[Core release blocker] Refuse Pro databases on every surface and add the contact entry point (ADR-081 step 3) #3413

Core release blocker. This carries out step 3 of ADR-081's migration, the last gate before core's first release (step 4). After it, no released core build can open a Pro database, and core has exactly one, contact-only reference to the paid product.

Decisions

• ADR-083 §2: required_extensions and the Pro-database guard
• ADR-084 §1: the contact entry point and the refusal's download link
• ADR-082 §3.2: the replaceable slot collaboration.entry
• ADR-081 §2b, §8: the only places core names the paid product, and the one ratchet allowlist entry

Acceptance criteria

required_extensions and the open guard

• The database-settings schema declares required_extensions: a list of strings, empty by default, stored in the base bucket so it survives a retype to a subtype.
• The daemon's shared services take the set of supported extension ids, which is empty in core.
• On every database open, before any seeding or write, the daemon reads the settings singleton's required_extensions. If any entry is unsupported:
  • the open fails with FAILED_PRECONDITION, reason requires_extension, and the unsupported ids;
  • nothing is written to the file (a test checks the file is byte-identical);
  • the daemon keeps serving other databases, including when the refused database is the registry default.
• This is not a security control, and the code comments say so: the file is plain SQLite.

The refusal on every surface

• App: "This database needs NodeSpace Pro" for pro, or "This database needs an extension this app doesn't support (‹id›)" otherwise. It shows a "Download NodeSpace Pro" link, a compile-time constant pointing at https://nodespace.ai until a direct link exists, and actions to switch to another registered database or create a new one. No contact link. It never offers to move or modify the file.
• CLI: any command routed to such a database exits non-zero with the same message, and nodespace db list marks the database.
• Tray: the Databases menu marks the database.
• Skill guidance: SKILL.md / references/cli.md describe the new CLI error and the db list marker. They tell the agent not to retry, move or edit the file, and to tell the user the database needs NodeSpace Pro. The SKILL.md drift check passes.
• The extension-id display names (pro → "NodeSpace Pro") and the download-link constant live in one module, which is the only entry in scripts/check-pro-boundary.ts's allowlist. It exempts only that string.

Contact entry point

• The Labs "Team synchronization" card reads "Want team collaboration? Contact us", with the mailto:developer@nodespace.ai link opened through openUrl. Core sends nothing else and makes no network request for it.
• Core renders the card as the default content of the replaceable slot collaboration.entry. The default renders only while no contribution is registered for the slot, and stays suppressed even if a registered contribution is hidden, throws or fails to load.
• Unit tests pin the mailto and download-link constants. Component tests use a fixture contribution to cover the slot's default and its suppression.

Gate

• bun run test:changed passes, and the merge gate passes. Core's first release can be cut after this lands.

Supersedes

The website-entry plan of the earlier ADR drafts was replaced by the contact card. This issue supersedes #3358 (the slot is now collaboration.entry), #3359, #3360 and #3362, and the entry-point half of #3361.

Dependencies

• Blocked by [Core release blocker] Strip all Pro code, edition branching and sync/ACL state from core in one pass (ADR-081 steps 0 and 2) #3412 (the one-pass strip: it removes the Labs switch and the settings-node sync fields this builds on), and through it NodeSpaceAI/nodespace-sync#517.
• Blocks core's first release (ADR-081 step 4).
• Pro rebuild (after core release): finish core's extension points for typed subtypes, edge fields and Pro UI (ADR-082) #3414 later replaces the guard's fixed empty supported-extension set with the registration hook.

References

Read these before starting. They are the source of truth; where this issue and an ADR disagree, the ADR wins.

• ADR-081: Pro is a separate app; core ships no Pro code
• ADR-082: Core extension points for the Pro app
• ADR-083: Pro-owned state leaves the core data model
• ADR-084: Core-to-Pro upgrade and install flow