Merge remote-tracking branch 'origin/main' into claude/sort-dot-path-fallback-fc72e9

Author: os-zhuang

.changeset/adapter-hono-auth-wildcard-yields.md

@@ -1,5 +1,5 @@
 ---
-"@objectstack/adapter-hono": patch
+"@objectstack/hono": patch
 ---
 
 fix(adapters/hono): the auth wildcard yields paths the auth service does not own (#4117)

.changeset/adr-0104-meta-advertisement-as-implemented.md

@@ -0,0 +1,4 @@
+---
+---
+
+docs(adr-0104): amend the upgrade-path advertisement clause to record how it landed (#4253/#4284) — `os migrate meta` names the migrations without gate status, because gate status is per deployment (2026-07-27 addendum) while `meta` acts on source, which deploys to zero-or-N of them; status is reported where a datastore is actually open. Releases nothing.

.changeset/ai-slot-remedy-tells-the-truth.md

@@ -0,0 +1,18 @@
+---
+'@objectstack/spec': patch
+'@objectstack/runtime': patch
+---
+
+Discovery stops telling Cloud/Enterprise deployments that nothing implements `ai` (#4093 follow-up).
+
+`CORE_SERVICE_PROVIDER` recorded `null` for `ai` because no **workspace** package provides it, and `serviceUnavailableMessage('ai')` therefore produced *"No implementation ships for the 'ai' slot"*. That is false: `@objectstack/service-ai` registers the slot in `objectstack-ai/cloud`. The table conflated "not in this repository" with "does not exist" — the same class of wrong answer the table was introduced to end, one step further out.
+
+Verified against the cloud repository rather than inferred: `packages/service-ai/src/plugin.ts` calls `ctx.registerService('ai', …)`, and the package is `private: true`, so there is genuinely nothing to install — which is why `null` stays right and an `Install X` sentence would still be wrong. `search`, `workflow` and `graphql` were checked the same way and nothing registers them in either repository, so their `null` and their "nothing ships" sentence are accurate.
+
+`ai` now carries a `REMEDY_DETAIL` sentence — *"Provided by @objectstack/service-ai in ObjectStack Cloud/Enterprise — no implementation ships in the open framework"* — the mechanism `ui` already used. Both discovery (`services.ai.message`) and the `/ai` 501 body report it.
+
+This **removes** code: `/ai`'s domain had a local message override, added because the shared sentence was wrong there. Correcting the table fixed the domain *and* discovery, which the override could never reach, so the override and `capabilityUnavailable`'s `message?` parameter are both gone. A slot whose sentence is wrong needs the table corrected, not a local exception.
+
+Also corrected: three places still describing `/ai`'s absent-service answer as a 404 (`docs/api/client-sdk.mdx`, `docs/releases/v17.mdx`, and a comment in `packages/client`'s URL-conformance test) — stale since that answer became 501.
+
+FROM → TO: `services.ai.message` and the `/ai/*` 501 body change text. Nothing branches on either — `status` and `enabled` are the contract, the message is prose for humans and agents.

.changeset/changelog-ships-in-tarball.md

@@ -0,0 +1,100 @@
+---
+"@objectstack/account": patch
+"@objectstack/cli": patch
+"@objectstack/client": patch
+"@objectstack/client-react": patch
+"@objectstack/cloud-connection": patch
+"@objectstack/connector-mcp": patch
+"@objectstack/connector-openapi": patch
+"@objectstack/connector-rest": patch
+"@objectstack/connector-slack": patch
+"@objectstack/console": patch
+"@objectstack/core": patch
+"@objectstack/driver-memory": patch
+"@objectstack/driver-mongodb": patch
+"@objectstack/driver-sql": patch
+"@objectstack/driver-sqlite-wasm": patch
+"@objectstack/embedder-openai": patch
+"@objectstack/formula": patch
+"@objectstack/hono": patch
+"@objectstack/knowledge-memory": patch
+"@objectstack/knowledge-ragflow": patch
+"@objectstack/lint": patch
+"@objectstack/mcp": patch
+"@objectstack/metadata": patch
+"@objectstack/metadata-core": patch
+"@objectstack/metadata-fs": patch
+"@objectstack/metadata-protocol": patch
+"@objectstack/objectql": patch
+"@objectstack/observability": patch
+"@objectstack/platform-objects": patch
+"@objectstack/plugin-approvals": patch
+"@objectstack/plugin-audit": patch
+"@objectstack/plugin-auth": patch
+"@objectstack/plugin-dev": patch
+"@objectstack/plugin-email": patch
+"@objectstack/plugin-hono-server": patch
+"@objectstack/plugin-pinyin-search": patch
+"@objectstack/plugin-reports": patch
+"@objectstack/plugin-security": patch
+"@objectstack/plugin-sharing": patch
+"@objectstack/plugin-webhooks": patch
+"@objectstack/rest": patch
+"@objectstack/runtime": patch
+"@objectstack/sdui-parser": patch
+"@objectstack/service-analytics": patch
+"@objectstack/service-automation": patch
+"@objectstack/service-cache": patch
+"@objectstack/service-cluster": patch
+"@objectstack/service-cluster-redis": patch
+"@objectstack/service-datasource": patch
+"@objectstack/service-i18n": patch
+"@objectstack/service-job": patch
+"@objectstack/service-knowledge": patch
+"@objectstack/service-messaging": patch
+"@objectstack/service-package": patch
+"@objectstack/service-queue": patch
+"@objectstack/service-realtime": patch
+"@objectstack/service-settings": patch
+"@objectstack/service-sms": patch
+"@objectstack/service-storage": patch
+"@objectstack/setup": patch
+"@objectstack/studio": patch
+"@objectstack/trigger-api": patch
+"@objectstack/trigger-record-change": patch
+"@objectstack/trigger-schedule": patch
+"@objectstack/types": patch
+"@objectstack/verify": patch
+"create-objectstack": patch
+"objectstack-vscode": patch
+---
+
+chore(packaging): CHANGELOG.md ships in every npm tarball (#4261)
+
+The AGENTS.md post-task checklist requires breaking changesets to carry their
+FROM → TO migration because "this text ships to consumers as `CHANGELOG.md`
+inside the npm package and is what an upgrading agent greps after the tombstone
+error." That delivery path was severed for 68 of the 69 publishable packages:
+npm packs `package.json` / `README*` / `LICENSE*` unconditionally but — unlike
+older npm versions — not `CHANGELOG.md`, and the canonical
+`"files": ["dist", "README.md"]` whitelist never named it. Measured on npm
+10.9.7: `npm pack --dry-run` on `@objectstack/types` shipped 3 files while its
+70KB `CHANGELOG.md` stayed behind. Only `@objectstack/spec` listed it
+explicitly.
+
+The tombstone-error scenario is precisely the one where the repo is out of
+reach — the upgrading agent has `node_modules` and nothing else — so the
+migration text has to ride in the tarball. Every publishable package now
+declares `CHANGELOG.md` in `files`, and the canonical whitelist is
+`["dist", "README.md", "CHANGELOG.md"]`.
+
+The other half is the gate: `check:published-files` gains a fifth invariant,
+COMPLETE — a whitelist that fails to cover `CHANGELOG.md` fails the
+always-required lint job, so the next package cannot silently sever the path
+again. `@objectstack/spec`'s per-package EXTRA_ENTRIES exemption dissolves
+into the canonical set.
+
+Consumer-visible change: one more file per install (the package's changelog,
+e.g. 70.8KB for `@objectstack/types`), and `grep -r "removed key"
+node_modules/@objectstack/*/CHANGELOG.md` now finds the migration it was
+promised.

.changeset/docs-plugin-spec-onupgrade-example.md

@@ -0,0 +1,5 @@
+---
+---
+
+docs: fix the plugin-spec CHANGELOG example that still taught the retired
+`onUpgrade` hook as running automatically (#4212 family). Releases nothing.

.changeset/fix-stale-hono-changeset-ref.md

@@ -0,0 +1,4 @@
+---
+---
+
+Repo-plumbing only: the pending changeset `adapter-hono-auth-wildcard-yields` referenced the Hono adapter by its old `@objectstack/adapter-hono` name, which `changeset version` rejects because the workspace package is named `@objectstack/hono`. Renamed the entry; a full sweep of every other pending changeset (and `pre.json`) against the workspace found nothing else stale. Releases nothing by itself.

.changeset/register-field-file-collection-proof.md

@@ -0,0 +1,4 @@
+---
+---
+
+chore(spec): register the `adr0104-field-file-collection` dogfood proof tag in the ADR-0054 registry, honestly unbound — the collection contract it guards is `lifecycle` on the system `sys_file` object, already bound to `data-lifecycle`. Gate-only (`packages/spec/scripts/`, not published), so this releases nothing.

.changeset/wait-timeout-keys-retired.md

@@ -0,0 +1,42 @@
+---
+'@objectstack/spec': major
+'@objectstack/service-automation': patch
+---
+
+feat(spec)!: retire `waitEventConfig.timeoutMs` / `.onTimeout` — `wait` never had a timeout (#4158)
+
+Both keys described a timeout and neither delivered one, so protocol 18 removes the pair
+rather than leaving a promise the runtime does not keep (PD #10).
+
+- **`onTimeout`** had **zero** readers. No path ever inspected it, so neither `'fail'` nor
+  `'continue'` ever happened — and its `.default('fail')` stamped a decision nothing made
+  onto every wait node. The showcase set `onTimeout: 'continue'`, which did nothing.
+- **`timeoutMs`** said *"maximum wait time before timeout"* while its only reader used it
+  as the timer **duration** when `timerDuration` was absent. It did something, just not
+  what it claimed.
+
+Together they declared a timeout `wait` does not have: a run resumes when its timer
+elapses or its signal arrives, never on a deadline. Real timeout semantics are left
+unimplemented deliberately — they should be built to a requirement, not retrofitted to
+fit two keys that happened to be declared.
+
+`timeoutMs` **converts to `timerDuration`** rather than being dropped, because that is
+what it did. It is stringified on the way: the target is `z.string()` while `timeoutMs`
+was `z.number()`, and `parseIsoDuration` reads a bare numeric string as milliseconds — so
+`timeoutMs: 60000` and `timerDuration: '60000'` are the same wait. Moving the number
+unstringified would have produced a block that no longer parses, which a test pins. With
+`timerDuration` already set it is dropped instead: the executor's `??` never looked past
+the duration, so it was already dead metadata.
+
+Both leave the **load path** (`retiredFromLoadPath`), which is the registry's existing
+split: a key retired for being *renamed* keeps a load window, because punishing an author
+for a spelling nobody warned them about is pointless; a key that **misdescribed itself**
+does not, because silently absorbing it lets the author keep believing they configured a
+timeout. That is why `api.requireAuth`, the tool/app/flow inert keys and RLS `priority`
+all left it too. The migration chain converts stored sources mechanically; the schema
+tombstones name the replacement.
+
+One fixture interaction worth recording: the #4045 lift fixture used
+`waitEventConfig.timeoutMs` to demonstrate its fourth ledger entry, and the fixture
+harness replays the whole table — so its `after` described an end state protocol 18 makes
+unreachable. It now lifts `eventType` instead. The harness caught this itself.

content/docs/api/client-sdk.mdx

@@ -315,8 +315,9 @@ await client.notifications.markAllRead();
 // through sys_inbox_message and tracks read-state in sys_notification_receipt.
 // These helpers will be repointed during the objectui bell cut-over.
 
-// AI — served by `service-ai` (Cloud/EE); 404s "AI service is not configured"
-// when the plugin is absent, so check `discovery.services` first.
+// AI — served by `service-ai` (Cloud/EE). Without it the route is mounted but
+// unimplemented, so it answers 501 and discovery reports the slot unavailable
+// with the same sentence; check `discovery.services` first.
 const answer = await client.ai.chat({
   messages: [{ role: 'user', content: 'How many open orders this quarter?' }],
   conversationId,                        // omit to have one created and echoed back

content/docs/protocol/kernel/http-protocol.mdx

@@ -55,7 +55,7 @@ GET /api/v1/discovery HTTP/1.1
     "metadata": { "enabled": true, "status": "available", "route": "/api/v1/meta", "provider": "objectql" },
     "auth": { "enabled": true, "status": "available", "route": "/api/v1/auth", "provider": "@objectstack/plugin-auth" },
     "workflow": { "enabled": false, "status": "unavailable", "message": "No implementation ships for the 'workflow' slot — register a service under it to enable" },
-    "ai": { "enabled": false, "status": "unavailable", "message": "No implementation ships for the 'ai' slot — register a service under it to enable" }
+    "ai": { "enabled": false, "status": "unavailable", "message": "Provided by @objectstack/service-ai in ObjectStack Cloud/Enterprise — no implementation ships in the open framework" }
   },
   "locale": {
     "default": "en-US",