@@ -0,0 +1,13 @@
+---
+'@objectstack/metadata-core': patch
+---
+
+Clause-②: no
+
+The `source` describe on `MetadataEventSchema` no longer lists `"fs"`, `"studio"`, `"rest"`, `"ai"` and
+`"git-import"` as origin labels: of those, only `fs` is written by any producer (`FileSystemRepository`),
+and no write path stamps an authoring surface there. It now says what the field is: the write path that
+produced the event, an open label its writer stamps rather than an enum to pick from or match against, for
+example `protocol.saveMetaItem`, `protocol.publishMetaItem`, `migrate-stored`, `sys-metadata-repo`
+(`SysMetadataRepository`'s default) or `fs`. The field stays `z.string()`, so no key, type, export or
+accepted value changes, and every repository emits exactly what it emitted before.
@@ -0,0 +1,31 @@
+---
+'@objectstack/objectql': minor
+'@objectstack/lint': minor
+---
+
+fix(objectql,lint)!: a `conditional` validation rule's `when` reads one hop through a reference, the way a rule's `condition` does
+
+Clause-②: no (narrowing)
+
+<!-- adr-0087: not-required (no-migration-prescription) No spec key, stored shape, export or authorable spelling is added, removed or renamed, so there is nothing for `objectstack migrate meta` to rewrite. A rule keeps its authored shape. What changes is how a `conditional` rule's `when` is judged: the engine now serves it one hop through a reference (it read the bare id before), and the validation-rule pass judges its hops as it judges a `condition`'s. Both narrow: the save door refuses four `when` shapes it accepted, and the runtime refuses a write it judged on an empty reference under a null-safe `when`. -->
+
+**BREAKING** (an accept-set narrowing, at the save door and at write time), shipped as `minor` under the launch-window convention for breaking changes.
+
+A `conditional` rule's `when` that reads through a lookup (`record.account.status == 'active'`) now works. The engine loads the related row for it, as it does for a `script` or `cross_field` rule's `condition`, and `when` picks `then` or `otherwise` on that row. Before, `when` met the stored id, so the read faulted and every write the rule guarded was refused with "The when-predicate reads 'status', which this object does not declare". A `when` nested in a `then` or `otherwise` is served the same way. A sibling rule keeps its own verdict when a `when` cannot be evaluated.
+
+`@objectstack/objectql`, at write time:
+
+- FROM: `when: record.account.status == 'active'` refused every write it guarded as unevaluable. TO: it is judged on the related row.
+- FROM: a null-safe spelling (`record.account.?status.orValue('') == 'active'`, `has(record.account.status) && …`) read the stored id and silently took `otherwise` for every account. TO: it is judged on the related row.
+- FROM: on a write whose reference is empty, a null-safe `when`, or one that tests `record.account != null` in the same expression, evaluated to false and judged `otherwise`. TO: the write is refused (`400 VALIDATION_FAILED`, `_record` `rule_violation`), as a `condition` reading through an empty reference is. The refusal names the guard.
+- A `when` that reads a second hop, a field the related object does not declare, or the reference both through it and as a value is refused with a sentence that names the related object and field, instead of the generic one. A `when` that faults on a delete's reference cleanup names the delete, as a `condition` does.
+- The guard spelling `when: record.account != null` reads the stored id, as before.
+
+`@objectstack/lint`, where a rule is written: `os validate`, `os build` and the object save door (`PUT /api/v1/meta/object/:name`) run the same pass, under the existing `EXPRESSION_INVALID` rule. They now judge a `when`, top level and nested, with the checks a `condition` gets. Each of these saved before (`200`) and is refused now (`422 INVALID_METADATA` at the save door), located at the `when` slot. At run time each refused every write it guarded, and the third also took `otherwise` on an empty reference:
+
+- FROM: a second hop (`record.account.owner.email != null`), saved. TO: refused.
+- FROM: a field the target does not declare (`record.account.region == 'north'`), saved. TO: refused, "unknown field `region` on `<target>`".
+- FROM: the reference read both through it and as a value (`record.account != null && record.account.status == 'active'`), saved. TO: refused, naming the guard.
+- FROM: a hop into a stored-metadata-body table, saved. TO: refused.
+
+What to do. To skip a rule while the reference is empty, keep the reference test in its own `when` and nest the rule that reads through it: a `conditional` whose `when` is `record.account != null`, with your `conditional` as its `then`. To refuse an empty reference, make the field `required: true`. Read a field the target declares, and read one hop.
@@ -0,0 +1,18 @@
+---
+'@objectstack/plugin-audit': patch
+'@objectstack/plugin-sharing': patch
+---
+
+fix(plugin-audit, plugin-sharing): record pages, the `by_object` grouping and the Config list no longer name the target object by its API name
+
+Clause-②: no
+
+- **A record share's title is its recipient.** `sys_record_share` declares `nameField: 'recipient_id'`. It declared no title pointer, so the registry derived `object_name` (the first `*_name` text field), and a record share's page heading read the shared record's object API name, such as `showcase_announcement`. Its `titleFormat` is removed: the declared pointer outranks it everywhere.
+- **A share link's title is its label, else what it grants.** `sys_share_link` declares `nameField: 'label'`, the field the registry already derived. A link with no label is titled by `titleFormat: '{permission} · {audience}'` (for example "View · Anyone with the link") instead of `{object_name}/{record_id} ({permission})`.
+- **`sys_audit_log` drops its `titleFormat`.** It read `{action} · {object_name}`, but the required `action` pointer outranks it, so it never titled a row.
+- **The strip lists neither half of the pointer pair.** `highlightFields` no longer lists `object_name` or `record_id` on the three objects. The record page's strip drew them as stored text, an API name and a raw id. A strip field is also hidden from the Details tab, which is where `record_id` draws as the record card, headed by the target object's label.
+- **`sys_record_share.by_object` sorts by object instead of grouping on it.** A group header drew `object_name` as stored text. The sort still keeps one object's grants together.
+- **`sys_audit_log.config_changes` drops its Object column.** Its rows carry no `record_id`, so the column drew a stored API name (`sys_setting`, `sys_platform_setting` or `sys_user`) with no record beside it.
+- **Unchanged:** `object_name` stays a declared field on all three objects, and the pointer pair, its indexes and every query on it are untouched. On the record page, the Details tab still shows `object_name` as a row of its stored text.
+
+A patch: title and highlight declarations and list view keys change on shipped platform objects. No export, type, accepted value, stored column or authorable key changes.
@@ -0,0 +1,10 @@
+---
+'@objectstack/metadata-protocol': patch
+---
+
+fix(metadata-protocol): a seed replay no longer rewrites every seeded row that carries a password or secret field on every boot
+
+Clause-②: no (a replay comparison: no accept set, served body or masking verdict moves; the loader takes no new read and never sees a stored credential)
+
+- **What changed.** A replay reads the existing rows through `engine.find`, which serves a set `secret` field, and a set `password` field on an object not managed by better-auth, as `SECRET_MASK` in every context (ADR-0100). The replay compared the seed's plaintext with that mask, read the row as changed and rewrote it on every boot: `updated_at` moved, lifecycle validation ran again and history could record an edit nobody made. A field the object declares masked on read (asked of `isMaskedOnReadFieldType`, the same declaration the engine's own mask reads) now never blocks the skip while the existing row reads back the mask.
+- **What a seed author sees.** A seed change to ONLY such a field is not applied on replay. Change another field of the same row as well (the rewrite then writes the whole seeded record, the new credential included), or rebuild the database. Setting a credential on a row that has none, or clearing one, is still written: an unset credential reads back `null`, not the mask. A load that skipped a row without comparing a credential says so in one `info` line naming the fields and both remedies.
@@ -0,0 +1,18 @@
+---
+'@objectstack/objectql': patch
+---
+
+fix(objectql): a `runAs: 'user'` hook now carries the acting user's email, so a `current_user.email` row policy admits it as it admits the same user's own request
+
+A hook declaring `runAs: 'user'` is pinned to the triggering user, and the pinned context is seeded with the user's grants and organization peer list through the resolver the request path uses (`resolveUserAuthzGrants` from `@objectstack/core`). That seed never took the user's email, although the same resolution returns it. When the triggering write carried a hand-built system context such as `{ isSystem: true, userId, tenantId }` (the approvals status mirror and a `runAs: 'system'` flow's writes are shipped producers), the pinned context carried no `email`. Every row policy keyed on `current_user.email` (for example `assignee == current_user.email`) therefore dropped out, and the hook's `ctx.api` reads returned no rows where the same user's request returns theirs. It failed closed: rows were hidden, never leaked.
+
+The seed now carries the email too:
+
+- A pinned context with no `email` takes the user's stored email (`sys_user.email`), from the user-row read the resolution already makes, which is the fallback the request path uses.
+- An email the context already carries, such as a session's on a request-resolved context, is kept exactly as it was.
+- A context that carries `permissions` and a peer list but no email is no longer handed through unseeded: it resolves once and takes the email alone. Its positions, permission sets and peer list stay exactly as they were.
+- A user with no stored email (a phone-only sign-up) still carries none, and email-keyed policies still drop out for them, as on their own request.
+
+`runAs: 'inherit'` (the default) and `runAs: 'system'` are unchanged, and a `runAs: 'user'` hook whose trigger names no user is still refused with `HOOK_UNSCOPED_DATA_ACCESS`. A `runAs: 'user'` hook fired from a context that lacks the email now pays one grants resolution per dispatch, as one that lacks either list already did. If the resolver fails, the hook runs on the unseeded pin and a warning names the policies that drop out.
+
+Clause-②: no
@@ -39,8 +39,8 @@
  * down, in `os build` and at this door alike. The pass now runs the same
  * `check()` on every nested predicate, at the location the null-guard gate
  * already gives it (`validation rule 'outer' then → 'inner'`), with the
- * relationship-traversal checks on a nested `condition` (ObjectQL hydrates it)
- * and not on a nested `when` (it does not). The second describe block below
+ * relationship-traversal checks on a nested `condition` and — since #24512 —
+ * on a nested `when` (ObjectQL hydrates both). The second describe block below
  * pins it; its protocol half is the #22042 block of the same protocol file.
  */
 import { describe, expect, it } from 'vitest';
@@ -236,7 +236,7 @@ const fxRef = (validations: unknown[]) => {
   const base = fxRule(validations);
   return { ...base, fields: { ...base.fields, account: { type: 'lookup', label: 'Account', reference: 'fx_rule' } } };
 };
-/** Reads more than one relationship hop — a shape `checkPredicate` refuses, and `checkConditional` never judges. */
+/** Reads more than one relationship hop — a shape `checkPredicate` and (#24512) `checkConditional` refuse. */
 const MULTI_HOP = 'record.account.owner.email != null';
 const HYDRATION = {
   type: 'conditional',
@@ -311,16 +311,21 @@ describe('#22042 — a `conditional` rule\'s nested predicates meet the same ver
     ]);
   });
 
-  it('the traversal checks follow the evaluator per slot: ON for a nested `condition`, OFF for a nested `when`', () => {
+  it('the traversal checks follow the evaluator per slot: ON for a nested `condition` and, since #24512, a nested `when`', () => {
     const atBuild = buildFindings(fxRef([HYDRATION]));
 
-    // `checkPredicate` refuses a read deeper than one hop at any depth, so the build says so…
-    expect(atBuild.map((f) => f.where), dump(atBuild)).toEqual(["object 'fx_rule' · validation rule 'outer' then → 'inner'"]);
-    expect(atBuild[0]!.message).toContain('ONE hop');
-    // …and `checkConditional` never hydrates a `when`, so the same source there earns no
-    // traversal prescription — exactly as the top-level `when` site is opted out.
+    // `checkPredicate` refuses a read deeper than one hop at any depth, and
+    // `checkConditional` evaluates a `when` on the same hydrated scope, so the
+    // build says so for both slots…
+    expect(atBuild.map((f) => f.where), dump(atBuild)).toEqual([
+      "object 'fx_rule' · validation rule 'outer' then → 'inner'",
+      "object 'fx_rule' · validation rule 'outer' otherwise → 'mid' when-predicate",
+    ]);
+    for (const f of atBuild) expect(f.message).toContain('ONE hop');
+    // …and at the top-level `when` site too.
     const topWhen = buildFindings(fxRef([{ ...HYDRATION, when: MULTI_HOP, then: NESTED_VALID.otherwise, otherwise: undefined }]));
-    expect(topWhen, dump(topWhen)).toEqual([]);
+    expect(topWhen.map((f) => f.where), dump(topWhen)).toEqual(["object 'fx_rule' · validation 'outer' when"]);
+    expect(topWhen[0]!.message).toContain('ONE hop');
     expect(expressionFindings(gateObject(fxRef([HYDRATION])).errors)).toEqual(atBuild);
   });
 
@@ -382,3 +387,68 @@ describe('#24468 — the object door refuses a rule hop to a field the target do
     expect(expressionFindings(result.advisories), dump(result)).toEqual([]);
   });
 });
+
+describe('#24512 — the object door judges a `conditional` rule\'s `when` hop as it judges a `condition`\'s', () => {
+  /** The lookup's target, delivered by ANOTHER package the written one depends on. */
+  const account = {
+    name: 'fx_account', label: 'Account', sharingModel: 'private', _packageId: 'com.example.accounts',
+    fields: { status: { type: 'text', label: 'Status' } },
+  };
+  const order = (validations: unknown[]) => ({
+    name: 'fx_order',
+    label: 'Order',
+    sharingModel: 'private',
+    fields: {
+      amount: { type: 'number', label: 'Amount' },
+      account: { type: 'lookup', label: 'Account', reference: 'fx_account' },
+    },
+    validations,
+  });
+  const gate = (when: string, name = 'gate') => ({
+    type: 'conditional', name, when, message: 'x',
+    then: { type: 'script', name: 'cap', condition: 'record.amount != null && record.amount > 100', message: 'y' },
+  });
+  const gateOrder = (validations: unknown[]) => runRuntimeAuthoringRules({
+    type: 'object',
+    item: order(validations),
+    context: { objects: [account] },
+    packageScope: { packageId: 'com.example.orders', dependencies: ['com.example.accounts'] },
+  });
+
+  it('the fixtures are spec-valid: each refusal below is the expression verdict, not the schema\'s', () => {
+    for (const when of ["record.account.region == 'north'", 'record.account.owner.email != null', "record.account.status == 'open'"]) {
+      const parsed = ObjectSchema.safeParse(order([gate(when), { type: 'conditional', name: 'outer', when: 'record.amount != null', message: 'x', then: gate(when, 'inner') }]));
+      expect(parsed.success, dump(parsed.error?.issues)).toBe(true);
+    }
+  });
+
+  it('⭐ LIT — a `when` reading a field the target does not declare is REFUSED under EXPRESSION_INVALID, naming the slot, the field and the target', () => {
+    const result = gateOrder([gate("record.account.region == 'north'")]);
+
+    const errs = expressionFindings(result.errors);
+    expect(errs, dump(result)).toHaveLength(1);
+    const where = "object 'fx_order' · validation 'gate' when";
+    expect(errs[0]).toMatchObject({ rule: EXPRESSION_INVALID, severity: 'error', where, path: where });
+    expect(errs[0]!.message).toContain('unknown field `region` on `fx_account`');
+    expect(errs[0]!.message).toContain('the rule has no verdict');
+  });
+
+  it('⭐ LIT — a `when` reading a second hop is REFUSED, and a nested `when` is judged too', () => {
+    const result = gateOrder([{
+      type: 'conditional', name: 'outer', when: 'record.amount != null', message: 'x',
+      then: gate('record.account.owner.email != null', 'inner'),
+    }]);
+
+    const errs = expressionFindings(result.errors);
+    expect(errs.map((e) => e.where), dump(result)).toEqual(["object 'fx_order' · validation rule 'outer' then → 'inner' when-predicate"]);
+    expect(errs[0]).toMatchObject({ rule: EXPRESSION_INVALID, severity: 'error' });
+    expect(errs[0]!.message).toContain('ONE hop');
+  });
+
+  it('⭐ CONTROL — a `when` reading a field the target declares publishes clean', () => {
+    const result = gateOrder([gate("record.account.status == 'open'")]);
+
+    expect(expressionFindings(result.errors), dump(result)).toEqual([]);
+    expect(expressionFindings(result.advisories), dump(result)).toEqual([]);
+  });
+});