os-hourly-full-run-ci — machine-findable marker for this generated card. ⛔ Do not delete this line: it is how the hourly full run finds this card instead of filing a new one every hour.

hourly full run: red on main (CI)

Swept 2026-10-02T10:18:04.799Z · run log · commit ee75aae1a8ebc2625e57074527d446151535634b · conclusion failure.
CI runs the FULL battery on main every hour (#16467). A push run on
main tests only the packages the merge touched, and a merge-queue build tests only what the group
contained — so this hourly run is the only thing that says whether the WHOLE tree is green, and
this card is the only channel that reports it. Nothing is blocked by it.
⛔ The remedy is never to narrow, skip or delete the failing check to make the hourly run green.
Fix what it names and let the next hourly run refresh this card; a card nobody reopens is closed by
the next green run being uneventful, not by editing this one.

What landed since the last green hourly run

Range: bbe03f4068 (run 36705938370, the last green CI schedule run) .. ee75aae1a8 — compare

Truncated by the compare API; open the compare link for the full list.

• bee75cebe6 feat(spec)!: a form view's subform columns are the inline grid column contract, and an identity-only column is judged as the type it renders (finding(spec): an inline grid column is judged on only one of its carriers — FormViewSchema.subforms[].columns is z.array(z.any()), and a currency column's scale reaches no refusal when its type comes from the child field #20901) (feat(spec)!: a form view's subform columns are the inline grid column contract, and an identity-only column is judged as the type it renders (#20901) #20927)
• 95555e71cf feat(spec): declare the per-row write-drop signal on the import and validate answers, and the served import warnings (feat(spec): declare the per-row write-drop signal on the import and validate answers, and the served import warnings #20930)
• 1571aedce5 fix(service-analytics)!: one field-level read gate at the analytics door, before either strategy (security(analytics): the native-SQL strategy answers a query naming a field the caller has no field-level read permission for, where the engine and the ObjectQL strategy refuse 403 #20917) (fix(service-analytics)!: one field-level read gate at the analytics door, before either strategy (#20917) #20931)
• 31c39964fc feat(spec): offer useGrouping on the number field form, and delete its stale not-enforced-yet omit row (feat(spec): offer useGrouping on the number field form, and delete its stale not-enforced-yet omit row #20934)
• 3fbf3ca617 fix(core,drivers,formula,metadata,objectql,platform-objects): refusals, field help and log lines state each decision in words instead of a tracker number (stage 5) (fix(core,drivers,formula,metadata,objectql,platform-objects): refusals, field help and log lines state each decision in words instead of a tracker number (stage 5) #20924)
• f80e2a6dad fix(rest): an import row for a missing database column answers what the create door answers (fix(rest): an import row for a missing database column answers what the create door answers #20941)
• 8460592f08 fix(metadata,objectql,driver-memory): route queryHistory through the lowering, lower type-blind without a field map, then delete driver-memory F3 ([finding] 仓内存在 5 个独立的过滤器→谓词编译器,每次语义裁决成本 ×5 —— 值得立「谓词编译收敛」调查程序(#5298 成本清单副产品) #5930 step 4, group 1b) (fix(metadata,objectql,driver-memory): route queryHistory through the lowering, lower type-blind without a field map, then delete driver-memory F3 (#5930 step 4, group 1b) #20925)
• 75519e1c0a fix(service-automation, metadata-protocol): a shipped flow name arms the loader's body at both boot steps, and a stored row of that name is reported as shadowed (automation: at kernel:ready the flow sync re-arms a stored row's body over the loader's for a packaged flow name, after the boot pull armed the loader's, so the stored body runs while the receipt says the package's is armed #20913) (fix(service-automation, metadata-protocol): a shipped flow name arms the loader's body at both boot steps, and a stored row of that name is reported as shadowed (#20913) #20942)
• 95fed33a20 fix(driver-memory): the cube face lowers the FilterArray spelling of where instead of answering every row (fix(driver-memory): the cube face lowers the FilterArray spelling of where instead of answering every row #20944)
• 5ad848845d docs(cli): re-anchor the dead tracker citations in lane files outside stage 14's list to the commits that decided them (docs(cli): re-anchor the dead tracker citations in lane files outside stage 14's list to the commits that decided them #20947)
• 013f97df93 docs(spec): record_related names its row placement inside a parent record (docs(spec): record_related names its row placement inside a parent record #20948)
• 3ad65b0ccc ci(console-pin): a head that moves the spec's entry layout runs Console Pin Gate and misses its dist cache (ci(console-pin): a head that moves the spec's entry layout runs Console Pin Gate and misses its dist cache #20945)
• 3693a1b50d fix(lint): field-no-consumers reads an inline grid column name as a field of the child object (fix(lint): field-no-consumers reads an inline grid column name as a field of the child object #20950)
• f6ccca4a44 fix(objectql,rest): a date or datetime refused for its year names the kind's years, not an ISO-8601 sentence ([finding] the write door refuses a readable ISO datetime outside its years with "must be a valid datetime (ISO-8601)", a false sentence for that value; the comparand door names the range, the write door does not #20846) (fix(objectql,rest): a date or datetime refused for its year names the kind's years, not an ISO-8601 sentence (#20846) #20952)
• c1602ba429 docs: shared picklist — NORTH-STAR feature line, two planned records-forms items, coverage waiver; upgrade skill stops claiming a connector sync ran (docs: shared picklist — NORTH-STAR feature line, two planned records-forms items, coverage waiver; upgrade skill stops claiming a connector sync ran #20938)
• c6b3a01d5d fix(spec): the field → name respelling reaches a form view's subform columns as its own ADR-0087 step, and two step-18 entries read true (finding(spec): an inline grid column is judged on only one of its carriers — FormViewSchema.subforms[].columns is z.array(z.any()), and a currency column's scale reaches no refusal when its type comes from the child field #20901) (fix(spec): the field → name respelling reaches a form view's subform columns as its own ADR-0087 step, and two step-18 entries read true (#20901) #20953)
• de8cd58685 fix(plugin-security)!: a field the caller may not read is judged as a cross-field comparand exactly as it is as a filter key (security(plugin-security): the engine's field guard does not judge a cross-field comparand that names a field the caller may not read, so a comparison against a hidden field is served instead of refused 403 #20932) (fix(plugin-security)!: a field the caller may not read is judged as a cross-field comparand exactly as it is as a filter key (#20932) #20954)
• d7b9817693 fix(rest): an import row for a NOT NULL refusal or a unique conflict answers what the create door answers (fix(rest): an import row for a NOT NULL refusal or a unique conflict answers what the create door answers #20956)
• 4957ee5ef0 docs(skills): objectstack-query states the served nested-relation filter in where, its limits, and the two-step route past them (docs(skills): objectstack-query states the served nested-relation filter in where, its limits, and the two-step route past them #20902)
• ff5ca47b07 docs(adr): ADR-0005 appendix (c) — the storage switch is in force for view, and a saved view stores the parsed value of every key its body carried (ruling B) (docs(adr): ADR-0005 appendix (c) — the storage switch is in force for view, and a saved view stores the parsed value of every key its body carried (ruling B) #20899)
• b1aee33f88 fix(metadata-protocol)!: refuse a flow saved into a package this deployment has not installed (metadata: the /meta flow save accepts a write bound to a package id that no installed package has, and stores it active #20863) (fix(metadata-protocol)!: refuse a flow saved into a package this deployment has not installed (#20863) #20959)
• 83480c6a2f fix(security,service-analytics)!: the security contract publishes which fields a caller may query on, and the analytics field gate refuses a masked field as a group or filter member (security(analytics): a field the caller may only see masked is answered unmasked as a grouped or filtered member on the native-SQL strategy; the published field reader has no masked-for-this-caller answer #20935) (fix(security,service-analytics)!: the security contract publishes which fields a caller may query on, and the analytics field gate refuses a masked field as a group or filter member (#20935) #20955)
• 5f6b63a6fd fix(service-analytics)!: an object read through a relationship path joins the one admitted and scoped object set (security(analytics): on the native-SQL strategy an inferred cube's relationship path reads the related object without that object's read admission or its row scope #20933) (fix(service-analytics)!: an object read through a relationship path joins the one admitted and scoped object set (#20933) #20962)
• 212d613ca0 pm-dispatch: retire the fleet one-tooling-slot rule; a lane’s open P0/P1 is an undispatched one (pm-dispatch: retire the fleet one-tooling-slot rule; a lane’s open P0/P1 is an undispatched one #20967)
• 525b8139a2 fix(service-analytics): a date-bucket key's two readers match core's writer for a year below 1000, and the draft preview keys a week by its ISO label ([finding] service-analytics still spells a year below 1000 its own way: formatDateBucket labels bucket key 0050 as 1970 and 0050-06 as 50-06, and the draft-preview bucketDate writes unpadded keys the published path no longer writes #20867) (fix(service-analytics): a date-bucket key's two readers match core's writer for a year below 1000, and the draft preview keys a week by its ISO label (#20867) #20971)
• 05be352596 fix(formula,plugin-security): the cross-class field-comparison refusal leads with its remedy, so REST callers read the fix (refusal text: the cross-class field-comparison refusal (972 characters) is cut at the 500-character client bound before its remedy sentence, so no caller of /data or security/explain reads the fix #20869) (fix(formula,plugin-security): the cross-class field-comparison refusal leads with its remedy, so REST callers read the fix (#20869) #20972)
• 7fa67dada3 fix(pm): fleet-write lands a pull mutation only when its answer shows the requested state (fix(pm): fleet-write lands a pull mutation only when its answer shows the requested state #20974)
• 587c84e6d5 fix(release): the audit backfills only a version whose whole fixed group is on npm (fix(release): the audit backfills only a version whose whole fixed group is on npm #20978)
• dfe5a0863f docs(cli): drop the dead tracker number from bin/run.js docblock and keep the sentence (docs(cli): drop the dead tracker number from bin/run.js docblock and keep the sentence #20983)
• 8d329f02ee fix(service-analytics)!: the nested-relation filter gets the engine's answer on every analytics face — the related object read as the caller, capped (#20802 analytics half (domain:services): the cube read and the analytics read scope answer { relation: { field: value } } as the engine seam now serves it — as the caller, capped, one answer on every face #20887) (fix(service-analytics)!: the nested-relation filter gets the engine's answer on every analytics face — the related object read as the caller, capped (#20887) #20916)
• 315888d660 feat(spec,lint): one derived list of page-component slot positions, read by all three page walks (spec(ui): walkAddressedPageComponents skips page:card's properties.footer as a back-compat spelling, but PageCardProps.footer is a declared, rendered slot, so nodes there go unjudged; the three platform page walks disagree on positions #20940) (feat(spec,lint): one derived list of page-component slot positions, read by all three page walks (#20940) #20961)
• a5bce40888 fix(scripts): the citation extractor reads hyphen-suffixed, slash-joined and URL-spelled citations, pinned in one spelling table (fix(scripts): the citation extractor reads hyphen-suffixed, slash-joined and URL-spelled citations, pinned in one spelling table #20989)
• f8178ffece fix(driver-memory): $contains on a multi-valued or JSON-stored field is membership, on every face (fix(driver-memory): $contains on a multi-valued or JSON-stored field is membership, on every face #20984)
• 25f2e64657 fix(metadata-protocol): the by-name read of a shipped flow name serves the loader's body, as the list does (metadata: the by-name flow read serves a stored row's body under the shipping package's provenance for a shipped flow name, so it disagrees with the flow list, which serves the loader's body #20946) (fix(metadata-protocol): the by-name read of a shipped flow name serves the loader's body, as the list does (#20946) #20994)
• 8055ff2279 docs(releases): append a dated correction to the 17.3.0 migrate-meta upgrade bullet (docs(releases): append a dated correction to the 17.3.0 migrate-meta upgrade bullet #20985)
• e161ad358d fix(rest): a NOT NULL refusal's hint leads with the remedy for a declared column and names schema drift only as a condition (fix(rest): a NOT NULL refusal's hint leads with the remedy for a declared column and names schema drift only as a condition #21001)
• 9b0de7de73 docs(tsconfig,tests): prose naming the retired check:type-source-resolution reads in the past tense (docs(tsconfig,tests): prose naming the retired check:type-source-resolution reads in the past tense #20996)
• 1979df04ad docs(qa): re-point the eight accept-set checklist anchors at their enclosing declarations (docs(qa): re-point the eight accept-set checklist anchors at their enclosing declarations #20999)
• b84b240b2a feat(cli,lint)!: os validate and os build refuse a field picklist that names no picklist, and lint R8 counts picklist as an options source (feat(cli,lint)!: os validate and os build refuse a field picklist that names no picklist, and lint R8 counts picklist as an options source #21003)
• 2f2fa11d75 fix(approvals): a snapshot field the reader is served masked is no longer served as stored (security(approvals): the approval snapshot redaction narrows by getReadableFields, which counts a field the caller is served masked as readable, so such a field may reach an approver as stored rather than masked (source-read, not yet measured) #20964) (fix(approvals): a snapshot field the reader is served masked is no longer served as stored (#20964) #20993)
• b253fadfb7 docs(devx): re-anchor the dead tracker citation in check-test-typecheck and regenerate the 19 test-typecheck ledgers (docs(devx): re-anchor the dead tracker citation in check-test-typecheck and regenerate the 19 test-typecheck ledgers #21010)
• a3dc8171ce fix(driver-memory,driver-mongodb): refuse a non-boolean $exists comparand with INVALID_FILTER / 400, as $null's is refused ([finding] $exists with a non-boolean comparand ("yes", 1) is accepted at every door and inverted on driver-memory: it returns the rows with NO value; the spec declares $exists: z.boolean(), and its $null twin is refused #20897) (fix(driver-memory,driver-mongodb): refuse a non-boolean $exists comparand with INVALID_FILTER / 400, as $null's is refused (#20897) #20979)
• 173b68ed69 docs(cli): state the package-docs search as the any-depth rule it is (docs(cli): state the package-docs search as the any-depth rule it is #21013)
• f257223600 docs(changeset): scope two pending service-analytics BREAKING banners to the SQL echo on either strategy, and anchor the nested-relation note to its measured base (docs(changeset): scope two pending service-analytics BREAKING banners to the SQL echo on either strategy, and anchor the nested-relation note to its measured base #21012)
• 2a4254a608 fix(release): the release-integrity backfill builds from the version commit's tree, not github.sha (fix(release): the release-integrity backfill builds from the version commit's tree, not github.sha #21008)
• d67b94280a fix(objectql): a per-aggregation filter counts $contains on a multi-valued field by membership, as its where twin does (fix(objectql): a per-aggregation filter counts $contains on a multi-valued field by membership, as its where twin does #21004)
• d1f8ce8658 ci(pr-automation): run the ADR-0087 and major-bump steps past a designed Check Changeset red (ci(pr-automation): run the ADR-0087 and major-bump steps past a designed Check Changeset red #20976)
• 576afc17bd docs(spec): the 17.4.0 entry no longer records the paid packages/rest follow-up as owed (docs(spec): the 17.4.0 entry no longer records the paid packages/rest follow-up as owed #21014)
• 14bde86fad fix(pm): check-widening-tells pays a tombstone re-declared through a transparent wrapper (fix(pm): check-widening-tells pays a tombstone re-declared through a transparent wrapper #21016)
• 9bdbd76613 docs(agents,os-regen-merge): the driver-free merge-tree probe fetches both commits (docs(agents,os-regen-merge): the driver-free merge-tree probe fetches both commits #20968)
• 78e3e3a622 docs(qa): studio-authoring.doc-on-app-menu — the doc app-menu acceptance item, with its first run (docs(qa): studio-authoring.doc-on-app-menu — the doc app-menu acceptance item, with its first run #20973)
• bb2eccf7ed fix(service-analytics)!: the analytics door refuses a multi-value grouping and a JSON-stored count_distinct, judged on the declaration, as the engine does (fix(service-analytics)!: the analytics door refuses a multi-value grouping and a JSON-stored count_distinct, judged on the declaration, as the engine does #21019)
• 8f784959cf fix(rest): the import template answers to the import door's gates, not the export's (The import template (GET /data/:object/export?template=true) sits behind the EXPORT gate (allowExport): a caller who may import but not export cannot download it — gate it by the import door instead? (from #18386 acceptance-6 verification) #20896) (fix(rest): the import template answers to the import door's gates, not the export's (#20896) #20977)
• ebb66aa198 fix(spec): registration remedies name the entry file and gen:migration-registry, never the generated registry.ts (fix(spec): registration remedies name the entry file and gen:migration-registry, never the generated registry.ts #21021)
• 5d5e679873 feat(spec)!: an analytics cube member's sql is a column reference, and the showcase done rate moves to its dataset ([Decision] analytics field gate (#20917): an authored cube member whose sql is an expression — keep the stand-down, judge its identifiers, refuse it, or retire expressions #20943) (feat(spec)!: an analytics cube member's sql is a column reference, and the showcase done rate moves to its dataset (#20943) #20998)
• 6073bb96b8 fix(cli): os migrate meta prints the manual change that judges an applied edit beside that edit, marked review (fix(cli): os migrate meta prints the manual change that judges an applied edit beside that edit, marked review #21025)
• 4f83db5a73 fix(spec): the pure-annotation build plugin marks real calls only, so the published text equals its source ([finding] spec build: the pure-schema-construction plugin rewrites strictObject( inside a string literal, so the published migration text differs from its source #20686) (fix(spec): the pure-annotation build plugin marks real calls only, so the published text equals its source (#20686) #20992)
• b8191f7fc3 chore(objectui): bump the console pin to e420df310f5b (carries objectui#11163 and objectui#11199) (chore(objectui): bump the console pin to e420df310f5b (carries objectui#11163 and objectui#11199) #20990)
• ceee88f46e fix(plugin-security,driver-sql,driver-turso): lower type-blind at the RLS seam without a guard, then delete the F1/F2 whole-day and NOT-rewrite copies ([finding] 仓内存在 5 个独立的过滤器→谓词编译器,每次语义裁决成本 ×5 —— 值得立「谓词编译收敛」调查程序(#5298 成本清单副产品) #5930 step 4, group 2) (fix(plugin-security,driver-sql,driver-turso): lower type-blind at the RLS seam without a guard, then delete the F1/F2 whole-day and NOT-rewrite copies (#5930 step 4, group 2) #20988)
• d830d71faf feat(spec): a retired key's tsc error names the retirement and points at os validate ([finding][devx] a retired spec key surfaces in tsc as TS2322: Type 'string' is not assignable to type 'undefined' — nothing in the type error says the key was retired or what replaces it #20621) (feat(spec): a retired key's tsc error names the retirement and points at os validate (#20621) #21023)
• 5dbeb7d7b7 fix(service-analytics): the ObjectQL strategy hands the engine its null tests as $null, so a $not over a multi-valued lookup gets the engine's rows (analytics: on the ObjectQL strategy a $not over a multi-valued lookup ($contains) is refused 400, because the NULL-safe guard reaches driver-sql as $ne: null on a JSON column, where the engine answers the rows #20918) (fix(service-analytics): the ObjectQL strategy hands the engine its null tests as $null, so a $not over a multi-valued lookup gets the engine's rows (#20918) #21036)
• 0c5a71b094 fix(metadata-protocol): a packaged action or permission set's refusal names its own sanctioned path (ADR-0126 Regime C rows) (fix(metadata-protocol): a packaged action or permission set's refusal names its own sanctioned path (ADR-0126 Regime C rows) #21026)
• a75311dd27 fix(objectql)!: engine aggregate asks the field-type table for every row — min / max / avg over a refused type answer INVALID_FIELD / 400 on every driver (fix(objectql)!: engine aggregate asks the field-type table for every row — min / max / avg over a refused type answer INVALID_FIELD / 400 on every driver #21037)
• d1633f3ae8 fix(core,driver-sql,service-analytics): the analytics native-SQL path answers measures declared number as numbers ([finding] analytics: on PostgreSQL the native-SQL path answers a measure the response declares number as a string (count: "2"), where SQLite answers 2 — the class #20335 closed at the engine door #20889) (fix(core,driver-sql,service-analytics): the analytics native-SQL path answers measures declared number as numbers (#20889) #21040)
• 657b6b7f30 feat(objectql,metadata-protocol): validate and insertMany answer which row lost which field (feat(objectql,metadata-protocol): validate and insertMany answer which row lost which field #21041)
• 2821e9f15b feat(cli)!: os validate and os build refuse a picklistExtensions entry whose extend names no declared picklist (feat(cli)!: os validate and os build refuse a picklistExtensions entry whose extend names no declared picklist #21049)
• 94990a29f8 fix(metadata-protocol): the layered read of a shipped flow name reports the loader's body as the effective layer, as the by-name read and the list do (metadata: the layered read of a shipped flow name reports a stored row as the effective layer, so after #20946 it disagrees with the by-name read and the list (and the published-snapshot read serves that layer) #21002) (fix(metadata-protocol): the layered read of a shipped flow name reports the loader's body as the effective layer, as the by-name read and the list do (#21002) #21043)
• a9d36d51b7 fix(plugin-security)!: a caller who resolves no permission set is served a masked field masked and may not query on it (fix(plugin-security)!: a caller who resolves no permission set is served a masked field masked and may not query on it #21051)
• 11d28c17df feat(spec)!: a dimensionless dashboard widget declares two or more measures only on a type that renders them — refuse pie / donut / funnel / scatter / radar / treemap / sankey at values (objectui#8894 ruling D) (feat(spec)!: a dimensionless dashboard widget declares two or more measures only on a type that renders them — refuse pie / donut / funnel / scatter / radar / treemap / sankey at values (objectui#8894 ruling D) #21053)
• dcd3309f2e fix(core,objectql)!: a relative-date placeholder resolved outside its field's years is refused INVALID_FILTER / 400, naming the placeholder and the year (fix(core,objectql)!: a relative-date placeholder resolved outside its field's years is refused INVALID_FILTER / 400, naming the placeholder and the year #21065)
• dff98c1f51 ci(lint): every job in lint.yml carries a timeout-minutes derived from its measured duration (ci(lint): every job in lint.yml carries a timeout-minutes derived from its measured duration #21064)
• 6f578888a8 fix(plugin-audit)!: an engine read of sys_activity returns only the rows whose parent record the caller can read (fix(plugin-audit)!: an engine read of sys_activity returns only the rows whose parent record the caller can read #21069)
• c27404f0a9 fix(spec,i18n): an object's embedded listViews are served translated from the _views keys the extractor writes (finding(spec,i18n): translateObject never reads an object's embedded listViews, so their labels are served in the authored language while os i18n extract writes _views keys for them #21006) (fix(spec,i18n): an object's embedded listViews are served translated from the _views keys the extractor writes (#21006) #21072)
• b3d7a70864 fix(spec): ObjectSchema.fields refuses constructor / prototype at the offending key, not at the fields slot (fix(spec): ObjectSchema.fields refuses constructor / prototype at the offending key, not at the fields slot #21070)
• 94608a7d72 fix(spec): a book tree's Uncategorized group holds only the book's own packages' unplaced docs, per ADR-0046 §6.4 ([finding] GET /meta/book/:name/tree puts every package's ungrouped docs in the book's synthetic Uncategorized group — resolveBookTree's orphan catch-all ignores bookPackage, against ADR-0046 §6.4 and the portal's per-package answer #20980) (fix(spec): a book tree's Uncategorized group holds only the book's own packages' unplaced docs, per ADR-0046 §6.4 (#20980) #21076)
• e0c768fbd4 ci(dogfood): carry the shard slice in a task env so the dogfood test hash sees its upstream closure (ci(dogfood): carry the shard slice in a task env so the dogfood test hash sees its upstream closure #21074)
• 6fc22b780d docs(merge-driver): the system-context row's prose says the line-anchors comparator is the identity on that page today (docs(merge-driver): the system-context row's prose says the line-anchors comparator is the identity on that page today #21075)
• 63d1a7c378 docs(react-pages,skills,showcase): teach the data-invalidation nonce in a react page's live-data effect, opt the two showcase react pages in (docs(react-pages,skills,showcase): teach the data-invalidation nonce in a react page's live-data effect, and opt the two showcase react pages in (ruling A on objectui#10887 member 3) #20395) (docs(react-pages,skills,showcase): teach the data-invalidation nonce in a react page's live-data effect, opt the two showcase react pages in (#20395) #21045)
• 88b484e00c feat(objectql): resolve picklist references at runtime — served options, additive extensions, write validation, load-time refusal (feat(objectql): resolve picklist references at runtime — served options, additive extensions, write validation, load-time refusal #21047)
• 318bdafd51 fix(scripts): the SDUI manifest generator realpaths its runner directory, so a TMPDIR behind a symlink (the macOS default) no longer fails regeneration (fix(scripts): the SDUI manifest generator realpaths its runner directory, so a TMPDIR behind a symlink (the macOS default) no longer fails regeneration #21077)
• c2ec2986ac docs(qa): re-point the two-factor-disable mfa_required anchor at a declaration the resolver reads (docs(qa): re-point the two-factor-disable mfa_required anchor at a declaration the resolver reads #21027)
• fed0db8f69 docs(data): count_distinct is lowered on the SQL family; state the real limit (docs(data): count_distinct is lowered on the SQL family; state the real limit #21085)
• b10f6e46d4 fix(deps): take the fix for next GHSA-vcvr-r3jv-pc5j (critical) and dompurify GHSA-p98j-92pf-mc4p (fix(deps): take the fix for next GHSA-vcvr-r3jv-pc5j (critical) and dompurify GHSA-p98j-92pf-mc4p #21083)
• 9b81314c29 fix(service-analytics)!: a relationship-path hop with no declared join reads the object its lookup field declares (analytics: on an inferred cube, a dotted path through a lookup whose name differs from its target object is never served — the door admits (and refuses) the lookup's NAME as if it were an object #20986) (fix(service-analytics)!: a relationship-path hop with no declared join reads the object its lookup field declares (#20986) #21088)
• d19da5d620 docs: a cube member's sql is a column reference, in ADR-0021, the dashboards skill and the cube checklist item (docs: a cube member's sql is a column reference, in ADR-0021, the dashboards skill and the cube checklist item #21071)
• e07566b737 fix(lint,spec): field-no-consumers reads a subform entry's child keys against the child, and credits a derived inline grid through deriveInlineGridColumns (fix(lint,spec): field-no-consumers reads a subform entry's child keys against the child, and credits a derived inline grid through deriveInlineGridColumns #21089)
• 5e470f8c1c fix(lint)!: os validate refuses a dataset dimension over a JSON-stored field, and count_distinct over a field declared multiple: true (fix(lint)!: os validate refuses a dataset dimension over a JSON-stored field, and count_distinct over a field declared multiple: true #21073)
• cf0346ec78 fix(driver-sql): os migrate plan on a new database prints no DATABASE_ERROR for the tables whose DDL it deferred ([finding] os migrate plan against a database that does not exist yet prints 6 [sql-driver] DATABASE_ERROR … no such table warnings: the dry run defers the DDL, then its boot reads sys_metadata, sys_metadata_activation and sys_migration anyway #20821) (fix(driver-sql): os migrate plan on a new database prints no DATABASE_ERROR for the tables whose DDL it deferred (#20821) #21093)
• 2742e53709 fix(spec): step 18's rationale gains the form-view-subform-columns-closed fragment (fix(spec): step 18's rationale gains the form-view-subform-columns-closed fragment #21090)
• 8368f1c005 feat(service-automation,core,types): the connector sync executor pulls a mapping's connectorSource through the import runner, moved beside bulkWrite (feat(service-automation,core,types): the connector sync executor pulls a mapping's connectorSource through the import runner, moved beside bulkWrite #21084)
• 9c8b65aa23 fix(plugin-security)!: the record an anonymous public-form submit echoes back passes the result masker (fix(plugin-security)!: the record an anonymous public-form submit echoes back passes the result masker #21101)
• 32d3b3c76e fix(cli,spec): os plugin publish sends visibility only when asked; PackageSchema.visibility defaults to org (fix(cli,spec): os plugin publish sends visibility only when asked; PackageSchema.visibility defaults to org #21099)
• d98bf24676 fix(objectql)!: engine aggregate judges the sum row too — sum over a refused type answers INVALID_FIELD / 400 on every driver (fix(objectql)!: engine aggregate judges the sum row too — sum over a refused type answers INVALID_FIELD / 400 on every driver #21103)
• 2bddb19ccb fix(runtime)!: the analytics dispatcher faces refuse an unauthenticated caller with 401 UNAUTHENTICATED (security (P0 suspect): a non-system caller who resolves no permission set — an unauthenticated one included — is admitted to aggregate any object at an analytics door, object admission and row scope skipped #21061) (fix(runtime)!: the analytics dispatcher faces refuse an unauthenticated caller with 401 UNAUTHENTICATED (#21061) #21098)
• 12fbb2fac8 fix(cli)!: os environments create drops --clone-from and the unread clone_from_environment_id key (cli: os environments create --clone-from sends clone_from_environment_id, which the control plane never reads; drop it (ruled on cloud#1876) #21028) (fix(cli)!: os environments create drops --clone-from and the unread clone_from_environment_id key (#21028) #21100)
• 53ed3d1093 fix(driver-mongodb): MongoDBDriver compiles the whole-day comparison it is handed; formula's copy stops on a measured answer move (fix(driver-mongodb): MongoDBDriver compiles the whole-day comparison it is handed; formula's copy stops on a measured answer move #21105)
• 99398542b3 fix(showcase): the contributor set's row-level policies apply to every holder of the set (fix(showcase): the contributor set's row-level policies apply to every holder of the set #21104)
• a11faeecb3 fix(objectql)!: a per-aggregation filter refuses a scalar comparison on a declared JSON-stored field, in where's words (fix(objectql)!: a per-aggregation filter refuses a scalar comparison on a declared JSON-stored field, in where's words #21097)
• 3c3a05cd45 build(typecheck): graduate cloud-connection, observability and hono from the DEBT ledger (type-check coverage: graduate the last three DEBT packages (cloud-connection, hono, observability) — the remainder of #4311 #20800) (build(typecheck): graduate cloud-connection, observability and hono from the DEBT ledger (#20800) #21038)
• ba03198789 docs: point the two stale merge-tree probe copies at the fetch-first recipe ([finding] Two more copies of the fetch-less driver-free merge-tree probe misread a missing object as a conflict: platform-readings.md (the seat's conflict proof) and migrations/entries/README.md ("Reproduce any row") #20970) (docs: point the two stale merge-tree probe copies at the fetch-first recipe (#20970) #21112)
• 514001a8d8 fix(rest,runtime): the published-snapshot doors answer the package's flow for a shipped flow name with a stored row, as the layered read does (metadata: the layered read of a shipped flow name reports a stored row as the effective layer, so after #20946 it disagrees with the by-name read and the list (and the published-snapshot read serves that layer) #21002) (fix(rest,runtime): the published-snapshot doors answer the package's flow for a shipped flow name with a stored row, as the layered read does (#21002) #21116)
• 7a606a9a34 fix(rest,runtime): datasource metadata reads require the same capability as the datasource admin door (fix(rest,runtime): datasource metadata reads require the same capability as the datasource admin door #21119)
• cfad7de9bc fix(metadata-protocol)!: stored metadata bodies on the generic data door are served as their type's read projection ([security] Stored datasource credentials are served unredacted to an admin through a read path outside the two datasource read doors — detail withheld pending maintainer #21086) (fix(metadata-protocol)!: stored metadata bodies on the generic data door are served as their type's read projection (#21086) #21115)
• b11d778080 chore(ci)(deps): bump actions/create-github-app-token from 2 to 3 (chore(ci)(deps): bump actions/create-github-app-token from 2 to 3 #21022)
• 670680e93e docs(qa): P0 sweep follow-through — re-point query-contract-matrix, correct the run's checklist findings, extend two pins (docs(qa): P0 sweep follow-through — re-point query-contract-matrix, correct the run's checklist findings, extend two pins #21111)
• 840ec9dab3 chore(deps)(deps-dev): bump the development-dependencies group across 1 directory with 16 updates (chore(deps)(deps-dev): bump the development-dependencies group across 1 directory with 16 updates #21024)
• 250dec8971 feat(metadata-protocol): a stored page naming an absent plugin is reported at load, and draft promotion re-stamps requires (feat(metadata-protocol): a stored page naming an absent plugin is reported at load, and draft promotion re-stamps requires #21121)
• 1bd14c9848 fix(core)!: a date macro whose offset lands past every instant a JavaScript Date holds is refused INVALID_FILTER / 400, naming the placeholder (fix(core)!: a date macro whose offset lands past every instant a JavaScript Date holds is refused INVALID_FILTER / 400, naming the placeholder #21123)
• b616c0a63d feat(lint): a ledger-dead or live-elsewhere key warns without an authorWarn opt-in, and never shows the ledger note (lint: liveness-dead-property and liveness-live-elsewhere-property cannot fire on 17.3.0 — 90 dead + 1 live-elsewhere ledger rows and not one sets authorWarn #16094) (feat(lint): a ledger-dead or live-elsewhere key warns without an authorWarn opt-in, and never shows the ledger note (#16094) #21092)
• 39ab2940e2 fix(service-analytics)!: the cube door asks the aggregate × field-type table for every measure (analytics: a config cube min/max over a text column is served at the cube door under fields[] type number; the dataset door refuses the pair by the compatibility table, the cube door consults nothing #21044) (fix(service-analytics)!: the cube door asks the aggregate × field-type table for every measure (#21044) #21128)
• 399e3aa97b fix(examples,spec): dashboard widget options census — examples drop the options keys no dataset-bound renderer reads, and the schema doc states the read set (fix(examples,spec): dashboard widget options census — examples drop the options keys no dataset-bound renderer reads, and the schema doc states the read set #21130)
• 432c8abb48 fix(plugin-auth): mount the OIDC discovery routes before the socket opens, not after the auth instance builds (fix(plugin-auth): mount the OIDC discovery routes before the socket opens, not after the auth instance builds #21132)
• c6954d6d09 fix(service-datasource): the datasource admin door judges the record it will persist against DatasourceSchema ([finding] POST /api/v1/datasources (and the PATCH door) never run DatasourceSchema's cross-field refinements — a mongo credentialsRef pairing that os build and PUT /meta refuse is accepted 201, and the bound secret is silently unused #21058) (fix(service-datasource): the datasource admin door judges the record it will persist against DatasourceSchema (#21058) #21133)
• 665cab338f fix(plugin-security,spec)!: a caller who resolves no permission set is not served a capability-gated field, and the security contract says so (fix(plugin-security,spec)!: a caller who resolves no permission set is not served a capability-gated field, and the security contract says so #21134)
• b3917d9090 feat(spec)!: action:button / action:icon refuse endpoint with ActionSchema's rename to target, read from one table (finding(spec): action:button / action:icon accept endpoint, the key ActionSchema refuses with the prescription endpoint → target: one concept, two verdicts in one release #21005) (feat(spec)!: action:button / action:icon refuse endpoint with ActionSchema's rename to target, read from one table (#21005) #21122)
• e952cff578 fix(service-knowledge): drop the record.* branch from the realtime event bridge and name data.record.* in its docs (fix(service-knowledge): drop the record.* branch from the realtime event bridge and name data.record.* in its docs #21140)
• 27c0cf3f75 fix(spec): the object-kanban quickAdd retirement prescribes "delete the key", not the unregistered kanban-ui block (fix(spec): the object-kanban quickAdd retirement prescribes "delete the key", not the unregistered kanban-ui block #21141)
• db48028f1a docs(adr): close ADR-0006 v4 open question 2 as org (cli: os package publish sends visibility: org when --visibility is omitted, so re-publishing a marketplace package silently demotes it to org visibility #20892) (docs(adr): close ADR-0006 v4 open question 2 as org (#20892) #21126)
• 35729160a2 test(metadata-core,driver-mongodb): shipped case labels and mongod harness text state each case in words instead of a tracker number (stage 5b) (test(metadata-core,driver-mongodb): shipped case labels and mongod harness text state each case in words instead of a tracker number (stage 5b) #21139)
• 58a77dbde2 fix(service-analytics)!: the analytics read scope and the native where answer $contains on a JSON-stored field by membership ([finding] $contains / $notContains on a declared multi-valued or JSON-stored field still answer SUBSTRING on five faces, the analytics RLS read scope among them (u1 admits a row storing u10) #20987) (fix(service-analytics)!: the analytics read scope and the native where answer $contains on a JSON-stored field by membership (#20987) #21117)
• f20f669e17 fix(cli): os migrate plan / apply run no app onEnable and no post-declaration host hooks (fix(cli): os migrate plan / apply run no app onEnable and no post-declaration host hooks #21138)
• 70dae533c5 feat(spec): discovery reports which auth route families are mounted (authFamilies.admin) (feat(spec): discovery reports which auth route families are mounted (authFamilies.admin) #21145)
• 2488b98b48 fix(plugin-audit): an activity row serves a parent field's value only to a reader the security service serves that field (security(plugin-audit): an activity row composed at write time may carry a changed field's values to a reader who can read the parent record but not that field (unmeasured; measure first) #21081) (fix(plugin-audit): an activity row serves a parent field's value only to a reader the security service serves that field (#21081) #21152)
• df1feaed70 fix(spec): the pending connector-sync note matches the executor, and the error-code ledger lists its two refuse() codes (spec: before the next changeset version, the connector-sync release notes contradict each other and the error-code ledger misses two service-automation rows (PR #21084 follow-ups) #21106) (fix(spec): the pending connector-sync note matches the executor, and the error-code ledger lists its two refuse() codes (#21106) #21150)
• ae1e95010a fix(service-analytics): the field-level read gate refuses a cube member that names no field instead of standing down (service-analytics: delete the analytics field gate's stand-down on an authored cube expression member once #20943 retires raw expressions in a cube member's sql (the branch becomes unreachable) #20965) (fix(service-analytics): the field-level read gate refuses a cube member that names no field instead of standing down (#20965) #21153)
• fde553c509 chore(turbo): opt out of the agent-guidance block in the root turbo.json (chore(turbo): opt out of the agent-guidance block in the root turbo.json #21151)
• c35436c754 fix(objectql)!: a per-aggregation filter and having refuse a non-boolean $exists / $null with INVALID_FILTER / 400, in the drivers' words ([finding] the aggregation filter and having read a non-boolean $exists by truthiness and DROP a non-boolean $null, on every driver: the engine evaluates both in-process, and its gate refuses only $empty #20981) (fix(objectql)!: a per-aggregation filter and having refuse a non-boolean $exists / $null with INVALID_FILTER / 400, in the drivers' words (#20981) #21157)
• 7164587ffe fix(cli): os start forwards SIGTERM/SIGINT to its serve child and reaps it on exit (fix(cli): os start forwards SIGTERM/SIGINT to its serve child and reaps it on exit #21161)
• bafb8c9498 fix(rest): the public lookup picker searches and sorts by the first display field the caller may query (fix(rest): the public lookup picker searches and sorts by the first display field the caller may query #21136)
• f0cc16e8d5 fix(service-storage): presigned S3 PUT URLs no longer carry the CRC32 of an empty body (fix(service-storage): presigned S3 PUT URLs no longer carry the CRC32 of an empty body #21164)
• e35c40a525 feat(driver-turso): the remote transport issues auto_number values from the shared persistent sequence (driver-turso remote: generate auto_number values on the RemoteTransport — the #6944 appetite door now has measured demand (a hosted HotCRM environment cannot create an account: 501) #21113) (feat(driver-turso): the remote transport issues auto_number values from the shared persistent sequence (#21113) #21160)
• 327391c3af fix(lint): a liveness finding's fix text never comes from the ledger note, for any row class (fix(lint): a liveness finding's fix text never comes from the ledger note, for any row class #21169)
• d34aa58a2a fix(metadata-protocol): the layered read's code layer is null for a name no package ships, before and after hydration (metadata: once a stored flow row under a name no package ships is hydrated, the layered read reports it as the code layer, against the spec's "null when no artifact ships this item" #21059) (fix(metadata-protocol): the layered read's code layer is null for a name no package ships, before and after hydration (#21059) #21168)
• f3b16fc2f3 chore(deps): take the 2026-10 production-dependency group without the better-auth family (deps: take the 2026-10 production-dependency group without the better-auth family (replaces Dependabot #21029) #21094) (chore(deps): take the 2026-10 production-dependency group without the better-auth family (#21094) #21162)
• fbcc05f400 fix(plugin-audit): the compliance ledger's before/after snapshots serve a parent field only to a reader the security service serves that field (security(plugin-audit): the compliance ledger's create/update rows serve a withheld field's stored value in their before/after snapshots to a reader whose sets grant the ledger read, while the data plane serves that reader without the key #21155) (fix(plugin-audit): the compliance ledger's before/after snapshots serve a parent field only to a reader the security service serves that field (#21155) #21171)
• 9bdc6d3faa fix(spec): a stack whose mapping authors connectorSource validates and lints again — the live ledger row carries no author warning ([finding] os lint / os validate crash on any stack whose mapping authors connectorSource: the ledger row is live with authorWarn: true, and the liveness rule throws its integrity sentinel #21127) (fix(spec): a stack whose mapping authors connectorSource validates and lints again — the live ledger row carries no author warning (#21127) #21176)
• b9087d77e9 fix(cli,cloud-connection,types): CLI help, warnings and refusals state each decision in words instead of a tracker number (stage 1) (fix(cli,cloud-connection,types): CLI help, warnings and refusals state each decision in words instead of a tracker number (stage 1) #21172)
• 336e191441 fix(security): close out the stored-metadata-body family — project or refuse every further read/copy/evaluate exit (fix(security): close out the stored-metadata-body family — project or refuse every further read/copy/evaluate exit #21144)
• 454bbb6866 fix(rest,runtime): datasource metadata writes require the same capability as the datasource admin door (fix(rest,runtime): datasource metadata writes require the same capability as the datasource admin door #21148)
• 2c1cef3345 fix(core)!: the JSON-column gate refuses $startsWith, $endsWith, $icontains and $like / $ilike as it refuses the equality family (fix(core)!: the JSON-column gate refuses $startsWith, $endsWith, $icontains and $like / $ilike as it refuses the equality family #21165)
• ebdb6f2aca fix(driver-turso,driver-sql): a business-key upsert keeps the stored id on the remote face, and both faces answer the stored row ([finding] driver-turso remote: upsert keyed on a business column replaces the existing row's primary key (the #8622 re-key) — RemoteTransport's merge set keeps id, which the local face declares insert-only #21166) (fix(driver-turso,driver-sql): a business-key upsert keeps the stored id on the remote face, and both faces answer the stored row (#21166) #21184)
• 45ce12a480 fix(driver-memory)!: refuse the equality and ordering family on a declared JSON-stored field, in the SQL family's words ([finding] driver-memory answers the equality and ordering family per element on a multi-valued field ($eq / $in / $nin / $gt on a multiple: true lookup), where driver-sql refuses all ten with 400 INVALID_FILTER #21066) (fix(driver-memory)!: refuse the equality and ordering family on a declared JSON-stored field, in the SQL family's words (#21066) #21159)
• 0b12b9ea8f fix(service-analytics): refuse a caller-named non-column member at the analytics query door in every tier ([security] An analytics query path can carry caller-supplied member text into the native statement in a tier the field gate does not judge — detail withheld pending maintainer #21156) (fix(service-analytics): refuse a caller-named non-column member at the analytics query door in every tier (#21156) #21173)
• cb45469e67 fix(service-analytics)!: the analytics native-SQL path declines an object an engine middleware is registered for, so its read gates apply (fix(service-analytics)!: the analytics native-SQL path declines an object an engine middleware is registered for, so its read gates apply #21170)
• 0d421041d1 chore(objectui): bump the console pin to 31971ff1e28f (one zod instance in the vendored Console), add a single-zod canary to build-console.sh, and key the release console cache on the spec zod range (chore(objectui): bump the console pin to 31971ff1e28f (one zod instance in the vendored Console), add a single-zod canary to build-console.sh, and key the release console cache on the spec zod range #21149)
• f115b1ff45 fix(rest): REST refusals, notes and the OpenAPI text state each decision in words instead of a tracker number (stage 2) (fix(rest): REST refusals, notes and the OpenAPI text state each decision in words instead of a tracker number (stage 2) #21188)
• 55012df30f fix(plugin-auth): the admin identity rows on the compliance ledger record the admin's decisions, never a value of a user field (security(plugin-auth): the compliance-ledger row an admin create-user writes carries a withheld user field's value in its decision metadata, which a ledger reader withheld that field is served #21174) (fix(plugin-auth): the admin identity rows on the compliance ledger record the admin's decisions, never a value of a user field (#21174) #21195)
• 5e5ce48cef pm-dispatch: owe the isolated contract review on three contract faces; changeset and docs prose move to the seat's ACCEPT (pm-dispatch: owe the isolated contract review on three contract faces; changeset and docs prose move to the seat's ACCEPT #21192)
• b42e034673 build(turbo): build task hashes cover the root scripts each build runs (turbo: build hashes do not cover five root inputs the builds read (tsup-drop-sources-content, scaffold policy + cli init.ts, three build-time check scripts) — stage-2 precondition of the remote cache #21193) (build(turbo): build task hashes cover the root scripts each build runs (#21193) #21199)
• e18fea6dcd fix(objectql,driver-mongodb,formula): having compiles the whole-day bound it is handed; $contains asks membership on a JSON-stored field (#5930 step 4 (domain:engine): the engine-fed faces delete their hand-copied filter meaning (driver-sql, turso remote, memory query, mongodb, formula, having); the memory reference matcher retires (D6) #20822 group 3b) (fix(objectql,driver-mongodb,formula): having compiles the whole-day bound it is handed; $contains asks membership on a JSON-stored field (#20822 group 3b) #21196)
• ce8a6d29a6 feat(lint): os validate, os build and os lint flag unread dashboard widget options keys by name (feat(lint): os validate, os build and os lint flag unread dashboard widget options keys by name #21204)
• 862f12c0b9 fix(driver-turso)!: the remote filter compiler refuses the JSON-column family and answers $contains by membership ([finding] driver-turso remote: RemoteTransport.buildWhereSQL has no JSON-column gate — $contains matches a substring instead of a member, $nin fails open, and the refused families compile over the serialized array (the orphaned #20987 remote item) #21178) (fix(driver-turso)!: the remote filter compiler refuses the JSON-column family and answers $contains by membership (#21178) #21208)
• 097ef80270 fix(analytics): the native-SQL strategy applies the engine's aggregate policies — double accumulation, the PostgreSQL boolean cast and the empty-sum fold, hoisted into core (analytics: the native-SQL strategy skips the engine aggregate policies — SUM/AVG exact decimal on PostgreSQL (not #20387's double), and an all-NULL group sums to null where the ObjectQL face folds it to 0 (#15546) #21042) (fix(analytics): the native-SQL strategy applies the engine's aggregate policies — double accumulation, the PostgreSQL boolean cast and the empty-sum fold, hoisted into core (#21042) #21209)
• e2ed61a16a chore(deps): move the CLI to @oclif/core 5, with plugin-help 7 and plugin-plugins 7 in one commit (cli: move to the @oclif/core 5 line, with plugin-help 7 and plugin-plugins 7 in the same commit (replaces Dependabot #21034, #21031, #21035) #21125) (chore(deps): move the CLI to @oclif/core 5, with plugin-help 7 and plugin-plugins 7 in one commit (#21125) #21212)
• a29a0ea555 feat(spec)!: an object-master-detail-form block's detail entries are a strict shape whose columns are the inline grid column contract (finding(spec): ObjectMasterDetailFormPropsSchema.details is z.unknown(), a third unjudged carrier of the inline grid column: a bogus key or a typed currency column with scale publishes green #20928) (feat(spec)!: an object-master-detail-form block's detail entries are a strict shape whose columns are the inline grid column contract (#20928) #21215)
• ce4e205e2b fix(service-analytics)!: refuse a caller-supplied analytics member that is not a column reference at the door (fix(service-analytics)!: refuse a caller-supplied analytics member that is not a column reference at the door #21190)
• bbcd20c527 fix(core): an import row reports the fields its write dropped, on the dry run and on the commit (fix(core): an import row reports the fields its write dropped, on the dry run and on the commit #21203)
• 1ecb871beb fix(plugin-audit,plugin-approvals)!: refuse a query over activity text, ledger snapshots or the approval snapshot for a reader withheld a field of its record (security(plugin-audit): a filter over the stored activity text answers by row presence: the generic list door evaluates the predicate at rest, before #21081's read-time redaction, so a reader can probe a field value it is not served #21154) (fix(plugin-audit,plugin-approvals)!: refuse a query over activity text, ledger snapshots or the approval snapshot for a reader withheld a field of its record (#21154) #21179)
• 682873d999 fix(core): the JSON-column refusal reads true on every face and reaches a REST caller whole (fix(core): the JSON-column refusal reads true on every face and reaches a REST caller whole #21213)
• c6b6889193 fix(driver-sql): an autonumber prefix carrying _, % or \ seeds its counter from the stored MAX on SQLite ([finding] SQLite: an autonumber format whose prefix contains _ or % seeds its counter from 0 — scanMaxNumericTail escapes the prefix but Knex emits no ESCAPE clause, so the bootstrap and #5495 re-seed scans match nothing #21163) (fix(driver-sql): an autonumber prefix carrying _, % or \ seeds its counter from the stored MAX on SQLite (#21163) #21206)
• e47355be55 fix(auth, webhooks, messaging): runtime strings state each decision in words instead of a tracker number (stage 1) (fix(auth, webhooks, messaging): runtime strings state each decision in words instead of a tracker number (stage 1) #21218)
• 7c5a311a58 fix(runtime): runtime refusals, warnings and route-ledger notes state each decision in words instead of a tracker number (stage 3) (fix(runtime): runtime refusals, warnings and route-ledger notes state each decision in words instead of a tracker number (stage 3) #21219)
• 9969228626 feat(spec): ObjectSchema.imageField — an object declares its record picture, refused unless it names an image or avatar field (feat(spec): ObjectSchema.imageField — an object declares its record picture, refused unless it names an image or avatar field #21221)
• d6d6e872e5 feat(spec,client)!: ActionSchema gains outcomeMessages (success copy per handler outcome, ${result.*}), and environments.delete stops guaranteeing message (feat(spec,client)!: ActionSchema gains outcomeMessages (success copy per handler outcome, ${result.*}), and environments.delete stops guaranteeing message #21214)
• 5b481e23c0 docs(spec): the released 17.5.0 quickAdd entry no longer sends the control to the retired kanban-ui block (docs(spec): the released 17.5.0 quickAdd entry no longer sends the control to the retired kanban-ui block #21224)
• 62b90d74f7 fix(plugin-security,spec)!: a non-system caller that carries a principal and resolves no permission set gets the deny baseline at object admission and at the row scope (fix(plugin-security,spec)!: a non-system caller that carries a principal and resolves no permission set gets the deny baseline at object admission and at the row scope #21217)
• 3ddd3d0c4a fix(mcp)!: the MCP stdio engine-only reader joins the stored-metadata-body family (exit one) (fix(mcp)!: the MCP stdio engine-only reader joins the stored-metadata-body family (exit one) #21228)
• 95e24b0096 fix(driver-sql,driver-turso)!: refuse an upsert whose conflict lands on another organization's row ([security] driver upsert: a tenant-scoped upsert keyed on a globally-unique business column can merge into, and re-parent, another tenant's row #21185) (fix(driver-sql,driver-turso)!: refuse an upsert whose conflict lands on another organization's row (#21185) #21225)
• 3a7b6eb063 fix(service-analytics)!: judge and present a relationship-path cube measure by its column's declaration on the object the path reaches (fix(service-analytics)!: judge and present a relationship-path cube measure by its column's declaration on the object the path reaches #21230)
• 49d2a24f7e fix(verify, plugin-dev, plugin-hono-server): the verify --rls report, tenancy refusals and no-API warning state each decision in words instead of a tracker number (stage 4) (fix(verify, plugin-dev, plugin-hono-server): the verify --rls report, tenancy refusals and no-API warning state each decision in words instead of a tracker number (stage 4) #21231)
• a7d9768ecd docs(metadata-protocol): re-anchor the dead tracker citations to the commits and ADR that decided them (docs(metadata-protocol): re-anchor the dead tracker citations to the commits and ADR that decided them #21233)
• 1a4c7f8268 fix(spec): filter-text-operator-declared-type-refused's control excludes JSON-stored fields and names the JSON-column door (fix(spec): filter-text-operator-declared-type-refused's control excludes JSON-stored fields and names the JSON-column door #21234)
• ef96c9ede7 fix(plugin-security): the RLS write check judges a date / datetime / time column in its stored form (fix(plugin-security): the RLS write check judges a date / datetime / time column in its stored form #21235)
• be5a83cfaa fix(driver-sql): create and bulkCreate answer the stored row on MySQL (driver-sql on MySQL: create() answers the insert id (0) instead of the inserted record, so sign-up answers 400 FAILED_TO_CREATE_USER, the dev admin seed fails and no user can sign in #21227) (fix(driver-sql): create and bulkCreate answer the stored row on MySQL (#21227) #21239)
• 3dc33b2d13 feat(spec,rest,lint)!: retire the form field's publicPicker and the anonymous lookup route (spec(forms): retire publicPicker — anonymous public forms stop taking lookup / master_detail / user fields, and the anonymous picker route goes (ruling E on #21079) #21180) (feat(spec,rest,lint)!: retire the form field's publicPicker and the anonymous lookup route (#21180) #21222)
• d150c30396 docs(metadata-protocol): re-anchor the remaining dead tracker and comment-id citations in test comments (stage 2 of dead tracker citations in the domain:engine packages (645 sites, 160 numbers, 104 files): the ruling C+D stage for this lane (from #20556) #20595) (docs(metadata-protocol): re-anchor the remaining dead tracker and comment-id citations in test comments (stage 2 of #20595) #21246)
• 4b59a381a1 fix(driver-turso)!: the remote face's doors carry the caller's tenant scope, and a remote create stamps the organization ([security] driver-turso remote face: find / count / update / delete / create apply no tenant scope (only distinct() refuses), where the local face scopes every door by DriverOptions.tenantId #21226) (fix(driver-turso)!: the remote face's doors carry the caller's tenant scope, and a remote create stamps the organization (#21226) #21245)
• 4727fcb22a fix(service-analytics)!: refuse a JSON-stored dimension or count_distinct over a relationship path the cube declares no join for, located through the one hop resolver (fix(service-analytics)!: refuse a JSON-stored dimension or count_distinct over a relationship path the cube declares no join for, located through the one hop resolver #21247)
• a23be7498e fix(dogfood, downstream-contract, plugin-dev): the qa fixtures, conformance ledgers and harness refusals state each decision in words instead of a tracker number (stage 5a) (fix(dogfood, downstream-contract, plugin-dev): the qa fixtures, conformance ledgers and harness refusals state each decision in words instead of a tracker number (stage 5a) #21250)
• 434c6c7cab feat(spec)!: an analytics dataset dimension's and measure's field is a column reference (spec(dataset): a dataset dimension/measure field admits a SQL expression at author time; narrow it to a column reference, as #20943 did for a cube member's sql #21220) (feat(spec)!: an analytics dataset dimension's and measure's field is a column reference (#21220) #21240)
• 8dea55d314 docs(adr): ADR-0061 D5 — dated note: the anonymous publicPicker search model is retired by ruling E (spec(forms): retire publicPicker — anonymous public forms stop taking lookup / master_detail / user fields, and the anonymous picker route goes (ruling E on #21079) #21180) (docs(adr): ADR-0061 D5 — dated note: the anonymous publicPicker search model is retired by ruling E (#21180) #21223)
• 30c530e5c0 fix(plugin-audit): a read of the compliance ledger returns only the rows about records the caller can read (security(plugin-audit): sys_audit_log has no parent-record read gate, so a ledger reader is served the rows about a record the data plane answers 404 to (the ledger's #20833) #21175) (fix(plugin-audit): a read of the compliance ledger returns only the rows about records the caller can read (#21175) #21194)
• d2bc644f20 fix(core,objectql,plugin-security): the RLS write check judges a lone scalar on a declared multi-valued field as the list it is stored as (fix(core,objectql,plugin-security): the RLS write check judges a lone scalar on a declared multi-valued field as the list it is stored as #21253)
• 7923c8eca0 fix(driver-sql): a MySQL NOW() datetime default carries its column's precision (fix(driver-sql): a MySQL NOW() datetime default carries its column's precision #21252)
• ee42f00e39 feat(lint): os validate judges every keyed child of an action translation entry against its declaration (feat(lint): os validate judges every keyed child of an action translation entry against its declaration #21258)
• 24c554dac2 feat(spec)!: record:line_items gets its ComponentPropsMap row, its columns are the inline grid column contract, and the showcase Tasks grid binds by name (finding(showcase): project-detail's record:line_items block keys its five columns as field, while the line-items grid binds name — the Tasks grid renders empty cells #21142) (feat(spec)!: record:line_items gets its ComponentPropsMap row, its columns are the inline grid column contract, and the showcase Tasks grid binds by name (#21142) #21244)
• f148852752 docs(skills): the dashboards rule stops teaching unread widget options extras (docs(skills): the dashboards rule stops teaching unread widget options extras #21205)
• 2791138cbf fix(service-analytics): qualify a native-SQL base column whenever the statement joins a relationship path, read from the hop resolver's joins, not cube.joins (fix(service-analytics): qualify a native-SQL base column whenever the statement joins a relationship path, read from the hop resolver's joins, not cube.joins #21266)
• b91e40bc89 fix(dogfood): the authz conformance matrix rows state each decision in words instead of a tracker number (stage 5b) (fix(dogfood): the authz conformance matrix rows state each decision in words instead of a tracker number (stage 5b) #21265)
• 4bf4e7e70a docs(objectql): re-anchor the dead tracker citations to the commits and ADRs that decided them (stage 3 of dead tracker citations in the domain:engine packages (645 sites, 160 numbers, 104 files): the ruling C+D stage for this lane (from #20556) #20595) (docs(objectql): re-anchor the dead tracker citations to the commits and ADRs that decided them (stage 3 of #20595) #21268)
• 9dae4752e0 pm-dispatch: the claim template spells the ceiling tier by its constant name and cites the --tier MANDATORY path line, never the model id (pm-dispatch: the claim template spells the ceiling tier by its constant name and cites the --tier MANDATORY path line, never the model id #21269)
• 95b91cc85d fix(driver-sql): write an undeclared builtin audit timestamp in its column datetime form (MySQL: sys_jwks never stored, /auth/jwks 500) (fix(driver-sql): write an undeclared builtin audit timestamp in its column datetime form (MySQL: sys_jwks never stored, /auth/jwks 500) #21272)
• d82f8677d1 fix(scripts): check:i18n-coverage declares the example configs and their src trees to the dispatch derivation (fix(scripts): check:i18n-coverage declares the example configs and their src trees to the dispatch derivation #21271)
• c7396f1a99 docs(spec): the DashboardWidgetOptionsSchema doc comment says a misspelled options key compiles and parses, and a wrong value is the type error (docs(spec): the DashboardWidgetOptionsSchema doc comment says a misspelled options key compiles and parses, and a wrong value is the type error #21275)
• 748b240723 feat(types,automation): a host's per-kernel scheduled-work OFF reports its own reason (feat(types,automation): a host's per-kernel scheduled-work OFF reports its own reason #21270)
• 4e6dc2338a fix(pm/fleet-write): re-list a lagging issue list before an issue_create read-back says unfound (fix(pm/fleet-write): re-list a lagging issue list before an issue_create read-back says unfound #21278)
• 617f25f8a4 chore: version packages (chore: version packages #20639)
• 9fb9b25362 docs(skills): the dashboards rule stops teaching a per-series override on the compareTo comparison series (docs(skills): the dashboards rule stops teaching a per-series override on the compareTo comparison series #21283)
• 4b09689619 ci: wire the Vercel turbo remote cache into Build Core, signed and inert until configured (ci: wire the Vercel turbo remote cache into Build Core, signed and inert until configured #21191)
• dcc5ef4c5a fix(lint,spec): field-no-consumers reads an inline relationship's join key, its per-row expand form, a detail entry's formFields and a record:line_items block against the child (finding(lint): field-no-consumers still calls two in-use child-context fields "inert" — a lookup's inline-grid join key, and the fields an inline grid's per-row expand form draws (the family's closeout after #20951) #21091) (fix(lint,spec): field-no-consumers reads an inline relationship's join key, its per-row expand form, a detail entry's formFields and a record:line_items block against the child (#21091) #21256)
• 5a9292e6f6 feat(spec)!: an object-grid block's exportOptions is the list view's export options object, and a bare format array is refused (spec: ComponentPropsMap['object-grid'].exportOptions is z.unknown(), so a bare exportOptions: ['csv'] passes every door and objectui's grid silently exports csv/json instead #21229) (feat(spec)!: an object-grid block's exportOptions is the list view's export options object, and a bare format array is refused (#21229) #21287)
• 3196ef1a18 fix(pm): issue-transfer confirms a transfer on the target and reads a lagging old URL as a pending redirect (fix(pm): issue-transfer confirms a transfer on the target and reads a lagging old URL as a pending redirect #21291)
• 383a00c73d docs(releases): draft the 17.6.0 release notes and upgrade checklist (docs(releases): draft the 17.6.0 release notes and upgrade checklist #21290)
• 0e10be6068 fix(service-package, metadata-protocol): sys_packages is created and written on MySQL; a refused package write fails install and edit instead of answering success (fix(service-package, metadata-protocol): sys_packages is created and written on MySQL; a refused package write fails install and edit instead of answering success #21273)
• 4e530568a2 docs(adr-0114): repoint the consumer line at @objectstack/core for the moved import files (docs(adr-0114): repoint the consumer line at @objectstack/core for the moved import files #21298)
• 7ebb543164 feat(spec,plugin-audit): the compliance ledger's audit capability exempts its holder from the parent-record read gate; platform administrators hold it by default (security(plugin-audit): an audit capability for the compliance ledger, held by platform administrators by default, exempts its holder from the parent-record read gate (ruling 甲 on #21175, part B) #21260) (feat(spec,plugin-audit): the compliance ledger's audit capability exempts its holder from the parent-record read gate; platform administrators hold it by default (#21260) #21296)
• c2cd65154c fix(objectql)!: having and the per-aggregation filter refuse a plain { $field } across two comparison classes, as where does (fix(objectql)!: having and the per-aggregation filter refuse a plain { $field } across two comparison classes, as where does #21297)
• 30af17e413 fix(core,driver-sql,driver-turso): a single-value file field inside the ADR-0104 window is told to finish the media-column move, not to use $contains (fix(core,driver-sql,driver-turso): a single-value file field inside the ADR-0104 window is told to finish the media-column move, not to use $contains #21282)
• 125ce9f718 docs(skills): objectstack-ai says guardrails is enforced per turn and output validation lives on action.ai.outputSchema (docs(skills): objectstack-ai says guardrails is enforced per turn and output validation lives on action.ai.outputSchema #21302)
• 5f7d84769a docs(protocol): the actions.mdx outputSchema bullet says the cloud AI runtime validates the action result (docs(protocol): the actions.mdx outputSchema bullet says the cloud AI runtime validates the action result #21303)
• 393ae878d3 fix(showcase): the command-center KPI tiles write object-metric filter in the ViewFilterRule array form (fix(showcase): the command-center KPI tiles write object-metric filter in the ViewFilterRule array form #21305)
• 1371dc980c feat(lint): os validate refuses an action translation's resultDialog title / description / acknowledge when the action declares no resultDialog (feat(lint): os validate refuses an action translation's resultDialog title / description / acknowledge when the action declares no resultDialog #21304)
• 135daaa06b feat(spec): agent.guardrails is live, enforced by the cloud AI runtime; tool.outputSchema steers authors to action.ai.outputSchema (feat(spec): agent.guardrails is live, enforced by the cloud AI runtime; tool.outputSchema steers authors to action.ai.outputSchema #21280)
• dabd1c5be7 fix(cli): drop the never-loaded oclif.plugins entries and correct the text that says os plugins works (fix(cli): drop the never-loaded oclif.plugins entries and correct the text that says os plugins works #21306)
• 75260587b3 docs(spec): the master-detail detail entry's inlineMode and formFields describes state both renderer paths (spec(ui): an object-master-detail-form detail entry's inlineMode describe says the mode is resolved from the relationship's inlineEdit when omitted; on an entry kept as authored the renderer resolves nothing #21284) (docs(spec): the master-detail detail entry's inlineMode and formFields describes state both renderer paths (#21284) #21307)
• 1c52a5e557 fix(spec): the strict blueprint nav item's label describe states that null inherits the target's current label (fix(spec): the strict blueprint nav item's label describe states that null inherits the target's current label #21309)
• 6091136e92 fix(mcp, email, knowledge, queue, sms, storage, trigger, i18n): runtime strings state each decision in words instead of a tracker number (stage 2) (fix(mcp, email, knowledge, queue, sms, storage, trigger, i18n): runtime strings state each decision in words instead of a tracker number (stage 2) #21311)
• bcd68a29f3 feat(cli,create-objectstack): os generate picklist, the src/picklists starter barrel, and a Picklists count in the metadata summary (feat(cli,create-objectstack): os generate picklist, the src/picklists starter barrel, and a Picklists count in the metadata summary #21167)
• 1caa603730 fix(service-analytics)!: refuse an analytics order key that names no member the query selects (fix(service-analytics)!: refuse an analytics order key that names no member the query selects #21314)
• bada8d35d7 fix(pm): fleet-write relay reports created and moved card numbers as check-run annotations; the read-backs read them first (fix(pm): fleet-write relay reports created and moved card numbers as check-run annotations; the read-backs read them first #21312)
• 222ecc27f9 feat(spec): ICryptoProvider gains a required keyedDigest member; LocalCryptoProvider implements it (feat(spec): ICryptoProvider gains a required keyedDigest member; LocalCryptoProvider implements it #21292)
• 97239c3c8a fix(plugin-security): the RLS write check refuses an operator the read refuses on a declared JSON-stored column (RLS: the write check evaluates a scalar comparison (!=, ==, in) on a declared multi-valued / JSON-stored column that the read refuses 400, so a policy the read cannot run admits writes #21254) (fix(plugin-security): the RLS write check refuses an operator the read refuses on a declared JSON-stored column (#21254) #21317)
• 1911d7cd1b docs(skills): the platform skill counts the eight generator barrels, picklists included (docs(skills): the platform skill counts the eight generator barrels, picklists included #21337)
• 04f0cc4992 fix(objectql): redact a driver fault where it leaves the engine, not only in the engine's log line (fix(objectql): redact a driver fault where it leaves the engine, not only in the engine's log line #21335)
• 6c5bef5f4e docs(adr): ADR-0128 §4 dated note — the keyed-digest break did not carry D1, and why (docs(adr): ADR-0128 §4 dated note — the keyed-digest break did not carry D1, and why #21343)
• 99e1912afc feat(spec): retire the metric sub-caption — the widget translation subCaption key and translateDashboard's options.description overlay (feat(spec): retire the metric sub-caption — the widget translation subCaption key and translateDashboard's options.description overlay #21342)
• 57c9fe39bc ci: the core filter starts Build Core for a build-input-only diff, held to turbo.json by check-ci-filter-parity (ci: the core filter starts Build Core for a build-input-only diff, held to turbo.json by check-ci-filter-parity #21338)
• 50e1c6554f fix(plugin-audit,platform-objects,plugin-auth,plugin-sharing,plugin-approvals,objectql)!: the audit ledger honours internal, and the credential-class census is declared internal (fix(plugin-audit,platform-objects,plugin-auth,plugin-sharing,plugin-approvals,objectql)!: the audit ledger honours internal, and the credential-class census is declared internal #21301)
• 1878ef9798 fix(plugin-security,platform-objects): an org member is not served a colleague's identity Admin-group fields, directly or through activity (plugin-security: an org member reading a colleague's sys_user row is served the Admin-group fields (last_login_ip/at, failed_login_count, locked_until, ban_*, phone_number) — and through sys_activity, their sign-in history #21237) (fix(plugin-security,platform-objects): an org member is not served a colleague's identity Admin-group fields, directly or through activity (#21237) #21340)
• f9bcd08bef fix(datasource, approvals): runtime strings state each decision in words instead of a tracker number (stage 3) (fix(datasource, approvals): runtime strings state each decision in words instead of a tracker number (stage 3) #21346)
• 96b12b589f ci(lint): run the issue-transfer door self-test in the pm roster (ci(lint): run the issue-transfer door self-test in the pm roster #21348)
• 23365eaedf feat(spec)!: the AI runtime's two JSON-Schema slots refuse an untyped subschema that carries a type-scoped keyword, at its path (finding(spec): the two JSON-Schema slots the cloud AI runtime compiles (action.ai.outputSchema, agent.structuredOutput.schema) accept an untyped subschema carrying a type-scoped keyword, which that runtime refuses before it runs #21289) (feat(spec)!: the AI runtime's two JSON-Schema slots refuse an untyped subschema that carries a type-scoped keyword, at its path (#21289) #21353)
• 16eefc6c0e docs(spec): the master-detail detail entry's sortField and amountField describes state each renderer path (spec(ui): an object-master-detail-form detail entry's sortField describe says it is derived when omitted; on the renderer's fast path nothing derives it #21315) (docs(spec): the master-detail detail entry's sortField and amountField describes state each renderer path (#21315) #21355)
• 69612451c2 fix(deps): patch tsx 4.23.15 so oclif registers it on every supported Node, re-arming the reroute probe CONTROL leg (fix(deps): patch tsx 4.23.15 so oclif registers it on every supported Node, re-arming the reroute probe CONTROL leg #21356)
• 13a24ece2d docs(driver-sql): re-anchor the dead tracker citations to the commits and ADR that decided them (stage 4 of dead tracker citations in the domain:engine packages (645 sites, 160 numbers, 104 files): the ruling C+D stage for this lane (from #20556) #20595) (docs(driver-sql): re-anchor the dead tracker citations to the commits and ADR that decided them (stage 4 of #20595) #21357)
• 37a0148666 docs(cli): the README states the global flags and the os plugin group that the built os registers (docs(cli): the README states the global flags and the os plugin group that the built os registers #21354)
• 5fd4855a9a docs(qa): re-point eight checklist items the 17.6.0 release-verification run proved stale (docs(qa): re-point eight checklist items the 17.6.0 release-verification run proved stale #21339)
• 11d9b5021d fix(release): the GitHub Releases writer converges on a racing writer's 422 already_exists and reports duplicate Releases (fix(release): the GitHub Releases writer converges on a racing writer's 422 already_exists and reports duplicate Releases #21358)
• 39119014dc fix(spec): a bound action's translation is read only under its own object, never from globalActions (fix(spec): a bound action's translation is read only under its own object, never from globalActions #21344)
• 7aab75920b fix(formula,plugin-security)!: delete formula's whole-day copy of the bare-day bound (lteBound); the RLS seam refuses a non-number on a numeric column (fix(formula,plugin-security)!: delete formula's whole-day copy of the bare-day bound (lteBound); the RLS seam refuses a non-number on a numeric column #21336)
• 9360df4138 docs(releases): finalize the 17.6.0 notes after publish (docs(releases): finalize the 17.6.0 notes after publish #21362)
• fbe2debb77 fix(service-analytics): the ObjectQL face applies a query's order, offset and limit, as its echoed sql says (fix(service-analytics): the ObjectQL face applies a query's order, offset and limit, as its echoed sql says #21363)
• f39760864c fix(cli)!: os verify runs the author-time rules first, and a stack they refuse fails verify with the findings os validate reports (fix(cli)!: os verify runs the author-time rules first, and a stack they refuse fails verify with the findings os validate reports #21364)
• 3937ad2f32 feat(spec)!: an agent's structuredOutput is JSON-only — retire the regex / grammar / xml formats and the coerce_types step; the block is live, enforced by the cloud AI runtime (feat(spec)!: an agent's structuredOutput is JSON-only — retire the regex / grammar / xml formats and the coerce_types step; the block is live, enforced by the cloud AI runtime #21367)
• d78bd011ea ci: Build Core starts on a diff confined to one of its own guard scripts, held to the job steps by check-ci-filter-parity (ci: Build Core starts on a diff confined to one of its own guard scripts, held to the job steps by check-ci-filter-parity #21368)
• 11905a4f8b fix(cli)!: os generate binds declared metadata (--object, --flow), never the item name, and every scaffold passes validate, build and lint (fix(cli)!: os generate binds declared metadata (--object, --flow), never the item name, and every scaffold passes validate, build and lint #21369)
• 43e928dd4c feat(gates): check:self-test-wired audits every root alias that declares a --self-test (finding(pm tooling): check:self-test-wired cannot see a declared --self-test alias that no workflow names, so removing the only step that runs one stays green #21351) (feat(gates): check:self-test-wired audits every root alias that declares a --self-test (#21351) #21366)
• 7b21af80cb ci(release): the release-integrity audit names the changesets a version commit did not consume (ci(release): the release-integrity audit names the changesets a version commit did not consume #21373)
• db0cf2231b docs(driver-memory): re-anchor the dead tracker citations to the commits that decided them (stage 5 of dead tracker citations in the domain:engine packages (645 sites, 160 numbers, 104 files): the ruling C+D stage for this lane (from #20556) #20595) (docs(driver-memory): re-anchor the dead tracker citations to the commits that decided them (stage 5 of #20595) #21375)
• ee75aae1a8 fix(plugin-security): security/explain answers the read's refusal for an operator the read refuses on a declared JSON-stored column (plugin-security: security.explain answers a record visible under a row-level policy that aims a JSON-column-incompatible operator at a declared JSON-stored field, while find refuses the same read with INVALID_FILTER / 400 #21319) (fix(plugin-security): security/explain answers the read's refusal for an operator the read refuses on a declared JSON-stored column (#21319) #21371)
  Filed by .github/workflows/scheduled-full-run-card.yml. Generated by Claude Code