Merge origin/main into claude/issue-13871-generate-codegen-ghost-field-types

Keeps the gate-family derivation and the verification on a tree that is at
origin/main, per scripts/pm/dispatch-gates.mjs's stale-tree refusal.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016yfqQh2dBgPAymYd7xipza

Author: claude

.changeset/authz-brand-structured-clone-doc.md

@@ -0,0 +1,42 @@
+---
+'@objectstack/core': patch
+---
+
+docs(core): the `AuthzStoreUnavailableError` brand doc states the measured `structuredClone` behaviour instead of claiming survival (#14006)
+
+Documentation only — no runtime change, no type change, no accept/reject
+behaviour moves. It ships as a patch because the docblock is a **published
+byte**: `tsup`'s declaration rollup carries it into `dist/index.d.ts` and
+`dist/index.d.cts`, so it is what a consumer reads on hover.
+
+The brand's docblock justified the string-keyed own property with two reasons
+joined by an `and`, of which only the second was true:
+
+> A string-keyed own property (not a `Symbol.for` registry key) so it survives
+> `structuredClone`, and so a duplicated copy of this module still brands
+> identically.
+
+Measured on Node 22.22.2: the structured-clone algorithm gives `Error` a
+dedicated serialization carrying `message`, `stack` and `cause` only, and drops
+every other own property — the brand, the ADR-0112 `code`, `status` and
+`object` alike (a subclass's own `name` returns as `'Error'`). The
+plain-object control is the half that proves it: `{ __brand: true, code: 'C' }`
+keeps **both** keys through the same call, so the loss is specific to `Error`,
+not general to `structuredClone`.
+
+The property and the reason that actually earns it are kept — a duplicated copy
+of the module still brands identically, which is exactly what `instanceof`
+cannot do across two installed copies of `@objectstack/core`. The false half is
+replaced by the measured behaviour, carrying the reproducible script and the
+Node version rather than a second unsourced assertion, and phrased to match
+what `service-not-registered.ts` already records for its own brand (one
+phrasing across the two modules, not two).
+
+⛔ The clone gap is deliberately NOT "fixed" with a `toJSON` or a custom
+serialization: no call site crosses a clone boundary today
+(`rethrowAuthzStoreUnavailable` on the rest rethrow paths,
+`isAuthzStoreUnavailableError` inside service `catch` blocks — all in-process),
+and adding one would widen the module's surface with nothing pulling on it. The
+docblock instead names the trap the false claim invited: branching on the brand
+across a worker or `postMessage` boundary would answer `false` and fail OPEN on
+a security path.

.changeset/data-event-organization-id.md

@@ -0,0 +1,34 @@
+---
+"@objectstack/spec": minor
+---
+
+feat(spec): `DataEvent` names the organization the record belongs to, so a tenant-scoped consumer can tell whose event it is
+
+The realtime `DataEvent` payload (`@objectstack/spec/api`, the body of every
+`data.record.created` / `data.record.updated` / `data.record.deleted` event)
+gains an optional `organizationId`: the organization the record belongs to.
+Until now the event carried the object name, the record id and the row body,
+and nothing that named the tenant — so a consumer that fans events out per
+organization (a webhook subscription, a per-organization realtime subscriber)
+had no term to discriminate on short of reading the row body, which is absent
+on delete events and is not the consumer's to read.
+
+What a consumer may assume:
+
+- **Present** — exactly that organization, never a guess: the organization the
+  record belongs to, not the caller's active organization standing in for it.
+- **Absent** — the record belongs to no organization. That is every event on a
+  `single`-posture deployment (no organization wall, nothing stamps the
+  column) and an organization-less, environment-wide row under a walled
+  posture. Read it as "not behind any organization wall", never as "unknown,
+  look it up".
+
+Declared = enforced: the key is optional and nothing else. No default
+fabricates a tenant; `null` and the empty string are refused with a located
+issue, so "no organization" has exactly one spelling — the key is absent.
+
+Additive and shape-preserving: every event that parsed before parses
+identically, and no producer emits the key yet — the ObjectQL engine's publish
+site is a separate change that follows this contract. The bulk
+`BulkDataEvent` (`data.records.*`) is deliberately untouched: a predicate
+write's affected set is its own contract with its own tenant question.

.changeset/job-once-schedule-leader-election.md

@@ -0,0 +1,35 @@
+---
+"@objectstack/service-job": patch
+---
+
+fix(service-job): leader-elect `type: 'once'` schedules on `DbJobAdapter` (#13918)
+
+`DbJobAdapter.schedule()` decides which adapter owns a scheduled fire, and only
+`CronJobAdapter` takes the cluster lock (`runScheduled()` -> `lock.acquire('job:'
++ name, { waitMs: 0 })`). `cron` schedules were routed there from the start and
+`interval` schedules since #13686 — but `once` schedules still went to the inner
+`IntervalJobAdapter`, a bare `setTimeout` with no lock. On a multi-replica
+deployment a one-shot job therefore ran **once per replica**, not once per
+cluster, and a one-shot is the worst-shaped of the three: there is no later tick
+during which a business-level de-duplication marker could win, so every replica's
+copy lands inside the same short window.
+
+`once` now takes the same leader-elected path as `cron` and `interval` whenever a
+cron adapter is assembled, and stays registered on the inner adapter via
+`register()` (stored, not armed), so `trigger()`, `replay()`, `getExecutions()`
+and `listJobs()` answer for it exactly as before. Affected paths in this repo:
+the automation wait-node's timer resume and its cold-boot re-arm
+(`@objectstack/service-automation`), schedule-triggered flows with an `at`
+(`@objectstack/trigger-schedule`), and app-declared jobs with a `once` schedule
+(`@objectstack/runtime`).
+
+**Behaviour change, on multi-replica assemblies only.** A `once` job now fires on
+one replica per cluster instead of on every replica. Single-node behaviour is
+unchanged in both assemblies: with a cron adapter and no cluster driver the lock
+is always granted, and with no cron adapter at all the job still fires on the
+inner timer exactly as before. The semantics are **at-most-once per cluster**
+(maintainer ruling 2026-09-01): election decides who fires, not that the fire
+survives — a leader that dies mid-fire loses it, and nothing re-arms it. That
+takes nothing away, because the previous unelected `setTimeout` was not persisted
+either and the same crash lost it on every replica at once. No re-arm, retry or
+persistence mechanism is added.

.changeset/rest-duplicate-record-arm-field-restored.md

@@ -0,0 +1,16 @@
+---
+'@objectstack/rest': patch
+---
+
+Restore the `field` key and the curated conflict sentence on the 409 body for an insert refused by a unique constraint
+
+Since the ObjectQL engine began answering a driver's unique violation with its own `DUPLICATE_RECORD` envelope (`status: 409`, `object`, `field`, the driver error on `cause`), `POST /api/v1/data/:object` let that envelope leave `classifyDataError` through the generic declared-status passthrough: still 409, but with `code: 'DUPLICATE_RECORD'`, no `field`, and the engine's own sentence in `error`. The `isUniqueViolationError` arm that names the conflicting column (`field: 'email'`, "A record with this email already exists") was no longer reached for an insert conflict. Measured with the real engine and real drivers: on `driver-sqlite-wasm` the `field` key disappeared from every conflict on a single-column index; on `driver-memory` the sentence changed.
+
+A dedicated arm for the engine's envelope now sits with the other structured 409s (`DELETE_RESTRICTED`, `CONCURRENT_UPDATE`), ahead of the passthrough:
+
+- `code` stays `UNIQUE_VIOLATION` — the code every client branching on this conflict already reads.
+- `field` is restored whenever the dialect determinably named the column (SQLite, Postgres); composite keys and index-naming dialects (MySQL) carry no `field` key, exactly as before.
+- `error` is the curated end-user sentence again; the engine's own sentence rides on `developerMessage`, the same split the `DELETE_RESTRICTED` body uses.
+- The body still quotes nothing the driver said — no offending value, no statement, no index name — including on `driver-memory`, whose raw refusal used to echo the offending values as JSON through the passthrough.
+
+`patch`: a restoration of the shipped body's keys and wording; the wire `code` and the status are unchanged. The arm fires for the engine's envelope only; a plugin or sandbox body that throws the registered `DUPLICATE_RECORD` itself keeps the answer it gets today.

.changeset/scim-transaction-scope-at-request-door.md

@@ -0,0 +1,5 @@
+---
+'@objectstack/plugin-auth': patch
+---
+
+SCIM provisioning multi-writes now run inside one engine transaction, as the adapter's `#3653` scoping note already declared. On `@better-auth/scim` 1.7.2 the SCIM request scope was stamped with `AsyncLocalStorage.enterWith` inside the `verifyBearerToken` callback and was not observed at write time (measured: zero `engine.transaction` calls across `POST /scim/v2/Users` and `PATCH /scim/v2/Users/{id}`), so `sys_user`, `sys_scim_subject` and `sys_scim_user` landed as separate autocommits, and a refused deactivation left the SCIM resource reporting `active: false` for an account that was still enabled. `AuthManager.handleRequest` now opens the scope with `run(...)` around every request under `/scim/v2` — exactly as narrow as before; non-SCIM better-auth flows keep their sequential posture. A refused last-administrator deactivation now rolls the vendor's own `scimUser.active = false` write back, so the SCIM resource keeps reading `active: true`. The pin the #14360 suite held on that residual (`scim-deactivation-reconcile-user.test.ts`, face (c)) is flipped from `false` to `true` deliberately with this change, and a new runtime pin (`scim-transaction-scope.test.ts`) observes each SCIM mutation calling `engine.transaction`.

.claude/skills/pm-dispatch/SKILL.md

@@ -357,8 +357,8 @@ issue 任何人不得认领** —— 那意味着分诊还没走到,不是「可
 跑到清空排空稳态,阈值吸收突发(实测 40 分钟到 13 张 ≈ 稳态四倍,审计式倾倒形态)——
 没有阈值,倾倒只能按到达顺序摊进常规轮,失掉同族同上下文一次读完的批次红利,
 队尾同期继续增长;⛔ 二者不可互相替代。
-**紧急卡直接分诊** (维护者 2026-08-13):维护者点名或 p0 嫌疑 ⇒ 立即起
-`claude-fable-5` 分诊子代理,不等定时轮次;授权面 = 分诊本身(定级/路由/标签/既有评论格式),
+**紧急卡直接分诊** (维护者 2026-08-13):维护者点名或 p0 嫌疑 ⇒ 立即起 `CONTRACT_REVIEW_TIER` 档
+分诊子代理,不等定时轮次;授权面 = 分诊本身(定级/路由/标签/既有评论格式),
 ⛔ 不写码不认领;产出落卡,与定时轮分诊同格式同效力(细则见 `references/dispatch-runbook.md`)。
 **跨仓 pin 链的窗口级兜底也在本 sweep**(联动单第一产者仍是接受座位;
 ⛔ 只立单不执行 bump): objectui pin 落后且其队列已空 ⇒ 在本仓立/刷新 console bump 单;
@@ -587,16 +587,16 @@ closes-list:部分交付 PR 特意写 Refs 而非 Fixes 时它恰为空,正是
 **派发模型是 PM 的逐卡显式决定** —— 下限 `sonnet`(机械卡:
 正确性由门禁农场机械判定,失败在漏跑门不在判断);默认判断档 `opus`(M/L、
 裁决实施、任何带设计判断的卡;拿不准就升一档 —— 错派低档的返工贵过省下的额度);
-上限 `fable`(最重协议/流程/编排卡,按卡取用非新默认)。**⛔ 强制条款两条**:
-① 凡改**协议语义面**的卡一律 `model: "claude-fable-5"` —— 面 = 本 `SKILL.md` 主文件、
+上限 `fable`(最重协议/流程/编排卡,按卡取用非新默认)。**⛔ 强制条款两条**:① 凡改
+**协议语义面**的卡一律 `CONTRACT_REVIEW_TIER` 档(`--tier` 输出)—— 面 = 本 `SKILL.md` 主文件、
 决策框架拷贝所在文件(以 `check:skill-frame-sync` 强制处为准)与 `.claude/agents/os-dev.md`(2026-08-20
 收窄,维护者原话:「接受你的建议」—— fable 当审计师用,不当施工队用);
 仅 `references/**` 面、或任一 pm-dispatch 治理面上一行级机械文本改动的卡降为 **opus 施工**
 (纯机械一行 PM 酌定可至 sonnet 地板),**补偿控制即既有技能面复核档要求**(ACCEPT 路径分叉
 ①:复核席跑契约复审档位)—— opus 施工的治理面改动只经 fable 档复核到达维护者,
 ⛔ 不新增标签不新增链;② 凡**改变契约接受/拒绝行为或扩大公开面**的卡(`domain:spec`
 语义面;判据即分诊代裁的机械边界测试与 spec 席内分派判据 —— `references/lanes/spec.md`,
-⛔ 不另抄第二份)一律 `claude-fable-5`(维护者 2026-08-12 裁定,
+⛔ 不另抄第二份)一律 `CONTRACT_REVIEW_TIER` 档(维护者 2026-08-12 裁定,
 原话:「同意,就按语义面收窄,立卡并通知 spec 席」)—— 契约错毒化一切下游,
 全仓最贵(条款②闸门见「入队与落地」)。**负边界(维护者 2026-08-28 裁定)**:
 运行时权限/安全**行为**变更不是条款② —— 归人工地板「安全/权限边界」

.github/workflows/cut-rc.yml

@@ -866,11 +866,11 @@ jobs:
           echo "@objectstack/cli@$(jq -r '.version' packages/cli/package.json) is on main at ${LOCAL}."
 
       # Pre-publish gate #2035, kept in step with release.yml's publish job rather
-      # than dropped for speed. In pre mode (which the guard step proved is active,
-      # so ALWAYS on this lane) the #3600 amendment makes it advisory: a major
-      # train exists to ship deliberate surface removals, and a migrated hotcrm
-      # cannot exist until the rc artifacts it would migrate against are published.
-      # It reports; it cannot block.
+      # than dropped for speed. This step is advisory by construction — it has no
+      # BLOCKING switch — because this lane only ever runs in pre mode (the guard
+      # step above proved it active). It reports; it cannot block. For why the
+      # equivalent gate in release.yml is currently advisory too, and what re-arms
+      # it, see that step's own comment.
       - name: Downstream backward-compat smoke (live hotcrm, advisory in pre mode)
         if: ${{ !inputs.dry_run }}
         env:
@@ -879,7 +879,7 @@ jobs:
           if bash scripts/downstream-smoke.sh; then
             echo "::notice::hotcrm@${HOTCRM_REF} is still compatible with the pre-release train."
           else
-            echo "::warning::hotcrm@${HOTCRM_REF} is incompatible with the pre-release train — expected for this window's deliberate removals. Ship a migrated hotcrm release and bump HOTCRM_REF in release.yml before 'changeset pre exit' re-arms that gate."
+            echo "::warning::hotcrm@${HOTCRM_REF} is incompatible with the pre-release train — expected for this window's deliberate removals. Ship a migrated hotcrm release, bump it, and set BLOCKING=1 in .github/workflows/release.yml to re-arm this gate."
           fi
 
       # ────────────────────────────────────────────────────────────────────────

content/docs/references/api/events.mdx

@@ -57,6 +57,7 @@ const result = BulkDataEventSchema.parse(data);
 | **type** | `Enum<'data.record.created' \| 'data.record.updated' \| 'data.record.deleted'>` | ✅ | Event type |
 | **object** | `string` | ✅ | Object name |
 | **recordId** | `string` | ✅ | Record ID |
+| **organizationId** | `string` | optional | Organization the record belongs to (its organization_id), so a tenant-scoped consumer can discriminate the event's tenant without reading the record body. Absent when the record belongs to no organization: every event on a single-posture deployment (no organization wall, nothing stamps the column), and a row that carries no organization under a walled posture (environment-wide, or an object outside the wall) — read absence as "not behind any organization wall", never as "unknown". Present = exactly that organization; never fabricated, and the empty string is refused. |
 | **changes** | `Record<string, any>` | optional | Changed fields |
 | **before** | `Record<string, any>` | optional | Before state |
 | **after** | `Record<string, any>` | optional | After state |

packages/core/src/security/authz-store-unavailable.ts

@@ -106,9 +106,31 @@ export const AUTHZ_STORE_UNAVAILABLE_MESSAGE =
 
 /**
  * The own-property brand {@link isAuthzStoreUnavailableError} tests for.
- * A string-keyed own property (not a `Symbol.for` registry key) so it survives
- * `structuredClone`, and so a duplicated copy of this module still brands
- * identically.
+ * A string-keyed own property (not a `Symbol.for` registry key), so a
+ * duplicated copy of this module still brands identically — which is exactly
+ * what `instanceof` cannot do (module doc above).
+ *
+ * ⚠️ The brand does NOT survive `structuredClone`, and no claim here depends
+ * on it doing so — the same measured behaviour `service-not-registered.ts`
+ * records for its own brand. Reproduce on Node 22.22.2:
+ *
+ * ```js
+ * const e = new Error('x'); e.__brand = true; e.code = 'C';
+ * const c = structuredClone(e);
+ * // c.__brand === undefined   c.code === undefined   c.message === 'x'
+ * // control: structuredClone({ __brand: true, code: 'C' }) keeps BOTH keys
+ * ```
+ *
+ * `Error` has a dedicated serialization carrying `message`, `stack` and
+ * `cause` only, so it DROPS every other own property — this brand, the
+ * ADR-0112 `code`, `status` and `object` alike (and a subclass's own `name`
+ * returns as `'Error'`). The plain-object control is the half that proves the
+ * loss is specific to `Error`, not general to `structuredClone`.
+ *
+ * ⛔ So never branch on this brand across a worker or `postMessage` boundary:
+ * it would answer `false` and fail OPEN. Every call site today is in-process —
+ * `rethrowAuthzStoreUnavailable` on the rest rethrow paths and
+ * `isAuthzStoreUnavailableError` inside service `catch` blocks.
  */
 const AUTHZ_STORE_UNAVAILABLE_BRAND = '__objectstackAuthzStoreUnavailable' as const;