@@ -0,0 +1,51 @@
+---
+"@objectstack/dogfood": patch
+---
+
+docs(qa): record `dispatcher-plugin.ts` as deliberately outside the #2992 transport tripwire set, with the reason (#9410)
+
+`packages/runtime/src/dispatcher-plugin.ts` has both properties that make a file
+a plausible landing site for a realtime transport, and neither the conformance
+test nor the protocol page said anything about it. It **mounts routes** —
+`/actions`, `/automation` and `/packages`, the registration path separate from
+the `@objectstack/rest` one — and it **already writes SSE**: two
+`text/event-stream` sites with `no-cache` and `keep-alive`, working plumbing an
+agent could extend without writing any new transport mechanics. None of the five
+`#2992` / ADR-0096 D4 transport tripwires watch it, so a subscribe/fan-out
+transport wired there mints no `TRANSPORT-WIRED` key, produces no UNCLASSIFIED
+surface and reds no build. The protocol page stated the general limitation ("a
+transport wired outside the watched files produces no key and no failure")
+without naming the specific already-SSE-capable file sitting inside it.
+
+**This change is a recording. It changes no behaviour**: no probe is added, no
+key is minted, and no matrix row is written for the two existing sites.
+
+The reason is recorded because it is the part a reader cannot re-derive cheaply.
+Those two `text/event-stream` sites are **per-request AI response streaming, not
+realtime subscription fan-out**: each drains one `AsyncIterable` that the route
+handler itself returned into that same request's response body and then calls
+`res.end()` — the second site's own source comment names its producer as the AI
+routes. No subscriber is registered, no event is delivered to a *set* of
+recipients, and the file carries no upgrade handler, no subscribe registration
+and no realtime-service call. Watching it with the existing mechanics pattern
+would therefore mint a key on day one for a surface that is not the hazard
+`#2992` is about, leaving only two exits: classify two non-realtime sites in the
+matrix vocabulary, or weaken the pattern. Neither is acceptable, so the file
+stays out and the boundary is written down instead.
+
+It is written in the two places a reader actually lands. In
+`authz-conformance.test.ts` the note closes the tripwire probe list, so a reader
+who has just finished enumerating the watched set reads the set's boundary in
+the same breath — beside, and explicitly distinguished from, the pre-existing
+`#5519` mention of the same file, which is about anonymous gates on the mounted
+routes and is a different point. In `realtime-protocol.mdx` it extends the
+identity-admission callout at the exact sentence that states the general
+limitation.
+
+The exclusion is drawn on **fan-out, not on the SSE content type**, and both
+records say so: wiring an upgrade handler, a subscribe registration or a
+realtime-service call into that file puts it back inside the hazard while the
+recorded boundary still claims otherwise. Promoting it into the tripwire
+population with such a fan-out-specific marker is written into #8347's
+acceptance as a precondition of the WebSocket/SSE transport landing, so the
+design effort is spent when the hazard becomes real rather than now.
@@ -0,0 +1,51 @@
+---
+"@objectstack/service-automation": patch
+---
+
+fix(service-automation): a triggered run carries the flow author's `successMessage` / `errorMessage` — `execute()` and both retry exits, symmetric with `resume()` (#9414)
+
+`AutomationResult` declares `successMessage` / `errorMessage` as a general
+terminal-result feature — *"Friendly terminal messages copied from the flow
+definition (`flow.successMessage` / `flow.errorMessage`) … `successMessage` is
+set on terminal success, `errorMessage` on failure."* One producer honoured it.
+`resumeInternal` set both on its terminal returns; `execute()` set neither, on
+either exit, and neither did `executeWithoutRetry` or `retryExecution`.
+
+So a flow's own words reached a caller **only if the run happened to pause and
+be resumed**. A flow dispatched straight through
+`POST /api/v1/automation/:name/trigger` — or the legacy `trigger/:name` that
+`client.automation.trigger()` calls — carried nothing, though the flow declared
+the text and the contract said it was set. One declaration, two behaviours
+decided by *route* rather than by authoring.
+
+**The consumer was already there and already reading.** The trigger route
+carries `errorMessage` into `error.details.errorMessage` (#9413), which is the
+one place the console reads it from (objectui `flowResponse.ts`, #4899) — and on
+the trigger path it was **always absent at the source**, so every non-screen flow
+showed the raw node error instead of the sentence its author wrote.
+
+Four terminal exits now produce the pair, which is every exit a triggered run can
+leave through:
+
+- `execute()` terminal success → `successMessage`; terminal failure →
+  `errorMessage`, **beside** the raw `error` rather than instead of it (the
+  transport folds `error` into the ADR-0112 message and carries the author's text
+  in `details`).
+- `executeWithoutRetry()` — both exits. `retryExecution` returns this result
+  verbatim when a later attempt succeeds, so without it `successMessage` would
+  depend on *which attempt* happened to work.
+- `retryExecution()`'s **exhausted** exit, which is a different exit from
+  `execute()`'s own failure return — a flow under `errorHandling.strategy:
+  'retry'` never reaches that one. A repair stopping at `execute()` would have
+  left the message missing for exactly the runs most likely to need it.
+
+**Nothing else gained a message, deliberately.** The paused return is not
+terminal; the skip exits (`condition_not_met`, `reentrancy_loop_guard`) return
+`success: true` for a run that executed no node; the never-dispatched exits
+(flow not found / disabled / no start node) have no lifecycle verdict at all and
+must not acquire a second channel implying one. Those boundaries are pinned, not
+just described.
+
+No new keys and no contract edit — the pair was declared, documented and
+consumed already; this is the production half catching up (ADR-0049
+enforce-or-remove, restoration direction).
@@ -0,0 +1,48 @@
+---
+"@objectstack/objectql": patch
+---
+
+fix(engine): `deleteBehavior: 'set_null'` on a `multiple: true` reference field removes the deleted MEMBER from the stored array instead of nulling the whole slot, and the temporary 409 hold shipped with #9437 is removed (#9438)
+
+On a set-valued foreign key, "set null" now means what it has to mean: the
+reference to the deleted record is filtered out of the stored array and the
+remaining members are written back untouched. Before the interim hold, this
+limb wrote `null` over the WHOLE array — a row holding `["acc_a","acc_b"]`
+re-read as `null` after `acc_a` was deleted, silently dropping the live
+reference to `acc_b`.
+
+**The residual shape is the ruled one, consumed rather than decided here.**
+When the last member is removed, the field is written as **`[]`, never
+`null`** — the representation `FieldSchema` pins as verbatim contract
+(`packages/spec/src/data/field.zod.ts`, the `multiple` and `required` doc
+blocks; #9447, maintainer ruling 2026-08-18, binding for every writer). The
+open question that kept this limb held back was exactly that shape; it is
+now answered at the spec, and this write consumes the answer.
+
+**The temporary holding position is removed in the same stroke — it was
+built to be removed.** #9437 shipped an explicit interim: any delete that
+would take the `set_null` limb on a multi-value reference was refused
+`DELETE_RESTRICTED` / 409, with a `developerMessage` naming the refusal
+TEMPORARY and citing the tracking issue literally. Those deletes now
+succeed and remove the member. The refusal envelope for a genuinely
+configured `restrict` is unchanged, and the interim's extra sentence is gone
+with the interim.
+
+Removal compares whole members (`String(v) !== String(id)`), the same
+reading the dependents narrowing already applies — the probe's `$contains`
+pushdown is a substring superset, so an id that is a prefix of another
+neither loses its own member nor takes its neighbor's. Every other
+disposition is untouched: `cascade` still deletes dependents, a
+single-valued `set_null` still clears its foreign key to `null`, an
+explicit `restrict` still refuses with its own sentence, and the required-FK
+escalation stays exactly as it was.
+
+Pinned against the driver double that models the JSON TEXT column and
+against a real `SqlDriver` on better-sqlite3 through the real data-plane
+delete: member removal with a surviving sibling that still resolves, the
+emptying case asserted literally as `[]` and not `null` on a re-read of the
+database, and the controls beside them.
+
+Note: `required` on a multi-value lookup now *documents* non-empty-array
+semantics (same ruling), but the validator does not yet enforce it — that
+enforcement gap is tracked separately in #9476 and is not changed here.
@@ -0,0 +1,40 @@
+---
+"@objectstack/plugin-audit": patch
+---
+
+Published README documents the record-view audit surface that actually shipped
+
+The README was corrected against the shipped surface before record-view auditing landed,
+so it still told readers that "reads and views are not on the ledger" and that the plugin
+takes no configuration. Both became false when the `read` action, its writer and the
+`record_views` list view merged. This is a docs-only change; it needs a version bump
+because the README is in the package's published `files` array, and a correction with no
+release never reaches the npm package page at all.
+
+What the page now documents, each point verified against the source rather than against a
+description of it:
+
+- the `read` action and its writer, in the action table and in the shipped list views;
+- the per-object opt-in as what it is — an **install-time list** passed to the plugin
+  constructor (`new AuditPlugin({ readAudit: { objects: [...] } })`), explicitly **not** an
+  `enable.auditReads` object-metadata key. A declarable key can be set on an object in a
+  deployment that never installs the plugin, producing metadata that reads as audited and
+  writes nothing, which is the exact class of claim this page was corrected to remove;
+- the three settings the plugin forwards, and the one writer knob (`maxBufferedEvents`) it
+  does not, which is reachable only by calling `installReadAuditWriter` directly;
+- the record-detail discriminator that keeps list and search reads out of scope, including
+  the `$or` / `$not` refusal and the AND-composed predicate the security middleware leaves
+  behind;
+- batched writes off the request path, the view-instant `created_at`, and the two loud
+  once-only failure postures (buffer overflow, failed ledger write);
+- the two declared boundaries — a system-elevated read and a read with no principal both
+  write no row;
+- that no field values are recorded, and therefore that the ledger cannot answer what a
+  viewer actually saw;
+- that the shipped `record_views` view carries an `ip_address` column which is always empty
+  on a `read` row, because no read-path writer stamps it.
+
+Record-view auditing adds no enterprise dependency: this package's declared edition is
+`open`, and the opt-in is ordinary plugin configuration. The two enterprise-dependent
+behaviours already annotated on the page — the hierarchy resolver and the archive
+datasource — are unchanged.
@@ -0,0 +1,58 @@
+---
+"@objectstack/cli": patch
+---
+
+fix(cli): `os migrate meta --from N` can finally open the retired-key sources it exists to rewrite (#9418)
+
+The codemod refused its own input class. A retired authorable key is a
+`retiredKey()` tombstone — `z.never()` carrying the upgrade prescription — so the
+current schema does not strip it, it **rejects** it. And a real
+`objectstack.config.ts` runs that schema itself: `os init` scaffolds
+`export default defineStack({ … })`, larger projects spread `defineView` /
+`defineAgent` / `defineFlow` across per-artifact modules, and every one of those
+`define*` helpers is a `Schema.parse()`. The rejection therefore fired while the
+config module was being **evaluated**, inside the load, before `os migrate meta`
+reached its first conversion — the command exited 1 having rewritten nothing.
+
+The message it printed was the instruction that sent the author there. The
+sentence "Run `os migrate meta --from <N>` to rewrite existing sources
+automatically." ships **144 times across 39 files** under `packages/spec/src`, so the v17 upgrade path closed
+a loop on itself: hit a retired key, get told to run the codemod, watch the
+codemod refuse **because of** the retired key.
+
+**The fix is a tolerant load for that one command.** There was no CLI-side
+validation step to reorder — the gate lives in the loaded module — so
+`loadConfig()` gains an opt-in `authoredSource` mode that replaces each
+`@objectstack/spec` entrypoint the config imports (the root **and** the subpaths
+the example apps author through, `@objectstack/spec/ui`, `/ai`, `/data`, …) with
+a generated shim. The shim re-exports the real module and wraps its `define*`
+helpers as try-real-then-authored: the real helper runs first, and only when the
+current schema refuses the artifact is it handed on **exactly as authored**, with
+the swallowed verdict announced on stderr.
+
+Three properties keep this a restoration rather than a widening of what the
+command accepts:
+
+- **A source that loads today loads identically** — the real helper still runs,
+  so its defaults and transforms still apply (`defineForm` still moves
+  `schemaId` into `data`, `defineStack` still merges actions into objects). Only
+  the sources that are refused today take the new path.
+- **Validation is moved after the conversion, not skipped.** The command still
+  parses the **migrated** stack through `ObjectStackDefinitionSchema` and reports
+  `schemaValid`, so a source broken for reasons the chain cannot fix is still
+  reported as broken — after the codemod has done the part it can.
+- **Every other command still hears the tombstone.** `os build`, `os validate`
+  and `os serve` keep the default strict load: the rejection is their upgrade
+  channel, and only the codemod is entitled to read past it. Pinned both ways.
+
+`os migrate meta --stored` was probed and is **not** affected: it never reads
+`objectstack.config.ts` at all — it boots from the compiled artifact and replays
+the chain over `sys_metadata` rows, and it already exits 0 in a project whose
+config carries a retired key. The defect was the authored-source arm alone.
+
+The regression proof is shaped like a real project rather than like a test — the
+retired keys are authored through `defineStack` **and** through helpers imported
+from a spec subpath, which is where a tolerance scoped to `defineStack` alone
+would still have refused. The suite that shipped alongside the defect could not
+have caught it: its fixture is a bare `export default { … }` object literal, and
+a bare literal is validated by nobody at load.
@@ -0,0 +1,80 @@
+---
+"@objectstack/plugin-audit": patch
+---
+
+docs(plugin-audit): the published README stops documenting an `auditService` API, a row shape and an action vocabulary that do not exist (#9517)
+
+<!-- adr-0087: not-required (no-migration-prescription) Documentation only. No
+authorable property is added, renamed, retired or tombstoned; no schema, type or
+runtime behaviour changes. The only edited artifact is the package README, which
+ships in the package's `files` array. -->
+
+`packages/plugins/plugin-audit/README.md` is in the package's published `files`
+array and `private` is unset, so it is **what the npm package page renders**. It
+documented an API surface with no implementation anywhere in the repo, under a
+banner claiming SOC 2 / HIPAA / GDPR readiness.
+
+**Measured against `origin/main` before anything was rewritten**, and the drift
+was wider than the ledger of it:
+
+- **Every `auditService.*` method the README called is absent from the repo** —
+  `getFailedActions`, `logAdminAction`, `logDataAccess`, and also
+  `getRecordHistory`, `getUserActivity`, `searchLogs`, `getRecordSnapshot`,
+  `generateReport`, `archiveLogs`, `purgeLogs`, `logDataDeletion`,
+  `logDataExport`. Twelve methods, zero implementations. A reader following the
+  README wrote code that could not compile.
+- **`PluginAudit` does not exist**, and neither does the `.configure({...})`
+  static it was called through — no class in this repo exposes one. The export is
+  `AuditPlugin`, a `Plugin` class registered as `kernel.use(new AuditPlugin())`
+  and taking **no configuration at all**. The documented config object
+  (`trackObjects`, `trackFields`, `retentionDays`, `autoArchive`, `excludeUsers`,
+  `trackSystemEvents`) was fabricated in full.
+- **`IAuditService` is not in `@objectstack/spec/contracts`** — the README's
+  "Contract Implementation" section named an interface the spec has never
+  declared.
+- **The row shape was not the shipped one.** The README declared `timestamp`,
+  `userName`, `userEmail`, `recordName`, `changes`, `sessionId`, `status` and
+  `errorMessage`. `sys_audit_log` declares none of them.
+- **The action values were outside the enum.** `'insert'`, `'auth:login'`,
+  `'security:password_reset'`, `'workflow:approval'` and `'user_role_change'` are
+  not forms this object accepts; the namespaced-colon spelling never was one.
+- **The object name was wrong** — `audit_log`, not `sys_audit_log`.
+- **The REST namespace does not exist.** Six `/api/v1/audit/*` routes were
+  documented; the object declares `apiMethods: ['get', 'list']` and is read over
+  the ordinary object API.
+
+The compliance paragraph is **deleted, not softened or relocated**: a
+regulatory-readiness claim is a company-level statement needing an accountable
+owner, and it does not belong in a package README. The three external
+SOC 2 / GDPR / HIPAA links that existed only to support that framing are gone
+with it.
+
+The replacement documents only what the code can be pointed at: the real exports;
+the real `sys_audit_log` columns; the seven-value action enum **with the writer
+for each value**, so a reader can check any row of it; the credential masking on
+`old_value` / `new_value`; and the coverage model, which is
+**all objects minus an exclusion list** rather than the fabricated per-object
+`trackObjects` config — subtraction, because the object universe is open and an
+enumerated allow list would silently stop auditing everything registered after
+boot.
+
+Three things are now stated that the old README obscured, all of them gaps a
+reader could otherwise mistake for coverage:
+
+- **reads and views are not on the ledger** — no writer emits a read action;
+- **failed operations are not on the ledger** — there is no success/failure
+  column, and the writers fire only on `after*` events, i.e. only on operations
+  that succeeded, so `getFailedActions`-style "security monitoring" had no
+  mechanism behind it in the first place;
+- **`ip_address` / `user_agent` are populated on auth events only** — the
+  record-level writer does not stamp them, so a null client fingerprint on a CRUD
+  row does not mean the request had none.
+
+Two dependency boundaries are **named with their degraded behaviour** rather than
+left silent, following the `access-recipes.mdx` pattern: hierarchy-relative
+permission scopes need `@objectstack/security-enterprise` and **fail closed to
+`own`** without it, so a grant written to let managers read their reports' audit
+rows shows them only their own on an open build; and `lifecycle.archive` needs a
+registered `archive` datasource, **failing closed to retention** without one —
+nothing is ever deleted and the table grows, which is the safe direction for a
+ledger but not the documented one.