@@ -0,0 +1,11 @@
+---
+'@objectstack/service-knowledge': patch
+---
+
+fix(service-knowledge): the realtime event bridge no longer keeps a `record.created` / `record.updated` / `record.deleted` branch, and its docs name the events ObjectQL really publishes (#20573)
+
+No producer emits a bare `record.*` event: the ObjectQL engine publishes `data.record.created` / `data.record.updated` / `data.record.deleted` for a single-record write and `data.records.updated` / `data.records.deleted` for a predicate write (`multi: true`), and `@objectstack/spec` already dropped the bare names from `RealtimeEventType`. The `KnowledgeServicePlugin` subscription handler still carried a branch for them, with a `payload.record ?? payload` fallback for a shape nothing sends. That branch is removed. The `data.record.*` sync (record body from `after`, id from `recordId`) and the `data.records.*` stale-index warning are unchanged.
+
+The `enableEventSync` option's TSDoc and the `handleRecordUpsert` / `handleRecordDelete` docs now name `data.record.created|updated|deleted` instead of `record.*`.
+
+If a plugin of yours publishes a bare `record.created`, `record.updated` or `record.deleted` event through `IRealtimeService` and relied on the knowledge index following it, publish `data.record.created|updated|deleted` with the `DataEvent` payload instead (the record in `after`, its id in `recordId`).
@@ -0,0 +1,31 @@
+---
+'@objectstack/spec': minor
+---
+
+feat(spec)!: `action:button` / `action:icon` refuse `endpoint` with the rename `ActionSchema` already prescribes — `endpoint` → `target` (#21005)
+
+**BREAKING** — `endpoint` on an `action:button` or `action:icon` component (`ActionButtonProps`, `ActionIconProps`) is no longer a declared key. `ActionSchema` has always refused `endpoint` with "Did you mean `endpoint` → `target`?", while these two rows accepted it. objectui's console registers its own `api` handler, which reads `target` and never `endpoint`, so an `api` button written with `endpoint` passed the props gate and called nothing. The rows now refuse it with the same rename, read from the one alias table the action and both rows share. Write the endpoint as `target`.
+
+Clause-②: yes (narrowing)
+
+## FROM → TO
+
+| you wrote (17.5 and earlier) | write instead |
+| --- | --- |
+| `{ type: 'action:button', properties: { actionType: 'api', endpoint: '/api/v1/x' } }` | `{ type: 'action:button', properties: { actionType: 'api', target: '/api/v1/x' } }` |
+| `{ type: 'action:icon', properties: { actionType: 'api', endpoint: '/api/v1/x' } }` | `{ type: 'action:icon', properties: { actionType: 'api', target: '/api/v1/x' } }` |
+| `endpoint` on a block with no `actionType` | add `actionType: 'api'` and rename `endpoint` to `target` |
+
+**The one-line fix:** rename `endpoint` to `target` in the block's `properties`; the value (the URL the `api` action calls) is unchanged.
+
+**What an author who still writes it sees.** A page is never refused for it: a page component's `properties` is an open bag, so `definePage()`, `defineStack({ pages })` and the page write door accept the page as before. `os validate` / `os build` / `os lint` report `component-props-unknown-key` as a warning at `properties.endpoint`, with the rename "Did you mean `endpoint` → `target`?" — the same clause `ActionSchema` prints. The two rows also stop answering `path` with the edit-distance guess `patch` (the declarative write's field values): `url`, `endpoint`, `path` and `href` all rename to `target`, on the action and on both blocks alike. A typed `ActionButtonProps` / `ActionIconProps` input fails `tsc` at `endpoint`.
+
+## The migration kit
+
+- **The D2 conversion `action-block-endpoint-to-target`** (protocol 18, retired from the load path) renames `endpoint` to `target` on an `action:button` / `action:icon` whose `actionType` is `api`, the one meaning the key declared, with one notice per block. It reaches blocks in regions, nested in a container's `children`, and in a slotted page's named slots, so a stored `page` row or a built artifact that carries the key loads with `target` through the rehydration seams, which replay it. An already-present `target` wins: a twin with the same value is dropped. A block with no `actionType`, another `actionType`, a non-string `endpoint`, or a `target` that names a different endpoint is left as stored and reported as a TODO. Run `os migrate meta --from 17` to list the mechanical edits for existing sources; apply them by hand.
+- **The D3 entry `action-block-endpoint-spelling-retired`** names what the rename cannot decide: the TODO sites above, and code — a custom action handler that read `endpoint` off the action reads nothing once the block carries `target`.
+- **No deprecation window**, per the project's startup-stage posture.
+
+Census at landing: no producer in this repository (examples, templates, platform pages, fixtures) or in objectui's examples authors `endpoint` on either block. ⚠️ **The out-of-repo consumer population is NOT MEASURED.** `@objectstack/spec` is published, so this is breaking for consumers no telemetry was consulted for.
+
+<!-- adr-0087: registered action-block-endpoint-to-target, action-block-endpoint-spelling-retired -->
@@ -0,0 +1,33 @@
+---
+'@objectstack/spec': minor
+---
+
+docs(spec)!: the security service contract's field answers for a caller who resolves no permission set exclude the fields that declare `requiredPermissions` (#21063)
+
+Clause-②: yes (narrowing)
+
+<!-- adr-0087: not-required (no-migration-prescription) Only the prose of the ISecurityService interface moves: no method, parameter, return type, schema key or stored shape changes, so objectstack migrate meta has nothing to rewrite. The answers it now states are the ones every field-level requiredPermissions declaration already implied. -->
+
+**BREAKING for implementers and consumers of `ISecurityService` field answers.**
+
+**What changed.** The contract in `@objectstack/spec/contracts` now states the
+field answers for a non-system caller who resolves no permission set. Such a
+caller holds no permission-set field grant and no capability. No grant narrows
+its answers, and a field's own declarations still apply: a field that declares
+`requiredPermissions` is not in its `getReadableFields` answer (unless a
+`maskingRule` on the field serves it masked, which keeps it as a served
+column), and it is not in its `getWritableFields` answer.
+`getMetadataReadableFields` answers the same for that caller when the
+deployment's fallback set resolves to nothing. The contract used to say the
+data-plane answer for that caller was the full field set, because the engine
+middleware skipped its whole field gate for it. The middleware skips only its
+permission-set grant gates.
+
+**Who this reaches.** An implementation of `ISecurityService` must answer this
+way for that caller. A consumer that relied on the full field set for that
+caller now receives the narrower answer from the reference implementation
+(`@objectstack/plugin-security`).
+
+**What to do.** An implementation folds each field's `requiredPermissions`
+into its answer for this caller exactly as it does for a caller whose
+permission sets lack the capability. A consumer needs no change.
@@ -0,0 +1,40 @@
+---
+'@objectstack/plugin-security': minor
+---
+
+fix(plugin-security)!: a field that declares `requiredPermissions` is not served to a caller who resolves no permission set, and that caller may not query on it or write it (#21063)
+
+Clause-②: yes (narrowing)
+
+<!-- adr-0087: not-required (no-migration-prescription) Nothing an author wrote is rewritten or changes meaning: every field-level requiredPermissions already declared mask on read and deny on write for a caller who does not hold all of it, and this change makes the runtime honour that declaration for the one caller class it skipped. No stored metadata, schema key or published type moves. -->
+
+**BREAKING for callers who resolve no permission set.**
+
+**What changed.** A field that declares `requiredPermissions` is masked on read
+and denied on write unless the caller holds all of them (ADR-0066 D3). A caller
+who carries a principal but resolves no permission set holds no capability, so
+the gate applies to it, but the runtime served that caller the stored value,
+let it filter, sort, group and aggregate on the field, and accepted a write
+that named it. The explain engine already reported the field hidden for that
+caller. Now the field is not served to it (a field that also declares a
+`maskingRule` is served masked, as before). A filter, sort key, group key or
+aggregate that names the field is refused with `403 PERMISSION_DENIED`, and so
+is a write payload that names it, as for any other caller who lacks the
+capability.
+
+The published field answers agree with what is served and refused.
+`ISecurityService.getReadableFields`, `getQueryableFields` and
+`getWritableFields` no longer list such a field for this caller, and neither
+does `getMetadataReadableFields` when the deployment's fallback set resolves to
+nothing. The write preview answers such a payload as the write path does.
+
+**Who this reaches.** A caller who resolves no permission set but carries a
+position, a named permission set or a user id. A caller with none of the three
+is handed through untouched, as before, and the field projections say so. A
+caller who resolves at least one permission set is unaffected, and so is a
+system context. Whether this caller may read or write the object at all is
+unchanged.
+
+**What to do.** Nothing, unless such a caller needs the field. A field's
+`requiredPermissions` name the capabilities that open it, so give the caller a
+permission set that holds all of them, or drop the requirement from the field.
@@ -62,7 +62,6 @@ const result = AIChatWindowProps.parse(data);
 | **description** | `string` | optional | Action description, forwarded to the runner — the parameter dialog shows it under its title |
 | **target** | `string` | optional | Executor target, forwarded to the runner: the URL, script name, flow name or API endpoint, per `actionType` |
 | **openIn** | `Enum<'self' \| 'new-tab'>` | optional | For a `url` action: `self` navigates in place, `new-tab` opens a new browser tab |
-| **endpoint** | `string` | optional | API endpoint for an `api` action, forwarded to the runner |
 | **method** | `string` | optional | HTTP method for an `api` action, forwarded to the runner |
 | **bodyExtra** | `any` | optional | Static request-body fields for an `api` action, forwarded to the runner |
 | **bodyShape** | `any` | optional | How an `api` action shapes its request body, forwarded to the runner |
@@ -118,7 +117,6 @@ const result = AIChatWindowProps.parse(data);
 | **params** | `any` | optional | Action parameters, forwarded to the runner: an array is the list of inputs to collect from the user; an object is forwarded as the static parameter values |
 | **target** | `string` | optional | Executor target, forwarded to the runner: the URL, script name, flow name or API endpoint, per `actionType` |
 | **openIn** | `Enum<'self' \| 'new-tab'>` | optional | For a `url` action: `self` navigates in place, `new-tab` opens a new browser tab |
-| **endpoint** | `string` | optional | API endpoint for an `api` action, forwarded to the runner |
 | **method** | `string` | optional | HTTP method for an `api` action, forwarded to the runner |
 | **bodyExtra** | `any` | optional | Static request-body fields for an `api` action, forwarded to the runner |
 | **bodyShape** | `any` | optional | How an `api` action shapes its request body, forwarded to the runner |
 
@@ -158,9 +158,13 @@ describe('getWritableFields — the answers the contract names', () => {
     expect(await plugin.getWritableFields('invoice', { isSystem: true })).toEqual(FIELDS);
   });
 
-  it('no permission sets resolved: the full field set, as the middleware skips its write gate', async () => {
-    const { plugin } = await boot([], { noBaseline: true });
-    expect(await plugin.getWritableFields('invoice', WRITER_CTX)).toEqual(FIELDS);
+  it('no permission sets resolved: the full field set minus the capability-gated field, which the write gate refuses', async () => {
+    const { plugin, middleware } = await boot([], { noBaseline: true });
+    // [#21063] The caller holds no capability, so `margin`'s
+    // `requiredPermissions` refuses it on write; nothing else is refused.
+    expect(await plugin.getWritableFields('invoice', WRITER_CTX)).toEqual(FIELDS.filter((f) => f !== 'margin'));
+    expect(await middlewareAdmits(middleware, 'update', WRITER_CTX, { margin: PAYLOAD_VALUE.margin })).toBe(false);
+    expect(await middlewareAdmits(middleware, 'update', WRITER_CTX, { secret: PAYLOAD_VALUE.secret })).toBe(true);
   });
 
   it('an unresolvable object is no answer (undefined), not an empty one', async () => {