
   - Rename deprecated `flex-shrink-0` → `shrink-0` and `flex-grow-N` →
     `grow-N` (Tailwind v4 dropped the long-form aliases). Affects
     data-table, fields/index, FileField, ChatbotEnhanced,
@@ -1140,6 +1301,7 @@
   Library builds (vite lib mode) now externalize every non-relative import instead of bundling third-party CJS dependencies into the published dist. This avoids inlined `require("react")` / `require("react-dom")` calls that cause `Calling \`require\` for "react" in an environment that doesn't expose the \`require\` function` runtime errors when consumer apps re-bundle the published dist.
 
   Specifically fixes:
+
   - `@object-ui/plugin-dashboard` no longer inlines `react-grid-layout` (and its transitive `react-draggable` / `react-resizable` CJS bundles). `react-grid-layout` is now declared as a peer dependency so consumers install a single ESM-friendly copy.
   - `@object-ui/components`, `@object-ui/plugin-calendar`, `@object-ui/plugin-charts`, `@object-ui/plugin-designer` no longer inline `react-i18next` / `i18next` / `use-sync-external-store` CJS shims.
   - All plugin packages now use a unified `external: (id) => !/^[./]/.test(id) && !id.startsWith(__dirname)` rule, ensuring future additions of CJS deps are automatically externalized.
@@ -1198,15 +1360,18 @@
 - b2be122: fix(mobile): round 2 — kanban readability, calendar default view, timeline dot clipping
 
   **Kanban**
+
   - Remove `font-mono` from card titles, descriptions, column headers, and empty-state labels — CRM cards no longer render in a monospace font.
   - Constrain column body height (`max-h-full min-h-0` + `h-full` on the layout root) so `ScrollArea` activates and cards don't bleed past the viewport bottom.
   - Opportunistically derive `description` (e.g. `$60K · Acme Corp · @owner`) and up to two `badges` (priority/severity/industry/rating) in `ObjectKanban` when the schema/source omits them, giving mobile cards more context at a glance.
 
   **Calendar**
+
   - `ObjectCalendar` previously hardcoded `view={schema.defaultView ?? 'month'}`, making the view-selector dropdown a no-op. Wire the `view` state through to the `<Calendar>` prop so user selection is respected.
   - On mobile (viewport < 768 px) coerce `day` defaults to `month` via a synchronous lazy initialiser and a resize/orientation effect — avoids the useless 24-hour empty-hour grid for date-only events.
 
   **Timeline**
+
   - Add `ml-3` to the `<Timeline>` `<ol>` so the `absolute -left-3` marker dots are no longer clipped at the scroll-container edge.
 
 - Updated dependencies [a2d7023]
diff --git a/packages/plugin-timeline/package.json b/packages/plugin-timeline/package.json
index 90cb0ece43..8e0fe5e8a5 100644
--- a/packages/plugin-timeline/package.json
+++ b/packages/plugin-timeline/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/plugin-timeline",
-  "version": "17.3.0",
+  "version": "17.4.0",
   "type": "module",
   "license": "MIT",
   "description": "Timeline component plugin for Object UI",
diff --git a/packages/plugin-tree/CHANGELOG.md b/packages/plugin-tree/CHANGELOG.md
index 051e15d4c8..14013bbe6a 100644
--- a/packages/plugin-tree/CHANGELOG.md
+++ b/packages/plugin-tree/CHANGELOG.md
@@ -1,5 +1,65 @@
 # @object-ui/plugin-tree
 
+## 17.4.0
+
+### Patch Changes
+
+- Updated dependencies [794c497]
+- Updated dependencies [993336f]
+- Updated dependencies [f0a625a]
+- Updated dependencies [b5980f4]
+- Updated dependencies [8aad9fd]
+- Updated dependencies [6719877]
+- Updated dependencies [56ff091]
+- Updated dependencies [7864f03]
+- Updated dependencies [0cbdca8]
+- Updated dependencies [d229dfa]
+- Updated dependencies [ecae400]
+- Updated dependencies [4bc6c23]
+- Updated dependencies [d3e738a]
+- Updated dependencies [c3b01a7]
+- Updated dependencies [f5f8744]
+- Updated dependencies [7ed3360]
+- Updated dependencies [69becd2]
+- Updated dependencies [5e52495]
+- Updated dependencies [0fa5e4d]
+- Updated dependencies [b750823]
+- Updated dependencies [5bfaabd]
+- Updated dependencies [e06810e]
+- Updated dependencies [ab3ad4f]
+- Updated dependencies [c2fd122]
+- Updated dependencies [ac2139c]
+- Updated dependencies [b14ab3a]
+- Updated dependencies [e24d767]
+- Updated dependencies [8c60819]
+- Updated dependencies [aca561a]
+- Updated dependencies [e64a52e]
+- Updated dependencies [844d17f]
+- Updated dependencies [48132f7]
+- Updated dependencies [4dcd52a]
+- Updated dependencies [42ae5c6]
+- Updated dependencies [0ef9dfd]
+- Updated dependencies [1d723e3]
+- Updated dependencies [0109f54]
+- Updated dependencies [7e5bb5d]
+- Updated dependencies [fbc23e0]
+- Updated dependencies [6d762da]
+- Updated dependencies [e6fdbdc]
+- Updated dependencies [54233b1]
+- Updated dependencies [f9faa7d]
+- Updated dependencies [97b63d7]
+- Updated dependencies [6bb454a]
+- Updated dependencies [523be48]
+- Updated dependencies [7e2b7e9]
+- Updated dependencies [33526fd]
+- Updated dependencies [32413ec]
+- Updated dependencies [c1e1e6b]
+  - @object-ui/components@17.4.0
+  - @object-ui/react@17.4.0
+  - @object-ui/core@17.4.0
+  - @object-ui/i18n@17.4.0
+  - @object-ui/types@17.4.0
+
 ## 17.3.0
 
 ### Patch Changes
diff --git a/packages/plugin-tree/package.json b/packages/plugin-tree/package.json
index 324e5fb702..eacd49c26a 100644
--- a/packages/plugin-tree/package.json
+++ b/packages/plugin-tree/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/plugin-tree",
-  "version": "17.3.0",
+  "version": "17.4.0",
   "type": "module",
   "license": "MIT",
   "description": "Tree / tree-grid visualization plugin for Object UI",
diff --git a/packages/plugin-view/CHANGELOG.md b/packages/plugin-view/CHANGELOG.md
index 86a2fddab3..3e1740baa8 100644
--- a/packages/plugin-view/CHANGELOG.md
+++ b/packages/plugin-view/CHANGELOG.md
@@ -1,5 +1,77 @@
 # @object-ui/plugin-view
 
+## 17.4.0
+
+### Patch Changes
+
+- Updated dependencies [794c497]
+- Updated dependencies [993336f]
+- Updated dependencies [f0a625a]
+- Updated dependencies [b5980f4]
+- Updated dependencies [8aad9fd]
+- Updated dependencies [6719877]
+- Updated dependencies [56ff091]
+- Updated dependencies [7864f03]
+- Updated dependencies [0cbdca8]
+- Updated dependencies [d229dfa]
+- Updated dependencies [18c42c6]
+- Updated dependencies [ecae400]
+- Updated dependencies [4bc6c23]
+- Updated dependencies [d3e738a]
+- Updated dependencies [c3b01a7]
+- Updated dependencies [f5f8744]
+- Updated dependencies [8497579]
+- Updated dependencies [f0c9a90]
+- Updated dependencies [7ed3360]
+- Updated dependencies [69becd2]
+- Updated dependencies [5e52495]
+- Updated dependencies [0fa5e4d]
+- Updated dependencies [b750823]
+- Updated dependencies [5bfaabd]
+- Updated dependencies [022002a]
+- Updated dependencies [e06810e]
+- Updated dependencies [ab3ad4f]
+- Updated dependencies [c2fd122]
+- Updated dependencies [1bd6faa]
+- Updated dependencies [9154d9e]
+- Updated dependencies [ac2139c]
+- Updated dependencies [b14ab3a]
+- Updated dependencies [e24d767]
+- Updated dependencies [8c60819]
+- Updated dependencies [aca561a]
+- Updated dependencies [e64a52e]
+- Updated dependencies [844d17f]
+- Updated dependencies [48132f7]
+- Updated dependencies [4dcd52a]
+- Updated dependencies [42ae5c6]
+- Updated dependencies [0ef9dfd]
+- Updated dependencies [1d723e3]
+- Updated dependencies [0109f54]
+- Updated dependencies [7e5bb5d]
+- Updated dependencies [fbc23e0]
+- Updated dependencies [6d762da]
+- Updated dependencies [e6fdbdc]
+- Updated dependencies [54233b1]
+- Updated dependencies [f9faa7d]
+- Updated dependencies [97b63d7]
+- Updated dependencies [14c59c0]
+- Updated dependencies [aeb8424]
+- Updated dependencies [6bb454a]
+- Updated dependencies [1a33b1a]
+- Updated dependencies [11c1e71]
+- Updated dependencies [523be48]
+- Updated dependencies [7e2b7e9]
+- Updated dependencies [33526fd]
+- Updated dependencies [32413ec]
+- Updated dependencies [c1e1e6b]
+  - @object-ui/components@17.4.0
+  - @object-ui/react@17.4.0
+  - @object-ui/core@17.4.0
+  - @object-ui/i18n@17.4.0
+  - @object-ui/types@17.4.0
+  - @object-ui/plugin-grid@17.4.0
+  - @object-ui/plugin-form@17.4.0
+
 ## 17.3.0
 
 ### Patch Changes
@@ -1872,6 +1944,7 @@ colorField, scale }` arrived with only `titleField` and an axis pinned to the
   Library builds (vite lib mode) now externalize every non-relative import instead of bundling third-party CJS dependencies into the published dist. This avoids inlined `require("react")` / `require("react-dom")` calls that cause `Calling \`require\` for "react" in an environment that doesn't expose the \`require\` function` runtime errors when consumer apps re-bundle the published dist.
 
   Specifically fixes:
+
   - `@object-ui/plugin-dashboard` no longer inlines `react-grid-layout` (and its transitive `react-draggable` / `react-resizable` CJS bundles). `react-grid-layout` is now declared as a peer dependency so consumers install a single ESM-friendly copy.
   - `@object-ui/components`, `@object-ui/plugin-calendar`, `@object-ui/plugin-charts`, `@object-ui/plugin-designer` no longer inline `react-i18next` / `i18next` / `use-sync-external-store` CJS shims.
   - All plugin packages now use a unified `external: (id) => !/^[./]/.test(id) && !id.startsWith(__dirname)` rule, ensuring future additions of CJS deps are automatically externalized.
diff --git a/packages/plugin-view/package.json b/packages/plugin-view/package.json
index 6d5e82d00c..c7095b4e3d 100644
--- a/packages/plugin-view/package.json
+++ b/packages/plugin-view/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/plugin-view",
-  "version": "17.3.0",
+  "version": "17.4.0",
   "type": "module",
   "license": "MIT",
   "description": "Object View plugin for Object UI",
diff --git a/packages/providers/CHANGELOG.md b/packages/providers/CHANGELOG.md
index 88dfaefa39..925ac91e27 100644
--- a/packages/providers/CHANGELOG.md
+++ b/packages/providers/CHANGELOG.md
@@ -1,5 +1,18 @@
 # @object-ui/providers — Changelog
 
+## 17.4.0
+
+### Patch Changes
+
+- Updated dependencies [d229dfa]
+- Updated dependencies [c2fd122]
+- Updated dependencies [48132f7]
+- Updated dependencies [7e5bb5d]
+- Updated dependencies [e6fdbdc]
+- Updated dependencies [7e2b7e9]
+- Updated dependencies [c1e1e6b]
+  - @object-ui/types@17.4.0
+
 ## 17.3.0
 
 ### Patch Changes
@@ -598,24 +611,29 @@
 - a2d7023: End-user feature batch — forms, designer history, import/export, and PWA offline sync.
 
   **Forms (`@object-ui/fields`, `@object-ui/providers`)**
+
   - `FileField`: native `<input capture="environment">` camera capture for mobile devices, plus a uploading-progress indicator driven by `UploadProvider`.
   - `ImageField`: per-image inline crop/rotate via the lazy-loaded `ImageCropperDialog` (canvas-based, zero new deps).
   - New `UploadProvider` in `@object-ui/providers` with pluggable adapters for S3 and Azure Blob (plus the default object-URL adapter for local previews). XHR-based with progress, abort, and retry.
   - `LookupField`: `lookup.dependsOn: string | string[]` to chain dependent lookups (e.g. State depends on Country); the trigger is gated until parent values are present and the OData `$filter` is built automatically.
 
   **Container-aware widget widths (`@object-ui/components`)**
+
   - New `useResizeObserver(ref)` hook exposing `{ width, height }` of any element. SSR-safe; reads the initial size via `getBoundingClientRect`.
   - `plugin-gantt` and `plugin-kanban` now react to their container size instead of `window.innerWidth`, so they behave correctly inside split panels and dashboards.
 
   **Designer history (`@object-ui/plugin-designer`)**
+
   - `useUndoRedo` (and therefore `useDesignerHistory`) gains `persistKey` + `storage` options to round-trip the undo/redo stack through `sessionStorage`, plus a `clearPersisted()` cleanup helper. Drafts now survive accidental tab refreshes.
   - New `<HistoryPanel>` component renders the timeline visually with one-click jump-to-checkpoint via the new `jumpTo(index)` API.
 
   **Import wizard (`@object-ui/plugin-grid`)**
+
   - Saved column-mapping templates: name, save, re-apply, and delete via a new template bar in the mapping step. Persisted under `objectui:import-templates:${objectName}` (override via `templateStorageKey` / `templateStorage`).
   - Inline validation correction: cells with errors in the preview step are now editable; corrections feed straight into the import without requiring a re-upload, with green-bar status indicators for fixed rows.
 
   **PWA offline sync (`@object-ui/mobile`)**
+
   - New `MemoryOfflineQueue` / `IndexedDbOfflineQueue` (`createOfflineQueue()` picks the best backend) backed by IndexedDB.
   - `createOfflineDataSource(inner, { queue })` wraps any DataSource so mutations issued while offline (or that fail with a network-style error) are queued and replayed in order on reconnect. Includes `replay()`, `drop()`, `clear()`, `pending()`, an `onChange` notifier, and an opt-in `resolveConflict` hook for stale-write conflicts.
   - New `useOfflineSync(source)` hook exposes `{ isOnline, pending, isReplaying, replay, drop, clear }` and auto-replays on the browser's `online` event.
diff --git a/packages/providers/package.json b/packages/providers/package.json
index 76a2c48d47..1ea4937ed7 100644
--- a/packages/providers/package.json
+++ b/packages/providers/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/providers",
-  "version": "17.3.0",
+  "version": "17.4.0",
   "type": "module",
   "license": "MIT",
   "description": "Reusable context providers for ObjectUI applications",
diff --git a/packages/react-runtime/CHANGELOG.md b/packages/react-runtime/CHANGELOG.md
index 403cd27fa3..640eee7168 100644
--- a/packages/react-runtime/CHANGELOG.md
+++ b/packages/react-runtime/CHANGELOG.md
@@ -1,5 +1,19 @@
 # @object-ui/react-runtime
 
+## 17.4.0
+
+### Patch Changes
+
+- d11996e: Give `@object-ui/react-runtime`'s React peer range an upper bound: `peerDependencies.react` narrows from `>=18` to `^18.0.0 || ^19.0.0`, the spelling the other 30 react peers in the fixed version group already declare (objectui#3741).
+
+  An unbounded range is a promise that grows on its own. `>=18` satisfies React 20 the day React 20 is published — a major this package has never been built against, let alone tested — and it makes that claim from an already-published manifest, with no commit and no review to point at. This package is the least appropriate place in the workspace for such a promise: it vendors react-runner and evaluates author-supplied JSX against the _host's_ React, so a host on an untested major does not fail at this package's boundary, it fails somewhere inside the page it rendered.
+
+  Nothing in the package wanted the wider range. Its entire React surface is `Component`, `createElement`, `isValidElement`, `ReactElement` and `ReactNode`, all unchanged in React 19 and none of them touching anything React 19 removed. The range was never a stated constraint either: `>=18` was written when the package was created on 2026-06-30 (`d23d6ebfa`, PR #2105) and no commit since revisited the line. The workspace pins React to `19.2.8` through the root `pnpm.overrides`, so 19 is the only major this package's tests have ever exercised — the unbounded upper end was untested by construction.
+
+  The README sentence restating the range moves with it, and the doc gate that compares the two (`doc-version-claims.test.ts`, objectui#3717) keeps them in step from here.
+
+  A new pin, `scripts/__tests__/react-peer-range-norm-3741.test.ts`, now asserts the norm across every workspace manifest, because this was the third package born off-norm and the first two were each corrected in isolation: `plugin-dashboard` was born narrow and fixed on 2026-05-08 (`d2b6ecec6`), `plugin-report` was born narrow and fixed in objectui#3690 (PR #3727) after a React 19 consumer hit `ERESOLVE` on install, and this one was born unbounded. The existing doc gate could not have caught any of them — it checks a README against its own manifest, and react-runtime's two sides agreed with each other while both said `>=18`.
+
 ## 17.3.0
 
 ## 17.2.0
diff --git a/packages/react-runtime/package.json b/packages/react-runtime/package.json
index c9bab01ee5..48a786aa77 100644
--- a/packages/react-runtime/package.json
+++ b/packages/react-runtime/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/react-runtime",
-  "version": "17.3.0",
+  "version": "17.4.0",
   "type": "module",
   "sideEffects": false,
   "license": "MIT",
diff --git a/packages/react/CHANGELOG.md b/packages/react/CHANGELOG.md
index 51a81b4e16..71df3fc5f3 100644
--- a/packages/react/CHANGELOG.md
+++ b/packages/react/CHANGELOG.md
@@ -1,5 +1,438 @@
 # @object-ui/react
 
+## 17.4.0
+
+### Minor Changes
+
+- 5bfaabd: `PageComponentSchema.dataSource` now reaches every object-bound block, not just
+  `list-view` — and `element:record_picker` stops discarding `view`
+  (objectstack#6953).
+
+  objectstack#5576 wired the spec's per-element data binding
+  (`dataSource: { object, view?, filter?, sort?, limit? }`) to `list-view` and left
+  the same declaration inert on every other page component. Two gaps remained, and
+  both were silent:
+
+  - **`element:record_picker` read four of the five keys and dropped `view`.** So
+    `dataSource: { object: 'account', view: 'hot' }` — the spec's own example —
+    built a picker over EVERY account instead of the rows the saved view selects.
+    Nothing threw and nothing rendered an error; the option list was simply wider
+    than what was authored, which also means a user could select a record the page
+    said was out of scope.
+  - **`object-grid` / `object-form` / `object-kanban` / `object-calendar` /
+    `object-chart` / `object-metric` / `record:related_list` read none of it.**
+    Each gates its fetch on its own `objectName`, and nothing mapped
+    `dataSource.object` onto it, so a page written the way the spec documents
+    rendered an empty grid / a field-less form / a board with no cards / an empty
+    month / an empty chart / a static metric number — with no request and no
+    diagnostic anywhere. Spec-valid metadata rendering nothing is the
+    objectstack#4413 shape.
+
+  Composition follows objectstack#5576's landed semantics unchanged on every block:
+  a named saved view supplies the baseline, a key written on the component itself
+  overrides it, an explicit binding key overrides both, `filter` AND-combines
+  ("additional filter criteria" — a binding can narrow a view, never widen it), and
+  a `view` name that does not resolve renders a configuration error instead of
+  degrading to the object's full scope.
+
+  - `@object-ui/react` — new `useElementDataSourceSchema(schema, mapping, dataSource?)`
+    and `ElementDataSourceGate` apply a resolved binding to the schema keys a given
+    block reads, plus `ElementDataSourceErrorPanel` / `ElementDataSourceLoadingPanel`
+    for the two non-final states. One precedence table for all blocks rather than
+    one copy per block — that copy is how "additional filter criteria" would have
+    become two dialects.
+  - A mapping names **only** keys its block genuinely reads. A composed value
+    written onto a key the block ignores would be accepted and dropped, which is
+    the defect being removed, one layer deeper — so a kanban's swimlane `columns`
+    never receive a view's field list, and a block with no row cap leaves `limit`
+    unmapped. The per-block coverage table, including two residual gaps that are
+    named rather than papered over, is in `content/docs/guide/data-source.md`.
+
+  No behaviour changes for a block that carries no `dataSource`: the binding-free
+  path returns the schema by reference, so nothing remounts and nothing refetches.
+
+- 48132f7: Track the `@objectstack` family at `17.0.0-rc.5` (objectui#3560).
+
+  The pin moves from `^17.0.0-rc.2` to `^17.0.0-rc.5` across all 37 declarations in
+  30 `package.json` files, and the sibling `@objectstack/*` packages (`client` /
+  `formula` / `lint`) move with it — they pin `@objectstack/spec` **exactly**, so
+  leaving them behind would keep a second copy of the spec in the tree and have
+  `@objectstack/lint` validating against schemas that still accept the keys rc.3–rc.5
+  retire. `pnpm-lock.yaml` now resolves one copy of each of the six family packages
+  (`spec` / `client` / `core` / `formula` / `lint` / `sdui-parser`), all at rc.5.
+
+  Bumping the pin and repairing the fallout cannot be split: the pin alone reddens
+  CI, and the code alone targets a shape that is not in effect yet.
+
+  ## A live bug this upgrade fixes
+
+  **`ObjectStackDataSource.delete()` never emitted its mutation event, and resolved
+  `undefined` instead of a boolean.** `@objectstack/client`'s `DeleteDataResult`
+  declared a key called `deleted` — a key no schema has ever declared and no server
+  path has ever returned on `DELETE /data/:object/:id`. So `result.deleted`
+  compiled and read `undefined` at runtime: the guard never fired, a successful
+  delete notified no subscriber, and every consumer's cache stayed stale.
+  objectstack#5638 corrected the interface to the schema's `success`; following the
+  rename is what restores both behaviours. Nothing in this repo had to change shape
+  for it — the code was already asking the right question of the wrong key.
+
+  ## Breaking, in FROM → TO form
+
+  - **The five `@objectstack/spec/ui` interaction-config modules are gone** —
+    touch / dnd / keyboard / animation / offline, 32 defs and 64 exports
+    (objectstack#4988, PR objectstack#5321). None of them had an authoring door: no
+    metadata document could ever carry one of these blocks, so a stack that parsed
+    before the retirement parses byte-for-byte the same after it. `@object-ui/types`
+    drops the 32 `export type` re-exports. The vocabulary each one's only real
+    consumer needs is now declared by that consumer, which is the remedy the spec's
+    own retirement ledger prescribes ("declare that union locally — it is your
+    client's policy, not the platform's"):
+
+    - `@object-ui/react`'s `useOffline` owns `OfflineStrategy`, `ConflictResolution`,
+      `PersistStorageType`, `EvictionPolicyType`, `OfflineConfig`,
+      `OfflineCacheConfig`, `OfflineSyncConfig`;
+    - `@object-ui/core`'s `DndProtocol` / `KeyboardProtocol` own `DndConfig`,
+      `DragItem`, `DropZone`, `DragConstraint`, `DragHandle`, `DropEffect`,
+      `KeyboardNavigationConfig`, `KeyboardShortcut`, `FocusManagement`,
+      `FocusTrapConfig`;
+    - `@object-ui/types`' `mobile` module owns `SpecGestureConfig`,
+      `SwipeGestureConfig`, `PinchGestureConfig`, `LongPressGestureConfig`,
+      `TouchTargetConfig`, `TouchInteraction` (plus a new `SPEC_GESTURE_TYPES`
+      runtime tuple), so `@object-ui/mobile`'s import paths are unchanged.
+
+    Every shape is moved verbatim — same keys, same members, same optionality — so
+    no hook or bridge changes behaviour. Consumers importing these names from
+    `@object-ui/types` must import them from the owning package instead. Note the
+    spec's _surviving_ `ConnectorConflictResolution` (`/integration`, connector sync)
+    and `ConflictResolutionStrategy` (`/api`, route merge policy) are **different
+    concepts** — do not re-point at them.
+
+  - **`@object-ui/types` no longer re-exports `NotificationAction` or `EmbedConfig`**
+    (objectstack#5015, PR objectstack#5300). Both were published `ui` vocabulary with
+    no authoring door; no notification action was ever parsed from metadata and no
+    iframe route ever read an embed config. The presentation enums
+    (`NotificationType` / `NotificationSeverity` / `NotificationPosition`) and
+    `SharingConfig` **survive** and are untouched — public form sharing still gates
+    the anonymous endpoints on `allowAnonymous` + `publicLink`.
+    `@object-ui/core`'s `SharingProtocol` keeps `resolveEmbedConfig` /
+    `generateEmbedCode` against a locally declared `EmbedConfig`, so its surface is
+    unchanged.
+  - **`ThemeEngine` stops emitting nine retired CSS variable groups**
+    (objectstack#5021 option 2, PR objectstack#5289). `theme.animation`,
+    `theme.zIndex` and five typography groups (`fontSize` / `fontWeight` /
+    `lineHeight` / `letterSpacing`, plus `fontFamily.heading` / `fontFamily.mono`)
+    are tombstones the schema now rejects by name, so `--duration-*`, `--timing-*`,
+    `--z-*`, `--font-size-*`, `--font-weight-*`, `--line-height-*`,
+    `--letter-spacing-*`, `--font-heading` and `--font-mono` had become structurally
+    dead code — no author could produce the input that reached them.
+    `generateAnimationVars` and `generateZIndexVars` are removed from
+    `@object-ui/core`, and `@object-ui/types` drops `Animation` / `ZIndex` /
+    `AnimationSchema` / `ZIndexSchema`. **`theme.customVars` is the declared — and
+    since #5021 the only — door**: each entry is emitted verbatim as
+    `--<key>: <value>`, so a `--z-modal` or a `--duration-fast` goes there now.
+    LIVE emission is untouched byte for byte: `colors`, `borderRadius`, `shadows`,
+    `typography.fontFamily.base` (→ `--font-sans`) and `customVars`.
+  - **`@object-ui/types`' `HttpMethodSchema` now binds the spec's
+    `HttpMethodSubsetSchema`, and `HttpMethod` binds `HttpMethodSubset`**
+    (objectstack#5832, PR objectstack#5976 — objectui#3499). The spec renamed its
+    5-value UI subset because `schemaNameFromExportKey` strips the `Schema` suffix,
+    so the 5-value and 7-value enums both published as `shared/HttpMethod` and the
+    later write won — the emitted JSON Schema and reference page described only one
+    of them. **The runtime domain is unchanged and this repo's exported names are
+    unchanged**; this follows the rename without touching cross-package semantics.
+    Deliberately NOT re-pointed at the spec's bare `HttpMethod`: that is the 7-value
+    enum, and widening to it would let `method: 'HEAD'` compile and then throw in
+    `HttpRequestSchema.parse()`.
+  - **`dashboard.widgets[].actionUrl` / `actionType` / `actionIcon` / `aria` are
+    refused, not stripped** (objectstack#5010, ADR-0049 enforce-or-remove). A
+    dashboard widget has no action button and never had one — every action the
+    dashboard dispatches comes from `header.actions[]` — and no renderer ever applied
+    the widget `aria`, so it promised accessibility compliance it did not deliver.
+    A stale dashboard now gets a named error telling it where the affordance moved,
+    instead of silently losing it. Run `os migrate meta --from 16` to rewrite.
+
+### Patch Changes
+
+- 8aad9fd: Action-face predicates written against the canonical `record.` root now evaluate
+
+  `action:button`, `action:icon`, `action:menu` and `action:group` gated their
+  actions on `useCondition(pred, context)`, which evaluates on
+  `new ExpressionEvaluator({ ...scope, ...context })` — and the context each of
+  them passed was the row spread flat, or nothing at all. Only the shorthand
+  spelling resolved:
+
+  | predicate                    | verdict, before                  |
+  | ---------------------------- | -------------------------------- |
+  | `status == "pending"`        | evaluates (`action:button` only) |
+  | `record.status == "pending"` | throws `record is not defined`   |
+  | `data.status == "pending"`   | throws `data is not defined`     |
+
+  `record.` is not a mistaken spelling — it is the canonical one. It is what
+  `ExpressionEvaluator`'s CEL path binds (`bag.record` as the record namespace),
+  what `evalRowPredicate` binds on the record header, list rows, the row kebab
+  and conditional formatting (`record.status` / bare `status` / `data.status`),
+  and what the server enforces with. A `visible` that fails CLOSED turns the throw
+  into "hidden", so a correctly-authored predicate deleted its own button —
+  indistinguishable from the gate having said no. On the fail-soft legs the same
+  throw lands the other way: `disabled` greyed a control out for everyone.
+
+  Live rather than theoretical: every declared action on framework's
+  `sys_approval_request` gates on `record.viewer.*`, so the whole server-declared
+  approval decision set was invisible wherever the declared-action bar rendered
+  until objectui#4077 fixed that bar. These four generic renderers carried the
+  same binding.
+
+  What changed:
+
+  - all four bind the row the three canonical ways, through one named helper
+    (`usePredicateRecordContext`, exported from `@object-ui/react` beside
+    `useCondition`), so the action face and the row surfaces answer an author's
+    `visible:` the same way;
+  - `action:icon` reads the row at all. It evaluated against an empty bag, so not
+    even the bare-field shorthand resolved — and its `data` prop was landing in
+    the props spread onto the DOM button;
+  - `action:menu`'s items and `action:group`'s two leaves receive the row from
+    their host, which they previously never got;
+  - `action:bar` forwards the row into the overflow menu it builds, not just to
+    its inline members. An action's predicate had been answering a different
+    question purely because it spilled past `maxVisible` — which on mobile
+    defaults to 1, making the verdict a function of the viewport.
+
+  Deliberately unchanged: the evaluation entry and each site's error policy. A
+  predicate that genuinely faults still fails closed on `action:button` /
+  `action:menu` `visible` and still fails soft on the other legs, exactly as
+  before; `toPredicateInput`, `hasDeclaredVisibilityGate` and the empty-predicate
+  rules keep their pinned semantics. Binding the row is a separate question from
+  what to do when the predicate faults.
+
+  A surface with no row of its own binds nothing rather than an empty record, so
+  a host that supplies the row through the ambient predicate scope is not blanked
+  out; a row passed explicitly still wins over the scope.
+
+- e06810e: `PageComponentSchema.dataSource` is now consumed instead of discarded — a
+  `list-view` page component can reference a **saved view by name** for the first
+  time, and writing the binding no longer breaks the component
+  (objectstack#5576).
+
+  The spec declares a per-element data binding on every page component —
+  `dataSource: { object, view?, filter?, sort?, limit? }` — and objectui read none
+  of it. `ViewDataProvider.resolveElementDataSource` forwarded
+  `filter`/`sort`/`limit` and dropped `view` entirely, and had no caller outside its
+  own test; nothing mapped `object` onto the `objectName` a list actually reads. So
+  "reference a saved view by name" was published, validated and inert, and every
+  page that wanted a saved view's columns/filter/sort had to inline a second copy of
+  them — the drift the binding exists to remove.
+
+  Writing the binding also **broke** the block, for a reason unrelated to `view`:
+  `SchemaRenderer` spread the schema's `dataSource` metadata onto the component as a
+  React prop, and that is the prop name the host uses to inject the data-source
+  ADAPTER. The plain `{ object, view }` object shadowed the adapter, so the first
+  `dataSource.find(…)` threw `dataSource.find is not a function` and `list-view`
+  rendered "Couldn't load records" — a spec-compliant component failing next to
+  identical ones that omitted the binding.
+
+  - `@object-ui/react` — `SchemaRenderer` no longer spreads `schema.dataSource` as a
+    prop (it is metadata, like `visibleWhen`); renderers read it off `schema`. An
+    explicit React `dataSource` prop is unaffected. New
+    `useElementDataSource(schema, dataSource?)` hook resolves a binding, fetching
+    the named saved view from the object definition's `listViews` and the metadata
+    overlay's `listViews()`.
+  - `@object-ui/core` — new `isElementDataSourceConfig` / `collectSavedViews` /
+    `resolveSavedView` / `composeElementDataSource`, and `resolveElementDataSource`
+    now honours `view` through an optional `DataFetcher.fetchViews`, reporting an
+    unresolvable view as an error instead of silently returning every record.
+    `resolveViewId` moved here from `@object-ui/app-shell` (re-exported there) so
+    one matcher serves both the object page and a page component.
+  - `@object-ui/plugin-list` — `list-view` maps the binding onto the props
+    `ListView` reads. `dataSource.*` keys are authoritative, view-supplied values
+    are a baseline the component's own keys override, and `filter` AND-combines at
+    every level (the spec calls the binding's filter "additional criteria"), so a
+    binding can narrow a saved view but never widen it. A `view` name that does not
+    resolve renders a configuration error naming the object's actual views and
+    issues no query — it never falls back to the object's default view, because that
+    turns a typo into a silently wider answer.
+
+- ab3ad4f: An empty predicate is no longer a declared gate anywhere (objectui#3850, objectui#3862)
+
+  "Is a gate DECLARED on this key — is there a condition to reach a verdict on?" was
+  answered three times in this repo, with three different scopes, and the widest
+  answers sat on `disabled`, where the mistake is not benign:
+
+  - `hasDeclaredVisibilityGate` (the action face) asked `!= null && !== ''`, so every
+    OBJECT counted — including `{ dialect: 'cel', source: '' }`. That envelope is not
+    a hand-written curiosity: `@objectstack/spec`'s `ExpressionInputSchema` normalizes
+    every authored predicate into one, so "the author left the predicate empty"
+    compiles to exactly it. The verdict path normalized the same value back to
+    `undefined`, and `evaluateCondition(undefined)` answers `true` — "no condition, so
+    visible/enabled". On `visible` that `true` means SHOW, so the two mistakes
+    cancelled; on `disabled` it means GREY, so they compounded: a button disabled
+    forever that no author asked to disable (objectui#3850, the residue objectui#3842
+    left behind).
+  - `SchemaRenderer` asked `disabled !== undefined` inline, one notch wider again, so
+    `disabled: null` greyed out too — on the GENERIC rendering path, since that block
+    runs for every node type, and not as an internal flag either: `_disabled` is
+    forwarded to the component as a real `disabled` prop (objectui#3862).
+  - `ActionRunner`'s execution gates asked "does this normalize to something
+    evaluable?" — the scope that turned out to be right (objectui#3848 / objectui#3872).
+
+  There is now ONE definition, `hasDeclaredPredicate`, exported from
+  `@object-ui/core` (`evaluator/declaredPredicate.ts`, beside the `toPredicateInput`
+  normalizer it is derived from): a gate is declared when normalization still leaves a
+  condition to evaluate. `''`, a whitespace-only string, an empty-`source` envelope
+  and any non-predicate value (`0`, `{}`) are NOT declared; `false` IS (a verdict is
+  not a missing gate — objectui#3812). `hasDeclaredVisibilityGate` keeps its name as a
+  re-export of it, so the five member-action renderer call sites, `DeclaredActionsBar`
+  and `record-quick-actions` are unchanged and inherit the scope;
+  `SchemaRenderer`'s `disabled` / `disabledOn` chain and `ActionRunner`'s two gates
+  read the same function. No consumer got a local "and also check for empty" test —
+  that fourth dialect is what objectui#3842 / objectui#3849 spent two PRs merging away.
+
+  Measured behaviour change, `action:button` and the generic path, before → after:
+
+  | value                                                     | `visible`      | `disabled` | `enabled` | `SchemaRenderer` `disabled` prop |
+  | --------------------------------------------------------- | -------------- | ---------- | --------- | -------------------------------- |
+  | `''`                                                      | shown → shown  | on → on    | on → on   | forwarded → absent               |
+  | `null`                                                    | shown → shown  | on → on    | on → on   | forwarded → absent               |
+  | `{ dialect: 'cel', source: '' }`                          | shown → shown  | GREY → on  | on → on   | forwarded → absent               |
+  | `{ source: '' }`                                          | shown → shown  | GREY → on  | on → on   | forwarded → absent               |
+  | `'   '` (whitespace)                                      | HIDDEN → shown | on → on    | GREY → on | forwarded → absent               |
+  | `0` / `{}` (not predicates)                               | shown → shown  | GREY → on  | on → on   | forwarded → absent               |
+  | `true` / `false` / bare CEL / `${…}` / non-empty envelope | unchanged      | unchanged  | unchanged | unchanged                        |
+
+  Every row moves toward "there is no gate here", never away from it, and no value
+  that HAS a verdict changes it — the verdict is still read from the raw value, only
+  the gate in front of it narrowed. Two rows are behaviour changes rather than the
+  equivalence the ruling expected, and are pinned as such: the whitespace string moves
+  on `visible` / `enabled` (it used to normalize to `'${   }'`, which evaluates falsy,
+  so a predicate that says nothing HID the action from everyone), and non-predicate
+  junk stops greying controls out (fail-open, the posture `ActionRunner` already
+  committed to).
+
+  One blank spelling is knowingly still outside the scope: an envelope whose `source`
+  is blank but not EMPTY (`{ dialect: 'cel', source: '   ' }`) — the normalizer folds a
+  `source` of `''` and does not trim, so the string spelling of a blank predicate is
+  trimmed and the envelope spelling is not, and `disabled` still greys out for that one
+  value. The ruling enumerated three empty spellings; this is a fourth, measured and
+  filed as objectui#3960 rather than widened in here.
+
+  One chain is deliberately untouched: `SchemaRenderer`'s `visible` / `visibleWhen` /
+  `visibleOn` / `visibility` / `hidden` / `hiddenOn` legs keep `!== undefined`, because
+  narrowing them would change ALIAS PRECEDENCE, not just emptiness. The `hidden` legs
+  are not negated and therefore carry this same defect with the polarity that makes the
+  node vanish — measured, out of this ruling's scope, filed as objectui#3955.
+
+- 0109f54: Blank predicates and non-predicate values are no longer gates, at the last three entries that still judged them (objectui#3955, objectui#3957, objectui#3960)
+
+  objectui#3850 sank "is a predicate gate DECLARED here?" into one definition,
+  `@object-ui/core`'s `hasDeclaredPredicate`. Three places were left out of that
+  ruling's placement clause, each with the same shape of defect: the evaluator's
+  single default for "there is nothing here to evaluate" is `true`, meaning
+  _visible/enabled_, and wherever a too-wide "declared" test hands it an empty
+  predicate on an INVERTED key, that `true` turns a control off for a value the
+  metadata never used to say anything.
+
+  **`SchemaRenderer`'s `hidden` / `hiddenOn` legs (objectui#3955)** asked
+  `!== undefined` and did NOT negate the verdict, so an empty predicate meant HIDE
+  and the node disappeared — on the generic rendering path, since that block runs
+  for every schema type. Harder to diagnose than the `disabled` twin objectui#3862
+  fixed: a greyed-out control is still on screen, while a node that never rendered
+  is indistinguishable from metadata that meant to hide it. Both legs now read the
+  shared definition.
+
+  **The "blank" criterion now covers the envelope spelling (objectui#3960).** The
+  definition trimmed a whitespace-only STRING and not an envelope's whitespace-only
+  `source`, because `toPredicateInput` folds a `source` of `''` and does not trim.
+  So `{ dialect: 'cel', source: '   ' }` was a declared gate whose verdict came from
+  core's own CEL entry calling that exact value "no predicate" (`if (!source.trim())
+return true`) — `disabled` greyed out forever and `ActionRunner.execute` answered
+  `{ success: false, error: 'Action is disabled' }` with the handler never invoked.
+  Blankness is now decided once for both spellings, at the definition. The
+  NORMALIZER's contract is deliberately unchanged: "what shape does the evaluator
+  accept" is not the same question as "is there a condition", and moving the trim
+  there would have flipped verdicts for every
+  `useCondition(toPredicateInput(…))` call site, including container-level `visible`
+  reads that never asked this question at all.
+
+  **`ActionEngine.getActionsForLocation`'s `visible` filter (objectui#3957)** was the
+  last consumer answering the question with a range of its own — three empty
+  spellings folded by hand, everything else coerced with `Boolean(raw)`. It now reads
+  the shared definition and the coercion branch is gone, so one value no longer gets
+  two answers depending on whether an action was surfaced by the engine or rendered
+  standalone (the invariant objectui#3314 established). Its fail-CLOSED posture on a
+  predicate that THROWS is untouched (`throwOnError: true` + `warnHiddenPredicate`):
+  "the predicate faulted" and "there is no predicate" are different facts.
+
+  Behaviour changes, before → after. Observation-class: each needs an author to write
+  an empty/blank predicate or a non-predicate value, and there is no known user path
+  today.
+
+  | value                                                       | `ActionEngine` `visible` | `SchemaRenderer` `hidden` | `disabled` (action face + generic path) | `ActionRunner.execute` `disabled` |
+  | ----------------------------------------------------------- | ------------------------ | ------------------------- | --------------------------------------- | --------------------------------- |
+  | `''` / `null`                                               | shown → shown            | HIDDEN → rendered         | unchanged                               | unchanged                         |
+  | `'   '` (blank text)                                        | HIDDEN → shown           | HIDDEN → rendered         | unchanged                               | unchanged                         |
+  | `0` / `NaN`                                                 | HIDDEN → shown           | HIDDEN → rendered         | unchanged                               | unchanged                         |
+  | `{}` / `[]`                                                 | shown → shown            | HIDDEN → rendered         | unchanged                               | unchanged                         |
+  | `{ dialect: 'cel', source: '' }`                            | shown → shown            | HIDDEN → rendered         | unchanged                               | unchanged                         |
+  | `{ dialect: 'cel', source: '   ' }`                         | shown → shown            | HIDDEN → rendered         | GREY → on                               | refused → runs                    |
+  | `{ source: '   ' }` (no dialect)                            | HIDDEN → shown           | HIDDEN → rendered         | GREY → on                               | refused → runs                    |
+  | `true` / `false` / bare CEL / `${…}` / a non-blank envelope | unchanged                | unchanged                 | unchanged                               | unchanged                         |
+
+  Every row moves toward "there is no gate here", never away from it, and no value
+  that HAS a verdict changes it — a declared `false` is still a verdict, not a
+  missing gate (objectui#3812), and blankness is `trim()`, not "short": `{ dialect:
+'cel', source: ' x ' }` is a predicate. One alias precedence changes with the
+  `hidden` legs and is pinned rather than claimed as an equivalence: an undeclared
+  `hidden` no longer short-circuits the chain, so a declared `hiddenOn` is finally
+  consulted.
+
+  `SchemaRenderer`'s four `visible*` legs keep `!== undefined` deliberately, as
+  objectui#3850 ruled: their `true` is negated, so an empty predicate already lands
+  on "shown", and narrowing them would change alias precedence rather than fix
+  anything.
+
+- Updated dependencies [6719877]
+- Updated dependencies [56ff091]
+- Updated dependencies [7864f03]
+- Updated dependencies [d229dfa]
+- Updated dependencies [4bc6c23]
+- Updated dependencies [c3b01a7]
+- Updated dependencies [f5f8744]
+- Updated dependencies [3765678]
+- Updated dependencies [d83f6b3]
+- Updated dependencies [5f08c05]
+- Updated dependencies [69becd2]
+- Updated dependencies [5e52495]
+- Updated dependencies [b750823]
+- Updated dependencies [e06810e]
+- Updated dependencies [ab3ad4f]
+- Updated dependencies [c2fd122]
+- Updated dependencies [ac2139c]
+- Updated dependencies [b14ab3a]
+- Updated dependencies [8c60819]
+- Updated dependencies [41d6022]
+- Updated dependencies [e64a52e]
+- Updated dependencies [844d17f]
+- Updated dependencies [48132f7]
+- Updated dependencies [4dcd52a]
+- Updated dependencies [42ae5c6]
+- Updated dependencies [1d723e3]
+- Updated dependencies [0109f54]
+- Updated dependencies [7e5bb5d]
+- Updated dependencies [fbc23e0]
+- Updated dependencies [6d762da]
+- Updated dependencies [e6fdbdc]
+- Updated dependencies [f9faa7d]
+- Updated dependencies [6bb454a]
+- Updated dependencies [523be48]
+- Updated dependencies [7e2b7e9]
+- Updated dependencies [33526fd]
+- Updated dependencies [32413ec]
+- Updated dependencies [c1e1e6b]
+  - @object-ui/core@17.4.0
+  - @object-ui/i18n@17.4.0
+  - @object-ui/types@17.4.0
+  - @object-ui/data-objectstack@17.4.0
+
 ## 17.3.0
 
 ### Patch Changes
@@ -1555,6 +1988,7 @@
   result and the "warn-once" tracking are now stored separately: a
   `WeakMap` caches the validation outcome (so the visual flag is stable),
   while a `WeakSet` continues to dedupe `console.warn` output.
+
   - @object-ui/types@6.2.2
   - @object-ui/core@6.2.2
   - @object-ui/i18n@6.2.2
@@ -1704,6 +2138,7 @@
 ### Minor Changes
 
 - b2d1704: feat(cmdk): record search across objects in the Command Palette
+
   - New `useRecordSearch` hook in `@object-ui/react` debounces a query, fans out
     to `dataSource.find(name, { $search, $top })` across candidate objects, and
     aggregates hits. Race-safe via a monotonic runId; per-object 404s are
@@ -1718,6 +2153,7 @@
 
   Three related fixes that all addressed the same UX: a user follows a URL
   shaped `/{object}/{recordId}` and sees a completely blank content area.
+
   1. **`useNavigationOverlay` produced the broken URL itself.** When
      middle-click / Cmd-click opened a gallery card in a new tab and no
      `onNavigate` was provided, the hook built `/{object}/{id}` — a URL
@@ -1737,6 +2173,7 @@
 
 - aa063db: `useRecordSearch` now orders hits by relevance instead of object-fanout
   order. Tiers (higher wins):
+
   - 110: exact recordId paste
   - 100: display exactly equals the query
   - 80: display starts with the query
@@ -1796,17 +2233,20 @@
 - bd8447d: Three platform-wide detail polish items.
 
   **Tighter page rhythm**
+
   - Outer `PageRenderer` padding `p-4 md:p-6 lg:p-8` → `p-3 md:p-4 lg:p-6`
     and outer body wrap `space-y-8` → `space-y-6` so list / detail / home
     pages share the same edge rhythm. Cuts ~16px of edge slack on lg.
 
   **Highlights KPI treatment**
+
   - `HeaderHighlight` now renders numeric / currency / percent / decimal
     values as KPI numbers (`text-xl md:text-2xl font-semibold tabular-nums`)
     instead of the uniform `text-sm font-semibold`, so amount / probability
     / count fields read as headline stats — Salesforce-style key facts.
 
   **Discussion footer upgrade**
+
   - `RecordActivityTimeline` now uses `RichTextCommentInput` (bold / italic /
     list / code, `@`-mention autocomplete, preview toggle, Send) instead of
     a bare `<textarea>`.
@@ -1817,6 +2257,7 @@
     and sidebar positions.
 
 - d51a577: feat(platform): Discussion attachments + @mention directory + Reference Rail aside
+
   - **Discussion attachments** — `RichTextCommentInput` now accepts an `extraSlot`
     and a `canSubmitEmpty` flag so hosts can mount the existing
     `CommentAttachment` composer beneath the editor without forking the toolbar.
@@ -1906,6 +2347,7 @@
   page so the two renderers share state.
 
 - 74962b0: feat(detail): record:discussion schema component + flush accordion variant
+
   - New `record:discussion` schema type lets authors place the record
     chatter feed anywhere in a custom Page schema. Wired through a
     shared `DiscussionContext` provider on the `assignedPage` branch
@@ -1926,6 +2368,7 @@
   customize the header or one tab.
 
   **Slot menu (v1):**
+
   - `header` — replaces `page:header`
   - `actions` — replaces the `record:quick_actions` action bar
   - `highlights` — replaces the chips + chevron path strip
@@ -1953,6 +2396,7 @@
   ```
 
   **API changes:**
+
   - `PageSchema` (in `@object-ui/types`): adds `kind?: 'full' | 'slotted'`
     (default `'full'`) and `slots?: PageSlotMap`.
   - `usePageAssignment` (in `@object-ui/react`): result now exposes a
@@ -2132,6 +2576,7 @@
   detail view (`TypeError: titleFormat.replace is not a function`) and printed
   `Failed to evaluate expression: ${[object Object]}` for every action visibility
   predicate.
+
   - `@object-ui/core`: `ExpressionEvaluator.evaluate` / `evaluateCondition` now
     unwrap Expression envelopes transparently.
   - `@object-ui/react`: new `toPredicateInput()` helper to safely normalize
@@ -2383,6 +2828,7 @@
 - New plugin-object and ObjectQL SDK updates
 
   **Added:**
+
   - New Plugin: @object-ui/plugin-object - ObjectQL plugin for automatic table and form generation
     - ObjectTable: Auto-generates tables from ObjectQL object schemas
     - ObjectForm: Auto-generates forms from ObjectQL object schemas with create/edit/view modes
@@ -2391,6 +2837,7 @@
   - ObjectQL Integration: Enhanced ObjectQLDataSource with getObjectSchema() method using MetadataApiClient
 
   **Changed:**
+
   - Updated @objectql/sdk from ^1.8.3 to ^1.9.1
   - Updated @objectql/types from ^1.8.3 to ^1.9.1
 
@@ -2404,6 +2851,7 @@
 - Patch release: Add automated changeset workflow and CI/CD improvements
 
   This release includes infrastructure improvements:
+
   - Added changeset-based version management
   - Enhanced CI/CD workflows with GitHub Actions
   - Improved documentation for contributing and releasing
diff --git a/packages/react/package.json b/packages/react/package.json
index a448a1dc3e..e32b903772 100644
--- a/packages/react/package.json
+++ b/packages/react/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/react",
-  "version": "17.3.0",
+  "version": "17.4.0",
   "type": "module",
   "license": "MIT",
   "description": "React bindings and SchemaRenderer component for Object UI",
diff --git a/packages/runner/CHANGELOG.md b/packages/runner/CHANGELOG.md
index 3f479fad73..873ec0eff6 100644
--- a/packages/runner/CHANGELOG.md
+++ b/packages/runner/CHANGELOG.md
@@ -1,5 +1,78 @@
 # @object-ui/runner
 
+## 17.4.0
+
+### Patch Changes
+
+- 04fb8b8: Runner in-app navigation now carries the current query string across to the pushed URL instead of `pushState`-ing a bare path. Opening the Runner with `?api=<base>` and clicking a sidebar entry no longer drops the parameter from the address bar, so reloading or sharing the resulting URL still reaches the same backend rather than silently falling back to the (normally empty) `LocalBundleLoader` and rendering `Page not found`. The whole query string is preserved, not just `api` — `@object-ui/core`'s `?__debug…` flags survive navigation for the same reason. A navigation target that spells out its own query keeps it and wins on collision, with the remaining current parameters merged in behind it (#3578).
+- 03f25f7: Complete `packages/runner/vite.config.ts`'s workspace alias table to the full
+  transitive import closure, so `@object-ui/runner` boots and builds from the
+  monorepo sources without a prior `pnpm -w build` (objectui#3575).
+
+  The table aliased 7 `@object-ui/*` specifiers to `packages/*/src`, but those
+  `src` trees import 8 more workspace packages that were not aliased. Those fell
+  back to Node resolution and landed on `packages/<pkg>/dist`, which does not
+  exist in a fresh install-only checkout — so the "From Source" flow documented in
+  `content/docs/utilities/runner.mdx` (`pnpm install` then `pnpm dev`, no build
+  step) failed with "Failed to run dependency scan" and served HTTP 500 for every
+  module on the chain. `pnpm --filter @object-ui/runner build` failed the same way.
+
+  Newly aliased: `i18n`, `sdui-parser`, `react-runtime`, `fields`, `plugin-detail`
+  (first layer), `providers` and `permissions` (only reachable once the first layer
+  resolves to src), and `data-objectstack` (a type-only import that esbuild erases,
+  so the dependency scan never reported it).
+
+  This is user-visible in the published artifact, because the alias table is not
+  scoped by `command` and therefore applies to `vite build` as well. Bundling the
+  newly aliased packages from src stops the per-icon `lucide-react/dynamic.mjs`
+  chunks from being inlined, so the build now emits ~1.7k lazy icon micro-chunks
+  like `apps/console` does. `build.modulePreload` is disabled to match console, so
+  those chunks are not all preloaded on first paint: the measured initial eager
+  payload drops from 4231003 to 591795 bytes, while total `dist` size grows about
+  5.5% because the previously inlined icons are now separate files.
+
+- Updated dependencies [794c497]
+- Updated dependencies [993336f]
+- Updated dependencies [f0a625a]
+- Updated dependencies [b5980f4]
+- Updated dependencies [8aad9fd]
+- Updated dependencies [6719877]
+- Updated dependencies [56ff091]
+- Updated dependencies [0cbdca8]
+- Updated dependencies [d229dfa]
+- Updated dependencies [ecae400]
+- Updated dependencies [a7e39a8]
+- Updated dependencies [4bc6c23]
+- Updated dependencies [d3e738a]
+- Updated dependencies [c3b01a7]
+- Updated dependencies [7ed3360]
+- Updated dependencies [0fa5e4d]
+- Updated dependencies [5bfaabd]
+- Updated dependencies [e06810e]
+- Updated dependencies [ab3ad4f]
+- Updated dependencies [c2fd122]
+- Updated dependencies [e24d767]
+- Updated dependencies [aca561a]
+- Updated dependencies [48132f7]
+- Updated dependencies [0ef9dfd]
+- Updated dependencies [1d723e3]
+- Updated dependencies [0109f54]
+- Updated dependencies [7e5bb5d]
+- Updated dependencies [fbc23e0]
+- Updated dependencies [e6fdbdc]
+- Updated dependencies [54233b1]
+- Updated dependencies [97b63d7]
+- Updated dependencies [6bb454a]
+- Updated dependencies [523be48]
+- Updated dependencies [7e2b7e9]
+- Updated dependencies [c1e1e6b]
+  - @object-ui/components@17.4.0
+  - @object-ui/react@17.4.0
+  - @object-ui/core@17.4.0
+  - @object-ui/types@17.4.0
+  - @object-ui/plugin-charts@17.4.0
+  - @object-ui/plugin-kanban@17.4.0
+
 ## 17.3.0
 
 ### Patch Changes
@@ -1191,6 +1264,7 @@
 ### Patch Changes
 
 - 1b6dc64: fix: complete Tailwind v3→v4 migration cleanup
+
   - Rename deprecated `flex-shrink-0` → `shrink-0` and `flex-grow-N` →
     `grow-N` (Tailwind v4 dropped the long-form aliases). Affects
     data-table, fields/index, FileField, ChatbotEnhanced,
@@ -1494,6 +1568,7 @@
 - New plugin-object and ObjectQL SDK updates
 
   **Added:**
+
   - New Plugin: @object-ui/plugin-object - ObjectQL plugin for automatic table and form generation
     - ObjectTable: Auto-generates tables from ObjectQL object schemas
     - ObjectForm: Auto-generates forms from ObjectQL object schemas with create/edit/view modes
@@ -1502,6 +1577,7 @@
   - ObjectQL Integration: Enhanced ObjectQLDataSource with getObjectSchema() method using MetadataApiClient
 
   **Changed:**
+
   - Updated @objectql/sdk from ^1.8.3 to ^1.9.1
   - Updated @objectql/types from ^1.8.3 to ^1.9.1
 
diff --git a/packages/runner/package.json b/packages/runner/package.json
index 39b980a066..74417bc6ed 100644
--- a/packages/runner/package.json
+++ b/packages/runner/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@object-ui/runner",
   "private": false,
-  "version": "17.3.0",
+  "version": "17.4.0",
   "description": "Universal Object UI Application Runner",
   "type": "module",
   "homepage": "https://www.objectui.org/docs/utilities/runner",
diff --git a/packages/sdui-parser/CHANGELOG.md b/packages/sdui-parser/CHANGELOG.md
index ef96e6a01b..f908c561c4 100644
--- a/packages/sdui-parser/CHANGELOG.md
+++ b/packages/sdui-parser/CHANGELOG.md
@@ -1,5 +1,7 @@
 # @object-ui/sdui-parser
 
+## 17.4.0
+
 ## 17.3.0
 
 ## 17.2.0
diff --git a/packages/sdui-parser/package.json b/packages/sdui-parser/package.json
index 53310fc385..aaf926c97e 100644
--- a/packages/sdui-parser/package.json
+++ b/packages/sdui-parser/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/sdui-parser",
-  "version": "17.3.0",
+  "version": "17.4.0",
   "type": "module",
   "sideEffects": false,
   "license": "MIT",
diff --git a/packages/types/CHANGELOG.md b/packages/types/CHANGELOG.md
index 2e3f3e06a8..f2c3bf7d45 100644
--- a/packages/types/CHANGELOG.md
+++ b/packages/types/CHANGELOG.md
@@ -1,5 +1,274 @@
 # @object-ui/types
 
+## 17.4.0
+
+### Minor Changes
+
+- 48132f7: Track the `@objectstack` family at `17.0.0-rc.5` (objectui#3560).
+
+  The pin moves from `^17.0.0-rc.2` to `^17.0.0-rc.5` across all 37 declarations in
+  30 `package.json` files, and the sibling `@objectstack/*` packages (`client` /
+  `formula` / `lint`) move with it — they pin `@objectstack/spec` **exactly**, so
+  leaving them behind would keep a second copy of the spec in the tree and have
+  `@objectstack/lint` validating against schemas that still accept the keys rc.3–rc.5
+  retire. `pnpm-lock.yaml` now resolves one copy of each of the six family packages
+  (`spec` / `client` / `core` / `formula` / `lint` / `sdui-parser`), all at rc.5.
+
+  Bumping the pin and repairing the fallout cannot be split: the pin alone reddens
+  CI, and the code alone targets a shape that is not in effect yet.
+
+  ## A live bug this upgrade fixes
+
+  **`ObjectStackDataSource.delete()` never emitted its mutation event, and resolved
+  `undefined` instead of a boolean.** `@objectstack/client`'s `DeleteDataResult`
+  declared a key called `deleted` — a key no schema has ever declared and no server
+  path has ever returned on `DELETE /data/:object/:id`. So `result.deleted`
+  compiled and read `undefined` at runtime: the guard never fired, a successful
+  delete notified no subscriber, and every consumer's cache stayed stale.
+  objectstack#5638 corrected the interface to the schema's `success`; following the
+  rename is what restores both behaviours. Nothing in this repo had to change shape
+  for it — the code was already asking the right question of the wrong key.
+
+  ## Breaking, in FROM → TO form
+
+  - **The five `@objectstack/spec/ui` interaction-config modules are gone** —
+    touch / dnd / keyboard / animation / offline, 32 defs and 64 exports
+    (objectstack#4988, PR objectstack#5321). None of them had an authoring door: no
+    metadata document could ever carry one of these blocks, so a stack that parsed
+    before the retirement parses byte-for-byte the same after it. `@object-ui/types`
+    drops the 32 `export type` re-exports. The vocabulary each one's only real
+    consumer needs is now declared by that consumer, which is the remedy the spec's
+    own retirement ledger prescribes ("declare that union locally — it is your
+    client's policy, not the platform's"):
+
+    - `@object-ui/react`'s `useOffline` owns `OfflineStrategy`, `ConflictResolution`,
+      `PersistStorageType`, `EvictionPolicyType`, `OfflineConfig`,
+      `OfflineCacheConfig`, `OfflineSyncConfig`;
+    - `@object-ui/core`'s `DndProtocol` / `KeyboardProtocol` own `DndConfig`,
+      `DragItem`, `DropZone`, `DragConstraint`, `DragHandle`, `DropEffect`,
+      `KeyboardNavigationConfig`, `KeyboardShortcut`, `FocusManagement`,
+      `FocusTrapConfig`;
+    - `@object-ui/types`' `mobile` module owns `SpecGestureConfig`,
+      `SwipeGestureConfig`, `PinchGestureConfig`, `LongPressGestureConfig`,
+      `TouchTargetConfig`, `TouchInteraction` (plus a new `SPEC_GESTURE_TYPES`
+      runtime tuple), so `@object-ui/mobile`'s import paths are unchanged.
+
+    Every shape is moved verbatim — same keys, same members, same optionality — so
+    no hook or bridge changes behaviour. Consumers importing these names from
+    `@object-ui/types` must import them from the owning package instead. Note the
+    spec's _surviving_ `ConnectorConflictResolution` (`/integration`, connector sync)
+    and `ConflictResolutionStrategy` (`/api`, route merge policy) are **different
+    concepts** — do not re-point at them.
+
+  - **`@object-ui/types` no longer re-exports `NotificationAction` or `EmbedConfig`**
+    (objectstack#5015, PR objectstack#5300). Both were published `ui` vocabulary with
+    no authoring door; no notification action was ever parsed from metadata and no
+    iframe route ever read an embed config. The presentation enums
+    (`NotificationType` / `NotificationSeverity` / `NotificationPosition`) and
+    `SharingConfig` **survive** and are untouched — public form sharing still gates
+    the anonymous endpoints on `allowAnonymous` + `publicLink`.
+    `@object-ui/core`'s `SharingProtocol` keeps `resolveEmbedConfig` /
+    `generateEmbedCode` against a locally declared `EmbedConfig`, so its surface is
+    unchanged.
+  - **`ThemeEngine` stops emitting nine retired CSS variable groups**
+    (objectstack#5021 option 2, PR objectstack#5289). `theme.animation`,
+    `theme.zIndex` and five typography groups (`fontSize` / `fontWeight` /
+    `lineHeight` / `letterSpacing`, plus `fontFamily.heading` / `fontFamily.mono`)
+    are tombstones the schema now rejects by name, so `--duration-*`, `--timing-*`,
+    `--z-*`, `--font-size-*`, `--font-weight-*`, `--line-height-*`,
+    `--letter-spacing-*`, `--font-heading` and `--font-mono` had become structurally
+    dead code — no author could produce the input that reached them.
+    `generateAnimationVars` and `generateZIndexVars` are removed from
+    `@object-ui/core`, and `@object-ui/types` drops `Animation` / `ZIndex` /
+    `AnimationSchema` / `ZIndexSchema`. **`theme.customVars` is the declared — and
+    since #5021 the only — door**: each entry is emitted verbatim as
+    `--<key>: <value>`, so a `--z-modal` or a `--duration-fast` goes there now.
+    LIVE emission is untouched byte for byte: `colors`, `borderRadius`, `shadows`,
+    `typography.fontFamily.base` (→ `--font-sans`) and `customVars`.
+  - **`@object-ui/types`' `HttpMethodSchema` now binds the spec's
+    `HttpMethodSubsetSchema`, and `HttpMethod` binds `HttpMethodSubset`**
+    (objectstack#5832, PR objectstack#5976 — objectui#3499). The spec renamed its
+    5-value UI subset because `schemaNameFromExportKey` strips the `Schema` suffix,
+    so the 5-value and 7-value enums both published as `shared/HttpMethod` and the
+    later write won — the emitted JSON Schema and reference page described only one
+    of them. **The runtime domain is unchanged and this repo's exported names are
+    unchanged**; this follows the rename without touching cross-package semantics.
+    Deliberately NOT re-pointed at the spec's bare `HttpMethod`: that is the 7-value
+    enum, and widening to it would let `method: 'HEAD'` compile and then throw in
+    `HttpRequestSchema.parse()`.
+  - **`dashboard.widgets[].actionUrl` / `actionType` / `actionIcon` / `aria` are
+    refused, not stripped** (objectstack#5010, ADR-0049 enforce-or-remove). A
+    dashboard widget has no action button and never had one — every action the
+    dashboard dispatches comes from `header.actions[]` — and no renderer ever applied
+    the widget `aria`, so it promised accessibility compliance it did not deliver.
+    A stale dashboard now gets a named error telling it where the affordance moved,
+    instead of silently losing it. Run `os migrate meta --from 16` to rewrite.
+
+- e6fdbdc: Reclaim the natural names `GestureType` and `GestureConfig` (objectui#3363).
+
+  `@objectstack/spec` 17.0.0-rc.3 deleted the whole `ui/touch` module
+  (objectstack#4988, PR objectstack#5321), vacating three names objectui had
+  renamed **away from** in objectstack#4115 purely to avoid a collision. Two of
+  those workarounds have now outlived their reason and are undone.
+
+  ## Breaking, in FROM → TO form
+
+  - `TouchGestureType` → **`GestureType`** — objectui's direction-fused recogniser
+    vocabulary (`tap`, `swipe-left`, `swipe-up`, …).
+  - `TouchGestureConfig` → **`GestureConfig`** — the flat gesture→`action` handler
+    binding.
+
+  Both are exported from `@object-ui/types` and re-exported by `@object-ui/mobile`.
+  Nothing about either shape changed: same members, same optionality. Consumers
+  import the new name; there is no other edit.
+
+  **The old names are gone, not deprecated.** This follows the precedent set by the
+  objectstack#4115 rename batch that introduced them, whose own migration note reads:
+  "an alias would preserve exactly the ambiguity being removed". A deprecated alias
+  would be worse here than in the general case, because the ambiguity these renames
+  exist to prevent is between two same-named types — leaving `TouchGestureType`
+  alive next to `GestureType` restores the two-spellings-one-concept problem while
+  claiming to retire it.
+
+  The retired spec vocabulary that used to hold these names still lives in
+  `@object-ui/types`' `mobile` module under its deliberate `Spec…` prefix
+  (`SpecGestureType`, `SpecGestureConfig`, `SwipeGestureConfig`, …), and that prefix
+  is untouched — it is now the only thing distinguishing the two contracts, so
+  `useSpecGesture` still maps one onto the other exactly as before.
+
+  ## `PWAOfflineConfig` is deliberately NOT reclaimed
+
+  The spec vacated `OfflineConfig` in the same retirement, but the spec was never
+  its only claimant: that rename was a **cross-package arbitration between two
+  objectui packages**, and `@object-ui/react` won it. `useOffline`'s config is the
+  offline data/sync model key for key, so it holds the bare `OfflineConfig`, while
+  this package's service-worker route cache stays `PWAOfflineConfig`
+  (objectui#3156 / objectui#3159).
+
+  Before objectui#3560 that name reached `@object-ui/react` from the spec, so the
+  spec-side tripwire covered it by accident. Since the retirement it is declared
+  locally in `packages/react/src/hooks/useOffline.ts`, which means the spec's
+  vacancy no longer says anything about whether the name is free — it is not.
+  Reclaiming it would put two different `OfflineConfig` shapes on the public
+  surface of two packages that are routinely imported together, which is the exact
+  ambiguity objectstack#4115 renamed it away from.
+
+  `page-nav-misc-spec-parity.test.ts` now pins that reason directly instead of
+  leaving it as prose: it asserts `@object-ui/react` still declares
+  `OfflineConfig`, and its failure message tells the next reader that the reclaim
+  has become available if it ever stops.
+
+### Patch Changes
+
+- d229dfa: `BulkActionParam.options` entries now accept the widget config the renderer already forwards
+
+  The entry type was a closed `{ label, value }`, and it was the only layer in the
+  path that said so. `bulkParamToField` spreads each entry into the metadata it
+  hands the field widget (`{ ...o, value: String(o.value) }`), so extra keys
+  survive; the destination shape `SelectOptionMetadata` declares `color` / `icon` /
+  `disabled` / `visibleWhen` and `@object-ui/fields` genuinely reads them; and
+  `@objectstack/spec`'s `BulkActionParamSchema` makes the same entry
+  `.passthrough()`, so the server accepts them. Writing
+  `options: [{ label: 'Purple', value: 'purple', color: '#8B5CF6' }]` therefore
+  produced a TypeScript excess-property error on a configuration the renderer
+  honours — the type rejected working metadata, which is the most expensive
+  direction for an author (an AI author especially) that trusts it absolutely.
+
+  The entry now carries a `[key: string]: unknown` catch-all, matching the one its
+  parent `BulkActionParam` has had all along and the idiom `ActionParamOption`
+  settled one interface over. `label` and `value` stay required and keep their
+  exact types: open is not optional, and the catch-all is not an invitation to
+  author new option keys — the authoring gate remains the spec's strict
+  `SelectOptionSchema`. No runtime behaviour changes; the widening is
+  backward-compatible for consumers.
+
+- c2fd122: fix(actions): forward `bodyShape` end-to-end so a declared body wrap is honoured
+
+  Sibling of the `bodyExtra` fix, same failure shape one key over. `bodyShape` is
+  the spec's body-WRAPPING declaration for a `type: 'api'` action — `'flat'` (the
+  default) or `{ wrap: key }` to nest the collected params under `key`, the shape
+  better-auth's `organization/update` needs. The console `apiHandler` read it
+  unconditionally while **no** action renderer forwarded it, so an author who
+  declared `bodyShape: { wrap: 'data' }` on an `action:button` / `:group` / `:icon`
+  / `:menu` action got a FLAT body on the wire: the endpoint received the params at
+  the top level, and the declaration read as honoured because it parsed and
+  published.
+
+  The four declared-action renderers now forward the key, and `ActionSchema`
+  declares it (typed by derivation from the spec, so the union cannot drift).
+  `ActionRunner.executeAPI` — the fallback path taken when no host registered an
+  `api` handler — now reads it too, closing a second asymmetry in which the same
+  action changed body shape depending on which host executed it. The wrap covers
+  the collected params only; `bodyExtra` and other top-level keys stay flat, which
+  is the spec's own wording for the key and what both console read-sites already
+  did.
+
+  `element:button` deliberately does **not** forward it: its whitelist mirrors
+  spec's `InlineActionSchema` pick list field for field, and that pick list does
+  not include `bodyShape` — it is not inline vocabulary.
+
+- 7e5bb5d: fix(actions): forward `bodyExtra` end-to-end through the action chain
+
+  An action's static request body (`bodyExtra`) was dropped one hop before the
+  `ActionRunner`: every action renderer forwards an explicit whitelist of keys, and
+  none of them listed `bodyExtra`. Since `@objectstack/spec` 17 made it the only way
+  a `type: 'api'` action can carry a payload (`params` keeps its single meaning as
+  the parameter definition array), and the ADR-0087
+  `inline-action-api-params-to-body-extra` conversion rewrites older object-form
+  `params` pages onto it at load, a previously-working published page validated,
+  published and then POSTed an empty body.
+
+  `element:button`, `action:button`, `action:group`, `action:icon` and `action:menu`
+  now forward the key; `ActionRunner.executeAPI` merges it into the request body
+  **last** (so a constant always overrides a same-named user param, matching the
+  console `apiHandler`); `ActionSchema` declares it; and a non-array `params` on a
+  `type: 'api'` action keeps working for one version window with a dev-mode
+  deprecation warning naming `bodyExtra`.
+
+- 7e2b7e9: Fix saved list-view preferences never reading back (density, column widths, sort, hidden columns, inline edit)
+
+  `listViewOverrides` in the ObjectStack adapter enumerated `GET /api/v1/meta/{objectName}` — putting the object name in the metadata **type** slot — while `updateViewConfig` persists under `type='view'`. The two key spaces are disjoint, so the batch map came back empty for every object and every personalization a user saved on a list view was written to the server but never read back, showing up as "the setting didn't save".
+
+  The read now enumerates `type='view'` once and narrows to the object client-side, through the same accessor `listViews()` uses over the same rows — the metadata index is name-only, so there is no server-side `?object=` filter to push it into.
+
+  Second half: the batch read no longer swallows its own failures into an empty map. An empty map is an authoritative "this object has no overrides" and callers may still trust it and skip the per-view reads (the batch optimization is intact), but a transport failure now rejects, so the per-view `getView` fallback it was silently disabling becomes reachable again. `DataSource.listViewOverrides` documents both terms so other adapters implement the same contract.
+
+- c1e1e6b: Studio's widget config panel no longer authors the retired `actionUrl` widget key
+
+  `actionUrl` / `actionType` / `actionIcon` were retired at the WIDGET level in
+  `@objectstack/spec` 17.0.0-rc.3 (objectstack#5010, ADR-0049 D2). They are
+  `retiredKey` tombstones: `DashboardWidgetSchema` types them `never` and refuses
+  any value, so authoring one is a tsc error and a parse error. Two producers in
+  `plugin-dashboard` were still emitting the widget-level key anyway
+  (objectstack#7129):
+
+  - `WidgetConfigPanel` offered a Behavior-group field labelled "Click-through
+    URL", bound to `actionUrl`. That control was inert twice over: no dashboard
+    widget renderer has ever read `widget.actionUrl`, so a URL typed there never
+    navigated anywhere, and the value it wrote was refused by the spec.
+  - `DashboardWithConfig` seeded `actionUrl: widget.actionUrl ?? ''` into every
+    widget config handed to the panel. Because the ADR-0021 save scrub only knew
+    the dataset-shape keys, that seed rode through to `onWidgetSave` on EVERY
+    save — so a Studio author who merely renamed a widget still persisted
+    `actionUrl: ''` into stored metadata, a key the spec then refuses. This is
+    the wider half of the defect: it did not require anyone to use the field.
+
+  The Behavior group and the seed are both gone, and `sanitizeDraftForType` now
+  scrubs all three keys as a second line of defence, for stored widgets that
+  already carry them and for hosts that drive `WidgetConfigPanel` directly.
+
+  Behaviour change surface: the widget config panel loses its Behavior section
+  (that section contained only this one field). Nothing that rendered before stops
+  rendering — the field had no consumer. `header.actions[]` keeps its own,
+  unrelated and still-live `actionUrl`; only the widget-level key is a tombstone.
+
+  Also corrects the `DashboardWidgetSchema` docblock in `@object-ui/types`, which
+  listed the three retired keys among those that "flow in from the spec" next to
+  live keys like `colorVariant`. They do flow in — as `?: never`. The docblock now
+  says so, and notes that while authoring one is a tsc error, _reading_ one still
+  type-checks (`never | undefined`), which is exactly how these producers survived
+  the 2026-08-04 sweep that removed the renderer-side reads.
+
 ## 17.3.0
 
 ### Minor Changes
@@ -2891,6 +3160,7 @@ colorField, scale }` arrived with only `titleField` and an axis pinned to the
 - 991b62d: Add `compareTo` field to dashboard widgets for period-over-period
   comparison. Supports `'previousPeriod'`, `'previousYear'`, and
   `{ offset: '7d' | '4w' | '1M' | '1y' }`.
+
   - **Metric / gauge widgets** now compute a delta percentage when `compareTo`
     is set and surface it as a derived `trend` (auto-labelled via
     `dashboard.trend.vsLast*` i18n keys sniffed from the filter macros).
@@ -2991,6 +3261,7 @@ colorField, scale }` arrived with only `titleField` and an axis pinned to the
 
   Extract the bulk-vs-per-row decision into a reusable
   `executeBulkBatch(input, ops)` helper in `@object-ui/core`:
+
   - Single decision tree shared by both update and delete fast paths.
   - Bulk success → no per-row pass.
   - Bulk partial-count → aggregate batch error.
@@ -3026,6 +3297,7 @@ colorField, scale }` arrived with only `titleField` and an axis pinned to the
 ### Minor Changes
 
 - cf30cc2: Polish Lightning record detail page layout.
+
   - `record:details` sections now render with Card chrome by default when a `title` is present, restoring visual grouping that was missing on pages like the opportunity detail page.
   - Section labels can be translated via the `{ns}.objects.{objectName}._sections.{name}.label` convention. Author each section with a stable `name` (e.g. `info`, `forecast`) and the renderer picks up the locale-specific label automatically. Falls back to the literal `label` when no translation exists.
   - The `page:header` action toolbar now collapses into a `⋯` overflow menu when more than two actions are present. The first business action stays inline; secondary system actions (Edit / Share / Delete) move into the menu, with destructive styling applied to Delete.
@@ -3043,6 +3315,7 @@ colorField, scale }` arrived with only `titleField` and an axis pinned to the
   multi-user editing scenarios.
 
   **`@object-ui/data-objectstack`**
+
   - Exports `ConcurrentUpdateError` (carries `currentVersion` and
     `currentRecord`) and `isConcurrentUpdateError()` type guard.
   - `update()` / `delete()` accept `opts.ifMatch` and forward it via the
@@ -3055,6 +3328,7 @@ colorField, scale }` arrived with only `titleField` and an axis pinned to the
     from conflicts without parsing the wire format.
 
   **`@object-ui/core`**
+
   - `ApiDataSource.update()` and `.delete()` accept `opts.ifMatch` and emit
     the `If-Match` HTTP header.
 
@@ -3078,6 +3352,7 @@ colorField, scale }` arrived with only `titleField` and an axis pinned to the
   customize the header or one tab.
 
   **Slot menu (v1):**
+
   - `header` — replaces `page:header`
   - `actions` — replaces the `record:quick_actions` action bar
   - `highlights` — replaces the chips + chevron path strip
@@ -3105,6 +3380,7 @@ colorField, scale }` arrived with only `titleField` and an axis pinned to the
   ```
 
   **API changes:**
+
   - `PageSchema` (in `@object-ui/types`): adds `kind?: 'full' | 'slotted'`
     (default `'full'`) and `slots?: PageSlotMap`.
   - `usePageAssignment` (in `@object-ui/react`): result now exposes a
@@ -3190,6 +3466,7 @@ colorField, scale }` arrived with only `titleField` and an axis pinned to the
 - Release v4.0.0: Unified app shell, convention-based i18n, and plugin architecture overhaul.
 
   ### Major Changes
+
   - **`@object-ui/app-shell`**: New unified application shell with sidebar, breadcrumb, and dashboard wiring.
   - **`@object-ui/providers`**: Promoted to first-class fixed package; new `DataSourceProvider` and `ThemeProvider` APIs.
   - **Convention-based i18n** (`@object-ui/i18n`): `useObjectLabel` now covers nav groups, dashboards, pages, reports, charts, and field options — zero-config localisation via translation packs.
@@ -3210,6 +3487,7 @@ colorField, scale }` arrived with only `titleField` and an axis pinned to the
   contract through the renderer end-to-end:
 
   **`@object-ui/types`** — `DataSource` gains four optional methods:
+
   - `createExportJob(resource, request)` → `{ jobId, status, estimatedRecords, createdAt }`
   - `getExportJobProgress(jobId)` → `{ status, processedRecords, totalRecords, percentComplete, downloadUrl, … }`
   - `cancelExportJob(jobId)` (optional)
@@ -3219,6 +3497,7 @@ colorField, scale }` arrived with only `titleField` and an axis pinned to the
   remain dependency-free.
 
   **`@object-ui/components`** — new public API:
+
   - `useExportJob({ dataSource, pollIntervalMs, onComplete, onError })` — owns the
     full polling loop, terminal-state handling, cancel, and download.
   - `<ExportProgressDialog open onOpenChange job filename closeAfterDownloadMs />` —
@@ -3256,11 +3535,13 @@ colorField, scale }` arrived with only `titleField` and an axis pinned to the
   `FormSchema.mobileStickyActions` (new) is the lower-level escape hatch — applied automatically when `mobile.stickyActions` is set on `ObjectFormSchema`.
 
   **`@object-ui/plugin-form`** — `ObjectForm` now:
+
   - propagates `mobile.fullscreenLongText` to every textarea/markdown/html field as `mobile_fullscreen: true`,
   - sets `mobileStickyActions` on the inner form schema and adds `pb-20` padding so content isn't covered by the fixed bar,
   - when `mobile.stepper === true` (or `'auto'` + `useIsMobile()` + > `stepperMinFields` fields), routes the flat field list through the existing `WizardForm` with synthetic single-field "steps" — keeping per-step validation and the existing `Next`/`Back`/`Submit` flow.
 
   **`@object-ui/components`** — the registered `form` renderer adds:
+
   - a `mobileStickyActions` opt-in that turns the action row into a `position: sticky; bottom: 0` bar on small viewports, and
   - an inline `FullscreenTextarea` wrapper used when no field-package widget is registered, providing the same expand-button + edit-dialog UX so the feature works even in lighter setups.
 
@@ -3327,6 +3608,7 @@ colorField, scale }` arrived with only `titleField` and an axis pinned to the
 - New plugin-object and ObjectQL SDK updates
 
   **Added:**
+
   - New Plugin: @object-ui/plugin-object - ObjectQL plugin for automatic table and form generation
     - ObjectTable: Auto-generates tables from ObjectQL object schemas
     - ObjectForm: Auto-generates forms from ObjectQL object schemas with create/edit/view modes
@@ -3335,6 +3617,7 @@ colorField, scale }` arrived with only `titleField` and an axis pinned to the
   - ObjectQL Integration: Enhanced ObjectQLDataSource with getObjectSchema() method using MetadataApiClient
 
   **Changed:**
+
   - Updated @objectql/sdk from ^1.8.3 to ^1.9.1
   - Updated @objectql/types from ^1.8.3 to ^1.9.1
 
@@ -3345,6 +3628,7 @@ colorField, scale }` arrived with only `titleField` and an axis pinned to the
 - Patch release: Add automated changeset workflow and CI/CD improvements
 
   This release includes infrastructure improvements:
+
   - Added changeset-based version management
   - Enhanced CI/CD workflows with GitHub Actions
   - Improved documentation for contributing and releasing
diff --git a/packages/types/package.json b/packages/types/package.json
index 9c41ca2198..e8178996c7 100644
--- a/packages/types/package.json
+++ b/packages/types/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/types",
-  "version": "17.3.0",
+  "version": "17.4.0",
   "description": "Pure TypeScript type definitions for Object UI - The Protocol Layer",
   "type": "module",
   "sideEffects": false,
diff --git a/packages/vscode-extension/CHANGELOG.md b/packages/vscode-extension/CHANGELOG.md
index 4cda044682..d0100c86cd 100644
--- a/packages/vscode-extension/CHANGELOG.md
+++ b/packages/vscode-extension/CHANGELOG.md
@@ -1,5 +1,30 @@
 # Changelog
 
+## 17.4.0
+
+### Patch Changes
+
+- Updated dependencies [6719877]
+- Updated dependencies [56ff091]
+- Updated dependencies [d229dfa]
+- Updated dependencies [4bc6c23]
+- Updated dependencies [c3b01a7]
+- Updated dependencies [e06810e]
+- Updated dependencies [ab3ad4f]
+- Updated dependencies [c2fd122]
+- Updated dependencies [48132f7]
+- Updated dependencies [1d723e3]
+- Updated dependencies [0109f54]
+- Updated dependencies [7e5bb5d]
+- Updated dependencies [fbc23e0]
+- Updated dependencies [e6fdbdc]
+- Updated dependencies [6bb454a]
+- Updated dependencies [523be48]
+- Updated dependencies [7e2b7e9]
+- Updated dependencies [c1e1e6b]
+  - @object-ui/core@17.4.0
+  - @object-ui/types@17.4.0
+
 ## 17.3.0
 
 ### Patch Changes
diff --git a/packages/vscode-extension/package.json b/packages/vscode-extension/package.json
index c5fafdf305..bb07ebed0d 100644
--- a/packages/vscode-extension/package.json
+++ b/packages/vscode-extension/package.json
@@ -2,7 +2,7 @@
   "name": "object-ui",
   "displayName": "Object UI",
   "description": "VSCode extension for Object UI - Schema-driven UI development with IntelliSense, validation, and live preview",
-  "version": "17.3.0",
+  "version": "17.4.0",
   "publisher": "objectui",
   "private": true,
   "icon": "icon.svg",