Merge origin/main (ad7c351) into claude/issue-20751-services-strings-stage6

The prose-id ledger conflicted: main's copy was taken and regenerated
with --census-ledger on the merged tree. Against main it deletes 16 lines
and adds none: the plugin-sharing and audit-writers.ts entries go to
zero and no other entry moves.

Claude-Session: https://claude.ai/code/session_01DiCSbmJrkzNhuEAier4VoJ
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.changeset/20595-core-provenance-anchors.md

@@ -0,0 +1,20 @@
+---
+'@objectstack/core': patch
+---
+
+Provenance comments in `@objectstack/core` cite the commits that decided them, not tracker numbers that no longer resolve
+
+Clause-②: no
+
+Docblocks and comments across the package cited issue-tracker numbers that now answer 404 on GitHub.
+Each now cites the commit in this repository's history that made the decision it describes, except
+three source comments: one in `resolve-authz-context.ts` that quotes a maintainer ruling now cites
+ADR-0131's 2026-09-17 amendment, which records that ruling verbatim, and two on the unpack-time
+integrity re-verification leg, which pointed at a tracker for work that was never built, now say in
+words that the leg is unbuilt. One test comment named a maintainer-ruling comment that also answers
+404; it now cites ADR-0025 §3.7, which records that ruling's effect. Some of these docblocks sit on
+exported members, so the reworded text appears in the published declaration files (`index.d.ts` /
+`index.d.cts`), and the comments esbuild keeps appear in the JavaScript output (`index.js` /
+`index.cjs`).
+
+Comment only: no export, type, error code, status, message text or runtime behaviour changes.

.changeset/20595-platform-objects-provenance-anchors.md

@@ -0,0 +1,16 @@
+---
+'@objectstack/platform-objects': patch
+---
+
+Provenance comments in `@objectstack/platform-objects` cite the commits that decided them, not tracker numbers that no longer resolve
+
+Clause-②: no
+
+Docblocks and comments across the package cited issue-tracker numbers that now answer 404 on GitHub.
+Each now cites the commit in this repository's history that made the decision it describes, except one
+that cites ADR-0104's 2026-09-05 addendum, the record of that ruling. Some of these docblocks sit on
+exported members, so the reworded text appears in the published declaration files (`apps`, `identity`,
+`metadata-translations` and `system` `index.d.ts` / `index.d.mts`), and the field comments esbuild keeps
+appear in the JavaScript output (`index`, `apps`, `audit`, `identity` and `plugin`, `.js` / `.mjs`).
+
+Comment only: no export, type, error code, status, message text or runtime behaviour changes.

.changeset/20749-lint-strings-stage2-state-the-decision.md

@@ -0,0 +1,24 @@
+---
+'@objectstack/lint': patch
+---
+
+Data-model, filter, predicate, search, sort, security, seed, view, widget and registry findings no longer cite tracker numbers; each one states the decision behind it in words
+
+Clause-②: no
+
+The remaining `@objectstack/lint` findings that `os validate`, `os lint` and `os build` show to authors, plus the `surfaceReason` texts of the exported `AUTHORING_RULES` registry and one integrity error, pointed at an issue-tracker number for the reason behind them. The number goes; where the sentence did not already say what was decided, it now does.
+
+- Data model: the bare declared `unique: true` warning says that protocol 18 rejects the spelling and that stored metadata still carrying it converts to `unique: 'global'`, which builds the same physical index.
+- Empty filter combinators: the `$and: []`, `$or: []` and empty-node messages say every backend reduces an empty combinator to its boolean identity; the `$or: []` message says an empty disjunction never opens a read scope to the whole table.
+- Null guards: the fail-closed outcome says a predicate that cannot evaluate refuses the write rather than being skipped.
+- Visibility and metadata-form predicates: the fall-open consequence says failing open is the console's settled behaviour; the dotted right-hand-side message says the form evaluator keeps its right-hand side a literal by design and says why only in a development build.
+- Component props: the advisory hint says props are judged at the authoring door as a warning before they become an error.
+- Rule schema formats: the format hint says `rule-validator.ts` registers the default `ajv-formats` set so that a `format` is enforced on every write.
+- Security posture: the unset-OWD message describes the leave_request incident (an object with no `sharingModel` let an ordinary read/write grant read and edit every other user's records); the `controlled_by_parent` message says the write is refused as a metadata defect rather than a permission denial.
+- Seeds and views: the seed state-machine message says a seed records established facts rather than walking the lifecycle; the `views:` container message says the stack schema, the rule and the registration loop hold `views:` to one container-only contract.
+- React pages: the absent-`groupBy` hint states the ruling directly.
+- Liveness: the unrecognised-status integrity error says such a status fails loudly rather than being graded `dead`.
+- `AUTHORING_RULES` `surfaceReason` texts: the full-snapshot, capability-reference and sharing-rule reasons name the runtime publish gate (the Studio, REST and MCP door that runs this registry) in place of a tracker number; the advisory-volume reason says the object door opened to the gating object rules alone; the component-types reason names the crossing discipline the gating object rules went through.
+- The other findings (search fields, sort fields, nav servability, dashboard actions, widget bindings and the remaining predicate and combinator messages) drop a citation the sentence already explained.
+
+Text only: no rule id, severity, condition, finding or registry field moves. A tool or test that matches the old text (for example a tracker-number suffix) needs the new spelling.

.changeset/20749-spec-strings-stage3-state-the-decision.md

@@ -0,0 +1,17 @@
+---
+'@objectstack/spec': patch
+---
+
+Field-key guidance, the retired `DriverCapabilities` tombstones, the datasource `readOnly` guidance, the retired filter operators and the legacy `apiMethods` strip warning no longer cite tracker numbers; each one states the decision behind it in words
+
+Clause-②: no
+
+These are the `@objectstack/spec` texts an author meets at the moment something is refused or rewritten: the unknown-field-key guidance that `os validate` and the lint print, the parse errors for retired `DriverCapabilities` keys, the guidance for `readOnly` written inside a datasource driver's `config`, the `INVALID_FILTER` refusal every driver face prints for `$regex` / `$options`, and the warning `enable.apiMethods` prints when it strips a retired legacy value. They pointed at an issue-tracker number for the reason behind them. The number goes; where the sentence did not already say what was decided, it now does.
+
+- Field-key guidance: `index` and `indexed` say the field-level index flag built no index and was removed under ADR-0049 enforce-or-remove; `dataQuality` and `cached` say their leftover `DataQualityRules` and `ComputedFieldCache` schemas were deleted from the public API too, and that computed-field caching returns only together with a runtime consumer.
+- `DriverCapabilities` tombstones: the `bulkCreate` / `bulkUpdate` / `bulkDelete` prescriptions name discovery's `transactionalBatch` bit, derived from the live composition so a client negotiates instead of probing; the `fullTextSearch` prescription says `$contains` itself stays case-sensitive while textual search is case-insensitive.
+- Datasource `readOnly` guidance: says a managed datasource has no read-only gate by decision, because a flag only the application checks cannot stop direct connections, migrations or DDL.
+- Retired filter operators: the `$regex` and `$options` refusals say they are retired under ADR-0049 enforce-or-remove, refused rather than reinterpreted.
+- Legacy `apiMethods` strip warning: the `restore` and `purge` prescriptions say `enable.trash` was retired because no runtime ever read it, and that the recycle-bin (soft-delete) work `restore` would need is parked.
+
+Text only: no key, schema shape, condition, error code or status moves. A tool or test that matches the old text (for example a tracker-number suffix) needs the new spelling.

.changeset/20751-services-strings-stage4-state-the-decision.md

@@ -0,0 +1,15 @@
+---
+'@objectstack/service-automation': patch
+'@objectstack/plugin-audit': patch
+---
+
+Automation refusals, prescriptions, log lines and run-object field help, and the activity type help, no longer cite tracker numbers; each one states the decision behind it in words
+
+Clause-②: no
+
+Some strings these two packages show to flow authors, operators and administrators pointed at an issue-tracker number for the reason behind them. The number goes; where the sentence did not already say what was decided, it now does.
+
+- `@objectstack/service-automation`: the refusal for a `fieldValues` write map says a runtime alias for it was rejected by design, so the node keeps one strict `fields` key; the refusal for a screen field's `visibleIf` says a predicate under any other key is never read, so the field always shows, and a `required` field meant to stay hidden then blocks the screen from ever being submitted; the undeclared-config-key refusal says the built-in node types were reconciled so that every key their executors read is declared; the unknown-function error in a flow value expression says such a name is refused rather than evaluated to null, which would write the field as undefined; the inert-connector warning says entries without a `provider` are catalog descriptors, while an entry that names a `provider` is a connector instance that provider's installed executor materializes; the `sys_automation_run` field help says the paused node's type decides who may continue a run (an approval pause only through its owning service), that rows written before run history recorded its trigger were not backfilled, and that a finished run's bounded step log keeps its per-node detail across a restart; three bridge debug lines say what each bridge provides. The bulk-intent guidance, the degraded-connector dispatch error and retry lines, the user-less `runAs` warning and refusal, the unclaimed-branch warning, the script-function and node-config refusals and the `sys_flow_dispatch` description drop their citations.
+- `@objectstack/plugin-audit`: the `sys_activity` `type` help, whose English text all four shipped locale bundles carry, says the vocabulary is open by decision, not a gap awaiting enforcement.
+
+Text only: no status, error code, field, route or control flow moves. A client or log filter that matches the old text (for example a tracker-number suffix) needs the new spelling.

.changeset/20751-services-strings-stage5-state-the-decision.md

@@ -0,0 +1,19 @@
+---
+'@objectstack/plugin-security': patch
+---
+
+Security refusals, explain details, field help and log lines no longer cite tracker numbers; each one states the decision behind it in words
+
+Clause-②: no
+
+Some strings the security plugin shows to administrators, authors and operators pointed at an issue-tracker number for the reason behind them. The number goes; where the sentence did not already say what was decided, it now does.
+
+- The curated capability-name refusal says a curated name is refused at authoring so that no admin-authored row can collide with the row the platform seeds for it.
+- The two delegation anchor refusals say the business-unit anchor roots the delegate's business-unit visibility, so a delegation may only narrow it.
+- The `managed_by` field help on `sys_permission_set` and `sys_position`, in every shipped locale, says capabilities, permission sets and positions all share one platform / package / admin vocabulary.
+- The explain details for an unresolvable security posture and for the View/Modify All Data bypass drop their citations; those sentences already said that access fails closed and that the write path consults the same bypass.
+- The derived-capability boot warning says the derivation refreshes a row's label and description only when it can prove the row is the platform's own, and that the seeder neither adopts a row it cannot prove is its own nor backfills provenance on the operator's behalf.
+- The fail-closed log lines say what each denial protects: a `controlled_by_parent` child is readable and writable only where its master is, and a chain the derivation cannot resolve admits no child; only a resolved sharing allow (Modify All Data or an edit-level share) may replace the platform ownership floor; an authored-policy verdict that cannot be resolved never lifts the sharing refusal; a path that bypasses the engine middleware never runs without the owner and share scope a direct read applies; a delegated read is never scoped wider than its delegator's own; an unreadable posture never defaults to public or uncontracted.
+- The public-form line says an anonymous submission cannot set ownership, tenancy or audit columns; the uninstall line says a package's permission rows are removed by `package_id`, so no grant outlives the package; the platform-owner wall-bypass line says only the declared platform owner's reads cross the wall and writes stay walled for everyone. The org-scoping entitlement, masking-rule, permission-set resolution, vocabulary-normalization and service-registration lines drop their citations, and the log lines that carried a tracker number in their `[security/…]` prefix now open with `[security]`.
+
+Text only: no status, error code, field, route or control flow moves. A client or log filter that matches the old text (for example a tracker-number suffix or prefix) needs the new spelling.

.changeset/21320-agent-lifecycle-retired.md

@@ -0,0 +1,77 @@
+---
+'@objectstack/spec': minor
+'@objectstack/platform-objects': patch
+---
+
+feat(spec)!: retire `agent.lifecycle`, the agent conversation state machine, and with it the XState `StateMachineSchema` family — a conversation phase is a skill with `triggerConditions`, orchestration is Flow, record transitions are the `state_machine` validation rule (#21320)
+
+**BREAKING** — `agent.lifecycle` was parsed and never read. No runtime, in this
+repository or in the cloud AI runtime that executes agents, moved an agent through a
+declared state or refused an undeclared transition, so an authored machine changed
+nothing an agent did (ADR-0049 enforce-or-remove). Enforcing it would have meant a
+statechart interpreter beside Flow, the two-engine shape ADR-0020 rejected. Authoring
+now refuses the key by name, with a prescription, and TypeScript rejects it.
+
+Its value schema had no other authorable door: ADR-0020 had already retired the XState
+shape as a record-lifecycle declaration and kept the file only for this key. So the
+family leaves the package with it.
+
+### FROM → TO
+
+| before | what to write instead |
+| --- | --- |
+| `agent.lifecycle` — any value | delete the key. |
+| a conversation phase in the machine (its own instructions and tools) | a skill with its own `instructions` and `tools`, selected by its `triggerConditions`, listed in the agent's `skills`. |
+| a multi-step process in the machine | a Flow. |
+| a record's status transitions in the machine | a `state_machine` validation rule in the object's `validations`: `{ type: 'state_machine', field, transitions: { from: [to, …] } }`. |
+| `StateMachineSchema`, `StateNodeSchema`, `TransitionSchema`, `ActionRefSchema`, `GuardRefSchema` and the types `StateMachineConfig`, `StateNode`, `StateNodeConfig`, `Transition`, `ActionRef`, `GuardRef` from `@objectstack/spec/automation` | no replacement: declare the shape your code needs itself, or drop it. For record transitions, `StateMachineValidationSchema` in `@objectstack/spec/data` is the enforced shape. |
+| `StateNodeConfig` from `@objectstack/spec` or `@objectstack/spec/ai` | removed with the family; nothing in those entries mentions it any more. |
+
+**The one-line fix: delete `lifecycle`; put phase-scoped instructions and tools in
+skills with `triggerConditions`, and orchestration in Flow.** `os migrate meta --from 17`
+lists the mechanical edits for existing sources (the `lifecycle` deletion). Where each
+deleted machine's intent goes is the author's judgement.
+
+The refusal is a parse error at `lifecycle` naming the key and the fix, and the key
+fails `tsc` (its input type is `never`).
+
+### The retirement kit
+
+- **Tombstone.** `lifecycle` is a `retiredKey()` on `AgentSchema` carrying the
+  prescription; the agent metadata form no longer offers it.
+- **D2 conversion `agent-lifecycle-removed`** (step 18, retired from the load path):
+  it deletes `lifecycle` from every agent, whatever it holds. The delete is lossless,
+  because no value of it ever changed what an agent did. Stored `sys_metadata` agent
+  rows and built artifacts replay it; one notice per agent. An object's ADR-0057
+  `lifecycle` block shares the name and is not touched.
+- **D3 entry `agent-lifecycle-retired`** carries the judgement the conversion cannot
+  make: which of the three destinations each deleted machine meant.
+- **`RETIRED_KEYS_BY_MAJOR[18]`** registers `ai/Agent:lifecycle`, and
+  **`RETIRED_DEFS_BY_MAJOR[18]`** registers the five published defs
+  `automation/StateMachine`, `automation/StateNode`, `automation/Transition`,
+  `automation/ActionRef` and `automation/GuardRef`. Their reference page
+  (`references/automation/state-machine`) is gone.
+- **No deprecation window**, per the project's startup-stage posture.
+
+### The liveness ledger
+
+The `agent.lifecycle` row moves `experimental` → `dead` with a REMOVED note
+(`verifiedAt` 2026-10-02); the tombstone keeps it in the walked shape. No `agent` row is
+`experimental` any more. `os validate` and every other parsing door refuse the key at
+parse, before any advisory runs. `os lint` reads the unparsed stack, so it now grades the
+key `liveness-dead-property` where it used to say `liveness-experimental-property`.
+
+### `@objectstack/platform-objects`
+
+The agent metadata-form catalogs drop the `lifecycle` row's label and help text in all
+four locales.
+
+⚠️ **The out-of-repo consumer population is NOT MEASURED.** `@objectstack/spec` is
+published: tenant-authored agents, and code outside this repository importing the
+family's exports, were not measured. This repository authors no `agent.lifecycle`
+outside `packages/spec` and imports none of the family outside it; the pinned objectui
+checkout imports none of the family and reads no `agent.lifecycle`.
+
+Clause-②: yes (narrowing)
+
+<!-- adr-0087: registered agent-lifecycle-removed, agent-lifecycle-retired -->

.changeset/21322-hot-install-binds-boot-steps.md

@@ -0,0 +1,14 @@
+---
+"@objectstack/cloud-connection": patch
+"@objectstack/plugin-security": patch
+---
+
+fix(cloud-connection,plugin-security): a package installed into a running runtime fires its record-change flows and has its permission sets in `sys_permission_set` right away, not after a restart
+
+Clause-②: no
+
+**Before**, `os package install ./dist/objectstack.json` into a running `os start` (the install-local route) registered the package, bound its script actions and body hooks, and stopped there. Two things the boot does for a package happen at `kernel:ready`, and that moment had already passed. The automation engine binds flows at `kernel:ready`, so the package's record-change flows never fired: a task updated to `done` wrote no note. The security plugin seeds declared permission sets at `kernel:ready`, so the package's set had no `sys_permission_set` row. `/meta/permission` listed the set, but an admin could not grant it. A restart fixed both, because the restart re-registers the package before those two steps run. Nothing in the CLI output or the install response said a restart was needed.
+
+**Now** the install route announces `metadata:reloaded` once the package is registered, bound, persisted and seeded. That is the same event a Studio package publish, a per-item publish and an artifact reload already announce. The automation engine already re-syncs its flows on it. The security plugin now re-runs its declared-permission seeding on it: the same function and organization passes as the boot, with the same provenance rules (`managed_by: 'package'`, `package_id`). Right after the install, the flow fires and the set's row exists, with the same state a restart gives. The seeding is idempotent and writes nothing when no permission set changed. It runs only after the boot's own pass has finished. A failed re-sync does not fail the install. It is logged at `warn` with the restart that repairs it.
+
+**Unchanged.** The restart path (the ledger rehydrate) announces nothing and behaves as before. The install response and the CLI output keep their fields and text. A package's `defineStack({ jobs })` are still not scheduled by install-local, on install or after a restart, because a job's handler is code from the artifact's runtime module and an inline install carries only the JSON.