fix(runtime): mount the in-app notifications REST routes (ADR-0030)

handleNotification (GET /notifications, POST /notifications/read[/all]) and its
discovery entry existed, but dispatcher-plugin never registered server.<verb>()
mounts for them — so only the cloud hosts' hono catch-all reached the handler;
the standalone / `os dev` server 404'd every /api/v1/notifications* request.

That was the real reason unread notifications never cleared: the console's
direct sys_notification_receipt write is rejected by ADR-0103's engine-owned
gate, and this REST fallback — the intended path — was unreachable. Mounting
the three routes makes mark-read persist in every deployment. Guarded by the
dispatcher-plugin route-registration regression test.

Verified end-to-end in the showcase example: POST /notifications/read/all → 200,
receipts flip delivered→read server-side, and the bell badge stays cleared
across the inbox poll (previously it flipped every row back to unread).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: baozhoutao

.changeset/localize-collab-notifications-and-storage-objects.md

@@ -1,12 +1,14 @@
 ---
 "@objectstack/plugin-audit": patch
 "@objectstack/service-storage": patch
+"@objectstack/runtime": patch
 ---
 
-feat(i18n): localize collaboration notification titles and the storage objects
+feat(i18n): localize collaboration notification titles and the storage objects; wire the notifications REST routes
 
-Two gaps left the notification surface English-only on localized workspaces
-(observed as `sys_file "repro.png" assigned to you` over an all-Chinese UI):
+Three gaps behind one report (a `sys_file "repro.png" assigned to you`
+notification that was English on an all-Chinese workspace, opened an English
+detail page, and never cleared its unread state):
 
 - **plugin-audit** — the assignment (`collab.assignment`) and @mention
   (`collab.mention`) bell titles were hardcoded English literals built from the
@@ -28,3 +30,14 @@ Two gaps left the notification surface English-only on localized workspaces
   `i18n.loadTranslations` on `kernel:ready`, matching service-messaging.
   (`sys_attachment` stays in platform-objects' bundles pending the
   storage-domain decomposition.)
+
+- **runtime** — the in-app notifications REST surface (`GET
+  /api/v1/notifications`, `POST /api/v1/notifications/read`, `POST
+  /api/v1/notifications/read/all`; ADR-0030) had its `handleNotification`
+  dispatch branch and discovery entry, but no `server.<verb>()` mount in
+  `dispatcher-plugin`, so only the cloud hosts' hono catch-all reached it — the
+  standalone / `os dev` server 404'd every request. That left mark-read with no
+  working endpoint (the console's direct `sys_notification_receipt` write is
+  rejected by ADR-0103's engine-owned gate), so unread notifications could never
+  clear. The three routes are now mounted explicitly, guarded by the
+  route-registration regression test.

packages/runtime/src/dispatcher-plugin.routes.test.ts

@@ -89,6 +89,23 @@ describe('createDispatcherPlugin — HTTP route registration', () => {
     expect(routes).toContain('POST /api/v1/packages');
   });
 
+  // Regression: the in-app notifications surface (ADR-0030) — inbox list +
+  // receipt mark-read — had a `handleNotification` dispatch() branch and a
+  // discovery entry, but NO server.<verb>() registration, so every
+  // `/api/v1/notifications*` request 404'd on the standalone / `os dev` server
+  // (only the cloud hosts' hono catch-all reached it). That left mark-read with
+  // no working endpoint — the console's direct receipt write is rejected by
+  // ADR-0103's engine-owned gate — so unread notifications could never clear.
+  it('mounts /notifications (GET list, POST read, POST read/all) so mark-read reaches dispatch()', async () => {
+    const { server, routes } = makeFakeServer();
+    const plugin = createDispatcherPlugin({ prefix: '/api/v1', securityHeaders: false });
+    await plugin.start?.(makeCtx(server));
+
+    expect(routes).toContain('GET /api/v1/notifications');
+    expect(routes).toContain('POST /api/v1/notifications/read');
+    expect(routes).toContain('POST /api/v1/notifications/read/all');
+  });
+
   it('also mounts a known existing route (sanity that start() ran)', async () => {
     const { server, routes } = makeFakeServer();
     const plugin = createDispatcherPlugin({ prefix: '/api/v1', securityHeaders: false });

packages/runtime/src/dispatcher-plugin.ts

@@ -691,6 +691,43 @@ export function createDispatcherPlugin(config: DispatcherPluginConfig = {}): Plu
                 }
             });
 
+            // ── In-app notifications (ADR-0030) ─────────────────────────
+            // The inbox list + receipt mark-read surface backed by the
+            // messaging service. `handleNotification` + its discovery entry
+            // already existed, but only the cloud hosts' @objectstack/hono
+            // catch-all reached it — the standalone / `os dev` server mounts
+            // ONLY the explicit routes here, so every `/api/v1/notifications*`
+            // request 404'd (mark-read had no working endpoint: the console's
+            // direct receipt write is rejected by ADR-0103's engine-owned
+            // gate, and this REST fallback was unreachable). Mount them
+            // explicitly so read-state actually persists in every deployment.
+            server.get(`${prefix}/notifications`, async (req: any, res: any) => {
+                try {
+                    const result = await dispatcher.dispatch('GET', '/notifications', undefined, req.query, { request: req });
+                    sendResult(result, res);
+                } catch (err: any) {
+                    errorResponse(err, res);
+                }
+            });
+
+            server.post(`${prefix}/notifications/read`, async (req: any, res: any) => {
+                try {
+                    const result = await dispatcher.dispatch('POST', '/notifications/read', req.body, req.query, { request: req });
+                    sendResult(result, res);
+                } catch (err: any) {
+                    errorResponse(err, res);
+                }
+            });
+
+            server.post(`${prefix}/notifications/read/all`, async (req: any, res: any) => {
+                try {
+                    const result = await dispatcher.dispatch('POST', '/notifications/read/all', req.body, req.query, { request: req });
+                    sendResult(result, res);
+                } catch (err: any) {
+                    errorResponse(err, res);
+                }
+            });
+
             // ── Packages ────────────────────────────────────────────────
             // Single pipeline (ADR-0076 D11 / OQ#9): every package route flows
             // through dispatch() — like analytics / i18n / automation / AI —