docs(skills): land the app-repo working principles in the published catalog

[claude]

Fixes#13848

Lands the objectstack half of the 2026-08-31 app-repo principles. The hotcrm half already landed (hotcrm PR 1438); this PR discharges the card's whole remaining range — the published-skills universal items and the pm-dispatch decision-analysis clause — so the card closes with it.

⛔ Human merge required — this PR raises five shrink-only token ceilings

Governed surface, draft only. The raise is ⛔ MAINTAINER-ONLY territory and is taken here because the ruling that authorizes it names this landing surface by name. Verbatim and untranslated, recorded on the card:

「元数据应用就应该是在平台的规范下，基于skills 写元数据，并且使用平台提供的os命令校验元数据的合法性，而不是重新造轮子。这个也应该进入 hotcrm 的规范，甚至是 objectstack 的skills」

and, for the escape-hatch ladder (same day):

「或者说 skills 应该说明，逃生仓是极端场景按照客户需求自定义的场景下才需要，应该尽量避免。」

The reviewer's call is whether 900 ceiling tokens is the right price for these principles. Everything else here is mechanical.

Landing map — where each item went, and why

The card's spec rows are domain-scoped, and published skills are loaded per domain, so each rule sits where the reader is at the moment the mistake is available — not collected into one section a data-schema author never loads.

Spec row	Rule	Landed in	Anchor
1	App is a simplified business implementation: metadata under the spec, authored from skills, checked with os; capability gaps go upstream	skills/objectstack-platform/SKILL.md	new section "The App / Platform Boundary"
2	Platform defect means wait for the fix — no workaround, no half-landing; blocked-by; verify the pin and re-run the repro before resuming	same section	same
4	A bad platform default is a default to fix	same section	same
5	Docs explain business concepts, not hand-copied machine inventories	skills/objectstack-ui/SKILL.md	Docs — Package Documentation, after the authoring rules
7	Invariant vs transition gate: validations[] vs requiredWhen / bounds	skills/objectstack-data/SKILL.md	the field-conditional-rule bullet list, beside requiredWhen
8	Blocking rests on a human judgement; no override escape hatch	skills/objectstack-data/rules/validation.md	Validation Properties — Severity Levels
9	Screen flow stays runAs: 'user'; elevated writes move into a subflow	skills/objectstack-automation/SKILL.md	beside the existing readonly blockquote
10	A runAs: 'system' sweep pins an organization predicate; tenant column is platform-injected	same file	same
Principle 5	The section ladder: derive, then group reference, then hand enumeration last	skills/objectstack-ui/SKILL.md	Record Presentation, beside "let the platform lay it out"
Clause ②	App-repo exception to the recommendation order	.claude/skills/pm-dispatch/references/decision-analysis.md	adjacent to the 四棱分歧推荐序 段

Row 9 corrects a real drift rather than only adding: the existing readonly blockquote says a flow maintaining a readonly field must run runAs: 'system'. True of the scheduled flow it was written for; read by an agent writing a screen flow it says "elevate the whole screen flow", which elevates every other write in it.

Principle 5 also required fixing the page that taught the rung it demotes: this file's two worked sections examples enumerated their members. Both now reference a declared group, which is what the ruling asks for and is also shorter.

Budgets — before / after

Token ratchet (node scripts/check-skills-token-ratchet.mjs), unit ceil(utf8 bytes / 4):

File	Tokens before	Tokens after	Growth	Ceiling before	Ceiling after	Raise
skills/objectstack-platform/SKILL.md	12704	12984	+280	12705	12984	+279
skills/objectstack-ui/SKILL.md	25143	25445	+302	25143	25445	+302
skills/objectstack-data/SKILL.md	13782	13892	+110	13783	13892	+109
skills/objectstack-data/rules/validation.md	3024	3109	+85	3024	3109	+85
skills/objectstack-automation/SKILL.md	12618	12768	+150	12643	12768	+125
Total			+927			+900

Growth exceeds the raise by 27 because three rows carried that much existing headroom, which is spent first. Whole shipped bundle: 186567 to 187494 tokens (+0.50 percent).

Paid down before raising: the only genuine deletion available was the two sections examples in the ui row, worth 13 tokens, and it is the fix the ruling asks for rather than a payment invented to fund the raise. Nothing else in these five files had text the new rules make redundant, so further funding would have meant deleting a live fact with no other home — the stop condition, not a budget.

The SKILL.md subtotal self-test pin shifts 118095 to 118910, exactly the 815 raised on the four SKILL.md rows (the fifth row is not a SKILL.md and correctly does not move it), so the id-strip's lowering claim keeps its original 80 tokens of slack. Same operation the 2026-08-27 pm-dispatch raise performed.

Line ratchet (node scripts/pm/check-skill-line-ratchet.mjs): decision-analysis.md stays 46 / 46 lines, no raise. The new clause is funded entirely by reflowing two paragraphs with the gate's own wrapLine, which frees exactly two lines. Widest-table-row pin unchanged at 0.

A regression this PR caused and fixed

The first commit put the authority block between the SHRINK-ONLY doc comment and export const CEILINGS, which pushed that testimony outside the 400-byte anchor window check-ratchet-remedy-authority.mjs searches around every CEILINGS mention. The farm-wide detector then classified the gate excluded instead of marked — MISCLASSIFIED, i.e. it reported that a gate had silently left the maintainer-only convention. Measured green on origin/main and red on the branch, so the regression was this PR's, not pre-existing. Second commit moves the block above the doc comment and records the constraint in place.

Worth noting for review: that gate is not in the family scripts/pm/dispatch-gates.mjs derives for these paths. It was run because a ratchet edit is exactly what it polices.

Verification

Gate union run after the final commit, at fa2a2ef70. Exit codes captured before any pipe (cmd > log 2>&1; EXIT=$?); each verdict read from the gate's own printed line.

36 gates run: the 32 the dispatch-gates family derives for this changeset (asserted with --repo objectstack-ai/objectstack), plus check:nul-bytes, check-skill-line-ratchet, the token ratchet's --self-test (64 cases), and check-ratchet-remedy-authority.

• 34 green, including check:doc-authoring, check:corpus-claim-drift, check:skill-frame-sync, check:skill-compatibility, check:skill-identifier-liveness, check:role-word, check:pm-skill-id-lint, check:pm-skill-ratchet, check:pm-governed-merges, check:nul-bytes, both ratchets and both self-tests.
• check:doc-formula-expressions needed @objectstack/formula and @objectstack/lint built first; after building both it is green (22 record-scoped examples, 9 spec TSDoc examples, 14 field-level predicates, all clean).
• check-test-completeness is NOT MEASURED locally, by construction: it parses a test-run log, the derived family names it with no argument, and the gate itself prints that this branch is unreachable in CI and is not a red. CI is authoritative for it.

Changeset

None, per the three immediate precedents for skills-only PRs on this surface (PRs 14001, 13972, 13891 — none carried one). skip-changeset label applied at PR open.

Out of scope

No hotcrm files, no content/docs/releases/, no pm-dispatch SKILL.md main-file growth. The nav-item-type rows of card 13890 are a different card queued behind this one on the ui SKILL.md face and are not touched here.

Generated by Claude Code

---

Generated by Claude Code

[claude]

Fixes#13848

Lands the objectstack half of the 2026-08-31 app-repo principles. The hotcrm half already landed (hotcrm PR 1438); this PR discharges the card's whole remaining range — the published-skills universal items and the pm-dispatch decision-analysis clause — so the card closes with it.

⛔ Human merge required — this PR raises five shrink-only token ceilings

Governed surface, draft only. The raise is ⛔ MAINTAINER-ONLY territory and is taken here because the ruling that authorizes it names this landing surface by name. Verbatim and untranslated, recorded on the card:

「元数据应用就应该是在平台的规范下，基于skills 写元数据，并且使用平台提供的os命令校验元数据的合法性，而不是重新造轮子。这个也应该进入 hotcrm 的规范，甚至是 objectstack 的skills」

and, for the escape-hatch ladder (same day):

「或者说 skills 应该说明，逃生仓是极端场景按照客户需求自定义的场景下才需要，应该尽量避免。」

The reviewer's call is whether 900 ceiling tokens is the right price for these principles. Everything else here is mechanical.

Landing map — where each item went, and why

The card's spec rows are domain-scoped, and published skills are loaded per domain, so each rule sits where the reader is at the moment the mistake is available — not collected into one section a data-schema author never loads.

Spec row	Rule	Landed in	Anchor
1	App is a simplified business implementation: metadata under the spec, authored from skills, checked with os; capability gaps go upstream	skills/objectstack-platform/SKILL.md	new section "The App / Platform Boundary"
2	Platform defect means wait for the fix — no workaround, no half-landing; blocked-by; verify the pin and re-run the repro before resuming	same section	same
4	A bad platform default is a default to fix	same section	same
5	Docs explain business concepts, not hand-copied machine inventories	skills/objectstack-ui/SKILL.md	Docs — Package Documentation, after the authoring rules
7	Invariant vs transition gate: validations[] vs requiredWhen / bounds	skills/objectstack-data/SKILL.md	the field-conditional-rule bullet list, beside requiredWhen
8	Blocking rests on a human judgement; no override escape hatch	skills/objectstack-data/rules/validation.md	Validation Properties — Severity Levels
9	Screen flow stays runAs: 'user'; elevated writes move into a subflow	skills/objectstack-automation/SKILL.md	beside the existing readonly blockquote
10	A runAs: 'system' sweep pins an organization predicate; tenant column is platform-injected	same file	same
Principle 5	The section ladder: derive, then group reference, then hand enumeration last	skills/objectstack-ui/SKILL.md	Record Presentation, beside "let the platform lay it out"
Clause ②	App-repo exception to the recommendation order	.claude/skills/pm-dispatch/references/decision-analysis.md	adjacent to the 四棱分歧推荐序 段

Row 9 corrects a real drift rather than only adding: the existing readonly blockquote says a flow maintaining a readonly field must run runAs: 'system'. True of the scheduled flow it was written for; read by an agent writing a screen flow it says "elevate the whole screen flow", which elevates every other write in it.

Principle 5 also required fixing the page that taught the rung it demotes: this file's two worked sections examples enumerated their members. Both now reference a declared group, which is what the ruling asks for and is also shorter.

Budgets — before / after

Token ratchet (node scripts/check-skills-token-ratchet.mjs), unit ceil(utf8 bytes / 4):

File	Tokens before	Tokens after	Growth	Ceiling before	Ceiling after	Raise
skills/objectstack-platform/SKILL.md	12704	12984	+280	12705	12984	+279
skills/objectstack-ui/SKILL.md	25143	25445	+302	25143	25445	+302
skills/objectstack-data/SKILL.md	13782	13892	+110	13783	13892	+109
skills/objectstack-data/rules/validation.md	3024	3109	+85	3024	3109	+85
skills/objectstack-automation/SKILL.md	12618	12768	+150	12643	12768	+125
Total			+927			+900

Growth exceeds the raise by 27 because three rows carried that much existing headroom, which is spent first. Whole shipped bundle: 186567 to 187494 tokens (+0.50 percent).

Paid down before raising: the only genuine deletion available was the two sections examples in the ui row, worth 13 tokens, and it is the fix the ruling asks for rather than a payment invented to fund the raise. Nothing else in these five files had text the new rules make redundant, so further funding would have meant deleting a live fact with no other home — the stop condition, not a budget.

The SKILL.md subtotal self-test pin shifts 118095 to 118910, exactly the 815 raised on the four SKILL.md rows (the fifth row is not a SKILL.md and correctly does not move it), so the id-strip's lowering claim keeps its original 80 tokens of slack. Same operation the 2026-08-27 pm-dispatch raise performed.

Line ratchet (node scripts/pm/check-skill-line-ratchet.mjs): decision-analysis.md stays 46 / 46 lines, no raise. The new clause is funded entirely by reflowing two paragraphs with the gate's own wrapLine, which frees exactly two lines. Widest-table-row pin unchanged at 0.

A regression this PR caused and fixed

The first commit put the authority block between the SHRINK-ONLY doc comment and export const CEILINGS, which pushed that testimony outside the 400-byte anchor window check-ratchet-remedy-authority.mjs searches around every CEILINGS mention. The farm-wide detector then classified the gate excluded instead of marked — MISCLASSIFIED, i.e. it reported that a gate had silently left the maintainer-only convention. Measured green on origin/main and red on the branch, so the regression was this PR's, not pre-existing. Second commit moves the block above the doc comment and records the constraint in place.

Worth noting for review: that gate is not in the family scripts/pm/dispatch-gates.mjs derives for these paths. It was run because a ratchet edit is exactly what it polices.

Verification

Gate union run after the final commit, at fa2a2ef70. Exit codes captured before any pipe (cmd > log 2>&1; EXIT=$?); each verdict read from the gate's own printed line.

36 gates run: the 32 the dispatch-gates family derives for this changeset (asserted with --repo objectstack-ai/objectstack), plus check:nul-bytes, check-skill-line-ratchet, the token ratchet's --self-test (64 cases), and check-ratchet-remedy-authority.

• 34 green, including check:doc-authoring, check:corpus-claim-drift, check:skill-frame-sync, check:skill-compatibility, check:skill-identifier-liveness, check:role-word, check:pm-skill-id-lint, check:pm-skill-ratchet, check:pm-governed-merges, check:nul-bytes, both ratchets and both self-tests.
• check:doc-formula-expressions needed @objectstack/formula and @objectstack/lint built first; after building both it is green (22 record-scoped examples, 9 spec TSDoc examples, 14 field-level predicates, all clean).
• check-test-completeness is NOT MEASURED locally, by construction: it parses a test-run log, the derived family names it with no argument, and the gate itself prints that this branch is unreachable in CI and is not a red. CI is authoritative for it.

Changeset

None, per the three immediate precedents for skills-only PRs on this surface (PRs 14001, 13972, 13891 — none carried one). skip-changeset label applied at PR open.

Out of scope

No hotcrm files, no content/docs/releases/, no pm-dispatch SKILL.md main-file growth. The nav-item-type rows of card 13890 are a different card queued behind this one on the ui SKILL.md face and are not touched here.

Generated by Claude Code

---

Generated by Claude Code

[claude]

Fixes#13848

Lands the objectstack half of the 2026-08-31 app-repo principles. The hotcrm half already landed (hotcrm PR 1438); this PR discharges the card's whole remaining range — the published-skills universal items and the pm-dispatch decision-analysis clause — so the card closes with it.

⛔ Human merge required — this PR raises five shrink-only token ceilings

Governed surface, draft only. The raise is ⛔ MAINTAINER-ONLY territory and is taken here because the ruling that authorizes it names this landing surface by name. Verbatim and untranslated, recorded on the card:

「元数据应用就应该是在平台的规范下，基于skills 写元数据，并且使用平台提供的os命令校验元数据的合法性，而不是重新造轮子。这个也应该进入 hotcrm 的规范，甚至是 objectstack 的skills」

and, for the escape-hatch ladder (same day):

「或者说 skills 应该说明，逃生仓是极端场景按照客户需求自定义的场景下才需要，应该尽量避免。」

The reviewer's call is whether 900 ceiling tokens is the right price for these principles. Everything else here is mechanical.

Landing map — where each item went, and why

The card's spec rows are domain-scoped, and published skills are loaded per domain, so each rule sits where the reader is at the moment the mistake is available — not collected into one section a data-schema author never loads.

Spec row	Rule	Landed in	Anchor
1	App is a simplified business implementation: metadata under the spec, authored from skills, checked with os; capability gaps go upstream	skills/objectstack-platform/SKILL.md	new section "The App / Platform Boundary"
2	Platform defect means wait for the fix — no workaround, no half-landing; blocked-by; verify the pin and re-run the repro before resuming	same section	same
4	A bad platform default is a default to fix	same section	same
5	Docs explain business concepts, not hand-copied machine inventories	skills/objectstack-ui/SKILL.md	Docs — Package Documentation, after the authoring rules
7	Invariant vs transition gate: validations[] vs requiredWhen / bounds	skills/objectstack-data/SKILL.md	the field-conditional-rule bullet list, beside requiredWhen
8	Blocking rests on a human judgement; no override escape hatch	skills/objectstack-data/rules/validation.md	Validation Properties — Severity Levels
9	Screen flow stays runAs: 'user'; elevated writes move into a subflow	skills/objectstack-automation/SKILL.md	beside the existing readonly blockquote
10	A runAs: 'system' sweep pins an organization predicate; tenant column is platform-injected	same file	same
Principle 5	The section ladder: derive, then group reference, then hand enumeration last	skills/objectstack-ui/SKILL.md	Record Presentation, beside "let the platform lay it out"
Clause ②	App-repo exception to the recommendation order	.claude/skills/pm-dispatch/references/decision-analysis.md	adjacent to the 四棱分歧推荐序 段

Row 9 corrects a real drift rather than only adding: the existing readonly blockquote says a flow maintaining a readonly field must run runAs: 'system'. True of the scheduled flow it was written for; read by an agent writing a screen flow it says "elevate the whole screen flow", which elevates every other write in it.

Principle 5 also required fixing the page that taught the rung it demotes: this file's two worked sections examples enumerated their members. Both now reference a declared group, which is what the ruling asks for and is also shorter.

Budgets — before / after

Token ratchet (node scripts/check-skills-token-ratchet.mjs), unit ceil(utf8 bytes / 4):

File	Tokens before	Tokens after	Growth	Ceiling before	Ceiling after	Raise
skills/objectstack-platform/SKILL.md	12704	12984	+280	12705	12984	+279
skills/objectstack-ui/SKILL.md	25143	25445	+302	25143	25445	+302
skills/objectstack-data/SKILL.md	13782	13892	+110	13783	13892	+109
skills/objectstack-data/rules/validation.md	3024	3109	+85	3024	3109	+85
skills/objectstack-automation/SKILL.md	12618	12768	+150	12643	12768	+125
Total			+927			+900

Growth exceeds the raise by 27 because three rows carried that much existing headroom, which is spent first. Whole shipped bundle: 186567 to 187494 tokens (+0.50 percent).

Paid down before raising: the only genuine deletion available was the two sections examples in the ui row, worth 13 tokens, and it is the fix the ruling asks for rather than a payment invented to fund the raise. Nothing else in these five files had text the new rules make redundant, so further funding would have meant deleting a live fact with no other home — the stop condition, not a budget.

The SKILL.md subtotal self-test pin shifts 118095 to 118910, exactly the 815 raised on the four SKILL.md rows (the fifth row is not a SKILL.md and correctly does not move it), so the id-strip's lowering claim keeps its original 80 tokens of slack. Same operation the 2026-08-27 pm-dispatch raise performed.

Line ratchet (node scripts/pm/check-skill-line-ratchet.mjs): decision-analysis.md stays 46 / 46 lines, no raise. The new clause is funded entirely by reflowing two paragraphs with the gate's own wrapLine, which frees exactly two lines. Widest-table-row pin unchanged at 0.

A regression this PR caused and fixed

The first commit put the authority block between the SHRINK-ONLY doc comment and export const CEILINGS, which pushed that testimony outside the 400-byte anchor window check-ratchet-remedy-authority.mjs searches around every CEILINGS mention. The farm-wide detector then classified the gate excluded instead of marked — MISCLASSIFIED, i.e. it reported that a gate had silently left the maintainer-only convention. Measured green on origin/main and red on the branch, so the regression was this PR's, not pre-existing. Second commit moves the block above the doc comment and records the constraint in place.

Worth noting for review: that gate is not in the family scripts/pm/dispatch-gates.mjs derives for these paths. It was run because a ratchet edit is exactly what it polices.

Verification

Gate union run after the final commit, at fa2a2ef70. Exit codes captured before any pipe (cmd > log 2>&1; EXIT=$?); each verdict read from the gate's own printed line.

36 gates run: the 32 the dispatch-gates family derives for this changeset (asserted with --repo objectstack-ai/objectstack), plus check:nul-bytes, check-skill-line-ratchet, the token ratchet's --self-test (64 cases), and check-ratchet-remedy-authority.

• 34 green, including check:doc-authoring, check:corpus-claim-drift, check:skill-frame-sync, check:skill-compatibility, check:skill-identifier-liveness, check:role-word, check:pm-skill-id-lint, check:pm-skill-ratchet, check:pm-governed-merges, check:nul-bytes, both ratchets and both self-tests.
• check:doc-formula-expressions needed @objectstack/formula and @objectstack/lint built first; after building both it is green (22 record-scoped examples, 9 spec TSDoc examples, 14 field-level predicates, all clean).
• check-test-completeness is NOT MEASURED locally, by construction: it parses a test-run log, the derived family names it with no argument, and the gate itself prints that this branch is unreachable in CI and is not a red. CI is authoritative for it.

Changeset

None, per the three immediate precedents for skills-only PRs on this surface (PRs 14001, 13972, 13891 — none carried one). skip-changeset label applied at PR open.

Out of scope

No hotcrm files, no content/docs/releases/, no pm-dispatch SKILL.md main-file growth. The nav-item-type rows of card 13890 are a different card queued behind this one on the ui SKILL.md face and are not touched here.

Generated by Claude Code

---

Generated by Claude Code

[claude]

Fixes#13848

Lands the objectstack half of the 2026-08-31 app-repo principles. The hotcrm half already landed (hotcrm PR 1438); this PR discharges the card's whole remaining range — the published-skills universal items and the pm-dispatch decision-analysis clause — so the card closes with it.

⛔ Human merge required — this PR raises five shrink-only token ceilings

Governed surface, draft only. The raise is ⛔ MAINTAINER-ONLY territory and is taken here because the ruling that authorizes it names this landing surface by name. Verbatim and untranslated, recorded on the card:

「元数据应用就应该是在平台的规范下，基于skills 写元数据，并且使用平台提供的os命令校验元数据的合法性，而不是重新造轮子。这个也应该进入 hotcrm 的规范，甚至是 objectstack 的skills」

and, for the escape-hatch ladder (same day):

「或者说 skills 应该说明，逃生仓是极端场景按照客户需求自定义的场景下才需要，应该尽量避免。」

The reviewer's call is whether 900 ceiling tokens is the right price for these principles. Everything else here is mechanical.

Landing map — where each item went, and why

The card's spec rows are domain-scoped, and published skills are loaded per domain, so each rule sits where the reader is at the moment the mistake is available — not collected into one section a data-schema author never loads.

Spec row	Rule	Landed in	Anchor
1	App is a simplified business implementation: metadata under the spec, authored from skills, checked with os; capability gaps go upstream	skills/objectstack-platform/SKILL.md	new section "The App / Platform Boundary"
2	Platform defect means wait for the fix — no workaround, no half-landing; blocked-by; verify the pin and re-run the repro before resuming	same section	same
4	A bad platform default is a default to fix	same section	same
5	Docs explain business concepts, not hand-copied machine inventories	skills/objectstack-ui/SKILL.md	Docs — Package Documentation, after the authoring rules
7	Invariant vs transition gate: validations[] vs requiredWhen / bounds	skills/objectstack-data/SKILL.md	the field-conditional-rule bullet list, beside requiredWhen
8	Blocking rests on a human judgement; no override escape hatch	skills/objectstack-data/rules/validation.md	Validation Properties — Severity Levels
9	Screen flow stays runAs: 'user'; elevated writes move into a subflow	skills/objectstack-automation/SKILL.md	beside the existing readonly blockquote
10	A runAs: 'system' sweep pins an organization predicate; tenant column is platform-injected	same file	same
Principle 5	The section ladder: derive, then group reference, then hand enumeration last	skills/objectstack-ui/SKILL.md	Record Presentation, beside "let the platform lay it out"
Clause ②	App-repo exception to the recommendation order	.claude/skills/pm-dispatch/references/decision-analysis.md	adjacent to the 四棱分歧推荐序 段

Row 9 corrects a real drift rather than only adding: the existing readonly blockquote says a flow maintaining a readonly field must run runAs: 'system'. True of the scheduled flow it was written for; read by an agent writing a screen flow it says "elevate the whole screen flow", which elevates every other write in it.

Principle 5 also required fixing the page that taught the rung it demotes: this file's two worked sections examples enumerated their members. Both now reference a declared group, which is what the ruling asks for and is also shorter.

Budgets — before / after

Token ratchet (node scripts/check-skills-token-ratchet.mjs), unit ceil(utf8 bytes / 4):

File	Tokens before	Tokens after	Growth	Ceiling before	Ceiling after	Raise
skills/objectstack-platform/SKILL.md	12704	12984	+280	12705	12984	+279
skills/objectstack-ui/SKILL.md	25143	25445	+302	25143	25445	+302
skills/objectstack-data/SKILL.md	13782	13892	+110	13783	13892	+109
skills/objectstack-data/rules/validation.md	3024	3109	+85	3024	3109	+85
skills/objectstack-automation/SKILL.md	12618	12768	+150	12643	12768	+125
Total			+927			+900

Growth exceeds the raise by 27 because three rows carried that much existing headroom, which is spent first. Whole shipped bundle: 186567 to 187494 tokens (+0.50 percent).

Paid down before raising: the only genuine deletion available was the two sections examples in the ui row, worth 13 tokens, and it is the fix the ruling asks for rather than a payment invented to fund the raise. Nothing else in these five files had text the new rules make redundant, so further funding would have meant deleting a live fact with no other home — the stop condition, not a budget.

The SKILL.md subtotal self-test pin shifts 118095 to 118910, exactly the 815 raised on the four SKILL.md rows (the fifth row is not a SKILL.md and correctly does not move it), so the id-strip's lowering claim keeps its original 80 tokens of slack. Same operation the 2026-08-27 pm-dispatch raise performed.

Line ratchet (node scripts/pm/check-skill-line-ratchet.mjs): decision-analysis.md stays 46 / 46 lines, no raise. The new clause is funded entirely by reflowing two paragraphs with the gate's own wrapLine, which frees exactly two lines. Widest-table-row pin unchanged at 0.

A regression this PR caused and fixed

The first commit put the authority block between the SHRINK-ONLY doc comment and export const CEILINGS, which pushed that testimony outside the 400-byte anchor window check-ratchet-remedy-authority.mjs searches around every CEILINGS mention. The farm-wide detector then classified the gate excluded instead of marked — MISCLASSIFIED, i.e. it reported that a gate had silently left the maintainer-only convention. Measured green on origin/main and red on the branch, so the regression was this PR's, not pre-existing. Second commit moves the block above the doc comment and records the constraint in place.

Worth noting for review: that gate is not in the family scripts/pm/dispatch-gates.mjs derives for these paths. It was run because a ratchet edit is exactly what it polices.

Verification

Gate union run after the final commit, at fa2a2ef70. Exit codes captured before any pipe (cmd > log 2>&1; EXIT=$?); each verdict read from the gate's own printed line.

36 gates run: the 32 the dispatch-gates family derives for this changeset (asserted with --repo objectstack-ai/objectstack), plus check:nul-bytes, check-skill-line-ratchet, the token ratchet's --self-test (64 cases), and check-ratchet-remedy-authority.

• 34 green, including check:doc-authoring, check:corpus-claim-drift, check:skill-frame-sync, check:skill-compatibility, check:skill-identifier-liveness, check:role-word, check:pm-skill-id-lint, check:pm-skill-ratchet, check:pm-governed-merges, check:nul-bytes, both ratchets and both self-tests.
• check:doc-formula-expressions needed @objectstack/formula and @objectstack/lint built first; after building both it is green (22 record-scoped examples, 9 spec TSDoc examples, 14 field-level predicates, all clean).
• check-test-completeness is NOT MEASURED locally, by construction: it parses a test-run log, the derived family names it with no argument, and the gate itself prints that this branch is unreachable in CI and is not a red. CI is authoritative for it.

Changeset

None, per the three immediate precedents for skills-only PRs on this surface (PRs 14001, 13972, 13891 — none carried one). skip-changeset label applied at PR open.

Out of scope

No hotcrm files, no content/docs/releases/, no pm-dispatch SKILL.md main-file growth. The nav-item-type rows of card 13890 are a different card queued behind this one on the ui SKILL.md face and are not touched here.

Generated by Claude Code

---

Generated by Claude Code

[claude]

Fixes#13848

Lands the objectstack half of the 2026-08-31 app-repo principles. The hotcrm half already landed (hotcrm PR 1438); this PR discharges the card's whole remaining range — the published-skills universal items and the pm-dispatch decision-analysis clause — so the card closes with it.

⛔ Human merge required — this PR raises five shrink-only token ceilings

Governed surface, draft only. The raise is ⛔ MAINTAINER-ONLY territory and is taken here because the ruling that authorizes it names this landing surface by name. Verbatim and untranslated, recorded on the card:

「元数据应用就应该是在平台的规范下，基于skills 写元数据，并且使用平台提供的os命令校验元数据的合法性，而不是重新造轮子。这个也应该进入 hotcrm 的规范，甚至是 objectstack 的skills」

and, for the escape-hatch ladder (same day):

「或者说 skills 应该说明，逃生仓是极端场景按照客户需求自定义的场景下才需要，应该尽量避免。」

The reviewer's call is whether 900 ceiling tokens is the right price for these principles. Everything else here is mechanical.

Landing map — where each item went, and why

The card's spec rows are domain-scoped, and published skills are loaded per domain, so each rule sits where the reader is at the moment the mistake is available — not collected into one section a data-schema author never loads.

Spec row	Rule	Landed in	Anchor
1	App is a simplified business implementation: metadata under the spec, authored from skills, checked with os; capability gaps go upstream	skills/objectstack-platform/SKILL.md	new section "The App / Platform Boundary"
2	Platform defect means wait for the fix — no workaround, no half-landing; blocked-by; verify the pin and re-run the repro before resuming	same section	same
4	A bad platform default is a default to fix	same section	same
5	Docs explain business concepts, not hand-copied machine inventories	skills/objectstack-ui/SKILL.md	Docs — Package Documentation, after the authoring rules
7	Invariant vs transition gate: validations[] vs requiredWhen / bounds	skills/objectstack-data/SKILL.md	the field-conditional-rule bullet list, beside requiredWhen
8	Blocking rests on a human judgement; no override escape hatch	skills/objectstack-data/rules/validation.md	Validation Properties — Severity Levels
9	Screen flow stays runAs: 'user'; elevated writes move into a subflow	skills/objectstack-automation/SKILL.md	beside the existing readonly blockquote
10	A runAs: 'system' sweep pins an organization predicate; tenant column is platform-injected	same file	same
Principle 5	The section ladder: derive, then group reference, then hand enumeration last	skills/objectstack-ui/SKILL.md	Record Presentation, beside "let the platform lay it out"
Clause ②	App-repo exception to the recommendation order	.claude/skills/pm-dispatch/references/decision-analysis.md	adjacent to the 四棱分歧推荐序 段

Row 9 corrects a real drift rather than only adding: the existing readonly blockquote says a flow maintaining a readonly field must run runAs: 'system'. True of the scheduled flow it was written for; read by an agent writing a screen flow it says "elevate the whole screen flow", which elevates every other write in it.

Principle 5 also required fixing the page that taught the rung it demotes: this file's two worked sections examples enumerated their members. Both now reference a declared group, which is what the ruling asks for and is also shorter.

Budgets — before / after

Token ratchet (node scripts/check-skills-token-ratchet.mjs), unit ceil(utf8 bytes / 4):

File	Tokens before	Tokens after	Growth	Ceiling before	Ceiling after	Raise
skills/objectstack-platform/SKILL.md	12704	12984	+280	12705	12984	+279
skills/objectstack-ui/SKILL.md	25143	25445	+302	25143	25445	+302
skills/objectstack-data/SKILL.md	13782	13892	+110	13783	13892	+109
skills/objectstack-data/rules/validation.md	3024	3109	+85	3024	3109	+85
skills/objectstack-automation/SKILL.md	12618	12768	+150	12643	12768	+125
Total			+927			+900

Growth exceeds the raise by 27 because three rows carried that much existing headroom, which is spent first. Whole shipped bundle: 186567 to 187494 tokens (+0.50 percent).

Paid down before raising: the only genuine deletion available was the two sections examples in the ui row, worth 13 tokens, and it is the fix the ruling asks for rather than a payment invented to fund the raise. Nothing else in these five files had text the new rules make redundant, so further funding would have meant deleting a live fact with no other home — the stop condition, not a budget.

The SKILL.md subtotal self-test pin shifts 118095 to 118910, exactly the 815 raised on the four SKILL.md rows (the fifth row is not a SKILL.md and correctly does not move it), so the id-strip's lowering claim keeps its original 80 tokens of slack. Same operation the 2026-08-27 pm-dispatch raise performed.

Line ratchet (node scripts/pm/check-skill-line-ratchet.mjs): decision-analysis.md stays 46 / 46 lines, no raise. The new clause is funded entirely by reflowing two paragraphs with the gate's own wrapLine, which frees exactly two lines. Widest-table-row pin unchanged at 0.

A regression this PR caused and fixed

The first commit put the authority block between the SHRINK-ONLY doc comment and export const CEILINGS, which pushed that testimony outside the 400-byte anchor window check-ratchet-remedy-authority.mjs searches around every CEILINGS mention. The farm-wide detector then classified the gate excluded instead of marked — MISCLASSIFIED, i.e. it reported that a gate had silently left the maintainer-only convention. Measured green on origin/main and red on the branch, so the regression was this PR's, not pre-existing. Second commit moves the block above the doc comment and records the constraint in place.

Worth noting for review: that gate is not in the family scripts/pm/dispatch-gates.mjs derives for these paths. It was run because a ratchet edit is exactly what it polices.

Verification

Gate union run after the final commit, at fa2a2ef70. Exit codes captured before any pipe (cmd > log 2>&1; EXIT=$?); each verdict read from the gate's own printed line.

36 gates run: the 32 the dispatch-gates family derives for this changeset (asserted with --repo objectstack-ai/objectstack), plus check:nul-bytes, check-skill-line-ratchet, the token ratchet's --self-test (64 cases), and check-ratchet-remedy-authority.

• 34 green, including check:doc-authoring, check:corpus-claim-drift, check:skill-frame-sync, check:skill-compatibility, check:skill-identifier-liveness, check:role-word, check:pm-skill-id-lint, check:pm-skill-ratchet, check:pm-governed-merges, check:nul-bytes, both ratchets and both self-tests.
• check:doc-formula-expressions needed @objectstack/formula and @objectstack/lint built first; after building both it is green (22 record-scoped examples, 9 spec TSDoc examples, 14 field-level predicates, all clean).
• check-test-completeness is NOT MEASURED locally, by construction: it parses a test-run log, the derived family names it with no argument, and the gate itself prints that this branch is unreachable in CI and is not a red. CI is authoritative for it.

Changeset

None, per the three immediate precedents for skills-only PRs on this surface (PRs 14001, 13972, 13891 — none carried one). skip-changeset label applied at PR open.

Out of scope

No hotcrm files, no content/docs/releases/, no pm-dispatch SKILL.md main-file growth. The nav-item-type rows of card 13890 are a different card queued behind this one on the ui SKILL.md face and are not touched here.

Generated by Claude Code

---

Generated by Claude Code

[claude]

Fixes#13848

Lands the objectstack half of the 2026-08-31 app-repo principles. The hotcrm half already landed (hotcrm PR 1438); this PR discharges the card's whole remaining range — the published-skills universal items and the pm-dispatch decision-analysis clause — so the card closes with it.

⛔ Human merge required — this PR raises five shrink-only token ceilings

Governed surface, draft only. The raise is ⛔ MAINTAINER-ONLY territory and is taken here because the ruling that authorizes it names this landing surface by name. Verbatim and untranslated, recorded on the card:

「元数据应用就应该是在平台的规范下，基于skills 写元数据，并且使用平台提供的os命令校验元数据的合法性，而不是重新造轮子。这个也应该进入 hotcrm 的规范，甚至是 objectstack 的skills」

and, for the escape-hatch ladder (same day):

「或者说 skills 应该说明，逃生仓是极端场景按照客户需求自定义的场景下才需要，应该尽量避免。」

The reviewer's call is whether 900 ceiling tokens is the right price for these principles. Everything else here is mechanical.

Landing map — where each item went, and why

The card's spec rows are domain-scoped, and published skills are loaded per domain, so each rule sits where the reader is at the moment the mistake is available — not collected into one section a data-schema author never loads.

Spec row	Rule	Landed in	Anchor
1	App is a simplified business implementation: metadata under the spec, authored from skills, checked with os; capability gaps go upstream	skills/objectstack-platform/SKILL.md	new section "The App / Platform Boundary"
2	Platform defect means wait for the fix — no workaround, no half-landing; blocked-by; verify the pin and re-run the repro before resuming	same section	same
4	A bad platform default is a default to fix	same section	same
5	Docs explain business concepts, not hand-copied machine inventories	skills/objectstack-ui/SKILL.md	Docs — Package Documentation, after the authoring rules
7	Invariant vs transition gate: validations[] vs requiredWhen / bounds	skills/objectstack-data/SKILL.md	the field-conditional-rule bullet list, beside requiredWhen
8	Blocking rests on a human judgement; no override escape hatch	skills/objectstack-data/rules/validation.md	Validation Properties — Severity Levels
9	Screen flow stays runAs: 'user'; elevated writes move into a subflow	skills/objectstack-automation/SKILL.md	beside the existing readonly blockquote
10	A runAs: 'system' sweep pins an organization predicate; tenant column is platform-injected	same file	same
Principle 5	The section ladder: derive, then group reference, then hand enumeration last	skills/objectstack-ui/SKILL.md	Record Presentation, beside "let the platform lay it out"
Clause ②	App-repo exception to the recommendation order	.claude/skills/pm-dispatch/references/decision-analysis.md	adjacent to the 四棱分歧推荐序 段

Row 9 corrects a real drift rather than only adding: the existing readonly blockquote says a flow maintaining a readonly field must run runAs: 'system'. True of the scheduled flow it was written for; read by an agent writing a screen flow it says "elevate the whole screen flow", which elevates every other write in it.

Principle 5 also required fixing the page that taught the rung it demotes: this file's two worked sections examples enumerated their members. Both now reference a declared group, which is what the ruling asks for and is also shorter.

Budgets — before / after

Token ratchet (node scripts/check-skills-token-ratchet.mjs), unit ceil(utf8 bytes / 4):

File	Tokens before	Tokens after	Growth	Ceiling before	Ceiling after	Raise
skills/objectstack-platform/SKILL.md	12704	12984	+280	12705	12984	+279
skills/objectstack-ui/SKILL.md	25143	25445	+302	25143	25445	+302
skills/objectstack-data/SKILL.md	13782	13892	+110	13783	13892	+109
skills/objectstack-data/rules/validation.md	3024	3109	+85	3024	3109	+85
skills/objectstack-automation/SKILL.md	12618	12768	+150	12643	12768	+125
Total			+927			+900

Growth exceeds the raise by 27 because three rows carried that much existing headroom, which is spent first. Whole shipped bundle: 186567 to 187494 tokens (+0.50 percent).

Paid down before raising: the only genuine deletion available was the two sections examples in the ui row, worth 13 tokens, and it is the fix the ruling asks for rather than a payment invented to fund the raise. Nothing else in these five files had text the new rules make redundant, so further funding would have meant deleting a live fact with no other home — the stop condition, not a budget.

The SKILL.md subtotal self-test pin shifts 118095 to 118910, exactly the 815 raised on the four SKILL.md rows (the fifth row is not a SKILL.md and correctly does not move it), so the id-strip's lowering claim keeps its original 80 tokens of slack. Same operation the 2026-08-27 pm-dispatch raise performed.

Line ratchet (node scripts/pm/check-skill-line-ratchet.mjs): decision-analysis.md stays 46 / 46 lines, no raise. The new clause is funded entirely by reflowing two paragraphs with the gate's own wrapLine, which frees exactly two lines. Widest-table-row pin unchanged at 0.

A regression this PR caused and fixed

The first commit put the authority block between the SHRINK-ONLY doc comment and export const CEILINGS, which pushed that testimony outside the 400-byte anchor window check-ratchet-remedy-authority.mjs searches around every CEILINGS mention. The farm-wide detector then classified the gate excluded instead of marked — MISCLASSIFIED, i.e. it reported that a gate had silently left the maintainer-only convention. Measured green on origin/main and red on the branch, so the regression was this PR's, not pre-existing. Second commit moves the block above the doc comment and records the constraint in place.

Worth noting for review: that gate is not in the family scripts/pm/dispatch-gates.mjs derives for these paths. It was run because a ratchet edit is exactly what it polices.

Verification

Gate union run after the final commit, at fa2a2ef70. Exit codes captured before any pipe (cmd > log 2>&1; EXIT=$?); each verdict read from the gate's own printed line.

36 gates run: the 32 the dispatch-gates family derives for this changeset (asserted with --repo objectstack-ai/objectstack), plus check:nul-bytes, check-skill-line-ratchet, the token ratchet's --self-test (64 cases), and check-ratchet-remedy-authority.

• 34 green, including check:doc-authoring, check:corpus-claim-drift, check:skill-frame-sync, check:skill-compatibility, check:skill-identifier-liveness, check:role-word, check:pm-skill-id-lint, check:pm-skill-ratchet, check:pm-governed-merges, check:nul-bytes, both ratchets and both self-tests.
• check:doc-formula-expressions needed @objectstack/formula and @objectstack/lint built first; after building both it is green (22 record-scoped examples, 9 spec TSDoc examples, 14 field-level predicates, all clean).
• check-test-completeness is NOT MEASURED locally, by construction: it parses a test-run log, the derived family names it with no argument, and the gate itself prints that this branch is unreachable in CI and is not a red. CI is authoritative for it.

Changeset

None, per the three immediate precedents for skills-only PRs on this surface (PRs 14001, 13972, 13891 — none carried one). skip-changeset label applied at PR open.

Out of scope

No hotcrm files, no content/docs/releases/, no pm-dispatch SKILL.md main-file growth. The nav-item-type rows of card 13890 are a different card queued behind this one on the ui SKILL.md face and are not touched here.

Generated by Claude Code

---

Generated by Claude Code

[claude]

Fixes#13848

Lands the objectstack half of the 2026-08-31 app-repo principles. The hotcrm half already landed (hotcrm PR 1438); this PR discharges the card's whole remaining range — the published-skills universal items and the pm-dispatch decision-analysis clause — so the card closes with it.

⛔ Human merge required — this PR raises five shrink-only token ceilings

Governed surface, draft only. The raise is ⛔ MAINTAINER-ONLY territory and is taken here because the ruling that authorizes it names this landing surface by name. Verbatim and untranslated, recorded on the card:

「元数据应用就应该是在平台的规范下，基于skills 写元数据，并且使用平台提供的os命令校验元数据的合法性，而不是重新造轮子。这个也应该进入 hotcrm 的规范，甚至是 objectstack 的skills」

and, for the escape-hatch ladder (same day):

「或者说 skills 应该说明，逃生仓是极端场景按照客户需求自定义的场景下才需要，应该尽量避免。」

The reviewer's call is whether 900 ceiling tokens is the right price for these principles. Everything else here is mechanical.

Landing map — where each item went, and why

The card's spec rows are domain-scoped, and published skills are loaded per domain, so each rule sits where the reader is at the moment the mistake is available — not collected into one section a data-schema author never loads.

Spec row	Rule	Landed in	Anchor
1	App is a simplified business implementation: metadata under the spec, authored from skills, checked with os; capability gaps go upstream	skills/objectstack-platform/SKILL.md	new section "The App / Platform Boundary"
2	Platform defect means wait for the fix — no workaround, no half-landing; blocked-by; verify the pin and re-run the repro before resuming	same section	same
4	A bad platform default is a default to fix	same section	same
5	Docs explain business concepts, not hand-copied machine inventories	skills/objectstack-ui/SKILL.md	Docs — Package Documentation, after the authoring rules
7	Invariant vs transition gate: validations[] vs requiredWhen / bounds	skills/objectstack-data/SKILL.md	the field-conditional-rule bullet list, beside requiredWhen
8	Blocking rests on a human judgement; no override escape hatch	skills/objectstack-data/rules/validation.md	Validation Properties — Severity Levels
9	Screen flow stays runAs: 'user'; elevated writes move into a subflow	skills/objectstack-automation/SKILL.md	beside the existing readonly blockquote
10	A runAs: 'system' sweep pins an organization predicate; tenant column is platform-injected	same file	same
Principle 5	The section ladder: derive, then group reference, then hand enumeration last	skills/objectstack-ui/SKILL.md	Record Presentation, beside "let the platform lay it out"
Clause ②	App-repo exception to the recommendation order	.claude/skills/pm-dispatch/references/decision-analysis.md	adjacent to the 四棱分歧推荐序 段

Row 9 corrects a real drift rather than only adding: the existing readonly blockquote says a flow maintaining a readonly field must run runAs: 'system'. True of the scheduled flow it was written for; read by an agent writing a screen flow it says "elevate the whole screen flow", which elevates every other write in it.

Principle 5 also required fixing the page that taught the rung it demotes: this file's two worked sections examples enumerated their members. Both now reference a declared group, which is what the ruling asks for and is also shorter.

Budgets — before / after

Token ratchet (node scripts/check-skills-token-ratchet.mjs), unit ceil(utf8 bytes / 4):

File	Tokens before	Tokens after	Growth	Ceiling before	Ceiling after	Raise
skills/objectstack-platform/SKILL.md	12704	12984	+280	12705	12984	+279
skills/objectstack-ui/SKILL.md	25143	25445	+302	25143	25445	+302
skills/objectstack-data/SKILL.md	13782	13892	+110	13783	13892	+109
skills/objectstack-data/rules/validation.md	3024	3109	+85	3024	3109	+85
skills/objectstack-automation/SKILL.md	12618	12768	+150	12643	12768	+125
Total			+927			+900

Growth exceeds the raise by 27 because three rows carried that much existing headroom, which is spent first. Whole shipped bundle: 186567 to 187494 tokens (+0.50 percent).

Paid down before raising: the only genuine deletion available was the two sections examples in the ui row, worth 13 tokens, and it is the fix the ruling asks for rather than a payment invented to fund the raise. Nothing else in these five files had text the new rules make redundant, so further funding would have meant deleting a live fact with no other home — the stop condition, not a budget.

The SKILL.md subtotal self-test pin shifts 118095 to 118910, exactly the 815 raised on the four SKILL.md rows (the fifth row is not a SKILL.md and correctly does not move it), so the id-strip's lowering claim keeps its original 80 tokens of slack. Same operation the 2026-08-27 pm-dispatch raise performed.

Line ratchet (node scripts/pm/check-skill-line-ratchet.mjs): decision-analysis.md stays 46 / 46 lines, no raise. The new clause is funded entirely by reflowing two paragraphs with the gate's own wrapLine, which frees exactly two lines. Widest-table-row pin unchanged at 0.

A regression this PR caused and fixed

The first commit put the authority block between the SHRINK-ONLY doc comment and export const CEILINGS, which pushed that testimony outside the 400-byte anchor window check-ratchet-remedy-authority.mjs searches around every CEILINGS mention. The farm-wide detector then classified the gate excluded instead of marked — MISCLASSIFIED, i.e. it reported that a gate had silently left the maintainer-only convention. Measured green on origin/main and red on the branch, so the regression was this PR's, not pre-existing. Second commit moves the block above the doc comment and records the constraint in place.

Worth noting for review: that gate is not in the family scripts/pm/dispatch-gates.mjs derives for these paths. It was run because a ratchet edit is exactly what it polices.

Verification

Gate union run after the final commit, at fa2a2ef70. Exit codes captured before any pipe (cmd > log 2>&1; EXIT=$?); each verdict read from the gate's own printed line.

36 gates run: the 32 the dispatch-gates family derives for this changeset (asserted with --repo objectstack-ai/objectstack), plus check:nul-bytes, check-skill-line-ratchet, the token ratchet's --self-test (64 cases), and check-ratchet-remedy-authority.

• 34 green, including check:doc-authoring, check:corpus-claim-drift, check:skill-frame-sync, check:skill-compatibility, check:skill-identifier-liveness, check:role-word, check:pm-skill-id-lint, check:pm-skill-ratchet, check:pm-governed-merges, check:nul-bytes, both ratchets and both self-tests.
• check:doc-formula-expressions needed @objectstack/formula and @objectstack/lint built first; after building both it is green (22 record-scoped examples, 9 spec TSDoc examples, 14 field-level predicates, all clean).
• check-test-completeness is NOT MEASURED locally, by construction: it parses a test-run log, the derived family names it with no argument, and the gate itself prints that this branch is unreachable in CI and is not a red. CI is authoritative for it.

Changeset

None, per the three immediate precedents for skills-only PRs on this surface (PRs 14001, 13972, 13891 — none carried one). skip-changeset label applied at PR open.

Out of scope

No hotcrm files, no content/docs/releases/, no pm-dispatch SKILL.md main-file growth. The nav-item-type rows of card 13890 are a different card queued behind this one on the ui SKILL.md face and are not touched here.

Generated by Claude Code

---

Generated by Claude Code

[claude]

Fixes#13848

Lands the objectstack half of the 2026-08-31 app-repo principles. The hotcrm half already landed (hotcrm PR 1438); this PR discharges the card's whole remaining range — the published-skills universal items and the pm-dispatch decision-analysis clause — so the card closes with it.

⛔ Human merge required — this PR raises five shrink-only token ceilings

Governed surface, draft only. The raise is ⛔ MAINTAINER-ONLY territory and is taken here because the ruling that authorizes it names this landing surface by name. Verbatim and untranslated, recorded on the card:

「元数据应用就应该是在平台的规范下，基于skills 写元数据，并且使用平台提供的os命令校验元数据的合法性，而不是重新造轮子。这个也应该进入 hotcrm 的规范，甚至是 objectstack 的skills」

and, for the escape-hatch ladder (same day):

「或者说 skills 应该说明，逃生仓是极端场景按照客户需求自定义的场景下才需要，应该尽量避免。」

The reviewer's call is whether 900 ceiling tokens is the right price for these principles. Everything else here is mechanical.

Landing map — where each item went, and why

The card's spec rows are domain-scoped, and published skills are loaded per domain, so each rule sits where the reader is at the moment the mistake is available — not collected into one section a data-schema author never loads.

Spec row	Rule	Landed in	Anchor
1	App is a simplified business implementation: metadata under the spec, authored from skills, checked with os; capability gaps go upstream	skills/objectstack-platform/SKILL.md	new section "The App / Platform Boundary"
2	Platform defect means wait for the fix — no workaround, no half-landing; blocked-by; verify the pin and re-run the repro before resuming	same section	same
4	A bad platform default is a default to fix	same section	same
5	Docs explain business concepts, not hand-copied machine inventories	skills/objectstack-ui/SKILL.md	Docs — Package Documentation, after the authoring rules
7	Invariant vs transition gate: validations[] vs requiredWhen / bounds	skills/objectstack-data/SKILL.md	the field-conditional-rule bullet list, beside requiredWhen
8	Blocking rests on a human judgement; no override escape hatch	skills/objectstack-data/rules/validation.md	Validation Properties — Severity Levels
9	Screen flow stays runAs: 'user'; elevated writes move into a subflow	skills/objectstack-automation/SKILL.md	beside the existing readonly blockquote
10	A runAs: 'system' sweep pins an organization predicate; tenant column is platform-injected	same file	same
Principle 5	The section ladder: derive, then group reference, then hand enumeration last	skills/objectstack-ui/SKILL.md	Record Presentation, beside "let the platform lay it out"
Clause ②	App-repo exception to the recommendation order	.claude/skills/pm-dispatch/references/decision-analysis.md	adjacent to the 四棱分歧推荐序 段

Row 9 corrects a real drift rather than only adding: the existing readonly blockquote says a flow maintaining a readonly field must run runAs: 'system'. True of the scheduled flow it was written for; read by an agent writing a screen flow it says "elevate the whole screen flow", which elevates every other write in it.

Principle 5 also required fixing the page that taught the rung it demotes: this file's two worked sections examples enumerated their members. Both now reference a declared group, which is what the ruling asks for and is also shorter.

Budgets — before / after

Token ratchet (node scripts/check-skills-token-ratchet.mjs), unit ceil(utf8 bytes / 4):

File	Tokens before	Tokens after	Growth	Ceiling before	Ceiling after	Raise
skills/objectstack-platform/SKILL.md	12704	12984	+280	12705	12984	+279
skills/objectstack-ui/SKILL.md	25143	25445	+302	25143	25445	+302
skills/objectstack-data/SKILL.md	13782	13892	+110	13783	13892	+109
skills/objectstack-data/rules/validation.md	3024	3109	+85	3024	3109	+85
skills/objectstack-automation/SKILL.md	12618	12768	+150	12643	12768	+125
Total			+927			+900

Growth exceeds the raise by 27 because three rows carried that much existing headroom, which is spent first. Whole shipped bundle: 186567 to 187494 tokens (+0.50 percent).

Paid down before raising: the only genuine deletion available was the two sections examples in the ui row, worth 13 tokens, and it is the fix the ruling asks for rather than a payment invented to fund the raise. Nothing else in these five files had text the new rules make redundant, so further funding would have meant deleting a live fact with no other home — the stop condition, not a budget.

The SKILL.md subtotal self-test pin shifts 118095 to 118910, exactly the 815 raised on the four SKILL.md rows (the fifth row is not a SKILL.md and correctly does not move it), so the id-strip's lowering claim keeps its original 80 tokens of slack. Same operation the 2026-08-27 pm-dispatch raise performed.

Line ratchet (node scripts/pm/check-skill-line-ratchet.mjs): decision-analysis.md stays 46 / 46 lines, no raise. The new clause is funded entirely by reflowing two paragraphs with the gate's own wrapLine, which frees exactly two lines. Widest-table-row pin unchanged at 0.

A regression this PR caused and fixed

The first commit put the authority block between the SHRINK-ONLY doc comment and export const CEILINGS, which pushed that testimony outside the 400-byte anchor window check-ratchet-remedy-authority.mjs searches around every CEILINGS mention. The farm-wide detector then classified the gate excluded instead of marked — MISCLASSIFIED, i.e. it reported that a gate had silently left the maintainer-only convention. Measured green on origin/main and red on the branch, so the regression was this PR's, not pre-existing. Second commit moves the block above the doc comment and records the constraint in place.

Worth noting for review: that gate is not in the family scripts/pm/dispatch-gates.mjs derives for these paths. It was run because a ratchet edit is exactly what it polices.

Verification

Gate union run after the final commit, at fa2a2ef70. Exit codes captured before any pipe (cmd > log 2>&1; EXIT=$?); each verdict read from the gate's own printed line.

36 gates run: the 32 the dispatch-gates family derives for this changeset (asserted with --repo objectstack-ai/objectstack), plus check:nul-bytes, check-skill-line-ratchet, the token ratchet's --self-test (64 cases), and check-ratchet-remedy-authority.

• 34 green, including check:doc-authoring, check:corpus-claim-drift, check:skill-frame-sync, check:skill-compatibility, check:skill-identifier-liveness, check:role-word, check:pm-skill-id-lint, check:pm-skill-ratchet, check:pm-governed-merges, check:nul-bytes, both ratchets and both self-tests.
• check:doc-formula-expressions needed @objectstack/formula and @objectstack/lint built first; after building both it is green (22 record-scoped examples, 9 spec TSDoc examples, 14 field-level predicates, all clean).
• check-test-completeness is NOT MEASURED locally, by construction: it parses a test-run log, the derived family names it with no argument, and the gate itself prints that this branch is unreachable in CI and is not a red. CI is authoritative for it.

Changeset

None, per the three immediate precedents for skills-only PRs on this surface (PRs 14001, 13972, 13891 — none carried one). skip-changeset label applied at PR open.

Out of scope

No hotcrm files, no content/docs/releases/, no pm-dispatch SKILL.md main-file growth. The nav-item-type rows of card 13890 are a different card queued behind this one on the ui SKILL.md face and are not touched here.

Generated by Claude Code

---

Generated by Claude Code