@objectstack/core 17.2.0 → 17.4.0

package/dist/index.js

@@ -713,138 +713,6 @@ function createLogger(config) {
 // src/kernel.ts
 import { ServiceRequirementDef } from "@objectstack/spec/system";
 
-// src/security/plugin-config-validator.ts
-import { z } from "zod";
-var PluginConfigValidator = class {
-  constructor(logger) {
-    this.logger = logger;
-  }
-  /**
-   * Validate plugin configuration against its Zod schema
-   * 
-   * @param plugin - Plugin metadata with configSchema
-   * @param config - User-provided configuration
-   * @returns Validated and typed configuration
-   * @throws Error with detailed validation errors
-   */
-  validatePluginConfig(plugin, config) {
-    if (!plugin.configSchema) {
-      this.logger.debug(`Plugin ${plugin.name} has no config schema - skipping validation`);
-      return config;
-    }
-    try {
-      const validatedConfig = plugin.configSchema.parse(config);
-      this.logger.debug(`\u2705 Plugin config validated: ${plugin.name}`, {
-        plugin: plugin.name,
-        configKeys: Object.keys(config || {}).length
-      });
-      return validatedConfig;
-    } catch (error) {
-      if (error instanceof z.ZodError) {
-        const formattedErrors = this.formatZodErrors(error);
-        const errorMessage = [
-          `Plugin ${plugin.name} configuration validation failed:`,
-          ...formattedErrors.map((e) => `  - ${e.path}: ${e.message}`)
-        ].join("\n");
-        this.logger.error(errorMessage, void 0, {
-          plugin: plugin.name,
-          errors: formattedErrors
-        });
-        throw new Error(errorMessage);
-      }
-      throw error;
-    }
-  }
-  /**
-   * Validate partial configuration (for incremental updates)
-   * 
-   * @param plugin - Plugin metadata
-   * @param partialConfig - Partial configuration to validate
-   * @returns Validated partial configuration
-   */
-  validatePartialConfig(plugin, partialConfig) {
-    if (!plugin.configSchema) {
-      return partialConfig;
-    }
-    try {
-      const partialSchema = plugin.configSchema.partial();
-      const validatedConfig = partialSchema.parse(partialConfig);
-      this.logger.debug(`\u2705 Partial config validated: ${plugin.name}`);
-      return validatedConfig;
-    } catch (error) {
-      if (error instanceof z.ZodError) {
-        const formattedErrors = this.formatZodErrors(error);
-        const errorMessage = [
-          `Plugin ${plugin.name} partial configuration validation failed:`,
-          ...formattedErrors.map((e) => `  - ${e.path}: ${e.message}`)
-        ].join("\n");
-        throw new Error(errorMessage);
-      }
-      throw error;
-    }
-  }
-  /**
-   * Get default configuration from schema
-   * 
-   * @param plugin - Plugin metadata
-   * @returns Default configuration object
-   */
-  getDefaultConfig(plugin) {
-    if (!plugin.configSchema) {
-      return void 0;
-    }
-    try {
-      const defaults = plugin.configSchema.parse({});
-      this.logger.debug(`Default config extracted: ${plugin.name}`);
-      return defaults;
-    } catch (error) {
-      this.logger.debug(`No default config available: ${plugin.name}`);
-      return void 0;
-    }
-  }
-  /**
-   * Check if configuration is valid without throwing
-   * 
-   * @param plugin - Plugin metadata
-   * @param config - Configuration to check
-   * @returns True if valid, false otherwise
-   */
-  isConfigValid(plugin, config) {
-    if (!plugin.configSchema) {
-      return true;
-    }
-    const result = plugin.configSchema.safeParse(config);
-    return result.success;
-  }
-  /**
-   * Get configuration errors without throwing
-   * 
-   * @param plugin - Plugin metadata
-   * @param config - Configuration to check
-   * @returns Array of validation errors, or empty array if valid
-   */
-  getConfigErrors(plugin, config) {
-    if (!plugin.configSchema) {
-      return [];
-    }
-    const result = plugin.configSchema.safeParse(config);
-    if (result.success) {
-      return [];
-    }
-    return this.formatZodErrors(result.error);
-  }
-  // Private methods
-  formatZodErrors(error) {
-    return error.issues.map((e) => ({
-      path: e.path.join(".") || "root",
-      message: e.message
-    }));
-  }
-};
-function createPluginConfigValidator(logger) {
-  return new PluginConfigValidator(logger);
-}
-
 // src/security/plugin-artifact-signature.ts
 import {
   sign as cryptoSign,
@@ -947,6 +815,43 @@ async function verifyPluginArtifact(input, keys) {
   return { ok: true, publisherVerified: publisher.verified, platformVerified };
 }
 
+// src/service-not-registered.ts
+var SERVICE_NOT_REGISTERED_CODE = "SERVICE_NOT_REGISTERED";
+var SERVICE_NOT_REGISTERED_BRAND = "__objectstackServiceNotRegistered";
+function serviceNotRegisteredError(name) {
+  const err = new Error(`Service '${name}' not found`);
+  err[SERVICE_NOT_REGISTERED_BRAND] = true;
+  err.code = SERVICE_NOT_REGISTERED_CODE;
+  err.serviceName = name;
+  return err;
+}
+function isServiceNotRegisteredError(err) {
+  return typeof err === "object" && err !== null && err[SERVICE_NOT_REGISTERED_BRAND] === true;
+}
+
+// src/plugin-contract.ts
+import { PluginSchema } from "@objectstack/spec/kernel";
+var PLUGIN_CONTRACT_VIOLATION_CODE = "PLUGIN_CONTRACT_VIOLATION";
+function assertPluginContract(plugin) {
+  const result = PluginSchema.safeParse(plugin);
+  if (result.success) {
+    return;
+  }
+  const issues = result.error.issues.filter((issue) => issue.path[0] !== "version");
+  if (issues.length === 0) {
+    return;
+  }
+  const first = issues[0];
+  const at = first.path.length > 0 ? first.path.join(".") : "(root)";
+  const id = plugin.id;
+  const named = typeof id === "string" && id.length > 0 ? `'${plugin.name}' (id: ${id})` : `'${plugin.name}'`;
+  const error = new Error(
+    `${PLUGIN_CONTRACT_VIOLATION_CODE}: plugin ${named} is refused by the declared plugin contract at '${at}': ${first.message}`
+  );
+  error.code = PLUGIN_CONTRACT_VIOLATION_CODE;
+  throw error;
+}
+
 // src/plugin-loader.ts
 var ServiceLifecycle = /* @__PURE__ */ ((ServiceLifecycle2) => {
   ServiceLifecycle2["SINGLETON"] = "singleton";
@@ -962,7 +867,6 @@ var PluginLoader = class {
     this.scopedServices = /* @__PURE__ */ new Map();
     this.creating = /* @__PURE__ */ new Set();
     this.logger = logger;
-    this.configValidator = new PluginConfigValidator(logger);
   }
   /**
    * Set the plugin context for service factories
@@ -985,13 +889,11 @@ var PluginLoader = class {
       this.logger.info(`Loading plugin: ${plugin.name}`);
       const metadata = this.toPluginMetadata(plugin);
       this.validatePluginStructure(metadata);
+      this.validatePluginContract(metadata);
       const versionCheck = this.checkVersionCompatibility(metadata);
       if (!versionCheck.compatible) {
         throw new Error(`Version incompatible: ${versionCheck.message}`);
       }
-      if (metadata.configSchema) {
-        this.validatePluginConfig(metadata);
-      }
       if (metadata.signature) {
         await this.verifyPluginSignature(metadata);
       }
@@ -1030,7 +932,7 @@ var PluginLoader = class {
     if (!registration) {
       const instance = this.serviceInstances.get(name);
       if (!instance) {
-        throw new Error(`Service '${name}' not found`);
+        throw serviceNotRegisteredError(name);
       }
       return instance;
     }
@@ -1172,6 +1074,27 @@ var PluginLoader = class {
       throw new Error(`Invalid semantic version: ${plugin.version}`);
     }
   }
+  /**
+   * Refuse a plugin object the DECLARED plugin contract refuses (#16049,
+   * maintainer ruling 2026-09-06: "the protocol is the baseline; the runtime
+   * aligns to it").
+   *
+   * The check itself — `PluginSchema.safeParse` for validation only, the
+   * eight keys it reaches, the `version` exclusion and the
+   * `PLUGIN_CONTRACT_VIOLATION` envelope — lives in `plugin-contract.ts`,
+   * because since #16721 it is ONE statement run by BOTH kernels:
+   * `LiteKernel.use()` calls it directly, and `ObjectKernel.use()` reaches
+   * it here, through `loadPlugin`. That module's comment is the authority on
+   * what is refused; this method adds nothing to it and subtracts nothing.
+   *
+   * What stays THIS loader's own, and is deliberately not shared: the
+   * structural checks one call up ({@link validatePluginStructure} —
+   * `name`, `init`, semver) and the version-compatibility check below.
+   * The convergence is on the schema, not on the loader.
+   */
+  validatePluginContract(plugin) {
+    assertPluginContract(plugin);
+  }
   checkVersionCompatibility(plugin) {
     const version = plugin.version;
     if (!this.isValidSemanticVersion(version)) {
@@ -1190,16 +1113,6 @@ var PluginLoader = class {
     const semverRegex = /^\d+\.\d+\.\d+(-[a-zA-Z0-9.-]+)?(\+[a-zA-Z0-9.-]+)?$/;
     return semverRegex.test(version);
   }
-  validatePluginConfig(plugin, config) {
-    if (!plugin.configSchema) {
-      return;
-    }
-    if (config === void 0) {
-      this.logger.debug(`Plugin ${plugin.name} has configuration schema (config validation postponed)`);
-      return;
-    }
-    this.configValidator.validatePluginConfig(plugin, config);
-  }
   async verifyPluginSignature(plugin) {
     if (!plugin.signature) {
       return;
@@ -1391,6 +1304,7 @@ function createMemoryI18n() {
   const authored = /* @__PURE__ */ new Map();
   let defaultLocale = "en";
   let supportedLocales;
+  let fallbackLocale;
   function resolveKey(data, key) {
     const parts = key.split(".");
     let current = data;
@@ -1427,7 +1341,11 @@ function createMemoryI18n() {
     _serviceName: "i18n",
     t(key, locale, params) {
       const data = resolveTranslations(locale) ?? mergedLocale(defaultLocale);
-      const value = data ? resolveKey(data, key) : void 0;
+      let value = data ? resolveKey(data, key) : void 0;
+      if (value === void 0 && fallbackLocale && fallbackLocale !== locale) {
+        const fallbackData = resolveTranslations(fallbackLocale);
+        value = fallbackData ? resolveKey(fallbackData, key) : void 0;
+      }
       if (value == null) return key;
       if (!params) return value;
       return value.replace(/\{\{(\w+)\}\}/g, (_, name) => String(params[name] ?? `{{${name}}}`));
@@ -1484,12 +1402,27 @@ function createMemoryI18n() {
     },
     setDefaultLocale(locale) {
       defaultLocale = locale;
+    },
+    /**
+     * @see II18nService.setFallbackLocale — [#15694]
+     *
+     * ⛔ There is deliberately NO `getFallbackLocale()` beside this. The two
+     * are different questions: this one is what the provider was TOLD, the
+     * accessor is what the serving layer ASKS it in order to build the
+     * metadata-document translators' fallback chain (#14882). Answering the
+     * second from `defaultLocale` — the only value that was always available
+     * here — would settle the default-locale contract question #14882 leaves
+     * deliberately open, from a degraded provider. Without the accessor those
+     * reads keep the resolvers' own default, which is known and intentional.
+     */
+    setFallbackLocale(locale) {
+      fallbackLocale = locale;
     }
   };
 }
 
 // src/metadata-service-contract.ts
-import { pluralToSingular } from "@objectstack/spec/shared";
+import { pluralToSingular } from "@objectstack/spec/meta-spelling";
 var REGISTER_REFUSAL_CODE = "VALIDATION_ERROR";
 function canonicalMetadataServiceType(type) {
   return pluralToSingular(type);
@@ -1809,6 +1742,7 @@ async function raceWithTimeout(operation, timeoutMs, createTimeoutError) {
 }
 
 // src/kernel.ts
+var DEGRADED_CAPABILITIES_SERVICE = "kernel.degraded-capabilities";
 var ObjectKernel = class {
   constructor(config = {}) {
     this.plugins = /* @__PURE__ */ new Map();
@@ -1816,7 +1750,12 @@ var ObjectKernel = class {
     this.hooks = /* @__PURE__ */ new Map();
     this.state = "idle";
     this.startedPlugins = /* @__PURE__ */ new Set();
-    this.pluginStartTimes = /* @__PURE__ */ new Map();
+    /**
+     * Plugin name -> elapsed milliseconds that plugin's `start()` took. These
+     * are DURATIONS, never start instants; the old spelling `pluginStartTimes`
+     * said the opposite of what it held.
+     */
+    this.pluginStartupDurations = /* @__PURE__ */ new Map();
     this.shutdownHandlers = [];
     this.config = {
       defaultStartupTimeout: 3e4,
@@ -2003,9 +1942,40 @@ var ObjectKernel = class {
     }
     if (missingCoreServices.length > 0) {
       this.logger.warn(`System started with degraded capabilities. Missing core services: ${missingCoreServices.join(", ")}`);
+      this.publishDegradedCapabilities(missingCoreServices);
     }
     this.logger.info("System requirement check passed");
   }
+  /**
+   * Publish this boot's degraded-capabilities conclusion on
+   * {@link DEGRADED_CAPABILITIES_SERVICE} — the data half of the warning
+   * `validateSystemRequirements()` just logged (#16630).
+   *
+   * ⛔ Best-effort, and silent on failure BY DESIGN: this is a diagnostic
+   * readout, and a readout must never be able to fail a boot that the kernel
+   * has just decided is good enough to run. The one way `registerService`
+   * can throw here is a name collision, which the guard above already
+   * forecloses; the `catch` is there so that stays true if either ever
+   * changes. (`recordSeedOutcome` in `@objectstack/runtime` states the same
+   * rule for the same reason.)
+   *
+   * The value is FROZEN and holds a COPY. `getService` hands out the stored
+   * reference, so an unfrozen live array would let any reader edit the
+   * kernel's own record of what was missing — and this record exists
+   * precisely so that two packages cannot disagree about it.
+   */
+  publishDegradedCapabilities(missingCoreServices) {
+    try {
+      if (this.services.has(DEGRADED_CAPABILITIES_SERVICE) || this.pluginLoader.hasService(DEGRADED_CAPABILITIES_SERVICE)) {
+        return;
+      }
+      this.registerService(
+        DEGRADED_CAPABILITIES_SERVICE,
+        Object.freeze({ missingCoreServices: Object.freeze([...missingCoreServices]) })
+      );
+    } catch {
+    }
+  }
   /**
    * Bootstrap the kernel with enhanced features
    */
@@ -2118,11 +2088,23 @@ var ObjectKernel = class {
     }
     return results;
   }
+  /**
+   * Per-plugin startup durations: plugin name -> elapsed milliseconds that
+   * plugin's `start()` took. Not start instants -- see
+   * {@link PluginStartupResult.durationMs}.
+   */
+  getPluginStartupDurations() {
+    return new Map(this.pluginStartupDurations);
+  }
   /**
    * Get plugin startup metrics
+   *
+   * @deprecated Renamed to {@link ObjectKernel.getPluginStartupDurations},
+   * which states what the values are. Retained as a delegating alias so
+   * nothing has to change on this release; slated for removal.
    */
   getPluginMetrics() {
-    return new Map(this.pluginStartTimes);
+    return this.getPluginStartupDurations();
   }
   /**
    * Whether a plugin with the given name has been registered on this kernel.
@@ -2244,11 +2226,14 @@ var ObjectKernel = class {
       );
       const duration = Date.now() - startTime;
       this.startedPlugins.add(plugin.name);
-      this.pluginStartTimes.set(plugin.name, duration);
+      this.pluginStartupDurations.set(plugin.name, duration);
       this.logger.debug(`Plugin started: ${plugin.name} (${duration}ms)`);
       return {
         success: true,
         pluginName: plugin.name,
+        durationMs: duration,
+        // Deprecated alias carrying the same elapsed value; see
+        // PluginStartupResult.startTime.
         startTime: duration
       };
     } catch (error) {
@@ -2258,6 +2243,9 @@ var ObjectKernel = class {
         success: false,
         pluginName: plugin.name,
         error,
+        durationMs: duration,
+        // Deprecated alias carrying the same elapsed value; see
+        // PluginStartupResult.startTime.
         startTime: duration,
         timedOut: isTimeout
       };
@@ -2373,6 +2361,67 @@ var ObjectKernel = class {
   }
 };
 
+// src/artifact-packages.ts
+import { ArtifactPackageSchema } from "@objectstack/spec";
+var MAX_REPORTED_ENTRY_ISSUES = 5;
+function refuse(code, message) {
+  const err = new Error(message);
+  err.code = code;
+  err.status = 422;
+  return err;
+}
+function artifactPackageId(manifest) {
+  const id = manifest?.id || manifest?.name;
+  return typeof id === "string" && id !== "" ? id : void 0;
+}
+function resolveArtifactPackageOrder(artifact) {
+  const declared = artifact?.packages;
+  if (declared === void 0 || declared === null) return [artifact];
+  if (!Array.isArray(declared)) {
+    throw refuse(
+      "INVALID_ARTIFACT_PACKAGES",
+      `A release artifact's \`packages\` must be an array of package entries (ADR-0130 D4, \`ArtifactPackageEntrySchema\`), but this artifact carries \`packages\` of type ${typeof declared}. Omit the key entirely for a single-package artifact \u2014 \`manifest\` is retained, not replaced.`
+    );
+  }
+  const nodes = /* @__PURE__ */ new Map();
+  declared.forEach((entry, index) => {
+    const verdict = ArtifactPackageSchema.safeParse(entry);
+    if (!verdict.success) {
+      const issues = verdict.error.issues;
+      const shown = issues.slice(0, MAX_REPORTED_ENTRY_ISSUES);
+      throw refuse(
+        "INVALID_ARTIFACT_PACKAGE_ENTRY",
+        `Release artifact \`packages[${index}]\` is not a package entry (ADR-0130 D4): ` + shown.map((i) => `${i.path.join(".") || "<entry>"}: ${i.message}`).join("; ") + (issues.length > shown.length ? ` (+${issues.length - shown.length} more)` : "") + ". Each entry is a WRAPPER object carrying its package under `manifest:` \u2014 wrap an inlined body as `{ manifest: { \u2026 } }`. The key position is reserved so a future external-segment form is an additive key rather than a reshape. The body under `manifest:` is the ASSEMBLED package body (`AssembledPackageBodySchema`): its `objects` / `datasources` are DEFINITIONS, not the authoring manifest's glob patterns \u2014 a compiled artifact has no files left to glob."
+      );
+    }
+    const manifest = entry.manifest;
+    const id = artifactPackageId(manifest);
+    if (id === void 0) {
+      throw refuse(
+        "INVALID_ARTIFACT_PACKAGE_ENTRY",
+        `Release artifact \`packages[${index}]\` carries a manifest with no usable package id: \`registerApp\` keys the installed package on \`id || name\`, so an entry without either cannot be ordered against its siblings or addressed after install.`
+      );
+    }
+    if (nodes.has(id)) {
+      throw refuse(
+        "DUPLICATE_ARTIFACT_PACKAGE",
+        `Release artifact declares package "${id}" more than once (\`packages[${index}]\` repeats an earlier entry). One artifact carries each package once \u2014 an artifact is one atomic delivery (ADR-0130 D1/D6), not a list with last-writer-wins.`
+      );
+    }
+    nodes.set(id, {
+      // `name` is what `resolvePluginOrder` puts in its diagnostics; the MAP KEY
+      // is what its edges resolve against. Both are the package id, so an error
+      // it raises names the same string the artifact author wrote.
+      name: id,
+      optionalDependencies: Object.keys(
+        manifest.dependencies ?? {}
+      ),
+      manifest
+    });
+  });
+  return resolvePluginOrder(nodes).map((node) => node.manifest);
+}
+
 // src/lite-kernel.ts
 var LiteKernel = class extends ObjectKernelBase {
   constructor(config) {
@@ -2384,6 +2433,26 @@ var LiteKernel = class extends ObjectKernelBase {
    * Register a plugin
    * @param plugin - Plugin instance
    *
+   * A plugin object the DECLARED plugin contract refuses is refused here,
+   * with `PLUGIN_CONTRACT_VIOLATION` — the same check, the same envelope,
+   * that `ObjectKernel.use()` runs through `PluginLoader` (`plugin-contract.ts`
+   * is the one statement both kernels call; #16721, maintainer ruling
+   * 2026-09-08, option A under #9864's precedent that the kernels converge).
+   *
+   * This method used to write the object straight into the registry, so the
+   * same plugin was accepted by this kernel and refused by `ObjectKernel` —
+   * and `AGENTS.md` names THIS kernel for tests, so a plugin could be green
+   * in vitest and refused at production boot. Measured before converging
+   * (#16721 step 1): of 813 `LiteKernel.use()` calls reachable in this
+   * repository's suites, 807 were accepted by the schema unchanged and the
+   * six refusals came from three test-local fixture objects, none of them
+   * product code.
+   *
+   * Ordering, and why it is pinned: state first (`validateIdle`), then the
+   * contract, then registration — a refused plugin never reaches the
+   * registry, so it can neither be booted nor supersede an earlier
+   * registration under its name.
+   *
    * Duplicate names OVERWRITE, with one `warn` naming both versions — the
    * declared contract in `plugin-registration.ts`, applied identically by
    * `ObjectKernel.use()` (#9864, maintainer ruling 2026-08-19).
@@ -2397,6 +2466,7 @@ var LiteKernel = class extends ObjectKernelBase {
    */
   use(plugin) {
     this.validateIdle();
+    assertPluginContract(plugin);
     registerPluginByName(this.plugins, plugin, this.logger);
     return this;
   }
@@ -3102,6 +3172,55 @@ var PluginSignatureVerifier = class {
   }
 };
 
+// src/security/plugin-artifact-integrity.ts
+import { createHash } from "crypto";
+var SRI_ALGORITHMS = /* @__PURE__ */ new Set(["sha256", "sha384", "sha512"]);
+function sriDigestFor(declared, data) {
+  const dash = declared.indexOf("-");
+  const alg = dash > 0 && SRI_ALGORITHMS.has(declared.slice(0, dash)) ? declared.slice(0, dash) : "sha256";
+  return `${alg}-${createHash(alg).update(data).digest("base64")}`;
+}
+function verifyIntegrity(files, integrity, options = {}) {
+  if (integrity === null || integrity === void 0) {
+    return { ok: true, skipped: true, checked: 0, violations: [] };
+  }
+  const exempt = new Set(options.exempt ?? []);
+  const byPath = /* @__PURE__ */ new Map();
+  for (const f of files) {
+    if (!exempt.has(f.path)) byPath.set(f.path, f.data);
+  }
+  const violations = [];
+  let checked = 0;
+  for (const [path, declaredRaw] of Object.entries(integrity)) {
+    if (exempt.has(path)) continue;
+    const declared = typeof declaredRaw === "string" ? declaredRaw : String(declaredRaw);
+    const data = byPath.get(path);
+    if (data === void 0) {
+      violations.push({ kind: "missing_file", path, declared });
+      continue;
+    }
+    checked++;
+    const actual = sriDigestFor(declared, data);
+    if (actual !== declared) violations.push({ kind: "digest_mismatch", path, declared, actual });
+  }
+  for (const path of [...byPath.keys()].sort()) {
+    if (!Object.prototype.hasOwnProperty.call(integrity, path)) {
+      violations.push({ kind: "extra_file", path });
+    }
+  }
+  return { ok: violations.length === 0, skipped: false, checked, violations };
+}
+function formatIntegrityViolation(v) {
+  switch (v.kind) {
+    case "digest_mismatch":
+      return `${v.path}: digest mismatch \u2014 manifest declares ${v.declared}, artifact bytes hash to ${v.actual}`;
+    case "missing_file":
+      return `${v.path}: declared in the integrity map but absent from the artifact`;
+    case "extra_file":
+      return `${v.path}: present in the artifact but not in the integrity map`;
+  }
+}
+
 // src/security/plugin-permission-enforcer.ts
 var PluginPermissionEnforcer = class {
   constructor(logger) {
@@ -3973,236 +4092,14 @@ var _PluginSandboxRuntime = class _PluginSandboxRuntime {
 _PluginSandboxRuntime.MONITORING_INTERVAL_MS = 5e3;
 var PluginSandboxRuntime = _PluginSandboxRuntime;
 
-// src/security/security-scanner.ts
-var PluginSecurityScanner = class {
-  constructor(logger, config) {
-    // Known vulnerabilities database (CVE cache)
-    this.vulnerabilityDb = /* @__PURE__ */ new Map();
-    // Scan results cache
-    this.scanResults = /* @__PURE__ */ new Map();
-    this.passThreshold = 70;
-    this.logger = logger.child({ component: "SecurityScanner" });
-    if (config?.passThreshold !== void 0) {
-      this.passThreshold = config.passThreshold;
-    }
-  }
-  /**
-   * Perform a comprehensive security scan on a plugin
-   */
-  async scan(target) {
-    this.logger.info("Starting security scan", {
-      pluginId: target.pluginId,
-      version: target.version
-    });
-    const issues = [];
-    try {
-      const codeIssues = await this.scanCode(target);
-      issues.push(...codeIssues);
-      const depIssues = await this.scanDependencies(target);
-      issues.push(...depIssues);
-      const malwareIssues = await this.scanMalware(target);
-      issues.push(...malwareIssues);
-      const licenseIssues = await this.scanLicenses(target);
-      issues.push(...licenseIssues);
-      const configIssues = await this.scanConfiguration(target);
-      issues.push(...configIssues);
-      const score = this.calculateSecurityScore(issues);
-      const result = {
-        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-        scanner: { name: "ObjectStack Security Scanner", version: "1.0.0" },
-        status: score >= this.passThreshold ? "passed" : "failed",
-        vulnerabilities: issues.map((issue) => ({
-          id: issue.id,
-          severity: issue.severity,
-          category: issue.category,
-          title: issue.title,
-          description: issue.description,
-          location: issue.location ? `${issue.location.file}:${issue.location.line}` : void 0,
-          remediation: issue.remediation,
-          affectedVersions: [],
-          exploitAvailable: false,
-          patchAvailable: false
-        })),
-        summary: {
-          totalVulnerabilities: issues.length,
-          criticalCount: issues.filter((i) => i.severity === "critical").length,
-          highCount: issues.filter((i) => i.severity === "high").length,
-          mediumCount: issues.filter((i) => i.severity === "medium").length,
-          lowCount: issues.filter((i) => i.severity === "low").length,
-          infoCount: issues.filter((i) => i.severity === "info").length
-        }
-      };
-      this.scanResults.set(`${target.pluginId}:${target.version}`, result);
-      this.logger.info("Security scan complete", {
-        pluginId: target.pluginId,
-        score,
-        status: result.status,
-        summary: result.summary
-      });
-      return result;
-    } catch (error) {
-      this.logger.error("Security scan failed", {
-        pluginId: target.pluginId,
-        error
-      });
-      throw error;
-    }
-  }
-  /**
-   * Scan code for vulnerabilities
-   */
-  async scanCode(target) {
-    const issues = [];
-    this.logger.debug("Code scan complete", {
-      pluginId: target.pluginId,
-      issuesFound: issues.length
-    });
-    return issues;
-  }
-  /**
-   * Scan dependencies for known vulnerabilities
-   */
-  async scanDependencies(target) {
-    const issues = [];
-    if (!target.dependencies) {
-      return issues;
-    }
-    for (const [depName, version] of Object.entries(target.dependencies)) {
-      const vulnKey = `${depName}@${version}`;
-      const vulnerability = this.vulnerabilityDb.get(vulnKey);
-      if (vulnerability) {
-        issues.push({
-          id: `vuln-${vulnerability.cve || depName}`,
-          severity: vulnerability.severity,
-          category: "vulnerability",
-          title: `Vulnerable dependency: ${depName}`,
-          description: `${depName}@${version} has known security vulnerabilities`,
-          remediation: vulnerability.fixedIn ? `Upgrade to ${vulnerability.fixedIn.join(" or ")}` : "No fix available",
-          cve: vulnerability.cve
-        });
-      }
-    }
-    this.logger.debug("Dependency scan complete", {
-      pluginId: target.pluginId,
-      dependencies: Object.keys(target.dependencies).length,
-      vulnerabilities: issues.length
-    });
-    return issues;
-  }
-  /**
-   * Scan for malware patterns
-   */
-  async scanMalware(target) {
-    const issues = [];
-    this.logger.debug("Malware scan complete", {
-      pluginId: target.pluginId,
-      issuesFound: issues.length
-    });
-    return issues;
-  }
-  /**
-   * Check license compliance
-   */
-  async scanLicenses(target) {
-    const issues = [];
-    if (!target.dependencies) {
-      return issues;
-    }
-    this.logger.debug("License scan complete", {
-      pluginId: target.pluginId,
-      issuesFound: issues.length
-    });
-    return issues;
-  }
-  /**
-   * Check configuration security
-   */
-  async scanConfiguration(target) {
-    const issues = [];
-    this.logger.debug("Configuration scan complete", {
-      pluginId: target.pluginId,
-      issuesFound: issues.length
-    });
-    return issues;
-  }
-  /**
-   * Calculate security score based on issues
-   */
-  calculateSecurityScore(issues) {
-    let score = 100;
-    for (const issue of issues) {
-      switch (issue.severity) {
-        case "critical":
-          score -= 20;
-          break;
-        case "high":
-          score -= 10;
-          break;
-        case "medium":
-          score -= 5;
-          break;
-        case "low":
-          score -= 2;
-          break;
-        case "info":
-          score -= 0;
-          break;
-      }
-    }
-    return Math.max(0, score);
-  }
-  /**
-   * Add a vulnerability to the database
-   */
-  addVulnerability(packageName, version, vulnerability) {
-    const key = `${packageName}@${version}`;
-    this.vulnerabilityDb.set(key, vulnerability);
-    this.logger.debug("Vulnerability added to database", {
-      package: packageName,
-      version,
-      cve: vulnerability.cve
-    });
-  }
-  /**
-   * Get scan result from cache
-   */
-  getScanResult(pluginId, version) {
-    return this.scanResults.get(`${pluginId}:${version}`);
-  }
-  /**
-   * Clear scan results cache
-   */
-  clearCache() {
-    this.scanResults.clear();
-    this.logger.debug("Scan results cache cleared");
-  }
-  /**
-   * Update vulnerability database from external source
-   */
-  async updateVulnerabilityDatabase() {
-    this.logger.info("Updating vulnerability database");
-    this.logger.info("Vulnerability database updated", {
-      entries: this.vulnerabilityDb.size
-    });
-  }
-  /**
-   * Shutdown security scanner
-   */
-  shutdown() {
-    this.vulnerabilityDb.clear();
-    this.scanResults.clear();
-    this.logger.info("Security scanner shutdown complete");
-  }
-};
-
 // src/security/api-key.ts
-import { createHash, randomBytes } from "crypto";
+import { createHash as createHash2, randomBytes } from "crypto";
 import { postureEnforcesWall, postureUsesUnionScope, normalizeTenancyPosture } from "@objectstack/spec/security";
 var API_KEY_PREFIX = "osk_";
 var API_KEY_ENTROPY_BYTES = 32;
 var VISIBLE_PREFIX_LEN = 12;
 function hashApiKey(raw) {
-  return createHash("sha256").update(raw, "utf8").digest("hex");
+  return createHash2("sha256").update(raw, "utf8").digest("hex");
 }
 function generateApiKey(prefix = API_KEY_PREFIX) {
   const secret = randomBytes(API_KEY_ENTROPY_BYTES).toString("base64url");
@@ -4281,19 +4178,22 @@ async function resolveApiKeyAdmission(ql, headers, nowMs = Date.now(), tenancyPo
   const userId = row.user_id ?? row.userId;
   if (!userId || typeof userId !== "string") return { outcome: "none" };
   const tenantId = typeof row.active_organization_id === "string" && row.active_organization_id ? row.active_organization_id : void 0;
+  const keyId = typeof row.id === "string" && row.id ? row.id : void 0;
   if (!tenantId && tenancyPosture) {
     const posture = tenancyPosture;
     if (postureEnforcesWall(posture) && !postureUsesUnionScope(posture)) {
       return {
         outcome: "refused",
         reason: "organization_required",
+        keyId,
+        userId,
         message: "This API key carries no organization and cannot be used under the `isolated` tenancy posture, where every organization-scoped read is walled to an active organization. Mint a replacement key \u2014 new keys inherit the minter\u2019s active organization."
       };
     }
   }
   return {
     outcome: "admitted",
-    principal: { userId, tenantId, scopes: parseScopes(row.scopes) }
+    principal: { userId, keyId, tenantId, scopes: parseScopes(row.scopes) }
   };
 }
 function readHeader(headers, name) {
@@ -4319,14 +4219,45 @@ function safeJsonParse(s, fallback) {
   }
 }
 
+// src/security/authz-store-unavailable.ts
+var AUTHZ_STORE_UNAVAILABLE_STATUS = 503;
+var AUTHZ_STORE_UNAVAILABLE_CODE = "SERVICE_UNAVAILABLE";
+var AUTHZ_STORE_UNAVAILABLE_MESSAGE = "The authorization store could not be read, so this request's permissions were never determined. This is a server-side outage, not a permission denial.";
+var AUTHZ_STORE_UNAVAILABLE_BRAND = "__objectstackAuthzStoreUnavailable";
+var _a, _b;
+var AuthzStoreUnavailableError = class extends (_b = Error, _a = AUTHZ_STORE_UNAVAILABLE_BRAND, _b) {
+  constructor(object, cause) {
+    super(`${AUTHZ_STORE_UNAVAILABLE_MESSAGE} (failed read: \`${object}\`)`);
+    /** Brand — see the module doc on why this is not `instanceof`. */
+    this[_a] = true;
+    /** ADR-0112 wire code. */
+    this.code = AUTHZ_STORE_UNAVAILABLE_CODE;
+    /** HTTP status a transport should answer. */
+    this.status = AUTHZ_STORE_UNAVAILABLE_STATUS;
+    this.name = "AuthzStoreUnavailableError";
+    this.object = object;
+    if (cause !== void 0) this.cause = cause;
+  }
+};
+function isAuthzStoreUnavailableError(err) {
+  return typeof err === "object" && err !== null && err[AUTHZ_STORE_UNAVAILABLE_BRAND] === true;
+}
+function rethrowAuthzStoreUnavailable(err) {
+  if (isAuthzStoreUnavailableError(err)) throw err;
+  return void 0;
+}
+
 // src/security/resolve-authz-context.ts
+import { isMissingTableError, resolveTenancyPosture } from "@objectstack/types";
 import {
   mapMembershipRole,
   BUILTIN_IDENTITY_PLATFORM_ADMIN,
   ADMIN_FULL_ACCESS,
+  ADMIN_FULL_ACCESS_CAPABILITIES,
   ORGANIZATION_ADMIN_GRANTS
 } from "@objectstack/spec";
 import { postureEnforcesWall as postureEnforcesWall2 } from "@objectstack/spec/security";
+import { isValueDomainMember } from "@objectstack/spec/shared";
 
 // src/security/grant-validity.ts
 function toEpochMs(value) {
@@ -4346,6 +4277,20 @@ function isGrantActive(row, nowMs) {
   if (until !== void 0 && !(nowMs < until)) return false;
   return true;
 }
+function nextGrantValidityBoundary(rows, nowMs) {
+  let next;
+  for (const row of rows) {
+    if (!row) continue;
+    const from = toEpochMs(row.valid_from ?? row.validFrom);
+    const until = toEpochMs(row.valid_until ?? row.validUntil);
+    for (const bound of [from, until]) {
+      if (bound !== void 0 && bound > nowMs && (next === void 0 || bound < next)) {
+        next = bound;
+      }
+    }
+  }
+  return next;
+}
 function isGrantExpired(row, nowMs) {
   if (!row) return false;
   const until = toEpochMs(row.valid_until ?? row.validUntil);
@@ -4353,6 +4298,227 @@ function isGrantExpired(row, nowMs) {
   return !(nowMs < until);
 }
 
+// src/security/authz-cache-posture.ts
+var AUTHZ_GRANTS_CACHE_TTL_ENV = "OS_AUTHZ_GRANTS_CACHE_TTL_MS";
+function resolveAuthzCachePosture(input) {
+  const { ttlMs, bus, driver } = input;
+  if (!(ttlMs > 0)) {
+    return { posture: "disabled", loud: false, message: "" };
+  }
+  if (bus === "bridged") {
+    return {
+      posture: "bus-narrowed",
+      loud: false,
+      message: `[authz-cache] grants cache ENABLED (ttl=${ttlMs}ms) with the "authz.invalidated" bridge attached` + (driver ? ` (cluster driver "${driver}")` : "") + ". The bus narrows the TYPICAL convergence to one network hop; the TTL remains the correctness bound, because no shipped driver delivers better than at-most-once (cluster.mdx \xA74.2)."
+    };
+  }
+  const why = bus === "in-process" ? `the cluster driver "${driver ?? "memory"}" is in-process and does not fan out across replicas` : "no cluster service is registered on this node";
+  return {
+    posture: "ttl-only",
+    loud: true,
+    message: `[authz-cache] grants cache ENABLED (ttl=${ttlMs}ms) with NO "authz.invalidated" invalidation bus \u2014 ${why}. A grant revoked on another replica is honoured by this one for up to ${ttlMs}ms. That is a supported configuration, not an error: the TTL is the correctness bound and it still holds. It is stated because a silently-absent invalidation bridge is how a security control gets disabled without anyone noticing (#4785). To narrow the typical window, configure a remote cluster driver; to remove it entirely, set ${AUTHZ_GRANTS_CACHE_TTL_ENV}=0.`
+  };
+}
+function readAuthzGrantsCacheTtlMs(env = typeof process !== "undefined" ? process.env : {}) {
+  const raw = env[AUTHZ_GRANTS_CACHE_TTL_ENV];
+  if (raw === void 0 || raw.trim() === "") {
+    return { ttlMs: 0, malformed: false };
+  }
+  const parsed = Number(raw.trim());
+  if (!Number.isFinite(parsed) || parsed < 0) {
+    return { ttlMs: 0, raw, malformed: true };
+  }
+  return { ttlMs: Math.floor(parsed), raw, malformed: false };
+}
+function reportAuthzCachePosture(input, sink2) {
+  if (input.malformedTtl) {
+    sink2.warn(
+      `[authz-cache] ${AUTHZ_GRANTS_CACHE_TTL_ENV}=${JSON.stringify(input.malformedTtl.raw ?? "")} is not a non-negative number; the grants cache is treated as DISABLED. Set a millisecond count, or 0 to disable it deliberately.`
+    );
+  }
+  const statement = resolveAuthzCachePosture(input);
+  if (statement.posture === "disabled") return statement;
+  if (statement.loud) sink2.warn(statement.message);
+  else sink2.info?.(statement.message);
+  return statement;
+}
+
+// src/security/resolve-user-grants-cache.ts
+var GRANTS_CACHE_WATCHED_OBJECTS = /* @__PURE__ */ new Set([
+  "sys_member",
+  "sys_user_position",
+  "sys_user_permission_set",
+  "sys_position",
+  "sys_position_permission_set",
+  "sys_permission_set",
+  "sys_user"
+]);
+var grantsCacheStates = /* @__PURE__ */ new WeakMap();
+var WRITE_OPERATIONS = /* @__PURE__ */ new Set(["insert", "update", "delete"]);
+function grantsCacheState(ql) {
+  const existing = grantsCacheStates.get(ql);
+  if (existing !== void 0) return existing ?? void 0;
+  const seamQl = ql;
+  const epoch = seamQl.writeEpoch;
+  const hasEpoch = !!epoch && typeof epoch === "object" && typeof epoch.current === "number" && typeof epoch.bump === "function" && typeof epoch.subscribe === "function";
+  if (!hasEpoch || typeof seamQl.registerMiddleware !== "function") {
+    return void 0;
+  }
+  const state = { gen: 0, entries: /* @__PURE__ */ new Map() };
+  try {
+    seamQl.registerMiddleware(async (ctx, next) => {
+      if (typeof ctx?.operation !== "string" || !WRITE_OPERATIONS.has(ctx.operation) || typeof ctx?.object !== "string" || !GRANTS_CACHE_WATCHED_OBJECTS.has(ctx.object)) {
+        return next();
+      }
+      try {
+        await next();
+      } finally {
+        state.gen += 1;
+      }
+    });
+    epoch.subscribe((_epoch, reason) => {
+      if (reason !== "write") state.gen += 1;
+    });
+  } catch {
+    grantsCacheStates.set(ql, null);
+    return void 0;
+  }
+  grantsCacheStates.set(ql, state);
+  return state;
+}
+function grantsCacheKey(userId, opts) {
+  return JSON.stringify([
+    userId,
+    opts.tenantId ?? null,
+    opts.seedEmail ?? null,
+    Array.isArray(opts.seedPermissions) ? opts.seedPermissions : []
+  ]);
+}
+var cloneGrants = (grants) => structuredClone(grants);
+function openUserGrantsCache(ql, userId, opts) {
+  if (opts.bypassGrantsCache) return void 0;
+  const { ttlMs } = readAuthzGrantsCacheTtlMs();
+  if (ttlMs <= 0) return void 0;
+  if (!ql || typeof ql !== "object" || typeof ql.find !== "function") {
+    return void 0;
+  }
+  const state = grantsCacheState(ql);
+  if (!state) return void 0;
+  const key = grantsCacheKey(userId, opts);
+  const now = opts.nowMs ?? Date.now();
+  const genAtOpen = state.gen;
+  const existing = state.entries.get(key);
+  if (existing) {
+    if (existing.gen === state.gen && existing.expiresAt > now) {
+      return { hit: cloneGrants(existing.value), commit: () => {
+      } };
+    }
+    state.entries.delete(key);
+  }
+  return {
+    commit(grants, nextBoundaryMs) {
+      const expiresAt = Math.min(now + ttlMs, nextBoundaryMs ?? Number.POSITIVE_INFINITY);
+      if (expiresAt <= now) return;
+      state.entries.set(key, { value: cloneGrants(grants), gen: genAtOpen, expiresAt });
+    }
+  };
+}
+
+// src/security/platform-admin.ts
+import { isEmailVerifiedUserRow, PLATFORM_OWNER_EMAIL_ENV, resolvePlatformOwnerEmail } from "@objectstack/types";
+var PLATFORM_ADMIN_EMAIL_SEPARATOR = ",";
+function normalizePlatformAdminEmail(value) {
+  return typeof value === "string" ? value.trim().toLowerCase() : "";
+}
+function isParseableAddress(entry) {
+  if (/\s/.test(entry)) return false;
+  const at = entry.indexOf("@");
+  if (at <= 0) return false;
+  if (entry.indexOf("@", at + 1) !== -1) return false;
+  return at < entry.length - 1;
+}
+var EMPTY_CONFIG = Object.freeze({
+  emails: Object.freeze([]),
+  declaredSpellings: Object.freeze([])
+});
+function parsePlatformAdminEmails(raw) {
+  if (raw == null) return EMPTY_CONFIG;
+  const text = String(raw);
+  if (text.trim() === "") return EMPTY_CONFIG;
+  const emails = [];
+  const declaredSpellings = [];
+  for (const piece of text.split(PLATFORM_ADMIN_EMAIL_SEPARATOR)) {
+    const entry = normalizePlatformAdminEmail(piece);
+    if (entry === "") continue;
+    if (!isParseableAddress(entry)) {
+      return {
+        emails: Object.freeze([]),
+        declaredSpellings: Object.freeze([]),
+        raw: text,
+        refusal: `${PLATFORM_OWNER_EMAIL_ENV} entry ${JSON.stringify(piece)} is not an email address, so the WHOLE variable is refused and this deployment has ZERO config-derived platform administrators. The entry is not skipped on purpose: silently dropping it would leave a narrower administrator set than the operator declared, with nothing to notice. Fix the entry, or remove it \u2014 ${PLATFORM_OWNER_EMAIL_ENV} takes one address or a comma-separated list of them.`
+      };
+    }
+    if (!emails.includes(entry)) {
+      emails.push(entry);
+      declaredSpellings.push(piece.trim());
+    }
+  }
+  return {
+    emails: Object.freeze(emails),
+    declaredSpellings: Object.freeze(declaredSpellings),
+    raw: text
+  };
+}
+var defaultSink = {
+  error: (m) => console.error(m),
+  warn: (m) => console.warn(m)
+};
+var sink = defaultSink;
+function setPlatformAdminConfigSink(next) {
+  const prev = sink;
+  sink = next ?? defaultSink;
+  return prev;
+}
+var NOT_MEMOIZED = /* @__PURE__ */ Symbol("platform-admin-config-not-memoized");
+var memoKey = NOT_MEMOIZED;
+var memoValue = EMPTY_CONFIG;
+function resolvePlatformAdminEmails() {
+  const raw = resolvePlatformOwnerEmail();
+  if (memoKey !== NOT_MEMOIZED && memoKey === raw) return memoValue;
+  const parsed = parsePlatformAdminEmails(raw);
+  memoKey = raw;
+  memoValue = parsed;
+  if (parsed.refusal) sink.error(`[authz] ${parsed.refusal}`);
+  return parsed;
+}
+function resetPlatformAdminEmailMemo() {
+  memoKey = NOT_MEMOIZED;
+  memoValue = EMPTY_CONFIG;
+}
+function matchesConfiguredPlatformAdmin(row, config) {
+  if (config.emails.length === 0) return false;
+  if (!row || typeof row !== "object") return false;
+  if (!isConfiguredPlatformAdminEmail(row.email, config)) return false;
+  return isEmailVerifiedUserRow(row);
+}
+function isConfiguredPlatformAdminEmail(email, config) {
+  if (config.emails.length === 0) return false;
+  const candidate = normalizePlatformAdminEmail(email);
+  return candidate !== "" && config.emails.includes(candidate);
+}
+var legacyGrantPointerSaid = false;
+function reportLegacyPlatformAdminGrant(input) {
+  if (legacyGrantPointerSaid) return;
+  legacyGrantPointerSaid = true;
+  const email = normalizePlatformAdminEmail(input.email);
+  sink.warn(
+    `[authz] user ${input.userId} holds PLATFORM_ADMIN through the legacy unscoped 'admin_full_access' grant row, not through ${PLATFORM_OWNER_EMAIL_ENV}. The grant row is the OLD anchor and is honoured for now; it is removed in a later release. Re-anchor this deployment by declaring its administrators in configuration: ${PLATFORM_OWNER_EMAIL_ENV}=${email || "<the administrator's verified email address>"} (comma-separated for several), and make sure each account's email is VERIFIED \u2014 an unverified account holding a configured address is not an administrator. Reported once per process; further holders are not listed.`
+  );
+}
+function resetLegacyPlatformAdminGrantReport() {
+  legacyGrantPointerSaid = false;
+}
+
 // src/security/posture-ladder.ts
 var POSTURE_LADDER = [
   "PLATFORM_ADMIN",
@@ -4426,6 +4592,18 @@ function safeJsonParse2(s, fallback) {
     return fallback;
   }
 }
+function warnApiKeyRefusal(details) {
+  const { reason, keyId, userId, organizationId } = details;
+  console.warn(
+    `[security] API key refused (${reason}): key=${keyId ?? "<unknown>"} principal=${userId ?? "<unknown>"} organization=${organizationId ?? "<none>"}. The caller received the generic 401 UNAUTHENTICATED \u2014 this reason is server-side only.`
+  );
+}
+function warnSessionOrganizationClaimDropped(details) {
+  const { reason, sessionId, userId, organizationId } = details;
+  console.warn(
+    `[security] Session organization claim dropped (${reason}): session=${sessionId ?? "<unknown>"} principal=${userId ?? "<unknown>"} organization=${organizationId ?? "<none>"}. The session stays authenticated with NO active organization \u2014 the wire is unchanged.`
+  );
+}
 async function tryFind(ql, object, where, limit = 100, organizationId) {
   if (!ql || typeof ql.find !== "function") return [];
   try {
@@ -4433,8 +4611,9 @@ async function tryFind(ql, object, where, limit = 100, organizationId) {
     let rows = await ql.find(object, { where, limit, context });
     if (rows && rows.value) rows = rows.value;
     return Array.isArray(rows) ? rows : [];
-  } catch {
-    return [];
+  } catch (err) {
+    if (isMissingTableError(err, object)) return [];
+    throw new AuthzStoreUnavailableError(object, err);
   }
 }
 async function resolveAuthzContext(input) {
@@ -4448,9 +4627,15 @@ async function resolveAuthzContext(input) {
   };
   let userId;
   let tenantId;
+  let sessionId;
   const admission = await resolveApiKeyAdmission(ql, headers, input.nowMs, input.tenancyPosture);
   if (admission.outcome === "refused") {
-    ctx.authRefusal = { reason: admission.reason, message: admission.message };
+    warnApiKeyRefusal({
+      reason: admission.reason,
+      keyId: admission.keyId,
+      userId: admission.userId,
+      organizationId: admission.organizationId
+    });
     return ctx;
   }
   const keyPrincipal = admission.outcome === "admitted" ? admission.principal : void 0;
@@ -4466,6 +4651,8 @@ async function resolveAuthzContext(input) {
       const sessionData = await input.getSession(headers);
       userId = sessionData?.user?.id ?? sessionData?.session?.userId;
       tenantId = tenantId ?? sessionData?.session?.activeOrganizationId;
+      const rawSessionId = sessionData?.session?.id;
+      sessionId = typeof rawSessionId === "string" && rawSessionId ? rawSessionId : void 0;
       ctx.accessToken = sessionData?.session?.token ?? ctx.accessToken;
       if (sessionData?.user?.email) ctx.email = String(sessionData.user.email);
     } catch {
@@ -4475,7 +4662,7 @@ async function resolveAuthzContext(input) {
   ctx.userId = userId;
   if (tenantId) ctx.tenantId = tenantId;
   if (!ql || typeof ql.find !== "function") return ctx;
-  const grants = await resolveUserAuthzGrants(ql, userId, {
+  let grants = await resolveUserAuthzGrants(ql, userId, {
     tenantId,
     nowMs: input.nowMs,
     seedPermissions: ctx.permissions,
@@ -4484,19 +4671,37 @@ async function resolveAuthzContext(input) {
   if (keyPrincipal?.tenantId && input.tenancyPosture) {
     const posture = input.tenancyPosture;
     if (postureEnforcesWall2(posture) && !grants.accessible_org_ids.includes(keyPrincipal.tenantId)) {
+      warnApiKeyRefusal({
+        reason: "organization_membership_ended",
+        keyId: keyPrincipal.keyId,
+        userId: keyPrincipal.userId,
+        organizationId: keyPrincipal.tenantId
+      });
       return {
         positions: [],
         permissions: [],
         systemPermissions: [],
         org_user_ids: [],
-        accessible_org_ids: [],
-        authRefusal: {
-          reason: "organization_membership_ended",
-          message: "This API key authenticates into an organization its owner is no longer a member of. The key was not revoked \u2014 the membership that backed it ended."
-        }
+        accessible_org_ids: []
       };
     }
   }
+  if (!keyPrincipal && tenantId && input.tenancyPosture && postureEnforcesWall2(input.tenancyPosture) && !grants.accessible_org_ids.includes(tenantId)) {
+    warnSessionOrganizationClaimDropped({
+      reason: "organization_membership_ended",
+      sessionId,
+      userId,
+      organizationId: tenantId
+    });
+    tenantId = void 0;
+    delete ctx.tenantId;
+    grants = await resolveUserAuthzGrants(ql, userId, {
+      tenantId,
+      nowMs: input.nowMs,
+      seedPermissions: ctx.permissions,
+      seedEmail: ctx.email
+    });
+  }
   ctx.positions = grants.positions;
   ctx.permissions = grants.permissions;
   ctx.systemPermissions = grants.systemPermissions;
@@ -4508,6 +4713,8 @@ async function resolveAuthzContext(input) {
   return ctx;
 }
 async function resolveUserAuthzGrants(ql, userId, opts = {}) {
+  const grantsCache = openUserGrantsCache(ql, userId, opts);
+  if (grantsCache?.hit) return grantsCache.hit;
   const { tenantId } = opts;
   const grants = {
     positions: [],
@@ -4528,7 +4735,8 @@ async function resolveUserAuthzGrants(ql, userId, opts = {}) {
     }
     return userRow;
   };
-  const needsUserRow = !grants.email || !grants.permissions.includes("ai_seat");
+  const platformAdminConfig = resolvePlatformAdminEmails();
+  const needsUserRow = !grants.email || !grants.permissions.includes("ai_seat") || platformAdminConfig.emails.length > 0;
   const [, members, userPositionRows, orgMembersLeg, upsRowsAll] = await Promise.all([
     needsUserRow ? getUserRow() : Promise.resolve(void 0),
     tryFind(ql, "sys_member", { user_id: userId }, 200),
@@ -4630,6 +4838,18 @@ async function resolveUserAuthzGrants(ql, userId, opts = {}) {
     }
     if (Object.keys(mergedTabs).length > 0) grants.tabPermissions = mergedTabs;
   }
+  const configConfersPlatformAdmin = platformAdminConfig.emails.length > 0 && matchesConfiguredPlatformAdmin(await getUserRow(), platformAdminConfig);
+  if (configConfersPlatformAdmin) {
+    hasPlatformAdminGrant = true;
+    if (!grants.permissions.includes(ADMIN_FULL_ACCESS)) grants.permissions.push(ADMIN_FULL_ACCESS);
+    for (const p of ADMIN_FULL_ACCESS_CAPABILITIES.systemPermissions ?? []) {
+      if (!grants.systemPermissions.includes(p)) grants.systemPermissions.push(p);
+    }
+  } else if (hasPlatformAdminGrant) {
+    if (postureEnforcesWall2(resolveTenancyPosture())) {
+      reportLegacyPlatformAdminGrant({ userId, email: userRow?.email });
+    }
+  }
   if (hasPlatformAdminGrant && !grants.positions.includes(BUILTIN_IDENTITY_PLATFORM_ADMIN)) {
     grants.positions.unshift(BUILTIN_IDENTITY_PLATFORM_ADMIN);
   }
@@ -4643,19 +4863,24 @@ async function resolveUserAuthzGrants(ql, userId, opts = {}) {
     const aiAccess = (await getUserRow())?.ai_access;
     if (aiAccess === true || aiAccess === 1 || aiAccess === "1") grants.permissions.push("ai_seat");
   }
+  grantsCache?.commit(
+    grants,
+    nextGrantValidityBoundary([...members, ...userPositionRows, ...upsRowsAll], nowMs)
+  );
   return grants;
 }
-function isValidTimeZone(tz) {
+async function hasPlatformAdminStanding(ql, userId, opts = {}) {
+  if (!ql || typeof userId !== "string" || userId.length === 0) return false;
   try {
-    new Intl.DateTimeFormat("en-US", { timeZone: tz });
-    return true;
+    const grants = await resolveUserAuthzGrants(ql, userId, { nowMs: opts.nowMs });
+    return grants.posture === "PLATFORM_ADMIN";
   } catch {
     return false;
   }
 }
 function coerceTimeZone(value) {
   const s = typeof value === "string" ? value.trim() : value != null ? String(value).trim() : "";
-  return s && isValidTimeZone(s) ? s : void 0;
+  return s && isValueDomainMember("iana_time_zone", s) ? s : void 0;
 }
 function coerceLocale(value) {
   const s = typeof value === "string" ? value.trim() : value != null ? String(value).trim() : "";
@@ -4666,25 +4891,98 @@ function coerceCurrency(value) {
   return /^[A-Z]{3}$/.test(s) ? s : void 0;
 }
 var LOCALIZATION_FAILURE_CACHE_TTL_MS = 3e4;
-var localizationFailureCache = /* @__PURE__ */ new WeakMap();
+var LOCALIZATION_CACHE_TTL_ENV = "OS_LOCALIZATION_CACHE_TTL_MS";
+var LOCALIZATION_SUCCESS_CACHE_DEFAULT_TTL_MS = 3e4;
+function localizationSuccessCacheTtlMs(env = typeof process !== "undefined" ? process.env : {}) {
+  const raw = env[LOCALIZATION_CACHE_TTL_ENV];
+  if (raw === void 0 || raw.trim() === "") return LOCALIZATION_SUCCESS_CACHE_DEFAULT_TTL_MS;
+  const parsed = Number(raw.trim());
+  if (!Number.isFinite(parsed) || parsed < 0) return 0;
+  return Math.floor(parsed);
+}
+function readWriteEpoch(ql) {
+  if (!ql || typeof ql !== "object") return void 0;
+  const epoch = ql.writeEpoch;
+  if (!epoch || typeof epoch !== "object") return void 0;
+  const seam = epoch;
+  if (typeof seam.current !== "number" || typeof seam.bump !== "function" || typeof seam.subscribe !== "function") {
+    return void 0;
+  }
+  return seam.current;
+}
+var localizationSettingsStates = /* @__PURE__ */ new WeakMap();
+var localizationNoSettingsState = { gen: 0 };
+function localizationSettingsState(settings) {
+  if (!settings || typeof settings !== "object") return localizationNoSettingsState;
+  const existing = localizationSettingsStates.get(settings);
+  if (existing) return existing;
+  const state = { gen: 0 };
+  localizationSettingsStates.set(settings, state);
+  const subscribe = settings.subscribe;
+  if (typeof subscribe === "function") {
+    try {
+      subscribe.call(
+        settings,
+        "localization",
+        () => {
+          state.gen += 1;
+        }
+      );
+    } catch {
+    }
+  }
+  return state;
+}
+var localizationCache = /* @__PURE__ */ new WeakMap();
+function localizationEntryIsLive(entry, epoch, settings) {
+  if (entry.kind === "failure") return true;
+  return entry.epoch === epoch && entry.settings === settings && entry.settingsGen === settings.gen;
+}
+function putLocalizationEntry(ql, key, entry) {
+  const bucket = localizationCache.get(ql) ?? /* @__PURE__ */ new Map();
+  bucket.set(key, entry);
+  localizationCache.set(ql, bucket);
+}
 async function resolveLocalizationContext(input) {
-  const { ql, tenantId, userId } = input;
+  const { ql, settings, tenantId, userId } = input;
   const cacheKey = `${tenantId ?? ""}|${userId ?? ""}`;
-  if (ql && typeof ql === "object") {
-    const hit = localizationFailureCache.get(ql)?.get(cacheKey);
-    if (hit && hit.expiresAt > Date.now()) return hit.value;
-  }
-  const { value, failed } = await resolveLocalizationContextUncached(input);
-  if (failed && ql && typeof ql === "object") {
-    const bucket = localizationFailureCache.get(ql) ?? /* @__PURE__ */ new Map();
-    bucket.set(cacheKey, { value, expiresAt: Date.now() + LOCALIZATION_FAILURE_CACHE_TTL_MS });
-    localizationFailureCache.set(ql, bucket);
+  const cacheable = Boolean(ql) && typeof ql === "object";
+  const epoch = cacheable ? readWriteEpoch(ql) : void 0;
+  const settingsState = localizationSettingsState(settings);
+  if (cacheable) {
+    const hit = localizationCache.get(ql)?.get(cacheKey);
+    if (hit && hit.expiresAt > Date.now() && localizationEntryIsLive(hit, epoch, settingsState)) {
+      return hit.value;
+    }
+  }
+  const { value, backendFailed } = await resolveLocalizationContextUncached(input);
+  if (!cacheable) return value;
+  if (backendFailed) {
+    putLocalizationEntry(ql, cacheKey, {
+      value,
+      expiresAt: Date.now() + LOCALIZATION_FAILURE_CACHE_TTL_MS,
+      kind: "failure"
+    });
+    return value;
+  }
+  const ttlMs = localizationSuccessCacheTtlMs();
+  if (epoch !== void 0 && ttlMs > 0) {
+    putLocalizationEntry(ql, cacheKey, {
+      value,
+      expiresAt: Date.now() + ttlMs,
+      kind: "success",
+      epoch,
+      settings: settingsState,
+      settingsGen: settingsState.gen
+    });
+  } else {
+    localizationCache.get(ql)?.delete(cacheKey);
   }
   return value;
 }
 async function resolveLocalizationContextUncached(input) {
   const { ql, settings, tenantId, userId } = input;
-  let failed = false;
+  let backendFailed = false;
   try {
     if (settings && typeof settings.get === "function") {
       const sctx = { tenantId, userId };
@@ -4698,33 +4996,22 @@ async function resolveLocalizationContextUncached(input) {
           localeRes = many.locale;
           currencyRes = many.currency;
         } catch {
-          failed = true;
         }
       } else {
         [tzRes, localeRes, currencyRes] = await Promise.all([
-          settings.get("localization", "timezone", sctx).catch(() => {
-            failed = true;
-            return void 0;
-          }),
-          settings.get("localization", "locale", sctx).catch(() => {
-            failed = true;
-            return void 0;
-          }),
-          settings.get("localization", "currency", sctx).catch(() => {
-            failed = true;
-            return void 0;
-          })
+          settings.get("localization", "timezone", sctx).catch(() => void 0),
+          settings.get("localization", "locale", sctx).catch(() => void 0),
+          settings.get("localization", "currency", sctx).catch(() => void 0)
         ]);
       }
       const tz = coerceTimeZone(tzRes?.value);
       const locale = coerceLocale(localeRes?.value);
       const currency = coerceCurrency(currencyRes?.value);
       if (tz || locale || currency) {
-        return { value: { timezone: tz ?? "UTC", locale: locale ?? "en-US", currency }, failed: false };
+        return { value: { timezone: tz ?? "UTC", locale: locale ?? "en-US", currency }, backendFailed: false };
       }
     }
   } catch {
-    failed = true;
   }
   let rows = [];
   if (ql && typeof ql.find === "function") {
@@ -4737,7 +5024,7 @@ async function resolveLocalizationContextUncached(input) {
       if (result && result.value) result = result.value;
       rows = Array.isArray(result) ? result : [];
     } catch {
-      failed = true;
+      backendFailed = true;
     }
   }
   const valueOf = (k) => rows.find((r) => r.key === k)?.value;
@@ -4747,7 +5034,7 @@ async function resolveLocalizationContextUncached(input) {
       locale: coerceLocale(valueOf("locale")) ?? "en-US",
       currency: coerceCurrency(valueOf("currency"))
     },
-    failed
+    backendFailed
   };
 }
 
@@ -4909,7 +5196,7 @@ function shouldDenyAnonymous(input) {
 var ADMIN_STANDING_SURFACE = {
   sys_permission_set: {
     role: "derives",
-    reason: "The row `platform_admin` is resolved BY NAME from (\xA76b). Renaming it, deleting it or switching it off (ADR-0049 `active`, read here since #8613) un-makes every platform admin at once, with no identity table touched.",
+    reason: "The row `admin_full_access` is resolved BY NAME from (\xA76b) \u2014 `platform_admin` is the POSITION that row derives, not the row's own name. Renaming it, deleting it or switching it off (ADR-0049 `active`, read here since #8613) un-makes every GRANT-derived platform admin at once, with no identity table touched. \u26A0\uFE0F It does NOT un-make a CONFIG-derived one (\xA76b-config, #11970): that route sets the same standing from `ADMIN_FULL_ACCESS_CAPABILITIES` in `@objectstack/spec` and matches the caller's own stored `sys_user` row, so it touches an identity table and never reads this one. With `OS_PLATFORM_OWNER_EMAIL` unset the first sentence is the whole truth; with it declared, this row stops being the single point that un-makes every administrator.",
     columns: [
       "id",
       "name",
@@ -4951,8 +5238,14 @@ var ADMIN_STANDING_SURFACE = {
     ]
   },
   sys_user: {
-    role: "reads-only",
-    reason: "Read for the `current_user.email` RLS fallback and the ADR-0024 `ai_seat` synthesis (\xA77). Neither confers administrator standing. The guard does watch this table, but for the ban/delete WRITE SHAPES \u2014 `banned` is never read here, so it is not a derivation column and carries no standing-key list."
+    role: "derives",
+    reason: "[#11663 L2] RECLASSIFIED from `reads-only`. This table used to be read only for the `current_user.email` RLS fallback and the ADR-0024 `ai_seat` synthesis (\xA77), and the note here said so: \"Neither confers administrator standing.\" That sentence is now FALSE. The config anchor (\xA76b-config) matches the row's own `email` against the deployment's declared administrator list and requires `email_verified` to read verified, so a write that changes either column takes platform-admin standing away from a config-derived administrator \u2014 an address change and an email_verified reset are both ordinary, reachable writes, and neither touches a grant table. `banned` stays absent from the column list because the resolver still never reads it; the guard watches the ban/delete WRITE SHAPES on this table for its own reasons, which is a different question from what this resolver consumes.",
+    columns: [
+      "id",
+      "email",
+      "email_verified",
+      "ai_access"
+    ]
   },
   sys_user_position: {
     role: "reads-only",
@@ -4967,6 +5260,13 @@ var ADMIN_STANDING_SURFACE = {
     reason: "Position-bound permission sets (\xA76a). Contributes ids to `psIds` \u2014 and therefore names to `permissions` \u2014 but not to `unscopedUserPsIds`, which is the set \xA76b tests for platform-admin standing."
   }
 };
+var ADMIN_STANDING_NON_TABLE_INPUTS = [
+  {
+    kind: "env",
+    name: "OS_PLATFORM_OWNER_EMAIL",
+    reason: "The deployment's declared platform administrator(s) \u2014 one address or a comma-separated list, matched case-insensitively against `sys_user.email` and conferring standing only when that row's `email_verified` reads verified (\xA76b-config). Read live on every derivation with a per-process memo keyed on the raw string, so a rolled process picks up a change with no special path. Unset, blank, or carrying any unparseable entry means ZERO config-derived administrators, fail closed. No runtime write reaches it, so no break-glass guard can simulate a change to it: revocation is a configuration change plus a process roll, by design."
+  }
+];
 function adminStandingTables() {
   return Object.entries(ADMIN_STANDING_SURFACE).filter(([, t]) => t.role === "derives").map(([name]) => name).sort();
 }
@@ -4998,6 +5298,9 @@ function withoutOperationPrivateKeys(exec) {
   return out;
 }
 
+// src/security/authz-invalidation-channel.ts
+var AUTHZ_INVALIDATED_CHANNEL = "authz.invalidated";
+
 // src/utils/datetime.ts
 import { nextUtcCalendarDay, utcInstantMs } from "@objectstack/spec/data";
 function calendarPartsInTz(d, tz) {
@@ -5278,7 +5581,7 @@ function omitInternalFieldsFromWriteResponse(schema, records) {
 }
 
 // src/utils/migration-journal.ts
-import { createHash as createHash2, randomUUID } from "crypto";
+import { createHash as createHash3, randomUUID } from "crypto";
 import {
   MIGRATION_JOURNAL_OBJECT
 } from "@objectstack/spec/system";
@@ -5335,7 +5638,7 @@ function hashMigrationPlan(plan, chunks) {
     steps: plan.steps.map((s) => s.name),
     chunks: chunks.map((c) => [c.stepIndex, c.offset, c.length])
   });
-  return createHash2("sha256").update(shape, "utf8").digest("hex").slice(0, 32);
+  return createHash3("sha256").update(shape, "utf8").digest("hex").slice(0, 32);
 }
 async function appendEvent(engine, event, execContext) {
   await engine.insert(
@@ -5666,6 +5969,52 @@ function errText(err) {
   }
 }
 
+// src/utils/advisory-aggregation.ts
+import { AsyncLocalStorage } from "async_hooks";
+var ADVISORY_SAMPLE_ROWS = 5;
+var storage = new AsyncLocalStorage();
+function keyOf(object, rule) {
+  return JSON.stringify([object, rule]);
+}
+function recordAdvisoryHit(hit) {
+  const collector = storage.getStore();
+  if (!collector) return false;
+  const key = keyOf(hit.object, hit.rule);
+  const existing = collector.groups.get(key);
+  if (existing) {
+    existing.rows += 1;
+    if (hit.recordRef != null && existing.sampleRows.length < ADVISORY_SAMPLE_ROWS) {
+      existing.sampleRows.push(hit.recordRef);
+    }
+    return true;
+  }
+  collector.groups.set(key, {
+    object: hit.object,
+    rule: hit.rule,
+    severity: hit.severity,
+    message: hit.message,
+    rows: 1,
+    sampleRows: hit.recordRef != null ? [hit.recordRef] : []
+  });
+  return true;
+}
+function isAggregatingAdvisories() {
+  return storage.getStore() !== void 0;
+}
+async function runWithAdvisoryAggregation(fn, report) {
+  const collector = { groups: /* @__PURE__ */ new Map() };
+  try {
+    return await storage.run(collector, fn);
+  } finally {
+    if (collector.groups.size > 0) {
+      try {
+        report([...collector.groups.values()]);
+      } catch {
+      }
+    }
+  }
+}
+
 // src/utils/filter-tokens.ts
 import {
   classifyFilterToken,
@@ -5903,6 +6252,110 @@ function isUninterpretableTemporalComparand(kind, value) {
   return !(readsAsWallClock(s) || readsAsInstant(s));
 }
 
+// src/utils/metadata-activation-store.ts
+var METADATA_ACTIVATION_TABLE = "sys_metadata_activation";
+var SYSTEM_CTX2 = { isSystem: true, positions: [], permissions: [] };
+var InMemoryMetadataActivationStore = class {
+  constructor() {
+    this.rows = /* @__PURE__ */ new Map();
+  }
+  async list() {
+    return [...this.rows.values()];
+  }
+  async setActive(row) {
+    this.rows.set(row.name, { ...row });
+  }
+};
+var ObjectStoreMetadataActivationStore = class {
+  constructor(engine, metadataType) {
+    this.engine = engine;
+    this.metadataType = metadataType;
+  }
+  /**
+   * Every row of this type. Read once at boot to hydrate the consumer's
+   * projection.
+   *
+   * The only scoping is the `metadata_type` discriminator: the ledger is
+   * deployment-wide and has no tenant column, so there is no second axis to
+   * filter on (see the module header).
+   */
+  async list() {
+    const rows = await this.engine.find(METADATA_ACTIVATION_TABLE, {
+      where: { metadata_type: this.metadataType },
+      context: SYSTEM_CTX2
+    });
+    if (!Array.isArray(rows)) return [];
+    const out = [];
+    for (const row of rows) {
+      const r = row;
+      if (typeof r.name !== "string" || !r.name) continue;
+      out.push({
+        name: r.name,
+        packageId: typeof r.package_id === "string" ? r.package_id : "",
+        // The column defaults to `true`; only an explicit `false`
+        // disarms. A driver that round-trips booleans as 0/1
+        // (SQLite/libsql) is read through the same `=== false || === 0`
+        // test, so a `0` is not mistaken for `true`.
+        active: !(r.active === false || r.active === 0)
+      });
+    }
+    return out;
+  }
+  /**
+   * Insert or update the row for one packaged artifact.
+   *
+   * Read-then-write rather than a blind upsert because the object's
+   * uniqueness is a DECLARED index (`unique: 'global'` over
+   * `(metadata_type, name)`), not a primary key this store controls: there is
+   * no id to collide on, so an insert-and-catch could not tell "already
+   * there" from a real store failure.
+   *
+   * That index is also why taking the FIRST match is taking the only one: the
+   * read below is keyed on exactly the index's two columns, so it can match
+   * at most one row. It used to pick the first row with a NULL organization
+   * out of the result, back when the table carried a reserved tenant column;
+   * with no such column the set it was choosing from can no longer hold more
+   * than one member.
+   */
+  async setActive(row) {
+    const existing = await this.engine.find(METADATA_ACTIVATION_TABLE, {
+      where: { metadata_type: this.metadataType, name: row.name },
+      context: SYSTEM_CTX2
+    });
+    const current = Array.isArray(existing) ? existing[0] : void 0;
+    if (current && current.id != null) {
+      await this.engine.update(
+        METADATA_ACTIVATION_TABLE,
+        { id: current.id, active: row.active, package_id: row.packageId },
+        { context: SYSTEM_CTX2 }
+      );
+      return;
+    }
+    await this.engine.insert(
+      METADATA_ACTIVATION_TABLE,
+      {
+        metadata_type: this.metadataType,
+        name: row.name,
+        package_id: row.packageId,
+        active: row.active
+      },
+      { context: SYSTEM_CTX2 }
+    );
+  }
+  /**
+   * Read the backing table once so a misconfiguration surfaces at BOOT
+   * rather than as a failed toggle later. Throws the driver error verbatim —
+   * `no such table: sys_metadata_activation` means the object was never
+   * registered (or its schema never synced) in this composition.
+   *
+   * ⚠️ Unscoped by design: the question is "does the TABLE read at all",
+   * which is a property of the composition, not of one `metadata_type`.
+   */
+  async probe() {
+    await this.engine.find(METADATA_ACTIVATION_TABLE, { where: {}, limit: 1, context: SYSTEM_CTX2 });
+  }
+};
+
 // src/utils/record-not-found.ts
 function recordNotFoundError(object, id) {
   const err = new Error(`Record ${id} not found in ${object}`);
@@ -5913,6 +6366,45 @@ function recordNotFoundError(object, id) {
 }
 
 // src/health-monitor.ts
+var RECOVERY_IS_THRESHOLD_GATED = {
+  degraded: true,
+  unhealthy: true,
+  failed: true,
+  recovering: true,
+  healthy: false,
+  unknown: false
+};
+function healthMonitorRefusal(message) {
+  const err = new Error(message);
+  err.code = "VALIDATION_ERROR";
+  err.status = 400;
+  return err;
+}
+var RETIRED_HEALTH_CHECK_KEYS = [
+  [
+    "autoRestart",
+    "'autoRestart' was removed from PluginHealthCheck in @objectstack/spec 18 (#12032, ADR-0049 enforce-or-remove) \u2014 it never restarted a plugin. `attemptRestart` called `plugin.destroy()` and stopped there, then logged 'Plugin restarted' and set status `recovering`, and the periodic checks carried on against the destroyed instance \u2014 which the default check (`{ name: 'plugin-loaded', status: 'passed' }`) passes forever, so a destroyed, never-re-initialised plugin ended up reported `healthy`. Delete the key. This monitor no longer destroys anything: a failing plugin is reported `unhealthy` or `failed` and left alone."
+  ],
+  [
+    "maxRestartAttempts",
+    "'maxRestartAttempts' was removed from PluginHealthCheck in @objectstack/spec 18 (#12032, ADR-0049 enforce-or-remove) \u2014 it capped a restart that never happened, so it only counted `destroy()` calls. Delete the key."
+  ],
+  [
+    "restartBackoff",
+    "'restartBackoff' was removed from PluginHealthCheck in @objectstack/spec 18 (#12032, ADR-0049 enforce-or-remove) \u2014 it delayed a restart that never happened, so it only moved when the `destroy()` landed. Delete the key."
+  ]
+];
+var RESTART_IS_THE_HOSTS_JOB = " Restarting a plugin is the HOST's job in this host-driven library: poll `getHealthStatus(pluginName)` / `getHealthReport(pluginName)` and act on `unhealthy` / `failed` at the level that owns the plugin's lifetime \u2014 recreate the kernel, or let your supervisor restart the process.";
+function assertNoRetiredKeys(pluginName, config) {
+  for (const [key, guidance] of RETIRED_HEALTH_CHECK_KEYS) {
+    if (!Object.prototype.hasOwnProperty.call(config, key)) {
+      continue;
+    }
+    throw healthMonitorRefusal(
+      `[HealthMonitor] Plugin '${pluginName}': ${guidance}${RESTART_IS_THE_HOSTS_JOB}`
+    );
+  }
+}
 var PluginHealthMonitor = class {
   constructor(logger) {
     this.healthChecks = /* @__PURE__ */ new Map();
@@ -5921,18 +6413,17 @@ var PluginHealthMonitor = class {
     this.checkIntervals = /* @__PURE__ */ new Map();
     this.failureCounters = /* @__PURE__ */ new Map();
     this.successCounters = /* @__PURE__ */ new Map();
-    this.restartAttempts = /* @__PURE__ */ new Map();
     this.logger = logger.child({ component: "HealthMonitor" });
   }
   /**
    * Register a plugin for health monitoring
    */
   registerPlugin(pluginName, config) {
+    assertNoRetiredKeys(pluginName, config);
     this.healthChecks.set(pluginName, config);
     this.healthStatus.set(pluginName, "unknown");
     this.failureCounters.set(pluginName, 0);
     this.successCounters.set(pluginName, 0);
-    this.restartAttempts.set(pluginName, 0);
     this.logger.info("Plugin registered for health monitoring", {
       plugin: pluginName,
       interval: config.interval
@@ -5984,6 +6475,7 @@ var PluginHealthMonitor = class {
     let status = "healthy";
     let message;
     const checks = [];
+    let failureRoute;
     try {
       if (config.checkMethod && typeof plugin[config.checkMethod] === "function") {
         const checkResult = await this.raceCheckTimeout(
@@ -6004,8 +6496,8 @@ var PluginHealthMonitor = class {
       if (status === "healthy") {
         this.successCounters.set(pluginName, (this.successCounters.get(pluginName) || 0) + 1);
         this.failureCounters.set(pluginName, 0);
-        const currentStatus = this.healthStatus.get(pluginName);
-        if (currentStatus === "unhealthy" || currentStatus === "degraded") {
+        const currentStatus = this.healthStatus.get(pluginName) ?? "unknown";
+        if (RECOVERY_IS_THRESHOLD_GATED[currentStatus]) {
           const successCount = this.successCounters.get(pluginName) || 0;
           if (successCount >= config.successThreshold) {
             this.healthStatus.set(pluginName, "healthy");
@@ -6017,27 +6509,11 @@ var PluginHealthMonitor = class {
           this.healthStatus.set(pluginName, "healthy");
         }
       } else {
-        this.failureCounters.set(pluginName, (this.failureCounters.get(pluginName) || 0) + 1);
-        this.successCounters.set(pluginName, 0);
-        const failureCount = this.failureCounters.get(pluginName) || 0;
-        if (failureCount >= config.failureThreshold) {
-          this.healthStatus.set(pluginName, "unhealthy");
-          this.logger.warn("Plugin marked as unhealthy", {
-            plugin: pluginName,
-            failures: failureCount
-          });
-          if (config.autoRestart) {
-            await this.attemptRestart(pluginName, plugin, config);
-          }
-        } else {
-          this.healthStatus.set(pluginName, "degraded");
-        }
+        failureRoute = "returned";
       }
     } catch (error) {
       status = "failed";
       message = error instanceof Error ? error.message : "Unknown error";
-      this.failureCounters.set(pluginName, (this.failureCounters.get(pluginName) || 0) + 1);
-      this.healthStatus.set(pluginName, "failed");
       checks.push({
         name: "health-check",
         status: "failed",
@@ -6047,69 +6523,59 @@ var PluginHealthMonitor = class {
         plugin: pluginName,
         error
       });
+      failureRoute = "thrown";
+    }
+    if (failureRoute) {
+      this.recordFailedRound(pluginName, config, failureRoute);
     }
     const report = {
       status: this.healthStatus.get(pluginName) || "unknown",
       timestamp: (/* @__PURE__ */ new Date()).toISOString(),
       message,
       metrics: {
-        uptime: Date.now() - startTime
+        uptimeMs: Date.now() - startTime
       },
       checks: checks.length > 0 ? checks : void 0
     };
     this.healthReports.set(pluginName, report);
   }
   /**
-   * Attempt to restart a plugin
+   * Handle one failed round — the single path BOTH failure routes take.
+   *
+   * `performHealthCheck` can fail two disjoint ways: the check *returns* a
+   * failure (`false` or `{ status: 'unhealthy' }`), or it *throws* — which by
+   * `raceCheckTimeout` includes every `timeout` overrun, the severest case of
+   * the two. The routes used to be handled in separate blocks, and only the
+   * returned one cleared `successCounters`, so the counters a declared
+   * `failureThreshold` / `successThreshold` are counted with depended on which
+   * way the round happened to fail (#11852).
+   *
+   * What stays route-specific is the *status label*, deliberately. A throw is
+   * the separate `failed` status applied immediately with no threshold — that
+   * is the documented contract (`content/docs/protocol/kernel/lifecycle.mdx`,
+   * "Custom Health Checks") and is pinned by the timeout test. Only the
+   * counters are shared, because that is what `failureThreshold` declares, and
+   * it does not name a route.
+   *
+   * This round ENDS here. Nothing is done TO the plugin — see the #12032 note
+   * on the class: a monitor that cannot re-initialise a plugin has no business
+   * destroying one.
    */
-  async attemptRestart(pluginName, plugin, config) {
-    const attempts = this.restartAttempts.get(pluginName) || 0;
-    if (attempts >= config.maxRestartAttempts) {
-      this.logger.error("Max restart attempts reached, giving up", {
-        plugin: pluginName,
-        attempts
-      });
+  recordFailedRound(pluginName, config, route) {
+    const failureCount = (this.failureCounters.get(pluginName) || 0) + 1;
+    this.failureCounters.set(pluginName, failureCount);
+    this.successCounters.set(pluginName, 0);
+    const thresholdReached = failureCount >= config.failureThreshold;
+    if (route === "thrown") {
       this.healthStatus.set(pluginName, "failed");
-      return;
-    }
-    this.restartAttempts.set(pluginName, attempts + 1);
-    const delay = this.calculateBackoff(attempts, config.restartBackoff);
-    this.logger.info("Scheduling plugin restart", {
-      plugin: pluginName,
-      attempt: attempts + 1,
-      delay
-    });
-    await new Promise((resolve) => setTimeout(resolve, delay));
-    try {
-      if (plugin.destroy) {
-        await plugin.destroy();
-      }
-      this.logger.info("Plugin restarted", { plugin: pluginName });
-      this.failureCounters.set(pluginName, 0);
-      this.successCounters.set(pluginName, 0);
-      this.healthStatus.set(pluginName, "recovering");
-    } catch (error) {
-      this.logger.error("Plugin restart failed", {
+    } else if (thresholdReached) {
+      this.healthStatus.set(pluginName, "unhealthy");
+      this.logger.warn("Plugin marked as unhealthy", {
         plugin: pluginName,
-        error
+        failures: failureCount
       });
-      this.healthStatus.set(pluginName, "failed");
-    }
-  }
-  /**
-   * Calculate backoff delay for restarts
-   */
-  calculateBackoff(attempt, strategy) {
-    const baseDelay = 1e3;
-    switch (strategy) {
-      case "fixed":
-        return baseDelay;
-      case "linear":
-        return baseDelay * (attempt + 1);
-      case "exponential":
-        return baseDelay * Math.pow(2, attempt);
-      default:
-        return baseDelay;
+    } else {
+      this.healthStatus.set(pluginName, "degraded");
     }
   }
   /**
@@ -6142,7 +6608,6 @@ var PluginHealthMonitor = class {
     this.healthReports.clear();
     this.failureCounters.clear();
     this.successCounters.clear();
-    this.restartAttempts.clear();
     this.logger.info("Health monitor shutdown complete");
   }
   /**
@@ -6183,7 +6648,7 @@ var PluginHealthMonitor = class {
 };
 
 // src/hot-reload.ts
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash4 } from "crypto";
 var generateUUID = () => {
   if (typeof crypto !== "undefined" && crypto.randomUUID) {
     return crypto.randomUUID();
@@ -6194,6 +6659,42 @@ var generateUUID = () => {
     return v.toString(16);
   });
 };
+var HONOURED_STATE_STRATEGIES = ["memory", "none"];
+var RETIRED_STATE_STRATEGY_GUIDANCE = "'disk' and 'distributed' were removed from HotReloadConfig.stateStrategy in @objectstack/spec 18 (ADR-0049 enforce-or-remove) \u2014 neither was ever implemented. Both wrote to the same in-memory Map as 'memory' and reported it only at debug level, so a host that asked for durable or cluster-replicated state got process-local memory and no error. Use 'memory' for in-process state preservation across a reload, or 'none' to disable it. There is no in-tree replacement for durable or distributed plugin state \u2014 persist it in the host, which owns the process lifetime these strategies pretended to outlive.";
+function hotReloadRefusal(message) {
+  const err = new Error(message);
+  err.code = "VALIDATION_ERROR";
+  err.status = 400;
+  return err;
+}
+function assertHonouredStateStrategy(pluginName, strategy) {
+  if (HONOURED_STATE_STRATEGIES.includes(strategy)) {
+    return;
+  }
+  const shown = typeof strategy === "string" ? `'${strategy}'` : String(strategy);
+  const retired = strategy === "disk" || strategy === "distributed";
+  throw hotReloadRefusal(
+    `[HotReload] Plugin '${pluginName}': unsupported stateStrategy ${shown}. Honoured values are ${HONOURED_STATE_STRATEGIES.map((v) => `'${v}'`).join(" and ")}. ` + (retired ? RETIRED_STATE_STRATEGY_GUIDANCE : "This value has never been implemented by PluginStateManager.")
+  );
+}
+var RETIRED_HOT_RELOAD_KEYS = [
+  [
+    "distributedConfig",
+    "'distributedConfig' was removed from HotReloadConfig in @objectstack/spec 18 (ADR-0049 enforce-or-remove) \u2014 nothing ever read it. A provider, endpoints, a key prefix, a TTL and a replication factor could all be declared and no connection was ever opened. It left with the stateStrategy: 'distributed' value it was documented as being required for. Delete the key; there is no in-tree replacement for distributed plugin state \u2014 persist it in the host."
+  ],
+  [
+    "watchPatterns",
+    "'watchPatterns' was removed from HotReloadConfig in @objectstack/spec 18 (ADR-0049 enforce-or-remove) \u2014 nothing ever read it. Its only two uses were log lines: no watcher was ever constructed from it, so an author could declare a glob and no file change ever triggered a reload. File watching is the HOST's job in this host-driven library. Delete the key, declare your globs wherever your own watcher reads them, and call `HotReloadManager.scheduleReload(pluginName, reloadFn)` when one matches \u2014 that is the debounced integration point this class does implement."
+  ]
+];
+function assertNoRetiredKeys2(pluginName, config) {
+  for (const [key, guidance] of RETIRED_HOT_RELOAD_KEYS) {
+    if (!Object.prototype.hasOwnProperty.call(config, key)) {
+      continue;
+    }
+    throw hotReloadRefusal(`[HotReload] Plugin '${pluginName}': ${guidance}`);
+  }
+}
 var PluginStateManager = class {
   constructor(logger) {
     this.stateSnapshots = /* @__PURE__ */ new Map();
@@ -6220,17 +6721,6 @@ var PluginStateManager = class {
         this.memoryStore.set(snapshotId, snapshot);
         this.logger.debug("State saved to memory", { pluginId, snapshotId });
         break;
-      case "disk":
-        this.memoryStore.set(snapshotId, snapshot);
-        this.logger.debug("State saved to disk (memory fallback)", { pluginId, snapshotId });
-        break;
-      case "distributed":
-        this.memoryStore.set(snapshotId, snapshot);
-        this.logger.debug("State saved to distributed store (memory fallback)", {
-          pluginId,
-          snapshotId
-        });
-        break;
       case "none":
         this.logger.debug("State persistence disabled", { pluginId });
         break;
@@ -6278,7 +6768,7 @@ var PluginStateManager = class {
    */
   calculateChecksum(state) {
     const stateStr = JSON.stringify(state);
-    return createHash3("sha256").update(stateStr).digest("hex");
+    return createHash4("sha256").update(stateStr).digest("hex");
   }
   /**
    * Shutdown state manager
@@ -6292,7 +6782,6 @@ var PluginStateManager = class {
 var HotReloadManager = class {
   constructor(logger) {
     this.reloadConfigs = /* @__PURE__ */ new Map();
-    this.watchHandles = /* @__PURE__ */ new Map();
     this.reloadTimers = /* @__PURE__ */ new Map();
     this.logger = logger.child({ component: "HotReload" });
     this.stateManager = new PluginStateManager(logger);
@@ -6301,6 +6790,8 @@ var HotReloadManager = class {
    * Register a plugin for hot reload
    */
   registerPlugin(pluginName, config) {
+    assertHonouredStateStrategy(pluginName, config.stateStrategy);
+    assertNoRetiredKeys2(pluginName, config);
     if (!config.enabled) {
       this.logger.debug("Hot reload disabled for plugin", { plugin: pluginName });
       return;
@@ -6308,32 +6799,45 @@ var HotReloadManager = class {
     this.reloadConfigs.set(pluginName, config);
     this.logger.info("Plugin registered for hot reload", {
       plugin: pluginName,
-      watchPatterns: config.watchPatterns,
       stateStrategy: config.stateStrategy
     });
   }
   /**
-   * Start watching for changes (requires file system integration)
+   * Refuse the file-watching call this class never implemented (#12428).
+   *
+   * The body used to be a guard plus `logger.info('File watching started')`
+   * over an in-source note saying real watching "would require chokidar or
+   * similar". Nothing was ever watched, so an operator who set
+   * `enabled: true` and read that line at INFO had been told the opposite of
+   * the truth — positive confirmation of a capability that did not exist.
+   * ADR-0049 leaves three states and this surface qualified for none of the
+   * other two: no runtime composes this class, so ENFORCE would build for a
+   * caller that does not exist, and no roadmap entry anywhere claims the
+   * feature, so EXPERIMENTAL would be a promise nobody made.
+   *
+   * Kept as a throwing door rather than deleted: removing the method leaves a
+   * JavaScript host a bare `TypeError: not a function` with no prescription,
+   * and this is the one place a caller of the old placeholder is guaranteed
+   * to arrive. The refusal carries an ADR-0112 envelope so it can be asserted
+   * rather than merely caught.
    */
   startWatching(pluginName) {
-    const config = this.reloadConfigs.get(pluginName);
-    if (!config || !config.enabled) {
-      return;
-    }
-    this.logger.info("File watching started", {
-      plugin: pluginName,
-      patterns: config.watchPatterns
-    });
+    throw hotReloadRefusal(
+      `[HotReload] Plugin '${pluginName}': startWatching() never watched anything and was removed in @objectstack/core 18 (ADR-0049 enforce-or-remove). It logged 'File watching started' at info level while no watcher was ever constructed, so no file change could ever trigger a reload. File watching is the HOST's job in this host-driven library: run your own watcher and call \`HotReloadManager.scheduleReload(pluginName, reloadFn)\` when a file changes \u2014 that is the debounced integration point this class does implement. \`HotReloadConfig.watchPatterns\` was removed in @objectstack/spec 18 for the same reason; declare your globs where your watcher reads them.`
+    );
   }
   /**
-   * Stop watching for changes
+   * Cancel a pending debounced reload for a plugin.
+   *
+   * The name is historical (#12428). This never stopped a watcher, because
+   * nothing in this class ever started one: its `watchHandles` cleanup branch
+   * read a Map that had no writer anywhere in the tree, so the branch was
+   * structurally unreachable rather than merely untaken, and it left with
+   * `startWatching`'s placeholder. What survives is the half that always did
+   * something — the debounce timer armed by `scheduleReload` is cleared, so a
+   * reload that was scheduled but has not fired yet is cancelled.
    */
   stopWatching(pluginName) {
-    const handle = this.watchHandles.get(pluginName);
-    if (handle) {
-      this.watchHandles.delete(pluginName);
-      this.logger.info("File watching stopped", { plugin: pluginName });
-    }
     const timer = this.reloadTimers.get(pluginName);
     if (timer) {
       clearTimeout(timer);
@@ -6476,14 +6980,10 @@ var HotReloadManager = class {
    * Shutdown hot reload manager
    */
   shutdown() {
-    for (const pluginName of this.watchHandles.keys()) {
-      this.stopWatching(pluginName);
-    }
     for (const timer of this.reloadTimers.values()) {
       clearTimeout(timer);
     }
     this.reloadConfigs.clear();
-    this.watchHandles.clear();
     this.reloadTimers.clear();
     this.stateManager.shutdown();
     this.logger.info("Hot reload manager shutdown complete");
@@ -6892,7 +7392,9 @@ var NamespaceResolver = class {
 // src/index.ts
 import { UNMATCHED_ROUTE_PATTERN } from "@objectstack/spec/contracts";
 export {
+  ADMIN_STANDING_NON_TABLE_INPUTS,
   ADMIN_STANDING_SURFACE,
+  ADVISORY_SAMPLE_ROWS,
   ANONYMOUS_DENY_BODY,
   ANONYMOUS_DENY_CODE,
   ANONYMOUS_DENY_MESSAGE,
@@ -6900,11 +7402,19 @@ export {
   API_KEY_PREFIX,
   AUDIENCE_BINDING_SUGGESTION_STATUSES,
   AUDIENCE_BINDING_SUGGESTION_STATUS_VALUES,
+  AUTHZ_GRANTS_CACHE_TTL_ENV,
+  AUTHZ_INVALIDATED_CHANNEL,
+  AUTHZ_STORE_UNAVAILABLE_CODE,
+  AUTHZ_STORE_UNAVAILABLE_MESSAGE,
+  AUTHZ_STORE_UNAVAILABLE_STATUS,
+  AuthzStoreUnavailableError,
   CORE_FALLBACK_FACTORIES,
   DependencyResolver,
   ENTRY_EXECUTION_CONTEXT_FIELDS,
   HotReloadManager,
+  InMemoryMetadataActivationStore,
   LiteKernel,
+  METADATA_ACTIVATION_TABLE,
   MigrationJournalRefusal,
   MigrationPlanRegistry,
   NamespaceResolver,
@@ -6912,18 +7422,19 @@ export {
   ObjectKernel,
   ObjectKernelBase,
   ObjectLogger,
+  ObjectStoreMetadataActivationStore,
+  PLATFORM_ADMIN_EMAIL_SEPARATOR,
   POSTURE_INJECTION_RULE,
   POSTURE_LADDER,
   POSTURE_RANK,
-  PluginConfigValidator,
   PluginHealthMonitor,
   PluginLoader,
   PluginPermissionEnforcer,
   PluginPermissionManager,
   PluginSandboxRuntime,
-  PluginSecurityScanner,
   PluginSignatureVerifier,
   qa_exports as QA,
+  SERVICE_NOT_REGISTERED_CODE,
   SIGNATURE_ALG,
   SecurePluginContext,
   SemanticVersionManager,
@@ -6933,6 +7444,7 @@ export {
   UnresolvedFilterTokenError,
   adminStandingColumns,
   adminStandingTables,
+  artifactPackageId,
   assembleExecutionContext,
   assembleExecutionContextOrGuest,
   assertInitServiceRequirements,
@@ -6951,7 +7463,6 @@ export {
   createMemoryJob,
   createMemoryMetadata,
   createMemoryQueue,
-  createPluginConfigValidator,
   createPluginPermissionEnforcer,
   deepMerge,
   defaultIsTransientError,
@@ -6963,48 +7474,70 @@ export {
   extractApiKey,
   filterTokenContextFrom,
   findInterruptedRuns,
+  formatIntegrityViolation,
   generateApiKey,
   generateEd25519KeyPair,
   getEnv,
   getMemoryUsage,
+  hasPlatformAdminStanding,
   hashApiKey,
   hashMigrationPlan,
+  isAggregatingAdvisories,
   isAudienceBindingSuggestionStatus,
   isAuthGateAllowlisted,
+  isAuthzStoreUnavailableError,
+  isConfiguredPlatformAdminEmail,
   isExpired,
   isGrantActive,
   isGrantExpired,
   isNode,
   isRowActive,
+  isServiceNotRegisteredError,
   isUninterpretableTemporalComparand,
+  matchesConfiguredPlatformAdmin,
   nextUtcCalendarDay,
   normalizeAuthGate,
+  normalizePlatformAdminEmail,
   omitInternalFieldsFromWriteResponse,
+  parsePlatformAdminEmails,
   parseScopes,
   parseSignature,
   planChunks,
   postureVisibleRows,
   readAuthoredTranslationLayer,
+  readAuthzGrantsCacheTtlMs,
   readRunJournal,
+  recordAdvisoryHit,
   recordNotFoundError,
+  reportAuthzCachePosture,
+  reportLegacyPlatformAdminGrant,
+  resetLegacyPlatformAdminGrantReport,
+  resetPlatformAdminEmailMemo,
   resolveApiKeyAdmission,
   resolveApiKeyPrincipal,
+  resolveArtifactPackageOrder,
+  resolveAuthzCachePosture,
   resolveAuthzContext,
   resolveFilterToken,
   resolveFilterTokens,
   resolveLocale,
   resolveLocalizationContext,
+  resolvePlatformAdminEmails,
   resolvePluginOrder,
   resolveUserAuthzGrants,
   resumeMigrationJournal,
+  rethrowAuthzStoreUnavailable,
   runMigrationJournal,
+  runWithAdvisoryAggregation,
   safeExit,
+  setPlatformAdminConfigSink,
   shouldDenyAnonymous,
   signPayload,
   temporalComparandKind,
   unknownAudienceBindingSuggestionStatusMessage,
   utcInstantMs,
   validateInitServiceContract,
+  verifyIntegrity,
   verifyPayload,
   verifyPlatformSignature,
   verifyPluginArtifact,