[WIP] Create a new version release - #42

Merge-lap onto current main. One conflict, in the shared ADR-0087 retirement
registry (`packages/spec/src/migrations/registry.ts`): main's
`import-run-automations-declared-default-corrected` (#6190) and this branch's
`api-runtime-create-withdrawn` (#5488) both append a SemanticMigration into
step 17's array, sharing the brace above and below.

Resolved UNION-KEEP — neither entry may be lost (#6526). Recounted from the
merged file: 43 step-17 semantic entries, with both #42
(`api-runtime-create-withdrawn`) and #43
(`import-run-automations-declared-default-corrected`) present.

The two generated artifacts were NOT text-merged (the os-regen merge driver
refuses to): `spec-changes.json` and `docs/protocol-upgrade-guide.md` were
regenerated from the merged tree, and both entries are present in each.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PiRUoQkTSBBmpyXBY3cVn2

…14919)

ADR-0049 enforce-or-remove; maintainer ruling 2026-09-05 (director summon #14,
decision batch #42). The class was a shell that reported success: four of its
five private scanners returned an empty issue list unconditionally, and the
fifth matched against an in-memory vulnerability database whose only writer had
zero callers -- so every scan() ever performed answered status: 'passed' with a
perfect score, for a malicious plugin as readily as a benign one. A security
control that cannot fail is worse than none, because callers rely on it.

- delete packages/core/examples/phase2-integration.ts (the only constructor)
- delete src/security/security-scanner.ts; drop its export block from
  src/security/index.ts, leaving a tombstone naming the retirement
- rewrite PHASE2_IMPLEMENTATION.md section 6 to state plainly that plugin
  security scanning is NOT a platform capability, and drop the two capability
  claims elsewhere in the same document that outlived their subject
- delete the FOLLOW-UPS.md row, repair the paragraph that existed only to
  compound it, and correct the neighbouring row whose evidence the deletion
  falsified
- pin the retirement as an export-list assertion on both barrels

Repair was refused by name: a real vulnerability scanner is a feature with a
design surface, not a defect fix. There is no replacement export.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ARYe3yQTQCUFm5qPYNgKaJ

…is not a platform capability (objectstack-ai#15930)

* feat(core)!: retire PluginSecurityScanner across all four surfaces (objectstack-ai#14919)

ADR-0049 enforce-or-remove; maintainer ruling 2026-09-05 (director summon objectstack-ai#14,
decision batch objectstack-ai#42). The class was a shell that reported success: four of its
five private scanners returned an empty issue list unconditionally, and the
fifth matched against an in-memory vulnerability database whose only writer had
zero callers -- so every scan() ever performed answered status: 'passed' with a
perfect score, for a malicious plugin as readily as a benign one. A security
control that cannot fail is worse than none, because callers rely on it.

- delete packages/core/examples/phase2-integration.ts (the only constructor)
- delete src/security/security-scanner.ts; drop its export block from
  src/security/index.ts, leaving a tombstone naming the retirement
- rewrite PHASE2_IMPLEMENTATION.md section 6 to state plainly that plugin
  security scanning is NOT a platform capability, and drop the two capability
  claims elsewhere in the same document that outlived their subject
- delete the FOLLOW-UPS.md row, repair the paragraph that existed only to
  compound it, and correct the neighbouring row whose evidence the deletion
  falsified
- pin the retirement as an export-list assertion on both barrels

Repair was refused by name: a real vulnerability scanner is a feature with a
design surface, not a defect fix. There is no replacement export.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ARYe3yQTQCUFm5qPYNgKaJ

* feat(spec): register the PluginSecurityScanner retirement in the ADR-0087 ledger (objectstack-ai#14919)

check-adr-0087-registration refused the previous disposition, correctly: the
changeset carries a real consumer prescription (delete the import and every
call), so `not-required (no-migration-prescription)` was a self-contradiction.
Every other not-required category is false too -- @objectstack/core publishes,
so `unpublished` is out; `already-registered` has no entry to name;
`type-surface-only` needs an any/unknown-to-concrete narrowing this is not; and
`runtime-interface-only` explicitly inherits the same prescription refusal
(objectstack-ai#8299). The only truthful disposition left is `registered`.

That is also the repo's settled convention for this exact shape -- a published TS
symbol with no spec schema, no stored source and no tombstone, where the ledger
is the only channel that reaches an upgrader. contracts.IDataDriver.findStream
and actor-user-roles-to-positions are both registered on those grounds.

D3 semantic, not a D2 conversion: the class has no spec schema, so there is no
authorable key to tombstone and no stored sys_metadata row to rewrite -- a
scanner was constructed per call and every result lived in a per-instance Map
discarded with the object, so applyConversionsToStoredItem has no seam that would
ever see one. This is what the ruling's "no metadata migration" excludes, and it
is excluded.

- add entries/semantic/18.plugin-security-scanner-retired.ts (one file, per the
  entries README kit -- no hand edit inside registry.ts's generated markers)
- regenerate registry.ts via gen:migration-registry (157 semantic entries)
- flip the core changeset's marker to `registered
  plugin-security-scanner-retired`, keeping the BREAKING banner, the
  no-replacement statement and the NOT MEASURED paragraph untouched
- add the @objectstack/spec patch changeset, mirroring the objectstack-ai#6138 backfill

Measured and recorded in that changeset: the regeneration lap the entries README
warns about did not materialise. check:generated reports all 15 artifacts up to
date, and running gen:spec-changes and gen:upgrade-guide explicitly moved
neither file -- a major-18 semantic entry is not yet projected into either.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ARYe3yQTQCUFm5qPYNgKaJ

* fix(changeset): the `registered` marker takes ids only — move its rationale into the body

check-adr-0087-registration parses everything after `registered` as a
comma/space-separated id list, so the trailing `why` prose that the
`not-required (...)` forms accept was read as 131 nonexistent migration ids. The
asymmetry is real and AGENTS.md spells it: `registered SOME-MIGRATION-ID` carries
no `why`, the three `not-required` forms do. The rationale is unchanged, only
relocated into the changeset body where a reader gets it anyway.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ARYe3yQTQCUFm5qPYNgKaJ

---------

Co-authored-by: Claude <noreply@anthropic.com>