@@ -0,0 +1,42 @@
+---
+'@objectstack/spec': minor
+---
+
+**BREAKING for authored metadata** — an ADR-0031 structured region body (`loop.config.body`, a `parallel` branch, `try_catch`'s `try` / `catch`) now refuses two node populations at parse: a node whose TYPE parks the run on every execution, and an `end` node (#15646, absorbing #18112).
+
+Clause-②: yes
+
+The flow accept set shrinks for five node types inside region bodies — shapes the runtime never honoured. Both refusals are the authoring-time enforcement of a limit the engine already holds at run time and #3267 ruled 禁: **a region body runs synchronously inside the enclosing run, so it can neither park that run nor terminate it.**
+
+```
+✗ nodes.1.config.body.nodes.0.type: A `approval` node may not sit inside a structured region —
+  `loop 'sweep' body → try_catch 'guard' try` is a region body and the `approval` node `sign_off`
+  is inside it. A region body runs synchronously and cannot durably pause …
+```
+
+**What is refused**
+
+- **A node that pauses on EVERY execution** — `screen`, `wait`, `approval`, `approval_revise`.
+- **An `end` node**, whatever its `outcome`. An `end` in a region was a no-op, and a refusing one was converted into a region error at the boundary; neither is what the author wrote.
+
+**⛔ What is deliberately NOT refused: `subflow` and `map`.** Their shipped executors also declare `supportsPause: true`, but they pause exactly when the child flow their `config.flowName` names pauses — a **different metadata record**, not in hand while this flow is parsed. Refusing them by type would also refuse `loop { map(synchronous child) }`, a shape that runs correctly today and is covered by an existing regression suite. A parse-time rule refuses what is statically wrong; a region-contained node that actually suspends is a fact only the run holds. **Nothing an author wrote with a region-nested `map` or `subflow` needs editing for this release.**
+
+**Why it was silent, measured.** The engine converts a suspension raised inside a region into an error — but the executor has already written its progress state into the ENCLOSING scope by then. Contain that error in a `try_catch` and the residue is read back as progress by the next entry to the same node. On a real `AutomationEngine`, `loop { try_catch { map(pausing child) } }` over 3 iterations × 2 items: not one item's subflow completed, only two of three iterations reached the catch, and iteration 3 read `started === collection.length`, ran nothing, and returned `success` with `summary.failed = 0`. ⚠️ Read that for the MECHANISM, not for this change's reach — the shape it was measured on is a `map`, and making that run's refusal loud is a separate change to the automation engine, not this one.
+
+### Migration — FROM → TO
+
+| You wrote | Write instead |
+| --- | --- |
+| `loop { body: [ …, end ] }` | `loop { body: [ … ] } → end` — give the region a normal exit and put the terminator, with its `outcome` / `message`, on the top-level graph |
+| `loop { body: [ wait ] }` | a top-level `wait`, with the top-level graph as the repeating construct — a region body cannot park the run, so the nested form never waited |
+| `parallel { branches: [ [ approval ] , … ] }` | put the `approval` on the top-level graph and fan out around it, or split the branch's pausing half into a `subflow` the top-level graph calls |
+
+The one-line fix is always the same: **move the node onto the top-level graph and route the region's exit to it.** ⛔ Not mechanically convertible — hoisting a node out of a region is a graph rewrite (new edges, a changed exit, sometimes a deleted container) and which shape the author meant is an intent no artifact records, so this ships as an ADR-0087 D3 structured TODO rather than a D2 conversion.
+
+<!-- adr-0087: registered structured-region-body-pause-and-end-refused -->
+
+**⚠️ Two boundaries this refusal does not reach, stated rather than discovered.** A pausing node type contributed by a **plugin** is not refused: ADR-0018 left the node-type namespace open and a parse has no registry. A region nested past **`MAX_REGION_DEPTH` (32)** is not judged: the parse walk stops there, and unlike a duplicate node id there is no second spec refusal behind it. For both, the engine's run-time refusal is the only one — unchanged by this change, and not fixed by it.
+
+⛔ No engine source is edited. What the refusal does to the run time is stated rather than left to be discovered: `AutomationEngine.registerFlow` and the ADR-0087 stored-row rehydration seam both go through `FlowSchema.parse` (`canonicalizeStoredFlow`), so a flow carrying a refused shape no longer registers or rehydrates — it is met at LOAD, not at the region boundary, and a stored row that carries one stops loading until it is rewritten. The engine's own run-time refusals for these shapes stay in place but are reachable only through the two boundaries above; for the `end` arm those are the only remaining path, because the refusal signal it answers is raised at exactly one site — an `end` node whose `outcome` is `refused`.
+
+**Published surface.** `FLOW_PAUSE_CAPABLE_NODE_TYPES` is published with the four types above. ⚠️ Read its contents, not its name: it is the UNCONDITIONALLY pausing set, not every type that can pause — `subflow` and `map` declare `supportsPause: true` and are deliberately absent, for the reason above. The identifier is unchanged, so this release removes no export.
@@ -0,0 +1,112 @@
+---
+"@objectstack/spec": minor
+"@objectstack/formula": minor
+---
+
+feat(spec)!: every engine-evaluated expression slot requires a non-blank `source` — the #15430 rule generalised from the flow-node ledger to the other 36 declaring positions (#15811, decision batch #122 item 2)
+
+<!-- adr-0087: registered evaluated-expression-slots-source-required -->
+
+**BREAKING** accept-set narrowing on 36 published metadata slots. Each of them
+composed `ExpressionInputSchema` and now composes `EvaluatedExpressionInputSchema`,
+so an envelope carrying only `ast` (`{ dialect: 'cel', ast: … }` with no `source`)
+and a `source` that is blank after trimming — through the envelope key or through
+the bare-string shorthand — are refused at the door instead of parsing and then
+faulting at run time. The prescription is registered under protocol major 18 as
+the semantic migration `evaluated-expression-slots-source-required`.
+
+**⚠️ Graded `minor`, not `major`, and the ruling said `major`.** Decision batch
+#122 item 3 ordered a 「`major` changeset」. This repo's launch-window convention
+ships breaking changes as `minor` while the fixed group versions in lockstep, and
+`scripts/check-changeset-no-major.mjs` enforces it: a `major` marker here would
+promote all ~70 packages to a whole-stack major release, which is a release act.
+The convention's own written carriers for breaking-ness are used instead and both
+are present — this **BREAKING** banner and the ADR-0087 disposition above. The
+ruling's substance (a breaking narrowing, carried by an ADR-0087 semantic
+migration entry) is delivered; only the marker differs, and it differs because a
+repo gate forbids the marker.
+
+**What is NOT narrowed.** `ExpressionSchema` / `ExpressionInputSchema` remain the
+persistence contract (`source` OR `ast`), by item 2 of the same ruling, and so
+does `PredicateInputSchema`, which is a plain alias of the latter. A slot that
+only PERSISTS an envelope is untouched; the narrowing is at the slots an engine
+EVALUATES. An `ast` carried BESIDE a string `source` stays admitted everywhere.
+
+**The population was re-derived, not inherited.** By identity — a negative
+lookaround on identifier characters, so `CronExpressionInputSchema` and
+`TemplateExpressionInputSchema` cannot leak in as substrings — over
+`packages/spec/src`, non-test: 34 declaring source lines, two of which are
+file-local alias consts (`ui/action.zod.ts` `ActionConditionInputSchema`,
+`system/settings-manifest.zod.ts` `SettingsVisibilityInputSchema`) that mount two
+slots each, giving **36 declaring positions**. Three of them reach the schema as a
+union member rather than head-of-declaration (`RecordAlertProps.visible`,
+`ServiceLevelIndicator.successCriteria`, `TraceSamplingConfig.composite[].condition`).
+
+On **two of those three the sibling arm is untouched**: `RecordAlertProps.visible`
+still takes a boolean literal, and `ServiceLevelIndicator.successCriteria` still
+takes its structured `{ threshold, operator, percentile? }` object — including one
+that happens to carry a `dialect` key.
+
+⚠️ **On the third, `TraceSamplingConfig.composite[].condition`, the sibling arm
+narrows too, and deliberately.** Its structured-filter arm is a bare
+`z.record(z.string(), z.unknown())`, which accepted `{ dialect: 'cel', ast }` as an
+ordinary filter — so swapping the expression arm changed nothing at all there. That
+arm now declines any object carrying a `dialect` key, and six shapes the base
+accepted THROUGH THAT ARM ALONE (measured: the base's `ExpressionInputSchema`
+refused every one of them) are refused at this slot:
+
+| authored `condition` | base | now |
+|---|---|---|
+| `{ dialect: 'cel' }` | accepted | refused |
+| `{ dialect: 'js', source: 'x' }` | accepted | refused |
+| `{ dialect: 'nope', source: 'x' }` | accepted | refused |
+| `{ dialect: 'cel', source: 5 }` | accepted | refused |
+| `{ dialect: 'cel', source: 'x', meta: { rationale: 5 } }` | accepted | refused |
+| `{ dialect: 'zzz', foo: 1 }` | accepted | refused |
+
+FROM → TO at that slot: if the value really is a **structured filter**, drop the
+`dialect` key (`{ dialect: 'cel', service: 'api' }` → `{ service: 'api' }`); if it is
+an **expression**, give it a dialect this platform evaluates and a non-blank `source`
+(`{ dialect: 'js', source: 'x' }` → `{ dialect: 'cel', source: 'x' }`). A structured
+filter that carries no `dialect` key — `{}`, `{ service: 'api' }`,
+`{ attributes: { 'http.route': '/v1/orders' } }` — is accepted exactly as before.
+
+**Why an authoring-time refusal and not a run-time one.** Measured at the
+chokepoint, `celEngine.evaluate` never silently succeeds on either shape — it
+returns a `parse` fault — so what happened next was decided entirely by the
+slot's fail policy, and the two halves of that population fail in opposite
+directions: fail-CLOSED slots (`ObjectFieldGroup.visibleWhen`,
+`RowCrudActionOverride.visibleWhen`, `BulkActionDef.visible`, the two
+settings-manifest `visible` slots) hid a group, a row button, or silently excluded
+every selected record from a bulk run and reported them as *skipped*; fail-SOFT
+slots left a gate that had stopped gating. Nothing in between said a word: the
+authoring lint `validateVisibilityPredicates` measured 0 findings on an `ast`-only
+envelope and 0 on a blank `source`, against two control legs that each measured 1.
+
+**`@objectstack/formula` gains `printCelAst(ast)`** — the inverse of
+`parseCelToAst`, and the lossless half of the migration: an `ast`-only CEL
+envelope is printed back to surface syntax mechanically, with no judgment asked of
+the author. It is lossless about MEANING, not bytes (the printer re-renders from
+the parse tree, so `'x'` comes back as `"x"`), and it answers `null` — never a
+guess — for anything it cannot round-trip through the platform's own bounded
+parser. That `null`, and every blank `source`, are what the semantic migration
+entry's structured TODO covers.
+
+**The published TypeScript interface `RowCrudPredicates` narrows with it**
+(`Expression | ExpressionInput` → `EvaluatedExpression | EvaluatedExpressionInput`),
+because it mirrors the two `RowCrudActionOverride` slots and a type that still
+promised an `ast`-only envelope would advertise what the schema now refuses.
+
+**So do the four expression constructors — `expression()`, `cel`, `tmpl`, `cron`
+(and therefore the `F` / `P` aliases) — which now return `EvaluatedExpression`
+instead of `Expression`.** Each one assigns a `string` to `source`
+unconditionally, so the wider return type described none of them; it was slop
+that cost nothing until an evaluated slot began requiring `source`, at which
+point ``visibleWhen: P`…` `` — the spelling the spec's own docblock teaches —
+stopped type-checking, and `@objectstack/platform-objects` failed its DTS build
+on exactly that. `EvaluatedExpression` is assignable to `Expression`, so every
+persistence-contract slot keeps accepting these values unchanged; what the
+narrower return type adds is that an evaluated slot accepts them too. An author
+who genuinely has no `source` was never calling these constructors — an
+`ast`-only envelope is an object literal, and an evaluated slot refuses it on
+purpose.
@@ -0,0 +1,17 @@
+---
+'@objectstack/spec': minor
+---
+
+`element:text.variant` accepts the nine values objectui's text node publishes — `h1`–`h6`, `body`, `caption`, `overline` — and still accepts `heading` and `subheading` (#17108).
+
+Clause-②: yes (widening)
+
+Release 1 of 2 for the objectui#7450 convergence (director batch #71, 2026-09-07, maintainer verbatim 「其他同意」), split across two releases by the maintainer's decision of 2026-09-09, option B. This release is **additive only**: the accepted set grows by seven and nothing is refused that was accepted before, so an out-of-repo author can converge on a released pin before any spelling stops working.
+
+Measured on the 17.3.0 declaration, per value, through `ElementTextPropsSchema.safeParse`: `h1`–`h6` and `overline` were refused with `invalid_value`; they are accepted now. `heading`, `subheading`, `body` and `caption` were accepted and are accepted now. A value outside the eleven — `small` — is still refused with `invalid_value` at path `variant`, so the enum remains a closed set rather than having stopped judging `variant` at all.
+
+- **`.optional().default('body')` is kept, deliberately.** An `element:text` node parsed without a `variant` still materialises `variant: 'body'`, exactly as before. Absence is the one thing a widening must not move, and the `ui:text` side of the platform deliberately does *not* synthesise `body` for an absent `variant` (objectui#6942) — that asymmetry is pre-existing and is left where it was.
+- **⛔ Nothing is retired.** `heading` and `subheading` become named refusals carrying migration hints in **release 2**, which is a separate card and is blocked on a value-level retirement mechanism that does not exist yet: `retiredKey()` and ADR-0087 D2 retire a *key*, not a *value*. Authors who want to move early can write `h2` for `heading` and `h3` for `subheading`; neither spelling stops working in this release.
+- **No renderer changes here.** `element:text`'s renderer, its designer inspector options and its i18n rows are objectui's, on the released pin, and land on objectui's side of the sequence.
+
+Generated projections follow the declaration: `api-surface-declarations/ui.txt` gains the seven members on `ElementTextPropsSchema` and on `ComponentPropsMap['element:text']`, and the `content/docs/references/ui/component.mdx` property table widens. `check:api-surface` reports nothing removed or narrowed.
@@ -0,0 +1,51 @@
+---
+'@objectstack/spec': minor
+---
+
+**BREAKING for authored metadata** — a `$between` range now requires two endpoints that are present and non-empty. A blank bound (`''` or an absent `undefined` bound, at either side) is refused at the authoring door, and the refusal names the blank side (#18012).
+
+Clause-②: yes
+
+Maintainer ruling A on decision batch #146 item 5, 2026-09-17 「146 同意」.
+
+## What changed, and why it is a new rule rather than a repair
+
+`FieldOperatorsSchema.safeParse({ $between: [1, ''] })` answered `success: true` — measured on the card against spec 17.4.0 and re-measured on `main` before this change. That acceptance was **conformant**: the endpoint contract shared by both bounds says verbatim that "Each endpoint is a number, a Date, or a string", and the empty string is a string. So this narrows a published face by adding a rule to it, rather than pulling code back to a declaration it was already violating.
+
+What made the acceptance wrong is the other half of the same contract — "Closed interval [min, max]" — which no backend can honour against a blank. `driver-sql` binds the blank into `whereBetween`; the JS matchers compare it as a value. Either way the range stops bounding on that side **while still reading as a complete two-element range**, so the query runs with one meaningless boundary and no signal at any layer. The reference matcher was already taught to survive the `null` form of exactly this (a bounded range answered every valued row, because both of the arm's comparisons are false against a missing bound); the door that admitted it was never addressed.
+
+The only producer ever measured is a UI builder padding a **half-typed** pair so a length-based completeness check passes it. Nobody writes a blank bound on purpose — which is why it is refused rather than given a published meaning.
+
+```
+FROM  FieldOperatorsSchema.safeParse({ $between: [1, ''] })
+      -> { success: true }                       // a half-filled range, green all the way
+                                                 // to the driver
+
+TO    FieldOperatorsSchema.safeParse({ $between: [1, ''] })
+      -> { success: false,
+           issues: [{ code: 'custom', path: ['$between', 1],
+                      message: 'A blank value is not a valid $between endpoint at index 1
+                                (the MAX bound). …' }] }
+```
+
+## Migration — FROM → TO
+
+| You wrote | Write instead |
+| --- | --- |
+| `{ $between: [1, ''] }` | `{ $between: [1, 100] }` — the upper bound you meant, written out |
+| `{ $between: ['', '2026-12-31'] }` | `{ $between: ['2026-01-01', '2026-12-31'] }` — the lower bound you meant |
+| a range that was only ever bounded on ONE side | `{ "$gte": min }` or `{ "$lte": max }` — a one-sided bound is not a range |
+
+**The one-line fix: write the bound that is missing, or — if only one side was ever meant — drop `$between` and write that side as a scalar comparison.** ⛔ Not mechanically convertible: the bound the author did not type is not recoverable from the one they did, so this ships as an ADR-0087 D3 structured TODO and **no D2 conversion**. Both of the two readings a conversion could take are wrong — dropping the operator deletes a constraint the author wrote and silently WIDENS the result set, and treating the blank side as unbounded invents a filter nobody authored.
+
+<!-- adr-0087: registered filter-between-blank-endpoint-refused -->
+
+## What does NOT change
+
+- **Arity.** A one-element or three-element `$between` was already refused, and still is, by the tuple's own contract. This rule is about a two-element range one of whose elements means nothing.
+- **`null` bounds.** Already refused since 2026-08-31, and they keep **their own** message, which prescribes the null predicate — an author who wrote `null` was reaching for absence, not for a bound. Two blank spellings, two intents, two remedies.
+- **Falsiness.** `{ $between: [0, 100] }` and `{ $between: ['0', '9'] }` parse exactly as before. The rule is blankness, not falsiness.
+- **Whitespace-only endpoints** are deliberately **not** judged. The ruling is the empty string; widening the refusal past it would narrow a published face further than the ruling did.
+- **The set slots.** `{ $in: ['', 'won'] }`, `{ $nin: [''] }`, `{ $eq: '' }` and `{ $gte: '' }` are untouched — an empty string is a legitimate stored VALUE, and only an interval ENDPOINT is judged here.
+- **Stored documents.** The read path does not re-validate stored rows, and the stored-row conversion pass neither validates nor drops anything, so no stored view becomes unreadable. What changes is that **re-saving** one is refused, at the endpoint's own path, with the blank side named.
+- **The published export surface.** No export is added, removed or renamed; the refusal rides the existing endpoint factory that both the documentation copy (`RangeOperatorSchema`) and the enforced copy (`FieldOperatorsSchema`) already share, so the two cannot drift.