fix(runtime): honour external.validation.checkOnBoot in the boot sweep (#13037) (#13149)

`checkOnBoot` was declared on `DatasourceSchema` with `.default(true)` and read
by nothing: `ExternalValidationPlugin.start` hooked `kernel:ready` and called
`runValidation(ctx)` unconditionally. An author who wrote `checkOnBoot: false`
and left `onMismatch` at its default still got the boot sweep, and a measured
mismatch still aborted boot with `ExternalSchemaMismatchError`.

The sweep now resolves each datasource's parsed `checkOnBoot` and drops the
rows of any datasource that set `false` before a verdict is drawn from them:
no `onMismatch` policy, no unreachable-remote warning, not counted in the
all-clear, and one info line naming what was skipped. `true` or absent leaves
the sweep exactly as it was. Uncertainty resolves towards validating — an
absent key, a legacy stored row, or a definition the metadata service could
not read is checked, never inferred to have opted out.

Scope pinned at the maintainer's ruling: the boot step only.
`scheduleDriftChecks()` / `checkIntervalMs` stay independent, stated in an
in-place comment at both read points and held by a test.


Claude-Session: https://claude.ai/code/session_01UjujZN219uFzBhSYfMykCd

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-litant

.changeset/external-validation-checkonboot-enforced.md

@@ -0,0 +1,53 @@
+---
+"@objectstack/runtime": patch
+---
+
+fix(runtime): honour `datasource.external.validation.checkOnBoot` in the boot validation sweep (#13037)
+
+`checkOnBoot` has been declared on `DatasourceSchema` — with `.default(true)` —
+since the `external.validation` block was written, and **nothing read it**. Its
+two block-mates are read (`onMismatch` by `resolveOnMismatch()`,
+`checkIntervalMs` by `scheduleDriftChecks()`), which is what made the gap legible
+rather than a whole-block miss: `ExternalValidationPlugin.start` hooked
+`kernel:ready` and called `runValidation(ctx)` with no condition on it.
+
+So an author who wrote `validation: { checkOnBoot: false }` and left `onMismatch`
+at its default got the boot sweep anyway, and a measured mismatch threw
+`ExternalSchemaMismatchError` and **aborted boot** — the exact outcome the key
+reads as opting out of. The `.default(true)` made it worse than an ignored key:
+the knob is materialized into every parse output, so a dead setting is
+byte-identical to an honoured one in stored and serialized datasources, and
+neither an author, an AI author, nor someone reading the metadata store could
+tell which one they had.
+
+Maintainer ruling 2026-08-29 — ADR-0049 disposition **enforce, not remove**:
+
+- `checkOnBoot: false` ⇒ that datasource is skipped by the `kernel:ready` sweep.
+  No `onMismatch` policy is applied to its rows, so a measured mismatch on it can
+  no longer abort startup; its unreachable-remote rows raise no boot warning; and
+  its objects are not counted in the all-clear. The skip is logged once, naming
+  the datasources and stating that the verdict beside it covers the remaining
+  ones only.
+- `checkOnBoot: true` or absent ⇒ today's behaviour, unchanged — a measured
+  mismatch still throws `ExternalSchemaMismatchError` and aborts boot under the
+  default `onMismatch: 'fail'`.
+
+The gate is **per datasource**, because the sweep is whole-farm and the key is
+per-source: in one boot, an opted-out datasource does not suppress another
+datasource's abort. Every uncertainty resolves towards running the check — an
+absent key, an unparsed or legacy stored row, a managed datasource with no
+`external` block, and a definition the metadata service could not read are all
+validated, never inferred to have opted out.
+
+**Scope, pinned at the ruling: the boot step only.** `scheduleDriftChecks()` and
+its `external.validation.checkIntervalMs` read point stay independent — a
+datasource that opts out of the boot check keeps whatever background drift
+checking it armed. The two keys answer different questions ("gate my startup on
+this" versus "watch this while I run"), and both the code comment and a test hold
+that boundary.
+
+Not a contract-face change: no schema, no key, and no accepted spelling moves.
+`checkonboot` and `validateonboot` remain what they already were — entries in the
+`strictObject` rejection table that refuse the misspelling and prescribe
+`checkOnBoot` — so `checkOnBoot` is the single authorable spelling and the gate
+has a single read point.