Merge origin/main into claude/issue-28404-override-declaration

Regenerate the spec artefacts from the merged tree.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017ihL2fi9zfJhUTubyJYb6V

Author: claude

.changeset/27331-skills-marketplace-handbook-link.md

@@ -0,0 +1,12 @@
+---
+'@objectstack/skills': patch
+---
+
+docs(skills): the `os package publish` row of objectstack-platform's operations reference points app authors at the Marketplace handbook
+
+Clause-②: no
+Metadata-protocol: none
+
+- **Before.** The platform skill's operations reference described `os package publish` as an upload to the cloud catalog and nothing more. An agent authoring an app from the skills never found the page that says what a listing is made of (`objectstack.manifest.json`, the README), what review checks, and what the customer's administrator goes through after installing.
+- **Now.** That row names the listing file, the README, review and the administrator's screens, and links `https://objectstack.ai/docs/deployment/marketplace-handbook`.
+- Paid for under the skills token ratchet by deleting the cloud-connection note's tail (the `LocalManifestSource` ledger and runtime-identity bind v2), plugin internals an app author never acts on. The file stays under its ceiling; no ceiling moves, no frontmatter, schema, key or behaviour changes.

.changeset/27948-action-copy-envelope-readers.md

@@ -0,0 +1,21 @@
+---
+'@object-ui/core': patch
+'@object-ui/react': patch
+'@object-ui/fields': patch
+---
+
+fix(core,react): an action's `description`, a param's `helpText` and an `outcomeMessages` entry read the `template` envelope
+
+Clause-②: no
+Metadata-protocol: none
+
+objectstack#27948 step 2 types these three as `template` slots, so a served action can carry `{ dialect: 'template', source }` where it carried a string.
+
+- **Param dialog.** The runner hands the param-collection handler the action and params with `description` and each `helpText` reduced to their text (`actionCopyText`), so the dialog draws the sentence, never `[object Object]`; a locale map is handed on unchanged for the host to localize.
+- **Outcome toast.** `useActionTextLocalizer` keeps an `outcomeMessages` envelope's shape (a bundle entry replaces its `source`) instead of collapsing it to the word "template", and the runner fills the envelope's holes as it fills the string's.
+
+- **Param fields.** `@object-ui/fields`' `resolveActionParams` reads a param's `helpText` through `actionCopySource`, so an envelope yields its sentence (a field-backed param with no text falls back to the field's own help) and `ActionParam` stays assignable to its `RawActionParam`.
+
+- **Studio's action preview** (`@object-ui/app-shell`, unpublished) draws a param's `helpText`, `confirmText` and `successMessage` from the envelope's `source`: it drew `helpText` raw (an object as a React child) and read the other two as a locale map, which showed the word "template".
+
+What to do: nothing. `${…}` copy written before the migration keeps reading.

.changeset/27948-action-copy-template-slots.md

@@ -0,0 +1,33 @@
+---
+'@objectstack/spec': minor
+'@objectstack/lint': minor
+'@objectstack/platform-objects': patch
+'@objectstack/runtime': patch
+'@objectstack/cli': patch
+---
+
+feat(spec)!: an action's `description`, each param's `helpText` and each `outcomeMessages` entry are `template` slots; the doors refuse `${…}` there
+
+Clause-②: yes (narrowing)
+Metadata-protocol: narrowed
+
+<!-- adr-0087: registered action-dialog-outcome-copy-template-holes -->
+
+Step 2 of #27948 (ruling A): the five action copy keys speak one hole syntax, ADR-0032's `{{ }}`. `confirmText` and `successMessage` already did (#24814); the param dialog's `description`, each param's `helpText` and each `outcomeMessages` entry now join them.
+
+- **The parse.** Each of the three is typed as `confirmText` is: a bare string is shorthand for `{ dialect: 'template', source }` and parses to that envelope; the envelope is taken; `description` and an `outcomeMessages` entry keep the inline locale map they took as an `I18nLabel`, and `helpText` stays without one (it was a plain string). A blank string and a `${…}` sentence still parse, so a stored action loads.
+- **The roots.** `description` and `helpText` read `confirmText`'s roots: `record`, the record the action runs against (a registered action's `params` is the input list the dialog collects, so it binds nothing). An `outcomeMessages` entry reads `successMessage`'s: `result`, the handler's answer, and `record`.
+- **The doors.** `objectstack validate`, `compile` and the publish gate (422) judge each sentence through the same judge as `confirmText`: a `${…}` token, a single-brace `{x}` token, a hole over a root the runner does not bind, a hole holding logic or an unknown formatter, and a blank sentence are errors, each named at its own path (`description`, `params[N].helpText`, `outcomeMessages.OUTCOME`) with its `{{ }}` spelling. An inline `properties.action` is judged on its params' `helpText`.
+- **The readers.** The CLI's i18n extraction seeds the envelope's text exactly as the bare string's, and the MCP `list_actions` param description reads `helpText`'s text, never the object.
+- **The platform's own copy** is rewritten: the invite actions' outcomes (`Invitation sent to {{ result.email }}`), `resend_invitation`'s and `update_member_role`'s descriptions, the role-change `permission_set_granted` outcomes, and their four translation bundles.
+
+What to do (FROM → TO, on `description`, `params[].helpText` and `outcomeMessages` entries):
+
+- `Resend the invitation to ${record.email}?` → `Resend the invitation to {{ record.email }}?`
+- `Invitation sent to ${result.email}` → `Invitation sent to {{ result.email }}`
+- `${record.owner?.name ?? 'nobody'}` → `{{ record.owner.name | default:'nobody' }}` (the `default` formatter also covers an empty value)
+- other logic in a `${…}` token moves into the handler's answer and is read from `result`.
+
+The console keeps filling `${…}` in a stored sentence with no `{{ }}` hole, so stored copy reads as before until its next save, which is judged. `os migrate meta` lists the change (`action-dialog-outcome-copy-template-holes`); no conversion is registered, since a `${…}` token held an expression and a hole holds only a path and formatters.
+
+A TypeScript reader of a parsed `ActionSchema` now meets the envelope on these three keys: read its text with `templateSlotSource` (`@objectstack/spec/automation`).

.changeset/28001-cascade-delete-objects-beside-item.md

@@ -0,0 +1,16 @@
+---
+'@objectstack/spec': minor
+'@objectstack/objectql': patch
+'@objectstack/metadata-protocol': patch
+'@objectstack/rest': patch
+---
+
+feat: the object read names the objects a delete can cascade into, beside the item
+
+Clause-②: yes (widening)
+Metadata-protocol: added
+Skills-docs: none — `cascadeDeleteObjects` is a served-only key beside the object read with no authorable spelling; no file under `skills/**` teaches the object read's envelope keys (a `git grep` of `skills/` for `cascadeDeleteObjects` and `disabledActions` names nothing), and every taught `deleteBehavior` use stays true.
+
+- **Served beside the object** (`@objectstack/metadata-protocol`, `@objectstack/rest`). `GET /api/v1/meta/object/:name` serves `cascadeDeleteObjects` beside `item`: the names of the objects that deleting a record of this object can also delete. That is every object whose relation into it cascades (a `master_detail` by default, a `lookup` or `tree` that declares `deleteBehavior: 'cascade'`), and the objects that cascade into those in turn, each once. A `restrict` or `set_null` relation removes nothing and is not named. The default cached door carries it too, and the list is folded into that door's ETag, so an object registered later that cascades into this one changes the ETag. The key is absent where no engine answered, on a draft read, on the list read and on every type other than `object`; `[]` means nothing cascades. `item` is unchanged. A delete confirmation can now name what else a delete removes without keeping its own copy of the rule.
+- **The fact it serves** (`@objectstack/objectql`). `ObjectQL.getCascadeDeleteObjects(object)` answers that list from the delete walk's own relation scan, which the delete and this read now share. It reads the registry and no row, so it never says which records or how many. It returns `undefined` for an object the registry does not hold.
+- **The declaration** (`@objectstack/spec`). `GetMetaItemResponseSchema` and `GetMetaItemCachedResponseSchema` gain the optional `cascadeDeleteObjects` (an array of object names), and `IObjectQLEngine` gains the optional member `getCascadeDeleteObjects(objectName)`, which the metadata read calls through the kernel's service table. Nothing about it is authorable.

.changeset/28005-thank-you-record-slot.md

@@ -0,0 +1,17 @@
+---
+'@objectstack/spec': minor
+'@objectstack/lint': minor
+---
+
+feat(spec): a form's thank-you panel can name the record's engine-generated fields, and the public submit answer has a declared shape
+
+Clause-②: yes (widening)
+Metadata-protocol: added
+
+A public form's confirmation panel could not tell a web-to-case visitor their case number: `title` and `message` were plain text, and `POST /api/v1/forms/SLUG/submit` answers `{ id }` only.
+
+- **The slot.** A form's `submitBehavior: { kind: 'thank-you', title, message }` may name a field of the record just submitted as `{{record.field_name}}`, the same token the `redirect` behavior's `url` takes. Any other brace is refused at parse, naming the offending text: `{record.x}`, `{{ record.x }}` and `{{case_number}}` are not the token.
+- **Only engine-generated fields.** A named field must be one whose value the engine generates on insert: its type is in `RUNTIME_OWNED_FIELD_TYPES` (today `autonumber`). Any other stored value may have been set by a `beforeInsert` / `afterInsert` hook from records an anonymous visitor cannot read. `os validate`, `os build`, `os lint` and the publish gate on a `view` or `page` write refuse any other name (rule `thank-you-record-field`), naming the field and its type. This covers every form view shape and a page `object-form` component.
+- **The answer shape.** `PublicFormSubmitResponseSchema` (`@objectstack/spec/api`) declares the submit answer as `id` plus an optional `fields` map holding exactly the named fields, and nothing else. `thankYouRecordFieldNames` (`@objectstack/spec/ui`) reads which fields a panel names.
+
+The server fills `fields` and the console fills the tokens in follow-up releases. Until then, a panel that names a field shows the token text as written.

.changeset/28051-skills-derived-currency-refusal.md

@@ -0,0 +1,12 @@
+---
+'@objectstack/skills': patch
+---
+
+docs(skills): the skills teach the third `fixed`-currency refusal, a derived measure's own `currency` against its operands' one `fixed` code
+
+Clause-②: no
+Metadata-protocol: none
+
+- `objectstack-data` `rules/field-types.md` (Currency resolution) and `objectstack-ui` `rules/dashboards.md` (the dataset currency comment) taught two `fixed` refusals and missed the third: a derived `sum` or `difference` whose monetary operands all resolve to one `fixed` code refuses another `currency` at dataset compile, with `DATASET_INVALID` / 400. Both files now teach it beside the other two, with the shipped prescription: delete the measure's `currency` (the column takes the operands' code), or restate that code.
+- Paid for inside each file: `field-types.md` drops the `currency_code` naming convention its own example already shows; `dashboards.md` drops the retired `categoryGranularity` parenthetical, which the parse refusal and the Dataset-Bound Widgets paragraph already carry. Neither ratchet row moves.
+- No schema, key or behaviour changes.

.changeset/28209-skills-code-datasource-env-credential.md

@@ -0,0 +1,12 @@
+---
+'@objectstack/skills': patch
+---
+
+docs(skills): objectstack-data teaches the code-defined datasource credential route (`OS_DATASOURCE_<NAME>_PASSWORD`, behind the host switch)
+
+Clause-②: no
+Metadata-protocol: none
+
+- **Before.** `rules/datasources.md` taught `credentialsRef` and `connector` as the only credential channels. A datasource defined in code has no `sys_secret:` handle to point at (the Setup form refuses a code-origin datasource, and nothing else mints one), so an agent following the rule wrote a reference the connect could never resolve.
+- **Now.** The credential section says a code-declared datasource reads its password at connect from `OS_DATASOURCE_<NAME>_PASSWORD` (the name upper-cased) while the host switch `OS_DATASOURCE_ENV_CREDENTIALS` is `on`; that `os serve`, `os start` and `os dev` default it on, a library composition leaves it off, and the switch takes `on` or `off` only; that a declared `credentialsRef` or `connector` still wins and never falls back to the variable; and the operator's caution that an installed package may declare a datasource of any free name and so read that variable.
+- The file stays under its token ceiling: the new text is paid for by deleting restatements in the same file (the field-reference pointer the references index already carries, the `writable` and `columnMap` restatements of their own sections, the `datasource` field default the SKILL.md field table carries, and two detail clauses). No ceiling moves, no frontmatter, schema or behaviour changes.

content/docs/api/data-api.mdx

@@ -518,12 +518,18 @@ monetary measure column takes the measure's own `currency`; then, only when the
 field is `currencyMode: 'fixed'`, that field's `currencyConfig.defaultCurrency`; then the
 tenant default currency (the `localization.currency` setting), if one is set. A
 `dynamic` field (the default mode) never lends its `defaultCurrency` — only `fixed` does —
-so its column shows the tenant default. The cube query on this page carries no column
-`currency`.
+so its column shows the tenant default. A derived `sum` or `difference` whose monetary
+operands all resolve to one `fixed` code takes that code at the field's step; any other
+derived measure (a `ratio`, a `product`, operands in the tenant's currency) is monetary
+only by its own `currency`, else its column carries none. The cube query on this page
+carries no column `currency`.
 
 Over a `fixed` field the measure's `currency` may only restate the field's code. A
 different code is refused when the dataset compiles, with `DATASET_INVALID` / 400: delete
-the measure's `currency`, and the column takes the field's code. A derived measure whose
+the measure's `currency`, and the column takes the field's code. A derived `sum` or
+`difference` whose operands resolve to one `fixed` code is held to the same rule: a
+different `currency` is refused with `DATASET_INVALID` / 400 — delete the measure's
+`currency` (the column takes the operands' code), or restate it. A derived measure whose
 monetary operands resolve to two different `fixed` codes is refused the same way, whatever
 the operation: derive it from measures in one currency, or drop the operand in the other.
 Neither a `fixed` code against the tenant default nor a measure `currency` over a

content/docs/data-modeling/currency.mdx

@@ -178,8 +178,12 @@ that column. A `count` column never carries `currencyField`. See the
 - **A derived measure whose monetary operands resolve to two different `fixed` codes** is
   refused at compile with `DATASET_INVALID` / 400, whatever the operation. Derive it from
   measures in one currency, or drop the operand in the other. A derived `sum` or
-  `difference` over one `fixed` code carries that code, so a measure built on it is judged
-  the same way.
+  `difference` over one `fixed` code carries that code, on its result column too, so a
+  measure built on it is judged the same way.
+- **A derived `sum` or `difference` whose `currency` differs from its operands' one `fixed`
+  code** is refused at compile with `DATASET_INVALID` / 400: `currency: 'USD'` over two
+  measures fixed to `EUR` would print euros as dollars. Delete the measure's `currency`, and
+  the column takes the operands' code, or restate that code.
 - **Not judged:** a `fixed` code against the tenant currency, which compile does not know,
   and a measure `currency` over a `dynamic` field, which wins as the top of the currency
   chain.

content/docs/deployment/cli.mdx

@@ -771,7 +771,7 @@ os compile --json                    # JSON output for CI pipelines
   → Normalizing stack definition...
   → Lowering inline handlers...
   → Validating protocol compliance...
-  → Running author-time rules (56)...
+  → Running author-time rules (57)...
   → Checking that every required capability has a provider installable in this edition...
   → Collecting package docs (ADR-0046)... 0 collected
   → Writing artifact...