objectstack-ai · os-zhuang · Sep 5, 2026 · Sep 4, 2026 · Sep 4, 2026 · Sep 4, 2026
@@ -123,6 +123,10 @@ The migration is **non-destructive** and **idempotent**: each legacy org's datab
 
 ## References
 
+> **Path note (2026-09):** the three `packages/services/service-tenant/…` paths below are historical
+> and deliberately unlinked — the `packages/services/service-tenant/` package left this repository with the control-plane split to `objectstack-ai/cloud` (`473fce590`, 2026-05-21).
+> They are kept as written because they record where this decision landed at the time.
+
 - `packages/spec/src/cloud/environment.zod.ts` — protocol schemas
 - `packages/services/service-tenant/src/objects/sys-environment.object.ts` — merged control-plane environment object (includes DB addressing)
 - `packages/services/service-tenant/src/environment-provisioning.ts` — provisioning service

@@ -191,6 +191,7 @@ The migration is non-destructive and idempotent. Steps 1–4 ship in v4.x as an
 
 - `packages/spec/src/cloud/environment-package.zod.ts` — current installation schema (to be updated)
 - `packages/services/service-tenant/src/objects/sys-package-installation.object.ts` — DB object (to be updated)
+  *(Path note, 2026-09: historical and deliberately unlinked — the `packages/services/service-tenant/` package left this repository with the control-plane split to `objectstack-ai/cloud` (`473fce590`, 2026-05-21).)*
 - ADR-0002: `docs/adr/0002-environment-database-isolation.md` — Control Plane / Data Plane split
 - Salesforce Unlocked Packages: <https://developer.salesforce.com/docs/atlas.en-us.pkg2_dev.meta/pkg2_dev/>
 - Power Platform Solution Layers: <https://learn.microsoft.com/power-platform/alm/solution-layers-alm>

@@ -134,4 +134,8 @@ Custom domains and multi-hostname binding (ACME certificates, `sys_domain` table
 
 - Plan: `apps-server-sleepy-newell` (the plan this ADR crystallizes).
 - Code: `packages/runtime/src/kernel-manager.ts`, `packages/runtime/src/project-kernel-factory.ts`, `packages/runtime/src/http-dispatcher.ts`, `apps/objectos/server/bootstrap.ts`, `apps/cloud/objectstack.config.ts`.
+  *(Path note, 2026-09: four of these five are historical and deliberately unlinked — the two runtime
+  paths for the reason the Path note in §2 gives (`packages/runtime/src/cloud/` was removed by #1600,
+  `60fc50186`), and `apps/objectos/` and `apps/cloud/` because both split out to `objectstack-ai/cloud`
+  on 2026-05-21 (`617016428` / `2a1fc869a`). `http-dispatcher.ts` is the only one still in this repository.)*
 - Related guide: [Cloud vs Self-Hosted deployment](../../content/docs/deployment/index.mdx).
@@ -25,7 +25,7 @@ Project concept entirely. As a consequence:
   `branch`. The column physically named `project_id` on `sys_metadata`
   is treated as a legacy alias and will be renamed/dropped in the
   ADR-0008 PR-10 migration.
-- All references to `this.projectId` in `packages/objectql/src/protocol.ts`
+- All references to `this.projectId` in `packages/metadata-protocol/src/protocol.ts`
   are deprecated. New code must consult `organization_id` (and, in M1,
   the branch ref) only.
 - The `(type, name, project_id)` UNIQUE index is superseded by
@@ -143,7 +143,7 @@ Three different things were tangled into one place:
 
 ### Storage shape
 
-`sys_metadata` schema (`packages/platform-objects/src/metadata/sys-metadata.object.ts`) is the storage substrate. No schema changes needed in Phase 1:
+`sys_metadata` schema (`packages/metadata-core/src/objects/sys-metadata.object.ts`) is the storage substrate. No schema changes needed in Phase 1:
 
 | column | role |
 |---|---|
@@ -194,7 +194,9 @@ Five files in `packages/platform-objects/src/metadata/` duplicate a Zod schema t
 
 `sys-metadata.object.ts` and `sys-metadata-history.object.ts` are retained — they are the storage substrate, not duplicates of any metadata type.
 
-`MetadataProjector` (`packages/metadata/src/projection/metadata-projector.ts`) becomes dead code under this ADR. It is left in place for one release as a no-op safety net, and removed in the next major along with the deprecated objects.
+`MetadataProjector` (`packages/metadata/src/projection/metadata-projector.ts` — *Path note, 2026-09:
+the module was deleted in `516f48ca9`, the same change that implemented this ADR; the name survives
+only in `packages/metadata/src/migrations/drop-projection-tables.ts`*) becomes dead code under this ADR. It is left in place for one release as a no-op safety net, and removed in the next major along with the deprecated objects.
 
 ## Consequences
 
@@ -231,7 +233,7 @@ Five files in `packages/platform-objects/src/metadata/` duplicate a Zod schema t
 
 ## References
 
-- `packages/objectql/src/protocol.ts` — `getMetaItem`, `saveMetaItem`, `deleteMetaItem`, `loadMetaFromDb` (this ADR's primary site)
+- `packages/metadata-protocol/src/protocol.ts` — `getMetaItem`, `saveMetaItem`, `deleteMetaItem`, `loadMetaFromDb` (this ADR's primary site)
 - `packages/rest/src/rest-server.ts` — `PUT/GET/DELETE /api/v1/meta/:type/:name` routes
 - `packages/spec/src/api/protocol.zod.ts` — `ObjectStackProtocol` interface (`deleteMetaItem` added)
 - `packages/spec/src/kernel/metadata-plugin.zod.ts` — `MetadataTypeRegistryEntrySchema.supportsOverlay` (future hook for the whitelist)
@@ -247,7 +249,7 @@ Two implementation issues were discovered during browser E2E verification with t
 
 ### 1. List endpoint did not include overlay rows in project kernels
 
-`getMetaItems(type)` in `packages/objectql/src/protocol.ts` was gated by
+`getMetaItems(type)` in `packages/metadata-protocol/src/protocol.ts` was gated by
 `if (this.projectId === undefined)` before consulting `sys_metadata`. Project
 kernels — which are precisely where overlays live — therefore returned only
 artifact entries. `GET /api/v1/meta/view` listed 16 artifact items and zero
@@ -315,7 +317,7 @@ change, any JSON shape was accepted and stored verbatim, surfacing as
 runtime errors only at read time when the merged effective metadata was
 fed into the UI engine.
 
-Implementation (`packages/objectql/src/protocol.ts`):
+Implementation (`packages/metadata-protocol/src/protocol.ts`):
 
 - `resolveOverlaySchema(type, item)` dispatches by metadata type:
   - `view` → `ListViewSchema` or `FormViewSchema` (picked by the `type`
@@ -359,7 +361,7 @@ types fall through, plural type strings normalize correctly.
 
 ### Registry-driven opt-in (was: hard-coded whitelist)
 
-`packages/objectql/src/protocol.ts` previously gated `PUT/DELETE
+`packages/metadata-protocol/src/protocol.ts` previously gated `PUT/DELETE
 /api/v1/meta/:type/:name` against a **hard-coded** `Set` of allowed types
 (`OVERLAY_ALLOWED_TYPES = new Set(['view', 'dashboard'])`). Any new metadata
 type that wanted to participate in the overlay system had to find and edit
@@ -453,7 +455,7 @@ idempotent migration is provided and run automatically by
 >    place: the `allowOrgOverride` boolean on its
 >    `DEFAULT_METADATA_TYPE_REGISTRY` entry.
 > 3. The **overlay validator** lives in exactly one place:
->    `resolveOverlaySchema()` in `packages/objectql/src/protocol.ts`.
+>    `resolveOverlaySchema()` in `packages/metadata-protocol/src/protocol.ts`.
 >
 > Do **not** re-declare the same shape as a `*.object.ts` (the
 > projection-table pattern is removed; see Addendum 2026-05-16 (b)).
@@ -652,7 +654,7 @@ coverage:
 
 ### Admin UX: field-level Code-vs-Effective diff
 
-The Layers tab in the metadata editor (`packages/app-shell/.../LayeredDiff.tsx`
+The Layers tab in the metadata editor (`objectui:packages/app-shell/src/views/metadata-admin/LayeredDiff.tsx`
 in `objectui`) now defaults to a **Diff** view that compares
 `layered.code` (artifact baseline) against `layered.effective` (merged)
 field-by-field. Each top-level key renders as a row with a colour-coded
@@ -680,7 +682,7 @@ the present), so this section is where the present tense lives.
 
 | Addendum (d) says | Today | Superseded by |
 |:---|:---|:---|
-| "`addSysMetadataOverlayIndex(driver)` — exported from `@objectstack/metadata/migrations`" | **Deleted.** The export and its module are gone; `packages/metadata/src/migrations/index.ts` carries a tombstone in their place that records the measurement and forbids re-introducing a producer for `idx_sys_metadata_overlay_active` in that package. | #6771 (PR #6824, merged 2026-08-08); `.changeset/overlay-index-single-producer.md` |
+| "`addSysMetadataOverlayIndex(driver)` — exported from `@objectstack/metadata/migrations`" | **Deleted.** The export and its module are gone; `packages/metadata/src/migrations/index.ts` carries a tombstone in their place that records the measurement and forbids re-introducing a producer for `idx_sys_metadata_overlay_active` in that package. | #6771 (PR #6824, merged 2026-08-08); `.changeset/overlay-index-single-producer.md` (since consumed by the release, `24c1b91e4`) |
 | "a new idempotent migration is provided and run automatically by `DatabaseLoader.ensureSchema()`" | **No overlay-index DDL is issued from that method at all**, on either of its two paths — both call sites went with the export. What `ensureSchema()` still runs is the `project_id` → `environment_id` forward migration, which is a different concern. | #6771 (PR #6824) |
 | "Drivers ignore `indexes` declarations on synced tables today" | **False** — and this one is *not* a consequence of #6771. `SqlDriver.syncDeclaredIndexes` materializes every declared index, through knex's `table.unique(fields, { indexName })` / `table.index(fields, name)`, skipping by name for idempotence. | The driver itself. The spec records the same fact where the `IDataDriver` capability bit `indexes` was retired for having no reader: "Declared indexes are materialised by the driver itself during schema sync (`SqlDriver.syncDeclaredIndexes`)". |
 
@@ -745,7 +747,7 @@ form from being re-imposed over it.
 
 ### Anchors
 
-Both files above are registered in `scripts/adr-anchors.json` against ADR-0005, so
+Both files above are registered in `scripts/adr-anchors/` against ADR-0005, so
 the next author to edit either one is told which decision they are standing on.
 That is the recurrence guard Prime Directive #13 names and the one thing this
 amendment adds beyond prose: the producer that was deleted had no anchor, and

@@ -177,6 +177,8 @@ The toggle is sticky per user; once on, it stays on across sessions.
    later (different semantics) when Builder UX ships. SDK consumers
    (none in production yet) must rename calls.
 3. **`apps/cloud/server/index.ts` and `worker.ts` change** their hostname
+   *(Path note, 2026-09: historical and deliberately unlinked — `apps/cloud/` split out to
+   `objectstack-ai/cloud` on 2026-05-21, `2a1fc869a`.)*
    resolution from `sys_project` to `sys_environment`.
 
 ### Neutral

@@ -219,5 +219,7 @@ Each phase is independently shippable behind a feature flag
   §12.3 — original three-layer-model recommendation
 - `packages/services/service-tenant/src/objects/sys-project.object.ts`
   — current single-table model; relabelled in Phase 0
+  *(Path note, 2026-09: historical and deliberately unlinked — the object was renamed to
+  `sys-environment.object.ts` by `0ee839c53`, and then the `packages/services/service-tenant/` package left this repository with the control-plane split to `objectstack-ai/cloud` (`473fce590`, 2026-05-21).)*
 
 
@@ -189,7 +189,9 @@ installed where" goes through Packages → version history → installations.
 1. `sys_package_version.published_from_project_id` (introduced in v3) is
    removed as a field — provenance lives in `sys_package_version.metadata`
    if needed.
-2. `ProjectArtifactSchema` (`packages/spec/src/cloud/project-artifact.zod.ts`)
+2. `ProjectArtifactSchema` (`packages/spec/src/cloud/project-artifact.zod.ts` — *Path note, 2026-09:
+   the follow-up rename this paragraph anticipates happened; the file is
+   `packages/spec/src/cloud/environment-artifact.zod.ts` today, renamed by `944f18758`, 2026-05-24*)
    is the envelope returned by `GET /cloud/projects/:id/artifact`. The
    route name is kept for BC; the response shape continues to wrap the
    compiled `ObjectStackDefinitionSchema`. The "Project" in the schema
@@ -202,7 +204,7 @@ installed where" goes through Packages → version history → installations.
 
 | Phase | Scope | Status |
 |:---|:---|:---|
-| **A — Drop Project from the protocol** | Remove `packages/spec/src/cloud/project.zod.ts`; update `index.ts`; trim Project tests from `environment.test.ts`; mark `sys_environment_revision` as `@deprecated transitional` | ✅ This commit |
+| **A — Drop Project from the protocol** | Remove `packages/spec/src/cloud/project.zod.ts` (since removed, as this phase prescribes — `d4eed33ab`); update `index.ts`; trim Project tests from `environment.test.ts`; mark `sys_environment_revision` as `@deprecated transitional` | ✅ This commit |
 | **B — Rewire CLI publish onto Package** | `objectstack publish` resolves implicit `sys_package`; calls `POST /cloud/packages/:id/versions`; upserts `sys_package_installation`. Old `/cloud/projects/:envId/metadata` becomes a thin BC shim that internally walks the new path. | Next |
 | **C — Split CLI commands** | `objectstack push` (version only) + `objectstack deploy` (installation upsert) + `objectstack promote` + `objectstack rollback`. `publish` stays as a `push && deploy` alias. | Next+1 |
 | **D — Remove transitional revision table** | After Phase B is shipping and verified: drop `sys_environment_revision` schema, delete `_DEPRECATED` route handlers, wipe table from any seeded control planes. | After C |

@@ -446,6 +446,7 @@ Review existing `sys_oauth_application`, `sys_webhook`, `sys_two_factor` — kee
 
 - `packages/platform-objects/src/identity/sys-user-preference.object.ts` — original config-resolution comment
 - `packages/services/service-tenant/src/objects/sys-environment-credential.object.ts` — encrypted-creds reference impl
+  *(Path note, 2026-09: historical and deliberately unlinked — the `packages/services/service-tenant/` package left this repository with the control-plane split to `objectstack-ai/cloud` (`473fce590`, 2026-05-21).)*
 - `packages/spec/src/data/field.zod.ts` — existing field type catalogue
 - `packages/platform-objects/src/apps/setup.app.ts` — Setup app shell
 - Apple "Implementing an iOS Settings Bundle" — https://developer.apple.com/documentation/foundation/userdefaults/implementing_an_ios_settings_bundle

@@ -482,7 +482,7 @@ The plan is intentionally staged so each milestone is **independently shippable*
 - [ ] All existing tests pass; new contract suite passes for both `InMemoryRepository` and `FileSystemRepository`
 - [ ] Cold start of the [HotCRM reference app](https://github.com/objectstack-ai/hotcrm) is ≤ current baseline (no eager full-load)
 - [ ] `MetadataEvent` stream visible in `apps/studio/Logs` panel
-- [ ] No code in `packages/objectql/src/protocol.ts` reads files or imports from `@objectstack/metadata-fs`
+- [ ] No code in `packages/metadata-protocol/src/protocol.ts` reads files or imports from `@objectstack/metadata-fs`
 
 **Out of scope for M0**
 

@@ -139,6 +139,8 @@ HotCRM has a placeholder `live_data` skill that grounds Copilot answers in the l
 1. Add `'flow_author'` to `sales_copilot.skills[]`.
 2. Drop the explicit cut we made when removing the in-CRM `flow_designer` draft (commit retained in branch `feat/wow-2-flow-designer-draft`).
 3. Update `content/docs/ai-copilot/live-schema.mdx` with a Wow #2 sibling page.
+   *(Path note, 2026-09: this is a HotCRM path, not a path in this repository — no file has ever
+   existed at `content/docs/ai-copilot/` here. It is kept as the record of the planned edit.)*
 
 No CRM data model changes.
 
@@ -154,3 +156,5 @@ Pending platform review. HotCRM v1 launch (W9) will ship without Wow #2 unless t
 * ADR-0003 — package-as-first-class-citizen (target for `register_flow`).
 * ADR-0008 — metadata repository + change log (provides idempotency + audit).
 * HotCRM `content/docs/ai-copilot/live-schema.mdx` — Wow #1 marketing copy that sets up Wow #2.
+  *(Path note, 2026-09: a HotCRM path, not a path in this repository — no file has ever existed at
+  `content/docs/ai-copilot/` here.)*
@@ -314,3 +314,5 @@ ships next.
 * `packages/spec/src/ui/action.zod.ts` — `ActionSchema` + `ActionAiSchema`
 * `packages/spec/src/contracts/ai-service.ts` — `AIToolDefinition`
 * `packages/services/service-ai/src/tools/action-tools.ts` — the bridge
+  *(Path note, 2026-09: historical and deliberately unlinked — `service-ai` was removed whole under
+  ADR-0025 S2, `21d4f8901`, 2026-06-25; the open edition is MCP-only.)*
@@ -550,6 +550,11 @@ No new ADR-0011 surface is needed. The Action Registry, agent runtime, and tool-
 
 The following are clean enough to copy verbatim; each goes into `packages/messaging-utils/` with a NOTICE entry:
 
+> **Path note (2026-09):** the three `packages/messaging-utils/src/…` paths in the *Our path* column
+> are **proposed** destinations, not citations — no `packages/messaging-utils/` package has ever
+> existed in this repository's history. They record where this ADR intended the borrowed artifacts
+> to land.
+
 | openclaw source | Our path | Why borrowed |
 |:---|:---|:---|
 | `plugin-sdk/security-runtime.ts::safeEqualSecret` | `packages/messaging-utils/src/safe-equal.ts` | Constant-time secret compare; well-tested, no objectstack-specific shape needed |

@@ -16,7 +16,7 @@ internal `name` mirrors the key.
 The Studio metadata editor, however, treated `fields` as an **array** all
 the way down:
 
-1. Hand-crafted JSON Schema in `packages/objectql/src/protocol.ts`
+1. Hand-crafted JSON Schema in `packages/metadata-protocol/src/protocol.ts`
    declared `{ type: 'array', items: { … } }`.
 2. The form spec in `packages/spec/src/data/object.form.ts` declared
    `{ type: 'repeater', widget: 'grid' }`.

@@ -5,6 +5,16 @@
 **Builds on**: [ADR-0005](./0005-metadata-customization-overlay.md) (one Zod source of truth per metadata type)
 **Consumers**: `@objectstack/spec`, `@objectstack/runtime`, `@objectstack/objectql`, `@objectstack/plugins/driver-sql`, `@objectstack/services/service-ai`, `@objectstack/cli`, `../objectui`
 
+> **Path note (2026-09), paths only — no decision changes.** Five paths this record cites are
+> historical and deliberately unlinked: `packages/spec/src/data/external-lookup.zod.ts` (retired
+> under ADR-0049 enforce-or-remove, `29488ccae`, 2026-08-12), `packages/spec/src/automation/sync.zod.ts`
+> (the L1 "Simple Sync" layer was retired whole, `891d345a7`, 2026-08-03), and
+> `packages/services/service-ai/src/tools/query-data.tool.ts` +
+> `packages/services/service-ai/src/schema-retriever.ts` (`service-ai` removed under ADR-0025 S2,
+> `21d4f8901`, 2026-06-25). `packages/spec/src/shared/error-map.ts` is a **proposed** path — no file
+> has ever existed there. Each is kept as written because it records this decision's surface at the
+> time it was taken.
+
 ---
 
 ## 0. Context

@@ -454,8 +454,9 @@ enabled), so disable state would otherwise be lost. Persistence is local-first:
 - `../objectui/.../layout/UnifiedSidebar.tsx` — `active_package` selector (authoring target)
 - `packages/runtime/src/http-dispatcher.ts` — `assemblePackageManifest` + `GET /packages/:id/export` (§9.2)
 - `packages/runtime/src/cloud/marketplace-install-local-plugin.ts` — inline-manifest import + register-before-persist (§9.2–9.3)
+  *(Path note, 2026-09: historical and deliberately unlinked — `packages/runtime/src/cloud/` was removed by ADR-0006 Phase 4 (`15fcd360d`, 2026-06-11), which took the cloud plugins out of the framework runtime.)*
 - `packages/objectql/src/registry.ts` — `isPackageDisabled` + `listItems` disabled-package filter (§9.5); `setInitialDisabledPackageIds` + `installPackage` disable seeding (§9.7)
-- `packages/objectql/src/protocol.ts` — `getMetaItems` final-merge disabled-package filter (§9.5)
+- `packages/metadata-protocol/src/protocol.ts` — `getMetaItems` final-merge disabled-package filter (§9.5)
 - `packages/objectql/src/engine.ts` — `registerApp` consumes `tools` / `skills` (§9.6)
 - `packages/spec/src/shared/metadata-collection.zod.ts` — `PLURAL_TO_SINGULAR` gains `tools` / `skills` (§9.6)
 - `packages/spec/src/stack.zod.ts` — top-level `tools` on `ObjectStackDefinition` (§9.6)