Merge origin/main into claude/issue-6190-reject-org-scoped-write

Conflict: packages/objectql/src/protocol-meta.test.ts — union of #5488's
inverted verdict (NOT_CREATABLE 403; api is code-only) and #6973's env-wide
re-spell (organizationId removed). Verified: the merged protocol.ts equals
main + exactly this branch's delta, so #6710's authoring-channel re-key and
#6190's orgScopedWriteRefusal both survive intact.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LGRN2cSRfggfX9B2L83bQc

Author: claude

.changeset/adr0094-d5r-overlay-direction-retired.md

@@ -0,0 +1,25 @@
+---
+"@objectstack/plugin-security": patch
+---
+
+ADR-0094 D5-R: retire the "customize packaged permission sets through an ADR-0005 env
+overlay" direction (2026-07-14), and make the ADR text and the
+`permission-set-projection.ts` header agree with what is enforced.
+
+`#6483` (PR #6608) rolled `permission` back to `allowOrgOverride: false`, so a metadata
+write against a **code-declared (artifact-backed)** permission set is refused with 403
+`NOT_OVERRIDABLE` — ADR-0005's security row ("overlays would create silent privilege
+drift") is enforced again. The supported channel for those sets is the one ADR-0086
+always named: edit the package and re-publish. Environment authoring survives on the
+`allowRuntimeCreate` tier, for sets whose definition lives only in `sys_metadata`
+(data-door creations, and package sets authored + published through the metadata door);
+that tier edits the single stored definition in place and is deliberately **not**
+described as a re-route of the retired overlay channel.
+
+No behaviour change: the four production write points keep their current dispositions.
+The refusal is left to the producer — `plugin-security` does not re-derive
+artifact-backing to pre-empt it — and the two write points that catch a failed metadata
+write (the `restore` leg and the boot backfill) keep reporting on the durability channel.
+What changes is prose, plus test coverage that can now see the gate: the suite's protocol
+stub models ADR-0005's tier gate, so the four cases that pinned the retired direction no
+longer pass for want of a stub that could refuse.

.changeset/aggregation-node-distinct-retired.md

@@ -0,0 +1,71 @@
+---
+'@objectstack/spec': major
+'@objectstack/objectql': major
+---
+
+refactor(spec,objectql)!: retire `AggregationNode.distinct` — one face honoured it, five ignored it, and the same query answered two plausible numbers (#6815, ADR-0049)
+
+<!-- adr-0087: registered aggregation-node-distinct-retired -->
+
+**FROM → TO:** `{ function: 'count', field: 'x', distinct: true, alias: 'a' }` →
+`{ function: 'count_distinct', field: 'x', alias: 'a' }` — the deduplicating spelling
+every backend computes, lowered to `COUNT(DISTINCT x)` on both SQL faces since #6409.
+`{ function: 'sum' | 'avg' | 'min' | 'max', …, distinct: true }` → delete the key; there is
+no replacement, because no SQL backend ever computed `SUM(DISTINCT …)` here and the
+in-memory fallback was the only thing that did. `distinct: false` → delete the key; it
+selected the behaviour that is now the only behaviour.
+
+`AggregationNode.distinct` was read by exactly ONE of the six faces that consume an
+`aggregations[]` entry. `objectql`'s in-memory fallback (`in-memory-aggregation.ts`)
+deduplicated the values before applying the function; `SqlDriver.aggregate`, the Turso
+`RemoteTransport.aggregate`, `driver-mongodb`'s `buildAggregationStage`, `driver-memory`'s
+`computeAggregate` and `service-analytics`' `AGGREGATE_SQL` all ignored it. So
+`{ function: 'sum', field: 'amount', distinct: true }` returned a deduplicated sum when the
+engine fell back in memory and an ordinary sum on every SQL datasource — one query, two
+numbers, chosen by which backend answered. The engine picks that path per query (a driver
+without native aggregation, a non-UTC date bucket, a partial SQL driver), so the number
+could move under a dashboard with nothing changing in the query.
+
+That is the divergence class #6203 and #5907 each closed on the aggregate axis, still open
+on this key, and it is worse to leave: both answers are plausible NUMBERS rather than a
+refusal, so nothing surfaced it. It survived the #4286 sweep of this same schema because
+that sweep asked which members no executor reads — the wrong question for a key whose
+defect is *which* executor reads it.
+
+REMOVE rather than ENFORCE, per the maintainer ruling of 2026-08-09: `count_distinct`
+already covers the only deduplicating spelling with measured demand and took ADR-0049's
+enforce leg in #6409, while `SUM(DISTINCT …)` / `AVG(DISTINCT …)` are near-universally a
+modelling mistake and would have to be lowered across five faces — two of them frozen under
+#5499 — to buy it.
+
+The retirement kit:
+
+- **Tombstone, not deletion** (`retiredKey()`): `AggregationNodeSchema` is not `.strict()`,
+  so a plain delete would let existing queries parse clean and lose the key in silence
+  (#3733, ADR-0104) — trading a divergent flag for an ignored one. Authoring it is now a
+  `tsc` error at the call site and a parse error carrying the prescription. One tombstone
+  covers every aggregation door: `QuerySchema.aggregations` and
+  `EngineAggregateOptionsSchema.aggregations` both reuse that one schema by reference.
+- **ADR-0087 D3 `SemanticMigration`** (`aggregation-node-distinct-retired`) plus the exact
+  `RETIRED_KEYS_BY_MAJOR[17]` entry `data/AggregationNode:distinct`. No D2 conversion,
+  deliberately: `QueryAST` is a request surface — the client SDK builder's output and the
+  `POST /data/:object/query` body — never stored in stack metadata, so there is no source
+  for `os migrate meta` to rewrite. That is the disposition every other `data.query.*`
+  retirement in this major already takes (#4286).
+- `objectql`'s in-memory fallback loses its `collectValues` dedupe limb — the whole runtime
+  cost of the removal. **The observable numbers change on that one path, and that is the
+  point:** a `sum`/`avg` that used to be deduplicated there now answers what every SQL face
+  has always answered for the same query. Verify against the SQL answer, not against the
+  pre-upgrade fallback answer — the two disagreed.
+- Measured blast radius inside the fallback, narrower than the key suggests: only `sum` and
+  `avg` ever changed answer. `count` returned from its own branch before reaching the
+  dedupe, `count_distinct` fed the values into a `Set` (dedupe-then-`Set` is `Set`), and
+  dedupe does not move `min`/`max`.
+- `POST /api/v1/data/:object/query` answers `400 VALIDATION_FAILED` with a `fields[]` entry
+  at `aggregations.<i>.distinct` instead of serving a number — the #3899 entry validation
+  descending into the array, pinned in the REST request-schema conformance gate.
+- Liveness ledger (`query.json` `aggregations.children.distinct` → `dead`, README counts),
+  generated baselines (`authorable-surface/data.json` gains `[RETIRED]`),
+  `spec-changes.json`, the upgrade guide and the reference docs regenerated.
+
+`count_distinct` is untouched and remains the live deduplicating spelling.

.changeset/api-runtime-create-withdrawn.md

@@ -0,0 +1,77 @@
+---
+'@objectstack/spec': major
+'@objectstack/metadata-protocol': major
+'@objectstack/objectql': major
+---
+
+refactor(spec)!: `api` is code-only — withdraw a runtime create door the endpoint matcher could never read (#5488, ADR-0049 remove side)
+
+<!-- adr-0087: registered api-runtime-create-withdrawn -->
+
+**FROM → TO:** `PUT /api/v1/meta/api/{name}` (200 "Saved") → declare the endpoint as a
+stack artifact (`**/*.api.ts`, or `defineStack({ apis })`) and ship it through
+`publishPackage`. The runtime write now answers **403 `NOT_CREATABLE`**, in `?mode=draft`
+as well as direct-active. The artifact route is **unchanged** — a `**/*.api.ts` file valid
+before this release is valid after it, byte for byte.
+
+`DEFAULT_METADATA_TYPE_REGISTRY`'s `api` entry declared `allowRuntimeCreate: true` and the
+runtime never honoured it. Measured on a real showcase boot (`objectstack dev --fresh`, 47
+plugins):
+
+```
+PUT /api/v1/meta/api/e8_backdoor   → 200 {"success":true,…,"message":"Saved …"}
+GET /api/v1/apps/showcase/backdoor → 404      (anonymous AND authenticated)
+```
+
+…and **no** `[EndpointMatcher] … EXCLUDED` line anywhere in the boot log: the endpoint was
+not gated out, it was never in the index at all. The serving criterion belongs to
+`IMetadataService.matchEndpoint` → `EndpointMatcher` → `MetadataManager.listForIndex('api')`,
+which reads the manager's own registry plus its registered loaders
+(`["filesystem","memory"]` on dev/serve). A runtime write lands in `sys_metadata`, which is
+in neither. So the declaration promised a capability that could not exist.
+
+A declared-but-unhonoured capability is ADR-0049 false compliance, and "answers Saved, then
+404s forever" is its most dangerous shape for the AI authors ADR-0033 targets. The
+maintainer ruled REMOVE on 2026-08-07 rather than converge the read path: making the matcher
+read `sys_metadata` re-opens cache, invalidation, tenancy and the ADR-0110 D3
+miss-vs-outage distinction on a new read path, and there is no business pull for
+Studio-authored endpoints today — 17.x serves declarative endpoints through stack artifacts,
+which is what showcase uses (#5040 E8, LIVE).
+
+## The retirement kit
+
+- **`allowRuntimeCreate: false`** on the `api` registry entry. With `allowOrgOverride`
+  already `false`, the type is now **code-only** — the `job` / `agent` / `capability` shape —
+  so the existing #5086 inlet refuses before persistence, on every kernel, with
+  `code: 'NOT_CREATABLE'`, `status: 403` and a prescription derived from the entry's own
+  `filePatterns[0]`. No new refusal mechanism was written for this.
+- **`gateApiDraftsForPublish` is retired** (`metadata-protocol`), together with its nine
+  tests and the `PUBLISH_DRAFTS_NAMESPACE_REMEDY` string only it appended. It landed two
+  days earlier in PR #5279 and is removed **deliberately and on the record**, not lost in a
+  refactor: it gated a draft→active promotion into a state the matcher can never read, and
+  with the inlet closed no `api` draft can exist for it to judge. The in-place comment at
+  its old call site carries the reasoning.
+- **The `metadata-plugin.zod.ts` decision block is rewritten as a recorded overturn.** It
+  used to record CODE-ONLY as "considered and rejected"; its three bullets are kept verbatim
+  with what became of each, so the reversal is auditable rather than silently contradicted.
+- **The `api` create seed is removed** and `api` joins `KNOWN_UNSEEDED`. A pre-filled "New
+  API Endpoint" form whose save can only 403 is the UI half of the same false compliance.
+- **Pins, not deletions.** The two #5271 tripwire pins that asserted
+  `allowRuntimeCreate: true` are **replaced** by retirement pins asserting the new verdict —
+  their comments predicted this exact consequence, and both predictions were correct. Every
+  rejection case asserts `code` **and** `status` (ADR-0112 envelope), never `toThrow()`
+  alone (#6142).
+
+## What did NOT change
+
+`validateApiEndpointDeclarations` / `identityFreeEndpointGateFailure` remain the one judge
+of what is servable, on the route that serves: the stack schema, `publishPackage` (#5189),
+and again at load in `buildEndpointIndex` (PR #5203). ADR-0121's "publish REJECTS" ruling is
+intact. `deleteMetaItem` stays ungated so pre-existing rows can be cleaned up, and
+`OS_METADATA_WRITABLE=api` remains the single operator escape hatch — note it unlocks the
+**write** only; the endpoint still will not be served, which is why it is a diagnostic
+rather than a workaround.
+
+**Re-entry path**, recorded by the ruling: if #2657 Part B promotes `apis` to a registered
+type **with a real consumption path**, the flag and the publish gate come back together —
+implementation first, declaration second.

.changeset/app-publish-gate-own-key.md

@@ -0,0 +1,105 @@
+---
+"@objectstack/spec": major
+"@objectstack/rest": minor
+"@objectstack/runtime": minor
+---
+
+fix(spec,rest,runtime)!: the ADR-0045 publish gate gets its own machine-managed key — `app.hidden` goes back to meaning navigation, and the built-in Account app stops 404ing for every normal user (#4829)
+
+<!-- adr-0087: registered app-hidden-to-unpublished -->
+
+**FROM → TO:** nothing to rewrite by hand. `app.hidden` keeps its spelling and its
+authoring contract; the publish gate moves to a new machine-managed key,
+`app._unpublished`, which no author writes. Stored `sys_metadata` app rows carrying
+`hidden: true` are rewritten to `_unpublished: true` by the ADR-0087 conversion
+`app-hidden-to-unpublished` — automatically on every stored-row read, and in place via
+`os migrate meta --stored --apply`.
+
+## The defect
+
+`filterAppForUser` (`@objectstack/rest`) treated `app.hidden` as an access gate:
+
+```ts
+if (item.hidden === true && !sysPerms.has('studio.access') && !sysPerms.has('setup.access')) return null;
+```
+
+`hidden` does not mean that. Its contract, written in `app.zod.ts` the day the key was
+born alongside the built-in Account app, is navigation presentation: *"Hidden apps stay
+fully routable and permission-checked"* — keep it out of the App Switcher, surface it from
+the avatar menu, which is exactly how personal-settings apps behave in GitHub Settings,
+the Google account chip and Salesforce Personal Settings.
+
+So the platform's own `account` app — authored `hidden: true` on purpose — was erased from
+`GET /api/v1/meta/app` for every user without `studio.access` / `setup.access`. Clicking
+the avatar → Profile landed on *"App not available — it may still be publishing"*, and
+password changes, avatar, linked accounts, active sessions and the inbox were all
+unreachable. Any admin saw a completely healthy system, which is why it survived a release
+candidate and shipped a downstream workaround.
+
+The two contracts arrived from different places. ADR-0045 §3 did not introduce `hidden`; it
+**borrowed** it, citing an "ADR-0019 launcher contract (`hidden`, `active`)" as an existing
+read side. That contract does not exist — **ADR-0019 contains no `hidden`** and never
+discussed launchers, the avatar menu or the Account app. The reference was dangling from
+the day it was written, which is why nothing caught the collision it created: one boolean,
+two contracts, disagreeing on the only question that matters — *may a normal user reach
+this app?*
+
+## What changed
+
+- **`AppSchema` declares `_unpublished`** — the ADR-0045 §3 publish gate. `true` means the
+  app is unpublished: externally unobservable, not merely unlisted. It is written by the AI
+  additive-materialization path and cleared by `POST /packages/:id/publish-drafts`, and its
+  `_` prefix is this repo's existing marker for the channel tooling stamps onto artifacts
+  (ADR-0010's `_lock` / `_provenance` envelope; the prefix `lintAuthoredRecordKeys` already
+  skips). It is *declared* rather than omitted because the write path validates against
+  this very schema (`saveMetaItem` → 422; `Registry.validate('app', …)` → `AppSchema.parse`),
+  so an undeclared key would make the platform's own flip unwritable. The strict door
+  answers the author-shaped spellings — `unpublished`, `published`, `draft` — with a
+  prescription that says *publish state is not authorable*, rather than routing them onto
+  the key.
+- **`app.hidden` is navigation only**, and its docblock now says so with the incident
+  attached. Authoring `hidden: true` affects the App Switcher and nothing else.
+- **The REST gate judges `_unpublished`.** A hidden app is served to everyone, with its
+  `hidden` flag intact so the shell can place it; an unpublished app still 404s externally
+  and still reaches builders for direct-URL preview, and `requiredPermissions` still applies
+  to both.
+- **`publish-drafts` clears `_unpublished`** instead of un-hiding. It writes `false` rather
+  than deleting the key, because ADR-0045 §3 makes publish/unpublish symmetric, and it
+  copies `hidden` through untouched — publishing no longer rewrites a presentation choice
+  as a side effect. The response fields keep their `unhiddenApps` / `unhideError` spelling:
+  they are a wire contract read by the objectui Publish button, and renaming them from a
+  repo that cannot update that consumer would be a silent break of exactly the kind this
+  change is about.
+- **ADR-0045 is amended**, its dangling ADR-0019 reference corrected, and both
+  implementation sites (`rest-server.ts`, `runtime/domains/packages.ts`) are now anchored in
+  `scripts/adr-anchors.json` — neither carried an anchor before, which is why an author
+  could change ADR-0045's §3 without knowing they were changing a decision.
+
+## Why a new key rather than deleting the gate
+
+Taking `hidden` out of the access decision was proposed first and refused. The gate is §3 of
+an **Accepted** ADR with pin tests and a live implementation behind it, so removing it in a
+patch would reverse a recorded decision by side effect. It is also the worse failure
+direction: a gate that fails **open** exposes a half-built app to real users, silently.
+
+## Migration reach
+
+The conversion is `retiredFromLoadPath: true`, and here that flag is load-bearing rather
+than bookkeeping — it confines the rewrite to **stored rows**. `hidden` is not retired as an
+authorable key, so a conversion running on the load path would rewrite
+`defineApp({ hidden: true })`, and the Account app itself, into unpublished apps and
+reproduce the defect through the conversion layer. Excluded from the load path, it replays
+only where the old meaning is the only meaning: the stored-row rehydration seams and
+`os migrate meta`. Stored `hidden: true` was unambiguous under the old regime — that value
+*was* the gate, so nobody stored it to mean "keep me out of the switcher"; code-declared
+apps like `ACCOUNT_APP` never enter `sys_metadata`, and the Studio app form has no `hidden`
+control.
+
+## Follow-ups (other repos, filed separately)
+
+- **cloud** — the AI materialization write point must stamp `_unpublished: true` where it
+  stamps `hidden: true` today.
+- **objectui** — the Unpublished banner and the Publish button must read/clear
+  `_unpublished`; the App Switcher keeps reading `hidden`, which now means only what it says.
+- **os-project-titanwind-ehr** — PLAT-DEF-040's startup `{hidden:false}` overlay can be
+  deleted once this ships.