@wildo-ai/saas-models 1.1.3 → 1.1.5

package/dist/esm/resources/resources-config.shared.factory.js

@@ -1,9 +1,11 @@
+import { ResourceConfiguration_QueueConfigSchema } from '../queue/queues.shared.schemas.js';
+import { normalizeScheduledRecoveryPolicy } from '../queue/jobs.shared.schemas.js';
 /**
  * Operations Shared Schemas
  *
  * Reusable operation schemas for bulk actions and common operations
  */
-import { ExpiresInDurationSchema, getImpersonalizeMaskValue, getImpersonalizeTreatment, getZodObjectShape, getZodType, isBackendOnlyField, isDiscriminatorField, isExcludedFromCreate, isExcludedFromUpdate, isBusinessKeyField, isZodObject, isSummaryField, isTemplatableFileField, isUniqueField, isVirtualField, SingleFileValueSchema, toPatchOptionalField, mainSchemaFieldIsClearable, unwrapSchema, getDataCategories, } from '@wildo-ai/zod-decorators';
+import { ExpiresInDurationSchema, getImpersonalizeMaskValue, getImpersonalizeTreatment, getZodObjectShape, getZodType, isBackendOnlyField, isDiscriminatorField, isExcludedFromCreate, isExcludedFromUpdate, isBusinessKeyField, isZodObject, isSummaryField, isTemplatableFileField, isUniqueField, isVirtualField, SingleFileValueSchema, toPatchOptionalField, mainSchemaFieldIsClearable, unwrapSchema, getDataCategories, markPatchRequestDtoObject, } from '@wildo-ai/zod-decorators';
 import { z } from 'zod';
 import { ErrorType } from '../errors/errors.shared.schemas.js';
 import { ErasureRetentionMode, ResourceDataSubjectKind, RetentionStatus, RetentionStatusSchema } from '../compliance/privacy/impersonalization.shared.schemas.js';
@@ -27,11 +29,13 @@ import { unknownPersonalDataCategories } from '../compliance/privacy/personal-da
  * only when TypeScript must INVENT a specifier for an INFERRED type. Re-run the probe if a
  * root-exported contract here ever starts inferring one.
  */
-import { HttpApiResourceBindingSchema, HttpApiTransportDialect, assertHttpApiBindingDialectCoherence } from '../http-api-binding/http-api-binding.shared.schemas.js';
+import { HttpApiResourceBindingSchema, assertHttpApiBindingDialectCoherence } from '../http-api-binding/http-api-binding.shared.schemas.js';
+import { HTTP_API_ENGINE_INJECTED_FIELDS, HTTP_API_TENANT_ANCHOR_FIELD, READ_THROUGH_ORGANIZATION_UNIT_FIELD_NAME, } from '../http-api-binding/read-through-engine-anchors.shared.js';
+import { HttpApiTransportDialect } from '../http-api-binding/http-api-transport-dialect.shared.js';
 import { ExternalDataDestinationPopulation, ExternalDataFieldCoercion, ExternalDataMappingEntryKind, ExternalDataPipelineDeclarationSchema, assertExternalDataPipelineDeclarationCoherence, } from '../external-data/external-data-pipeline.shared.schemas.js';
 import { HttpMethod } from '../requests/http-requests.shared.js';
 import { ConsumableToken_ConsumptionMode, TokenAuthenticationPolicy } from '../security/authentications/consumable-token.shared.schemas.js';
-import { OPERATION_VARIANT_KEY, Resources_BulkOperationBaseSchema, Resources_Filter_BaseSchema, Resources_Filter_DateRangeSchema, createPaginationRequestSchema, createPaginationResponseMetadataSchema, ResourceGeneratedOperationKind, ResourceSystemAccessMode, PersistenceAdapter, isPersistenceAdapter, SortOrder, ResourceCollectionExportResponseSchema, } from './resources-config.shared.schemas.js';
+import { OPERATION_VARIANT_KEY, wrapRequestDtoAsBulk, resolveBulkOperationMaxSelection, Resources_Filter_BaseSchema, Resources_Filter_DateRangeSchema, Resources_Filter_NumberRangeSchema, isResourcesFilterNumberRangeSchema, createPaginationRequestSchema, DEFAULT_LIST_PAGE_CEILING, DEFAULT_SEARCH_PAGE_CEILING, createPaginationResponseMetadataSchema, ResourceGeneratedOperationKind, ResourceSystemAccessMode, PersistenceAdapter, isPersistenceAdapter, SortOrder, ResourceCollectionExportResponseSchema, } from './resources-config.shared.schemas.js';
 import { CoreResourceOperation, CoreResourceType, coreResourceShared_FieldIdentifier } from './resources.shared.core.definitions.js';
 import { PRIMARY_SCOPE_FIELD_IDENTIFIERS, PRIMARY_SCOPE_TO_CORE_RESOURCE_TYPE, FIELD_IDENTIFIER_TO_PRIMARY_SCOPE, RelationshipNature, ResourceOperationRiskLevel, ResourceOperationVariantType, ResourceOperation_ServiceRuntimeMode, ResourceParentResourceRequirement, ResourcePrimaryScope, ResourceRelationshipBulkAction, ResourceRelationshipBulkActionResultSchema, ResourceRelationshipBulkClearOperationRequestSchema, ResourceRelationshipBulkCreateOperationRequestSchema, ResourceRelationshipBulkLinkOperationRequestSchema, ResourceRelationshipBulkReplaceOperationRequestSchema, ResourceRelationshipBulkSetOperationRequestSchema, ResourceRelationshipBulkUnlinkOperationRequestSchema, ResourceRelationshipAccessScopeStrategy, ResourceRelationshipCardinality, ResourceTranspositionPolicy } from './resources.shared.schemas.js';
 import { createResourcesRelationship } from './resources-relationships.shared.factory.js';
@@ -41,6 +45,7 @@ import { ResourcesSummaryUtils } from './utils/resources-summary.utils.js';
 import { collectTemplatableFileFieldPaths, stripTemplatableFileFieldsRecursively } from './utils/templatable-file-fields.shared.utils.js';
 import { selectByPersistenceAdapter } from './utils/persistence-adapter-discrimination.shared.utils.js';
 import { isServiceResolvableDefaultOperation, SERVICE_RESOLVABLE_OPERATION_VARIANT_TYPES, URL_BEARING_OPERATION_VARIANT_TYPES, } from './utils/resource-operation-type-guards.utils.js';
+import { describeCaughtError } from '../errors/errors.shared.utils.js';
 // --------------------------------
 // Error Helpers
 // --------------------------------
@@ -140,6 +145,57 @@ const RETENTION_REQUIRED_SERVICE_RESOLVABLE_OPERATIONS = [
         why: 'the see-through read primitive listRetainedAsSystem surfaces retained records via LIST',
     },
 ];
+/**
+ * The operations an `isAnonymizable` resource must expose to the SERVICE dispatch
+ * layer, with the `AnonymousSessionBackendService` primitive that needs each one.
+ *
+ * Sibling of {@link RETENTION_REQUIRED_SERVICE_RESOLVABLE_OPERATIONS} and consumed by
+ * the same TWO halves — presence (is it declared in `coreOperations`?) and
+ * resolvability (does it have a default variant `getServiceOperationPathDefault`
+ * can serve?). A separate constant rather than a shared one, because the two
+ * capabilities demand different operations for different reasons and merging them
+ * would make each entry's `why` unreadable.
+ *
+ * **Each entry is a DISJUNCTION, and that is the whole design decision.** Retention
+ * needs three specific operations, so its constant is a flat list of single ops.
+ * The anonymous-session cleanup needs to DELETE a known id set, and
+ * `deleteOwnedRecords` deliberately serves that with `DELETE_MANY` when the
+ * resource publishes one and per-row `DELETE` otherwise — so demanding
+ * `DELETE_MANY` would force every anonymizable resource to publish a bulk-delete
+ * surface it may not want (`draftNotes`, the only such resource today, publishes
+ * `DELETE` alone), while demanding `DELETE` would refuse a resource that
+ * legitimately publishes only the bulk form. The honest requirement is "at least
+ * one of these resolves", which is exactly what the runtime probes.
+ *
+ * Measured 2026-09-09: before this guard existed, `deleteOwnedRecords` resolved
+ * `DELETE_MANY` unconditionally, so for `draftNotes` the cleanup batch's phase 1
+ * threw on every run — the per-session catch counted an error and the
+ * `ANONYMOUS_USERS` anchor row was never removed. The runtime is now correct; this
+ * constant is what refuses the configuration at boot instead of discovering it at
+ * the first sweep.
+ */
+const ANONYMIZABLE_REQUIRED_SERVICE_RESOLVABLE_OPERATIONS = [
+    {
+        operations: [CoreResourceOperation.LIST],
+        primitive: 'listAnonymousRecords',
+        why: 'the transposition and cleanup lookups list a session\'s rows via LIST',
+    },
+    {
+        operations: [CoreResourceOperation.UPDATE_MANY],
+        primitive: 'reassignOwnership (updateManyAsSystem)',
+        why: 'the anon→user transposition rewrites { userId, anonymousUserId } via updateManyAsSystem',
+    },
+    {
+        operations: [CoreResourceOperation.DELETE_MANY, CoreResourceOperation.DELETE],
+        primitive: 'deleteOwnedRecords',
+        why: 'the expired-session sweep, the DISCARD transposition arm and the REPLACE pre-delete all remove '
+            + 'a known id set, preferring DELETE_MANY and falling back to per-row DELETE',
+    },
+];
+/** Human-readable "A or B" rendering of one requirement group's alternatives. */
+function describeOperationAlternatives(operations) {
+    return operations.length === 1 ? String(operations[0]) : operations.join(' or ');
+}
 function assertOperationPathKeySegment(value, label, operation) {
     if (value.includes(' | ')) {
         throw createConfigurationError(`Operation '${operation}' cannot use ${label} '${value}' because operation path keys reserve the delimiter ' | '`);
@@ -514,6 +570,41 @@ function validateTokenGenerationConfig(config, resourceIdentifier, operationIden
             `consumeAt only applies to one-off session tokens.`);
     }
 }
+/**
+ * Validates tokenAuthentication configuration at build time.
+ *
+ * **The only thing this refuses is an EMPTY `types` array, and that is the whole point.**
+ * `types: []` is well-typed, reads as "no restriction needed", and used to fail OPEN: the runtime
+ * collapsed an empty list to `undefined` and `ConsumableTokenBackendService.validateToken` treats
+ * `undefined` as "the caller does its own binding check", so the operation accepted EVERY consumable
+ * token type in the system — a password-reset link, an email-verification link, an OAuth state token
+ * — with that token's `roles` flowing into the execution context. That is the confused-deputy shape:
+ * one token namespace, several verifiers, and an audience check that was optional at the verifier.
+ *
+ * Refusing here rather than at the verifier is deliberate. A runtime refusal turns an authoring
+ * mistake into a request-time failure on a path nobody may exercise before production; a build-time
+ * refusal makes the shape unrepresentable, because a resource config is constructed at module load
+ * and an application carrying one cannot boot. `validateToken` ALSO refuses an empty array now, as
+ * the chokepoint backstop for a config that never passed through this factory — see issue #313.
+ *
+ * An operation that genuinely wants no type constraint has no expression here and must not get one:
+ * the correct authoring is to name every type the operation accepts. A verifier that owns its own
+ * binding check (the file-share download, `validateFileToken`) calls `validateToken` directly and
+ * never declares `tokenAuthentication` at all.
+ */
+function validateTokenAuthenticationConfig(config, resourceIdentifier, operationIdentifier) {
+    const prefix = `[${resourceIdentifier}.${operationIdentifier}] tokenAuthentication`;
+    if (!config.types || config.types.length === 0) {
+        throw createConfigurationError(`${prefix}: types must be a non-empty array of the consumable token types this operation accepts. ` +
+            `An empty list is not "no restriction" — it would accept EVERY consumable token type in the ` +
+            `system (password-reset, email-verification, OAuth state, …) as authentication for this ` +
+            `operation, with that token's roles. Name the types explicitly.`);
+    }
+    if (!config.policy) {
+        throw createConfigurationError(`${prefix}: policy is required (ALTERNATIVE — the token replaces JWT auth; or ADDITIVE — the ` +
+            `token is required on top of it).`);
+    }
+}
 /**
  * Validates tokenRevocation configuration at build time.
  */
@@ -690,7 +781,8 @@ function buildUpdateRequestDto(mainSchema, customExclusions) {
             // back over the stored value (see `toPatchOptionalField`).
             updateShape[fieldName] = toPatchOptionalField(stripTemplatableFileFieldsRecursively(fieldSchema));
         }
-        return stripTemplatableFileFieldsRecursively(z.object(updateShape));
+        // PATCH write rule: absent key untouched, null clears — the fact a form reads to clear a field (#989).
+        return stripTemplatableFileFieldsRecursively(markPatchRequestDtoObject(z.object(updateShape)));
     }
     catch {
         // If schema is not an object, return as-is
@@ -1325,6 +1417,13 @@ export function createResourceSearchQueryRequestSchema(params) {
             if (schema instanceof z.ZodDate) {
                 processedFields[key] = Resources_Filter_DateRangeSchema.optional();
             }
+            else if (isResourcesFilterNumberRangeSchema(schema)) {
+                // Already the range vocabulary — the author wrote it, which is the opt-in. Named here
+                // rather than left to the fallback below so the numeric range is a VISIBLE branch beside
+                // the date one; the two are the framework's only structured filter shapes and a reader
+                // looking for "which filters are ranges" must find both in one place.
+                processedFields[key] = Resources_Filter_NumberRangeSchema.optional();
+            }
             else if (schema instanceof z.ZodString) {
                 processedFields[key] = schema.optional();
             }
@@ -1486,7 +1585,12 @@ export function createResourceConfiguration_Initialization(params) {
         create: ResourceSystemAccessMode.FORBIDDEN,
         update: ResourceSystemAccessMode.FORBIDDEN,
         updateMany: ResourceSystemAccessMode.FORBIDDEN,
-    }, isAnonymizable = false, transpositionPolicy, retentionPolicy, dataSubjectPolicy, portabilityPolicy, persistenceAdapter, persistenceAdapterIsolation, httpApiBinding, introspectionBinding, coreOperations, customOperation, operationsConfiguration, } = params;
+    }, isAnonymizable = false, 
+    // Carried through UNCHANGED and with no default. Absent means "this resource is not the erasure
+    // lane", which is true of almost every resource — a default here would make every resource claim
+    // to be one. The bindings are validated at boot, not here: this factory has the declaration but
+    // not the registry, and a name resolves against the resource's own schema and operations.
+    subjectErasureLane, transpositionPolicy, retentionPolicy, dataSubjectPolicy, portabilityPolicy, persistenceAdapter, persistenceAdapterIsolation, httpApiBinding, introspectionBinding, coreOperations, customOperation, operationsConfiguration, } = params;
     /**
      * HTTP_API ↔ binding coherence — enforced at AUTHORING, both directions, because each half
      * alone is a contradiction the backend could only discover later and worse:
@@ -1547,7 +1651,7 @@ export function createResourceConfiguration_Initialization(params) {
             assertHttpApiBindingDialectCoherence(bindingParse.data);
         }
         catch (error) {
-            throw createConfigurationError(`[${resourceIdentifier}] invalid httpApiBinding declaration: ${error instanceof Error ? error.message : String(error)}`);
+            throw createConfigurationError(`[${resourceIdentifier}] invalid httpApiBinding declaration: ${describeCaughtError(error)}`);
         }
         return bindingParse.data;
     })();
@@ -1593,7 +1697,7 @@ export function createResourceConfiguration_Initialization(params) {
             assertHttpApiBindingDialectCoherence(declaration.binding);
         }
         catch (error) {
-            refuse(error instanceof Error ? error.message : String(error));
+            refuse(describeCaughtError(error));
         }
         const shape = getZodObjectShape(mainSchema);
         const requireMappedTarget = (fieldName, context) => {
@@ -1627,6 +1731,34 @@ export function createResourceConfiguration_Initialization(params) {
         if (!isUniqueField(keyFieldSchema)) {
             refuse(`remoteKeyLocalField: '${declaration.remoteKeyLocalField}' must ALSO be declared .isUnique(). The schema planner derives a UNIQUE constraint from .isUnique() and NOT from .isBusinessKey(), so without it the store would accept two rows for one remote row whenever two runs overlap — the merge would be enforced only by this engine's read-then-write, never by the database.`);
         }
+        /*
+         * The two PARTITION stamps (#1058 E4), when the source instance is partitioned.
+         *
+         * Validated through `requireMappedTarget` like every other engine-written target, so both
+         * inherit the `.excludeFromCreate()/.excludeFromUpdate()` requirement — these decide who may see
+         * a row and whether an orphan pass deletes it, and a caller that could write either could move
+         * its own rows into another subsidiary's confinement or out of the orphan comparison entirely.
+         *
+         * Both must ACCEPT ABSENCE, and that is the one rule the sibling `remoteKeyLocalField` does not
+         * share. A row whose partition field is unset is SHARED (E2) — it belongs to every caller and to
+         * no unit — so both stamps land `null` on it. A required target would reject exactly the rows
+         * the decision says everyone may see, and it would reject them at LOAD time, per row, with a
+         * reason about a field the author never wrote a value for.
+         */
+        for (const [label, partitionField] of [
+            ['partitionUnitLocalField', declaration.partitionUnitLocalField],
+            ['partitionKeyLocalField', declaration.partitionKeyLocalField],
+        ]) {
+            if (partitionField === undefined)
+                continue;
+            const partitionSchema = requireMappedTarget(partitionField, label);
+            if (!(unwrapSchema(partitionSchema) instanceof z.ZodString)) {
+                refuse(`${label}: '${partitionField}' must be a STRING field — it stores ${label === 'partitionUnitLocalField' ? 'an ORGANIZATION_UNITS id' : "the remote partition key in the canonical text an assignment row holds"}.`);
+            }
+            if (unwrapSchema(partitionSchema) === partitionSchema) {
+                refuse(`${label}: '${partitionField}' must be optional or nullable. A row whose remote partition field is unset is SHARED — it belongs to every caller and to no unit — and this stamp lands null on it, so a required target rejects exactly the rows every caller is entitled to see.`);
+            }
+        }
         for (const entry of declaration.mapping) {
             const targetSchema = requireMappedTarget(entry.localField, `mapping('${entry.localField}')`);
             if (entry.kind === ExternalDataMappingEntryKind.REMOTE_FIELD) {
@@ -1775,6 +1907,194 @@ export function createResourceConfiguration_Initialization(params) {
             `(DERIVE RESOURCE PRIMARY SCOPE) for the full rationale.`);
     }
     // ========================================
+    // HTTP_API × PRIMARY SCOPE — a system of record's rows belong to the OWNER organization
+    // ========================================
+    //
+    // Rows read out of a system of record are STAMPED with the organization that owns the application
+    // (#1055 §6), and the engine's per-row gate reads that stamp. Three things have to be true of the
+    // resource for the stamp to mean anything, and all three are checkable HERE.
+    //
+    // ## Why here, and not at registration — R13 was measured and is wrong on this half
+    //
+    // #1055's review pass says "the resource factory never sees relationships", so the anchor check
+    // must move to boot registration. It does see them: `resourceRelationships` is a parameter of this
+    // function (a resource config is a FUNCTION of the registry's relationship list — see any
+    // `*.resources-config.ts`), and `primaryScopeRelationship` is resolved from it thirty lines up.
+    //
+    // So the split the plan prescribed buys nothing and costs the author their error at the moment they
+    // write the file. What genuinely CANNOT be checked here is the INSTANCE — whether `system` names a
+    // declared one and whether the dialects agree — because the saas configuration is not in scope in
+    // an application's `shared-lib`. That half stays at registration, which is the first place both the
+    // binding and the declaration are visible.
+    if (resolvedHttpApiBinding !== undefined) {
+        if (resourcePrimaryScope !== ResourcePrimaryScope.ORGANIZATIONS) {
+            throw createConfigurationError(`[${resourceIdentifier}] an http-api resource must be ORGANIZATIONS-scoped, and this one resolves to `
+                + `'${resourcePrimaryScope}'. Its rows are stamped with the organization that owns the application, and the `
+                + `per-row tenant gate reads that stamp — an APPLICATION- or USER_SELF-scoped resource has no organization in `
+                + `its execution context to compare it against, so every read would be decided by a field nothing could match.`);
+        }
+        /*
+         * The anchor must be REQUIRES_CONTEXT, and it must name no foreign key.
+         *
+         * STANDALONE is the one that was MEASURED to fail rather than reasoned about: it answered
+         * 403 `parent_scope_denied` to an ORG_OWNER, because `initiatorIds.organizationId` is filled only
+         * from URL parameters and a standalone resource is not routed under its scope parent.
+         *
+         * A `foreignKeyField` would be a field the projection can never fill: a remote row carries no
+         * Wildo organization id, which is the entire reason the stamp exists. Naming one would make every
+         * row look as though it declared a tenant it does not have.
+         */
+        if (primaryScopeRelationship !== undefined) {
+            if (primaryScopeRelationship.accessScopeStrategy !== ResourceRelationshipAccessScopeStrategy.REQUIRES_CONTEXT) {
+                throw createConfigurationError(`[${resourceIdentifier}] an http-api resource's primary-scope relationship must be REQUIRES_CONTEXT, and this `
+                    + `one is '${String(primaryScopeRelationship.accessScopeStrategy)}'. A STANDALONE anchor is not routed under its `
+                    + `organization, so the execution context carries no organization id and an ORG_OWNER is answered `
+                    + `403 parent_scope_denied — measured, not inferred.`);
+            }
+            if (primaryScopeRelationship.foreignKeyField !== undefined) {
+                throw createConfigurationError(`[${resourceIdentifier}] an http-api resource's primary-scope relationship declares `
+                    + `foreignKeyField '${String(primaryScopeRelationship.foreignKeyField)}', which the projection can never fill — `
+                    + `a remote row carries no Wildo organization id. The tenant anchor is STAMPED onto the projected row from the `
+                    + `application's owner organization; remove the foreign key.`);
+            }
+        }
+    }
+    // ========================================
+    // EXTERNAL-DATA PIPELINE × PRIMARY SCOPE — the destination is ORGANIZATIONS-owned, and the ENGINE
+    // supplies the tenant
+    // ========================================
+    //
+    // Since #868 a pipeline load STAMPS every entry with the organization that owns the application
+    // (#1054), under the destination's own declared foreign key. So the question this rule asks has
+    // inverted: it used to demand that the AUTHOR supply the tenant, and now it demands that the author
+    // leave room for the ENGINE to.
+    //
+    // ## What the previous rule was, and why it could not stay
+    //
+    // It refused a required scope FK that no mapping supplied, because a load genuinely carried no
+    // tenant. MEASURED 2026-09-11 against a real Mongo store, through the real engines, on a
+    // destination shaped exactly like Wonder Todos' `externalCustomers`:
+    //
+    //   | declaration                                   | run          | rows | tenant | reachable |
+    //   |-----------------------------------------------|--------------|------|--------|-----------|
+    //   | no mapping onto the scope FK                   | completed    |   2  |  NO    |     0     |
+    //   | a CONSTANT mapping onto the scope FK           | completed    |   2  |  YES   |     2     |
+    //
+    // The first row is why a refusal existed at all: a `completed-pass` run with `entriesFailed: 0`
+    // that writes rows no contextual read can find. A silent success producing unreachable data is
+    // strictly worse than a refusal.
+    //
+    // But both remedies it offered are now WRONG. A `CONSTANT` id cannot be authored — organizations
+    // are created at runtime, so there is no id to commit — and a STANDALONE anchor was measured to
+    // answer 403 `parent_scope_denied` to an ORG_OWNER, because `initiatorIds.organizationId` is filled
+    // only from URL parameters and a standalone resource is not routed under its scope parent. The rule
+    // was refusing the one correct shape and recommending two broken ones.
+    //
+    // ## What it refuses now, and why each one is a LIE rather than an incompleteness
+    //
+    // Every clause below rejects a declaration that would be UNTRUE if it ran, which is the test
+    // `application-creation-directive.md` sets for a refusal. None of them asks anyone to decide
+    // anything: each names the one shape that works.
+    if (externalDataPipeline !== undefined) {
+        const pipelineDestinationRefusal = (reason) => {
+            throw createConfigurationError(`[${resourceIdentifier}] invalid externalDataPipeline declaration: ${reason}
+`
+                + `
+`
+                + `A pipeline reads a SYSTEM OF RECORD — a deployment the operator runs, read with the application's own
+`
+                + `service identity — so every row it loads belongs to the organization that OWNS the application, and the
+`
+                + `engine stamps that organization onto each entry as it is built. What the destination owes is somewhere
+`
+                + `to put it: an ORGANIZATIONS primary scope, reached through a ROUTED relationship
+`
+                + `(accessScopeStrategy: REQUIRES_CONTEXT) that names a REQUIRED foreignKeyField, with that field mapped by
+`
+                + `nothing and declared .excludeFromCreate().excludeFromUpdate().`);
+        };
+        // (a) The destination must be ORGANIZATIONS-scoped. Decision Q2 of #1049: system-of-record data
+        //     belongs to the owner organization, so an APPLICATION- or USER_SELF-scoped destination is a
+        //     statement about ownership that contradicts where the rows come from.
+        if (resourcePrimaryScope !== ResourcePrimaryScope.ORGANIZATIONS) {
+            pipelineDestinationRefusal(`its primary scope is ${String(resourcePrimaryScope)}, and a system-of-record destination must be ORGANIZATIONS.`);
+        }
+        // (b) There must BE a routed scope relationship carrying a foreign key. Without one the stamp has
+        //     nowhere to land: a field the schema does not declare is dropped by the strict re-parse, and
+        //     the row lands unanchored — the measured failure above, arriving through the fix for it.
+        //     STANDALONE is called out by name because it is the remedy the previous rule recommended.
+        if (primaryScopeRelationship === undefined) {
+            pipelineDestinationRefusal('it declares no primary-scope relationship, so a loaded row has no tenant field.');
+        }
+        if (primaryScopeRelationship.accessScopeStrategy === ResourceRelationshipAccessScopeStrategy.STANDALONE) {
+            pipelineDestinationRefusal('its primary-scope relationship is STANDALONE. A standalone resource is not routed under its organization, so '
+                + '`initiatorIds.organizationId` is never filled and an ORG_OWNER is answered 403 parent_scope_denied — measured '
+                + 'on `billableServices`, 2026-09-14. This was the previous rule\'s own first recommendation.');
+        }
+        const scopeForeignKeyField = primaryScopeRelationship.foreignKeyField;
+        if (scopeForeignKeyField === undefined) {
+            pipelineDestinationRefusal('its primary-scope relationship names no foreignKeyField, so there is no column to stamp the owner organization '
+                + 'onto. (A VIRTUAL read-through resource is the opposite case and must NOT name one — its rows are projected, '
+                + 'never stored.)');
+        }
+        // (c) Nothing may MAP onto the tenant field. Two sources of truth for the tenant is the defect,
+        //     not a convenience: a mapping wins at load time and the stamp becomes decoration.
+        if (externalDataPipeline.mapping.some((entry) => entry.localField === scopeForeignKeyField)) {
+            pipelineDestinationRefusal(`a mapping entry writes '${String(scopeForeignKeyField)}', which the engine stamps. Two sources of truth for the `
+                + 'tenant is exactly the ambiguity this rule exists to remove — remove the mapping entry.');
+        }
+        // (d) The tenant field must be REQUIRED. Optional means "a row without a tenant is legal", and no
+        //     row loaded from a system of record is: an untenanted row is unreadable, and the schema would
+        //     be promising that it is a supported state.
+        const scopeFieldSchema = getZodObjectShape(mainSchema)[scopeForeignKeyField];
+        if (scopeFieldSchema === undefined) {
+            pipelineDestinationRefusal(`its primary-scope relationship names foreignKeyField '${String(scopeForeignKeyField)}', which the schema does not `
+                + 'declare. The stamp would be dropped by the strict re-parse and every row would land unanchored.');
+        }
+        // `unwrapSchema` strips optional/nullable/default wrappers, so an unwrapped schema IDENTICAL to
+        // the declared one means nothing wrapped it — the same test the mapping validation above uses.
+        if (unwrapSchema(scopeFieldSchema) !== scopeFieldSchema) {
+            pipelineDestinationRefusal(`'${String(scopeForeignKeyField)}' is optional, nullable or defaulted. A row loaded from a system of record always `
+                + 'has an owner, so an absent tenant is not a state this resource can be in — and declaring it legal makes an '
+                + 'unreadable row look like a supported one.');
+        }
+        // (e) The tenant field must be excluded from CREATE and UPDATE. It is engine-supplied, so a
+        //     client that could send it could hand its own rows to another organization — and one that
+        //     could update it could move them.
+        if (!isExcludedFromCreate(scopeFieldSchema) || !isExcludedFromUpdate(scopeFieldSchema)) {
+            pipelineDestinationRefusal(`'${String(scopeForeignKeyField)}' is engine-supplied and must be declared `
+                + '.excludeFromCreate().excludeFromUpdate(). Without them a caller can name the tenant on a write — creating a row '
+                + 'under another organization, or moving an existing one out of its own.');
+        }
+        /*
+         * (f) The destination population is NOT constrained here, and that DIVERGES from #868's review
+         * decision R2(e), which said to refuse `OPEN` in this slice. Recorded rather than done quietly.
+         *
+         * R2(e)'s reason was that "caller-minted rows under another organization contradict 'belongs to
+         * the owner'". Two things measured against that:
+         *
+         *  - Nothing depends on the claim being universally true. The per-row tenant gate reads each
+         *    row's own anchor, so a loaded row owned by the owner organization and a caller-minted row
+         *    owned by its creator are both read correctly, by different people. There is no site that
+         *    asserts "every row of this resource belongs to the owner".
+         *  - A caller cannot name the tenant anyway: clause (e) above requires `.excludeFromCreate()`, so
+         *    a caller-minted row takes its organization from the request context like any other, and the
+         *    orphan walk cannot reach it either — the walk filters on `__seed.seedKey`, which a
+         *    caller-minted row does not carry.
+         *
+         * And the deciding one is this repository's own test for a refusal
+         * (`application-creation-directive.md`): if this refuses, what does the operator do next? The
+         * answer would be "change your product decision about whether callers may add rows" — a
+         * DECISION, not a repair to an untrue artifact. That makes it a workflow gate rather than a
+         * refusal, and the directive says a workflow must MARK rather than block.
+         *
+         * Refusing it would also have made three shipped, tested behaviours unreachable: the CREATE/UPDATE
+         * DTO stripping that protects remote-authoritative fields on caller-minted rows, the admission of
+         * create-shaped custom operations, and the admission of a declared caller CREATE. Those pins live
+         * in `external-data-pipeline-coherence.test.ts` and still pass.
+         */
+    }
+    // ========================================
     // isAnonymizable VALIDATION & ENRICHMENT (W7.3a)
     // ========================================
     let effectiveMainSchema = mainSchema;
@@ -1801,11 +2121,18 @@ export function createResourceConfiguration_Initialization(params) {
                 throw e;
             throw createConfigurationError(`[${resourceIdentifier}] isAnonymizable: true but mainSchema is not a ZodObject (cannot validate userId field).`);
         }
-        if (!coreOperations.includes(CoreResourceOperation.LIST)) {
-            throw createConfigurationError(`[${resourceIdentifier}] isAnonymizable: true requires LIST in coreOperations (needed for transposition lookup).`);
-        }
-        if (!coreOperations.includes(CoreResourceOperation.UPDATE_MANY)) {
-            throw createConfigurationError(`[${resourceIdentifier}] isAnonymizable: true requires UPDATE_MANY in coreOperations (needed for transposition batch update).`);
+        // PRESENCE half of the anonymizable operation contract: each requirement group must have at
+        // least one of its alternatives declared at all. The RESOLVABILITY half — that a declared op
+        // has a variant `AnonymousSessionBackendService` can actually dispatch — runs later, once the
+        // operation variants are assembled (search `ANONYMIZABLE_REQUIRED_SERVICE_RESOLVABLE_OPERATIONS`).
+        // Deliberately two checks, exactly as for `retentionPolicy`, because they have two different
+        // fixes: "declare the op" vs "declare it with a service-resolvable variant".
+        for (const { operations: alternatives, primitive, why } of ANONYMIZABLE_REQUIRED_SERVICE_RESOLVABLE_OPERATIONS) {
+            if (alternatives.some((alternative) => coreOperations.includes(alternative))) {
+                continue;
+            }
+            throw createConfigurationError(`[${resourceIdentifier}] isAnonymizable: true requires ${describeOperationAlternatives(alternatives)} ` +
+                `in coreOperations (${primitive}: ${why}).`);
         }
         effectiveMainSchema = mainSchema.extend({
             anonymousUserId: z.string().optional().nullable().isDBIndexed()
@@ -2044,7 +2371,7 @@ export function createResourceConfiguration_Initialization(params) {
                     resolveImpersonalizeResetValue(fieldSchema, fieldName);
                 }
                 catch (error) {
-                    throw createConfigurationError(`[${resourceIdentifier}] ${error instanceof Error ? error.message : String(error)}`);
+                    throw createConfigurationError(`[${resourceIdentifier}] ${describeCaughtError(error)}`);
                 }
             }
         }
@@ -2112,6 +2439,20 @@ export function createResourceConfiguration_Initialization(params) {
         // fields after the strict parse — see deriveTrustedSystemWritePreservedFields).
         effectiveMainSchema = effectiveMainSchema.extend({
             retentionStatus: RetentionStatusSchema
+                /*
+                 * A framework VOCABULARY, declared as one. `RetentionStatus` is injected onto every resource
+                 * that declares a `retentionPolicy`, so without this its members would take their words from
+                 * each field PATH in turn — the same enum described afresh per resource, by an LLM that
+                 * reaches a different phrasing each time. `.systemEnum()` routes them to
+                 * `system_enums.RetentionStatus.*`, authored once and read everywhere.
+                 *
+                 * It changes nothing visible today, deliberately: the field is `.isHidden()` in both modes,
+                 * so the planner now asks for no words for it at all (#1298). The declaration is here so
+                 * that the day a surface shows a retention state — a retained-row badge, an erasure report —
+                 * it inherits ONE vocabulary rather than starting the per-path drift that #1298 measured on
+                 * its sibling `impersonalizedAt`, which had collected eleven English labels unseen.
+                 */
+                .systemEnum('RetentionStatus')
                 .default(RetentionStatus.ACTIVE)
                 .isDBIndexed()
                 .excludeFromCreate()
@@ -2270,6 +2611,123 @@ export function createResourceConfiguration_Initialization(params) {
     // consumes. Unlike a nested `.impersonalizeWith()` — which is a boot error because the row would
     // flip to RETAINED with the field intact — a nested category breaks nothing at runtime; it simply
     // never reaches a notice.
+    /*
+     * ENGINE-INJECTED ANCHORS on a read-through resource (#1058 R7).
+     *
+     * ## What is being injected, and why an author cannot declare it
+     *
+     * A VIRTUAL resource's schema describes the REMOTE entity. Every field in it comes from the
+     * target, and there is no local row — which is exactly why such a resource may carry no field of
+     * ours, no file and no retrieval corpus. So the two anchors the engine needs have nowhere to be
+     * authored:
+     *
+     *  - `organizationId` — the application's OWNER organization, stamped onto every projected row
+     *    (#1055 §6). The engine's per-row tenant gate reads it; without it, every read answered
+     *    `row_carries_no_tenant_anchor`;
+     *  - `organizationUnitId` — the ORGANIZATION UNIT owning the row's remote PARTITION (#1058 §3),
+     *    and the field `READ_THROUGH_ORGANIZATION_UNIT_FIELD_NAME` names as this resource's derived
+     *    `unitFieldName`.
+     *
+     * Both were already WRITTEN by the projector before this. What they lacked was a declared place:
+     * the resource's own contract, its specification and its OpenAPI knew nothing of two fields every
+     * served row carries. `billable-services.schemas.ts` names that gap as this slice's, and this is
+     * it — the declaration, not the stamp.
+     *
+     * ## Required vs optional, which is a statement about the rows
+     *
+     * `organizationId` is REQUIRED: a row that reaches a caller always has one, because the repository
+     * refuses with `OWNER_ORGANIZATION_ABSENT` before serving anything when there is no owner.
+     *
+     * `organizationUnitId` is OPTIONAL, and that is not caution. Two kinds of row genuinely have no
+     * unit — a SHARED row whose partition field is unset (E2, an Odoo product belonging to no company)
+     * and a row of a partition no operator has assigned (E3). Declaring it required would make both
+     * states illegal in a contract that serves them.
+     *
+     * ## Both are excluded from CREATE and UPDATE
+     *
+     * For the reason the pipeline lane states about its own tenant stamp: a caller who could send this
+     * field could hand rows to another organization, and one who could update it could move them.
+     * Writes are refused on an HTTP_API resource anyway, so this is the second lock rather than the
+     * first — and it is the one that keeps the fields out of the request DTOs, where they would read
+     * as something a client is invited to supply.
+     */
+    if (persistenceAdapter === PersistenceAdapter.HTTP_API) {
+        // EXPLICIT object check, for the reason the retention injection above records: `getZodObjectShape`
+        // returns `{}` for a union, so a try/catch around it is dead code and the real failure surfaces
+        // later as an undiagnosable `extend is not a function`.
+        if (!isZodObject(effectiveMainSchema)) {
+            throw createConfigurationError(`[${resourceIdentifier}] persistenceAdapter 'http-api' injects the '${HTTP_API_ENGINE_INJECTED_FIELDS.join("' and '")}' `
+                + 'anchors, which requires a ZodObject mainSchema — polymorphic/union mainSchemas are not supported on a '
+                + 'read-through resource.');
+        }
+        const httpApiShape = getZodObjectShape(effectiveMainSchema);
+        for (const injectedField of HTTP_API_ENGINE_INJECTED_FIELDS) {
+            /*
+             * Zod-4 `.extend()` SILENTLY OVERWRITES a duplicate key, so an author's own field would be
+             * clobbered rather than reported. Refused for a second reason too: the engine stamps this field
+             * on every projected row regardless, so an authored one could never be the value served — it
+             * would be a declaration the author can read in their own schema and never observe taking
+             * effect.
+             */
+            if (httpApiShape[injectedField]) {
+                throw createConfigurationError(`[${resourceIdentifier}] declares '${injectedField}', which the engine INJECTS on every http-api resource and `
+                    + 'STAMPS on every projected row. An authored field of that name is never the value served — remove it.');
+            }
+            /*
+             * And nothing in the BINDING may target them either.
+             *
+             * The projector applies both stamps LAST, so a mapping onto one is inert rather than dangerous
+             * — which is precisely why it must be refused here. An authoring mistake that silently does
+             * nothing is worse than one that fails: the author reads a declaration that looks like it
+             * decides the tenant, and no run ever disagrees with them.
+             *
+             * This refusal is what the projector's own comment has claimed since #1055. It did not exist —
+             * measured 2026-09-18 across `saas-models`, `saas-backend-lib` and `saas-specifications`, where
+             * the only mapping-target refusals were the external-data PIPELINE's. It matters more now than
+             * it did then: before this block the fields were undeclared, so an author had no reason to
+             * think of them; declaring them is what makes mapping onto one a thing somebody would try.
+             */
+            if (resolvedHttpApiBinding?.fieldMappings.some((mapping) => mapping.localField === injectedField)) {
+                throw createConfigurationError(`[${resourceIdentifier}] httpApiBinding maps a remote field onto '${injectedField}', which the engine stamps `
+                    + 'after every mapping. The mapping can never take effect — remove it.');
+            }
+            if (resolvedHttpApiBinding?.keyFields.some((keyField) => keyField.localField === injectedField)) {
+                throw createConfigurationError(`[${resourceIdentifier}] httpApiBinding declares a key component landing on '${injectedField}', which the engine `
+                    + 'stamps after every key component. Name a different localField.');
+            }
+        }
+        effectiveMainSchema = effectiveMainSchema.extend({
+            /*
+             * `.isDBIndexed().isForeignKey()` on the tenant anchor, and the reason is a MEASUREMENT rather
+             * than a convention.
+             *
+             * The SQL planner plans a table for an http-api resource today, and before this injection it
+             * derived the tenant column — WITH its index — from the primary-scope relationship. A bare
+             * `z.string()` here takes precedence over that derivation, so the first `wildo db diff` after
+             * the injection reported `DROP_INDEX organizationId` on Wonder Todos: a declared field
+             * silently replacing a derived one, and dropping its index on the way past.
+             *
+             * These decorators restore the plan the relationship produced. They are also what
+             * `resource-schema-awareness.md` requires of every `organizationId` in an application's own
+             * schema, so the injected field now matches what an author would have had to write.
+             */
+            [HTTP_API_TENANT_ANCHOR_FIELD]: z.string()
+                .isDBIndexed()
+                .isForeignKey()
+                .excludeFromCreate()
+                .excludeFromUpdate(),
+            /*
+             * NOT indexed, deliberately. A read-through resource has no local row, so nothing ever queries
+             * this table by unit — the confinement is a predicate pushed to the REMOTE, in the remote's own
+             * partition key. An index here would cost a migration on every PostgreSQL-backed surface to
+             * serve a query that cannot be issued.
+             */
+            [READ_THROUGH_ORGANIZATION_UNIT_FIELD_NAME]: z.string()
+                .optional()
+                .excludeFromCreate()
+                .excludeFromUpdate(),
+        });
+    }
     if (isZodObject(effectiveMainSchema)) {
         for (const [fieldName, fieldSchema] of Object.entries(getZodObjectShape(effectiveMainSchema))) {
             const declared = getDataCategories(fieldSchema);
@@ -2415,6 +2873,8 @@ export function createResourceConfiguration_Initialization(params) {
         const userNotifications = processUserNotifications(config.userNotifications || [], resourceIdentifier, operation, resourcePrimaryScope);
         // Process m2mNotifications using helper function
         const m2mNotifications = processM2MNotifications(config.m2mNotifications || [], resourceIdentifier, operation);
+        // Parse once so partial authored policies keep defaults and every variant shares the same policy.
+        const queueConfig = ResourceConfiguration_QueueConfigSchema.parse(config.queueConfig);
         // Process each variant to create flattened operations
         config.variants.forEach((variantParams, variantIndex) => {
             // Note: Cascading delete is now handled via childOperations.lifecycle.onParentDelete on relationships
@@ -2498,6 +2958,7 @@ export function createResourceConfiguration_Initialization(params) {
                 operationIdentifier: operation,
                 isOperationDefault,
                 serviceRuntimeMode: config.serviceRuntimeMode || ResourceOperation_ServiceRuntimeMode.INLINE,
+                queueConfig,
                 requestDto: derivedRequestDto, // Temporary - will be replaced by buildAllOperationDtos
                 responseDto: operationResponseDto, // Temporary - will be replaced by buildAllOperationDtos
                 // When the variant supplied an explicit `requestDto`, it is an author-owned
@@ -2514,6 +2975,10 @@ export function createResourceConfiguration_Initialization(params) {
                 // parts, unlike the notification families above, which the factory stamps with scope and
                 // identifier. `undefined` means the operation consumes no metered product.
                 recordsUsage: config.recordsUsage,
+                // Same reasoning: one authored object, carried as-is. `undefined` means this operation
+                // declares no purpose of its own beyond whatever `serviceConsentRequirement` already
+                // requires application-wide (#1258 Step 3).
+                consentGate: config.consentGate,
                 // Fields from ResourceConfiguration_OperationVariant_Base
                 variantType: variantParams.variantType,
                 resourceOperationLike: variantParams.resourceOperationLike,
@@ -2525,6 +2990,10 @@ export function createResourceConfiguration_Initialization(params) {
                 collectionExport: variantParams.collectionExport,
                 requiredFeatures: normalizeRequiredFeatures(variantParams.requiredFeatures),
                 riskLevel: variantParams.riskLevel || ResourceOperationRiskLevel.LOW,
+                // Undeclared stays undefined on purpose: `resolveOperationReversibility` derives the
+                // answer from `resourceOperationLike` when the field is absent, so defaulting it here
+                // would freeze the derivation at config time and make a DELETE added later look reversible.
+                reversibility: variantParams.reversibility,
                 // Forwarded for the same reason as the flags below: the frontend resources client reads it
                 // off the RUNTIME operation, so dropping it here would leave a declared long-run timeout
                 // silently unapplied and the 30s default cutting the request (issue #237).
@@ -2539,10 +3008,17 @@ export function createResourceConfiguration_Initialization(params) {
                 // an unforwarded flag would leave the authored requirement silently unenforced — the exact
                 // failure mode the flag exists to prevent.
                 requiresStepUpAuthentication: variantParams.requiresStepUpAuthentication,
+                // Forwarded for the same reason: the controller, the service tier and the frontend client all read it off the
+                // RUNTIME operation, so an unforwarded declaration would refuse every keyed request as undeclared.
+                idempotencyKey: variantParams.idempotencyKey,
                 admitsCrossTenantPlatformAdministration: variantParams.admitsCrossTenantPlatformAdministration,
                 // Same forwarding obligation as its cross-tenant sibling: the authorizer reads this off the
                 // RUNTIME operation, so dropping it here would silently re-close the admin surface.
                 admitsCrossSubjectUserAdministration: variantParams.admitsCrossSubjectUserAdministration,
+                // Third sibling, same forwarding obligation: the scope-root directory classification reads
+                // this off the RUNTIME operation, so dropping it here would re-close a door whose declared
+                // collection shape is the only thing that makes it safe (#1267).
+                admitsSelfConfinedScopeRootWrite: variantParams.admitsSelfConfinedScopeRootWrite,
                 // Forwarded for the same reason again: the post-commit audit emission reads it off the
                 // RUNTIME operation. Dropping it would either lose an authored below-floor opt-in (a silent
                 // audit gap) or lose an authored suppression (a duplicate row next to a purpose-built event).
@@ -2574,6 +3050,20 @@ export function createResourceConfiguration_Initialization(params) {
                 if (haveBulkOperation && (operationToCheck === CoreResourceOperation.READ || operationToCheck === CoreResourceOperation.LIST)) {
                     throw createConfigurationError(`Operation '${operation}' cannot have bulk operations (read and list are not bulkable)`);
                 }
+                /*
+                 * A bulk twin of CREATE has no coherent meaning, so it is refused rather than half-built (#1551).
+                 *
+                 * The twin keeps `operationIdentifier: 'create'`, so the controller, the service dispatcher and both
+                 * repositories route it to the SINGLE-row create; only the request DTO pretended otherwise, and this
+                 * factory and the DTO builder even disagreed on which pretence. Batch creation is CREATE_MANY, whose
+                 * request is the `{ data: row[] }` envelope its service reads. No authored resource declared a bulk
+                 * twin of CREATE when this refusal was added (22 `haveBulkOperation` declarations, all on DELETE or
+                 * UPDATE-like operations).
+                 */
+                if (haveBulkOperation && operationToCheck === CoreResourceOperation.CREATE) {
+                    throw createConfigurationError(`Operation '${operation}' cannot have a bulk twin: every tier would run it as a single-row create. `
+                        + `Declare ${CoreResourceOperation.CREATE_MANY} for batch creation — its request is { data: row[] }.`);
+                }
                 const tokenStateSideEffects = [
                     ...(apiCallParams.tokenGeneration ? ['tokenGeneration'] : []),
                     ...(apiCallParams.tokenRevocation ? ['tokenRevocation'] : []),
@@ -2610,6 +3100,9 @@ export function createResourceConfiguration_Initialization(params) {
                 if (apiCallParams.tokenRevocation) {
                     validateTokenRevocationConfig(apiCallParams.tokenRevocation, resourceIdentifier, operation);
                 }
+                if (apiCallParams.tokenAuthentication) {
+                    validateTokenAuthenticationConfig(apiCallParams.tokenAuthentication, resourceIdentifier, operation);
+                }
                 const apiCallOperationFields = {
                     ...baseOperationFields,
                     httpVerb,
@@ -2647,7 +3140,7 @@ export function createResourceConfiguration_Initialization(params) {
                     const searchableOptions = variantParams.searchableOptions || { caseSensitive: false, fullMatchOnly: false };
                     const rawFilterFields = variantParams.filterFields || {};
                     const sortFields = variantParams.sortFields || [];
-                    const maxPaginatedResultPerPageLimit = variantParams.maxPaginatedResultPerPageLimit || 50;
+                    const maxPaginatedResultPerPageLimit = variantParams.maxPaginatedResultPerPageLimit || DEFAULT_SEARCH_PAGE_CEILING;
                     const filterFields = {};
                     Object.entries(rawFilterFields).forEach(([key, value]) => {
                         if (typeof value !== 'function') {
@@ -2688,7 +3181,7 @@ export function createResourceConfiguration_Initialization(params) {
                         // LIST has one pagination authority. Keep the effective ceiling on the resolved
                         // operation so request/response DTO construction, repositories, auto-generated
                         // SUMMARY/CONTEXT variants and API-reference projection all observe the same value.
-                        maxPaginatedResultPerPageLimit: variantParams.maxPaginatedResultPerPageLimit ?? 100,
+                        maxPaginatedResultPerPageLimit: variantParams.maxPaginatedResultPerPageLimit ?? DEFAULT_LIST_PAGE_CEILING,
                     };
                     if (variantParams.filterFields !== undefined) {
                         listEnrichment.filterFields = variantParams.filterFields;
@@ -2703,28 +3196,27 @@ export function createResourceConfiguration_Initialization(params) {
                 operations.push(apiCallOperationFields);
                 // Add bulk operation if enabled
                 if (haveBulkOperation) {
-                    const bulkDto = (() => {
-                        if (operationToCheck === CoreResourceOperation.CREATE) {
-                            return apiCallOperationFields.requestDto && apiCallOperationFields.requestDto !== z.object({})
-                                ? z.object({
-                                    data: z.array(apiCallOperationFields.requestDto)
-                                })
-                                : z.object({
-                                    data: z.array(z.object({}))
-                                });
-                        }
-                        if (apiCallOperationFields.requestDto instanceof z.ZodObject) {
-                            return Resources_BulkOperationBaseSchema.extend(getZodObjectShape(apiCallOperationFields.requestDto));
-                        }
-                        return apiCallOperationFields.requestDto && apiCallOperationFields.requestDto !== z.object({})
-                            ? Resources_BulkOperationBaseSchema.and(apiCallOperationFields.requestDto)
-                            : Resources_BulkOperationBaseSchema;
-                    })();
+                    // The documented, enforced batch limit (`BULK_OPERATION_DEFAULT_MAX_SELECTION` unless the
+                    // variant declares `bulkOperationMaxSelection`). A bulk CREATE is bounded on its `data` rows
+                    // for the same reason a bulk UPDATE/DELETE is bounded on its `_ids`.
+                    const bulkMaxSelection = resolveBulkOperationMaxSelection(apiCallParams);
+                    const rowRequestDto = apiCallOperationFields.requestDto;
+                    // The DTO builder rebuilds this later from the same function; both must agree.
+                    const bulkDto = wrapRequestDtoAsBulk({
+                        rowRequestDto: rowRequestDto && !(rowRequestDto instanceof z.ZodObject && Object.keys(rowRequestDto.shape).length === 0)
+                            ? rowRequestDto
+                            : undefined,
+                        maxSelection: bulkMaxSelection,
+                        // The DTO builder's predicate, verbatim, so the two constructions cannot disagree: a bulk twin
+                        // of CREATE is refused above, and only CREATE_MANY takes `{ data: [] }`.
+                        isCreate: operationToCheck === CoreResourceOperation.CREATE_MANY,
+                    });
                     const bulkOperationFields = {
                         ...apiCallOperationFields,
                         isBulkOperation: true,
                         isOperationDefault: false, // Bulk operations are never default
-                        requestDto: bulkDto
+                        requestDto: bulkDto,
+                        bulkOperationMaxSelection: bulkMaxSelection,
                     };
                     operations.push(bulkOperationFields);
                 }
@@ -2734,7 +3226,10 @@ export function createResourceConfiguration_Initialization(params) {
                 const { variantType, ...specificFields } = variantParams; // Extract variantType and get rest
                 const nonApiCallOperation = {
                     ...baseOperationFields,
-                    ...specificFields
+                    ...specificFields,
+                    ...((variantParams.variantType === ResourceOperationVariantType.CRON_JOB || variantParams.variantType === ResourceOperationVariantType.BATCH_JOB)
+                        ? { scheduledRecovery: normalizeScheduledRecoveryPolicy(variantParams.scheduledRecovery) }
+                        : {}),
                 };
                 operations.push(nonApiCallOperation);
             }
@@ -2776,6 +3271,7 @@ export function createResourceConfiguration_Initialization(params) {
                     operationIdentifier: operation,
                     isOperationDefault: false, // Auto-variants are never operation default
                     serviceRuntimeMode: config.serviceRuntimeMode || ResourceOperation_ServiceRuntimeMode.INLINE,
+                    queueConfig,
                     requestDto: defaultApiCallVariant.requestDto || deriveRequestDto(operation, effectiveMainSchema, undefined), // Temporary - will be replaced by buildAllOperationDtos
                     // Forwarded for the same reason as `unimplementedAcknowledgement` below: an auto-variant
                     // is a projection of the default variant, so it inherits that variant's request contract
@@ -2783,6 +3279,15 @@ export function createResourceConfiguration_Initialization(params) {
                     // AUTHORED contract look auto-derived to the request-contract-breadth guard.
                     hasCustomRequestDto: defaultApiCallVariant.hasCustomRequestDto ?? !!defaultApiCallVariant.requestDto,
                     responseDto, // Temporary - will be replaced by buildAllOperationDtos
+                    // Stamped like every other factory-built operation, and it is what makes "temporary" true. An
+                    // auto-variant's `responseDto` is framework-derived, but without the flag the DTO rebuild
+                    // fell back to its structural heuristic, found the temporary schema "significantly
+                    // different" from the rebuilt one and PRESERVED it as custom. For a CONTEXT variant that
+                    // temporary schema is the context DTO of the empty-registry factory pass, so the full-
+                    // registry rebuild added the runtime relationship field BESIDE the fallback one:
+                    // `users/self/context` declared both `userSelfPreference` and `userSelfPreferences`, at
+                    // runtime and in the published API reference (#582).
+                    hasCustomResponseDto: false,
                     notificationBadgeOperations: config.notificationBadgeOperations || [],
                     userNotifications,
                     m2mNotifications,
@@ -2790,6 +3295,9 @@ export function createResourceConfiguration_Initialization(params) {
                     resourceOperationLike: defaultApiCallVariant.resourceOperationLike,
                     requiredFeatures: normalizeRequiredFeatures(defaultApiCallVariant.requiredFeatures),
                     riskLevel: defaultApiCallVariant.riskLevel || ResourceOperationRiskLevel.LOW,
+                    // Inherited like riskLevel: an auto-variant is a projection of the default variant, so a
+                    // SUMMARY or CONTEXT derivative of an irreversible operation is equally irreversible.
+                    reversibility: defaultApiCallVariant.reversibility,
                     // Inherited like riskLevel: an auto-variant is a projection of the default variant. The
                     // read-shaped projections are unlikely to need it, but inheriting keeps "projection of
                     // the default" a single consistent rule rather than a per-field accident.
@@ -2805,11 +3313,17 @@ export function createResourceConfiguration_Initialization(params) {
                     // anyway — inheriting keeps that a property of the exemption list rather than an accident
                     // of this projection.)
                     requiresStepUpAuthentication: defaultApiCallVariant.requiresStepUpAuthentication,
+                    // Inherited like step-up: an auto-variant projects the default variant's contract, header included.
+                    idempotencyKey: defaultApiCallVariant.idempotencyKey,
                     admitsCrossTenantPlatformAdministration: defaultApiCallVariant.admitsCrossTenantPlatformAdministration,
                     // Inherited for the same reason as the cross-tenant flag: an auto-variant is a PROJECTION of
                     // the default operation and must make the same addressing claim, or it would refuse the very
                     // subjects the operation it projects is admitted to administer.
                     admitsCrossSubjectUserAdministration: defaultApiCallVariant.admitsCrossSubjectUserAdministration,
+                    // Inherited for the same reason as both siblings: an auto-variant projects the default
+                    // variant's contract, and a projection that dropped this claim would be classified as an
+                    // unconfined directory write while the operation it projects is not.
+                    admitsSelfConfinedScopeRootWrite: defaultApiCallVariant.admitsSelfConfinedScopeRootWrite,
                     // Inherited for the same reason: an auto-variant is a projection of the default variant,
                     // so it must make the same audit claim. Inheriting a `suppressGenericEvent` matters most —
                     // the purpose-built event that supersedes the default covers its projections too, and a
@@ -2866,6 +3380,17 @@ export function createResourceConfiguration_Initialization(params) {
                 if (defaultApiCallVariant.tokenRevocation) {
                     validateTokenRevocationConfig(defaultApiCallVariant.tokenRevocation, resourceIdentifier, `${operation}.${variantKey}`);
                 }
+                // `tokenAuthentication` is deliberately NOT re-validated here, and the absence is a decision
+                // rather than an omission (issue #313). `defaultApiCallVariant` is SELECTED from `operations`
+                // — variants that were built, and validated, by the authored path above — so its
+                // `tokenAuthentication` cannot be a value that block has not already refused. A guard here
+                // would be unreachable, and an unreachable guard is not defence in depth: it is an untested
+                // claim that reads like coverage (`.claude/rules/invariant-call-site-enumeration.md` #25,
+                // #19). Measured: neutering it left every pin in
+                // `token-authentication-type-list.guard.test.ts` green.
+                //
+                // The same is true of the two blocks immediately above — they predate this note and are kept
+                // as found, but do not add a fourth on their model.
                 return baseOperationFields;
             };
             // Generate READ.summary variant
@@ -3035,6 +3560,41 @@ export function createResourceConfiguration_Initialization(params) {
                 `its transport group — a lone variant marked \`isDefault: false\` leaves the group with NO default.`);
         }
     }
+    // ── RESOLVABILITY half of the ANONYMIZABLE operation contract ───────────
+    //
+    // Same two-halves shape as retention above, for the other dynamic-loop capability. The presence
+    // half proved that each requirement group has an alternative DECLARED; this proves one of them
+    // is REACHABLE by `AnonymousSessionBackendService`, whose three primitives
+    // (`listAnonymousRecords` / `updateManyAsSystem` / `deleteOwnedRecords`) all resolve through
+    // `getServiceOperationPathDefault`.
+    //
+    // Runs HERE rather than with the presence half for the same reason retention's does:
+    // `isOperationDefault` is computed by the operations loop above, and it is variant-type-LOCAL —
+    // a lone variant marked `isDefault: false` leaves its transport group with NO default.
+    //
+    // Reads the SAME predicate the resolver applies (`isServiceResolvableDefaultOperation`), and the
+    // same predicate `deleteOwnedRecords` probes with when it chooses between DELETE_MANY and
+    // per-row DELETE — so the guard, the runtime chooser and the resolver cannot disagree.
+    if (isAnonymizable) {
+        for (const { operations: alternatives, primitive, why } of ANONYMIZABLE_REQUIRED_SERVICE_RESOLVABLE_OPERATIONS) {
+            if (alternatives.some((alternative) => operations.some((candidate) => isServiceResolvableDefaultOperation(candidate, alternative)))) {
+                continue;
+            }
+            const declaredVariants = operations
+                .filter((candidate) => alternatives.includes(candidate.operationIdentifier))
+                .map((candidate) => `${String(candidate.operationIdentifier)}/${candidate.variantType}` +
+                `${candidate.variantKey ? `:${candidate.variantKey}` : ''}${candidate.isOperationDefault ? ' (default)' : ''}`);
+            throw createConfigurationError(`[${resourceIdentifier}] isAnonymizable: true requires ${describeOperationAlternatives(alternatives)} ` +
+                `to be SERVICE-RESOLVABLE, but no accepted DEFAULT variant is declared. Declared variants: ` +
+                `[${declaredVariants.length > 0 ? declaredVariants.join(', ') : 'none'}]. The anonymous-session ` +
+                `primitive ${primitive} (${why}) resolves through getServiceOperationPathDefault, which accepts ` +
+                `only [${SERVICE_RESOLVABLE_OPERATION_VARIANT_TYPES.join(', ')}] and only the operation default. ` +
+                `REPOSITORY_ONLY is route-less but is served by the SEPARATE getRepositoryOperationPathDefault ` +
+                `transport, so it passes the "operation exists" check and then FAILS TO RESOLVE the moment an ` +
+                `anonymous session converts or expires. Use ${ResourceOperationVariantType.INTERNAL_CALL} for a ` +
+                `capability that must stay route-less, and make sure it is the default for its transport group.`);
+        }
+    }
     const resourceConfig = {
         isDisabled: params.isDisabled ?? false,
         resourcePrimaryScope,
@@ -3053,6 +3613,7 @@ export function createResourceConfiguration_Initialization(params) {
         isSystemResource,
         primaryKeyIdentifiesInitiator,
         systemAccessPolicy: effectiveSystemAccessPolicy,
+        subjectErasureLane,
         isAnonymizable,
         transpositionPolicy: isAnonymizable
             ? (transpositionPolicy ?? ResourceTranspositionPolicy.ADD)
@@ -3094,6 +3655,7 @@ export function createResourceConfiguration_Initialization(params) {
         isSystemResource,
         primaryKeyIdentifiesInitiator,
         systemAccessPolicy: effectiveSystemAccessPolicy,
+        subjectErasureLane,
         isAnonymizable,
         transpositionPolicy: isAnonymizable
             ? (transpositionPolicy ?? ResourceTranspositionPolicy.ADD)