feat(platform-objects): sys_personal_view, a reader's own named list views, with the owner's delete door (server step)

.changeset/29443-personal-views-server.md

@@ -0,0 +1,48 @@
+---
+'@objectstack/platform-objects': patch
+'@objectstack/plugin-auth': patch
+'@objectstack/plugin-security': patch
+'@objectstack/spec': patch
+'@objectstack/cli': patch
+---
+
+feat(platform-objects): `sys_personal_view`, a reader's own named list views (server step of the first version)
+
+Clause-②: yes (widening)
+Metadata-protocol: none
+
+A reader can now keep named list views of their own, as user data rather than view metadata. The new platform object `sys_personal_view` holds one row per saved list:
+
+- its owner (`user_id`);
+- the object it lists (`object_name`);
+- the name the owner gave it (`label`);
+- the list configuration, in spec's `ListView` shape (`config`).
+
+It is registered beside `sys_user_preference`, on the same template, and the generic data API serves it at `/api/v1/data/sys_personal_view`. Which view opens by default is not stored here: the reader's existing per-object pin holds a view id, and a personal view's id is one more value it can hold.
+
+- **Owner only.**
+  - The object declares the owner-only default row scope `user_id == current_user.id` for every operation. The table carries the organization column, so the organization wall bounds it too.
+  - Another member gets nothing: no read by id (`404`), nothing listed, and no update (`404 RECORD_NOT_FOUND`).
+  - A create naming another owner is refused `403 PERMISSION_DENIED`.
+  - A view's owner is fixed when it is saved: an update that changes `user_id` is refused `403 PERMISSION_DENIED` for every caller but the system, platform administrators included. A save rule holds this, because for an organization member the `member_default` update floor (`created_by == current_user.id`) applies to an update in place of the object's own row scope.
+- **No back door for organization administrators.** `organization_admin`, and the derived `organization_admin_no_bypass`, name the object without the wildcard's super-user bits. An organization administrator reads, writes and deletes only their own views.
+- **Platform administrators are not limited.** The bare `admin_full_access` wildcard carries `viewAllRecords` and `modifyAllRecords`, so through the generic data API a platform administrator reads, edits and deletes any member's view. This is the same as `sys_user_preference` today. Whether that should change is an open question.
+- **The body is a `ListView` for the row's own object, judged on every save.**
+  - A create, and an update that sends `config` or `object_name`, parse the resulting body with spec's `ListViewSchema`.
+  - A body that does not parse is refused `400 VALIDATION_FAILED`, with one `fields[]` entry per issue, each path under `config`.
+  - A body whose `data.object` names a different object than `object_name` is refused the same way, on `config.data.object`.
+  - No new error code.
+- **Field security is not re-judged on save.** A view whose filter names a field the reader cannot read is still saved. The list query that applies the filter is refused `403 PERMISSION_DENIED` by the existing predicate guard.
+- **Not view metadata.** `/meta` never serves a personal view, the metadata write door never writes one, and a package export never carries one. Its id is the engine's record id, so it never takes the `object.key` view syntax.
+- **The owner's delete door.** `DELETE /api/v1/personal-views/:id` removes one personal view, and only the caller's own.
+  - The row is read as the caller, so another member or an organization administrator gets the unknown-id `404 RECORD_NOT_FOUND`.
+  - A row the caller can read but does not own is refused `403 PERMISSION_DENIED`.
+  - Only then is the row removed, as the system, attributed to the caller and inside the caller's organization. Success is `200` with `{ id, deleted: true }`.
+  - The door takes no query parameter (`400 VALIDATION_ERROR`) and serves signed-in callers only (`401 UNAUTHENTICATED`).
+  - `AuthPlugin` mounts it on the kernel's HTTP server, in the shape of the comment-reaction unreact door.
+- **Grants.**
+  - `member_default` grants read, create and edit on the object, and no delete. That set is bound to the `everyone` anchor, which carries no delete bit (ADR-0090 D5).
+  - A member's generic data `DELETE` on a personal view is still refused `403 PERMISSION_DENIED`. The door above grants nothing.
+  - External members (`external_default`) get no grant in this version. Whether they can save views is an open question for the Console half.
+
+`PLATFORM_OBJECTS_BY_PACKAGE['platform-objects']` (`@objectstack/spec/system`) now lists `sys_personal_view`, so lint and cross-reference checks know the name is real. The CLI's organization-ownership inventory carries the new object's row.

content/docs/permissions/system-context.mdx

@@ -143,6 +143,7 @@ bugs — it is the protection or the side effect that silently does not happen.
 | 25 | Engine-owned / append-only write guard bypassed | plugin-security | Get: generic writes to `managedBy` engine-owned objects | `packages/plugins/plugin-security/src/system-write-guard.ts#isUserContextWrite`, `packages/plugins/plugin-security/src/system-write-guard.ts#assertEngineOwnedWriteAllowed` |
 | 26 | Identity write guard bypassed (ADR-0092) | plugin-auth | Get: direct writes to identity tables through the generic data path | `packages/plugins/plugin-auth/src/identity-write-guard.ts#isUserContextWrite` |
 | 26b | API key restore guard does not refuse | plugin-auth | Get: a write setting `revoked: false` on a `sys_api_key` row an administrator's forced password reset revoked is admitted without the platform-administrator check a user-context restore must pass; the reason is still cleared. Lose: nothing a caller reaches: no system writer restores a key, and the mint, the last-used stamp and the forced reset itself never set `revoked: false` | `packages/plugins/plugin-auth/src/api-key-restore-guard.ts#isUserContextWrite` |
+| 26c | **Personal-view owner rule does not refuse** — a `sys_personal_view` update that changes `user_id` is admitted | plugin-auth | Get: a system writer can move a personal view to another owner (no shipped system writer does). Lose: nothing a caller reaches. A non-system update whose `user_id` differs from the stored owner is refused `403 PERMISSION_DENIED`, for every caller, a platform administrator included; an echo of the stored owner is no change. The rule exists because, for an organization member, `member_default`'s `'*'` update floor (`created_by == current_user.id`) applies to an update in place of the object's own row scope | `packages/plugins/plugin-auth/src/personal-view-hooks.ts#registerPersonalViewHooks` |
 | 27 | Search-companion column **kept** in a read's rows when it was explicitly requested | objectql | Get: the internal companion column is readable. Lose: nothing for app code — this is the engine reading its own index | `stripSearchCompanionFromRead` |
 | 28 | Dependent-count disclosure on a blocked delete | objectql | Get: the count of blocking children. Nothing was elevated past the caller, so nothing is withheld | `dependentCountIsDisclosable` |
 | 29 | Reference-cleanup log attributes the write to `'system'` | objectql | Get: an honest actor label instead of `anonymous` when the context carries neither `userId` nor `actor` | `recordReferenceCheckElevation` |
@@ -574,6 +575,7 @@ and CI refuses one that differs from what the tree produces.
 | `packages/plugins/plugin-auth/src/api-key-restore-guard.ts#isUserContextWrite` | 1 | 26b |
 | `packages/plugins/plugin-auth/src/auth-plugin.ts#start` | 1 | 12 |
 | `packages/plugins/plugin-auth/src/identity-write-guard.ts#isUserContextWrite` | 1 | 26 |
+| `packages/plugins/plugin-auth/src/personal-view-hooks.ts#registerPersonalViewHooks` | 1 | 26c |
 | `packages/plugins/plugin-auth/src/principal-session-mint.ts#refuseUpFront` | 1 | 61b |
 | `packages/plugins/plugin-email/src/email-template-door.ts#isOrganizationWrite` | 1 | 59 |
 | `packages/plugins/plugin-security/src/flow-system-identity-write-refusal.ts#elevationSource` | 1 | 1b |

content/docs/permissions/tenant-audit-census.mdx

@@ -132,7 +132,7 @@ are reported as `undecidable` rather than assumed either way.
 
 The same holds twice over for the context. An options argument spelled as a
 literal can be read; one spelled `options`, `{ ...opts }`, or handed through a
-forwarding shim cannot, and **51 of the 255 sites are spelled that way**. A
+forwarding shim cannot, and **51 of the 256 sites are spelled that way**. A
 context resolved from an inline literal or a local `const` can be tested for
 `isSystem`; one arriving from a helper call cannot.
 
@@ -197,10 +197,10 @@ reproduce them. Where it disagrees, it disagrees on the page:
 
 | carried figure | where it survives | this census |
 | :--- | :--- | ---: |
-| 175 write call sites | quoted in the merged changeset | **255** |
+| 175 write call sites | quoted in the merged changeset | **256** |
 | 24 carrying no tenant context | quoted in the merged changeset | **2** provable and tenancy-enabled; **29** more whose options argument is unreadable |
-| 127 of 175 statically decidable, 48 runtime-parameter-name sites | restated on the `isSystem`-scoping card | **177 of 255** decidable, **78** undecidable |
-| 135 (77%) silenced by the `isSystem` guard before the posture gate | the lost issue body — **no surviving corroboration** | **not reproduced**: 145 decidably elevated, 0 decidably not, 102 undecidable |
+| 127 of 175 statically decidable, 48 runtime-parameter-name sites | restated on the `isSystem`-scoping card | **177 of 256** decidable, **79** undecidable |
+| 135 (77%) silenced by the `isSystem` guard before the posture gate | the lost issue body — **no surviving corroboration** | **not reproduced**: 146 decidably elevated, 0 decidably not, 102 undecidable |
 | 141 and 132, two independent re-derivations | the card that filed this work | — |
 
 **The differences are not reconciled, and deliberately so.** The old census's
@@ -217,11 +217,11 @@ would report a smaller number and would not say so.
 
 The fourth row is the one worth flagging to anyone citing it. **The 135 / 77%
 figure has no surviving corroboration anywhere in the tree.** This census reads
-145 of 255 (57%) as decidably elevated, with 102 more whose elevation is a
+146 of 256 (57%) as decidably elevated, with 102 more whose elevation is a
 run-time fact — so the claim is neither confirmed nor refuted, and the honest
 answer is that a static reading cannot settle it.
 
-⇒ **Cite `2 / 255`, and say what it is**: the sites whose options argument was
+⇒ **Cite `2 / 256`, and say what it is**: the sites whose options argument was
 READ and holds no tenant context, against a decidably tenancy-enabled object.
 That is the control's provable yield surface. ⛔ Do not cite it as "the sites
 without tenant context" — **29 further sites** have an options argument this
@@ -233,31 +233,31 @@ cannot read, and they are neither in nor out.
 
 | what | count |
 | :--- | ---: |
-| write call sites on the application surface | **255** |
+| write call sites on the application surface | **256** |
 | …whose object name is statically decidable | 177 |
-| …whose object name is chosen at run time | 78 |
+| …whose object name is chosen at run time | 79 |
 | …against an object with tenancy ENABLED | 176 |
 | …against an object that declares tenancy off | 1 |
-| threading a tenant context | 196 |
+| threading a tenant context | 197 |
 | PROVABLY carrying none (options read, no context key) | **8** |
 | …of those, against a decidably tenancy-enabled object | **2** |
 | options argument UNREADABLE — may or may not carry one | 51 |
 | …of those, against a decidably tenancy-enabled object | 29 |
-| threading a decidably ELEVATED (`isSystem`) context | 145 |
+| threading a decidably ELEVATED (`isSystem`) context | 146 |
 | threading a context that is decidably NOT elevated | 0 |
 | threading a context whose elevation is a run-time fact | 102 |
 
 | how the instrument reached the site | count |
 | :--- | ---: |
-| receiver carried a readable engine type | 193 |
+| receiver carried a readable engine type | 194 |
 | receiver erased, placed by the object NAME | 52 |
 | receiver erased, placed by an `object: string` PARAMETER | 5 |
 | receiver erased, placed by an `UNTYPED_RECEIVERS` row | 5 |
 
 | object name spelled inline | 116 |
 | object name spelled through a `const` | 61 |
 | object name is an `object: string` parameter | 7 |
-| object name is some other run-time expression | 71 |
+| object name is some other run-time expression | 72 |
 
 ### Subtractions the census could NOT defend — enforced
 
@@ -307,13 +307,13 @@ holds still. They are required to be HERE and to say WHEN they were true;
 their values are not compared. The reasoning, and the measurement behind it,
 are in `scripts/check-tenant-audit-census.mjs`.
 
-Measured on 2026-10-31 at `d06a02507`.
+Measured on 2026-11-02 at `ac273cf07`.
 
 | corpus scale (not enforced) | count |
 | :--- | ---: |
-| tracked non-test sources scanned | 830 |
-| engine-shaped types recognised | 96 |
-| declared objects in the registry | 124 |
-| same-named calls subtracted as non-engine | 214 |
+| tracked non-test sources scanned | 852 |
+| engine-shaped types recognised | 99 |
+| declared objects in the registry | 125 |
+| same-named calls subtracted as non-engine | 227 |
 
 {/* END GENERATED: tenant-audit-census */}

docs/audits/2026-08-tenant-audit-write-call-sites.counts.md

@@ -33,17 +33,17 @@ silent, and `node scripts/tenant-audit-census.mjs --write` is the resolution.
 
 | Measure | Value |
 |---|---:|
-| Write call sites | 255 |
+| Write call sites | 256 |
 | Object name statically decidable | 177 |
-| Object name chosen at run time | 78 |
+| Object name chosen at run time | 79 |
 | Against a tenancy-enabled object | 176 |
 | Against an object declaring tenancy off | 1 |
-| Threading a tenant context | 196 |
+| Threading a tenant context | 197 |
 | Provably carrying none | 8 |
 | …and decidably tenancy-enabled | 2 |
 | Options argument unreadable | 51 |
 | …and decidably tenancy-enabled | 29 |
-| Threading a decidably elevated context | 145 |
+| Threading a decidably elevated context | 146 |
 | Threading a decidably non-elevated context | 0 |
 | Threading a context of undecidable elevation | 102 |
 
@@ -90,14 +90,14 @@ holds still. They are required to be HERE and to say WHEN they were true;
 their values are not compared. The reasoning, and the measurement behind it,
 are in `scripts/check-tenant-audit-census.mjs`.
 
-Measured on 2026-10-31 at `d06a02507`.
+Measured on 2026-11-02 at `ac273cf07`.
 
 | corpus scale (not enforced) | count |
 | :--- | ---: |
-| tracked non-test sources scanned | 830 |
-| engine-shaped types recognised | 96 |
-| declared objects in the registry | 124 |
-| same-named calls subtracted as non-engine | 214 |
+| tracked non-test sources scanned | 852 |
+| engine-shaped types recognised | 99 |
+| declared objects in the registry | 125 |
+| same-named calls subtracted as non-engine | 227 |
 
 ## Every site
 
@@ -166,6 +166,7 @@ Measured on 2026-10-31 at `d06a02507`.
 | `packages/plugins/plugin-auth/src/organization-delete.ts` | `delete` | `sys_team` | enabled | elevated | 1 |
 | `packages/plugins/plugin-auth/src/organization-delete.ts` | `delete` | `sys_team_member` | enabled | elevated | 1 |
 | `packages/plugins/plugin-auth/src/organization-delete.ts` | `delete` | `sys_user_permission_set` | enabled | elevated | 1 |
+| `packages/plugins/plugin-auth/src/personal-view-routes.ts` | `delete` | `PERSONAL_VIEW_OBJECT` | undecidable | elevated | 1 |
 | `packages/plugins/plugin-auth/src/reconcile-membership.ts` | `insert` | `sys_member` | enabled | context, elevation undecidable | 1 |
 | `packages/plugins/plugin-auth/src/scim-connection-service.ts` | `insert` | `sys_scim_connection_credential` | enabled | PROVABLY NONE | 1 |
 | `packages/plugins/plugin-auth/src/session-tombstone.ts` | `update` | `objectName` | undecidable | options unreadable | 1 |

packages/cli/src/utils/organization-ownership-inventory.ts

@@ -795,6 +795,10 @@ export const ORGANIZATION_OWNERSHIP_INVENTORY: readonly InventoryEntry[] = [
   // Exchange rates (`@objectstack/platform-objects`, #27185): an organization's
   // administrators author its own rate table; no parent row anchors a rate.
   { object: 'sys_exchange_rate', census: PMAIN, fate: 'attribution', citation: `${CENSUS_MAIN} (in reach, added since the first census); ${D10_SINGLE}`, anchors: [] },
+  // A reader's own named list views (`@objectstack/platform-objects`, ruling
+  // 6570568131 on #28971): user data on the preference template, each row in
+  // its owner's organization; no parent row anchors a view.
+  { object: 'sys_personal_view', census: PMAIN, fate: 'attribution', citation: `${CENSUS_MAIN} (in reach, added since the first census); ${D10_SINGLE}`, anchors: [] },
   { object: 'sys_import_job', census: P1, fate: 'attribution', citation: `${D3_ORG_ROWS}; ${D10_SINGLE}`, anchors: [] },
   { object: 'sys_user_preference', census: P1, fate: 'attribution', citation: `${D3_ORG_ROWS}; ${D10_SINGLE}`, anchors: [] },
 

packages/platform-objects/scripts/i18n-extract.config.ts

@@ -127,6 +127,7 @@ import {
   SysTwoFactor,
   SysDeviceCode,
   SysUserPreference,
+  SysPersonalView,
   SysOauthApplication,
   SysOauthAccessToken,
   SysOauthRefreshToken,
@@ -268,6 +269,7 @@ const config: ObjectStackDefinition = defineStack({
     SysTwoFactor,
     SysDeviceCode,
     SysUserPreference,
+    SysPersonalView,
     SysOauthApplication,
     SysOauthAccessToken,
     SysOauthRefreshToken,

packages/platform-objects/src/apps/translations/bundle-ownership.test.ts

@@ -21,7 +21,7 @@ const OWNED_OBJECTS = new Set([
   'sys_user', 'sys_session', 'sys_account', 'sys_verification', 'sys_organization',
   'sys_member', 'sys_invitation', 'sys_team', 'sys_team_member', 'sys_business_unit',
   'sys_business_unit_member', 'sys_api_key', 'sys_two_factor', 'sys_device_code',
-  'sys_user_preference', 'sys_oauth_application', 'sys_oauth_access_token',
+  'sys_user_preference', 'sys_personal_view', 'sys_oauth_application', 'sys_oauth_access_token',
   'sys_oauth_refresh_token', 'sys_oauth_consent', 'sys_oauth_resource',
   'sys_oauth_client_resource', 'sys_oauth_client_assertion', 'sys_jwks',
   // identity — external SSO provider (admin-facing, better-auth-managed)

packages/platform-objects/src/apps/translations/en.objects.generated.ts

@@ -1414,6 +1414,38 @@ export const enObjects: NonNullable<TranslationData['objects']> = {
       }
     }
   },
+  sys_personal_view: {
+    label: "Personal View",
+    pluralLabel: "Personal Views",
+    description: "A reader's own named list views (My Views). Visible only to the owner.",
+    fields: {
+      id: {
+        label: "Personal View ID"
+      },
+      created_at: {
+        label: "Created At"
+      },
+      updated_at: {
+        label: "Updated At"
+      },
+      user_id: {
+        label: "Owner",
+        help: "The user this view belongs to. Only this user reads or changes it."
+      },
+      object_name: {
+        label: "Object",
+        help: "The object this view lists (its machine name)."
+      },
+      label: {
+        label: "Name",
+        help: "The name the owner gave this view."
+      },
+      config: {
+        label: "View Configuration",
+        help: "The list configuration, in spec's ListView shape. Validated on every save."
+      }
+    }
+  },
   sys_oauth_application: {
     label: "OAuth Application",
     pluralLabel: "OAuth Applications",

packages/platform-objects/src/apps/translations/es-ES.objects.generated.ts

@@ -1414,6 +1414,38 @@ export const esESObjects: NonNullable<TranslationData['objects']> = {
       }
     }
   },
+  sys_personal_view: {
+    label: "Vista personal",
+    pluralLabel: "Vistas personales",
+    description: "Las vistas de lista con nombre propio de un lector (Mis vistas). Solo las ve su propietario.",
+    fields: {
+      id: {
+        label: "ID de vista personal"
+      },
+      created_at: {
+        label: "Fecha de creación"
+      },
+      updated_at: {
+        label: "Fecha de actualización"
+      },
+      user_id: {
+        label: "Propietario",
+        help: "El usuario al que pertenece esta vista. Solo este usuario puede leerla o cambiarla."
+      },
+      object_name: {
+        label: "Objeto",
+        help: "El objeto que lista esta vista (su nombre técnico)."
+      },
+      label: {
+        label: "Nombre",
+        help: "El nombre que el propietario dio a esta vista."
+      },
+      config: {
+        label: "Configuración de la vista",
+        help: "La configuración de la lista, en la forma ListView de spec. Se valida en cada guardado."
+      }
+    }
+  },
   sys_oauth_application: {
     label: "Aplicación OAuth",
     pluralLabel: "Aplicaciones OAuth",