chore(changeset,runtime): runtime minor under Clause-② yes (widening); DefaultDatasourcePluginOptions.dev arms the step-down only

Claude-Session: https://claude.ai/code/session_016GiHYRmLSNWTfbX9gVQkpz
Co-Authored-By: Claude <noreply@anthropic.com>

Author: claude

.changeset/21733-standalone-dev-self-heal.md

@@ -1,13 +1,13 @@
 ---
-"@objectstack/runtime": patch
+"@objectstack/runtime": minor
 "@objectstack/cli": patch
 ---
 
 fix(runtime,cli): a plain `os dev` now self-heals safe schema drift on restart and provisions the `telemetry` sibling database, as `content/docs/deployment/cli.mdx` already says (#21733)
 
-Clause-②: no
+Clause-②: yes (widening)
 
 - **What was broken.** A config with no instantiated `plugins[]` (every fresh scaffold) boots through the standalone stack. Its `default` datasource was built without `autoMigrate: 'safe'`: only the config-load fallback that a host config or `OS_MODE=off` takes carried it. So safe drift was never applied on restart. An example is a per-organization unique index that an older release left non-NULL-safe. Meanwhile the driver's drift line and `os migrate plan` both said the change was "auto-applied at boot under dev autoMigrate: 'safe'". The same boot never provisioned the `<db>.telemetry.<ext>` sibling either.
 - **The fix.** The dev self-heal decision now lives in one place, `devAutoMigrateConfig` in `@objectstack/runtime`. That is the driver kinds whose connection contract declares `autoMigrate` (sqlite, postgres, mysql), on a dev boot. The standalone stack, the CLI's config-load fallback and the telemetry sibling all read it, so no kind gains or loses the self-heal relative to the host path. The telemetry provision is one helper (`provisionTelemetryDatasource`) that both serving paths call, under the same `resolveTelemetryDbPath` rule: dev default-on for a file-backed SQLite primary, `OS_TELEMETRY_DB=0` to opt out, `OS_TELEMETRY_DB=<path>` to opt in anywhere.
 - **Only a serving boot self-heals.** The standalone stack arms the self-heal on an explicit `dev: true`. That is what `os dev` passes. It does not arm it on the `NODE_ENV=development` default that its sqlite step-down still takes. A one-shot command (`os migrate *`, `os meta resync`, …) passes no `dev`, so it never applies drift its operator did not confirm, whatever `NODE_ENV` says. Production boots are unchanged: the definition carries no `autoMigrate`, and the SQL driver refuses it under `NODE_ENV=production` anyway.
-- **Why patch.** This is a fix to documented behaviour. No config key, schema or accept set changes. `@objectstack/runtime` gains one export, `devAutoMigrateConfig` (and its `DevAutoMigrateConfig` type). It is the existing decision moved out of the CLI so the CLI can read it rather than keep a second copy. This follows the same single-owner move as the Turso loader in 68f5eccb17.
+- **Why minor.** `@objectstack/runtime` gains two exports on its only entry, `devAutoMigrateConfig` and its `DevAutoMigrateConfig` type. That is the widening: the existing decision moved out of the CLI so that the CLI reads it rather than keep a second copy. No config key, schema or accept set moves. `@objectstack/cli` is a `patch`: its fix restores documented behaviour and adds no public surface.

packages/runtime/src/default-datasource-plugin.ts

@@ -62,7 +62,15 @@ export interface DefaultDatasourceDefinition {
 }
 
 export interface DefaultDatasourcePluginOptions {
-  /** Arms the shared factory's dev sqlite step-down (#2229) + loosen-only self-heal passthroughs. */
+  /**
+   * Arms the shared factory's dev sqlite step-down (#2229): native
+   * better-sqlite3 → wasm → in-memory when the native binding cannot load.
+   * That is ALL it arms. The dev schema self-heal does not ride here: it rides
+   * in the definition's `config.autoMigrate`, which the host decides with
+   * `devAutoMigrateConfig` (`dev-auto-migrate.ts`, #21733) before it builds
+   * this plugin — so `dev: true` with a definition that carries no
+   * `autoMigrate` boots without the self-heal.
+   */
   dev?: boolean;
   /**
    * Forwarded to the shared factory: what a `sqlite` default does when its