Merge origin/main — reconcile with ADR-0115 (#4137): plugin-dev half superseded, runtime /ui discovery gate kept

#4137 retired the entire stub table wholesale (Tiers A+B+C), which includes the
data and ui retirements this branch carried incrementally — plugin-dev files
resolve to main's state. What this branch still adds is the runtime seam #4137
deliberately left untouched: discovery's routes.ui/services.ui gate on the
protocol service that actually serves /ui, which matters more post-ADR-0115
because no boot registers a ui-slot occupant at all now.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018UNGqBQcdJ2RYHtWgntJ9B

Author: claude

.changeset/analytics-between-predicate-dropped.md

@@ -0,0 +1,29 @@
+---
+"@objectstack/service-analytics": patch
+---
+
+fix(service-analytics): a `$between` analytics filter no longer vanishes from the query (ADR-0053 D-A3.1)
+
+A dashboard widget or dataset whose filter used `$between` was querying **every
+row**. `normalizeAnalyticsFilters` maps Mongo-style operators onto the internal
+pipeline form, `$between` was missing from that map, and an unmapped operator is
+skipped — so the predicate was silently dropped from the compiled WHERE clause.
+Both strategies read that normalizer, so both the raw-SQL and the ObjectQL
+aggregate paths were affected. The symptom is #3650's: a chart that draws the
+whole dataset instead of the requested window, with nothing in the SQL to
+suggest a filter was ever asked for.
+
+`$between [min, max]` now lowers to its two bounds (`gte` + `lte`) instead of
+gaining an operator of its own, so a range's max inherits the calendar-day
+whole-day rule (#3777) from each strategy's existing upper-bound handling —
+`NativeSQLStrategy` compiles a bare-day upper bound half-open itself, and the
+ObjectQL path gets the same rule from the driver — rather than needing a second
+implementation to keep in step. A malformed `$between` (not a two-element
+array) now throws instead of being dropped, matching the stance driver-memory
+took for the same shape in #3948: an unbounded read is exactly the failure this
+prevents, and it is indistinguishable from a legitimately wide query.
+
+Found by giving the temporal conformance matrix its missing sixth consumer
+(`native-sql-temporal-conformance.test.ts`), which executes the shared cases
+against a real SQLite engine and asserts row ids — a dropped predicate is
+invisible to the SQL-string assertions the strategy's other suites use.

.changeset/analytics-filter-operator-coverage.md

@@ -0,0 +1,42 @@
+---
+"@objectstack/service-analytics": patch
+---
+
+fix(service-analytics): every authorable filter operator now reaches the query (#4128)
+
+Closes the cause behind the `$between` defect rather than just that instance.
+`normalizeAnalyticsFilters` skipped any operator missing from its map, and a
+skipped predicate does not narrow a query — it **widens** it: the compiled SQL
+stays valid and returns rows the author excluded. Four operators from the
+spec's authorable vocabulary sat in that state, plus one that was mapped
+incorrectly.
+
+- **`$startsWith` / `$endsWith`** were dropped entirely. Both strategies now
+  compile them — anchored `LIKE 'x%'` / `LIKE '%x'` on the raw-SQL path, and
+  the canonical `$startsWith` / `$endsWith` operators (which every driver
+  implements directly) on the ObjectQL path, so an anchored match does not
+  depend on regex dialect.
+- **`$null`** was dropped. It is the shape the console emits for an "is empty"
+  / "is not empty" filter, so such a widget was showing every row. Now compiles
+  to `IS NULL` / `IS NOT NULL` per its boolean.
+- **`$exists`** was mapped value-*independently* to `set`, so `{$exists: false}`
+  compiled to `IS NOT NULL` — the exact inverse of what it asks for. It and
+  `$null` are now resolved explicitly, because a key→name map cannot express an
+  operator whose meaning flips with its value.
+- **`$notContains`** reached the ObjectQL strategy, which had no arm for it and
+  fell through to a `default` returning a bare value — compiling "does not
+  contain x" as "**equals** x".
+- **Unknown operators now throw** on both surfaces instead of being silently
+  dropped (normalizer) or reinterpreted as an equality (ObjectQL strategy). An
+  operator outside the vocabulary is a caller error, and a loud one beats a
+  silently widened read — the call driver-memory made for the same shape in
+  #3948.
+
+Still declared as a gap, but no longer a silent one: `$or` / `$not` are skipped,
+since expressing them needs a recursive WHERE builder rather than the flat
+array the strategies consume.
+
+Cover is `filter-operator-coverage.test.ts`, which runs the whole vocabulary
+against a real SQLite engine and asserts **row ids** — six of its cases fail
+without this change. A dropped predicate is invisible to the SQL-string
+assertions the strategies' other suites use, which is how these survived.

.changeset/app-dead-authoring-keys.md

@@ -0,0 +1,34 @@
+---
+"@objectstack/spec": major
+---
+
+feat(spec)!: tombstone the seven dead AppSchema authoring keys (#4001 app step, PR A)
+
+The 2026-06 AppSchema liveness audit verdicted seven authorable keys DEAD —
+never read by any consumer in framework or objectui. Authoring them shipped
+config the author believed was in effect; `sharing`/`embed` were the
+dangerous case (a declared public-access surface no route enforced,
+ADR-0049 class). All seven are now `retiredKey()` tombstones: `tsc`-level
+`never` for typed authors, a parse-time prescription for everyone else —
+NOT a silent strip, because `AppSchema` is not yet `.strict()`.
+
+**Removed keys and their prescriptions (FROM → TO):**
+
+- `App.version` → an app is versioned by its owning package: `manifest.version`.
+- `App.aria` → declare `aria` on the component/widget that renders the DOM node.
+- `App.objects` / `App.apis` → the self-described "config file convenience";
+  objects/apis belong to the stack (`defineStack({ objects, apis })`) — the
+  chatbot derives an app's object list from its NAV ITEMS, never from these.
+- `App.sharing` / `App.embed` → public access is granted per FORM VIEW
+  (`FormView.sharing`, the public-data-collection surface); no public-app or
+  iframe route ever read the app-level blocks.
+- `App.mobileNavigation` → fully unimplemented (even `packages/mobile`
+  ignored it); returns if/when a real mobile navigation ships.
+
+Deleting a key is behavior-preserving by construction — none ever had a
+runtime effect. `os migrate meta --from <16 or lower>` rewrites your source
+(the `app-dead-authoring-keys-removed` conversion, ADR-0087), or delete the
+keys by hand.
+
+This clears the ADR-0049 precondition for PR B (AppSchema + navigation-union
+`.strict()`): strictness should guard the real contract, not dead keys.

.changeset/dev-plugin-data-ui-slots-and-ui-route-gate.md

@@ -0,0 +1,70 @@
+---
+"@objectstack/spec": minor
+"@objectstack/runtime": patch
+"@objectstack/service-i18n": patch
+---
+
+fix(spec,runtime,service-i18n): the dispatcher domains and their service contracts describe the same surface (#4127)
+
+#4087 retired a `/storage` bridge that called `upload(key, data, options?)` as
+`upload(file, { request })` — a shape no implementation has. Sweeping the other
+dispatcher domains against `packages/spec/src/contracts/*` found the mirror-image
+gap in three places: the call site and the implementation agreed, and the
+**contract** was the thing that had never been written down. Each one was worked
+around at the call site with `typeof x.foo === 'function'` — a duck-type is what
+"the contract does not cover this" looks like when nobody fixes the contract.
+
+Fixed at the contract, per Prime Directive #12.
+
+**`INotificationService` — the inbox half.** `listInbox` / `markRead` /
+`markAllRead` now exist, with `InboxQuery` / `InboxNotification` /
+`InboxListResult` / `MarkReadResult`. Three SDK-expressed routes
+(`notifications.list` / `.markRead` / `.markAllRead`) have rested on them all
+along, implemented by `service-messaging`, while this contract described only
+`send`. The cost was not theoretical: the dev notification stub implements
+exactly `send` and `sendBatch` **because it followed the contract**, so the one
+implementation written to spec was the one the dispatcher had to duck-type past.
+
+They are optional, and the probe stays: an inbox needs a durable store, and a
+send-only provider (SMTP, Twilio, a Slack webhook) fills the slot legitimately
+without one. `handlerReady` cannot express that — the slot is serveable, one
+capability of it is absent. The `/notifications` domain now takes
+`INotificationService` instead of `as any`, and each write route probes its own
+method rather than riding the entry `listInbox` check (they are separately
+optional, so "has an inbox to read" never implied "has read-state to write").
+
+**`II18nService.getFieldLabels`.** Both serving surfaces — the dispatcher's
+`/i18n/labels/:object/:locale` and service-i18n's own mount — probed for it and
+both documented it as "optional on `II18nService`", which was not true. It is
+now. service-i18n's probe loses two casts with it (one through
+`Record<string, unknown>`, one re-declaring the signature inline).
+
+**`IAutomationService.getFlowRuntimeStates`** + the `FlowRuntimeState` type.
+`GET /automation/_status` (and the CLI boot summary, and the
+`kernel:bootstrapped` audit) already called it while the contract stopped at
+`listFlows(): string[]`. The dispatcher's inline cast declared it as
+`{ name, enabled, bound }` — a third copy of the shape and a narrower one than
+the engine returns, dropping the `status` / `triggerType` / `object` fields that
+say WHY a flow is unbound.
+
+Two runtime fixes fell out of the same sweep:
+
+- **`POST /automation/trigger/:name` now builds a real `AutomationContext`.**
+  It passed the raw HTTP body to `execute(name, body)`, so the
+  `{ recordId, objectName, params }` translation never ran and — the sharper
+  half — no caller identity was forwarded. A flow's default `runAs` is `'user'`,
+  and a `runAs:'user'` run whose trigger resolved no user has its data
+  operations REFUSED (#3760, fail-closed), so `client.automation.trigger()`
+  could not run a data-touching flow at all while `POST /:name/trigger` could.
+  service-automation's own comment claims "most trigger surfaces (REST action /
+  trigger endpoint) already resolve the full envelope"; for this endpoint it was
+  not true. Both routes share one context builder now.
+- **The dead `automationService.trigger(...)` probe is gone.** Nothing in the
+  repo has ever implemented `trigger` on the automation slot and the contract
+  never declared it, so the branch was unreachable on every deployment and its
+  `execute` "fallback" was the route. Declaring `trigger?` would have blessed a
+  second name for `execute`; the dead branch is deleted instead.
+
+No migration. Every added contract member is optional, so existing
+implementations stay valid; the two runtime fixes only make routes that were
+failing or degraded behave like their working twins.

.changeset/dispatcher-call-sites-meet-their-contracts.md

@@ -0,0 +1,33 @@
+---
+'@objectstack/plugin-dev': minor
+---
+
+feat(plugin-dev)!: the stub table is retired — DevPlugin assembles real plugins and registers no service implementations of its own (ADR-0115, #4093, #4104).
+
+DevPlugin used to fill every core-service slot no real plugin occupied with a dev stub. Every one of those stubs is gone. A slot nothing fills now stays EMPTY, exactly as in production: routes answer 404/501, discovery reports `unavailable`, and in-process consumers must handle absence — which production already required of them. FROM → TO per retired slot:
+
+| Slot | The stub did | Instead |
+|:---|:---|:---|
+| `security.permissions` | allow-all `checkObjectPermission()` | install `@objectstack/plugin-security` (already part of the default assembly) |
+| `security.rls` | compiled no row filter | same — `plugin-security` |
+| `security.fieldMasker` | returned results unmasked | same — `plugin-security` |
+| `auth` | `verify()` accepted everyone as admin | install `@objectstack/plugin-auth` (already part of the default assembly) |
+| `data` | accepted writes, stored nothing | install `@objectstack/objectql` (already part of the default assembly) |
+| `ui` | shapeless `{}` placeholder | nothing consumed it; handle the absent slot |
+| `ai` | placeholder chat/complete answers | install a real AI service |
+| `automation` | `execute()` reported success without running | install an automation engine plugin |
+| `notification` | claimed "sent", delivered nothing | install a notification service |
+| `file-storage` | in-memory files lost on restart | `@objectstack/service-storage` — now auto-wired by DevPlugin when installed (local-disk adapter) |
+| `realtime` | in-process pub/sub copy | `@objectstack/service-realtime` — now auto-wired by DevPlugin when installed (its default in-memory adapter) |
+| `search` | in-memory substring index | no consumer resolves this slot; a future search service ships its own dev strategy |
+| `workflow` | unvalidated state transitions | no consumer resolves this slot; a future workflow service ships its own dev strategy |
+| `metadata` | a second hand-written copy of core's `createMemoryMetadata` | no behavior change — the kernel pre-injects core's fallback for empty core slots (`CORE_FALLBACK_FACTORIES`), and ObjectQL registers the real metadata service in the default assembly |
+| `cache` / `queue` / `job` / `i18n` | re-registered core's `createMemory*` fallbacks | no behavior change — the kernel pre-injects the same core fallbacks automatically; install `@objectstack/service-cache` / `service-queue` / `service-job` for real engines, and i18n auto-wires from the stack's translations (unchanged) |
+
+Also new, from the same ADR:
+
+- **Production guard** (first shipped with the security-trio subset): `DevPlugin.init()` throws when `NODE_ENV === 'production'` — the assembly is built around a well-known default auth secret and a seeded dev admin. Escape hatch: `OS_ALLOW_DEV_PLUGIN=1`.
+- **Assembly auto-wire**: `@objectstack/service-storage` and `@objectstack/service-realtime` are wired as optional child plugins when installed (both ship with DevPlugin's dependencies), so dev keeps working file storage and realtime through real implementations.
+- `options.services` keys for the retired stubs are accepted and ignored; `'file-storage'` / `'realtime'` now toggle the real service wiring.
+
+One-line fix for an upgrading stack: if something you called in dev now throws "service not found" or 404s, that call was consuming a fabricated answer — install the real service for that slot (table above), or make the caller tolerate absence the way it already must in production.

.changeset/retire-the-dev-stub-table.md

@@ -0,0 +1,47 @@
+---
+'@objectstack/cli': patch
+'@objectstack/runtime': patch
+---
+
+fix(cli,runtime): an artifact you NAMED and a boot input you don't have are different failures — say which (#4110 follow-up, #4131 step 1)
+
+Three corrections, all from the same principle: a platform may boot with no
+application (#4085), and that says nothing about how a MISSING NAMED INPUT
+should be read.
+
+- **A named-but-missing artifact boots empty and silently.** #4110 made an
+  absent artifact non-fatal all the way down — right for the conventional
+  `<cwd>/dist/objectstack.json`, which is just "not compiled yet". But
+  `OS_ARTIFACT_PATH` / `{ artifactPath }` skip the existence check by design, so
+  the tolerance reached them too: `OS_ARTIFACT_PATH=/nope os serve` printed
+  "booting from artifact", reached `Server is ready`, and named the missing path
+  NOWHERE in its output (serve's boot-quiet window drops the loader's calm
+  line). `createDefaultHostConfig` — the boot with no config, where the artifact
+  IS the deployment — now rejects a named local artifact that does not exist,
+  naming both the path and which source named it. The loader keeps its
+  tolerance, so the config-boot path #4085 fixed is untouched.
+
+- **"Configuration file not found" never said where it looked.** The two things
+  that actually happen are a typo'd filename and the wrong working directory,
+  and the second is the common one. It now names the config path, the artifact
+  path, and that `OS_ARTIFACT_PATH` is unset — and still refuses rather than
+  inventing a zero-object platform, pointing at `objectstack start` for a boot
+  that is app-less on purpose.
+
+- **That refusal was being truncated.** `this.exit(1)` unwinds to oclif's
+  `process.exit`, which does not drain a piped stdout, so a diagnostic split
+  across several `console.log` calls loses its tail — measured: only the first
+  two lines of the new message survived a pipe, i.e. exactly the part that says
+  where to look went missing. Both of `serve`'s pre-flight refusals now emit one
+  write. Caught by the e2e added here, not by review.
+
+Also corrects the plugin-ordering claims in `createStandaloneStack` and in the
+test that pinned them: the comment said the datasource plugin's array position
+"MUST precede ObjectQLPlugin: its start() connects the default driver", and the
+test asserted that index with the same rationale. The connect happens in
+`init()`, and the kernel resolves order from the dependency graph — which hoists
+ObjectQLPlugin ahead of the datasource plugin (measured: 6 slots earlier), the
+reverse of what the slot reads as. The test now pins the declared dependency
+that actually orders the two inits, which deleting the array position cannot
+break and deleting the declaration does. #4131 tracks making the AppPlugin end
+of that contract enforced rather than conventional.