@@ -0,0 +1,15 @@
+---
+'@objectstack/runtime': minor
+---
+
+Bind an environment artifact's install-time GRANTED permission set to the packages that artifact materializes.
+
+`EnvironmentArtifactSchema.grantedPermissions` — the consented `{ services, hooks, network, fs }` set the control plane compiles onto the artifact at install-consent time (ADR-0025 §3.5 step 2 / F4) — now reaches `PluginPermissionEnforcer.registerGrantedPermissions` at materialize time, one call per consent record, keyed by the plugin manifest `id`. `AppPlugin.init()` performs the binding, so it happens on every path that turns an artifact into a kernel plugin without either caller changing a line, and the enforcer holding the result is readable as `AppPlugin.permissionEnforcer` (with `AppPlugin.grantBinding` recording what bound).
+
+Absent, `{}` and a consented entry stay three distinct states. An artifact carrying no `grantedPermissions` key allocates no enforcer and registers nothing, so a package with no consent record loads exactly as it did; a per-plugin `{}` is a consent record that consented to nothing and registers a bag that denies every service, hook, host and path. A consent record naming a package the artifact does not carry is reported at `warn` rather than passing in silence.
+
+Fixed alongside, because without it the binding was unreachable: the `{ schemaVersion, metadata }` envelope unwrap in `loadArtifactBundle` handed the kernel `metadata` alone and dropped every key standing beside it, so an envelope artifact reached the kernel with `grantedPermissions` stripped. The loss was silent and indistinguishable from the legitimate absent reading. The unwrap now carries the key across when the envelope declares it, `{}` included, and never invents one.
+
+New exports from `@objectstack/runtime`: `registerArtifactGrantedPermissions`, `resolveArtifactGrantBinding`, `carriedPackageIds`, `ArtifactGrantBinding`.
+
+This is the registration half. Access-time enforcement runs through `SecurePluginContext`, which no production path constructs; that seam is ADR-0025 install-flow work and is unchanged here.
@@ -0,0 +1,108 @@
+---
+"@objectstack/metadata": minor
+"@objectstack/metadata-protocol": patch
+---
+
+fix(metadata): four `isoFromValidDate` call sites collapse onto the shared canonical-ISO spelling; `MetadataHistoryRecord.recordedAt` gets the terminal value it never had (#16422)
+
+## What was wrong
+
+`#14037`/`#14038` landed a narrow per-site helper, `isoFromValidDate`, beside
+the shared `canonicalIsoInstant` spelling. It rewrote exactly one shape — a
+valid JS `Date` becomes ISO text — and handed **every other input back
+untouched**. Four adapter boundaries used it, and each fed a field declared
+`z.string()` or `z.string().datetime()`:
+
+| site | declared as |
+|:--|:--|
+| `SysMetadataRepository.rowToEvent` → `MetadataEvent.ts` | `z.string()` |
+| `DatabaseLoader.rowToRecord` → `MetadataRecord.createdAt` / `.updatedAt` | `z.string().datetime().optional()` |
+| `DatabaseLoader.getHistoryRecord` → `MetadataHistoryRecord.recordedAt` | `z.string().datetime()` — **required** |
+| `DatabaseLoader.queryHistory` → the same field, the other door | `z.string().datetime()` — **required** |
+
+So a `null`, a `number`, an opaque column and an Invalid `Date` all arrived at a
+field declared `string`, each wearing an `as string` / `as string | undefined`
+cast that asserted the opposite. Measured over the seven inputs that
+distinguish the two helpers, the declared schemas refused **21 of 35** produced
+values.
+
+`recordedAt` was the sharp end: a REQUIRED `z.string().datetime()` for which
+none of the three available answers was legal — the visible text
+`"Invalid Date"` fails the refinement, `undefined` fails the required field, and
+the pass-through fed it the `Date` object, which fails both.
+
+## What it does now
+
+Those four sites read `canonicalIsoInstant`, whose return type **is**
+`string | undefined`, so all four casts are deleted rather than restated. Both
+sibling definitions of `isoFromValidDate` are gone. The terminal value is chosen
+per site, from the site's own declared schema:
+
+- `MetadataRecord.createdAt` / `.updatedAt` are `.optional()` → `undefined`, the
+  branch an absent column already took. ⛔ No default is invented for a field the
+  schema lets be absent.
+- `MetadataHistoryRecord.recordedAt` is required → the **epoch**, via a named
+  `recordedAtFallback()` shared by both history doors. ⛔ Not `new Date()`: a
+  `now` stamp is a plausible-looking recording instant nobody measured, and it
+  sorts a version recorded years ago to the top of a newest-first timeline. The
+  epoch invents no fact and sorts to the oldest end. It is also the answer the
+  sibling reader of this same `sys_metadata_history.recorded_at` column already
+  gives (`rowToEvent` and `history()`, both `?? new Date(0).toISOString()`).
+
+Schema refusals over the same seven inputs: **21 → 8**. The eight that remain
+are a `number` and an opaque object at four sites — shapes no driver is measured
+to materialise for these columns. They now arrive as the declared *type* (a
+string) that simply is not a valid datetime, so the producer's bug stays visible
+instead of being papered over.
+
+## One behaviour change worth reading twice — and it is why this is `minor`
+
+`DatabaseLoader.stat()` computes `record.updatedAt ?? record.createdAt`. An
+Invalid `updated_at` used to WIN that `??` — a `Date` is truthy and not nullish —
+so a row with an unreadable `updated_at` and a good `created_at` published
+`new Date()` as its `mtime`. It now folds to `undefined` one step earlier and
+loses the `??`, so the row publishes its `created_at`: a stored instant in place
+of a fabricated one, and exactly the "same `?? DEFAULT` chain an absent column
+takes" that `#14078`'s own ruling text prescribes for the shape.
+
+⚠️ **The old answer was LEGAL.** `new Date().toISOString()` satisfies
+`MetadataStats.mtime`'s `z.string().datetime()` perfectly well, and the
+pre-existing pin asserted exactly that. So this one site is **not** the repair of
+a violation — it is one legal published answer replaced by a different legal
+published answer on a published read verb. Nothing was refused before and is
+permitted now; a consumer simply receives a different instant.
+
+## Why the two levels differ
+
+- **`@objectstack/metadata` — `minor`.** Its four repaired sites, on their own,
+  are the "repairing an implementation that silently violated its own already
+  published declared type" case: the values that changed there are ones
+  `MetadataRecordSchema` / `MetadataHistoryRecordSchema` already refused, and
+  nothing a consumer legitimately received has moved. But this package also
+  carries `stat()`, and that site changes a **legal** published answer, which the
+  paragraph above measures. The level is per package, so the four repaired sites
+  ride along at `minor`.
+- **`@objectstack/metadata-protocol` — `patch`.** Neither of its two sites moves
+  a legal published answer. `rowToEvent` only stops emitting values
+  `MetadataEventSchema` refused (a `Date`, a `number`, an opaque object in a
+  field declared `z.string()`), and `listCommits` is byte-identical on all seven
+  probe inputs.
+
+⛔ No declared type narrowed, no export was added or removed (neither helper was
+ever exported), and no envelope or accept set moved — so this is `minor` by the
+changed-answer row, not a breaking change, and it carries no ADR-0087
+disposition.
+
+## What deliberately did NOT collapse
+
+`listCommits` in `@objectstack/metadata-protocol` keeps its copy. Its docblock
+promises callers the RAW value back for a non-`Date`, and the shared spelling
+rewrites the whole domain: swapping it in would ERASE an Invalid `Date` from the
+response (`undefined` — the one answer ADR-0053 D-F3 refuses, because it silently
+drops a value that is on disk) and hand a `number` or an opaque object to the
+commit-timeline sort as `String(value)` rather than verbatim. Measured, that site
+is byte-identical on all seven inputs before and after this change.
+
+`SqlDriver`'s same-named helper is not part of this family at all: it takes
+`Date` (not `unknown`), both its call sites narrow with `instanceof Date` first,
+and it is the PRODUCER-side fold ADR-0053 D-F3 governs. It is untouched.
@@ -0,0 +1,68 @@
+---
+"@objectstack/driver-memory": minor
+"@objectstack/driver-sql": patch
+"@objectstack/objectql": patch
+---
+
+fix(driver-memory,driver-sql): an explicit `tenancy.enabled: false` opt-out is sticky, so a partial `syncSchema` re-registration no longer flips a platform-global object's UNIQUE partition (#16729)
+
+## What was wrong
+
+`InMemoryDriver.syncSchema` recomputed its uniqueness constraints from whatever
+schema THAT call happened to carry. A second registration without a `tenancy`
+block — the `{ name, fields }` shape — fell through to the implicit
+`organization_id` heuristic, so a `unique` field moved from **one row per
+install** (`scopeField: null`, which is what `tenancy.enabled: false` declares)
+to **one row per organization**. A duplicate the declaration refuses then
+landed. Measured at the driver door on `origin/main` `d61139f1ba`:
+
+| sequence | second `key: 'K'`, different organization |
+|:--|:--|
+| register with `tenancy.enabled: false` | `REFUSED` — `UNIQUE_VIOLATION` / 409 |
+| …then re-register with `{ name, fields }` | **`LANDED`** |
+
+`SqlDriver` running the same sequence refuses in **both** cases: it has kept a
+sticky `tenantOptOutByTable` since #3249. `driver-memory` had mirrored the inner
+`computeTenantField` and not the wrapper that consults the record, so "mirrors
+`computeTenantField` arm for arm" stayed literally true while the pair diverged.
+
+It is silent in both directions — nothing logs the flip, and the refusal names
+the field, never the partition. That is the declared-vs-enforced shape Prime
+Directive #10 forbids, reached by a state change rather than by a missing check.
+
+## What it does now
+
+- **`@objectstack/driver-memory`** gains `computeAndRecordTenantField`, the
+  sticky resolver, and the `TenantOptOutRecord` type for the per-instance record
+  a driver owns. `InMemoryDriver` holds one and resolves through it, handing
+  BOTH declaration surfaces — field-level `unique` and declared `indexes[]` —
+  the same resolved column. `uniqueConstraintsFromFields` and
+  `uniqueConstraintsFromDeclaredIndexes` accept that column as an optional
+  second argument; called with one argument they answer exactly as before.
+  `tenantFieldOf` is unchanged and still a pure function of its argument.
+- **`@objectstack/driver-sql`**: the shard leaf resolved its tenant column with
+  the BARE `computeTenantField`, so a `rotateShards` sweep carrying no `tenancy`
+  block gave a shard an organization key part the base table's index does not
+  have — one object, two partitions, decided by which physical table a row
+  landed in. It now resolves through the record, keyed by the base table.
+- **`@objectstack/objectql`**: `LifecycleObjectLike` declares `tenancy`. The
+  Archiver hands that object straight to `cold.syncSchema`, and the published
+  type refused the key while the driver below read it — so an author writing a
+  fresh literal was pushed into producing exactly the partial re-registration
+  above. Same correction #16711 made where the shard leaf narrowed the key off
+  the object it was handed.
+
+The record is deliberately narrow. Only the explicit OPT-OUT is sticky: a
+declared `tenancy.tenantField` is not recorded, matching `SqlDriver`. An object
+that never declared the opt-out never enters the record, so a genuinely
+org-scoped object keeps its `organization_id` partition across a partial
+re-registration — an implementation answering `null` more often would not be
+stickier, it would be tenant isolation switched off. A carried `tenancy` block
+stays authoritative in both directions and CLEARS a recorded opt-out.
+
+`@objectstack/driver-memory` is `minor` for the two new public-entry exports.
+The behaviour repairs themselves are `patch`: each restores an implementation to
+the `tenancy.enabled: false` contract (`isTenancyDisabled`, ADR-0066) it was
+already declaring, rather than replacing one legal published answer with
+another. The `objectql` entry is a published type WIDENING — a key the interface
+refused is now accepted, and nothing that compiled before stops compiling.
@@ -0,0 +1,90 @@
+---
+'@objectstack/types': minor
+'@objectstack/metadata-protocol': patch
+'@objectstack/metadata': patch
+'@objectstack/cli': patch
+'@objectstack/driver-sql': patch
+---
+
+fix(types,metadata-protocol,metadata,cli): a stored operator record names the dialect again, not the driver's composed refusal
+
+Since the raw-SQL seam began declaring its own fault, `SqlDriver.execute()` no longer
+lets the dialect's error out: it raises `code: DATABASE_ERROR` / `status: 500` with a
+COMPOSED message that discloses neither the statement nor the diagnostic, and carries
+the dialect error whole under a non-enumerable `cause`. That envelope is deliberate and
+is unchanged here.
+
+What changed underneath it is what every consumer STORED. Each migration probe, backfill
+and rename in `@objectstack/metadata-protocol` / `@objectstack/metadata` embedded
+`error.message` into an operator-facing record, so those records began reading
+
+    the database refused to run a raw statement
+
+where they used to read
+
+    no such column: foo
+
+For a live console that costs nothing — the driver prints the statement and the dialect
+text to its warn sink one line earlier. For a record read later it costs everything:
+whoever opens a customer install's backfill result a week on never had that line, and the
+dialect's words were unrecoverable for them.
+
+`@objectstack/types` now exports `operatorFacingErrorText(error)` — a depth-bounded walk
+of the `cause` chain, shaped like the `matchesDriverError` beside it — and the thirteen
+stored-record sites plus `os db clean`'s console line read through it:
+
+- `runtime-index-preflight` — the per-probe `detail` and the seam-failure fan-out;
+- `seed-tenancy-backfill` — the `absent` detail, the organization-probe report and the
+  three per-object warnings;
+- `partial-index-probe` — the `detail` both callers report (and its two module comments,
+  which stated the opposite of what happened);
+- `migrate-env-id-to-project-id`, `migrate-project-id-to-environment-id`,
+  `migrate-sys-notification-to-event`, `drop-projection-tables` — the per-table `error`;
+- `os db clean` — the `VACUUM failed` line.
+
+Two narrowings are part of the contract, not incidental: an UNDECLARED throw is returned
+on its own message channel, its `cause` never walked, and a declared envelope that is not
+the raw-path one — the typed read exits' terminal, which composes a different sentence —
+is left exactly as it arrived.
+
+That message channel is deliberately NOT byte-identical to what the replaced expressions
+computed. The RULE, rather than a catalogue of cases: an undeclared throw comes back as
+`messageChannelOf(error) || String(error)` — the thrown value's own string `message`, the
+string itself when a string was thrown, and `String(error)` when neither yields text. Every
+difference from the replaced expressions follows from that rule, so read the rule and not a
+list. Illustrations of it, not an exhaustive set: an empty-message `Error` reads its `name`,
+which for a named subclass is that subclass's name rather than `Error` / `TypeError`; a
+thrown non-`Error` reads its own text or `String(error)` where `(e as Error).message` read
+`undefined`, and where `null` / `undefined` threw a `TypeError` out of the catch, so no
+record was written at all and the operation aborted; an object carrying a NON-EMPTY string
+`message` reads it where `err instanceof Error ? … : String(err)` recorded `[object Object]`
+(one carrying an EMPTY `message` still reads `[object Object]`). A thrown EMPTY string reads
+`''`, so this channel is neither always prose nor never empty.
+
+## The levels, and why they are not uniform
+
+`@objectstack/types` takes **`minor`**: it is the one package here that grows a published
+surface — `operatorFacingErrorText` is a new export, present in `dist/index.d.ts` and in the
+export list. A purely additive widening takes at least `minor`.
+
+The other four take **`patch`**, because none of them widens anything: they are a bug fix in a
+released package, which is exactly what `patch` is for. `@objectstack/driver-sql` is named
+because this change moves its `src/**` — by one ADDED file, the `.test.ts` that pins the helper
+against a real `SqlDriver.execute()` refusal. Its published `dist/` is byte-unchanged by this
+PR: no entry point reaches a test file, and `files` packs `dist` only.
+
+**Not breaking, and deliberately not marked so.** Nothing is removed, renamed or made stricter:
+what moves is the TEXT inside an operator-facing `detail` / `error` field, never a field name
+and never a type. The change these sites were made for is the declared raw-path fault, where
+the record gains the dialect's words in place of the driver's composed placeholder. Every
+other throw now reaches these records through the rule above rather than through the
+expression each site spelled out, so its text can move too — a consequence of the rule, not a
+bounded list of exceptions. At thirteen of the fourteen sites the rule is the whole record,
+and some shapes still record `''` there: a thrown empty string, a thrown empty array, and an
+`Error` whose `name` and `message` are both empty are the ones measured. The fourteenth is
+`seed-tenancy-backfill`'s organization probe, which keeps a `|| 'unknown error'` fallback on
+top of the rule, so those same three shapes record `'unknown error'` there rather than `''`;
+that fallback is deliberate — the site reads an empty value as "the probe did not fail" — and
+whether it should go is tracked by #17167. The sentence being replaced is not a value any
+consumer can have been parsing: it is an opaque human diagnostic. A consumer reading these
+records gets the dialect's words back where it had been getting a placeholder.