@@ -0,0 +1,32 @@
+---
+'@objectstack/spec': minor
+---
+
+feat(spec)!: a page action row declares `ActionSchema`'s own `operation` enum and refuses `onSuccess` beside `operation: 'update'`, with the action's text
+
+Clause-②: no (narrowing)
+
+<!-- adr-0087: registered ui-page-action-row-operation-declared -->
+
+**BREAKING**: an accept-set narrowing on two keys of four published page component rows, shipped as `minor` under the launch-window convention for accept-set narrowings.
+
+The page action rows are `action:button` and `action:icon` (`properties`), and each member of an `action:group` or `action:menu` (`properties.actions[]`). Each forwards `operation` to the console's action runner, which reads it before any executor: `operation: 'update'` performs the declarative write through the platform action route and runs no executor of its own. The rows typed `operation` as an open value and never carried `ActionSchema`'s refusal of `onSuccess` beside `operation: 'update'`, so a row with an `api` or `script` executor, the write and a hop parsed while the same action was refused. Now:
+
+- a row's `operation` is `ActionSchema`'s own enum (one member, `'update'`); `'delete'` and `'custom'` get the action's "bulk-def operation with no row-level form" refusal, and any other value is refused at `operation`;
+- a row's `onSuccess` beside `operation: 'update'` is refused whatever executor the row names (or none), with ONE text shared with `ActionSchema`: the hop would follow the write, whose success carries no result `${result.*}` could read.
+
+`ActionSchema`'s reach is unchanged. Its message for the pairing used to open "`onSuccess` is not defined for an `operation: 'update'` action yet"; it now states what the runner does (reads `operation` before any executor, writes, then hops) and keeps the prescription "Drop `onSuccess`".
+
+### FROM → TO
+
+| before | what to write instead |
+| --- | --- |
+| `{ actionType: 'api', operation: 'update', patch: { status: 'done' }, onSuccess: { navigate: '/done' } }` (or `type` on a member, or no executor) | the same row without `onSuccess`: the runner performs the write before any executor, so the hop followed a write whose success declares no result |
+| `{ operation: 'delete', … }` / `{ operation: 'custom', … }` on a row | no `operation`: a row delete is the object's own delete affordance, and a row is already the action a bulk def's `'custom'` would name |
+| any other `operation` value | `operation: 'update'` with a `patch`, or no `operation` (the runner ran nothing for it) |
+
+**The one-line fix: on a page action row, write `operation` only as `'update'`, and never beside `onSuccess`.** `os migrate meta --from 17` lists the D3 entry `ui-page-action-row-operation-declared`; the rewrite is by hand.
+
+**What an author now sees.** `os validate`'s props gate reports the refusal at the row's `operation` or `onSuccess` (`properties.…`, or `properties.actions.N.…` for a member). For example, `{ actionType: 'api', operation: 'update', patch: { status: 'done' }, onSuccess: { navigate: '/done' } }` on an `action:button` gets: ``An `action:button`'s `onSuccess` (`operation: 'update'`) would follow a result the contract does not declare: the console's action runner reads `operation` before any executor, …``. The same row without `onSuccess` parses unchanged.
+
+**Measured producers.** None in this repository. In objectui (at its pin `1fb1ced36243` and its main `b9814b3`), the action renderers' own tests carry `operation: 'update'` rows without `onSuccess`, which stay accepted; no row carries another `operation` value or the pairing. objectui's metadata-admin form already clears `onSuccess` when an author switches an action into an update.
@@ -108,3 +108,29 @@ describe("the props gate refuses a page action row's `onSuccess` beside an execu
     expect(validateComponentProps(stackWith(node({ [key]: 'form', target: 'task_form' })))).toEqual([]);
   });
 });
+
+// `operation` on a page action row: `ActionSchema`'s own enum, and its refusal
+// of `onSuccess` beside `operation: 'update'` (the runner performs the write
+// before any executor), whatever executor the row names.
+
+describe("the props gate judges a page action row's `operation` as `ActionSchema` does", () => {
+  const UPDATE = { operation: 'update', patch: { status: 'done' } };
+
+  it.each(ROWS)("REFUSAL: %s with `api`, `operation: 'update'` and `onSuccess` is one finding at `onSuccess`", (_row, node, at, key, subject) => {
+    const findings = validateComponentProps(stackWith(node({ [key]: 'api', ...UPDATE, onSuccess: { navigate: '/tasks' } })));
+    expect(findings.map((f) => [f.rule, f.path])).toEqual([[COMPONENT_PROPS_INVALID, `${at}.onSuccess`]]);
+    expect(findings[0].message).toContain(
+      `${ownerOf(subject)} \`onSuccess\` (\`operation: 'update'\`) would follow a result the contract does not declare:`,
+    );
+  });
+
+  it.each(ROWS)("ACCEPTED CONTROL: %s with `api` and `operation: 'update'` and no `onSuccess` reports nothing", (_row, node, _at, key) => {
+    expect(validateComponentProps(stackWith(node({ [key]: 'api', ...UPDATE })))).toEqual([]);
+  });
+
+  it.each(ROWS)("REFUSAL: %s with `operation: 'delete'` is one finding at `operation`", (_row, node, at) => {
+    const findings = validateComponentProps(stackWith(node({ operation: 'delete', patch: { status: 'done' } })));
+    expect(findings.map((f) => [f.rule, f.path])).toEqual([[COMPONENT_PROPS_INVALID, `${at}.operation`]]);
+    expect(findings[0].message).toContain("`operation: 'delete'` is a bulk-def operation with no row-level form");
+  });
+});
@@ -0,0 +1,32 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+import type { SemanticMigration } from '../../types.js';
+
+export const entry: SemanticMigration = {
+  id: 'ui-page-action-row-operation-declared',
+  surface: 'the `operation` of a page action row (`properties.operation` on an `action:button` or `action:icon`, '
+    + 'and `operation` on each `action:group` / `action:menu` member of `properties.actions`): any value but '
+    + '`\'update\'`. Also the `onSuccess` of a page action row that declares `operation: \'update\'`, whatever '
+    + 'executor the row names (`actionType` on a node, `type` on a member, or none)',
+  replacement: '`operation: \'update\'` with a `patch` for the declarative single-record write, or no `operation`. '
+    + 'A row delete is the object\'s own delete affordance; a bulk def\'s `\'custom\'` has no row form, because the '
+    + 'row is already the action. Beside `operation: \'update\'`, no `onSuccess`. ⛔ NOT mechanically convertible: '
+    + 'whether a row meant the write or the hop is the author\'s call.',
+  reason:
+    'Every page action row forwards `operation` to the console\'s action runner beside its executor, and the runner '
+    + 'reads it before any executor: `operation === \'update\'` performs the declarative write through the platform '
+    + 'action route, and any other value falls through to the executor and does nothing. The rows typed the key as '
+    + 'an open value, so such a value parsed clean, and they never carried `ActionSchema`\'s refusal of `onSuccess` '
+    + 'beside `operation: \'update\'`: a row with an `api` or `script` executor, the write and a hop parsed, while '
+    + 'the same action was refused. The rows now declare `ActionSchema`\'s own `operation` enum and refuse the '
+    + 'pairing with the action\'s own text: the hop would follow the write, which runs no handler and no executor, '
+    + 'so its success carries no result `${result.*}` could read. A page\'s `properties` is not parsed on the '
+    + 'metadata save or load path; `os validate`\'s props gate parses it against these same rows and reports the '
+    + 'refusal at the row\'s `operation` or `onSuccess`. Measured producers: none in this repository; none in '
+    + 'objectui\'s action rows at its pin or main.',
+  acceptanceCriteria:
+    'Every page action row\'s `operation` is absent or `\'update\'`, and no row with `operation: \'update\'` carries '
+    + '`onSuccess`; `os validate` reports no `component-props-invalid` finding at `properties.operation`, '
+    + '`properties.actions.N.operation`, or at the `onSuccess` of an `operation: \'update\'` row, and every such row '
+    + 'parses as before.',
+};