fix(#4509): three auth-gate disconnects close — email_template bridges, job and validation close their doors (#4558)

* feat(email): materialize declared email_template metadata into sys_email_template (#4509)

Authoring an `email_template` was a silent no-op. `sendTemplate` resolves
`(name, locale)` against sys_email_template ROWS, whose only writers were the
built-in auth templates plus a code-constructed `EmailServicePluginOptions.
templates` that no bootstrapper passed — while every door an author can use
(stack `emailTemplates:`, `*.email-template.ts`, Studio, PUT /meta) parked items
in a metadata store nothing read back. An admin could "fix" the password-reset
mail in Studio and users kept receiving the built-in copy: ADR-0078 false
compliance on AUTH mail. Webhook #3461's shape, closed the same way (ADR-0049
enforce-or-remove, route: enforce).

`bootstrapDeclaredEmailTemplates` materializes declared items at boot, validating
each through EmailTemplateDefinitionSchema.parse() and projecting with
`mapTemplateToRow` — the SAME mapping the built-in seeder uses, extracted and
shared so the two doors cannot drift. Because email_template is
allowRuntimeCreate:true (unlike webhook), the plugin also subscribes to metadata
changes and re-materializes the changed item, so a Studio save takes effect
without a restart; a withdrawn template deactivates its rows rather than losing
them.

Three breaks sat on this path, and closing any two would still have shipped a
template that never sent:
- objectql never registered a manifest's `emailTemplates:` into the registry at
  all — the key was missing from the generic ingestion list, so the bridge's own
  source was empty.
- Built-in seeds left `managed_by` at the column's 'admin' default, masquerading
  as admin-authored; since the bridge refuses to overwrite admin rows, a built-in
  would permanently outrank the template an app declared. Built-ins now stamp
  'platform'.
- Nothing materialized declared metadata into rows.

Seed-not-clobber mirrors sys_webhook (#3489): sys_email_template gains
managed_by/customized, declared rows re-seed as 'package', and an admin-created
or admin-edited row is never overwritten. Separate axis from `is_system`, which
keeps its meaning for built-ins.

Ledger email_template flips 13 dead → fully live, with an ADR-0054 proof bound on
`subject`: it boots a real stack, authors a template overriding a built-in auth
template, and asserts the AUTHORED wording reaches the transport.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E5CYr5SDwe85gH2Jr5KSgu

* feat(spec)!: close the job runtime-create gate — a job is a code artifact (#4509)

A `job` created at runtime could never be scheduled. `JobSchema.handler` names a
function in the compiled bundle's function table — the schema says so, and the
scheduler is built that way: AppPlugin sources jobs from `bundle.jobs` alone and
resolves handlers through `collectBundleFunctions(bundle)`. Yet the type was
registered allowRuntimeCreate:true (and allowOrgOverride:true), so a job authored
in Studio or via PUT /meta parsed, saved, reported success, and never ran.

Unlike the sibling disconnects in this batch, this one cannot be bridged: the
runtime writer does not have the bundle and cannot name a function inside it. The
missing piece is a handler-binding design, not an ingestion path. Per ADR-0049
enforce-or-remove the honest move is to close the door — both flags now false,
with a rationale block modeled on the `agent` entry stating what re-opening would
require.

`job` stays a first-class authorable type: `*.job.ts` and `defineStack({ jobs })`
are the supported doors and are fully enforced, so the kind still passes the
ADR-0088 admission test and stays registered.

Also restamps job.json's evidence lines, which pointed at app-plugin.ts:767-791
and had drifted ~25 lines — the gate resolves paths, not line numbers, which is
exactly the rot `verifiedAt` exists to catch.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E5CYr5SDwe85gH2Jr5KSgu

* chore(i18n): regenerate object bundles for the sys_email_template provenance columns (#4509)

Follow-up to the materializer bridge: `managed_by` / `customized` on
sys_email_template are new translatable field labels, so the nine locale bundles
had drifted from the schema. `node scripts/check-i18n-bundles.mjs --write`
(merge mode — no existing translation overwritten).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E5CYr5SDwe85gH2Jr5KSgu

* feat(spec)!: retire the standalone validation metadata kind (#4509, ADR-0088)

A validation rule authored as its own artifact bound to nothing and gated no
write. ValidationRuleSchema carries no object-binding key — no `object`, no
`objectName` — and all six variants are strictObject, so an author could not
supply one either. No merge step existed; the only code expecting such a key was
a reference-tracker row scanning a field the schema would have stripped.
Meanwhile the engine evaluates exactly one shape: the object's own
`validations[]`, on insert and on every matched update row.

So a rule created through the standalone door (*.validation.ts, or Studio's
Validations list) parsed, saved, reported success, and intercepted nothing —
including a state_machine rule, which ADR-0020 routes through this same
vocabulary. An author could believe they had locked down record state
transitions and have changed nothing.

Under ADR-0088 the kind fails the admission test on its first clause: a rule has
no independent lifecycle, because it only means something against an object. And
unlike the sibling disconnects in this batch it could not be bridged into one —
the shape has nowhere to name its object. Enforce-or-remove picks ENFORCE where
the feature exists and only wiring is missing (email_template), REMOVE where the
shape cannot carry the feature.

The rule VOCABULARY is untouched: ValidationRuleSchema and all six variants are
unchanged and fully live, and the engine's evaluation path is not modified. The
ledger keeps governing the schema through the gate's SPEC_ONLY_SCHEMAS override
(alongside webhook and query) — an ungoverned live schema is how the next drift
would hide.

Removed: registry entry (with its file patterns), MetadataTypeSchema member,
metadata-core lockstep enum member, schema-map entry, create seed, Studio nav
item + hand-crafted form + its four locale strings, and the dangling
reference-tracker row. Stored standalone rows are left alone — never evaluated,
so nothing changes behaviorally.

Also restamps validation.json's engine evidence lines (drifted ~220 lines) and
adds the ADR-0088 addendum recording the retirement.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E5CYr5SDwe85gH2Jr5KSgu

* chore(liveness): record the nav action dispatch gap as closed (#4509)

app.json's type note carried the one gap the AppSchema navigation walk found by
hand: an `action` item rendered and gated like any other while its click went to
an `onAction` prop no shipped shell passed. objectui @e8bec83 wires it — the
sidebar resolves the action name against metadata and dispatches through the
console action runtime, and a shell that still passes no handler now hides
action items instead of rendering them dead.

Re-pins the objectui evidence (the old pin @940ba24 predates the fix) and dates
the row.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E5CYr5SDwe85gH2Jr5KSgu

* fix(email): type the metadata slot lookup so the ratchet holds (#4509)

CI's slot-lookup ratchet caught the bridge's `ctx.getService('metadata')`:
email-plugin.ts is grandfathered for its three existing erasures, and a new
untyped lookup pushed it to four. Pass the slot's contract type
(`IMetadataService`) as #4251 asks — which also gives the subscribe/get calls a
real type instead of `any`.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E5CYr5SDwe85gH2Jr5KSgu

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-zhuang

.changeset/email-template-materializer-bridge.md

@@ -0,0 +1,60 @@
+---
+"@objectstack/platform-objects": minor
+"@objectstack/plugin-email": minor
+"@objectstack/objectql": minor
+"@objectstack/spec": patch
+---
+
+feat(email): declared email templates reach the mail service (#4509)
+
+Authoring an `email_template` was a silent no-op. `EmailService.sendTemplate`
+resolves `(name, locale)` against **`sys_email_template` rows**, and the only
+writers of those rows were the built-in auth templates plus a code-constructed
+`EmailServicePluginOptions.templates` that no bootstrapper ever passed. Every
+door an author can actually use — a stack's `emailTemplates:`, an
+`*.email-template.ts` file, Studio's metadata-admin list, `PUT /meta` — parked
+items in a metadata store nothing read back. So an admin could "fix" the
+password-reset email in Studio, get a success toast, and watch users keep
+receiving the built-in copy: ADR-0078 false compliance on **authentication
+mail**. This is the shape #3461 had for webhooks, closed the same way (ADR-0049
+enforce-or-remove, route: enforce).
+
+**`bootstrapDeclaredEmailTemplates`** now materializes declared templates into
+`sys_email_template` at boot. Each item is validated through
+`EmailTemplateDefinitionSchema.parse()` — the spec schema finally has a real
+consumer, defaults and all — and projected with `mapTemplateToRow`, which is the
+**same** mapping the built-in seeder uses, extracted and shared so the two doors
+cannot drift apart. A malformed template warns and is skipped rather than
+crashing boot.
+
+**Runtime writes take effect immediately.** Unlike `webhook`, `email_template`
+is `allowRuntimeCreate: true`, so a boot-only bridge would have left a Studio
+save inert until the next restart — the same bug, half-fixed. The plugin also
+subscribes to `email_template` metadata changes and re-materializes the single
+changed item; withdrawing a template deactivates its rows (across locales)
+rather than deleting them.
+
+**Three breaks sat on this path, not one**, and closing any two of them would
+still have shipped a template that never sent:
+
+- `@objectstack/objectql` never registered a manifest's `emailTemplates:` into
+  the metadata registry at all — the key was simply missing from the generic
+  ingestion list, so the bridge's own source was empty.
+- The built-in seeder left `managed_by` at the column's `'admin'` default, which
+  made platform templates masquerade as admin-authored. Since the bridge refuses
+  to overwrite admin rows, a built-in would have permanently outranked the
+  template an app declared. Built-ins now stamp `managed_by: 'platform'`.
+- Nothing materialized declared metadata into rows.
+
+**Seed-not-clobber** mirrors `sys_webhook` (#3489) and `sys_sharing_rule`
+(#2909): `sys_email_template` gains `managed_by` / `customized`. Declared
+templates re-seed every boot as `managed_by: 'package'`; a row an admin created
+(`admin`) or edited (`customized`, stamped by a `beforeUpdate` hook) is never
+overwritten, so reworded transactional mail survives redeploys. This is a
+separate axis from `is_system`, which keeps its existing meaning for built-ins.
+
+The `email_template` liveness ledger flips from 13 dead properties to fully
+live, with an ADR-0054 runtime proof bound on `subject`
+(`email-template-materialization`): it boots a real stack, authors a template
+that overrides a built-in auth template, and asserts the **authored** wording is
+what reaches the transport.

.changeset/job-runtime-create-closed.md

@@ -0,0 +1,40 @@
+---
+"@objectstack/spec": major
+---
+
+feat(spec)!: `job` is a code artifact — runtime creation and org overrides are withdrawn (#4509)
+
+A `job` metadata item created at runtime could never be scheduled. `JobSchema.handler`
+names a function in the **compiled bundle's function table** — the schema says so
+("must match a key in `defineStack({ functions })`") and the scheduler is built that
+way: `AppPlugin` sources jobs from `bundle.jobs` alone and resolves each handler
+through `collectBundleFunctions(bundle)`, skipping any job whose handler is not in
+that table. Yet the type was registered `allowRuntimeCreate: true` (and
+`allowOrgOverride: true`), so a job authored in Studio or through `PUT /meta` parsed,
+saved, reported success — and never ran.
+
+Unlike the sibling disconnects closed in this batch, this one **cannot be bridged**.
+The runtime writer does not have the bundle and cannot name a function inside it; the
+missing piece is a handler-binding design, not an ingestion path. Under ADR-0049
+enforce-or-remove, the honest move is to close the door:
+
+- `allowRuntimeCreate: false` — no "create job" in Studio or via `PUT /meta`.
+- `allowOrgOverride: false` — no per-org job fork, which was unreachable for the same
+  reason.
+
+**`job` remains a first-class authorable type.** `*.job.ts` / `*.job.yml` /
+`*.job.json` files and `defineStack({ jobs })` are the supported doors, and they are
+fully enforced — every schedule shape, `retryPolicy`, `timeout` and `enabled` reach
+the scheduler. The kind stays in the metadata registry because its file loader is
+genuinely consumed (ADR-0088 admission test).
+
+**If you were creating jobs at runtime:** move the definition into your stack
+(`defineStack({ jobs, functions })`) so the handler resolves against a real function.
+Rows already in `sys_metadata` are left untouched — they were never scheduled, so
+nothing changes behaviorally; `migrateStoredMetadata` now reports them `skipped`, the
+same way it does for `agent`.
+
+Re-opening the type means constraining `handler` to something a runtime writer can
+name — an already-registered flow, or a named and separately governed function — and
+building the bridge to `IJobService.schedule`. Flipping the flag without that work
+just restores the silent no-op.

.changeset/validation-kind-retired.md

@@ -0,0 +1,55 @@
+---
+"@objectstack/spec": major
+"@objectstack/metadata-core": major
+"@objectstack/metadata-protocol": minor
+"@objectstack/platform-objects": minor
+---
+
+feat(spec)!: retire the standalone `validation` metadata kind (#4509, ADR-0088)
+
+A validation rule authored as its own artifact bound to nothing and gated no
+write. `ValidationRuleSchema` carries **no object-binding key** — no `object`,
+no `objectName` — and all six variants are `strictObject`, so an author could
+not supply one either. No merge step existed. The only code that expected such a
+key was a reference-tracker row scanning a field the schema would have stripped.
+Meanwhile the engine evaluates exactly one shape: the object's own
+`validations[]` array, on insert and on every matched update row.
+
+So a rule created through the standalone door — a `*.validation.ts` file, or
+Studio's Validations list — parsed, saved, reported success, and intercepted
+nothing. Including a `state_machine` rule, which ADR-0020 routes through this
+same vocabulary: an author could believe they had locked down record state
+transitions and have changed nothing at all.
+
+Under ADR-0088 the kind fails the admission test on its first clause: a rule has
+no independent lifecycle, because it only means something against an object. And
+unlike the sibling disconnects closed in this batch, it could not be bridged into
+one — the shape has nowhere to name its object.
+
+**The rule vocabulary is untouched.** `ValidationRuleSchema` and all six
+variants are unchanged and fully live; the engine's evaluation path is not
+modified by this change. It is the *kind* that was inert, not the schema. The
+liveness ledger keeps governing it through the gate's `SPEC_ONLY_SCHEMAS`
+override (alongside `webhook` and `query`), because an ungoverned live schema is
+exactly how the next drift would hide.
+
+**Migration.** Move the rule into the owning object's `validations:` array — the
+rule body is identical, same schema, same six variants:
+
+```ts
+// before — a standalone *.validation.ts, which never ran
+export default defineValidation({ name: 'amount_positive', type: 'script', … })
+
+// after — on the object, where rules are evaluated
+ObjectSchema.create({
+  name: 'invoice',
+  validations: [{ name: 'amount_positive', type: 'script', … }],
+})
+```
+
+Removed: the registry entry (and its `*.validation.ts` / `*.validation.yml`
+patterns), the `MetadataTypeSchema` member, the metadata-core lockstep enum
+member, the schema-map entry, the create seed, Studio's Validations nav item and
+its hand-crafted form, and the dangling reference-tracker row. Standalone rows
+already in `sys_metadata` are left alone — they were never evaluated, so nothing
+changes behaviorally.

content/docs/references/api/metadata.mdx

@@ -328,7 +328,7 @@ Metadata query with filtering, sorting, and pagination
 
 | Property | Type | Required | Description |
 | :--- | :--- | :--- | :--- |
-| **types** | `Enum<'object' \| 'field' \| 'validation' \| 'hook' \| 'seed' \| 'mapping' \| 'view' \| 'page' \| 'dashboard' \| 'app' \| 'action' \| 'report' \| 'dataset' \| 'flow' \| 'job' \| 'datasource' \| 'external_catalog' \| 'translation' \| 'email_template' \| 'doc' \| 'book' \| 'permission' \| 'position' \| 'agent' \| 'tool' \| 'skill'>[]` | optional | Filter by metadata types |
+| **types** | `Enum<'object' \| 'field' \| 'hook' \| 'seed' \| 'mapping' \| 'view' \| 'page' \| 'dashboard' \| 'app' \| 'action' \| 'report' \| 'dataset' \| 'flow' \| 'job' \| 'datasource' \| 'external_catalog' \| 'translation' \| 'email_template' \| 'doc' \| 'book' \| 'permission' \| 'position' \| 'agent' \| 'tool' \| 'skill'>[]` | optional | Filter by metadata types |
 | **namespaces** | `string[]` | optional | Filter by namespaces |
 | **packageId** | `string` | optional | Filter by owning package |
 | **search** | `string` | optional | Full-text search query |
@@ -363,7 +363,7 @@ Metadata query with filtering, sorting, and pagination
 
 | Property | Type | Required | Description |
 | :--- | :--- | :--- | :--- |
-| **type** | `Enum<'object' \| 'field' \| 'validation' \| 'hook' \| 'seed' \| 'mapping' \| 'view' \| 'page' \| 'dashboard' \| 'app' \| 'action' \| 'report' \| 'dataset' \| 'flow' \| 'job' \| 'datasource' \| 'external_catalog' \| 'translation' \| 'email_template' \| 'doc' \| 'book' \| 'permission' \| 'position' \| 'agent' \| 'tool' \| 'skill'>` | ✅ | Metadata type |
+| **type** | `Enum<'object' \| 'field' \| 'hook' \| 'seed' \| 'mapping' \| 'view' \| 'page' \| 'dashboard' \| 'app' \| 'action' \| 'report' \| 'dataset' \| 'flow' \| 'job' \| 'datasource' \| 'external_catalog' \| 'translation' \| 'email_template' \| 'doc' \| 'book' \| 'permission' \| 'position' \| 'agent' \| 'tool' \| 'skill'>` | ✅ | Metadata type |
 | **name** | `string` | ✅ | Item name (snake_case) |
 | **data** | `Record<string, any>` | ✅ | Metadata payload |
 | **namespace** | `string` | optional | Optional namespace |

content/docs/references/kernel/metadata-plugin.mdx

@@ -130,7 +130,7 @@ const result = MetadataBulkRegisterRequest.parse(data);
 | Property | Type | Required | Description |
 | :--- | :--- | :--- | :--- |
 | **event** | `Enum<'metadata.registered' \| 'metadata.updated' \| 'metadata.unregistered' \| 'metadata.validated' \| 'metadata.deployed' \| 'metadata.overlay.applied' \| 'metadata.overlay.removed' \| 'metadata.imported' \| 'metadata.exported'>` | ✅ | Event type |
-| **metadataType** | `Enum<'object' \| 'field' \| 'validation' \| 'hook' \| 'seed' \| 'mapping' \| 'view' \| 'page' \| 'dashboard' \| 'app' \| 'action' \| 'report' \| 'dataset' \| 'flow' \| 'job' \| 'datasource' \| 'external_catalog' \| 'translation' \| 'email_template' \| 'doc' \| 'book' \| 'permission' \| 'position' \| 'agent' \| 'tool' \| 'skill'>` | ✅ | Metadata type |
+| **metadataType** | `Enum<'object' \| 'field' \| 'hook' \| 'seed' \| 'mapping' \| 'view' \| 'page' \| 'dashboard' \| 'app' \| 'action' \| 'report' \| 'dataset' \| 'flow' \| 'job' \| 'datasource' \| 'external_catalog' \| 'translation' \| 'email_template' \| 'doc' \| 'book' \| 'permission' \| 'position' \| 'agent' \| 'tool' \| 'skill'>` | ✅ | Metadata type |
 | **name** | `string` | ✅ | Metadata item name |
 | **namespace** | `string` | optional | Namespace |
 | **packageId** | `string` | optional | Owning package ID |
@@ -183,7 +183,7 @@ const result = MetadataBulkRegisterRequest.parse(data);
 
 | Property | Type | Required | Description |
 | :--- | :--- | :--- | :--- |
-| **types** | `Enum<'object' \| 'field' \| 'validation' \| 'hook' \| 'seed' \| 'mapping' \| 'view' \| 'page' \| 'dashboard' \| 'app' \| 'action' \| 'report' \| 'dataset' \| 'flow' \| 'job' \| 'datasource' \| 'external_catalog' \| 'translation' \| 'email_template' \| 'doc' \| 'book' \| 'permission' \| 'position' \| 'agent' \| 'tool' \| 'skill'>[]` | optional | Filter by metadata types |
+| **types** | `Enum<'object' \| 'field' \| 'hook' \| 'seed' \| 'mapping' \| 'view' \| 'page' \| 'dashboard' \| 'app' \| 'action' \| 'report' \| 'dataset' \| 'flow' \| 'job' \| 'datasource' \| 'external_catalog' \| 'translation' \| 'email_template' \| 'doc' \| 'book' \| 'permission' \| 'position' \| 'agent' \| 'tool' \| 'skill'>[]` | optional | Filter by metadata types |
 | **namespaces** | `string[]` | optional | Filter by namespaces |
 | **packageId** | `string` | optional | Filter by owning package |
 | **search** | `string` | optional | Full-text search query |
@@ -218,7 +218,6 @@ const result = MetadataBulkRegisterRequest.parse(data);
 
 * `object`
 * `field`
-* `validation`
 * `hook`
 * `seed`
 * `mapping`
@@ -252,7 +251,7 @@ const result = MetadataBulkRegisterRequest.parse(data);
 
 | Property | Type | Required | Description |
 | :--- | :--- | :--- | :--- |
-| **type** | `Enum<'object' \| 'field' \| 'validation' \| 'hook' \| 'seed' \| 'mapping' \| 'view' \| 'page' \| 'dashboard' \| 'app' \| 'action' \| 'report' \| 'dataset' \| 'flow' \| 'job' \| 'datasource' \| 'external_catalog' \| 'translation' \| 'email_template' \| 'doc' \| 'book' \| 'permission' \| 'position' \| 'agent' \| 'tool' \| 'skill'>` | ✅ | Metadata type identifier |
+| **type** | `Enum<'object' \| 'field' \| 'hook' \| 'seed' \| 'mapping' \| 'view' \| 'page' \| 'dashboard' \| 'app' \| 'action' \| 'report' \| 'dataset' \| 'flow' \| 'job' \| 'datasource' \| 'external_catalog' \| 'translation' \| 'email_template' \| 'doc' \| 'book' \| 'permission' \| 'position' \| 'agent' \| 'tool' \| 'skill'>` | ✅ | Metadata type identifier |
 | **label** | `string` | ✅ | Display label for the metadata type |
 | **description** | `string` | optional | Description of the metadata type |
 | **filePatterns** | `string[]` | ✅ | Glob patterns to discover files of this type |

docs/adr/0088-metadata-kind-admission-and-retirement.md

@@ -54,3 +54,48 @@ The cached remote-schema snapshot of a federated datasource (ADR-0062) has a rea
 - `OPS_FILE_SUFFIX_REGEX` drops the four suffixes: `*.trigger.ts` / `*.router.ts` / `*.function.ts` / `*.service.ts` are no longer valid OPS metadata file names.
 - The showcase's registry-driven `KIND_COVERAGE` shrinks in lockstep (its coverage test enforces exact registry membership); the four waivers disappear and `external_catalog`'s waiver becomes a permanent, documented exclusion.
 - ADR-0005 / ADR-0010 prose tables no longer list the retired kinds.
+
+## Addendum (2026-08): `validation` retired — the admission test's first clause
+
+`validation` was registered as a kind with `allowRuntimeCreate: true`, a
+`*.validation.ts` loader, and a Studio form. On the admission test above it
+nonetheless fails the **first** clause — independent lifecycle — and the failure
+is not cosmetic:
+
+- **No independent lifecycle.** A rule only means something against an object,
+  and the only shape the engine evaluates is `object.validations[]`
+  (`evaluateValidationRules` on insert and on every matched update row).
+- **No way to bind.** `ValidationRuleSchema` carries no `object` / `objectName`
+  key, and all six variants are `strictObject`, so an author could not supply
+  one either — the parse would reject it. There was no merge step, and the only
+  code that expected such a key was a reference-tracker row scanning a field
+  that could never exist.
+
+So the standalone door led nowhere: an item authored through it — including a
+`state_machine` rule, which ADR-0020 explicitly routes through this same
+vocabulary — saved cleanly, reported success, and intercepted no write. That is
+the ADR-0049 false-compliance shape, on a surface authors reasonably expect to
+gate their data.
+
+The kind is removed (registry entry, `MetadataTypeSchema` member, metadata-core
+lockstep enum, schema map entry, Studio nav item and hand-crafted form, create
+seed, and the dangling reference row). `ValidationRuleSchema` itself is
+**unchanged and fully live** — it is the kind that was inert, not the
+vocabulary. The liveness ledger keeps governing the schema through the gate's
+`SPEC_ONLY_SCHEMAS` override, alongside `webhook` and `query`, precisely because
+an ungoverned live schema is how the next drift would hide.
+
+Note the contrast with the sibling disconnects closed in the same batch (#4509).
+`email_template` had a real feature with missing wiring, so enforce-or-remove
+resolved it by **enforcing** — a materializer bridge. `validation` had a shape
+that could not carry the feature at all, so it resolves by **removing**. The
+test is not "is this dead?" but "can this be made to work as declared?".
+
+- `MetadataTypeSchema` and `DEFAULT_METADATA_TYPE_REGISTRY` shrink 26 → 25.
+- `*.validation.ts` / `*.validation.yml` are no longer metadata file patterns.
+  (`OPS_FILE_SUFFIX_REGEX` never listed them — no change there.)
+- Persisted standalone `sys_metadata` rows are left alone. They were never
+  evaluated, so nothing changes behaviorally; `migrateStoredMetadata` declines
+  them like any unregistered type.
+- **Migration for authors:** move the rule into the object's `validations:`
+  array. The rule body is unchanged — same schema, same six variants.

examples/app-showcase/src/coverage.ts

@@ -54,24 +54,19 @@ export const KIND_COVERAGE: Record<MetadataType, KindCoverage> = {
   object: {
     status: 'demonstrated',
     files: ['src/data/objects/index.ts', 'src/data/objects/field-zoo.object.ts'],
+    notes:
+      'Also carries the validation-rule surface: rules are authored inline via object `validations` (the `validation` KIND was retired in #4509 — ADR-0088 — because a standalone rule had no way to name the object it validated). Every declared rule type is write-path enforced (rule-validator dispatches all of state_machine/script/cross_field/format/json_schema/conditional — ADR-0020 "no silent no-ops", closing the #1475 gap) and each is demonstrated: state_machine (task/project), script+cross_field (project), format/json_schema/conditional (account). Field-level requiredWhen/readonlyWhen are likewise enforced and demonstrated on invoice.',
   },
   field: {
     status: 'demonstrated',
     files: ['src/data/objects/field-zoo.object.ts'],
     notes:
       'FieldSchema is authored inline on objects (the stack DSL has no standalone `fields` collection); field-zoo exhausts every field type — see the variant-level test.',
   },
-  validation: {
-    status: 'demonstrated',
-    files: [
-      'src/data/objects/account.object.ts',
-      'src/data/objects/task.object.ts',
-      'src/data/objects/project.object.ts',
-      'src/data/objects/invoice.object.ts',
-    ],
-    notes:
-      'Authored inline via object `validations`. Every declared rule type is now write-path enforced (rule-validator dispatches all of state_machine/script/cross_field/format/json_schema/conditional — ADR-0020 "no silent no-ops", closing the #1475 gap) and each is demonstrated: state_machine (task/project), script+cross_field (project), format/json_schema/conditional (account). Field-level requiredWhen/readonlyWhen are likewise enforced and demonstrated on invoice.',
-  },
+  // `validation` was retired as a KIND in #4509 (ADR-0088) — the coverage test
+  // fails on any entry the registry no longer knows. The rules themselves are
+  // unchanged and still demonstrated; that coverage moved onto `object`, which
+  // is where they are authored.
   hook: { status: 'demonstrated', files: ['src/data/hooks/index.ts'] },
   seed: { status: 'demonstrated', files: ['src/data/seed/index.ts'] },
   mapping: {