@@ -0,0 +1,11 @@
+---
+'@objectstack/cli': patch
+---
+
+fix(cli): a hook that destructures a renamed key off `ctx` is no longer refused as not-lowerable (#22459)
+
+Clause-②: no
+
+- **What changed.** The free-identifier scan behind `objectstack lint`'s `hook-body/not-lowerable` rule and `objectstack build`'s hook lowering counted a renamed destructuring key as a free identifier. For `const { event, input, previous: prev } = ctx`, it reported `previous`, a property read off `ctx`, although the only name the pattern binds is `prev`. So `objectstack lint` failed the hook with the advice "reach them through `ctx`", which the hook already did, and `objectstack build` shipped it as a bundled closure instead of a metadata-only body. A non-computed destructuring key is now a key, as the key of `{ key: value }` already was. Nested patterns (`{ a: { b: c } } = ctx`), patterns inside array patterns, the parameters of a callback inside the handler, and `catch` clauses are covered by the same rule.
+- **What is still refused.** A destructuring default or a computed key that names something out of scope is still free: `const { key: alias = FALLBACK } = ctx` and `const { [KEY]: v } = ctx` report `FALLBACK` and `KEY`, as before. A genuinely free `previous` that is not read off `ctx` is still refused.
+- **What to do.** Nothing. A hook written this way now lowers to a body on the next `objectstack build`, and `objectstack lint` stops reporting it. The un-renamed spelling (`const prev = ctx.previous`) keeps working as before.
@@ -0,0 +1,12 @@
+---
+'@objectstack/plugin-auth': minor
+---
+
+With SSO domain verification on, `POST /api/v1/auth/admin/sso/request-domain-verification` and `POST /api/v1/auth/admin/sso/verify-domain` answer an unknown `providerId` with `404 RESOURCE_NOT_FOUND`, no longer with `400 DOMAIN_VERIFICATION_DISABLED`
+
+Clause-②: yes (widening)
+
+- **Before.** With `OS_SSO_DOMAIN_VERIFICATION` on, a platform admin who sent a `providerId` that does not exist got `400 DOMAIN_VERIFICATION_DISABLED`, "Domain verification is not enabled for this environment (set OS_SSO_DOMAIN_VERIFICATION)": an instruction to turn on a feature that was already on. `@better-auth/sso` answers both an unmounted route (feature off) and an unknown provider (feature on) with a `404` that carries no `code`, and both bridges mapped every such `404` to the feature-off answer.
+- **Now.** The two mounts hand each bridge the environment's own setting (`AuthManager.isSsoDomainVerificationEnabled()`). Off: `400 DOMAIN_VERIFICATION_DISABLED`, as before, and the vendor is no longer called. On: a code-less vendor `404` is the provider lookup missing, answered `404 RESOURCE_NOT_FOUND` with a message naming the provider id. The decision never reads the vendor's `404` wording.
+- **Unchanged.** The platform-admin gate answers first, on or off (an anonymous caller gets `401`). A missing `providerId` is still `400 INVALID_REQUEST`. With the feature on, an existing provider still gets the vendor's own answer: the DNS record, `NO_PENDING_VERIFICATION`, `DOMAIN_VERIFICATION_FAILED`, a `403` for a provider the caller may not manage.
+- **The exported bridges.** `runRequestDomainVerification` and `runVerifyDomain` take an optional third argument, `{ domainVerificationEnabled?: boolean }`. A caller that omits it keeps the earlier mapping: a code-less `404` is answered `400 DOMAIN_VERIFICATION_DISABLED`, byte for byte. A host that mounts these helpers itself passes the environment's setting to get the not-found answer.
@@ -0,0 +1,13 @@
+---
+'@objectstack/spec': minor
+---
+
+`ISecurityService` declares an optional, feature-detected member that answers the existing ADR-0055 master-detail write check: `checkControlledByParentWrite(object, recordId, context)`.
+
+Clause-②: yes (widening)
+
+- **What it answers.** It answers what the master-detail write check decides for an update of one record by the caller. A by-id write to a `controlled_by_parent` record requires edit access to its master, and the write path checks each master up the chain: the object-level `update` grant, the master's write row-level security, and record sharing. The answer equals what a by-id update of the same record gets from that check, the ADR-0090 D10 delegator leg included. It adds no verdict: it exposes the one the write path already reaches, so a gate on a record's attachments or comments can judge the record as its own update is judged.
+- **What it resolves with.** `ControlledByParentWriteOutcome` is a discriminated union. `allow` means the check does not refuse. `deny` names the leg that refused (`ControlledByParentWriteDenialLeg`: `object_permission`, `row_level_security`, `record_sharing` or `master_chain`). `not_applicable` means the object is not `controlled_by_parent`. `unresolvable` names why the check reached no verdict (`ControlledByParentWriteUnresolvedReason`: a missing `master_detail` relation, a record that does not exist, or an empty master reference). A store fault is not an outcome: the member rejects with the engine's own error, so the fault keeps its declared status (a datasource outage is `503`).
+- **Optional, and absence is typed.** A security service without the member still satisfies the contract, and an unguarded call does not compile. Absence means no master check is composed for a consumer to ask, which is not a policy that admits.
+
+Nothing an author writes changes, and no runtime behaviour changes. `@objectstack/plugin-security` does not serve the member yet. An implementation typed as `ISecurityService` that serves this name must serve it under the declared signature.
@@ -183,7 +183,7 @@ PM 的工作是循环:选卡 → 认领 → 派发 → 收集 → 复核 → 报
 - governed 面统一定义:`docs/adr/**` + `.claude/**`(全量)+ `skills/**` + `docs/NORTH-STAR.md`。
 - governed 面同含 `AGENTS.md` + `CLAUDE.md`;`GOVERNED_REPOS` 各仓同治理待遇,执行席恒随落地仓车道。
 - 路径面命中 Tier H ⇒ ACCEPT 换终局四件套,混合 diff ⛔ 不按比例判;要拆让 dev 单独开 PR。
-- 改动 >5000 行(含生成物)同换终局四件套,⛔ 无 Tier S 例外;读数 = PR additions+deletions。
+- 改动 >3000 行(含生成物)同换终局四件套,⛔ 无 Tier S 例外;读数 = PR additions+deletions。
 - ① 复核结论照常写在 issue 上;技能面 hunk 须由契约复审档的席复核,档外席先交 skills 席。
 - ② PR 留给维护者看得见地悬着;终局两条:人工直合即审核记录;授权批准 ⇒ 席位落地。
 - 看得见 = ACCEPT 同笔挂 `needs-user-decision` + 贴终稿「维护者速读」评论;①仍是审核记录。
 
@@ -55,7 +55,7 @@
 - 确认 MERGED 要两个读数:每轮同时读队列分支与 `origin/main`。
 - 契约复核 PASS 落地的 PR 到窗口时已 ready 且 auto-merge 在挂,见 `contract-review.md`。
 - 窗口自身权责不变:跟到 MERGED、踢出处置、落地后对账。
-- 转 ready/入队前跑 `check-governed-merges.mjs --pr N`:受管面照两层;>5000 行(含生成物)照 Tier H。
+- 转 ready/入队前跑 `check-governed-merges.mjs --pr N`:受管面照两层;>3000 行(含生成物)照 Tier H。
 - 受管路径全在 `.claude/**` 者 Tier S:席内达档复核过落地前检三条即转正式入队。
 - Tier H(其余受管面)者:四件套留 draft 等人批,⛔ 不翻正式不入队;获授权批准后认领席落地。
 - ⛔ 两层不由席位批准;清标即落地同受此闸,漏判会被队列守卫在 merge group 里拒收。
 
@@ -507,7 +507,7 @@ Even inside your own worktree, operate defensively:
    ⛔ **Three classes of PR never enter this path on green alone:** (a) a diff touching any **governed surface**
    (**Prime Directive #14**, which names them and holds the current list — **this file and `CLAUDE.md` are on it**,
    so re-read it rather than recalling it); (b) the **Version Packages** PR, or any PR whose merge performs a
-   release (**Prime Directive #15**); (c) a PR whose **changed lines exceed 5,000** (`additions + deletions`,
+   release (**Prime Directive #15**); (c) a PR whose **changed lines exceed 3,000** (`additions + deletions`,
    generated files included) — it lands the way a Tier H surface does: an authorized APPROVED review and then
    the owning seat, or a human merge. Read the PR's file list (`get_files`), **its author and its size** before
    you arm anything.
 
@@ -22,6 +22,8 @@ import { lowerCallables } from '../utils/lower-callables.js';
 
 // Module scope — exactly what a lowered body cannot reach.
 const SLA_MATRIX: Record<string, number> = { high: 4, low: 48 };
+// Module scope, spelled like a `ctx` key — a reference to THIS is free.
+const previous = { rank: 1 };
 
 const freeIdentifierHook = {
   name: 'case_sla',
@@ -139,6 +141,56 @@ describe('checkHookBodyLowering', () => {
     });
   });
 
+  describe('a hook that destructures a renamed key off `ctx` reaches its value through `ctx`', () => {
+    // `previous` is a property READ OFF ctx — exactly what this rule's own
+    // remedy prescribes — and `prev` is the only name the pattern binds. The
+    // scan used to count the key as a free identifier, so lint refused the
+    // hook (advising what it already did) and the build bundled it.
+    const renamedKeyHook = {
+      name: 'carry_rank',
+      object: 'task',
+      events: ['beforeInsert', 'beforeUpdate'],
+      handler: (ctx: any) => {
+        const { event, input, previous: prev } = ctx;
+        if (event === 'beforeUpdate' && prev) input.rank = prev.rank;
+      },
+    };
+    // The control: the same spelling, but read from module scope — not `ctx`.
+    const freePreviousHook = {
+      name: 'carry_rank_free',
+      object: 'task',
+      events: ['beforeUpdate'],
+      handler: (ctx: any) => {
+        const prev = previous;
+        ctx.input.rank = prev.rank;
+      },
+    };
+
+    it('lint reports nothing, and the build lowers it to a body', () => {
+      expect(checkHookBodyLowering({ hooks: [{ ...renamedKeyHook }] })).toEqual([]);
+
+      const lowering = lowerCallables({ hooks: [{ ...renamedKeyHook }] });
+      expect(lowering.bodyExtractionWarnings).toEqual([]);
+      expect(lowering.bodyExtracted).toBe(1);
+      const [hook] = lowering.lowered.hooks as Array<{ body?: { source: string } }>;
+      expect(hook.body?.source).toContain('previous: prev');
+    });
+
+    it('a genuinely free `previous` is still refused, by both', () => {
+      const issues = checkHookBodyLowering({ hooks: [{ ...freePreviousHook }] });
+      expect(issues).toHaveLength(1);
+      expect(issues[0].severity).toBe('error');
+      expect(issues[0].rule).toBe(NOT_LOWERABLE_RULE);
+      expect(issues[0].path).toBe('hooks[0].handler');
+
+      const lowering = lowerCallables({ hooks: [{ ...freePreviousHook }] });
+      expect(lowering.bodyExtracted).toBe(0);
+      expect(lowering.bodyExtractionWarnings.map((w) => [w.kind, w.freeIdentifiers])).toEqual([
+        ['free-identifiers', ['previous']],
+      ]);
+    });
+  });
+
   it('keeps the STRUCTURAL refusal a warning — the bundle is its designed answer', () => {
     const issues = checkHookBodyLowering({ hooks: [forbiddenTokenHook] });
 
 
@@ -75,6 +75,65 @@ describe('detectFreeIdentifiers (#1876 — body self-containment)', () => {
     }
   });
 
+  // A renamed destructuring key — `const { previous: prev } = ctx` — reads
+  // `previous` OFF `ctx`; the only name it introduces is `prev`. The key is a
+  // property name exactly like the `key` of `{ key: value }`, so counting it as
+  // a free identifier refused a self-contained handler (and bundled it), with
+  // advice — "reach them through `ctx`" — describing what it already did.
+  describe('a destructuring KEY is not a reference; its alias is the binding', () => {
+    const lowerable: Array<[string, string]> = [
+      [
+        'a renamed key off ctx, beside shorthand keys',
+        "(ctx) => { const { event, input, previous: prev } = ctx; if (event === 'beforeUpdate' && prev) input.n = prev.n; }",
+      ],
+      ['a nested renamed pattern', '(ctx) => { const { a: { b: c } } = ctx; return c; }'],
+      [
+        'a defaulted alias whose default is in scope',
+        '(ctx) => { const d = ctx.fallback; const { key: alias = d } = ctx; return alias; }',
+      ],
+      [
+        'a computed key and a default, both in scope',
+        '(ctx) => { const k = ctx.k; const d = 0; const { [k]: v = d } = ctx; return v; }',
+      ],
+      // The same element shape reached two other ways.
+      ['an object pattern inside an array pattern', '(ctx) => { const [{ previous: prev }] = ctx.items; return prev; }'],
+      ['a nested callback parameter', '(ctx) => ctx.items.map(({ previous: prev }) => prev.n)'],
+      ['a catch-clause pattern', '(ctx) => { try { ctx.run(); } catch ({ message: msg }) { ctx.log = msg; } }'],
+      // No key at all: elements are bound by position, so nothing to mistake.
+      ['an array pattern', '(ctx) => { const [first, second] = ctx.items; return first + second; }'],
+    ];
+    for (const [label, source] of lowerable) {
+      it(label, () => {
+        const r = detectFreeIdentifiers(source);
+        expect(r.unparsed).toBe(false);
+        expect(r.free).toEqual([]);
+      });
+    }
+
+    // The controls: what the element still READS is still judged. Only the key
+    // stopped counting — a default or a computed key that names something out
+    // of scope is as free as it ever was.
+    it('a defaulted alias whose default is free is still reported', () => {
+      const r = detectFreeIdentifiers('(ctx) => { const { key: alias = FALLBACK } = ctx; return alias; }');
+      expect(r.free).toEqual(['FALLBACK']);
+    });
+
+    it('a shorthand element whose default is free is still reported', () => {
+      const r = detectFreeIdentifiers('(ctx) => { const { previous = FALLBACK } = ctx; return previous; }');
+      expect(r.free).toEqual(['FALLBACK']);
+    });
+
+    it('a computed key that is free is still reported', () => {
+      const r = detectFreeIdentifiers('(ctx) => { const { [KEY]: v } = ctx; return v; }');
+      expect(r.free).toEqual(['KEY']);
+    });
+
+    it('a genuinely free `previous` (no ctx source) is still reported', () => {
+      const r = detectFreeIdentifiers('(ctx) => { const prev = previous; ctx.input.n = prev.n; }');
+      expect(r.free).toEqual(['previous']);
+    });
+  });
+
   describe('real compiled `.toString()` shapes', () => {
     it('does not flag a self-contained closure', () => {
       const handler = (ctx: any) => {
@@ -83,6 +142,15 @@ describe('detectFreeIdentifiers (#1876 — body self-containment)', () => {
       };
       expect(detectFreeIdentifiers(src(handler)).free).toEqual([]);
     });
+
+    it('does not flag a renamed destructuring key after the compiler has had it', () => {
+      const handler = (ctx: any) => {
+        const { event, input, previous: prev } = ctx;
+        if (event === 'beforeUpdate' && prev) input.n = prev.n;
+      };
+      expect(src(handler)).toContain('previous: prev');
+      expect(detectFreeIdentifiers(src(handler)).free).toEqual([]);
+    });
   });
 
   it('never invents free vars for non-handler junk (conservative — caller won\'t block)', () => {
 
@@ -227,8 +227,9 @@ function collectBindings(fn: ts.FunctionLikeDeclarationBase): Set<string> {
 /**
  * Collect identifiers used in VALUE position (potential references). Excludes
  * the false-positive sources: property-access member names, non-shorthand
- * object/class member keys, and statement labels. Binding names that slip
- * through are harmless — they are subtracted via `bindings` downstream.
+ * object/class member keys, non-computed destructuring keys, and statement
+ * labels. Binding names that slip through are harmless — they are subtracted
+ * via `bindings` downstream.
  */
 function collectReferences(fn: ts.FunctionLikeDeclarationBase): Set<string> {
   const refs = new Set<string>();
@@ -253,6 +254,19 @@ function collectReferences(fn: ts.FunctionLikeDeclarationBase): Set<string> {
       walk(node.initializer);
       return;
     }
+    if (ts.isBindingElement(node)) {
+      // `{ key: alias = d } = ctx` — the same rule as `{ key: value }` above:
+      // `key` names a property READ OFF the source, so it is not a ref (unless
+      // computed). Visit the binding name (an alias is subtracted via
+      // `bindings`; a nested pattern recurses here), a computed key's
+      // expression, and the default — `{ [k]: v = d }` reads `k` and `d`.
+      if (node.propertyName && ts.isComputedPropertyName(node.propertyName)) {
+        walk(node.propertyName.expression);
+      }
+      walk(node.name);
+      if (node.initializer) walk(node.initializer);
+      return;
+    }
     if (ts.isMethodDeclaration(node) || ts.isPropertyDeclaration(node) || ts.isGetAccessor(node) || ts.isSetAccessor(node)) {
       if (node.name && ts.isComputedPropertyName(node.name)) walk(node.name.expression);
       ts.forEachChild(node, (c) => { if (c !== node.name) walk(c); });
 
@@ -87,8 +87,10 @@ const mockCtx = (): PluginContext =>
 /**
  * Mount the plugin's REAL route registration on a real Hono app (the
  * auth-catchall-fallthrough.test.ts harness), with the auth manager reduced to
- * the two seams the bridges read: `getApi().getSession` (what the gate judges)
- * and `handleRequest` (where the bridge delegates).
+ * the seams the bridges read: `getApi().getSession` (what the gate judges),
+ * `handleRequest` (where the bridge delegates) and, after the gate, the two
+ * domain-verification mounts' `isSsoDomainVerificationEnabled()` [#22463] —
+ * ON here, as in `makeSsoVendor` below.
  */
 async function mountBridges(deps: {
   getSession: (headers: Headers) => unknown | Promise<unknown>;
@@ -110,6 +112,7 @@ async function mountBridges(deps: {
     getApi: async () => ({
       getSession: async ({ headers }: { headers: Headers }) => deps.getSession(headers),
     }),
+    isSsoDomainVerificationEnabled: () => true,
   };
   (plugin as any).registerAuthRoutes({ getRawApp: () => app, getPort: () => 0 }, ctx);
   return app;