@@ -0,0 +1,23 @@
+---
+'@objectstack/spec': minor
+'@objectstack/objectql': minor
+'@objectstack/metadata': minor
+'@objectstack/runtime': minor
+---
+
+refactor(spec)!: retire the `ragPipelines` collection listings no stack can declare, and with them the `rag_pipeline` metadata type at the `/meta` door (#31380)
+
+Clause-②: no (narrowing) — `PLURAL_TO_SINGULAR` (a published `@objectstack/spec` export, typed `Record<string, string>`) loses its `ragPipelines` row, so `/meta/rag_pipeline` leaves the URL-spelling contract and a write that would start the type's namespace is refused where it was stored before. Nothing is widened.
+Metadata-protocol: narrowed
+
+<!-- adr-0087: registered meta-type-rag-pipeline-retired -->
+
+**BREAKING** for a client that writes metadata under the type `rag_pipeline` through `PUT /meta/rag_pipeline/:name`, or that reads `PLURAL_TO_SINGULAR.ragPipelines` / `SINGULAR_TO_PLURAL.rag_pipeline`.
+
+- **`@objectstack/spec`.** `ragPipelines` is removed from `PLURAL_TO_SINGULAR` (and so from `SINGULAR_TO_PLURAL` and the generated `META_URL_TO_SINGULAR`). The stack schema never declared the key, so `defineStack({ ragPipelines })` was refused before and still is, now with a prescription instead of the bare unrecognized-key message; no stack could ever ship one. Retiring the row takes `rag_pipeline` out of the `/meta` URL-spelling contract, as the `themes` row's retirement did for `theme`: the type now gets the unrecognised-type refusal (`400 INVALID_REQUEST`, "'rag_pipeline' is not a metadata type") at the write door instead of the no-schema branch that stored any JSON, and `GET /meta/types` no longer advertises it as creatable. The refusal is not unconditional: the write door keeps accepting a type whose namespace already exists in the deployment's `sys_metadata`, so a deployment that already holds `rag_pipeline` rows still has schema-less writes to that type accepted until those rows are deleted. The upgrade guide carries the semantic entry `meta-type-rag-pipeline-retired`. No ADR-0087 conversion: no stack source can hold the key, so `os migrate meta` has nothing to rewrite.
+- **`@objectstack/objectql`.** `ragPipelines` leaves the collections the engine registers from a manifest and from a nested plugin. A parsed stack never carried it; only a hand-built manifest handed straight to `registerApp` could, and its `ragPipelines` array is now ignored like any other undeclared key.
+- **`@objectstack/metadata`.** `ragPipelines` leaves the artifact field map; the strict stack parse already refused an artifact definition that carried it.
+- **`@objectstack/runtime`.** `ragPipelines` leaves the app-payload probe that decides whether a bundle with no app id was meant to register an app.
+- **Package export.** `GET /packages/:id/export` and `GET /packages/export` build their collections from `PLURAL_TO_SINGULAR`, so a `rag_pipeline` row a deployment wrote under a package through the old door is no longer exported. Such a row is not rewritten: `/meta` reads still answer and `DELETE /meta/rag_pipeline/:name` still works, so delete the residue rather than rely on an export to carry it. Deleting the last row also closes the namespace, after which a write to the type is refused there too. An older export carrying a non-empty `ragPipelines` array is refused by a customization-pair install, which names the key; an empty one is skipped as before.
+
+**The remedy.** Delete any `ragPipelines` key from a stack source, artifact or hand-built manifest, and stop writing `/meta/rag_pipeline`; nothing replaces it. Retrieval sources are described by the knowledge-source schemas in `@objectstack/spec/ai` and indexed by the knowledge service a deployment installs, not by a stack collection.
@@ -28,7 +28,8 @@ describe('lint — every package-authored name carries the package namespace (ru
     // set by a floor and by the types the decision's audit named.
     expect(Object.keys(NAME_JUDGED_ELSEWHERE).sort()).toEqual(['docs', 'objects', 'views']);
     for (const reason of Object.values(NAME_JUDGED_ELSEWHERE)) expect(reason.length).toBeGreaterThan(20);
-    expect(JUDGED.length).toBeGreaterThanOrEqual(28);
+    // 27, not 28: #31380 retired `ragPipelines` from `PLURAL_TO_SINGULAR`.
+    expect(JUDGED.length).toBeGreaterThanOrEqual(27);
     expect(JUDGED).toEqual(expect.arrayContaining([
       'apps', 'pages', 'dashboards', 'reports', 'datasets', 'actions', 'flows', 'jobs',
       'positions', 'permissions', 'capabilities', 'sharingRules', 'queues', 'assignmentRules',
 
@@ -694,12 +694,13 @@ export class ProtocolDiscoveryAndBasesFacet {
             //
             // What this keeps, and it is the whole point: the legitimate
             // plugin kinds with no static registry entry — `webhook`,
-            // `connector`, `analytics_cube`, `rag_pipeline` — are IN the static
-            // spelling contract (limb 1 of the URL map), so the predicate
-            // accepts them and they stay advertised as creatable. (`theme` and
-            // `sharing_rule` were two more: `theme` left the contract with its
-            // carrier, and ADR-0131 D6 gave `sharing_rule` a code-only registry
-            // entry, so it takes the registry arm above.)
+            // `connector`, `analytics_cube` — are IN the static spelling
+            // contract (limb 1 of the URL map), so the predicate accepts them
+            // and they stay advertised as creatable. (`theme`, `rag_pipeline`
+            // and `sharing_rule` were three more: `theme` left the contract with
+            // its carrier, `rag_pipeline` with its retired listing row — no
+            // stack could declare it — and ADR-0131 D6 gave `sharing_rule` a
+            // code-only registry entry, so it takes the registry arm above.)
             // `PUT /meta/theme/dark` is the operation the plugin path exists to
             // serve and this change must not touch it.
             //
 
@@ -38,13 +38,15 @@
  *  1. **statically declared** (`view`, `hook`, `agent`) — the flag comes off
  *     the registry entry, as it always did, in both the `true` and the `false`
  *     direction;
- *  2. **URL-map-only plugin kinds** (`webhook`, and its three siblings) — no
+ *  2. **URL-map-only plugin kinds** (`webhook`, and its two siblings) — no
  *     registry entry, IN the static spelling contract, still advertised and
  *     still mintable. This is the discriminating control: without it the change
  *     cannot show its narrowing is narrow;
  *  3. **withdrawn** (`policy`, `data`, `package`, `kind` — and, since commit 35ad101bc,
  *     `theme`, whose carrier retired out of the spelling contract while legacy
- *     stored rows can still hold the key live) — live `SchemaRegistry` keys,
+ *     stored rows can still hold the key live, and `rag_pipeline`, which left
+ *     the contract the same way when its listing row was retired) — live
+ *     `SchemaRegistry` keys,
  *     in NEITHER half of the static contract, advertised `false` and refused.
  *
  * Harness: the real `getMetaTypes()` and the real `saveMetaItem()` on one
@@ -54,6 +56,11 @@
  * is where `data`, `kind` and `package` come from in production, and why the
  * listing must have an opinion about them at all.
  */
+// `@objectstack/lint` is reached through the save door's author-time gate, a
+// dynamic `import()` (`metadata-diagnostics.ts`). Paid here, at collection, so no
+// case's `testTimeout` window pays that first load
+// (`scripts/check-test-source-alias.mjs`, "The source reach").
+import '@objectstack/lint';
 import { describe, expect, it } from 'vitest';
 // [#5619] The producer's OWN write-verb dispatch decisions, so the fake engine
 // below cannot accept a call ObjectQL itself refuses.
@@ -191,6 +198,17 @@ const SAMPLE: Array<{
         creatable: false,
         item: { name: 'probe_theme', label: 'Probe', colors: { primary: '#3b82f6' } },
     },
+    {
+        // `rag_pipeline` moved from class 2 to class 3 exactly as `theme` did: its
+        // `ragPipelines` listing row retired out of the spelling contract (ADR-0049 —
+        // no stack could declare the collection), while a legacy environment's
+        // stored rows can still hold the key in the live set. Until then it was
+        // class 2's one kind with no schema at all.
+        type: 'rag_pipeline',
+        klass: 'withdrawn',
+        creatable: false,
+        item: { name: 'probe_rag_pipeline', label: 'Probe' },
+    },
     { type: 'policy', klass: 'withdrawn', creatable: false, item: { name: 'probe_policy', label: 'Probe' } },
     { type: 'data', klass: 'withdrawn', creatable: false, item: { name: 'probe_data', label: 'Probe' } },
     { type: 'package', klass: 'withdrawn', creatable: false, item: { name: 'probe_package', label: 'Probe' } },
@@ -261,17 +279,18 @@ describe('#8421 — the read door and the mint door agree, across all three clas
         }
     });
 
-    it('the four URL-map-only plugin kinds are ALL still advertised as creatable', async () => {
+    it('the three URL-map-only plugin kinds are ALL still advertised as creatable', async () => {
         // The blanket-flip guard, quantified rather than sampled. `webhook`
         // above is the one driven end-to-end through a write; the others have
         // no hand-written spec-valid body here, so they are pinned on the door
         // that this change actually moved — the advertisement. Breaking any of
         // them is the one outcome that would make this change worse than the
-        // defect it closes. (`theme` left the set at commit 35ad101bc.)
+        // defect it closes. (`theme` left the set at commit 35ad101bc, and
+        // `rag_pipeline` when its listing row was retired.)
         const { protocol } = makeProtocol();
         const listing = await protocol.getMetaTypes();
         for (const kind of [
-            'analytics_cube', 'connector', 'rag_pipeline', 'webhook',
+            'analytics_cube', 'connector', 'webhook',
         ]) {
             const entry = listing.entries.find((e: any) => e.type === kind);
             expect(entry, `${kind} must be listed`).toBeDefined();
 
@@ -51,6 +51,11 @@
  * `protocol.code-only-types.test.ts` uses. A gate INSIDE `saveMetaItem` cannot
  * be measured against a harness that mocks `saveMetaItem`.
  */
+// `@objectstack/lint` is reached through the save door's author-time gate, a
+// dynamic `import()` (`metadata-diagnostics.ts`). Paid here, at collection, so no
+// case's `testTimeout` window pays that first load
+// (`scripts/check-test-source-alias.mjs`, "The source reach").
+import '@objectstack/lint';
 import { describe, expect, it } from 'vitest';
 // [#5619] The producer's OWN write-verb dispatch decisions, so the fake engine
 // below cannot accept a call ObjectQL itself refuses.
@@ -180,6 +185,18 @@ describe('#8421 — an unrecognised `/meta` type is refused instead of minted',
         expect(metaRows(rows).length).toBe(0);
     });
 
+    it('`rag_pipeline` is on the refused side too — its listing row was retired', async () => {
+        // The same exit as `theme`: `rag_pipeline` was a URL-map-only kind with no
+        // schema, so this door stored any JSON under it. Its `ragPipelines` fold
+        // left `PLURAL_TO_SINGULAR` (ADR-0049 — no stack could declare the
+        // collection), so it now earns the same refusal, and nothing is stored.
+        const { protocol, rows } = makeProtocol();
+        await expect(
+            protocol.saveMetaItem({ type: 'rag_pipeline', name: 'my_pipeline', item: { name: 'my_pipeline', label: 'Test' } }),
+        ).rejects.toMatchObject({ code: 'INVALID_REQUEST', status: 400 });
+        expect(metaRows(rows).length).toBe(0);
+    });
+
     it('names the offending type and why, per the 2026-08-12 refusal ruling', async () => {
         const { protocol } = makeProtocol();
         await expect(
 
@@ -194,7 +194,10 @@ const ARTIFACT_FIELD_TO_TYPE: Record<string, string> = {
     agents: 'agent',
     tools: 'tool',
     skills: 'skill',
-    ragPipelines: 'rag_pipeline',
+    // `ragPipelines: 'rag_pipeline'` removed (ADR-0049 enforce-or-remove), the
+    // fourth retirement of the `policies` shape: the stack schema declares no
+    // `ragPipelines` key, so the strict parse below refuses a definition that
+    // carries one and this entry could never match.
     hooks: 'hook',
     mappings: 'mapping',
     // Shared option lists. Registered as items here so the artifact boot
 
@@ -174,7 +174,6 @@ describe('the two registration seams enumerate ONE collection list (#7049)', ()
     ['roles', 'ADR-0090 retired'],
     ['profiles', 'ADR-0088 retired'],
     ['policies', 'ADR-0088 retired'],
-    ['ragPipelines', 'not declared by ObjectStackDefinitionSchema'],
   ];
 
   const excluded = new Set(NOT_COMPARABLE.map(([k]) => k));
@@ -224,8 +223,10 @@ describe('the two registration seams enumerate ONE collection list (#7049)', ()
     // `views` left this list in #7163 — the only entry that was ever excluded
     // for a BEHAVIOUR difference rather than a retired-kind one. Every survivor
     // is a kind the schema rejects before either seam runs.
+    // `ragPipelines` left too: never declared by the stack schema, it was
+    // retired from the engine's list itself (ADR-0049), not merely excluded here.
     expect(NOT_COMPARABLE.map(([k]) => k)).toEqual([
-      'workflows', 'approvals', 'roles', 'profiles', 'policies', 'ragPipelines',
+      'workflows', 'approvals', 'roles', 'profiles', 'policies',
     ]);
     expect(NOT_COMPARABLE.map(([k]) => k)).not.toContain('views');
   });
 
@@ -4082,8 +4082,9 @@ const METADATA_ARRAY_KEYS = [
   // queue service, the assignment seam), so a declaration must reach it with
   // its package stamped, as every collection on this list does.
   'queues', 'assignmentRules',
-  // AI Protocol
-  'agents', 'tools', 'skills', 'ragPipelines',
+  // AI Protocol. (`ragPipelines` was retired from this list under ADR-0049:
+  // the stack schema never declared it, so no stack could ship one.)
+  'agents', 'tools', 'skills',
   // API Protocol
   'apis',
   // Data Extensions
 
@@ -446,7 +446,7 @@ describe('ADR-0130 D4 — the manifest service registers every other residual ty
     apps: 'app', pages: 'page', dashboards: 'dashboard', reports: 'report', actions: 'action',
     workflows: 'workflow', positions: 'position', permissions: 'permission', capabilities: 'capability',
     sharingRules: 'sharing_rule', apis: 'api', webhooks: 'webhook', agents: 'agent', tools: 'tool',
-    skills: 'skill', ragPipelines: 'rag_pipeline', hooks: 'hook', mappings: 'mapping',
+    skills: 'skill', hooks: 'hook', mappings: 'mapping',
     analyticsCubes: 'analytics_cube', emailTemplates: 'email_template', docs: 'doc', books: 'book',
   };
   const itemOf = (type: string) => ({ name: `acme_top_${type}`, label: `Top ${type}` });
 
@@ -15,10 +15,11 @@
  *      (#19586) the refusal must be the SCHEMA's, naming the broken field —
  *      never an author-time gate rule, which throws the same envelope.
  *
- * Types without a Zod schema in the central registry (today only
- * `rag_pipeline` among the URL-map kinds — `theme`/`webhook` and their
- * siblings all resolve schemas via `UNREGISTERED_KIND_SCHEMAS` since
- * #6245 / commit 2306a765c) are still expected to pass through unvalidated — that is
+ * Types without a Zod schema in the central registry (none among the URL-map
+ * kinds today — `webhook` and its siblings all resolve schemas via
+ * `UNREGISTERED_KIND_SCHEMAS` since #6245 / commit 2306a765c, and `rag_pipeline`,
+ * the last schema-less one, left the URL-spelling contract when its listing row
+ * was retired) are still expected to pass through unvalidated — that is
  * the documented fall-through, not a regression. We pin it explicitly so any
  * future coverage gap is visible in the report.
  *