diff --git a/.changeset/address-geo-unique-ids.md b/.changeset/address-geo-unique-ids.md
deleted file mode 100644
index e0e4d3b595..0000000000
--- a/.changeset/address-geo-unique-ids.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-'@object-ui/fields': patch
----
-
-AddressField / GeolocationField sub-inputs now derive their DOM ids from a `useId()` prefix + sub-field name (the RadioField / CheckboxesField `groupId` paradigm) instead of hardcoded literals ("street", "city", "state", "zipCode", "country", "latitude", "longitude"). Two address or geolocation fields in one form no longer produce duplicate DOM ids, and each sub-label's `htmlFor` resolves to and focuses its own field's input instead of the first match in the document (#3343).
diff --git a/.changeset/app-shell-sidebars-derived-area-visibility.md b/.changeset/app-shell-sidebars-derived-area-visibility.md
deleted file mode 100644
index 97d8736adb..0000000000
--- a/.changeset/app-shell-sidebars-derived-area-visibility.md
+++ /dev/null
@@ -1,30 +0,0 @@
----
-"@object-ui/app-shell": patch
----
-
-`AppSidebar` and `UnifiedSidebar` area switchers now adopt the derived area
-visibility introduced for `AppSchemaRenderer` in objectui#3311, closing the
-same visible-but-empty gap in the console shells (objectui#3319).
-
-Both sidebars inlined their own area switcher without any area-level
-filtering, so an area whose navigation items were **all** gated away
-(`visible` expression, `requiredPermissions`, `requiresObject` /
-`requiresService` capability gates) still appeared in the switcher and
-rendered an empty navigation — and a fully gated *first* area was even
-auto-activated, landing the user on an empty sidebar.
-
-## What changed
-
-- **Shared predicate, not a second implementation.** Both switchers now call
-  `hasVisibleNavigationItems` from `@object-ui/layout` — the exact guards
-  `NavigationRenderer` applies per item — so the switcher can never disagree
-  with the rendered navigation. In `UnifiedSidebar`, `action` items count as
-  content (it wires `onAction`, framework#4509); in `AppSidebar` they do not
-  (it wires none).
-- **The active area is elected among visible areas only**: first visible by
-  default, re-elected when the active area is gated away, and a gating change
-  that merely *reveals* an area never steals the user's current selection.
-- `areas: any[]` tightened to `NavigationArea[]` in both components.
-
-No authorable area-level key is introduced — visibility stays derived, per
-the objectui#3311 ruling.
diff --git a/.changeset/area-visibility-derived-from-items.md b/.changeset/area-visibility-derived-from-items.md
deleted file mode 100644
index 6b8c75213c..0000000000
--- a/.changeset/area-visibility-derived-from-items.md
+++ /dev/null
@@ -1,41 +0,0 @@
----
-"@object-ui/layout": minor
----
-
-`AppSchemaRenderer` now derives area visibility from the items inside the
-area, closing the visible-but-empty regression the spec 17.0.0 area-key
-retirement left behind (objectui#3311, option C of the recorded ruling).
-
-Spec 17.0.0 retired the authorable area-level `visible` /
-`requiredPermissions` (`AREA_VISIBLE_RETIRED` /
-`AREA_REQUIRED_PERMISSIONS_RETIRED`) — an area is a layout grouping, not an
-access boundary — and objectui followed in #3315 by deleting the area
-switcher's filter. Correct on the contract, but it changed the navigation
-surface: an area whose items are **all** gated away used to disappear from
-the switcher and instead rendered as a selectable, empty area.
-
-## What changed
-
-- **Area visibility is now derived, not authored.** An area appears in the
-  switcher iff at least one of its navigation items survives the exact
-  item-level guards `NavigationRenderer` applies: the `visible` expression,
-  `requiredPermissions`, the `requiresObject` / `requiresService` runtime
-  capability gates, and — for `action` items — the presence of an `onAction`
-  dispatcher (framework#4509: without one they are not rendered, so they
-  cannot carry an area either). Separators never count; a `group` counts only
-  through its children.
-- **The active area is elected among visible areas only.** A fully gated
-  first area is no longer auto-activated, and when a gating change hides the
-  currently active area the shell re-elects the first visible one. A gating
-  change that merely *reveals* an area never yanks the user away from where
-  they are.
-- **An area with no items at all derives the same way**: no visible item →
-  hidden. (Boundary recorded in objectui#3311.)
-- New export `hasVisibleNavigationItems(items, options)` from
-  `@object-ui/layout` — the predicate behind the derivation, usable by other
-  shells that render their own area switchers.
-
-No authorable key is involved anywhere: the platform's `.strict()` area
-object still rejects the retired keys, and the derivation — computed from the
-same guards that decide what renders — cannot disagree with the rendered
-navigation, so there is nothing for a metadata author to get wrong.
diff --git a/.changeset/aria-required-five-more-sites.md b/.changeset/aria-required-five-more-sites.md
deleted file mode 100644
index b3a3f72be7..0000000000
--- a/.changeset/aria-required-five-more-sites.md
+++ /dev/null
@@ -1,15 +0,0 @@
----
-'@object-ui/components': patch
-'@object-ui/app-shell': patch
-'@object-ui/plugin-detail': patch
----
-
-Deliver the required state to the control in the five renderers outside the object form that still painted it as an asterisk only (objectui#3299 — the same defect #3290/#3298 fixed in `form.tsx`).
-
-Each site converges on the reference shape (`EmbeddableForm.tsx`): the control carries `aria-required={required || undefined}` and the asterisk is `aria-hidden="true"`, so assistive tech announces required once, as a state — instead of hearing a bare "asterisk" folded into the accessible name, or nothing at all.
-
-- `@object-ui/app-shell` — `ActionParamDialog` (both the boolean row and the default branch, delivered through the real field widgets' `toDomProps` whitelist) and `CreateViewDialog` (display label, machine name, and every type-specific required-field selector).
-- `@object-ui/components` — the custom `ActionParamDialog` (all five typed branches, including the Radix select trigger) and `FieldContainer`, whose existing Slot injection (`id` / `aria-describedby` / `aria-invalid`) now also injects `aria-required`, covering every consumer in one place.
-- `@object-ui/plugin-detail` — `InlineCreateRelated`'s create-tab inputs.
-
-Deliberately NOT the native `required` attribute (#3290 ruling): each of these hosts runs its own validation, and native `required` would arm the browser's constraint-validation bubble beside it. The SDUI controls that already use native `required` (`renderers/form/{input,textarea,select,checkbox}.tsx`, `basic/text-input.tsx`) are unchanged — they don't have a second validator, so their channel is already correct.
diff --git a/.changeset/aria-required-reaches-the-control.md b/.changeset/aria-required-reaches-the-control.md
deleted file mode 100644
index 40a226d10d..0000000000
--- a/.changeset/aria-required-reaches-the-control.md
+++ /dev/null
@@ -1,54 +0,0 @@
----
-"@object-ui/components": patch
----
-
-The required state now reaches the input control as `aria-required`, instead of
-existing only as part of the control's accessible name (objectui#3290).
-
-The form renderer has always computed a correct `required` — the static
-`required` flag merged with the `requiredWhen` CEL verdict — and then spent it
-on exactly one thing: the red asterisk in `<FormLabel>`. That asterisk carried
-`aria-label="required"`, so the only path from the computed state to assistive
-tech was `<label for>` folding it into the control's **accessible name**: the
-field was announced as "Title required".
-
-A state smuggled through a name is broken three ways:
-
-- it is read in name order rather than announced as a state, and "list the
-  required fields" style navigation cannot see it at all;
-- a field rendered without a `label` (compact layouts, inline grid editing)
-  draws no asterisk, so the signal disappears entirely;
-- `requiredWhen` makes required **dynamic**, and a state channel can express
-  the flip where a name cannot.
-
-## What changed
-
-- Every field control — built-in (`input` / `textarea` / `checkbox` / `switch` /
-  `select`) and registered widget alike — now receives `aria-required="true"`
-  when the field resolves required, and **no attribute at all** when it does
-  not. Absence rather than `aria-required="false"` is deliberate: it is what
-  the `requiredWhen`-turns-false case has to produce.
-- The red asterisk is now `aria-hidden="true"` and no longer carries
-  `aria-label="required"`. It renders exactly as before for sighted users; it
-  simply stops being announced, so the state is reported once (as a state) and
-  not twice.
-
-**No field widget needed a change.** `aria-required` is already declared and
-typed on the widget props contract (`FieldWidgetComponentProps &
-AriaAttributes`) and every widget forwards its leftover props to the control it
-renders, so all 48 widgets pick it up unmodified.
-
-Two non-changes, both deliberate:
-
-- **No native `required` attribute.** That would arm the browser's own
-  constraint-validation bubble alongside react-hook-form's `<FormMessage/>` —
-  two validators, two UIs, one field. `aria-required` reports the state without
-  triggering native validation.
-- **No `required` boolean in the widget props contract.** A boolean would give
-  the required marker a second author, and the next widget draws its own
-  asterisk next to the renderer's — the double-display failure objectui#3222
-  already declined for the validation message.
-
-If you select the asterisk in a test, it is now
-`span[data-required-marker]` — an explicit locator, rather than an
-accessibility attribute doubling as a test hook.
diff --git a/.changeset/builtin-select-empty-state-translated.md b/.changeset/builtin-select-empty-state-translated.md
deleted file mode 100644
index aeff8e5ab7..0000000000
--- a/.changeset/builtin-select-empty-state-translated.md
+++ /dev/null
@@ -1,39 +0,0 @@
----
-"@object-ui/components": patch
----
-
-The form renderer's built-in `select` branch stops saying "No options available"
-in English to non-English sessions (objectui#3263).
-
-FROM: the inline branch that renders a `type: 'select'` field — the one taken
-whenever the field is a `BUILTIN_FIELD_TYPES` member, i.e. before the `field:`
-registry is consulted — rendered `{emptyHint || 'No options available'}`. TO:
-`{emptyHint || t('fields.options.empty')}`, the same i18n key the registered
-option widgets fall back to (objectui#3231, all ten locale packs).
-
-This was the last hardcoded copy of that sentence in `form.tsx`, and the file was
-half-translated in a way a user could see inside one widget: the dependency-gate
-sentence next to it already went through `t()`
-(`fields.options.selectFirst`), so under a `zh` session a gated select read
-"请先选择Country" and the same select — one keystroke later, when the parent
-value matched no option — flipped to English.
-
-`fields.options.empty` is added to `useSafeFormTranslation`'s defaults map, the
-pattern `fields.options.selectFirst` already follows there, so a form rendered
-with no `I18nProvider` (standalone widget, test, embedded form) produces the
-byte-identical English string it produced before. Both halves are pinned by
-tests: the Chinese rendering in one file, the no-provider English fallback in
-another (mounting a provider installs it as react-i18next's global default,
-which would erase the state the second one observes).
-
-The box moved from an inline `<div>` into a small `BuiltinSelectEmptyState`
-component in the same file, because `renderFieldComponent` is a plain helper that
-early-returns on the registered-widget path — a hook called there would run
-conditionally. It forwards its rest props, since `<FormControl>` is a Radix
-`Slot` that supplies the control's `id` / `aria-describedby`; a test pins that
-the field's `<label for>` still resolves to this box.
-
-Deliberately NOT unified with `@object-ui/fields`' `OptionsEmptyState`: different
-package, different render path (inline branch vs. registry). What the two share
-is the i18n key, not a component — merging them would impose one path's markup
-and props on the other.
diff --git a/.changeset/combobox-trigger-never-submits-forms.md b/.changeset/combobox-trigger-never-submits-forms.md
deleted file mode 100644
index ec27174860..0000000000
--- a/.changeset/combobox-trigger-never-submits-forms.md
+++ /dev/null
@@ -1,12 +0,0 @@
----
-"@object-ui/components": patch
----
-
-The Combobox trigger now declares `type="button"` explicitly, so it can never
-submit an enclosing `<form>` (objectui#3344). The current Radix
-`PopoverTrigger` happens to supply `type="button"` through its Slot, but that
-form-safety guarantee was an upstream implementation detail — it is now a
-locally declared, regression-tested contract, matching the explicit style of
-LookupField / MultiSelectField / RatingField. The default sits before the
-trigger pass-through spread (objectui#3318), so a consumer who explicitly
-passes `type` (e.g. `type="submit"`) still wins.
diff --git a/.changeset/core-server-dispatcher-factory.md b/.changeset/core-server-dispatcher-factory.md
deleted file mode 100644
index 30187b34e3..0000000000
--- a/.changeset/core-server-dispatcher-factory.md
+++ /dev/null
@@ -1,39 +0,0 @@
----
-"@object-ui/core": minor
-"@object-ui/app-shell": patch
----
-
-`@object-ui/core` now ships the server-action dispatcher factory —
-`createServerActionHandler({ fetch, baseUrl, resolveObject, ... })` — so any
-consumer of the runner (standalone renderers, SDUI hosts, embedded usage) can
-run `action.body` script actions by registering the produced handler, instead
-of dead-ending on the built-in `executeScript`'s "must be executed server-side"
-error with no supported way to make it run (objectui#2904, the follow-up
-objectui#2896 deferred).
-
-The factory is deliberately opinion-free about the three things core has no
-business deciding — auth (`fetch` is an injected authenticated wrapper), origin
-(`baseUrl` string or thunk; no bundler env convention), and fallback object
-scope (`resolveObject`) — and owns everything protocol-shaped, once:
-
-- name-based action identity (ADR-0110 D1 — `target` is a binding expression,
-  never an identity);
-- the record-id resolution dance, also exported as
-  `resolveServerActionRecordId` (`_rowRecord`, `recordIdField`, toolbar
-  selection fallback with its single/zero-select guards, aggregate
-  `_selectedIds` bypass), replaceable wholesale via `resolveRecordId` for
-  hosts with their own policy (record pages);
-- a re-entrancy guard per action+record;
-- the `/actions` response-envelope rule: `interpretActionResponse`,
-  `readActionPayload` and `actionErrorDetail` moved from `@object-ui/app-shell`
-  internals into core and are now public exports.
-
-`@object-ui/app-shell`'s two hand-rolled copies of this POST —
-`useConsoleActionRuntime.serverActionHandler` and `RecordDetailView`'s — are
-collapsed into one console wrapper (`createConsoleServerActionHandler`) that
-layers the browser-only choreography (popup pre-open dance, zero-roundtrip
-`newTabUrl` fast path, `redirectUrl` convention) over the core factory. The
-copies had already drifted twice (objectstack#3913 — envelope; framework#3935 —
-identity, fixed in one copy only): RecordDetailView now also dispatches by
-declarative `name` instead of `target || name`, and no longer leaks the
-client-side `_rowRecord` stash to the server.
diff --git a/.changeset/detail-authored-type-narrow-only-editability.md b/.changeset/detail-authored-type-narrow-only-editability.md
deleted file mode 100644
index fd21ed48aa..0000000000
--- a/.changeset/detail-authored-type-narrow-only-editability.md
+++ /dev/null
@@ -1,17 +0,0 @@
----
-'@object-ui/plugin-detail': patch
----
-
-Behavior change — **an authored display `type` can NARROW inline editability, but never WIDEN it** (objectui#3355).
-
-Both detail-surface editability gates (`HeaderHighlight`, the `record:highlights` strip; `DetailSection`, the details body) used to resolve ONE effective type with display precedence — `viewFieldType || objectFieldType`. An authored non-computed `type` therefore ERASED the object's `formula` / `summary` / `rollup` / `auto_number` declaration from the gate's view, and a machine-owned column became inline-editable.
-
-The gate now reads the two types separately and takes their UNION: a field is non-editable if the authored entry type **or** the object field's type is computed. Renderer/editor selection keeps the old precedence, so nothing about the display changes — only who may write.
-
-What flips:
-
-- `{ name: 'supply_share', type: 'number' }` authored over an object field declared `rollup` (or `formula` / `summary` / `auto_number`) — a display override written to fix formatting — no longer offers a pencil / double-click editor. This is the shipped configuration behind objectstack-ai/objectstack#5077: a hook-maintained rollup was overwritten by hand from the header strip and stayed corrupted until an unrelated child-row touch re-fired it (downstream yinlianghui/hotcrm-heimao#61).
-- Narrowing is unchanged: an authored `type: 'formula'` still locks a plain object column.
-- Fields with no authored computed type over a plain object column stay editable, and the entry-level `readonly` declaration from objectui#3356 is still honored.
-
-The object schema is authoritative about what is machine-computed; a presentation override has no business granting write access. The rule now lives in ONE shared helper, `isComputedFieldType` in `fieldEnrichment.ts` — beside `enrichDetailField`, the module both hosts already share — with the computed-type set moved there too (still re-exported as `TEXTUAL_REF_FALLBACK_TYPES`), so the strip and the body cannot drift apart again.
diff --git a/.changeset/entitlement-error-context-reads-details.md b/.changeset/entitlement-error-context-reads-details.md
deleted file mode 100644
index 8b2205465e..0000000000
--- a/.changeset/entitlement-error-context-reads-details.md
+++ /dev/null
@@ -1,46 +0,0 @@
----
-"@object-ui/app-shell": minor
----
-
-The environment entitlement dialog now reads its context from
-`error.details.*` — the single declared location — and the flat dual-dialect
-tolerance is deleted (objectui#3329, the objectui half of cloud#1046).
-
-`entitlementDialogFromError()` maps a cloud env-create 403 into the friendly
-upgrade / limit dialog. It read `upgrade_url`, `contact_url`, `plan`, `current`
-and `limit` off the error object's **top level**, where the control plane used
-to put them as undeclared siblings of `code`. Those keys are conformant only by
-evaporating: `ApiErrorSchema` is a plain `z.object` that STRIPS unknown keys, so
-they survive to the Console purely because this path consumes the raw wire body
-before any parse. ADR-0112 (with framework#4224 and cloud#930's `AiErrorExtra`)
-declares `details` as the slot for structured error context, and cloud#1046
-moves the producer there.
-
-## What changed
-
-- All entitlement context is read from `error.details.<key>` and **nowhere
-  else**. `code` and `message` are declared `ApiErrorSchema` fields and stay on
-  `error` itself.
-- `entitlementErrorFields()` — the `body?.error ?? body` flat/nested tolerance —
-  is **removed**. A flat body (`error` as a string with `code` at the top level)
-  no longer produces a dialog; it takes the caller's ordinary error path.
-- No `??` chain between shapes was added in its place: exactly one shape is
-  accepted after this change, and tests pin both directions (details is read;
-  the retired locations are not).
-
-## Breaking note — read before tracking objectui `main` directly
-
-This is a wire-shape change with no consumer-side fallback, by decision on
-cloud#1046 (option A). It is safe for the **hosted** product because the cloud
-image pins objectui by `.objectui-sha`: cloud#1046's second half lands the
-producer change and the pin bump in one PR, so producer and consumer flip
-atomically and the hosted Console never runs one against the other.
-
-**Self-hosted deployments that track objectui `main` ahead of their control
-plane** will, until that control plane emits `error.details.*`, see the
-entitlement dialog lose its context: the upgrade CTA falls back to
-`/settings/billing`, `PRODUCTION_ENV_LIMIT` drops its "Contact sales" CTA,
-`DEV_ENV_PLAN_LOCKED` says "free plan" regardless of the real plan, and
-`DEV_ENV_LIMIT` drops the "using X of Y" counts. The dialog itself still opens
-and its titles/messages are unaffected — `code` did not move. Upgrade the
-control plane past cloud#1046 to restore the context.
diff --git a/.changeset/field-widget-dom-prop-whitelist.md b/.changeset/field-widget-dom-prop-whitelist.md
deleted file mode 100644
index 1fe444442d..0000000000
--- a/.changeset/field-widget-dom-prop-whitelist.md
+++ /dev/null
@@ -1,90 +0,0 @@
----
-"@object-ui/fields": minor
----
-
-Field widgets no longer spread renderer-only props — or arbitrary keys from a
-field config — onto the DOM element they render (objectui#3291).
-
-**Behaviour change:** an unknown key written on a field configuration (or on an
-SDUI `field:*` node) stops becoming an HTML attribute on the rendered control.
-Nothing reads those attributes, but they were serialized into the DOM, into
-snapshots, and into anything scraping rendered markup.
-
-## What was happening
-
-Widgets forwarded their leftover props with a bare spread, so whatever a host
-handed them became an attribute. Measured on a real form with a real widget:
-
-```
-<input placeholder="PH-f" zzcanary="CANARY-STR" zzcanaryobj="[object Object]"
-       zzcanarynum="42" id="…" type="text" value="" name="f">
-```
-
-`zzcanaryobj="[object Object]"` is an ordinary extra key on the field config
-being `String()`-ed onto an attribute. React 19 does not warn about any of it:
-an all-lowercase unknown attribute is passed through in complete silence, which
-is why this went unnoticed.
-
-Eleven widgets carried a line that looked like it prevented exactly this:
-
-```ts
-const { inputType, ...domProps } = props as any;   // "Filter out non-DOM props"
-```
-
-`inputType` is already stripped by the form renderer before a widget sees it,
-so that line filtered nothing — the comment actively misled. It is gone.
-
-## What changed
-
-- New `toDomProps(props)`, exported from `@object-ui/fields`. It keeps only
-  what may legitimately become a DOM attribute and drops the rest.
-- The 14 field widgets that spread onto a host element now go through it:
-  `text`, `textarea`, `number`, `boolean`, `date`, `datetime`, `time`, `email`,
-  `phone`, `url`, `password`, `currency`, `percent`, and `select`.
-
-**It is a whitelist, not a list of keys to drop.** The largest leak source is
-not any named renderer prop — it is the open tail of author-supplied keys. The
-form renderer destructures a fixed set of known keys and forwards the rest
-verbatim, and `SchemaRenderer` is wider still: it spreads the whole authored
-node as props with no strip layer at all, so on that path a widget's own spread
-is the only line of defence. A blacklist of today's renderer-only props would
-pass every canary above and would not stop the next authored key either.
-
-The forwarded set is the one `FieldWidgetComponentProps` already **declares**:
-`id`, `name`, `autoFocus`, `tabIndex`, `onBlur`, `onFocus`, `onClick`,
-`className`, `disabled`, plus `aria-*` and the `data-*` family. Until now that
-was a type-level claim a widget could violate at runtime just by spreading;
-`toDomProps` is its executable form.
-
-Two compile-time assertions tie the helper to the declaration, and it is worth
-being exact about which drift each one prevents:
-
-- the contract's DOM pass-through block is now a named type
-  (`FieldWidgetDomProps`), and **both directions are compiler-bound**:
-  forwarding a key the contract does not declare fails to compile, and
-  declaring a DOM key the helper does not forward fails to compile too. The
-  second direction guards *declared but not delivered* — a key that
-  type-checks, reads as supported, and silently never reaches the element. The
-  leak test structurally cannot see that class of bug: it looks for attributes
-  that arrive, not for ones that go missing.
-- `className` and `disabled` are bound in the **forward direction only**. They
-  are DOM-legal and are forwarded, but they live in the controlled-input block
-  because widgets also interpret them, so they are deliberately outside
-  `FieldWidgetDomProps`.
-
-An HTML global attribute the contract does not declare (`role`, say) is no
-longer forwarded. It only ever arrived through the open spread. If a field node
-should be able to author one, declare it on `FieldWidgetComponentProps` and add
-it to the whitelist — the fix belongs at the contract, not in a wider spread.
-
-## Regression gate
-
-A new contract test renders **every** registered field widget through **both**
-hosts — the real form renderer and `SchemaRenderer` — and fails on any
-attribute HTML does not define for that element. It walks real DOM attributes
-rather than listening for React warnings (React 19 is silent for the exact case
-that leaked), asserts a validation error genuinely rendered before scanning the
-error variant, and calibrates its own judge against two fixtures: standard
-markup that must produce zero findings, and planted fake attributes that must
-all be found. A new widget type is covered automatically — the sweep is derived
-from the widget registry, so adding one without covering it fails the test.
diff --git a/.changeset/field-widget-error-slot-follows-spec.md b/.changeset/field-widget-error-slot-follows-spec.md
deleted file mode 100644
index 0dc5c00553..0000000000
--- a/.changeset/field-widget-error-slot-follows-spec.md
+++ /dev/null
@@ -1,86 +0,0 @@
----
-"@object-ui/fields": minor
-"@object-ui/components": minor
----
-
-Field widgets are finally told when their field fails validation, and the props
-slot that carries it takes the name the published contract gives it
-(objectui#3222).
-
-**Breaking** for anyone implementing a field widget (see migration below). The
-repo version policy keeps this a `minor` — objectui's major tracks
-`@objectstack`'s — so read the bump as "breaking within objectui".
-
-## The a11y defect this fixes
-
-`@objectstack/spec/ui`'s `FieldWidgetPropsSchema` — the published contract that
-third-party and AI-authored field widgets are written against — has always
-declared `error?: string`. `@object-ui/fields` declared its own slot as
-`errorMessage`. That looked like a naming split; it was worse:
-
-```
-producers of `errorMessage` anywhere in packages/ + apps/ :  0
-reads of `errorMessage` in packages/fields/src            : 15  (7 widgets)
-reads of `props.error`                                    :  0
-```
-
-The slot was dead under BOTH spellings. No host ever passed it: the form
-renderer showed validation text through its own `<FormMessage/>` and never
-forwarded the prop. So `EmailField`, `CurrencyField`, `UrlField`,
-`RichTextField`, `PercentField`, `TextAreaField` and `PhoneField` each computed
-`aria-invalid={!!errorMessage}` from a value that was `undefined` forever —
-**`aria-invalid` had never once been set, and a screen reader was never told
-the field had failed validation.**
-
-Worse than "never set": `<FormControl>` is a Radix `Slot` that hands its child a
-CORRECT `aria-invalid`, but a widget's own attribute is written after the props
-spread, so it wins. Those seven widgets were actively overwriting the right
-answer with `false`.
-
-FROM: `renderFieldComponent` received no validation state, and the widget props
-type declared `errorMessage?: string`, which nothing produced.
-TO: the form renderer passes react-hook-form's `fieldState.error?.message` down
-as `error` when it renders a registered widget, and the props type declares
-`error?: string`. Both ends of the contract are live for the first time; a
-rename alone would only have swapped one dead key for another.
-
-## Migration for widget authors
-
-```diff
--export function MyField({ value, onChange, field, readonly, errorMessage }: FieldWidgetComponentProps< string >) {
--  return <Input value={value} aria-invalid={!!errorMessage} />;
-+export function MyField({ value, onChange, field, readonly, error }: FieldWidgetComponentProps< string >) {
-+  return <Input value={value} aria-invalid={!!error} />;
-```
-
-No alias is kept. `errorMessage` was retained nowhere on purpose — a tolerant
-second spelling is exactly the de-facto second contract AGENTS.md #0.1 forbids,
-and it is what would let a missed call site go quiet again. Because
-objectui#3221 had already removed the type's `[key: string]: any`, every missed
-site is a compile error rather than a silent `any`, so the compiler — not grep
-— validated this rename.
-
-## Responsibilities are split, not duplicated
-
-The widget consumes `error` **only** to drive `aria-invalid` on the control it
-renders (which only it can do — `aria-invalid` has to sit on the input element).
-The message TEXT stays with `<FormMessage/>` in the form renderer. A widget that
-also renders the text double-displays it, and the docs, the agent prompt and the
-tests all now say so.
-
-For the same reason `required` — also declared by the spec, also never delivered
-— is deliberately NOT lowered into widget props: the required marker has exactly
-one author, the renderer's `<FormLabel>`, and giving widgets the flag invites a
-second asterisk. The a11y state a widget could legitimately carry is
-`aria-required`, which needs no contract change at all (`AriaAttributes` is
-already part of the type and widgets already forward it).
-
-Builtin field types are unaffected: they render inside `<FormControl>`, whose
-Slot already supplies `aria-invalid`, so `error` is stripped there rather than
-leaking into the DOM as a stray attribute.
-
-Docs updated to match: `content/docs/guide/plugin-development.md`,
-`skills/objectui/guides/plugin-development.md` and
-`.github/prompts/component.prompt.md` — the last of which additionally used the
-spec's non-generic type alias as a generic (`FieldWidgetProps< number >`) and
-destructured a `mode` prop that exists on neither type.
diff --git a/.changeset/field-widget-single-metadata-carrier.md b/.changeset/field-widget-single-metadata-carrier.md
deleted file mode 100644
index 6bb7cebefd..0000000000
--- a/.changeset/field-widget-single-metadata-carrier.md
+++ /dev/null
@@ -1,74 +0,0 @@
----
-"@object-ui/fields": minor
-"@object-ui/components": minor
----
-
-**BREAKING (v17)** — field widgets receive their metadata on ONE key, `field`.
-`schema` is removed from the widget contract (objectui#3233).
-
-## What changed
-
-`schema` was a second carrier for what `field` already means. Two producers fed
-it: `SchemaRenderer` passed the authored node as `schema`, and the form
-renderer's `renderFieldComponent` passed `schema={props.field || props.schema ||
-props}` *alongside* `field`. The predictable result was ~30 widgets resolving
-their config as `field || schema` — one concept, two spellings, a de-facto
-second contract (AGENTS.md #0.1).
-
-- `FieldWidgetComponentProps` no longer declares `schema`. Reading
-  `props.schema` is now a compile error, not a silent `any`.
-- Both producers converged. The form renderer passes `field` only. The SDUI node
-  → `field` translation happens exactly once, in a new registration adapter
-  (`withFieldCarrier`), which every built-in field widget is registered through.
-- All `field || schema` reads in `@object-ui/fields` are now plain `field` reads.
-
-## Migrating a widget you wrote
-
-**Reading the metadata** — replace the fallback with the single key:
-
-```diff
--const config = field || (props as any).schema;
-+const config = field;
-```
-
-**Registering a widget** — if your widget can be rendered from a schema node
-(anything `SchemaRenderer` dispatches, not just forms), wrap it once so it still
-gets `field`:
-
-```diff
-+import { withFieldCarrier } from '@object-ui/fields';
-+
--ComponentRegistry.register('color', ColorField, { namespace: 'field' });
-+ComponentRegistry.register('color', withFieldCarrier(ColorField), { namespace: 'field' });
-```
-
-`withFieldCarrier` forwards the node **by reference** — nothing is copied,
-narrowed or renamed — and consumes `schema` so it cannot reach the DOM through a
-widget's `...props` spread.
-
-A third-party widget that still reads `props.schema` and is **not** re-registered
-through the adapter will read `undefined` in v17 and silently render an empty /
-default state. That is the deliberate cost of a major boundary: one contract
-beats N dialects, and a widget that picks the wrong spelling should fail at
-compile time rather than work under one host and not another.
-
-## What did NOT change
-
-- **Host metadata (SDUI JSON) is untouched.** No authored schema changes; this is
-  a change to how widgets are *written*, not to what apps declare.
-- **`schema` is still the universal SDUI prop** every registered component
-  receives from `SchemaRenderer` (`element:*`, `page:*`, grids, reports). Only
-  the *field-widget* contract retired it. In particular `renderFieldComponent`
-  still passes `schema` when a form field type resolves to a plain component
-  through the bare-name fallback (e.g. `type: 'text'` reaching the display text
-  widget) — that component's contract is the node, and dropping it there would
-  render `undefined.className`.
-
-## Payload equivalence
-
-Every path that used to deliver a payload through `schema` now delivers the
-identical object through `field`, and both halves are pinned by tests asserting
-**object identity**, not shape:
-
-- form path — `packages/components/src/renderers/form/__tests__/form-field-carrier.test.tsx`
-- SDUI path — `packages/fields/src/__tests__/field-carrier-sdui.test.tsx`
diff --git a/.changeset/flow-node-geometry-is-spec-position.md b/.changeset/flow-node-geometry-is-spec-position.md
deleted file mode 100644
index b61ea0f19b..0000000000
--- a/.changeset/flow-node-geometry-is-spec-position.md
+++ /dev/null
@@ -1,38 +0,0 @@
----
-"@object-ui/app-shell": minor
----
-
-The flow designer writes node geometry as the spec's `FlowNode.position`, not its
-own `ui: { x, y }` (objectui#3172).
-
-FROM: dragging, adding-at-a-point and insert-on-edge each wrote `node.ui = {x, y}`
-— a fourth-generation local spelling of a concept `@objectstack/spec` has modelled
-as `FlowNode.position` all along. TO: all three write `position: { x, y }`, and the
-canvas migrates on write: a stored flow's legacy `ui` is lifted onto `position` and
-the key removed in the first patch the canvas emits, geometry-related or not.
-
-**This is a behaviour fix, not a rename.** `FlowNodeSchema` has been `.strict()`
-since objectstack#4001, so `ui` is an `unrecognized_keys` error: the live client
-validation flagged the draft on every keystroke and the server rejected the save
-with a 422. In other words, dragging a node made the flow unsavable — the
-convergence is what makes the designer's most basic gesture round-trip again. A
-test now parses `{ …node, ui: {x, y} }` through the spec's own schema and asserts
-the rejection, so the claim is executed rather than argued.
-
-Reading is backwards-compatible: `manualPosition()` prefers `position` and falls
-back to a legacy `ui`, so a flow stored before this change still opens with its
-nodes exactly where the author left them (pinned by a test that lays out both
-spellings and compares the maps). The fallback is a migration path, not a second
-contract — nothing writes `ui`, and the canvas strips it at its input boundary, so
-no patch can re-emit it.
-
-The geometry type is now derived from the spec by reference
-(`FlowNodePosition = NonNullable< SpecFlowNode['position'] >`), and
-`spec-symbol-parity.test.ts` pins the equality in both directions — including that
-both coordinates are required, so a half-position stays unrepresentable. The
-shape-copy in `FlowPreview.tsx` is gone; it reads the canvas's own node type, the
-way it already read the canvas's edge type.
-
-Breaking for anyone reading `node.ui` off a flow draft: after the author's first
-edit the key is gone and the coordinates live under `node.position`. Nothing in
-this repo or the engine read it — it was a designer-local key the schema rejected.
diff --git a/.changeset/highlights-entry-readonly.md b/.changeset/highlights-entry-readonly.md
deleted file mode 100644
index 987ae0ad28..0000000000
--- a/.changeset/highlights-entry-readonly.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-'@object-ui/plugin-detail': patch
-'@object-ui/types': patch
----
-
-`record:highlights` now honours a `readonly: true` on an authored field entry, so a header chip for a platform-owned column no longer offers inline edit. `HeaderHighlight`'s editability gate already consulted `field.readonly`, but the renderer rebuilt each entry from a fixed `{name,label,icon,type}` list and dropped `readonly` one layer before that check, so the gate could never fire from authored metadata — a hook-maintained rollup or approval-written grade could be overwritten by hand from the detail-page header strip and stayed wrong until an unrelated write re-fired the computation. `readonly` is now a declared key on `HighlightField` and on the `RecordHighlightsComponentProps.fields[]` entry union, mirroring `DetailViewField.readonly` (objectstack#5077).
diff --git a/.changeset/list-toolbar-filter-fold-to-spec-rules.md b/.changeset/list-toolbar-filter-fold-to-spec-rules.md
deleted file mode 100644
index ec5eba06c0..0000000000
--- a/.changeset/list-toolbar-filter-fold-to-spec-rules.md
+++ /dev/null
@@ -1,10 +0,0 @@
----
-'@object-ui/app-shell': patch
-'@object-ui/i18n': patch
----
-
-The list toolbar's "Filter" now saves. Saving a filter from the runtime toolbar PUT the FilterBuilder's whole group object (`{ id, logic, conditions }`) into the view's `filter`, where `@objectstack/spec`'s `ListViewSchema.filter` declares `ViewFilterRule[]` — so every save came back `422 invalid_metadata` and the filter was silently never persisted (objectstack#5159).
-
-The producer now folds the builder's group to the spec's flat `{ field, operator, value }` rule list before persisting, sharing one transform with the Studio view inspector (which had the only copy). Operators normalize through the spec's own `normalizeFilterOperator`, so the four builder operators the Studio's local table had drifted behind — `startsWith`, `endsWith`, `isNull`, `isNotNull` — now persist correctly too. The builder's per-row `id` is no longer written: it is a React list key that the read path regenerates, so stored view bodies keep the declared vocabulary only.
-
-A filter whose shape cannot be represented losslessly as a flat rule list — `OR` across several conditions, or nested condition groups — is now refused with a translated message instead of being quietly saved as `AND`, which would have returned a different set of records than the one on screen. Such a filter still applies to the current list; it just does not become part of the saved view.
diff --git a/.changeset/live-e2e-lane.md b/.changeset/live-e2e-lane.md
deleted file mode 100644
index 8d11dbadff..0000000000
--- a/.changeset/live-e2e-lane.md
+++ /dev/null
@@ -1,39 +0,0 @@
----
----
-
-ci: the live e2e suite finally runs in CI — against a real, published backend
-
-Release-nothing: adds `.github/workflows/live-e2e.yml`, `e2e/live/ci/*`, one
-root script, and no package code.
-
-`e2e/live/**` holds 20+ Playwright specs covering the interaction-critical
-paths, and none of them ran in CI — they need a real ObjectStack backend and no
-job provided one. That is how framework#3528 shipped: a lazily-loaded widget's
-suspension tore down its own flow dialog, a failure only a real browser against
-a real backend can see. The specs existed, passed when a human remembered to
-run them, and guarded nothing.
-
-The new lane boots `objectstack dev` from PUBLISHED `@objectstack/*` packages
-(pinned in `e2e/live/ci/backend.env`, matched to the `@objectstack/spec`
-version in `pnpm-lock.yaml`) serving the showcase app checked out at the
-commit its release tag points to — so every PR smoke-tests "this console x the
-released backend" as a matched pair, with nothing built from framework source.
-The showcase metadata pin mirrors the framework repo's `.objectui-sha` console
-pin, in the opposite direction.
-
-Two deliberate limits, per the maintainer's ruling on #2835:
-
-- **Informational, non-required**: `continue-on-error: true` keeps the lane
-  out of the merge gate until it has proven stable (objectstack#4850 is the
-  prior art for a new lane's flake ejecting unrelated PRs from the queue).
-- **Allowlist start**: only `screen-flow`, `action-modal` and `master-detail`
-  run (`pnpm test:e2e:live:ci`) — grow the list a few proven specs at a time
-  instead of switching all 20+ on and inheriting whatever flake exists.
-
-Also removes ci.yml's stale `dev-server` job — `apps/dev-server` left the tree
-long ago, `pnpm --filter @object-ui/dev-server build` matches nothing, and the
-job has been green by vacuity ever since. And re-enables
-`DashboardRenderer.designMode` (skipped since 2026-05-01 as `TODO(#ci-hang)`):
-on today's dependency tree the suite passes standalone (24/24), and the
-re-enabling PR's own sharded Test jobs gate the full-suite behaviour, so the
-skip was outliving whatever transitive dependency caused the hang.
diff --git a/.changeset/mobile-fullscreen-rides-the-field-metadata.md b/.changeset/mobile-fullscreen-rides-the-field-metadata.md
deleted file mode 100644
index 2c6ec25ce0..0000000000
--- a/.changeset/mobile-fullscreen-rides-the-field-metadata.md
+++ /dev/null
@@ -1,46 +0,0 @@
----
-"@object-ui/plugin-form": minor
-"@object-ui/types": minor
----
-
-`mobile.fullscreenLongText` finally reaches auto-generated long-text fields, and
-`mobile_fullscreen` gets one declared carrier (objectui#3245).
-
-FROM: `ObjectForm` stamped the flag onto the FormField itself
-(`{ ...f, mobile_fullscreen: true }`). TO: it stamps the flag onto the object the
-form renderer will actually forward to the widget as `field` — `f.field || f`,
-resolved exactly the way `renderFieldComponent` resolves it.
-
-**The flag's only legal carrier is the field metadata, and its only producer is
-`ObjectForm`.** That convention was already what the widget side assumed after
-objectui#3232/#3233 (`TextAreaField` reads `field.mobile_fullscreen` and nothing
-else, and `field` is the single metadata carrier); the producer was writing to a
-different object, so for auto-generated fields the two never met.
-
-What was broken, end to end: `ObjectForm` builds an auto-generated field as
-`type: 'field:textarea'` **and** stashes the object-field metadata on `.field`.
-The renderer forwards `field: field.field || field`, so the widget received the
-raw metadata — which never carried the flag — while the FormField-level copy was
-dropped by `stripRegisteredFieldProps`. Every entry point into `TextAreaField`
-therefore read `undefined` and the expand affordance never rendered. Only the
-hand-authored `customFields` path (no `.field` to shadow the FormField) ever
-worked, i.e. the feature was dead on the path virtually every form takes. Unit
-tests on both ends passed the whole time, because the break lived in the seam
-between them; this release adds the feature's first integration coverage — real
-`ObjectForm` → real form renderer → real `TextAreaField`, no mocks — which fails
-against the old producer and passes against the new one.
-
-`mobile_fullscreen` is now declared on `@object-ui/types`' `BaseFieldMetadata`,
-hence on every member of the `FieldMetadata` union that
-`FieldWidgetComponentProps.field` resolves to. It is deliberately **not** an
-`@objectstack/spec` property: nobody authors it on a field definition, it is a
-projection of the form-level `ObjectFormSchema.mobile.fullscreenLongText` setting
-onto the field metadata at render time. Declaring it removes the last untyped
-end of the chain — the producer's `as FormField` cast is gone — so the two sides
-can now disagree out loud instead of silently.
-
-The hand-authored `customFields` path keeps working unchanged, and keeps its own
-metadata: the flag is stamped on the FormField only when there is no `.field` to
-carry it. Synthesizing a `field` object in that case would light the affordance
-up while quietly replacing the field's `rows` / `placeholder` with defaults — the
-regression test pins that too.
diff --git a/.changeset/modal-dead-fallthrough-record-page.md b/.changeset/modal-dead-fallthrough-record-page.md
deleted file mode 100644
index 5f28c89e0d..0000000000
--- a/.changeset/modal-dead-fallthrough-record-page.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"@object-ui/app-shell": patch
----
-
-RecordDetailView's `type:'modal'` dispatch no longer falls back to the server-side action handler when the target resolves to neither a page nor an object. That fallthrough could never succeed — the framework rejects `type:'modal'` over REST with a 400 (`headlessActionTypeError`) — so it only converted an authoring mistake into a confusing round-trip. The record page now reports the same descriptive authoring error as the shared console runtime (objectstack#3959), naming the action, the dud target, and the way out (`type:'script'` with `params`).
diff --git a/.changeset/object-chart-drilldown-declared-input.md b/.changeset/object-chart-drilldown-declared-input.md
deleted file mode 100644
index 19b132420e..0000000000
--- a/.changeset/object-chart-drilldown-declared-input.md
+++ /dev/null
@@ -1,11 +0,0 @@
----
-'@object-ui/plugin-charts': minor
----
-
-`<ObjectChart>` declares `drillDown` as a registry input, so the SDUI save gate treats the segment drill as a contract prop instead of an unknown one (framework#5022).
-
-The component has read `schema.drillDown` all along — it is what opens the drawer of underlying records when you click a bar or a slice — but the prop was declared in neither the protocol nor this registry entry. The manifest the save gate validates page JSX against is built verbatim from these `inputs`, so an author who wrote the drill got an `unknown-prop` diagnostic for a prop that works. `@objectstack/spec` now declares the shape (`ChartDrillDownSchema`, published on the react-tier `<ObjectChart>` contract); this is the renderer half.
-
-The published input describes the six keys the spec declares — `enabled`, `filter`, `title`, `target` (`'drawer' | 'dialog'`), `columns`, `maxRows` — and deliberately not the wider `DrillDownConfig` this repo shares with the table / pivot / metric widgets: `ObjectChart` reads none of `mode` / `report` / `view` / `sort`, and does not implement `target: 'navigate'` (it renders the drawer instead — objectui#3354).
-
-The untyped `(schema as any).drillDown` read is now typed as `DrillDownConfig`. Narrowing it to the spec's `ChartDrillDown` is left as a TODO on the version pin: `@objectstack/spec` is pinned at `^17.0.0-rc.2` here and the declaration lands in the next rc, and re-declaring the shape locally would be the fork that lets the two drift.
diff --git a/.changeset/option-widgets-empty-hint-single-source.md b/.changeset/option-widgets-empty-hint-single-source.md
deleted file mode 100644
index 52e98ffcee..0000000000
--- a/.changeset/option-widgets-empty-hint-single-source.md
+++ /dev/null
@@ -1,45 +0,0 @@
----
-"@object-ui/components": patch
-"@object-ui/fields": patch
-"@object-ui/i18n": patch
----
-
-The option widgets' "this list cannot be filled" message now has one source, and
-it is translated (objectui#3231).
-
-FROM: `SelectField`, `MultiSelectField`, `RadioField` and `CheckboxesField` each
-carried their own copy of the empty/gated state, each destructured the declared
-`emptyHint` prop into `_emptyHint` and dropped it, and each rendered a hardcoded
-English literal (`'No options available'`, `` `Select ${…} first` ``) even in a
-Chinese or Japanese session. TO: one shared `OptionsEmptyState` — the host's
-`emptyHint` when it supplied one, otherwise a translated fallback
-(`fields.options.empty` / `fields.options.selectFirst`, added to all ten locale
-packs).
-
-`emptyHint` was declared, produced by the form renderer and transported, then
-lost three times over — so no registered widget could ever render it. All three
-breaks are fixed, because closing only the last one delivers nothing:
-
-- `isOptionField` compared the raw resolved type against `'select'` /`'radio'` /
-  `'multiselect'` / `'checkboxes'`. Object-derived forms emit
-  `mapFieldTypeToFormType`'s prefixed ids (`field:select`), which matched none of
-  them, so for every option field coming from an object schema — the normal case
-  in the console — the whole cascade block was skipped and no hint was computed
-  at all. It now normalizes the `field:` prefix, the same normalization
-  `stripRegisteredFieldProps` already applied a few lines below.
-- `stripRegisteredFieldProps` then removed the `emptyHint` key from what was
-  left. It is now forwarded to the four cascade option types, alongside
-  `dependentValues`. This stays an allow-list rather than a blanket
-  pass-through: every other registered widget spreads its leftover props onto a
-  DOM node, where an unknown `emptyHint` attribute is a React warning.
-- the widgets themselves discarded it. Keeping it out of the `...props` spread
-  was correct; not using it afterwards was not.
-
-User-visible effect: a dependency-gated option list now prompts with the
-controlling field's **label** ("Select Country first") instead of its raw
-metadata name, in the session's language; an unconfigured list says so in the
-session's language too. The gate sentence is one i18n key shared by the renderer
-and the widget fallback, so the two sides cannot word it differently.
-
-Untouched: the built-in (unregistered) `select` branch of the form renderer,
-which already consumed `emptyHint`. That is a separate live path.
diff --git a/.changeset/page-block-inspector-visible-when.md b/.changeset/page-block-inspector-visible-when.md
deleted file mode 100644
index d6c1a1697c..0000000000
--- a/.changeset/page-block-inspector-visible-when.md
+++ /dev/null
@@ -1,56 +0,0 @@
----
-"@object-ui/app-shell": patch
----
-
-The Page block inspector's conditional-visibility control now authors
-`visibleWhen`, and says "Visible when" while doing it (objectui#3229).
-
-FROM: the `ConditionBuilder` rendered for the selected page block read and wrote
-`block.hidden`. TO: it reads and writes `block.visibleWhen`, the canonical
-conditional-visibility key (ADR-0089), through the same envelope read/write pair
-the hook and action guards use (objectui#3218).
-
-`PageComponentSchema` (`ui/page.zod.ts`) is `.strict()` and has no `hidden` key
-at all. So this was not a tolerant consumer accepting something sloppy — it was
-the **producer emitting a key the contract rejects**: every author who filled
-that box got a save-time parse failure naming a key they never typed, because the
-inspector typed it for them. The spec's own error message already names the fix
-(`` the canonical key is `visibleWhen` ``). A designer that mass-produces drafts
-guaranteed to be rejected is a worse failure than a lenient reader — a lenient
-reader lets wrong metadata run, this made the *correct tool* emit the wrong thing.
-
-The fix also closes the gap in the other direction: a **valid** block carrying
-`visibleWhen` previously had no control in the inspector that could edit its
-visibility, because the only visibility control on screen wrote a different key.
-Removing the control instead would have stopped teaching the wrong key but left
-that gap open, which is a capability regression.
-
-**The semantic flip lands in the UI copy, not just the key.** `hidden` and
-`visibleWhen` are inverses (`hidden` true ⇒ gone; `visibleWhen` true ⇒ shown), so
-the label, the i18n key (`engine.inspector.pageBlock.hidden` →
-`engine.inspector.pageBlock.visibleWhen`) and both language packs move together:
-"Hidden (CEL)" → "Visible when (CEL)", 「隐藏条件（CEL）」→「显示条件（CEL）」.
-Renaming the key while leaving hide-flavoured copy would have been worse than
-leaving the bug: authors would write the predicate backwards, producing metadata
-that PARSES and means the opposite — the objectui#3276 class, which objectui#3257's
-guard is structurally blind to because it only asks whether a draft parses.
-
-**No value is migrated.** An existing `hidden` expression is NOT negated into
-`visibleWhen`: textually negating an arbitrary CEL predicate is unsound
-(`!(a && b)` is not `!a && !b`), and there is no stored valid draft to migrate
-anyway — since ADR-0089 D3a `hidden` is a loud parse failure on save, and before
-D3a the key was silently dropped, so it never reached published metadata either.
-A loud error on a rare stale draft, with the spec's message pointing at
-`visibleWhen`, beats silently rewriting an author's predicate.
-
-Because `visibleWhen` is `ExpressionInputSchema`, a persisted block carries the
-`{ dialect, source }` envelope rather than the authored string, so the control
-goes through `expressionSource` / `writeExpressionSource` — an edit preserves
-`dialect` and `meta` and drops the stale `ast`, instead of flattening the
-envelope to a bare string and silently swapping the evaluation engine.
-
-Tests pin DIRECTION, not just the key name (the objectui#3276 precedent makes
-that a hard requirement): the block the inspector actually commits is rendered
-through `SchemaRenderer` and must appear when its predicate is true and be absent
-when it is false, alongside assertions that the committed key is `visibleWhen`,
-never `hidden`, and that the resulting draft parses.
diff --git a/.changeset/page-header-inputs-declare-subtitle.md b/.changeset/page-header-inputs-declare-subtitle.md
deleted file mode 100644
index 82c5321d13..0000000000
--- a/.changeset/page-header-inputs-declare-subtitle.md
+++ /dev/null
@@ -1,39 +0,0 @@
----
-"@object-ui/layout": patch
----
-
-The legacy `page-header` alias stops advertising `description` as an authorable
-key (objectui#3226).
-
-FROM: `registerLayout()` declared `inputs: [title, description]`. TO:
-`inputs: [title, subtitle]` — the key `@objectstack/spec/ui`'s `PageHeaderProps`
-declares, and the one the canonical `page:header` renderer in
-`@object-ui/components` already declares.
-
-`inputs` is a DECLARATION surface, not documentation: the designer builds its
-property palette from it, and the framework's `check:react-declaration-parity`
-diffs it against the spec schemas. Declaring `description` therefore did not
-merely tolerate a legacy spelling — it published a second dialect for the one
-concept the protocol calls `subtitle`, and told authors (an AI author most
-readily, since the registry is what it reads to learn the shape) that the
-non-spec key was legal. Metadata that took the offer renders a subtitle under
-`page-header` and silently loses it under `page:header`: same JSON, two results,
-which is the outcome a single contract exists to prevent.
-
-No runtime behaviour changes. `PageHeader` still reads `subtitle ?? description`,
-deliberately: this alias exists for out-of-repo consumer schemas, so "no in-repo
-author writes `description`" (verified — zero hits) is not evidence that nobody
-does, and dropping the read today would delete an external page's second line
-while its title kept rendering, the least reportable failure mode there is. That
-read is retired together with an ADR-0087 D2 conversion entry
-(`page-header-subtitle-alias`, `description` → `subtitle` rewritten at load
-time), which lives in the framework repo and is tracked separately. Narrowing the
-declaration did not need to wait on it and breaks no consumer; leaving the
-declaration wrong in the meantime keeps minting the metadata the conversion would
-then have to absorb.
-
-New tests pin both halves so neither can drift back: the registration may not
-declare `description`, must declare `subtitle`, and — checked against the spec's
-own shape rather than a hand-written allowlist — may declare nothing
-`@objectstack/spec` does not; while the runtime fallback is pinned as a sequencing
-guard, to be deleted in the same change that lands the conversion entry.
diff --git a/.changeset/permission-facet-link-field-carrier.md b/.changeset/permission-facet-link-field-carrier.md
deleted file mode 100644
index 7190968ff7..0000000000
--- a/.changeset/permission-facet-link-field-carrier.md
+++ /dev/null
@@ -1,11 +0,0 @@
----
-"@object-ui/plugin-detail": patch
----
-
-`field:permission-facet-link` now registers through `withFieldCarrier` — the
-repo's only raw `field:` registration bypassed the single-metadata-carrier seam
-(objectui#3233), so under the SDUI path (`SchemaRenderer` passes `schema`,
-never `field`) the widget read `field === undefined` and silently rendered an
-anonymous facet summary (`field?.name` empty, no facet branch selected). The
-form and inline-edit hosts were unaffected — they pass `field` directly, which
-the carrier forwards unchanged. Fixes objectui#3307.
diff --git a/.changeset/popup-copy-english-i18n.md b/.changeset/popup-copy-english-i18n.md
deleted file mode 100644
index 3f98bf4eb0..0000000000
--- a/.changeset/popup-copy-english-i18n.md
+++ /dev/null
@@ -1,19 +0,0 @@
----
-"@object-ui/app-shell": patch
-"@object-ui/i18n": patch
----
-
-The console server-action wrapper's `opensInNewTab` choreography no longer
-ships hard-coded bilingual Chinese/English copy (objectui#3321, AGENTS.md
-Commandment #-1): the pre-opened SSO spinner tab (title + body) and the
-popup-blocked toast (title, description, action label) are now localized
-through new `console.serverAction.*` keys in `@object-ui/i18n`, added at full
-parity across all eleven locale packs.
-
-`createConsoleServerActionHandler` gains an optional i18next-style `t` option
-(`t(key, englishDefault)`) — the wrapper is a plain function, so the translate
-function is injected from the two hook-context call sites
-(`useConsoleActionRuntime`, `RecordDetailView`) via `useObjectTranslation`.
-When omitted (tests / standalone), every string falls back to its English
-default; no non-English copy remains in code. Locale strings are HTML-escaped
-before being written into the spinner document.
diff --git a/.changeset/previews-read-only-spec-declared-keys.md b/.changeset/previews-read-only-spec-declared-keys.md
deleted file mode 100644
index b55c035cf5..0000000000
--- a/.changeset/previews-read-only-spec-declared-keys.md
+++ /dev/null
@@ -1,77 +0,0 @@
----
-"@object-ui/app-shell": patch
----
-
-Five metadata designers stop rendering keys `@objectstack/spec` rejects, and start
-rendering the keys it declares (objectui#3275, objectui#3281).
-
-The previews and the console's sample drafts had been wrong TOGETHER, which is
-why the gallery looked healthy. objectui#3266 corrected the samples and the
-gallery immediately rendered LESS — agent's TOOLS and KNOWLEDGE blocks, skill's
-TRIGGER PHRASES, app's per-item row and `Dashboard` badge, and datasource's
-CAPABILITIES all vanished or degraded. Nothing had broken: those blocks were only
-ever lit up by metadata that cannot be saved. This is the renderer half of that
-finding, and the same fix objectui#3236 / PR #3258 made to `ToolPreview`.
-
-A preview that renders a rejected key does not just show something useless — it
-tells the author "this is correct" until publish refuses it. For AI-generated
-metadata that is where a stale key hides and multiplies, so every read below was
-deleted rather than kept behind a fallback (AGENTS.md #0.1).
-
-**Retired keys, deleted** — each is a `retiredKey()` tombstone rejected by name:
-`agent.tools` (objectstack#3894 — an agent reaches exactly the tools its skills
-declare, ADR-0064), `agent.knowledge` (objectstack#3896 — it never scoped
-retrieval), `skill.triggerPhrases` (objectstack#3896 — phrases were never matched
-against a user's message).
-
-**`AppPreview` / `AppNavCanvas`** — `AppSchema.navigation` is a discriminated
-union on `type` whose every branch is `.strict()`. Both surfaces ignored the
-discriminator: kind came from `it.object` / `it.dashboard`, the route from
-`it.path ?? it.href ?? it.route ?? it.url`, and the landing from
-`landingRoute ?? landing ?? defaultRoute ?? '/'`. Not one of those is a key
-(`landing` was removed in objectstack#4001), so the reading was exactly inverted —
-a valid app showed generic badges, no targets and an invented `Landing: /`. Now
-`type` is the badge, each branch's own key is the target
-(`objectName`/`pageName`/`dashboardName`/`url`/`reportName`/`componentRef`/
-`actionDef.actionName`), and the route comes from `resolveHref`, the shell's own
-nav → URL mapping that `useNavPins` and `SearchResultsPage` already share — so a
-link in the preview is the link the runtime follows. The landing entry is
-DERIVED, never read off the draft — it is the first navigation item that yields
-a route, the same rule the console shell applies; `homePageId` was retired in
-`@objectstack/spec` 17.0.0 and is not consulted.
-
-**`DatasourcePreview`** — `capabilities` is a `DatasourceCapabilities` object of
-boolean flags, and the preview tested `Array.isArray`, lighting the block up only
-for the pre-17 token array the schema refuses. It now lists the flags set to
-`true`. The `driver ?? d.type` fallback is gone (the schema's own hint is
-`type` → `driver`), as is the `default` pill behind `isDefault ?? default` —
-routing is declared at stack level via `datasourceMapping`, never on the
-datasource.
-
-**`SkillPreview`** — the trigger-conditions table read `cond.expression ??
-cond.value` under a `cond.type` gutter, so a spec-valid condition rendered as
-`COND | sales_order` with the field it tests and the operator it applies both
-invisible. It is now three columns — `field` / `operator` / `value` — straight off
-`SkillTriggerConditionSchema`, and a row missing one of those required cells says
-so instead of rendering a blank that reads as fine.
-
-**`ValidationPreview`** (objectui#3281) — drew nine rule types where the union has
-six. `unique`, `async` and `custom` were removed by one paragraph of
-`validation.zod.ts`, because a rule must be a deterministic, synchronous,
-side-effect-free predicate over one record; each now redirects to the layer that
-does the job (a unique **index** — a SELECT-then-INSERT rule is racy, TOCTOU — a
-form-layer check, a lifecycle hook). Two alias fallbacks went with them:
-`condition ?? expression` and `pattern ?? regex`, where neither `expression` nor
-`pattern` has ever been a key on any branch — which is precisely why a bogus
-`expression` sat unnoticed in the console sample. Two branches were also simply
-wrong: `conditional` read `condition` instead of its `when` (a valid rule showed
-"No expression set", and its nested `then`/`otherwise` now render), and
-`json_schema` had no branch at all, so a valid rule displayed "Unknown rule type".
-
-`validation.object` is deliberately still read: `anchors.ts` registers a
-standalone `validation` resource matched by `anchorByField('object')`, so a
-standalone rule genuinely carries it. Not every key a union omits is residue.
-
-Verified in the preview gallery before and after, per designer; each preview also
-gains tests that feed a spec-valid draft and assert the block renders, then feed a
-stale draft carrying the retired key and assert nothing renders from it.
diff --git a/.changeset/record-chatter-loading-signal.md b/.changeset/record-chatter-loading-signal.md
deleted file mode 100644
index 6a3d559936..0000000000
--- a/.changeset/record-chatter-loading-signal.md
+++ /dev/null
@@ -1,49 +0,0 @@
----
-"@object-ui/app-shell": patch
-"@object-ui/plugin-detail": patch
----
-
-The record discussion panel now says "loading" while it is loading, instead of
-"No comments yet" (objectui#3209).
-
-FROM: opening any record page showed the discussion/chatter panel asserting
-`No comments yet` for the whole first leg of the page, then contradicting
-itself when the comments appeared. TO: the panel shows the loading row until
-the feed has actually answered, and only then commits to "this record has no
-comments".
-
-objectui#3205 gave `RecordActivityTimeline` the render branch that prefers a
-loading row over the empty copy, and `RecordChatterPanel` already forwarded
-`loading` to it in both positions — but on the chatter chain **nothing
-produced the signal**, so that branch could never fire. `record:activity`
-computes its own flag and was visibly fixed by #3205; chatter was not. The
-four wiring points are one chain and are all closed here, because any one of
-them left open still ships the empty copy to some user:
-
-- `RecordDetailView` — the host that OWNS the feed fetch — now derives a
-  `feedLoading` flag from its two reads (`sys_comment` + `sys_activity`);
-- `<DiscussionContextProvider loading={feedLoading}>` publishes it (the field
-  was already declared on `DiscussionContextValue`, and already read by
-  `record:activity`);
-- the auto-appended `<RecordChatterPanel loading={feedLoading}>` — the panel
-  authored pages get when they place no discussion slot — receives it
-  directly;
-- the `record:chatter` / `record:discussion` renderer forwards
-  `loading={discussion?.loading}`, so a hand-placed block is on the same
-  chain as the synthesized one.
-
-The two reads run in parallel, so the flag closes over **both**: it clears on
-`Promise.allSettled`, and a REJECTED read counts as an answer. A deployment
-without the audit plugin 404s `sys_activity` and an object with
-`enable.feeds: false` 403s `sys_comment`; neither may pin the panel in a
-permanent spinner, which would be a worse bug than the one being fixed. The
-flag is keyed by `object:recordId` rather than being a plain boolean, so the
-first render of a record already reads as loading (no one-frame flash of the
-empty state) and navigating between records cannot show the previous record's
-settled answer.
-
-No tolerance was added at the consumer. The timeline still does not guess that
-"no items yet and just mounted" means loading — that guess is wrong the moment
-a record genuinely has no comments, and the signal belongs to whoever owns the
-fetch. Same shape as objectui#3165 / #3205: divergence converges at the
-producer.
diff --git a/.changeset/record-feed-keyed-by-record.md b/.changeset/record-feed-keyed-by-record.md
deleted file mode 100644
index bd40473d6a..0000000000
--- a/.changeset/record-feed-keyed-by-record.md
+++ /dev/null
@@ -1,55 +0,0 @@
----
-"@object-ui/app-shell": patch
----
-
-The record discussion panel no longer shows the PREVIOUS record's comments and
-activity (objectui#3268).
-
-FROM: clicking from record A to record B in a list left A's comments and
-activity rows on B's discussion panel, with B's own rows merged in alongside
-them. TO: each record's panel shows that record's feed and nothing else, and a
-record that is still being fetched shows the loading row rather than the
-record the user just came from.
-
-This was cross-record data display, not a cosmetic glitch. `RecordDetailView`
-is deliberately NOT remounted between records — no mount site passes a `key=`
-(`console/AppContent.tsx`, and the `ObjectView` / `ObjectDataPage` /
-`InterfaceListPage` drawers just swap `recordIdOverride`), per objectui#2269
-"refresh data, don't rebuild UI" — so its feed state survived the navigation,
-and both reads (`sys_comment`, `sys_activity`) merged into it BY ROW ID. A's
-rows and B's rows have different ids, so the merge could not dedupe them away
-and nothing anywhere reset the list.
-
-It also suppressed the fix objectui#3209 had just shipped. On record→record
-navigation `feedLoading` did flip true, but `RecordActivityTimeline`'s branch
-is `loading && filtered.length === 0` (objectui#3205, deliberate: a refresh
-must not turn an on-screen feed into a spinner) and the leftover rows kept
-`filtered` non-empty — so the panel rendered the previous record's content
-where a loading state belonged. The two issues only add up to a working
-feature together.
-
-The feed state is now keyed by `objectName:recordId` — the same key
-objectui#3209 introduced in this file for the loading flag, and the very
-`thread_id` the rows carry server-side. The render reads only the current
-key's slice, so "empty for a new record" FALLS OUT of reading a key that has
-no slice; there is no `setFeedItems([])` racing the fetch that fills it. A
-response that lands after the user has navigated away is written under the key
-its effect closed over, so it updates the record it was fetched for and can
-never bleed into the record now on screen — the same guarantee `settledFeedKey`
-already gave the loading flag. One idiom in this file, not two.
-
-Keying rather than clearing is what keeps OPTIMISTIC rows safe. A comment the
-user has just posted but that has not come back from the server lives only in
-this state, and it now rides in its own record's slice: navigating away and
-back finds it again, and it never appears on another record's panel. Nothing
-deletes a slice, so returning to a record shows its rows immediately while the
-re-read confirms them (objectui#3205 again), and the re-read folds the
-persisted copy onto the optimistic row by id — same id, because that is the id
-it was created under — so there is no duplicate when it lands. The same
-scoping applies to threaded replies and reaction toggles.
-
-No tolerance was added at the consumer. `RecordActivityTimeline` still keeps
-`loading && filtered.length === 0` exactly as objectui#3205 wrote it; once the
-feed's lifecycle is correct that condition is right on its own. Weakening it
-would have been treating the symptom at the consumer, which is what
-objectui#3165 / #3205 / #3209 all deliberately avoided.
diff --git a/.changeset/record-picker-select-label.md b/.changeset/record-picker-select-label.md
deleted file mode 100644
index 50eb6904d6..0000000000
--- a/.changeset/record-picker-select-label.md
+++ /dev/null
@@ -1,20 +0,0 @@
----
-"@object-ui/fields": patch
----
-
-The lookup "Browse all records" Record Picker now formats its columns with
-the same field metadata the list view uses (objectui#3333). Previously the
-dialog handed cell renderers a bare `{ name, type }` descriptor, so a
-`select` column had no `options` and fell back to title-casing the raw
-stored value (`manufacturing` rendered as "Manufacturing" instead of the
-authored option label, e.g. "03 制造") — while the same field displayed
-correctly in the list view and on the record detail page.
-
-`RecordPickerDialog` gains an optional `fieldsMeta` prop (the referenced
-object's schema `fields` map). When provided, each column's field descriptor
-is enriched from the schema — `options` (run through the shared i18n option
-translation), `currency`, `scale`, `precision`, `format`, `reference_to`, … —
-and columns authored as plain strings in `lookup_columns` inherit the schema
-field's `type`, so they format identically to typed columns. `LookupField`
-passes the referenced object's schema it already fetches for `titleFormat`.
-Callers that don't pass `fieldsMeta` keep the previous behavior.
diff --git a/.changeset/retire-action-param-validation.md b/.changeset/retire-action-param-validation.md
deleted file mode 100644
index 5e5adce3be..0000000000
--- a/.changeset/retire-action-param-validation.md
+++ /dev/null
@@ -1,48 +0,0 @@
----
-"@object-ui/types": minor
-"@object-ui/core": minor
----
-
-Retire `validation` from the action-param contract — it was declared on both
-halves, read by neither, and rejected outright by the server (objectui#3201).
-
-FROM: `validation?: string` was declared on the AUTHORING type
-(`@object-ui/types`' `ActionParam`) and on the RESOLVED type (`@object-ui/core`'s
-`ActionParamDef`). TO: it is declared on neither.
-
-**Breaking for anyone who declared it — but it never did anything.** This is
-marked `minor`, not `major`, per the repo's version-alignment policy (objectui's
-major tracks `@objectstack`'s, so objectui's own breaking changes ship as `minor`
-with the breaking semantics spelled out here).
-
-**Migration: delete it.** If you authored `validation: '...'` on an action param,
-it never took effect, and publishing that metadata to the server is a hard parse
-failure — so any metadata that reached production either never carried the key or
-never parsed. Removing it changes no runtime behaviour; it only moves the error
-from "silent no-op, then rejected at publish" to a `tsc` error at the keystroke.
-
-Why it could not work as authored:
-
-- `ActionParamSchema` in `@objectstack/spec/ui` is `.strict()` and does not list
-  `validation`, so an authored key is a PARSE REJECTION on the server:
-  `Unrecognized key(s) on this action param: \`validation\``. Meanwhile `tsc`
-  against the public type accepted it — the type vouched for a key the platform
-  itself refuses.
-- Nothing read it on the resolved side either: it was never a key of
-  `resolveActionParams()`'s `RawActionParam`, the runtime field metadata a
-  field-backed param inherits from carries no `validation` to source one from,
-  and `paramToField()` never mapped it — so it could not reach the field widgets,
-  whose rules `buildValidationRules()` builds from `required` / `minLength` /
-  `maxLength` / `pattern`.
-
-Removed rather than implemented, on ADR-0049 enforce-or-remove. Giving it meaning
-would mean first deciding what an "expression" is here (CEL? a formula? a regex?)
-and adding it to `@objectstack/spec`, which is where such a capability has to
-start — not accreted renderer-side around a key the contract does not have.
-
-This also retires the last named exception in objectui#3174's drift guard
-(`packages/types/src/__tests__/page-nav-misc-spec-parity.test.ts`), which carried
-`validation` as the one key `ActionParam` added on top of the spec's set. The
-rule it pins — **the authoring type declares exactly the spec's authorable
-keys** — is now literal: the guard asserts the local-only key set is empty, so
-any future addition fails the build instead of being waved through.
diff --git a/.changeset/richtext-honors-mobile-fullscreen.md b/.changeset/richtext-honors-mobile-fullscreen.md
deleted file mode 100644
index e1c9503800..0000000000
--- a/.changeset/richtext-honors-mobile-fullscreen.md
+++ /dev/null
@@ -1,49 +0,0 @@
----
-"@object-ui/fields": minor
-"@object-ui/plugin-form": minor
----
-
-`RichTextField` honours `mobile_fullscreen`, so `mobile.fullscreenLongText` is
-finally true of rich text too (objectui#3301).
-
-`ObjectFormSchema.mobile.fullscreenLongText` has always been documented as
-"textarea/rich-text get an expand button", and `ObjectForm` has always stamped
-`mobile_fullscreen` onto `field:markdown` / `field:html` fields to deliver it.
-Both of those types resolve to `RichTextField`, and that widget never read the
-flag: a producer with no consumer. Turning the setting on gave a phone user an
-expand affordance on their textareas and nothing at all on their markdown or
-HTML fields, with nothing anywhere reporting that half the feature was inert.
-
-FROM: `RichTextField` ignored the flag entirely (`grep fullscreen` over that
-file returned nothing). TO: it reads `field.mobile_fullscreen` — the same single
-metadata carrier `TextAreaField` reads, and nowhere else — and renders the same
-expand affordance and full-height editing dialog.
-
-**The affordance now has one implementation, not two.** One form-level setting
-should produce one behaviour, so the expand button, the dialog and the
-draft/commit semantics moved into a shared `FullscreenFieldEditor` that both
-widgets render; only the EDITOR is per-widget. A second hand-written copy of
-that state machine would be the same defect this release fixes, with an extra
-step — it drifts, and nothing reports the drift. The rich-text dialog hosts the
-widget's real editing surface (same format indicator, same editor), not a bare
-textarea, so whatever that editor grows into, both positions get it at once.
-
-Behaviour is identical across the two widgets and unchanged for
-`TextAreaField`: the dialog seeds its draft from the committed value at open
-time, keeps typing local (a react-hook-form field is not marked dirty by an
-edit the user may still cancel), commits once on "Done", and discards on
-"Cancel". Test ids follow the existing convention per widget —
-`richtext-fullscreen-toggle` / `-dialog` / `-input` / `-save` alongside the
-`textarea-*` ones, since a single form can contain both.
-
-There is deliberately no prop spelling of the flag and no `??` fallback chain in
-either widget. The field metadata is the one carrier (objectui#3233), so a
-misspelled or misplaced flag stays inert and visible rather than being quietly
-caught by a tolerant consumer.
-
-Also removes a dead type from the producer: `ObjectForm` stamped the flag on
-`'string-multiline'`, a string that `grep -rn` finds exactly once across both
-this repo and `objectstack` — that line itself. No producer emitted it, no
-registry key matched it, no widget read it. The remaining four stamped types
-(`textarea`, `field:textarea`, `field:markdown`, `field:html`) each have a real
-reader.
diff --git a/.changeset/select-aria-reaches-the-trigger.md b/.changeset/select-aria-reaches-the-trigger.md
deleted file mode 100644
index c7d190d245..0000000000
--- a/.changeset/select-aria-reaches-the-trigger.md
+++ /dev/null
@@ -1,29 +0,0 @@
----
-"@object-ui/fields": patch
----
-
-`field:select` now announces its validation state to assistive tech: the
-widget's DOM pass-through lands on the Radix `SelectTrigger` — the focusable
-`<button role="combobox">` a user actually interacts with — instead of
-`Select.Root`, which renders no DOM element of its own and silently dropped
-every `aria-*` the form renderer delivered (objectui#3306).
-
-Before this, a required select that failed validation showed the red message
-while a screen reader was told nothing: `aria-invalid`, `aria-describedby`
-(the link to the message text) and `aria-required` (objectui#3290's state
-channel) all landed on Root and vanished. All three now reach the trigger,
-and the widget computes `aria-invalid` from the published `error` slot after
-the spread, the objectui#3222 discipline — a valid field explicitly says
-`aria-invalid="false"` rather than staying mute.
-
-Two keys deliberately stay on Root: `name` (Root forwards it to the hidden
-native `<select>` that takes part in form submission) and `disabled` (Root is
-the single authority that disables trigger, items and hidden select together).
-
-Guarding the whole class forward, a new registry-wide sweep
-(`widget-aria-invalid-registry-e2e.test.tsx`, the objectui#3291 leak-sweep
-paradigm) renders every registered field widget through the real form, drives
-a real validation failure, and asserts `aria-invalid="true"` appears inside
-the field's row. The 29 widget types measured not to deliver yet are pinned in
-a ratchet ledger (tracked in objectui#3318): fixing one turns its ledger row
-red until the entry is removed, so the ledger only ever shrinks.
diff --git a/.changeset/spec-17-rc2-pin-bump.md b/.changeset/spec-17-rc2-pin-bump.md
deleted file mode 100644
index 8b8557e3cb..0000000000
--- a/.changeset/spec-17-rc2-pin-bump.md
+++ /dev/null
@@ -1,90 +0,0 @@
----
-"@object-ui/types": minor
-"@object-ui/core": minor
-"@object-ui/layout": minor
-"@object-ui/app-shell": minor
-"@object-ui/data-objectstack": minor
-"@object-ui/console": minor
----
-
-Track `@objectstack/spec` 17.0.0-rc.2 (objectui#3235, #3208, #3287, #3264).
-
-The pin moves from `^17.0.0-rc.1` to `^17.0.0-rc.2` across the workspace, and
-the sibling `@objectstack/*` packages (`client` / `core` / `formula` / `lint`)
-move with it — they pin `@objectstack/spec` **exactly**, so leaving them behind
-kept a second copy of the spec in the tree and would have had `@objectstack/lint`
-validating against rc.1 schemas that still accept keys rc.2 retires.
-
-Breaking semantics, in FROM → TO form:
-
-- **`app.homePageId` is retired — an app's landing page is now its first
-  navigation item.** An app that pinned a landing page with `homePageId` will
-  open on the first reachable navigation entry (by `order`) instead; the root
-  landing still follows `isDefault`. To restore a specific landing page, reorder
-  `navigation` so the intended entry comes first. Stored metadata is migrated by
-  `os migrate meta --from 16`. The key is a hard error now, not a stripped one:
-  the spec ships a tombstone that names the migration.
-  Upstream retired it because of its SHAPE, not its usage — it was an ID
-  cross-reference with no referential integrity, so a `homePageId` that pointed
-  at nothing silently fell back to the first navigation item anyway
-  (objectstack#4667, premise corrected in #4709). If the capability returns, it
-  returns as a flag on the navigation item itself, which cannot dangle.
-- **`@object-ui/types`' `HttpMethod` now resolves to the spec's
-  `HttpMethodType`.** Shape is verbatim identical — the same 5-value UI subset —
-  and `@object-ui/types` still exports it as `HttpMethod`, so no consumer
-  changes. The spec renamed its `./ui` export because `HttpMethod` named two
-  different types depending on the import path (`./shared` / `./api` carry a
-  7-value enum including `HEAD` / `OPTIONS`); objectui deliberately keeps the
-  5-value one (objectstack#4691).
-- **`AppContextSelector.includeAll` / `placement` are gone.** Neither ever did
-  anything in this renderer: context selectors are mandatory-scope, so no "All"
-  row was ever rendered, and `placement: 'topbar'` put nothing in the topbar.
-  Both carried schema defaults, which is why the liveness lint structurally
-  could not flag them — removal was the only channel that reaches an author
-  (framework#4509).
-- **`NavigationArea.visible` / `order` / `requiredPermissions` are gone.** An
-  area is a layout grouping, not an access boundary. Gating moved down to the
-  navigation ITEM, where `visible` and `requiredPermissions` are unchanged and
-  still enforced. `AppSchemaRenderer`'s area switcher no longer hides an area, so
-  an area whose items are all gated away renders as visible-but-empty rather
-  than disappearing.
-- **`@object-ui/core` no longer exports `NotificationProtocol`**
-  (`resolveNotificationConfig`, `specNotificationToToast`, `mapSeverityToVariant`,
-  `mapPosition`, `ToastNotification`). It bridged `@objectstack/spec/ui`'s
-  `Notification` / `NotificationConfig`, which objectstack#4610 deleted with no
-  successor. Use `resolveNotificationConfig` from `@object-ui/react`
-  (`NotificationContext`), which owns the live `NotificationSystemConfig` and is
-  what every notification surface already read. Note that the spec's *other*
-  `Notification` — `@objectstack/spec/api` — is the REST inbox row, a different
-  contract, and is deliberately NOT aliased in as a replacement.
-- **The `email_template` client-side validator now uses
-  `EmailTemplateDefinitionSchema`.** It was pointing at the removed
-  `EmailTemplateSchema`, so authored templates were being checked against the
-  wrong contract: the live one is keyed `name` + `locale` (not `id`) and splits
-  the body into `bodyHtml` / `bodyText` (not `body` + `bodyType`)
-  (objectstack#4616 / #4807).
-
-Fixes that are not breaking, but were only found because rc.2 stopped being
-lenient — each had been passing vacuously:
-
-- **`view` drafts are actually validated now.** The client validator named the
-  aggregated container schema while this admin authors first-class `ViewItem`s,
-  and the container used to strip `viewKind` / `config` in silence — so no view
-  draft ever had one of its own keys checked. It now validates each shape
-  against its own schema (objectui#3312).
-- **The console's worked examples were wrong**, and being stripped rather than
-  refused: `view.list.object` (the container root already declares it),
-  `job.concurrency` / `job.timeoutMs` (no such keys; the spelling is `timeout`,
-  already in ms), `email_template.from` / `.to` (a template is not a send —
-  the sender override is `fromOverride`, an object), and
-  `datasource.capabilities` / `.healthCheck` (objectstack#4583 removed the
-  former; the latter was never a datasource key). These are the drafts an
-  author — or a model generating metadata — copies.
-- Action key inventory re-derived: `ActionSchema` gained the package-lock
-  envelope (`_lock*` / `_package*` / `_provenance`), so a packaged action no
-  longer reports them as unknown keys.
-- The schema-diff panel labels the new `default_mismatch` finding.
-- Test fixtures pinning the retired `managedBy: 'system'` bucket now use
-  `engine-owned`. Protocol 17 split that value (objectstack#3355), so it
-  resolved to the default-writable fallback and a batch of "stays locked"
-  assertions had quietly stopped asserting anything.
diff --git a/.changeset/tags-placeholder-i18n.md b/.changeset/tags-placeholder-i18n.md
deleted file mode 100644
index c2ef64f06f..0000000000
--- a/.changeset/tags-placeholder-i18n.md
+++ /dev/null
@@ -1,13 +0,0 @@
----
-"@object-ui/fields": patch
-"@object-ui/i18n": patch
----
-
-`TagsField` no longer ships a hardcoded Chinese input placeholder
-(objectui#3342, AGENTS.md Commandment #-1). The placeholder now resolves
-through the pinned chain: the author-declared `field.placeholder` wins
-(previously ignored by this widget); otherwise the widget's own copy arrives
-via `useFieldTranslation()` under the new `fields.tags.placeholder` key, added
-at full parity across all locale packs (Chinese lives in the zh pack, not in
-code); with no `I18nProvider` mounted the English default from FIELD_DEFAULTS
-renders — never a raw key.
diff --git a/.changeset/textarea-mobile-fullscreen-single-source.md b/.changeset/textarea-mobile-fullscreen-single-source.md
deleted file mode 100644
index 2a68da3c30..0000000000
--- a/.changeset/textarea-mobile-fullscreen-single-source.md
+++ /dev/null
@@ -1,47 +0,0 @@
----
-"@object-ui/fields": patch
----
-
-`TextAreaField`'s mobile fullscreen flag converges on its one real producer
-(objectui#3232).
-
-FROM: the widget resolved the "show the expand affordance" decision through a
-four-way `??` chain — a `mobileFullscreen` (camelCase) prop, the field
-metadata's `mobile_fullscreen`, a `mobile_fullscreen` prop, and
-`schema.mobile_fullscreen`. TO: a single read of the field metadata's
-`mobile_fullscreen`, resolved through the `field || schema` carrier pair every
-widget in this package already uses.
-
-No runtime behaviour changes, because three of those four reads were
-permanently `undefined`:
-
-- `mobileFullscreen` (camelCase) had **no producer anywhere in the repo** — the
-  only occurrences of that spelling were the widget's own read and the
-  destructure that kept it off the DOM spread. The doc comment nonetheless
-  claimed "the host form passes `mobileFullscreen`", so the contract it
-  described had never held.
-- `mobile_fullscreen` as a **prop** cannot arrive: the form renderer's
-  `stripRegisteredFieldProps` explicitly removes `mobile_fullscreen` and
-  `fullscreen` from the props forwarded to registered field widgets.
-- `schema.mobile_fullscreen` was the same object `field || schema` already
-  resolves, so it could only ever restate the metadata read.
-
-What actually drives the affordance — and is now the only thing that does — is
-the field metadata flag `ObjectForm` stamps onto long-text fields from
-`ObjectFormSchema.mobile.fullscreenLongText`. That path is unchanged and is now
-pinned by tests (button, dialog, and the committed edit), so the cleanup cannot
-have silently removed the working behaviour.
-
-Also untouched: the built-in (unregistered) `textarea` branch of the form
-renderer, which reads `mobile_fullscreen || fullscreen` off the form-field
-props and renders its own `FullscreenTextarea`. That is a separate live path.
-
-Why this is worth a changeset rather than a silent tidy-up: reads that nobody
-writes are not free. They document a contract that does not exist — the next
-author follows the comment, passes the prop, and is ignored without a word —
-and a `??` chain that accepts four spellings and rejects none is exactly where
-a misspelled key hides. With one source, a wrong spelling has no read path left
-to absorb it. Per AGENTS.md #0.1 and Prime Directive #12, divergence like this
-converges at the producer, not by accumulating tolerance at the consumer. No
-host-override prop was invented in its place: inventing a key with no producer
-is the same mistake in the other direction.
diff --git a/.changeset/toolpreview-drop-retired-flag-pills.md b/.changeset/toolpreview-drop-retired-flag-pills.md
deleted file mode 100644
index 4ea900710c..0000000000
--- a/.changeset/toolpreview-drop-retired-flag-pills.md
+++ /dev/null
@@ -1,39 +0,0 @@
----
-"@object-ui/app-shell": patch
----
-
-`ToolPreview` stops advertising retired `ToolSchema` flags (objectui#3236).
-
-The metadata-admin tool preview painted a header strip of flag pills read
-straight off the raw draft: `Requires confirmation`, `Active` / `Disabled`,
-`built-in`, and the `category` tag. All four keys have been removed from
-`@objectstack/spec`'s `ToolSchema` — `requiresConfirmation` in the 16.x line
-(objectstack#3715, ADR-0033 §2) and `category` / `active` / `builtIn` in
-17.0.0 (objectstack#3896 audit close-out). The schema is `.strict()` and now
-rejects each by name with an upgrade prescription, so no newly authored tool
-can carry them; verified against the `@objectstack/spec@17.0.0-rc.1` this repo
-depends on.
-
-New metadata could not reach these pills — but rows stored before the removals
-still carry the keys, and for those the preview kept rendering. That is the
-harmful direction, not a cosmetic one:
-
-- `Requires confirmation` advertised a safety pause that no execution path has
-  ever performed. Nothing read the key — not the LLM tool set (a tool reaches
-  the model as name/description/parameters only), not `ToolRegistry.execute`,
-  not `POST /ai/tools/:name/execute`. A reviewer reading the preview saw a
-  destructive tool marked as gated when it was not. The real gate is
-  `action.ai.requiresConfirmation`, which the HITL approval queue reads.
-- `Disabled` claimed a tool had been withdrawn while `ToolRegistry.getAll()`
-  kept handing it to the LLM and the execute route kept running it.
-
-Same shape as objectui#2962: a UI badge advertising a capability the runtime
-does not have. The pills are gone; the surviving header strip shows label,
-machine name and the `objectName` pill (`objectName` is still a live spec key),
-and nothing else in the preview changed — parameters table, example LLM call
-and output schema are untouched.
-
-New tests feed the preview a stale draft that still carries all four retired
-keys and assert none of them renders, so the pills cannot grow back: the names
-survive in the spec's tombstone guidance, which gives the next reader a
-plausible-looking reason to "restore" them.
diff --git a/.changeset/widget-aria-invalid-delivery-batch.md b/.changeset/widget-aria-invalid-delivery-batch.md
deleted file mode 100644
index 4a5c9c7290..0000000000
--- a/.changeset/widget-aria-invalid-delivery-batch.md
+++ /dev/null
@@ -1,33 +0,0 @@
----
-"@object-ui/fields": patch
-"@object-ui/components": patch
----
-
-20 more registered field widgets now announce a failed validation to assistive
-tech: `multiselect`, `radio`, `checkboxes`, `tags`, `lookup`, `master_detail`,
-`user`, `owner`, `file`, `image`, `location`, `object`, `color`, `rating`,
-`code`, `avatar`, `address`, `geolocation`, `qrcode` and `object-ref` carry
-`aria-invalid="true"` on their real focusable control after a validation
-failure, where before the red message rendered while a screen reader was told
-nothing (objectui#3318, the registry-wide gap objectui#3306's sweep measured).
-
-Each widget follows the objectui#3222/#3306 pattern: the `toDomProps(props)`
-whitelist spread goes onto the control the user actually focuses — the input,
-the lookup trigger button, the radiogroup (`role="radiogroup"` is the
-ARIA-designated carrier for a set of radios), every chip/checkbox/star of the
-composite option widgets, the upload dropzone/button — followed by an explicit
-`aria-invalid={!!error}` computed from the published `error` slot. Wrapper
-`<div>`s never carry the state, and `name` is withheld from non-form-control
-elements (the objectui#3291 leak class).
-
-`Combobox` (`@object-ui/components`) now accepts standard button attributes
-and forwards them to its focusable `role="combobox"` trigger, giving
-combobox-based widgets an element to deliver `aria-invalid` /
-`aria-describedby` to — the same seam objectui#3306 opened on
-`SelectTrigger`.
-
-Nine types remain on the objectui#3318 ratchet ledger with their blockers
-documented there (`formula`/`summary`/`auto_number`/`vector` render no
-focusable control; `grid`, `slider`, `signature` need component-level design;
-`filter-condition`/`recipient-picker` deliver in their editable states but
-render a dependency-gate hint with no control in a fresh form).
diff --git a/apps/console/CHANGELOG.md b/apps/console/CHANGELOG.md
index 90f79d1326..00925ced46 100644
--- a/apps/console/CHANGELOG.md
+++ b/apps/console/CHANGELOG.md
@@ -1,5 +1,96 @@
 # @object-ui/console
 
+## 17.3.0
+
+### Minor Changes
+
+- d22ae31: Track `@objectstack/spec` 17.0.0-rc.2 (objectui#3235, #3208, #3287, #3264).
+
+  The pin moves from `^17.0.0-rc.1` to `^17.0.0-rc.2` across the workspace, and
+  the sibling `@objectstack/*` packages (`client` / `core` / `formula` / `lint`)
+  move with it — they pin `@objectstack/spec` **exactly**, so leaving them behind
+  kept a second copy of the spec in the tree and would have had `@objectstack/lint`
+  validating against rc.1 schemas that still accept keys rc.2 retires.
+
+  Breaking semantics, in FROM → TO form:
+
+  - **`app.homePageId` is retired — an app's landing page is now its first
+    navigation item.** An app that pinned a landing page with `homePageId` will
+    open on the first reachable navigation entry (by `order`) instead; the root
+    landing still follows `isDefault`. To restore a specific landing page, reorder
+    `navigation` so the intended entry comes first. Stored metadata is migrated by
+    `os migrate meta --from 16`. The key is a hard error now, not a stripped one:
+    the spec ships a tombstone that names the migration.
+    Upstream retired it because of its SHAPE, not its usage — it was an ID
+    cross-reference with no referential integrity, so a `homePageId` that pointed
+    at nothing silently fell back to the first navigation item anyway
+    (objectstack#4667, premise corrected in #4709). If the capability returns, it
+    returns as a flag on the navigation item itself, which cannot dangle.
+  - **`@object-ui/types`' `HttpMethod` now resolves to the spec's
+    `HttpMethodType`.** Shape is verbatim identical — the same 5-value UI subset —
+    and `@object-ui/types` still exports it as `HttpMethod`, so no consumer
+    changes. The spec renamed its `./ui` export because `HttpMethod` named two
+    different types depending on the import path (`./shared` / `./api` carry a
+    7-value enum including `HEAD` / `OPTIONS`); objectui deliberately keeps the
+    5-value one (objectstack#4691).
+  - **`AppContextSelector.includeAll` / `placement` are gone.** Neither ever did
+    anything in this renderer: context selectors are mandatory-scope, so no "All"
+    row was ever rendered, and `placement: 'topbar'` put nothing in the topbar.
+    Both carried schema defaults, which is why the liveness lint structurally
+    could not flag them — removal was the only channel that reaches an author
+    (framework#4509).
+  - **`NavigationArea.visible` / `order` / `requiredPermissions` are gone.** An
+    area is a layout grouping, not an access boundary. Gating moved down to the
+    navigation ITEM, where `visible` and `requiredPermissions` are unchanged and
+    still enforced. `AppSchemaRenderer`'s area switcher no longer hides an area, so
+    an area whose items are all gated away renders as visible-but-empty rather
+    than disappearing.
+  - **`@object-ui/core` no longer exports `NotificationProtocol`**
+    (`resolveNotificationConfig`, `specNotificationToToast`, `mapSeverityToVariant`,
+    `mapPosition`, `ToastNotification`). It bridged `@objectstack/spec/ui`'s
+    `Notification` / `NotificationConfig`, which objectstack#4610 deleted with no
+    successor. Use `resolveNotificationConfig` from `@object-ui/react`
+    (`NotificationContext`), which owns the live `NotificationSystemConfig` and is
+    what every notification surface already read. Note that the spec's _other_
+    `Notification` — `@objectstack/spec/api` — is the REST inbox row, a different
+    contract, and is deliberately NOT aliased in as a replacement.
+  - **The `email_template` client-side validator now uses
+    `EmailTemplateDefinitionSchema`.** It was pointing at the removed
+    `EmailTemplateSchema`, so authored templates were being checked against the
+    wrong contract: the live one is keyed `name` + `locale` (not `id`) and splits
+    the body into `bodyHtml` / `bodyText` (not `body` + `bodyType`)
+    (objectstack#4616 / #4807).
+
+  Fixes that are not breaking, but were only found because rc.2 stopped being
+  lenient — each had been passing vacuously:
+
+  - **`view` drafts are actually validated now.** The client validator named the
+    aggregated container schema while this admin authors first-class `ViewItem`s,
+    and the container used to strip `viewKind` / `config` in silence — so no view
+    draft ever had one of its own keys checked. It now validates each shape
+    against its own schema (objectui#3312).
+  - **The console's worked examples were wrong**, and being stripped rather than
+    refused: `view.list.object` (the container root already declares it),
+    `job.concurrency` / `job.timeoutMs` (no such keys; the spelling is `timeout`,
+    already in ms), `email_template.from` / `.to` (a template is not a send —
+    the sender override is `fromOverride`, an object), and
+    `datasource.capabilities` / `.healthCheck` (objectstack#4583 removed the
+    former; the latter was never a datasource key). These are the drafts an
+    author — or a model generating metadata — copies.
+  - Action key inventory re-derived: `ActionSchema` gained the package-lock
+    envelope (`_lock*` / `_package*` / `_provenance`), so a packaged action no
+    longer reports them as unknown keys.
+  - The schema-diff panel labels the new `default_mismatch` finding.
+  - Test fixtures pinning the retired `managedBy: 'system'` bucket now use
+    `engine-owned`. Protocol 17 split that value (objectstack#3355), so it
+    resolved to the default-writable fallback and a batch of "stays locked"
+    assertions had quietly stopped asserting anything.
+
+### Patch Changes
+
+- @object-ui/sdui-parser@17.3.0
+- @object-ui/react-runtime@17.3.0
+
 ## 17.2.0
 
 ### Minor Changes
diff --git a/apps/console/package.json b/apps/console/package.json
index 726cd4a0c7..51de18bd24 100644
--- a/apps/console/package.json
+++ b/apps/console/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/console",
-  "version": "17.2.0",
+  "version": "17.3.0",
   "description": "ObjectStack Console — opinionated, fork-ready runtime console built on @object-ui/app-shell with the full plugin set wired up. Ships as a Hono UI plugin serving a pre-built SPA.",
   "license": "MIT",
   "type": "module",
diff --git a/packages/app-shell/CHANGELOG.md b/packages/app-shell/CHANGELOG.md
index 994643bf3e..37902163a6 100644
--- a/packages/app-shell/CHANGELOG.md
+++ b/packages/app-shell/CHANGELOG.md
@@ -1,5 +1,561 @@
 # @object-ui/app-shell — Changelog
 
+## 17.3.0
+
+### Minor Changes
+
+- 8ec4067: The environment entitlement dialog now reads its context from
+  `error.details.*` — the single declared location — and the flat dual-dialect
+  tolerance is deleted (objectui#3329, the objectui half of cloud#1046).
+
+  `entitlementDialogFromError()` maps a cloud env-create 403 into the friendly
+  upgrade / limit dialog. It read `upgrade_url`, `contact_url`, `plan`, `current`
+  and `limit` off the error object's **top level**, where the control plane used
+  to put them as undeclared siblings of `code`. Those keys are conformant only by
+  evaporating: `ApiErrorSchema` is a plain `z.object` that STRIPS unknown keys, so
+  they survive to the Console purely because this path consumes the raw wire body
+  before any parse. ADR-0112 (with framework#4224 and cloud#930's `AiErrorExtra`)
+  declares `details` as the slot for structured error context, and cloud#1046
+  moves the producer there.
+
+  ## What changed
+  - All entitlement context is read from `error.details.<key>` and **nowhere
+    else**. `code` and `message` are declared `ApiErrorSchema` fields and stay on
+    `error` itself.
+  - `entitlementErrorFields()` — the `body?.error ?? body` flat/nested tolerance —
+    is **removed**. A flat body (`error` as a string with `code` at the top level)
+    no longer produces a dialog; it takes the caller's ordinary error path.
+  - No `??` chain between shapes was added in its place: exactly one shape is
+    accepted after this change, and tests pin both directions (details is read;
+    the retired locations are not).
+
+  ## Breaking note — read before tracking objectui `main` directly
+
+  This is a wire-shape change with no consumer-side fallback, by decision on
+  cloud#1046 (option A). It is safe for the **hosted** product because the cloud
+  image pins objectui by `.objectui-sha`: cloud#1046's second half lands the
+  producer change and the pin bump in one PR, so producer and consumer flip
+  atomically and the hosted Console never runs one against the other.
+
+  **Self-hosted deployments that track objectui `main` ahead of their control
+  plane** will, until that control plane emits `error.details.*`, see the
+  entitlement dialog lose its context: the upgrade CTA falls back to
+  `/settings/billing`, `PRODUCTION_ENV_LIMIT` drops its "Contact sales" CTA,
+  `DEV_ENV_PLAN_LOCKED` says "free plan" regardless of the real plan, and
+  `DEV_ENV_LIMIT` drops the "using X of Y" counts. The dialog itself still opens
+  and its titles/messages are unaffected — `code` did not move. Upgrade the
+  control plane past cloud#1046 to restore the context.
+
+- 6e794a1: The flow designer writes node geometry as the spec's `FlowNode.position`, not its
+  own `ui: { x, y }` (objectui#3172).
+
+  FROM: dragging, adding-at-a-point and insert-on-edge each wrote `node.ui = {x, y}`
+  — a fourth-generation local spelling of a concept `@objectstack/spec` has modelled
+  as `FlowNode.position` all along. TO: all three write `position: { x, y }`, and the
+  canvas migrates on write: a stored flow's legacy `ui` is lifted onto `position` and
+  the key removed in the first patch the canvas emits, geometry-related or not.
+
+  **This is a behaviour fix, not a rename.** `FlowNodeSchema` has been `.strict()`
+  since objectstack#4001, so `ui` is an `unrecognized_keys` error: the live client
+  validation flagged the draft on every keystroke and the server rejected the save
+  with a 422. In other words, dragging a node made the flow unsavable — the
+  convergence is what makes the designer's most basic gesture round-trip again. A
+  test now parses `{ …node, ui: {x, y} }` through the spec's own schema and asserts
+  the rejection, so the claim is executed rather than argued.
+
+  Reading is backwards-compatible: `manualPosition()` prefers `position` and falls
+  back to a legacy `ui`, so a flow stored before this change still opens with its
+  nodes exactly where the author left them (pinned by a test that lays out both
+  spellings and compares the maps). The fallback is a migration path, not a second
+  contract — nothing writes `ui`, and the canvas strips it at its input boundary, so
+  no patch can re-emit it.
+
+  The geometry type is now derived from the spec by reference
+  (`FlowNodePosition = NonNullable< SpecFlowNode['position'] >`), and
+  `spec-symbol-parity.test.ts` pins the equality in both directions — including that
+  both coordinates are required, so a half-position stays unrepresentable. The
+  shape-copy in `FlowPreview.tsx` is gone; it reads the canvas's own node type, the
+  way it already read the canvas's edge type.
+
+  Breaking for anyone reading `node.ui` off a flow draft: after the author's first
+  edit the key is gone and the coordinates live under `node.position`. Nothing in
+  this repo or the engine read it — it was a designer-local key the schema rejected.
+
+- d22ae31: Track `@objectstack/spec` 17.0.0-rc.2 (objectui#3235, #3208, #3287, #3264).
+
+  The pin moves from `^17.0.0-rc.1` to `^17.0.0-rc.2` across the workspace, and
+  the sibling `@objectstack/*` packages (`client` / `core` / `formula` / `lint`)
+  move with it — they pin `@objectstack/spec` **exactly**, so leaving them behind
+  kept a second copy of the spec in the tree and would have had `@objectstack/lint`
+  validating against rc.1 schemas that still accept keys rc.2 retires.
+
+  Breaking semantics, in FROM → TO form:
+
+  - **`app.homePageId` is retired — an app's landing page is now its first
+    navigation item.** An app that pinned a landing page with `homePageId` will
+    open on the first reachable navigation entry (by `order`) instead; the root
+    landing still follows `isDefault`. To restore a specific landing page, reorder
+    `navigation` so the intended entry comes first. Stored metadata is migrated by
+    `os migrate meta --from 16`. The key is a hard error now, not a stripped one:
+    the spec ships a tombstone that names the migration.
+    Upstream retired it because of its SHAPE, not its usage — it was an ID
+    cross-reference with no referential integrity, so a `homePageId` that pointed
+    at nothing silently fell back to the first navigation item anyway
+    (objectstack#4667, premise corrected in #4709). If the capability returns, it
+    returns as a flag on the navigation item itself, which cannot dangle.
+  - **`@object-ui/types`' `HttpMethod` now resolves to the spec's
+    `HttpMethodType`.** Shape is verbatim identical — the same 5-value UI subset —
+    and `@object-ui/types` still exports it as `HttpMethod`, so no consumer
+    changes. The spec renamed its `./ui` export because `HttpMethod` named two
+    different types depending on the import path (`./shared` / `./api` carry a
+    7-value enum including `HEAD` / `OPTIONS`); objectui deliberately keeps the
+    5-value one (objectstack#4691).
+  - **`AppContextSelector.includeAll` / `placement` are gone.** Neither ever did
+    anything in this renderer: context selectors are mandatory-scope, so no "All"
+    row was ever rendered, and `placement: 'topbar'` put nothing in the topbar.
+    Both carried schema defaults, which is why the liveness lint structurally
+    could not flag them — removal was the only channel that reaches an author
+    (framework#4509).
+  - **`NavigationArea.visible` / `order` / `requiredPermissions` are gone.** An
+    area is a layout grouping, not an access boundary. Gating moved down to the
+    navigation ITEM, where `visible` and `requiredPermissions` are unchanged and
+    still enforced. `AppSchemaRenderer`'s area switcher no longer hides an area, so
+    an area whose items are all gated away renders as visible-but-empty rather
+    than disappearing.
+  - **`@object-ui/core` no longer exports `NotificationProtocol`**
+    (`resolveNotificationConfig`, `specNotificationToToast`, `mapSeverityToVariant`,
+    `mapPosition`, `ToastNotification`). It bridged `@objectstack/spec/ui`'s
+    `Notification` / `NotificationConfig`, which objectstack#4610 deleted with no
+    successor. Use `resolveNotificationConfig` from `@object-ui/react`
+    (`NotificationContext`), which owns the live `NotificationSystemConfig` and is
+    what every notification surface already read. Note that the spec's _other_
+    `Notification` — `@objectstack/spec/api` — is the REST inbox row, a different
+    contract, and is deliberately NOT aliased in as a replacement.
+  - **The `email_template` client-side validator now uses
+    `EmailTemplateDefinitionSchema`.** It was pointing at the removed
+    `EmailTemplateSchema`, so authored templates were being checked against the
+    wrong contract: the live one is keyed `name` + `locale` (not `id`) and splits
+    the body into `bodyHtml` / `bodyText` (not `body` + `bodyType`)
+    (objectstack#4616 / #4807).
+
+  Fixes that are not breaking, but were only found because rc.2 stopped being
+  lenient — each had been passing vacuously:
+
+  - **`view` drafts are actually validated now.** The client validator named the
+    aggregated container schema while this admin authors first-class `ViewItem`s,
+    and the container used to strip `viewKind` / `config` in silence — so no view
+    draft ever had one of its own keys checked. It now validates each shape
+    against its own schema (objectui#3312).
+  - **The console's worked examples were wrong**, and being stripped rather than
+    refused: `view.list.object` (the container root already declares it),
+    `job.concurrency` / `job.timeoutMs` (no such keys; the spelling is `timeout`,
+    already in ms), `email_template.from` / `.to` (a template is not a send —
+    the sender override is `fromOverride`, an object), and
+    `datasource.capabilities` / `.healthCheck` (objectstack#4583 removed the
+    former; the latter was never a datasource key). These are the drafts an
+    author — or a model generating metadata — copies.
+  - Action key inventory re-derived: `ActionSchema` gained the package-lock
+    envelope (`_lock*` / `_package*` / `_provenance`), so a packaged action no
+    longer reports them as unknown keys.
+  - The schema-diff panel labels the new `default_mismatch` finding.
+  - Test fixtures pinning the retired `managedBy: 'system'` bucket now use
+    `engine-owned`. Protocol 17 split that value (objectstack#3355), so it
+    resolved to the default-writable fallback and a batch of "stays locked"
+    assertions had quietly stopped asserting anything.
+
+### Patch Changes
+
+- 8d9984c: `AppSidebar` and `UnifiedSidebar` area switchers now adopt the derived area
+  visibility introduced for `AppSchemaRenderer` in objectui#3311, closing the
+  same visible-but-empty gap in the console shells (objectui#3319).
+
+  Both sidebars inlined their own area switcher without any area-level
+  filtering, so an area whose navigation items were **all** gated away
+  (`visible` expression, `requiredPermissions`, `requiresObject` /
+  `requiresService` capability gates) still appeared in the switcher and
+  rendered an empty navigation — and a fully gated _first_ area was even
+  auto-activated, landing the user on an empty sidebar.
+
+  ## What changed
+  - **Shared predicate, not a second implementation.** Both switchers now call
+    `hasVisibleNavigationItems` from `@object-ui/layout` — the exact guards
+    `NavigationRenderer` applies per item — so the switcher can never disagree
+    with the rendered navigation. In `UnifiedSidebar`, `action` items count as
+    content (it wires `onAction`, framework#4509); in `AppSidebar` they do not
+    (it wires none).
+  - **The active area is elected among visible areas only**: first visible by
+    default, re-elected when the active area is gated away, and a gating change
+    that merely _reveals_ an area never steals the user's current selection.
+  - `areas: any[]` tightened to `NavigationArea[]` in both components.
+
+  No authorable area-level key is introduced — visibility stays derived, per
+  the objectui#3311 ruling.
+
+- 532cf8b: Deliver the required state to the control in the five renderers outside the object form that still painted it as an asterisk only (objectui#3299 — the same defect #3290/#3298 fixed in `form.tsx`).
+
+  Each site converges on the reference shape (`EmbeddableForm.tsx`): the control carries `aria-required={required || undefined}` and the asterisk is `aria-hidden="true"`, so assistive tech announces required once, as a state — instead of hearing a bare "asterisk" folded into the accessible name, or nothing at all.
+
+  - `@object-ui/app-shell` — `ActionParamDialog` (both the boolean row and the default branch, delivered through the real field widgets' `toDomProps` whitelist) and `CreateViewDialog` (display label, machine name, and every type-specific required-field selector).
+  - `@object-ui/components` — the custom `ActionParamDialog` (all five typed branches, including the Radix select trigger) and `FieldContainer`, whose existing Slot injection (`id` / `aria-describedby` / `aria-invalid`) now also injects `aria-required`, covering every consumer in one place.
+  - `@object-ui/plugin-detail` — `InlineCreateRelated`'s create-tab inputs.
+
+  Deliberately NOT the native `required` attribute (#3290 ruling): each of these hosts runs its own validation, and native `required` would arm the browser's constraint-validation bubble beside it. The SDUI controls that already use native `required` (`renderers/form/{input,textarea,select,checkbox}.tsx`, `basic/text-input.tsx`) are unchanged — they don't have a second validator, so their channel is already correct.
+
+- 5781fb1: `@object-ui/core` now ships the server-action dispatcher factory —
+  `createServerActionHandler({ fetch, baseUrl, resolveObject, ... })` — so any
+  consumer of the runner (standalone renderers, SDUI hosts, embedded usage) can
+  run `action.body` script actions by registering the produced handler, instead
+  of dead-ending on the built-in `executeScript`'s "must be executed server-side"
+  error with no supported way to make it run (objectui#2904, the follow-up
+  objectui#2896 deferred).
+
+  The factory is deliberately opinion-free about the three things core has no
+  business deciding — auth (`fetch` is an injected authenticated wrapper), origin
+  (`baseUrl` string or thunk; no bundler env convention), and fallback object
+  scope (`resolveObject`) — and owns everything protocol-shaped, once:
+
+  - name-based action identity (ADR-0110 D1 — `target` is a binding expression,
+    never an identity);
+  - the record-id resolution dance, also exported as
+    `resolveServerActionRecordId` (`_rowRecord`, `recordIdField`, toolbar
+    selection fallback with its single/zero-select guards, aggregate
+    `_selectedIds` bypass), replaceable wholesale via `resolveRecordId` for
+    hosts with their own policy (record pages);
+  - a re-entrancy guard per action+record;
+  - the `/actions` response-envelope rule: `interpretActionResponse`,
+    `readActionPayload` and `actionErrorDetail` moved from `@object-ui/app-shell`
+    internals into core and are now public exports.
+
+  `@object-ui/app-shell`'s two hand-rolled copies of this POST —
+  `useConsoleActionRuntime.serverActionHandler` and `RecordDetailView`'s — are
+  collapsed into one console wrapper (`createConsoleServerActionHandler`) that
+  layers the browser-only choreography (popup pre-open dance, zero-roundtrip
+  `newTabUrl` fast path, `redirectUrl` convention) over the core factory. The
+  copies had already drifted twice (objectstack#3913 — envelope; framework#3935 —
+  identity, fixed in one copy only): RecordDetailView now also dispatches by
+  declarative `name` instead of `target || name`, and no longer leaks the
+  client-side `_rowRecord` stash to the server.
+
+- 68b6a28: The list toolbar's "Filter" now saves. Saving a filter from the runtime toolbar PUT the FilterBuilder's whole group object (`{ id, logic, conditions }`) into the view's `filter`, where `@objectstack/spec`'s `ListViewSchema.filter` declares `ViewFilterRule[]` — so every save came back `422 invalid_metadata` and the filter was silently never persisted (objectstack#5159).
+
+  The producer now folds the builder's group to the spec's flat `{ field, operator, value }` rule list before persisting, sharing one transform with the Studio view inspector (which had the only copy). Operators normalize through the spec's own `normalizeFilterOperator`, so the four builder operators the Studio's local table had drifted behind — `startsWith`, `endsWith`, `isNull`, `isNotNull` — now persist correctly too. The builder's per-row `id` is no longer written: it is a React list key that the read path regenerates, so stored view bodies keep the declared vocabulary only.
+
+  A filter whose shape cannot be represented losslessly as a flat rule list — `OR` across several conditions, or nested condition groups — is now refused with a translated message instead of being quietly saved as `AND`, which would have returned a different set of records than the one on screen. Such a filter still applies to the current list; it just does not become part of the saved view.
+
+- 94755bb: RecordDetailView's `type:'modal'` dispatch no longer falls back to the server-side action handler when the target resolves to neither a page nor an object. That fallthrough could never succeed — the framework rejects `type:'modal'` over REST with a 400 (`headlessActionTypeError`) — so it only converted an authoring mistake into a confusing round-trip. The record page now reports the same descriptive authoring error as the shared console runtime (objectstack#3959), naming the action, the dud target, and the way out (`type:'script'` with `params`).
+- 8e02ad7: The Page block inspector's conditional-visibility control now authors
+  `visibleWhen`, and says "Visible when" while doing it (objectui#3229).
+
+  FROM: the `ConditionBuilder` rendered for the selected page block read and wrote
+  `block.hidden`. TO: it reads and writes `block.visibleWhen`, the canonical
+  conditional-visibility key (ADR-0089), through the same envelope read/write pair
+  the hook and action guards use (objectui#3218).
+
+  `PageComponentSchema` (`ui/page.zod.ts`) is `.strict()` and has no `hidden` key
+  at all. So this was not a tolerant consumer accepting something sloppy — it was
+  the **producer emitting a key the contract rejects**: every author who filled
+  that box got a save-time parse failure naming a key they never typed, because the
+  inspector typed it for them. The spec's own error message already names the fix
+  (`` the canonical key is `visibleWhen` ``). A designer that mass-produces drafts
+  guaranteed to be rejected is a worse failure than a lenient reader — a lenient
+  reader lets wrong metadata run, this made the _correct tool_ emit the wrong thing.
+
+  The fix also closes the gap in the other direction: a **valid** block carrying
+  `visibleWhen` previously had no control in the inspector that could edit its
+  visibility, because the only visibility control on screen wrote a different key.
+  Removing the control instead would have stopped teaching the wrong key but left
+  that gap open, which is a capability regression.
+
+  **The semantic flip lands in the UI copy, not just the key.** `hidden` and
+  `visibleWhen` are inverses (`hidden` true ⇒ gone; `visibleWhen` true ⇒ shown), so
+  the label, the i18n key (`engine.inspector.pageBlock.hidden` →
+  `engine.inspector.pageBlock.visibleWhen`) and both language packs move together:
+  "Hidden (CEL)" → "Visible when (CEL)", 「隐藏条件（CEL）」→「显示条件（CEL）」.
+  Renaming the key while leaving hide-flavoured copy would have been worse than
+  leaving the bug: authors would write the predicate backwards, producing metadata
+  that PARSES and means the opposite — the objectui#3276 class, which objectui#3257's
+  guard is structurally blind to because it only asks whether a draft parses.
+
+  **No value is migrated.** An existing `hidden` expression is NOT negated into
+  `visibleWhen`: textually negating an arbitrary CEL predicate is unsound
+  (`!(a && b)` is not `!a && !b`), and there is no stored valid draft to migrate
+  anyway — since ADR-0089 D3a `hidden` is a loud parse failure on save, and before
+  D3a the key was silently dropped, so it never reached published metadata either.
+  A loud error on a rare stale draft, with the spec's message pointing at
+  `visibleWhen`, beats silently rewriting an author's predicate.
+
+  Because `visibleWhen` is `ExpressionInputSchema`, a persisted block carries the
+  `{ dialect, source }` envelope rather than the authored string, so the control
+  goes through `expressionSource` / `writeExpressionSource` — an edit preserves
+  `dialect` and `meta` and drops the stale `ast`, instead of flattening the
+  envelope to a bare string and silently swapping the evaluation engine.
+
+  Tests pin DIRECTION, not just the key name (the objectui#3276 precedent makes
+  that a hard requirement): the block the inspector actually commits is rendered
+  through `SchemaRenderer` and must appear when its predicate is true and be absent
+  when it is false, alongside assertions that the committed key is `visibleWhen`,
+  never `hidden`, and that the resulting draft parses.
+
+- a415684: The console server-action wrapper's `opensInNewTab` choreography no longer
+  ships hard-coded bilingual Chinese/English copy (objectui#3321, AGENTS.md
+  Commandment #-1): the pre-opened SSO spinner tab (title + body) and the
+  popup-blocked toast (title, description, action label) are now localized
+  through new `console.serverAction.*` keys in `@object-ui/i18n`, added at full
+  parity across all eleven locale packs.
+
+  `createConsoleServerActionHandler` gains an optional i18next-style `t` option
+  (`t(key, englishDefault)`) — the wrapper is a plain function, so the translate
+  function is injected from the two hook-context call sites
+  (`useConsoleActionRuntime`, `RecordDetailView`) via `useObjectTranslation`.
+  When omitted (tests / standalone), every string falls back to its English
+  default; no non-English copy remains in code. Locale strings are HTML-escaped
+  before being written into the spinner document.
+
+- 8ff3ad7: Five metadata designers stop rendering keys `@objectstack/spec` rejects, and start
+  rendering the keys it declares (objectui#3275, objectui#3281).
+
+  The previews and the console's sample drafts had been wrong TOGETHER, which is
+  why the gallery looked healthy. objectui#3266 corrected the samples and the
+  gallery immediately rendered LESS — agent's TOOLS and KNOWLEDGE blocks, skill's
+  TRIGGER PHRASES, app's per-item row and `Dashboard` badge, and datasource's
+  CAPABILITIES all vanished or degraded. Nothing had broken: those blocks were only
+  ever lit up by metadata that cannot be saved. This is the renderer half of that
+  finding, and the same fix objectui#3236 / PR #3258 made to `ToolPreview`.
+
+  A preview that renders a rejected key does not just show something useless — it
+  tells the author "this is correct" until publish refuses it. For AI-generated
+  metadata that is where a stale key hides and multiplies, so every read below was
+  deleted rather than kept behind a fallback (AGENTS.md #0.1).
+
+  **Retired keys, deleted** — each is a `retiredKey()` tombstone rejected by name:
+  `agent.tools` (objectstack#3894 — an agent reaches exactly the tools its skills
+  declare, ADR-0064), `agent.knowledge` (objectstack#3896 — it never scoped
+  retrieval), `skill.triggerPhrases` (objectstack#3896 — phrases were never matched
+  against a user's message).
+
+  **`AppPreview` / `AppNavCanvas`** — `AppSchema.navigation` is a discriminated
+  union on `type` whose every branch is `.strict()`. Both surfaces ignored the
+  discriminator: kind came from `it.object` / `it.dashboard`, the route from
+  `it.path ?? it.href ?? it.route ?? it.url`, and the landing from
+  `landingRoute ?? landing ?? defaultRoute ?? '/'`. Not one of those is a key
+  (`landing` was removed in objectstack#4001), so the reading was exactly inverted —
+  a valid app showed generic badges, no targets and an invented `Landing: /`. Now
+  `type` is the badge, each branch's own key is the target
+  (`objectName`/`pageName`/`dashboardName`/`url`/`reportName`/`componentRef`/
+  `actionDef.actionName`), and the route comes from `resolveHref`, the shell's own
+  nav → URL mapping that `useNavPins` and `SearchResultsPage` already share — so a
+  link in the preview is the link the runtime follows. The landing entry is
+  DERIVED, never read off the draft — it is the first navigation item that yields
+  a route, the same rule the console shell applies; `homePageId` was retired in
+  `@objectstack/spec` 17.0.0 and is not consulted.
+
+  **`DatasourcePreview`** — `capabilities` is a `DatasourceCapabilities` object of
+  boolean flags, and the preview tested `Array.isArray`, lighting the block up only
+  for the pre-17 token array the schema refuses. It now lists the flags set to
+  `true`. The `driver ?? d.type` fallback is gone (the schema's own hint is
+  `type` → `driver`), as is the `default` pill behind `isDefault ?? default` —
+  routing is declared at stack level via `datasourceMapping`, never on the
+  datasource.
+
+  **`SkillPreview`** — the trigger-conditions table read `cond.expression ??
+cond.value` under a `cond.type` gutter, so a spec-valid condition rendered as
+  `COND | sales_order` with the field it tests and the operator it applies both
+  invisible. It is now three columns — `field` / `operator` / `value` — straight off
+  `SkillTriggerConditionSchema`, and a row missing one of those required cells says
+  so instead of rendering a blank that reads as fine.
+
+  **`ValidationPreview`** (objectui#3281) — drew nine rule types where the union has
+  six. `unique`, `async` and `custom` were removed by one paragraph of
+  `validation.zod.ts`, because a rule must be a deterministic, synchronous,
+  side-effect-free predicate over one record; each now redirects to the layer that
+  does the job (a unique **index** — a SELECT-then-INSERT rule is racy, TOCTOU — a
+  form-layer check, a lifecycle hook). Two alias fallbacks went with them:
+  `condition ?? expression` and `pattern ?? regex`, where neither `expression` nor
+  `pattern` has ever been a key on any branch — which is precisely why a bogus
+  `expression` sat unnoticed in the console sample. Two branches were also simply
+  wrong: `conditional` read `condition` instead of its `when` (a valid rule showed
+  "No expression set", and its nested `then`/`otherwise` now render), and
+  `json_schema` had no branch at all, so a valid rule displayed "Unknown rule type".
+
+  `validation.object` is deliberately still read: `anchors.ts` registers a
+  standalone `validation` resource matched by `anchorByField('object')`, so a
+  standalone rule genuinely carries it. Not every key a union omits is residue.
+
+  Verified in the preview gallery before and after, per designer; each preview also
+  gains tests that feed a spec-valid draft and assert the block renders, then feed a
+  stale draft carrying the retired key and assert nothing renders from it.
+
+- 12bf669: The record discussion panel now says "loading" while it is loading, instead of
+  "No comments yet" (objectui#3209).
+
+  FROM: opening any record page showed the discussion/chatter panel asserting
+  `No comments yet` for the whole first leg of the page, then contradicting
+  itself when the comments appeared. TO: the panel shows the loading row until
+  the feed has actually answered, and only then commits to "this record has no
+  comments".
+
+  objectui#3205 gave `RecordActivityTimeline` the render branch that prefers a
+  loading row over the empty copy, and `RecordChatterPanel` already forwarded
+  `loading` to it in both positions — but on the chatter chain **nothing
+  produced the signal**, so that branch could never fire. `record:activity`
+  computes its own flag and was visibly fixed by #3205; chatter was not. The
+  four wiring points are one chain and are all closed here, because any one of
+  them left open still ships the empty copy to some user:
+
+  - `RecordDetailView` — the host that OWNS the feed fetch — now derives a
+    `feedLoading` flag from its two reads (`sys_comment` + `sys_activity`);
+  - `<DiscussionContextProvider loading={feedLoading}>` publishes it (the field
+    was already declared on `DiscussionContextValue`, and already read by
+    `record:activity`);
+  - the auto-appended `<RecordChatterPanel loading={feedLoading}>` — the panel
+    authored pages get when they place no discussion slot — receives it
+    directly;
+  - the `record:chatter` / `record:discussion` renderer forwards
+    `loading={discussion?.loading}`, so a hand-placed block is on the same
+    chain as the synthesized one.
+
+  The two reads run in parallel, so the flag closes over **both**: it clears on
+  `Promise.allSettled`, and a REJECTED read counts as an answer. A deployment
+  without the audit plugin 404s `sys_activity` and an object with
+  `enable.feeds: false` 403s `sys_comment`; neither may pin the panel in a
+  permanent spinner, which would be a worse bug than the one being fixed. The
+  flag is keyed by `object:recordId` rather than being a plain boolean, so the
+  first render of a record already reads as loading (no one-frame flash of the
+  empty state) and navigating between records cannot show the previous record's
+  settled answer.
+
+  No tolerance was added at the consumer. The timeline still does not guess that
+  "no items yet and just mounted" means loading — that guess is wrong the moment
+  a record genuinely has no comments, and the signal belongs to whoever owns the
+  fetch. Same shape as objectui#3165 / #3205: divergence converges at the
+  producer.
+
+- a8aa576: The record discussion panel no longer shows the PREVIOUS record's comments and
+  activity (objectui#3268).
+
+  FROM: clicking from record A to record B in a list left A's comments and
+  activity rows on B's discussion panel, with B's own rows merged in alongside
+  them. TO: each record's panel shows that record's feed and nothing else, and a
+  record that is still being fetched shows the loading row rather than the
+  record the user just came from.
+
+  This was cross-record data display, not a cosmetic glitch. `RecordDetailView`
+  is deliberately NOT remounted between records — no mount site passes a `key=`
+  (`console/AppContent.tsx`, and the `ObjectView` / `ObjectDataPage` /
+  `InterfaceListPage` drawers just swap `recordIdOverride`), per objectui#2269
+  "refresh data, don't rebuild UI" — so its feed state survived the navigation,
+  and both reads (`sys_comment`, `sys_activity`) merged into it BY ROW ID. A's
+  rows and B's rows have different ids, so the merge could not dedupe them away
+  and nothing anywhere reset the list.
+
+  It also suppressed the fix objectui#3209 had just shipped. On record→record
+  navigation `feedLoading` did flip true, but `RecordActivityTimeline`'s branch
+  is `loading && filtered.length === 0` (objectui#3205, deliberate: a refresh
+  must not turn an on-screen feed into a spinner) and the leftover rows kept
+  `filtered` non-empty — so the panel rendered the previous record's content
+  where a loading state belonged. The two issues only add up to a working
+  feature together.
+
+  The feed state is now keyed by `objectName:recordId` — the same key
+  objectui#3209 introduced in this file for the loading flag, and the very
+  `thread_id` the rows carry server-side. The render reads only the current
+  key's slice, so "empty for a new record" FALLS OUT of reading a key that has
+  no slice; there is no `setFeedItems([])` racing the fetch that fills it. A
+  response that lands after the user has navigated away is written under the key
+  its effect closed over, so it updates the record it was fetched for and can
+  never bleed into the record now on screen — the same guarantee `settledFeedKey`
+  already gave the loading flag. One idiom in this file, not two.
+
+  Keying rather than clearing is what keeps OPTIMISTIC rows safe. A comment the
+  user has just posted but that has not come back from the server lives only in
+  this state, and it now rides in its own record's slice: navigating away and
+  back finds it again, and it never appears on another record's panel. Nothing
+  deletes a slice, so returning to a record shows its rows immediately while the
+  re-read confirms them (objectui#3205 again), and the re-read folds the
+  persisted copy onto the optimistic row by id — same id, because that is the id
+  it was created under — so there is no duplicate when it lands. The same
+  scoping applies to threaded replies and reaction toggles.
+
+  No tolerance was added at the consumer. `RecordActivityTimeline` still keeps
+  `loading && filtered.length === 0` exactly as objectui#3205 wrote it; once the
+  feed's lifecycle is correct that condition is right on its own. Weakening it
+  would have been treating the symptom at the consumer, which is what
+  objectui#3165 / #3205 / #3209 all deliberately avoided.
+
+- 30ac2e1: `ToolPreview` stops advertising retired `ToolSchema` flags (objectui#3236).
+
+  The metadata-admin tool preview painted a header strip of flag pills read
+  straight off the raw draft: `Requires confirmation`, `Active` / `Disabled`,
+  `built-in`, and the `category` tag. All four keys have been removed from
+  `@objectstack/spec`'s `ToolSchema` — `requiresConfirmation` in the 16.x line
+  (objectstack#3715, ADR-0033 §2) and `category` / `active` / `builtIn` in
+  17.0.0 (objectstack#3896 audit close-out). The schema is `.strict()` and now
+  rejects each by name with an upgrade prescription, so no newly authored tool
+  can carry them; verified against the `@objectstack/spec@17.0.0-rc.1` this repo
+  depends on.
+
+  New metadata could not reach these pills — but rows stored before the removals
+  still carry the keys, and for those the preview kept rendering. That is the
+  harmful direction, not a cosmetic one:
+
+  - `Requires confirmation` advertised a safety pause that no execution path has
+    ever performed. Nothing read the key — not the LLM tool set (a tool reaches
+    the model as name/description/parameters only), not `ToolRegistry.execute`,
+    not `POST /ai/tools/:name/execute`. A reviewer reading the preview saw a
+    destructive tool marked as gated when it was not. The real gate is
+    `action.ai.requiresConfirmation`, which the HITL approval queue reads.
+  - `Disabled` claimed a tool had been withdrawn while `ToolRegistry.getAll()`
+    kept handing it to the LLM and the execute route kept running it.
+
+  Same shape as objectui#2962: a UI badge advertising a capability the runtime
+  does not have. The pills are gone; the surviving header strip shows label,
+  machine name and the `objectName` pill (`objectName` is still a live spec key),
+  and nothing else in the preview changed — parameters table, example LLM call
+  and output schema are untouched.
+
+  New tests feed the preview a stale draft that still carries all four retired
+  keys and assert none of them renders, so the pills cannot grow back: the names
+  survive in the spec's tombstone guidance, which gives the next reader a
+  plausible-looking reason to "restore" them.
+
+- Updated dependencies [b7165ce]
+- Updated dependencies [608669e]
+- Updated dependencies [532cf8b]
+- Updated dependencies [680080a]
+- Updated dependencies [a7651e6]
+- Updated dependencies [34595eb]
+- Updated dependencies [5781fb1]
+- Updated dependencies [19b8c9b]
+- Updated dependencies [56409c2]
+- Updated dependencies [042e09d]
+- Updated dependencies [23018cc]
+- Updated dependencies [68b6a28]
+- Updated dependencies [f44d872]
+- Updated dependencies [825bbe3]
+- Updated dependencies [d2363e7]
+- Updated dependencies [a415684]
+- Updated dependencies [9bc3709]
+- Updated dependencies [f833d3a]
+- Updated dependencies [30ae33a]
+- Updated dependencies [49f7449]
+- Updated dependencies [d22ae31]
+- Updated dependencies [c7ed4c3]
+- Updated dependencies [a321fa4]
+- Updated dependencies [8d8094a]
+  - @object-ui/fields@17.3.0
+  - @object-ui/layout@17.3.0
+  - @object-ui/components@17.3.0
+  - @object-ui/core@17.3.0
+  - @object-ui/types@17.3.0
+  - @object-ui/i18n@17.3.0
+  - @object-ui/data-objectstack@17.3.0
+  - @object-ui/plugin-editor@17.3.0
+  - @object-ui/react@17.3.0
+  - @object-ui/auth@17.3.0
+  - @object-ui/collaboration@17.3.0
+  - @object-ui/permissions@17.3.0
+  - @object-ui/providers@17.3.0
+
 ## 17.2.0
 
 ### Minor Changes
diff --git a/packages/app-shell/package.json b/packages/app-shell/package.json
index be05163623..e0f4d88b4d 100644
--- a/packages/app-shell/package.json
+++ b/packages/app-shell/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/app-shell",
-  "version": "17.2.0",
+  "version": "17.3.0",
   "type": "module",
   "license": "MIT",
   "description": "Minimal application shell for ObjectUI - framework-agnostic rendering engine",
diff --git a/packages/auth/CHANGELOG.md b/packages/auth/CHANGELOG.md
index 61337673c9..4a7c395cec 100644
--- a/packages/auth/CHANGELOG.md
+++ b/packages/auth/CHANGELOG.md
@@ -1,5 +1,15 @@
 # @object-ui/auth
 
+## 17.3.0
+
+### Patch Changes
+
+- Updated dependencies [23018cc]
+- Updated dependencies [f44d872]
+- Updated dependencies [f833d3a]
+- Updated dependencies [d22ae31]
+  - @object-ui/types@17.3.0
+
 ## 17.2.0
 
 ### Minor Changes
diff --git a/packages/auth/package.json b/packages/auth/package.json
index a71b902e5c..003562487a 100644
--- a/packages/auth/package.json
+++ b/packages/auth/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/auth",
-  "version": "17.2.0",
+  "version": "17.3.0",
   "type": "module",
   "license": "MIT",
   "description": "Authentication system for Object UI with AuthProvider, useAuth hook, AuthGuard, and form components.",
diff --git a/packages/cli/CHANGELOG.md b/packages/cli/CHANGELOG.md
index 2f12436f9d..5a3b1dd837 100644
--- a/packages/cli/CHANGELOG.md
+++ b/packages/cli/CHANGELOG.md
@@ -1,5 +1,25 @@
 # @object-ui/cli
 
+## 17.3.0
+
+### Patch Changes
+
+- Updated dependencies [532cf8b]
+- Updated dependencies [680080a]
+- Updated dependencies [a7651e6]
+- Updated dependencies [34595eb]
+- Updated dependencies [56409c2]
+- Updated dependencies [042e09d]
+- Updated dependencies [23018cc]
+- Updated dependencies [f44d872]
+- Updated dependencies [825bbe3]
+- Updated dependencies [f833d3a]
+- Updated dependencies [d22ae31]
+- Updated dependencies [8d8094a]
+  - @object-ui/components@17.3.0
+  - @object-ui/types@17.3.0
+  - @object-ui/react@17.3.0
+
 ## 17.2.0
 
 ### Patch Changes
diff --git a/packages/cli/package.json b/packages/cli/package.json
index e4bfcccaf7..9db12381b7 100644
--- a/packages/cli/package.json
+++ b/packages/cli/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/cli",
-  "version": "17.2.0",
+  "version": "17.3.0",
   "description": "Standalone CLI for Object UI — scaffold, develop, build and validate JSON/YAML schema-driven applications.",
   "type": "module",
   "homepage": "https://www.objectui.org/docs/utilities/cli",
diff --git a/packages/collaboration/CHANGELOG.md b/packages/collaboration/CHANGELOG.md
index 30a9884e52..3c958156d0 100644
--- a/packages/collaboration/CHANGELOG.md
+++ b/packages/collaboration/CHANGELOG.md
@@ -1,5 +1,15 @@
 # @object-ui/collaboration
 
+## 17.3.0
+
+### Patch Changes
+
+- Updated dependencies [23018cc]
+- Updated dependencies [f44d872]
+- Updated dependencies [f833d3a]
+- Updated dependencies [d22ae31]
+  - @object-ui/types@17.3.0
+
 ## 17.2.0
 
 ### Minor Changes
diff --git a/packages/collaboration/package.json b/packages/collaboration/package.json
index c8b31410fe..fc5f94badf 100644
--- a/packages/collaboration/package.json
+++ b/packages/collaboration/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/collaboration",
-  "version": "17.2.0",
+  "version": "17.3.0",
   "type": "module",
   "license": "MIT",
   "description": "Real-time collaboration for Object UI with presence tracking, live cursors, conflict resolution, and comment threads.",
diff --git a/packages/components/CHANGELOG.md b/packages/components/CHANGELOG.md
index edc3934da4..1d7512ddbb 100644
--- a/packages/components/CHANGELOG.md
+++ b/packages/components/CHANGELOG.md
@@ -1,5 +1,351 @@
 # @object-ui/components
 
+## 17.3.0
+
+### Minor Changes
+
+- 56409c2: Field widgets are finally told when their field fails validation, and the props
+  slot that carries it takes the name the published contract gives it
+  (objectui#3222).
+
+  **Breaking** for anyone implementing a field widget (see migration below). The
+  repo version policy keeps this a `minor` — objectui's major tracks
+  `@objectstack`'s — so read the bump as "breaking within objectui".
+
+  ## The a11y defect this fixes
+
+  `@objectstack/spec/ui`'s `FieldWidgetPropsSchema` — the published contract that
+  third-party and AI-authored field widgets are written against — has always
+  declared `error?: string`. `@object-ui/fields` declared its own slot as
+  `errorMessage`. That looked like a naming split; it was worse:
+
+  ```
+  producers of `errorMessage` anywhere in packages/ + apps/ :  0
+  reads of `errorMessage` in packages/fields/src            : 15  (7 widgets)
+  reads of `props.error`                                    :  0
+  ```
+
+  The slot was dead under BOTH spellings. No host ever passed it: the form
+  renderer showed validation text through its own `<FormMessage/>` and never
+  forwarded the prop. So `EmailField`, `CurrencyField`, `UrlField`,
+  `RichTextField`, `PercentField`, `TextAreaField` and `PhoneField` each computed
+  `aria-invalid={!!errorMessage}` from a value that was `undefined` forever —
+  **`aria-invalid` had never once been set, and a screen reader was never told
+  the field had failed validation.**
+
+  Worse than "never set": `<FormControl>` is a Radix `Slot` that hands its child a
+  CORRECT `aria-invalid`, but a widget's own attribute is written after the props
+  spread, so it wins. Those seven widgets were actively overwriting the right
+  answer with `false`.
+
+  FROM: `renderFieldComponent` received no validation state, and the widget props
+  type declared `errorMessage?: string`, which nothing produced.
+  TO: the form renderer passes react-hook-form's `fieldState.error?.message` down
+  as `error` when it renders a registered widget, and the props type declares
+  `error?: string`. Both ends of the contract are live for the first time; a
+  rename alone would only have swapped one dead key for another.
+
+  ## Migration for widget authors
+
+  ```diff
+  -export function MyField({ value, onChange, field, readonly, errorMessage }: FieldWidgetComponentProps< string >) {
+  -  return <Input value={value} aria-invalid={!!errorMessage} />;
+  +export function MyField({ value, onChange, field, readonly, error }: FieldWidgetComponentProps< string >) {
+  +  return <Input value={value} aria-invalid={!!error} />;
+  ```
+
+  No alias is kept. `errorMessage` was retained nowhere on purpose — a tolerant
+  second spelling is exactly the de-facto second contract AGENTS.md #0.1 forbids,
+  and it is what would let a missed call site go quiet again. Because
+  objectui#3221 had already removed the type's `[key: string]: any`, every missed
+  site is a compile error rather than a silent `any`, so the compiler — not grep
+  — validated this rename.
+
+  ## Responsibilities are split, not duplicated
+
+  The widget consumes `error` **only** to drive `aria-invalid` on the control it
+  renders (which only it can do — `aria-invalid` has to sit on the input element).
+  The message TEXT stays with `<FormMessage/>` in the form renderer. A widget that
+  also renders the text double-displays it, and the docs, the agent prompt and the
+  tests all now say so.
+
+  For the same reason `required` — also declared by the spec, also never delivered
+  — is deliberately NOT lowered into widget props: the required marker has exactly
+  one author, the renderer's `<FormLabel>`, and giving widgets the flag invites a
+  second asterisk. The a11y state a widget could legitimately carry is
+  `aria-required`, which needs no contract change at all (`AriaAttributes` is
+  already part of the type and widgets already forward it).
+
+  Builtin field types are unaffected: they render inside `<FormControl>`, whose
+  Slot already supplies `aria-invalid`, so `error` is stripped there rather than
+  leaking into the DOM as a stray attribute.
+
+  Docs updated to match: `content/docs/guide/plugin-development.md`,
+  `skills/objectui/guides/plugin-development.md` and
+  `.github/prompts/component.prompt.md` — the last of which additionally used the
+  spec's non-generic type alias as a generic (`FieldWidgetProps< number >`) and
+  destructured a `mode` prop that exists on neither type.
+
+- 042e09d: **BREAKING (v17)** — field widgets receive their metadata on ONE key, `field`.
+  `schema` is removed from the widget contract (objectui#3233).
+
+  ## What changed
+
+  `schema` was a second carrier for what `field` already means. Two producers fed
+  it: `SchemaRenderer` passed the authored node as `schema`, and the form
+  renderer's `renderFieldComponent` passed `schema={props.field || props.schema ||
+props}` _alongside_ `field`. The predictable result was ~30 widgets resolving
+  their config as `field || schema` — one concept, two spellings, a de-facto
+  second contract (AGENTS.md #0.1).
+
+  - `FieldWidgetComponentProps` no longer declares `schema`. Reading
+    `props.schema` is now a compile error, not a silent `any`.
+  - Both producers converged. The form renderer passes `field` only. The SDUI node
+    → `field` translation happens exactly once, in a new registration adapter
+    (`withFieldCarrier`), which every built-in field widget is registered through.
+  - All `field || schema` reads in `@object-ui/fields` are now plain `field` reads.
+
+  ## Migrating a widget you wrote
+
+  **Reading the metadata** — replace the fallback with the single key:
+
+  ```diff
+  -const config = field || (props as any).schema;
+  +const config = field;
+  ```
+
+  **Registering a widget** — if your widget can be rendered from a schema node
+  (anything `SchemaRenderer` dispatches, not just forms), wrap it once so it still
+  gets `field`:
+
+  ```diff
+  +import { withFieldCarrier } from '@object-ui/fields';
+  +
+  -ComponentRegistry.register('color', ColorField, { namespace: 'field' });
+  +ComponentRegistry.register('color', withFieldCarrier(ColorField), { namespace: 'field' });
+  ```
+
+  `withFieldCarrier` forwards the node **by reference** — nothing is copied,
+  narrowed or renamed — and consumes `schema` so it cannot reach the DOM through a
+  widget's `...props` spread.
+
+  A third-party widget that still reads `props.schema` and is **not** re-registered
+  through the adapter will read `undefined` in v17 and silently render an empty /
+  default state. That is the deliberate cost of a major boundary: one contract
+  beats N dialects, and a widget that picks the wrong spelling should fail at
+  compile time rather than work under one host and not another.
+
+  ## What did NOT change
+  - **Host metadata (SDUI JSON) is untouched.** No authored schema changes; this is
+    a change to how widgets are _written_, not to what apps declare.
+  - **`schema` is still the universal SDUI prop** every registered component
+    receives from `SchemaRenderer` (`element:*`, `page:*`, grids, reports). Only
+    the _field-widget_ contract retired it. In particular `renderFieldComponent`
+    still passes `schema` when a form field type resolves to a plain component
+    through the bare-name fallback (e.g. `type: 'text'` reaching the display text
+    widget) — that component's contract is the node, and dropping it there would
+    render `undefined.className`.
+
+  ## Payload equivalence
+
+  Every path that used to deliver a payload through `schema` now delivers the
+  identical object through `field`, and both halves are pinned by tests asserting
+  **object identity**, not shape:
+
+  - form path — `packages/components/src/renderers/form/__tests__/form-field-carrier.test.tsx`
+  - SDUI path — `packages/fields/src/__tests__/field-carrier-sdui.test.tsx`
+
+### Patch Changes
+
+- 532cf8b: Deliver the required state to the control in the five renderers outside the object form that still painted it as an asterisk only (objectui#3299 — the same defect #3290/#3298 fixed in `form.tsx`).
+
+  Each site converges on the reference shape (`EmbeddableForm.tsx`): the control carries `aria-required={required || undefined}` and the asterisk is `aria-hidden="true"`, so assistive tech announces required once, as a state — instead of hearing a bare "asterisk" folded into the accessible name, or nothing at all.
+
+  - `@object-ui/app-shell` — `ActionParamDialog` (both the boolean row and the default branch, delivered through the real field widgets' `toDomProps` whitelist) and `CreateViewDialog` (display label, machine name, and every type-specific required-field selector).
+  - `@object-ui/components` — the custom `ActionParamDialog` (all five typed branches, including the Radix select trigger) and `FieldContainer`, whose existing Slot injection (`id` / `aria-describedby` / `aria-invalid`) now also injects `aria-required`, covering every consumer in one place.
+  - `@object-ui/plugin-detail` — `InlineCreateRelated`'s create-tab inputs.
+
+  Deliberately NOT the native `required` attribute (#3290 ruling): each of these hosts runs its own validation, and native `required` would arm the browser's constraint-validation bubble beside it. The SDUI controls that already use native `required` (`renderers/form/{input,textarea,select,checkbox}.tsx`, `basic/text-input.tsx`) are unchanged — they don't have a second validator, so their channel is already correct.
+
+- 680080a: The required state now reaches the input control as `aria-required`, instead of
+  existing only as part of the control's accessible name (objectui#3290).
+
+  The form renderer has always computed a correct `required` — the static
+  `required` flag merged with the `requiredWhen` CEL verdict — and then spent it
+  on exactly one thing: the red asterisk in `<FormLabel>`. That asterisk carried
+  `aria-label="required"`, so the only path from the computed state to assistive
+  tech was `<label for>` folding it into the control's **accessible name**: the
+  field was announced as "Title required".
+
+  A state smuggled through a name is broken three ways:
+
+  - it is read in name order rather than announced as a state, and "list the
+    required fields" style navigation cannot see it at all;
+  - a field rendered without a `label` (compact layouts, inline grid editing)
+    draws no asterisk, so the signal disappears entirely;
+  - `requiredWhen` makes required **dynamic**, and a state channel can express
+    the flip where a name cannot.
+
+  ## What changed
+  - Every field control — built-in (`input` / `textarea` / `checkbox` / `switch` /
+    `select`) and registered widget alike — now receives `aria-required="true"`
+    when the field resolves required, and **no attribute at all** when it does
+    not. Absence rather than `aria-required="false"` is deliberate: it is what
+    the `requiredWhen`-turns-false case has to produce.
+  - The red asterisk is now `aria-hidden="true"` and no longer carries
+    `aria-label="required"`. It renders exactly as before for sighted users; it
+    simply stops being announced, so the state is reported once (as a state) and
+    not twice.
+
+  **No field widget needed a change.** `aria-required` is already declared and
+  typed on the widget props contract (`FieldWidgetComponentProps &
+AriaAttributes`) and every widget forwards its leftover props to the control it
+  renders, so all 48 widgets pick it up unmodified.
+
+  Two non-changes, both deliberate:
+
+  - **No native `required` attribute.** That would arm the browser's own
+    constraint-validation bubble alongside react-hook-form's `<FormMessage/>` —
+    two validators, two UIs, one field. `aria-required` reports the state without
+    triggering native validation.
+  - **No `required` boolean in the widget props contract.** A boolean would give
+    the required marker a second author, and the next widget draws its own
+    asterisk next to the renderer's — the double-display failure objectui#3222
+    already declined for the validation message.
+
+  If you select the asterisk in a test, it is now
+  `span[data-required-marker]` — an explicit locator, rather than an
+  accessibility attribute doubling as a test hook.
+
+- a7651e6: The form renderer's built-in `select` branch stops saying "No options available"
+  in English to non-English sessions (objectui#3263).
+
+  FROM: the inline branch that renders a `type: 'select'` field — the one taken
+  whenever the field is a `BUILTIN_FIELD_TYPES` member, i.e. before the `field:`
+  registry is consulted — rendered `{emptyHint || 'No options available'}`. TO:
+  `{emptyHint || t('fields.options.empty')}`, the same i18n key the registered
+  option widgets fall back to (objectui#3231, all ten locale packs).
+
+  This was the last hardcoded copy of that sentence in `form.tsx`, and the file was
+  half-translated in a way a user could see inside one widget: the dependency-gate
+  sentence next to it already went through `t()`
+  (`fields.options.selectFirst`), so under a `zh` session a gated select read
+  "请先选择Country" and the same select — one keystroke later, when the parent
+  value matched no option — flipped to English.
+
+  `fields.options.empty` is added to `useSafeFormTranslation`'s defaults map, the
+  pattern `fields.options.selectFirst` already follows there, so a form rendered
+  with no `I18nProvider` (standalone widget, test, embedded form) produces the
+  byte-identical English string it produced before. Both halves are pinned by
+  tests: the Chinese rendering in one file, the no-provider English fallback in
+  another (mounting a provider installs it as react-i18next's global default,
+  which would erase the state the second one observes).
+
+  The box moved from an inline `<div>` into a small `BuiltinSelectEmptyState`
+  component in the same file, because `renderFieldComponent` is a plain helper that
+  early-returns on the registered-widget path — a hook called there would run
+  conditionally. It forwards its rest props, since `<FormControl>` is a Radix
+  `Slot` that supplies the control's `id` / `aria-describedby`; a test pins that
+  the field's `<label for>` still resolves to this box.
+
+  Deliberately NOT unified with `@object-ui/fields`' `OptionsEmptyState`: different
+  package, different render path (inline branch vs. registry). What the two share
+  is the i18n key, not a component — merging them would impose one path's markup
+  and props on the other.
+
+- 34595eb: The Combobox trigger now declares `type="button"` explicitly, so it can never
+  submit an enclosing `<form>` (objectui#3344). The current Radix
+  `PopoverTrigger` happens to supply `type="button"` through its Slot, but that
+  form-safety guarantee was an upstream implementation detail — it is now a
+  locally declared, regression-tested contract, matching the explicit style of
+  LookupField / MultiSelectField / RatingField. The default sits before the
+  trigger pass-through spread (objectui#3318), so a consumer who explicitly
+  passes `type` (e.g. `type="submit"`) still wins.
+- 825bbe3: The option widgets' "this list cannot be filled" message now has one source, and
+  it is translated (objectui#3231).
+
+  FROM: `SelectField`, `MultiSelectField`, `RadioField` and `CheckboxesField` each
+  carried their own copy of the empty/gated state, each destructured the declared
+  `emptyHint` prop into `_emptyHint` and dropped it, and each rendered a hardcoded
+  English literal (`'No options available'`, `` `Select ${…} first` ``) even in a
+  Chinese or Japanese session. TO: one shared `OptionsEmptyState` — the host's
+  `emptyHint` when it supplied one, otherwise a translated fallback
+  (`fields.options.empty` / `fields.options.selectFirst`, added to all ten locale
+  packs).
+
+  `emptyHint` was declared, produced by the form renderer and transported, then
+  lost three times over — so no registered widget could ever render it. All three
+  breaks are fixed, because closing only the last one delivers nothing:
+
+  - `isOptionField` compared the raw resolved type against `'select'` /`'radio'` /
+    `'multiselect'` / `'checkboxes'`. Object-derived forms emit
+    `mapFieldTypeToFormType`'s prefixed ids (`field:select`), which matched none of
+    them, so for every option field coming from an object schema — the normal case
+    in the console — the whole cascade block was skipped and no hint was computed
+    at all. It now normalizes the `field:` prefix, the same normalization
+    `stripRegisteredFieldProps` already applied a few lines below.
+  - `stripRegisteredFieldProps` then removed the `emptyHint` key from what was
+    left. It is now forwarded to the four cascade option types, alongside
+    `dependentValues`. This stays an allow-list rather than a blanket
+    pass-through: every other registered widget spreads its leftover props onto a
+    DOM node, where an unknown `emptyHint` attribute is a React warning.
+  - the widgets themselves discarded it. Keeping it out of the `...props` spread
+    was correct; not using it afterwards was not.
+
+  User-visible effect: a dependency-gated option list now prompts with the
+  controlling field's **label** ("Select Country first") instead of its raw
+  metadata name, in the session's language; an unconfigured list says so in the
+  session's language too. The gate sentence is one i18n key shared by the renderer
+  and the widget fallback, so the two sides cannot word it differently.
+
+  Untouched: the built-in (unregistered) `select` branch of the form renderer,
+  which already consumed `emptyHint`. That is a separate live path.
+
+- 8d8094a: 20 more registered field widgets now announce a failed validation to assistive
+  tech: `multiselect`, `radio`, `checkboxes`, `tags`, `lookup`, `master_detail`,
+  `user`, `owner`, `file`, `image`, `location`, `object`, `color`, `rating`,
+  `code`, `avatar`, `address`, `geolocation`, `qrcode` and `object-ref` carry
+  `aria-invalid="true"` on their real focusable control after a validation
+  failure, where before the red message rendered while a screen reader was told
+  nothing (objectui#3318, the registry-wide gap objectui#3306's sweep measured).
+
+  Each widget follows the objectui#3222/#3306 pattern: the `toDomProps(props)`
+  whitelist spread goes onto the control the user actually focuses — the input,
+  the lookup trigger button, the radiogroup (`role="radiogroup"` is the
+  ARIA-designated carrier for a set of radios), every chip/checkbox/star of the
+  composite option widgets, the upload dropzone/button — followed by an explicit
+  `aria-invalid={!!error}` computed from the published `error` slot. Wrapper
+  `<div>`s never carry the state, and `name` is withheld from non-form-control
+  elements (the objectui#3291 leak class).
+
+  `Combobox` (`@object-ui/components`) now accepts standard button attributes
+  and forwards them to its focusable `role="combobox"` trigger, giving
+  combobox-based widgets an element to deliver `aria-invalid` /
+  `aria-describedby` to — the same seam objectui#3306 opened on
+  `SelectTrigger`.
+
+  Nine types remain on the objectui#3318 ratchet ledger with their blockers
+  documented there (`formula`/`summary`/`auto_number`/`vector` render no
+  focusable control; `grid`, `slider`, `signature` need component-level design;
+  `filter-condition`/`recipient-picker` deliver in their editable states but
+  render a dependency-gate hint with no control in a fresh form).
+
+- Updated dependencies [5781fb1]
+- Updated dependencies [23018cc]
+- Updated dependencies [68b6a28]
+- Updated dependencies [f44d872]
+- Updated dependencies [825bbe3]
+- Updated dependencies [a415684]
+- Updated dependencies [f833d3a]
+- Updated dependencies [d22ae31]
+- Updated dependencies [c7ed4c3]
+  - @object-ui/core@17.3.0
+  - @object-ui/types@17.3.0
+  - @object-ui/i18n@17.3.0
+  - @object-ui/react@17.3.0
+  - @object-ui/sdui-parser@17.3.0
+  - @object-ui/react-runtime@17.3.0
+
 ## 17.2.0
 
 ### Minor Changes
diff --git a/packages/components/package.json b/packages/components/package.json
index 88cdada349..0366da6961 100644
--- a/packages/components/package.json
+++ b/packages/components/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/components",
-  "version": "17.2.0",
+  "version": "17.3.0",
   "type": "module",
   "license": "MIT",
   "description": "Standard UI component library for Object UI, built with Shadcn UI + Tailwind CSS",
diff --git a/packages/core/CHANGELOG.md b/packages/core/CHANGELOG.md
index 161e109d13..f738dcd29c 100644
--- a/packages/core/CHANGELOG.md
+++ b/packages/core/CHANGELOG.md
@@ -1,5 +1,178 @@
 # @object-ui/core
 
+## 17.3.0
+
+### Minor Changes
+
+- 5781fb1: `@object-ui/core` now ships the server-action dispatcher factory —
+  `createServerActionHandler({ fetch, baseUrl, resolveObject, ... })` — so any
+  consumer of the runner (standalone renderers, SDUI hosts, embedded usage) can
+  run `action.body` script actions by registering the produced handler, instead
+  of dead-ending on the built-in `executeScript`'s "must be executed server-side"
+  error with no supported way to make it run (objectui#2904, the follow-up
+  objectui#2896 deferred).
+
+  The factory is deliberately opinion-free about the three things core has no
+  business deciding — auth (`fetch` is an injected authenticated wrapper), origin
+  (`baseUrl` string or thunk; no bundler env convention), and fallback object
+  scope (`resolveObject`) — and owns everything protocol-shaped, once:
+
+  - name-based action identity (ADR-0110 D1 — `target` is a binding expression,
+    never an identity);
+  - the record-id resolution dance, also exported as
+    `resolveServerActionRecordId` (`_rowRecord`, `recordIdField`, toolbar
+    selection fallback with its single/zero-select guards, aggregate
+    `_selectedIds` bypass), replaceable wholesale via `resolveRecordId` for
+    hosts with their own policy (record pages);
+  - a re-entrancy guard per action+record;
+  - the `/actions` response-envelope rule: `interpretActionResponse`,
+    `readActionPayload` and `actionErrorDetail` moved from `@object-ui/app-shell`
+    internals into core and are now public exports.
+
+  `@object-ui/app-shell`'s two hand-rolled copies of this POST —
+  `useConsoleActionRuntime.serverActionHandler` and `RecordDetailView`'s — are
+  collapsed into one console wrapper (`createConsoleServerActionHandler`) that
+  layers the browser-only choreography (popup pre-open dance, zero-roundtrip
+  `newTabUrl` fast path, `redirectUrl` convention) over the core factory. The
+  copies had already drifted twice (objectstack#3913 — envelope; framework#3935 —
+  identity, fixed in one copy only): RecordDetailView now also dispatches by
+  declarative `name` instead of `target || name`, and no longer leaks the
+  client-side `_rowRecord` stash to the server.
+
+- f833d3a: Retire `validation` from the action-param contract — it was declared on both
+  halves, read by neither, and rejected outright by the server (objectui#3201).
+
+  FROM: `validation?: string` was declared on the AUTHORING type
+  (`@object-ui/types`' `ActionParam`) and on the RESOLVED type (`@object-ui/core`'s
+  `ActionParamDef`). TO: it is declared on neither.
+
+  **Breaking for anyone who declared it — but it never did anything.** This is
+  marked `minor`, not `major`, per the repo's version-alignment policy (objectui's
+  major tracks `@objectstack`'s, so objectui's own breaking changes ship as `minor`
+  with the breaking semantics spelled out here).
+
+  **Migration: delete it.** If you authored `validation: '...'` on an action param,
+  it never took effect, and publishing that metadata to the server is a hard parse
+  failure — so any metadata that reached production either never carried the key or
+  never parsed. Removing it changes no runtime behaviour; it only moves the error
+  from "silent no-op, then rejected at publish" to a `tsc` error at the keystroke.
+
+  Why it could not work as authored:
+
+  - `ActionParamSchema` in `@objectstack/spec/ui` is `.strict()` and does not list
+    `validation`, so an authored key is a PARSE REJECTION on the server:
+    `Unrecognized key(s) on this action param: \`validation\``. Meanwhile `tsc`
+    against the public type accepted it — the type vouched for a key the platform
+    itself refuses.
+  - Nothing read it on the resolved side either: it was never a key of
+    `resolveActionParams()`'s `RawActionParam`, the runtime field metadata a
+    field-backed param inherits from carries no `validation` to source one from,
+    and `paramToField()` never mapped it — so it could not reach the field widgets,
+    whose rules `buildValidationRules()` builds from `required` / `minLength` /
+    `maxLength` / `pattern`.
+
+  Removed rather than implemented, on ADR-0049 enforce-or-remove. Giving it meaning
+  would mean first deciding what an "expression" is here (CEL? a formula? a regex?)
+  and adding it to `@objectstack/spec`, which is where such a capability has to
+  start — not accreted renderer-side around a key the contract does not have.
+
+  This also retires the last named exception in objectui#3174's drift guard
+  (`packages/types/src/__tests__/page-nav-misc-spec-parity.test.ts`), which carried
+  `validation` as the one key `ActionParam` added on top of the spec's set. The
+  rule it pins — **the authoring type declares exactly the spec's authorable
+  keys** — is now literal: the guard asserts the local-only key set is empty, so
+  any future addition fails the build instead of being waved through.
+
+- d22ae31: Track `@objectstack/spec` 17.0.0-rc.2 (objectui#3235, #3208, #3287, #3264).
+
+  The pin moves from `^17.0.0-rc.1` to `^17.0.0-rc.2` across the workspace, and
+  the sibling `@objectstack/*` packages (`client` / `core` / `formula` / `lint`)
+  move with it — they pin `@objectstack/spec` **exactly**, so leaving them behind
+  kept a second copy of the spec in the tree and would have had `@objectstack/lint`
+  validating against rc.1 schemas that still accept keys rc.2 retires.
+
+  Breaking semantics, in FROM → TO form:
+
+  - **`app.homePageId` is retired — an app's landing page is now its first
+    navigation item.** An app that pinned a landing page with `homePageId` will
+    open on the first reachable navigation entry (by `order`) instead; the root
+    landing still follows `isDefault`. To restore a specific landing page, reorder
+    `navigation` so the intended entry comes first. Stored metadata is migrated by
+    `os migrate meta --from 16`. The key is a hard error now, not a stripped one:
+    the spec ships a tombstone that names the migration.
+    Upstream retired it because of its SHAPE, not its usage — it was an ID
+    cross-reference with no referential integrity, so a `homePageId` that pointed
+    at nothing silently fell back to the first navigation item anyway
+    (objectstack#4667, premise corrected in #4709). If the capability returns, it
+    returns as a flag on the navigation item itself, which cannot dangle.
+  - **`@object-ui/types`' `HttpMethod` now resolves to the spec's
+    `HttpMethodType`.** Shape is verbatim identical — the same 5-value UI subset —
+    and `@object-ui/types` still exports it as `HttpMethod`, so no consumer
+    changes. The spec renamed its `./ui` export because `HttpMethod` named two
+    different types depending on the import path (`./shared` / `./api` carry a
+    7-value enum including `HEAD` / `OPTIONS`); objectui deliberately keeps the
+    5-value one (objectstack#4691).
+  - **`AppContextSelector.includeAll` / `placement` are gone.** Neither ever did
+    anything in this renderer: context selectors are mandatory-scope, so no "All"
+    row was ever rendered, and `placement: 'topbar'` put nothing in the topbar.
+    Both carried schema defaults, which is why the liveness lint structurally
+    could not flag them — removal was the only channel that reaches an author
+    (framework#4509).
+  - **`NavigationArea.visible` / `order` / `requiredPermissions` are gone.** An
+    area is a layout grouping, not an access boundary. Gating moved down to the
+    navigation ITEM, where `visible` and `requiredPermissions` are unchanged and
+    still enforced. `AppSchemaRenderer`'s area switcher no longer hides an area, so
+    an area whose items are all gated away renders as visible-but-empty rather
+    than disappearing.
+  - **`@object-ui/core` no longer exports `NotificationProtocol`**
+    (`resolveNotificationConfig`, `specNotificationToToast`, `mapSeverityToVariant`,
+    `mapPosition`, `ToastNotification`). It bridged `@objectstack/spec/ui`'s
+    `Notification` / `NotificationConfig`, which objectstack#4610 deleted with no
+    successor. Use `resolveNotificationConfig` from `@object-ui/react`
+    (`NotificationContext`), which owns the live `NotificationSystemConfig` and is
+    what every notification surface already read. Note that the spec's _other_
+    `Notification` — `@objectstack/spec/api` — is the REST inbox row, a different
+    contract, and is deliberately NOT aliased in as a replacement.
+  - **The `email_template` client-side validator now uses
+    `EmailTemplateDefinitionSchema`.** It was pointing at the removed
+    `EmailTemplateSchema`, so authored templates were being checked against the
+    wrong contract: the live one is keyed `name` + `locale` (not `id`) and splits
+    the body into `bodyHtml` / `bodyText` (not `body` + `bodyType`)
+    (objectstack#4616 / #4807).
+
+  Fixes that are not breaking, but were only found because rc.2 stopped being
+  lenient — each had been passing vacuously:
+
+  - **`view` drafts are actually validated now.** The client validator named the
+    aggregated container schema while this admin authors first-class `ViewItem`s,
+    and the container used to strip `viewKind` / `config` in silence — so no view
+    draft ever had one of its own keys checked. It now validates each shape
+    against its own schema (objectui#3312).
+  - **The console's worked examples were wrong**, and being stripped rather than
+    refused: `view.list.object` (the container root already declares it),
+    `job.concurrency` / `job.timeoutMs` (no such keys; the spelling is `timeout`,
+    already in ms), `email_template.from` / `.to` (a template is not a send —
+    the sender override is `fromOverride`, an object), and
+    `datasource.capabilities` / `.healthCheck` (objectstack#4583 removed the
+    former; the latter was never a datasource key). These are the drafts an
+    author — or a model generating metadata — copies.
+  - Action key inventory re-derived: `ActionSchema` gained the package-lock
+    envelope (`_lock*` / `_package*` / `_provenance`), so a packaged action no
+    longer reports them as unknown keys.
+  - The schema-diff panel labels the new `default_mismatch` finding.
+  - Test fixtures pinning the retired `managedBy: 'system'` bucket now use
+    `engine-owned`. Protocol 17 split that value (objectstack#3355), so it
+    resolved to the default-writable fallback and a batch of "stays locked"
+    assertions had quietly stopped asserting anything.
+
+### Patch Changes
+
+- Updated dependencies [23018cc]
+- Updated dependencies [f44d872]
+- Updated dependencies [f833d3a]
+- Updated dependencies [d22ae31]
+  - @object-ui/types@17.3.0
+
 ## 17.2.0
 
 ### Minor Changes
diff --git a/packages/core/package.json b/packages/core/package.json
index 17d81fe0d4..30dfa03890 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/core",
-  "version": "17.2.0",
+  "version": "17.3.0",
   "type": "module",
   "sideEffects": false,
   "license": "MIT",
diff --git a/packages/create-plugin/CHANGELOG.md b/packages/create-plugin/CHANGELOG.md
index 42f306a195..7f0e0fd384 100644
--- a/packages/create-plugin/CHANGELOG.md
+++ b/packages/create-plugin/CHANGELOG.md
@@ -1,5 +1,7 @@
 # @object-ui/create-plugin
 
+## 17.3.0
+
 ## 17.2.0
 
 ## 17.1.0
diff --git a/packages/create-plugin/package.json b/packages/create-plugin/package.json
index 682c76ec52..d13a6ddbb0 100644
--- a/packages/create-plugin/package.json
+++ b/packages/create-plugin/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/create-plugin",
-  "version": "17.2.0",
+  "version": "17.3.0",
   "description": "CLI tool to scaffold ObjectUI plugins",
   "type": "module",
   "license": "MIT",
diff --git a/packages/data-objectstack/CHANGELOG.md b/packages/data-objectstack/CHANGELOG.md
index 9253dcd6dd..8ab638f0fe 100644
--- a/packages/data-objectstack/CHANGELOG.md
+++ b/packages/data-objectstack/CHANGELOG.md
@@ -1,5 +1,101 @@
 # @object-ui/data-objectstack
 
+## 17.3.0
+
+### Minor Changes
+
+- d22ae31: Track `@objectstack/spec` 17.0.0-rc.2 (objectui#3235, #3208, #3287, #3264).
+
+  The pin moves from `^17.0.0-rc.1` to `^17.0.0-rc.2` across the workspace, and
+  the sibling `@objectstack/*` packages (`client` / `core` / `formula` / `lint`)
+  move with it — they pin `@objectstack/spec` **exactly**, so leaving them behind
+  kept a second copy of the spec in the tree and would have had `@objectstack/lint`
+  validating against rc.1 schemas that still accept keys rc.2 retires.
+
+  Breaking semantics, in FROM → TO form:
+
+  - **`app.homePageId` is retired — an app's landing page is now its first
+    navigation item.** An app that pinned a landing page with `homePageId` will
+    open on the first reachable navigation entry (by `order`) instead; the root
+    landing still follows `isDefault`. To restore a specific landing page, reorder
+    `navigation` so the intended entry comes first. Stored metadata is migrated by
+    `os migrate meta --from 16`. The key is a hard error now, not a stripped one:
+    the spec ships a tombstone that names the migration.
+    Upstream retired it because of its SHAPE, not its usage — it was an ID
+    cross-reference with no referential integrity, so a `homePageId` that pointed
+    at nothing silently fell back to the first navigation item anyway
+    (objectstack#4667, premise corrected in #4709). If the capability returns, it
+    returns as a flag on the navigation item itself, which cannot dangle.
+  - **`@object-ui/types`' `HttpMethod` now resolves to the spec's
+    `HttpMethodType`.** Shape is verbatim identical — the same 5-value UI subset —
+    and `@object-ui/types` still exports it as `HttpMethod`, so no consumer
+    changes. The spec renamed its `./ui` export because `HttpMethod` named two
+    different types depending on the import path (`./shared` / `./api` carry a
+    7-value enum including `HEAD` / `OPTIONS`); objectui deliberately keeps the
+    5-value one (objectstack#4691).
+  - **`AppContextSelector.includeAll` / `placement` are gone.** Neither ever did
+    anything in this renderer: context selectors are mandatory-scope, so no "All"
+    row was ever rendered, and `placement: 'topbar'` put nothing in the topbar.
+    Both carried schema defaults, which is why the liveness lint structurally
+    could not flag them — removal was the only channel that reaches an author
+    (framework#4509).
+  - **`NavigationArea.visible` / `order` / `requiredPermissions` are gone.** An
+    area is a layout grouping, not an access boundary. Gating moved down to the
+    navigation ITEM, where `visible` and `requiredPermissions` are unchanged and
+    still enforced. `AppSchemaRenderer`'s area switcher no longer hides an area, so
+    an area whose items are all gated away renders as visible-but-empty rather
+    than disappearing.
+  - **`@object-ui/core` no longer exports `NotificationProtocol`**
+    (`resolveNotificationConfig`, `specNotificationToToast`, `mapSeverityToVariant`,
+    `mapPosition`, `ToastNotification`). It bridged `@objectstack/spec/ui`'s
+    `Notification` / `NotificationConfig`, which objectstack#4610 deleted with no
+    successor. Use `resolveNotificationConfig` from `@object-ui/react`
+    (`NotificationContext`), which owns the live `NotificationSystemConfig` and is
+    what every notification surface already read. Note that the spec's _other_
+    `Notification` — `@objectstack/spec/api` — is the REST inbox row, a different
+    contract, and is deliberately NOT aliased in as a replacement.
+  - **The `email_template` client-side validator now uses
+    `EmailTemplateDefinitionSchema`.** It was pointing at the removed
+    `EmailTemplateSchema`, so authored templates were being checked against the
+    wrong contract: the live one is keyed `name` + `locale` (not `id`) and splits
+    the body into `bodyHtml` / `bodyText` (not `body` + `bodyType`)
+    (objectstack#4616 / #4807).
+
+  Fixes that are not breaking, but were only found because rc.2 stopped being
+  lenient — each had been passing vacuously:
+
+  - **`view` drafts are actually validated now.** The client validator named the
+    aggregated container schema while this admin authors first-class `ViewItem`s,
+    and the container used to strip `viewKind` / `config` in silence — so no view
+    draft ever had one of its own keys checked. It now validates each shape
+    against its own schema (objectui#3312).
+  - **The console's worked examples were wrong**, and being stripped rather than
+    refused: `view.list.object` (the container root already declares it),
+    `job.concurrency` / `job.timeoutMs` (no such keys; the spelling is `timeout`,
+    already in ms), `email_template.from` / `.to` (a template is not a send —
+    the sender override is `fromOverride`, an object), and
+    `datasource.capabilities` / `.healthCheck` (objectstack#4583 removed the
+    former; the latter was never a datasource key). These are the drafts an
+    author — or a model generating metadata — copies.
+  - Action key inventory re-derived: `ActionSchema` gained the package-lock
+    envelope (`_lock*` / `_package*` / `_provenance`), so a packaged action no
+    longer reports them as unknown keys.
+  - The schema-diff panel labels the new `default_mismatch` finding.
+  - Test fixtures pinning the retired `managedBy: 'system'` bucket now use
+    `engine-owned`. Protocol 17 split that value (objectstack#3355), so it
+    resolved to the default-writable fallback and a batch of "stays locked"
+    assertions had quietly stopped asserting anything.
+
+### Patch Changes
+
+- Updated dependencies [5781fb1]
+- Updated dependencies [23018cc]
+- Updated dependencies [f44d872]
+- Updated dependencies [f833d3a]
+- Updated dependencies [d22ae31]
+  - @object-ui/core@17.3.0
+  - @object-ui/types@17.3.0
+
 ## 17.2.0
 
 ### Minor Changes
diff --git a/packages/data-objectstack/package.json b/packages/data-objectstack/package.json
index 12a64af949..6bdbb86e82 100644
--- a/packages/data-objectstack/package.json
+++ b/packages/data-objectstack/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/data-objectstack",
-  "version": "17.2.0",
+  "version": "17.3.0",
   "description": "ObjectStack Data Adapter for Object UI",
   "license": "MIT",
   "type": "module",
diff --git a/packages/fields/CHANGELOG.md b/packages/fields/CHANGELOG.md
index b6b24c2985..678a70b6f6 100644
--- a/packages/fields/CHANGELOG.md
+++ b/packages/fields/CHANGELOG.md
@@ -1,5 +1,481 @@
 # @object-ui/fields
 
+## 17.3.0
+
+### Minor Changes
+
+- 19b8c9b: Field widgets no longer spread renderer-only props — or arbitrary keys from a
+  field config — onto the DOM element they render (objectui#3291).
+
+  **Behaviour change:** an unknown key written on a field configuration (or on an
+  SDUI `field:*` node) stops becoming an HTML attribute on the rendered control.
+  Nothing reads those attributes, but they were serialized into the DOM, into
+  snapshots, and into anything scraping rendered markup.
+
+  ## What was happening
+
+  Widgets forwarded their leftover props with a bare spread, so whatever a host
+  handed them became an attribute. Measured on a real form with a real widget:
+
+  ```
+  <input placeholder="PH-f" zzcanary="CANARY-STR" zzcanaryobj="[object Object]"
+         zzcanarynum="42" id="…" type="text" value="" name="f">
+  ```
+
+  `zzcanaryobj="[object Object]"` is an ordinary extra key on the field config
+  being `String()`-ed onto an attribute. React 19 does not warn about any of it:
+  an all-lowercase unknown attribute is passed through in complete silence, which
+  is why this went unnoticed.
+
+  Eleven widgets carried a line that looked like it prevented exactly this:
+
+  ```ts
+  const { inputType, ...domProps } = props as any; // "Filter out non-DOM props"
+  ```
+
+  `inputType` is already stripped by the form renderer before a widget sees it,
+  so that line filtered nothing — the comment actively misled. It is gone.
+
+  ## What changed
+  - New `toDomProps(props)`, exported from `@object-ui/fields`. It keeps only
+    what may legitimately become a DOM attribute and drops the rest.
+  - The 14 field widgets that spread onto a host element now go through it:
+    `text`, `textarea`, `number`, `boolean`, `date`, `datetime`, `time`, `email`,
+    `phone`, `url`, `password`, `currency`, `percent`, and `select`.
+
+  **It is a whitelist, not a list of keys to drop.** The largest leak source is
+  not any named renderer prop — it is the open tail of author-supplied keys. The
+  form renderer destructures a fixed set of known keys and forwards the rest
+  verbatim, and `SchemaRenderer` is wider still: it spreads the whole authored
+  node as props with no strip layer at all, so on that path a widget's own spread
+  is the only line of defence. A blacklist of today's renderer-only props would
+  pass every canary above and would not stop the next authored key either.
+
+  The forwarded set is the one `FieldWidgetComponentProps` already **declares**:
+  `id`, `name`, `autoFocus`, `tabIndex`, `onBlur`, `onFocus`, `onClick`,
+  `className`, `disabled`, plus `aria-*` and the `data-*` family. Until now that
+  was a type-level claim a widget could violate at runtime just by spreading;
+  `toDomProps` is its executable form.
+
+  Two compile-time assertions tie the helper to the declaration, and it is worth
+  being exact about which drift each one prevents:
+
+  - the contract's DOM pass-through block is now a named type
+    (`FieldWidgetDomProps`), and **both directions are compiler-bound**:
+    forwarding a key the contract does not declare fails to compile, and
+    declaring a DOM key the helper does not forward fails to compile too. The
+    second direction guards _declared but not delivered_ — a key that
+    type-checks, reads as supported, and silently never reaches the element. The
+    leak test structurally cannot see that class of bug: it looks for attributes
+    that arrive, not for ones that go missing.
+  - `className` and `disabled` are bound in the **forward direction only**. They
+    are DOM-legal and are forwarded, but they live in the controlled-input block
+    because widgets also interpret them, so they are deliberately outside
+    `FieldWidgetDomProps`.
+
+  An HTML global attribute the contract does not declare (`role`, say) is no
+  longer forwarded. It only ever arrived through the open spread. If a field node
+  should be able to author one, declare it on `FieldWidgetComponentProps` and add
+  it to the whitelist — the fix belongs at the contract, not in a wider spread.
+
+  ## Regression gate
+
+  A new contract test renders **every** registered field widget through **both**
+  hosts — the real form renderer and `SchemaRenderer` — and fails on any
+  attribute HTML does not define for that element. It walks real DOM attributes
+  rather than listening for React warnings (React 19 is silent for the exact case
+  that leaked), asserts a validation error genuinely rendered before scanning the
+  error variant, and calibrates its own judge against two fixtures: standard
+  markup that must produce zero findings, and planted fake attributes that must
+  all be found. A new widget type is covered automatically — the sweep is derived
+  from the widget registry, so adding one without covering it fails the test.
+
+- 56409c2: Field widgets are finally told when their field fails validation, and the props
+  slot that carries it takes the name the published contract gives it
+  (objectui#3222).
+
+  **Breaking** for anyone implementing a field widget (see migration below). The
+  repo version policy keeps this a `minor` — objectui's major tracks
+  `@objectstack`'s — so read the bump as "breaking within objectui".
+
+  ## The a11y defect this fixes
+
+  `@objectstack/spec/ui`'s `FieldWidgetPropsSchema` — the published contract that
+  third-party and AI-authored field widgets are written against — has always
+  declared `error?: string`. `@object-ui/fields` declared its own slot as
+  `errorMessage`. That looked like a naming split; it was worse:
+
+  ```
+  producers of `errorMessage` anywhere in packages/ + apps/ :  0
+  reads of `errorMessage` in packages/fields/src            : 15  (7 widgets)
+  reads of `props.error`                                    :  0
+  ```
+
+  The slot was dead under BOTH spellings. No host ever passed it: the form
+  renderer showed validation text through its own `<FormMessage/>` and never
+  forwarded the prop. So `EmailField`, `CurrencyField`, `UrlField`,
+  `RichTextField`, `PercentField`, `TextAreaField` and `PhoneField` each computed
+  `aria-invalid={!!errorMessage}` from a value that was `undefined` forever —
+  **`aria-invalid` had never once been set, and a screen reader was never told
+  the field had failed validation.**
+
+  Worse than "never set": `<FormControl>` is a Radix `Slot` that hands its child a
+  CORRECT `aria-invalid`, but a widget's own attribute is written after the props
+  spread, so it wins. Those seven widgets were actively overwriting the right
+  answer with `false`.
+
+  FROM: `renderFieldComponent` received no validation state, and the widget props
+  type declared `errorMessage?: string`, which nothing produced.
+  TO: the form renderer passes react-hook-form's `fieldState.error?.message` down
+  as `error` when it renders a registered widget, and the props type declares
+  `error?: string`. Both ends of the contract are live for the first time; a
+  rename alone would only have swapped one dead key for another.
+
+  ## Migration for widget authors
+
+  ```diff
+  -export function MyField({ value, onChange, field, readonly, errorMessage }: FieldWidgetComponentProps< string >) {
+  -  return <Input value={value} aria-invalid={!!errorMessage} />;
+  +export function MyField({ value, onChange, field, readonly, error }: FieldWidgetComponentProps< string >) {
+  +  return <Input value={value} aria-invalid={!!error} />;
+  ```
+
+  No alias is kept. `errorMessage` was retained nowhere on purpose — a tolerant
+  second spelling is exactly the de-facto second contract AGENTS.md #0.1 forbids,
+  and it is what would let a missed call site go quiet again. Because
+  objectui#3221 had already removed the type's `[key: string]: any`, every missed
+  site is a compile error rather than a silent `any`, so the compiler — not grep
+  — validated this rename.
+
+  ## Responsibilities are split, not duplicated
+
+  The widget consumes `error` **only** to drive `aria-invalid` on the control it
+  renders (which only it can do — `aria-invalid` has to sit on the input element).
+  The message TEXT stays with `<FormMessage/>` in the form renderer. A widget that
+  also renders the text double-displays it, and the docs, the agent prompt and the
+  tests all now say so.
+
+  For the same reason `required` — also declared by the spec, also never delivered
+  — is deliberately NOT lowered into widget props: the required marker has exactly
+  one author, the renderer's `<FormLabel>`, and giving widgets the flag invites a
+  second asterisk. The a11y state a widget could legitimately carry is
+  `aria-required`, which needs no contract change at all (`AriaAttributes` is
+  already part of the type and widgets already forward it).
+
+  Builtin field types are unaffected: they render inside `<FormControl>`, whose
+  Slot already supplies `aria-invalid`, so `error` is stripped there rather than
+  leaking into the DOM as a stray attribute.
+
+  Docs updated to match: `content/docs/guide/plugin-development.md`,
+  `skills/objectui/guides/plugin-development.md` and
+  `.github/prompts/component.prompt.md` — the last of which additionally used the
+  spec's non-generic type alias as a generic (`FieldWidgetProps< number >`) and
+  destructured a `mode` prop that exists on neither type.
+
+- 042e09d: **BREAKING (v17)** — field widgets receive their metadata on ONE key, `field`.
+  `schema` is removed from the widget contract (objectui#3233).
+
+  ## What changed
+
+  `schema` was a second carrier for what `field` already means. Two producers fed
+  it: `SchemaRenderer` passed the authored node as `schema`, and the form
+  renderer's `renderFieldComponent` passed `schema={props.field || props.schema ||
+props}` _alongside_ `field`. The predictable result was ~30 widgets resolving
+  their config as `field || schema` — one concept, two spellings, a de-facto
+  second contract (AGENTS.md #0.1).
+
+  - `FieldWidgetComponentProps` no longer declares `schema`. Reading
+    `props.schema` is now a compile error, not a silent `any`.
+  - Both producers converged. The form renderer passes `field` only. The SDUI node
+    → `field` translation happens exactly once, in a new registration adapter
+    (`withFieldCarrier`), which every built-in field widget is registered through.
+  - All `field || schema` reads in `@object-ui/fields` are now plain `field` reads.
+
+  ## Migrating a widget you wrote
+
+  **Reading the metadata** — replace the fallback with the single key:
+
+  ```diff
+  -const config = field || (props as any).schema;
+  +const config = field;
+  ```
+
+  **Registering a widget** — if your widget can be rendered from a schema node
+  (anything `SchemaRenderer` dispatches, not just forms), wrap it once so it still
+  gets `field`:
+
+  ```diff
+  +import { withFieldCarrier } from '@object-ui/fields';
+  +
+  -ComponentRegistry.register('color', ColorField, { namespace: 'field' });
+  +ComponentRegistry.register('color', withFieldCarrier(ColorField), { namespace: 'field' });
+  ```
+
+  `withFieldCarrier` forwards the node **by reference** — nothing is copied,
+  narrowed or renamed — and consumes `schema` so it cannot reach the DOM through a
+  widget's `...props` spread.
+
+  A third-party widget that still reads `props.schema` and is **not** re-registered
+  through the adapter will read `undefined` in v17 and silently render an empty /
+  default state. That is the deliberate cost of a major boundary: one contract
+  beats N dialects, and a widget that picks the wrong spelling should fail at
+  compile time rather than work under one host and not another.
+
+  ## What did NOT change
+  - **Host metadata (SDUI JSON) is untouched.** No authored schema changes; this is
+    a change to how widgets are _written_, not to what apps declare.
+  - **`schema` is still the universal SDUI prop** every registered component
+    receives from `SchemaRenderer` (`element:*`, `page:*`, grids, reports). Only
+    the _field-widget_ contract retired it. In particular `renderFieldComponent`
+    still passes `schema` when a form field type resolves to a plain component
+    through the bare-name fallback (e.g. `type: 'text'` reaching the display text
+    widget) — that component's contract is the node, and dropping it there would
+    render `undefined.className`.
+
+  ## Payload equivalence
+
+  Every path that used to deliver a payload through `schema` now delivers the
+  identical object through `field`, and both halves are pinned by tests asserting
+  **object identity**, not shape:
+
+  - form path — `packages/components/src/renderers/form/__tests__/form-field-carrier.test.tsx`
+  - SDUI path — `packages/fields/src/__tests__/field-carrier-sdui.test.tsx`
+
+- 30ae33a: `RichTextField` honours `mobile_fullscreen`, so `mobile.fullscreenLongText` is
+  finally true of rich text too (objectui#3301).
+
+  `ObjectFormSchema.mobile.fullscreenLongText` has always been documented as
+  "textarea/rich-text get an expand button", and `ObjectForm` has always stamped
+  `mobile_fullscreen` onto `field:markdown` / `field:html` fields to deliver it.
+  Both of those types resolve to `RichTextField`, and that widget never read the
+  flag: a producer with no consumer. Turning the setting on gave a phone user an
+  expand affordance on their textareas and nothing at all on their markdown or
+  HTML fields, with nothing anywhere reporting that half the feature was inert.
+
+  FROM: `RichTextField` ignored the flag entirely (`grep fullscreen` over that
+  file returned nothing). TO: it reads `field.mobile_fullscreen` — the same single
+  metadata carrier `TextAreaField` reads, and nowhere else — and renders the same
+  expand affordance and full-height editing dialog.
+
+  **The affordance now has one implementation, not two.** One form-level setting
+  should produce one behaviour, so the expand button, the dialog and the
+  draft/commit semantics moved into a shared `FullscreenFieldEditor` that both
+  widgets render; only the EDITOR is per-widget. A second hand-written copy of
+  that state machine would be the same defect this release fixes, with an extra
+  step — it drifts, and nothing reports the drift. The rich-text dialog hosts the
+  widget's real editing surface (same format indicator, same editor), not a bare
+  textarea, so whatever that editor grows into, both positions get it at once.
+
+  Behaviour is identical across the two widgets and unchanged for
+  `TextAreaField`: the dialog seeds its draft from the committed value at open
+  time, keeps typing local (a react-hook-form field is not marked dirty by an
+  edit the user may still cancel), commits once on "Done", and discards on
+  "Cancel". Test ids follow the existing convention per widget —
+  `richtext-fullscreen-toggle` / `-dialog` / `-input` / `-save` alongside the
+  `textarea-*` ones, since a single form can contain both.
+
+  There is deliberately no prop spelling of the flag and no `??` fallback chain in
+  either widget. The field metadata is the one carrier (objectui#3233), so a
+  misspelled or misplaced flag stays inert and visible rather than being quietly
+  caught by a tolerant consumer.
+
+  Also removes a dead type from the producer: `ObjectForm` stamped the flag on
+  `'string-multiline'`, a string that `grep -rn` finds exactly once across both
+  this repo and `objectstack` — that line itself. No producer emitted it, no
+  registry key matched it, no widget read it. The remaining four stamped types
+  (`textarea`, `field:textarea`, `field:markdown`, `field:html`) each have a real
+  reader.
+
+### Patch Changes
+
+- b7165ce: AddressField / GeolocationField sub-inputs now derive their DOM ids from a `useId()` prefix + sub-field name (the RadioField / CheckboxesField `groupId` paradigm) instead of hardcoded literals ("street", "city", "state", "zipCode", "country", "latitude", "longitude"). Two address or geolocation fields in one form no longer produce duplicate DOM ids, and each sub-label's `htmlFor` resolves to and focuses its own field's input instead of the first match in the document (#3343).
+- 825bbe3: The option widgets' "this list cannot be filled" message now has one source, and
+  it is translated (objectui#3231).
+
+  FROM: `SelectField`, `MultiSelectField`, `RadioField` and `CheckboxesField` each
+  carried their own copy of the empty/gated state, each destructured the declared
+  `emptyHint` prop into `_emptyHint` and dropped it, and each rendered a hardcoded
+  English literal (`'No options available'`, `` `Select ${…} first` ``) even in a
+  Chinese or Japanese session. TO: one shared `OptionsEmptyState` — the host's
+  `emptyHint` when it supplied one, otherwise a translated fallback
+  (`fields.options.empty` / `fields.options.selectFirst`, added to all ten locale
+  packs).
+
+  `emptyHint` was declared, produced by the form renderer and transported, then
+  lost three times over — so no registered widget could ever render it. All three
+  breaks are fixed, because closing only the last one delivers nothing:
+
+  - `isOptionField` compared the raw resolved type against `'select'` /`'radio'` /
+    `'multiselect'` / `'checkboxes'`. Object-derived forms emit
+    `mapFieldTypeToFormType`'s prefixed ids (`field:select`), which matched none of
+    them, so for every option field coming from an object schema — the normal case
+    in the console — the whole cascade block was skipped and no hint was computed
+    at all. It now normalizes the `field:` prefix, the same normalization
+    `stripRegisteredFieldProps` already applied a few lines below.
+  - `stripRegisteredFieldProps` then removed the `emptyHint` key from what was
+    left. It is now forwarded to the four cascade option types, alongside
+    `dependentValues`. This stays an allow-list rather than a blanket
+    pass-through: every other registered widget spreads its leftover props onto a
+    DOM node, where an unknown `emptyHint` attribute is a React warning.
+  - the widgets themselves discarded it. Keeping it out of the `...props` spread
+    was correct; not using it afterwards was not.
+
+  User-visible effect: a dependency-gated option list now prompts with the
+  controlling field's **label** ("Select Country first") instead of its raw
+  metadata name, in the session's language; an unconfigured list says so in the
+  session's language too. The gate sentence is one i18n key shared by the renderer
+  and the widget fallback, so the two sides cannot word it differently.
+
+  Untouched: the built-in (unregistered) `select` branch of the form renderer,
+  which already consumed `emptyHint`. That is a separate live path.
+
+- 9bc3709: The lookup "Browse all records" Record Picker now formats its columns with
+  the same field metadata the list view uses (objectui#3333). Previously the
+  dialog handed cell renderers a bare `{ name, type }` descriptor, so a
+  `select` column had no `options` and fell back to title-casing the raw
+  stored value (`manufacturing` rendered as "Manufacturing" instead of the
+  authored option label, e.g. "03 制造") — while the same field displayed
+  correctly in the list view and on the record detail page.
+
+  `RecordPickerDialog` gains an optional `fieldsMeta` prop (the referenced
+  object's schema `fields` map). When provided, each column's field descriptor
+  is enriched from the schema — `options` (run through the shared i18n option
+  translation), `currency`, `scale`, `precision`, `format`, `reference_to`, … —
+  and columns authored as plain strings in `lookup_columns` inherit the schema
+  field's `type`, so they format identically to typed columns. `LookupField`
+  passes the referenced object's schema it already fetches for `titleFormat`.
+  Callers that don't pass `fieldsMeta` keep the previous behavior.
+
+- 49f7449: `field:select` now announces its validation state to assistive tech: the
+  widget's DOM pass-through lands on the Radix `SelectTrigger` — the focusable
+  `<button role="combobox">` a user actually interacts with — instead of
+  `Select.Root`, which renders no DOM element of its own and silently dropped
+  every `aria-*` the form renderer delivered (objectui#3306).
+
+  Before this, a required select that failed validation showed the red message
+  while a screen reader was told nothing: `aria-invalid`, `aria-describedby`
+  (the link to the message text) and `aria-required` (objectui#3290's state
+  channel) all landed on Root and vanished. All three now reach the trigger,
+  and the widget computes `aria-invalid` from the published `error` slot after
+  the spread, the objectui#3222 discipline — a valid field explicitly says
+  `aria-invalid="false"` rather than staying mute.
+
+  Two keys deliberately stay on Root: `name` (Root forwards it to the hidden
+  native `<select>` that takes part in form submission) and `disabled` (Root is
+  the single authority that disables trigger, items and hidden select together).
+
+  Guarding the whole class forward, a new registry-wide sweep
+  (`widget-aria-invalid-registry-e2e.test.tsx`, the objectui#3291 leak-sweep
+  paradigm) renders every registered field widget through the real form, drives
+  a real validation failure, and asserts `aria-invalid="true"` appears inside
+  the field's row. The 29 widget types measured not to deliver yet are pinned in
+  a ratchet ledger (tracked in objectui#3318): fixing one turns its ledger row
+  red until the entry is removed, so the ledger only ever shrinks.
+
+- c7ed4c3: `TagsField` no longer ships a hardcoded Chinese input placeholder
+  (objectui#3342, AGENTS.md Commandment #-1). The placeholder now resolves
+  through the pinned chain: the author-declared `field.placeholder` wins
+  (previously ignored by this widget); otherwise the widget's own copy arrives
+  via `useFieldTranslation()` under the new `fields.tags.placeholder` key, added
+  at full parity across all locale packs (Chinese lives in the zh pack, not in
+  code); with no `I18nProvider` mounted the English default from FIELD_DEFAULTS
+  renders — never a raw key.
+- a321fa4: `TextAreaField`'s mobile fullscreen flag converges on its one real producer
+  (objectui#3232).
+
+  FROM: the widget resolved the "show the expand affordance" decision through a
+  four-way `??` chain — a `mobileFullscreen` (camelCase) prop, the field
+  metadata's `mobile_fullscreen`, a `mobile_fullscreen` prop, and
+  `schema.mobile_fullscreen`. TO: a single read of the field metadata's
+  `mobile_fullscreen`, resolved through the `field || schema` carrier pair every
+  widget in this package already uses.
+
+  No runtime behaviour changes, because three of those four reads were
+  permanently `undefined`:
+
+  - `mobileFullscreen` (camelCase) had **no producer anywhere in the repo** — the
+    only occurrences of that spelling were the widget's own read and the
+    destructure that kept it off the DOM spread. The doc comment nonetheless
+    claimed "the host form passes `mobileFullscreen`", so the contract it
+    described had never held.
+  - `mobile_fullscreen` as a **prop** cannot arrive: the form renderer's
+    `stripRegisteredFieldProps` explicitly removes `mobile_fullscreen` and
+    `fullscreen` from the props forwarded to registered field widgets.
+  - `schema.mobile_fullscreen` was the same object `field || schema` already
+    resolves, so it could only ever restate the metadata read.
+
+  What actually drives the affordance — and is now the only thing that does — is
+  the field metadata flag `ObjectForm` stamps onto long-text fields from
+  `ObjectFormSchema.mobile.fullscreenLongText`. That path is unchanged and is now
+  pinned by tests (button, dialog, and the committed edit), so the cleanup cannot
+  have silently removed the working behaviour.
+
+  Also untouched: the built-in (unregistered) `textarea` branch of the form
+  renderer, which reads `mobile_fullscreen || fullscreen` off the form-field
+  props and renders its own `FullscreenTextarea`. That is a separate live path.
+
+  Why this is worth a changeset rather than a silent tidy-up: reads that nobody
+  writes are not free. They document a contract that does not exist — the next
+  author follows the comment, passes the prop, and is ignored without a word —
+  and a `??` chain that accepts four spellings and rejects none is exactly where
+  a misspelled key hides. With one source, a wrong spelling has no read path left
+  to absorb it. Per AGENTS.md #0.1 and Prime Directive #12, divergence like this
+  converges at the producer, not by accumulating tolerance at the consumer. No
+  host-override prop was invented in its place: inventing a key with no producer
+  is the same mistake in the other direction.
+
+- 8d8094a: 20 more registered field widgets now announce a failed validation to assistive
+  tech: `multiselect`, `radio`, `checkboxes`, `tags`, `lookup`, `master_detail`,
+  `user`, `owner`, `file`, `image`, `location`, `object`, `color`, `rating`,
+  `code`, `avatar`, `address`, `geolocation`, `qrcode` and `object-ref` carry
+  `aria-invalid="true"` on their real focusable control after a validation
+  failure, where before the red message rendered while a screen reader was told
+  nothing (objectui#3318, the registry-wide gap objectui#3306's sweep measured).
+
+  Each widget follows the objectui#3222/#3306 pattern: the `toDomProps(props)`
+  whitelist spread goes onto the control the user actually focuses — the input,
+  the lookup trigger button, the radiogroup (`role="radiogroup"` is the
+  ARIA-designated carrier for a set of radios), every chip/checkbox/star of the
+  composite option widgets, the upload dropzone/button — followed by an explicit
+  `aria-invalid={!!error}` computed from the published `error` slot. Wrapper
+  `<div>`s never carry the state, and `name` is withheld from non-form-control
+  elements (the objectui#3291 leak class).
+
+  `Combobox` (`@object-ui/components`) now accepts standard button attributes
+  and forwards them to its focusable `role="combobox"` trigger, giving
+  combobox-based widgets an element to deliver `aria-invalid` /
+  `aria-describedby` to — the same seam objectui#3306 opened on
+  `SelectTrigger`.
+
+  Nine types remain on the objectui#3318 ratchet ledger with their blockers
+  documented there (`formula`/`summary`/`auto_number`/`vector` render no
+  focusable control; `grid`, `slider`, `signature` need component-level design;
+  `filter-condition`/`recipient-picker` deliver in their editable states but
+  render a dependency-gate hint with no control in a fresh form).
+
+- Updated dependencies [532cf8b]
+- Updated dependencies [680080a]
+- Updated dependencies [a7651e6]
+- Updated dependencies [34595eb]
+- Updated dependencies [5781fb1]
+- Updated dependencies [56409c2]
+- Updated dependencies [042e09d]
+- Updated dependencies [23018cc]
+- Updated dependencies [68b6a28]
+- Updated dependencies [f44d872]
+- Updated dependencies [825bbe3]
+- Updated dependencies [a415684]
+- Updated dependencies [f833d3a]
+- Updated dependencies [d22ae31]
+- Updated dependencies [c7ed4c3]
+- Updated dependencies [8d8094a]
+  - @object-ui/components@17.3.0
+  - @object-ui/core@17.3.0
+  - @object-ui/types@17.3.0
+  - @object-ui/i18n@17.3.0
+  - @object-ui/react@17.3.0
+  - @object-ui/providers@17.3.0
+
 ## 17.2.0
 
 ### Minor Changes
diff --git a/packages/fields/package.json b/packages/fields/package.json
index ced8985146..8e97148c9f 100644
--- a/packages/fields/package.json
+++ b/packages/fields/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/fields",
-  "version": "17.2.0",
+  "version": "17.3.0",
   "description": "Field renderers and registry for Object UI",
   "license": "MIT",
   "type": "module",
diff --git a/packages/i18n/CHANGELOG.md b/packages/i18n/CHANGELOG.md
index 17c6f58d56..13e1f01193 100644
--- a/packages/i18n/CHANGELOG.md
+++ b/packages/i18n/CHANGELOG.md
@@ -1,5 +1,79 @@
 # @object-ui/i18n
 
+## 17.3.0
+
+### Patch Changes
+
+- 68b6a28: The list toolbar's "Filter" now saves. Saving a filter from the runtime toolbar PUT the FilterBuilder's whole group object (`{ id, logic, conditions }`) into the view's `filter`, where `@objectstack/spec`'s `ListViewSchema.filter` declares `ViewFilterRule[]` — so every save came back `422 invalid_metadata` and the filter was silently never persisted (objectstack#5159).
+
+  The producer now folds the builder's group to the spec's flat `{ field, operator, value }` rule list before persisting, sharing one transform with the Studio view inspector (which had the only copy). Operators normalize through the spec's own `normalizeFilterOperator`, so the four builder operators the Studio's local table had drifted behind — `startsWith`, `endsWith`, `isNull`, `isNotNull` — now persist correctly too. The builder's per-row `id` is no longer written: it is a React list key that the read path regenerates, so stored view bodies keep the declared vocabulary only.
+
+  A filter whose shape cannot be represented losslessly as a flat rule list — `OR` across several conditions, or nested condition groups — is now refused with a translated message instead of being quietly saved as `AND`, which would have returned a different set of records than the one on screen. Such a filter still applies to the current list; it just does not become part of the saved view.
+
+- 825bbe3: The option widgets' "this list cannot be filled" message now has one source, and
+  it is translated (objectui#3231).
+
+  FROM: `SelectField`, `MultiSelectField`, `RadioField` and `CheckboxesField` each
+  carried their own copy of the empty/gated state, each destructured the declared
+  `emptyHint` prop into `_emptyHint` and dropped it, and each rendered a hardcoded
+  English literal (`'No options available'`, `` `Select ${…} first` ``) even in a
+  Chinese or Japanese session. TO: one shared `OptionsEmptyState` — the host's
+  `emptyHint` when it supplied one, otherwise a translated fallback
+  (`fields.options.empty` / `fields.options.selectFirst`, added to all ten locale
+  packs).
+
+  `emptyHint` was declared, produced by the form renderer and transported, then
+  lost three times over — so no registered widget could ever render it. All three
+  breaks are fixed, because closing only the last one delivers nothing:
+
+  - `isOptionField` compared the raw resolved type against `'select'` /`'radio'` /
+    `'multiselect'` / `'checkboxes'`. Object-derived forms emit
+    `mapFieldTypeToFormType`'s prefixed ids (`field:select`), which matched none of
+    them, so for every option field coming from an object schema — the normal case
+    in the console — the whole cascade block was skipped and no hint was computed
+    at all. It now normalizes the `field:` prefix, the same normalization
+    `stripRegisteredFieldProps` already applied a few lines below.
+  - `stripRegisteredFieldProps` then removed the `emptyHint` key from what was
+    left. It is now forwarded to the four cascade option types, alongside
+    `dependentValues`. This stays an allow-list rather than a blanket
+    pass-through: every other registered widget spreads its leftover props onto a
+    DOM node, where an unknown `emptyHint` attribute is a React warning.
+  - the widgets themselves discarded it. Keeping it out of the `...props` spread
+    was correct; not using it afterwards was not.
+
+  User-visible effect: a dependency-gated option list now prompts with the
+  controlling field's **label** ("Select Country first") instead of its raw
+  metadata name, in the session's language; an unconfigured list says so in the
+  session's language too. The gate sentence is one i18n key shared by the renderer
+  and the widget fallback, so the two sides cannot word it differently.
+
+  Untouched: the built-in (unregistered) `select` branch of the form renderer,
+  which already consumed `emptyHint`. That is a separate live path.
+
+- a415684: The console server-action wrapper's `opensInNewTab` choreography no longer
+  ships hard-coded bilingual Chinese/English copy (objectui#3321, AGENTS.md
+  Commandment #-1): the pre-opened SSO spinner tab (title + body) and the
+  popup-blocked toast (title, description, action label) are now localized
+  through new `console.serverAction.*` keys in `@object-ui/i18n`, added at full
+  parity across all eleven locale packs.
+
+  `createConsoleServerActionHandler` gains an optional i18next-style `t` option
+  (`t(key, englishDefault)`) — the wrapper is a plain function, so the translate
+  function is injected from the two hook-context call sites
+  (`useConsoleActionRuntime`, `RecordDetailView`) via `useObjectTranslation`.
+  When omitted (tests / standalone), every string falls back to its English
+  default; no non-English copy remains in code. Locale strings are HTML-escaped
+  before being written into the spinner document.
+
+- c7ed4c3: `TagsField` no longer ships a hardcoded Chinese input placeholder
+  (objectui#3342, AGENTS.md Commandment #-1). The placeholder now resolves
+  through the pinned chain: the author-declared `field.placeholder` wins
+  (previously ignored by this widget); otherwise the widget's own copy arrives
+  via `useFieldTranslation()` under the new `fields.tags.placeholder` key, added
+  at full parity across all locale packs (Chinese lives in the zh pack, not in
+  code); with no `I18nProvider` mounted the English default from FIELD_DEFAULTS
+  renders — never a raw key.
+
 ## 17.2.0
 
 ### Minor Changes
diff --git a/packages/i18n/package.json b/packages/i18n/package.json
index 62e2b5ad57..bd8a86bc19 100644
--- a/packages/i18n/package.json
+++ b/packages/i18n/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/i18n",
-  "version": "17.2.0",
+  "version": "17.3.0",
   "type": "module",
   "sideEffects": false,
   "license": "MIT",
diff --git a/packages/layout/CHANGELOG.md b/packages/layout/CHANGELOG.md
index 174c5d4d79..5bef5c1e6f 100644
--- a/packages/layout/CHANGELOG.md
+++ b/packages/layout/CHANGELOG.md
@@ -1,5 +1,184 @@
 # @object-ui/layout
 
+## 17.3.0
+
+### Minor Changes
+
+- 608669e: `AppSchemaRenderer` now derives area visibility from the items inside the
+  area, closing the visible-but-empty regression the spec 17.0.0 area-key
+  retirement left behind (objectui#3311, option C of the recorded ruling).
+
+  Spec 17.0.0 retired the authorable area-level `visible` /
+  `requiredPermissions` (`AREA_VISIBLE_RETIRED` /
+  `AREA_REQUIRED_PERMISSIONS_RETIRED`) — an area is a layout grouping, not an
+  access boundary — and objectui followed in #3315 by deleting the area
+  switcher's filter. Correct on the contract, but it changed the navigation
+  surface: an area whose items are **all** gated away used to disappear from
+  the switcher and instead rendered as a selectable, empty area.
+
+  ## What changed
+  - **Area visibility is now derived, not authored.** An area appears in the
+    switcher iff at least one of its navigation items survives the exact
+    item-level guards `NavigationRenderer` applies: the `visible` expression,
+    `requiredPermissions`, the `requiresObject` / `requiresService` runtime
+    capability gates, and — for `action` items — the presence of an `onAction`
+    dispatcher (framework#4509: without one they are not rendered, so they
+    cannot carry an area either). Separators never count; a `group` counts only
+    through its children.
+  - **The active area is elected among visible areas only.** A fully gated
+    first area is no longer auto-activated, and when a gating change hides the
+    currently active area the shell re-elects the first visible one. A gating
+    change that merely _reveals_ an area never yanks the user away from where
+    they are.
+  - **An area with no items at all derives the same way**: no visible item →
+    hidden. (Boundary recorded in objectui#3311.)
+  - New export `hasVisibleNavigationItems(items, options)` from
+    `@object-ui/layout` — the predicate behind the derivation, usable by other
+    shells that render their own area switchers.
+
+  No authorable key is involved anywhere: the platform's `.strict()` area
+  object still rejects the retired keys, and the derivation — computed from the
+  same guards that decide what renders — cannot disagree with the rendered
+  navigation, so there is nothing for a metadata author to get wrong.
+
+- d22ae31: Track `@objectstack/spec` 17.0.0-rc.2 (objectui#3235, #3208, #3287, #3264).
+
+  The pin moves from `^17.0.0-rc.1` to `^17.0.0-rc.2` across the workspace, and
+  the sibling `@objectstack/*` packages (`client` / `core` / `formula` / `lint`)
+  move with it — they pin `@objectstack/spec` **exactly**, so leaving them behind
+  kept a second copy of the spec in the tree and would have had `@objectstack/lint`
+  validating against rc.1 schemas that still accept keys rc.2 retires.
+
+  Breaking semantics, in FROM → TO form:
+
+  - **`app.homePageId` is retired — an app's landing page is now its first
+    navigation item.** An app that pinned a landing page with `homePageId` will
+    open on the first reachable navigation entry (by `order`) instead; the root
+    landing still follows `isDefault`. To restore a specific landing page, reorder
+    `navigation` so the intended entry comes first. Stored metadata is migrated by
+    `os migrate meta --from 16`. The key is a hard error now, not a stripped one:
+    the spec ships a tombstone that names the migration.
+    Upstream retired it because of its SHAPE, not its usage — it was an ID
+    cross-reference with no referential integrity, so a `homePageId` that pointed
+    at nothing silently fell back to the first navigation item anyway
+    (objectstack#4667, premise corrected in #4709). If the capability returns, it
+    returns as a flag on the navigation item itself, which cannot dangle.
+  - **`@object-ui/types`' `HttpMethod` now resolves to the spec's
+    `HttpMethodType`.** Shape is verbatim identical — the same 5-value UI subset —
+    and `@object-ui/types` still exports it as `HttpMethod`, so no consumer
+    changes. The spec renamed its `./ui` export because `HttpMethod` named two
+    different types depending on the import path (`./shared` / `./api` carry a
+    7-value enum including `HEAD` / `OPTIONS`); objectui deliberately keeps the
+    5-value one (objectstack#4691).
+  - **`AppContextSelector.includeAll` / `placement` are gone.** Neither ever did
+    anything in this renderer: context selectors are mandatory-scope, so no "All"
+    row was ever rendered, and `placement: 'topbar'` put nothing in the topbar.
+    Both carried schema defaults, which is why the liveness lint structurally
+    could not flag them — removal was the only channel that reaches an author
+    (framework#4509).
+  - **`NavigationArea.visible` / `order` / `requiredPermissions` are gone.** An
+    area is a layout grouping, not an access boundary. Gating moved down to the
+    navigation ITEM, where `visible` and `requiredPermissions` are unchanged and
+    still enforced. `AppSchemaRenderer`'s area switcher no longer hides an area, so
+    an area whose items are all gated away renders as visible-but-empty rather
+    than disappearing.
+  - **`@object-ui/core` no longer exports `NotificationProtocol`**
+    (`resolveNotificationConfig`, `specNotificationToToast`, `mapSeverityToVariant`,
+    `mapPosition`, `ToastNotification`). It bridged `@objectstack/spec/ui`'s
+    `Notification` / `NotificationConfig`, which objectstack#4610 deleted with no
+    successor. Use `resolveNotificationConfig` from `@object-ui/react`
+    (`NotificationContext`), which owns the live `NotificationSystemConfig` and is
+    what every notification surface already read. Note that the spec's _other_
+    `Notification` — `@objectstack/spec/api` — is the REST inbox row, a different
+    contract, and is deliberately NOT aliased in as a replacement.
+  - **The `email_template` client-side validator now uses
+    `EmailTemplateDefinitionSchema`.** It was pointing at the removed
+    `EmailTemplateSchema`, so authored templates were being checked against the
+    wrong contract: the live one is keyed `name` + `locale` (not `id`) and splits
+    the body into `bodyHtml` / `bodyText` (not `body` + `bodyType`)
+    (objectstack#4616 / #4807).
+
+  Fixes that are not breaking, but were only found because rc.2 stopped being
+  lenient — each had been passing vacuously:
+
+  - **`view` drafts are actually validated now.** The client validator named the
+    aggregated container schema while this admin authors first-class `ViewItem`s,
+    and the container used to strip `viewKind` / `config` in silence — so no view
+    draft ever had one of its own keys checked. It now validates each shape
+    against its own schema (objectui#3312).
+  - **The console's worked examples were wrong**, and being stripped rather than
+    refused: `view.list.object` (the container root already declares it),
+    `job.concurrency` / `job.timeoutMs` (no such keys; the spelling is `timeout`,
+    already in ms), `email_template.from` / `.to` (a template is not a send —
+    the sender override is `fromOverride`, an object), and
+    `datasource.capabilities` / `.healthCheck` (objectstack#4583 removed the
+    former; the latter was never a datasource key). These are the drafts an
+    author — or a model generating metadata — copies.
+  - Action key inventory re-derived: `ActionSchema` gained the package-lock
+    envelope (`_lock*` / `_package*` / `_provenance`), so a packaged action no
+    longer reports them as unknown keys.
+  - The schema-diff panel labels the new `default_mismatch` finding.
+  - Test fixtures pinning the retired `managedBy: 'system'` bucket now use
+    `engine-owned`. Protocol 17 split that value (objectstack#3355), so it
+    resolved to the default-writable fallback and a batch of "stays locked"
+    assertions had quietly stopped asserting anything.
+
+### Patch Changes
+
+- d2363e7: The legacy `page-header` alias stops advertising `description` as an authorable
+  key (objectui#3226).
+
+  FROM: `registerLayout()` declared `inputs: [title, description]`. TO:
+  `inputs: [title, subtitle]` — the key `@objectstack/spec/ui`'s `PageHeaderProps`
+  declares, and the one the canonical `page:header` renderer in
+  `@object-ui/components` already declares.
+
+  `inputs` is a DECLARATION surface, not documentation: the designer builds its
+  property palette from it, and the framework's `check:react-declaration-parity`
+  diffs it against the spec schemas. Declaring `description` therefore did not
+  merely tolerate a legacy spelling — it published a second dialect for the one
+  concept the protocol calls `subtitle`, and told authors (an AI author most
+  readily, since the registry is what it reads to learn the shape) that the
+  non-spec key was legal. Metadata that took the offer renders a subtitle under
+  `page-header` and silently loses it under `page:header`: same JSON, two results,
+  which is the outcome a single contract exists to prevent.
+
+  No runtime behaviour changes. `PageHeader` still reads `subtitle ?? description`,
+  deliberately: this alias exists for out-of-repo consumer schemas, so "no in-repo
+  author writes `description`" (verified — zero hits) is not evidence that nobody
+  does, and dropping the read today would delete an external page's second line
+  while its title kept rendering, the least reportable failure mode there is. That
+  read is retired together with an ADR-0087 D2 conversion entry
+  (`page-header-subtitle-alias`, `description` → `subtitle` rewritten at load
+  time), which lives in the framework repo and is tracked separately. Narrowing the
+  declaration did not need to wait on it and breaks no consumer; leaving the
+  declaration wrong in the meantime keeps minting the metadata the conversion would
+  then have to absorb.
+
+  New tests pin both halves so neither can drift back: the registration may not
+  declare `description`, must declare `subtitle`, and — checked against the spec's
+  own shape rather than a hand-written allowlist — may declare nothing
+  `@objectstack/spec` does not; while the runtime fallback is pinned as a sequencing
+  guard, to be deleted in the same change that lands the conversion entry.
+
+- Updated dependencies [532cf8b]
+- Updated dependencies [680080a]
+- Updated dependencies [a7651e6]
+- Updated dependencies [34595eb]
+- Updated dependencies [5781fb1]
+- Updated dependencies [56409c2]
+- Updated dependencies [042e09d]
+- Updated dependencies [23018cc]
+- Updated dependencies [f44d872]
+- Updated dependencies [825bbe3]
+- Updated dependencies [f833d3a]
+- Updated dependencies [d22ae31]
+- Updated dependencies [8d8094a]
+  - @object-ui/components@17.3.0
+  - @object-ui/core@17.3.0
+  - @object-ui/types@17.3.0
+  - @object-ui/react@17.3.0
+
 ## 17.2.0
 
 ### Minor Changes
diff --git a/packages/layout/package.json b/packages/layout/package.json
index eda964fb72..065823db86 100644
--- a/packages/layout/package.json
+++ b/packages/layout/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/layout",
-  "version": "17.2.0",
+  "version": "17.3.0",
   "type": "module",
   "sideEffects": false,
   "main": "dist/index.umd.cjs",
diff --git a/packages/mobile/CHANGELOG.md b/packages/mobile/CHANGELOG.md
index e8f210ab8e..930460862a 100644
--- a/packages/mobile/CHANGELOG.md
+++ b/packages/mobile/CHANGELOG.md
@@ -1,5 +1,15 @@
 # @object-ui/mobile
 
+## 17.3.0
+
+### Patch Changes
+
+- Updated dependencies [23018cc]
+- Updated dependencies [f44d872]
+- Updated dependencies [f833d3a]
+- Updated dependencies [d22ae31]
+  - @object-ui/types@17.3.0
+
 ## 17.2.0
 
 ### Minor Changes
diff --git a/packages/mobile/package.json b/packages/mobile/package.json
index 496926bd55..718a3fdb3e 100644
--- a/packages/mobile/package.json
+++ b/packages/mobile/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/mobile",
-  "version": "17.2.0",
+  "version": "17.3.0",
   "type": "module",
   "license": "MIT",
   "description": "Mobile optimization for Object UI with responsive components, PWA support, and touch gesture handling.",
diff --git a/packages/permissions/CHANGELOG.md b/packages/permissions/CHANGELOG.md
index 2d2bedfee5..e17d5116c4 100644
--- a/packages/permissions/CHANGELOG.md
+++ b/packages/permissions/CHANGELOG.md
@@ -1,5 +1,15 @@
 # @object-ui/permissions
 
+## 17.3.0
+
+### Patch Changes
+
+- Updated dependencies [23018cc]
+- Updated dependencies [f44d872]
+- Updated dependencies [f833d3a]
+- Updated dependencies [d22ae31]
+  - @object-ui/types@17.3.0
+
 ## 17.2.0
 
 ### Patch Changes
diff --git a/packages/permissions/package.json b/packages/permissions/package.json
index d977ecfb14..5ee0bc860f 100644
--- a/packages/permissions/package.json
+++ b/packages/permissions/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/permissions",
-  "version": "17.2.0",
+  "version": "17.3.0",
   "type": "module",
   "license": "MIT",
   "description": "RBAC permission system for Object UI with object/field/row-level access control, permission guards, and hooks.",
diff --git a/packages/plugin-ai/CHANGELOG.md b/packages/plugin-ai/CHANGELOG.md
index ccafe26652..6e01adcffa 100644
--- a/packages/plugin-ai/CHANGELOG.md
+++ b/packages/plugin-ai/CHANGELOG.md
@@ -1,5 +1,27 @@
 # @object-ui/plugin-ai
 
+## 17.3.0
+
+### Patch Changes
+
+- Updated dependencies [532cf8b]
+- Updated dependencies [680080a]
+- Updated dependencies [a7651e6]
+- Updated dependencies [34595eb]
+- Updated dependencies [5781fb1]
+- Updated dependencies [56409c2]
+- Updated dependencies [042e09d]
+- Updated dependencies [23018cc]
+- Updated dependencies [f44d872]
+- Updated dependencies [825bbe3]
+- Updated dependencies [f833d3a]
+- Updated dependencies [d22ae31]
+- Updated dependencies [8d8094a]
+  - @object-ui/components@17.3.0
+  - @object-ui/core@17.3.0
+  - @object-ui/types@17.3.0
+  - @object-ui/react@17.3.0
+
 ## 17.2.0
 
 ### Patch Changes
diff --git a/packages/plugin-ai/package.json b/packages/plugin-ai/package.json
index 2916971179..410f0bf4a2 100644
--- a/packages/plugin-ai/package.json
+++ b/packages/plugin-ai/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/plugin-ai",
-  "version": "17.2.0",
+  "version": "17.3.0",
   "type": "module",
   "main": "dist/index.umd.cjs",
   "module": "dist/index.js",
diff --git a/packages/plugin-calendar/CHANGELOG.md b/packages/plugin-calendar/CHANGELOG.md
index 05f0e2b354..8fe40a9c69 100644
--- a/packages/plugin-calendar/CHANGELOG.md
+++ b/packages/plugin-calendar/CHANGELOG.md
@@ -1,5 +1,43 @@
 # @object-ui/plugin-calendar
 
+## 17.3.0
+
+### Patch Changes
+
+- Updated dependencies [b7165ce]
+- Updated dependencies [532cf8b]
+- Updated dependencies [680080a]
+- Updated dependencies [a7651e6]
+- Updated dependencies [34595eb]
+- Updated dependencies [5781fb1]
+- Updated dependencies [bbbde12]
+- Updated dependencies [19b8c9b]
+- Updated dependencies [56409c2]
+- Updated dependencies [042e09d]
+- Updated dependencies [23018cc]
+- Updated dependencies [68b6a28]
+- Updated dependencies [f44d872]
+- Updated dependencies [825bbe3]
+- Updated dependencies [c7fba27]
+- Updated dependencies [a415684]
+- Updated dependencies [12bf669]
+- Updated dependencies [9bc3709]
+- Updated dependencies [f833d3a]
+- Updated dependencies [30ae33a]
+- Updated dependencies [49f7449]
+- Updated dependencies [d22ae31]
+- Updated dependencies [c7ed4c3]
+- Updated dependencies [a321fa4]
+- Updated dependencies [8d8094a]
+  - @object-ui/fields@17.3.0
+  - @object-ui/components@17.3.0
+  - @object-ui/plugin-detail@17.3.0
+  - @object-ui/core@17.3.0
+  - @object-ui/types@17.3.0
+  - @object-ui/i18n@17.3.0
+  - @object-ui/react@17.3.0
+  - @object-ui/mobile@17.3.0
+
 ## 17.2.0
 
 ### Patch Changes
diff --git a/packages/plugin-calendar/package.json b/packages/plugin-calendar/package.json
index 8bc7ce8460..0031ab20b0 100644
--- a/packages/plugin-calendar/package.json
+++ b/packages/plugin-calendar/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/plugin-calendar",
-  "version": "17.2.0",
+  "version": "17.3.0",
   "type": "module",
   "license": "MIT",
   "description": "Calendar view plugins for Object UI - includes both ObjectQL-integrated and standalone calendar components",
diff --git a/packages/plugin-charts/CHANGELOG.md b/packages/plugin-charts/CHANGELOG.md
index abf5bd3078..0a18486412 100644
--- a/packages/plugin-charts/CHANGELOG.md
+++ b/packages/plugin-charts/CHANGELOG.md
@@ -1,5 +1,41 @@
 # @object-ui/plugin-charts
 
+## 17.3.0
+
+### Minor Changes
+
+- 524a635: `<ObjectChart>` declares `drillDown` as a registry input, so the SDUI save gate treats the segment drill as a contract prop instead of an unknown one (framework#5022).
+
+  The component has read `schema.drillDown` all along — it is what opens the drawer of underlying records when you click a bar or a slice — but the prop was declared in neither the protocol nor this registry entry. The manifest the save gate validates page JSX against is built verbatim from these `inputs`, so an author who wrote the drill got an `unknown-prop` diagnostic for a prop that works. `@objectstack/spec` now declares the shape (`ChartDrillDownSchema`, published on the react-tier `<ObjectChart>` contract); this is the renderer half.
+
+  The published input describes the six keys the spec declares — `enabled`, `filter`, `title`, `target` (`'drawer' | 'dialog'`), `columns`, `maxRows` — and deliberately not the wider `DrillDownConfig` this repo shares with the table / pivot / metric widgets: `ObjectChart` reads none of `mode` / `report` / `view` / `sort`, and does not implement `target: 'navigate'` (it renders the drawer instead — objectui#3354).
+
+  The untyped `(schema as any).drillDown` read is now typed as `DrillDownConfig`. Narrowing it to the spec's `ChartDrillDown` is left as a TODO on the version pin: `@objectstack/spec` is pinned at `^17.0.0-rc.2` here and the declaration lands in the next rc, and re-declaring the shape locally would be the fork that lets the two drift.
+
+### Patch Changes
+
+- Updated dependencies [532cf8b]
+- Updated dependencies [680080a]
+- Updated dependencies [a7651e6]
+- Updated dependencies [34595eb]
+- Updated dependencies [5781fb1]
+- Updated dependencies [56409c2]
+- Updated dependencies [042e09d]
+- Updated dependencies [23018cc]
+- Updated dependencies [68b6a28]
+- Updated dependencies [f44d872]
+- Updated dependencies [825bbe3]
+- Updated dependencies [a415684]
+- Updated dependencies [f833d3a]
+- Updated dependencies [d22ae31]
+- Updated dependencies [c7ed4c3]
+- Updated dependencies [8d8094a]
+  - @object-ui/components@17.3.0
+  - @object-ui/core@17.3.0
+  - @object-ui/types@17.3.0
+  - @object-ui/i18n@17.3.0
+  - @object-ui/react@17.3.0
+
 ## 17.2.0
 
 ### Minor Changes
diff --git a/packages/plugin-charts/package.json b/packages/plugin-charts/package.json
index 5f96568390..9d70287190 100644
--- a/packages/plugin-charts/package.json
+++ b/packages/plugin-charts/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/plugin-charts",
-  "version": "17.2.0",
+  "version": "17.3.0",
   "type": "module",
   "license": "MIT",
   "description": "Chart components plugin for Object UI, powered by Recharts",
diff --git a/packages/plugin-chatbot/CHANGELOG.md b/packages/plugin-chatbot/CHANGELOG.md
index 5a59a6f862..d169a752e6 100644
--- a/packages/plugin-chatbot/CHANGELOG.md
+++ b/packages/plugin-chatbot/CHANGELOG.md
@@ -1,5 +1,31 @@
 # @object-ui/plugin-chatbot
 
+## 17.3.0
+
+### Patch Changes
+
+- Updated dependencies [532cf8b]
+- Updated dependencies [680080a]
+- Updated dependencies [a7651e6]
+- Updated dependencies [34595eb]
+- Updated dependencies [5781fb1]
+- Updated dependencies [56409c2]
+- Updated dependencies [042e09d]
+- Updated dependencies [23018cc]
+- Updated dependencies [68b6a28]
+- Updated dependencies [f44d872]
+- Updated dependencies [825bbe3]
+- Updated dependencies [a415684]
+- Updated dependencies [f833d3a]
+- Updated dependencies [d22ae31]
+- Updated dependencies [c7ed4c3]
+- Updated dependencies [8d8094a]
+  - @object-ui/components@17.3.0
+  - @object-ui/core@17.3.0
+  - @object-ui/types@17.3.0
+  - @object-ui/i18n@17.3.0
+  - @object-ui/react@17.3.0
+
 ## 17.2.0
 
 ### Minor Changes
diff --git a/packages/plugin-chatbot/package.json b/packages/plugin-chatbot/package.json
index ecdf7fd22e..807f77b9df 100644
--- a/packages/plugin-chatbot/package.json
+++ b/packages/plugin-chatbot/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/plugin-chatbot",
-  "version": "17.2.0",
+  "version": "17.3.0",
   "type": "module",
   "license": "MIT",
   "description": "Chatbot interface plugin for Object UI",
diff --git a/packages/plugin-dashboard/CHANGELOG.md b/packages/plugin-dashboard/CHANGELOG.md
index 412903ec2f..d347fb5619 100644
--- a/packages/plugin-dashboard/CHANGELOG.md
+++ b/packages/plugin-dashboard/CHANGELOG.md
@@ -1,5 +1,38 @@
 # @object-ui/plugin-dashboard
 
+## 17.3.0
+
+### Patch Changes
+
+- Updated dependencies [b7165ce]
+- Updated dependencies [532cf8b]
+- Updated dependencies [680080a]
+- Updated dependencies [a7651e6]
+- Updated dependencies [34595eb]
+- Updated dependencies [5781fb1]
+- Updated dependencies [19b8c9b]
+- Updated dependencies [56409c2]
+- Updated dependencies [042e09d]
+- Updated dependencies [23018cc]
+- Updated dependencies [68b6a28]
+- Updated dependencies [f44d872]
+- Updated dependencies [825bbe3]
+- Updated dependencies [a415684]
+- Updated dependencies [9bc3709]
+- Updated dependencies [f833d3a]
+- Updated dependencies [30ae33a]
+- Updated dependencies [49f7449]
+- Updated dependencies [d22ae31]
+- Updated dependencies [c7ed4c3]
+- Updated dependencies [a321fa4]
+- Updated dependencies [8d8094a]
+  - @object-ui/fields@17.3.0
+  - @object-ui/components@17.3.0
+  - @object-ui/core@17.3.0
+  - @object-ui/types@17.3.0
+  - @object-ui/i18n@17.3.0
+  - @object-ui/react@17.3.0
+
 ## 17.2.0
 
 ### Patch Changes
diff --git a/packages/plugin-dashboard/package.json b/packages/plugin-dashboard/package.json
index 83686110f9..da94932556 100644
--- a/packages/plugin-dashboard/package.json
+++ b/packages/plugin-dashboard/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/plugin-dashboard",
-  "version": "17.2.0",
+  "version": "17.3.0",
   "type": "module",
   "license": "MIT",
   "description": "Dashboard plugin for Object UI",
diff --git a/packages/plugin-designer/CHANGELOG.md b/packages/plugin-designer/CHANGELOG.md
index ea00fe48dd..d64a511e18 100644
--- a/packages/plugin-designer/CHANGELOG.md
+++ b/packages/plugin-designer/CHANGELOG.md
@@ -1,5 +1,41 @@
 # @object-ui/plugin-designer
 
+## 17.3.0
+
+### Patch Changes
+
+- Updated dependencies [b7165ce]
+- Updated dependencies [532cf8b]
+- Updated dependencies [680080a]
+- Updated dependencies [a7651e6]
+- Updated dependencies [34595eb]
+- Updated dependencies [5781fb1]
+- Updated dependencies [19b8c9b]
+- Updated dependencies [56409c2]
+- Updated dependencies [042e09d]
+- Updated dependencies [23018cc]
+- Updated dependencies [68b6a28]
+- Updated dependencies [f44d872]
+- Updated dependencies [825bbe3]
+- Updated dependencies [a415684]
+- Updated dependencies [9bc3709]
+- Updated dependencies [f833d3a]
+- Updated dependencies [30ae33a]
+- Updated dependencies [49f7449]
+- Updated dependencies [d22ae31]
+- Updated dependencies [c7ed4c3]
+- Updated dependencies [a321fa4]
+- Updated dependencies [8d8094a]
+  - @object-ui/fields@17.3.0
+  - @object-ui/components@17.3.0
+  - @object-ui/core@17.3.0
+  - @object-ui/types@17.3.0
+  - @object-ui/i18n@17.3.0
+  - @object-ui/plugin-form@17.3.0
+  - @object-ui/data-objectstack@17.3.0
+  - @object-ui/plugin-grid@17.3.0
+  - @object-ui/react@17.3.0
+
 ## 17.2.0
 
 ### Patch Changes
diff --git a/packages/plugin-designer/package.json b/packages/plugin-designer/package.json
index dd9a43788e..b399daa7ac 100644
--- a/packages/plugin-designer/package.json
+++ b/packages/plugin-designer/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/plugin-designer",
-  "version": "17.2.0",
+  "version": "17.3.0",
   "type": "module",
   "license": "MIT",
   "description": "Visual designer plugin for Object UI with page, data model, process, and report designers plus collaborative editing.",
diff --git a/packages/plugin-detail/CHANGELOG.md b/packages/plugin-detail/CHANGELOG.md
index 1ab1662ee5..3bb6598b89 100644
--- a/packages/plugin-detail/CHANGELOG.md
+++ b/packages/plugin-detail/CHANGELOG.md
@@ -1,5 +1,92 @@
 # @object-ui/plugin-detail
 
+## 17.3.0
+
+### Patch Changes
+
+- 532cf8b: Deliver the required state to the control in the five renderers outside the object form that still painted it as an asterisk only (objectui#3299 — the same defect #3290/#3298 fixed in `form.tsx`).
+
+  Each site converges on the reference shape (`EmbeddableForm.tsx`): the control carries `aria-required={required || undefined}` and the asterisk is `aria-hidden="true"`, so assistive tech announces required once, as a state — instead of hearing a bare "asterisk" folded into the accessible name, or nothing at all.
+
+  - `@object-ui/app-shell` — `ActionParamDialog` (both the boolean row and the default branch, delivered through the real field widgets' `toDomProps` whitelist) and `CreateViewDialog` (display label, machine name, and every type-specific required-field selector).
+  - `@object-ui/components` — the custom `ActionParamDialog` (all five typed branches, including the Radix select trigger) and `FieldContainer`, whose existing Slot injection (`id` / `aria-describedby` / `aria-invalid`) now also injects `aria-required`, covering every consumer in one place.
+  - `@object-ui/plugin-detail` — `InlineCreateRelated`'s create-tab inputs.
+
+  Deliberately NOT the native `required` attribute (#3290 ruling): each of these hosts runs its own validation, and native `required` would arm the browser's constraint-validation bubble beside it. The SDUI controls that already use native `required` (`renderers/form/{input,textarea,select,checkbox}.tsx`, `basic/text-input.tsx`) are unchanged — they don't have a second validator, so their channel is already correct.
+
+- bbbde12: Behavior change — **an authored display `type` can NARROW inline editability, but never WIDEN it** (objectui#3355).
+
+  Both detail-surface editability gates (`HeaderHighlight`, the `record:highlights` strip; `DetailSection`, the details body) used to resolve ONE effective type with display precedence — `viewFieldType || objectFieldType`. An authored non-computed `type` therefore ERASED the object's `formula` / `summary` / `rollup` / `auto_number` declaration from the gate's view, and a machine-owned column became inline-editable.
+
+  The gate now reads the two types separately and takes their UNION: a field is non-editable if the authored entry type **or** the object field's type is computed. Renderer/editor selection keeps the old precedence, so nothing about the display changes — only who may write.
+
+  What flips:
+
+  - `{ name: 'supply_share', type: 'number' }` authored over an object field declared `rollup` (or `formula` / `summary` / `auto_number`) — a display override written to fix formatting — no longer offers a pencil / double-click editor. This is the shipped configuration behind objectstack-ai/objectstack#5077: a hook-maintained rollup was overwritten by hand from the header strip and stayed corrupted until an unrelated child-row touch re-fired it (downstream yinlianghui/hotcrm-heimao#61).
+  - Narrowing is unchanged: an authored `type: 'formula'` still locks a plain object column.
+  - Fields with no authored computed type over a plain object column stay editable, and the entry-level `readonly` declaration from objectui#3356 is still honored.
+
+  The object schema is authoritative about what is machine-computed; a presentation override has no business granting write access. The rule now lives in ONE shared helper, `isComputedFieldType` in `fieldEnrichment.ts` — beside `enrichDetailField`, the module both hosts already share — with the computed-type set moved there too (still re-exported as `TEXTUAL_REF_FALLBACK_TYPES`), so the strip and the body cannot drift apart again.
+
+- 23018cc: `record:highlights` now honours a `readonly: true` on an authored field entry, so a header chip for a platform-owned column no longer offers inline edit. `HeaderHighlight`'s editability gate already consulted `field.readonly`, but the renderer rebuilt each entry from a fixed `{name,label,icon,type}` list and dropped `readonly` one layer before that check, so the gate could never fire from authored metadata — a hook-maintained rollup or approval-written grade could be overwritten by hand from the detail-page header strip and stayed wrong until an unrelated write re-fired the computation. `readonly` is now a declared key on `HighlightField` and on the `RecordHighlightsComponentProps.fields[]` entry union, mirroring `DetailViewField.readonly` (objectstack#5077).
+- c7fba27: `field:permission-facet-link` now registers through `withFieldCarrier` — the
+  repo's only raw `field:` registration bypassed the single-metadata-carrier seam
+  (objectui#3233), so under the SDUI path (`SchemaRenderer` passes `schema`,
+  never `field`) the widget read `field === undefined` and silently rendered an
+  anonymous facet summary (`field?.name` empty, no facet branch selected). The
+  form and inline-edit hosts were unaffected — they pass `field` directly, which
+  the carrier forwards unchanged. Fixes objectui#3307.
+- 12bf669: The record discussion panel now says "loading" while it is loading, instead of
+  "No comments yet" (objectui#3209).
+
+  FROM: opening any record page showed the discussion/chatter panel asserting
+  `No comments yet` for the whole first leg of the page, then contradicting
+  itself when the comments appeared. TO: the panel shows the loading row until
+  the feed has actually answered, and only then commits to "this record has no
+  comments".
+
+  objectui#3205 gave `RecordActivityTimeline` the render branch that prefers a
+  loading row over the empty copy, and `RecordChatterPanel` already forwarded
+  `loading` to it in both positions — but on the chatter chain **nothing
+  produced the signal**, so that branch could never fire. `record:activity`
+  computes its own flag and was visibly fixed by #3205; chatter was not. The
+  four wiring points are one chain and are all closed here, because any one of
+  them left open still ships the empty copy to some user:
+
+  - `RecordDetailView` — the host that OWNS the feed fetch — now derives a
+    `feedLoading` flag from its two reads (`sys_comment` + `sys_activity`);
+  - `<DiscussionContextProvider loading={feedLoading}>` publishes it (the field
+    was already declared on `DiscussionContextValue`, and already read by
+    `record:activity`);
+  - the auto-appended `<RecordChatterPanel loading={feedLoading}>` — the panel
+    authored pages get when they place no discussion slot — receives it
+    directly;
+  - the `record:chatter` / `record:discussion` renderer forwards
+    `loading={discussion?.loading}`, so a hand-placed block is on the same
+    chain as the synthesized one.
+
+  The two reads run in parallel, so the flag closes over **both**: it clears on
+  `Promise.allSettled`, and a REJECTED read counts as an answer. A deployment
+  without the audit plugin 404s `sys_activity` and an object with
+  `enable.feeds: false` 403s `sys_comment`; neither may pin the panel in a
+  permanent spinner, which would be a worse bug than the one being fixed. The
+  flag is keyed by `object:recordId` rather than being a plain boolean, so the
+  first render of a record already reads as loading (no one-frame flash of the
+  empty state) and navigating between records cannot show the previous record's
+  settled answer.
+
+  No tolerance was added at the consumer. The timeline still does not guess that
+  "no items yet and just mounted" means loading — that guess is wrong the moment
+  a record genuinely has no comments, and the signal belongs to whoever owns the
+  fetch. Same shape as objectui#3165 / #3205: divergence converges at the
+  producer.
+
+- Updated dependencies [68b6a28]
+- Updated dependencies [825bbe3]
+- Updated dependencies [a415684]
+- Updated dependencies [c7ed4c3]
+  - @object-ui/i18n@17.3.0
+
 ## 17.2.0
 
 ### Minor Changes
diff --git a/packages/plugin-detail/package.json b/packages/plugin-detail/package.json
index 8e622d139c..a0790d9a6f 100644
--- a/packages/plugin-detail/package.json
+++ b/packages/plugin-detail/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/plugin-detail",
-  "version": "17.2.0",
+  "version": "17.3.0",
   "type": "module",
   "license": "MIT",
   "description": "DetailView plugin for Object UI - comprehensive detail page with sections, tabs, and related lists",
diff --git a/packages/plugin-editor/CHANGELOG.md b/packages/plugin-editor/CHANGELOG.md
index dc8a1c3ae4..c438fae59f 100644
--- a/packages/plugin-editor/CHANGELOG.md
+++ b/packages/plugin-editor/CHANGELOG.md
@@ -1,5 +1,27 @@
 # @object-ui/plugin-editor
 
+## 17.3.0
+
+### Patch Changes
+
+- Updated dependencies [532cf8b]
+- Updated dependencies [680080a]
+- Updated dependencies [a7651e6]
+- Updated dependencies [34595eb]
+- Updated dependencies [5781fb1]
+- Updated dependencies [56409c2]
+- Updated dependencies [042e09d]
+- Updated dependencies [23018cc]
+- Updated dependencies [f44d872]
+- Updated dependencies [825bbe3]
+- Updated dependencies [f833d3a]
+- Updated dependencies [d22ae31]
+- Updated dependencies [8d8094a]
+  - @object-ui/components@17.3.0
+  - @object-ui/core@17.3.0
+  - @object-ui/types@17.3.0
+  - @object-ui/react@17.3.0
+
 ## 17.2.0
 
 ### Patch Changes
diff --git a/packages/plugin-editor/package.json b/packages/plugin-editor/package.json
index 4993a19c6e..22d5f95081 100644
--- a/packages/plugin-editor/package.json
+++ b/packages/plugin-editor/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/plugin-editor",
-  "version": "17.2.0",
+  "version": "17.3.0",
   "type": "module",
   "license": "MIT",
   "description": "Rich text editor plugin for Object UI, powered by Monaco Editor",
diff --git a/packages/plugin-form/CHANGELOG.md b/packages/plugin-form/CHANGELOG.md
index 2ad26615b6..01779e6869 100644
--- a/packages/plugin-form/CHANGELOG.md
+++ b/packages/plugin-form/CHANGELOG.md
@@ -1,5 +1,128 @@
 # @object-ui/plugin-form
 
+## 17.3.0
+
+### Minor Changes
+
+- f44d872: `mobile.fullscreenLongText` finally reaches auto-generated long-text fields, and
+  `mobile_fullscreen` gets one declared carrier (objectui#3245).
+
+  FROM: `ObjectForm` stamped the flag onto the FormField itself
+  (`{ ...f, mobile_fullscreen: true }`). TO: it stamps the flag onto the object the
+  form renderer will actually forward to the widget as `field` — `f.field || f`,
+  resolved exactly the way `renderFieldComponent` resolves it.
+
+  **The flag's only legal carrier is the field metadata, and its only producer is
+  `ObjectForm`.** That convention was already what the widget side assumed after
+  objectui#3232/#3233 (`TextAreaField` reads `field.mobile_fullscreen` and nothing
+  else, and `field` is the single metadata carrier); the producer was writing to a
+  different object, so for auto-generated fields the two never met.
+
+  What was broken, end to end: `ObjectForm` builds an auto-generated field as
+  `type: 'field:textarea'` **and** stashes the object-field metadata on `.field`.
+  The renderer forwards `field: field.field || field`, so the widget received the
+  raw metadata — which never carried the flag — while the FormField-level copy was
+  dropped by `stripRegisteredFieldProps`. Every entry point into `TextAreaField`
+  therefore read `undefined` and the expand affordance never rendered. Only the
+  hand-authored `customFields` path (no `.field` to shadow the FormField) ever
+  worked, i.e. the feature was dead on the path virtually every form takes. Unit
+  tests on both ends passed the whole time, because the break lived in the seam
+  between them; this release adds the feature's first integration coverage — real
+  `ObjectForm` → real form renderer → real `TextAreaField`, no mocks — which fails
+  against the old producer and passes against the new one.
+
+  `mobile_fullscreen` is now declared on `@object-ui/types`' `BaseFieldMetadata`,
+  hence on every member of the `FieldMetadata` union that
+  `FieldWidgetComponentProps.field` resolves to. It is deliberately **not** an
+  `@objectstack/spec` property: nobody authors it on a field definition, it is a
+  projection of the form-level `ObjectFormSchema.mobile.fullscreenLongText` setting
+  onto the field metadata at render time. Declaring it removes the last untyped
+  end of the chain — the producer's `as FormField` cast is gone — so the two sides
+  can now disagree out loud instead of silently.
+
+  The hand-authored `customFields` path keeps working unchanged, and keeps its own
+  metadata: the flag is stamped on the FormField only when there is no `.field` to
+  carry it. Synthesizing a `field` object in that case would light the affordance
+  up while quietly replacing the field's `rows` / `placeholder` with defaults — the
+  regression test pins that too.
+
+- 30ae33a: `RichTextField` honours `mobile_fullscreen`, so `mobile.fullscreenLongText` is
+  finally true of rich text too (objectui#3301).
+
+  `ObjectFormSchema.mobile.fullscreenLongText` has always been documented as
+  "textarea/rich-text get an expand button", and `ObjectForm` has always stamped
+  `mobile_fullscreen` onto `field:markdown` / `field:html` fields to deliver it.
+  Both of those types resolve to `RichTextField`, and that widget never read the
+  flag: a producer with no consumer. Turning the setting on gave a phone user an
+  expand affordance on their textareas and nothing at all on their markdown or
+  HTML fields, with nothing anywhere reporting that half the feature was inert.
+
+  FROM: `RichTextField` ignored the flag entirely (`grep fullscreen` over that
+  file returned nothing). TO: it reads `field.mobile_fullscreen` — the same single
+  metadata carrier `TextAreaField` reads, and nowhere else — and renders the same
+  expand affordance and full-height editing dialog.
+
+  **The affordance now has one implementation, not two.** One form-level setting
+  should produce one behaviour, so the expand button, the dialog and the
+  draft/commit semantics moved into a shared `FullscreenFieldEditor` that both
+  widgets render; only the EDITOR is per-widget. A second hand-written copy of
+  that state machine would be the same defect this release fixes, with an extra
+  step — it drifts, and nothing reports the drift. The rich-text dialog hosts the
+  widget's real editing surface (same format indicator, same editor), not a bare
+  textarea, so whatever that editor grows into, both positions get it at once.
+
+  Behaviour is identical across the two widgets and unchanged for
+  `TextAreaField`: the dialog seeds its draft from the committed value at open
+  time, keeps typing local (a react-hook-form field is not marked dirty by an
+  edit the user may still cancel), commits once on "Done", and discards on
+  "Cancel". Test ids follow the existing convention per widget —
+  `richtext-fullscreen-toggle` / `-dialog` / `-input` / `-save` alongside the
+  `textarea-*` ones, since a single form can contain both.
+
+  There is deliberately no prop spelling of the flag and no `??` fallback chain in
+  either widget. The field metadata is the one carrier (objectui#3233), so a
+  misspelled or misplaced flag stays inert and visible rather than being quietly
+  caught by a tolerant consumer.
+
+  Also removes a dead type from the producer: `ObjectForm` stamped the flag on
+  `'string-multiline'`, a string that `grep -rn` finds exactly once across both
+  this repo and `objectstack` — that line itself. No producer emitted it, no
+  registry key matched it, no widget read it. The remaining four stamped types
+  (`textarea`, `field:textarea`, `field:markdown`, `field:html`) each have a real
+  reader.
+
+### Patch Changes
+
+- Updated dependencies [b7165ce]
+- Updated dependencies [532cf8b]
+- Updated dependencies [680080a]
+- Updated dependencies [a7651e6]
+- Updated dependencies [34595eb]
+- Updated dependencies [5781fb1]
+- Updated dependencies [19b8c9b]
+- Updated dependencies [56409c2]
+- Updated dependencies [042e09d]
+- Updated dependencies [23018cc]
+- Updated dependencies [68b6a28]
+- Updated dependencies [f44d872]
+- Updated dependencies [825bbe3]
+- Updated dependencies [a415684]
+- Updated dependencies [9bc3709]
+- Updated dependencies [f833d3a]
+- Updated dependencies [30ae33a]
+- Updated dependencies [49f7449]
+- Updated dependencies [d22ae31]
+- Updated dependencies [c7ed4c3]
+- Updated dependencies [a321fa4]
+- Updated dependencies [8d8094a]
+  - @object-ui/fields@17.3.0
+  - @object-ui/components@17.3.0
+  - @object-ui/core@17.3.0
+  - @object-ui/types@17.3.0
+  - @object-ui/i18n@17.3.0
+  - @object-ui/react@17.3.0
+  - @object-ui/permissions@17.3.0
+
 ## 17.2.0
 
 ### Minor Changes
diff --git a/packages/plugin-form/package.json b/packages/plugin-form/package.json
index f7c065cf1f..9757a3d280 100644
--- a/packages/plugin-form/package.json
+++ b/packages/plugin-form/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/plugin-form",
-  "version": "17.2.0",
+  "version": "17.3.0",
   "type": "module",
   "license": "MIT",
   "description": "Form plugin for Object UI",
diff --git a/packages/plugin-gantt/CHANGELOG.md b/packages/plugin-gantt/CHANGELOG.md
index b638ae0b83..a4632b8266 100644
--- a/packages/plugin-gantt/CHANGELOG.md
+++ b/packages/plugin-gantt/CHANGELOG.md
@@ -1,5 +1,42 @@
 # @object-ui/plugin-gantt
 
+## 17.3.0
+
+### Patch Changes
+
+- Updated dependencies [b7165ce]
+- Updated dependencies [532cf8b]
+- Updated dependencies [680080a]
+- Updated dependencies [a7651e6]
+- Updated dependencies [34595eb]
+- Updated dependencies [5781fb1]
+- Updated dependencies [bbbde12]
+- Updated dependencies [19b8c9b]
+- Updated dependencies [56409c2]
+- Updated dependencies [042e09d]
+- Updated dependencies [23018cc]
+- Updated dependencies [68b6a28]
+- Updated dependencies [f44d872]
+- Updated dependencies [825bbe3]
+- Updated dependencies [c7fba27]
+- Updated dependencies [a415684]
+- Updated dependencies [12bf669]
+- Updated dependencies [9bc3709]
+- Updated dependencies [f833d3a]
+- Updated dependencies [30ae33a]
+- Updated dependencies [49f7449]
+- Updated dependencies [d22ae31]
+- Updated dependencies [c7ed4c3]
+- Updated dependencies [a321fa4]
+- Updated dependencies [8d8094a]
+  - @object-ui/fields@17.3.0
+  - @object-ui/components@17.3.0
+  - @object-ui/plugin-detail@17.3.0
+  - @object-ui/core@17.3.0
+  - @object-ui/types@17.3.0
+  - @object-ui/i18n@17.3.0
+  - @object-ui/react@17.3.0
+
 ## 17.2.0
 
 ### Patch Changes
diff --git a/packages/plugin-gantt/package.json b/packages/plugin-gantt/package.json
index c3e88e0324..f14477a72a 100644
--- a/packages/plugin-gantt/package.json
+++ b/packages/plugin-gantt/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/plugin-gantt",
-  "version": "17.2.0",
+  "version": "17.3.0",
   "type": "module",
   "license": "MIT",
   "description": "Gantt chart plugin for Object UI",
diff --git a/packages/plugin-grid/CHANGELOG.md b/packages/plugin-grid/CHANGELOG.md
index c178b17f6e..372ee866ad 100644
--- a/packages/plugin-grid/CHANGELOG.md
+++ b/packages/plugin-grid/CHANGELOG.md
@@ -1,5 +1,40 @@
 # @object-ui/plugin-grid
 
+## 17.3.0
+
+### Patch Changes
+
+- Updated dependencies [b7165ce]
+- Updated dependencies [532cf8b]
+- Updated dependencies [680080a]
+- Updated dependencies [a7651e6]
+- Updated dependencies [34595eb]
+- Updated dependencies [5781fb1]
+- Updated dependencies [19b8c9b]
+- Updated dependencies [56409c2]
+- Updated dependencies [042e09d]
+- Updated dependencies [23018cc]
+- Updated dependencies [68b6a28]
+- Updated dependencies [f44d872]
+- Updated dependencies [825bbe3]
+- Updated dependencies [a415684]
+- Updated dependencies [9bc3709]
+- Updated dependencies [f833d3a]
+- Updated dependencies [30ae33a]
+- Updated dependencies [49f7449]
+- Updated dependencies [d22ae31]
+- Updated dependencies [c7ed4c3]
+- Updated dependencies [a321fa4]
+- Updated dependencies [8d8094a]
+  - @object-ui/fields@17.3.0
+  - @object-ui/components@17.3.0
+  - @object-ui/core@17.3.0
+  - @object-ui/types@17.3.0
+  - @object-ui/i18n@17.3.0
+  - @object-ui/react@17.3.0
+  - @object-ui/mobile@17.3.0
+  - @object-ui/permissions@17.3.0
+
 ## 17.2.0
 
 ### Minor Changes
diff --git a/packages/plugin-grid/package.json b/packages/plugin-grid/package.json
index b102aa9081..cd79ddc6d7 100644
--- a/packages/plugin-grid/package.json
+++ b/packages/plugin-grid/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/plugin-grid",
-  "version": "17.2.0",
+  "version": "17.3.0",
   "type": "module",
   "license": "MIT",
   "description": "Grid plugin for Object UI",
diff --git a/packages/plugin-kanban/CHANGELOG.md b/packages/plugin-kanban/CHANGELOG.md
index c484043e26..b0572c157e 100644
--- a/packages/plugin-kanban/CHANGELOG.md
+++ b/packages/plugin-kanban/CHANGELOG.md
@@ -1,5 +1,42 @@
 # @object-ui/plugin-kanban
 
+## 17.3.0
+
+### Patch Changes
+
+- Updated dependencies [b7165ce]
+- Updated dependencies [532cf8b]
+- Updated dependencies [680080a]
+- Updated dependencies [a7651e6]
+- Updated dependencies [34595eb]
+- Updated dependencies [5781fb1]
+- Updated dependencies [bbbde12]
+- Updated dependencies [19b8c9b]
+- Updated dependencies [56409c2]
+- Updated dependencies [042e09d]
+- Updated dependencies [23018cc]
+- Updated dependencies [68b6a28]
+- Updated dependencies [f44d872]
+- Updated dependencies [825bbe3]
+- Updated dependencies [c7fba27]
+- Updated dependencies [a415684]
+- Updated dependencies [12bf669]
+- Updated dependencies [9bc3709]
+- Updated dependencies [f833d3a]
+- Updated dependencies [30ae33a]
+- Updated dependencies [49f7449]
+- Updated dependencies [d22ae31]
+- Updated dependencies [c7ed4c3]
+- Updated dependencies [a321fa4]
+- Updated dependencies [8d8094a]
+  - @object-ui/fields@17.3.0
+  - @object-ui/components@17.3.0
+  - @object-ui/plugin-detail@17.3.0
+  - @object-ui/core@17.3.0
+  - @object-ui/types@17.3.0
+  - @object-ui/i18n@17.3.0
+  - @object-ui/react@17.3.0
+
 ## 17.2.0
 
 ### Patch Changes
diff --git a/packages/plugin-kanban/package.json b/packages/plugin-kanban/package.json
index 920236e49b..c2cb07c8bc 100644
--- a/packages/plugin-kanban/package.json
+++ b/packages/plugin-kanban/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/plugin-kanban",
-  "version": "17.2.0",
+  "version": "17.3.0",
   "type": "module",
   "license": "MIT",
   "description": "Kanban board plugin for Object UI, powered by dnd-kit",
diff --git a/packages/plugin-list/CHANGELOG.md b/packages/plugin-list/CHANGELOG.md
index 0dc63b5460..929b6e1093 100644
--- a/packages/plugin-list/CHANGELOG.md
+++ b/packages/plugin-list/CHANGELOG.md
@@ -1,5 +1,7 @@
 # @object-ui/plugin-list
 
+## 17.3.0
+
 ## 17.2.0
 
 ### Minor Changes
diff --git a/packages/plugin-list/package.json b/packages/plugin-list/package.json
index bd52f84c91..34cd5bcf2c 100644
--- a/packages/plugin-list/package.json
+++ b/packages/plugin-list/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/plugin-list",
-  "version": "17.2.0",
+  "version": "17.3.0",
   "type": "module",
   "license": "MIT",
   "description": "ListView plugin for Object UI - unified view component with view type switching",
diff --git a/packages/plugin-map/CHANGELOG.md b/packages/plugin-map/CHANGELOG.md
index 1239c94ca3..31adee3584 100644
--- a/packages/plugin-map/CHANGELOG.md
+++ b/packages/plugin-map/CHANGELOG.md
@@ -1,5 +1,27 @@
 # @object-ui/plugin-map
 
+## 17.3.0
+
+### Patch Changes
+
+- Updated dependencies [532cf8b]
+- Updated dependencies [680080a]
+- Updated dependencies [a7651e6]
+- Updated dependencies [34595eb]
+- Updated dependencies [5781fb1]
+- Updated dependencies [56409c2]
+- Updated dependencies [042e09d]
+- Updated dependencies [23018cc]
+- Updated dependencies [f44d872]
+- Updated dependencies [825bbe3]
+- Updated dependencies [f833d3a]
+- Updated dependencies [d22ae31]
+- Updated dependencies [8d8094a]
+  - @object-ui/components@17.3.0
+  - @object-ui/core@17.3.0
+  - @object-ui/types@17.3.0
+  - @object-ui/react@17.3.0
+
 ## 17.2.0
 
 ### Patch Changes
diff --git a/packages/plugin-map/package.json b/packages/plugin-map/package.json
index 1964c9ffd7..d4ca3a7d44 100644
--- a/packages/plugin-map/package.json
+++ b/packages/plugin-map/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/plugin-map",
-  "version": "17.2.0",
+  "version": "17.3.0",
   "type": "module",
   "license": "MIT",
   "description": "Map visualization plugin for Object UI",
diff --git a/packages/plugin-markdown/CHANGELOG.md b/packages/plugin-markdown/CHANGELOG.md
index 7a0b97c262..026ba3a804 100644
--- a/packages/plugin-markdown/CHANGELOG.md
+++ b/packages/plugin-markdown/CHANGELOG.md
@@ -1,5 +1,27 @@
 # @object-ui/plugin-markdown
 
+## 17.3.0
+
+### Patch Changes
+
+- Updated dependencies [532cf8b]
+- Updated dependencies [680080a]
+- Updated dependencies [a7651e6]
+- Updated dependencies [34595eb]
+- Updated dependencies [5781fb1]
+- Updated dependencies [56409c2]
+- Updated dependencies [042e09d]
+- Updated dependencies [23018cc]
+- Updated dependencies [f44d872]
+- Updated dependencies [825bbe3]
+- Updated dependencies [f833d3a]
+- Updated dependencies [d22ae31]
+- Updated dependencies [8d8094a]
+  - @object-ui/components@17.3.0
+  - @object-ui/core@17.3.0
+  - @object-ui/types@17.3.0
+  - @object-ui/react@17.3.0
+
 ## 17.2.0
 
 ### Patch Changes
diff --git a/packages/plugin-markdown/package.json b/packages/plugin-markdown/package.json
index 30531b5031..e7fd0eabde 100644
--- a/packages/plugin-markdown/package.json
+++ b/packages/plugin-markdown/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/plugin-markdown",
-  "version": "17.2.0",
+  "version": "17.3.0",
   "type": "module",
   "license": "MIT",
   "description": "Markdown rendering plugin for Object UI, powered by react-markdown",
diff --git a/packages/plugin-report/CHANGELOG.md b/packages/plugin-report/CHANGELOG.md
index fd23d80f7e..a0b867bbc8 100644
--- a/packages/plugin-report/CHANGELOG.md
+++ b/packages/plugin-report/CHANGELOG.md
@@ -1,5 +1,39 @@
 # @object-ui/plugin-report
 
+## 17.3.0
+
+### Patch Changes
+
+- Updated dependencies [b7165ce]
+- Updated dependencies [532cf8b]
+- Updated dependencies [680080a]
+- Updated dependencies [a7651e6]
+- Updated dependencies [34595eb]
+- Updated dependencies [5781fb1]
+- Updated dependencies [19b8c9b]
+- Updated dependencies [56409c2]
+- Updated dependencies [042e09d]
+- Updated dependencies [23018cc]
+- Updated dependencies [68b6a28]
+- Updated dependencies [f44d872]
+- Updated dependencies [825bbe3]
+- Updated dependencies [a415684]
+- Updated dependencies [9bc3709]
+- Updated dependencies [f833d3a]
+- Updated dependencies [30ae33a]
+- Updated dependencies [49f7449]
+- Updated dependencies [d22ae31]
+- Updated dependencies [c7ed4c3]
+- Updated dependencies [a321fa4]
+- Updated dependencies [8d8094a]
+  - @object-ui/fields@17.3.0
+  - @object-ui/components@17.3.0
+  - @object-ui/core@17.3.0
+  - @object-ui/types@17.3.0
+  - @object-ui/i18n@17.3.0
+  - @object-ui/plugin-grid@17.3.0
+  - @object-ui/react@17.3.0
+
 ## 17.2.0
 
 ### Patch Changes
diff --git a/packages/plugin-report/package.json b/packages/plugin-report/package.json
index c6c3288b6f..2cdee8c423 100644
--- a/packages/plugin-report/package.json
+++ b/packages/plugin-report/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/plugin-report",
-  "version": "17.2.0",
+  "version": "17.3.0",
   "type": "module",
   "main": "dist/index.umd.cjs",
   "module": "dist/index.js",
diff --git a/packages/plugin-timeline/CHANGELOG.md b/packages/plugin-timeline/CHANGELOG.md
index 0dd997a91d..27c6dbc9bd 100644
--- a/packages/plugin-timeline/CHANGELOG.md
+++ b/packages/plugin-timeline/CHANGELOG.md
@@ -1,5 +1,32 @@
 # @object-ui/plugin-timeline
 
+## 17.3.0
+
+### Patch Changes
+
+- Updated dependencies [532cf8b]
+- Updated dependencies [680080a]
+- Updated dependencies [a7651e6]
+- Updated dependencies [34595eb]
+- Updated dependencies [5781fb1]
+- Updated dependencies [56409c2]
+- Updated dependencies [042e09d]
+- Updated dependencies [23018cc]
+- Updated dependencies [68b6a28]
+- Updated dependencies [f44d872]
+- Updated dependencies [825bbe3]
+- Updated dependencies [a415684]
+- Updated dependencies [f833d3a]
+- Updated dependencies [d22ae31]
+- Updated dependencies [c7ed4c3]
+- Updated dependencies [8d8094a]
+  - @object-ui/components@17.3.0
+  - @object-ui/core@17.3.0
+  - @object-ui/types@17.3.0
+  - @object-ui/i18n@17.3.0
+  - @object-ui/react@17.3.0
+  - @object-ui/mobile@17.3.0
+
 ## 17.2.0
 
 ### Minor Changes
diff --git a/packages/plugin-timeline/package.json b/packages/plugin-timeline/package.json
index f3c6e0ea82..44ae16e82d 100644
--- a/packages/plugin-timeline/package.json
+++ b/packages/plugin-timeline/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/plugin-timeline",
-  "version": "17.2.0",
+  "version": "17.3.0",
   "type": "module",
   "license": "MIT",
   "description": "Timeline component plugin for Object UI",
diff --git a/packages/plugin-tree/CHANGELOG.md b/packages/plugin-tree/CHANGELOG.md
index 28547d051b..c7b0da3bb8 100644
--- a/packages/plugin-tree/CHANGELOG.md
+++ b/packages/plugin-tree/CHANGELOG.md
@@ -1,5 +1,27 @@
 # @object-ui/plugin-tree
 
+## 17.3.0
+
+### Patch Changes
+
+- Updated dependencies [532cf8b]
+- Updated dependencies [680080a]
+- Updated dependencies [a7651e6]
+- Updated dependencies [34595eb]
+- Updated dependencies [5781fb1]
+- Updated dependencies [56409c2]
+- Updated dependencies [042e09d]
+- Updated dependencies [23018cc]
+- Updated dependencies [f44d872]
+- Updated dependencies [825bbe3]
+- Updated dependencies [f833d3a]
+- Updated dependencies [d22ae31]
+- Updated dependencies [8d8094a]
+  - @object-ui/components@17.3.0
+  - @object-ui/core@17.3.0
+  - @object-ui/types@17.3.0
+  - @object-ui/react@17.3.0
+
 ## 17.2.0
 
 ### Patch Changes
diff --git a/packages/plugin-tree/package.json b/packages/plugin-tree/package.json
index ff3b4080b9..bcec024e19 100644
--- a/packages/plugin-tree/package.json
+++ b/packages/plugin-tree/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/plugin-tree",
-  "version": "17.2.0",
+  "version": "17.3.0",
   "type": "module",
   "license": "MIT",
   "description": "Tree / tree-grid visualization plugin for Object UI",
diff --git a/packages/plugin-view/CHANGELOG.md b/packages/plugin-view/CHANGELOG.md
index 4e3c6ca418..0a86376dd3 100644
--- a/packages/plugin-view/CHANGELOG.md
+++ b/packages/plugin-view/CHANGELOG.md
@@ -1,5 +1,34 @@
 # @object-ui/plugin-view
 
+## 17.3.0
+
+### Patch Changes
+
+- Updated dependencies [532cf8b]
+- Updated dependencies [680080a]
+- Updated dependencies [a7651e6]
+- Updated dependencies [34595eb]
+- Updated dependencies [5781fb1]
+- Updated dependencies [56409c2]
+- Updated dependencies [042e09d]
+- Updated dependencies [23018cc]
+- Updated dependencies [68b6a28]
+- Updated dependencies [f44d872]
+- Updated dependencies [825bbe3]
+- Updated dependencies [a415684]
+- Updated dependencies [f833d3a]
+- Updated dependencies [30ae33a]
+- Updated dependencies [d22ae31]
+- Updated dependencies [c7ed4c3]
+- Updated dependencies [8d8094a]
+  - @object-ui/components@17.3.0
+  - @object-ui/core@17.3.0
+  - @object-ui/types@17.3.0
+  - @object-ui/i18n@17.3.0
+  - @object-ui/plugin-form@17.3.0
+  - @object-ui/plugin-grid@17.3.0
+  - @object-ui/react@17.3.0
+
 ## 17.2.0
 
 ### Patch Changes
diff --git a/packages/plugin-view/package.json b/packages/plugin-view/package.json
index 6ffbd4866d..a8c71c61a8 100644
--- a/packages/plugin-view/package.json
+++ b/packages/plugin-view/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/plugin-view",
-  "version": "17.2.0",
+  "version": "17.3.0",
   "type": "module",
   "license": "MIT",
   "description": "Object View plugin for Object UI",
diff --git a/packages/providers/CHANGELOG.md b/packages/providers/CHANGELOG.md
index 91fac63d39..660bff590b 100644
--- a/packages/providers/CHANGELOG.md
+++ b/packages/providers/CHANGELOG.md
@@ -1,5 +1,15 @@
 # @object-ui/providers — Changelog
 
+## 17.3.0
+
+### Patch Changes
+
+- Updated dependencies [23018cc]
+- Updated dependencies [f44d872]
+- Updated dependencies [f833d3a]
+- Updated dependencies [d22ae31]
+  - @object-ui/types@17.3.0
+
 ## 17.2.0
 
 ### Minor Changes
diff --git a/packages/providers/package.json b/packages/providers/package.json
index c1b287079d..912207f1a0 100644
--- a/packages/providers/package.json
+++ b/packages/providers/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/providers",
-  "version": "17.2.0",
+  "version": "17.3.0",
   "type": "module",
   "license": "MIT",
   "description": "Reusable context providers for ObjectUI applications",
diff --git a/packages/react-runtime/CHANGELOG.md b/packages/react-runtime/CHANGELOG.md
index cd44f51d1b..403cd27fa3 100644
--- a/packages/react-runtime/CHANGELOG.md
+++ b/packages/react-runtime/CHANGELOG.md
@@ -1,5 +1,7 @@
 # @object-ui/react-runtime
 
+## 17.3.0
+
 ## 17.2.0
 
 ## 17.1.0
diff --git a/packages/react-runtime/package.json b/packages/react-runtime/package.json
index 1943f6d365..f3d2c8c5d8 100644
--- a/packages/react-runtime/package.json
+++ b/packages/react-runtime/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/react-runtime",
-  "version": "17.2.0",
+  "version": "17.3.0",
   "type": "module",
   "sideEffects": false,
   "license": "MIT",
diff --git a/packages/react/CHANGELOG.md b/packages/react/CHANGELOG.md
index 671dc1f19a..e776a7a5b3 100644
--- a/packages/react/CHANGELOG.md
+++ b/packages/react/CHANGELOG.md
@@ -1,5 +1,23 @@
 # @object-ui/react
 
+## 17.3.0
+
+### Patch Changes
+
+- Updated dependencies [5781fb1]
+- Updated dependencies [23018cc]
+- Updated dependencies [68b6a28]
+- Updated dependencies [f44d872]
+- Updated dependencies [825bbe3]
+- Updated dependencies [a415684]
+- Updated dependencies [f833d3a]
+- Updated dependencies [d22ae31]
+- Updated dependencies [c7ed4c3]
+  - @object-ui/core@17.3.0
+  - @object-ui/types@17.3.0
+  - @object-ui/i18n@17.3.0
+  - @object-ui/data-objectstack@17.3.0
+
 ## 17.2.0
 
 ### Minor Changes
diff --git a/packages/react/package.json b/packages/react/package.json
index 1fee3a1266..6111f051b0 100644
--- a/packages/react/package.json
+++ b/packages/react/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/react",
-  "version": "17.2.0",
+  "version": "17.3.0",
   "type": "module",
   "license": "MIT",
   "description": "React bindings and SchemaRenderer component for Object UI",
diff --git a/packages/runner/CHANGELOG.md b/packages/runner/CHANGELOG.md
index 8ede3ce17a..4929ec23db 100644
--- a/packages/runner/CHANGELOG.md
+++ b/packages/runner/CHANGELOG.md
@@ -1,5 +1,30 @@
 # @object-ui/runner
 
+## 17.3.0
+
+### Patch Changes
+
+- Updated dependencies [532cf8b]
+- Updated dependencies [680080a]
+- Updated dependencies [a7651e6]
+- Updated dependencies [34595eb]
+- Updated dependencies [5781fb1]
+- Updated dependencies [56409c2]
+- Updated dependencies [042e09d]
+- Updated dependencies [23018cc]
+- Updated dependencies [f44d872]
+- Updated dependencies [524a635]
+- Updated dependencies [825bbe3]
+- Updated dependencies [f833d3a]
+- Updated dependencies [d22ae31]
+- Updated dependencies [8d8094a]
+  - @object-ui/components@17.3.0
+  - @object-ui/core@17.3.0
+  - @object-ui/types@17.3.0
+  - @object-ui/plugin-charts@17.3.0
+  - @object-ui/plugin-kanban@17.3.0
+  - @object-ui/react@17.3.0
+
 ## 17.2.0
 
 ### Minor Changes
diff --git a/packages/runner/package.json b/packages/runner/package.json
index 2c1a48e750..4026638e35 100644
--- a/packages/runner/package.json
+++ b/packages/runner/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@object-ui/runner",
   "private": false,
-  "version": "17.2.0",
+  "version": "17.3.0",
   "description": "Universal Object UI Application Runner",
   "type": "module",
   "homepage": "https://www.objectui.org/docs/utilities/runner",
diff --git a/packages/sdui-parser/CHANGELOG.md b/packages/sdui-parser/CHANGELOG.md
index 1ad1e23a2e..ef96e6a01b 100644
--- a/packages/sdui-parser/CHANGELOG.md
+++ b/packages/sdui-parser/CHANGELOG.md
@@ -1,5 +1,7 @@
 # @object-ui/sdui-parser
 
+## 17.3.0
+
 ## 17.2.0
 
 ### Minor Changes
diff --git a/packages/sdui-parser/package.json b/packages/sdui-parser/package.json
index 7220c54017..142e64c200 100644
--- a/packages/sdui-parser/package.json
+++ b/packages/sdui-parser/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/sdui-parser",
-  "version": "17.2.0",
+  "version": "17.3.0",
   "type": "module",
   "sideEffects": false,
   "license": "MIT",
diff --git a/packages/types/CHANGELOG.md b/packages/types/CHANGELOG.md
index 61ce5572ec..c04a28b54a 100644
--- a/packages/types/CHANGELOG.md
+++ b/packages/types/CHANGELOG.md
@@ -1,5 +1,181 @@
 # @object-ui/types
 
+## 17.3.0
+
+### Minor Changes
+
+- f44d872: `mobile.fullscreenLongText` finally reaches auto-generated long-text fields, and
+  `mobile_fullscreen` gets one declared carrier (objectui#3245).
+
+  FROM: `ObjectForm` stamped the flag onto the FormField itself
+  (`{ ...f, mobile_fullscreen: true }`). TO: it stamps the flag onto the object the
+  form renderer will actually forward to the widget as `field` — `f.field || f`,
+  resolved exactly the way `renderFieldComponent` resolves it.
+
+  **The flag's only legal carrier is the field metadata, and its only producer is
+  `ObjectForm`.** That convention was already what the widget side assumed after
+  objectui#3232/#3233 (`TextAreaField` reads `field.mobile_fullscreen` and nothing
+  else, and `field` is the single metadata carrier); the producer was writing to a
+  different object, so for auto-generated fields the two never met.
+
+  What was broken, end to end: `ObjectForm` builds an auto-generated field as
+  `type: 'field:textarea'` **and** stashes the object-field metadata on `.field`.
+  The renderer forwards `field: field.field || field`, so the widget received the
+  raw metadata — which never carried the flag — while the FormField-level copy was
+  dropped by `stripRegisteredFieldProps`. Every entry point into `TextAreaField`
+  therefore read `undefined` and the expand affordance never rendered. Only the
+  hand-authored `customFields` path (no `.field` to shadow the FormField) ever
+  worked, i.e. the feature was dead on the path virtually every form takes. Unit
+  tests on both ends passed the whole time, because the break lived in the seam
+  between them; this release adds the feature's first integration coverage — real
+  `ObjectForm` → real form renderer → real `TextAreaField`, no mocks — which fails
+  against the old producer and passes against the new one.
+
+  `mobile_fullscreen` is now declared on `@object-ui/types`' `BaseFieldMetadata`,
+  hence on every member of the `FieldMetadata` union that
+  `FieldWidgetComponentProps.field` resolves to. It is deliberately **not** an
+  `@objectstack/spec` property: nobody authors it on a field definition, it is a
+  projection of the form-level `ObjectFormSchema.mobile.fullscreenLongText` setting
+  onto the field metadata at render time. Declaring it removes the last untyped
+  end of the chain — the producer's `as FormField` cast is gone — so the two sides
+  can now disagree out loud instead of silently.
+
+  The hand-authored `customFields` path keeps working unchanged, and keeps its own
+  metadata: the flag is stamped on the FormField only when there is no `.field` to
+  carry it. Synthesizing a `field` object in that case would light the affordance
+  up while quietly replacing the field's `rows` / `placeholder` with defaults — the
+  regression test pins that too.
+
+- f833d3a: Retire `validation` from the action-param contract — it was declared on both
+  halves, read by neither, and rejected outright by the server (objectui#3201).
+
+  FROM: `validation?: string` was declared on the AUTHORING type
+  (`@object-ui/types`' `ActionParam`) and on the RESOLVED type (`@object-ui/core`'s
+  `ActionParamDef`). TO: it is declared on neither.
+
+  **Breaking for anyone who declared it — but it never did anything.** This is
+  marked `minor`, not `major`, per the repo's version-alignment policy (objectui's
+  major tracks `@objectstack`'s, so objectui's own breaking changes ship as `minor`
+  with the breaking semantics spelled out here).
+
+  **Migration: delete it.** If you authored `validation: '...'` on an action param,
+  it never took effect, and publishing that metadata to the server is a hard parse
+  failure — so any metadata that reached production either never carried the key or
+  never parsed. Removing it changes no runtime behaviour; it only moves the error
+  from "silent no-op, then rejected at publish" to a `tsc` error at the keystroke.
+
+  Why it could not work as authored:
+
+  - `ActionParamSchema` in `@objectstack/spec/ui` is `.strict()` and does not list
+    `validation`, so an authored key is a PARSE REJECTION on the server:
+    `Unrecognized key(s) on this action param: \`validation\``. Meanwhile `tsc`
+    against the public type accepted it — the type vouched for a key the platform
+    itself refuses.
+  - Nothing read it on the resolved side either: it was never a key of
+    `resolveActionParams()`'s `RawActionParam`, the runtime field metadata a
+    field-backed param inherits from carries no `validation` to source one from,
+    and `paramToField()` never mapped it — so it could not reach the field widgets,
+    whose rules `buildValidationRules()` builds from `required` / `minLength` /
+    `maxLength` / `pattern`.
+
+  Removed rather than implemented, on ADR-0049 enforce-or-remove. Giving it meaning
+  would mean first deciding what an "expression" is here (CEL? a formula? a regex?)
+  and adding it to `@objectstack/spec`, which is where such a capability has to
+  start — not accreted renderer-side around a key the contract does not have.
+
+  This also retires the last named exception in objectui#3174's drift guard
+  (`packages/types/src/__tests__/page-nav-misc-spec-parity.test.ts`), which carried
+  `validation` as the one key `ActionParam` added on top of the spec's set. The
+  rule it pins — **the authoring type declares exactly the spec's authorable
+  keys** — is now literal: the guard asserts the local-only key set is empty, so
+  any future addition fails the build instead of being waved through.
+
+- d22ae31: Track `@objectstack/spec` 17.0.0-rc.2 (objectui#3235, #3208, #3287, #3264).
+
+  The pin moves from `^17.0.0-rc.1` to `^17.0.0-rc.2` across the workspace, and
+  the sibling `@objectstack/*` packages (`client` / `core` / `formula` / `lint`)
+  move with it — they pin `@objectstack/spec` **exactly**, so leaving them behind
+  kept a second copy of the spec in the tree and would have had `@objectstack/lint`
+  validating against rc.1 schemas that still accept keys rc.2 retires.
+
+  Breaking semantics, in FROM → TO form:
+
+  - **`app.homePageId` is retired — an app's landing page is now its first
+    navigation item.** An app that pinned a landing page with `homePageId` will
+    open on the first reachable navigation entry (by `order`) instead; the root
+    landing still follows `isDefault`. To restore a specific landing page, reorder
+    `navigation` so the intended entry comes first. Stored metadata is migrated by
+    `os migrate meta --from 16`. The key is a hard error now, not a stripped one:
+    the spec ships a tombstone that names the migration.
+    Upstream retired it because of its SHAPE, not its usage — it was an ID
+    cross-reference with no referential integrity, so a `homePageId` that pointed
+    at nothing silently fell back to the first navigation item anyway
+    (objectstack#4667, premise corrected in #4709). If the capability returns, it
+    returns as a flag on the navigation item itself, which cannot dangle.
+  - **`@object-ui/types`' `HttpMethod` now resolves to the spec's
+    `HttpMethodType`.** Shape is verbatim identical — the same 5-value UI subset —
+    and `@object-ui/types` still exports it as `HttpMethod`, so no consumer
+    changes. The spec renamed its `./ui` export because `HttpMethod` named two
+    different types depending on the import path (`./shared` / `./api` carry a
+    7-value enum including `HEAD` / `OPTIONS`); objectui deliberately keeps the
+    5-value one (objectstack#4691).
+  - **`AppContextSelector.includeAll` / `placement` are gone.** Neither ever did
+    anything in this renderer: context selectors are mandatory-scope, so no "All"
+    row was ever rendered, and `placement: 'topbar'` put nothing in the topbar.
+    Both carried schema defaults, which is why the liveness lint structurally
+    could not flag them — removal was the only channel that reaches an author
+    (framework#4509).
+  - **`NavigationArea.visible` / `order` / `requiredPermissions` are gone.** An
+    area is a layout grouping, not an access boundary. Gating moved down to the
+    navigation ITEM, where `visible` and `requiredPermissions` are unchanged and
+    still enforced. `AppSchemaRenderer`'s area switcher no longer hides an area, so
+    an area whose items are all gated away renders as visible-but-empty rather
+    than disappearing.
+  - **`@object-ui/core` no longer exports `NotificationProtocol`**
+    (`resolveNotificationConfig`, `specNotificationToToast`, `mapSeverityToVariant`,
+    `mapPosition`, `ToastNotification`). It bridged `@objectstack/spec/ui`'s
+    `Notification` / `NotificationConfig`, which objectstack#4610 deleted with no
+    successor. Use `resolveNotificationConfig` from `@object-ui/react`
+    (`NotificationContext`), which owns the live `NotificationSystemConfig` and is
+    what every notification surface already read. Note that the spec's _other_
+    `Notification` — `@objectstack/spec/api` — is the REST inbox row, a different
+    contract, and is deliberately NOT aliased in as a replacement.
+  - **The `email_template` client-side validator now uses
+    `EmailTemplateDefinitionSchema`.** It was pointing at the removed
+    `EmailTemplateSchema`, so authored templates were being checked against the
+    wrong contract: the live one is keyed `name` + `locale` (not `id`) and splits
+    the body into `bodyHtml` / `bodyText` (not `body` + `bodyType`)
+    (objectstack#4616 / #4807).
+
+  Fixes that are not breaking, but were only found because rc.2 stopped being
+  lenient — each had been passing vacuously:
+
+  - **`view` drafts are actually validated now.** The client validator named the
+    aggregated container schema while this admin authors first-class `ViewItem`s,
+    and the container used to strip `viewKind` / `config` in silence — so no view
+    draft ever had one of its own keys checked. It now validates each shape
+    against its own schema (objectui#3312).
+  - **The console's worked examples were wrong**, and being stripped rather than
+    refused: `view.list.object` (the container root already declares it),
+    `job.concurrency` / `job.timeoutMs` (no such keys; the spelling is `timeout`,
+    already in ms), `email_template.from` / `.to` (a template is not a send —
+    the sender override is `fromOverride`, an object), and
+    `datasource.capabilities` / `.healthCheck` (objectstack#4583 removed the
+    former; the latter was never a datasource key). These are the drafts an
+    author — or a model generating metadata — copies.
+  - Action key inventory re-derived: `ActionSchema` gained the package-lock
+    envelope (`_lock*` / `_package*` / `_provenance`), so a packaged action no
+    longer reports them as unknown keys.
+  - The schema-diff panel labels the new `default_mismatch` finding.
+  - Test fixtures pinning the retired `managedBy: 'system'` bucket now use
+    `engine-owned`. Protocol 17 split that value (objectstack#3355), so it
+    resolved to the default-writable fallback and a batch of "stays locked"
+    assertions had quietly stopped asserting anything.
+
+### Patch Changes
+
+- 23018cc: `record:highlights` now honours a `readonly: true` on an authored field entry, so a header chip for a platform-owned column no longer offers inline edit. `HeaderHighlight`'s editability gate already consulted `field.readonly`, but the renderer rebuilt each entry from a fixed `{name,label,icon,type}` list and dropped `readonly` one layer before that check, so the gate could never fire from authored metadata — a hook-maintained rollup or approval-written grade could be overwritten by hand from the detail-page header strip and stayed wrong until an unrelated write re-fired the computation. `readonly` is now a declared key on `HighlightField` and on the `RecordHighlightsComponentProps.fields[]` entry union, mirroring `DetailViewField.readonly` (objectstack#5077).
+
 ## 17.2.0
 
 ### Minor Changes
diff --git a/packages/types/package.json b/packages/types/package.json
index 4f0205e895..f6d4806c7d 100644
--- a/packages/types/package.json
+++ b/packages/types/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/types",
-  "version": "17.2.0",
+  "version": "17.3.0",
   "description": "Pure TypeScript type definitions for Object UI - The Protocol Layer",
   "type": "module",
   "sideEffects": false,
diff --git a/packages/vscode-extension/CHANGELOG.md b/packages/vscode-extension/CHANGELOG.md
index fc49504e16..fdef236650 100644
--- a/packages/vscode-extension/CHANGELOG.md
+++ b/packages/vscode-extension/CHANGELOG.md
@@ -1,5 +1,17 @@
 # Changelog
 
+## 17.3.0
+
+### Patch Changes
+
+- Updated dependencies [5781fb1]
+- Updated dependencies [23018cc]
+- Updated dependencies [f44d872]
+- Updated dependencies [f833d3a]
+- Updated dependencies [d22ae31]
+  - @object-ui/core@17.3.0
+  - @object-ui/types@17.3.0
+
 ## 17.2.0
 
 ### Patch Changes
diff --git a/packages/vscode-extension/package.json b/packages/vscode-extension/package.json
index 2bd58d0ecc..c5fafdf305 100644
--- a/packages/vscode-extension/package.json
+++ b/packages/vscode-extension/package.json
@@ -2,7 +2,7 @@
   "name": "object-ui",
   "displayName": "Object UI",
   "description": "VSCode extension for Object UI - Schema-driven UI development with IntelliSense, validation, and live preview",
-  "version": "17.2.0",
+  "version": "17.3.0",
   "publisher": "objectui",
   "private": true,
   "icon": "icon.svg",