docs: 13 factual corrections across content/docs/** where the page contradicts the enforced platform (#10616 sweep)

content/docs/concepts/architecture.mdx

@@ -95,6 +95,7 @@ import { ObjectSchema, Field } from '@objectstack/spec/data';
 
 export const Customer = ObjectSchema.create({
  name: 'customer',
+ sharingModel: 'private',
  label: 'Customer',
  icon: 'building',
 
@@ -401,6 +402,7 @@ import { ObjectSchema, Field } from '@objectstack/spec/data';
 
 export const Opportunity = ObjectSchema.create({
  name: 'opportunity',
+ sharingModel: 'private',
  label: 'Opportunity',
  icon: 'target',
 

content/docs/concepts/metadata-driven.mdx

@@ -79,6 +79,7 @@ import { ObjectSchema, Field } from '@objectstack/spec/data';
 
 export const User = ObjectSchema.create({
  name: 'user',
+ sharingModel: 'private',
  label: 'User',
  icon: 'user',
 
@@ -243,6 +244,7 @@ import { ObjectSchema, Field } from '@objectstack/spec/data';
 
 export const Task = ObjectSchema.create({
  name: 'task',
+ sharingModel: 'private',
  label: 'Task',
  icon: 'check-square',
 
@@ -341,6 +343,7 @@ import { ObjectSchema, Field } from '@objectstack/spec/data';
 
 export const Account = ObjectSchema.create({
  name: 'account',
+ sharingModel: 'private',
  label: 'Account',
  fields: {
  name: Field.text({ required: true }),
@@ -387,6 +390,7 @@ Follow these strict naming conventions for consistency:
 // ✅ Correct naming
 export const TodoTask = ObjectSchema.create({
  name: 'todo_task', // snake_case machine name
+ sharingModel: 'private', // OWD — required on custom objects
  label: 'Todo Task',
 
  fields: {
@@ -463,14 +467,15 @@ annual_revenue: Field.currency({
 ```typescript
 export const Account = ObjectSchema.create({
  name: 'account',
+ sharingModel: 'private',
  label: 'Account',
 
  fields: { /* ... */ },
 
  enable: {
  trackHistory: true, // Enable field history tracking
  searchable: true, // Include in global search
- apiEnabled: true, // Expose via REST/GraphQL
+ apiEnabled: true, // Expose object via automatic APIs (REST)
  files: true, // Enable file attachments
  feeds: true, // Enable activity feed
  activities: true, // Enable tasks and events
@@ -486,6 +491,7 @@ import { ObjectSchema, Field } from '@objectstack/spec/data';
 
 export const ExampleObject = ObjectSchema.create({
  name: 'example_object', // Required: snake_case
+ sharingModel: 'private', // Required on custom objects: the OWD baseline
  label: 'Example Object', // Required: Human-readable
  pluralLabel: 'Example Objects', // Optional
  icon: 'box', // Optional: Lucide icon name

content/docs/data-modeling/drivers.mdx

@@ -905,6 +905,7 @@ Then in your object definition:
 ```typescript
 export const AuditLog = ObjectSchema.create({
  name: 'audit_log',
+ sharingModel: 'private',
  datasource: 'analytics', // Routes to the analytics database
  fields: { /* ... */ },
 });

content/docs/data-modeling/external-datasources.mdx

@@ -72,6 +72,7 @@ and `external.columnMap`.
 ```typescript
 export const Customer = ObjectSchema.create({
  name: 'ext_customer',
+ sharingModel: 'private',
  datasource: 'warehouse',
  external: {
  remoteName: 'customers', // remote TABLE name (object name may differ)
@@ -255,6 +256,10 @@ ObjectSchema.create({ /* ... */ external: { remoteName: 'orders', writable: true
 
 With either gate off, insert/update/delete on the federated object is rejected.
 
+The `/* ... */` above still has to carry a `sharingModel` — a custom (non-`sys_`) object
+that declares no OWD is an **`os validate` error** (`security-owd-unset`), federated or
+not. See the full object above.
+
 <Callout type="warn">
 **This gate is federation-only — it does nothing on a managed datasource.**
 `allowWrites` answers *who owns this external database*, not *is this connection

content/docs/data-modeling/field-types.mdx

@@ -314,7 +314,7 @@ Reference to a record in another object (foreign key).
 | Property | Type | Default | Description |
 |:---|:---|:---|:---|
 | `reference` | `string` | **required** | Target object name (snake_case) |
-| `referenceFilters` | `string[]` | — | **Removed** (#2377, ADR-0049) — no longer a recognized field property (unknown keys are stripped by the schema). Use structured `lookupFilters` + `dependsOn` instead; see [Relationships](/docs/data-modeling/relationships) |
+| `referenceFilters` | `string[]` | — | **Removed** (#2377, ADR-0049) — no longer a recognized field property. `FieldSchema` is a strict object, so an unknown key is **rejected with guidance**, not silently stripped (ADR-0078): the error echoes the offending key and prescribes the replacement. Use structured `lookupFilters` + `dependsOn` instead; see [Relationships](/docs/data-modeling/relationships) |
 | `deleteBehavior` | `'restrict' \| 'cascade' \| 'set_null'` | `'set_null'` | Behavior when referenced record is deleted. On a *required* lookup `set_null` is escalated to `restrict`, since a NOT NULL foreign key cannot be cleared — **whether the `set_null` was defaulted or written out explicitly**. On a `multiple: true` required lookup the escalation is judged per referencing row: only a row the member removal would leave EMPTY is refused. `cascade` and `restrict` are the values honored as written. Where `set_null` does run, a `multiple: true` lookup loses only the deleted **member** — the other members are kept, and a set emptied that way is stored as `[]`, never `null` |
 
 ```typescript
@@ -336,7 +336,7 @@ Parent-child relationship (cascading delete by default).
 | Property | Type | Default | Description |
 |:---|:---|:---|:---|
 | `reference` | `string` | **required** | Target (master) object name |
-| `referenceFilters` | `string[]` | — | **Removed** (#2377, ADR-0049) — no longer a recognized field property (unknown keys are stripped by the schema). Use structured `lookupFilters` + `dependsOn` instead; see [Relationships](/docs/data-modeling/relationships) |
+| `referenceFilters` | `string[]` | — | **Removed** (#2377, ADR-0049) — no longer a recognized field property. `FieldSchema` is a strict object, so an unknown key is **rejected with guidance**, not silently stripped (ADR-0078): the error echoes the offending key and prescribes the replacement. Use structured `lookupFilters` + `dependsOn` instead; see [Relationships](/docs/data-modeling/relationships) |
 | `deleteBehavior` | `'restrict' \| 'cascade' \| 'set_null'` | `'cascade'` | Behavior when parent is deleted. `restrict` is the only value that deviates: master-detail cascades on everything else, so an explicit `set_null` here is **not** honored — the child is deleted with the parent |
 | `inlineEdit` | `boolean \| 'grid' \| 'form'` | — | Edit child records inline on the parent create/edit form (`true` = auto-pick, `'grid'`, or `'form'`) |
 | `inlineColumns` | `array` | — | Optional explicit inline grid columns |
@@ -530,7 +530,7 @@ Name-keyed map of embedded sub-objects (`Record<string, SubObject>`). Insertion
 ## Enhanced Types
 
 ### `location`
-Geographic coordinates. Stored as `{ latitude, longitude, altitude?, accuracy? }` (latitude −90..90, longitude −180..180). No per-type config properties.
+Geographic coordinates. Stored as `{ lat, lng, altitude?, accuracy? }` (`lat` −90..90, `lng` −180..180). No per-type config properties. The key names are `lat`/`lng`, not `latitude`/`longitude` — see `LocationValueSchema` in `field-value.zod.ts` (ADR-0104 D1).
 
 ```typescript
 { name: 'headquarters', label: 'Location', type: 'location' }

content/docs/data-modeling/fields.mdx

@@ -17,6 +17,7 @@ import { ObjectSchema, Field } from '@objectstack/spec/data';
 
 export const Contact = ObjectSchema.create({
  name: 'contact',
+ sharingModel: 'private',
  label: 'Contact',
  fields: {
  first_name: Field.text({ label: 'First Name', required: true }),

content/docs/data-modeling/formulas.mdx

@@ -93,6 +93,7 @@ import { ObjectSchema, Field } from '@objectstack/spec/data';
 
 export const Invoice = ObjectSchema.create({
  name: 'invoice',
+ sharingModel: 'private',
  nameField: 'display_title', // ADR-0079 — the record title is a designated field; composite titles migrate off the deprecated `titleFormat` to a text formula
  fields: {
  // Composite record title as a text formula, surfaced via `nameField` above.

content/docs/data-modeling/index.mdx

@@ -15,6 +15,7 @@ import { ObjectSchema, Field } from '@objectstack/spec/data';
 
 export const Lead = ObjectSchema.create({
  name: 'crm_lead',
+ sharingModel: 'public_read_write', // OWD — required on every custom object
  label: 'Lead',
  pluralLabel: 'Leads',
  icon: 'funnel',
@@ -35,8 +36,8 @@ That one definition is enough to get a persisted table, CRUD + query endpoints,
 - **A full spectrum of field types** — from `text`, `currency`, and `lookup`/`master_detail` relationships to `formula`, `summary`, `signature`, and `vector` (with `dimensions` config for AI embeddings). See the [Field Types gallery](/docs/data-modeling/field-types).
 - **Validation as metadata** — required/format rules, CEL script validation with access to `previous.<field>`, uniqueness via indexes, and severity levels — enforced identically in API, UI, and automation.
 - **CEL expressions** — formula fields and computed defaults share one expression language ([Expressions](/docs/data-modeling/formulas)).
-- **A compiled query AST** — queries are JSON documents validated against the protocol, then compiled by a driver into native queries with joins, aggregations, window functions, HAVING, and subqueries. The [query cheat sheet](/docs/data-modeling/queries) covers the syntax; the [spec](/docs/protocol/objectql/query-syntax) is normative.
-- **Four database drivers in this repo** — `driver-sql` (PostgreSQL / MySQL / SQLite via Knex), `driver-mongodb`, `driver-memory` (in-memory, for tests and demos), and `driver-sqlite-wasm` (SQLite in the browser / WebContainers). The same model runs unchanged on any of them.
+- **A compiled query AST** — queries are JSON documents validated against the protocol, then compiled by a driver into native queries with aggregations, `groupBy`, `HAVING`, and subqueries. `joins` and request-surface `windowFunctions` were **retired in protocol 17** (#4286, ADR-0049) and are now rejected at parse; window functions survive only as a SQL-driver door (`SqlDriver.findWithWindowFunctions()`), not on the `IDataDriver` contract. The [query cheat sheet](/docs/data-modeling/queries) covers the syntax; the [spec](/docs/protocol/objectql/query-syntax) is normative.
+- **Five database drivers in this repo** — `driver-sql` (PostgreSQL / MySQL / SQLite via Knex), `driver-mongodb`, `driver-memory` (in-memory, for tests and demos), `driver-sqlite-wasm` (SQLite in the browser / WebContainers), and `driver-turso` (Turso / libSQL — an **optional** install, because it pulls `@libsql/client` plus native bindings; see [Database Drivers](/docs/data-modeling/drivers)). The same model runs unchanged on any of them.
 - **External datasource federation** — introspect an existing external database, import selected tables into the catalog, and query them alongside native objects ([External Datasources](/docs/data-modeling/external-datasources)).
 - **Composable ownership** — one package owns an object, and any other package can merge fields, validation rules, and indexes into it without forking the definition ([Object Extensions](/docs/data-modeling/object-extensions)).
 - **Repeatable bulk import** — a named mapping projects someone else's column headers and codes onto your fields, and the import endpoint applies it by name ([Import Mappings](/docs/data-modeling/import-mappings)).

content/docs/data-modeling/objects.mdx

@@ -15,6 +15,7 @@ import { ObjectSchema, Field } from '@objectstack/spec/data';
 
 export const Account = ObjectSchema.create({
  name: 'account',
+ sharingModel: 'private',
  label: 'Account',
  pluralLabel: 'Accounts',
  icon: 'building',
@@ -79,7 +80,7 @@ Control which platform features are active for this object:
 enable: {
  trackHistory: true, // Field history tracking for audit
  searchable: true, // Include in global search index
- apiEnabled: true, // Expose via REST/GraphQL APIs
+ apiEnabled: true, // Expose object via automatic APIs (REST)
  apiMethods: ['get', 'list', 'create', 'update', 'delete'],
  files: true, // File attachments
  feeds: true, // Activity feed and comments
@@ -373,6 +374,7 @@ import { ObjectSchema, Field } from '@objectstack/spec/data';
 
 export const ProjectTask = ObjectSchema.create({
  name: 'project_task',
+ sharingModel: 'private',
  label: 'Project Task',
  pluralLabel: 'Project Tasks',
  icon: 'check-square',

content/docs/data-modeling/schema-design.mdx

@@ -21,6 +21,7 @@ import { ObjectSchema, Field } from '@objectstack/spec/data';
 export const MyObject = ObjectSchema.create({
  // Metadata
  name: 'my_object', // Machine name (snake_case)
+ sharingModel: 'private', // OWD baseline — REQUIRED on custom objects
  label: 'My Object', // Display name
  pluralLabel: 'My Objects', // Plural form
  icon: 'briefcase', // Icon identifier
@@ -67,13 +68,14 @@ Control which features are available for an object:
 enable: {
  trackHistory: true, // Track field changes over time
  searchable: true, // Include in global search
- apiEnabled: true, // Expose via REST/GraphQL
+ apiEnabled: true, // Expose object via automatic APIs (REST)
  apiMethods: [ // Whitelist API operations — six primitives only;
  'get', // search/export/… DERIVE from them (list grants
  'list', // aggregate/search/export; create+update grants
  'create', // upsert/import). undefined = all, [] = none.
  'update',
- 'delete'
+ 'delete',
+ 'bulk' // omitting `bulk` DENIES batch operations
  ],
  files: true, // Allow file attachments
  feeds: true, // Enable activity feed (Chatter-like)
@@ -284,6 +286,7 @@ import { ObjectSchema } from '@objectstack/spec/data';
 
 export const Account = ObjectSchema.create({
  name: 'account',
+ sharingModel: 'private',
  label: 'Account',
 
  fieldGroups: [
@@ -403,6 +406,7 @@ here (ADR-0085).
 ```typescript
 export const Account = ObjectSchema.create({
  name: 'account',
+ sharingModel: 'private',
  label: 'Account',
  pluralLabel: 'Accounts',
  icon: 'building',

content/docs/data-modeling/seed-data.mdx

@@ -246,6 +246,7 @@ seed value is an **array of natural keys**. Each element resolves independently.
 ```typescript
 const Book = ObjectSchema.create({
  name: 'book',
+ sharingModel: 'private',
  fields: {
  name: Field.text({ label: 'Title', required: true }),
  authors: Field.lookup('author', { label: 'Authors', multiple: true }),