Selected-record buttons (preview; not a published release claim)

Native page composition
A core.button may opt into props.recordTarget="bound-record". Its saved actionId
and bindingKey must identify an action/binding combination registered with the
runtime broker. This does not expose arbitrary URLs or create permission.

For a workspace selection, set props.recordFrom to that workspace's unique
shared key. The editor exposes Action record source and Source workspace shared
key. The runtime matches the selected record ID against the current secured
data-grid binding. Exactly one matching row is required. Only its declared
action IDs are offered, and its exact revision is retained. A record absent
from the current binding page remains unavailable; no first row is selected.
Do not combine recordFrom with dataKey, or bound-record with saved recordId or
expectedRevision. Refresh the secured binding to recover a current target.

Without recordFrom, bound-record accepts a single object from its binding,
optionally under an explicit dotted dataKey path:
  {recordId, revision, actions:[{actionId, requiresExpectedRevision,
                              requiresConfirmation}]}
Action flags must be booleans. Arrays are not treated as selections.

Portable React composition
react/bound-grid-target.ts exports boundGridTarget(data, selectedRecordId).
Pass current secured data-grid presentation data and the user's explicit
selection. It returns the same single-record envelope, or null when the target
is missing, ambiguous, or invalid. react/bound-button-target.ts then validates
the chosen action and preserves the exact revision string.
These helpers supply no transport or authority. Use the applicable generated
public module client for external apps; do not assume the native runtime broker
is a public API. Native pages use their existing saved-page broker contract.
The platform continues to own schemas and authorization.

react/moduleParts.tsx provides the same PageRecordContextProvider,
usePublishPageSelection, usePageSelection, useInvalidatePageRecord and
usePageRecordRefresh hooks as the native composition layer. Keep each page's
provider isolated. Notify the named source only after the API acknowledges a
successful mutation. Refresh listeners must use secured reads and preserve
active drafts; notifications never authorize a write or automatically retry it.
Native Work Orders queues these reads while editing or writing and coalesces
them when editing ends. Other native publisher adapters still require review.

Interaction requirements
Disable immediately before awaiting confirmation or a request; use a synchronous
guard as well as disabled rendering. Cancel the old action if selection changes
during confirmation. Keep an uncertain mutation locked until current secured
data has been refreshed. A new React render is not a refresh. Never coerce the
revision through Date or numeric conversion. The server validates permission
and concurrency again regardless of the client state.

Limits of this checkpoint
The explicit source settings and shared target helpers are implemented. Full
visual action discovery, all-module selection coverage, and routed live tenant
acceptance are not established by this document. Current runtime activation and
public kit publication remain on hold. Forked pages retain their own saved
configuration; this feature does not mutate upstream templates or tenant schemas.
