config.storage authored with driver/root is silently ignored — a host asking for S3 gets local disk #4167

Found while fixing #4096 (PR #4166), which corrected the same mismatch one layer down. Filing rather than papering over, because the fix is a contract decision (AGENTS.md Prime Directive #12).

The mismatch

StorageServicePluginOptions declares:

{ adapter?: 'local' | 's3'; local?: LocalStorageAdapterOptions; s3?: { bucket; region; endpoint? }; … }

There is no driver and no root. But serve forwards a host's config.storage block verbatim as soon as it names either dialect:

if (cfgStorage && (cfgStorage.driver || cfgStorage.adapter)) {
  return { options: cfgStorage };
}

So a config authored as { driver: 's3', bucket: '…' } is accepted by the branch, passed to the plugin, and every key is dropped. The constructor's { adapter: 'local', ...options } default then applies and the host silently gets local disk — while believing it configured S3.

TypeScript does not catch it: the value is an untyped config field, and an object literal reaching a parameter whose interface has no index signature type-checks fine while doing nothing at runtime.

Why this is worth a decision, not a shim

#4096 was the same bug in serve's own fallback ({ driver: 'local', root }), where the consequence was a wrong upload directory plus a bogus migration warning on every boot. That one I fixed at the producer, because serve owns both ends.

This one crosses an authoring boundary, so the two honest options are:

1. The config schema is right and the plugin should accept the driver/root dialect — then it belongs in a declared conversion/alias shim (the ADR-0087 conversion layer or readAliasedConfig), warned once and removable on a schedule, not a bare ??.
2. The plugin's shape is canonical and the driver/root dialect is wrong — then config.storage should be validated at authoring/compile time so an unrecognised block is rejected loudly instead of silently downgrading to local disk.

Either way the current state — accepted, ignored, no diagnostic — is the declared ≠ enforced shape Prime Directive #10 is about. Note that whichever is chosen, serve's branch condition also needs revisiting: it currently treats the mere presence of driver as "the host configured a backend", which is what routes an unreadable block past the working default.

Repro

// objectstack.config.ts
export default {
  // …
  storage: { driver: 's3', bucket: 'my-bucket', region: 'us-east-1' },
};

Boot with os serve. Files are written to local disk under the plugin's default root; nothing reports that the S3 configuration was discarded.

Scope note

Untouched by #4166, which deliberately keeps forwarding the block verbatim — the helper's doc comment records why, so the next reader does not "tidy" it into an alias.