os-nightly-full-run-rerun-safety — machine-findable marker for this generated card. ⛔ Do not delete this line: it is how the nightly full run finds this card instead of filing a new one every night.

nightly full run: red on main (Rerun Safety)

Swept 2026-10-17T06:46:27.351Z · run log · commit 9ffe8af094a4c230ec1354521f2efea89eba1f7a · conclusion failure.
Rerun Safety runs on main once a night, and no pull request, merge-queue build or other
scheduled run takes its measurement -- so this nightly run is the only thing that reports it, and
this card is the only channel that carries it. Nothing is blocked by it.
⛔ The remedy is never to narrow, skip or delete the failing check to make the nightly run green.
Fix what it names and let the next nightly run refresh this card; a card nobody reopens is closed by
the next green run being uneventful, not by editing this one.

What landed since the last green nightly run

Range: 16c5a33fdd (run 36216601546, the last green Rerun Safety schedule run) .. 9ffe8af094 — compare

Truncated by the compare API; open the compare link for the full list.

• bc0538a429 feat(spec)!: retire the datasource driver spelling mongo — refused naming mongodb, its D2 conversion leaves the load path (F1 of spec(conversions): eight ADR-0087 D2 conversions stay on the 18 load path after #23487 — five families each need a ruling before they can retire #23543) (feat(spec)!: retire the datasource driver spelling mongo — refused naming mongodb, its D2 conversion leaves the load path (F1 of #23543) #23600)
• be48c5ec3b feat(spec)!: retire AdminScope.manageBindings and authorEnvironmentSets — delegation rights no door honoured ([finding] AdminScope.manageBindings and authorEnvironmentSets are honoured by no write path after C3; the ADR-0090 D9/D12 junction gates are unmeasured; permissions docs describe removed gates #23488) (feat(spec)!: retire AdminScope.manageBindings and authorEnvironmentSets — delegation rights no door honoured (#23488) #23601)
• b1e9280890 fix(plugin-security,organizations): the seed-ownership claims re-own only the rows the seed landed on (ADR-0138 D1) (fix(plugin-security,organizations): the seed-ownership claims re-own only the rows the seed landed on (ADR-0138 D1) #23605)
• 9a6f790a38 feat(scripts): dispatch-gates names check:durability-log-level for a file holding a catch and a declared durability-critical callee (feat(scripts): dispatch-gates names check:durability-log-level for a file holding a catch and a declared durability-critical callee #23612)
• 9f81260487 fix(plugin-approvals): a request's subject title is served only from fields its reader may read (fix(plugin-approvals): a request's subject title is served only from fields its reader may read #23614)
• af255525c8 test(spec): four ruled-class test files declare their measured CI budget (test(spec): four ruled-class test files declare their measured CI budget #23613)
• 93f3526e62 fix(cli): the read-only migrate arms say they write no row or table, and that opening a SQLite file can still switch its journal mode (fix(cli): the read-only migrate arms say they write no row or table, and that opening a SQLite file can still switch its journal mode #23608)
• 361c9464ca docs(changelog): the 18.0.0-next.0 entry says per posture what the ADR-0131 ceremony does with existing junction rows (docs(changelog): the 18.0.0-next.0 entry says per posture what the ADR-0131 ceremony does with existing junction rows #23611)
• dd29bbe60d feat(metadata-core,metadata-protocol)!: the sys_metadata family declares no organization column; indexes re-keyed (ADR-0131 D6/D7, C7b S2) (feat(metadata-core,metadata-protocol)!: the sys_metadata family declares no organization column; indexes re-keyed (ADR-0131 D6/D7, C7b S2) #23469)
• 72329942f9 test(verify): five slow test files pay the boot's first load at module scope, and handle builds its second fixture without a registry reset (test(verify): five slow test files pay the boot's first load at module scope, and handle builds its second fixture without a registry reset #23620)
• 7c6b7f4a35 fix(rest,runtime)!: a JSON null /data create or query is refused 400 on both doors; the dispatcher query validates FindDataRequestSchema and asks exposure first (fix(rest,runtime)!: a JSON null /data create or query is refused 400 on both doors; the dispatcher query validates FindDataRequestSchema and asks exposure first #23617)
• e611e2bdae fix(plugin-auth): a user import reports an invitation the email transport did not deliver (fix(plugin-auth): a user import reports an invitation the email transport did not deliver #23627)
• 7a96bf8e5e docs(spec): the sha-less objectui line citations move to their liveness rows (docs(spec): the sha-less objectui line citations move to their liveness rows #23621)
• f7cd580bff fix(plugin-hono-server): a Hono door's 409 DELETE_RESTRICTED, and every structured refusal, carries RestServer's arm fields (hono: a 409 DELETE_RESTRICTED answered by createHonoApp carries no developerMessage, dependentObject, dependentCount or object, which RestServer's structuredCodeAnswer arm carries (the #23531 family beyond CONCURRENT_UPDATE) #23587) (fix(plugin-hono-server): a Hono door's 409 DELETE_RESTRICTED, and every structured refusal, carries RestServer's arm fields (#23587) #23616)
• 23e689dc7d fix(plugin-security,spec): the grant remedy texts name the reviewed-plan ceremony; C7b wording follow-ups in cli, plugin-auth and the durability vocabularies (grant name follow-ups after C7b S3 (#23430): skills security rule still says the retired grant id column is "legacy, do not write"; ceremony remedy text names a bare --apply that S4 now refuses without --plan-file #23513) (fix(plugin-security,spec): the grant remedy texts name the reviewed-plan ceremony; C7b wording follow-ups in cli, plugin-auth and the durability vocabularies (#23513) #23624)
• b513343ac1 fix(plugin-approvals): lookup-target titles and the record-lock refusal title are served only from fields the caller may read (fix(plugin-approvals): lookup-target titles and the record-lock refusal title are served only from fields the caller may read #23629)
• edac2183c0 fix(cli): a production serve with no storage says so before any plugin starts, and refuses when its auth service needs a driver (fix(cli): a production serve with no storage says so before any plugin starts, and refuses when its auth service needs a driver #23631)
• 7dc7d2213f fix(metadata-protocol): an optimistic-concurrency conflict reports only what the caller may read (fix(metadata-protocol): an optimistic-concurrency conflict reports only what the caller may read #23628)
• 42718df382 fix(docs): serve llms-full.txt as a static file written at build time, out of Vercel's 20 MB ISR fallback cap (fix(docs): serve llms-full.txt as a static file written at build time, out of Vercel's 20 MB ISR fallback cap #23640)
• a647783d46 refactor(rest): move registerBatchEndpoints into batch-routes.ts ([maintainer] refactor(rest): split packages/rest/src/rest-server.ts (13,701 lines, 70 commits in 30 days) along its register*Endpoints seams, one move-only slice per PR, /meta after #22877 stage 2 #23050 slice 2) (refactor(rest): move registerBatchEndpoints into batch-routes.ts (#23050 slice 2) #23642)
• c5dd7fce30 feat(spec)!: retire the page kind jsx — refused naming html, its D2 conversion leaves the load path (F5-jsx of spec(conversions): eight ADR-0087 D2 conversions stay on the 18 load path after #23487 — five families each need a ruling before they can retire #23543) (feat(spec)!: retire the page kind jsx — refused naming html, its D2 conversion leaves the load path (F5-jsx of #23543) #23638)
• 7cb33cfefe fix(metadata-protocol)!: an uninstall that would drop a table another stored row still serves is refused 409 before anything is removed (fix(metadata-protocol)!: an uninstall that would drop a table another stored row still serves is refused 409 before anything is removed #23504)
• c7dd48ab4c fix(driver-sqlite-wasm): handle a failing background flush instead of rejecting unhandled (fix(driver-sqlite-wasm): handle a failing background flush instead of rejecting unhandled #23643)
• c2bb302c88 fix(cli): the organization-ownership ceremony reads its dialect once, through metadata-core's shared resolver, and refuses an unresolved one before any statement (fix(cli): the organization-ownership ceremony reads its dialect once, through metadata-core's shared resolver, and refuses an unresolved one before any statement #23647)
• 6792be6ab8 docs(qa): re-point the eight stale platform-checklist anchors at what the files declare now (docs(qa): re-point the eight stale platform-checklist anchors at what the files declare now #23651)
• 286eb9ef32 docs(qa): lifecycle-retention-sweep steps[4] re-expects the idle sweep's one aggregate line (platform-checklist accuracy and fixture gaps from the #23104 browser pass, successor of #23121: the rows #23132 did not land (family card) #23169) (docs(qa): lifecycle-retention-sweep steps[4] re-expects the idle sweep's one aggregate line (#23169) #23652)
• 1ced0f82bd feat(pm): scope the at-tier contract review of a mixed diff to reviewFace hits — the Scope: line (feat(pm): scope the at-tier contract review of a mixed diff to reviewFace hits — the Scope: line #23655)
• 881eeff315 pm-dispatch execution-duties: a split-off off-lane card does not inherit the parent's domain; ceiling 183 → 185 by ruling (pm-dispatch execution-duties: a split-off off-lane card does not inherit the parent's domain; ceiling 183 → 185 by ruling #23660)
• 57994c311f fix(metadata-protocol)!: the per-item publish and the draft discard that name no package act on the draft the draft save writes (metadata-protocol: the draft doors naming no package resolve three addresses — the save and read inherit the active binding, the discard reads the draft rows, the publish takes the first draft row a package-agnostic findOne returns #23495) (fix(metadata-protocol)!: the per-item publish and the draft discard that name no package act on the draft the draft save writes (#23495) #23654)
• 462dff36f1 feat(drivers): ADR-0139 E3 + E4 — the five drivers compile the composed ReadableIds leaf or refuse it with D3's envelope, with the conformance case-set (feat(drivers): ADR-0139 E3 + E4 — the five drivers compile the composed ReadableIds leaf or refuse it with D3's envelope, with the conformance case-set #23656)
• 94924e01c1 fix(plugin-audit): the parent-record read gates skip an object the caller cannot read without reading it, so no denial is logged for the skip (fix(plugin-audit): the parent-record read gates skip an object the caller cannot read without reading it, so no denial is logged for the skip #23663)
• cad343e201 fix(metadata-protocol): deleting a runtime object hydrated at boot unregisters it at once; the metadata service's boot copy is not its code layer (fix(metadata-protocol): deleting a runtime object hydrated at boot unregisters it at once; the metadata service's boot copy is not its code layer #23659)
• 5bb9a83bd0 fix(plugin-hono-server): a Hono door's 409 CONCURRENT_UPDATE carries currentRecord, the caller's own read of the row (hono: a 409 CONCURRENT_UPDATE rendered by #16545's recogniser (createHonoApp, the direct-mount adapter) carries no currentVersion or currentRecord, which the wire contract and objectui's conflict bar read #23531) (fix(plugin-hono-server): a Hono door's 409 CONCURRENT_UPDATE carries currentRecord, the caller's own read of the row (#23531) #23667)
• 8044f4d5d9 fix(core): a bootstrap that fails after every plugin started rolls them back too (fix(core): a bootstrap that fails after every plugin started rolls them back too #23664)
• 5a33154900 feat(pm): line ratchet — a raise is authorized by the ordering ruling of record (id + measured delta in the PR body) (feat(pm): line ratchet — a raise is authorized by the ordering ruling of record (id + measured delta in the PR body) #23668)
• 5477020809 docs(skills): the security rule states a grant's uniqueness by the declared unique: 'organization' index, in place of the retired permission_set_id column (skills/objectstack-data/rules/security.md still calls the retired grant id column "legacy, do not write": restate grants by name with the per-organization unique index (split from #23513 item 1) #23615) (docs(skills): the security rule states a grant's uniqueness by the declared unique: 'organization' index, in place of the retired permission_set_id column (#23615) #23669)
• a4b87ef556 fix(cli): os migrate finds the SQL driver on a wasm-sqlite:// database, so the ownership ceremony and os migrate plan run on it (fix(cli): os migrate finds the SQL driver on a wasm-sqlite:// database, so the ownership ceremony and os migrate plan run on it #23671)
• 7e6e4e1da6 fix(plugin-approvals): a payload_display lookup target is titled only for a target record the reader may read (fix(plugin-approvals): a payload_display lookup target is titled only for a target record the reader may read #23672)
• 8d1fb1fb2d refactor(rest): move registerApprovalsEndpoints into approvals-routes.ts, with one registrar list ([maintainer] refactor(rest): split packages/rest/src/rest-server.ts (13,701 lines, 70 commits in 30 days) along its register*Endpoints seams, one move-only slice per PR, /meta after #22877 stage 2 #23050 slice 3) (refactor(rest): move registerApprovalsEndpoints into approvals-routes.ts, with one registrar list (#23050 slice 3) #23670)
• 4feb2d0fbc fix(metadata-protocol)!: one sentence for every write over a sealed, package-held name; the inferred create remedy retires (fix(metadata-protocol)!: one sentence for every write over a sealed, package-held name; the inferred create remedy retires #23626)
• 09dd537193 feat(scripts): scoped mode for check-platform-checklist (--changed-from REF judges only anchors into the change set) (feat(scripts): scoped mode for check-platform-checklist (--changed-from REF judges only anchors into the change set) #23677)
• c24598658d fix(plugin-sharing): the record-share grant names each non-user value's sharing-rule recipient, so group is sent to team (fix(plugin-sharing): the record-share grant names each non-user value's sharing-rule recipient, so group is sent to team #23678)
• 361a1c46d3 feat(client): meta.publishItem names the package whose draft it promotes, sent as ?package= (feat(client): meta.publishItem names the package whose draft it promotes, sent as ?package= #23680)
• c2635881e0 fix(rest,runtime)!: the authoring-trail doors stop admitting setup.access, so an organization admin is refused the environment's trail (fix(rest,runtime)!: the authoring-trail doors stop admitting setup.access, so an organization admin is refused the environment's trail #23674)
• eea76497d2 fix(cli): os migrate organization-ownership --apply drops organization_id from an object the host declares platform-global (ADR-0131 D7) (fix(cli): os migrate organization-ownership --apply drops organization_id from an object the host declares platform-global (ADR-0131 D7) #23681)
• c9810dd9d1 fix(plugin-hono-server): a Hono door answers the engine's DuplicateRecordError as 409 UNIQUE_VIOLATION, with the arm's fields (hono: a 409 DELETE_RESTRICTED answered by createHonoApp carries no developerMessage, dependentObject, dependentCount or object, which RestServer's structuredCodeAnswer arm carries (the #23531 family beyond CONCURRENT_UPDATE) #23587) (fix(plugin-hono-server): a Hono door answers the engine's DuplicateRecordError as 409 UNIQUE_VIOLATION, with the arm's fields (#23587) #23682)
• cbe7712706 fix(metadata-protocol): an orphan adoption hands each adopted object's registry owner and definition to the target package in the same request (metadata-protocol: an adopt-orphans into a package rebinds a runtime object's row in storage, but the registry keeps the sys_metadata owner and the old definition until a restart (ADR-0070 D5) #23646) (fix(metadata-protocol): an orphan adoption hands each adopted object's registry owner and definition to the target package in the same request (#23646) #23688)
• 3bc407d307 fix(objectql): keep the metadata service's copy of a runtime-authored object current after boot (MCP stdio exposure gate) (fix(objectql): keep the metadata service's copy of a runtime-authored object current after boot (MCP stdio exposure gate) #23687)
• f77ba411e3 fix(driver-memory): a composed ReadableIds leaf hashes its readable ids once per query, not once per row (ADR-0139 D3) (fix(driver-memory): a composed ReadableIds leaf hashes its readable ids once per query, not once per row (ADR-0139 D3) #23695)
• f1e21c4f45 test(plugin-auth): the SCIM deactivation and last-admin-guard suites run under 10 s (two test budget (domain:services): 18 test file(s) over 10 s of wall in the hourly full battery (Part of #23151) #23184 rows) (test(plugin-auth): the SCIM deactivation and last-admin-guard suites run under 10 s (two #23184 rows) #23697)
• 30c33e3875 fix(objectql): the boot hydration ERROR names the storage remedies when no driver serves sys_metadata (fix(objectql): the boot hydration ERROR names the storage remedies when no driver serves sys_metadata #23698)
• 6074eafb63 fix(cli)!: os migrate apply --allow-destructive holds back every organization_id drop until the organization-ownership ceremony verifies (cli: os migrate apply --allow-destructive drops organization_id from a host-declared platform-global object before the organization-ownership ceremony has verified, because the drop gate reads only the platform inventory #23684) (fix(cli)!: os migrate apply --allow-destructive holds back every organization_id drop until the organization-ownership ceremony verifies (#23684) #23699)
• 954bf721f1 fix(metadata-protocol)!: the promote doors ask ADR-0029 D9.9's question the save door asks (metadata-protocol: two producers still store a second package's active row of an object that a runtime-authored row owns — a draft promoted after the owner's save, and a package-less owner — past ADR-0029 D9.9's save-door refusal (family close-out) #23630) (fix(metadata-protocol)!: the promote doors ask ADR-0029 D9.9's question the save door asks (#23630) #23683)
• 395ca21cc7 fix(runtime): the dispatcher answers the engine's DuplicateRecordError as 409 UNIQUE_VIOLATION, with the arm's fields (runtime: the dispatcher's own catch arms answer the engine's DuplicateRecordError as 409 DUPLICATE_RECORD, not the ruled wire spelling UNIQUE_VIOLATION (measured at POST /api/v1/actions/:object/:action) #23686) (fix(runtime): the dispatcher answers the engine's DuplicateRecordError as 409 UNIQUE_VIOLATION, with the arm's fields (#23686) #23700)
• 69351e985a feat(plugin-audit): the parent-record read gates write one ReadableIds leaf per parent object, with no pre-scan; D5's three classes keep the bounded probe (ADR-0139 E5) (feat(plugin-audit): the parent-record read gates write one ReadableIds leaf per parent object, with no pre-scan; D5's three classes keep the bounded probe (ADR-0139 E5) #23693)
• 1d80f1ee88 refactor(rest): move registerSharingEndpoints and registerSharingRuleEndpoints into sharing-routes.ts ([maintainer] refactor(rest): split packages/rest/src/rest-server.ts (13,701 lines, 70 commits in 30 days) along its register*Endpoints seams, one move-only slice per PR, /meta after #22877 stage 2 #23050 slice 4) (refactor(rest): move registerSharingEndpoints and registerSharingRuleEndpoints into sharing-routes.ts (#23050 slice 4) #23705)
• 8c85141c5b docs(changeset): five pending notes state what the next 18.0.0 prerelease ships, amended in place (Hono currentRecord; organization_id drop gate) (docs(changeset): five pending notes state what the next 18.0.0 prerelease ships, amended in place (Hono currentRecord; organization_id drop gate) #23707)
• cd86e41b04 fix(objectql,runtime): install datasourceMapping before the first schema sync, so a mapped boot keeps one store (objectql/runtime: a host config's datasourceMapping default is installed after schema sync and the Default Organization, so unbound platform objects then route to a datasource whose schema never synced ("no such table") #23649) (fix(objectql,runtime): install datasourceMapping before the first schema sync, so a mapped boot keeps one store (#23649) #23694)
• 53e3638ea2 chore(objectui): move the console pin to 1f23d5b070fa, carrying app-shell (Setup catalog editors): show History and Audit only to a caller the trail doors admit — objectstack#23546 narrows /meta history, audit and diff away from setup.access objectui#12475 and security(app-shell): AiChatPage auto-sends ?handoffPrompt= from the URL as the build agent's first message, so a crafted link makes a signed-in user author (and, with autoPublishAiBuilds, publish) metadata in one click objectui#12493 (chore(objectui): move the console pin to 1f23d5b070fa, carrying objectstack-ai/objectui#12475 and objectstack-ai/objectui#12493 #23709)
• 43d75ef274 test(service-datasource): the pool-support and driver-factory suites run under 10 s (two test budget (domain:services): 18 test file(s) over 10 s of wall in the hourly full battery (Part of #23151) #23184 rows) (test(service-datasource): the pool-support and driver-factory suites run under 10 s (two #23184 rows) #23711)
• 4c21e57169 fix(mcp): an MCP tool call repeating a unique value answers UNIQUE_VIOLATION, not the engine's DUPLICATE_RECORD (mcp: a tool call that repeats a unique value answers the engine's in-process DUPLICATE_RECORD in its error result, not the ruled wire spelling UNIQUE_VIOLATION (create_record, run_action, resume_run) #23701) (fix(mcp): an MCP tool call repeating a unique value answers UNIQUE_VIOLATION, not the engine's DUPLICATE_RECORD (#23701) #23713)
• c03077e294 fix(metadata-protocol)!: a draft save naming no package, of an item never published into a package, takes the draft doors' address (metadata-protocol: a draft save naming no package, of an item never published into a package whose only draft is bound to package Q, writes a package-unbound draft beside it, while the publish and discard naming none act on Q's (after PR #23654) #23657) (fix(metadata-protocol)!: a draft save naming no package, of an item never published into a package, takes the draft doors' address (#23657) #23706)
• 9e0945cf45 fix(runtime): the sandbox relay keeps the engine's DuplicateRecordError, so a script body's uncaught duplicate answers 409 UNIQUE_VIOLATION (runtime: an engine DuplicateRecordError a sandboxed script body lets propagate leaves the VM as SandboxError, so no door recognises it and it answers 409 DUPLICATE_RECORD, not the ruled UNIQUE_VIOLATION #23702) (fix(runtime): the sandbox relay keeps the engine's DuplicateRecordError, so a script body's uncaught duplicate answers 409 UNIQUE_VIOLATION (#23702) #23717)
• a515abdd8c refactor(rest): move registerAnalyticsEndpoints into analytics-routes.ts ([maintainer] refactor(rest): split packages/rest/src/rest-server.ts (13,701 lines, 70 commits in 30 days) along its register*Endpoints seams, one move-only slice per PR, /meta after #22877 stage 2 #23050 slice 5) (refactor(rest): move registerAnalyticsEndpoints into analytics-routes.ts (#23050 slice 5) #23719)
• 76560a1d84 fix(objectql): give a runtime-authored object a metadata-service copy on a kernel with an environmentId, so both MCP doors refuse an object whose API exposure is off (fix(objectql): give a runtime-authored object a metadata-service copy on a kernel with an environmentId, so both MCP doors refuse an object whose API exposure is off #23716)
• f40d877f81 test(organizations): the two upload-wall suites run under 10 s (two test budget (domain:services): 18 test file(s) over 10 s of wall in the hourly full battery (Part of #23151) #23184 rows) (test(organizations): the two upload-wall suites run under 10 s (two #23184 rows) #23721)
• 6ee483cdb2 fix(runtime): a sandboxed body's thrown plain object is answered with its own message, never 'undefined: …' or '[object Object]' (runtime(sandbox): a script body that throws a plain object is answered with the client message 'undefined: <message>' or '[object Object]' at the action door, because the reject handler flattens a value with no name #23718) (fix(runtime): a sandboxed body's thrown plain object is answered with its own message, never 'undefined: …' or '[object Object]' (#23718) #23722)
• fdbcec0b2e fix(cli): six read-only arms claim no row or table, and name the journal-mode switch on a SQLite file (fix(cli): six read-only arms claim no row or table, and name the journal-mode switch on a SQLite file #23725)
• 9bb93706fb fix(metadata-protocol): an orphan adoption rebinds a draft view in storage only, never registering it live (fix(metadata-protocol): an orphan adoption rebinds a draft view in storage only, never registering it live #23724)
• 534ca13eb5 test(service-automation): pin the flow runAs and filter-date semantics hotcrm pins (two verify: classify hotcrm's "platform-semantics pins" — each becomes a derived proof family in @objectstack/verify or a platform regression test in dogfood, never an app test (epic hotcrm#1579, step 5c) #15953 rows) (test(service-automation): pin the flow runAs and filter-date semantics hotcrm pins (two #15953 rows) #23728)
• 069fd40c49 fix(metadata-protocol): the strict draft read naming no package serves its content from the draft its version names (fix(metadata-protocol): the strict draft read naming no package serves its content from the draft its version names #23727)
• 94af3aeaf8 docs(changeset): the consumed page-action-row operation changeset no longer says an api row beside the update parses (deliberate correction) (docs(changeset): the consumed page-action-row operation changeset no longer says an api row beside the update parses (deliberate correction) #23524)
• d0c09e47c1 feat(lint)!: the two page component rules run on the runtime publish door (ruling B) (feat(lint)!: the two page component rules run on the runtime publish door (ruling B) #23418)
• d0f7eb5951 refactor(rest): move registerSecurityExplainEndpoints and registerSecurityEndpoints into security-routes.ts ([maintainer] refactor(rest): split packages/rest/src/rest-server.ts (13,701 lines, 70 commits in 30 days) along its register*Endpoints seams, one move-only slice per PR, /meta after #22877 stage 2 #23050 slice 6) (refactor(rest): move registerSecurityExplainEndpoints and registerSecurityEndpoints into security-routes.ts (#23050 slice 6) #23729)
• 1b9e526d1b pm: a package's test:repo project is CI's run; a spec-plus-one-package card is build-heavy and goes mode:cloud (pm: a package's test:repo project is CI's run; a spec-plus-one-package card is build-heavy and goes mode:cloud #23676)
• 3b46855fb9 docs(pm-dispatch): name axis 4's new-gate clause as the one exception to the decision template's never-flip-the-letter rule (docs(pm-dispatch): name axis 4's new-gate clause as the one exception to the decision template's never-flip-the-letter rule #23675)
• 53646fc4b5 fix(driver-sql): a sqlite file that cannot be created or opened fails connect at once, naming the file and the OS error (runtime: a declared sqlite datasource whose file cannot be created never settles its connect, so the boot is refused only by a plugin start timeout (30 s, 120 s after PR #23694) that names neither the datasource, the path nor the open error #23696) (fix(driver-sql): a sqlite file that cannot be created or opened fails connect at once, naming the file and the OS error (#23696) #23730)
• a869ea6362 fix(metadata-protocol)!: a save naming a package of an object its package-less definition owns is refused, with a way out into that package (ADR-0029 D9.9) (fix(metadata-protocol)!: a save naming a package of an object its package-less definition owns is refused, with a way out into that package (ADR-0029 D9.9) #23704)
• 2906cd8d2e fix(cli): the ready banner prints API: and MCP: addresses only when an HTTP server is composed (fix(cli): the ready banner prints API: and MCP: addresses only when an HTTP server is composed #23741)
• 140238a47b chore(objectui): move the console pin to f96f771140f1, carrying Studio read-only posture: a lock in the app chip and one "Read-only · Customize with an overlay" link in the item header replace the banner, the rail footer, the amber badge and the form strips objectui#12453 and Navigation edit mode keeps the 240 px rail and shows the remove control without hover objectui#12519 (chore(objectui): move the console pin to f96f771140f1, carrying objectstack-ai/objectui#12453 and objectstack-ai/objectui#12519 #23738)
• c6c84d3175 test(plugin-security): the explain/enforce parity table shares a read-only principal rig per posture source (test(plugin-security): the explain/enforce parity table shares a read-only principal rig per posture source #23748)
• 29c7157af4 pm-dispatch: a declared narrowing is the fourth contract-review face, at CONTRACT_REVIEW_TIER (pm-dispatch: a declared narrowing is the fourth contract-review face, at CONTRACT_REVIEW_TIER #23750)
• 941c78ae2e feat(spec)!: a field-heavy task flow on desktop derives a bounded modal; mobile keeps full-screen (feat(spec)!: a field-heavy task flow on desktop derives a bounded modal; mobile keeps full-screen #23747)
• d176b0aab3 feat(spec)!: refuse the wait / connector_action loose config keys naming their sibling block; their D2 lifts leave the load path (F3 of spec(conversions): eight ADR-0087 D2 conversions stay on the 18 load path after #23487 — five families each need a ruling before they can retire #23543) (feat(spec)!: refuse the wait / connector_action loose config keys naming their sibling block; their D2 lifts leave the load path (F3 of #23543) #23742)
• 1ac24f2f89 fix(spec): translateView localizes a form view's sections through objects.OBJECT._sections.NAME (fix(spec): translateView localizes a form view's sections through objects.OBJECT._sections.NAME #23749)
• 0326b32952 test(objectql,driver-sql): platform pins replacing hotcrm's platform-semantics tests (verify: classify hotcrm's "platform-semantics pins" — each becomes a derived proof family in @objectstack/verify or a platform regression test in dogfood, never an app test (epic hotcrm#1579, step 5c) #15953 engine rows 3, 4-5, 7, 8, 10, 11) (test(objectql,driver-sql): platform pins replacing hotcrm's platform-semantics tests (#15953 engine rows 3, 4-5, 7, 8, 10, 11) #23754)
• 4fe8b3def0 test(metadata-protocol): lock-one-resolution takes each distinct read request's reads once, 20 s to 8.4 s (test budget (domain:engine): 6 test file(s) over 10 s of wall in the hourly full battery (Part of #23151) #23182 row 1) (test(metadata-protocol): lock-one-resolution takes each distinct read request's reads once, 20 s to 8.4 s (#23182 row 1) #23755)
• eae3b389d2 test(spec): eight scripts/ test-budget rows -- three trimmed, five declare their measured CI budget (test(spec): eight scripts/ test-budget rows -- three trimmed, five declare their measured CI budget #23752)
• 0a052e6705 feat(spec)!: a stack's datasources collection refuses a datasource named default, the host-reserved name (feat(spec)!: a stack's datasources collection refuses a datasource named default, the host-reserved name #23757)
• 7428da02a2 refactor(plugin-hono-server,runtime): the Hono doors and the dispatcher read UNIQUE_VIOLATION off the shared arm instead of stamping the literal (error-code provenance: the Hono doors and the runtime dispatcher stamp UNIQUE_VIOLATION as a literal inside a ternary that check:error-code-provenance cannot see, and the ledger has no row for either package #23714) (refactor(plugin-hono-server,runtime): the Hono doors and the dispatcher read UNIQUE_VIOLATION off the shared arm instead of stamping the literal (#23714) #23760)
• 6362c66ca8 docs(objectql): a currency field is a bare number in one currency, with no exchange rates (docs(objectql): a currency field is a bare number in one currency, with no exchange rates #23762)
• 8776119bdc feat(spec): referenceDeletedWhen beside referenceVia marks a pointer's target as platform-deleted (feat(spec): referenceDeletedWhen beside referenceVia marks a pointer's target as platform-deleted #23759)
• 9fcea20514 fix(runtime): callData's addressed-object exposure refusal carries the data door's code on the /data and /mcp doors (fix(runtime): callData's addressed-object exposure refusal carries the data door's code on the /data and /mcp doors #23773)
• 14aff678b8 fix(metadata-protocol)!: a draft save naming no package of an object its package-less definition owns is judged at its draft address, and refused with a way out to the package-less draft (ADR-0029 D9.9) (fix(metadata-protocol)!: a draft save naming no package of an object its package-less definition owns is judged at its draft address, and refused with a way out to the package-less draft (ADR-0029 D9.9) #23769)
• b55be4213c fix(runtime): a sandboxed body whose rejection no read can flatten ends its run at once with a fixed sentence, instead of at the wall-clock ceiling (runtime(sandbox): a sandboxed body whose rejection cannot be flattened (throw '', a null-prototype object, a message getter that throws) is never recorded, so the action door waits for the 30 s wall-clock ceiling and answers 500 #23723) (fix(runtime): a sandboxed body whose rejection no read can flatten ends its run at once with a fixed sentence, instead of at the wall-clock ceiling (#23723) #23774)
• ec44cf60bf refactor(rest): move registerDiscoveryEndpoints and registerOpenApiEndpoints into discovery-routes.ts ([maintainer] refactor(rest): split packages/rest/src/rest-server.ts (13,701 lines, 70 commits in 30 days) along its register*Endpoints seams, one move-only slice per PR, /meta after #22877 stage 2 #23050 slice 7) (refactor(rest): move registerDiscoveryEndpoints and registerOpenApiEndpoints into discovery-routes.ts (#23050 slice 7) #23763)
• 0a168a33ea feat(spec)!: FormSectionSchema.columns drops default(1) — undeclared section density is the renderer's, declared is the author's ceiling (feat(spec)!: FormSectionSchema.columns drops default(1) — undeclared section density is the renderer's, declared is the author's ceiling #23771)
• 0b1179f332 feat(service-storage): the sys_attachment read gate writes one ReadableIds leaf per parent object and does no pre-scan; D5's three classes keep the probe (ADR-0139 E7, attachments) (feat(service-storage): the sys_attachment read gate writes one ReadableIds leaf per parent object and does no pre-scan; D5's three classes keep the probe (ADR-0139 E7, attachments) #23767)
• a69a40a572 feat(spec)!: a page declares nothing the console does not honour — isDefault only on a bound record page, a closed template set, regions its template places (feat(spec)!: a page declares nothing the console does not honour — isDefault only on a bound record page, a closed template set, regions its template places #23708)
• d3df3ba24b test(objectql): bulk-write-per-row-hooks runs under the 10 s budget (test budget (domain:engine): 6 test file(s) over 10 s of wall in the hourly full battery (Part of #23151) #23182 row 5) (test(objectql): bulk-write-per-row-hooks runs under the 10 s budget (#23182 row 5) #23779)
• 8684079f2a fix(metadata-protocol,metadata): the legacy-organization read seam's loose ends: paged reads, the loader's count, the rollback's named refusal (ADR-0131 D6/D7) (fix(metadata-protocol,metadata): the legacy-organization read seam's loose ends: paged reads, the loader's count, the rollback's named refusal (ADR-0131 D6/D7) #23778)
• e5136ff10f chore: version packages (next) (chore: version packages (next) #23481)
• 46ca793edb docs(skills): pages.md says what a page type, template and region name run (docs(skills): pages.md says what a page type, template and region name run #23758)
• 9cb9d95574 feat(spec,plugin-auth): a short-lived principal-session mint, IAuthService.mintPrincipalSession, implemented by AuthManager (feat(spec,plugin-auth): a short-lived principal-session mint, IAuthService.mintPrincipalSession, implemented by AuthManager #23786)
• 2fdfb5d230 docs(skills): the datasources rule states that default is host-reserved, connected from OS_DATABASE_URL, and refused in a stack's datasources (skills(objectstack-data): rules/datasources.md reads as an invitation to declare a datasource named default, which the stack now refuses as host-reserved #23768) (docs(skills): the datasources rule states that default is host-reserved, connected from OS_DATABASE_URL, and refused in a stack's datasources (#23768) #23793)
• b711056e63 docs(skills): navigation.md states the derived record surface per flow — viewing routes to a page, create/edit opens a modal bounded on desktop and full-screen on mobile, a light record uses a drawer (docs(skills): navigation.md states the derived record surface per flow — viewing routes to a page, create/edit opens a modal bounded on desktop and full-screen on mobile, a light record uses a drawer #23795)
• b485122a7f fix(cli): os serve refuses an OS_DATABASE_URL whose scheme no driver recognises, and reads pg:// and a scheme-less path as the runtime host does (fix(cli): os serve refuses an OS_DATABASE_URL whose scheme no driver recognises, and reads pg:// and a scheme-less path as the runtime host does #23761)
• 609d07a7df test(metadata-protocol): lock-one-resolution runs as four shards under the 10 s budget (test budget (domain:engine): 6 test file(s) over 10 s of wall in the hourly full battery (Part of #23151) #23182 row 1, step B) (test(metadata-protocol): lock-one-resolution runs as four shards under the 10 s budget (#23182 row 1, step B) #23790)
• 9d4fb3c306 fix(runtime): standalone database-URL refusals name the scheme, never the URL (fix(runtime): standalone database-URL refusals name the scheme, never the URL #23791)
• 23d0bc78ba fix(spec): page.print and the flow terminal-toast translations read live in the liveness ledger, so a print page is no longer warned that nothing applies it (fix(spec): page.print and the flow terminal-toast translations read live in the liveness ledger, so a print page is no longer warned that nothing applies it #23776)
• 97b8e7a51d feat(spec): a generic record:json record block — one record key as indented JSON behind a required, fail-closed requiredPermissions gate (feat(spec): a generic record:json record block — one record key as indented JSON behind a required, fail-closed requiredPermissions gate #23783)
• 9b799e6fb5 fix(scripts): spell pnpm flags so a global pnpm 11+/12 frontend parses them (--config.production=false, --silent) (fix(scripts): spell pnpm flags so a global pnpm 11+/12 frontend parses them (--config.production=false, --silent) #23777)
• 60f9bafb86 docs(spec): the routes / App.apis retire text stops sending app authors to an imperative http.server route (ruling C′ item 2) (docs(spec): the routes / App.apis retire text stops sending app authors to an imperative http.server route (ruling C′ item 2) #23785)
• 74b436263a fix(plugin-approvals): sys_approval_request.record_id declares referenceDeletedWhen on cancel_reason = record_deleted (fix(plugin-approvals): sys_approval_request.record_id declares referenceDeletedWhen on cancel_reason = record_deleted #23798)
• ae0ca66f41 feat(spec)!: retire page:header showStar — the follow star the reference console no longer draws (feat(spec)!: retire page:header showStar — the follow star the reference console no longer draws #23781)
• f846cc2020 docs(spec): step-18 entries, the exportOptions TSDoc and the stored-shapes row say a stored page's next save meets the component-props gate at the metadata save door (docs(spec): step-18 entries, the exportOptions TSDoc and the stored-shapes row say a stored page's next save meets the component-props gate at the metadata save door #23800)
• d795719926 fix(devx): npm 10 crashes with edgesOut on the vendor-export probe and the blank scaffold — the probe installs with a pinned npm 11, the template overrides vitest (fix(devx): npm 10 crashes with edgesOut on the vendor-export probe and the blank scaffold — the probe installs with a pinned npm 11, the template overrides vitest #23799)
• 59f9763d3e test(driver-sql): sql-driver-connect-bound runs under the 10 s budget (test budget (domain:engine): 6 test file(s) over 10 s of wall in the hourly full battery (Part of #23151) #23182 row 6) (test(driver-sql): sql-driver-connect-bound runs under the 10 s budget (#23182 row 6) #23812)
• af3873bad7 docs(spec): a form section's translation TSDoc names both addresses — objects.OBJECT._sections for an object form view, metadataForms for a metadata form (docs(spec): a form section's translation TSDoc names both addresses — objects.OBJECT._sections for an object form view, metadataForms for a metadata form #23815)
• f606ba2e25 feat(spec)!: a job retryPolicy with no attempts is refused at maxRetries; retry-policy-converged leaves the load path (F2 of spec(conversions): eight ADR-0087 D2 conversions stay on the 18 load path after #23487 — five families each need a ruling before they can retire #23543) (feat(spec)!: a job retryPolicy with no attempts is refused at maxRetries; retry-policy-converged leaves the load path (F2 of #23543) #23810)
• 92ca4cd84f test(spec): three src/ test-budget rows trimmed, two at a one-program floor left listed (test(spec): three src/ test-budget rows trimmed, two at a one-program floor left listed #23819)
• 5b6c257b06 feat(plugin-audit): sys_activity gains writer-stamped read-rule columns with an idempotent backfill, and the withheld-row rule is a predicate with no SYSTEM pre-scan (ADR-0139 E6) (feat(plugin-audit): sys_activity gains writer-stamped read-rule columns with an idempotent backfill, and the withheld-row rule is a predicate with no SYSTEM pre-scan (ADR-0139 E6) #23814)
• 1ecb08a1cc fix(spec): four metadata type descriptions Setup shows are plain admin sentences (fix(spec): four metadata type descriptions Setup shows are plain admin sentences #23817)
• 43567a8fcb ci(spec-shape-gate): drop the closed objectui#12325 retirement entry and point the header at the deleted objectui copy’s last commit (ci(spec-shape-gate): drop the closed objectui#12325 retirement entry and point the header at the deleted objectui copy’s last commit #23822)
• 0cfd0c49bd fix(plugin-auth): a minted principal session is never refreshed by a read, so it boots the console (fix(plugin-auth): a minted principal session is never refreshed by a read, so it boots the console #23828)
• 3fed1eb00a spec(liveness): app.branding.logo is live — objectui AppMark renders it at the pin (spec(liveness): app.branding.logo is live — objectui AppMark renders it at the pin #23830)
• df2c5519ee fix(metadata-core): drop the optional vitest peer so npm 10 installs it again (fix(metadata-core): drop the optional vitest peer so npm 10 installs it again #23834)
• 3c080a65c8 docs(changeset): mark the 11 changesets 18.0.0-next.2 shipped without a CHANGELOG entry (docs(changeset): mark the 11 changesets 18.0.0-next.2 shipped without a CHANGELOG entry #23835)
• ee0e115391 docs: default record page remedies name the other package's page, not the whole package (docs: default record page remedies name the other package's page, not the whole package #23831)
• 66d456d016 fix(cli): the memory:// / mingo:// OS_DATABASE_URL refusal names the scheme, never the URL (fix(cli): the memory:// / mingo:// OS_DATABASE_URL refusal names the scheme, never the URL #23840)
• 1eac7ad751 fix(rest): GET /forms/:slug localizes a public form's section headings under Accept-Language (fix(rest): GET /forms/:slug localizes a public form's section headings under Accept-Language #23844)
• 30ce56e803 fix(platform-objects,metadata-core,service-messaging): Setup descriptions are plain admin sentences; ADR references move to the docblocks (fix(platform-objects,metadata-core,service-messaging): Setup descriptions are plain admin sentences; ADR references move to the docblocks #23845)
• a31ff2eb5d fix(cli): os init / os create emit overrides.vitest so new projects install on npm 10 (fix(cli): os init / os create emit overrides.vitest so new projects install on npm 10 #23850)
• f7a5ebed78 fix(runtime,cli): refuse an uncreatable SQLite database directory at once instead of hanging in recursive mkdir (fix(runtime,cli): refuse an uncreatable SQLite database directory at once instead of hanging in recursive mkdir #23851)
• 49700e4c02 docs(skills): objectstack-api stops teaching an app to mount routes on http.server (skills(objectstack-api): the "Choosing between apis: and a code handler" table and the "Code routes" section still teach app authors to mount on http.server, which ruling C′ (#23128) retired as an app-author surface #23787) (docs(skills): objectstack-api stops teaching an app to mount routes on http.server (#23787) #23807)
• 9a1d9344ff docs(os-dev): run the scoped platform-checklist check before push on an exported-symbol rename or removal (docs(os-dev): run the scoped platform-checklist check before push on an exported-symbol rename or removal #23766)
• 0af559e806 fix(release): refuse a Version Packages PR whose queue build lands behind main; mark next.2's 11 missed changesets (fix(release): refuse a Version Packages PR whose queue build lands behind main; mark next.2's 11 missed changesets #23833)
• ae4dfafa15 fix(driver-turso,cli): the v18 organization-ownership ceremony runs on a Turso remote database (fix(driver-turso,cli): the v18 organization-ownership ceremony runs on a Turso remote database #23843)
• f7e836da1e docs(pm-dispatch): let an execution seat accept a filer-labelled card when the lane fits the domain table and the body passes the filing gate; triage spot-checks after (docs(pm-dispatch): let an execution seat accept a filer-labelled card when the lane fits the domain table and the body passes the filing gate; triage spot-checks after #23751)
• 6422da58e8 feat(spec,automation): FlowRuntimeState.unboundCause classifies an unbound flow row beside its reason (feat(spec,automation): FlowRuntimeState.unboundCause classifies an unbound flow row beside its reason #23854)
• 7a6ba03109 docs(deployment): name the npm 10 edgesOut install failure and its npm 11 / overrides.vitest remedies (docs(deployment): name the npm 10 edgesOut install failure and its npm 11 / overrides.vitest remedies #23864)
• 34b740f2d1 fix(runtime,cli): one file-URL filename rule for both hosts — FILE: strips case-insensitively, file://NAME opens NAME on the CLI host (fix(runtime,cli): one file-URL filename rule for both hosts — FILE: strips case-insensitively, file://NAME opens NAME on the CLI host #23862)
• a35f7a6764 feat(spec)!: delete checkPageComponentViewData; the component-props rule is the one judge of a page component's retired api data binding (feat(spec)!: delete checkPageComponentViewData; the component-props rule is the one judge of a page component's retired api data binding #23784)
• 41e84c0103 fix(cli): the os dev watcher prints why a recompile was refused (fix(cli): the os dev watcher prints why a recompile was refused #23867)
• 6db53acd66 docs(os-dev): admit the ruled ceiling raise in the ratchet block and point at the ratchet header (docs(os-dev): admit the ruled ceiling raise in the ratchet block and point at the ratchet header #23868)
• 105902f10a feat(spec)!: retire the view form's visibleOn and the page component's visibility as keys; their ADR-0089 renames leave the load path (F4 of spec(conversions): eight ADR-0087 D2 conversions stay on the 18 load path after #23487 — five families each need a ruling before they can retire #23543) (feat(spec)!: retire the view form's visibleOn and the page component's visibility as keys; their ADR-0089 renames leave the load path (F4 of #23543) #23836)
• c5cf546a6f fix(runtime): the standalone host refuses an opaque-scheme OS_DATABASE_URL, and a .wasm.db ending no longer rescues an unrecognised scheme (fix(runtime): the standalone host refuses an opaque-scheme OS_DATABASE_URL, and a .wasm.db ending no longer rescues an unrecognised scheme #23861)
• adad73f714 feat(spec): a select option declares its lifecycle kind (open / won / lost); every stage-field option must declare it (feat(spec): a select option declares its lifecycle kind (open / won / lost); every stage-field option must declare it #23846)
• 6f7ad7900f docs: guest has no bind door until ADR-0138 D3 item 5's door is built (ADR-0090 D9 line, two docblocks) (docs: guest has no bind door until ADR-0138 D3 item 5's door is built (ADR-0090 D9 line, two docblocks) #23780)
• 944f03850e ci(spec-shape-gate): the workflow header says objectui deleted its copy and names the commit that last has it (ci(spec-shape-gate): the workflow header says objectui deleted its copy and names the commit that last has it #23823)
• 94114c1f26 fix(plugin-audit): a user's own UI-state write writes no ledger row (fix(plugin-audit): a user's own UI-state write writes no ledger row #23866)
• d0fe050489 fix(spec): the Permission Set, Position and view form help texts Setup shows are plain admin copy (fix(spec): the Permission Set, Position and view form help texts Setup shows are plain admin copy #23870)
• 497518c3f6 docs: re-measure the example CRM size (30 files, 1,844 lines, ~17.5k tokens) and state the commit it was measured at (docs: re-measure the example CRM size (30 files, 1,844 lines, ~17.5k tokens) and state the commit it was measured at #23876)
• 77efc66223 feat(platform-objects)!: Setup's organization, team, business-unit and user records carry no Discussion feed (enable.feeds: false) (feat(platform-objects)!: Setup's organization, team, business-unit and user records carry no Discussion feed (enable.feeds: false) #23869)
• 570f01d270 docs(adr-0069): record ruling C′'s enforcement and the API-key admission seam (docs(adr-0069): record ruling C′'s enforcement and the API-key admission seam #23875)
• 2034975a47 fix(driver-turso): a Turso remote database enforces the storage.notNull a field declares (fix(driver-turso): a Turso remote database enforces the storage.notNull a field declares #23893)
• d5666be876 refactor(rest): move registerEmailEndpoints into email-routes.ts ([maintainer] refactor(rest): split packages/rest/src/rest-server.ts (13,701 lines, 70 commits in 30 days) along its register*Endpoints seams, one move-only slice per PR, /meta after #22877 stage 2 #23050 slice 8) (refactor(rest): move registerEmailEndpoints into email-routes.ts (#23050 slice 8) #23882)
• a13fd4df69 test(lint): the two lazy-deps contract files declare their whole-package-import budget (test(lint): the two lazy-deps contract files declare their whole-package-import budget #23888)
• 0744f94366 feat(scripts): a third test-budget class, "compiles the package type graph once" (feat(scripts): a third test-budget class, "compiles the package type graph once" #23897)
• dd11563f61 feat(spec): settings info_banner translation slot — banners.ID.{title,text} and its two resolvers (feat(spec): settings info_banner translation slot — banners.ID.{title,text} and its two resolvers #23886)
• 0cb45e9e0a fix(runtime): an explicit sqlite / sqlite-wasm selection refuses a URL that is not a file path, on both hosts (fix(runtime): an explicit sqlite / sqlite-wasm selection refuses a URL that is not a file path, on both hosts #23896)
• abb6df0e01 fix(cli): three more read-only arms claim no row or table, and name the journal-mode switch on a SQLite file (fix(cli): three more read-only arms claim no row or table, and name the journal-mode switch on a SQLite file #23895)
• b9dbc3d895 feat(plugin-security): under a walled posture, deployment-level acceptance of package defaults is host configuration (acceptedDefaultPermissionSets, ADR-0131 D5) (feat(plugin-security): under a walled posture, deployment-level acceptance of package defaults is host configuration (acceptedDefaultPermissionSets, ADR-0131 D5) #23884)
• cf071687f1 feat(metadata-protocol)!: the flow save door refuses a retired spelling on a NEW flow; a stored flow keeps the full chain (feat(metadata-protocol)!: the flow save door refuses a retired spelling on a NEW flow; a stored flow keeps the full chain #23902)
• d97b665c09 docs(qa): author the v18 line's capabilities into the platform checklist (48 since:v18 items) (docs(qa): author the v18 line's capabilities into the platform checklist (48 since:v18 items) #23901)
• 2ef46279cf docs(adr-0131): amend D5 — under a walled posture, deployment-level acceptance of package defaults is host configuration (docs(adr-0131): amend D5 — under a walled posture, deployment-level acceptance of package defaults is host configuration #23883)
• cdf37771d0 feat(cli,runtime): os dev upgrades a v17-shape development database in place; the ownership ceremony covers the telemetry sibling and adopts legacy shipped-set seeds (ADR-0131) (feat(cli,runtime): os dev upgrades a v17-shape development database in place; the ownership ceremony covers the telemetry sibling and adopts legacy shipped-set seeds (ADR-0131) #23906)
• 11fea6b000 ci(spec-shape-gate): register the retirement of the page component's visibility and the view form's visibleOn (ci(spec-shape-gate): register the retirement of the page component's visibility and the view form's visibleOn #23920)
• 099cc9d698 fix(setup-copy): approval, security, automation and sharing descriptions read as admin copy; ADR numbers move to comments (fix(setup-copy): approval, security, automation and sharing descriptions read as admin copy; ADR numbers move to comments #23917)
• 4216796d14 docs(spec): the lookup picker reads its seven keys camelCase-only (docblock + six liveness notes) (docs(spec): the lookup picker reads its seven keys camelCase-only (docblock + six liveness notes) #23894)
• 98ba1bf1d2 fix(cli): os migrate organization-ownership --apply refuses an --out it cannot write before executing anything (fix(cli): os migrate organization-ownership --apply refuses an --out it cannot write before executing anything #23905)
• cbbd96a78b fix(lint): one-line fix lines for the slice-19 rule ids (two flow wrong-syntax ids, capability, liveness ledger, two page-field ids, list-view mode); os explain carries what they explained (fix(lint): one-line fix lines for the slice-19 rule ids (two flow wrong-syntax ids, capability, liveness ledger, two page-field ids, list-view mode); os explain carries what they explained #23918)
• 17e9e96a50 chore(claude): allow the edit tools on the os-dev worktrees' .changeset/pre notes (chore(claude): allow the edit tools on the os-dev worktrees' .changeset/pre notes #23930)
• 8f4260fe66 feat(platform-objects,service-messaging): Setup lists show their own empty state; API Keys gains Create Key (feat(platform-objects,service-messaging): Setup lists show their own empty state; API Keys gains Create Key #23924)
• e375315b55 fix(lint): one-line fix hints for the six data-model-rules ids ([maintainer] validate: the field-no-consumers warning is one 856-character line, printed by validate, build and dev alike — one-line verdict + rule: id + a pointer to the full reasoning (os explain, which today takes only schema names) #22161 slice 18) (fix(lint): one-line fix hints for the six data-model-rules ids (#22161 slice 18) #23907)
• 7277c07f68 feat(scripts): check:pnpm-flag-spellings — no committed pnpm call spells -s, --prod=VALUE, --production=VALUE or --no-production, which a global pnpm 11+/12 frontend rejects (feat(scripts): check:pnpm-flag-spellings — no committed pnpm call spells -s, --prod=VALUE, --production=VALUE or --no-production, which a global pnpm 11+/12 frontend rejects #23824)
• 61e5ee9e57 fix(cli,driver-turso): os migrate plan/apply run on a Turso remote database and name the drift entries they cannot apply (fix(cli,driver-turso): os migrate plan/apply run on a Turso remote database and name the drift entries they cannot apply #23923)
• 161aee1047 fix(cli): a serve boot that binds no HTTP server announces no address, and MCP: prints only when its route is mounted (fix(cli): a serve boot that binds no HTTP server announces no address, and MCP: prints only when its route is mounted #23947)
• bef7bdc14a fix(cli): os migrate organization-ownership plans a v17 database still holding the retired sys_scim_provider, as fate 4 (ADR-0131 D10) (fix(cli): os migrate organization-ownership plans a v17 database still holding the retired sys_scim_provider, as fate 4 (ADR-0131 D10) #23874)
• 6d1660dc3b fix(client): getRuntimeStatus rows are the FlowRuntimeState contract (fix(client): getRuntimeStatus rows are the FlowRuntimeState contract #23956)
• 68ffa5dc1a refactor(rest): move registerSearchEndpoints into search-routes.ts ([maintainer] refactor(rest): split packages/rest/src/rest-server.ts (13,701 lines, 70 commits in 30 days) along its register*Endpoints seams, one move-only slice per PR, /meta after #22877 stage 2 #23050 slice 9) (refactor(rest): move registerSearchEndpoints into search-routes.ts (#23050 slice 9) #23959)
• e9301e8a9f test(spec): re-measure the two declared test budgets over 11 executed hourly runs (test(spec): re-measure the two declared test budgets over 11 executed hourly runs #23937)
• 67e8792ff4 feat(plugin-audit): sys_comment gains a writer-stamped object_name + record_id pair with a backfill, and the comment-thread read gate leafs over it (ADR-0139 E7) (feat(plugin-audit): sys_comment gains a writer-stamped object_name + record_id pair with a backfill, and the comment-thread read gate leafs over it (ADR-0139 E7) #23881)
• 0b6956490a fix(create-objectstack): a failed install lists the install step in "Next steps" (fix(create-objectstack): a failed install lists the install step in "Next steps" #23966)
• 2054a0888c fix(service-automation): a failing parallel keeps every branch's steps in the run log (fix(service-automation): a failing parallel keeps every branch's steps in the run log #23970)
• 2e0e4517a6 feat(platform-objects): User Preferences and Identity Links leave Setup's menu; the User page gains a Preferences tab (feat(platform-objects): User Preferences and Identity Links leave Setup's menu; the User page gains a Preferences tab #23936)
• 022c6e799e test(dogfood): pin the undeclared-key refusal on the suite's SQL driver arms (verify: classify hotcrm's "platform-semantics pins" — each becomes a derived proof family in @objectstack/verify or a platform regression test in dogfood, never an app test (epic hotcrm#1579, step 5c) #15953 slice 7) (test(dogfood): pin the undeclared-key refusal on the suite's SQL driver arms (#15953 slice 7) #23976)
• e66f13ca91 chore(objectui): move the console pin to f8267df93aba, past the spec deletion of checkPageComponentViewData (chore(objectui): move the console pin to f8267df93aba, past the spec deletion of checkPageComponentViewData #23973)
• 2e1562091c fix(cli,runtime): refuse an uncreatable state, output or cache directory at once instead of looping in recursive mkdir (fix(cli,runtime): refuse an uncreatable state, output or cache directory at once instead of looping in recursive mkdir #23979)
• f901746ac8 feat(spec)!: reserve the retired callout node types http_request, http_call and webhook; flow-node-http-callout-rename leaves the load path (F5-http of spec(conversions): eight ADR-0087 D2 conversions stay on the 18 load path after #23487 — five families each need a ruling before they can retire #23543) (feat(spec)!: reserve the retired callout node types http_request, http_call and webhook; flow-node-http-callout-rename leaves the load path (F5-http of #23543) #23954)
• 9f12417868 docs(changelog): stored sys_comment.reactions survive the v18 upgrade; amend the retirement entries in place (docs(changelog): stored sys_comment.reactions survive the v18 upgrade; amend the retirement entries in place #23981)
• b25d98a46f fix(objectql): bind previous to null on insert so a rule that reads it answers with its own message (fix(objectql): bind previous to null on insert so a rule that reads it answers with its own message #23971)
• d050a8fc63 fix(spec,objectql): installed pages carrying a retired declaration convert at load instead of stopping the kernel build (fix(spec,objectql): installed pages carrying a retired declaration convert at load instead of stopping the kernel build #23962)
• adce192974 feat(cli): os migrate organization-ownership reports the declared sharing-rule mirrors as advisory while this release's boot still seeds them (feat(cli): os migrate organization-ownership reports the declared sharing-rule mirrors as advisory while this release's boot still seeds them #23988)
• 5fb8d158b5 fix(plugin-security): Everyone and Guest position descriptions read as admin copy (fix(plugin-security): Everyone and Guest position descriptions read as admin copy #23987)
• d132140ebc refactor(rest): move registerUiEndpoints into ui-routes.ts ([maintainer] refactor(rest): split packages/rest/src/rest-server.ts (13,701 lines, 70 commits in 30 days) along its register*Endpoints seams, one move-only slice per PR, /meta after #22877 stage 2 #23050 slice 10) (refactor(rest): move registerUiEndpoints into ui-routes.ts (#23050 slice 10) #23990)
• 61a6809564 test(verify): harness.one-composition pays the boot's first load at module scope (test budget (domain:cli): 119 test file(s) over 10 s of wall in the hourly full battery (Part of #23151) #23181 slice 4) (test(verify): harness.one-composition pays the boot's first load at module scope (#23181 slice 4) #23994)
• 4ffdebe182 fix(core): a revoked API key's refusal names the restore road instead of claiming permanence (fix(core): a revoked API key's refusal names the restore road instead of claiming permanence #23991)
• e18b23fac5 docs(qa): re-point six stale platform-checklist clauses across five items to the shapes their rulings shipped (docs(qa): re-point six stale platform-checklist clauses across five items to the shapes their rulings shipped #24000)
• bbdfc0576a feat(spec)!: retire the permission set's authored managedBy, a provenance key nothing read (feat(spec)!: retire the permission set's authored managedBy, a provenance key nothing read #23989)
• 92fd343bcf docs(permissions): name where a high-privilege anchor binding is refused; spec patch changeset for the anchor docblock (docs(permissions): name where a high-privilege anchor binding is refused; spec patch changeset for the anchor docblock #24006)
• 19955fb73f fix(service-automation): settle the run row when a resume is refused because its flow or parked node is gone (fix(service-automation): settle the run row when a resume is refused because its flow or parked node is gone #24003)
• fd9664ffac fix(app-showcase): ship the approver-bindings specimen obsolete, not draft (fix(app-showcase): ship the approver-bindings specimen obsolete, not draft #24008)
• fd0e72abc2 docs(qa): re-point identity-auth.api-key-ui-lifecycle's revoke oracle to 403 API_KEY_REVOKED (docs(qa): re-point identity-auth.api-key-ui-lifecycle's revoke oracle to 403 API_KEY_REVOKED #24012)
• bb14934cda fix(cli): a serve boot that composes no HTTP server stays up until it is stopped (fix(cli): a serve boot that composes no HTTP server stays up until it is stopped #24019)
• aefab7c2c6 fix(rest)!: the /meta item and list reads serve a view stored with no label without an invented label (fix(rest)!: the /meta item and list reads serve a view stored with no label without an invented label #24013)
• 9e797a8976 fix(runtime): mount every /api/v1/keys verb so an anonymous caller is answered 401 on the standalone server (fix(runtime): mount every /api/v1/keys verb so an anonymous caller is answered 401 on the standalone server #24009)
• cf31c34823 test(spec): the two type-graph test files declare their measured CI budget (test(spec): the two type-graph test files declare their measured CI budget #24015)
• 2c702fd9f6 feat(spec)!: unexport normalizeVisibleWhen and VISIBILITY_ALIAS_KEYS from @objectstack/spec/shared; read visibleWhen directly (feat(spec)!: unexport normalizeVisibleWhen and VISIBILITY_ALIAS_KEYS from @objectstack/spec/shared; read visibleWhen directly #24004)
• 75ced061b8 fix(plugin-hono-server,hono,cloud-connection)!: refuse an unparseable request body with 400 INVALID_REQUEST instead of reading it as {} (fix(plugin-hono-server,hono,cloud-connection)!: refuse an unparseable request body with 400 INVALID_REQUEST instead of reading it as {} #24005)
• 2b274600b1 test(dogfood): activity-text-predicate pays its boot's first load at module scope and splits its slow control case (test(dogfood): activity-text-predicate pays its boot's first load at module scope and splits its slow control case #24026)
• 66d2757024 feat(spec): the installed-package row declares its origin, a closed source (code / marketplace / authored), and the served writable verdict (feat(spec): the installed-package row declares its origin, a closed source (code / marketplace / authored), and the served writable verdict #24010)
• b74434c581 feat(plugin-approvals): engine-written display labels for the approval lists (step, flow, waiting on, record pointer, acted-as) (feat(plugin-approvals): engine-written display labels for the approval lists (step, flow, waiting on, record pointer, acted-as) #23984)
• c4111c676a fix(cli,driver-turso): os migrate plan on a Turso remote database lists the changes it cannot apply with the transport's limit, not --allow-destructive (fix(cli,driver-turso): os migrate plan on a Turso remote database lists the changes it cannot apply with the transport's limit, not --allow-destructive #24014)
• d731b89a64 fix(identity): Invite User offers only the roles the caller may grant, read from the role cap's own table (fix(identity): Invite User offers only the roles the caller may grant, read from the role cap's own table #24033)
• 605aa01726 fix(runtime): the SQLite file-path refusal names what the operator can change (fix(runtime): the SQLite file-path refusal names what the operator can change #24039)
• 5c2ac83a23 fix(rest): a producer-declared 4xx refusal is not logged as [REST] Unhandled error (fix(rest): a producer-declared 4xx refusal is not logged as [REST] Unhandled error #24038)
• 905f57bc74 docs(spec): record-surface docblocks name editMode and the per-flow derivation (docs(spec): record-surface docblocks name editMode and the per-flow derivation #24035)
• e246f06119 feat(plugin-auth,platform-objects,core)!: a key a forced password reset revoked is restored by a platform administrator only (feat(plugin-auth,platform-objects,core)!: a key a forced password reset revoked is restored by a platform administrator only #24044)
• a65a59be41 feat(spec)!: retire the ADR-0078 conversion-conflict channel — onConflict / reservedNodeTypes, the notice types, the conflicts arrays and the FLOW_CONVERSION_CONFLICT 409 (feat(spec)!: retire the ADR-0078 conversion-conflict channel — onConflict / reservedNodeTypes, the notice types, the conflicts arrays and the FLOW_CONVERSION_CONFLICT 409 #24045)
• b1d5569d98 fix(scripts): report-test-timings marks a row replayed only when its own turbo task replayed (fix(scripts): report-test-timings marks a row replayed only when its own turbo task replayed #24052)
• a33f3d58fe fix(cli): four more read-only sentences name what they vouch for, and the journal-mode switch on a SQLite file (fix(cli): four more read-only sentences name what they vouch for, and the journal-mode switch on a SQLite file #24053)
• 62f959dd62 fix(runtime)!: POST /packages refuses an overwrite over a read-only package with 422 WRITABLE_PACKAGE_REQUIRED (fix(runtime)!: POST /packages refuses an overwrite over a read-only package with 422 WRITABLE_PACKAGE_REQUIRED #24055)
• 077b75f559 fix(metadata-core): the protocol handshake reads an engines.protocol || union instead of refusing it on its first alternative (fix(metadata-core): the protocol handshake reads an engines.protocol || union instead of refusing it on its first alternative #24051)
• c91af8ed64 test(lint): load the linked @objectstack/spec dist with Node, not vite's transform (test(lint): load the linked @objectstack/spec dist with Node, not vite's transform #24048)
• b6805ac0f6 fix(lint): one-line fix lines for the twelve lint-flow-patterns anti-pattern rule ids (slice 20); os explain carries what they explained (fix(lint): one-line fix lines for the twelve lint-flow-patterns anti-pattern rule ids (slice 20); os explain carries what they explained #24058)
• c7168ac95b fix(service-package,cloud-connection): convert stored package bodies forward at the sys_packages and marketplace doors (fix(service-package,cloud-connection): convert stored package bodies forward at the sys_packages and marketplace doors #24028)
• 44fe210632 fix(plugin-approvals): name the record by object label and id in every approval notification body (fix(plugin-approvals): name the record by object label and id in every approval notification body #24064)
• ab3ba2ca2c fix(plugin-auth)!: sixteen auth routes refuse an unparseable declared-JSON request body with 400 INVALID_REQUEST instead of reading it as {} (fix(plugin-auth)!: sixteen auth routes refuse an unparseable declared-JSON request body with 400 INVALID_REQUEST instead of reading it as {} #24049)
• 8133cc7805 test(dogfood): the authz census and the matrix docblock read the runtime route ledger as the 92 rows it holds (test(dogfood): the authz census and the matrix docblock read the runtime route ledger as the 92 rows it holds #24069)
• 8a83cebc15 docs(spec): IHttpRequest.body TSDoc states what a handler reads and that the read may refuse (docs(spec): IHttpRequest.body TSDoc states what a handler reads and that the read may refuse #24068)
• 76d9dca5fa fix(hono)!: createHonoApp reads a dispatched body by plugin-hono-server's rule, so a text/plain or undeclared body is refused when a domain reads it (fix(hono)!: createHonoApp reads a dispatched body by plugin-hono-server's rule, so a text/plain or undeclared body is refused when a domain reads it #24071)
• ba8bf1dcda fix(showcase): the Status × Priority matrix subtitle names the estimated hours its cells hold (fix(showcase): the Status × Priority matrix subtitle names the estimated hours its cells hold #24084)
• be076dad28 docs(adr-0018): dated note — http_request, http_call and webhook are reserved retired node names (F5-http of spec(conversions): eight ADR-0087 D2 conversions stay on the 18 load path after #23487 — five families each need a ruling before they can retire #23543) (docs(adr-0018): dated note — http_request, http_call and webhook are reserved retired node names (F5-http of #23543) #23955)
• 6e180163de feat(metadata-protocol)!: a flow re-save that newly introduces a retired spelling is refused like a new flow's (feat(metadata-protocol)!: a flow re-save that newly introduces a retired spelling is refused like a new flow's #23986)
• b15f8a1997 feat(service-print): print a record's print page to a PDF in headless Chromium as the requesting user, and archive it on the record (feat(service-print): print a record's print page to a PDF in headless Chromium as the requesting user, and archive it on the record #23811)
• b04f7d18d6 ci(rerun-safety): a truthful verdict, passes bounded by the job's time, and a card on a red night (ci(rerun-safety): a truthful verdict, passes bounded by the job's time, and a card on a red night #23975)
• 051aea67af docs(adr): ADR-0078 and ADR-0087 note the conversion-conflict channel's retirement (docs(adr): ADR-0078 and ADR-0087 note the conversion-conflict channel's retirement #24046)
• b75129fba7 fix(plugin-approvals): an approval request record title reads the flow label (process_label), falling back to process_name (fix(plugin-approvals): an approval request record title reads the flow label (process_label), falling back to process_name #24085)
• 570c7a2d95 fix(cli): os serve no longer hangs on a runtime state file directory that can never be made (fix(cli): os serve no longer hangs on a runtime state file directory that can never be made #24088)
• d6bd98a3fe fix(metadata-protocol): duplicatePackage reports a refused install of the copy's package record (fix(metadata-protocol): duplicatePackage reports a refused install of the copy's package record #24081)
• 45e6001763 feat(spec): register the invitation role cap refusal codes under plugin-auth (feat(spec): register the invitation role cap refusal codes under plugin-auth #24092)
• 50ccfa6697 docs(qa): re-point the half-A platform-checklist items that described an older product (docs(qa): re-point the half-A platform-checklist items that described an older product #24118)
• c40a0dd9c8 refactor(rest): move registerFormEndpoints into form-routes.ts ([maintainer] refactor(rest): split packages/rest/src/rest-server.ts (13,701 lines, 70 commits in 30 days) along its register*Endpoints seams, one move-only slice per PR, /meta after #22877 stage 2 #23050 slice 11) (refactor(rest): move registerFormEndpoints into form-routes.ts (#23050 slice 11) #24054)
• 33228c5b6c fix(plugin-email): wire sys_email persistence + the template loader in init, so a boot-time verification send stops throwing TEMPLATE_NOT_FOUND (fix(plugin-email): wire sys_email persistence + the template loader in init, so a boot-time verification send stops throwing TEMPLATE_NOT_FOUND #24113)
• c1c0a90942 fix(rest): the API-exposure gate reads the one object it checks, by name, instead of every object's metadata on each /data request (fix(rest): the API-exposure gate reads the one object it checks, by name, instead of every object's metadata on each /data request #24093)
• 27d7c2aa1d fix(cli): a --no-server boot takes the datasource admin routes' own degrade line, not an ordering fault (fix(cli): a --no-server boot takes the datasource admin routes' own degrade line, not an ordering fault #24132)
• 462d02f00a docs(spec): describe objectui's normaliseOptions as it is at the console pin (docs(spec): describe objectui's normaliseOptions as it is at the console pin #24072)
• 5c92b01304 fix(showcase): the invoice print page heads its line-items table with labels, not field names (fix(showcase): the invoice print page heads its line-items table with labels, not field names #24139)
• 9ffe8af094 docs(qa): re-point the half-B platform-checklist items that described an older product (docs(qa): re-point the half-B platform-checklist items that described an older product #24141)
  Filed by .github/workflows/scheduled-full-run-card.yml. Generated by Claude Code