@@ -0,0 +1,40 @@
+---
+'@objectstack/rest': minor
+---
+
+REST no longer reads a FAILED authorization-input lookup as "this check does not apply" — the tenancy-posture and ADR-0069 auth-gate seams in `computeExecCtx` fail closed
+
+Two seams inside `RestServer.computeExecCtx` absorbed a FAILURE into the same `undefined` an
+ABSENT wiring produces, and both feed authorization inputs. Unlike the sibling repairs in this
+family — where an unknown was answered as a REFUSAL — these two pointed the other way: a failure
+read as *permissive*, so a refusal was SKIPPED rather than produced. Driven on a real
+`ObjectKernel`, each fault beside a positive control that is the same fixture with the one fault
+removed:
+
+| wiring | before | after |
+|:--|:--|:--|
+| healthy `isolated` tenancy, ex-member's org-stamped API key | 401 refused | 401 — unchanged |
+| `tenancy` never registered (supported no-tenancy composition) | 200 served | 200 — unchanged |
+| `tenancy` registered and FAILED to construct | **200 served, full grants** | **503** |
+| auth gate INACTIVE | admitted | admitted — unchanged |
+| auth gate ACTIVE, healthy re-read, gated user | 403 | 403 — unchanged |
+| `isAuthGateActive()` itself THROWS | admitted | admitted — unchanged |
+| auth gate ACTIVE, session re-read FAILS | **admitted, no wire trace** | **503** |
+
+- **Tenancy posture.** Only the service registry's *branded* "never registered" rejection is
+  absorbed — the `isServiceNotRegisteredError` discriminator the shipped `objectQLProvider`
+  already uses one layer down. Every other rejection (a factory that threw, a scoped registration
+  resolved without a scope id, a circular service dependency) raises the same loud
+  `AuthzStoreUnavailableError` the data-engine seam raises, so the door answers a server-side
+  outage instead of serving the request. The classification is the registry's, never message text.
+  The WIRING fact is taken from the kernel's presence and never inferred from what the read
+  returned.
+- **ADR-0069 auth gate.** Fails closed in one precisely measured window only: `isAuthGateActive()`
+  answered `true` **and** the gate's session re-read then failed. A gate the deployment declared
+  active no longer vanishes silently. The common inactive path, a probe that throws, and a
+  successful re-read carrying no gate all keep their existing behaviour.
+
+Boot behaviour is unchanged: no composition that starts today stops starting. Single-kernel REST
+deployments — the wiring with no `kernel-manager` service — keep their current behaviour exactly,
+including the fact that `computeExecCtx` reads no tenancy posture there. What that wiring actually
+skips is being measured separately and is not changed here.
@@ -0,0 +1,51 @@
+---
+"@objectstack/objectql": patch
+"@objectstack/cli": patch
+---
+
+fix(objectql,cli): a navigation contribution relocated past a missing group now says so, at `warn` and at build time
+
+A package that injects navigation into another package's app names the target
+container by id (`navigationContributions[].group`). When that id matches no
+`type: "group"` node in the target app, `SchemaRegistry.applyNavContributions`
+appends the items at the app's **top level** and continues.
+
+That relocation is unchanged, deliberately. The merge is a read-time fold
+precisely so registration order does not matter — `registerAppNavContribution`
+does not require the target app to exist yet — and a package contributing into
+an *optional* group has to keep working. Refusing would trade both away.
+
+What changes is that it is no longer invisible. The only trace used to be one
+log line gated at `info`/`debug`, so a deployment running at
+`OS_REGISTRY_LOG=warn` watched its information architecture change in complete
+silence: a typo'd group id — exactly what an AI author emits — turned a nested
+menu entry into a top-level one, and because the entry was still *present*, no
+smoke test noticed. That is worse than a dropped entry, which someone notices.
+
+The trace is now a real diagnostic naming the contributing package, the target
+app, the missing group id and the relocated items:
+
+- **At runtime.** An ADR-0038 `BuildIssue`-family record (ADR-0112 D6c — a
+  diagnostics code, lowercase and out of the error ledger) is carried on the
+  app and reachable as `registry.getAppNavDiagnostics(appName)`, and announced
+  through `console.warn`, so it survives `OS_REGISTRY_LOG=warn` and reaches
+  `os doctor` / boot output. Emitted once per registry per distinct mis-aim:
+  the fold runs on every read of the app, and a line printed per request is as
+  unreadable as one never printed. A deployment that asks for `silent` still
+  gets silence, and still keeps the record.
+- **At authoring time.** `os build` and `os validate` answer the same question
+  over a composed artifact, through the same predicate, and report the same
+  finding where an author sees it first — in the text output and in `--json`
+  under the existing `warnings` key, beside the authoring-rule advisories and
+  capability hints. A contribution aimed at an app no package in the artifact
+  ships is not reported: contributing into an app another artifact installs is
+  the supported case, and is why the merge is a fold.
+
+**Nothing is refused.** No new failure, no ordering constraint, no change to
+what installs or to what `os build` accepts — a diagnostic was added and a
+refusal was not.
+
+`examples/app-multi-package` now demonstrates the mechanism it was missing: the
+App package publishes a `sales_group` container and the Orders module
+contributes its nav entry into it, which is what a module split converts an
+app's own navigation into.
@@ -271,6 +271,10 @@ conversion 是消费者跟的。两个都要写。
       (``.toThrow(/<key>.*removed.*use `<replacement>`/s)`` —— `s` 标志是 house
       style,因为消息跨行),一条阳性,对非 strict 剥除路径断言
       `not.toHaveProperty(key)`。参考 `packages/spec/src/ai/agent.test.ts:69-95`。
+      ⭐ **缺席 pin 一律 tree-scoped,永不 file-scoped**:file-scoped 只看得见作者想得
+      到的那个文件,漏网的恰是他不知道的引用(实测五处、三个包、两张卡,其中两处还
+      是删除**之后**新写的)。排除 `**/CHANGELOG.md`、`.changeset/` 与 pin 自身,理由
+      写在旁边,⛔ 不建允许清单文件;⛔ 缺席断言不是陈旧提及,「修好它」即删掉守卫。
 - [ ] **Examples** —— `examples/app-showcase/**` 必须停止编写该键。墓碑路线上
       `tsc` 替你找齐。
 - [ ] **已发布 skills** —— 教这个键的 `skills/*/SKILL.md`(表格、`defineX` 示例)
 
@@ -64,7 +64,7 @@ not on any flag.
 ## How the flag is set
 
 `isSystem` is **server-constructed and never client-supplied**. Inbound HTTP
-cannot set it (`packages/rest/src/rest-server.ts:1520`, `:1549`), and neither
+cannot set it (`packages/rest/src/rest-server.ts:1524`, `:1553`), and neither
 can an action body (`packages/runtime/src/domains/actions.ts:404`). It is
 written by internal callers only, as an option on the engine call:
 
@@ -103,7 +103,7 @@ that silently does not happen.
 | 14 | MCP stdio bridge skips the object API-exposure gate | mcp | Get: the bridge reaches objects whose `apiEnabled` / `apiMethods` would refuse an external caller | `stdio-data-bridge.ts:246` |
 | 15 | **Read-audit rows are not written** | plugin-audit | Lose: the "a person opened this record" trail. `sudo()` keeps the caller's `userId`, so this flag is the only thing separating a human read from a platform one | `read-audit.ts:556` |
 | 16 | Approval snapshot payload redaction skipped | plugin-approvals | Get: the whole snapshot on `find` / `findOne` — the audit/replay channel. Lose: field-visibility redaction over approval payloads | `payload-redaction-middleware.ts:115` |
-| 17 | REST anonymous-deny seam satisfied | rest | Get: `enforceAuth` passes with no `userId`. Not reachable from the wire — `isSystem` is never set on an inbound request | `rest-server.ts:1552` |
+| 17 | REST anonymous-deny seam satisfied | rest | Get: `enforceAuth` passes with no `userId`. Not reachable from the wire — `isSystem` is never set on an inbound request | `rest-server.ts:1556` |
 
 ### 2. Write pipeline and data integrity
 
@@ -158,7 +158,7 @@ The largest single consumer — **17 of the 106 sites**.
 |:--|:---|:---|:---|:---|
 | 48 | Object API-exposure gate bypassed (`apiEnabled` / `apiMethods`) | runtime | Get: internal self-writes ignore exposure declarations — these govern **external** exposure, not engine self-writes | `action-execution.ts:138` |
 | 49 | Action `requiredPermissions` bypassed | runtime | Get: engine self-invocation runs any action | `action-execution.ts:401` |
-| 50 | `manage_metadata` bypassed on metadata writes | runtime, rest | Get: schema writes without the capability | `domains/meta.ts:471`, `:874`, `rest-server.ts:4789`, `:6203`, `:6451`, `:6882`, `:7075` |
+| 50 | `manage_metadata` bypassed on metadata writes | runtime, rest | Get: schema writes without the capability | `domains/meta.ts:471`, `:874`, `rest-server.ts:4888`, `:6302`, `:6550`, `:6981`, `:7174` |
 | 51 | The shared metadata-write verdict itself returns `allowed` | metadata-core | Get: the one function all of row 50's doors consult answers yes before any capability is examined | `meta-write-capability.ts:134` |
 | 52 | Anonymous-deny seam satisfied on the domain dispatchers and the package/federation routes | runtime, rest | Get: passes with no `userId` | `domains/actions.ts:411`, `domains/ai.ts:60`, `domains/automation.ts:989`, `domains/meta.ts:232`, `domains/security.ts:78`, `domains/packages.ts:326`, `external-datasource-routes.ts:302`, `package-routes.ts:97` |
 | 53 | MCP principal check satisfied | runtime | Get: MCP surface reachable with no user | `domains/mcp.ts:61` |
@@ -199,7 +199,7 @@ assuming `isSystem` covers it is a documented source of bugs.
 | "It preserves a supplied `updated_at` / `updated_by`" | **No.** That is `preserveAudit`, a separate opt-in — and an UPDATE-path exemption only | `field.zod.ts:1580` (#3493 / #6640) |
 | "It stamps `created_by`" | **No.** Audit stamping reads `userId` from the context. A user-less system write stamps nothing — that is today's behaviour, not an error | `runtime-identity.ts:280`–`281` |
 | "It bypasses every guard" | **No.** The last-admin guard applies to **every** context, `isSystem` included — the deprovision path that actually locks an org out is the system one | `last-admin-guard.ts:299` |
-| "A client can request it" | **No.** Never settable from inbound HTTP or from an action body | `rest-server.ts:1520`, `:1549`; `domains/actions.ts:404` |
+| "A client can request it" | **No.** Never settable from inbound HTTP or from an action body | `rest-server.ts:1524`, `:1553`; `domains/actions.ts:404` |
 
 ---
 
@@ -253,7 +253,7 @@ should recognise it instead of re-deriving it.
    rule-materialised grant that the next reconcile silently restores.
 
 5. **`applySystemFields` does not read this flag.** It is named as if it did.
-   `packages/objectql/src/registry.ts:464` is **schema-side column
+   `packages/objectql/src/registry.ts:475` is **schema-side column
    provisioning** — which columns an object carries — and consumes
    `ExecutionContext.isSystem` zero times. The write-time ownership behaviour
    people attribute to it is row 2, in `plugin-security`.
 
@@ -79,6 +79,37 @@ A few notable entries:
   live in `plugin-audit`, but they are not contributed as Setup nav
   entries.)
 
+### When a contribution names an anchor that is not there
+
+Aiming at a `group` id the target app does not declare is **not** refused and
+the entry is **not** dropped: the items are appended at the app's **top level**
+and the merge continues. That is deliberate — the merge is a read-time fold
+precisely so registration order does not matter (a contributor may register
+before the app it aims at), and a contribution into an *optional* anchor has to
+keep working when the plugin owning that anchor is not loaded.
+
+It is, however, **loud**. The relocation emits a
+`nav_contribution_group_missing` diagnostic at `warn` — naming the contributing
+package, the target app, the missing group id and the relocated items — so it
+survives `OS_REGISTRY_LOG=warn` and appears in boot output. The same finding is
+carried on the app itself, readable as
+`registry.getAppNavDiagnostics(appName)`, and it is raised once per distinct
+mis-aim rather than once per read of the app.
+
+`os build` **and `os validate`** answer the same question at compile time
+whenever the contributing package and the target app are composed into one
+artifact. Both print the finding and both carry it in `--json` under the
+existing `warnings` key, beside the authoring-rule advisories and the
+capability hints — the payload is deliberately closed, so a new class of
+finding fills a declared key rather than adding one. They **report** there;
+neither fails the build.
+
+⚠️ The anchor id is the whole contract between a shell and its contributors,
+and a contributor cannot see the shell's ids at authoring time. A typo
+therefore produces a menu that renders, passes a smoke test, and has silently
+moved the entry one level up — which is why the diagnostic exists rather than a
+refusal.
+
 ## Why a shell + contributions
 
 The Setup App is a shell of empty group anchors rather than a fixed
 
@@ -3,7 +3,7 @@
 > **v5.0 update (2026):** Throughout this document, the term *project* has been renamed to *environment* (no aliases; CLI flags, URL paths, schemas, env vars all hard-renamed). See [ADR-0006 v4 — the v5.0 rename and its no-alias decision](./0006-project-environment-split.v4.md#the-v50-rename-and-its-no-alias-decision) for the rationale. The body below is preserved verbatim for historical context.
 
 
-**Status**: Accepted (2026-05-16) · **Amended** (2026-05-22, see "Amendment: post-ADR-0006 v4 scope") · **Amended** (2026-04-13, branch concept removed — see [ADR-0008 §0](./0008-metadata-repository-and-change-log.md#0-2026-04-13-amendment--drop-project-and-branch-from-metaref)) · **Amended** (2026-08-09, #6825 — the Phase-1 overlay-index migration is deleted; see "Amendment (2026-08-09, #6825): overlay-index delivery after the Phase-1 migration was deleted")
+**Status**: Accepted (2026-05-16) · **Amended** (2026-05-22, see "Amendment: post-ADR-0006 v4 scope") · **Amended** (2026-04-13, branch concept removed — see [ADR-0008 §0](./0008-metadata-repository-and-change-log.md#0-2026-04-13-amendment--drop-project-and-branch-from-metaref)) · **Amended** (2026-08-09, #6825 — the Phase-1 overlay-index migration is deleted; see "Amendment (2026-08-09, #6825): overlay-index delivery after the Phase-1 migration was deleted") · **Amended** (2026-09-04, [ADR-0131](./0131-total-organization-ownership-no-null-organization-id.md) D6 — the per-organization overlay axis is **retired for now**: `sys_metadata` carries no organization column, org-scoped writes of the five tier-A types are refused, and the environment layer is the whole ledger; the environment → code layered resolution and the "no overlay row = the registry" reading are unchanged)
 **Deciders**: ObjectStack Protocol Architects
 **Builds on**: [ADR-0003](./0003-package-as-first-class-citizen.md) (Package as first-class citizen), [ADR-0004](./0004-cloud-multi-kernel.md) (Cloud + per-project kernels)
 **Amended by**: [ADR-0006 v4](./0006-project-environment-split.v4.md) (drops `sys_project` entirely), [ADR-0008](./0008-metadata-repository-and-change-log.md) (re-expresses overlay as `LayeredRepository`; subsequently drops `project`/`branch` from `MetaRef`), [ADR-0029 D9](./0029-kernel-object-ownership-and-platform-objects-decomposition.md#amendment-2026-08-09-6853-a-tenant-overlay-of-an-object-is-its-own-contributor-layer-not-a-second-own) (for `object` only: the overlay is a registry contributor LAYER over the packaged owner, resolved as `base = overlay ?? own`, instead of a destructive in-place overwrite)
 
@@ -1,6 +1,6 @@
 # ADR-0017: Object has-many View (Independent View Entities)
 
-**Status**: Accepted · Implemented Phases 1–4 (2026-05-30) · Phase 5 (Studio designer) deferred
+**Status**: Accepted · Implemented Phases 1–4 (2026-05-30) · Phase 5 (Studio designer) deferred · **Amended** (2026-09-04, [ADR-0131](./0131-total-organization-ownership-no-null-organization-id.md) D13 — §3.4's `sys_view_definition` store and §3.6's objectui repointing are **retired as inert**: verified on 2026-09-04 that no framework writer or reader of its rows exists, that `objectui` never referenced the object in its history (its runtime-view CRUD writes the ADR-0005 `view` overlay via `client.meta.saveItem`), and that a per-user view scope is a parked v18 direction. Runtime-authored views are environment metadata; §3.5's `GET /meta/view?object=` filter stands)
 **Deciders**: ObjectStack Protocol Architects
 **Builds on**: [ADR-0003](./0003-package-as-first-class-citizen.md) (package as first-class citizen), [ADR-0005](./0005-metadata-customization-overlay.md) (one Zod source per type, org overlay), [ADR-0010](./0010-metadata-protection-model.md) (L1/L2/L3 protection)
 **Consumers**: `@objectstack/spec`, `@objectstack/metadata`, `@objectstack/objectql`, `@objectstack/rest`, `@objectstack/platform-objects`, `../objectui` (runtime switcher + Studio designer)