skills(api): optimization flight — RestApiEndpointSchema example and other packages' anchors cut, the apiMethods rule stated once, http.server mount / error ledger / OCC taught (net −1,676 tokens)

[os-litant]

Part of #14304

The audit record this implements is posted verbatim on the card. Every claim written into the file was re-verified at source on this branch's base; the file:line for each is below. evals/README.md is untouched (API-H-01 is deferred to #14296 item 2), so the card stays open — that is why the first line is Part of, not a closing keyword.

Per-item: 落点 | before | after

finding	落点 (before)	before	after
API-E-01	SKILL.md:117-146 — the leading os:check example	authored RestApiEndpointSchema "via the REST API plugin"	deleted. The one live fact (auth is the flat public + permissions pair, no name/request/response field) folded into Auth Configuration
API-C-01	:472-510 Datasource Configuration + Supported Drivers	a defineDatasource example and a 7-row driver table	deleted → one pointer: objectstack-data rules/datasources.md, objectstack-platform Driver Selection Guide, and data/driver/config-registry.zod.ts for the id vocabulary
API-C-02	:513-538 Inter-Service Communication	IDataEngine contract prose + a marked block whose declare const kernel fabricated the host	deleted → the section's slot now carries the API-F-02 construct; service resolution points at objectstack-platform rules/service-registry.md
API-C-03	:458-468 Security Layers	a 4-row table naming no authorable key + a callout restating its own Description column	deleted → one boundary line under Authentication & Authorization
API-D-01 + API-F-05 + API-A-03	:316-366 Service Discovery / Health	a ServiceInfoos:check example, a JSON health body, /ready prose	rewritten to 3 lines — all three are response surfaces, nothing to author
API-D-02	:383-396 Handler Status	a 3-row table its own callout neutralised ("nothing reads it at runtime")	deleted; the now-single-child ## Dispatcher & Routing wrapper collapses into ## Dispatcher Error Codes
API-B-01	:419-429	third rendering of "no nested auth block" + an unmarked duplicate fragment	deleted, merged into one sentence that also carries the API-E-01 fold
API-B-02 + API-G-01	:203-209	a second objectstack validate gate block 384 lines from the first	deleted — the gate is stated once, in Verify your work, in the bundle-dominant os spelling
API-B-03	:65-71, :283-313, :559-563	the apiMethods primitives/derived rule stated 3×	once. Callout → 3 lines; derived table drops the 3 rows with no route and no derivation (history/restore/purge keep a one-line mention); Best Practice 6 stops restating it
API-B-05	:22-28	preamble restating the frontmatter above the fold	deleted
API-A-01	:31-39 "When to Use This Skill"	6 bullets, 3 of which misroute	Skill Boundaries table, matching objectstack-data / objectstack-query
API-A-02	frontmatter :3-12	promises "batch/versioning contracts"	"batch contracts" — versioning.zod.ts has zero consumers outside a pin test
API-A-03	:83-94	three /meta client query-param contracts	2 lines saying they are client contracts nothing declares
API-D-03	:544-547, :556-558	Best Practices 1 and 4	deleted (1 duplicates :273 and is wrong for the carve-out; 4 names no key and no gate)
API-D-04	:569-576	Pitfalls 1, 2, 4	deleted — FLS has no authorable spelling in the bundle, the page sizes match no platform constant, rate limiting is already the D6 rule
API-D-05	:191-198	two why-paragraphs after the carve-out rule	deleted, rule kept
API-F-04 + API-G-03	:275-279	environment-scoped routes + projectResolution, 0 usages	deleted (takes the retired project gloss with it)
API-F-06	:404-411	two declared-but-unenforced realtime notes	deleted from the skill; filed as #14446
API-G-02	:481	defineDatasource imported from the root barrel	moot — deleted with API-C-01
API-F-01(add)	gap — :164 named http.server with no example	one table cell	new ## Code routes: mounting on http.server` section
API-F-02(add)	gap — :548-555	frontmatter promised "error envelopes"; the ledger rule was absent	new ## Error Envelopes & the Code Ledger (ADR-0112)
API-F-03(add)	:575-576	"use optimistic locking (version field)", naming no spelling	the two real spellings, body-wins, 409 CONCURRENT_UPDATE

The three funded additions — every claim, with its source

1. http.server code mount — verified against all three shipping sites (examples/app-showcase/src/system/server/recalc-endpoint.ts:48-118, packages/plugins/plugin-sharing/src/sharing-plugin.ts:787-790, packages/plugins/plugin-approvals/src/approvals-plugin.ts:353-356).

• dual lookup readServer('http.server') ?? readServer('http-server'), canonical first — sharing-plugin.ts:787-790, approvals-plugin.ts:353-356; both carry the same comment that http.server is "the ONLY name present on all provider paths".
• kernel:ready, not later — packages/spec/src/contracts/plugin-lifecycle-events.ts:70-91: listen() is deferred to kernel:listeningbecause "route registration in Hono … seals the matcher the first time a request is matched"; recalc-endpoint.ts:110-112 hooks kernel:ready.
• the handler signature — RouteHandler = (req: IHttpRequest, res: IHttpResponse) at packages/spec/src/contracts/http-server.ts:108-111; IHttpResponse.status(code): IHttpResponse at :77 (so res.status(200).json(…) chains); IHttpServer.post at :216.
• the block is NOT os:check-marked, deliberately. See "Assumption 3" below — this is measured, not assumed.

2. ADR-0112 error-code ledger — packages/spec/src/api/error-code-ledger.zod.ts:6-56 states the two tiers, "An unregistered code fails schema parse — which fails the envelope conformance suites — which fails CI", the framework-packages-only scope rule (#4805, maintainer ruling 2026-08-03 re-confirmed 2026-08-09), and the downstream composition. Functions re-located by content on this base: makeApiErrorSchema at packages/spec/src/api/contract.zod.ts:146, envelopeViolations at :215.

3. OCC — packages/rest/src/rest-server.ts:7710-7727 is the PATCH /api/v1/data/:object/:id route: If-Match header or expectedVersion body field, const expectedVersion = bodyVersion ?? ifMatchHeader (body wins), and the field is stripped from the write payload. The token semantics, the 409 and the "" refusal are the spec's own .describe() at packages/spec/src/api/protocol.zod.ts:2097-2102. CONCURRENT_UPDATE is registered at packages/spec/src/api/error-code-ledger.zod.ts:168 and pinned to 409 at packages/rest/src/rest-unclassified-fault-status.test.ts:230.

premise_false

API-F-01, the "getService is async" clause — the audit's premise is false and was NOT written. The real host contract is PluginContext.getService[T](name: string): T (packages/core/src/types.ts:36, doc comment @throws Error if service not found) — synchronous, and it throws. Measured on this base:

• await ctx.getService in packages/plugins/**, excluding tests: 0 occurrences.
• non-awaited ctx.getService( / ctx.getService[T](, same scope: 112.
• the three app sites are ctx?.getService?.('manifest') with no await (packages/apps/{account,setup,studio}/src/index.ts:{60,55,68}).

The audit's evidence for "async" was recalc-endpoint.ts:52, which awaits — but that file's ctx is its own locally declared RecalcHostContext (:30-35) whose getService?: (name) => Promise<T> is a shim, not the host. That is precisely the defect API-C-02 was deleted for, so the skill states the true rule instead: getService is synchronous and throws, which is exactly why each name needs its own try and a() ?? b() in one try never reaches b.

The :532 "fix or unmark" item needs neither — the block is deleted with API-C-02, so no marker survives to prove or disprove anything.

PM assumptions — all six measured

#	assumption	verdict
1	skills/objectstack-api/** byte-identical a59f78d ↔ base	HOLDS — git diff a59f78d 96b627d1 -- skills/objectstack-api/ is empty; every audited span matched by content
2	the frontmatter edit forces regeneration of BOTH generated files	HOLDS — check:skill-docs red on both before gen:skill-docs, green after; the .mdx pulled 20 docs-family gates into the union, re-derived and run
3	the real PluginContext is unreachable from the os:check skills surface	HOLDS, measured directly.SURFACES[0] resolves resolutionDir/selfPackages = packages/spec only (packages/spec/scripts/check-skill-examples.ts:526-532). Probed it: a temporary marked block importing PluginContext from @objectstack/core fails TS2307: Cannot find module '@objectstack/core'. Probe reverted and proven byte-identical (worktree blob hash == HEAD blob hash, git diff HEAD empty). ⇒ the F-01 block stays unmarked rather than earning a marker with a fabricated stand-in
4	RestApiEndpointSchema 0 consumers · no plugin-rest-api package · no endpoints key	HOLDS — 0 hits outside packages/spec/src/api/plugin-rest-api* (positive control: the same grep for ApiEndpoint returns many); ls packages/plugins/ | grep -i rest empty; RestApiPluginConfig (packages/rest/src/rest-api-plugin.ts:95-105) is exactly {serverServiceName?, protocolServiceName?, kernelManagerServiceName?, api?}
5	a heading in this file may be bound by check:skill-identifier-liveness Leg 2	YES, and it is. Binding api-methods binds ## API Methods (Operations) to ApiMethod (scripts/check-skill-identifier-liveness.mjs:285-292). Fixed the author's way: the heading and all six primitives stay; only the derived rows moved. Gate green, 9 bindings, 0 ledgered gaps
6	a false premise is skipped and listed	applied to the getService clause above

Token delta

file	before	after	Δ	ceiling
skills/objectstack-api/SKILL.md	6311	4635	−1,676 (−26.6%)	6319, unchanged (headroom 8 → 1684)
skills/objectstack-api/evals/README.md	546	546	0	546 — untouched, API-H-01 deferred
skills/objectstack-api/references/_index.md	888	888	0	generator-owned, untouched
bundle, ratcheted (authored)	171406	169730	−1,676	171743

607 → 428 lines. No ceiling raised, no new file, no file deleted, and scripts/check-skills-token-ratchet.mjs is not edited.

The gap, itemised rather than smoothed. The dispatch target was −1,725 to −2,100; this lands at −1,676, short by 49 tokens (2.8%). It is not spread thin — it is two opposing errors in the audit's own estimates:

• the three funded additions cost 239 tokens more than funded: F-01 271 actual vs +130 budgeted; F-02 162 vs +120; F-03 +96 net vs +40. Each was trimmed once already (F-01 from 407 tokens, F-02 from 250); trimming further would start dropping the load-bearing clauses each was funded to carry.
• the deletions cut about 190 tokens more than the audit's per-span estimates, which is what absorbs most of that.

Closing the last 49 would mean cutting content no finding covers. Deliberately not done.

follow-up for objectstack-data / objectstack-platform

Both anchors are stronger than what this PR deleted, on every axis but one. Verified by heading on origin/claude/issue-14297-skills-data-optimization and origin/claude/issue-14299-skills-platform-optimization (what will merge):

• objectstack-data/rules/datasources.md — byte-identical to origin/main on the data flight's branch; headings ## schemaMode — who owns the schema, ## Auto-connect (no onEnable), ## Credentials — fail-closed, ## Writes — double opt-in. ✅
• objectstack-platform/SKILL.md → ## Driver Selection Guide — carries driver packages, class names, and the Turso "Cloud / EE only … UnsupportedDriverError" caveat that the deleted api table omitted. ✅ Also ## Well-Known Plugin Names & Services and rules/service-registry.md both present. ✅
• the one gap: neither anchor names the driver id vocabulary an author actually writes in defineDatasource({ driver: … }) — postgres, mysql, mongodb, sqlite, sqlite-wasm, turso, memory, and the mongo alias. The deleted api table did. Nothing is lost here — the pointer names the authoritative source, packages/spec/src/data/driver/config-registry.zod.ts:163 (resolveDriverId handles the aliases) — but a row in objectstack-data/rules/datasources.md would be the right home. Not filed as a card: it is one row inside a flight already in review; raising it here so that flight's reviewer can take it.

One file outside the declared surface, and why

scripts/role-word-baseline.json — check:role-word went red on this branch with its ratchet-DOWN remedy, because API-C-03 deleted the file's single baselined occurrence of the reserved word (the Security Layers row | **RBAC** | Object | Role-based access control (profile → permissions) |). The gate names --update as the author's own path when a baselined file goes clean; leaving the entry would leave budget a later edit could spend silently. Baseline 43 → 42 files; the skills/objectstack-api/SKILL.md row is dropped, no other row moves. Committed separately.

Out-of-scope card filed

#14446 — declared ≠ enforced (ADR-0049): RealtimeEventType (packages/spec/src/api/realtime.zod.ts:33-40) spells record.* while the platform emits data.record.* (api/events.zod.ts:139-141), and SubscriptionSchema.filters is z.unknown().optional() (realtime.zod.ts:49). finding label, unassigned, no pm-state, no priority. Dedupe searched first — the four nearest cards (#4602, #4626, #4673, #9055) are all closed and none covers this pair.

Gates — head sha 19ee5853

Union re-derived after regeneration and again after the final commit: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands → 42 commands (the .mdx output pulled in the docs family; the role-word baseline added 6 more: check:bash32-floor, check:cli-command-ids, check:entry-guard, check:parse-guard, check:pnpm-filter-targets, check:watch-hint-literal). All 42 run at 19ee5853; every exit code captured before any pipe.

41 green, 1 NOT MEASURED, 0 red.

• node scripts/check-skills-token-ratchet.mjs → ✓ … 38 authored bundle file(s) within their ceilings
• pnpm --filter @objectstack/spec check:skill-examples → ✅ 255 prose examples type-check across 3 surface(s) — every marked block parsed, so tsc ran the SEMANTIC pass on all of them (run under the shared verify lock; os-verify-lock: VERDICT command-exit 0). @objectstack/spec, @objectstack/client-react and @objectstack/formula closures built first, also under the lock — VERDICT command-exit 0 — so this gate could refuse rather than false-green.
• pnpm check:skill-identifier-liveness → OK — Leg 1: 488 citation(s) over 48 published file(s) …; Leg 2: 9 registered exhaustive section(s), 0 ledgered gap(s) (baseline was 500 citations; the drop is the deleted tables)
• pnpm check:skill-compatibility → ✓ … 11 SKILL.md file(s) reconciled against 78 workspace packages
• pnpm --filter @objectstack/spec check:skill-docs → ✅ Skill docs in sync
• pnpm check:role-word → ✓ after the ratchet-down
• node scripts/check-nul-bytes.mjs → OK (scanned 7875 text file(s) … no raw ASCII control bytes), plus a direct control-byte grep over the three edited files: no hits
• NOT MEASURED:node scripts/check-test-completeness.mjs exits 3, its own "PREREQUISITE NOT MET" code — it needs a saved turbo run test log this run has no reason to produce. Its own text: "Nothing was measured … It is NOT a finding". CI supplies the log.

Two gates were exit-3 / exit-1 prerequisite states on the first pass and turned green once the closures were built, not by any edit: check:doc-formula-expressions + check:doc-security-posture (needed @objectstack/formula built) and check:docs (needed gen:schema, which build runs first).

Labels

skip-changeset — nothing released by any package changes. Checked against scripts/check-empty-changeset.mjs's own enumeration (:357: "It releases nothing (.github/, .claude/, skills/, docs/, content/, examples/…)"); this diff is skills/** + content/docs/** + one scripts/ ledger. needs:contract-review on both this PR and the card — the OCC contract, the error-ledger rule and the http.server mount timing are contract-semantics claims.

Stays draft: governed face.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LraLgQVGq8egUwfYZpbYt1

---

Generated by Claude Code

[os-litant]

Part of #14304

The audit record this implements is posted verbatim on the card. Every claim written into the file was re-verified at source on this branch's base; the file:line for each is below. evals/README.md is untouched (API-H-01 is deferred to #14296 item 2), so the card stays open — that is why the first line is Part of, not a closing keyword.

Per-item: 落点 | before | after

finding	落点 (before)	before	after
API-E-01	SKILL.md:117-146 — the leading os:check example	authored RestApiEndpointSchema "via the REST API plugin"	deleted. The one live fact (auth is the flat public + permissions pair, no name/request/response field) folded into Auth Configuration
API-C-01	:472-510 Datasource Configuration + Supported Drivers	a defineDatasource example and a 7-row driver table	deleted → one pointer: objectstack-data rules/datasources.md, objectstack-platform Driver Selection Guide, and data/driver/config-registry.zod.ts for the id vocabulary
API-C-02	:513-538 Inter-Service Communication	IDataEngine contract prose + a marked block whose declare const kernel fabricated the host	deleted → the section's slot now carries the API-F-02 construct; service resolution points at objectstack-platform rules/service-registry.md
API-C-03	:458-468 Security Layers	a 4-row table naming no authorable key + a callout restating its own Description column	deleted → one boundary line under Authentication & Authorization
API-D-01 + API-F-05 + API-A-03	:316-366 Service Discovery / Health	a ServiceInfoos:check example, a JSON health body, /ready prose	rewritten to 3 lines — all three are response surfaces, nothing to author
API-D-02	:383-396 Handler Status	a 3-row table its own callout neutralised ("nothing reads it at runtime")	deleted; the now-single-child ## Dispatcher & Routing wrapper collapses into ## Dispatcher Error Codes
API-B-01	:419-429	third rendering of "no nested auth block" + an unmarked duplicate fragment	deleted, merged into one sentence that also carries the API-E-01 fold
API-B-02 + API-G-01	:203-209	a second objectstack validate gate block 384 lines from the first	deleted — the gate is stated once, in Verify your work, in the bundle-dominant os spelling
API-B-03	:65-71, :283-313, :559-563	the apiMethods primitives/derived rule stated 3×	once. Callout → 3 lines; derived table drops the 3 rows with no route and no derivation (history/restore/purge keep a one-line mention); Best Practice 6 stops restating it
API-B-05	:22-28	preamble restating the frontmatter above the fold	deleted
API-A-01	:31-39 "When to Use This Skill"	6 bullets, 3 of which misroute	Skill Boundaries table, matching objectstack-data / objectstack-query
API-A-02	frontmatter :3-12	promises "batch/versioning contracts"	"batch contracts" — versioning.zod.ts has zero consumers outside a pin test
API-A-03	:83-94	three /meta client query-param contracts	2 lines saying they are client contracts nothing declares
API-D-03	:544-547, :556-558	Best Practices 1 and 4	deleted (1 duplicates :273 and is wrong for the carve-out; 4 names no key and no gate)
API-D-04	:569-576	Pitfalls 1, 2, 4	deleted — FLS has no authorable spelling in the bundle, the page sizes match no platform constant, rate limiting is already the D6 rule
API-D-05	:191-198	two why-paragraphs after the carve-out rule	deleted, rule kept
API-F-04 + API-G-03	:275-279	environment-scoped routes + projectResolution, 0 usages	deleted (takes the retired project gloss with it)
API-F-06	:404-411	two declared-but-unenforced realtime notes	deleted from the skill; filed as #14446
API-G-02	:481	defineDatasource imported from the root barrel	moot — deleted with API-C-01
API-F-01(add)	gap — :164 named http.server with no example	one table cell	new ## Code routes: mounting on http.server` section
API-F-02(add)	gap — :548-555	frontmatter promised "error envelopes"; the ledger rule was absent	new ## Error Envelopes & the Code Ledger (ADR-0112)
API-F-03(add)	:575-576	"use optimistic locking (version field)", naming no spelling	the two real spellings, body-wins, 409 CONCURRENT_UPDATE

The three funded additions — every claim, with its source

1. http.server code mount — verified against all three shipping sites (examples/app-showcase/src/system/server/recalc-endpoint.ts:48-118, packages/plugins/plugin-sharing/src/sharing-plugin.ts:787-790, packages/plugins/plugin-approvals/src/approvals-plugin.ts:353-356).

• dual lookup readServer('http.server') ?? readServer('http-server'), canonical first — sharing-plugin.ts:787-790, approvals-plugin.ts:353-356; both carry the same comment that http.server is "the ONLY name present on all provider paths".
• kernel:ready, not later — packages/spec/src/contracts/plugin-lifecycle-events.ts:70-91: listen() is deferred to kernel:listeningbecause "route registration in Hono … seals the matcher the first time a request is matched"; recalc-endpoint.ts:110-112 hooks kernel:ready.
• the handler signature — RouteHandler = (req: IHttpRequest, res: IHttpResponse) at packages/spec/src/contracts/http-server.ts:108-111; IHttpResponse.status(code): IHttpResponse at :77 (so res.status(200).json(…) chains); IHttpServer.post at :216.
• the block is NOT os:check-marked, deliberately. See "Assumption 3" below — this is measured, not assumed.

2. ADR-0112 error-code ledger — packages/spec/src/api/error-code-ledger.zod.ts:6-56 states the two tiers, "An unregistered code fails schema parse — which fails the envelope conformance suites — which fails CI", the framework-packages-only scope rule (#4805, maintainer ruling 2026-08-03 re-confirmed 2026-08-09), and the downstream composition. Functions re-located by content on this base: makeApiErrorSchema at packages/spec/src/api/contract.zod.ts:146, envelopeViolations at :215.

3. OCC — packages/rest/src/rest-server.ts:7710-7727 is the PATCH /api/v1/data/:object/:id route: If-Match header or expectedVersion body field, const expectedVersion = bodyVersion ?? ifMatchHeader (body wins), and the field is stripped from the write payload. The token semantics, the 409 and the "" refusal are the spec's own .describe() at packages/spec/src/api/protocol.zod.ts:2097-2102. CONCURRENT_UPDATE is registered at packages/spec/src/api/error-code-ledger.zod.ts:168 and pinned to 409 at packages/rest/src/rest-unclassified-fault-status.test.ts:230.

premise_false

API-F-01, the "getService is async" clause — the audit's premise is false and was NOT written. The real host contract is PluginContext.getService[T](name: string): T (packages/core/src/types.ts:36, doc comment @throws Error if service not found) — synchronous, and it throws. Measured on this base:

• await ctx.getService in packages/plugins/**, excluding tests: 0 occurrences.
• non-awaited ctx.getService( / ctx.getService[T](, same scope: 112.
• the three app sites are ctx?.getService?.('manifest') with no await (packages/apps/{account,setup,studio}/src/index.ts:{60,55,68}).

The audit's evidence for "async" was recalc-endpoint.ts:52, which awaits — but that file's ctx is its own locally declared RecalcHostContext (:30-35) whose getService?: (name) => Promise<T> is a shim, not the host. That is precisely the defect API-C-02 was deleted for, so the skill states the true rule instead: getService is synchronous and throws, which is exactly why each name needs its own try and a() ?? b() in one try never reaches b.

The :532 "fix or unmark" item needs neither — the block is deleted with API-C-02, so no marker survives to prove or disprove anything.

PM assumptions — all six measured

#	assumption	verdict
1	skills/objectstack-api/** byte-identical a59f78d ↔ base	HOLDS — git diff a59f78d 96b627d1 -- skills/objectstack-api/ is empty; every audited span matched by content
2	the frontmatter edit forces regeneration of BOTH generated files	HOLDS — check:skill-docs red on both before gen:skill-docs, green after; the .mdx pulled 20 docs-family gates into the union, re-derived and run
3	the real PluginContext is unreachable from the os:check skills surface	HOLDS, measured directly.SURFACES[0] resolves resolutionDir/selfPackages = packages/spec only (packages/spec/scripts/check-skill-examples.ts:526-532). Probed it: a temporary marked block importing PluginContext from @objectstack/core fails TS2307: Cannot find module '@objectstack/core'. Probe reverted and proven byte-identical (worktree blob hash == HEAD blob hash, git diff HEAD empty). ⇒ the F-01 block stays unmarked rather than earning a marker with a fabricated stand-in
4	RestApiEndpointSchema 0 consumers · no plugin-rest-api package · no endpoints key	HOLDS — 0 hits outside packages/spec/src/api/plugin-rest-api* (positive control: the same grep for ApiEndpoint returns many); ls packages/plugins/ | grep -i rest empty; RestApiPluginConfig (packages/rest/src/rest-api-plugin.ts:95-105) is exactly {serverServiceName?, protocolServiceName?, kernelManagerServiceName?, api?}
5	a heading in this file may be bound by check:skill-identifier-liveness Leg 2	YES, and it is. Binding api-methods binds ## API Methods (Operations) to ApiMethod (scripts/check-skill-identifier-liveness.mjs:285-292). Fixed the author's way: the heading and all six primitives stay; only the derived rows moved. Gate green, 9 bindings, 0 ledgered gaps
6	a false premise is skipped and listed	applied to the getService clause above

Token delta

file	before	after	Δ	ceiling
skills/objectstack-api/SKILL.md	6311	4635	−1,676 (−26.6%)	6319, unchanged (headroom 8 → 1684)
skills/objectstack-api/evals/README.md	546	546	0	546 — untouched, API-H-01 deferred
skills/objectstack-api/references/_index.md	888	888	0	generator-owned, untouched
bundle, ratcheted (authored)	171406	169730	−1,676	171743

607 → 428 lines. No ceiling raised, no new file, no file deleted, and scripts/check-skills-token-ratchet.mjs is not edited.

The gap, itemised rather than smoothed. The dispatch target was −1,725 to −2,100; this lands at −1,676, short by 49 tokens (2.8%). It is not spread thin — it is two opposing errors in the audit's own estimates:

• the three funded additions cost 239 tokens more than funded: F-01 271 actual vs +130 budgeted; F-02 162 vs +120; F-03 +96 net vs +40. Each was trimmed once already (F-01 from 407 tokens, F-02 from 250); trimming further would start dropping the load-bearing clauses each was funded to carry.
• the deletions cut about 190 tokens more than the audit's per-span estimates, which is what absorbs most of that.

Closing the last 49 would mean cutting content no finding covers. Deliberately not done.

follow-up for objectstack-data / objectstack-platform

Both anchors are stronger than what this PR deleted, on every axis but one. Verified by heading on origin/claude/issue-14297-skills-data-optimization and origin/claude/issue-14299-skills-platform-optimization (what will merge):

• objectstack-data/rules/datasources.md — byte-identical to origin/main on the data flight's branch; headings ## schemaMode — who owns the schema, ## Auto-connect (no onEnable), ## Credentials — fail-closed, ## Writes — double opt-in. ✅
• objectstack-platform/SKILL.md → ## Driver Selection Guide — carries driver packages, class names, and the Turso "Cloud / EE only … UnsupportedDriverError" caveat that the deleted api table omitted. ✅ Also ## Well-Known Plugin Names & Services and rules/service-registry.md both present. ✅
• the one gap: neither anchor names the driver id vocabulary an author actually writes in defineDatasource({ driver: … }) — postgres, mysql, mongodb, sqlite, sqlite-wasm, turso, memory, and the mongo alias. The deleted api table did. Nothing is lost here — the pointer names the authoritative source, packages/spec/src/data/driver/config-registry.zod.ts:163 (resolveDriverId handles the aliases) — but a row in objectstack-data/rules/datasources.md would be the right home. Not filed as a card: it is one row inside a flight already in review; raising it here so that flight's reviewer can take it.

One file outside the declared surface, and why

scripts/role-word-baseline.json — check:role-word went red on this branch with its ratchet-DOWN remedy, because API-C-03 deleted the file's single baselined occurrence of the reserved word (the Security Layers row | **RBAC** | Object | Role-based access control (profile → permissions) |). The gate names --update as the author's own path when a baselined file goes clean; leaving the entry would leave budget a later edit could spend silently. Baseline 43 → 42 files; the skills/objectstack-api/SKILL.md row is dropped, no other row moves. Committed separately.

Out-of-scope card filed

#14446 — declared ≠ enforced (ADR-0049): RealtimeEventType (packages/spec/src/api/realtime.zod.ts:33-40) spells record.* while the platform emits data.record.* (api/events.zod.ts:139-141), and SubscriptionSchema.filters is z.unknown().optional() (realtime.zod.ts:49). finding label, unassigned, no pm-state, no priority. Dedupe searched first — the four nearest cards (#4602, #4626, #4673, #9055) are all closed and none covers this pair.

Gates — head sha 19ee5853

Union re-derived after regeneration and again after the final commit: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands → 42 commands (the .mdx output pulled in the docs family; the role-word baseline added 6 more: check:bash32-floor, check:cli-command-ids, check:entry-guard, check:parse-guard, check:pnpm-filter-targets, check:watch-hint-literal). All 42 run at 19ee5853; every exit code captured before any pipe.

41 green, 1 NOT MEASURED, 0 red.

• node scripts/check-skills-token-ratchet.mjs → ✓ … 38 authored bundle file(s) within their ceilings
• pnpm --filter @objectstack/spec check:skill-examples → ✅ 255 prose examples type-check across 3 surface(s) — every marked block parsed, so tsc ran the SEMANTIC pass on all of them (run under the shared verify lock; os-verify-lock: VERDICT command-exit 0). @objectstack/spec, @objectstack/client-react and @objectstack/formula closures built first, also under the lock — VERDICT command-exit 0 — so this gate could refuse rather than false-green.
• pnpm check:skill-identifier-liveness → OK — Leg 1: 488 citation(s) over 48 published file(s) …; Leg 2: 9 registered exhaustive section(s), 0 ledgered gap(s) (baseline was 500 citations; the drop is the deleted tables)
• pnpm check:skill-compatibility → ✓ … 11 SKILL.md file(s) reconciled against 78 workspace packages
• pnpm --filter @objectstack/spec check:skill-docs → ✅ Skill docs in sync
• pnpm check:role-word → ✓ after the ratchet-down
• node scripts/check-nul-bytes.mjs → OK (scanned 7875 text file(s) … no raw ASCII control bytes), plus a direct control-byte grep over the three edited files: no hits
• NOT MEASURED:node scripts/check-test-completeness.mjs exits 3, its own "PREREQUISITE NOT MET" code — it needs a saved turbo run test log this run has no reason to produce. Its own text: "Nothing was measured … It is NOT a finding". CI supplies the log.

Two gates were exit-3 / exit-1 prerequisite states on the first pass and turned green once the closures were built, not by any edit: check:doc-formula-expressions + check:doc-security-posture (needed @objectstack/formula built) and check:docs (needed gen:schema, which build runs first).

Labels

skip-changeset — nothing released by any package changes. Checked against scripts/check-empty-changeset.mjs's own enumeration (:357: "It releases nothing (.github/, .claude/, skills/, docs/, content/, examples/…)"); this diff is skills/** + content/docs/** + one scripts/ ledger. needs:contract-review on both this PR and the card — the OCC contract, the error-ledger rule and the http.server mount timing are contract-semantics claims.

Stays draft: governed face.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LraLgQVGq8egUwfYZpbYt1

---

Generated by Claude Code

[os-litant]

Part of #14304

The audit record this implements is posted verbatim on the card. Every claim written into the file was re-verified at source on this branch's base; the file:line for each is below. evals/README.md is untouched (API-H-01 is deferred to #14296 item 2), so the card stays open — that is why the first line is Part of, not a closing keyword.

Per-item: 落点 | before | after

finding	落点 (before)	before	after
API-E-01	SKILL.md:117-146 — the leading os:check example	authored RestApiEndpointSchema "via the REST API plugin"	deleted. The one live fact (auth is the flat public + permissions pair, no name/request/response field) folded into Auth Configuration
API-C-01	:472-510 Datasource Configuration + Supported Drivers	a defineDatasource example and a 7-row driver table	deleted → one pointer: objectstack-data rules/datasources.md, objectstack-platform Driver Selection Guide, and data/driver/config-registry.zod.ts for the id vocabulary
API-C-02	:513-538 Inter-Service Communication	IDataEngine contract prose + a marked block whose declare const kernel fabricated the host	deleted → the section's slot now carries the API-F-02 construct; service resolution points at objectstack-platform rules/service-registry.md
API-C-03	:458-468 Security Layers	a 4-row table naming no authorable key + a callout restating its own Description column	deleted → one boundary line under Authentication & Authorization
API-D-01 + API-F-05 + API-A-03	:316-366 Service Discovery / Health	a ServiceInfoos:check example, a JSON health body, /ready prose	rewritten to 3 lines — all three are response surfaces, nothing to author
API-D-02	:383-396 Handler Status	a 3-row table its own callout neutralised ("nothing reads it at runtime")	deleted; the now-single-child ## Dispatcher & Routing wrapper collapses into ## Dispatcher Error Codes
API-B-01	:419-429	third rendering of "no nested auth block" + an unmarked duplicate fragment	deleted, merged into one sentence that also carries the API-E-01 fold
API-B-02 + API-G-01	:203-209	a second objectstack validate gate block 384 lines from the first	deleted — the gate is stated once, in Verify your work, in the bundle-dominant os spelling
API-B-03	:65-71, :283-313, :559-563	the apiMethods primitives/derived rule stated 3×	once. Callout → 3 lines; derived table drops the 3 rows with no route and no derivation (history/restore/purge keep a one-line mention); Best Practice 6 stops restating it
API-B-05	:22-28	preamble restating the frontmatter above the fold	deleted
API-A-01	:31-39 "When to Use This Skill"	6 bullets, 3 of which misroute	Skill Boundaries table, matching objectstack-data / objectstack-query
API-A-02	frontmatter :3-12	promises "batch/versioning contracts"	"batch contracts" — versioning.zod.ts has zero consumers outside a pin test
API-A-03	:83-94	three /meta client query-param contracts	2 lines saying they are client contracts nothing declares
API-D-03	:544-547, :556-558	Best Practices 1 and 4	deleted (1 duplicates :273 and is wrong for the carve-out; 4 names no key and no gate)
API-D-04	:569-576	Pitfalls 1, 2, 4	deleted — FLS has no authorable spelling in the bundle, the page sizes match no platform constant, rate limiting is already the D6 rule
API-D-05	:191-198	two why-paragraphs after the carve-out rule	deleted, rule kept
API-F-04 + API-G-03	:275-279	environment-scoped routes + projectResolution, 0 usages	deleted (takes the retired project gloss with it)
API-F-06	:404-411	two declared-but-unenforced realtime notes	deleted from the skill; filed as #14446
API-G-02	:481	defineDatasource imported from the root barrel	moot — deleted with API-C-01
API-F-01(add)	gap — :164 named http.server with no example	one table cell	new ## Code routes: mounting on http.server` section
API-F-02(add)	gap — :548-555	frontmatter promised "error envelopes"; the ledger rule was absent	new ## Error Envelopes & the Code Ledger (ADR-0112)
API-F-03(add)	:575-576	"use optimistic locking (version field)", naming no spelling	the two real spellings, body-wins, 409 CONCURRENT_UPDATE

The three funded additions — every claim, with its source

1. http.server code mount — verified against all three shipping sites (examples/app-showcase/src/system/server/recalc-endpoint.ts:48-118, packages/plugins/plugin-sharing/src/sharing-plugin.ts:787-790, packages/plugins/plugin-approvals/src/approvals-plugin.ts:353-356).

• dual lookup readServer('http.server') ?? readServer('http-server'), canonical first — sharing-plugin.ts:787-790, approvals-plugin.ts:353-356; both carry the same comment that http.server is "the ONLY name present on all provider paths".
• kernel:ready, not later — packages/spec/src/contracts/plugin-lifecycle-events.ts:70-91: listen() is deferred to kernel:listeningbecause "route registration in Hono … seals the matcher the first time a request is matched"; recalc-endpoint.ts:110-112 hooks kernel:ready.
• the handler signature — RouteHandler = (req: IHttpRequest, res: IHttpResponse) at packages/spec/src/contracts/http-server.ts:108-111; IHttpResponse.status(code): IHttpResponse at :77 (so res.status(200).json(…) chains); IHttpServer.post at :216.
• the block is NOT os:check-marked, deliberately. See "Assumption 3" below — this is measured, not assumed.

2. ADR-0112 error-code ledger — packages/spec/src/api/error-code-ledger.zod.ts:6-56 states the two tiers, "An unregistered code fails schema parse — which fails the envelope conformance suites — which fails CI", the framework-packages-only scope rule (#4805, maintainer ruling 2026-08-03 re-confirmed 2026-08-09), and the downstream composition. Functions re-located by content on this base: makeApiErrorSchema at packages/spec/src/api/contract.zod.ts:146, envelopeViolations at :215.

3. OCC — packages/rest/src/rest-server.ts:7710-7727 is the PATCH /api/v1/data/:object/:id route: If-Match header or expectedVersion body field, const expectedVersion = bodyVersion ?? ifMatchHeader (body wins), and the field is stripped from the write payload. The token semantics, the 409 and the "" refusal are the spec's own .describe() at packages/spec/src/api/protocol.zod.ts:2097-2102. CONCURRENT_UPDATE is registered at packages/spec/src/api/error-code-ledger.zod.ts:168 and pinned to 409 at packages/rest/src/rest-unclassified-fault-status.test.ts:230.

premise_false

API-F-01, the "getService is async" clause — the audit's premise is false and was NOT written. The real host contract is PluginContext.getService[T](name: string): T (packages/core/src/types.ts:36, doc comment @throws Error if service not found) — synchronous, and it throws. Measured on this base:

• await ctx.getService in packages/plugins/**, excluding tests: 0 occurrences.
• non-awaited ctx.getService( / ctx.getService[T](, same scope: 112.
• the three app sites are ctx?.getService?.('manifest') with no await (packages/apps/{account,setup,studio}/src/index.ts:{60,55,68}).

The audit's evidence for "async" was recalc-endpoint.ts:52, which awaits — but that file's ctx is its own locally declared RecalcHostContext (:30-35) whose getService?: (name) => Promise<T> is a shim, not the host. That is precisely the defect API-C-02 was deleted for, so the skill states the true rule instead: getService is synchronous and throws, which is exactly why each name needs its own try and a() ?? b() in one try never reaches b.

The :532 "fix or unmark" item needs neither — the block is deleted with API-C-02, so no marker survives to prove or disprove anything.

PM assumptions — all six measured

#	assumption	verdict
1	skills/objectstack-api/** byte-identical a59f78d ↔ base	HOLDS — git diff a59f78d 96b627d1 -- skills/objectstack-api/ is empty; every audited span matched by content
2	the frontmatter edit forces regeneration of BOTH generated files	HOLDS — check:skill-docs red on both before gen:skill-docs, green after; the .mdx pulled 20 docs-family gates into the union, re-derived and run
3	the real PluginContext is unreachable from the os:check skills surface	HOLDS, measured directly.SURFACES[0] resolves resolutionDir/selfPackages = packages/spec only (packages/spec/scripts/check-skill-examples.ts:526-532). Probed it: a temporary marked block importing PluginContext from @objectstack/core fails TS2307: Cannot find module '@objectstack/core'. Probe reverted and proven byte-identical (worktree blob hash == HEAD blob hash, git diff HEAD empty). ⇒ the F-01 block stays unmarked rather than earning a marker with a fabricated stand-in
4	RestApiEndpointSchema 0 consumers · no plugin-rest-api package · no endpoints key	HOLDS — 0 hits outside packages/spec/src/api/plugin-rest-api* (positive control: the same grep for ApiEndpoint returns many); ls packages/plugins/ | grep -i rest empty; RestApiPluginConfig (packages/rest/src/rest-api-plugin.ts:95-105) is exactly {serverServiceName?, protocolServiceName?, kernelManagerServiceName?, api?}
5	a heading in this file may be bound by check:skill-identifier-liveness Leg 2	YES, and it is. Binding api-methods binds ## API Methods (Operations) to ApiMethod (scripts/check-skill-identifier-liveness.mjs:285-292). Fixed the author's way: the heading and all six primitives stay; only the derived rows moved. Gate green, 9 bindings, 0 ledgered gaps
6	a false premise is skipped and listed	applied to the getService clause above

Token delta

file	before	after	Δ	ceiling
skills/objectstack-api/SKILL.md	6311	4635	−1,676 (−26.6%)	6319, unchanged (headroom 8 → 1684)
skills/objectstack-api/evals/README.md	546	546	0	546 — untouched, API-H-01 deferred
skills/objectstack-api/references/_index.md	888	888	0	generator-owned, untouched
bundle, ratcheted (authored)	171406	169730	−1,676	171743

607 → 428 lines. No ceiling raised, no new file, no file deleted, and scripts/check-skills-token-ratchet.mjs is not edited.

The gap, itemised rather than smoothed. The dispatch target was −1,725 to −2,100; this lands at −1,676, short by 49 tokens (2.8%). It is not spread thin — it is two opposing errors in the audit's own estimates:

• the three funded additions cost 239 tokens more than funded: F-01 271 actual vs +130 budgeted; F-02 162 vs +120; F-03 +96 net vs +40. Each was trimmed once already (F-01 from 407 tokens, F-02 from 250); trimming further would start dropping the load-bearing clauses each was funded to carry.
• the deletions cut about 190 tokens more than the audit's per-span estimates, which is what absorbs most of that.

Closing the last 49 would mean cutting content no finding covers. Deliberately not done.

follow-up for objectstack-data / objectstack-platform

Both anchors are stronger than what this PR deleted, on every axis but one. Verified by heading on origin/claude/issue-14297-skills-data-optimization and origin/claude/issue-14299-skills-platform-optimization (what will merge):

• objectstack-data/rules/datasources.md — byte-identical to origin/main on the data flight's branch; headings ## schemaMode — who owns the schema, ## Auto-connect (no onEnable), ## Credentials — fail-closed, ## Writes — double opt-in. ✅
• objectstack-platform/SKILL.md → ## Driver Selection Guide — carries driver packages, class names, and the Turso "Cloud / EE only … UnsupportedDriverError" caveat that the deleted api table omitted. ✅ Also ## Well-Known Plugin Names & Services and rules/service-registry.md both present. ✅
• the one gap: neither anchor names the driver id vocabulary an author actually writes in defineDatasource({ driver: … }) — postgres, mysql, mongodb, sqlite, sqlite-wasm, turso, memory, and the mongo alias. The deleted api table did. Nothing is lost here — the pointer names the authoritative source, packages/spec/src/data/driver/config-registry.zod.ts:163 (resolveDriverId handles the aliases) — but a row in objectstack-data/rules/datasources.md would be the right home. Not filed as a card: it is one row inside a flight already in review; raising it here so that flight's reviewer can take it.

One file outside the declared surface, and why

scripts/role-word-baseline.json — check:role-word went red on this branch with its ratchet-DOWN remedy, because API-C-03 deleted the file's single baselined occurrence of the reserved word (the Security Layers row | **RBAC** | Object | Role-based access control (profile → permissions) |). The gate names --update as the author's own path when a baselined file goes clean; leaving the entry would leave budget a later edit could spend silently. Baseline 43 → 42 files; the skills/objectstack-api/SKILL.md row is dropped, no other row moves. Committed separately.

Out-of-scope card filed

#14446 — declared ≠ enforced (ADR-0049): RealtimeEventType (packages/spec/src/api/realtime.zod.ts:33-40) spells record.* while the platform emits data.record.* (api/events.zod.ts:139-141), and SubscriptionSchema.filters is z.unknown().optional() (realtime.zod.ts:49). finding label, unassigned, no pm-state, no priority. Dedupe searched first — the four nearest cards (#4602, #4626, #4673, #9055) are all closed and none covers this pair.

Gates — head sha 19ee5853

Union re-derived after regeneration and again after the final commit: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands → 42 commands (the .mdx output pulled in the docs family; the role-word baseline added 6 more: check:bash32-floor, check:cli-command-ids, check:entry-guard, check:parse-guard, check:pnpm-filter-targets, check:watch-hint-literal). All 42 run at 19ee5853; every exit code captured before any pipe.

41 green, 1 NOT MEASURED, 0 red.

• node scripts/check-skills-token-ratchet.mjs → ✓ … 38 authored bundle file(s) within their ceilings
• pnpm --filter @objectstack/spec check:skill-examples → ✅ 255 prose examples type-check across 3 surface(s) — every marked block parsed, so tsc ran the SEMANTIC pass on all of them (run under the shared verify lock; os-verify-lock: VERDICT command-exit 0). @objectstack/spec, @objectstack/client-react and @objectstack/formula closures built first, also under the lock — VERDICT command-exit 0 — so this gate could refuse rather than false-green.
• pnpm check:skill-identifier-liveness → OK — Leg 1: 488 citation(s) over 48 published file(s) …; Leg 2: 9 registered exhaustive section(s), 0 ledgered gap(s) (baseline was 500 citations; the drop is the deleted tables)
• pnpm check:skill-compatibility → ✓ … 11 SKILL.md file(s) reconciled against 78 workspace packages
• pnpm --filter @objectstack/spec check:skill-docs → ✅ Skill docs in sync
• pnpm check:role-word → ✓ after the ratchet-down
• node scripts/check-nul-bytes.mjs → OK (scanned 7875 text file(s) … no raw ASCII control bytes), plus a direct control-byte grep over the three edited files: no hits
• NOT MEASURED:node scripts/check-test-completeness.mjs exits 3, its own "PREREQUISITE NOT MET" code — it needs a saved turbo run test log this run has no reason to produce. Its own text: "Nothing was measured … It is NOT a finding". CI supplies the log.

Two gates were exit-3 / exit-1 prerequisite states on the first pass and turned green once the closures were built, not by any edit: check:doc-formula-expressions + check:doc-security-posture (needed @objectstack/formula built) and check:docs (needed gen:schema, which build runs first).

Labels

skip-changeset — nothing released by any package changes. Checked against scripts/check-empty-changeset.mjs's own enumeration (:357: "It releases nothing (.github/, .claude/, skills/, docs/, content/, examples/…)"); this diff is skills/** + content/docs/** + one scripts/ ledger. needs:contract-review on both this PR and the card — the OCC contract, the error-ledger rule and the http.server mount timing are contract-semantics claims.

Stays draft: governed face.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LraLgQVGq8egUwfYZpbYt1

---

Generated by Claude Code

[os-litant]

Part of #14304

The audit record this implements is posted verbatim on the card. Every claim written into the file was re-verified at source on this branch's base; the file:line for each is below. evals/README.md is untouched (API-H-01 is deferred to #14296 item 2), so the card stays open — that is why the first line is Part of, not a closing keyword.

Per-item: 落点 | before | after

finding	落点 (before)	before	after
API-E-01	SKILL.md:117-146 — the leading os:check example	authored RestApiEndpointSchema "via the REST API plugin"	deleted. The one live fact (auth is the flat public + permissions pair, no name/request/response field) folded into Auth Configuration
API-C-01	:472-510 Datasource Configuration + Supported Drivers	a defineDatasource example and a 7-row driver table	deleted → one pointer: objectstack-data rules/datasources.md, objectstack-platform Driver Selection Guide, and data/driver/config-registry.zod.ts for the id vocabulary
API-C-02	:513-538 Inter-Service Communication	IDataEngine contract prose + a marked block whose declare const kernel fabricated the host	deleted → the section's slot now carries the API-F-02 construct; service resolution points at objectstack-platform rules/service-registry.md
API-C-03	:458-468 Security Layers	a 4-row table naming no authorable key + a callout restating its own Description column	deleted → one boundary line under Authentication & Authorization
API-D-01 + API-F-05 + API-A-03	:316-366 Service Discovery / Health	a ServiceInfoos:check example, a JSON health body, /ready prose	rewritten to 3 lines — all three are response surfaces, nothing to author
API-D-02	:383-396 Handler Status	a 3-row table its own callout neutralised ("nothing reads it at runtime")	deleted; the now-single-child ## Dispatcher & Routing wrapper collapses into ## Dispatcher Error Codes
API-B-01	:419-429	third rendering of "no nested auth block" + an unmarked duplicate fragment	deleted, merged into one sentence that also carries the API-E-01 fold
API-B-02 + API-G-01	:203-209	a second objectstack validate gate block 384 lines from the first	deleted — the gate is stated once, in Verify your work, in the bundle-dominant os spelling
API-B-03	:65-71, :283-313, :559-563	the apiMethods primitives/derived rule stated 3×	once. Callout → 3 lines; derived table drops the 3 rows with no route and no derivation (history/restore/purge keep a one-line mention); Best Practice 6 stops restating it
API-B-05	:22-28	preamble restating the frontmatter above the fold	deleted
API-A-01	:31-39 "When to Use This Skill"	6 bullets, 3 of which misroute	Skill Boundaries table, matching objectstack-data / objectstack-query
API-A-02	frontmatter :3-12	promises "batch/versioning contracts"	"batch contracts" — versioning.zod.ts has zero consumers outside a pin test
API-A-03	:83-94	three /meta client query-param contracts	2 lines saying they are client contracts nothing declares
API-D-03	:544-547, :556-558	Best Practices 1 and 4	deleted (1 duplicates :273 and is wrong for the carve-out; 4 names no key and no gate)
API-D-04	:569-576	Pitfalls 1, 2, 4	deleted — FLS has no authorable spelling in the bundle, the page sizes match no platform constant, rate limiting is already the D6 rule
API-D-05	:191-198	two why-paragraphs after the carve-out rule	deleted, rule kept
API-F-04 + API-G-03	:275-279	environment-scoped routes + projectResolution, 0 usages	deleted (takes the retired project gloss with it)
API-F-06	:404-411	two declared-but-unenforced realtime notes	deleted from the skill; filed as #14446
API-G-02	:481	defineDatasource imported from the root barrel	moot — deleted with API-C-01
API-F-01(add)	gap — :164 named http.server with no example	one table cell	new ## Code routes: mounting on http.server` section
API-F-02(add)	gap — :548-555	frontmatter promised "error envelopes"; the ledger rule was absent	new ## Error Envelopes & the Code Ledger (ADR-0112)
API-F-03(add)	:575-576	"use optimistic locking (version field)", naming no spelling	the two real spellings, body-wins, 409 CONCURRENT_UPDATE

The three funded additions — every claim, with its source

1. http.server code mount — verified against all three shipping sites (examples/app-showcase/src/system/server/recalc-endpoint.ts:48-118, packages/plugins/plugin-sharing/src/sharing-plugin.ts:787-790, packages/plugins/plugin-approvals/src/approvals-plugin.ts:353-356).

• dual lookup readServer('http.server') ?? readServer('http-server'), canonical first — sharing-plugin.ts:787-790, approvals-plugin.ts:353-356; both carry the same comment that http.server is "the ONLY name present on all provider paths".
• kernel:ready, not later — packages/spec/src/contracts/plugin-lifecycle-events.ts:70-91: listen() is deferred to kernel:listeningbecause "route registration in Hono … seals the matcher the first time a request is matched"; recalc-endpoint.ts:110-112 hooks kernel:ready.
• the handler signature — RouteHandler = (req: IHttpRequest, res: IHttpResponse) at packages/spec/src/contracts/http-server.ts:108-111; IHttpResponse.status(code): IHttpResponse at :77 (so res.status(200).json(…) chains); IHttpServer.post at :216.
• the block is NOT os:check-marked, deliberately. See "Assumption 3" below — this is measured, not assumed.

2. ADR-0112 error-code ledger — packages/spec/src/api/error-code-ledger.zod.ts:6-56 states the two tiers, "An unregistered code fails schema parse — which fails the envelope conformance suites — which fails CI", the framework-packages-only scope rule (#4805, maintainer ruling 2026-08-03 re-confirmed 2026-08-09), and the downstream composition. Functions re-located by content on this base: makeApiErrorSchema at packages/spec/src/api/contract.zod.ts:146, envelopeViolations at :215.

3. OCC — packages/rest/src/rest-server.ts:7710-7727 is the PATCH /api/v1/data/:object/:id route: If-Match header or expectedVersion body field, const expectedVersion = bodyVersion ?? ifMatchHeader (body wins), and the field is stripped from the write payload. The token semantics, the 409 and the "" refusal are the spec's own .describe() at packages/spec/src/api/protocol.zod.ts:2097-2102. CONCURRENT_UPDATE is registered at packages/spec/src/api/error-code-ledger.zod.ts:168 and pinned to 409 at packages/rest/src/rest-unclassified-fault-status.test.ts:230.

premise_false

API-F-01, the "getService is async" clause — the audit's premise is false and was NOT written. The real host contract is PluginContext.getService[T](name: string): T (packages/core/src/types.ts:36, doc comment @throws Error if service not found) — synchronous, and it throws. Measured on this base:

• await ctx.getService in packages/plugins/**, excluding tests: 0 occurrences.
• non-awaited ctx.getService( / ctx.getService[T](, same scope: 112.
• the three app sites are ctx?.getService?.('manifest') with no await (packages/apps/{account,setup,studio}/src/index.ts:{60,55,68}).

The audit's evidence for "async" was recalc-endpoint.ts:52, which awaits — but that file's ctx is its own locally declared RecalcHostContext (:30-35) whose getService?: (name) => Promise<T> is a shim, not the host. That is precisely the defect API-C-02 was deleted for, so the skill states the true rule instead: getService is synchronous and throws, which is exactly why each name needs its own try and a() ?? b() in one try never reaches b.

The :532 "fix or unmark" item needs neither — the block is deleted with API-C-02, so no marker survives to prove or disprove anything.

PM assumptions — all six measured

#	assumption	verdict
1	skills/objectstack-api/** byte-identical a59f78d ↔ base	HOLDS — git diff a59f78d 96b627d1 -- skills/objectstack-api/ is empty; every audited span matched by content
2	the frontmatter edit forces regeneration of BOTH generated files	HOLDS — check:skill-docs red on both before gen:skill-docs, green after; the .mdx pulled 20 docs-family gates into the union, re-derived and run
3	the real PluginContext is unreachable from the os:check skills surface	HOLDS, measured directly.SURFACES[0] resolves resolutionDir/selfPackages = packages/spec only (packages/spec/scripts/check-skill-examples.ts:526-532). Probed it: a temporary marked block importing PluginContext from @objectstack/core fails TS2307: Cannot find module '@objectstack/core'. Probe reverted and proven byte-identical (worktree blob hash == HEAD blob hash, git diff HEAD empty). ⇒ the F-01 block stays unmarked rather than earning a marker with a fabricated stand-in
4	RestApiEndpointSchema 0 consumers · no plugin-rest-api package · no endpoints key	HOLDS — 0 hits outside packages/spec/src/api/plugin-rest-api* (positive control: the same grep for ApiEndpoint returns many); ls packages/plugins/ | grep -i rest empty; RestApiPluginConfig (packages/rest/src/rest-api-plugin.ts:95-105) is exactly {serverServiceName?, protocolServiceName?, kernelManagerServiceName?, api?}
5	a heading in this file may be bound by check:skill-identifier-liveness Leg 2	YES, and it is. Binding api-methods binds ## API Methods (Operations) to ApiMethod (scripts/check-skill-identifier-liveness.mjs:285-292). Fixed the author's way: the heading and all six primitives stay; only the derived rows moved. Gate green, 9 bindings, 0 ledgered gaps
6	a false premise is skipped and listed	applied to the getService clause above

Token delta

file	before	after	Δ	ceiling
skills/objectstack-api/SKILL.md	6311	4635	−1,676 (−26.6%)	6319, unchanged (headroom 8 → 1684)
skills/objectstack-api/evals/README.md	546	546	0	546 — untouched, API-H-01 deferred
skills/objectstack-api/references/_index.md	888	888	0	generator-owned, untouched
bundle, ratcheted (authored)	171406	169730	−1,676	171743

607 → 428 lines. No ceiling raised, no new file, no file deleted, and scripts/check-skills-token-ratchet.mjs is not edited.

The gap, itemised rather than smoothed. The dispatch target was −1,725 to −2,100; this lands at −1,676, short by 49 tokens (2.8%). It is not spread thin — it is two opposing errors in the audit's own estimates:

• the three funded additions cost 239 tokens more than funded: F-01 271 actual vs +130 budgeted; F-02 162 vs +120; F-03 +96 net vs +40. Each was trimmed once already (F-01 from 407 tokens, F-02 from 250); trimming further would start dropping the load-bearing clauses each was funded to carry.
• the deletions cut about 190 tokens more than the audit's per-span estimates, which is what absorbs most of that.

Closing the last 49 would mean cutting content no finding covers. Deliberately not done.

follow-up for objectstack-data / objectstack-platform

Both anchors are stronger than what this PR deleted, on every axis but one. Verified by heading on origin/claude/issue-14297-skills-data-optimization and origin/claude/issue-14299-skills-platform-optimization (what will merge):

• objectstack-data/rules/datasources.md — byte-identical to origin/main on the data flight's branch; headings ## schemaMode — who owns the schema, ## Auto-connect (no onEnable), ## Credentials — fail-closed, ## Writes — double opt-in. ✅
• objectstack-platform/SKILL.md → ## Driver Selection Guide — carries driver packages, class names, and the Turso "Cloud / EE only … UnsupportedDriverError" caveat that the deleted api table omitted. ✅ Also ## Well-Known Plugin Names & Services and rules/service-registry.md both present. ✅
• the one gap: neither anchor names the driver id vocabulary an author actually writes in defineDatasource({ driver: … }) — postgres, mysql, mongodb, sqlite, sqlite-wasm, turso, memory, and the mongo alias. The deleted api table did. Nothing is lost here — the pointer names the authoritative source, packages/spec/src/data/driver/config-registry.zod.ts:163 (resolveDriverId handles the aliases) — but a row in objectstack-data/rules/datasources.md would be the right home. Not filed as a card: it is one row inside a flight already in review; raising it here so that flight's reviewer can take it.

One file outside the declared surface, and why

scripts/role-word-baseline.json — check:role-word went red on this branch with its ratchet-DOWN remedy, because API-C-03 deleted the file's single baselined occurrence of the reserved word (the Security Layers row | **RBAC** | Object | Role-based access control (profile → permissions) |). The gate names --update as the author's own path when a baselined file goes clean; leaving the entry would leave budget a later edit could spend silently. Baseline 43 → 42 files; the skills/objectstack-api/SKILL.md row is dropped, no other row moves. Committed separately.

Out-of-scope card filed

#14446 — declared ≠ enforced (ADR-0049): RealtimeEventType (packages/spec/src/api/realtime.zod.ts:33-40) spells record.* while the platform emits data.record.* (api/events.zod.ts:139-141), and SubscriptionSchema.filters is z.unknown().optional() (realtime.zod.ts:49). finding label, unassigned, no pm-state, no priority. Dedupe searched first — the four nearest cards (#4602, #4626, #4673, #9055) are all closed and none covers this pair.

Gates — head sha 19ee5853

Union re-derived after regeneration and again after the final commit: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands → 42 commands (the .mdx output pulled in the docs family; the role-word baseline added 6 more: check:bash32-floor, check:cli-command-ids, check:entry-guard, check:parse-guard, check:pnpm-filter-targets, check:watch-hint-literal). All 42 run at 19ee5853; every exit code captured before any pipe.

41 green, 1 NOT MEASURED, 0 red.

• node scripts/check-skills-token-ratchet.mjs → ✓ … 38 authored bundle file(s) within their ceilings
• pnpm --filter @objectstack/spec check:skill-examples → ✅ 255 prose examples type-check across 3 surface(s) — every marked block parsed, so tsc ran the SEMANTIC pass on all of them (run under the shared verify lock; os-verify-lock: VERDICT command-exit 0). @objectstack/spec, @objectstack/client-react and @objectstack/formula closures built first, also under the lock — VERDICT command-exit 0 — so this gate could refuse rather than false-green.
• pnpm check:skill-identifier-liveness → OK — Leg 1: 488 citation(s) over 48 published file(s) …; Leg 2: 9 registered exhaustive section(s), 0 ledgered gap(s) (baseline was 500 citations; the drop is the deleted tables)
• pnpm check:skill-compatibility → ✓ … 11 SKILL.md file(s) reconciled against 78 workspace packages
• pnpm --filter @objectstack/spec check:skill-docs → ✅ Skill docs in sync
• pnpm check:role-word → ✓ after the ratchet-down
• node scripts/check-nul-bytes.mjs → OK (scanned 7875 text file(s) … no raw ASCII control bytes), plus a direct control-byte grep over the three edited files: no hits
• NOT MEASURED:node scripts/check-test-completeness.mjs exits 3, its own "PREREQUISITE NOT MET" code — it needs a saved turbo run test log this run has no reason to produce. Its own text: "Nothing was measured … It is NOT a finding". CI supplies the log.

Two gates were exit-3 / exit-1 prerequisite states on the first pass and turned green once the closures were built, not by any edit: check:doc-formula-expressions + check:doc-security-posture (needed @objectstack/formula built) and check:docs (needed gen:schema, which build runs first).

Labels

skip-changeset — nothing released by any package changes. Checked against scripts/check-empty-changeset.mjs's own enumeration (:357: "It releases nothing (.github/, .claude/, skills/, docs/, content/, examples/…)"); this diff is skills/** + content/docs/** + one scripts/ ledger. needs:contract-review on both this PR and the card — the OCC contract, the error-ledger rule and the http.server mount timing are contract-semantics claims.

Stays draft: governed face.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LraLgQVGq8egUwfYZpbYt1

---

Generated by Claude Code

[os-litant]

Part of #14304

The audit record this implements is posted verbatim on the card. Every claim written into the file was re-verified at source on this branch's base; the file:line for each is below. evals/README.md is untouched (API-H-01 is deferred to #14296 item 2), so the card stays open — that is why the first line is Part of, not a closing keyword.

Per-item: 落点 | before | after

finding	落点 (before)	before	after
API-E-01	SKILL.md:117-146 — the leading os:check example	authored RestApiEndpointSchema "via the REST API plugin"	deleted. The one live fact (auth is the flat public + permissions pair, no name/request/response field) folded into Auth Configuration
API-C-01	:472-510 Datasource Configuration + Supported Drivers	a defineDatasource example and a 7-row driver table	deleted → one pointer: objectstack-data rules/datasources.md, objectstack-platform Driver Selection Guide, and data/driver/config-registry.zod.ts for the id vocabulary
API-C-02	:513-538 Inter-Service Communication	IDataEngine contract prose + a marked block whose declare const kernel fabricated the host	deleted → the section's slot now carries the API-F-02 construct; service resolution points at objectstack-platform rules/service-registry.md
API-C-03	:458-468 Security Layers	a 4-row table naming no authorable key + a callout restating its own Description column	deleted → one boundary line under Authentication & Authorization
API-D-01 + API-F-05 + API-A-03	:316-366 Service Discovery / Health	a ServiceInfoos:check example, a JSON health body, /ready prose	rewritten to 3 lines — all three are response surfaces, nothing to author
API-D-02	:383-396 Handler Status	a 3-row table its own callout neutralised ("nothing reads it at runtime")	deleted; the now-single-child ## Dispatcher & Routing wrapper collapses into ## Dispatcher Error Codes
API-B-01	:419-429	third rendering of "no nested auth block" + an unmarked duplicate fragment	deleted, merged into one sentence that also carries the API-E-01 fold
API-B-02 + API-G-01	:203-209	a second objectstack validate gate block 384 lines from the first	deleted — the gate is stated once, in Verify your work, in the bundle-dominant os spelling
API-B-03	:65-71, :283-313, :559-563	the apiMethods primitives/derived rule stated 3×	once. Callout → 3 lines; derived table drops the 3 rows with no route and no derivation (history/restore/purge keep a one-line mention); Best Practice 6 stops restating it
API-B-05	:22-28	preamble restating the frontmatter above the fold	deleted
API-A-01	:31-39 "When to Use This Skill"	6 bullets, 3 of which misroute	Skill Boundaries table, matching objectstack-data / objectstack-query
API-A-02	frontmatter :3-12	promises "batch/versioning contracts"	"batch contracts" — versioning.zod.ts has zero consumers outside a pin test
API-A-03	:83-94	three /meta client query-param contracts	2 lines saying they are client contracts nothing declares
API-D-03	:544-547, :556-558	Best Practices 1 and 4	deleted (1 duplicates :273 and is wrong for the carve-out; 4 names no key and no gate)
API-D-04	:569-576	Pitfalls 1, 2, 4	deleted — FLS has no authorable spelling in the bundle, the page sizes match no platform constant, rate limiting is already the D6 rule
API-D-05	:191-198	two why-paragraphs after the carve-out rule	deleted, rule kept
API-F-04 + API-G-03	:275-279	environment-scoped routes + projectResolution, 0 usages	deleted (takes the retired project gloss with it)
API-F-06	:404-411	two declared-but-unenforced realtime notes	deleted from the skill; filed as #14446
API-G-02	:481	defineDatasource imported from the root barrel	moot — deleted with API-C-01
API-F-01(add)	gap — :164 named http.server with no example	one table cell	new ## Code routes: mounting on http.server` section
API-F-02(add)	gap — :548-555	frontmatter promised "error envelopes"; the ledger rule was absent	new ## Error Envelopes & the Code Ledger (ADR-0112)
API-F-03(add)	:575-576	"use optimistic locking (version field)", naming no spelling	the two real spellings, body-wins, 409 CONCURRENT_UPDATE

The three funded additions — every claim, with its source

1. http.server code mount — verified against all three shipping sites (examples/app-showcase/src/system/server/recalc-endpoint.ts:48-118, packages/plugins/plugin-sharing/src/sharing-plugin.ts:787-790, packages/plugins/plugin-approvals/src/approvals-plugin.ts:353-356).

• dual lookup readServer('http.server') ?? readServer('http-server'), canonical first — sharing-plugin.ts:787-790, approvals-plugin.ts:353-356; both carry the same comment that http.server is "the ONLY name present on all provider paths".
• kernel:ready, not later — packages/spec/src/contracts/plugin-lifecycle-events.ts:70-91: listen() is deferred to kernel:listeningbecause "route registration in Hono … seals the matcher the first time a request is matched"; recalc-endpoint.ts:110-112 hooks kernel:ready.
• the handler signature — RouteHandler = (req: IHttpRequest, res: IHttpResponse) at packages/spec/src/contracts/http-server.ts:108-111; IHttpResponse.status(code): IHttpResponse at :77 (so res.status(200).json(…) chains); IHttpServer.post at :216.
• the block is NOT os:check-marked, deliberately. See "Assumption 3" below — this is measured, not assumed.

2. ADR-0112 error-code ledger — packages/spec/src/api/error-code-ledger.zod.ts:6-56 states the two tiers, "An unregistered code fails schema parse — which fails the envelope conformance suites — which fails CI", the framework-packages-only scope rule (#4805, maintainer ruling 2026-08-03 re-confirmed 2026-08-09), and the downstream composition. Functions re-located by content on this base: makeApiErrorSchema at packages/spec/src/api/contract.zod.ts:146, envelopeViolations at :215.

3. OCC — packages/rest/src/rest-server.ts:7710-7727 is the PATCH /api/v1/data/:object/:id route: If-Match header or expectedVersion body field, const expectedVersion = bodyVersion ?? ifMatchHeader (body wins), and the field is stripped from the write payload. The token semantics, the 409 and the "" refusal are the spec's own .describe() at packages/spec/src/api/protocol.zod.ts:2097-2102. CONCURRENT_UPDATE is registered at packages/spec/src/api/error-code-ledger.zod.ts:168 and pinned to 409 at packages/rest/src/rest-unclassified-fault-status.test.ts:230.

premise_false

API-F-01, the "getService is async" clause — the audit's premise is false and was NOT written. The real host contract is PluginContext.getService[T](name: string): T (packages/core/src/types.ts:36, doc comment @throws Error if service not found) — synchronous, and it throws. Measured on this base:

• await ctx.getService in packages/plugins/**, excluding tests: 0 occurrences.
• non-awaited ctx.getService( / ctx.getService[T](, same scope: 112.
• the three app sites are ctx?.getService?.('manifest') with no await (packages/apps/{account,setup,studio}/src/index.ts:{60,55,68}).

The audit's evidence for "async" was recalc-endpoint.ts:52, which awaits — but that file's ctx is its own locally declared RecalcHostContext (:30-35) whose getService?: (name) => Promise<T> is a shim, not the host. That is precisely the defect API-C-02 was deleted for, so the skill states the true rule instead: getService is synchronous and throws, which is exactly why each name needs its own try and a() ?? b() in one try never reaches b.

The :532 "fix or unmark" item needs neither — the block is deleted with API-C-02, so no marker survives to prove or disprove anything.

PM assumptions — all six measured

#	assumption	verdict
1	skills/objectstack-api/** byte-identical a59f78d ↔ base	HOLDS — git diff a59f78d 96b627d1 -- skills/objectstack-api/ is empty; every audited span matched by content
2	the frontmatter edit forces regeneration of BOTH generated files	HOLDS — check:skill-docs red on both before gen:skill-docs, green after; the .mdx pulled 20 docs-family gates into the union, re-derived and run
3	the real PluginContext is unreachable from the os:check skills surface	HOLDS, measured directly.SURFACES[0] resolves resolutionDir/selfPackages = packages/spec only (packages/spec/scripts/check-skill-examples.ts:526-532). Probed it: a temporary marked block importing PluginContext from @objectstack/core fails TS2307: Cannot find module '@objectstack/core'. Probe reverted and proven byte-identical (worktree blob hash == HEAD blob hash, git diff HEAD empty). ⇒ the F-01 block stays unmarked rather than earning a marker with a fabricated stand-in
4	RestApiEndpointSchema 0 consumers · no plugin-rest-api package · no endpoints key	HOLDS — 0 hits outside packages/spec/src/api/plugin-rest-api* (positive control: the same grep for ApiEndpoint returns many); ls packages/plugins/ | grep -i rest empty; RestApiPluginConfig (packages/rest/src/rest-api-plugin.ts:95-105) is exactly {serverServiceName?, protocolServiceName?, kernelManagerServiceName?, api?}
5	a heading in this file may be bound by check:skill-identifier-liveness Leg 2	YES, and it is. Binding api-methods binds ## API Methods (Operations) to ApiMethod (scripts/check-skill-identifier-liveness.mjs:285-292). Fixed the author's way: the heading and all six primitives stay; only the derived rows moved. Gate green, 9 bindings, 0 ledgered gaps
6	a false premise is skipped and listed	applied to the getService clause above

Token delta

file	before	after	Δ	ceiling
skills/objectstack-api/SKILL.md	6311	4635	−1,676 (−26.6%)	6319, unchanged (headroom 8 → 1684)
skills/objectstack-api/evals/README.md	546	546	0	546 — untouched, API-H-01 deferred
skills/objectstack-api/references/_index.md	888	888	0	generator-owned, untouched
bundle, ratcheted (authored)	171406	169730	−1,676	171743

607 → 428 lines. No ceiling raised, no new file, no file deleted, and scripts/check-skills-token-ratchet.mjs is not edited.

The gap, itemised rather than smoothed. The dispatch target was −1,725 to −2,100; this lands at −1,676, short by 49 tokens (2.8%). It is not spread thin — it is two opposing errors in the audit's own estimates:

• the three funded additions cost 239 tokens more than funded: F-01 271 actual vs +130 budgeted; F-02 162 vs +120; F-03 +96 net vs +40. Each was trimmed once already (F-01 from 407 tokens, F-02 from 250); trimming further would start dropping the load-bearing clauses each was funded to carry.
• the deletions cut about 190 tokens more than the audit's per-span estimates, which is what absorbs most of that.

Closing the last 49 would mean cutting content no finding covers. Deliberately not done.

follow-up for objectstack-data / objectstack-platform

Both anchors are stronger than what this PR deleted, on every axis but one. Verified by heading on origin/claude/issue-14297-skills-data-optimization and origin/claude/issue-14299-skills-platform-optimization (what will merge):

• objectstack-data/rules/datasources.md — byte-identical to origin/main on the data flight's branch; headings ## schemaMode — who owns the schema, ## Auto-connect (no onEnable), ## Credentials — fail-closed, ## Writes — double opt-in. ✅
• objectstack-platform/SKILL.md → ## Driver Selection Guide — carries driver packages, class names, and the Turso "Cloud / EE only … UnsupportedDriverError" caveat that the deleted api table omitted. ✅ Also ## Well-Known Plugin Names & Services and rules/service-registry.md both present. ✅
• the one gap: neither anchor names the driver id vocabulary an author actually writes in defineDatasource({ driver: … }) — postgres, mysql, mongodb, sqlite, sqlite-wasm, turso, memory, and the mongo alias. The deleted api table did. Nothing is lost here — the pointer names the authoritative source, packages/spec/src/data/driver/config-registry.zod.ts:163 (resolveDriverId handles the aliases) — but a row in objectstack-data/rules/datasources.md would be the right home. Not filed as a card: it is one row inside a flight already in review; raising it here so that flight's reviewer can take it.

One file outside the declared surface, and why

scripts/role-word-baseline.json — check:role-word went red on this branch with its ratchet-DOWN remedy, because API-C-03 deleted the file's single baselined occurrence of the reserved word (the Security Layers row | **RBAC** | Object | Role-based access control (profile → permissions) |). The gate names --update as the author's own path when a baselined file goes clean; leaving the entry would leave budget a later edit could spend silently. Baseline 43 → 42 files; the skills/objectstack-api/SKILL.md row is dropped, no other row moves. Committed separately.

Out-of-scope card filed

#14446 — declared ≠ enforced (ADR-0049): RealtimeEventType (packages/spec/src/api/realtime.zod.ts:33-40) spells record.* while the platform emits data.record.* (api/events.zod.ts:139-141), and SubscriptionSchema.filters is z.unknown().optional() (realtime.zod.ts:49). finding label, unassigned, no pm-state, no priority. Dedupe searched first — the four nearest cards (#4602, #4626, #4673, #9055) are all closed and none covers this pair.

Gates — head sha 19ee5853

Union re-derived after regeneration and again after the final commit: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands → 42 commands (the .mdx output pulled in the docs family; the role-word baseline added 6 more: check:bash32-floor, check:cli-command-ids, check:entry-guard, check:parse-guard, check:pnpm-filter-targets, check:watch-hint-literal). All 42 run at 19ee5853; every exit code captured before any pipe.

41 green, 1 NOT MEASURED, 0 red.

• node scripts/check-skills-token-ratchet.mjs → ✓ … 38 authored bundle file(s) within their ceilings
• pnpm --filter @objectstack/spec check:skill-examples → ✅ 255 prose examples type-check across 3 surface(s) — every marked block parsed, so tsc ran the SEMANTIC pass on all of them (run under the shared verify lock; os-verify-lock: VERDICT command-exit 0). @objectstack/spec, @objectstack/client-react and @objectstack/formula closures built first, also under the lock — VERDICT command-exit 0 — so this gate could refuse rather than false-green.
• pnpm check:skill-identifier-liveness → OK — Leg 1: 488 citation(s) over 48 published file(s) …; Leg 2: 9 registered exhaustive section(s), 0 ledgered gap(s) (baseline was 500 citations; the drop is the deleted tables)
• pnpm check:skill-compatibility → ✓ … 11 SKILL.md file(s) reconciled against 78 workspace packages
• pnpm --filter @objectstack/spec check:skill-docs → ✅ Skill docs in sync
• pnpm check:role-word → ✓ after the ratchet-down
• node scripts/check-nul-bytes.mjs → OK (scanned 7875 text file(s) … no raw ASCII control bytes), plus a direct control-byte grep over the three edited files: no hits
• NOT MEASURED:node scripts/check-test-completeness.mjs exits 3, its own "PREREQUISITE NOT MET" code — it needs a saved turbo run test log this run has no reason to produce. Its own text: "Nothing was measured … It is NOT a finding". CI supplies the log.

Two gates were exit-3 / exit-1 prerequisite states on the first pass and turned green once the closures were built, not by any edit: check:doc-formula-expressions + check:doc-security-posture (needed @objectstack/formula built) and check:docs (needed gen:schema, which build runs first).

Labels

skip-changeset — nothing released by any package changes. Checked against scripts/check-empty-changeset.mjs's own enumeration (:357: "It releases nothing (.github/, .claude/, skills/, docs/, content/, examples/…)"); this diff is skills/** + content/docs/** + one scripts/ ledger. needs:contract-review on both this PR and the card — the OCC contract, the error-ledger rule and the http.server mount timing are contract-semantics claims.

Stays draft: governed face.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LraLgQVGq8egUwfYZpbYt1

---

Generated by Claude Code

[os-litant]

Part of #14304

The audit record this implements is posted verbatim on the card. Every claim written into the file was re-verified at source on this branch's base; the file:line for each is below. evals/README.md is untouched (API-H-01 is deferred to #14296 item 2), so the card stays open — that is why the first line is Part of, not a closing keyword.

Per-item: 落点 | before | after

finding	落点 (before)	before	after
API-E-01	SKILL.md:117-146 — the leading os:check example	authored RestApiEndpointSchema "via the REST API plugin"	deleted. The one live fact (auth is the flat public + permissions pair, no name/request/response field) folded into Auth Configuration
API-C-01	:472-510 Datasource Configuration + Supported Drivers	a defineDatasource example and a 7-row driver table	deleted → one pointer: objectstack-data rules/datasources.md, objectstack-platform Driver Selection Guide, and data/driver/config-registry.zod.ts for the id vocabulary
API-C-02	:513-538 Inter-Service Communication	IDataEngine contract prose + a marked block whose declare const kernel fabricated the host	deleted → the section's slot now carries the API-F-02 construct; service resolution points at objectstack-platform rules/service-registry.md
API-C-03	:458-468 Security Layers	a 4-row table naming no authorable key + a callout restating its own Description column	deleted → one boundary line under Authentication & Authorization
API-D-01 + API-F-05 + API-A-03	:316-366 Service Discovery / Health	a ServiceInfoos:check example, a JSON health body, /ready prose	rewritten to 3 lines — all three are response surfaces, nothing to author
API-D-02	:383-396 Handler Status	a 3-row table its own callout neutralised ("nothing reads it at runtime")	deleted; the now-single-child ## Dispatcher & Routing wrapper collapses into ## Dispatcher Error Codes
API-B-01	:419-429	third rendering of "no nested auth block" + an unmarked duplicate fragment	deleted, merged into one sentence that also carries the API-E-01 fold
API-B-02 + API-G-01	:203-209	a second objectstack validate gate block 384 lines from the first	deleted — the gate is stated once, in Verify your work, in the bundle-dominant os spelling
API-B-03	:65-71, :283-313, :559-563	the apiMethods primitives/derived rule stated 3×	once. Callout → 3 lines; derived table drops the 3 rows with no route and no derivation (history/restore/purge keep a one-line mention); Best Practice 6 stops restating it
API-B-05	:22-28	preamble restating the frontmatter above the fold	deleted
API-A-01	:31-39 "When to Use This Skill"	6 bullets, 3 of which misroute	Skill Boundaries table, matching objectstack-data / objectstack-query
API-A-02	frontmatter :3-12	promises "batch/versioning contracts"	"batch contracts" — versioning.zod.ts has zero consumers outside a pin test
API-A-03	:83-94	three /meta client query-param contracts	2 lines saying they are client contracts nothing declares
API-D-03	:544-547, :556-558	Best Practices 1 and 4	deleted (1 duplicates :273 and is wrong for the carve-out; 4 names no key and no gate)
API-D-04	:569-576	Pitfalls 1, 2, 4	deleted — FLS has no authorable spelling in the bundle, the page sizes match no platform constant, rate limiting is already the D6 rule
API-D-05	:191-198	two why-paragraphs after the carve-out rule	deleted, rule kept
API-F-04 + API-G-03	:275-279	environment-scoped routes + projectResolution, 0 usages	deleted (takes the retired project gloss with it)
API-F-06	:404-411	two declared-but-unenforced realtime notes	deleted from the skill; filed as #14446
API-G-02	:481	defineDatasource imported from the root barrel	moot — deleted with API-C-01
API-F-01(add)	gap — :164 named http.server with no example	one table cell	new ## Code routes: mounting on http.server` section
API-F-02(add)	gap — :548-555	frontmatter promised "error envelopes"; the ledger rule was absent	new ## Error Envelopes & the Code Ledger (ADR-0112)
API-F-03(add)	:575-576	"use optimistic locking (version field)", naming no spelling	the two real spellings, body-wins, 409 CONCURRENT_UPDATE

The three funded additions — every claim, with its source

1. http.server code mount — verified against all three shipping sites (examples/app-showcase/src/system/server/recalc-endpoint.ts:48-118, packages/plugins/plugin-sharing/src/sharing-plugin.ts:787-790, packages/plugins/plugin-approvals/src/approvals-plugin.ts:353-356).

• dual lookup readServer('http.server') ?? readServer('http-server'), canonical first — sharing-plugin.ts:787-790, approvals-plugin.ts:353-356; both carry the same comment that http.server is "the ONLY name present on all provider paths".
• kernel:ready, not later — packages/spec/src/contracts/plugin-lifecycle-events.ts:70-91: listen() is deferred to kernel:listeningbecause "route registration in Hono … seals the matcher the first time a request is matched"; recalc-endpoint.ts:110-112 hooks kernel:ready.
• the handler signature — RouteHandler = (req: IHttpRequest, res: IHttpResponse) at packages/spec/src/contracts/http-server.ts:108-111; IHttpResponse.status(code): IHttpResponse at :77 (so res.status(200).json(…) chains); IHttpServer.post at :216.
• the block is NOT os:check-marked, deliberately. See "Assumption 3" below — this is measured, not assumed.

2. ADR-0112 error-code ledger — packages/spec/src/api/error-code-ledger.zod.ts:6-56 states the two tiers, "An unregistered code fails schema parse — which fails the envelope conformance suites — which fails CI", the framework-packages-only scope rule (#4805, maintainer ruling 2026-08-03 re-confirmed 2026-08-09), and the downstream composition. Functions re-located by content on this base: makeApiErrorSchema at packages/spec/src/api/contract.zod.ts:146, envelopeViolations at :215.

3. OCC — packages/rest/src/rest-server.ts:7710-7727 is the PATCH /api/v1/data/:object/:id route: If-Match header or expectedVersion body field, const expectedVersion = bodyVersion ?? ifMatchHeader (body wins), and the field is stripped from the write payload. The token semantics, the 409 and the "" refusal are the spec's own .describe() at packages/spec/src/api/protocol.zod.ts:2097-2102. CONCURRENT_UPDATE is registered at packages/spec/src/api/error-code-ledger.zod.ts:168 and pinned to 409 at packages/rest/src/rest-unclassified-fault-status.test.ts:230.

premise_false

API-F-01, the "getService is async" clause — the audit's premise is false and was NOT written. The real host contract is PluginContext.getService[T](name: string): T (packages/core/src/types.ts:36, doc comment @throws Error if service not found) — synchronous, and it throws. Measured on this base:

• await ctx.getService in packages/plugins/**, excluding tests: 0 occurrences.
• non-awaited ctx.getService( / ctx.getService[T](, same scope: 112.
• the three app sites are ctx?.getService?.('manifest') with no await (packages/apps/{account,setup,studio}/src/index.ts:{60,55,68}).

The audit's evidence for "async" was recalc-endpoint.ts:52, which awaits — but that file's ctx is its own locally declared RecalcHostContext (:30-35) whose getService?: (name) => Promise<T> is a shim, not the host. That is precisely the defect API-C-02 was deleted for, so the skill states the true rule instead: getService is synchronous and throws, which is exactly why each name needs its own try and a() ?? b() in one try never reaches b.

The :532 "fix or unmark" item needs neither — the block is deleted with API-C-02, so no marker survives to prove or disprove anything.

PM assumptions — all six measured

#	assumption	verdict
1	skills/objectstack-api/** byte-identical a59f78d ↔ base	HOLDS — git diff a59f78d 96b627d1 -- skills/objectstack-api/ is empty; every audited span matched by content
2	the frontmatter edit forces regeneration of BOTH generated files	HOLDS — check:skill-docs red on both before gen:skill-docs, green after; the .mdx pulled 20 docs-family gates into the union, re-derived and run
3	the real PluginContext is unreachable from the os:check skills surface	HOLDS, measured directly.SURFACES[0] resolves resolutionDir/selfPackages = packages/spec only (packages/spec/scripts/check-skill-examples.ts:526-532). Probed it: a temporary marked block importing PluginContext from @objectstack/core fails TS2307: Cannot find module '@objectstack/core'. Probe reverted and proven byte-identical (worktree blob hash == HEAD blob hash, git diff HEAD empty). ⇒ the F-01 block stays unmarked rather than earning a marker with a fabricated stand-in
4	RestApiEndpointSchema 0 consumers · no plugin-rest-api package · no endpoints key	HOLDS — 0 hits outside packages/spec/src/api/plugin-rest-api* (positive control: the same grep for ApiEndpoint returns many); ls packages/plugins/ | grep -i rest empty; RestApiPluginConfig (packages/rest/src/rest-api-plugin.ts:95-105) is exactly {serverServiceName?, protocolServiceName?, kernelManagerServiceName?, api?}
5	a heading in this file may be bound by check:skill-identifier-liveness Leg 2	YES, and it is. Binding api-methods binds ## API Methods (Operations) to ApiMethod (scripts/check-skill-identifier-liveness.mjs:285-292). Fixed the author's way: the heading and all six primitives stay; only the derived rows moved. Gate green, 9 bindings, 0 ledgered gaps
6	a false premise is skipped and listed	applied to the getService clause above

Token delta

file	before	after	Δ	ceiling
skills/objectstack-api/SKILL.md	6311	4635	−1,676 (−26.6%)	6319, unchanged (headroom 8 → 1684)
skills/objectstack-api/evals/README.md	546	546	0	546 — untouched, API-H-01 deferred
skills/objectstack-api/references/_index.md	888	888	0	generator-owned, untouched
bundle, ratcheted (authored)	171406	169730	−1,676	171743

607 → 428 lines. No ceiling raised, no new file, no file deleted, and scripts/check-skills-token-ratchet.mjs is not edited.

The gap, itemised rather than smoothed. The dispatch target was −1,725 to −2,100; this lands at −1,676, short by 49 tokens (2.8%). It is not spread thin — it is two opposing errors in the audit's own estimates:

• the three funded additions cost 239 tokens more than funded: F-01 271 actual vs +130 budgeted; F-02 162 vs +120; F-03 +96 net vs +40. Each was trimmed once already (F-01 from 407 tokens, F-02 from 250); trimming further would start dropping the load-bearing clauses each was funded to carry.
• the deletions cut about 190 tokens more than the audit's per-span estimates, which is what absorbs most of that.

Closing the last 49 would mean cutting content no finding covers. Deliberately not done.

follow-up for objectstack-data / objectstack-platform

Both anchors are stronger than what this PR deleted, on every axis but one. Verified by heading on origin/claude/issue-14297-skills-data-optimization and origin/claude/issue-14299-skills-platform-optimization (what will merge):

• objectstack-data/rules/datasources.md — byte-identical to origin/main on the data flight's branch; headings ## schemaMode — who owns the schema, ## Auto-connect (no onEnable), ## Credentials — fail-closed, ## Writes — double opt-in. ✅
• objectstack-platform/SKILL.md → ## Driver Selection Guide — carries driver packages, class names, and the Turso "Cloud / EE only … UnsupportedDriverError" caveat that the deleted api table omitted. ✅ Also ## Well-Known Plugin Names & Services and rules/service-registry.md both present. ✅
• the one gap: neither anchor names the driver id vocabulary an author actually writes in defineDatasource({ driver: … }) — postgres, mysql, mongodb, sqlite, sqlite-wasm, turso, memory, and the mongo alias. The deleted api table did. Nothing is lost here — the pointer names the authoritative source, packages/spec/src/data/driver/config-registry.zod.ts:163 (resolveDriverId handles the aliases) — but a row in objectstack-data/rules/datasources.md would be the right home. Not filed as a card: it is one row inside a flight already in review; raising it here so that flight's reviewer can take it.

One file outside the declared surface, and why

scripts/role-word-baseline.json — check:role-word went red on this branch with its ratchet-DOWN remedy, because API-C-03 deleted the file's single baselined occurrence of the reserved word (the Security Layers row | **RBAC** | Object | Role-based access control (profile → permissions) |). The gate names --update as the author's own path when a baselined file goes clean; leaving the entry would leave budget a later edit could spend silently. Baseline 43 → 42 files; the skills/objectstack-api/SKILL.md row is dropped, no other row moves. Committed separately.

Out-of-scope card filed

#14446 — declared ≠ enforced (ADR-0049): RealtimeEventType (packages/spec/src/api/realtime.zod.ts:33-40) spells record.* while the platform emits data.record.* (api/events.zod.ts:139-141), and SubscriptionSchema.filters is z.unknown().optional() (realtime.zod.ts:49). finding label, unassigned, no pm-state, no priority. Dedupe searched first — the four nearest cards (#4602, #4626, #4673, #9055) are all closed and none covers this pair.

Gates — head sha 19ee5853

Union re-derived after regeneration and again after the final commit: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands → 42 commands (the .mdx output pulled in the docs family; the role-word baseline added 6 more: check:bash32-floor, check:cli-command-ids, check:entry-guard, check:parse-guard, check:pnpm-filter-targets, check:watch-hint-literal). All 42 run at 19ee5853; every exit code captured before any pipe.

41 green, 1 NOT MEASURED, 0 red.

• node scripts/check-skills-token-ratchet.mjs → ✓ … 38 authored bundle file(s) within their ceilings
• pnpm --filter @objectstack/spec check:skill-examples → ✅ 255 prose examples type-check across 3 surface(s) — every marked block parsed, so tsc ran the SEMANTIC pass on all of them (run under the shared verify lock; os-verify-lock: VERDICT command-exit 0). @objectstack/spec, @objectstack/client-react and @objectstack/formula closures built first, also under the lock — VERDICT command-exit 0 — so this gate could refuse rather than false-green.
• pnpm check:skill-identifier-liveness → OK — Leg 1: 488 citation(s) over 48 published file(s) …; Leg 2: 9 registered exhaustive section(s), 0 ledgered gap(s) (baseline was 500 citations; the drop is the deleted tables)
• pnpm check:skill-compatibility → ✓ … 11 SKILL.md file(s) reconciled against 78 workspace packages
• pnpm --filter @objectstack/spec check:skill-docs → ✅ Skill docs in sync
• pnpm check:role-word → ✓ after the ratchet-down
• node scripts/check-nul-bytes.mjs → OK (scanned 7875 text file(s) … no raw ASCII control bytes), plus a direct control-byte grep over the three edited files: no hits
• NOT MEASURED:node scripts/check-test-completeness.mjs exits 3, its own "PREREQUISITE NOT MET" code — it needs a saved turbo run test log this run has no reason to produce. Its own text: "Nothing was measured … It is NOT a finding". CI supplies the log.

Two gates were exit-3 / exit-1 prerequisite states on the first pass and turned green once the closures were built, not by any edit: check:doc-formula-expressions + check:doc-security-posture (needed @objectstack/formula built) and check:docs (needed gen:schema, which build runs first).

Labels

skip-changeset — nothing released by any package changes. Checked against scripts/check-empty-changeset.mjs's own enumeration (:357: "It releases nothing (.github/, .claude/, skills/, docs/, content/, examples/…)"); this diff is skills/** + content/docs/** + one scripts/ ledger. needs:contract-review on both this PR and the card — the OCC contract, the error-ledger rule and the http.server mount timing are contract-semantics claims.

Stays draft: governed face.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LraLgQVGq8egUwfYZpbYt1

---

Generated by Claude Code

[os-litant]

Part of #14304

The audit record this implements is posted verbatim on the card. Every claim written into the file was re-verified at source on this branch's base; the file:line for each is below. evals/README.md is untouched (API-H-01 is deferred to #14296 item 2), so the card stays open — that is why the first line is Part of, not a closing keyword.

Per-item: 落点 | before | after

finding	落点 (before)	before	after
API-E-01	SKILL.md:117-146 — the leading os:check example	authored RestApiEndpointSchema "via the REST API plugin"	deleted. The one live fact (auth is the flat public + permissions pair, no name/request/response field) folded into Auth Configuration
API-C-01	:472-510 Datasource Configuration + Supported Drivers	a defineDatasource example and a 7-row driver table	deleted → one pointer: objectstack-data rules/datasources.md, objectstack-platform Driver Selection Guide, and data/driver/config-registry.zod.ts for the id vocabulary
API-C-02	:513-538 Inter-Service Communication	IDataEngine contract prose + a marked block whose declare const kernel fabricated the host	deleted → the section's slot now carries the API-F-02 construct; service resolution points at objectstack-platform rules/service-registry.md
API-C-03	:458-468 Security Layers	a 4-row table naming no authorable key + a callout restating its own Description column	deleted → one boundary line under Authentication & Authorization
API-D-01 + API-F-05 + API-A-03	:316-366 Service Discovery / Health	a ServiceInfoos:check example, a JSON health body, /ready prose	rewritten to 3 lines — all three are response surfaces, nothing to author
API-D-02	:383-396 Handler Status	a 3-row table its own callout neutralised ("nothing reads it at runtime")	deleted; the now-single-child ## Dispatcher & Routing wrapper collapses into ## Dispatcher Error Codes
API-B-01	:419-429	third rendering of "no nested auth block" + an unmarked duplicate fragment	deleted, merged into one sentence that also carries the API-E-01 fold
API-B-02 + API-G-01	:203-209	a second objectstack validate gate block 384 lines from the first	deleted — the gate is stated once, in Verify your work, in the bundle-dominant os spelling
API-B-03	:65-71, :283-313, :559-563	the apiMethods primitives/derived rule stated 3×	once. Callout → 3 lines; derived table drops the 3 rows with no route and no derivation (history/restore/purge keep a one-line mention); Best Practice 6 stops restating it
API-B-05	:22-28	preamble restating the frontmatter above the fold	deleted
API-A-01	:31-39 "When to Use This Skill"	6 bullets, 3 of which misroute	Skill Boundaries table, matching objectstack-data / objectstack-query
API-A-02	frontmatter :3-12	promises "batch/versioning contracts"	"batch contracts" — versioning.zod.ts has zero consumers outside a pin test
API-A-03	:83-94	three /meta client query-param contracts	2 lines saying they are client contracts nothing declares
API-D-03	:544-547, :556-558	Best Practices 1 and 4	deleted (1 duplicates :273 and is wrong for the carve-out; 4 names no key and no gate)
API-D-04	:569-576	Pitfalls 1, 2, 4	deleted — FLS has no authorable spelling in the bundle, the page sizes match no platform constant, rate limiting is already the D6 rule
API-D-05	:191-198	two why-paragraphs after the carve-out rule	deleted, rule kept
API-F-04 + API-G-03	:275-279	environment-scoped routes + projectResolution, 0 usages	deleted (takes the retired project gloss with it)
API-F-06	:404-411	two declared-but-unenforced realtime notes	deleted from the skill; filed as #14446
API-G-02	:481	defineDatasource imported from the root barrel	moot — deleted with API-C-01
API-F-01(add)	gap — :164 named http.server with no example	one table cell	new ## Code routes: mounting on http.server` section
API-F-02(add)	gap — :548-555	frontmatter promised "error envelopes"; the ledger rule was absent	new ## Error Envelopes & the Code Ledger (ADR-0112)
API-F-03(add)	:575-576	"use optimistic locking (version field)", naming no spelling	the two real spellings, body-wins, 409 CONCURRENT_UPDATE

The three funded additions — every claim, with its source

1. http.server code mount — verified against all three shipping sites (examples/app-showcase/src/system/server/recalc-endpoint.ts:48-118, packages/plugins/plugin-sharing/src/sharing-plugin.ts:787-790, packages/plugins/plugin-approvals/src/approvals-plugin.ts:353-356).

• dual lookup readServer('http.server') ?? readServer('http-server'), canonical first — sharing-plugin.ts:787-790, approvals-plugin.ts:353-356; both carry the same comment that http.server is "the ONLY name present on all provider paths".
• kernel:ready, not later — packages/spec/src/contracts/plugin-lifecycle-events.ts:70-91: listen() is deferred to kernel:listeningbecause "route registration in Hono … seals the matcher the first time a request is matched"; recalc-endpoint.ts:110-112 hooks kernel:ready.
• the handler signature — RouteHandler = (req: IHttpRequest, res: IHttpResponse) at packages/spec/src/contracts/http-server.ts:108-111; IHttpResponse.status(code): IHttpResponse at :77 (so res.status(200).json(…) chains); IHttpServer.post at :216.
• the block is NOT os:check-marked, deliberately. See "Assumption 3" below — this is measured, not assumed.

2. ADR-0112 error-code ledger — packages/spec/src/api/error-code-ledger.zod.ts:6-56 states the two tiers, "An unregistered code fails schema parse — which fails the envelope conformance suites — which fails CI", the framework-packages-only scope rule (#4805, maintainer ruling 2026-08-03 re-confirmed 2026-08-09), and the downstream composition. Functions re-located by content on this base: makeApiErrorSchema at packages/spec/src/api/contract.zod.ts:146, envelopeViolations at :215.

3. OCC — packages/rest/src/rest-server.ts:7710-7727 is the PATCH /api/v1/data/:object/:id route: If-Match header or expectedVersion body field, const expectedVersion = bodyVersion ?? ifMatchHeader (body wins), and the field is stripped from the write payload. The token semantics, the 409 and the "" refusal are the spec's own .describe() at packages/spec/src/api/protocol.zod.ts:2097-2102. CONCURRENT_UPDATE is registered at packages/spec/src/api/error-code-ledger.zod.ts:168 and pinned to 409 at packages/rest/src/rest-unclassified-fault-status.test.ts:230.

premise_false

API-F-01, the "getService is async" clause — the audit's premise is false and was NOT written. The real host contract is PluginContext.getService[T](name: string): T (packages/core/src/types.ts:36, doc comment @throws Error if service not found) — synchronous, and it throws. Measured on this base:

• await ctx.getService in packages/plugins/**, excluding tests: 0 occurrences.
• non-awaited ctx.getService( / ctx.getService[T](, same scope: 112.
• the three app sites are ctx?.getService?.('manifest') with no await (packages/apps/{account,setup,studio}/src/index.ts:{60,55,68}).

The audit's evidence for "async" was recalc-endpoint.ts:52, which awaits — but that file's ctx is its own locally declared RecalcHostContext (:30-35) whose getService?: (name) => Promise<T> is a shim, not the host. That is precisely the defect API-C-02 was deleted for, so the skill states the true rule instead: getService is synchronous and throws, which is exactly why each name needs its own try and a() ?? b() in one try never reaches b.

The :532 "fix or unmark" item needs neither — the block is deleted with API-C-02, so no marker survives to prove or disprove anything.

PM assumptions — all six measured

#	assumption	verdict
1	skills/objectstack-api/** byte-identical a59f78d ↔ base	HOLDS — git diff a59f78d 96b627d1 -- skills/objectstack-api/ is empty; every audited span matched by content
2	the frontmatter edit forces regeneration of BOTH generated files	HOLDS — check:skill-docs red on both before gen:skill-docs, green after; the .mdx pulled 20 docs-family gates into the union, re-derived and run
3	the real PluginContext is unreachable from the os:check skills surface	HOLDS, measured directly.SURFACES[0] resolves resolutionDir/selfPackages = packages/spec only (packages/spec/scripts/check-skill-examples.ts:526-532). Probed it: a temporary marked block importing PluginContext from @objectstack/core fails TS2307: Cannot find module '@objectstack/core'. Probe reverted and proven byte-identical (worktree blob hash == HEAD blob hash, git diff HEAD empty). ⇒ the F-01 block stays unmarked rather than earning a marker with a fabricated stand-in
4	RestApiEndpointSchema 0 consumers · no plugin-rest-api package · no endpoints key	HOLDS — 0 hits outside packages/spec/src/api/plugin-rest-api* (positive control: the same grep for ApiEndpoint returns many); ls packages/plugins/ | grep -i rest empty; RestApiPluginConfig (packages/rest/src/rest-api-plugin.ts:95-105) is exactly {serverServiceName?, protocolServiceName?, kernelManagerServiceName?, api?}
5	a heading in this file may be bound by check:skill-identifier-liveness Leg 2	YES, and it is. Binding api-methods binds ## API Methods (Operations) to ApiMethod (scripts/check-skill-identifier-liveness.mjs:285-292). Fixed the author's way: the heading and all six primitives stay; only the derived rows moved. Gate green, 9 bindings, 0 ledgered gaps
6	a false premise is skipped and listed	applied to the getService clause above

Token delta

file	before	after	Δ	ceiling
skills/objectstack-api/SKILL.md	6311	4635	−1,676 (−26.6%)	6319, unchanged (headroom 8 → 1684)
skills/objectstack-api/evals/README.md	546	546	0	546 — untouched, API-H-01 deferred
skills/objectstack-api/references/_index.md	888	888	0	generator-owned, untouched
bundle, ratcheted (authored)	171406	169730	−1,676	171743

607 → 428 lines. No ceiling raised, no new file, no file deleted, and scripts/check-skills-token-ratchet.mjs is not edited.

The gap, itemised rather than smoothed. The dispatch target was −1,725 to −2,100; this lands at −1,676, short by 49 tokens (2.8%). It is not spread thin — it is two opposing errors in the audit's own estimates:

• the three funded additions cost 239 tokens more than funded: F-01 271 actual vs +130 budgeted; F-02 162 vs +120; F-03 +96 net vs +40. Each was trimmed once already (F-01 from 407 tokens, F-02 from 250); trimming further would start dropping the load-bearing clauses each was funded to carry.
• the deletions cut about 190 tokens more than the audit's per-span estimates, which is what absorbs most of that.

Closing the last 49 would mean cutting content no finding covers. Deliberately not done.

follow-up for objectstack-data / objectstack-platform

Both anchors are stronger than what this PR deleted, on every axis but one. Verified by heading on origin/claude/issue-14297-skills-data-optimization and origin/claude/issue-14299-skills-platform-optimization (what will merge):

• objectstack-data/rules/datasources.md — byte-identical to origin/main on the data flight's branch; headings ## schemaMode — who owns the schema, ## Auto-connect (no onEnable), ## Credentials — fail-closed, ## Writes — double opt-in. ✅
• objectstack-platform/SKILL.md → ## Driver Selection Guide — carries driver packages, class names, and the Turso "Cloud / EE only … UnsupportedDriverError" caveat that the deleted api table omitted. ✅ Also ## Well-Known Plugin Names & Services and rules/service-registry.md both present. ✅
• the one gap: neither anchor names the driver id vocabulary an author actually writes in defineDatasource({ driver: … }) — postgres, mysql, mongodb, sqlite, sqlite-wasm, turso, memory, and the mongo alias. The deleted api table did. Nothing is lost here — the pointer names the authoritative source, packages/spec/src/data/driver/config-registry.zod.ts:163 (resolveDriverId handles the aliases) — but a row in objectstack-data/rules/datasources.md would be the right home. Not filed as a card: it is one row inside a flight already in review; raising it here so that flight's reviewer can take it.

One file outside the declared surface, and why

scripts/role-word-baseline.json — check:role-word went red on this branch with its ratchet-DOWN remedy, because API-C-03 deleted the file's single baselined occurrence of the reserved word (the Security Layers row | **RBAC** | Object | Role-based access control (profile → permissions) |). The gate names --update as the author's own path when a baselined file goes clean; leaving the entry would leave budget a later edit could spend silently. Baseline 43 → 42 files; the skills/objectstack-api/SKILL.md row is dropped, no other row moves. Committed separately.

Out-of-scope card filed

#14446 — declared ≠ enforced (ADR-0049): RealtimeEventType (packages/spec/src/api/realtime.zod.ts:33-40) spells record.* while the platform emits data.record.* (api/events.zod.ts:139-141), and SubscriptionSchema.filters is z.unknown().optional() (realtime.zod.ts:49). finding label, unassigned, no pm-state, no priority. Dedupe searched first — the four nearest cards (#4602, #4626, #4673, #9055) are all closed and none covers this pair.

Gates — head sha 19ee5853

Union re-derived after regeneration and again after the final commit: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands → 42 commands (the .mdx output pulled in the docs family; the role-word baseline added 6 more: check:bash32-floor, check:cli-command-ids, check:entry-guard, check:parse-guard, check:pnpm-filter-targets, check:watch-hint-literal). All 42 run at 19ee5853; every exit code captured before any pipe.

41 green, 1 NOT MEASURED, 0 red.

• node scripts/check-skills-token-ratchet.mjs → ✓ … 38 authored bundle file(s) within their ceilings
• pnpm --filter @objectstack/spec check:skill-examples → ✅ 255 prose examples type-check across 3 surface(s) — every marked block parsed, so tsc ran the SEMANTIC pass on all of them (run under the shared verify lock; os-verify-lock: VERDICT command-exit 0). @objectstack/spec, @objectstack/client-react and @objectstack/formula closures built first, also under the lock — VERDICT command-exit 0 — so this gate could refuse rather than false-green.
• pnpm check:skill-identifier-liveness → OK — Leg 1: 488 citation(s) over 48 published file(s) …; Leg 2: 9 registered exhaustive section(s), 0 ledgered gap(s) (baseline was 500 citations; the drop is the deleted tables)
• pnpm check:skill-compatibility → ✓ … 11 SKILL.md file(s) reconciled against 78 workspace packages
• pnpm --filter @objectstack/spec check:skill-docs → ✅ Skill docs in sync
• pnpm check:role-word → ✓ after the ratchet-down
• node scripts/check-nul-bytes.mjs → OK (scanned 7875 text file(s) … no raw ASCII control bytes), plus a direct control-byte grep over the three edited files: no hits
• NOT MEASURED:node scripts/check-test-completeness.mjs exits 3, its own "PREREQUISITE NOT MET" code — it needs a saved turbo run test log this run has no reason to produce. Its own text: "Nothing was measured … It is NOT a finding". CI supplies the log.

Two gates were exit-3 / exit-1 prerequisite states on the first pass and turned green once the closures were built, not by any edit: check:doc-formula-expressions + check:doc-security-posture (needed @objectstack/formula built) and check:docs (needed gen:schema, which build runs first).

Labels

skip-changeset — nothing released by any package changes. Checked against scripts/check-empty-changeset.mjs's own enumeration (:357: "It releases nothing (.github/, .claude/, skills/, docs/, content/, examples/…)"); this diff is skills/** + content/docs/** + one scripts/ ledger. needs:contract-review on both this PR and the card — the OCC contract, the error-ledger rule and the http.server mount timing are contract-semantics claims.

Stays draft: governed face.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LraLgQVGq8egUwfYZpbYt1

---

Generated by Claude Code

[os-litant]

Part of #14304

The audit record this implements is posted verbatim on the card. Every claim written into the file was re-verified at source on this branch's base; the file:line for each is below. evals/README.md is untouched (API-H-01 is deferred to #14296 item 2), so the card stays open — that is why the first line is Part of, not a closing keyword.

Per-item: 落点 | before | after

finding	落点 (before)	before	after
API-E-01	SKILL.md:117-146 — the leading os:check example	authored RestApiEndpointSchema "via the REST API plugin"	deleted. The one live fact (auth is the flat public + permissions pair, no name/request/response field) folded into Auth Configuration
API-C-01	:472-510 Datasource Configuration + Supported Drivers	a defineDatasource example and a 7-row driver table	deleted → one pointer: objectstack-data rules/datasources.md, objectstack-platform Driver Selection Guide, and data/driver/config-registry.zod.ts for the id vocabulary
API-C-02	:513-538 Inter-Service Communication	IDataEngine contract prose + a marked block whose declare const kernel fabricated the host	deleted → the section's slot now carries the API-F-02 construct; service resolution points at objectstack-platform rules/service-registry.md
API-C-03	:458-468 Security Layers	a 4-row table naming no authorable key + a callout restating its own Description column	deleted → one boundary line under Authentication & Authorization
API-D-01 + API-F-05 + API-A-03	:316-366 Service Discovery / Health	a ServiceInfoos:check example, a JSON health body, /ready prose	rewritten to 3 lines — all three are response surfaces, nothing to author
API-D-02	:383-396 Handler Status	a 3-row table its own callout neutralised ("nothing reads it at runtime")	deleted; the now-single-child ## Dispatcher & Routing wrapper collapses into ## Dispatcher Error Codes
API-B-01	:419-429	third rendering of "no nested auth block" + an unmarked duplicate fragment	deleted, merged into one sentence that also carries the API-E-01 fold
API-B-02 + API-G-01	:203-209	a second objectstack validate gate block 384 lines from the first	deleted — the gate is stated once, in Verify your work, in the bundle-dominant os spelling
API-B-03	:65-71, :283-313, :559-563	the apiMethods primitives/derived rule stated 3×	once. Callout → 3 lines; derived table drops the 3 rows with no route and no derivation (history/restore/purge keep a one-line mention); Best Practice 6 stops restating it
API-B-05	:22-28	preamble restating the frontmatter above the fold	deleted
API-A-01	:31-39 "When to Use This Skill"	6 bullets, 3 of which misroute	Skill Boundaries table, matching objectstack-data / objectstack-query
API-A-02	frontmatter :3-12	promises "batch/versioning contracts"	"batch contracts" — versioning.zod.ts has zero consumers outside a pin test
API-A-03	:83-94	three /meta client query-param contracts	2 lines saying they are client contracts nothing declares
API-D-03	:544-547, :556-558	Best Practices 1 and 4	deleted (1 duplicates :273 and is wrong for the carve-out; 4 names no key and no gate)
API-D-04	:569-576	Pitfalls 1, 2, 4	deleted — FLS has no authorable spelling in the bundle, the page sizes match no platform constant, rate limiting is already the D6 rule
API-D-05	:191-198	two why-paragraphs after the carve-out rule	deleted, rule kept
API-F-04 + API-G-03	:275-279	environment-scoped routes + projectResolution, 0 usages	deleted (takes the retired project gloss with it)
API-F-06	:404-411	two declared-but-unenforced realtime notes	deleted from the skill; filed as #14446
API-G-02	:481	defineDatasource imported from the root barrel	moot — deleted with API-C-01
API-F-01(add)	gap — :164 named http.server with no example	one table cell	new ## Code routes: mounting on http.server` section
API-F-02(add)	gap — :548-555	frontmatter promised "error envelopes"; the ledger rule was absent	new ## Error Envelopes & the Code Ledger (ADR-0112)
API-F-03(add)	:575-576	"use optimistic locking (version field)", naming no spelling	the two real spellings, body-wins, 409 CONCURRENT_UPDATE

The three funded additions — every claim, with its source

1. http.server code mount — verified against all three shipping sites (examples/app-showcase/src/system/server/recalc-endpoint.ts:48-118, packages/plugins/plugin-sharing/src/sharing-plugin.ts:787-790, packages/plugins/plugin-approvals/src/approvals-plugin.ts:353-356).

• dual lookup readServer('http.server') ?? readServer('http-server'), canonical first — sharing-plugin.ts:787-790, approvals-plugin.ts:353-356; both carry the same comment that http.server is "the ONLY name present on all provider paths".
• kernel:ready, not later — packages/spec/src/contracts/plugin-lifecycle-events.ts:70-91: listen() is deferred to kernel:listeningbecause "route registration in Hono … seals the matcher the first time a request is matched"; recalc-endpoint.ts:110-112 hooks kernel:ready.
• the handler signature — RouteHandler = (req: IHttpRequest, res: IHttpResponse) at packages/spec/src/contracts/http-server.ts:108-111; IHttpResponse.status(code): IHttpResponse at :77 (so res.status(200).json(…) chains); IHttpServer.post at :216.
• the block is NOT os:check-marked, deliberately. See "Assumption 3" below — this is measured, not assumed.

2. ADR-0112 error-code ledger — packages/spec/src/api/error-code-ledger.zod.ts:6-56 states the two tiers, "An unregistered code fails schema parse — which fails the envelope conformance suites — which fails CI", the framework-packages-only scope rule (#4805, maintainer ruling 2026-08-03 re-confirmed 2026-08-09), and the downstream composition. Functions re-located by content on this base: makeApiErrorSchema at packages/spec/src/api/contract.zod.ts:146, envelopeViolations at :215.

3. OCC — packages/rest/src/rest-server.ts:7710-7727 is the PATCH /api/v1/data/:object/:id route: If-Match header or expectedVersion body field, const expectedVersion = bodyVersion ?? ifMatchHeader (body wins), and the field is stripped from the write payload. The token semantics, the 409 and the "" refusal are the spec's own .describe() at packages/spec/src/api/protocol.zod.ts:2097-2102. CONCURRENT_UPDATE is registered at packages/spec/src/api/error-code-ledger.zod.ts:168 and pinned to 409 at packages/rest/src/rest-unclassified-fault-status.test.ts:230.

premise_false

API-F-01, the "getService is async" clause — the audit's premise is false and was NOT written. The real host contract is PluginContext.getService[T](name: string): T (packages/core/src/types.ts:36, doc comment @throws Error if service not found) — synchronous, and it throws. Measured on this base:

• await ctx.getService in packages/plugins/**, excluding tests: 0 occurrences.
• non-awaited ctx.getService( / ctx.getService[T](, same scope: 112.
• the three app sites are ctx?.getService?.('manifest') with no await (packages/apps/{account,setup,studio}/src/index.ts:{60,55,68}).

The audit's evidence for "async" was recalc-endpoint.ts:52, which awaits — but that file's ctx is its own locally declared RecalcHostContext (:30-35) whose getService?: (name) => Promise<T> is a shim, not the host. That is precisely the defect API-C-02 was deleted for, so the skill states the true rule instead: getService is synchronous and throws, which is exactly why each name needs its own try and a() ?? b() in one try never reaches b.

The :532 "fix or unmark" item needs neither — the block is deleted with API-C-02, so no marker survives to prove or disprove anything.

PM assumptions — all six measured

#	assumption	verdict
1	skills/objectstack-api/** byte-identical a59f78d ↔ base	HOLDS — git diff a59f78d 96b627d1 -- skills/objectstack-api/ is empty; every audited span matched by content
2	the frontmatter edit forces regeneration of BOTH generated files	HOLDS — check:skill-docs red on both before gen:skill-docs, green after; the .mdx pulled 20 docs-family gates into the union, re-derived and run
3	the real PluginContext is unreachable from the os:check skills surface	HOLDS, measured directly.SURFACES[0] resolves resolutionDir/selfPackages = packages/spec only (packages/spec/scripts/check-skill-examples.ts:526-532). Probed it: a temporary marked block importing PluginContext from @objectstack/core fails TS2307: Cannot find module '@objectstack/core'. Probe reverted and proven byte-identical (worktree blob hash == HEAD blob hash, git diff HEAD empty). ⇒ the F-01 block stays unmarked rather than earning a marker with a fabricated stand-in
4	RestApiEndpointSchema 0 consumers · no plugin-rest-api package · no endpoints key	HOLDS — 0 hits outside packages/spec/src/api/plugin-rest-api* (positive control: the same grep for ApiEndpoint returns many); ls packages/plugins/ | grep -i rest empty; RestApiPluginConfig (packages/rest/src/rest-api-plugin.ts:95-105) is exactly {serverServiceName?, protocolServiceName?, kernelManagerServiceName?, api?}
5	a heading in this file may be bound by check:skill-identifier-liveness Leg 2	YES, and it is. Binding api-methods binds ## API Methods (Operations) to ApiMethod (scripts/check-skill-identifier-liveness.mjs:285-292). Fixed the author's way: the heading and all six primitives stay; only the derived rows moved. Gate green, 9 bindings, 0 ledgered gaps
6	a false premise is skipped and listed	applied to the getService clause above

Token delta

file	before	after	Δ	ceiling
skills/objectstack-api/SKILL.md	6311	4635	−1,676 (−26.6%)	6319, unchanged (headroom 8 → 1684)
skills/objectstack-api/evals/README.md	546	546	0	546 — untouched, API-H-01 deferred
skills/objectstack-api/references/_index.md	888	888	0	generator-owned, untouched
bundle, ratcheted (authored)	171406	169730	−1,676	171743

607 → 428 lines. No ceiling raised, no new file, no file deleted, and scripts/check-skills-token-ratchet.mjs is not edited.

The gap, itemised rather than smoothed. The dispatch target was −1,725 to −2,100; this lands at −1,676, short by 49 tokens (2.8%). It is not spread thin — it is two opposing errors in the audit's own estimates:

• the three funded additions cost 239 tokens more than funded: F-01 271 actual vs +130 budgeted; F-02 162 vs +120; F-03 +96 net vs +40. Each was trimmed once already (F-01 from 407 tokens, F-02 from 250); trimming further would start dropping the load-bearing clauses each was funded to carry.
• the deletions cut about 190 tokens more than the audit's per-span estimates, which is what absorbs most of that.

Closing the last 49 would mean cutting content no finding covers. Deliberately not done.

follow-up for objectstack-data / objectstack-platform

Both anchors are stronger than what this PR deleted, on every axis but one. Verified by heading on origin/claude/issue-14297-skills-data-optimization and origin/claude/issue-14299-skills-platform-optimization (what will merge):

• objectstack-data/rules/datasources.md — byte-identical to origin/main on the data flight's branch; headings ## schemaMode — who owns the schema, ## Auto-connect (no onEnable), ## Credentials — fail-closed, ## Writes — double opt-in. ✅
• objectstack-platform/SKILL.md → ## Driver Selection Guide — carries driver packages, class names, and the Turso "Cloud / EE only … UnsupportedDriverError" caveat that the deleted api table omitted. ✅ Also ## Well-Known Plugin Names & Services and rules/service-registry.md both present. ✅
• the one gap: neither anchor names the driver id vocabulary an author actually writes in defineDatasource({ driver: … }) — postgres, mysql, mongodb, sqlite, sqlite-wasm, turso, memory, and the mongo alias. The deleted api table did. Nothing is lost here — the pointer names the authoritative source, packages/spec/src/data/driver/config-registry.zod.ts:163 (resolveDriverId handles the aliases) — but a row in objectstack-data/rules/datasources.md would be the right home. Not filed as a card: it is one row inside a flight already in review; raising it here so that flight's reviewer can take it.

One file outside the declared surface, and why

scripts/role-word-baseline.json — check:role-word went red on this branch with its ratchet-DOWN remedy, because API-C-03 deleted the file's single baselined occurrence of the reserved word (the Security Layers row | **RBAC** | Object | Role-based access control (profile → permissions) |). The gate names --update as the author's own path when a baselined file goes clean; leaving the entry would leave budget a later edit could spend silently. Baseline 43 → 42 files; the skills/objectstack-api/SKILL.md row is dropped, no other row moves. Committed separately.

Out-of-scope card filed

#14446 — declared ≠ enforced (ADR-0049): RealtimeEventType (packages/spec/src/api/realtime.zod.ts:33-40) spells record.* while the platform emits data.record.* (api/events.zod.ts:139-141), and SubscriptionSchema.filters is z.unknown().optional() (realtime.zod.ts:49). finding label, unassigned, no pm-state, no priority. Dedupe searched first — the four nearest cards (#4602, #4626, #4673, #9055) are all closed and none covers this pair.

Gates — head sha 19ee5853

Union re-derived after regeneration and again after the final commit: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands → 42 commands (the .mdx output pulled in the docs family; the role-word baseline added 6 more: check:bash32-floor, check:cli-command-ids, check:entry-guard, check:parse-guard, check:pnpm-filter-targets, check:watch-hint-literal). All 42 run at 19ee5853; every exit code captured before any pipe.

41 green, 1 NOT MEASURED, 0 red.

• node scripts/check-skills-token-ratchet.mjs → ✓ … 38 authored bundle file(s) within their ceilings
• pnpm --filter @objectstack/spec check:skill-examples → ✅ 255 prose examples type-check across 3 surface(s) — every marked block parsed, so tsc ran the SEMANTIC pass on all of them (run under the shared verify lock; os-verify-lock: VERDICT command-exit 0). @objectstack/spec, @objectstack/client-react and @objectstack/formula closures built first, also under the lock — VERDICT command-exit 0 — so this gate could refuse rather than false-green.
• pnpm check:skill-identifier-liveness → OK — Leg 1: 488 citation(s) over 48 published file(s) …; Leg 2: 9 registered exhaustive section(s), 0 ledgered gap(s) (baseline was 500 citations; the drop is the deleted tables)
• pnpm check:skill-compatibility → ✓ … 11 SKILL.md file(s) reconciled against 78 workspace packages
• pnpm --filter @objectstack/spec check:skill-docs → ✅ Skill docs in sync
• pnpm check:role-word → ✓ after the ratchet-down
• node scripts/check-nul-bytes.mjs → OK (scanned 7875 text file(s) … no raw ASCII control bytes), plus a direct control-byte grep over the three edited files: no hits
• NOT MEASURED:node scripts/check-test-completeness.mjs exits 3, its own "PREREQUISITE NOT MET" code — it needs a saved turbo run test log this run has no reason to produce. Its own text: "Nothing was measured … It is NOT a finding". CI supplies the log.

Two gates were exit-3 / exit-1 prerequisite states on the first pass and turned green once the closures were built, not by any edit: check:doc-formula-expressions + check:doc-security-posture (needed @objectstack/formula built) and check:docs (needed gen:schema, which build runs first).

Labels

skip-changeset — nothing released by any package changes. Checked against scripts/check-empty-changeset.mjs's own enumeration (:357: "It releases nothing (.github/, .claude/, skills/, docs/, content/, examples/…)"); this diff is skills/** + content/docs/** + one scripts/ ledger. needs:contract-review on both this PR and the card — the OCC contract, the error-ledger rule and the http.server mount timing are contract-semantics claims.

Stays draft: governed face.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LraLgQVGq8egUwfYZpbYt1

---

Generated by Claude Code