@wildo-ai/saas-frontend-lib 1.1.9 → 1.1.11

package/dist/esm/core/resources/useResourceOperationActions.js

@@ -6,14 +6,16 @@
  * display priority sorting, risk-level-based button variants, confirmation dialogs for critical
  * operations, and "View Details" injection in summary mode.
  */
-import React, { useMemo, useState, useCallback, useContext, useRef } from 'react';
+import { useApplicationRoleTables } from '../../core/security/useApplicationRoleTables.js';
+import React, { useEffect, useMemo, useState, useCallback, useContext, useRef } from 'react';
 import { useResourceRegistry } from './useResourceRegistry.js';
-import { readBackgroundAcceptance, describeCaughtError } from '@wildo-ai/saas-models';
+import { readBackgroundAcceptance, describeCaughtError, readOperationApprovalPending } from '@wildo-ai/saas-models';
 import { useUserOrgs } from '../../core/security/useUserOrgs.js';
 import { useAppScopeSafe } from '../../core/scope/useAppScope.js';
 import { useNavigationController } from '../../core/navigation/useNavigationController.js';
 import { useI18n } from '../../core/i18n/useI18n.js';
 import { useUserFacingErrorMessage } from '../../core/errors/useUserFacingErrorMessage.js';
+import { resolveAuthoredOperationUnavailableReason } from '../../core/errors/user-facing-error-message.frontend.utils.js';
 import { resolveComponentLabel } from '../../core/i18n/component-label-resolution.utils.js';
 import { resolveOperationDisplayTitle } from '../../core/i18n/operation-title-resolution.utils.js';
 import { useIconRegistry } from '../../core/icons/useIconRegistry.js';
@@ -26,8 +28,10 @@ import { useOperationsEnabled, buildOperationEnabledKey, } from './hooks/useOper
 import { NavigationUtils } from '../../core/navigation/navigation.utils.js';
 import { frontendResourceUtils, FrontendResourceUtils } from './frontend-resource.utils.js';
 import { FrontendEvents } from '../../core/events/events.frontend.schemas.js';
-import { FrontendComponentType, ResourceOperationTextSlot } from '@wildo-ai/presets-components-models';
+import { FrontendComponentType } from '@wildo-ai/presets-components-models';
 import { IconCategory, IconSize, StandardIconReference } from '../../core/icons/icon-registry.frontend.schemas.js';
+import { viewerMayPerformOperation } from '../../core/navigation/launcher-resolution.js';
+import { isLauncherRuntimeAvailabilitySatisfied, useLauncherRuntimeAvailabilityContext } from '../../core/navigation/launcher-runtime-availability.js';
 import { WebSocketContext } from '../../core/requests/websockets/WebSocketContext.js';
 import { extractEphemeralFields } from './ephemeral-fields.utils.js';
 import { ActionVisibility, ActionPlacement, DisabledActionHandling, ResourceOperationActionPresentation, resolveActionDisclosure, isOperationHeadless } from '../../core/resources/resources.frontend.schemas.js';
@@ -36,10 +40,10 @@ import { ResourceOperationActionPopoverBody } from '../../components/resources/R
 import { ResourceOperationActionDropdownBody } from '../../components/resources/ResourceOperationActionDropdown.js';
 import { InPlaceOperationTargetKind, useInPlaceOperation } from '../../core/resources/in-place/InPlaceOperationContext.js';
 import { ButtonVariants_Variant } from '../../components/actions/button.js';
-import { actionPresentationNavigates, BULK_OPERATION_MATCH_SELECTION_CONTEXT_KEY, BULK_OPERATION_SELECTION_IDS_CONTEXT_KEY, buildBulkOperationMatchPayload, buildBulkOperationSelectorPayload, resolveResourceOperationActionPresentation, resolveResourceOperationDropdownChoice, isRiskyResourceOperation, getOperationsForCoreSemantic, RESOURCE_OPERATION_EXECUTED_DISCRIMINATOR_CONTEXT_KEY, isGeneratedFileRegenerateOperation, isCollectionScopedResourceOperation, isGeneratedCollectionExportOperation, readResourceOperationExecutedDiscriminator, resolveEffectiveCoreOperationFromOperation, shouldEmitResourceRefreshAfterDirectOperation, shouldTreatAsNonItemResourceOperation, toOperationResultSummary, } from './operation-semantics.frontend.utils.js';
+import { actionPresentationNavigates, BULK_OPERATION_MATCH_SELECTION_CONTEXT_KEY, BULK_OPERATION_SELECTION_IDS_CONTEXT_KEY, buildBulkOperationMatchPayload, buildBulkOperationSelectorPayload, resolveResourceOperationActionPresentation, resolveResourceOperationDropdownChoice, resolveSurfaceTitleOperationIdentifier, isRiskyResourceOperation, getOperationsForCoreSemantic, RESOURCE_OPERATION_EXECUTED_DISCRIMINATOR_CONTEXT_KEY, isGeneratedFileRegenerateOperation, isCollectionScopedResourceOperation, recordIsItsContextSingleton, isGeneratedCollectionExportOperation, collectionExportReRunsListingVariant, readResourceOperationExecutedDiscriminator, resolveEffectiveCoreOperationFromOperation, shouldEmitResourceRefreshAfterDirectOperation, shouldTreatAsNonItemResourceOperation, toOperationResultSummary, } from './operation-semantics.frontend.utils.js';
 import { isFrontendOperationAddressableForCurrentContext, pickPreferredOperationForCoreSemanticAddressability, shouldRequireCurrentContextAddressabilityForOperation, } from './resource-addressability.frontend.utils.js';
 import { normalizeContextResourceIdentifiersForOutcome, normalizeContextResourceIdentifiersForTransport, } from './context-resource-identifiers.frontend.utils.js';
-import { CoreResourceOperation, ResourceOperationRiskLevel, isIrreversibleOperation, ResourceOperationDisplayMode, ResourcesConfig_OperationPathUtils, Resources_SharedUtils, ResourceGeneratedOperationKind, ResourceCollectionExportRowScope, listCollectionExportSelections, ResourceOperationVariantType, FeatureUnavailabilityBehavior, userRolesSatisfyRequiredRoles, selectHighestRightsVariants, resolveBulkOperationMaxSelection, } from '@wildo-ai/saas-models';
+import { CoreResourceOperation, ResourceOperationRiskLevel, isIrreversibleOperation, ResourceOperationDisplayMode, ResourcesConfig_OperationPathUtils, Resources_SharedUtils, ResourceGeneratedOperationKind, ResourceCollectionExportRowScope, listCollectionExportSelections, ResourceOperationVariantType, FeatureUnavailabilityBehavior, selectHighestRightsVariants, resolveBulkOperationMatchMaxSelection, resolveBulkOperationMaxSelection, CoreResourceType, } from '@wildo-ai/saas-models';
 import { describeErrorGuidance, describeResourceErrorForNotification } from '../../components/form/validation-errors/resource-error-notification-context.utils.js';
 function toActionBarFeatureAvailability(featureAvailability) {
     return featureAvailability;
@@ -179,11 +183,36 @@ const CORE_OPERATION_LABEL_KEYS = {
 };
 /** Stable empty-array reference for role inputs when permissions are absent. */
 const EMPTY_ROLES = [];
+/**
+ * The organization an action surface's operations are ADDRESSED to: the one their requests will name.
+ *
+ * The backend authorizes an organization-scoped request against the caller's roles in the
+ * organization the request's path names, so a display gate that wants to agree with it has to read
+ * the roles for that same organization. The surface's own `contextResourceIdentifiers` carry it
+ * (`/organizations/:organizationId/...` is resolved into them by the route, and the request URL is
+ * built from them), and they win over the application's AMBIENT selection, which can differ: the
+ * stored "current organization" is whatever the person last selected, while a link, a bookmark or a
+ * typed URL can open a listing of another organization they belong to.
+ *
+ * Measured on Wonder Todos (#1461, 2026-10-02): the ambient organization was one where the
+ * administrator is only ORG_MEMBER, the todos listing was the Default Organization they OWN, and the
+ * bulk bar gated with the member roles. It dropped the `admin` change-status variant (ORG_ADMIN,
+ * background bulk run) and offered only the member variant, disabled — so no background run and no
+ * "View failures" could be reached, while a request would have been authorized.
+ *
+ * Falls back to the ambient organization only when the surface names none (an application-scoped
+ * surface, a page with no organization in its route).
+ */
+function resolveActionSurfaceOrganizationId(contextResourceIdentifiers, ambientOrganizationId) {
+    const addressed = contextResourceIdentifiers?.[CoreResourceType.ORGANIZATIONS];
+    const addressedId = addressed ? frontendResourceUtils.getResourceId(addressed) : '';
+    return addressedId.length > 0 ? addressedId : (ambientOrganizationId ?? null);
+}
 // ─────────────────────────────────────────────────────────────────────────────
 // Hook
 // ─────────────────────────────────────────────────────────────────────────────
 export function useResourceOperationActions(params) {
-    const { resourceType, displayMode, currentObject, contextResourceIdentifiers, parentResourcesRequirements, navigationZone, operationId = 'operations', excludeOperations, bulkOnly = false, selectionObjects, onSelectionNarrow, collectionOnly = false, placementFilter, selectedItemIds, matchAllSelection, additionalContext, successDiscriminator, suppressViewDetails = false, onOperationExecuted, collectionExportQuery, } = params;
+    const { resourceType, displayMode, currentObject, currentObjectDataMode, contextResourceIdentifiers, parentResourcesRequirements, navigationZone, sourceOperation, excludeOperations, bulkOnly = false, selectionObjects, onSelectionNarrow, collectionOnly = false, placementFilter, selectedItemIds, matchAllSelection, additionalContext, successDiscriminator, suppressViewDetails = false, onOperationExecuted, collectionExportQuery, } = params;
     // Read at panel-build time by the DROPDOWN body (its ✓ on the held value). A ref rather than a
     // dependency because callers re-create `currentObject` every render; see the note at `items`.
     const currentObjectRef = useRef(currentObject);
@@ -198,7 +227,7 @@ export function useResourceOperationActions(params) {
     // The element-level host, when this action bar is rendered inside a collection that provides one.
     // Absent everywhere else, where `isAvailable` is false — see `InPlaceOperationContext`.
     const inPlaceHost = useInPlaceOperation();
-    const { emit } = useEventBus();
+    const { emit, on } = useEventBus();
     const webSocket = useContext(WebSocketContext);
     const isWebSocketConnected = webSocket?.isConnected ?? false;
     // Best-effort success toast for direct-executed actions that return a human
@@ -273,6 +302,12 @@ export function useResourceOperationActions(params) {
     const resourceConfig = useMemo(() => {
         return registry.resourceConfigurations[resourceType];
     }, [registry, resourceType]);
+    // A detail page showing the singleton its context selects: an id-less verb there acts on this record (#2326).
+    const onTheContextSingletonRecord = displayMode === ResourceOperationDisplayMode.DETAIL && recordIsItsContextSingleton({
+        resourceRelationships: resourceConfig?.resourceRelationships,
+        currentObject,
+        contextResourceIdentifiers,
+    });
     // Resolve the effective action-surfacing (disclosure) policy for this view:
     // per-resource override (`layout.actionDisclosure[displayMode]`) over the
     // framework default. `disabledActionHandling` is consumed below to decide
@@ -375,17 +410,21 @@ export function useResourceOperationActions(params) {
     // perform — historically every declared operation rendered as a button and
     // only 403'd on click (admin / super-admin actions leaked to plain members).
     // Mirror the backend's hierarchy-aware authorization via
-    // `userRolesSatisfyRequiredRoles`: the user's app-scope roles
+    // `viewerMayPerformOperation`: the user's app-scope roles
     // (`permissions.appLevel`) and current-org roles
     // (`permissions.organizations[orgId]`) are expanded through their role
-    // hierarchies and matched (OR) against each operation's `roles`. The backend
-    // stays the security authority; this is a display gate that fails open on
-    // uncertainty (see the util). Value-stabilized like the sibling inputs above so
-    // a fresh `permissions` reference does not churn `filteredOps`.
-    const currentOrganizationId = appScope?.currentOrganizationId ?? null;
+    // hierarchies and matched (OR) against each operation's `roles`; failing that,
+    // the backend's access profile answers whether an organization-unit grant
+    // reaches a unit-narrowed resource (#2381). The backend stays the security
+    // authority; this is a display gate. Value-stabilized like the sibling inputs
+    // above so a fresh `permissions` reference does not churn `filteredOps`.
+    //
+    // The org roles are the caller's roles in the organization these actions are ADDRESSED to, not in
+    // the ambient selection: see `resolveActionSurfaceOrganizationId` (#1461).
+    const addressedOrganizationId = resolveActionSurfaceOrganizationId(stableContextResourceIdentifiers, appScope?.currentOrganizationId);
     const userAppRoles = permissions?.appLevel ?? EMPTY_ROLES;
-    const userOrgRoles = currentOrganizationId
-        ? permissions?.organizations?.[currentOrganizationId] ?? EMPTY_ROLES
+    const userOrgRoles = addressedOrganizationId
+        ? permissions?.organizations?.[addressedOrganizationId] ?? EMPTY_ROLES
         : EMPTY_ROLES;
     const userAppRolesKey = userAppRoles.join(',');
     const userOrgRolesKey = userOrgRoles.join(',');
@@ -393,7 +432,34 @@ export function useResourceOperationActions(params) {
     // Keyed on serialized contents (value-stabilization), matching the sibling
     // inputs above. ESLint exhaustive-deps is not wired in this repo.
     [userAppRolesKey]);
+    const roleTables = useApplicationRoleTables();
     const stableUserOrgRoles = useMemo(() => userOrgRoles, [userOrgRolesKey]);
+    // The viewer as the role check needs them, in the ADDRESSED organization: their roles there, the application's role
+    // tables, and the backend's access profile (unit grants) — `viewerMayPerformOperation` (#2376, #2381).
+    const accessProfile = permissions?.accessProfile ?? null;
+    const actionViewer = useMemo(() => ({
+        applicationRoles: [...stableUserAppRoles],
+        organizationRoles: [...stableUserOrgRoles],
+        roleTables,
+        organizationId: addressedOrganizationId ?? null,
+        accessProfile,
+    }), [stableUserAppRoles, stableUserOrgRoles, roleTables, addressedOrganizationId, accessProfile]);
+    /*
+     * Runtime-capability gating (#2649): an operation whose frontend config declares `runtimeAvailability` is offered
+     * only while the shell's runtime capabilities hold, the contract launcher items and settings sections already use.
+     * SCIM's Generate and Rotate are the first readers: they need a type a directory may provision, so in the revoke-only
+     * view of an organization of another type they are left out and Revoke is the one action on a token.
+     *
+     * Value-stabilized like the inputs above, as the SET of operations it leaves out, so the context's identity churning
+     * does not churn `filteredOps` (and with it every `enabledCondition` evaluation) unless the answer changes.
+     */
+    const runtimeAvailabilityContext = useLauncherRuntimeAvailabilityContext();
+    const runtimeUnavailableOperationsKey = useMemo(() => (resourceConfig?.operations ?? [])
+        .filter((op) => !isLauncherRuntimeAvailabilitySatisfied(op.operationFrontendConfig?.runtimeAvailability, runtimeAvailabilityContext))
+        .map((op) => ResourcesConfig_OperationPathUtils.createOperationPathKeyFromOperation(op))
+        .sort()
+        .join('\n'), [resourceConfig, runtimeAvailabilityContext]);
+    const runtimeUnavailableOperations = useMemo(() => new Set(runtimeUnavailableOperationsKey ? runtimeUnavailableOperationsKey.split('\n') : []), [runtimeUnavailableOperationsKey]);
     /**
      * Is the listing the user is looking at driven by a text SEARCH right now?
      *
@@ -403,6 +469,16 @@ export function useResourceOperationActions(params) {
      * flips; the ref exists precisely so the handler does NOT.
      */
     const listingSearchActive = collectionExportQuery?.isSearchActive;
+    /*
+     * The variant the listing shows per verb (#2705), rebuilt from its PRIMITIVE parts. The listing composes a new
+     * `collectionExportQuery` on every filter, sort and page change, and the operation filter below must not rebuild for
+     * those: a new filtered list re-evaluates every collection action's `enabledCondition` (the reason the query itself is
+     * read through a ref). Only a change of variant changes which export is offered.
+     */
+    const listingNamesVariants = collectionExportQuery?.listingVariantKeys !== undefined;
+    const listingListVariantKey = collectionExportQuery?.listingVariantKeys?.list;
+    const listingSearchVariantKey = collectionExportQuery?.listingVariantKeys?.search;
+    const listingVariantKeys = useMemo(() => (listingNamesVariants ? { list: listingListVariantKey, search: listingSearchVariantKey } : undefined), [listingNamesVariants, listingListVariantKey, listingSearchVariantKey]);
     /**
      * Does this resource declare exports on BOTH a search-sourced and a non-search-sourced operation?
      *
@@ -436,6 +512,10 @@ export function useResourceOperationActions(params) {
             // items memo, since it depends on the async `enabledCondition` result.)
             if (op.operationFrontendConfig?.actionVisibility === ActionVisibility.HIDDEN)
                 return false;
+            // Runtime-capability hide (#2649): the shell's capabilities say the action has nothing to do here. Display-only,
+            // like the line above; the backend still decides the operation.
+            if (runtimeUnavailableOperations.has(ResourcesConfig_OperationPathUtils.createOperationPathKeyFromOperation(op)))
+                return false;
             // Headless (API_ONLY) operations have NO UI surface — never render an action.
             // The canonical headless filter for every action surface (the create button in
             // ResourceLayout_List uses the same gate). An unsurfaced or `apiOnly()` item op
@@ -472,7 +552,7 @@ export function useResourceOperationActions(params) {
             // ONE predicate, shared with the list's mount check — see
             // `isCollectionScopedResourceOperation`, which carries all three ways to be collection-scoped
             // and the reason they may not be enumerated separately at each asker.
-            const isCollectionScoped = isCollectionScopedResourceOperation(op);
+            const isCollectionScoped = isCollectionScopedResourceOperation(op, { addressesTheContextSingletonRecord: onTheContextSingletonRecord });
             if (collectionOnly) {
                 if (!isCollectionScoped || isBulk)
                     return false;
@@ -501,6 +581,9 @@ export function useResourceOperationActions(params) {
             // itself, and hiding the only export while somebody types would remove a capability rather
             // than disambiguate one. The gate needs the listing to have TOLD us its mode, so a surface
             // that supplies no `collectionExportQuery` sees no change at all.
+            // An export of ANOTHER variant than the one the listing shows answers a set the person is not looking at (#2705).
+            if (!collectionExportReRunsListingVariant(op, listingVariantKeys))
+                return false;
             if (listingSearchActive !== undefined && exportSourceIsAmbiguous && isGeneratedCollectionExportOperation(op)) {
                 const exportsSearchResults = op.generatedOperation?.kind === ResourceGeneratedOperationKind.GENERATED_COLLECTION_EXPORT
                     && op.generatedOperation.sourceCoreOperation === CoreResourceOperation.SEARCH;
@@ -517,23 +600,19 @@ export function useResourceOperationActions(params) {
                 if (shouldTreatAsNonItemResourceOperation(op))
                     return false;
             }
-            // Only frontend-callable operations (API_CALL, API_CALL_WITH_CALLBACK)
+            // Only frontend-callable operations (API_CALL)
             const vType = op.variantType;
-            if (vType && vType !== ResourceOperationVariantType.API_CALL && vType !== ResourceOperationVariantType.API_CALL_WITH_CALLBACK) {
+            if (vType && vType !== ResourceOperationVariantType.API_CALL) {
                 return false;
             }
-            // Role-gating: do not surface operations the user's effective roles cannot
-            // perform (hierarchy-aware OR match mirroring backend authorization).
-            if (!userRolesSatisfyRequiredRoles({
-                requiredRoles: op.roles,
-                userAppRoles: stableUserAppRoles,
-                userOrgRoles: stableUserOrgRoles,
-            })) {
+            // Role-gating: do not surface operations the viewer may not perform — the backend gate's decision, including a
+            // reach that only an organization-unit grant confers (#2381), in the organization these actions address.
+            if (!viewerMayPerformOperation({ ...op, resourceType, resourcePrimaryScope: resourceConfig?.resourcePrimaryScope }, actionViewer)) {
                 return false;
             }
             return true;
         });
-    }, [resourceConfig, stableExcludeOperations, bulkOnly, collectionOnly, stableUserAppRoles, stableUserOrgRoles, listingSearchActive, exportSourceIsAmbiguous]);
+    }, [resourceConfig, resourceType, stableExcludeOperations, runtimeUnavailableOperations, bulkOnly, collectionOnly, actionViewer, listingSearchActive, listingVariantKeys, exportSourceIsAmbiguous, onTheContextSingletonRecord]);
     // ─── Step 2: Evaluate enabledCondition for all filtered operations ───
     // Async — starts as empty Map, then populates after evaluation completes.
     //
@@ -548,6 +627,9 @@ export function useResourceOperationActions(params) {
         currentObject,
         resourceType,
         selectionObjects,
+        ...(currentObjectDataMode ? { subjectDataMode: currentObjectDataMode } : {}),
+        // The `initiatorIds.organizationId` a condition sees is the one the request will carry (#1461).
+        ...(addressedOrganizationId ? { organizationId: addressedOrganizationId } : {}),
     });
     // Build contextual parameters for API calls (canonical implementation)
     const contextualParameters = useMemo(() => {
@@ -677,11 +759,6 @@ export function useResourceOperationActions(params) {
      * Feature-gated unavailability is not handled here — it has its own upgrade/contact affordance.
      */
     const isOperationRunning = useCallback((operation) => runningOperationKeys.has(ResourcesConfig_OperationPathUtils.createOperationPathKeyFromOperation(operation)), [runningOperationKeys]);
-    /**
-     * Does the current selection exceed what one request of this BULK operation may name? The limit is
-     * enforced by the bulk request schema (`resolveBulkOperationMaxSelection`); asking here too means the
-     * bar says so before anyone clicks, instead of a refused request after.
-     */
     /**
      * How many rows a bulk action would touch.
      *
@@ -690,11 +767,55 @@ export function useResourceOperationActions(params) {
      * selection the number is what the LISTING reported, because the client has no rows to count.
      */
     const resolveSelectionCount = useCallback(() => (matchAllSelection?.matchedCount ?? selectionObjects?.length ?? selectedItemIds?.length ?? 0), [matchAllSelection, selectedItemIds, selectionObjects]);
+    /*
+     * Record a background run this surface started, from WHICHEVER door executed it (#1461).
+     *
+     * A bulk action executes through one of two doors: directly (`handleExecuteOperation`, an action with
+     * no input) or through the operation's own form, hosted in the anchored panel or an overlay, when it
+     * takes input — Wonder Todos' "Change status" asks for the status. Only the direct door used to record
+     * the acceptance, so every form-bearing background action answered 202, changed its rows, and its
+     * progress, summary and "View failures" never appeared (measured 2026-10-02, 21 todos).
+     *
+     * Both doors emit RESOURCE_OPERATION_EXECUTED carrying the response as `resultSummary` and this
+     * surface's discriminator, so that event is the one place the acceptance is read. Filtered to bulk
+     * operations, which are the only runs this state reports.
+     */
+    const resolveSelectionCountRef = useRef(resolveSelectionCount);
+    resolveSelectionCountRef.current = resolveSelectionCount;
+    useEffect(() => {
+        if (!effectiveSuccessDiscriminator)
+            return undefined;
+        return on(FrontendEvents.RESOURCE_OPERATION_EXECUTED, (payload) => {
+            const acceptance = readBackgroundAcceptance(payload.resultSummary);
+            if (acceptance) {
+                setAcceptedBackgroundRun({ jobId: acceptance.jobId, attemptedCount: resolveSelectionCountRef.current() });
+            }
+        }, (payload) => payload.resourceType === resourceType
+            && payload.isBulkOperation === true
+            && payload.optionalDiscriminator === effectiveSuccessDiscriminator);
+    }, [on, resourceType, effectiveSuccessDiscriminator]);
+    /**
+     * The most rows one request of this BULK operation may name, for the selection as it stands.
+     *
+     * It depends on how the rows are named. An `_ids` list travels in the request, so the bulk request
+     * schema bounds it at `resolveBulkOperationMaxSelection` whatever the runtime. A MATCH selection
+     * ("all N matching") is resolved at the server, which bounds it by who waits — a background
+     * operation takes `BULK_OPERATION_BACKGROUND_MAX_SELECTION` — through the same
+     * `resolveBulkOperationMatchMaxSelection` this calls. Reading only the first limit disabled every
+     * background action above 100 matches, so its lane could never be chosen (#2062).
+     */
+    const resolveBulkSelectionCeiling = useCallback((operation) => (matchAllSelection
+        ? resolveBulkOperationMatchMaxSelection(operation)
+        : resolveBulkOperationMaxSelection(operation)), [matchAllSelection]);
+    /**
+     * Does the current selection exceed what one request of this BULK operation may name? Asked here
+     * as well as at the server so the bar says so before anyone clicks, instead of a refused request after.
+     */
     const exceedsBulkLimit = useCallback((operation) => {
         if (operation.isBulkOperation !== true)
             return false;
-        return resolveSelectionCount() > resolveBulkOperationMaxSelection(operation);
-    }, [resolveSelectionCount]);
+        return resolveSelectionCount() > resolveBulkSelectionCeiling(operation);
+    }, [resolveSelectionCount, resolveBulkSelectionCeiling]);
     const buildUnavailability = useCallback((operation, entry) => {
         if (exceedsBulkLimit(operation)) {
             return {
@@ -703,7 +824,7 @@ export function useResourceOperationActions(params) {
                     componentType: FrontendComponentType.RESOURCES_LAYOUTS_OPERATIONS_ITEMS,
                     key: 'bulkSelectionTooLarge',
                     params: {
-                        maxSelection: resolveBulkOperationMaxSelection(operation),
+                        maxSelection: resolveBulkSelectionCeiling(operation),
                         selectedCount: resolveSelectionCount(),
                     },
                 }),
@@ -714,8 +835,7 @@ export function useResourceOperationActions(params) {
         if (entry.featureAvailability && !entry.featureAvailability.isAvailable)
             return undefined;
         const opId = String(operation.operationIdentifier);
-        const authored = tResourceOperation(resourceType, opId, ResourceOperationTextSlot.UNAVAILABLE_REASON);
-        const specificReason = authored && !authored.startsWith('resources.') ? authored : undefined;
+        const specificReason = resolveAuthoredOperationUnavailableReason(tResourceOperation, resourceType, opId);
         const ineligible = entry.ineligibleSelectionIndices;
         if (operation.isBulkOperation === true && ineligible && ineligible.length > 0 && selectionObjects?.length) {
             const countLine = resolveComponentLabel({
@@ -750,7 +870,7 @@ export function useResourceOperationActions(params) {
                 key: 'unavailableForItem',
             }),
         };
-    }, [exceedsBulkLimit, onSelectionNarrow, resourceType, selectedItemIds, selectionObjects, tComponent, tResourceOperation]);
+    }, [exceedsBulkLimit, resolveBulkSelectionCeiling, resolveSelectionCount, onSelectionNarrow, resourceType, selectedItemIds, selectionObjects, tComponent, tResourceOperation]);
     // Get full operation enabled entry (enabled status + feature availability)
     const getOperationEntry = useCallback((operation) => {
         const operationKey = buildOperationEnabledKey(operation);
@@ -787,6 +907,11 @@ export function useResourceOperationActions(params) {
                         [BULK_OPERATION_MATCH_SELECTION_CONTEXT_KEY]: {
                             ...(matchAllSelection.filters ? { filters: matchAllSelection.filters } : {}),
                             ...(matchAllSelection.search ? { search: matchAllSelection.search } : {}),
+                            // The listing the rows came from, which the server re-runs (#2718).
+                            ...(matchAllSelection.listing ? { listing: matchAllSelection.listing } : {}),
+                            // For the words only ("will be cleared on 40 records", #2620): the wire selector is built from the
+                            // filters, the search and the listing (`buildBulkOperationMatchPayload`), never from the count.
+                            matchedCount: matchAllSelection.matchedCount,
                         },
                     }
                     : operation.isBulkOperation === true && selectedItemIds?.length
@@ -811,8 +936,8 @@ export function useResourceOperationActions(params) {
         const opContext = buildOperationContext(operation);
         const normalizedContextIdentifiers = FrontendResourceUtils.flattenContextIdentifiers(contextResourceIdentifiersWithIdEvidence);
         const urlPath = NavigationUtils.resolveResourceUrl(resourceConfig, operation, normalizedContextIdentifiers, registry.allResourceFieldIdentifiers, stableParentResourcesRequirements)?.resolvedUrl;
-        navigateToResource(opContext, NavigationUtils.createOperationInitiator(navigationZone, operationId), urlPath);
-    }, [resourceConfig, buildOperationContext, contextResourceIdentifiersWithIdEvidence, stableParentResourcesRequirements, registry, navigateToResource, navigationZone, operationId]);
+        navigateToResource(opContext, NavigationUtils.createOperationInitiator(navigationZone, sourceOperation), urlPath);
+    }, [resourceConfig, buildOperationContext, contextResourceIdentifiersWithIdEvidence, stableParentResourcesRequirements, registry, navigateToResource, navigationZone, sourceOperation]);
     // Execute an operation (DELETE, custom, etc.)
     /**
      * Fetch the export and hand the file to the browser.
@@ -953,9 +1078,20 @@ export function useResourceOperationActions(params) {
             // what is happening, in their own language, from the label tree. The engine used to answer
             // with the English sentence "Job has been queued for background processing" and this surface
             // showed it verbatim as a SUCCESS toast; both halves are gone.
+            // The run itself is recorded from the EXECUTED event both execution doors emit (see the
+            // subscription beside `acceptedBackgroundRun`); this door only announces it.
+            // #2288: an action held for another person's approval has not run either, and nothing else follows from it: no
+            // summary toast, no refresh, no outcome (the record changes, and announces itself, only when it is approved).
+            if (readOperationApprovalPending(result)) {
+                notificationRef.current?.notifyInfo(resolveComponentLabel({
+                    tComponent,
+                    componentType: FrontendComponentType.RESOURCES_LAYOUTS_OPERATIONS_ITEMS,
+                    key: 'operationSentForApproval',
+                }));
+                return;
+            }
             const backgroundAcceptance = readBackgroundAcceptance(result);
             if (backgroundAcceptance) {
-                setAcceptedBackgroundRun({ jobId: backgroundAcceptance.jobId, attemptedCount: resolveSelectionCount() });
                 notificationRef.current?.notifyInfo(resolveComponentLabel({
                     tComponent,
                     componentType: FrontendComponentType.RESOURCES_LAYOUTS_OPERATIONS_ITEMS,
@@ -1212,10 +1348,10 @@ export function useResourceOperationActions(params) {
                 : getOperationLabel(operation);
             // CRITICAL ops demand a deliberate "double validation": the user must type
             // the action's label to arm the confirm button. HIGH keeps the plain single
-            // confirm. (This covers direct-execute CRITICAL ops — e.g. DELETE; CRITICAL
-            // ops that navigate to a form, like a reset-with-flags, carry their
-            // double-validation on the form submit instead — see
-            // settings-hub-framework-topics.md Topic 2.)
+            // confirm. (This covers direct-execute ops — e.g. DELETE. A HIGH or CRITICAL
+            // op that navigates to a form — revoking an invitation with a reason, a
+            // reset-with-flags — is confirmed on the form's submit instead, with the
+            // same plain/typed split: `ResourceAutomatedForm`, #2261.)
             const requiresTypedConfirmation = riskLevel === ResourceOperationRiskLevel.CRITICAL;
             // The consequence, specifically (NN/g: say what will happen, never "are you sure?"): how many
             // rows a bulk action touches, and — only when true — that it cannot be undone. A risky action
@@ -1305,7 +1441,7 @@ export function useResourceOperationActions(params) {
      * caps and label-display mode, which are the bar's own layout knowledge — so the bar ignores this
      * panel where it cannot present it and falls back to the item's `onClick`.
      */
-    const buildAnchoredPanel = useCallback((operation, label) => {
+    const buildAnchoredPanel = useCallback((operation) => {
         const presentation = resolveResourceOperationActionPresentation(operation);
         /*
          * The three presentations that live in an ANCHORED PANEL meet here: POPOVER (a form), DROPDOWN
@@ -1341,6 +1477,10 @@ export function useResourceOperationActions(params) {
         }
         const operationKey = ResourcesConfig_OperationPathUtils.createOperationPathKeyFromOperation(operation);
         const dismiss = () => setOpenPopoverOperationKey(null);
+        // The panel's TITLE follows the one rule that names every surface showing an operation — the page header and
+        // the overlay title read it too (`resolveSurfaceTitleOperationIdentifier`): a named action keeps its own title,
+        // the core edit takes READ's heading rather than a button word. The bar shows it as the panel's heading (#2058).
+        const panelTitle = tResourceOperation(resourceType, resolveSurfaceTitleOperationIdentifier(operation.operationIdentifier, resourceConfig.operations), 'title');
         // A DROPDOWN's body is the list of values — edge to edge, like any menu — and executes on a
         // pick; everything else is the form. Both are detached hosts over the same operation view, so
         // they execute through the same contract.
@@ -1356,7 +1496,7 @@ export function useResourceOperationActions(params) {
             return {
                 open: openPopoverOperationKey === operationKey,
                 onOpenChange: (open) => setOpenPopoverOperationKey(open ? operationKey : null),
-                title: label,
+                title: panelTitle,
                 chrome: ActionBarPopoverChrome.LIST,
                 content: React.createElement(ResourceOperationActionDropdownBody, {
                     resourceContext: buildOperationContext(operation),
@@ -1369,14 +1509,14 @@ export function useResourceOperationActions(params) {
         return {
             open: openPopoverOperationKey === operationKey,
             onOpenChange: (open) => setOpenPopoverOperationKey(open ? operationKey : null),
-            title: label,
+            title: panelTitle,
             content: React.createElement(ResourceOperationActionPopoverBody, {
                 resourceContext: buildOperationContext(operation),
                 navigationZone,
                 onDismiss: dismiss,
             }),
         };
-    }, [resourceConfig, openPopoverOperationKey, buildOperationContext, navigationZone, inPlaceHost.isAvailable]);
+    }, [resourceConfig, resourceType, tResourceOperation, openPopoverOperationKey, buildOperationContext, navigationZone, inPlaceHost.isAvailable]);
     // ─── Step 3: Build ActionBarItem[] from filtered & enabled operations ───
     const items = useMemo(() => {
         if (!resourceConfig)
@@ -1414,7 +1554,17 @@ export function useResourceOperationActions(params) {
             // so a wholly-unavailable operation still surfaces its highest-rights variant
             // (rendered disabled / feature-locked) exactly as before.
             const enabledGroupVariants = groupVariants.filter((v) => getOperationEntry(v).isEnabled);
-            const variants = selectHighestRightsVariants(enabledGroupVariants.length > 0 ? enabledGroupVariants : groupVariants);
+            // A member's OWN enabled variant outranks the platform operator's crossing variant (#2315). The crossing variant
+            // carries the higher-rights role, so ranking alone put it first. For a super-administrator who also owns the
+            // organization, the operator's Release replaced the owner's on an organization-tier hold, and the backend
+            // refuses the platform's release of a live tenant's own hold. The operator's variant stays when it is the only
+            // enabled one (a platform-tier hold, or a verb both sides share, such as Revoke of an access grant).
+            const ownEnabledGroupVariants = actionViewer.organizationRoles.length > 0
+                ? enabledGroupVariants.filter((v) => v.admitsCrossTenantPlatformAdministration !== true)
+                : [];
+            const variants = selectHighestRightsVariants(ownEnabledGroupVariants.length > 0
+                ? ownEnabledGroupVariants
+                : enabledGroupVariants.length > 0 ? enabledGroupVariants : groupVariants);
             // Prefer the explicit non-bulk default variant for the group's primary
             // label/risk/icon. Undefined default flags should not masquerade as the
             // canonical operation because variants are already materialized by the registry.
@@ -1442,6 +1592,20 @@ export function useResourceOperationActions(params) {
             if (effectiveVisibility === ActionVisibility.WHEN_AVAILABLE && !entry.isEnabled) {
                 continue;
             }
+            // A BULK action that NO selected row can take is hidden, whatever the view's policy. The bar
+            // shows an unavailable bulk action so that it can explain which rows are the problem and offer
+            // "keep only the N eligible" — and with zero eligible rows there is nothing to keep and no way
+            // through, only a greyed button. Measured on Wonder Todos (2026-09-30): two completed todos
+            // selected, and the bar led with a greyed "Change status" and "Unassign todo" that neither row
+            // could take. The explained, disabled form stays whenever at least one row qualifies. A
+            // cross-page selection has no loaded rows to judge (`selectionObjects` is empty), so it is left
+            // to the server, as before.
+            if (!entry.isEnabled
+                && defaultVariant.isBulkOperation === true
+                && !!selectionObjects?.length
+                && (entry.ineligibleSelectionIndices?.length ?? 0) >= selectionObjects.length) {
+                continue;
+            }
             const variantEntries = new Map(variants.map((variant) => [variant, getOperationEntry(variant)]));
             const riskLevel = defaultVariant.riskLevel;
             // Colour: explicit `actionVariant` override wins; otherwise derive from risk.
@@ -1583,7 +1747,7 @@ export function useResourceOperationActions(params) {
             }
             if (variants.length === 1) {
                 // Single variant — simple button
-                const anchoredPanel = buildAnchoredPanel(defaultVariant, label);
+                const anchoredPanel = buildAnchoredPanel(defaultVariant);
                 actionItems.push({
                     type: 'button',
                     icon,
@@ -1646,7 +1810,7 @@ export function useResourceOperationActions(params) {
                     // it can anchor, and must be built like the single-variant branch above. Wiring it
                     // straight to `handleOperationClick` left a derived POPOVER setting a flag with no panel
                     // to read it.
-                    const soleAnchoredPanel = buildAnchoredPanel(defaultVariant, label);
+                    const soleAnchoredPanel = buildAnchoredPanel(defaultVariant);
                     actionItems.push({
                         type: 'button',
                         icon,
@@ -1754,6 +1918,8 @@ export function useResourceOperationActions(params) {
         contextResourceIdentifiersWithIdEvidence,
         contextualParameters,
         hasCurrentResourceId,
+        // Read by the collapse: a member's own variant outranks a crossing one (#2315).
+        actionViewer,
         isOperationAddressableForActions,
         registry,
         resourceType,
@@ -1789,6 +1955,8 @@ export function useResourceOperationActions(params) {
         handleCollectionExportDownload,
         tComponent,
         renderIcon,
+        // Read directly by the "no selected row can take it" hide for bulk actions.
+        selectionObjects,
     ]);
     return {
         items,