@@ -0,0 +1,33 @@
+---
+'@objectstack/service-analytics': minor
+---
+
+fix(service-analytics)!: the analytics door judges the two generic-exit declarations every other door judges — an object's `enable` block and a field's `internal: true` (#22634)
+
+Clause-②: no (narrowing)
+
+<!-- adr-0087: not-required (no-migration-prescription) No metadata moves: no spec key, authorable spelling, export or stored shape is removed, renamed or re-shaped, so there is nothing for `objectstack migrate meta` to rewrite. What narrows is a runtime read door: analytics stops serving objects and fields whose existing declarations already withhold them from every other generic exit, and the remedy is the declaration the author already wrote, never a rewrite of anyone's code or metadata. One optional hook, `getObjectDeclaration`, is added to the exported `AnalyticsServiceConfig` type; it is additive, and nothing on the type surface narrows. The other categories are closed on facts: the package publishes (not unpublished); no ADR-0087 id is named or touched (not registered or already-registered); and no exported declaration is removed or narrowed (not runtime-interface-only or type-surface-only). -->
+
+**BREAKING** (an accept-set narrowing), shipped as `minor` under the launch-window convention for breaking changes.
+
+Every generic exit judges an object's `enable` block through the spec's one exposure decision, `apiExposureDenialReason`: the REST data routes, the runtime dispatcher, the MCP data tools, and the cross-object search for the off switch. Every generic exit also withholds a field declared `internal: true`: the data door omits it from rows, the write responses strip it, and the engine's `aggregate()` refuses it as a group key. The analytics door read neither declaration.
+
+**FROM.** On both strategies (native SQL and ObjectQL), and for a member holding read and an administrator alike:
+
+- The ad-hoc query, the SQL face, the configured-cube door and the dataset door served the rows of an object declaring `apiEnabled: false`, and of an object whose `apiMethods` whitelist does not grant `list`.
+- On the native-SQL strategy, a field declared `internal: true` was served as a group key, as an aggregate input and as a filter operand.
+- On the ObjectQL strategy, the engine refused the same field as a group key or an aggregate input with an undeclared `500`. It still admitted the field as a filter operand.
+
+**TO.** Ahead of strategy selection, the door asks the spec's decision for the `aggregate` operation over every object a query reads: the base object, declared joins and relationship hops. It answers with the data door's codes for the same declaration:
+
+- `404 OBJECT_API_DISABLED` for `apiEnabled: false`;
+- `405 OBJECT_API_METHOD_NOT_ALLOWED` for a whitelist that does not grant the verb.
+
+On the ad-hoc doors this happens before any cube is inferred, so a refused request mints nothing. A member that reads a field declared `internal: true` is refused `400 INVALID_FIELD`, naming the object and the field. This holds in every position: dimension, measure input, filter or sort key, dataset filter, and relationship hop.
+
+- **Refused, not withheld.** On the data door, the row path omits such a field because a row is a projection. Every analytics member is evaluated instead: a group key, an aggregate input, a predicate. There is nothing to omit, and the data door's own aggregate face already refuses the field as a group key.
+- **Every caller.** Neither declaration takes a user, so administrators are refused exactly as members are. There is no system carve-out.
+- **Fails closed.** A declaration lookup that throws refuses the query with `403 PERMISSION_DENIED`, logged at `error`. `AnalyticsServicePlugin` wires the lookup from the data engine and refuses when no engine can answer. A host constructing `AnalyticsService` by hand with no `getObjectDeclaration` hook gets no gate, and is told so once.
+- **Unchanged.** An ordinary object and an ordinary field are served as before. An object that merely has an `internal` field is still served for every other field, and so is a bare count over it.
+
+**Measured producers.** On `origin/main` `f368b7e980`, no authored cube, dataset, dashboard or example in this repository names an `apiEnabled: false` object, an object whose whitelist omits `list`, or an `internal` field. The platform's System Overview datasets count `sys_user`, `sys_organization` and `sys_session`, and group `sys_audit_log` by two ordinary fields. Each of those objects grants `list`, and none of those members is `internal`. Deployed and cloud-held analytics definitions were NOT MEASURED.
@@ -0,0 +1,7 @@
+---
+'@objectstack/spec': patch
+---
+
+fix(spec): the error-code ledger records `@objectstack/service-analytics` as an emitter of `OBJECT_API_DISABLED` and `OBJECT_API_METHOD_NOT_ALLOWED` (#22634)
+
+The analytics door now answers the data door's two exposure codes for an object whose `enable` block refuses the aggregate operation, so `ERROR_CODE_LEDGER['@objectstack/service-analytics']` lists both. That is the provenance `check:error-code-provenance` holds every emitting package to. Value-only: `REGISTERED_ERROR_CODES` is unchanged, because both codes were already registered under `@objectstack/rest`. No export, schema or generated artifact moves.
@@ -266,7 +266,7 @@ PM 的工作是循环:选卡 → 认领 → 派发 → 收集 → 复核 → 报
 - 权重只排推荐不授权:读缩小特例与契约增生,⛔ 不背书投机扩张、不放行人工地板事。
 - 四维分析从业务角度写;四棱是四轴的卡面序列化,一一对应,也是分诊代裁置信门的输入。
 - 卡先于弹窗:需裁决先落 `needs-user-decision` 卡;收件箱由维护者定期消化,⛔ 不 assign 推送。
-- 决策卡带选项、推荐、证据与四棱块;被阻塞的执行卡同笔挂 `pm:blocked` + `Blocked-by:`。
+- 决策卡带选项、推荐、证据、四棱块与工作量列;受阻执行卡同笔挂 `pm:blocked`+`Blocked-by:`。
 - `AskUserQuestion` 只是在场加速器:仅当维护者在本会话 ~30 分钟内有过人类输入才可发。
 - 每问必带推荐项,被 Skip 或长挂即转卡通道,⛔ 不重弹。
 - 项目总监席:维护者在所在仓召唤 `/pm-dispatch director`;⛔ 无 Routine/cron;未回字 = 不在 = 停。
 
@@ -22,28 +22,28 @@
 带 re-check 命令的前提 / 具体问题 / 选项 / 推荐 / 相关单与 PR。正文六项:
 
 - 一句话问题:开头一句话说清冲突是什么,⛔ 不带实现名词,写客户看得见的症状。
-- 选项 × 真实代价表:每选项一行,做什么 + 客户可感知的后果;有实测的注明实测。
+- 选项 × 真实代价 × 工作量表:每选项一行,做什么 + 客户可感知后果 + 工作量;实测注明。
+- 工作量 = 车道 · 阶段/PR 数 · 实测先例(具名落地 PR 及 +/− 行数)或「无先例」;⛔ 不猜。
 - 业务含义直译:每选项配一句业务上等于什么,允许行业类比。
 - 四轴从业务立场论证(含四棱行):论据是客户、产品或事故后果,机制名词只作括号补充。
 - 防 AI 犯错轴写清出错时谁看到什么:响亮拒绝,还是静默泄露。
 - 推荐 + 回退 + 置信缺口:荐一项、给回退项、明说看不见什么;⛔ 不沿用他席推荐。
 - 推荐先只按①得出:终态句写两年后该能力的平台样子与主流平台建模,点名参照。
-- ②③④ 只调时序分期 ⛔ 不翻字母;契约迁就实现、分期半量 ⛔ 不作推荐。
+- ②③④ 与工作量只调时序分期 ⛔ 不翻字母;契约迁就实现、分期半量 ⛔ 不作推荐。
+- 工作量恒逐选项列;①读数相近而工作量差 ≥3× 推荐须点名;翻字母只凭维护者卡上另裁。
 - 自检行「只看①选 X;②③④ 是否翻转:否 / 是(理由)」,答是不改字母。
 - 裁后执行段:写明裁定之后怎么执行,让维护者只裁方向不背执行。
 
 ## 四棱卡面块固定形状
 
 - 落卡即带,⛔ 不留待维护者到场再补;四棱各一行,用中文写。
-- 语言例外见 SKILL.md 〈全体座位的不变量〉。
 - 首行机器可寻标记 `os-decision-facets`:纯文本单行与其 HTML 注释形等价,任一即满足。
 - 写后回读,提取按字面 grep;⛔ 注释形读不到永不读作无四棱块。
 - ① 项目长远合理性:本方案缩小还是扩大特例与契约增生。
 - ② 实际业务拉动:今天谁撞上;零拉动默认 defer 或 remove。
 - ③ 防 AI 犯错:闭合枚举优于自由结构,响亮拒绝优于静默容忍。
 - ④ 创业阶段不扩散:remove 优于 declare-and-maintain,每个已声明的键都是永久义务。
 - 四棱后:`Prior rulings read: <terms> → <n> hits; <ADR Dn|none>; thread: <k>|none`;未搜成整行写 unresolved。
-- 末尾推荐行 + 字母选项带自检「只看①选 X;②③④ 是否翻转:…」,再一行置信缺口。
 
 ## 应用仓推荐序特例
 
 
@@ -10,6 +10,7 @@
 - 同卡同笔只一场写,线程即顺序、后记者胜,裁前先读线程。
 - 裁决评论首行固定一条:`Ruling: batch #<n> item <k> · letter <X> · maintainer 「<verbatim>」 <UTC>`。
 - 录裁同笔改正文:首行加 `Ruled: <评论 id> · letter <X> · <UTC>`;⛔ 不新增标签与状态。
+- 裁决记录同笔写明所选字母的工作量,读数取自卡面工作量列。
 - 划掉原 ⛔ 不派断言,走 `post-stamped --body --ack-through`;漏此笔 ⇒ 接卡者先读正文退决策箱。
 - 入口:维护者说处理决裁或处理 contract-review,或 `/pm-dispatch director`。
 - 未回字 = 不在 = 停:维护者不在则本席不运行,⛔ 无巡检、审计、快照、聊天、卡评论。
@@ -21,6 +22,7 @@
 ## 基本原则
 
 - 三要素:每批 5 张;每卡从业务角度讲清问题、选项与代价;每卡带四维分析加一个推荐。
+- 呈报的代价列旁恒带工作量列(车道 · 阶段/PR 数 · 实测先例或「无先例」),与卡面同列。
 - 创业阶段不渐进:废弃别名与能力退役默认立即退休,无窗口、无双拼写宽限。
 - 一次裁清:子问题、分叉与执行参数(字母、车道、级别)同笔裁定,⛔ 不留 dev 另立决策卡。
 
 
@@ -17,22 +17,14 @@
 # stay routed here as directories: the driver still owns a same-category
 # collision, which is the residue sharding cannot remove.
 #
-# One entry below is still a SINGLE file — spec-changes.json — and #8344 asked
-# what the driver-less queue does to it. MEASURED (2026-08-13, the real in-flight
-# case plus four synthetic pairs, each merged in a clone with no
-# merge.os-regen.driver, over it and the protocol upgrade guide, then a second
-# committed single file): the queue leaves neither stale-but-clean. Both were sorted
-# unions and an ADR-0087 registration is insertion-only, so the queue's text merge
-# either takes both sides — byte-identical to the regeneration, gates green — or
-# conflicts outright. It conflicts only when the two in-flight entries are ADJACENT
-# in registry sort order; one existing entry between them is already enough to
-# merge clean AND current.
-#
-# Sharding it would not buy back an ejection, which is why it is still a single
-# file: every conflicting case also conflicts in
-# packages/spec/src/migrations/registry.ts — generated, committed, unsharded,
-# NOT_DRIVER_MANAGED — and every registration touches it by construction. The table
-# and the reproduction are in packages/spec/src/migrations/entries/README.md.
+# packages/spec/spec-changes.json LEFT this list at #22485, because it left git: the
+# #22449 B′ ruling generates it at publish (`scripts/release-spec-changes.sh` writes
+# it into the package before the tarball is packed), the pull request generates it
+# in memory, and the file is gitignored. NOT_DRIVER_MANAGED records `gen:spec-changes`
+# as untracked output. A branch that still carries a regenerated copy meets a
+# modify/delete conflict when it merges main, and the deletion is the resolution:
+# `git rm packages/spec/spec-changes.json`, then commit — git runs no merge driver on
+# a modify/delete, so nothing is deferred and no marker is left.
 #
 # docs/protocol-upgrade-guide.md LEFT this list at #22483 because nothing generates
 # it any more. It is a hand-written pointer stub naming the guide's public address,
@@ -46,7 +38,9 @@
 # forked before #22483 still defers the guide on its first merge of main; the merged
 # tree has no row to discharge it against, so the next commit and the push are
 # refused instead of passed (measured on PR #22556 with the previous head as the
-# control, both merge directions).
+# control, both merge directions). Since #22485 that refusal names the path as
+# UNROUTED and prints the remedy that settles it — compare it with the merged-in
+# side, keep the right bytes, `node scripts/check-regen-pending.mjs --release PATH`.
 #
 # `merge=os-regen` hands those paths to `scripts/git-merge-regen.mjs`, which does
 # NOT text-merge them. See that file for why it also does not regenerate them
@@ -177,7 +171,6 @@
 # case where two branches' rows do not overlap and the text merge exits 0 describing
 # neither side.
 
-packages/spec/spec-changes.json                              merge=os-regen
 packages/spec/liveness/state-counts/**                       merge=os-regen
 packages/spec/authorable-surface/**                          merge=os-regen
 packages/spec/authorable-surface.base.json                   merge=os-regen
 
@@ -136,3 +136,9 @@ examples/app-crm/storage/
 # The release lane's scratch space: the previously published tarball it unpacks
 # and the artifact it packs to verify the ADR-0087 D4 per-release section.
 .release-spec-changes/
+# The two ADR-0087 D4 projections `@objectstack/spec` ships: generated INTO the
+# package by that lane (`scripts/release-spec-changes.sh --prepare` / `--generate`)
+# right before the tarball is packed, and by `gen:spec-changes` locally. Never
+# committed (#22449 B′, #22485); `files[]` ships whatever the lane wrote.
+packages/spec/spec-changes.json
+packages/spec/protocol-upgrade-guide.md
@@ -383,9 +383,27 @@ a queue entry resolves to nobody. Route to a `team`, `department`, or
 Set Manager** — see [the `manager` callout above](#3-the-approval-node). `position`, `department`,
 `org_membership_level` and `expression` may additionally name which
 organization's directory resolves them — see
-[Approving across organizations](#cross-org-approvers). An entry that resolves
-to nobody is not an error: the request opens with an empty `pending_approvers`
-and nothing can move it, so the run parks forever.
+[Approving across organizations](#cross-org-approvers).
+
+What an entry that resolves to nobody leaves on the slate depends on its kind:
+
+- **A person entry** (`manager`, `field`) adds no slot. Nor does an
+  `expression` that yields no ids. A `user` entry never resolves to nobody: its
+  value is the slot.
+- **A group entry** (`position`, `team`, `department`, `org_membership_level`)
+  keeps its `<type>:<value>` literal as a slot, and so do a `queue` entry and an
+  `expression` value that `resolveAs` re-expands into a group with nobody in it.
+  A `position:<name>` slot is decided by whoever is staffed into that position
+  later. No person ever holds any other literal, so only an administrator can
+  decide it (the admin-override callout under
+  [Acting on requests in the console](#acting-on-requests-in-the-console)).
+  Beside entries that do resolve, a literal is a slot like any other, so a
+  `behavior` that needs every slot (`unanimous`) waits on it too.
+- **A slate left empty, or holding only literals,** goes to the node's
+  `onEmptyApprovers` policy, whose four values are listed under
+  [Approving across organizations](#cross-org-approvers). Under the default,
+  `admin_rescue`, the request opens on that slate and waits for an
+  administrator, or for a holder of a `position:` literal on it.
 
 ### The approver finds it in their queue
 
@@ -420,8 +438,8 @@ curl -b cookies.txt \
 ```
 
 `approverId` accepts a user id, an email, or a `<type>:<value>` approver literal
-(`position:finance_manager` — the form an entry falls back to when it resolves
-to no users) — and takes several values (comma-separated or repeated) to cover
+(`position:finance_manager` — the form a group entry falls back to when it
+resolves to no users) — and takes several values (comma-separated or repeated) to cover
 a person's identities in one call. A position literal matches under
 `position:<name>`, the one spelling the service admits a holder of that
 position under as their own identity. The deprecated pre-rename prefix is no
 
@@ -355,7 +355,7 @@ formViews: {
 | `kind` | Renderer behavior |
 |---|---|
 | `thank-you` | Replace the form with a confirmation panel (`title`, `message`). |
-| `redirect` | `window.location.assign(url)` after `delayMs` (defaults to 0). |
+| `redirect` | Navigate in-app to `url`, its `{{record.…}}` tokens substituted and URL-escaped, after `delayMs` (defaults to 0) — see below. |
 | `continue` | Re-read prefill values and reset state — user can submit another response without reload. |
 | `next-record` | Stub for queue contexts; falls back to thank-you when no queue is wired. |
 
@@ -382,7 +382,7 @@ submitBehavior: { kind: 'redirect', url: '/u/{{os.user.id}}' }           // not
 
 Widening this — an allowlist of absolute origins, say — waits for measured demand; the ruling took the narrowest shape deliberately.
 
-> **Current renderer status (2026-08-11).** The console shipping at the pinned `.objectui-sha` redirects **verbatim** on this value: it does not yet substitute `{{record.…}}` tokens or escape them. The three rules above are the contract, and the consumer half is tracked in [objectui#4190](https://github.com/objectstack-ai/objectui/issues/4190). Until it lands, a token would reach the browser literally — so write a plain path unless you are following that issue.
+The Console applies the three rules at submit time: it resolves each `{{record.…}}` token from the record the submit just wrote, URL-escapes the value, and navigates to the resolved path inside the console shell after `delayMs`; a `url` the schema refuses is never followed — the submit is still confirmed and the refusal is shown on screen.
 
 ### The default is mode-aware
 
 
@@ -1,6 +1,6 @@
 # ADR-0043: Actionable approval links — single-use tokens with a session-less confirm page
 
-**Status**: Accepted — implemented (proposed 2026-06-12 · calibrated 2026-06-12)
+**Status**: Accepted — implemented (proposed 2026-06-12 · calibrated 2026-06-12) · **Amended** (2026-10-10, #22631 — open-time notification is the approvals service's own `approval.requested` topic, not a flow-authored `notify` node; see the Issue bullet under Mechanics. One-tap links stay `remind()`-only; the token table and every decision below are unchanged)
 **Deciders**: ObjectStack Protocol Architects
 **Builds on**: [ADR-0042](./0042-approval-sla-escalation.md) (reserved system actors, audit-first discipline), thread interactions (#1740), [ADR-0012/0030](./0030-notification-platform-convergence.md) (messaging + outbox)
 **Closes**: [#1743](https://github.com/objectstack-ai/objectstack/issues/1743)
@@ -37,9 +37,11 @@ GET-executes design gets requests approved by robots.
 - **Issue** (`issueActionTokens`): 256-bit random raw tokens, returned
   once, hashes stored. Wired into `remind()` — each pending approver with
   a concrete identity (not `role:*` literals) gets their **own**
-  notification carrying their own approve/reject links. (Open-time
-  notification remains the flow author's `notify` node; templates there
-  can adopt the same links later.)
+  notification carrying their own approve/reject links. (Amended
+  2026-10-10, #22631: open-time notification is the approvals service's
+  `approval.requested` topic, published by `openNodeRequest` to each
+  concrete approver on the slate the request opens on — PR #22625; it
+  carries no links, and one-tap links remain `remind()`-only.)
 - **Confirm page** (`GET /api/v1/approvals/act?token=…`): session-less
   minimal HTML rendered by the plugin on the host Hono app — request
   summary (flow label, record title, action) + a POST form. Invalid /