Merge remote-tracking branch 'origin/main' into claude/issue-16896-automation-run-lifecycle-doors-docs

Author: claude

.changeset/readonly-insert-superseded-prose.md

@@ -0,0 +1,10 @@
+---
+"@objectstack/objectql": patch
+"@objectstack/rest": patch
+---
+
+Documentation only: seven in-source prose sites that still stated the superseded readonly-on-INSERT contract as live now state the ruled one.
+
+The 2026-09-03 maintainer ruling (option C, #14147) put the static `readonly` strip inside `engine.insert` under the same `isSystem` gate as `engine.update`, and deleted the metadata-protocol create-ingress copy. Comments and test headers written before that ruling still said, in the present tense, that a non-system INSERT is exempt from the static strip, or that the strip lives at the DataProtocol create ingress. Each now states the ruled contract, and the superseded sentence is kept only as history, marked as superseded.
+
+No behaviour changes and no test was deleted, skipped or re-scoped — the diff is comments only. It is a `patch` rather than `skip-changeset` because it was measured to publish: `@objectstack/objectql`'s comment edit moves source line numbers, so `dist/{index,core}.{js,mjs}.map` change, and `@objectstack/rest` inlines that same objectql source into its bundle, so `dist/index.{js,cjs}.map` change with it. Every emitted `.js` / `.mjs` / `.cjs` and every `.d.ts` / `.d.mts` / `.d.cts` is byte-identical before and after, and all six maps ship inside the published tarballs.

.changeset/seed-locale-producer-wiring.md

@@ -0,0 +1,20 @@
+---
+"@objectstack/runtime": minor
+"@objectstack/spec": patch
+---
+
+`AppPlugin` now supplies `SeedLoaderConfig.locale`, so the `Seed.locale` axis takes effect on the default boot path.
+
+The locale filter axis landed complete on the consumer side: the loader reads `Seed.locale`, composes it with `env` by conjunction, and names every dataset it drops. What it never had was a **producer** — no first-party call site passed `config.locale`, so `filterByLocale` returned its input on its first line and `dataset.locale` was never read at all. Authoring the key changed nothing. That is the same shape `Seed.env` spent releases in before framework#4704.
+
+- **The locale is resolved from the app's own `i18n.defaultLocale`** — the same envelope key, read the same way `loadTranslations` already reads it for `setDefaultLocale` — and threaded into all three `SeedLoaderRequest`s `AppPlugin` builds: the inline boot seed, the per-org replayer registered for tenant provisioning, and the dev hot-reload seeder.
+- **An app that declares no locale sends no `locale` key at all**, rather than an `'en'` default. Absence is the loader's unrestricted spelling, so a stack that never opted in keeps loading every dataset exactly as before; defaulting would have turned a wiring change into a data change, silently dropping a `locale: ['zh-CN']` dataset on every stack without an `i18n` block. A blank or non-string `defaultLocale` is treated as absence for the same reason.
+- **Resolved at the call sites, not inside `load()`.** The sibling `env` axis resolves itself in the loader off an ambient `NODE_ENV`; a locale has no ambient source, and the only layer that knows which locale a stack runs in is the app config the loader is never handed. So this axis needs a real producer, which is what this change is.
+
+`SeedLoaderService#warnOnUnresolvedLocaleScope` **stays**. It is not a signpost for an unwired state that has now gone away: three of this repo's six seed-request builders are publish/install-time paths that are handed no stack config and still pass no locale, embedding hosts build their own requests, and a stack may declare no `i18n` block at all. Every one of those still reaches `load()` with locale-scoped datasets and no `config.locale`, and the warning is what keeps that loud instead of silently inert.
+
+The liveness ledger row `seed.locale` moves `experimental` → `live` with a `producer` pointer naming this wiring, and records which call sites supply the locale and which do not rather than claiming the frontier away.
+
+⚠️ **Release-note reconciliation, for whoever compiles this release.** The sibling changeset `seed-locale-axis.md` (from the PR that landed the consumer half) states in the present tense that no first-party call site supplies `config.locale`, that the axis is inert on the default boot path, and that the liveness ledger records `seed.locale` as `experimental`. All three sentences describe the state that changeset shipped into, and **this change ends all three**. If both land in one release, the notes must read them in order — or fold them into one entry — rather than publishing the earlier state as current. ⛔ That sibling changeset is deliberately not edited here: it accurately records what its own PR did, and release notes are compiled centrally.
+
+⛔ Out of scope, unchanged: rows already written under a different locale stay resident. Every seed is an `upsert` and the loader only writes, so switching a stack's locale on a non-empty database does not remove the other market's rows.

content/docs/data-modeling/seed-data.mdx

@@ -215,11 +215,21 @@ is made when the seeds load rather than when your config is assembled — so
 switching markets does not mean rebuilding, and the axis is evaluated in the one
 layer that could ever reconcile rows already written for another market.
 
+<Callout type="info">
+  **Where the loading locale comes from.** On the normal boot path your stack
+  supplies it: the runtime reads your app's `i18n.defaultLocale` and passes it to
+  the seed loader, so declaring a locale on a dataset takes effect with no extra
+  wiring. Declare no `i18n` block and no locale is sent at all — which is the
+  unrestricted setting, not a filter.
+</Callout>
+
 <Callout type="warn">
   The axis is evaluated against the seed loader's `config.locale`. A host that
-  supplies no locale gets **every** dataset, and the loader warns naming each
-  locale-scoped dataset it let through — so a scope that is not taking effect is
-  one log line to diagnose rather than a silent no-op.
+  supplies no locale — an app with no declared `i18n.defaultLocale`, or an
+  embedding host that builds its own seed-load request — gets **every** dataset,
+  and the loader warns naming each locale-scoped dataset it let through, so a
+  scope that is not taking effect is one log line to diagnose rather than a
+  silent no-op.
 </Callout>
 
 ---

packages/objectql/src/readonly-strict-errors.ts

@@ -18,13 +18,16 @@ import type { DroppedFieldsEvent } from '@objectstack/spec/data';
  * static `readonly` (#2948), a TRUE `readonlyWhen` predicate (#3042), the
  * implicitly-readonly runtime-owned types (#5503), and the `primary_key` strip
  * of a payload `id` the update dispatch ruled is not an identifier (#6437); on
- * INSERT only the runtime-owned ones, because a create is deliberately exempt
- * from the author-declared strips (#3413). One error names everything wrong
- * with the payload instead of forcing a round-trip per field. `drops`
- * keeps the per-reason breakdown (the same `DroppedFieldsEvent` shape
- * `onFieldsDropped` would have received, had the write been allowed to
- * complete), so a caller can tell a schema-level lock from a state-dependent
- * one without parsing the message.
+ * INSERT the runtime-owned ones and, since the 2026-09-03 ruling (#14147)
+ * superseded the create-side exemption #3413 had granted, static `readonly`
+ * too — judged over `staticReadonlyInsertSubject`, which leaves a
+ * `sys_`-prefixed or `managedBy` object to its own guards (#15719), while
+ * `readonlyWhen` still locks nothing on a create (a conditional lock needs a
+ * prior record). One error names everything wrong with the payload instead of
+ * forcing a round-trip per field. `drops` keeps the per-reason breakdown (the
+ * same `DroppedFieldsEvent` shape `onFieldsDropped` would have received, had
+ * the write been allowed to complete), so a caller can tell a schema-level
+ * lock from a state-dependent one without parsing the message.
  *
  * ## The message is composed from `drops`, not from the error's name (#6437)
  *

packages/rest/src/rest-batch-endpoint.test.ts

@@ -305,11 +305,17 @@ describe('POST {basePath}/batch — cross-object transactional batch', () => {
 
   // ── create ingress parity (#3835) ─────────────────────────────────────────
   //
-  // The engine's INSERT path is static-`readonly`-exempt by design (#3413), so
-  // the #3043 strip that stops a non-system caller from seeding a read-only
-  // column lives at the protocol's create ingress. This route used to call
-  // `ql.insert` directly and skip it, so `readonly` meant two different things
-  // depending on which create endpoint you used.
+  // When this was written the #3043 strip that stops a non-system caller from
+  // seeding a read-only column lived at the protocol's create ingress, because
+  // the engine's INSERT path was static-`readonly`-exempt (#3413). This route
+  // used to call `ql.insert` directly and skip that ingress, so `readonly`
+  // meant two different things depending on which create endpoint you used.
+  // Since the maintainer ruling of 2026-09-03 (option C, #14147) the strip
+  // runs inside `engine.insert` for every non-system caller and the ingress
+  // copy is deleted, so both create routes are stripped identically. The
+  // routing pinned below stands on what the ingress still owns: the #3770
+  // object-existence gate, the #7823 `internal: true` response strip and the
+  // `droppedFields` relay — one create ingress, one response contract.
 
   it('routes create ops through the protocol create ingress, not ql.insert', async () => {
     const ql = makeQl();