@objectstack/core 17.1.0 → 17.3.0

package/dist/index.cjs

@@ -30,6 +30,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  ADMIN_STANDING_NON_TABLE_INPUTS: () => ADMIN_STANDING_NON_TABLE_INPUTS,
   ADMIN_STANDING_SURFACE: () => ADMIN_STANDING_SURFACE,
   ANONYMOUS_DENY_BODY: () => ANONYMOUS_DENY_BODY,
   ANONYMOUS_DENY_CODE: () => ANONYMOUS_DENY_CODE,
@@ -38,11 +39,19 @@ __export(index_exports, {
   API_KEY_PREFIX: () => API_KEY_PREFIX,
   AUDIENCE_BINDING_SUGGESTION_STATUSES: () => AUDIENCE_BINDING_SUGGESTION_STATUSES,
   AUDIENCE_BINDING_SUGGESTION_STATUS_VALUES: () => AUDIENCE_BINDING_SUGGESTION_STATUS_VALUES,
+  AUTHZ_GRANTS_CACHE_TTL_ENV: () => AUTHZ_GRANTS_CACHE_TTL_ENV,
+  AUTHZ_INVALIDATED_CHANNEL: () => AUTHZ_INVALIDATED_CHANNEL,
+  AUTHZ_STORE_UNAVAILABLE_CODE: () => AUTHZ_STORE_UNAVAILABLE_CODE,
+  AUTHZ_STORE_UNAVAILABLE_MESSAGE: () => AUTHZ_STORE_UNAVAILABLE_MESSAGE,
+  AUTHZ_STORE_UNAVAILABLE_STATUS: () => AUTHZ_STORE_UNAVAILABLE_STATUS,
+  AuthzStoreUnavailableError: () => AuthzStoreUnavailableError,
   CORE_FALLBACK_FACTORIES: () => CORE_FALLBACK_FACTORIES,
   DependencyResolver: () => DependencyResolver,
   ENTRY_EXECUTION_CONTEXT_FIELDS: () => ENTRY_EXECUTION_CONTEXT_FIELDS,
   HotReloadManager: () => HotReloadManager,
+  InMemoryMetadataActivationStore: () => InMemoryMetadataActivationStore,
   LiteKernel: () => LiteKernel,
+  METADATA_ACTIVATION_TABLE: () => METADATA_ACTIVATION_TABLE,
   MigrationJournalRefusal: () => MigrationJournalRefusal,
   MigrationPlanRegistry: () => MigrationPlanRegistry,
   NamespaceResolver: () => NamespaceResolver,
@@ -50,10 +59,11 @@ __export(index_exports, {
   ObjectKernel: () => ObjectKernel,
   ObjectKernelBase: () => ObjectKernelBase,
   ObjectLogger: () => ObjectLogger,
+  ObjectStoreMetadataActivationStore: () => ObjectStoreMetadataActivationStore,
+  PLATFORM_ADMIN_EMAIL_SEPARATOR: () => PLATFORM_ADMIN_EMAIL_SEPARATOR,
   POSTURE_INJECTION_RULE: () => POSTURE_INJECTION_RULE,
   POSTURE_LADDER: () => POSTURE_LADDER,
   POSTURE_RANK: () => POSTURE_RANK,
-  PluginConfigValidator: () => PluginConfigValidator,
   PluginHealthMonitor: () => PluginHealthMonitor,
   PluginLoader: () => PluginLoader,
   PluginPermissionEnforcer: () => PluginPermissionEnforcer,
@@ -62,6 +72,7 @@ __export(index_exports, {
   PluginSecurityScanner: () => PluginSecurityScanner,
   PluginSignatureVerifier: () => PluginSignatureVerifier,
   QA: () => qa_exports,
+  SERVICE_NOT_REGISTERED_CODE: () => SERVICE_NOT_REGISTERED_CODE,
   SIGNATURE_ALG: () => SIGNATURE_ALG,
   SecurePluginContext: () => SecurePluginContext,
   SemanticVersionManager: () => SemanticVersionManager,
@@ -71,6 +82,7 @@ __export(index_exports, {
   UnresolvedFilterTokenError: () => UnresolvedFilterTokenError,
   adminStandingColumns: () => adminStandingColumns,
   adminStandingTables: () => adminStandingTables,
+  artifactPackageId: () => artifactPackageId,
   assembleExecutionContext: () => assembleExecutionContext,
   assembleExecutionContextOrGuest: () => assembleExecutionContextOrGuest,
   assertInitServiceRequirements: () => assertInitServiceRequirements,
@@ -89,7 +101,6 @@ __export(index_exports, {
   createMemoryJob: () => createMemoryJob,
   createMemoryMetadata: () => createMemoryMetadata,
   createMemoryQueue: () => createMemoryQueue,
-  createPluginConfigValidator: () => createPluginConfigValidator,
   createPluginPermissionEnforcer: () => createPluginPermissionEnforcer,
   deepMerge: () => deepMerge,
   defaultIsTransientError: () => defaultIsTransientError,
@@ -101,48 +112,67 @@ __export(index_exports, {
   extractApiKey: () => extractApiKey,
   filterTokenContextFrom: () => filterTokenContextFrom,
   findInterruptedRuns: () => findInterruptedRuns,
+  formatIntegrityViolation: () => formatIntegrityViolation,
   generateApiKey: () => generateApiKey,
   generateEd25519KeyPair: () => generateEd25519KeyPair,
   getEnv: () => getEnv,
   getMemoryUsage: () => getMemoryUsage,
+  hasPlatformAdminStanding: () => hasPlatformAdminStanding,
   hashApiKey: () => hashApiKey,
   hashMigrationPlan: () => hashMigrationPlan,
   isAudienceBindingSuggestionStatus: () => isAudienceBindingSuggestionStatus,
   isAuthGateAllowlisted: () => isAuthGateAllowlisted,
+  isAuthzStoreUnavailableError: () => isAuthzStoreUnavailableError,
+  isConfiguredPlatformAdminEmail: () => isConfiguredPlatformAdminEmail,
   isExpired: () => isExpired,
   isGrantActive: () => isGrantActive,
   isGrantExpired: () => isGrantExpired,
   isNode: () => isNode,
   isRowActive: () => isRowActive,
+  isServiceNotRegisteredError: () => isServiceNotRegisteredError,
   isUninterpretableTemporalComparand: () => isUninterpretableTemporalComparand,
+  matchesConfiguredPlatformAdmin: () => matchesConfiguredPlatformAdmin,
   nextUtcCalendarDay: () => import_data.nextUtcCalendarDay,
   normalizeAuthGate: () => normalizeAuthGate,
+  normalizePlatformAdminEmail: () => normalizePlatformAdminEmail,
   omitInternalFieldsFromWriteResponse: () => omitInternalFieldsFromWriteResponse,
+  parsePlatformAdminEmails: () => parsePlatformAdminEmails,
   parseScopes: () => parseScopes,
   parseSignature: () => parseSignature,
   planChunks: () => planChunks,
   postureVisibleRows: () => postureVisibleRows,
   readAuthoredTranslationLayer: () => readAuthoredTranslationLayer,
+  readAuthzGrantsCacheTtlMs: () => readAuthzGrantsCacheTtlMs,
   readRunJournal: () => readRunJournal,
   recordNotFoundError: () => recordNotFoundError,
+  reportAuthzCachePosture: () => reportAuthzCachePosture,
+  reportLegacyPlatformAdminGrant: () => reportLegacyPlatformAdminGrant,
+  resetLegacyPlatformAdminGrantReport: () => resetLegacyPlatformAdminGrantReport,
+  resetPlatformAdminEmailMemo: () => resetPlatformAdminEmailMemo,
   resolveApiKeyAdmission: () => resolveApiKeyAdmission,
   resolveApiKeyPrincipal: () => resolveApiKeyPrincipal,
+  resolveArtifactPackageOrder: () => resolveArtifactPackageOrder,
+  resolveAuthzCachePosture: () => resolveAuthzCachePosture,
   resolveAuthzContext: () => resolveAuthzContext,
   resolveFilterToken: () => resolveFilterToken,
   resolveFilterTokens: () => resolveFilterTokens,
   resolveLocale: () => resolveLocale,
   resolveLocalizationContext: () => resolveLocalizationContext,
+  resolvePlatformAdminEmails: () => resolvePlatformAdminEmails,
   resolvePluginOrder: () => resolvePluginOrder,
   resolveUserAuthzGrants: () => resolveUserAuthzGrants,
   resumeMigrationJournal: () => resumeMigrationJournal,
+  rethrowAuthzStoreUnavailable: () => rethrowAuthzStoreUnavailable,
   runMigrationJournal: () => runMigrationJournal,
   safeExit: () => safeExit,
+  setPlatformAdminConfigSink: () => setPlatformAdminConfigSink,
   shouldDenyAnonymous: () => shouldDenyAnonymous,
   signPayload: () => signPayload,
   temporalComparandKind: () => temporalComparandKind,
   unknownAudienceBindingSuggestionStatusMessage: () => unknownAudienceBindingSuggestionStatusMessage,
   utcInstantMs: () => import_data.utcInstantMs,
   validateInitServiceContract: () => validateInitServiceContract,
+  verifyIntegrity: () => verifyIntegrity,
   verifyPayload: () => verifyPayload,
   verifyPlatformSignature: () => verifyPlatformSignature,
   verifyPluginArtifact: () => verifyPluginArtifact,
@@ -858,138 +888,6 @@ function createLogger(config) {
 // src/kernel.ts
 var import_system3 = require("@objectstack/spec/system");
 
-// src/security/plugin-config-validator.ts
-var import_zod = require("zod");
-var PluginConfigValidator = class {
-  constructor(logger) {
-    this.logger = logger;
-  }
-  /**
-   * Validate plugin configuration against its Zod schema
-   * 
-   * @param plugin - Plugin metadata with configSchema
-   * @param config - User-provided configuration
-   * @returns Validated and typed configuration
-   * @throws Error with detailed validation errors
-   */
-  validatePluginConfig(plugin, config) {
-    if (!plugin.configSchema) {
-      this.logger.debug(`Plugin ${plugin.name} has no config schema - skipping validation`);
-      return config;
-    }
-    try {
-      const validatedConfig = plugin.configSchema.parse(config);
-      this.logger.debug(`\u2705 Plugin config validated: ${plugin.name}`, {
-        plugin: plugin.name,
-        configKeys: Object.keys(config || {}).length
-      });
-      return validatedConfig;
-    } catch (error) {
-      if (error instanceof import_zod.z.ZodError) {
-        const formattedErrors = this.formatZodErrors(error);
-        const errorMessage = [
-          `Plugin ${plugin.name} configuration validation failed:`,
-          ...formattedErrors.map((e) => `  - ${e.path}: ${e.message}`)
-        ].join("\n");
-        this.logger.error(errorMessage, void 0, {
-          plugin: plugin.name,
-          errors: formattedErrors
-        });
-        throw new Error(errorMessage);
-      }
-      throw error;
-    }
-  }
-  /**
-   * Validate partial configuration (for incremental updates)
-   * 
-   * @param plugin - Plugin metadata
-   * @param partialConfig - Partial configuration to validate
-   * @returns Validated partial configuration
-   */
-  validatePartialConfig(plugin, partialConfig) {
-    if (!plugin.configSchema) {
-      return partialConfig;
-    }
-    try {
-      const partialSchema = plugin.configSchema.partial();
-      const validatedConfig = partialSchema.parse(partialConfig);
-      this.logger.debug(`\u2705 Partial config validated: ${plugin.name}`);
-      return validatedConfig;
-    } catch (error) {
-      if (error instanceof import_zod.z.ZodError) {
-        const formattedErrors = this.formatZodErrors(error);
-        const errorMessage = [
-          `Plugin ${plugin.name} partial configuration validation failed:`,
-          ...formattedErrors.map((e) => `  - ${e.path}: ${e.message}`)
-        ].join("\n");
-        throw new Error(errorMessage);
-      }
-      throw error;
-    }
-  }
-  /**
-   * Get default configuration from schema
-   * 
-   * @param plugin - Plugin metadata
-   * @returns Default configuration object
-   */
-  getDefaultConfig(plugin) {
-    if (!plugin.configSchema) {
-      return void 0;
-    }
-    try {
-      const defaults = plugin.configSchema.parse({});
-      this.logger.debug(`Default config extracted: ${plugin.name}`);
-      return defaults;
-    } catch (error) {
-      this.logger.debug(`No default config available: ${plugin.name}`);
-      return void 0;
-    }
-  }
-  /**
-   * Check if configuration is valid without throwing
-   * 
-   * @param plugin - Plugin metadata
-   * @param config - Configuration to check
-   * @returns True if valid, false otherwise
-   */
-  isConfigValid(plugin, config) {
-    if (!plugin.configSchema) {
-      return true;
-    }
-    const result = plugin.configSchema.safeParse(config);
-    return result.success;
-  }
-  /**
-   * Get configuration errors without throwing
-   * 
-   * @param plugin - Plugin metadata
-   * @param config - Configuration to check
-   * @returns Array of validation errors, or empty array if valid
-   */
-  getConfigErrors(plugin, config) {
-    if (!plugin.configSchema) {
-      return [];
-    }
-    const result = plugin.configSchema.safeParse(config);
-    if (result.success) {
-      return [];
-    }
-    return this.formatZodErrors(result.error);
-  }
-  // Private methods
-  formatZodErrors(error) {
-    return error.issues.map((e) => ({
-      path: e.path.join(".") || "root",
-      message: e.message
-    }));
-  }
-};
-function createPluginConfigValidator(logger) {
-  return new PluginConfigValidator(logger);
-}
-
 // src/security/plugin-artifact-signature.ts
 var import_node_crypto = require("crypto");
 var SIGNATURE_ALG = "ed25519";
@@ -1086,6 +984,20 @@ async function verifyPluginArtifact(input, keys) {
   return { ok: true, publisherVerified: publisher.verified, platformVerified };
 }
 
+// src/service-not-registered.ts
+var SERVICE_NOT_REGISTERED_CODE = "SERVICE_NOT_REGISTERED";
+var SERVICE_NOT_REGISTERED_BRAND = "__objectstackServiceNotRegistered";
+function serviceNotRegisteredError(name) {
+  const err = new Error(`Service '${name}' not found`);
+  err[SERVICE_NOT_REGISTERED_BRAND] = true;
+  err.code = SERVICE_NOT_REGISTERED_CODE;
+  err.serviceName = name;
+  return err;
+}
+function isServiceNotRegisteredError(err) {
+  return typeof err === "object" && err !== null && err[SERVICE_NOT_REGISTERED_BRAND] === true;
+}
+
 // src/plugin-loader.ts
 var ServiceLifecycle = /* @__PURE__ */ ((ServiceLifecycle2) => {
   ServiceLifecycle2["SINGLETON"] = "singleton";
@@ -1101,7 +1013,6 @@ var PluginLoader = class {
     this.scopedServices = /* @__PURE__ */ new Map();
     this.creating = /* @__PURE__ */ new Set();
     this.logger = logger;
-    this.configValidator = new PluginConfigValidator(logger);
   }
   /**
    * Set the plugin context for service factories
@@ -1128,9 +1039,6 @@ var PluginLoader = class {
       if (!versionCheck.compatible) {
         throw new Error(`Version incompatible: ${versionCheck.message}`);
       }
-      if (metadata.configSchema) {
-        this.validatePluginConfig(metadata);
-      }
       if (metadata.signature) {
         await this.verifyPluginSignature(metadata);
       }
@@ -1169,7 +1077,7 @@ var PluginLoader = class {
     if (!registration) {
       const instance = this.serviceInstances.get(name);
       if (!instance) {
-        throw new Error(`Service '${name}' not found`);
+        throw serviceNotRegisteredError(name);
       }
       return instance;
     }
@@ -1329,16 +1237,6 @@ var PluginLoader = class {
     const semverRegex = /^\d+\.\d+\.\d+(-[a-zA-Z0-9.-]+)?(\+[a-zA-Z0-9.-]+)?$/;
     return semverRegex.test(version);
   }
-  validatePluginConfig(plugin, config) {
-    if (!plugin.configSchema) {
-      return;
-    }
-    if (config === void 0) {
-      this.logger.debug(`Plugin ${plugin.name} has configuration schema (config validation postponed)`);
-      return;
-    }
-    this.configValidator.validatePluginConfig(plugin, config);
-  }
   async verifyPluginSignature(plugin) {
     if (!plugin.signature) {
       return;
@@ -1494,35 +1392,6 @@ function createMemoryQueue() {
   };
 }
 
-// src/fallbacks/memory-job.ts
-function createMemoryJob() {
-  const jobs = /* @__PURE__ */ new Map();
-  return {
-    __serviceInfo: {
-      status: "degraded",
-      handlerReady: false,
-      message: "In-process job registry \u2014 trigger() runs handlers, but scheduled jobs never fire on their own (no timer). Register a job plugin (e.g. Agenda) for real scheduling."
-    },
-    _serviceName: "job",
-    async schedule(name, schedule, handler) {
-      jobs.set(name, { schedule, handler });
-    },
-    async cancel(name) {
-      jobs.delete(name);
-    },
-    async trigger(name, data) {
-      const job = jobs.get(name);
-      if (job?.handler) await job.handler({ jobId: name, data });
-    },
-    async getExecutions() {
-      return [];
-    },
-    async listJobs() {
-      return [...jobs.keys()];
-    }
-  };
-}
-
 // src/fallbacks/memory-i18n.ts
 var import_system = require("@objectstack/spec/system");
 function deepMerge(target, source) {
@@ -1657,10 +1526,10 @@ function createMemoryI18n() {
 }
 
 // src/metadata-service-contract.ts
-var import_shared = require("@objectstack/spec/shared");
+var import_meta_spelling = require("@objectstack/spec/meta-spelling");
 var REGISTER_REFUSAL_CODE = "VALIDATION_ERROR";
 function canonicalMetadataServiceType(type) {
-  return (0, import_shared.pluralToSingular)(type);
+  return (0, import_meta_spelling.pluralToSingular)(type);
 }
 function registerRefusal(message) {
   const err = new Error(message);
@@ -1750,6 +1619,35 @@ function createMemoryMetadata() {
   };
 }
 
+// src/fallbacks/memory-job.ts
+function createMemoryJob() {
+  const jobs = /* @__PURE__ */ new Map();
+  return {
+    __serviceInfo: {
+      status: "degraded",
+      handlerReady: false,
+      message: "In-process job registry \u2014 trigger() runs handlers, but scheduled jobs never fire on their own (no timer). Register a job plugin (e.g. Agenda) for real scheduling."
+    },
+    _serviceName: "job",
+    async schedule(name, schedule, handler) {
+      jobs.set(name, { schedule, handler });
+    },
+    async cancel(name) {
+      jobs.delete(name);
+    },
+    async trigger(name, data) {
+      const job = jobs.get(name);
+      if (job?.handler) await job.handler({ jobId: name, data });
+    },
+    async getExecutions() {
+      return [];
+    },
+    async listJobs() {
+      return [...jobs.keys()];
+    }
+  };
+}
+
 // src/fallbacks/authored-translation-sync.ts
 var import_system2 = require("@objectstack/spec/system");
 var OWNER_PROP = "__authoredTranslationSyncOwner";
@@ -1882,7 +1780,6 @@ var CORE_FALLBACK_FACTORIES = {
   metadata: createMemoryMetadata,
   cache: createMemoryCache,
   queue: createMemoryQueue,
-  job: createMemoryJob,
   i18n: createMemoryI18n
 };
 
@@ -1906,6 +1803,48 @@ function registerPluginByName(registry, plugin, logger) {
   return previous;
 }
 
+// src/timeout-guard.ts
+var TimeoutGuard = class {
+  constructor(timeoutMs, createTimeoutError) {
+    /**
+     * Settles `expiry` without a value. `Promise<never>` has no resolvable
+     * value in the type system, but settling it is the entire point: it is
+     * only ever called from `reclaim()`, i.e. after the race it guarded has
+     * already been decided, so the resolution is discarded by construction and
+     * can never become a race winner. The cast localises that argument here
+     * rather than pushing a lie into every caller's return type.
+     */
+    this.settleExpiry = () => {
+    };
+    this.expiry = new Promise((resolve, reject) => {
+      this.settleExpiry = resolve;
+      this.timer = setTimeout(() => reject(createTimeoutError()), timeoutMs);
+    });
+  }
+  /**
+   * Reclaim the guard once the race it protects has been decided. Both
+   * halves, always: the timer is cleared so it cannot fire against a
+   * lifecycle phase that is already over, and `expiry` is settled so neither
+   * it nor the race's reaction on it is retained.
+   *
+   * Idempotent — `clearTimeout` on a cleared handle and a second resolve on
+   * a settled promise are both no-ops.
+   */
+  reclaim() {
+    clearTimeout(this.timer);
+    this.timer = void 0;
+    this.settleExpiry();
+  }
+};
+async function raceWithTimeout(operation, timeoutMs, createTimeoutError) {
+  const guard = new TimeoutGuard(timeoutMs, createTimeoutError);
+  try {
+    return await Promise.race([operation, guard.expiry]);
+  } finally {
+    guard.reclaim();
+  }
+}
+
 // src/kernel.ts
 var ObjectKernel = class {
   constructor(config = {}) {
@@ -2176,14 +2115,11 @@ var ObjectKernel = class {
     this.logger.info("Graceful shutdown started");
     const shutdownTimeoutError = new Error("Shutdown timeout exceeded");
     try {
-      const shutdownPromise = this.performShutdown();
-      const timeoutPromise = new Promise((_, reject) => {
-        const t = setTimeout(() => {
-          reject(shutdownTimeoutError);
-        }, this.config.shutdownTimeout);
-        if (t.unref) t.unref();
-      });
-      await Promise.race([shutdownPromise, timeoutPromise]);
+      await raceWithTimeout(
+        this.performShutdown(),
+        this.config.shutdownTimeout,
+        () => shutdownTimeoutError
+      );
       this.state = "stopped";
       this.logger.info("\u2705 Graceful shutdown complete");
     } catch (error) {
@@ -2301,25 +2237,17 @@ var ObjectKernel = class {
    * as well: if the hook never settles and nothing else keeps the loop alive,
    * Node exits before the timer can fire and the timeout is never reported.
    * The guard has to stay ref'd exactly as long as the race is undecided,
-   * which is what `clearTimeout` in a `finally` expresses.
+   * which is what clearing on settle expresses.
    *
-   * `operation` is widened to `T | PromiseLike<T>` because the Plugin
-   * contract permits a synchronous hook (`init`/`start` return
-   * `void | Promise<void>`); such a hook wins the race immediately and the
-   * guard is reclaimed on the same turn.
+   * Clearing the timer was only half of it, though (#10604): the promise the
+   * race still holds a reaction on has to SETTLE, or it and that reaction are
+   * retained past the end of the run — two leaking promises per boot, which
+   * is what `vitest --detectAsyncLeaks` names here. Both halves now live in
+   * `TimeoutGuard.reclaim()`, shared with `shutdown()`, so the two sites
+   * cannot drift into doing one half each again.
    */
   async raceStartupTimeout(operation, timeout, message) {
-    let guard;
-    const timeoutPromise = new Promise((_, reject) => {
-      guard = setTimeout(() => {
-        reject(new Error(message));
-      }, timeout);
-    });
-    try {
-      return await Promise.race([operation, timeoutPromise]);
-    } finally {
-      clearTimeout(guard);
-    }
+    return raceWithTimeout(operation, timeout, () => new Error(message));
   }
   /**
    * Whether a service is resolvable on this kernel right now — direct
@@ -2482,6 +2410,67 @@ var ObjectKernel = class {
   }
 };
 
+// src/artifact-packages.ts
+var import_spec = require("@objectstack/spec");
+var MAX_REPORTED_ENTRY_ISSUES = 5;
+function refuse(code, message) {
+  const err = new Error(message);
+  err.code = code;
+  err.status = 422;
+  return err;
+}
+function artifactPackageId(manifest) {
+  const id = manifest?.id || manifest?.name;
+  return typeof id === "string" && id !== "" ? id : void 0;
+}
+function resolveArtifactPackageOrder(artifact) {
+  const declared = artifact?.packages;
+  if (declared === void 0 || declared === null) return [artifact];
+  if (!Array.isArray(declared)) {
+    throw refuse(
+      "INVALID_ARTIFACT_PACKAGES",
+      `A release artifact's \`packages\` must be an array of package entries (ADR-0130 D4, \`ArtifactPackageEntrySchema\`), but this artifact carries \`packages\` of type ${typeof declared}. Omit the key entirely for a single-package artifact \u2014 \`manifest\` is retained, not replaced.`
+    );
+  }
+  const nodes = /* @__PURE__ */ new Map();
+  declared.forEach((entry, index) => {
+    const verdict = import_spec.ArtifactPackageSchema.safeParse(entry);
+    if (!verdict.success) {
+      const issues = verdict.error.issues;
+      const shown = issues.slice(0, MAX_REPORTED_ENTRY_ISSUES);
+      throw refuse(
+        "INVALID_ARTIFACT_PACKAGE_ENTRY",
+        `Release artifact \`packages[${index}]\` is not a package entry (ADR-0130 D4): ` + shown.map((i) => `${i.path.join(".") || "<entry>"}: ${i.message}`).join("; ") + (issues.length > shown.length ? ` (+${issues.length - shown.length} more)` : "") + ". Each entry is a WRAPPER object carrying its package under `manifest:` \u2014 wrap an inlined body as `{ manifest: { \u2026 } }`. The key position is reserved so a future external-segment form is an additive key rather than a reshape. The body under `manifest:` is the ASSEMBLED package body (`AssembledPackageBodySchema`): its `objects` / `datasources` are DEFINITIONS, not the authoring manifest's glob patterns \u2014 a compiled artifact has no files left to glob."
+      );
+    }
+    const manifest = entry.manifest;
+    const id = artifactPackageId(manifest);
+    if (id === void 0) {
+      throw refuse(
+        "INVALID_ARTIFACT_PACKAGE_ENTRY",
+        `Release artifact \`packages[${index}]\` carries a manifest with no usable package id: \`registerApp\` keys the installed package on \`id || name\`, so an entry without either cannot be ordered against its siblings or addressed after install.`
+      );
+    }
+    if (nodes.has(id)) {
+      throw refuse(
+        "DUPLICATE_ARTIFACT_PACKAGE",
+        `Release artifact declares package "${id}" more than once (\`packages[${index}]\` repeats an earlier entry). One artifact carries each package once \u2014 an artifact is one atomic delivery (ADR-0130 D1/D6), not a list with last-writer-wins.`
+      );
+    }
+    nodes.set(id, {
+      // `name` is what `resolvePluginOrder` puts in its diagnostics; the MAP KEY
+      // is what its edges resolve against. Both are the package id, so an error
+      // it raises names the same string the artifact author wrote.
+      name: id,
+      optionalDependencies: Object.keys(
+        manifest.dependencies ?? {}
+      ),
+      manifest
+    });
+  });
+  return resolvePluginOrder(nodes).map((node) => node.manifest);
+}
+
 // src/lite-kernel.ts
 var LiteKernel = class extends ObjectKernelBase {
   constructor(config) {
@@ -3211,6 +3200,55 @@ var PluginSignatureVerifier = class {
   }
 };
 
+// src/security/plugin-artifact-integrity.ts
+var import_node_crypto2 = require("crypto");
+var SRI_ALGORITHMS = /* @__PURE__ */ new Set(["sha256", "sha384", "sha512"]);
+function sriDigestFor(declared, data) {
+  const dash = declared.indexOf("-");
+  const alg = dash > 0 && SRI_ALGORITHMS.has(declared.slice(0, dash)) ? declared.slice(0, dash) : "sha256";
+  return `${alg}-${(0, import_node_crypto2.createHash)(alg).update(data).digest("base64")}`;
+}
+function verifyIntegrity(files, integrity, options = {}) {
+  if (integrity === null || integrity === void 0) {
+    return { ok: true, skipped: true, checked: 0, violations: [] };
+  }
+  const exempt = new Set(options.exempt ?? []);
+  const byPath = /* @__PURE__ */ new Map();
+  for (const f of files) {
+    if (!exempt.has(f.path)) byPath.set(f.path, f.data);
+  }
+  const violations = [];
+  let checked = 0;
+  for (const [path, declaredRaw] of Object.entries(integrity)) {
+    if (exempt.has(path)) continue;
+    const declared = typeof declaredRaw === "string" ? declaredRaw : String(declaredRaw);
+    const data = byPath.get(path);
+    if (data === void 0) {
+      violations.push({ kind: "missing_file", path, declared });
+      continue;
+    }
+    checked++;
+    const actual = sriDigestFor(declared, data);
+    if (actual !== declared) violations.push({ kind: "digest_mismatch", path, declared, actual });
+  }
+  for (const path of [...byPath.keys()].sort()) {
+    if (!Object.prototype.hasOwnProperty.call(integrity, path)) {
+      violations.push({ kind: "extra_file", path });
+    }
+  }
+  return { ok: violations.length === 0, skipped: false, checked, violations };
+}
+function formatIntegrityViolation(v) {
+  switch (v.kind) {
+    case "digest_mismatch":
+      return `${v.path}: digest mismatch \u2014 manifest declares ${v.declared}, artifact bytes hash to ${v.actual}`;
+    case "missing_file":
+      return `${v.path}: declared in the integrity map but absent from the artifact`;
+    case "extra_file":
+      return `${v.path}: present in the artifact but not in the integrity map`;
+  }
+}
+
 // src/security/plugin-permission-enforcer.ts
 var PluginPermissionEnforcer = class {
   constructor(logger) {
@@ -4305,16 +4343,16 @@ var PluginSecurityScanner = class {
 };
 
 // src/security/api-key.ts
-var import_node_crypto2 = require("crypto");
+var import_node_crypto3 = require("crypto");
 var import_security = require("@objectstack/spec/security");
 var API_KEY_PREFIX = "osk_";
 var API_KEY_ENTROPY_BYTES = 32;
 var VISIBLE_PREFIX_LEN = 12;
 function hashApiKey(raw) {
-  return (0, import_node_crypto2.createHash)("sha256").update(raw, "utf8").digest("hex");
+  return (0, import_node_crypto3.createHash)("sha256").update(raw, "utf8").digest("hex");
 }
 function generateApiKey(prefix = API_KEY_PREFIX) {
-  const secret = (0, import_node_crypto2.randomBytes)(API_KEY_ENTROPY_BYTES).toString("base64url");
+  const secret = (0, import_node_crypto3.randomBytes)(API_KEY_ENTROPY_BYTES).toString("base64url");
   const raw = `${prefix}${secret}`;
   return {
     raw,
@@ -4428,8 +4466,37 @@ function safeJsonParse(s, fallback) {
   }
 }
 
+// src/security/authz-store-unavailable.ts
+var AUTHZ_STORE_UNAVAILABLE_STATUS = 503;
+var AUTHZ_STORE_UNAVAILABLE_CODE = "SERVICE_UNAVAILABLE";
+var AUTHZ_STORE_UNAVAILABLE_MESSAGE = "The authorization store could not be read, so this request's permissions were never determined. This is a server-side outage, not a permission denial.";
+var AUTHZ_STORE_UNAVAILABLE_BRAND = "__objectstackAuthzStoreUnavailable";
+var _a, _b;
+var AuthzStoreUnavailableError = class extends (_b = Error, _a = AUTHZ_STORE_UNAVAILABLE_BRAND, _b) {
+  constructor(object, cause) {
+    super(`${AUTHZ_STORE_UNAVAILABLE_MESSAGE} (failed read: \`${object}\`)`);
+    /** Brand — see the module doc on why this is not `instanceof`. */
+    this[_a] = true;
+    /** ADR-0112 wire code. */
+    this.code = AUTHZ_STORE_UNAVAILABLE_CODE;
+    /** HTTP status a transport should answer. */
+    this.status = AUTHZ_STORE_UNAVAILABLE_STATUS;
+    this.name = "AuthzStoreUnavailableError";
+    this.object = object;
+    if (cause !== void 0) this.cause = cause;
+  }
+};
+function isAuthzStoreUnavailableError(err) {
+  return typeof err === "object" && err !== null && err[AUTHZ_STORE_UNAVAILABLE_BRAND] === true;
+}
+function rethrowAuthzStoreUnavailable(err) {
+  if (isAuthzStoreUnavailableError(err)) throw err;
+  return void 0;
+}
+
 // src/security/resolve-authz-context.ts
-var import_spec = require("@objectstack/spec");
+var import_types2 = require("@objectstack/types");
+var import_spec2 = require("@objectstack/spec");
 var import_security2 = require("@objectstack/spec/security");
 
 // src/security/grant-validity.ts
@@ -4450,6 +4517,20 @@ function isGrantActive(row, nowMs) {
   if (until !== void 0 && !(nowMs < until)) return false;
   return true;
 }
+function nextGrantValidityBoundary(rows, nowMs) {
+  let next;
+  for (const row of rows) {
+    if (!row) continue;
+    const from = toEpochMs(row.valid_from ?? row.validFrom);
+    const until = toEpochMs(row.valid_until ?? row.validUntil);
+    for (const bound of [from, until]) {
+      if (bound !== void 0 && bound > nowMs && (next === void 0 || bound < next)) {
+        next = bound;
+      }
+    }
+  }
+  return next;
+}
 function isGrantExpired(row, nowMs) {
   if (!row) return false;
   const until = toEpochMs(row.valid_until ?? row.validUntil);
@@ -4457,6 +4538,227 @@ function isGrantExpired(row, nowMs) {
   return !(nowMs < until);
 }
 
+// src/security/authz-cache-posture.ts
+var AUTHZ_GRANTS_CACHE_TTL_ENV = "OS_AUTHZ_GRANTS_CACHE_TTL_MS";
+function resolveAuthzCachePosture(input) {
+  const { ttlMs, bus, driver } = input;
+  if (!(ttlMs > 0)) {
+    return { posture: "disabled", loud: false, message: "" };
+  }
+  if (bus === "bridged") {
+    return {
+      posture: "bus-narrowed",
+      loud: false,
+      message: `[authz-cache] grants cache ENABLED (ttl=${ttlMs}ms) with the "authz.invalidated" bridge attached` + (driver ? ` (cluster driver "${driver}")` : "") + ". The bus narrows the TYPICAL convergence to one network hop; the TTL remains the correctness bound, because no shipped driver delivers better than at-most-once (cluster.mdx \xA74.2)."
+    };
+  }
+  const why = bus === "in-process" ? `the cluster driver "${driver ?? "memory"}" is in-process and does not fan out across replicas` : "no cluster service is registered on this node";
+  return {
+    posture: "ttl-only",
+    loud: true,
+    message: `[authz-cache] grants cache ENABLED (ttl=${ttlMs}ms) with NO "authz.invalidated" invalidation bus \u2014 ${why}. A grant revoked on another replica is honoured by this one for up to ${ttlMs}ms. That is a supported configuration, not an error: the TTL is the correctness bound and it still holds. It is stated because a silently-absent invalidation bridge is how a security control gets disabled without anyone noticing (#4785). To narrow the typical window, configure a remote cluster driver; to remove it entirely, set ${AUTHZ_GRANTS_CACHE_TTL_ENV}=0.`
+  };
+}
+function readAuthzGrantsCacheTtlMs(env = typeof process !== "undefined" ? process.env : {}) {
+  const raw = env[AUTHZ_GRANTS_CACHE_TTL_ENV];
+  if (raw === void 0 || raw.trim() === "") {
+    return { ttlMs: 0, malformed: false };
+  }
+  const parsed = Number(raw.trim());
+  if (!Number.isFinite(parsed) || parsed < 0) {
+    return { ttlMs: 0, raw, malformed: true };
+  }
+  return { ttlMs: Math.floor(parsed), raw, malformed: false };
+}
+function reportAuthzCachePosture(input, sink2) {
+  if (input.malformedTtl) {
+    sink2.warn(
+      `[authz-cache] ${AUTHZ_GRANTS_CACHE_TTL_ENV}=${JSON.stringify(input.malformedTtl.raw ?? "")} is not a non-negative number; the grants cache is treated as DISABLED. Set a millisecond count, or 0 to disable it deliberately.`
+    );
+  }
+  const statement = resolveAuthzCachePosture(input);
+  if (statement.posture === "disabled") return statement;
+  if (statement.loud) sink2.warn(statement.message);
+  else sink2.info?.(statement.message);
+  return statement;
+}
+
+// src/security/resolve-user-grants-cache.ts
+var GRANTS_CACHE_WATCHED_OBJECTS = /* @__PURE__ */ new Set([
+  "sys_member",
+  "sys_user_position",
+  "sys_user_permission_set",
+  "sys_position",
+  "sys_position_permission_set",
+  "sys_permission_set",
+  "sys_user"
+]);
+var grantsCacheStates = /* @__PURE__ */ new WeakMap();
+var WRITE_OPERATIONS = /* @__PURE__ */ new Set(["insert", "update", "delete"]);
+function grantsCacheState(ql) {
+  const existing = grantsCacheStates.get(ql);
+  if (existing !== void 0) return existing ?? void 0;
+  const seamQl = ql;
+  const epoch = seamQl.writeEpoch;
+  const hasEpoch = !!epoch && typeof epoch === "object" && typeof epoch.current === "number" && typeof epoch.bump === "function" && typeof epoch.subscribe === "function";
+  if (!hasEpoch || typeof seamQl.registerMiddleware !== "function") {
+    return void 0;
+  }
+  const state = { gen: 0, entries: /* @__PURE__ */ new Map() };
+  try {
+    seamQl.registerMiddleware(async (ctx, next) => {
+      if (typeof ctx?.operation !== "string" || !WRITE_OPERATIONS.has(ctx.operation) || typeof ctx?.object !== "string" || !GRANTS_CACHE_WATCHED_OBJECTS.has(ctx.object)) {
+        return next();
+      }
+      try {
+        await next();
+      } finally {
+        state.gen += 1;
+      }
+    });
+    epoch.subscribe((_epoch, reason) => {
+      if (reason !== "write") state.gen += 1;
+    });
+  } catch {
+    grantsCacheStates.set(ql, null);
+    return void 0;
+  }
+  grantsCacheStates.set(ql, state);
+  return state;
+}
+function grantsCacheKey(userId, opts) {
+  return JSON.stringify([
+    userId,
+    opts.tenantId ?? null,
+    opts.seedEmail ?? null,
+    Array.isArray(opts.seedPermissions) ? opts.seedPermissions : []
+  ]);
+}
+var cloneGrants = (grants) => structuredClone(grants);
+function openUserGrantsCache(ql, userId, opts) {
+  if (opts.bypassGrantsCache) return void 0;
+  const { ttlMs } = readAuthzGrantsCacheTtlMs();
+  if (ttlMs <= 0) return void 0;
+  if (!ql || typeof ql !== "object" || typeof ql.find !== "function") {
+    return void 0;
+  }
+  const state = grantsCacheState(ql);
+  if (!state) return void 0;
+  const key = grantsCacheKey(userId, opts);
+  const now = opts.nowMs ?? Date.now();
+  const genAtOpen = state.gen;
+  const existing = state.entries.get(key);
+  if (existing) {
+    if (existing.gen === state.gen && existing.expiresAt > now) {
+      return { hit: cloneGrants(existing.value), commit: () => {
+      } };
+    }
+    state.entries.delete(key);
+  }
+  return {
+    commit(grants, nextBoundaryMs) {
+      const expiresAt = Math.min(now + ttlMs, nextBoundaryMs ?? Number.POSITIVE_INFINITY);
+      if (expiresAt <= now) return;
+      state.entries.set(key, { value: cloneGrants(grants), gen: genAtOpen, expiresAt });
+    }
+  };
+}
+
+// src/security/platform-admin.ts
+var import_types = require("@objectstack/types");
+var PLATFORM_ADMIN_EMAIL_SEPARATOR = ",";
+function normalizePlatformAdminEmail(value) {
+  return typeof value === "string" ? value.trim().toLowerCase() : "";
+}
+function isParseableAddress(entry) {
+  if (/\s/.test(entry)) return false;
+  const at = entry.indexOf("@");
+  if (at <= 0) return false;
+  if (entry.indexOf("@", at + 1) !== -1) return false;
+  return at < entry.length - 1;
+}
+var EMPTY_CONFIG = Object.freeze({
+  emails: Object.freeze([]),
+  declaredSpellings: Object.freeze([])
+});
+function parsePlatformAdminEmails(raw) {
+  if (raw == null) return EMPTY_CONFIG;
+  const text = String(raw);
+  if (text.trim() === "") return EMPTY_CONFIG;
+  const emails = [];
+  const declaredSpellings = [];
+  for (const piece of text.split(PLATFORM_ADMIN_EMAIL_SEPARATOR)) {
+    const entry = normalizePlatformAdminEmail(piece);
+    if (entry === "") continue;
+    if (!isParseableAddress(entry)) {
+      return {
+        emails: Object.freeze([]),
+        declaredSpellings: Object.freeze([]),
+        raw: text,
+        refusal: `${import_types.PLATFORM_OWNER_EMAIL_ENV} entry ${JSON.stringify(piece)} is not an email address, so the WHOLE variable is refused and this deployment has ZERO config-derived platform administrators. The entry is not skipped on purpose: silently dropping it would leave a narrower administrator set than the operator declared, with nothing to notice. Fix the entry, or remove it \u2014 ${import_types.PLATFORM_OWNER_EMAIL_ENV} takes one address or a comma-separated list of them.`
+      };
+    }
+    if (!emails.includes(entry)) {
+      emails.push(entry);
+      declaredSpellings.push(piece.trim());
+    }
+  }
+  return {
+    emails: Object.freeze(emails),
+    declaredSpellings: Object.freeze(declaredSpellings),
+    raw: text
+  };
+}
+var defaultSink = {
+  error: (m) => console.error(m),
+  warn: (m) => console.warn(m)
+};
+var sink = defaultSink;
+function setPlatformAdminConfigSink(next) {
+  const prev = sink;
+  sink = next ?? defaultSink;
+  return prev;
+}
+var NOT_MEMOIZED = /* @__PURE__ */ Symbol("platform-admin-config-not-memoized");
+var memoKey = NOT_MEMOIZED;
+var memoValue = EMPTY_CONFIG;
+function resolvePlatformAdminEmails() {
+  const raw = (0, import_types.resolvePlatformOwnerEmail)();
+  if (memoKey !== NOT_MEMOIZED && memoKey === raw) return memoValue;
+  const parsed = parsePlatformAdminEmails(raw);
+  memoKey = raw;
+  memoValue = parsed;
+  if (parsed.refusal) sink.error(`[authz] ${parsed.refusal}`);
+  return parsed;
+}
+function resetPlatformAdminEmailMemo() {
+  memoKey = NOT_MEMOIZED;
+  memoValue = EMPTY_CONFIG;
+}
+function matchesConfiguredPlatformAdmin(row, config) {
+  if (config.emails.length === 0) return false;
+  if (!row || typeof row !== "object") return false;
+  if (!isConfiguredPlatformAdminEmail(row.email, config)) return false;
+  return (0, import_types.isEmailVerifiedUserRow)(row);
+}
+function isConfiguredPlatformAdminEmail(email, config) {
+  if (config.emails.length === 0) return false;
+  const candidate = normalizePlatformAdminEmail(email);
+  return candidate !== "" && config.emails.includes(candidate);
+}
+var legacyGrantPointerSaid = false;
+function reportLegacyPlatformAdminGrant(input) {
+  if (legacyGrantPointerSaid) return;
+  legacyGrantPointerSaid = true;
+  const email = normalizePlatformAdminEmail(input.email);
+  sink.warn(
+    `[authz] user ${input.userId} holds PLATFORM_ADMIN through the legacy unscoped 'admin_full_access' grant row, not through ${import_types.PLATFORM_OWNER_EMAIL_ENV}. The grant row is the OLD anchor and is honoured for now; it is removed in a later release. Re-anchor this deployment by declaring its administrators in configuration: ${import_types.PLATFORM_OWNER_EMAIL_ENV}=${email || "<the administrator's verified email address>"} (comma-separated for several), and make sure each account's email is VERIFIED \u2014 an unverified account holding a configured address is not an administrator. Reported once per process; further holders are not listed.`
+  );
+}
+function resetLegacyPlatformAdminGrantReport() {
+  legacyGrantPointerSaid = false;
+}
+
 // src/security/posture-ladder.ts
 var POSTURE_LADDER = [
   "PLATFORM_ADMIN",
@@ -4530,14 +4832,16 @@ function safeJsonParse2(s, fallback) {
     return fallback;
   }
 }
-async function tryFind(ql, object, where, limit = 100) {
+async function tryFind(ql, object, where, limit = 100, organizationId) {
   if (!ql || typeof ql.find !== "function") return [];
   try {
-    let rows = await ql.find(object, { where, limit, context: { isSystem: true } });
+    const context = organizationId ? { isSystem: true, tenantId: organizationId } : { isSystem: true };
+    let rows = await ql.find(object, { where, limit, context });
     if (rows && rows.value) rows = rows.value;
     return Array.isArray(rows) ? rows : [];
-  } catch {
-    return [];
+  } catch (err) {
+    if ((0, import_types2.isMissingTableError)(err, object)) return [];
+    throw new AuthzStoreUnavailableError(object, err);
   }
 }
 async function resolveAuthzContext(input) {
@@ -4611,6 +4915,8 @@ async function resolveAuthzContext(input) {
   return ctx;
 }
 async function resolveUserAuthzGrants(ql, userId, opts = {}) {
+  const grantsCache = openUserGrantsCache(ql, userId, opts);
+  if (grantsCache?.hit) return grantsCache.hit;
   const { tenantId } = opts;
   const grants = {
     positions: [],
@@ -4631,12 +4937,20 @@ async function resolveUserAuthzGrants(ql, userId, opts = {}) {
     }
     return userRow;
   };
+  const platformAdminConfig = resolvePlatformAdminEmails();
+  const needsUserRow = !grants.email || !grants.permissions.includes("ai_seat") || platformAdminConfig.emails.length > 0;
+  const [, members, userPositionRows, orgMembersLeg, upsRowsAll] = await Promise.all([
+    needsUserRow ? getUserRow() : Promise.resolve(void 0),
+    tryFind(ql, "sys_member", { user_id: userId }, 200),
+    tryFind(ql, "sys_user_position", { user_id: userId }, 200),
+    tenantId ? tryFind(ql, "sys_member", { organization_id: tenantId }, 1e3) : Promise.resolve([]),
+    tryFind(ql, "sys_user_permission_set", { user_id: userId }, 100)
+  ]);
   if (!grants.email) {
     const u = await getUserRow();
     if (u?.email) grants.email = String(u.email);
   }
   const nowMs = opts.nowMs ?? Date.now();
-  const members = await tryFind(ql, "sys_member", { user_id: userId }, 200);
   const accessibleOrgIds = /* @__PURE__ */ new Set();
   for (const m of members) {
     if (!isGrantActive(m, nowMs)) continue;
@@ -4644,16 +4958,17 @@ async function resolveUserAuthzGrants(ql, userId, opts = {}) {
     if (typeof org === "string" && org) accessibleOrgIds.add(org);
   }
   grants.accessible_org_ids = Array.from(accessibleOrgIds);
-  const activeMembers = tenantId ? members.filter((m) => (m.organization_id ?? m.organizationId) === tenantId) : members;
+  const activeMembers = members.filter(
+    (m) => isGrantActive(m, nowMs) && (!tenantId || (m.organization_id ?? m.organizationId) === tenantId)
+  );
   for (const m of activeMembers) {
     if (m.role && typeof m.role === "string") {
       for (const raw of m.role.split(",").map((s) => s.trim()).filter(Boolean)) {
-        const r = (0, import_spec.mapMembershipRole)(raw);
+        const r = (0, import_spec2.mapMembershipRole)(raw);
         if (!grants.positions.includes(r)) grants.positions.push(r);
       }
     }
   }
-  const userPositionRows = await tryFind(ql, "sys_user_position", { user_id: userId }, 200);
   for (const ur of userPositionRows) {
     const org = ur.organization_id ?? null;
     if (org && tenantId && org !== tenantId) continue;
@@ -4662,14 +4977,13 @@ async function resolveUserAuthzGrants(ql, userId, opts = {}) {
     if (typeof r === "string" && r && !grants.positions.includes(r)) grants.positions.push(r);
   }
   if (tenantId) {
-    const orgMembers = await tryFind(ql, "sys_member", { organization_id: tenantId }, 1e3);
+    const orgMembers = orgMembersLeg;
     const ids = new Set(
       orgMembers.map((m) => m.user_id ?? m.userId).filter((v) => typeof v === "string" && v.length > 0)
     );
     ids.add(userId);
     grants.org_user_ids = Array.from(ids);
   }
-  const upsRowsAll = await tryFind(ql, "sys_user_permission_set", { user_id: userId }, 100);
   const upsRows = upsRowsAll.filter((r) => isGrantActive(r, nowMs));
   const psIds = new Set(
     upsRows.filter((r) => {
@@ -4683,7 +4997,7 @@ async function resolveUserAuthzGrants(ql, userId, opts = {}) {
   let hasPlatformAdminGrant = false;
   if (!grants.positions.includes("everyone")) grants.positions.push("everyone");
   if (grants.positions.length > 0) {
-    const positionRows = await tryFind(ql, "sys_position", { name: { $in: grants.positions } }, 100);
+    const positionRows = await tryFind(ql, "sys_position", { name: { $in: grants.positions } }, 200, tenantId);
     const deactivatedNames = new Set(
       positionRows.filter((r) => !isRowActive(r)).map((r) => r.name).filter(Boolean)
     );
@@ -4706,7 +5020,7 @@ async function resolveUserAuthzGrants(ql, userId, opts = {}) {
     const mergedTabs = {};
     for (const ps of psRows) {
       if (ps.name && !grants.permissions.includes(ps.name)) grants.permissions.push(ps.name);
-      if (ps.name === import_spec.ADMIN_FULL_ACCESS && unscopedUserPsIds.has(ps.id)) hasPlatformAdminGrant = true;
+      if (ps.name === import_spec2.ADMIN_FULL_ACCESS && unscopedUserPsIds.has(ps.id)) hasPlatformAdminGrant = true;
       const sysPerms = typeof ps.system_permissions === "string" ? safeJsonParse2(ps.system_permissions, []) : ps.system_permissions ?? ps.systemPermissions;
       if (Array.isArray(sysPerms)) {
         for (const p of sysPerms) {
@@ -4726,21 +5040,46 @@ async function resolveUserAuthzGrants(ql, userId, opts = {}) {
     }
     if (Object.keys(mergedTabs).length > 0) grants.tabPermissions = mergedTabs;
   }
-  if (hasPlatformAdminGrant && !grants.positions.includes(import_spec.BUILTIN_IDENTITY_PLATFORM_ADMIN)) {
-    grants.positions.unshift(import_spec.BUILTIN_IDENTITY_PLATFORM_ADMIN);
+  const configConfersPlatformAdmin = platformAdminConfig.emails.length > 0 && matchesConfiguredPlatformAdmin(await getUserRow(), platformAdminConfig);
+  if (configConfersPlatformAdmin) {
+    hasPlatformAdminGrant = true;
+    if (!grants.permissions.includes(import_spec2.ADMIN_FULL_ACCESS)) grants.permissions.push(import_spec2.ADMIN_FULL_ACCESS);
+    for (const p of import_spec2.ADMIN_FULL_ACCESS_CAPABILITIES.systemPermissions ?? []) {
+      if (!grants.systemPermissions.includes(p)) grants.systemPermissions.push(p);
+    }
+  } else if (hasPlatformAdminGrant) {
+    if ((0, import_security2.postureEnforcesWall)((0, import_types2.resolveTenancyPosture)())) {
+      reportLegacyPlatformAdminGrant({ userId, email: userRow?.email });
+    }
+  }
+  if (hasPlatformAdminGrant && !grants.positions.includes(import_spec2.BUILTIN_IDENTITY_PLATFORM_ADMIN)) {
+    grants.positions.unshift(import_spec2.BUILTIN_IDENTITY_PLATFORM_ADMIN);
   }
   grants.posture = derivePosture({
     isPlatformAdmin: hasPlatformAdminGrant,
     // [ADR-0105 D4] Either org-admin capability set resolves the rung — the
     // wall-less variant differs only by withholding the superuser bits.
-    isTenantAdmin: import_spec.ORGANIZATION_ADMIN_GRANTS.some((n) => grants.permissions.includes(n))
+    isTenantAdmin: import_spec2.ORGANIZATION_ADMIN_GRANTS.some((n) => grants.permissions.includes(n))
   });
   if (!grants.permissions.includes("ai_seat")) {
     const aiAccess = (await getUserRow())?.ai_access;
     if (aiAccess === true || aiAccess === 1 || aiAccess === "1") grants.permissions.push("ai_seat");
   }
+  grantsCache?.commit(
+    grants,
+    nextGrantValidityBoundary([...members, ...userPositionRows, ...upsRowsAll], nowMs)
+  );
   return grants;
 }
+async function hasPlatformAdminStanding(ql, userId, opts = {}) {
+  if (!ql || typeof userId !== "string" || userId.length === 0) return false;
+  try {
+    const grants = await resolveUserAuthzGrants(ql, userId, { nowMs: opts.nowMs });
+    return grants.posture === "PLATFORM_ADMIN";
+  } catch {
+    return false;
+  }
+}
 function isValidTimeZone(tz) {
   try {
     new Intl.DateTimeFormat("en-US", { timeZone: tz });
@@ -4761,34 +5100,151 @@ function coerceCurrency(value) {
   const s = typeof value === "string" ? value.trim().toUpperCase() : "";
   return /^[A-Z]{3}$/.test(s) ? s : void 0;
 }
+var LOCALIZATION_FAILURE_CACHE_TTL_MS = 3e4;
+var LOCALIZATION_CACHE_TTL_ENV = "OS_LOCALIZATION_CACHE_TTL_MS";
+var LOCALIZATION_SUCCESS_CACHE_DEFAULT_TTL_MS = 3e4;
+function localizationSuccessCacheTtlMs(env = typeof process !== "undefined" ? process.env : {}) {
+  const raw = env[LOCALIZATION_CACHE_TTL_ENV];
+  if (raw === void 0 || raw.trim() === "") return LOCALIZATION_SUCCESS_CACHE_DEFAULT_TTL_MS;
+  const parsed = Number(raw.trim());
+  if (!Number.isFinite(parsed) || parsed < 0) return 0;
+  return Math.floor(parsed);
+}
+function readWriteEpoch(ql) {
+  if (!ql || typeof ql !== "object") return void 0;
+  const epoch = ql.writeEpoch;
+  if (!epoch || typeof epoch !== "object") return void 0;
+  const seam = epoch;
+  if (typeof seam.current !== "number" || typeof seam.bump !== "function" || typeof seam.subscribe !== "function") {
+    return void 0;
+  }
+  return seam.current;
+}
+var localizationSettingsStates = /* @__PURE__ */ new WeakMap();
+var localizationNoSettingsState = { gen: 0 };
+function localizationSettingsState(settings) {
+  if (!settings || typeof settings !== "object") return localizationNoSettingsState;
+  const existing = localizationSettingsStates.get(settings);
+  if (existing) return existing;
+  const state = { gen: 0 };
+  localizationSettingsStates.set(settings, state);
+  const subscribe = settings.subscribe;
+  if (typeof subscribe === "function") {
+    try {
+      subscribe.call(
+        settings,
+        "localization",
+        () => {
+          state.gen += 1;
+        }
+      );
+    } catch {
+    }
+  }
+  return state;
+}
+var localizationCache = /* @__PURE__ */ new WeakMap();
+function localizationEntryIsLive(entry, epoch, settings) {
+  if (entry.kind === "failure") return true;
+  return entry.epoch === epoch && entry.settings === settings && entry.settingsGen === settings.gen;
+}
+function putLocalizationEntry(ql, key, entry) {
+  const bucket = localizationCache.get(ql) ?? /* @__PURE__ */ new Map();
+  bucket.set(key, entry);
+  localizationCache.set(ql, bucket);
+}
 async function resolveLocalizationContext(input) {
   const { ql, settings, tenantId, userId } = input;
+  const cacheKey = `${tenantId ?? ""}|${userId ?? ""}`;
+  const cacheable = Boolean(ql) && typeof ql === "object";
+  const epoch = cacheable ? readWriteEpoch(ql) : void 0;
+  const settingsState = localizationSettingsState(settings);
+  if (cacheable) {
+    const hit = localizationCache.get(ql)?.get(cacheKey);
+    if (hit && hit.expiresAt > Date.now() && localizationEntryIsLive(hit, epoch, settingsState)) {
+      return hit.value;
+    }
+  }
+  const { value, backendFailed } = await resolveLocalizationContextUncached(input);
+  if (!cacheable) return value;
+  if (backendFailed) {
+    putLocalizationEntry(ql, cacheKey, {
+      value,
+      expiresAt: Date.now() + LOCALIZATION_FAILURE_CACHE_TTL_MS,
+      kind: "failure"
+    });
+    return value;
+  }
+  const ttlMs = localizationSuccessCacheTtlMs();
+  if (epoch !== void 0 && ttlMs > 0) {
+    putLocalizationEntry(ql, cacheKey, {
+      value,
+      expiresAt: Date.now() + ttlMs,
+      kind: "success",
+      epoch,
+      settings: settingsState,
+      settingsGen: settingsState.gen
+    });
+  } else {
+    localizationCache.get(ql)?.delete(cacheKey);
+  }
+  return value;
+}
+async function resolveLocalizationContextUncached(input) {
+  const { ql, settings, tenantId, userId } = input;
+  let backendFailed = false;
   try {
     if (settings && typeof settings.get === "function") {
       const sctx = { tenantId, userId };
-      const [tzRes, localeRes, currencyRes] = await Promise.all([
-        settings.get("localization", "timezone", sctx).catch(() => void 0),
-        settings.get("localization", "locale", sctx).catch(() => void 0),
-        settings.get("localization", "currency", sctx).catch(() => void 0)
-      ]);
+      let tzRes;
+      let localeRes;
+      let currencyRes;
+      if (typeof settings.getMany === "function") {
+        try {
+          const many = await settings.getMany("localization", ["timezone", "locale", "currency"], sctx);
+          tzRes = many.timezone;
+          localeRes = many.locale;
+          currencyRes = many.currency;
+        } catch {
+        }
+      } else {
+        [tzRes, localeRes, currencyRes] = await Promise.all([
+          settings.get("localization", "timezone", sctx).catch(() => void 0),
+          settings.get("localization", "locale", sctx).catch(() => void 0),
+          settings.get("localization", "currency", sctx).catch(() => void 0)
+        ]);
+      }
       const tz = coerceTimeZone(tzRes?.value);
       const locale = coerceLocale(localeRes?.value);
       const currency = coerceCurrency(currencyRes?.value);
-      if (tz || locale || currency) return { timezone: tz ?? "UTC", locale: locale ?? "en-US", currency };
+      if (tz || locale || currency) {
+        return { value: { timezone: tz ?? "UTC", locale: locale ?? "en-US", currency }, backendFailed: false };
+      }
     }
   } catch {
   }
-  const rows = await tryFind(
-    ql,
-    "sys_setting",
-    { namespace: "localization", key: { $in: ["timezone", "locale", "currency"] }, scope: "tenant" },
-    10
-  );
+  let rows = [];
+  if (ql && typeof ql.find === "function") {
+    try {
+      let result = await ql.find("sys_setting", {
+        where: { namespace: "localization", key: { $in: ["timezone", "locale", "currency"] }, scope: "tenant" },
+        limit: 10,
+        context: { isSystem: true }
+      });
+      if (result && result.value) result = result.value;
+      rows = Array.isArray(result) ? result : [];
+    } catch {
+      backendFailed = true;
+    }
+  }
   const valueOf = (k) => rows.find((r) => r.key === k)?.value;
   return {
-    timezone: coerceTimeZone(valueOf("timezone")) ?? "UTC",
-    locale: coerceLocale(valueOf("locale")) ?? "en-US",
-    currency: coerceCurrency(valueOf("currency"))
+    value: {
+      timezone: coerceTimeZone(valueOf("timezone")) ?? "UTC",
+      locale: coerceLocale(valueOf("locale")) ?? "en-US",
+      currency: coerceCurrency(valueOf("currency"))
+    },
+    backendFailed
   };
 }
 
@@ -4950,7 +5406,7 @@ function shouldDenyAnonymous(input) {
 var ADMIN_STANDING_SURFACE = {
   sys_permission_set: {
     role: "derives",
-    reason: "The row `platform_admin` is resolved BY NAME from (\xA76b). Renaming it, deleting it or switching it off (ADR-0049 `active`, read here since #8613) un-makes every platform admin at once, with no identity table touched.",
+    reason: "The row `admin_full_access` is resolved BY NAME from (\xA76b) \u2014 `platform_admin` is the POSITION that row derives, not the row's own name. Renaming it, deleting it or switching it off (ADR-0049 `active`, read here since #8613) un-makes every GRANT-derived platform admin at once, with no identity table touched. \u26A0\uFE0F It does NOT un-make a CONFIG-derived one (\xA76b-config, #11970): that route sets the same standing from `ADMIN_FULL_ACCESS_CAPABILITIES` in `@objectstack/spec` and matches the caller's own stored `sys_user` row, so it touches an identity table and never reads this one. With `OS_PLATFORM_OWNER_EMAIL` unset the first sentence is the whole truth; with it declared, this row stops being the single point that un-makes every administrator.",
     columns: [
       "id",
       "name",
@@ -4992,8 +5448,14 @@ var ADMIN_STANDING_SURFACE = {
     ]
   },
   sys_user: {
-    role: "reads-only",
-    reason: "Read for the `current_user.email` RLS fallback and the ADR-0024 `ai_seat` synthesis (\xA77). Neither confers administrator standing. The guard does watch this table, but for the ban/delete WRITE SHAPES \u2014 `banned` is never read here, so it is not a derivation column and carries no standing-key list."
+    role: "derives",
+    reason: "[#11663 L2] RECLASSIFIED from `reads-only`. This table used to be read only for the `current_user.email` RLS fallback and the ADR-0024 `ai_seat` synthesis (\xA77), and the note here said so: \"Neither confers administrator standing.\" That sentence is now FALSE. The config anchor (\xA76b-config) matches the row's own `email` against the deployment's declared administrator list and requires `email_verified` to read verified, so a write that changes either column takes platform-admin standing away from a config-derived administrator \u2014 an address change and an email_verified reset are both ordinary, reachable writes, and neither touches a grant table. `banned` stays absent from the column list because the resolver still never reads it; the guard watches the ban/delete WRITE SHAPES on this table for its own reasons, which is a different question from what this resolver consumes.",
+    columns: [
+      "id",
+      "email",
+      "email_verified",
+      "ai_access"
+    ]
   },
   sys_user_position: {
     role: "reads-only",
@@ -5008,6 +5470,13 @@ var ADMIN_STANDING_SURFACE = {
     reason: "Position-bound permission sets (\xA76a). Contributes ids to `psIds` \u2014 and therefore names to `permissions` \u2014 but not to `unscopedUserPsIds`, which is the set \xA76b tests for platform-admin standing."
   }
 };
+var ADMIN_STANDING_NON_TABLE_INPUTS = [
+  {
+    kind: "env",
+    name: "OS_PLATFORM_OWNER_EMAIL",
+    reason: "The deployment's declared platform administrator(s) \u2014 one address or a comma-separated list, matched case-insensitively against `sys_user.email` and conferring standing only when that row's `email_verified` reads verified (\xA76b-config). Read live on every derivation with a per-process memo keyed on the raw string, so a rolled process picks up a change with no special path. Unset, blank, or carrying any unparseable entry means ZERO config-derived administrators, fail closed. No runtime write reaches it, so no break-glass guard can simulate a change to it: revocation is a configuration change plus a process roll, by design."
+  }
+];
 function adminStandingTables() {
   return Object.entries(ADMIN_STANDING_SURFACE).filter(([, t]) => t.role === "derives").map(([name]) => name).sort();
 }
@@ -5039,6 +5508,9 @@ function withoutOperationPrivateKeys(exec) {
   return out;
 }
 
+// src/security/authz-invalidation-channel.ts
+var AUTHZ_INVALIDATED_CHANNEL = "authz.invalidated";
+
 // src/utils/datetime.ts
 var import_data = require("@objectstack/spec/data");
 function calendarPartsInTz(d, tz) {
@@ -5319,7 +5791,7 @@ function omitInternalFieldsFromWriteResponse(schema, records) {
 }
 
 // src/utils/migration-journal.ts
-var import_node_crypto3 = require("crypto");
+var import_node_crypto4 = require("crypto");
 var import_system4 = require("@objectstack/spec/system");
 var SYSTEM_CTX = { isSystem: true };
 var DEFAULT_CHUNK_SIZE = 200;
@@ -5374,7 +5846,7 @@ function hashMigrationPlan(plan, chunks) {
     steps: plan.steps.map((s) => s.name),
     chunks: chunks.map((c) => [c.stepIndex, c.offset, c.length])
   });
-  return (0, import_node_crypto3.createHash)("sha256").update(shape, "utf8").digest("hex").slice(0, 32);
+  return (0, import_node_crypto4.createHash)("sha256").update(shape, "utf8").digest("hex").slice(0, 32);
 }
 async function appendEvent(engine, event, execContext) {
   await engine.insert(
@@ -5447,7 +5919,7 @@ async function runMigrationJournal(engine, plan, options = {}) {
   }
   const { chunks, planHash, rowsByStep } = await loadPlan(engine, plan, options.chunkSize);
   const resuming = Boolean(options.runId);
-  const runId = options.runId ?? (0, import_node_crypto3.randomUUID)();
+  const runId = options.runId ?? (0, import_node_crypto4.randomUUID)();
   let events = [];
   let seq = 0;
   let committed = /* @__PURE__ */ new Set();
@@ -5939,6 +6411,110 @@ function isUninterpretableTemporalComparand(kind, value) {
   return !(readsAsWallClock(s) || readsAsInstant(s));
 }
 
+// src/utils/metadata-activation-store.ts
+var METADATA_ACTIVATION_TABLE = "sys_metadata_activation";
+var SYSTEM_CTX2 = { isSystem: true, positions: [], permissions: [] };
+var InMemoryMetadataActivationStore = class {
+  constructor() {
+    this.rows = /* @__PURE__ */ new Map();
+  }
+  async list() {
+    return [...this.rows.values()];
+  }
+  async setActive(row) {
+    this.rows.set(row.name, { ...row });
+  }
+};
+var ObjectStoreMetadataActivationStore = class {
+  constructor(engine, metadataType) {
+    this.engine = engine;
+    this.metadataType = metadataType;
+  }
+  /**
+   * Every row of this type. Read once at boot to hydrate the consumer's
+   * projection.
+   *
+   * The only scoping is the `metadata_type` discriminator: the ledger is
+   * deployment-wide and has no tenant column, so there is no second axis to
+   * filter on (see the module header).
+   */
+  async list() {
+    const rows = await this.engine.find(METADATA_ACTIVATION_TABLE, {
+      where: { metadata_type: this.metadataType },
+      context: SYSTEM_CTX2
+    });
+    if (!Array.isArray(rows)) return [];
+    const out = [];
+    for (const row of rows) {
+      const r = row;
+      if (typeof r.name !== "string" || !r.name) continue;
+      out.push({
+        name: r.name,
+        packageId: typeof r.package_id === "string" ? r.package_id : "",
+        // The column defaults to `true`; only an explicit `false`
+        // disarms. A driver that round-trips booleans as 0/1
+        // (SQLite/libsql) is read through the same `=== false || === 0`
+        // test, so a `0` is not mistaken for `true`.
+        active: !(r.active === false || r.active === 0)
+      });
+    }
+    return out;
+  }
+  /**
+   * Insert or update the row for one packaged artifact.
+   *
+   * Read-then-write rather than a blind upsert because the object's
+   * uniqueness is a DECLARED index (`unique: 'global'` over
+   * `(metadata_type, name)`), not a primary key this store controls: there is
+   * no id to collide on, so an insert-and-catch could not tell "already
+   * there" from a real store failure.
+   *
+   * That index is also why taking the FIRST match is taking the only one: the
+   * read below is keyed on exactly the index's two columns, so it can match
+   * at most one row. It used to pick the first row with a NULL organization
+   * out of the result, back when the table carried a reserved tenant column;
+   * with no such column the set it was choosing from can no longer hold more
+   * than one member.
+   */
+  async setActive(row) {
+    const existing = await this.engine.find(METADATA_ACTIVATION_TABLE, {
+      where: { metadata_type: this.metadataType, name: row.name },
+      context: SYSTEM_CTX2
+    });
+    const current = Array.isArray(existing) ? existing[0] : void 0;
+    if (current && current.id != null) {
+      await this.engine.update(
+        METADATA_ACTIVATION_TABLE,
+        { id: current.id, active: row.active, package_id: row.packageId },
+        { context: SYSTEM_CTX2 }
+      );
+      return;
+    }
+    await this.engine.insert(
+      METADATA_ACTIVATION_TABLE,
+      {
+        metadata_type: this.metadataType,
+        name: row.name,
+        package_id: row.packageId,
+        active: row.active
+      },
+      { context: SYSTEM_CTX2 }
+    );
+  }
+  /**
+   * Read the backing table once so a misconfiguration surfaces at BOOT
+   * rather than as a failed toggle later. Throws the driver error verbatim —
+   * `no such table: sys_metadata_activation` means the object was never
+   * registered (or its schema never synced) in this composition.
+   *
+   * ⚠️ Unscoped by design: the question is "does the TABLE read at all",
+   * which is a property of the composition, not of one `metadata_type`.
+   */
+  async probe() {
+    await this.engine.find(METADATA_ACTIVATION_TABLE, { where: {}, limit: 1, context: SYSTEM_CTX2 });
+  }
+};
+
 // src/utils/record-not-found.ts
 function recordNotFoundError(object, id) {
   const err = new Error(`Record ${id} not found in ${object}`);
@@ -5949,6 +6525,45 @@ function recordNotFoundError(object, id) {
 }
 
 // src/health-monitor.ts
+var RECOVERY_IS_THRESHOLD_GATED = {
+  degraded: true,
+  unhealthy: true,
+  failed: true,
+  recovering: true,
+  healthy: false,
+  unknown: false
+};
+function healthMonitorRefusal(message) {
+  const err = new Error(message);
+  err.code = "VALIDATION_ERROR";
+  err.status = 400;
+  return err;
+}
+var RETIRED_HEALTH_CHECK_KEYS = [
+  [
+    "autoRestart",
+    "'autoRestart' was removed from PluginHealthCheck in @objectstack/spec 18 (#12032, ADR-0049 enforce-or-remove) \u2014 it never restarted a plugin. `attemptRestart` called `plugin.destroy()` and stopped there, then logged 'Plugin restarted' and set status `recovering`, and the periodic checks carried on against the destroyed instance \u2014 which the default check (`{ name: 'plugin-loaded', status: 'passed' }`) passes forever, so a destroyed, never-re-initialised plugin ended up reported `healthy`. Delete the key. This monitor no longer destroys anything: a failing plugin is reported `unhealthy` or `failed` and left alone."
+  ],
+  [
+    "maxRestartAttempts",
+    "'maxRestartAttempts' was removed from PluginHealthCheck in @objectstack/spec 18 (#12032, ADR-0049 enforce-or-remove) \u2014 it capped a restart that never happened, so it only counted `destroy()` calls. Delete the key."
+  ],
+  [
+    "restartBackoff",
+    "'restartBackoff' was removed from PluginHealthCheck in @objectstack/spec 18 (#12032, ADR-0049 enforce-or-remove) \u2014 it delayed a restart that never happened, so it only moved when the `destroy()` landed. Delete the key."
+  ]
+];
+var RESTART_IS_THE_HOSTS_JOB = " Restarting a plugin is the HOST's job in this host-driven library: poll `getHealthStatus(pluginName)` / `getHealthReport(pluginName)` and act on `unhealthy` / `failed` at the level that owns the plugin's lifetime \u2014 recreate the kernel, or let your supervisor restart the process.";
+function assertNoRetiredKeys(pluginName, config) {
+  for (const [key, guidance] of RETIRED_HEALTH_CHECK_KEYS) {
+    if (!Object.prototype.hasOwnProperty.call(config, key)) {
+      continue;
+    }
+    throw healthMonitorRefusal(
+      `[HealthMonitor] Plugin '${pluginName}': ${guidance}${RESTART_IS_THE_HOSTS_JOB}`
+    );
+  }
+}
 var PluginHealthMonitor = class {
   constructor(logger) {
     this.healthChecks = /* @__PURE__ */ new Map();
@@ -5957,18 +6572,17 @@ var PluginHealthMonitor = class {
     this.checkIntervals = /* @__PURE__ */ new Map();
     this.failureCounters = /* @__PURE__ */ new Map();
     this.successCounters = /* @__PURE__ */ new Map();
-    this.restartAttempts = /* @__PURE__ */ new Map();
     this.logger = logger.child({ component: "HealthMonitor" });
   }
   /**
    * Register a plugin for health monitoring
    */
   registerPlugin(pluginName, config) {
+    assertNoRetiredKeys(pluginName, config);
     this.healthChecks.set(pluginName, config);
     this.healthStatus.set(pluginName, "unknown");
     this.failureCounters.set(pluginName, 0);
     this.successCounters.set(pluginName, 0);
-    this.restartAttempts.set(pluginName, 0);
     this.logger.info("Plugin registered for health monitoring", {
       plugin: pluginName,
       interval: config.interval
@@ -6020,6 +6634,7 @@ var PluginHealthMonitor = class {
     let status = "healthy";
     let message;
     const checks = [];
+    let failureRoute;
     try {
       if (config.checkMethod && typeof plugin[config.checkMethod] === "function") {
         const checkResult = await this.raceCheckTimeout(
@@ -6040,8 +6655,8 @@ var PluginHealthMonitor = class {
       if (status === "healthy") {
         this.successCounters.set(pluginName, (this.successCounters.get(pluginName) || 0) + 1);
         this.failureCounters.set(pluginName, 0);
-        const currentStatus = this.healthStatus.get(pluginName);
-        if (currentStatus === "unhealthy" || currentStatus === "degraded") {
+        const currentStatus = this.healthStatus.get(pluginName) ?? "unknown";
+        if (RECOVERY_IS_THRESHOLD_GATED[currentStatus]) {
           const successCount = this.successCounters.get(pluginName) || 0;
           if (successCount >= config.successThreshold) {
             this.healthStatus.set(pluginName, "healthy");
@@ -6053,27 +6668,11 @@ var PluginHealthMonitor = class {
           this.healthStatus.set(pluginName, "healthy");
         }
       } else {
-        this.failureCounters.set(pluginName, (this.failureCounters.get(pluginName) || 0) + 1);
-        this.successCounters.set(pluginName, 0);
-        const failureCount = this.failureCounters.get(pluginName) || 0;
-        if (failureCount >= config.failureThreshold) {
-          this.healthStatus.set(pluginName, "unhealthy");
-          this.logger.warn("Plugin marked as unhealthy", {
-            plugin: pluginName,
-            failures: failureCount
-          });
-          if (config.autoRestart) {
-            await this.attemptRestart(pluginName, plugin, config);
-          }
-        } else {
-          this.healthStatus.set(pluginName, "degraded");
-        }
+        failureRoute = "returned";
       }
     } catch (error) {
       status = "failed";
       message = error instanceof Error ? error.message : "Unknown error";
-      this.failureCounters.set(pluginName, (this.failureCounters.get(pluginName) || 0) + 1);
-      this.healthStatus.set(pluginName, "failed");
       checks.push({
         name: "health-check",
         status: "failed",
@@ -6083,6 +6682,10 @@ var PluginHealthMonitor = class {
         plugin: pluginName,
         error
       });
+      failureRoute = "thrown";
+    }
+    if (failureRoute) {
+      this.recordFailedRound(pluginName, config, failureRoute);
     }
     const report = {
       status: this.healthStatus.get(pluginName) || "unknown",
@@ -6096,56 +6699,42 @@ var PluginHealthMonitor = class {
     this.healthReports.set(pluginName, report);
   }
   /**
-   * Attempt to restart a plugin
+   * Handle one failed round — the single path BOTH failure routes take.
+   *
+   * `performHealthCheck` can fail two disjoint ways: the check *returns* a
+   * failure (`false` or `{ status: 'unhealthy' }`), or it *throws* — which by
+   * `raceCheckTimeout` includes every `timeout` overrun, the severest case of
+   * the two. The routes used to be handled in separate blocks, and only the
+   * returned one cleared `successCounters`, so the counters a declared
+   * `failureThreshold` / `successThreshold` are counted with depended on which
+   * way the round happened to fail (#11852).
+   *
+   * What stays route-specific is the *status label*, deliberately. A throw is
+   * the separate `failed` status applied immediately with no threshold — that
+   * is the documented contract (`content/docs/protocol/kernel/lifecycle.mdx`,
+   * "Custom Health Checks") and is pinned by the timeout test. Only the
+   * counters are shared, because that is what `failureThreshold` declares, and
+   * it does not name a route.
+   *
+   * This round ENDS here. Nothing is done TO the plugin — see the #12032 note
+   * on the class: a monitor that cannot re-initialise a plugin has no business
+   * destroying one.
    */
-  async attemptRestart(pluginName, plugin, config) {
-    const attempts = this.restartAttempts.get(pluginName) || 0;
-    if (attempts >= config.maxRestartAttempts) {
-      this.logger.error("Max restart attempts reached, giving up", {
-        plugin: pluginName,
-        attempts
-      });
+  recordFailedRound(pluginName, config, route) {
+    const failureCount = (this.failureCounters.get(pluginName) || 0) + 1;
+    this.failureCounters.set(pluginName, failureCount);
+    this.successCounters.set(pluginName, 0);
+    const thresholdReached = failureCount >= config.failureThreshold;
+    if (route === "thrown") {
       this.healthStatus.set(pluginName, "failed");
-      return;
-    }
-    this.restartAttempts.set(pluginName, attempts + 1);
-    const delay = this.calculateBackoff(attempts, config.restartBackoff);
-    this.logger.info("Scheduling plugin restart", {
-      plugin: pluginName,
-      attempt: attempts + 1,
-      delay
-    });
-    await new Promise((resolve) => setTimeout(resolve, delay));
-    try {
-      if (plugin.destroy) {
-        await plugin.destroy();
-      }
-      this.logger.info("Plugin restarted", { plugin: pluginName });
-      this.failureCounters.set(pluginName, 0);
-      this.successCounters.set(pluginName, 0);
-      this.healthStatus.set(pluginName, "recovering");
-    } catch (error) {
-      this.logger.error("Plugin restart failed", {
+    } else if (thresholdReached) {
+      this.healthStatus.set(pluginName, "unhealthy");
+      this.logger.warn("Plugin marked as unhealthy", {
         plugin: pluginName,
-        error
+        failures: failureCount
       });
-      this.healthStatus.set(pluginName, "failed");
-    }
-  }
-  /**
-   * Calculate backoff delay for restarts
-   */
-  calculateBackoff(attempt, strategy) {
-    const baseDelay = 1e3;
-    switch (strategy) {
-      case "fixed":
-        return baseDelay;
-      case "linear":
-        return baseDelay * (attempt + 1);
-      case "exponential":
-        return baseDelay * Math.pow(2, attempt);
-      default:
-        return baseDelay;
+    } else {
+      this.healthStatus.set(pluginName, "degraded");
     }
   }
   /**
@@ -6178,7 +6767,6 @@ var PluginHealthMonitor = class {
     this.healthReports.clear();
     this.failureCounters.clear();
     this.successCounters.clear();
-    this.restartAttempts.clear();
     this.logger.info("Health monitor shutdown complete");
   }
   /**
@@ -6219,7 +6807,7 @@ var PluginHealthMonitor = class {
 };
 
 // src/hot-reload.ts
-var import_node_crypto4 = require("crypto");
+var import_node_crypto5 = require("crypto");
 var generateUUID = () => {
   if (typeof crypto !== "undefined" && crypto.randomUUID) {
     return crypto.randomUUID();
@@ -6230,6 +6818,42 @@ var generateUUID = () => {
     return v.toString(16);
   });
 };
+var HONOURED_STATE_STRATEGIES = ["memory", "none"];
+var RETIRED_STATE_STRATEGY_GUIDANCE = "'disk' and 'distributed' were removed from HotReloadConfig.stateStrategy in @objectstack/spec 18 (ADR-0049 enforce-or-remove) \u2014 neither was ever implemented. Both wrote to the same in-memory Map as 'memory' and reported it only at debug level, so a host that asked for durable or cluster-replicated state got process-local memory and no error. Use 'memory' for in-process state preservation across a reload, or 'none' to disable it. There is no in-tree replacement for durable or distributed plugin state \u2014 persist it in the host, which owns the process lifetime these strategies pretended to outlive.";
+function hotReloadRefusal(message) {
+  const err = new Error(message);
+  err.code = "VALIDATION_ERROR";
+  err.status = 400;
+  return err;
+}
+function assertHonouredStateStrategy(pluginName, strategy) {
+  if (HONOURED_STATE_STRATEGIES.includes(strategy)) {
+    return;
+  }
+  const shown = typeof strategy === "string" ? `'${strategy}'` : String(strategy);
+  const retired = strategy === "disk" || strategy === "distributed";
+  throw hotReloadRefusal(
+    `[HotReload] Plugin '${pluginName}': unsupported stateStrategy ${shown}. Honoured values are ${HONOURED_STATE_STRATEGIES.map((v) => `'${v}'`).join(" and ")}. ` + (retired ? RETIRED_STATE_STRATEGY_GUIDANCE : "This value has never been implemented by PluginStateManager.")
+  );
+}
+var RETIRED_HOT_RELOAD_KEYS = [
+  [
+    "distributedConfig",
+    "'distributedConfig' was removed from HotReloadConfig in @objectstack/spec 18 (ADR-0049 enforce-or-remove) \u2014 nothing ever read it. A provider, endpoints, a key prefix, a TTL and a replication factor could all be declared and no connection was ever opened. It left with the stateStrategy: 'distributed' value it was documented as being required for. Delete the key; there is no in-tree replacement for distributed plugin state \u2014 persist it in the host."
+  ],
+  [
+    "watchPatterns",
+    "'watchPatterns' was removed from HotReloadConfig in @objectstack/spec 18 (ADR-0049 enforce-or-remove) \u2014 nothing ever read it. Its only two uses were log lines: no watcher was ever constructed from it, so an author could declare a glob and no file change ever triggered a reload. File watching is the HOST's job in this host-driven library. Delete the key, declare your globs wherever your own watcher reads them, and call `HotReloadManager.scheduleReload(pluginName, reloadFn)` when one matches \u2014 that is the debounced integration point this class does implement."
+  ]
+];
+function assertNoRetiredKeys2(pluginName, config) {
+  for (const [key, guidance] of RETIRED_HOT_RELOAD_KEYS) {
+    if (!Object.prototype.hasOwnProperty.call(config, key)) {
+      continue;
+    }
+    throw hotReloadRefusal(`[HotReload] Plugin '${pluginName}': ${guidance}`);
+  }
+}
 var PluginStateManager = class {
   constructor(logger) {
     this.stateSnapshots = /* @__PURE__ */ new Map();
@@ -6256,17 +6880,6 @@ var PluginStateManager = class {
         this.memoryStore.set(snapshotId, snapshot);
         this.logger.debug("State saved to memory", { pluginId, snapshotId });
         break;
-      case "disk":
-        this.memoryStore.set(snapshotId, snapshot);
-        this.logger.debug("State saved to disk (memory fallback)", { pluginId, snapshotId });
-        break;
-      case "distributed":
-        this.memoryStore.set(snapshotId, snapshot);
-        this.logger.debug("State saved to distributed store (memory fallback)", {
-          pluginId,
-          snapshotId
-        });
-        break;
       case "none":
         this.logger.debug("State persistence disabled", { pluginId });
         break;
@@ -6314,7 +6927,7 @@ var PluginStateManager = class {
    */
   calculateChecksum(state) {
     const stateStr = JSON.stringify(state);
-    return (0, import_node_crypto4.createHash)("sha256").update(stateStr).digest("hex");
+    return (0, import_node_crypto5.createHash)("sha256").update(stateStr).digest("hex");
   }
   /**
    * Shutdown state manager
@@ -6328,7 +6941,6 @@ var PluginStateManager = class {
 var HotReloadManager = class {
   constructor(logger) {
     this.reloadConfigs = /* @__PURE__ */ new Map();
-    this.watchHandles = /* @__PURE__ */ new Map();
     this.reloadTimers = /* @__PURE__ */ new Map();
     this.logger = logger.child({ component: "HotReload" });
     this.stateManager = new PluginStateManager(logger);
@@ -6337,6 +6949,8 @@ var HotReloadManager = class {
    * Register a plugin for hot reload
    */
   registerPlugin(pluginName, config) {
+    assertHonouredStateStrategy(pluginName, config.stateStrategy);
+    assertNoRetiredKeys2(pluginName, config);
     if (!config.enabled) {
       this.logger.debug("Hot reload disabled for plugin", { plugin: pluginName });
       return;
@@ -6344,32 +6958,45 @@ var HotReloadManager = class {
     this.reloadConfigs.set(pluginName, config);
     this.logger.info("Plugin registered for hot reload", {
       plugin: pluginName,
-      watchPatterns: config.watchPatterns,
       stateStrategy: config.stateStrategy
     });
   }
   /**
-   * Start watching for changes (requires file system integration)
+   * Refuse the file-watching call this class never implemented (#12428).
+   *
+   * The body used to be a guard plus `logger.info('File watching started')`
+   * over an in-source note saying real watching "would require chokidar or
+   * similar". Nothing was ever watched, so an operator who set
+   * `enabled: true` and read that line at INFO had been told the opposite of
+   * the truth — positive confirmation of a capability that did not exist.
+   * ADR-0049 leaves three states and this surface qualified for none of the
+   * other two: no runtime composes this class, so ENFORCE would build for a
+   * caller that does not exist, and no roadmap entry anywhere claims the
+   * feature, so EXPERIMENTAL would be a promise nobody made.
+   *
+   * Kept as a throwing door rather than deleted: removing the method leaves a
+   * JavaScript host a bare `TypeError: not a function` with no prescription,
+   * and this is the one place a caller of the old placeholder is guaranteed
+   * to arrive. The refusal carries an ADR-0112 envelope so it can be asserted
+   * rather than merely caught.
    */
   startWatching(pluginName) {
-    const config = this.reloadConfigs.get(pluginName);
-    if (!config || !config.enabled) {
-      return;
-    }
-    this.logger.info("File watching started", {
-      plugin: pluginName,
-      patterns: config.watchPatterns
-    });
+    throw hotReloadRefusal(
+      `[HotReload] Plugin '${pluginName}': startWatching() never watched anything and was removed in @objectstack/core 18 (ADR-0049 enforce-or-remove). It logged 'File watching started' at info level while no watcher was ever constructed, so no file change could ever trigger a reload. File watching is the HOST's job in this host-driven library: run your own watcher and call \`HotReloadManager.scheduleReload(pluginName, reloadFn)\` when a file changes \u2014 that is the debounced integration point this class does implement. \`HotReloadConfig.watchPatterns\` was removed in @objectstack/spec 18 for the same reason; declare your globs where your watcher reads them.`
+    );
   }
   /**
-   * Stop watching for changes
+   * Cancel a pending debounced reload for a plugin.
+   *
+   * The name is historical (#12428). This never stopped a watcher, because
+   * nothing in this class ever started one: its `watchHandles` cleanup branch
+   * read a Map that had no writer anywhere in the tree, so the branch was
+   * structurally unreachable rather than merely untaken, and it left with
+   * `startWatching`'s placeholder. What survives is the half that always did
+   * something — the debounce timer armed by `scheduleReload` is cleared, so a
+   * reload that was scheduled but has not fired yet is cancelled.
    */
   stopWatching(pluginName) {
-    const handle = this.watchHandles.get(pluginName);
-    if (handle) {
-      this.watchHandles.delete(pluginName);
-      this.logger.info("File watching stopped", { plugin: pluginName });
-    }
     const timer = this.reloadTimers.get(pluginName);
     if (timer) {
       clearTimeout(timer);
@@ -6512,14 +7139,10 @@ var HotReloadManager = class {
    * Shutdown hot reload manager
    */
   shutdown() {
-    for (const pluginName of this.watchHandles.keys()) {
-      this.stopWatching(pluginName);
-    }
     for (const timer of this.reloadTimers.values()) {
       clearTimeout(timer);
     }
     this.reloadConfigs.clear();
-    this.watchHandles.clear();
     this.reloadTimers.clear();
     this.stateManager.shutdown();
     this.logger.info("Hot reload manager shutdown complete");
@@ -6929,6 +7552,7 @@ var NamespaceResolver = class {
 var import_contracts = require("@objectstack/spec/contracts");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  ADMIN_STANDING_NON_TABLE_INPUTS,
   ADMIN_STANDING_SURFACE,
   ANONYMOUS_DENY_BODY,
   ANONYMOUS_DENY_CODE,
@@ -6937,11 +7561,19 @@ var import_contracts = require("@objectstack/spec/contracts");
   API_KEY_PREFIX,
   AUDIENCE_BINDING_SUGGESTION_STATUSES,
   AUDIENCE_BINDING_SUGGESTION_STATUS_VALUES,
+  AUTHZ_GRANTS_CACHE_TTL_ENV,
+  AUTHZ_INVALIDATED_CHANNEL,
+  AUTHZ_STORE_UNAVAILABLE_CODE,
+  AUTHZ_STORE_UNAVAILABLE_MESSAGE,
+  AUTHZ_STORE_UNAVAILABLE_STATUS,
+  AuthzStoreUnavailableError,
   CORE_FALLBACK_FACTORIES,
   DependencyResolver,
   ENTRY_EXECUTION_CONTEXT_FIELDS,
   HotReloadManager,
+  InMemoryMetadataActivationStore,
   LiteKernel,
+  METADATA_ACTIVATION_TABLE,
   MigrationJournalRefusal,
   MigrationPlanRegistry,
   NamespaceResolver,
@@ -6949,10 +7581,11 @@ var import_contracts = require("@objectstack/spec/contracts");
   ObjectKernel,
   ObjectKernelBase,
   ObjectLogger,
+  ObjectStoreMetadataActivationStore,
+  PLATFORM_ADMIN_EMAIL_SEPARATOR,
   POSTURE_INJECTION_RULE,
   POSTURE_LADDER,
   POSTURE_RANK,
-  PluginConfigValidator,
   PluginHealthMonitor,
   PluginLoader,
   PluginPermissionEnforcer,
@@ -6961,6 +7594,7 @@ var import_contracts = require("@objectstack/spec/contracts");
   PluginSecurityScanner,
   PluginSignatureVerifier,
   QA,
+  SERVICE_NOT_REGISTERED_CODE,
   SIGNATURE_ALG,
   SecurePluginContext,
   SemanticVersionManager,
@@ -6970,6 +7604,7 @@ var import_contracts = require("@objectstack/spec/contracts");
   UnresolvedFilterTokenError,
   adminStandingColumns,
   adminStandingTables,
+  artifactPackageId,
   assembleExecutionContext,
   assembleExecutionContextOrGuest,
   assertInitServiceRequirements,
@@ -6988,7 +7623,6 @@ var import_contracts = require("@objectstack/spec/contracts");
   createMemoryJob,
   createMemoryMetadata,
   createMemoryQueue,
-  createPluginConfigValidator,
   createPluginPermissionEnforcer,
   deepMerge,
   defaultIsTransientError,
@@ -7000,48 +7634,67 @@ var import_contracts = require("@objectstack/spec/contracts");
   extractApiKey,
   filterTokenContextFrom,
   findInterruptedRuns,
+  formatIntegrityViolation,
   generateApiKey,
   generateEd25519KeyPair,
   getEnv,
   getMemoryUsage,
+  hasPlatformAdminStanding,
   hashApiKey,
   hashMigrationPlan,
   isAudienceBindingSuggestionStatus,
   isAuthGateAllowlisted,
+  isAuthzStoreUnavailableError,
+  isConfiguredPlatformAdminEmail,
   isExpired,
   isGrantActive,
   isGrantExpired,
   isNode,
   isRowActive,
+  isServiceNotRegisteredError,
   isUninterpretableTemporalComparand,
+  matchesConfiguredPlatformAdmin,
   nextUtcCalendarDay,
   normalizeAuthGate,
+  normalizePlatformAdminEmail,
   omitInternalFieldsFromWriteResponse,
+  parsePlatformAdminEmails,
   parseScopes,
   parseSignature,
   planChunks,
   postureVisibleRows,
   readAuthoredTranslationLayer,
+  readAuthzGrantsCacheTtlMs,
   readRunJournal,
   recordNotFoundError,
+  reportAuthzCachePosture,
+  reportLegacyPlatformAdminGrant,
+  resetLegacyPlatformAdminGrantReport,
+  resetPlatformAdminEmailMemo,
   resolveApiKeyAdmission,
   resolveApiKeyPrincipal,
+  resolveArtifactPackageOrder,
+  resolveAuthzCachePosture,
   resolveAuthzContext,
   resolveFilterToken,
   resolveFilterTokens,
   resolveLocale,
   resolveLocalizationContext,
+  resolvePlatformAdminEmails,
   resolvePluginOrder,
   resolveUserAuthzGrants,
   resumeMigrationJournal,
+  rethrowAuthzStoreUnavailable,
   runMigrationJournal,
   safeExit,
+  setPlatformAdminConfigSink,
   shouldDenyAnonymous,
   signPayload,
   temporalComparandKind,
   unknownAudienceBindingSuggestionStatusMessage,
   utcInstantMs,
   validateInitServiceContract,
+  verifyIntegrity,
   verifyPayload,
   verifyPlatformSignature,
   verifyPluginArtifact,