diff --git a/.changeset/adr-0062-analytics-external.md b/.changeset/adr-0062-analytics-external.md
deleted file mode 100644
index c9e82fa909..0000000000
--- a/.changeset/adr-0062-analytics-external.md
+++ /dev/null
@@ -1,20 +0,0 @@
----
-"@objectstack/spec": minor
-"@objectstack/service-analytics": minor
----
-
-feat(analytics): correct analytics over federated objects (ADR-0062 Phase 3, D6)
-
-Analytics over an external (federated) object now aggregates against the
-**correct** remote table instead of silently querying the wrong one. The
-`NativeSQLStrategy` hand-compiles `FROM "<object>"` and bare column references,
-which bypass the driver's physical-table resolution (`external.remoteName` /
-`remoteSchema` / `columnMap`). It now **declines** any query whose base or joined
-object is federated, routing it to the `ObjectQLStrategy` — whose
-`engine.aggregate()` goes through the driver's `getBuilder` and already honours
-`remoteName`/`remoteSchema` (#2138/#2149). This "reuses the driver's resolution"
-(D6) rather than re-implementing it.
-
-Adds an optional `StrategyContext.isExternalObject(objectName)` hook (reported by
-the analytics plugin from the object's `external` block). Purely additive — with
-no hook, behavior is unchanged for managed objects.
diff --git a/.changeset/adr-0062-credentials-fail-closed.md b/.changeset/adr-0062-credentials-fail-closed.md
deleted file mode 100644
index d80305fdfd..0000000000
--- a/.changeset/adr-0062-credentials-fail-closed.md
+++ /dev/null
@@ -1,20 +0,0 @@
----
-"@objectstack/service-datasource": minor
----
-
-feat(datasource): fail-closed credential resolution at connect (ADR-0062 Phase 2, D3)
-
-`DatasourceConnectionService` now treats a declared `external.credentialsRef` as
-**fail-closed**: the credential must resolve to a cleartext secret (via the
-host's `SecretBinder` over `ICryptoProvider`) *before* the driver is built. An
-absent secret store, or a ref that cannot be resolved/decrypted (missing
-`sys_secret` row, rotated key, or a throwing resolver), leaves the datasource
-**unconnected with a clear message** — never a silent build-without-secret that
-would connect with no/wrong auth or fail later with a confusing driver error.
-
-The same policy as connect failures applies: a code-defined `external` datasource
-with `validation.onMismatch: 'fail'` auto-connected at boot fails fast (bricks
-boot); runtime-admin create/update + boot rehydration degrade-with-warning. Code-
-and runtime-origin secrets converge on the one connection path (the same
-`SecretBinder` is threaded through the shared service). New `failed-credentials`
-connect status.
diff --git a/.changeset/adr-0062-datasource-connection-service.md b/.changeset/adr-0062-datasource-connection-service.md
deleted file mode 100644
index 32c6a08f9e..0000000000
--- a/.changeset/adr-0062-datasource-connection-service.md
+++ /dev/null
@@ -1,38 +0,0 @@
----
-"@objectstack/service-datasource": minor
-"@objectstack/runtime": minor
-"@objectstack/spec": minor
----
-
-feat(datasource): auto-connect declared external datasources (ADR-0062 Phase 1, D1/D2/D5)
-
-A declared external datasource is now connected to a live ObjectQL driver and its
-federated objects are queryable **with zero app code** — no `onEnable` driver
-wiring. Implements ADR-0062 Phase 1.
-
-- **D1 — one connect path.** New `DatasourceConnectionService` in
-  `@objectstack/service-datasource` owns the single "definition → live driver"
-  path: build via the injected driver factory → resolve `external.credentialsRef`
-  via the `SecretBinder` → connect → `engine.registerDriver` under the datasource
-  name → register the datasource def → sync each bound federated object's read
-  metadata (DDL-free). Both origins converge on it: the runtime-admin
-  `registerPool` now delegates here, and `AppPlugin` auto-connects code-defined
-  datasources. Exposed as the `'datasource-connection'` kernel service.
-- **D2 — opt-in-safe gate.** A declared datasource auto-connects only when it is
-  `external`, an object **explicitly** binds to it via `object.datasource`, or it
-  sets the new `autoConnect: true` flag. A managed datasource that nothing
-  explicitly binds (incl. ones referenced only by a `datasourceMapping` rule, e.g.
-  `examples/app-crm`'s `:memory:` datasources) stays metadata-only — existing apps
-  are byte-for-byte unchanged. See the ADR-0062 D2 implementation note.
-- **D5 — lifecycle, ordering & policy.** Connect happens in `AppPlugin.start()`
-  (before the `kernel:ready` validation gate, relying on the kernel's
-  init-all-then-start-all ordering). Fail-fast for a declared `external` datasource
-  with `validation.onMismatch: 'fail'`; degrade-with-warning otherwise (and always
-  for runtime-admin/rehydrate, so a UI action or replica blip never bricks the
-  server). Adds a host-injectable `DatasourceConnectPolicy` (open-core default
-  allows; a multi-tenant host binds a stricter fail-closed policy for egress
-  isolation) consulted before every connect — one connect path, no cloud fork.
-
-Adds `datasource.autoConnect` to the spec. The legacy `onEnable` +
-`ctx.drivers.register` bridge remains supported as an escape hatch (idempotent vs.
-auto-connect). No behavior change for managed apps.
diff --git a/.changeset/adr-0062-default-driver-construction.md b/.changeset/adr-0062-default-driver-construction.md
deleted file mode 100644
index 313a9236d3..0000000000
--- a/.changeset/adr-0062-default-driver-construction.md
+++ /dev/null
@@ -1,21 +0,0 @@
----
-"@objectstack/runtime": patch
----
-
-refactor(runtime): build the standalone default driver via the shared datasource factory (ADR-0062 follow-up)
-
-`createStandaloneStack` now constructs its `default` driver for the user-facing
-kinds (memory / better-sqlite3 / postgres / mongodb) through the **same**
-`createDefaultDatasourceDriverFactory` used for declared and runtime-admin
-datasources — one "driver kind → instance" construction path instead of two
-hand-mirrored ones. Adding a dialect or changing connection/pool defaults now
-happens in a single place. URL→config translation, filesystem prep (`mkdir`),
-and pre-engine `DriverPlugin` registration stay in the stack (unchanged); the
-factory only constructs the driver. The pure-JS WASM sqlite driver stays bespoke
-in the stack — it's the standalone-specific, CI-safe default and not a
-user-creatable datasource type, so it has a single construction site already.
-
-No behavior change: the same driver instances are built for the same inputs
-(verified by a per-kind connect + CRUD round-trip test and a real `os dev` boot).
-Adds `@objectstack/service-datasource` as a runtime dependency (no cycle — that
-package depends only on core/spec).
diff --git a/.changeset/adr-0062-reconcile-cleanup.md b/.changeset/adr-0062-reconcile-cleanup.md
deleted file mode 100644
index 4516961d6e..0000000000
--- a/.changeset/adr-0062-reconcile-cleanup.md
+++ /dev/null
@@ -1,22 +0,0 @@
----
-"@objectstack/cli": minor
-"@objectstack/verify": minor
----
-
-feat(datasource): reject field.columnName on external objects + drop showcase onEnable bridge (ADR-0062 Phase 4, D7/D8)
-
-**D7 — reconcile column mapping.** `os compile`/`build` (`validateStackExpressions`)
-now rejects `field.columnName` on a federated (external) object with a corrective
-message: the driver's query pipeline ignores `field.columnName` for external
-objects, so `external.columnMap` is the single authoritative mechanism. Managed
-objects are untouched.
-
-**D8 — drop the canonical example's driver bridge.** `examples/app-showcase`
-declares its external datasource with **no** `onEnable` driver registration — the
-declared datasource auto-connects at boot (ADR-0062 D1). `onEnable` now only
-provisions the "remote" fixture tables. To cover this end-to-end, the
-`@objectstack/verify` harness wires the datasource-admin plugin (registering the
-`'datasource-connection'` service) when an app declares datasources, so it mirrors
-`objectstack dev`/serve; a new dogfood test reads the federated objects through the
-real REST stack (incl. the `remoteName` remap). `onEnable` + `ctx.drivers.register`
-remains supported as an escape hatch for drivers built dynamically at runtime.
diff --git a/.changeset/cli-validate-author-gate.md b/.changeset/cli-validate-author-gate.md
deleted file mode 100644
index b114307f93..0000000000
--- a/.changeset/cli-validate-author-gate.md
+++ /dev/null
@@ -1,20 +0,0 @@
----
-"@objectstack/cli": minor
-"create-objectstack": minor
----
-
-Make `os validate` the author-time verification gate and steer scaffolds toward it.
-
-- **`os validate`** now runs the same CEL/predicate gate as `os build`/`os compile`
-  (ADR-0032): every `visible`/`disabled`/`requiredWhen`/validation/flow/sharing
-  predicate is checked for CEL syntax and `record.<field>` existence on the target
-  object. It already ran the protocol schema and widget-binding checks; the
-  expression gate closes the gap so a bare field ref (`done` instead of
-  `record.done`) — which silently hides an action on every record at runtime
-  (#2183/#2185) — fails validation instead of shipping. `os validate` is now a
-  read-only superset of the build's checks (no artifact emitted).
-- **`create-objectstack`** now emits an `AGENTS.md` (and `.github/copilot-instructions.md`)
-  into every generated project instructing coding agents to run `npm run validate`
-  after editing metadata, aligns the blank template's `dev`/`start` scripts with the
-  example apps (`objectstack dev`/`objectstack start`), and sharpens the post-create
-  "Next steps" output.
diff --git a/.changeset/issue-2186-schema-migrate.md b/.changeset/issue-2186-schema-migrate.md
deleted file mode 100644
index 332e412a03..0000000000
--- a/.changeset/issue-2186-schema-migrate.md
+++ /dev/null
@@ -1,31 +0,0 @@
----
-"@objectstack/driver-sql": minor
-"@objectstack/cli": minor
-"@objectstack/rest": patch
----
-
-Schema drift detection + `os migrate` for non-additive metadata changes (#2186).
-
-The metadata→DB schema sync was additive-only: it created tables and added
-columns but never altered/dropped existing ones, so relaxing `required`,
-changing a type/length, or dropping a field silently diverged from an existing
-database. The physical column won at write time, surfacing a misleading
-`organization_id is required` 400 even though `/meta` reported the field
-optional.
-
-- **driver-sql** — the SQL driver now detects managed-schema drift (metadata is
-  the source of truth) and categorises each divergence `safe` / `needs_confirm`
-  / `destructive`. `initObjects` warns once per divergence with an actionable
-  hint. A new opt-in `SqlDriverConfig.autoMigrate: 'safe'` auto-applies the
-  *loosening* subset (relax `NOT NULL`, widen varchar) so an existing dev DB
-  self-heals on restart — never destructive, force-disabled under
-  `NODE_ENV=production`. New public methods `detectManagedDrift()` /
-  `applyMigrationEntries()`. SQLite reconciles via the official table-rebuild
-  (copy → swap), preserving data; Postgres/MySQL alter in place.
-- **cli** — new `os migrate plan` (dry-run, categorised diff) and
-  `os migrate apply` (`--allow-destructive` for drops/tightenings, confirm gate,
-  `--json`). `os dev`/`serve` now pass `autoMigrate: 'safe'` in dev only.
-- **rest** — a `NOT NULL` violation that reaches the driver (metadata validation
-  already passed) now carries a drift-aware `hint` pointing at `os migrate`,
-  instead of only the misleading "field is required" message. The
-  `VALIDATION_FAILED` / `fields` envelope is unchanged for back-compat.
diff --git a/examples/app-crm/CHANGELOG.md b/examples/app-crm/CHANGELOG.md
index f9eddaaf84..e6adabed54 100644
--- a/examples/app-crm/CHANGELOG.md
+++ b/examples/app-crm/CHANGELOG.md
@@ -1,5 +1,15 @@
 # @objectstack/example-crm
 
+## 4.0.56
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+- Updated dependencies [94d2161]
+  - @objectstack/spec@10.1.0
+  - @objectstack/runtime@10.1.0
+
 ## 4.0.55
 
 ### Patch Changes
diff --git a/examples/app-crm/package.json b/examples/app-crm/package.json
index 579d0a0967..38dcec1031 100644
--- a/examples/app-crm/package.json
+++ b/examples/app-crm/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/example-crm",
-  "version": "4.0.55",
+  "version": "4.0.56",
   "description": "Minimal CRM example — a smoke-test workspace that exercises the metadata loading pipeline (objects → views → app → dashboard → hook → flow → seed). For a full-featured enterprise CRM see https://github.com/objectstack-ai/hotcrm.",
   "license": "Apache-2.0",
   "private": true,
diff --git a/examples/app-showcase/CHANGELOG.md b/examples/app-showcase/CHANGELOG.md
index d0c28135bb..0d96bc8234 100644
--- a/examples/app-showcase/CHANGELOG.md
+++ b/examples/app-showcase/CHANGELOG.md
@@ -1,5 +1,20 @@
 # @objectstack/example-showcase
 
+## 0.2.2
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+- Updated dependencies [94d2161]
+- Updated dependencies [517dad9]
+  - @objectstack/spec@10.1.0
+  - @objectstack/runtime@10.1.0
+  - @objectstack/driver-sql@10.1.0
+  - @objectstack/cloud-connection@10.1.0
+  - @objectstack/connector-rest@10.1.0
+  - @objectstack/connector-slack@10.1.0
+
 ## 0.2.1
 
 ### Patch Changes
diff --git a/examples/app-showcase/package.json b/examples/app-showcase/package.json
index a812034003..2ae2497d0b 100644
--- a/examples/app-showcase/package.json
+++ b/examples/app-showcase/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/example-showcase",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Kitchen-sink showcase workspace — exercises every metadata type, every view type, every chart type, and the major end-to-end capability chains (security, automation, AI). Built for demonstration, debugging, and coverage-driven verification.",
   "license": "Apache-2.0",
   "private": true,
diff --git a/examples/app-todo/CHANGELOG.md b/examples/app-todo/CHANGELOG.md
index 99158858d2..ee86ac586d 100644
--- a/examples/app-todo/CHANGELOG.md
+++ b/examples/app-todo/CHANGELOG.md
@@ -1,5 +1,22 @@
 # @objectstack/example-todo
 
+## 4.0.56
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+- Updated dependencies [94d2161]
+  - @objectstack/spec@10.1.0
+  - @objectstack/runtime@10.1.0
+  - @objectstack/client@10.1.0
+  - @objectstack/metadata@10.1.0
+  - @objectstack/objectql@10.1.0
+  - @objectstack/driver-sqlite-wasm@10.1.0
+  - @objectstack/knowledge-memory@10.1.0
+  - @objectstack/service-ai@10.1.0
+  - @objectstack/service-knowledge@10.1.0
+
 ## 4.0.55
 
 ### Patch Changes
diff --git a/examples/app-todo/package.json b/examples/app-todo/package.json
index 1cc808ac67..cf4513fc0b 100644
--- a/examples/app-todo/package.json
+++ b/examples/app-todo/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/example-todo",
-  "version": "4.0.55",
+  "version": "4.0.56",
   "description": "Example Todo App using ObjectStack Protocol",
   "license": "Apache-2.0",
   "private": true,
diff --git a/packages/adapters/express/CHANGELOG.md b/packages/adapters/express/CHANGELOG.md
index c82fa95e1d..d6ba9aaaa3 100644
--- a/packages/adapters/express/CHANGELOG.md
+++ b/packages/adapters/express/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @objectstack/express
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [ac79f16]
+- Updated dependencies [94d2161]
+  - @objectstack/runtime@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/adapters/express/package.json b/packages/adapters/express/package.json
index b303d137fb..a26ae9ee6d 100644
--- a/packages/adapters/express/package.json
+++ b/packages/adapters/express/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/express",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
diff --git a/packages/adapters/fastify/CHANGELOG.md b/packages/adapters/fastify/CHANGELOG.md
index caf340d918..aa110ad5ef 100644
--- a/packages/adapters/fastify/CHANGELOG.md
+++ b/packages/adapters/fastify/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @objectstack/fastify
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [ac79f16]
+- Updated dependencies [94d2161]
+  - @objectstack/runtime@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/adapters/fastify/package.json b/packages/adapters/fastify/package.json
index e0b55775d8..db597f2152 100644
--- a/packages/adapters/fastify/package.json
+++ b/packages/adapters/fastify/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/fastify",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
diff --git a/packages/adapters/hono/CHANGELOG.md b/packages/adapters/hono/CHANGELOG.md
index d070a10ded..148e2add80 100644
--- a/packages/adapters/hono/CHANGELOG.md
+++ b/packages/adapters/hono/CHANGELOG.md
@@ -1,5 +1,15 @@
 # @objectstack/hono
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [ac79f16]
+- Updated dependencies [94d2161]
+  - @objectstack/runtime@10.1.0
+  - @objectstack/plugin-hono-server@10.1.0
+  - @objectstack/types@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/adapters/hono/package.json b/packages/adapters/hono/package.json
index 856919c9df..e4fb30b8a2 100644
--- a/packages/adapters/hono/package.json
+++ b/packages/adapters/hono/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/hono",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
diff --git a/packages/adapters/nestjs/CHANGELOG.md b/packages/adapters/nestjs/CHANGELOG.md
index 1984e199cf..8e9cea237b 100644
--- a/packages/adapters/nestjs/CHANGELOG.md
+++ b/packages/adapters/nestjs/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @objectstack/nestjs
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [ac79f16]
+- Updated dependencies [94d2161]
+  - @objectstack/runtime@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/adapters/nestjs/package.json b/packages/adapters/nestjs/package.json
index 1c42fa6847..f6648672db 100644
--- a/packages/adapters/nestjs/package.json
+++ b/packages/adapters/nestjs/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/nestjs",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
diff --git a/packages/adapters/nextjs/CHANGELOG.md b/packages/adapters/nextjs/CHANGELOG.md
index 68b291bb7e..2c0f490791 100644
--- a/packages/adapters/nextjs/CHANGELOG.md
+++ b/packages/adapters/nextjs/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @objectstack/nextjs
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [ac79f16]
+- Updated dependencies [94d2161]
+  - @objectstack/runtime@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/adapters/nextjs/package.json b/packages/adapters/nextjs/package.json
index b451d16a49..3a900f18a2 100644
--- a/packages/adapters/nextjs/package.json
+++ b/packages/adapters/nextjs/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/nextjs",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
diff --git a/packages/adapters/nuxt/CHANGELOG.md b/packages/adapters/nuxt/CHANGELOG.md
index 9af96e05cb..bdd7b3a3a4 100644
--- a/packages/adapters/nuxt/CHANGELOG.md
+++ b/packages/adapters/nuxt/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @objectstack/nuxt
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [ac79f16]
+- Updated dependencies [94d2161]
+  - @objectstack/runtime@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/adapters/nuxt/package.json b/packages/adapters/nuxt/package.json
index ea3b7e6a6c..20972c8a6f 100644
--- a/packages/adapters/nuxt/package.json
+++ b/packages/adapters/nuxt/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/nuxt",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
diff --git a/packages/adapters/sveltekit/CHANGELOG.md b/packages/adapters/sveltekit/CHANGELOG.md
index 24219291fb..85637e049c 100644
--- a/packages/adapters/sveltekit/CHANGELOG.md
+++ b/packages/adapters/sveltekit/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @objectstack/sveltekit
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [ac79f16]
+- Updated dependencies [94d2161]
+  - @objectstack/runtime@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/adapters/sveltekit/package.json b/packages/adapters/sveltekit/package.json
index fd5267a921..f8fbb32ba5 100644
--- a/packages/adapters/sveltekit/package.json
+++ b/packages/adapters/sveltekit/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/sveltekit",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
diff --git a/packages/apps/account/CHANGELOG.md b/packages/apps/account/CHANGELOG.md
index f62c9e305f..a2a2a55fc4 100644
--- a/packages/apps/account/CHANGELOG.md
+++ b/packages/apps/account/CHANGELOG.md
@@ -1,5 +1,14 @@
 # @objectstack/account
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+  - @objectstack/platform-objects@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/apps/account/package.json b/packages/apps/account/package.json
index 7567ce9013..723527fa7d 100644
--- a/packages/apps/account/package.json
+++ b/packages/apps/account/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/account",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "ObjectStack Account — the end-user account/self-service console app, packaged as its own ObjectStack app package (ADR-0048: one app per package).",
   "main": "dist/index.js",
diff --git a/packages/apps/setup/CHANGELOG.md b/packages/apps/setup/CHANGELOG.md
index 732e04460f..b220ee229c 100644
--- a/packages/apps/setup/CHANGELOG.md
+++ b/packages/apps/setup/CHANGELOG.md
@@ -1,5 +1,14 @@
 # @objectstack/setup
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+  - @objectstack/platform-objects@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/apps/setup/package.json b/packages/apps/setup/package.json
index 82d6d43f54..06ddf5a903 100644
--- a/packages/apps/setup/package.json
+++ b/packages/apps/setup/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/setup",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "ObjectStack Setup — the platform administration app, packaged as its own ObjectStack app package (ADR-0048: one app per package).",
   "main": "dist/index.js",
diff --git a/packages/apps/studio/CHANGELOG.md b/packages/apps/studio/CHANGELOG.md
index d63b0f2e53..cc146f045b 100644
--- a/packages/apps/studio/CHANGELOG.md
+++ b/packages/apps/studio/CHANGELOG.md
@@ -1,5 +1,14 @@
 # @objectstack/studio
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+  - @objectstack/platform-objects@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/apps/studio/package.json b/packages/apps/studio/package.json
index 6cd0b670cf..ddece5042b 100644
--- a/packages/apps/studio/package.json
+++ b/packages/apps/studio/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/studio",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "ObjectStack Studio — the metadata builder app, packaged as its own ObjectStack app package (ADR-0048: one app per package).",
   "main": "dist/index.js",
diff --git a/packages/cli/CHANGELOG.md b/packages/cli/CHANGELOG.md
index 6c716a57a7..1747d212ad 100644
--- a/packages/cli/CHANGELOG.md
+++ b/packages/cli/CHANGELOG.md
@@ -1,5 +1,124 @@
 # @objectstack/cli
 
+## 10.1.0
+
+### Minor Changes
+
+- 49da36e: feat(datasource): reject field.columnName on external objects + drop showcase onEnable bridge (ADR-0062 Phase 4, D7/D8)
+
+  **D7 — reconcile column mapping.** `os compile`/`build` (`validateStackExpressions`)
+  now rejects `field.columnName` on a federated (external) object with a corrective
+  message: the driver's query pipeline ignores `field.columnName` for external
+  objects, so `external.columnMap` is the single authoritative mechanism. Managed
+  objects are untouched.
+
+  **D8 — drop the canonical example's driver bridge.** `examples/app-showcase`
+  declares its external datasource with **no** `onEnable` driver registration — the
+  declared datasource auto-connects at boot (ADR-0062 D1). `onEnable` now only
+  provisions the "remote" fixture tables. To cover this end-to-end, the
+  `@objectstack/verify` harness wires the datasource-admin plugin (registering the
+  `'datasource-connection'` service) when an app declares datasources, so it mirrors
+  `objectstack dev`/serve; a new dogfood test reads the federated objects through the
+  real REST stack (incl. the `remoteName` remap). `onEnable` + `ctx.drivers.register`
+  remains supported as an escape hatch for drivers built dynamically at runtime.
+
+- 7cf283a: Make `os validate` the author-time verification gate and steer scaffolds toward it.
+
+  - **`os validate`** now runs the same CEL/predicate gate as `os build`/`os compile`
+    (ADR-0032): every `visible`/`disabled`/`requiredWhen`/validation/flow/sharing
+    predicate is checked for CEL syntax and `record.<field>` existence on the target
+    object. It already ran the protocol schema and widget-binding checks; the
+    expression gate closes the gap so a bare field ref (`done` instead of
+    `record.done`) — which silently hides an action on every record at runtime
+    (#2183/#2185) — fails validation instead of shipping. `os validate` is now a
+    read-only superset of the build's checks (no artifact emitted).
+  - **`create-objectstack`** now emits an `AGENTS.md` (and `.github/copilot-instructions.md`)
+    into every generated project instructing coding agents to run `npm run validate`
+    after editing metadata, aligns the blank template's `dev`/`start` scripts with the
+    example apps (`objectstack dev`/`objectstack start`), and sharpens the post-create
+    "Next steps" output.
+
+- 517dad9: Schema drift detection + `os migrate` for non-additive metadata changes (#2186).
+
+  The metadata→DB schema sync was additive-only: it created tables and added
+  columns but never altered/dropped existing ones, so relaxing `required`,
+  changing a type/length, or dropping a field silently diverged from an existing
+  database. The physical column won at write time, surfacing a misleading
+  `organization_id is required` 400 even though `/meta` reported the field
+  optional.
+
+  - **driver-sql** — the SQL driver now detects managed-schema drift (metadata is
+    the source of truth) and categorises each divergence `safe` / `needs_confirm`
+    / `destructive`. `initObjects` warns once per divergence with an actionable
+    hint. A new opt-in `SqlDriverConfig.autoMigrate: 'safe'` auto-applies the
+    _loosening_ subset (relax `NOT NULL`, widen varchar) so an existing dev DB
+    self-heals on restart — never destructive, force-disabled under
+    `NODE_ENV=production`. New public methods `detectManagedDrift()` /
+    `applyMigrationEntries()`. SQLite reconciles via the official table-rebuild
+    (copy → swap), preserving data; Postgres/MySQL alter in place.
+  - **cli** — new `os migrate plan` (dry-run, categorised diff) and
+    `os migrate apply` (`--allow-destructive` for drops/tightenings, confirm gate,
+    `--json`). `os dev`/`serve` now pass `autoMigrate: 'safe'` in dev only.
+  - **rest** — a `NOT NULL` violation that reaches the driver (metadata validation
+    already passed) now carries a drift-aware `hint` pointing at `os migrate`,
+    instead of only the misleading "field is required" message. The
+    `VALIDATION_FAILED` / `fields` envelope is unchanged for back-compat.
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+- Updated dependencies [94d2161]
+- Updated dependencies [49da36e]
+- Updated dependencies [517dad9]
+  - @objectstack/spec@10.1.0
+  - @objectstack/service-analytics@10.1.0
+  - @objectstack/service-datasource@10.1.0
+  - @objectstack/runtime@10.1.0
+  - @objectstack/verify@10.1.0
+  - @objectstack/driver-sql@10.1.0
+  - @objectstack/rest@10.1.0
+  - @objectstack/account@10.1.0
+  - @objectstack/setup@10.1.0
+  - @objectstack/studio@10.1.0
+  - @objectstack/client@10.1.0
+  - @objectstack/cloud-connection@10.1.0
+  - @objectstack/core@10.1.0
+  - @objectstack/formula@10.1.0
+  - @objectstack/mcp@10.1.0
+  - @objectstack/objectql@10.1.0
+  - @objectstack/observability@10.1.0
+  - @objectstack/platform-objects@10.1.0
+  - @objectstack/driver-memory@10.1.0
+  - @objectstack/driver-mongodb@10.1.0
+  - @objectstack/driver-sqlite-wasm@10.1.0
+  - @objectstack/plugin-approvals@10.1.0
+  - @objectstack/plugin-audit@10.1.0
+  - @objectstack/plugin-auth@10.1.0
+  - @objectstack/plugin-email@10.1.0
+  - @objectstack/plugin-hono-server@10.1.0
+  - @objectstack/plugin-org-scoping@10.1.0
+  - @objectstack/plugin-reports@10.1.0
+  - @objectstack/plugin-security@10.1.0
+  - @objectstack/plugin-sharing@10.1.0
+  - @objectstack/plugin-webhooks@10.1.0
+  - @objectstack/service-ai@10.1.0
+  - @objectstack/service-automation@10.1.0
+  - @objectstack/service-cache@10.1.0
+  - @objectstack/service-job@10.1.0
+  - @objectstack/service-messaging@10.1.0
+  - @objectstack/service-package@10.1.0
+  - @objectstack/service-queue@10.1.0
+  - @objectstack/service-realtime@10.1.0
+  - @objectstack/service-settings@10.1.0
+  - @objectstack/service-storage@10.1.0
+  - @objectstack/trigger-api@10.1.0
+  - @objectstack/trigger-record-change@10.1.0
+  - @objectstack/trigger-schedule@10.1.0
+  - @objectstack/types@10.1.0
+  - @objectstack/console@10.1.0
+
 ## 10.0.0
 
 ### Minor Changes
diff --git a/packages/cli/package.json b/packages/cli/package.json
index 44963e1459..82cd6f7c71 100644
--- a/packages/cli/package.json
+++ b/packages/cli/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/cli",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "description": "Command Line Interface for ObjectStack Protocol",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
diff --git a/packages/client-react/CHANGELOG.md b/packages/client-react/CHANGELOG.md
index f1bba93c2c..3f82beaecc 100644
--- a/packages/client-react/CHANGELOG.md
+++ b/packages/client-react/CHANGELOG.md
@@ -1,5 +1,15 @@
 # @objectstack/client-react
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+  - @objectstack/client@10.1.0
+  - @objectstack/core@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/client-react/package.json b/packages/client-react/package.json
index e11895e082..b8dd8482eb 100644
--- a/packages/client-react/package.json
+++ b/packages/client-react/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/client-react",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "React hooks for ObjectStack Client SDK",
   "main": "dist/index.js",
diff --git a/packages/client/CHANGELOG.md b/packages/client/CHANGELOG.md
index 9d2faecd33..927c1b4f5b 100644
--- a/packages/client/CHANGELOG.md
+++ b/packages/client/CHANGELOG.md
@@ -1,5 +1,14 @@
 # @objectstack/client
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+  - @objectstack/core@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/client/package.json b/packages/client/package.json
index f75bf96d57..72792d49a6 100644
--- a/packages/client/package.json
+++ b/packages/client/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/client",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "Official Client SDK for ObjectStack Protocol",
   "main": "dist/index.js",
diff --git a/packages/cloud-connection/CHANGELOG.md b/packages/cloud-connection/CHANGELOG.md
index e6e05b083f..718247e192 100644
--- a/packages/cloud-connection/CHANGELOG.md
+++ b/packages/cloud-connection/CHANGELOG.md
@@ -1,5 +1,17 @@
 # @objectstack/cloud-connection
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+- Updated dependencies [94d2161]
+  - @objectstack/spec@10.1.0
+  - @objectstack/runtime@10.1.0
+  - @objectstack/core@10.1.0
+  - @objectstack/types@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/cloud-connection/package.json b/packages/cloud-connection/package.json
index 480a34bdf6..2b72a7d776 100644
--- a/packages/cloud-connection/package.json
+++ b/packages/cloud-connection/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/cloud-connection",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "Runtime-side client for an ObjectStack cloud control plane — marketplace browse proxy, install-local, device-code binding, org catalog and installed views, and the /api/v1/runtime/config discovery endpoint. Open mechanism (ADR-0008): the hub service, plan policy, and entitlements stay server-side.",
   "type": "module",
diff --git a/packages/connectors/connector-mcp/CHANGELOG.md b/packages/connectors/connector-mcp/CHANGELOG.md
index 48f4b87d7f..f299702d8f 100644
--- a/packages/connectors/connector-mcp/CHANGELOG.md
+++ b/packages/connectors/connector-mcp/CHANGELOG.md
@@ -1,5 +1,14 @@
 # @objectstack/connector-mcp
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+  - @objectstack/core@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/connectors/connector-mcp/package.json b/packages/connectors/connector-mcp/package.json
index 12ae2fe098..fff9d7226b 100644
--- a/packages/connectors/connector-mcp/package.json
+++ b/packages/connectors/connector-mcp/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/connector-mcp",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "Model Context Protocol (MCP) connector for ObjectStack — a generic adapter that turns any MCP server's tools into a connector's actions on the automation engine's connector registry (ADR-0024).",
   "main": "dist/index.js",
diff --git a/packages/connectors/connector-openapi/CHANGELOG.md b/packages/connectors/connector-openapi/CHANGELOG.md
index 438338d5be..ae54e76431 100644
--- a/packages/connectors/connector-openapi/CHANGELOG.md
+++ b/packages/connectors/connector-openapi/CHANGELOG.md
@@ -1,5 +1,14 @@
 # @objectstack/connector-openapi
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+  - @objectstack/core@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/connectors/connector-openapi/package.json b/packages/connectors/connector-openapi/package.json
index 07c8714823..736596b14f 100644
--- a/packages/connectors/connector-openapi/package.json
+++ b/packages/connectors/connector-openapi/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@objectstack/connector-openapi",
-    "version": "10.0.0",
+    "version": "10.1.0",
     "license": "Apache-2.0",
     "description": "OpenAPI 3.x connector generator for ObjectStack — turns a declarative OpenAPI document into connector actions on the automation engine's registry, with a self-contained static-auth HTTP transport (ADR-0023).",
     "main": "dist/index.js",
diff --git a/packages/connectors/connector-rest/CHANGELOG.md b/packages/connectors/connector-rest/CHANGELOG.md
index 8485ef5796..86a29f6fe8 100644
--- a/packages/connectors/connector-rest/CHANGELOG.md
+++ b/packages/connectors/connector-rest/CHANGELOG.md
@@ -1,5 +1,14 @@
 # @objectstack/connector-rest
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+  - @objectstack/core@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/connectors/connector-rest/package.json b/packages/connectors/connector-rest/package.json
index 670e08dda9..02bee3e555 100644
--- a/packages/connectors/connector-rest/package.json
+++ b/packages/connectors/connector-rest/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/connector-rest",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "Generic REST connector for ObjectStack — the reference concrete connector that registers a `request` action on the automation engine's connector registry (ADR-0018 §Addendum).",
   "main": "dist/index.js",
diff --git a/packages/connectors/connector-slack/CHANGELOG.md b/packages/connectors/connector-slack/CHANGELOG.md
index d99b4ebed8..b0c3841a3a 100644
--- a/packages/connectors/connector-slack/CHANGELOG.md
+++ b/packages/connectors/connector-slack/CHANGELOG.md
@@ -1,5 +1,14 @@
 # @objectstack/connector-slack
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+  - @objectstack/core@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/connectors/connector-slack/package.json b/packages/connectors/connector-slack/package.json
index c229aefafa..7ebcc94e49 100644
--- a/packages/connectors/connector-slack/package.json
+++ b/packages/connectors/connector-slack/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/connector-slack",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "Slack Web API connector for ObjectStack — registers `chat.postMessage` / `chat.update` / `call` actions on the automation engine's connector registry (ADR-0018 §Addendum, ADR-0022).",
   "main": "dist/index.js",
diff --git a/packages/console/CHANGELOG.md b/packages/console/CHANGELOG.md
index b1e9c52898..09b62fa65b 100644
--- a/packages/console/CHANGELOG.md
+++ b/packages/console/CHANGELOG.md
@@ -1,5 +1,7 @@
 # @objectstack/console
 
+## 10.1.0
+
 ## 10.0.0
 
 ## 9.11.0
diff --git a/packages/console/package.json b/packages/console/package.json
index 71f489c021..ed0d6b1be6 100644
--- a/packages/console/package.json
+++ b/packages/console/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/console",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "description": "Prebuilt Console SPA pinned to this @objectstack/framework release. Source of truth: @object-ui/console (https://github.com/objectstack-ai/objectui).",
   "license": "Apache-2.0",
   "homepage": "https://github.com/objectstack-ai/framework/tree/main/packages/console",
diff --git a/packages/core/CHANGELOG.md b/packages/core/CHANGELOG.md
index e2d4d4d963..060d0ba6a4 100644
--- a/packages/core/CHANGELOG.md
+++ b/packages/core/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @objectstack/core
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/core/package.json b/packages/core/package.json
index 1327ab0374..099f502752 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/core",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "Microkernel Core for ObjectStack",
   "type": "module",
diff --git a/packages/create-objectstack/CHANGELOG.md b/packages/create-objectstack/CHANGELOG.md
index 275c87acd6..4389bc5a5e 100644
--- a/packages/create-objectstack/CHANGELOG.md
+++ b/packages/create-objectstack/CHANGELOG.md
@@ -1,5 +1,25 @@
 # create-objectstack
 
+## 10.1.0
+
+### Minor Changes
+
+- 7cf283a: Make `os validate` the author-time verification gate and steer scaffolds toward it.
+
+  - **`os validate`** now runs the same CEL/predicate gate as `os build`/`os compile`
+    (ADR-0032): every `visible`/`disabled`/`requiredWhen`/validation/flow/sharing
+    predicate is checked for CEL syntax and `record.<field>` existence on the target
+    object. It already ran the protocol schema and widget-binding checks; the
+    expression gate closes the gap so a bare field ref (`done` instead of
+    `record.done`) — which silently hides an action on every record at runtime
+    (#2183/#2185) — fails validation instead of shipping. `os validate` is now a
+    read-only superset of the build's checks (no artifact emitted).
+  - **`create-objectstack`** now emits an `AGENTS.md` (and `.github/copilot-instructions.md`)
+    into every generated project instructing coding agents to run `npm run validate`
+    after editing metadata, aligns the blank template's `dev`/`start` scripts with the
+    example apps (`objectstack dev`/`objectstack start`), and sharpens the post-create
+    "Next steps" output.
+
 ## 10.0.0
 
 ## 9.11.0
diff --git a/packages/create-objectstack/package.json b/packages/create-objectstack/package.json
index 74b36e2283..027a2c60ea 100644
--- a/packages/create-objectstack/package.json
+++ b/packages/create-objectstack/package.json
@@ -1,6 +1,6 @@
 {
   "name": "create-objectstack",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "description": "Create a new ObjectStack project — npx create-objectstack",
   "bin": {
     "create-objectstack": "./bin/create-objectstack.js"
diff --git a/packages/dogfood/CHANGELOG.md b/packages/dogfood/CHANGELOG.md
index f83de2cb1d..defa6cee89 100644
--- a/packages/dogfood/CHANGELOG.md
+++ b/packages/dogfood/CHANGELOG.md
@@ -1,5 +1,19 @@
 # @objectstack/dogfood
 
+## 0.0.4
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+- Updated dependencies [49da36e]
+  - @objectstack/spec@10.1.0
+  - @objectstack/verify@10.1.0
+  - @objectstack/example-crm@4.0.56
+  - @objectstack/example-showcase@0.2.2
+  - @objectstack/objectql@10.1.0
+  - @objectstack/plugin-security@10.1.0
+
 ## 0.0.3
 
 ### Patch Changes
diff --git a/packages/dogfood/package.json b/packages/dogfood/package.json
index 54478d7ba3..f6ddc71191 100644
--- a/packages/dogfood/package.json
+++ b/packages/dogfood/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/dogfood",
-  "version": "0.0.3",
+  "version": "0.0.4",
   "private": true,
   "license": "Apache-2.0",
   "description": "Dogfood regression gate — hand-written golden tests that boot real example apps through @objectstack/verify's in-process HTTP stack, pinning historical runtime regressions (#2018 timezone bucketing, #1994 cross-owner RLS, #2004 field fidelity) that static checks miss.",
diff --git a/packages/downstream-contract/CHANGELOG.md b/packages/downstream-contract/CHANGELOG.md
index e0eef73ce4..0ee371eba5 100644
--- a/packages/downstream-contract/CHANGELOG.md
+++ b/packages/downstream-contract/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @objectstack/downstream-contract
 
+## 0.0.2
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+
 ## 0.0.1
 
 ### Patch Changes
diff --git a/packages/downstream-contract/package.json b/packages/downstream-contract/package.json
index 3d0111f766..ddfe5c8ca6 100644
--- a/packages/downstream-contract/package.json
+++ b/packages/downstream-contract/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/downstream-contract",
-  "version": "0.0.1",
+  "version": "0.0.2",
   "description": "Frozen third-party consumer fixture — a backward-compatibility gate for @objectstack/spec. Authored the way an external project on a published release authors metadata; if a spec change breaks it, that change is breaking (#2035).",
   "license": "Apache-2.0",
   "private": true,
diff --git a/packages/formula/CHANGELOG.md b/packages/formula/CHANGELOG.md
index 99fd835508..62f207ffc7 100644
--- a/packages/formula/CHANGELOG.md
+++ b/packages/formula/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @objectstack/formula
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+
 ## 10.0.0
 
 ### Minor Changes
diff --git a/packages/formula/package.json b/packages/formula/package.json
index 44346285ec..05aee97ff5 100644
--- a/packages/formula/package.json
+++ b/packages/formula/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/formula",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "ObjectStack canonical expression engine — CEL (cel-js) + ObjectStack stdlib + dialect registry",
   "main": "dist/index.js",
diff --git a/packages/mcp/CHANGELOG.md b/packages/mcp/CHANGELOG.md
index b603c1638f..85f384e2a4 100644
--- a/packages/mcp/CHANGELOG.md
+++ b/packages/mcp/CHANGELOG.md
@@ -1,5 +1,15 @@
 # @objectstack/plugin-mcp-server
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+  - @objectstack/core@10.1.0
+  - @objectstack/types@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/mcp/package.json b/packages/mcp/package.json
index c4b0a23a5c..104df5208a 100644
--- a/packages/mcp/package.json
+++ b/packages/mcp/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/mcp",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "ObjectStack as an MCP server — exposes your app's objects (and AI tools) over the Model Context Protocol (stdio + Streamable HTTP)",
   "type": "module",
diff --git a/packages/metadata-core/CHANGELOG.md b/packages/metadata-core/CHANGELOG.md
index 8ae2ee0411..902e5eb29b 100644
--- a/packages/metadata-core/CHANGELOG.md
+++ b/packages/metadata-core/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @objectstack/metadata-core
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/metadata-core/package.json b/packages/metadata-core/package.json
index eb612972cc..b83ab962b8 100644
--- a/packages/metadata-core/package.json
+++ b/packages/metadata-core/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/metadata-core",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "Metadata Repository contracts: types, canonicalization, errors, interface (ADR-0008).",
   "type": "module",
diff --git a/packages/metadata-fs/CHANGELOG.md b/packages/metadata-fs/CHANGELOG.md
index d9d6c58e94..5308130045 100644
--- a/packages/metadata-fs/CHANGELOG.md
+++ b/packages/metadata-fs/CHANGELOG.md
@@ -1,5 +1,11 @@
 # @objectstack/metadata-fs
 
+## 10.1.0
+
+### Patch Changes
+
+- @objectstack/metadata-core@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/metadata-fs/package.json b/packages/metadata-fs/package.json
index 410bb4caec..aeed02440a 100644
--- a/packages/metadata-fs/package.json
+++ b/packages/metadata-fs/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/metadata-fs",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "FileSystemRepository: Node-only Repository implementation backed by JSON files and a JSONL change log (ADR-0008).",
   "type": "module",
diff --git a/packages/metadata/CHANGELOG.md b/packages/metadata/CHANGELOG.md
index 8f91f07844..8fa549d98d 100644
--- a/packages/metadata/CHANGELOG.md
+++ b/packages/metadata/CHANGELOG.md
@@ -1,5 +1,18 @@
 # @objectstack/metadata
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+  - @objectstack/core@10.1.0
+  - @objectstack/metadata-core@10.1.0
+  - @objectstack/platform-objects@10.1.0
+  - @objectstack/types@10.1.0
+  - @objectstack/metadata-fs@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/metadata/package.json b/packages/metadata/package.json
index cb237e817e..c366f331ea 100644
--- a/packages/metadata/package.json
+++ b/packages/metadata/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/metadata",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "Metadata loading, saving, and persistence for ObjectStack",
   "type": "module",
diff --git a/packages/objectql/CHANGELOG.md b/packages/objectql/CHANGELOG.md
index 6cd8b79887..c489de7187 100644
--- a/packages/objectql/CHANGELOG.md
+++ b/packages/objectql/CHANGELOG.md
@@ -1,5 +1,17 @@
 # @objectstack/objectql
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+  - @objectstack/core@10.1.0
+  - @objectstack/formula@10.1.0
+  - @objectstack/metadata-core@10.1.0
+  - @objectstack/types@10.1.0
+
 ## 10.0.0
 
 ### Minor Changes
diff --git a/packages/objectql/package.json b/packages/objectql/package.json
index 7f6fef4b2a..090f8a50a2 100644
--- a/packages/objectql/package.json
+++ b/packages/objectql/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/objectql",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "Isomorphic ObjectQL Engine for ObjectStack",
   "main": "dist/index.js",
diff --git a/packages/observability/CHANGELOG.md b/packages/observability/CHANGELOG.md
index 56335d402a..bdfb9ac8b0 100644
--- a/packages/observability/CHANGELOG.md
+++ b/packages/observability/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @objectstack/observability
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/observability/package.json b/packages/observability/package.json
index f010a0dc7d..c069ffc4e2 100644
--- a/packages/observability/package.json
+++ b/packages/observability/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/observability",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "Observability contracts and exporters for ObjectStack — MetricsRegistry, ErrorReporter, Logger plus noop/console/OTLP-HTTP exporters. Deployment-target neutral; runtime and services depend on this so the same instrumentation works on Cloudflare Workers, Node, and self-hosted Kubernetes.",
   "type": "module",
diff --git a/packages/platform-objects/CHANGELOG.md b/packages/platform-objects/CHANGELOG.md
index 48f2db6b72..e05c0d9700 100644
--- a/packages/platform-objects/CHANGELOG.md
+++ b/packages/platform-objects/CHANGELOG.md
@@ -1,5 +1,14 @@
 # @objectstack/platform-objects
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+  - @objectstack/metadata-core@10.1.0
+
 ## 10.0.0
 
 ### Major Changes
diff --git a/packages/platform-objects/package.json b/packages/platform-objects/package.json
index 38eb5cc6d9..96283ae993 100644
--- a/packages/platform-objects/package.json
+++ b/packages/platform-objects/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/platform-objects",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "Core platform object schemas for ObjectStack — identity, security, audit, tenant, and metadata objects",
   "main": "dist/index.js",
diff --git a/packages/plugins/driver-memory/CHANGELOG.md b/packages/plugins/driver-memory/CHANGELOG.md
index f4e1de60d5..3c6184bbf6 100644
--- a/packages/plugins/driver-memory/CHANGELOG.md
+++ b/packages/plugins/driver-memory/CHANGELOG.md
@@ -1,5 +1,14 @@
 # @objectstack/driver-memory
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+  - @objectstack/core@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/plugins/driver-memory/package.json b/packages/plugins/driver-memory/package.json
index 5ce68fc505..dc470c2627 100644
--- a/packages/plugins/driver-memory/package.json
+++ b/packages/plugins/driver-memory/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/driver-memory",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "In-Memory Driver for ObjectStack (Reference Implementation)",
   "main": "dist/index.js",
diff --git a/packages/plugins/driver-mongodb/CHANGELOG.md b/packages/plugins/driver-mongodb/CHANGELOG.md
index 915bb7bc12..63bfb0daca 100644
--- a/packages/plugins/driver-mongodb/CHANGELOG.md
+++ b/packages/plugins/driver-mongodb/CHANGELOG.md
@@ -1,5 +1,14 @@
 # @objectstack/driver-mongodb
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+  - @objectstack/core@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/plugins/driver-mongodb/package.json b/packages/plugins/driver-mongodb/package.json
index a22c0a8d0a..c9213d16e6 100644
--- a/packages/plugins/driver-mongodb/package.json
+++ b/packages/plugins/driver-mongodb/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/driver-mongodb",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "MongoDB Driver for ObjectStack - Native document database driver via official mongodb client",
   "main": "dist/index.js",
diff --git a/packages/plugins/driver-sql/CHANGELOG.md b/packages/plugins/driver-sql/CHANGELOG.md
index a6f8376e9e..469a5272b2 100644
--- a/packages/plugins/driver-sql/CHANGELOG.md
+++ b/packages/plugins/driver-sql/CHANGELOG.md
@@ -1,5 +1,42 @@
 # @objectstack/driver-sql
 
+## 10.1.0
+
+### Minor Changes
+
+- 517dad9: Schema drift detection + `os migrate` for non-additive metadata changes (#2186).
+
+  The metadata→DB schema sync was additive-only: it created tables and added
+  columns but never altered/dropped existing ones, so relaxing `required`,
+  changing a type/length, or dropping a field silently diverged from an existing
+  database. The physical column won at write time, surfacing a misleading
+  `organization_id is required` 400 even though `/meta` reported the field
+  optional.
+
+  - **driver-sql** — the SQL driver now detects managed-schema drift (metadata is
+    the source of truth) and categorises each divergence `safe` / `needs_confirm`
+    / `destructive`. `initObjects` warns once per divergence with an actionable
+    hint. A new opt-in `SqlDriverConfig.autoMigrate: 'safe'` auto-applies the
+    _loosening_ subset (relax `NOT NULL`, widen varchar) so an existing dev DB
+    self-heals on restart — never destructive, force-disabled under
+    `NODE_ENV=production`. New public methods `detectManagedDrift()` /
+    `applyMigrationEntries()`. SQLite reconciles via the official table-rebuild
+    (copy → swap), preserving data; Postgres/MySQL alter in place.
+  - **cli** — new `os migrate plan` (dry-run, categorised diff) and
+    `os migrate apply` (`--allow-destructive` for drops/tightenings, confirm gate,
+    `--json`). `os dev`/`serve` now pass `autoMigrate: 'safe'` in dev only.
+  - **rest** — a `NOT NULL` violation that reaches the driver (metadata validation
+    already passed) now carries a drift-aware `hint` pointing at `os migrate`,
+    instead of only the misleading "field is required" message. The
+    `VALIDATION_FAILED` / `fields` envelope is unchanged for back-compat.
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+  - @objectstack/core@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/plugins/driver-sql/package.json b/packages/plugins/driver-sql/package.json
index 7366a66f5a..312b7df349 100644
--- a/packages/plugins/driver-sql/package.json
+++ b/packages/plugins/driver-sql/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/driver-sql",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "SQL Driver for ObjectStack - Supports PostgreSQL, MySQL, SQLite via Knex",
   "main": "dist/index.js",
diff --git a/packages/plugins/driver-sqlite-wasm/CHANGELOG.md b/packages/plugins/driver-sqlite-wasm/CHANGELOG.md
index 9ec1bd30c8..5134b2c013 100644
--- a/packages/plugins/driver-sqlite-wasm/CHANGELOG.md
+++ b/packages/plugins/driver-sqlite-wasm/CHANGELOG.md
@@ -1,5 +1,16 @@
 # @objectstack/driver-sqlite-wasm
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+- Updated dependencies [517dad9]
+  - @objectstack/spec@10.1.0
+  - @objectstack/driver-sql@10.1.0
+  - @objectstack/core@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/plugins/driver-sqlite-wasm/package.json b/packages/plugins/driver-sqlite-wasm/package.json
index 37a643c649..c05f9b8d25 100644
--- a/packages/plugins/driver-sqlite-wasm/package.json
+++ b/packages/plugins/driver-sqlite-wasm/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/driver-sqlite-wasm",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "WASM SQLite Driver for ObjectStack — runs in browser/WebContainer (StackBlitz) without native bindings",
   "keywords": [
diff --git a/packages/plugins/embedder-openai/CHANGELOG.md b/packages/plugins/embedder-openai/CHANGELOG.md
index 06fd5eaca0..c68e680d15 100644
--- a/packages/plugins/embedder-openai/CHANGELOG.md
+++ b/packages/plugins/embedder-openai/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @objectstack/embedder-openai
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/plugins/embedder-openai/package.json b/packages/plugins/embedder-openai/package.json
index 81e80ad20e..4eaeeace68 100644
--- a/packages/plugins/embedder-openai/package.json
+++ b/packages/plugins/embedder-openai/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/embedder-openai",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "OpenAI-compatible embedder for ObjectStack — works against OpenAI, 阿里通义 DashScope, 智谱 BigModel, 硅基流动 SiliconFlow, 火山引擎 Doubao, MiniMax, Ollama, and any drop-in OpenAI-shape endpoint.",
   "main": "dist/index.js",
diff --git a/packages/plugins/knowledge-memory/CHANGELOG.md b/packages/plugins/knowledge-memory/CHANGELOG.md
index 911a6926e5..15827d2e9a 100644
--- a/packages/plugins/knowledge-memory/CHANGELOG.md
+++ b/packages/plugins/knowledge-memory/CHANGELOG.md
@@ -1,5 +1,15 @@
 # @objectstack/knowledge-memory
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+  - @objectstack/core@10.1.0
+  - @objectstack/service-knowledge@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/plugins/knowledge-memory/package.json b/packages/plugins/knowledge-memory/package.json
index 417740b483..a12e7842d8 100644
--- a/packages/plugins/knowledge-memory/package.json
+++ b/packages/plugins/knowledge-memory/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/knowledge-memory",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "In-memory knowledge adapter for ObjectStack (dev / test reference implementation).",
   "main": "dist/index.js",
diff --git a/packages/plugins/knowledge-ragflow/CHANGELOG.md b/packages/plugins/knowledge-ragflow/CHANGELOG.md
index 0b113953a4..4477c725ac 100644
--- a/packages/plugins/knowledge-ragflow/CHANGELOG.md
+++ b/packages/plugins/knowledge-ragflow/CHANGELOG.md
@@ -1,5 +1,15 @@
 # @objectstack/knowledge-ragflow
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+  - @objectstack/core@10.1.0
+  - @objectstack/service-knowledge@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/plugins/knowledge-ragflow/package.json b/packages/plugins/knowledge-ragflow/package.json
index 44d44e5c13..09a25442cd 100644
--- a/packages/plugins/knowledge-ragflow/package.json
+++ b/packages/plugins/knowledge-ragflow/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/knowledge-ragflow",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "RAGFlow knowledge adapter for ObjectStack — production-grade RAG via the Apache 2.0 RAGFlow REST API.",
   "main": "dist/index.js",
diff --git a/packages/plugins/plugin-approvals/CHANGELOG.md b/packages/plugins/plugin-approvals/CHANGELOG.md
index 709d2a3a2b..df9d252e36 100644
--- a/packages/plugins/plugin-approvals/CHANGELOG.md
+++ b/packages/plugins/plugin-approvals/CHANGELOG.md
@@ -1,5 +1,17 @@
 # @objectstack/plugin-approvals
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+  - @objectstack/core@10.1.0
+  - @objectstack/formula@10.1.0
+  - @objectstack/metadata-core@10.1.0
+  - @objectstack/platform-objects@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/plugins/plugin-approvals/package.json b/packages/plugins/plugin-approvals/package.json
index 33c0fbeb5c..91a920fbd0 100644
--- a/packages/plugins/plugin-approvals/package.json
+++ b/packages/plugins/plugin-approvals/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/plugin-approvals",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "Multi-step approval engine for ObjectStack — sys_approval_process + sys_approval_request + sys_approval_action + IApprovalService.",
   "main": "dist/index.js",
diff --git a/packages/plugins/plugin-audit/CHANGELOG.md b/packages/plugins/plugin-audit/CHANGELOG.md
index 0e3d60394f..49ef877e41 100644
--- a/packages/plugins/plugin-audit/CHANGELOG.md
+++ b/packages/plugins/plugin-audit/CHANGELOG.md
@@ -1,5 +1,15 @@
 # @objectstack/plugin-audit
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+  - @objectstack/core@10.1.0
+  - @objectstack/platform-objects@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/plugins/plugin-audit/package.json b/packages/plugins/plugin-audit/package.json
index de9693f2ae..24cf35ebf7 100644
--- a/packages/plugins/plugin-audit/package.json
+++ b/packages/plugins/plugin-audit/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/plugin-audit",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "Audit Plugin for ObjectStack — System audit log object and audit trail",
   "main": "dist/index.js",
diff --git a/packages/plugins/plugin-auth/CHANGELOG.md b/packages/plugins/plugin-auth/CHANGELOG.md
index 8c2ddc40e4..a3741dce26 100644
--- a/packages/plugins/plugin-auth/CHANGELOG.md
+++ b/packages/plugins/plugin-auth/CHANGELOG.md
@@ -1,5 +1,16 @@
 # Changelog
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+  - @objectstack/core@10.1.0
+  - @objectstack/platform-objects@10.1.0
+  - @objectstack/types@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/plugins/plugin-auth/package.json b/packages/plugins/plugin-auth/package.json
index f0ed3de3da..6d16619442 100644
--- a/packages/plugins/plugin-auth/package.json
+++ b/packages/plugins/plugin-auth/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/plugin-auth",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "Authentication & Identity Plugin for ObjectStack",
   "main": "dist/index.js",
diff --git a/packages/plugins/plugin-dev/CHANGELOG.md b/packages/plugins/plugin-dev/CHANGELOG.md
index eafd51ccbc..2c4161a234 100644
--- a/packages/plugins/plugin-dev/CHANGELOG.md
+++ b/packages/plugins/plugin-dev/CHANGELOG.md
@@ -1,5 +1,29 @@
 # @objectstack/plugin-dev
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+- Updated dependencies [94d2161]
+- Updated dependencies [517dad9]
+  - @objectstack/spec@10.1.0
+  - @objectstack/runtime@10.1.0
+  - @objectstack/rest@10.1.0
+  - @objectstack/account@10.1.0
+  - @objectstack/setup@10.1.0
+  - @objectstack/studio@10.1.0
+  - @objectstack/core@10.1.0
+  - @objectstack/objectql@10.1.0
+  - @objectstack/driver-memory@10.1.0
+  - @objectstack/plugin-auth@10.1.0
+  - @objectstack/plugin-hono-server@10.1.0
+  - @objectstack/plugin-org-scoping@10.1.0
+  - @objectstack/plugin-security@10.1.0
+  - @objectstack/service-i18n@10.1.0
+  - @objectstack/types@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/plugins/plugin-dev/package.json b/packages/plugins/plugin-dev/package.json
index 150d9bf8df..3653375f87 100644
--- a/packages/plugins/plugin-dev/package.json
+++ b/packages/plugins/plugin-dev/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/plugin-dev",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "Development Mode Plugin for ObjectStack — auto-enables all services with in-memory implementations",
   "main": "dist/index.js",
diff --git a/packages/plugins/plugin-email/CHANGELOG.md b/packages/plugins/plugin-email/CHANGELOG.md
index 9414330108..397d7bc17b 100644
--- a/packages/plugins/plugin-email/CHANGELOG.md
+++ b/packages/plugins/plugin-email/CHANGELOG.md
@@ -1,5 +1,16 @@
 # @objectstack/plugin-email
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+  - @objectstack/core@10.1.0
+  - @objectstack/formula@10.1.0
+  - @objectstack/platform-objects@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/plugins/plugin-email/package.json b/packages/plugins/plugin-email/package.json
index 18bf5e27a9..c72e8ca229 100644
--- a/packages/plugins/plugin-email/package.json
+++ b/packages/plugins/plugin-email/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/plugin-email",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "Email service plugin for ObjectStack — IEmailService + transport-pluggable outbound delivery with sys_email persistence.",
   "main": "dist/index.js",
diff --git a/packages/plugins/plugin-hono-server/CHANGELOG.md b/packages/plugins/plugin-hono-server/CHANGELOG.md
index 3c020907e4..e0e2aad861 100644
--- a/packages/plugins/plugin-hono-server/CHANGELOG.md
+++ b/packages/plugins/plugin-hono-server/CHANGELOG.md
@@ -1,5 +1,15 @@
 # @objectstack/plugin-hono-server
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+  - @objectstack/core@10.1.0
+  - @objectstack/types@10.1.0
+
 ## 10.0.0
 
 ### Minor Changes
diff --git a/packages/plugins/plugin-hono-server/package.json b/packages/plugins/plugin-hono-server/package.json
index e5d0b598cc..861e3851f5 100644
--- a/packages/plugins/plugin-hono-server/package.json
+++ b/packages/plugins/plugin-hono-server/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/plugin-hono-server",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "Standard Hono Server Adapter for ObjectStack Runtime",
   "main": "dist/index.js",
diff --git a/packages/plugins/plugin-msw/CHANGELOG.md b/packages/plugins/plugin-msw/CHANGELOG.md
index 2390380c59..4e8b21cdfa 100644
--- a/packages/plugins/plugin-msw/CHANGELOG.md
+++ b/packages/plugins/plugin-msw/CHANGELOG.md
@@ -1,5 +1,18 @@
 # @objectstack/plugin-msw
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+- Updated dependencies [94d2161]
+  - @objectstack/spec@10.1.0
+  - @objectstack/runtime@10.1.0
+  - @objectstack/core@10.1.0
+  - @objectstack/objectql@10.1.0
+  - @objectstack/types@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/plugins/plugin-msw/package.json b/packages/plugins/plugin-msw/package.json
index 076fd3a4ab..5612ecfd74 100644
--- a/packages/plugins/plugin-msw/package.json
+++ b/packages/plugins/plugin-msw/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/plugin-msw",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "description": "MSW (Mock Service Worker) Plugin for ObjectStack Runtime",
   "license": "Apache-2.0",
   "main": "dist/index.js",
diff --git a/packages/plugins/plugin-org-scoping/CHANGELOG.md b/packages/plugins/plugin-org-scoping/CHANGELOG.md
index fc2d24c29f..6088405344 100644
--- a/packages/plugins/plugin-org-scoping/CHANGELOG.md
+++ b/packages/plugins/plugin-org-scoping/CHANGELOG.md
@@ -1,5 +1,15 @@
 # @objectstack/plugin-org-scoping
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+  - @objectstack/core@10.1.0
+  - @objectstack/platform-objects@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/plugins/plugin-org-scoping/package.json b/packages/plugins/plugin-org-scoping/package.json
index 2e1943e5a2..58c906a884 100644
--- a/packages/plugins/plugin-org-scoping/package.json
+++ b/packages/plugins/plugin-org-scoping/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/plugin-org-scoping",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "Organization-Scoping Plugin for ObjectStack — row-level Organization isolation, per-org seed replay, default-org bootstrap",
   "main": "dist/index.js",
diff --git a/packages/plugins/plugin-reports/CHANGELOG.md b/packages/plugins/plugin-reports/CHANGELOG.md
index b340504d93..0b24e90862 100644
--- a/packages/plugins/plugin-reports/CHANGELOG.md
+++ b/packages/plugins/plugin-reports/CHANGELOG.md
@@ -1,5 +1,15 @@
 # @objectstack/plugin-reports
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+  - @objectstack/core@10.1.0
+  - @objectstack/platform-objects@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/plugins/plugin-reports/package.json b/packages/plugins/plugin-reports/package.json
index 6dea53904a..751788d597 100644
--- a/packages/plugins/plugin-reports/package.json
+++ b/packages/plugins/plugin-reports/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/plugin-reports",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "Saved reports + scheduled email digests for ObjectStack — sys_saved_report + sys_report_schedule + IReportService.",
   "main": "dist/index.js",
diff --git a/packages/plugins/plugin-security/CHANGELOG.md b/packages/plugins/plugin-security/CHANGELOG.md
index ad5c7a165b..ea68fa4c06 100644
--- a/packages/plugins/plugin-security/CHANGELOG.md
+++ b/packages/plugins/plugin-security/CHANGELOG.md
@@ -1,5 +1,16 @@
 # @objectstack/plugin-security
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+  - @objectstack/core@10.1.0
+  - @objectstack/formula@10.1.0
+  - @objectstack/platform-objects@10.1.0
+
 ## 10.0.0
 
 ### Minor Changes
diff --git a/packages/plugins/plugin-security/package.json b/packages/plugins/plugin-security/package.json
index 356f450006..70dd07cdac 100644
--- a/packages/plugins/plugin-security/package.json
+++ b/packages/plugins/plugin-security/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/plugin-security",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "Security Plugin for ObjectStack — RBAC, RLS, and Field-Level Security Runtime",
   "main": "dist/index.js",
diff --git a/packages/plugins/plugin-sharing/CHANGELOG.md b/packages/plugins/plugin-sharing/CHANGELOG.md
index 134ad41dff..38733ca26b 100644
--- a/packages/plugins/plugin-sharing/CHANGELOG.md
+++ b/packages/plugins/plugin-sharing/CHANGELOG.md
@@ -1,5 +1,17 @@
 # @objectstack/plugin-sharing
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+  - @objectstack/core@10.1.0
+  - @objectstack/formula@10.1.0
+  - @objectstack/objectql@10.1.0
+  - @objectstack/platform-objects@10.1.0
+
 ## 10.0.0
 
 ### Major Changes
diff --git a/packages/plugins/plugin-sharing/package.json b/packages/plugins/plugin-sharing/package.json
index b767ce1b2a..6f0086763c 100644
--- a/packages/plugins/plugin-sharing/package.json
+++ b/packages/plugins/plugin-sharing/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/plugin-sharing",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "Record-level sharing for ObjectStack — sys_record_share + middleware that enforces sharingModel + ISharingService.",
   "main": "dist/index.js",
diff --git a/packages/plugins/plugin-webhooks/CHANGELOG.md b/packages/plugins/plugin-webhooks/CHANGELOG.md
index 8bf4ac8cb9..97f06a0a20 100644
--- a/packages/plugins/plugin-webhooks/CHANGELOG.md
+++ b/packages/plugins/plugin-webhooks/CHANGELOG.md
@@ -1,5 +1,15 @@
 # @objectstack/plugin-webhooks
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+  - @objectstack/core@10.1.0
+  - @objectstack/service-messaging@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/plugins/plugin-webhooks/package.json b/packages/plugins/plugin-webhooks/package.json
index e72bf79db0..5ccfe01320 100644
--- a/packages/plugins/plugin-webhooks/package.json
+++ b/packages/plugins/plugin-webhooks/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/plugin-webhooks",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "Persistent, cluster-aware webhook dispatcher. Durable outbox + per-partition cluster.lock for exactly-once-ish delivery across nodes. See content/docs/concepts/webhook-delivery.mdx.",
   "type": "module",
diff --git a/packages/rest/CHANGELOG.md b/packages/rest/CHANGELOG.md
index 69008ef009..a42cfbde98 100644
--- a/packages/rest/CHANGELOG.md
+++ b/packages/rest/CHANGELOG.md
@@ -1,5 +1,41 @@
 # @objectstack/rest
 
+## 10.1.0
+
+### Patch Changes
+
+- 517dad9: Schema drift detection + `os migrate` for non-additive metadata changes (#2186).
+
+  The metadata→DB schema sync was additive-only: it created tables and added
+  columns but never altered/dropped existing ones, so relaxing `required`,
+  changing a type/length, or dropping a field silently diverged from an existing
+  database. The physical column won at write time, surfacing a misleading
+  `organization_id is required` 400 even though `/meta` reported the field
+  optional.
+
+  - **driver-sql** — the SQL driver now detects managed-schema drift (metadata is
+    the source of truth) and categorises each divergence `safe` / `needs_confirm`
+    / `destructive`. `initObjects` warns once per divergence with an actionable
+    hint. A new opt-in `SqlDriverConfig.autoMigrate: 'safe'` auto-applies the
+    _loosening_ subset (relax `NOT NULL`, widen varchar) so an existing dev DB
+    self-heals on restart — never destructive, force-disabled under
+    `NODE_ENV=production`. New public methods `detectManagedDrift()` /
+    `applyMigrationEntries()`. SQLite reconciles via the official table-rebuild
+    (copy → swap), preserving data; Postgres/MySQL alter in place.
+  - **cli** — new `os migrate plan` (dry-run, categorised diff) and
+    `os migrate apply` (`--allow-destructive` for drops/tightenings, confirm gate,
+    `--json`). `os dev`/`serve` now pass `autoMigrate: 'safe'` in dev only.
+  - **rest** — a `NOT NULL` violation that reaches the driver (metadata validation
+    already passed) now carries a drift-aware `hint` pointing at `os migrate`,
+    instead of only the misleading "field is required" message. The
+    `VALIDATION_FAILED` / `fields` envelope is unchanged for back-compat.
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+  - @objectstack/core@10.1.0
+  - @objectstack/service-package@10.1.0
+
 ## 10.0.0
 
 ### Minor Changes
diff --git a/packages/rest/package.json b/packages/rest/package.json
index 4f94a006a2..489453aa77 100644
--- a/packages/rest/package.json
+++ b/packages/rest/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/rest",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "ObjectStack REST API Server - automatic REST endpoint generation from protocol",
   "type": "module",
diff --git a/packages/runtime/CHANGELOG.md b/packages/runtime/CHANGELOG.md
index 3c641a7061..0861b6d771 100644
--- a/packages/runtime/CHANGELOG.md
+++ b/packages/runtime/CHANGELOG.md
@@ -1,5 +1,84 @@
 # @objectstack/runtime
 
+## 10.1.0
+
+### Minor Changes
+
+- ac79f16: feat(datasource): auto-connect declared external datasources (ADR-0062 Phase 1, D1/D2/D5)
+
+  A declared external datasource is now connected to a live ObjectQL driver and its
+  federated objects are queryable **with zero app code** — no `onEnable` driver
+  wiring. Implements ADR-0062 Phase 1.
+
+  - **D1 — one connect path.** New `DatasourceConnectionService` in
+    `@objectstack/service-datasource` owns the single "definition → live driver"
+    path: build via the injected driver factory → resolve `external.credentialsRef`
+    via the `SecretBinder` → connect → `engine.registerDriver` under the datasource
+    name → register the datasource def → sync each bound federated object's read
+    metadata (DDL-free). Both origins converge on it: the runtime-admin
+    `registerPool` now delegates here, and `AppPlugin` auto-connects code-defined
+    datasources. Exposed as the `'datasource-connection'` kernel service.
+  - **D2 — opt-in-safe gate.** A declared datasource auto-connects only when it is
+    `external`, an object **explicitly** binds to it via `object.datasource`, or it
+    sets the new `autoConnect: true` flag. A managed datasource that nothing
+    explicitly binds (incl. ones referenced only by a `datasourceMapping` rule, e.g.
+    `examples/app-crm`'s `:memory:` datasources) stays metadata-only — existing apps
+    are byte-for-byte unchanged. See the ADR-0062 D2 implementation note.
+  - **D5 — lifecycle, ordering & policy.** Connect happens in `AppPlugin.start()`
+    (before the `kernel:ready` validation gate, relying on the kernel's
+    init-all-then-start-all ordering). Fail-fast for a declared `external` datasource
+    with `validation.onMismatch: 'fail'`; degrade-with-warning otherwise (and always
+    for runtime-admin/rehydrate, so a UI action or replica blip never bricks the
+    server). Adds a host-injectable `DatasourceConnectPolicy` (open-core default
+    allows; a multi-tenant host binds a stricter fail-closed policy for egress
+    isolation) consulted before every connect — one connect path, no cloud fork.
+
+  Adds `datasource.autoConnect` to the spec. The legacy `onEnable` +
+  `ctx.drivers.register` bridge remains supported as an escape hatch (idempotent vs.
+  auto-connect). No behavior change for managed apps.
+
+### Patch Changes
+
+- 94d2161: refactor(runtime): build the standalone default driver via the shared datasource factory (ADR-0062 follow-up)
+
+  `createStandaloneStack` now constructs its `default` driver for the user-facing
+  kinds (memory / better-sqlite3 / postgres / mongodb) through the **same**
+  `createDefaultDatasourceDriverFactory` used for declared and runtime-admin
+  datasources — one "driver kind → instance" construction path instead of two
+  hand-mirrored ones. Adding a dialect or changing connection/pool defaults now
+  happens in a single place. URL→config translation, filesystem prep (`mkdir`),
+  and pre-engine `DriverPlugin` registration stay in the stack (unchanged); the
+  factory only constructs the driver. The pure-JS WASM sqlite driver stays bespoke
+  in the stack — it's the standalone-specific, CI-safe default and not a
+  user-creatable datasource type, so it has a single construction site already.
+
+  No behavior change: the same driver instances are built for the same inputs
+  (verified by a per-kind connect + CRUD round-trip test and a real `os dev` boot).
+  Adds `@objectstack/service-datasource` as a runtime dependency (no cycle — that
+  package depends only on core/spec).
+
+- Updated dependencies [49da36e]
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+- Updated dependencies [517dad9]
+  - @objectstack/spec@10.1.0
+  - @objectstack/service-datasource@10.1.0
+  - @objectstack/driver-sql@10.1.0
+  - @objectstack/rest@10.1.0
+  - @objectstack/core@10.1.0
+  - @objectstack/formula@10.1.0
+  - @objectstack/metadata@10.1.0
+  - @objectstack/objectql@10.1.0
+  - @objectstack/observability@10.1.0
+  - @objectstack/driver-memory@10.1.0
+  - @objectstack/driver-sqlite-wasm@10.1.0
+  - @objectstack/plugin-auth@10.1.0
+  - @objectstack/plugin-org-scoping@10.1.0
+  - @objectstack/plugin-security@10.1.0
+  - @objectstack/service-cluster@10.1.0
+  - @objectstack/service-i18n@10.1.0
+  - @objectstack/types@10.1.0
+
 ## 10.0.0
 
 ### Minor Changes
diff --git a/packages/runtime/package.json b/packages/runtime/package.json
index cfeec8d971..177ed4bbe4 100644
--- a/packages/runtime/package.json
+++ b/packages/runtime/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/runtime",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "ObjectStack Core Runtime & Query Engine",
   "type": "module",
diff --git a/packages/services/service-ai/CHANGELOG.md b/packages/services/service-ai/CHANGELOG.md
index 94ca7c0644..9de9da0bb4 100644
--- a/packages/services/service-ai/CHANGELOG.md
+++ b/packages/services/service-ai/CHANGELOG.md
@@ -1,5 +1,16 @@
 # @objectstack/service-ai
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+  - @objectstack/core@10.1.0
+  - @objectstack/formula@10.1.0
+  - @objectstack/types@10.1.0
+
 ## 10.0.0
 
 ### Minor Changes
diff --git a/packages/services/service-ai/package.json b/packages/services/service-ai/package.json
index 03b8d83d4b..d431ba6a03 100644
--- a/packages/services/service-ai/package.json
+++ b/packages/services/service-ai/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/service-ai",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "AI Service for ObjectStack — implements IAIService with LLM adapter layer, conversation management, tool registry, and REST/SSE routes",
   "type": "module",
diff --git a/packages/services/service-analytics/CHANGELOG.md b/packages/services/service-analytics/CHANGELOG.md
index a29d4c7d84..e49270cfc8 100644
--- a/packages/services/service-analytics/CHANGELOG.md
+++ b/packages/services/service-analytics/CHANGELOG.md
@@ -1,5 +1,32 @@
 # Changelog — @objectstack/service-analytics
 
+## 10.1.0
+
+### Minor Changes
+
+- 49da36e: feat(analytics): correct analytics over federated objects (ADR-0062 Phase 3, D6)
+
+  Analytics over an external (federated) object now aggregates against the
+  **correct** remote table instead of silently querying the wrong one. The
+  `NativeSQLStrategy` hand-compiles `FROM "<object>"` and bare column references,
+  which bypass the driver's physical-table resolution (`external.remoteName` /
+  `remoteSchema` / `columnMap`). It now **declines** any query whose base or joined
+  object is federated, routing it to the `ObjectQLStrategy` — whose
+  `engine.aggregate()` goes through the driver's `getBuilder` and already honours
+  `remoteName`/`remoteSchema` (#2138/#2149). This "reuses the driver's resolution"
+  (D6) rather than re-implementing it.
+
+  Adds an optional `StrategyContext.isExternalObject(objectName)` hook (reported by
+  the analytics plugin from the object's `external` block). Purely additive — with
+  no hook, behavior is unchanged for managed objects.
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+  - @objectstack/core@10.1.0
+
 ## 10.0.0
 
 ### Minor Changes
diff --git a/packages/services/service-analytics/package.json b/packages/services/service-analytics/package.json
index 3ce22bf061..5ad37cc54f 100644
--- a/packages/services/service-analytics/package.json
+++ b/packages/services/service-analytics/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/service-analytics",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "Analytics Service for ObjectStack — implements IAnalyticsService with multi-driver strategy pattern (NativeSQL, ObjectQL, InMemory)",
   "type": "module",
diff --git a/packages/services/service-automation/CHANGELOG.md b/packages/services/service-automation/CHANGELOG.md
index 50e3067521..a4ddb67a5e 100644
--- a/packages/services/service-automation/CHANGELOG.md
+++ b/packages/services/service-automation/CHANGELOG.md
@@ -1,5 +1,15 @@
 # @objectstack/service-automation
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+  - @objectstack/core@10.1.0
+  - @objectstack/formula@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/services/service-automation/package.json b/packages/services/service-automation/package.json
index b3a665d54f..0278541697 100644
--- a/packages/services/service-automation/package.json
+++ b/packages/services/service-automation/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/service-automation",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "Automation Service for ObjectStack — implements IAutomationService with plugin-based DAG flow execution engine",
   "type": "module",
diff --git a/packages/services/service-cache/CHANGELOG.md b/packages/services/service-cache/CHANGELOG.md
index 9ebd5220c6..46be57df48 100644
--- a/packages/services/service-cache/CHANGELOG.md
+++ b/packages/services/service-cache/CHANGELOG.md
@@ -1,5 +1,15 @@
 # @objectstack/service-cache
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+  - @objectstack/core@10.1.0
+  - @objectstack/observability@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/services/service-cache/package.json b/packages/services/service-cache/package.json
index af4ccb1abe..2bda8d4cc8 100644
--- a/packages/services/service-cache/package.json
+++ b/packages/services/service-cache/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/service-cache",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "Cache Service for ObjectStack — implements ICacheService with in-memory and Redis adapters",
   "type": "module",
diff --git a/packages/services/service-cluster-redis/CHANGELOG.md b/packages/services/service-cluster-redis/CHANGELOG.md
index fa4903cf3a..af67020032 100644
--- a/packages/services/service-cluster-redis/CHANGELOG.md
+++ b/packages/services/service-cluster-redis/CHANGELOG.md
@@ -1,5 +1,14 @@
 # @objectstack/service-cluster-redis
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+  - @objectstack/service-cluster@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/services/service-cluster-redis/package.json b/packages/services/service-cluster-redis/package.json
index caa16ac0cb..d4a52cd6fa 100644
--- a/packages/services/service-cluster-redis/package.json
+++ b/packages/services/service-cluster-redis/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/service-cluster-redis",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "Redis cluster driver for ObjectStack — implements IPubSub/ILock/IKV/ICounter against Redis using ioredis.",
   "type": "module",
diff --git a/packages/services/service-cluster/CHANGELOG.md b/packages/services/service-cluster/CHANGELOG.md
index bd34da2b73..7f1b05a399 100644
--- a/packages/services/service-cluster/CHANGELOG.md
+++ b/packages/services/service-cluster/CHANGELOG.md
@@ -1,5 +1,14 @@
 # @objectstack/service-cluster
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+  - @objectstack/core@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/services/service-cluster/package.json b/packages/services/service-cluster/package.json
index c3d52bb87d..e178cd3883 100644
--- a/packages/services/service-cluster/package.json
+++ b/packages/services/service-cluster/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/service-cluster",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "Cluster Service for ObjectStack — pluggable PubSub/Lock/KV/Counter primitives. Memory driver included; postgres/redis drivers ship separately.",
   "type": "module",
diff --git a/packages/services/service-datasource/CHANGELOG.md b/packages/services/service-datasource/CHANGELOG.md
index 52c3514212..e8ecbb6243 100644
--- a/packages/services/service-datasource/CHANGELOG.md
+++ b/packages/services/service-datasource/CHANGELOG.md
@@ -1,5 +1,66 @@
 # @objectstack/service-external-datasource
 
+## 10.1.0
+
+### Minor Changes
+
+- 49da36e: feat(datasource): fail-closed credential resolution at connect (ADR-0062 Phase 2, D3)
+
+  `DatasourceConnectionService` now treats a declared `external.credentialsRef` as
+  **fail-closed**: the credential must resolve to a cleartext secret (via the
+  host's `SecretBinder` over `ICryptoProvider`) _before_ the driver is built. An
+  absent secret store, or a ref that cannot be resolved/decrypted (missing
+  `sys_secret` row, rotated key, or a throwing resolver), leaves the datasource
+  **unconnected with a clear message** — never a silent build-without-secret that
+  would connect with no/wrong auth or fail later with a confusing driver error.
+
+  The same policy as connect failures applies: a code-defined `external` datasource
+  with `validation.onMismatch: 'fail'` auto-connected at boot fails fast (bricks
+  boot); runtime-admin create/update + boot rehydration degrade-with-warning. Code-
+  and runtime-origin secrets converge on the one connection path (the same
+  `SecretBinder` is threaded through the shared service). New `failed-credentials`
+  connect status.
+
+- ac79f16: feat(datasource): auto-connect declared external datasources (ADR-0062 Phase 1, D1/D2/D5)
+
+  A declared external datasource is now connected to a live ObjectQL driver and its
+  federated objects are queryable **with zero app code** — no `onEnable` driver
+  wiring. Implements ADR-0062 Phase 1.
+
+  - **D1 — one connect path.** New `DatasourceConnectionService` in
+    `@objectstack/service-datasource` owns the single "definition → live driver"
+    path: build via the injected driver factory → resolve `external.credentialsRef`
+    via the `SecretBinder` → connect → `engine.registerDriver` under the datasource
+    name → register the datasource def → sync each bound federated object's read
+    metadata (DDL-free). Both origins converge on it: the runtime-admin
+    `registerPool` now delegates here, and `AppPlugin` auto-connects code-defined
+    datasources. Exposed as the `'datasource-connection'` kernel service.
+  - **D2 — opt-in-safe gate.** A declared datasource auto-connects only when it is
+    `external`, an object **explicitly** binds to it via `object.datasource`, or it
+    sets the new `autoConnect: true` flag. A managed datasource that nothing
+    explicitly binds (incl. ones referenced only by a `datasourceMapping` rule, e.g.
+    `examples/app-crm`'s `:memory:` datasources) stays metadata-only — existing apps
+    are byte-for-byte unchanged. See the ADR-0062 D2 implementation note.
+  - **D5 — lifecycle, ordering & policy.** Connect happens in `AppPlugin.start()`
+    (before the `kernel:ready` validation gate, relying on the kernel's
+    init-all-then-start-all ordering). Fail-fast for a declared `external` datasource
+    with `validation.onMismatch: 'fail'`; degrade-with-warning otherwise (and always
+    for runtime-admin/rehydrate, so a UI action or replica blip never bricks the
+    server). Adds a host-injectable `DatasourceConnectPolicy` (open-core default
+    allows; a multi-tenant host binds a stricter fail-closed policy for egress
+    isolation) consulted before every connect — one connect path, no cloud fork.
+
+  Adds `datasource.autoConnect` to the spec. The legacy `onEnable` +
+  `ctx.drivers.register` bridge remains supported as an escape hatch (idempotent vs.
+  auto-connect). No behavior change for managed apps.
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+  - @objectstack/core@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/services/service-datasource/package.json b/packages/services/service-datasource/package.json
index 8c64d2bc00..e57f5c252c 100644
--- a/packages/services/service-datasource/package.json
+++ b/packages/services/service-datasource/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/service-datasource",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "The datasource service (ADR-0015): external-table federation (introspect/draft/import/validate) + runtime UI datasource lifecycle (list/test/create/update/remove + REST routes). Open-source mechanism; the tier line falls on which ICryptoProvider / driver factory a host injects.",
   "type": "module",
diff --git a/packages/services/service-i18n/CHANGELOG.md b/packages/services/service-i18n/CHANGELOG.md
index 1aa2eb99ab..b9e0a6a7e9 100644
--- a/packages/services/service-i18n/CHANGELOG.md
+++ b/packages/services/service-i18n/CHANGELOG.md
@@ -1,5 +1,14 @@
 # @objectstack/service-i18n
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+  - @objectstack/core@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/services/service-i18n/package.json b/packages/services/service-i18n/package.json
index 3deed5024d..4bcebcb3a7 100644
--- a/packages/services/service-i18n/package.json
+++ b/packages/services/service-i18n/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/service-i18n",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "I18n Service for ObjectStack — implements II18nService with file-based locale loading",
   "type": "module",
diff --git a/packages/services/service-job/CHANGELOG.md b/packages/services/service-job/CHANGELOG.md
index 206ca8c94a..e9941b00c8 100644
--- a/packages/services/service-job/CHANGELOG.md
+++ b/packages/services/service-job/CHANGELOG.md
@@ -1,5 +1,15 @@
 # @objectstack/service-job
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+  - @objectstack/core@10.1.0
+  - @objectstack/platform-objects@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/services/service-job/package.json b/packages/services/service-job/package.json
index 44d9cfd02b..2dd9aa4589 100644
--- a/packages/services/service-job/package.json
+++ b/packages/services/service-job/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/service-job",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "Job Service for ObjectStack — implements IJobService with setInterval and cron scheduling",
   "type": "module",
diff --git a/packages/services/service-knowledge/CHANGELOG.md b/packages/services/service-knowledge/CHANGELOG.md
index 577ad1ba59..b34bc7c3b4 100644
--- a/packages/services/service-knowledge/CHANGELOG.md
+++ b/packages/services/service-knowledge/CHANGELOG.md
@@ -1,5 +1,14 @@
 # @objectstack/service-knowledge
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+  - @objectstack/core@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/services/service-knowledge/package.json b/packages/services/service-knowledge/package.json
index 5bc03c2732..c62653b13d 100644
--- a/packages/services/service-knowledge/package.json
+++ b/packages/services/service-knowledge/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/service-knowledge",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "Knowledge Service for ObjectStack — orchestrator implementing IKnowledgeService over pluggable IKnowledgeAdapter backends (RAGFlow, LlamaIndex, Dify, in-memory).",
   "type": "module",
diff --git a/packages/services/service-messaging/CHANGELOG.md b/packages/services/service-messaging/CHANGELOG.md
index 69c43ffc34..1effe9efb7 100644
--- a/packages/services/service-messaging/CHANGELOG.md
+++ b/packages/services/service-messaging/CHANGELOG.md
@@ -1,5 +1,14 @@
 # @objectstack/service-messaging
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+  - @objectstack/core@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/services/service-messaging/package.json b/packages/services/service-messaging/package.json
index 6815f1e177..fbaabf1a0c 100644
--- a/packages/services/service-messaging/package.json
+++ b/packages/services/service-messaging/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/service-messaging",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "Messaging Service for ObjectStack — outbound notification dispatch (ADR-0012). Ships the MessagingChannel registry, emit() fan-out, and the always-on inbox channel; other channels (email/webhook/push/IM) plug in.",
   "type": "module",
diff --git a/packages/services/service-package/CHANGELOG.md b/packages/services/service-package/CHANGELOG.md
index e2f6c2ae5c..eb796f0035 100644
--- a/packages/services/service-package/CHANGELOG.md
+++ b/packages/services/service-package/CHANGELOG.md
@@ -1,5 +1,14 @@
 # @objectstack/service-package
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+  - @objectstack/core@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/services/service-package/package.json b/packages/services/service-package/package.json
index 1e602f5ba9..433119754a 100644
--- a/packages/services/service-package/package.json
+++ b/packages/services/service-package/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/service-package",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "Package management service for ObjectStack — publish, install, and manage packages",
   "type": "module",
diff --git a/packages/services/service-queue/CHANGELOG.md b/packages/services/service-queue/CHANGELOG.md
index 6fe3ba3ff2..cb852173f7 100644
--- a/packages/services/service-queue/CHANGELOG.md
+++ b/packages/services/service-queue/CHANGELOG.md
@@ -1,5 +1,15 @@
 # @objectstack/service-queue
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+  - @objectstack/core@10.1.0
+  - @objectstack/platform-objects@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/services/service-queue/package.json b/packages/services/service-queue/package.json
index 5b4f142643..0e1bcf5a67 100644
--- a/packages/services/service-queue/package.json
+++ b/packages/services/service-queue/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/service-queue",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "Queue Service for ObjectStack — implements IQueueService with in-memory and durable DB-backed (sys_job_queue) adapters",
   "type": "module",
diff --git a/packages/services/service-realtime/CHANGELOG.md b/packages/services/service-realtime/CHANGELOG.md
index 2a41e530e6..1e2ad09039 100644
--- a/packages/services/service-realtime/CHANGELOG.md
+++ b/packages/services/service-realtime/CHANGELOG.md
@@ -1,5 +1,15 @@
 # @objectstack/service-realtime
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+  - @objectstack/core@10.1.0
+  - @objectstack/platform-objects@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/services/service-realtime/package.json b/packages/services/service-realtime/package.json
index 2ebe5931b4..0d14d7a612 100644
--- a/packages/services/service-realtime/package.json
+++ b/packages/services/service-realtime/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/service-realtime",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "Realtime Service for ObjectStack — implements IRealtimeService with WebSocket and in-memory pub/sub",
   "type": "module",
diff --git a/packages/services/service-settings/CHANGELOG.md b/packages/services/service-settings/CHANGELOG.md
index 1db9e9933b..dc98f0c6b6 100644
--- a/packages/services/service-settings/CHANGELOG.md
+++ b/packages/services/service-settings/CHANGELOG.md
@@ -1,5 +1,16 @@
 # @objectstack/service-settings
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+  - @objectstack/core@10.1.0
+  - @objectstack/platform-objects@10.1.0
+  - @objectstack/types@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/services/service-settings/package.json b/packages/services/service-settings/package.json
index 7e37feadcf..77563052e2 100644
--- a/packages/services/service-settings/package.json
+++ b/packages/services/service-settings/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/service-settings",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "Settings service for ObjectStack — manifest registry + K/V resolver (OS_* env > Tenant > User > Default) + REST routes. See ADR-0007.",
   "type": "module",
diff --git a/packages/services/service-storage/CHANGELOG.md b/packages/services/service-storage/CHANGELOG.md
index a82ebbeaa3..2d8000c857 100644
--- a/packages/services/service-storage/CHANGELOG.md
+++ b/packages/services/service-storage/CHANGELOG.md
@@ -1,5 +1,16 @@
 # @objectstack/service-storage
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+  - @objectstack/core@10.1.0
+  - @objectstack/observability@10.1.0
+  - @objectstack/platform-objects@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/services/service-storage/package.json b/packages/services/service-storage/package.json
index ab950405cf..dcb228d5d9 100644
--- a/packages/services/service-storage/package.json
+++ b/packages/services/service-storage/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/service-storage",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "Storage Service for ObjectStack — implements IStorageService with local filesystem and S3 adapter skeleton",
   "type": "module",
diff --git a/packages/spec/CHANGELOG.md b/packages/spec/CHANGELOG.md
index f6dea12647..9844add3ee 100644
--- a/packages/spec/CHANGELOG.md
+++ b/packages/spec/CHANGELOG.md
@@ -1,5 +1,58 @@
 # @objectstack/spec
 
+## 10.1.0
+
+### Minor Changes
+
+- 49da36e: feat(analytics): correct analytics over federated objects (ADR-0062 Phase 3, D6)
+
+  Analytics over an external (federated) object now aggregates against the
+  **correct** remote table instead of silently querying the wrong one. The
+  `NativeSQLStrategy` hand-compiles `FROM "<object>"` and bare column references,
+  which bypass the driver's physical-table resolution (`external.remoteName` /
+  `remoteSchema` / `columnMap`). It now **declines** any query whose base or joined
+  object is federated, routing it to the `ObjectQLStrategy` — whose
+  `engine.aggregate()` goes through the driver's `getBuilder` and already honours
+  `remoteName`/`remoteSchema` (#2138/#2149). This "reuses the driver's resolution"
+  (D6) rather than re-implementing it.
+
+  Adds an optional `StrategyContext.isExternalObject(objectName)` hook (reported by
+  the analytics plugin from the object's `external` block). Purely additive — with
+  no hook, behavior is unchanged for managed objects.
+
+- ac79f16: feat(datasource): auto-connect declared external datasources (ADR-0062 Phase 1, D1/D2/D5)
+
+  A declared external datasource is now connected to a live ObjectQL driver and its
+  federated objects are queryable **with zero app code** — no `onEnable` driver
+  wiring. Implements ADR-0062 Phase 1.
+
+  - **D1 — one connect path.** New `DatasourceConnectionService` in
+    `@objectstack/service-datasource` owns the single "definition → live driver"
+    path: build via the injected driver factory → resolve `external.credentialsRef`
+    via the `SecretBinder` → connect → `engine.registerDriver` under the datasource
+    name → register the datasource def → sync each bound federated object's read
+    metadata (DDL-free). Both origins converge on it: the runtime-admin
+    `registerPool` now delegates here, and `AppPlugin` auto-connects code-defined
+    datasources. Exposed as the `'datasource-connection'` kernel service.
+  - **D2 — opt-in-safe gate.** A declared datasource auto-connects only when it is
+    `external`, an object **explicitly** binds to it via `object.datasource`, or it
+    sets the new `autoConnect: true` flag. A managed datasource that nothing
+    explicitly binds (incl. ones referenced only by a `datasourceMapping` rule, e.g.
+    `examples/app-crm`'s `:memory:` datasources) stays metadata-only — existing apps
+    are byte-for-byte unchanged. See the ADR-0062 D2 implementation note.
+  - **D5 — lifecycle, ordering & policy.** Connect happens in `AppPlugin.start()`
+    (before the `kernel:ready` validation gate, relying on the kernel's
+    init-all-then-start-all ordering). Fail-fast for a declared `external` datasource
+    with `validation.onMismatch: 'fail'`; degrade-with-warning otherwise (and always
+    for runtime-admin/rehydrate, so a UI action or replica blip never bricks the
+    server). Adds a host-injectable `DatasourceConnectPolicy` (open-core default
+    allows; a multi-tenant host binds a stricter fail-closed policy for egress
+    isolation) consulted before every connect — one connect path, no cloud fork.
+
+  Adds `datasource.autoConnect` to the spec. The legacy `onEnable` +
+  `ctx.drivers.register` bridge remains supported as an escape hatch (idempotent vs.
+  auto-connect). No behavior change for managed apps.
+
 ## 10.0.0
 
 ### Minor Changes
diff --git a/packages/spec/package.json b/packages/spec/package.json
index 80031bd2e4..44ee52c5fa 100644
--- a/packages/spec/package.json
+++ b/packages/spec/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/spec",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "description": "ObjectStack Protocol & Specification - TypeScript Interfaces, JSON Schemas, and Convention Configurations",
   "license": "Apache-2.0",
   "main": "dist/index.js",
diff --git a/packages/triggers/trigger-api/CHANGELOG.md b/packages/triggers/trigger-api/CHANGELOG.md
index 0b75a96593..856ee7cd94 100644
--- a/packages/triggers/trigger-api/CHANGELOG.md
+++ b/packages/triggers/trigger-api/CHANGELOG.md
@@ -1,5 +1,14 @@
 # @objectstack/trigger-api
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+  - @objectstack/core@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/triggers/trigger-api/package.json b/packages/triggers/trigger-api/package.json
index dda00ba211..d8d36cfc06 100644
--- a/packages/triggers/trigger-api/package.json
+++ b/packages/triggers/trigger-api/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/trigger-api",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "Inbound HTTP/webhook flow trigger for ObjectStack — per-flow HMAC-verified endpoints with queue-backed ingestion (ADR-0041)",
   "main": "dist/index.js",
diff --git a/packages/triggers/trigger-record-change/CHANGELOG.md b/packages/triggers/trigger-record-change/CHANGELOG.md
index d2e357fcca..a262755da1 100644
--- a/packages/triggers/trigger-record-change/CHANGELOG.md
+++ b/packages/triggers/trigger-record-change/CHANGELOG.md
@@ -1,5 +1,14 @@
 # @objectstack/plugin-trigger-record-change
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+  - @objectstack/core@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/triggers/trigger-record-change/package.json b/packages/triggers/trigger-record-change/package.json
index d6ba102051..89feb06a1c 100644
--- a/packages/triggers/trigger-record-change/package.json
+++ b/packages/triggers/trigger-record-change/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/trigger-record-change",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "Record-change flow trigger for ObjectStack — auto-launches flows on object insert/update/delete via ObjectQL lifecycle hooks (ADR-0018)",
   "main": "dist/index.js",
diff --git a/packages/triggers/trigger-schedule/CHANGELOG.md b/packages/triggers/trigger-schedule/CHANGELOG.md
index 08cb65e602..fa2b2bd4fd 100644
--- a/packages/triggers/trigger-schedule/CHANGELOG.md
+++ b/packages/triggers/trigger-schedule/CHANGELOG.md
@@ -1,5 +1,14 @@
 # @objectstack/plugin-trigger-schedule
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+  - @objectstack/core@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/triggers/trigger-schedule/package.json b/packages/triggers/trigger-schedule/package.json
index 4b232fc3b3..6829922ff2 100644
--- a/packages/triggers/trigger-schedule/package.json
+++ b/packages/triggers/trigger-schedule/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/trigger-schedule",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "Schedule flow trigger for ObjectStack — auto-launches flows on a cron/interval/once schedule via the IJobService (ADR-0018)",
   "main": "dist/index.js",
diff --git a/packages/types/CHANGELOG.md b/packages/types/CHANGELOG.md
index 93a039bf18..bfbdd3380b 100644
--- a/packages/types/CHANGELOG.md
+++ b/packages/types/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @objectstack/types
 
+## 10.1.0
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+  - @objectstack/spec@10.1.0
+
 ## 10.0.0
 
 ### Patch Changes
diff --git a/packages/types/package.json b/packages/types/package.json
index ebd5323362..89f74e6a2e 100644
--- a/packages/types/package.json
+++ b/packages/types/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/types",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "Shared interfaces describing the ObjectStack Runtime environment",
   "main": "dist/index.js",
diff --git a/packages/verify/CHANGELOG.md b/packages/verify/CHANGELOG.md
index 8cc638a977..5a9ad2a57e 100644
--- a/packages/verify/CHANGELOG.md
+++ b/packages/verify/CHANGELOG.md
@@ -1,5 +1,50 @@
 # @objectstack/verify
 
+## 10.1.0
+
+### Minor Changes
+
+- 49da36e: feat(datasource): reject field.columnName on external objects + drop showcase onEnable bridge (ADR-0062 Phase 4, D7/D8)
+
+  **D7 — reconcile column mapping.** `os compile`/`build` (`validateStackExpressions`)
+  now rejects `field.columnName` on a federated (external) object with a corrective
+  message: the driver's query pipeline ignores `field.columnName` for external
+  objects, so `external.columnMap` is the single authoritative mechanism. Managed
+  objects are untouched.
+
+  **D8 — drop the canonical example's driver bridge.** `examples/app-showcase`
+  declares its external datasource with **no** `onEnable` driver registration — the
+  declared datasource auto-connects at boot (ADR-0062 D1). `onEnable` now only
+  provisions the "remote" fixture tables. To cover this end-to-end, the
+  `@objectstack/verify` harness wires the datasource-admin plugin (registering the
+  `'datasource-connection'` service) when an app declares datasources, so it mirrors
+  `objectstack dev`/serve; a new dogfood test reads the federated objects through the
+  real REST stack (incl. the `remoteName` remap). `onEnable` + `ctx.drivers.register`
+  remains supported as an escape hatch for drivers built dynamically at runtime.
+
+### Patch Changes
+
+- Updated dependencies [49da36e]
+- Updated dependencies [49da36e]
+- Updated dependencies [ac79f16]
+- Updated dependencies [94d2161]
+- Updated dependencies [517dad9]
+  - @objectstack/spec@10.1.0
+  - @objectstack/service-analytics@10.1.0
+  - @objectstack/service-datasource@10.1.0
+  - @objectstack/runtime@10.1.0
+  - @objectstack/rest@10.1.0
+  - @objectstack/core@10.1.0
+  - @objectstack/objectql@10.1.0
+  - @objectstack/driver-sqlite-wasm@10.1.0
+  - @objectstack/plugin-auth@10.1.0
+  - @objectstack/plugin-hono-server@10.1.0
+  - @objectstack/plugin-org-scoping@10.1.0
+  - @objectstack/plugin-security@10.1.0
+  - @objectstack/plugin-sharing@10.1.0
+  - @objectstack/service-automation@10.1.0
+  - @objectstack/service-settings@10.1.0
+
 ## 10.0.0
 
 ### Minor Changes
diff --git a/packages/verify/package.json b/packages/verify/package.json
index 2abb10f8b7..de8e15081b 100644
--- a/packages/verify/package.json
+++ b/packages/verify/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/verify",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "license": "Apache-2.0",
   "description": "Boot any ObjectStack app in-process and verify it through the real HTTP stack — auto-derived CRUD round-trip fidelity plus the cross-owner RLS invariant. Catches runtime regressions that static checks miss.",
   "type": "module",
diff --git a/packages/vscode-objectstack/CHANGELOG.md b/packages/vscode-objectstack/CHANGELOG.md
index 820445a151..b95e0bee0e 100644
--- a/packages/vscode-objectstack/CHANGELOG.md
+++ b/packages/vscode-objectstack/CHANGELOG.md
@@ -1,5 +1,7 @@
 # objectstack-vscode
 
+## 10.1.0
+
 ## 10.0.0
 
 ## 9.11.0
diff --git a/packages/vscode-objectstack/package.json b/packages/vscode-objectstack/package.json
index e2329f0275..0d717aae4f 100644
--- a/packages/vscode-objectstack/package.json
+++ b/packages/vscode-objectstack/package.json
@@ -2,7 +2,7 @@
   "name": "objectstack-vscode",
   "displayName": "ObjectStack",
   "description": "ObjectStack Protocol — Autocomplete, validation, and inline diagnostics for .object.ts, .view.ts, and objectstack.config.ts files",
-  "version": "10.0.0",
+  "version": "10.1.0",
   "publisher": "objectstack",
   "license": "Apache-2.0",
   "repository": {