test(cli): pin that every always-on slate token has a serve mount; boot-level proof for package-registry

The vocabulary pin turns the prose that declined to assert the
package-registry absence into the assertion it was waiting for: every
PLATFORM_ALWAYS_ON_CAPABILITIES token keys a CAPABILITY_PROVIDERS entry
or a CAPABILITY_TO_TIER tier. The identity table gains the new row, and
a nightly e2e boots serve twice on one database to show an API-created
package survives a restart, plus a marketplace declarer mounting one
PackageServicePlugin.

Co-authored-by: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TnPAC1UsTGfHPXVUCL6iLn

Author: claude

.changeset/19387-package-registry-mount.md

@@ -0,0 +1,14 @@
+---
+'@objectstack/cli': patch
+---
+
+fix(cli): `objectstack serve` mounts the always-on `package-registry` capability, so a package created through the API survives a restart on a stock boot (#19387)
+
+Clause-②: no
+
+`package-registry` has been on the always-on slate (`PLATFORM_ALWAYS_ON_CAPABILITIES`) since the `marketplace` / `package-registry` split, and `serve` appended it to every app's `requires`. But `Serve.CAPABILITY_PROVIDERS` did not key it, and the resolver's no-provider branch says nothing about a token the app did not declare itself. So an app that did not declare `requires: ['marketplace']` got no `package` service. `POST /api/v1/packages` answered `201`, printed `no 'package' service — '…' registered in-memory only (will not survive a restart)`, and `GET /api/v1/packages/:id` answered `404` after a restart.
+
+- **`package-registry` now mounts `PackageServicePlugin`** from `@objectstack/service-package`, the provider the spec's `PLATFORM_CAPABILITY_PROVIDERS` row declares for it. A stock boot creates `sys_packages` and replays it at start, so installs and manifest edits made through the API persist.
+- **Apps that declare `marketplace` boot as before, with one `PackageServicePlugin`.** `marketplace` resolves to the same provider. The capability resolver now remembers the providers it has mounted itself, so the always-on token does not mount a second copy. Without that change, a declarer's boot would print `Plugin superseded: 'package-service'`.
+- **A stock database gains one table, `sys_packages`.** `PackageServicePlugin` creates it with raw DDL, as it already did for `marketplace` declarers. On the in-memory driver (`memory://`), which has no raw SQL, the boot now logs that the DDL was not run and that package hydration was skipped. Packages there last only as long as the process, as before.
+- `--preset minimal` still opts out of the whole slate. `protocol.installPackage` keeps its in-memory-only branch as the documented degraded path for hosts that mount no provider.

packages/cli/test/serve-capability-identity.test.ts

@@ -105,6 +105,10 @@ const EXPECTED_PROVIDER_NAME: Record<string, string> = {
   realtime: 'com.objectstack.service.realtime',
   mcp: 'com.objectstack.mcp',
   marketplace: 'package-service',
+  // Same provider as `marketplace` (#19387). The resolver's own-mount dedup
+  // relies on this: each row's identities contain the name the ONE constructed
+  // PackageServicePlugin registers, which the drift block below re-derives.
+  'package-registry': 'package-service',
   email: 'com.objectstack.service.email',
   sms: 'com.objectstack.service.sms',
   sharing: 'com.objectstack.service.sharing',

packages/cli/test/serve-capability-vocabulary.test.ts

@@ -49,16 +49,8 @@ describe('serve capability registries vs spec vocabulary (#3265)', () => {
    * `Serve.ALWAYS_ON_CAPABILITIES` is a re-export of the spec slate, so this is
    * a SURFACE pin rather than a second copy of the spec-side one: it asserts
    * the split survives the hop the CLI takes, and that hop is what decides
-   * which tokens land in an app's `requires`.
-   *
-   * ⚠️ Measured on `serve`'s resolver at c17ff70f3f and deliberately NOT
-   * asserted: `Serve.CAPABILITY_PROVIDERS` keys `marketplace` and does not yet
-   * key `package-registry`, so appending this token mounts nothing under
-   * `objectstack serve` until the runtime half of the same ruling lands
-   * (#17676 items 2/3/5, the engine lane). Pinning that ABSENCE here would
-   * turn the engine lane's own fix red for doing the ruled thing, so the gap
-   * is recorded in words and the pin states only what must hold either side of
-   * it.
+   * which tokens land in an app's `requires`. Whether an appended token then
+   * MOUNTS anything is the next pin's question.
    */
   it("appends the package-registry persistence to every app, never the catalogue half (#17676 A')", () => {
     expect(Serve.ALWAYS_ON_CAPABILITIES).toContain('package-registry');
@@ -70,6 +62,41 @@ describe('serve capability registries vs spec vocabulary (#3265)', () => {
     expect(PLATFORM_CAPABILITY_TOKENS).toContain('package-registry');
     expect(PLATFORM_CAPABILITY_TOKENS).toContain('marketplace');
   });
+
+  /**
+   * #19387 — the absence direction, which this file used to record in words
+   * only.
+   *
+   * `serve` force-appends every slate token to an app's `requires`, and then
+   * mounts a token through exactly one of two paths: a CAPABILITY_PROVIDERS
+   * entry (the `requires` resolver) or a CAPABILITY_TO_TIER entry (the
+   * dedicated tier blocks — the named list whose own docblock says why those
+   * tokens carry no provider entry). A slate token on NEITHER path passes both
+   * conjuncts of the resolver's no-provider branch — it was not declared by
+   * the app, and it is inside the vocabulary — so it mounts nothing and says
+   * nothing. That is how `package-registry` sat on the slate inert after the
+   * #17676 A' carve-out landed its spec half.
+   *
+   * ⛔ So a slate entry with no mount goes red HERE, on the pull request that
+   * adds it, rather than being noticed as a missing service after release.
+   * The spec slate and this package ship in one fixed release group, so a
+   * green pin covers every published pairing; the runtime branch is not given
+   * a warning for a case this makes unreachable.
+   */
+  it('every always-on slate token has a serve mount — a provider entry or a tier (#19387)', () => {
+    const providerTokens = new Set(Object.keys(Serve.CAPABILITY_PROVIDERS));
+    const tierTokens = new Set(Object.keys(Serve.CAPABILITY_TO_TIER));
+    // Non-vacuity: an empty slate would pass the filter below over nothing.
+    expect(Serve.ALWAYS_ON_CAPABILITIES.length).toBeGreaterThan(0);
+    const unmounted = Serve.ALWAYS_ON_CAPABILITIES.filter(
+      (token) => !providerTokens.has(token) && !tierTokens.has(token),
+    );
+    expect(
+      unmounted,
+      'always-on tokens that `serve` force-appends to every app and then mounts NOTHING for — ' +
+        'key each one in Serve.CAPABILITY_PROVIDERS at the provider PLATFORM_CAPABILITY_PROVIDERS declares',
+    ).toEqual([]);
+  });
 });
 
 // framework#3366 — the installable-provider registry must classify EVERY