Merge origin/main into claude/action-body-write-lint-4271

Conflict in validate-hook-body-writes.ts, resolved in main's favour and then
some. #4339 replaced this rule's hand-copied `SYSTEM_FIELDS` list with
`IMPLICIT_FIELDS` — derived from the spec via the package-shared
`system-fields.ts` (#4330) — which supersedes the `BODY_WRITE_SYSTEM_FIELDS`
rename this branch had introduced for the same reason. So the branch drops its
rename and exports `IMPLICIT_FIELDS` instead: the action rule shares the
derived set rather than the hand-copied one, which is strictly the outcome both
changes were after.

Author: os-zhuang

.changeset/action-body-write-set-lint.md

@@ -48,9 +48,10 @@ every exclusion is proved to be about applicability rather than an
 unextractable shape: the shared extractor still sees it, and this rule still
 reports nothing for it.
 
-One extractor, one field index, one system-column set, shared with the hook
-rule rather than copied — two copies would drift into two different answers
-about what a system column is.
+One extractor, one field index, one implicit-field set, shared with the hook
+rule rather than copied. The action rule is the same check on the other body
+surface, so a second copy of `IMPLICIT_FIELDS` would drift exactly the way the
+five hand-copied system-field lists #4330 collapsed did.
 
 The lint stays off the kernel boot path, and lands one notch tighter than the
 hook side: the only applicable pattern is rooted at `ctx.api`, so an action

.changeset/flow-executors-parse-config.md

@@ -0,0 +1,55 @@
+---
+"@objectstack/service-automation": minor
+"@objectstack/spec": minor
+---
+
+feat(automation,spec): flow executors `parse()` their config, and undeclared config keys reject at registration (#4277)
+
+The #4045 reconciliation left every flat builtin with a Zod config contract that
+nothing enforced, and #4059 left `registerFlow` warning about undeclared keys it
+could not yet safely reject. #4277 installs both halves of the enforcement:
+
+**1. Executors parse their config (execute time).** The 12 contract-carrying
+builtins — `get_record` / `create_record` / `update_record` / `delete_record`,
+`screen`, `map`, `notify`, `http`, `loop` / `parallel` / `try_catch` — now run
+`node.config` through their Zod contract before executing
+(`service-automation/builtin/parse-config.ts`). A type or missing-`required`
+violation refuses the node as a **guard** (`errorClass: 'guard'`, not routable
+via `fault` edges — config is metadata; re-running changes nothing), naming
+every violated path. `{token}` templates stay legal: string-typed slots parse
+the raw template, and `http` — whose executor reads the interpolated config —
+parses POST-interpolation, where a whole-token template has already resolved to
+its value's real type. Exemption: a legacy flat-graph `loop` (no `config.body`)
+predates the ADR-0031 construct and is not parsed.
+
+**2. Undeclared config keys are rejected at `registerFlow` (registration
+time).** The #4059 warning is now an error: a config key the node type's
+descriptor `configSchema` does not declare fails registration, with the exact
+path, the declared key set, a did-you-mean, and — for keys with documented
+history (`screen.visibleIf`, `create_record`/`update_record.fieldValues`) — a
+per-key tombstone (the `UNKNOWN_KEY_GUIDANCE` pattern). Unchanged exemptions:
+`assignment` is exempt wholesale (its top-level keys ARE the author's variable
+names), schemaless types (`decision`/`script`/`wait`/`subflow`/
+`connector_action`) declare nothing so nothing can be undeclared, and keyValue
+maps stop the walk (their keys are author data). Every `registerFlow` call site
+already try/catches per flow, so a bad stored flow is skipped loudly at boot,
+never a crashed kernel.
+
+**Contract fix folded in:** `LoopConfigSchema.collection` is now
+`z.union([z.string().min(1), z.array(z.unknown())])` — the executor has always
+accepted an inline array (shared resolve logic with `map.collection`, which
+already declared the union), so the string-only declaration under-declared what
+it reads.
+
+**Migration.** If a flow stops registering: the error names the undeclared key
+and its path — rename it to the declared key it meant (`visibleIf` →
+`visibleWhen`, `fieldValues` → `fields`), or delete it (an undeclared key was
+never read, so removing it changes no behavior). If an executor of yours
+genuinely reads the key, declare it on the node type's descriptor
+`configSchema`. If a node starts refusing at run time: the refusal names each
+violated path against the contract — fix the value's type or supply the missing
+required key (e.g. `get_record` `limit` must be a number; `screen`
+`fields[].options` entries are `{ value, label }` objects; `notify` requires
+`recipients` + `title`). Retry-policy defaults now come from the contract: a
+`try_catch` `retry` block that omits `retryDelayMs` gets the documented 1000ms
+base delay where the executor historically used 0.

.changeset/lint-system-fields-derived.md

@@ -0,0 +1,35 @@
+---
+"@objectstack/lint": patch
+---
+
+fix(lint): the seven system-field exemption lists derive from the spec's declarations (#4330)
+
+Five rules in `@objectstack/lint` each carried their own hand-copy of
+"registry-injected columns present on almost every object but absent from
+authored `fields`" — and they had already drifted from one another (two more
+copies had appeared by the time the fix landed). This is the shape #3786
+removed from the audit-provenance family, rebuilt one package over: the same
+list, maintained in parallel, each under a comment asking to be kept in sync
+with one of the others.
+
+The package now has one module, `system-fields.ts`, whose `SYSTEM_FIELDS` is
+DERIVED from the spec's two declarations — `FIELD_GROUP_SYSTEM_FIELDS`
+(`@objectstack/spec/data`) and `SystemFieldName` (`@objectstack/spec/system`)
+— and all seven field-resolving rules consume it. A pin test holds the
+boundary in both directions: the set contains exactly the two declarations'
+union, and none of the rule-local exemptions.
+
+Two deliberate behavior consequences, both in the permissive direction the
+rules' own comments argue for (over-inclusion costs at worst a missed
+warning; under-inclusion costs a false one):
+
+- `widget-bindings`, `page-field-bindings` and `react-page-props` now also
+  exempt `is_deleted`;
+- `flow-template-paths` now also exempts `user_id`.
+
+Names that are NOT system columns in the spec's sense (`name`, `owner`,
+`record_type`, and the legacy physical spellings `_id` / `space`) stay
+rule-local next to the reason each rule exempts them, instead of widening
+every rule: `name` in particular is an ordinary authored field on most
+objects, and exempting it package-wide would stop the field-existence rules
+from catching a reference to a field the object genuinely does not have.

.changeset/react-listview-searchable-fields-lint.md

@@ -0,0 +1,35 @@
+---
+"@objectstack/lint": minor
+---
+
+feat(lint): `<ListView searchableFields>` on a react page is checked against
+the bound object's fields (#4329)
+
+#4328's `searchable-field-unknown` gates a stale `searchableFields` entry on
+the metadata surfaces — an object's own ADR-0061 declaration, its built-in
+named list views, and a `defineView` aggregate's default `list` / named
+`listViews`. It did not cover the react page surface: `ListView` declares
+`searchableFields` as a dataProp, so a `kind:'react'` page could write
+`<ListView searchableFields={['renamed_field']}>` and nothing resolved the
+name. The failure is the one #4328 documents — the engine's
+`resolveSearchFields` silently filters the stale name out, so the search scans
+a narrower set than the page asked for, or (once every entry is stale) falls
+through to the auto-default and scans a wider one; and once the REST read path
+validates the `$searchFields` override (#4254), the prop objectui echoes
+verbatim becomes a `400 INVALID_FIELD` on that list.
+
+The check lives in `validate-react-page-props` — the gate that already parses
+the page's real JSX — and runs on `<ListView>` usages whose `objectName` and
+`searchableFields` are static literals, under the same rule id and severity
+(`searchable-field-unknown`, `error`) as the metadata surfaces. It is not a
+re-implementation: `validate-searchable-fields` now exports its core
+(`indexObjectSearchTargets` + `checkSearchableFieldList`), and the react gate
+runs that, so the two surfaces agree on what counts as a field by construction
+— same three skips (an object this stack does not define, an object with no
+authored field map, registry-injected system columns derived from the spec's
+own declarations), same dotted-path strictness (search matches the field map
+by exact string, so `owner_id.name` is flagged, not exempted).
+
+JSX-specific seams follow the gate's existing rules: a value that comes from a
+variable, a call, or a spread is not knowable at build time and is skipped
+silently — an unresolvable binding is not a wrong one (ADR-0072 D1).

.changeset/retire-dev-service-marker.md

@@ -0,0 +1,39 @@
+---
+'@objectstack/spec': major
+---
+
+**BREAKING**: the legacy `_dev: true` service marker is retired. `readServiceSelfInfo()`
+now reads exactly one marker — the standard `__serviceInfo` descriptor — and the
+`SERVICE_DEV_MARKER_KEY` export is removed.
+
+FROM → TO, for any service that self-identifies as not-fully-real:
+
+```ts
+// FROM — normalized to { status: 'stub', handlerReady: false }
+const svc = { _dev: true, chat };
+
+// TO — say which kind of unreal it is
+const svc = {
+  __serviceInfo: {
+    status: 'stub',        // 'stub' = fabricates answers | 'degraded' = really serves, reduced capability
+    message: 'Development stub — register <PluginName> for a real implementation',
+  },
+  chat,
+};
+```
+
+`handlerReady` defaults to `false` for `stub` and `true` for `degraded`; set it
+explicitly when the slot has no HTTP surface at all (`cache` / `queue` / `job`).
+
+**Why it matters if you skip the migration:** a service still carrying `_dev: true`
+reads as *unmarked* — i.e. as fully real — so discovery will report it
+`status: 'available', handlerReady: true`, and dispatcher domains will call it
+instead of refusing it. That is the "fake reported as real" failure ADR-0076 D12
+exists to prevent, so migrate rather than leave the marker in place.
+
+Removing rather than aliasing is deliberate: a boolean cannot express the
+`stub` / `degraded` split every consumer gates on (a stub's domain refuses it, a
+degraded implementation's domain keeps serving it). No producers remained in this
+repo when the reader was deleted — plugin-dev's stub table was retired in
+ADR-0115, and the kernel's in-memory fallbacks moved onto the descriptor in the
+same lineage.

.changeset/retire-inert-driver-plugin-options.md

@@ -0,0 +1,33 @@
+---
+"@objectstack/runtime": major
+"@objectstack/cli": patch
+---
+
+feat(runtime)!: retire the inert `DriverPluginOptions` — `DriverPlugin` takes `(driver, driverName?)` (#4320)
+
+`new DriverPlugin(driver, { datasourceName, registerAsDefault })` never did
+what it promised: both options configured a datasource-registration block in
+`start()` gated on `metadata.addDatasource`, a method **no metadata service
+implements** — so the block early-returned on every boot since inception and
+the options were dead weight (found while typing service lookups for #4251).
+
+**Migration** — delete the options argument; nothing changes at runtime
+because nothing ever happened:
+
+- FROM `new DriverPlugin(driver, { datasourceName: 'x', registerAsDefault: false })`
+  TO `new DriverPlugin(driver)`
+- FROM `new DriverPlugin(driver, 'name', options)` TO `new DriverPlugin(driver, 'name')`
+- The string second argument (`new DriverPlugin(driver, 'memory')`) is unchanged.
+
+If you passed `datasourceName` expecting routing to a named auxiliary driver:
+that routing never came from the option. It keys off the **driver name** —
+`DriverPlugin.init()` registers `driver.<name>`, ObjectQL's discovery loop
+adopts it, and the engine's lifecycle/datasource resolution looks the name up
+(see the telemetry provision in `os serve` for the pattern: stamp
+`driver.name`, register the plugin, done). For Setup → Datasources visibility,
+declare the datasource through `DatasourceConnectionService` /
+`registerInMemory('datasource', …)` (ADR-0062).
+
+The `DriverPluginOptions` interface was module-local (never exported from the
+package root), so the only public break is the constructor's second/third
+argument shape.

.changeset/schemaless-node-config-contracts.md

@@ -0,0 +1,43 @@
+---
+"@objectstack/spec": minor
+"@objectstack/service-automation": patch
+---
+
+feat(spec,automation): publish executor-derived config contracts for the schemaless flow nodes (#4278)
+
+The five descriptor-schemaless builtins (`decision` / `script` / `subflow` /
+`wait` / `connector_action`) deliberately publish no `configSchema`, so their
+Studio form lives only in objectui's hand-written `FLOW_NODE_CONFIG` table —
+and nothing reconciled that table against the executors. `script` had drifted:
+the form offered an `outputVariables` key nothing reads, two `actionType`
+options (`sms` / `notification`) that fail every run, a no-op default (`code`),
+and could not author the `function` / `inputs` / `outputVariable` path that
+works.
+
+New in `@objectstack/spec/automation` — contract exports only. Unlike their
+`builtin-node-config.zod.ts` siblings, which #4277 wired into execute-time
+parsing, no engine path `parse()`s node config with these: `script`'s legal key
+set depends on `actionType` and `decision` may branch purely on edge
+predicates, so a flat parse would either reject valid shapes or check nothing.
+Their enforcement is the objectui reconciliation test.
+
+- `ScriptConfigSchema` / `SubflowConfigSchema` / `DecisionConfigSchema` (+
+  `DecisionConditionSchema`) — written from the executors in
+  `service-automation`, the machine-readable half of the cross-repo
+  reconciliation objectui's `flow-node-config` test now performs. `wait` and
+  `connector_action` need no new schema — their contracts are the existing
+  `FlowNodeSchema` sibling blocks (`waitEventConfig` / `connectorConfig`).
+- `SCRIPT_BUILTIN_ACTION_TYPES` (`['email', 'slack']`) and
+  `SCRIPT_INVOKE_FUNCTION_ACTION_TYPE` (`'invoke_function'`) — the `script`
+  executor now builds its dispatch set from the published constant, so the
+  designer's options, the dispatch set, and the "not a built-in action"
+  failure message can no longer disagree.
+
+Undeclared-alias graduation in the same change (Prime Directive #12, the
+`map.flow` path): the `subflow` executor's bare `cfg.flowName ?? cfg.flow`
+fallback is deleted, replaced by the ADR-0087 D2 conversion
+`flow-node-subflow-flow-alias` — a stored `subflow` node authored with
+`config.flow` is rewritten to the canonical `config.flowName` at load
+(including the `AutomationEngine.registerFlow` rehydration seam). FROM
+`config.flow` TO `config.flowName`; one-line fix for hand-maintained sources:
+rename the key.

.changeset/slot-lookup-type-argument-ratchet.md

@@ -0,0 +1,32 @@
+---
+"@objectstack/spec": patch
+"@objectstack/runtime": patch
+---
+
+fix(spec,runtime): the service-lookup `any` guard now sees the type-argument form, and its scope stops at nothing under `packages/` (#4251)
+
+The #4127/#4214 rule banned `: any` and `as any` on a service-lookup result but
+not `getService<any>('data')` — the form the codebase actually used (80 sites,
+zero matches), erasing the slot contract identically. And the rule's `files`
+covered only `packages/runtime`, leaving the composition roots (rest,
+plugins/*, services/*) that hold most lookups unlinted. Both gaps closed: a
+third AST selector catches the type-argument form, the scope is now all of
+`packages/`, and the 40 not-yet-swept files are grandfathered in a visible,
+shrinking ratchet list (`SLOT_LOOKUP_UNSWEPT`) — enumerated at 180 sites by
+running the widened rule with the list emptied. `http.server` joins
+`UNCONTRACTED_SLOTS` (three providers, no written contract).
+
+Typing the three in-scope runtime sites surfaced its first yield: both
+`addDatasource` datasource-registration branches (DefaultDatasourcePlugin,
+DriverPlugin) probed a method **no metadata service implements**, so they had
+never run on any boot — deleted rather than typed against a phantom shape. The
+inert `DriverPluginOptions` they configured are tracked in #4320.
+`registerInMemory('datasource', …)` is the actual visibility path (#3827).
+
+Contract members declared from evidence, both optional: `IDataEngine` gains
+`getDefaultDriverName?()` / `getDriverByName?()` (ObjectQL's driver registry —
+the surface `os migrate` and serve's storage detection reach through
+`driver.<name>` services), `IMetadataService` gains `registerInMemory?()`
+(MetadataManager's boot-time seeding primitive). Callers that supplied `<any>`
+to these lookups should pass the slot's contract type instead — or nothing:
+an unmapped slot deliberately resolves to `unknown`, not `any`.

.changeset/stall-forensics-and-kernel-test-hygiene.md

@@ -0,0 +1,4 @@
+---
+---
+
+ci/test: #4250 stall forensics (SIGUSR2 stack harvest in run-with-stall-guard) + objectql kernel tests stop intercepting worker SIGTERM. Releases nothing.

.changeset/strip-read-decorations-on-save.md

@@ -0,0 +1,33 @@
+---
+"@objectstack/metadata-protocol": patch
+---
+
+fix(metadata-protocol): read decorations stop round-tripping into persisted metadata bodies (#4326)
+
+`getMetaItem` / `getMetaItems` decorate every served document with
+`_diagnostics` (and `_draft` on preview reads), while the write path persists
+the request body **verbatim** by design (ADR-0005 §Validation — `parsed.data`
+would strip Studio-only auxiliary fields). Nothing stripped the decorations in
+between, so the standard designer round-trip — GET the served document, edit a
+field, PUT the whole body back — baked a stale read-time verdict into
+`sys_metadata.metadata`, into its checksum, and into every history diff.
+
+It was never user-visible: reads recompute `_diagnostics` and the fresh verdict
+shadows the persisted one. What it corrupted was the stored bytes — a
+decoration-only re-save moved the content checksum, and history diffs carried
+diagnostic noise no author wrote.
+
+`saveMetaItem` now strips `_diagnostics` and `_draft` from the body before the
+destructive-change diff, the schema gate, the authoring gate, and persistence
+(new `stripReadDecorations`, exported for tests). A **silent** strip, unlike the
+neighbouring layered-envelope rejection: those keys are our own decoration
+riding on a document that is otherwise exactly what the author edited, so
+rejecting the round-trip would be hostile. The ADR-0010 protection envelope
+(`_lock`, `_lockReason`, `_provenance`) and `_packageId` are deliberately left
+alone — envelope state the write path legitimately carries, not read decoration.
+
+Also documents the #3903 conversion boundary on `SysMetadataRepository.get`:
+its body stays verbatim because every caller wants the bytes a hash was
+computed over (parent-version lineage, existence probes) or is diffing against
+equally-verbatim history rows — conversion belongs one layer up, at the
+protocol's serving seams.