docs(skills): state which record each validation rule type is judged against

[claude]

Fixes#15011

The rule-type table under "Available Rule Types" in skills/objectstack-data/rules/validation.md said what each type is for and when it fails, but never which record the predicate is evaluated on — and the answer is not uniform across the six. An author who reads "use a script rule for an invariant" and reasonably generalises it to "validations[] holds invariants" reaches for format to enforce a stored-data invariant and gets a write gate instead: no error, no signal, and legacy rows never checked.

One column added, Judged against, one short cell per row. Table only — no new prose section, no new heading, no example block, no change to the tool-choice paragraph at the head of Script Validation (merged at c454640a), no second file. Net 0 lines; the column is added to the eight existing table lines.

Before

| Type | Purpose | When Validation Fails |
|:-----|:--------|:---------------------|
| `script` | CEL predicate over the record | When predicate evaluates to `true` |
| `state_machine` | Legal state transitions | When transition not allowed |
| `format` | Regex or built-in format | When format doesn't match |
| `cross_field` | CEL predicate comparing fields | When predicate evaluates to `true` |
| `json_schema` | Validate JSON field | When JSON doesn't match schema |
| `conditional` | Apply nested rule when a predicate holds | When nested rule fails |

After

| Type | Purpose | When Validation Fails | Judged against |
|:-----|:--------|:---------------------|:---------------|
| `script` | CEL predicate over the record | When predicate evaluates to `true` | Merged record — prior row plus this write |
| `state_machine` | Legal state transitions | When transition not allowed | Written value vs the prior row's, only when the write sets the field (insert: `initialStates`) |
| `format` | Regex or built-in format | When format doesn't match | Write payload only — an omitted field is never judged |
| `cross_field` | CEL predicate comparing fields | When predicate evaluates to `true` | Merged record — prior row plus this write |
| `json_schema` | Validate JSON field | When JSON doesn't match schema | Write payload only — an omitted field is never judged |
| `conditional` | Apply nested rule when a predicate holds | When nested rule fails | Its `when` on the merged record; the nested rule as its own type |

Engine evidence, per row

Every cell is measured on this branch from packages/objectql/src/validation/rule-validator.ts, not copied from the card. The context the dispatch hands out is built at :2000-2012:

const previous = mode === 'update' && priorRecord ? materializeDeclaredFields({ ...priorRecord }, fields) : priorRecord;
const merged = { ...(previous ?? {}), ...data }; // type annotation elided: see the note below
if (groundTruth) materializeDeclaredFields(merged, fields);
const ctx: RuleContext = { data, merged, previous, mode, ... };

The one type annotation elided above is the plain record-map type; it is dropped only because a tag-shaped fragment does not survive this platform's body sanitizer. RuleContext's own docblock (:271-275) states the split independently: "data is the raw incoming write (a PATCH on update); merged overlays it on the prior record … Field-scoped rules (state_machine, format, json_schema) key off data to decide whether the write actually touched their field."

evaluateRule's switch is at :2177-2191:

Row	Dispatch, evaluateRule	Checker	Record handed to it
script	checkPredicate(rule, ctx.merged, ctx.previous, …)	checkPredicate:2332	ctx.merged — the prior row overlaid with the write. Bound as CEL record, with previous alongside.
cross_field	same case as script, same call	checkPredicate:2332	ctx.merged, identically
format	checkFormat(rule, ctx.data, …)	checkFormat:2384	ctx.data — opens if (!(rule.field in data)) return null, then reads data[rule.field], so an omitted field is not judged
json_schema	checkJsonSchema(rule, ctx.data, …)	checkJsonSchema:2451	ctx.data — same field in data guard, then data[rule.field]
state_machine	checkStateMachine(rule, ctx.mode, ctx.data, ctx.previous, ctx)	checkStateMachine:2209	update leg: same field in data guard, then from = previous[rule.field], to = data[rule.field]. Insert leg: data[rule.field] against rule.initialStates, no prior row.
conditional	checkConditional(rule, ctx)	checkConditional:2499	its when on ctx.merged (record: ctx.merged, previous: ctx.previous), then evaluateRule(branch, ctx) re-dispatches the nested rule through the same switch with the same ctx — so a nested format still reads the payload

All six agree with the reading the card predicted; no row had to be written against it.

Six rows is still the complete set.ValidationRuleSchema (packages/spec/src/data/validation.zod.ts:351-359) is a discriminatedUnion over exactly ScriptValidationSchema, StateMachineValidationSchema, FormatValidationSchema, CrossFieldValidationSchema, JSONValidationSchema, ConditionalValidationSchema — the six z.literal types at :179, :194, :211, :293, :314, :545. No seventh type, so the "There is no other type" sentence under the table stands untouched.

Ratchet and size readings

Both readings the published-skills contract asks for, lines and tokens (ceil(utf8 bytes / 4), the ratchet's own unit):

Reading	Before	After	Delta
Whole filerules/validation.md — lines	342	342	0
Whole filerules/validation.md — tokens	2499	2601	+102
Whole packageskills/**, all 46 .md — lines	13599	13599	0
Whole packageskills/**, all 46 .md — tokens	152000	152102	+102
Whole package, the 11 SKILL.md alone — lines / tokens	6835 / 79239	6835 / 79239	0 / 0

The SKILL.md sum is unmoved because the edited file is a rules/ file, not a SKILL.md; the all-.md row is the reading that actually moves and is reported beside it rather than instead of it.

Ceiling untouched. The gate's own line, after the change:

✓ check-skills-token-ratchet: skills/objectstack-data/rules/validation.md is 2601 tokens (ceiling 3109; headroom 508).
✓ check-skills-token-ratchet: 36 authored bundle file(s) within their ceilings; 11 generator-owned file(s) measured, not ratcheted.

+102 of the 610 tokens of headroom, leaving 508. No ceiling edited, no lines bought — so nothing is owed to the "delete content to pay the ratchet" rule.

The sibling line ratchet was run to confirm it does not cover this path, and it does not — its population is .claude/** plus the two repo-root instruction files:

✓ check-skill-line-ratchet: AGENTS.md is 1157 lines (ceiling 1162; headroom 5).
✓ check-skill-line-ratchet: declared cross-file moves: 1, total ceilings down 1 line.

Gates

Family re-derived after the commit from the real changeset — node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack — which named 20 families for this path; the dispatch list named those 20 plus check:skill-docs. The union of 21 was run. Verification run head: 09802409, tree clean, diff exactly one file (8 insertions, 8 deletions).

Each exit code was captured before any pipe; each line below is the gate's own verdict text.

Gate	Verdict line
check-ci-filter-parity	OK: all 135 declared cross-package glob(s) (95 unique) are covered by \core` or `crosspkg`, every `crosspkg` entry still covers one, and the `test` job's `if:` still names both filters.`
check-closing-keyword-parity	check-closing-keyword-parity: OK (3 parsers agree on all 9 keywords and both measured separators; sweep found 5 file(s) carrying the grammar across 8180 tracked file(s), all registered).
check-comment-mask-corpus	✓ comment-mask corpus sweep [scripts/js-comment-mask.mjs]: 5833 files, 0 disagree, 0 unparseable, 42.4s (comparator self-test: 12 cases pass).
check-cross-package-test-inputs (node)	OK: 25 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob.
check-shard-attestation	✓ check-shard-attestation: 2 aggregate gate(s) count 3 declared leg(s) across 3 attesting job(s).
check-skills-token-ratchet	✓ check-skills-token-ratchet: 36 authored bundle file(s) within their ceilings; 11 generator-owned file(s) measured, not ratcheted.
check-test-completeness	NOT MEASURED, in the gate's own words — see below
check:doc-formula-expressions	✓ check:doc-formula-expressions (spec TSDoc, #6763): 9 @example(s) judged clean across 1137 packages/spec/src files — rls-predicate=8, hook-record-condition=1, record-formula=0; 0 exempt.
check:skill-docs	✅ Skill docs in sync
check:agent-test-spelling	✓ check-agent-test-spelling: 0 violations — 432 file(s) · 5850 bare \--` token(s) · 1390 launcher-rooted run(s) · 9 separator(s) JUDGED · 5 vitest-backed script name(s) derived from 81 manifest(s)`
check:corpus-claim-drift	check-corpus-claim-drift: OK, no new claim sites beside a pinned spelling.
check:cross-package-test-inputs (pnpm)	All 117 self-test cases passed. / OK: 25 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob.
check:doc-authoring	✓ doc authoring guard: 46 published skill files clean — no internal issue-id references.
check:nul-bytes	check-nul-bytes: OK (scanned 8173 text file(s) -- 8173 tracked, 0 untracked-not-ignored; skipped 7 binary; no raw ASCII control bytes).
check:pm-governed-merges	✓ check-governed-merges --self-test: 245 assertions (…) / live: the real generator declared 9 output(s) and certified this tree — the enumeration in the middle is elided here for length only
check:refd-timer-probe	OK check-refd-timer-probe: 5828 source file(s) swept; the process-global timer probe is read in packages/qa/refd-timer-testkit/src/index.ts and nowhere else.
check:role-word	check-role-word: OK, no new occurrences of the reserved word.
check:skill-compatibility	✓ check-skill-compatibility-version: 11 SKILL.md file(s) reconciled against 79 workspace packages
check:skill-frame-sync	✓ check-skill-frame-sync: 2 copies of the decision frame are structurally isomorphic across 2 files
check:skill-identifier-liveness	check-skill-identifier-liveness OK — Leg 1: 465 citation(s) over 46 published file(s) checked against 94464 implementation word tokens (3 ledgered exemption(s)); Leg 2: 8 registered exhaustive section(s), 0 ledgered gap(s).
check:watch-hint-literal	✓ check-watch-hint-literal: 48 declaration(s) across 4 rostered name(s) … no unrostered spelling of the idiom in the tree.

20 green, 1 NOT MEASURED.check-test-completeness exited 3, which is that gate's prerequisite code, not a finding's 1. Its own text:

check-test-completeness: PREREQUISITE NOT MET — this gate grades a saved `turbo run test` log, and no log was named.
⚠ Arrived here from the gate family `scripts/pm/dispatch-gates.mjs` derives?
That list names this script with NO argument, which is this branch. There is no
local log to hand it, so the local reading for this gate is NOT MEASURED.
⛔ It is not a red, and there is nothing here to fix.

check:doc-formula-expressions first exited 3 the same way (PREREQUISITE NOT MET — the workspace package @objectstack/formula is not built, then the same for @objectstack/lint). That one was fixable locally: pnpm exec turbo run build --filter=@objectstack/formula and --filter=@objectstack/lint, after which it was re-run and produced the real green quoted above. It is reported as measured; check-test-completeness is not, because nothing local can produce the log it grades.

Heavy runs went through scripts/pm/os-verify-lock.sh (slot issue-15011): the 21-gate sweep held the lock 75s, waited 0s.

Scope and landing

Governed surface (skills/**) — opened as a draft, no reviewers requested, auto-merge not armed, ready not flipped; the dispatching seat reviews in-seat and requests the approvers, and the landing is the maintainer's.

skip-changeset: this diff publishes nothing from any package — it changes one Markdown file inside the published skills catalog, which ships as documentation rather than as a released package artifact. Same reading the recent skills PRs on this path used.

---

Generated by Claude Code

[claude]

Fixes#15011

The rule-type table under "Available Rule Types" in skills/objectstack-data/rules/validation.md said what each type is for and when it fails, but never which record the predicate is evaluated on — and the answer is not uniform across the six. An author who reads "use a script rule for an invariant" and reasonably generalises it to "validations[] holds invariants" reaches for format to enforce a stored-data invariant and gets a write gate instead: no error, no signal, and legacy rows never checked.

One column added, Judged against, one short cell per row. Table only — no new prose section, no new heading, no example block, no change to the tool-choice paragraph at the head of Script Validation (merged at c454640a), no second file. Net 0 lines; the column is added to the eight existing table lines.

Before

| Type | Purpose | When Validation Fails |
|:-----|:--------|:---------------------|
| `script` | CEL predicate over the record | When predicate evaluates to `true` |
| `state_machine` | Legal state transitions | When transition not allowed |
| `format` | Regex or built-in format | When format doesn't match |
| `cross_field` | CEL predicate comparing fields | When predicate evaluates to `true` |
| `json_schema` | Validate JSON field | When JSON doesn't match schema |
| `conditional` | Apply nested rule when a predicate holds | When nested rule fails |

After

| Type | Purpose | When Validation Fails | Judged against |
|:-----|:--------|:---------------------|:---------------|
| `script` | CEL predicate over the record | When predicate evaluates to `true` | Merged record — prior row plus this write |
| `state_machine` | Legal state transitions | When transition not allowed | Written value vs the prior row's, only when the write sets the field (insert: `initialStates`) |
| `format` | Regex or built-in format | When format doesn't match | Write payload only — an omitted field is never judged |
| `cross_field` | CEL predicate comparing fields | When predicate evaluates to `true` | Merged record — prior row plus this write |
| `json_schema` | Validate JSON field | When JSON doesn't match schema | Write payload only — an omitted field is never judged |
| `conditional` | Apply nested rule when a predicate holds | When nested rule fails | Its `when` on the merged record; the nested rule as its own type |

Engine evidence, per row

Every cell is measured on this branch from packages/objectql/src/validation/rule-validator.ts, not copied from the card. The context the dispatch hands out is built at :2000-2012:

const previous = mode === 'update' && priorRecord ? materializeDeclaredFields({ ...priorRecord }, fields) : priorRecord;
const merged = { ...(previous ?? {}), ...data }; // type annotation elided: see the note below
if (groundTruth) materializeDeclaredFields(merged, fields);
const ctx: RuleContext = { data, merged, previous, mode, ... };

The one type annotation elided above is the plain record-map type; it is dropped only because a tag-shaped fragment does not survive this platform's body sanitizer. RuleContext's own docblock (:271-275) states the split independently: "data is the raw incoming write (a PATCH on update); merged overlays it on the prior record … Field-scoped rules (state_machine, format, json_schema) key off data to decide whether the write actually touched their field."

evaluateRule's switch is at :2177-2191:

Row	Dispatch, evaluateRule	Checker	Record handed to it
script	checkPredicate(rule, ctx.merged, ctx.previous, …)	checkPredicate:2332	ctx.merged — the prior row overlaid with the write. Bound as CEL record, with previous alongside.
cross_field	same case as script, same call	checkPredicate:2332	ctx.merged, identically
format	checkFormat(rule, ctx.data, …)	checkFormat:2384	ctx.data — opens if (!(rule.field in data)) return null, then reads data[rule.field], so an omitted field is not judged
json_schema	checkJsonSchema(rule, ctx.data, …)	checkJsonSchema:2451	ctx.data — same field in data guard, then data[rule.field]
state_machine	checkStateMachine(rule, ctx.mode, ctx.data, ctx.previous, ctx)	checkStateMachine:2209	update leg: same field in data guard, then from = previous[rule.field], to = data[rule.field]. Insert leg: data[rule.field] against rule.initialStates, no prior row.
conditional	checkConditional(rule, ctx)	checkConditional:2499	its when on ctx.merged (record: ctx.merged, previous: ctx.previous), then evaluateRule(branch, ctx) re-dispatches the nested rule through the same switch with the same ctx — so a nested format still reads the payload

All six agree with the reading the card predicted; no row had to be written against it.

Six rows is still the complete set.ValidationRuleSchema (packages/spec/src/data/validation.zod.ts:351-359) is a discriminatedUnion over exactly ScriptValidationSchema, StateMachineValidationSchema, FormatValidationSchema, CrossFieldValidationSchema, JSONValidationSchema, ConditionalValidationSchema — the six z.literal types at :179, :194, :211, :293, :314, :545. No seventh type, so the "There is no other type" sentence under the table stands untouched.

Ratchet and size readings

Both readings the published-skills contract asks for, lines and tokens (ceil(utf8 bytes / 4), the ratchet's own unit):

Reading	Before	After	Delta
Whole filerules/validation.md — lines	342	342	0
Whole filerules/validation.md — tokens	2499	2601	+102
Whole packageskills/**, all 46 .md — lines	13599	13599	0
Whole packageskills/**, all 46 .md — tokens	152000	152102	+102
Whole package, the 11 SKILL.md alone — lines / tokens	6835 / 79239	6835 / 79239	0 / 0

The SKILL.md sum is unmoved because the edited file is a rules/ file, not a SKILL.md; the all-.md row is the reading that actually moves and is reported beside it rather than instead of it.

Ceiling untouched. The gate's own line, after the change:

✓ check-skills-token-ratchet: skills/objectstack-data/rules/validation.md is 2601 tokens (ceiling 3109; headroom 508).
✓ check-skills-token-ratchet: 36 authored bundle file(s) within their ceilings; 11 generator-owned file(s) measured, not ratcheted.

+102 of the 610 tokens of headroom, leaving 508. No ceiling edited, no lines bought — so nothing is owed to the "delete content to pay the ratchet" rule.

The sibling line ratchet was run to confirm it does not cover this path, and it does not — its population is .claude/** plus the two repo-root instruction files:

✓ check-skill-line-ratchet: AGENTS.md is 1157 lines (ceiling 1162; headroom 5).
✓ check-skill-line-ratchet: declared cross-file moves: 1, total ceilings down 1 line.

Gates

Family re-derived after the commit from the real changeset — node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack — which named 20 families for this path; the dispatch list named those 20 plus check:skill-docs. The union of 21 was run. Verification run head: 09802409, tree clean, diff exactly one file (8 insertions, 8 deletions).

Each exit code was captured before any pipe; each line below is the gate's own verdict text.

Gate	Verdict line
check-ci-filter-parity	OK: all 135 declared cross-package glob(s) (95 unique) are covered by \core` or `crosspkg`, every `crosspkg` entry still covers one, and the `test` job's `if:` still names both filters.`
check-closing-keyword-parity	check-closing-keyword-parity: OK (3 parsers agree on all 9 keywords and both measured separators; sweep found 5 file(s) carrying the grammar across 8180 tracked file(s), all registered).
check-comment-mask-corpus	✓ comment-mask corpus sweep [scripts/js-comment-mask.mjs]: 5833 files, 0 disagree, 0 unparseable, 42.4s (comparator self-test: 12 cases pass).
check-cross-package-test-inputs (node)	OK: 25 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob.
check-shard-attestation	✓ check-shard-attestation: 2 aggregate gate(s) count 3 declared leg(s) across 3 attesting job(s).
check-skills-token-ratchet	✓ check-skills-token-ratchet: 36 authored bundle file(s) within their ceilings; 11 generator-owned file(s) measured, not ratcheted.
check-test-completeness	NOT MEASURED, in the gate's own words — see below
check:doc-formula-expressions	✓ check:doc-formula-expressions (spec TSDoc, #6763): 9 @example(s) judged clean across 1137 packages/spec/src files — rls-predicate=8, hook-record-condition=1, record-formula=0; 0 exempt.
check:skill-docs	✅ Skill docs in sync
check:agent-test-spelling	✓ check-agent-test-spelling: 0 violations — 432 file(s) · 5850 bare \--` token(s) · 1390 launcher-rooted run(s) · 9 separator(s) JUDGED · 5 vitest-backed script name(s) derived from 81 manifest(s)`
check:corpus-claim-drift	check-corpus-claim-drift: OK, no new claim sites beside a pinned spelling.
check:cross-package-test-inputs (pnpm)	All 117 self-test cases passed. / OK: 25 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob.
check:doc-authoring	✓ doc authoring guard: 46 published skill files clean — no internal issue-id references.
check:nul-bytes	check-nul-bytes: OK (scanned 8173 text file(s) -- 8173 tracked, 0 untracked-not-ignored; skipped 7 binary; no raw ASCII control bytes).
check:pm-governed-merges	✓ check-governed-merges --self-test: 245 assertions (…) / live: the real generator declared 9 output(s) and certified this tree — the enumeration in the middle is elided here for length only
check:refd-timer-probe	OK check-refd-timer-probe: 5828 source file(s) swept; the process-global timer probe is read in packages/qa/refd-timer-testkit/src/index.ts and nowhere else.
check:role-word	check-role-word: OK, no new occurrences of the reserved word.
check:skill-compatibility	✓ check-skill-compatibility-version: 11 SKILL.md file(s) reconciled against 79 workspace packages
check:skill-frame-sync	✓ check-skill-frame-sync: 2 copies of the decision frame are structurally isomorphic across 2 files
check:skill-identifier-liveness	check-skill-identifier-liveness OK — Leg 1: 465 citation(s) over 46 published file(s) checked against 94464 implementation word tokens (3 ledgered exemption(s)); Leg 2: 8 registered exhaustive section(s), 0 ledgered gap(s).
check:watch-hint-literal	✓ check-watch-hint-literal: 48 declaration(s) across 4 rostered name(s) … no unrostered spelling of the idiom in the tree.

20 green, 1 NOT MEASURED.check-test-completeness exited 3, which is that gate's prerequisite code, not a finding's 1. Its own text:

check-test-completeness: PREREQUISITE NOT MET — this gate grades a saved `turbo run test` log, and no log was named.
⚠ Arrived here from the gate family `scripts/pm/dispatch-gates.mjs` derives?
That list names this script with NO argument, which is this branch. There is no
local log to hand it, so the local reading for this gate is NOT MEASURED.
⛔ It is not a red, and there is nothing here to fix.

check:doc-formula-expressions first exited 3 the same way (PREREQUISITE NOT MET — the workspace package @objectstack/formula is not built, then the same for @objectstack/lint). That one was fixable locally: pnpm exec turbo run build --filter=@objectstack/formula and --filter=@objectstack/lint, after which it was re-run and produced the real green quoted above. It is reported as measured; check-test-completeness is not, because nothing local can produce the log it grades.

Heavy runs went through scripts/pm/os-verify-lock.sh (slot issue-15011): the 21-gate sweep held the lock 75s, waited 0s.

Scope and landing

Governed surface (skills/**) — opened as a draft, no reviewers requested, auto-merge not armed, ready not flipped; the dispatching seat reviews in-seat and requests the approvers, and the landing is the maintainer's.

skip-changeset: this diff publishes nothing from any package — it changes one Markdown file inside the published skills catalog, which ships as documentation rather than as a released package artifact. Same reading the recent skills PRs on this path used.

---

Generated by Claude Code

[claude]

Fixes#15011

The rule-type table under "Available Rule Types" in skills/objectstack-data/rules/validation.md said what each type is for and when it fails, but never which record the predicate is evaluated on — and the answer is not uniform across the six. An author who reads "use a script rule for an invariant" and reasonably generalises it to "validations[] holds invariants" reaches for format to enforce a stored-data invariant and gets a write gate instead: no error, no signal, and legacy rows never checked.

One column added, Judged against, one short cell per row. Table only — no new prose section, no new heading, no example block, no change to the tool-choice paragraph at the head of Script Validation (merged at c454640a), no second file. Net 0 lines; the column is added to the eight existing table lines.

Before

| Type | Purpose | When Validation Fails |
|:-----|:--------|:---------------------|
| `script` | CEL predicate over the record | When predicate evaluates to `true` |
| `state_machine` | Legal state transitions | When transition not allowed |
| `format` | Regex or built-in format | When format doesn't match |
| `cross_field` | CEL predicate comparing fields | When predicate evaluates to `true` |
| `json_schema` | Validate JSON field | When JSON doesn't match schema |
| `conditional` | Apply nested rule when a predicate holds | When nested rule fails |

After

| Type | Purpose | When Validation Fails | Judged against |
|:-----|:--------|:---------------------|:---------------|
| `script` | CEL predicate over the record | When predicate evaluates to `true` | Merged record — prior row plus this write |
| `state_machine` | Legal state transitions | When transition not allowed | Written value vs the prior row's, only when the write sets the field (insert: `initialStates`) |
| `format` | Regex or built-in format | When format doesn't match | Write payload only — an omitted field is never judged |
| `cross_field` | CEL predicate comparing fields | When predicate evaluates to `true` | Merged record — prior row plus this write |
| `json_schema` | Validate JSON field | When JSON doesn't match schema | Write payload only — an omitted field is never judged |
| `conditional` | Apply nested rule when a predicate holds | When nested rule fails | Its `when` on the merged record; the nested rule as its own type |

Engine evidence, per row

Every cell is measured on this branch from packages/objectql/src/validation/rule-validator.ts, not copied from the card. The context the dispatch hands out is built at :2000-2012:

const previous = mode === 'update' && priorRecord ? materializeDeclaredFields({ ...priorRecord }, fields) : priorRecord;
const merged = { ...(previous ?? {}), ...data }; // type annotation elided: see the note below
if (groundTruth) materializeDeclaredFields(merged, fields);
const ctx: RuleContext = { data, merged, previous, mode, ... };

The one type annotation elided above is the plain record-map type; it is dropped only because a tag-shaped fragment does not survive this platform's body sanitizer. RuleContext's own docblock (:271-275) states the split independently: "data is the raw incoming write (a PATCH on update); merged overlays it on the prior record … Field-scoped rules (state_machine, format, json_schema) key off data to decide whether the write actually touched their field."

evaluateRule's switch is at :2177-2191:

Row	Dispatch, evaluateRule	Checker	Record handed to it
script	checkPredicate(rule, ctx.merged, ctx.previous, …)	checkPredicate:2332	ctx.merged — the prior row overlaid with the write. Bound as CEL record, with previous alongside.
cross_field	same case as script, same call	checkPredicate:2332	ctx.merged, identically
format	checkFormat(rule, ctx.data, …)	checkFormat:2384	ctx.data — opens if (!(rule.field in data)) return null, then reads data[rule.field], so an omitted field is not judged
json_schema	checkJsonSchema(rule, ctx.data, …)	checkJsonSchema:2451	ctx.data — same field in data guard, then data[rule.field]
state_machine	checkStateMachine(rule, ctx.mode, ctx.data, ctx.previous, ctx)	checkStateMachine:2209	update leg: same field in data guard, then from = previous[rule.field], to = data[rule.field]. Insert leg: data[rule.field] against rule.initialStates, no prior row.
conditional	checkConditional(rule, ctx)	checkConditional:2499	its when on ctx.merged (record: ctx.merged, previous: ctx.previous), then evaluateRule(branch, ctx) re-dispatches the nested rule through the same switch with the same ctx — so a nested format still reads the payload

All six agree with the reading the card predicted; no row had to be written against it.

Six rows is still the complete set.ValidationRuleSchema (packages/spec/src/data/validation.zod.ts:351-359) is a discriminatedUnion over exactly ScriptValidationSchema, StateMachineValidationSchema, FormatValidationSchema, CrossFieldValidationSchema, JSONValidationSchema, ConditionalValidationSchema — the six z.literal types at :179, :194, :211, :293, :314, :545. No seventh type, so the "There is no other type" sentence under the table stands untouched.

Ratchet and size readings

Both readings the published-skills contract asks for, lines and tokens (ceil(utf8 bytes / 4), the ratchet's own unit):

Reading	Before	After	Delta
Whole filerules/validation.md — lines	342	342	0
Whole filerules/validation.md — tokens	2499	2601	+102
Whole packageskills/**, all 46 .md — lines	13599	13599	0
Whole packageskills/**, all 46 .md — tokens	152000	152102	+102
Whole package, the 11 SKILL.md alone — lines / tokens	6835 / 79239	6835 / 79239	0 / 0

The SKILL.md sum is unmoved because the edited file is a rules/ file, not a SKILL.md; the all-.md row is the reading that actually moves and is reported beside it rather than instead of it.

Ceiling untouched. The gate's own line, after the change:

✓ check-skills-token-ratchet: skills/objectstack-data/rules/validation.md is 2601 tokens (ceiling 3109; headroom 508).
✓ check-skills-token-ratchet: 36 authored bundle file(s) within their ceilings; 11 generator-owned file(s) measured, not ratcheted.

+102 of the 610 tokens of headroom, leaving 508. No ceiling edited, no lines bought — so nothing is owed to the "delete content to pay the ratchet" rule.

The sibling line ratchet was run to confirm it does not cover this path, and it does not — its population is .claude/** plus the two repo-root instruction files:

✓ check-skill-line-ratchet: AGENTS.md is 1157 lines (ceiling 1162; headroom 5).
✓ check-skill-line-ratchet: declared cross-file moves: 1, total ceilings down 1 line.

Gates

Family re-derived after the commit from the real changeset — node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack — which named 20 families for this path; the dispatch list named those 20 plus check:skill-docs. The union of 21 was run. Verification run head: 09802409, tree clean, diff exactly one file (8 insertions, 8 deletions).

Each exit code was captured before any pipe; each line below is the gate's own verdict text.

Gate	Verdict line
check-ci-filter-parity	OK: all 135 declared cross-package glob(s) (95 unique) are covered by \core` or `crosspkg`, every `crosspkg` entry still covers one, and the `test` job's `if:` still names both filters.`
check-closing-keyword-parity	check-closing-keyword-parity: OK (3 parsers agree on all 9 keywords and both measured separators; sweep found 5 file(s) carrying the grammar across 8180 tracked file(s), all registered).
check-comment-mask-corpus	✓ comment-mask corpus sweep [scripts/js-comment-mask.mjs]: 5833 files, 0 disagree, 0 unparseable, 42.4s (comparator self-test: 12 cases pass).
check-cross-package-test-inputs (node)	OK: 25 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob.
check-shard-attestation	✓ check-shard-attestation: 2 aggregate gate(s) count 3 declared leg(s) across 3 attesting job(s).
check-skills-token-ratchet	✓ check-skills-token-ratchet: 36 authored bundle file(s) within their ceilings; 11 generator-owned file(s) measured, not ratcheted.
check-test-completeness	NOT MEASURED, in the gate's own words — see below
check:doc-formula-expressions	✓ check:doc-formula-expressions (spec TSDoc, #6763): 9 @example(s) judged clean across 1137 packages/spec/src files — rls-predicate=8, hook-record-condition=1, record-formula=0; 0 exempt.
check:skill-docs	✅ Skill docs in sync
check:agent-test-spelling	✓ check-agent-test-spelling: 0 violations — 432 file(s) · 5850 bare \--` token(s) · 1390 launcher-rooted run(s) · 9 separator(s) JUDGED · 5 vitest-backed script name(s) derived from 81 manifest(s)`
check:corpus-claim-drift	check-corpus-claim-drift: OK, no new claim sites beside a pinned spelling.
check:cross-package-test-inputs (pnpm)	All 117 self-test cases passed. / OK: 25 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob.
check:doc-authoring	✓ doc authoring guard: 46 published skill files clean — no internal issue-id references.
check:nul-bytes	check-nul-bytes: OK (scanned 8173 text file(s) -- 8173 tracked, 0 untracked-not-ignored; skipped 7 binary; no raw ASCII control bytes).
check:pm-governed-merges	✓ check-governed-merges --self-test: 245 assertions (…) / live: the real generator declared 9 output(s) and certified this tree — the enumeration in the middle is elided here for length only
check:refd-timer-probe	OK check-refd-timer-probe: 5828 source file(s) swept; the process-global timer probe is read in packages/qa/refd-timer-testkit/src/index.ts and nowhere else.
check:role-word	check-role-word: OK, no new occurrences of the reserved word.
check:skill-compatibility	✓ check-skill-compatibility-version: 11 SKILL.md file(s) reconciled against 79 workspace packages
check:skill-frame-sync	✓ check-skill-frame-sync: 2 copies of the decision frame are structurally isomorphic across 2 files
check:skill-identifier-liveness	check-skill-identifier-liveness OK — Leg 1: 465 citation(s) over 46 published file(s) checked against 94464 implementation word tokens (3 ledgered exemption(s)); Leg 2: 8 registered exhaustive section(s), 0 ledgered gap(s).
check:watch-hint-literal	✓ check-watch-hint-literal: 48 declaration(s) across 4 rostered name(s) … no unrostered spelling of the idiom in the tree.

20 green, 1 NOT MEASURED.check-test-completeness exited 3, which is that gate's prerequisite code, not a finding's 1. Its own text:

check-test-completeness: PREREQUISITE NOT MET — this gate grades a saved `turbo run test` log, and no log was named.
⚠ Arrived here from the gate family `scripts/pm/dispatch-gates.mjs` derives?
That list names this script with NO argument, which is this branch. There is no
local log to hand it, so the local reading for this gate is NOT MEASURED.
⛔ It is not a red, and there is nothing here to fix.

check:doc-formula-expressions first exited 3 the same way (PREREQUISITE NOT MET — the workspace package @objectstack/formula is not built, then the same for @objectstack/lint). That one was fixable locally: pnpm exec turbo run build --filter=@objectstack/formula and --filter=@objectstack/lint, after which it was re-run and produced the real green quoted above. It is reported as measured; check-test-completeness is not, because nothing local can produce the log it grades.

Heavy runs went through scripts/pm/os-verify-lock.sh (slot issue-15011): the 21-gate sweep held the lock 75s, waited 0s.

Scope and landing

Governed surface (skills/**) — opened as a draft, no reviewers requested, auto-merge not armed, ready not flipped; the dispatching seat reviews in-seat and requests the approvers, and the landing is the maintainer's.

skip-changeset: this diff publishes nothing from any package — it changes one Markdown file inside the published skills catalog, which ships as documentation rather than as a released package artifact. Same reading the recent skills PRs on this path used.

---

Generated by Claude Code

[claude]

Fixes#15011

The rule-type table under "Available Rule Types" in skills/objectstack-data/rules/validation.md said what each type is for and when it fails, but never which record the predicate is evaluated on — and the answer is not uniform across the six. An author who reads "use a script rule for an invariant" and reasonably generalises it to "validations[] holds invariants" reaches for format to enforce a stored-data invariant and gets a write gate instead: no error, no signal, and legacy rows never checked.

One column added, Judged against, one short cell per row. Table only — no new prose section, no new heading, no example block, no change to the tool-choice paragraph at the head of Script Validation (merged at c454640a), no second file. Net 0 lines; the column is added to the eight existing table lines.

Before

| Type | Purpose | When Validation Fails |
|:-----|:--------|:---------------------|
| `script` | CEL predicate over the record | When predicate evaluates to `true` |
| `state_machine` | Legal state transitions | When transition not allowed |
| `format` | Regex or built-in format | When format doesn't match |
| `cross_field` | CEL predicate comparing fields | When predicate evaluates to `true` |
| `json_schema` | Validate JSON field | When JSON doesn't match schema |
| `conditional` | Apply nested rule when a predicate holds | When nested rule fails |

After

| Type | Purpose | When Validation Fails | Judged against |
|:-----|:--------|:---------------------|:---------------|
| `script` | CEL predicate over the record | When predicate evaluates to `true` | Merged record — prior row plus this write |
| `state_machine` | Legal state transitions | When transition not allowed | Written value vs the prior row's, only when the write sets the field (insert: `initialStates`) |
| `format` | Regex or built-in format | When format doesn't match | Write payload only — an omitted field is never judged |
| `cross_field` | CEL predicate comparing fields | When predicate evaluates to `true` | Merged record — prior row plus this write |
| `json_schema` | Validate JSON field | When JSON doesn't match schema | Write payload only — an omitted field is never judged |
| `conditional` | Apply nested rule when a predicate holds | When nested rule fails | Its `when` on the merged record; the nested rule as its own type |

Engine evidence, per row

Every cell is measured on this branch from packages/objectql/src/validation/rule-validator.ts, not copied from the card. The context the dispatch hands out is built at :2000-2012:

const previous = mode === 'update' && priorRecord ? materializeDeclaredFields({ ...priorRecord }, fields) : priorRecord;
const merged = { ...(previous ?? {}), ...data }; // type annotation elided: see the note below
if (groundTruth) materializeDeclaredFields(merged, fields);
const ctx: RuleContext = { data, merged, previous, mode, ... };

The one type annotation elided above is the plain record-map type; it is dropped only because a tag-shaped fragment does not survive this platform's body sanitizer. RuleContext's own docblock (:271-275) states the split independently: "data is the raw incoming write (a PATCH on update); merged overlays it on the prior record … Field-scoped rules (state_machine, format, json_schema) key off data to decide whether the write actually touched their field."

evaluateRule's switch is at :2177-2191:

Row	Dispatch, evaluateRule	Checker	Record handed to it
script	checkPredicate(rule, ctx.merged, ctx.previous, …)	checkPredicate:2332	ctx.merged — the prior row overlaid with the write. Bound as CEL record, with previous alongside.
cross_field	same case as script, same call	checkPredicate:2332	ctx.merged, identically
format	checkFormat(rule, ctx.data, …)	checkFormat:2384	ctx.data — opens if (!(rule.field in data)) return null, then reads data[rule.field], so an omitted field is not judged
json_schema	checkJsonSchema(rule, ctx.data, …)	checkJsonSchema:2451	ctx.data — same field in data guard, then data[rule.field]
state_machine	checkStateMachine(rule, ctx.mode, ctx.data, ctx.previous, ctx)	checkStateMachine:2209	update leg: same field in data guard, then from = previous[rule.field], to = data[rule.field]. Insert leg: data[rule.field] against rule.initialStates, no prior row.
conditional	checkConditional(rule, ctx)	checkConditional:2499	its when on ctx.merged (record: ctx.merged, previous: ctx.previous), then evaluateRule(branch, ctx) re-dispatches the nested rule through the same switch with the same ctx — so a nested format still reads the payload

All six agree with the reading the card predicted; no row had to be written against it.

Six rows is still the complete set.ValidationRuleSchema (packages/spec/src/data/validation.zod.ts:351-359) is a discriminatedUnion over exactly ScriptValidationSchema, StateMachineValidationSchema, FormatValidationSchema, CrossFieldValidationSchema, JSONValidationSchema, ConditionalValidationSchema — the six z.literal types at :179, :194, :211, :293, :314, :545. No seventh type, so the "There is no other type" sentence under the table stands untouched.

Ratchet and size readings

Both readings the published-skills contract asks for, lines and tokens (ceil(utf8 bytes / 4), the ratchet's own unit):

Reading	Before	After	Delta
Whole filerules/validation.md — lines	342	342	0
Whole filerules/validation.md — tokens	2499	2601	+102
Whole packageskills/**, all 46 .md — lines	13599	13599	0
Whole packageskills/**, all 46 .md — tokens	152000	152102	+102
Whole package, the 11 SKILL.md alone — lines / tokens	6835 / 79239	6835 / 79239	0 / 0

The SKILL.md sum is unmoved because the edited file is a rules/ file, not a SKILL.md; the all-.md row is the reading that actually moves and is reported beside it rather than instead of it.

Ceiling untouched. The gate's own line, after the change:

✓ check-skills-token-ratchet: skills/objectstack-data/rules/validation.md is 2601 tokens (ceiling 3109; headroom 508).
✓ check-skills-token-ratchet: 36 authored bundle file(s) within their ceilings; 11 generator-owned file(s) measured, not ratcheted.

+102 of the 610 tokens of headroom, leaving 508. No ceiling edited, no lines bought — so nothing is owed to the "delete content to pay the ratchet" rule.

The sibling line ratchet was run to confirm it does not cover this path, and it does not — its population is .claude/** plus the two repo-root instruction files:

✓ check-skill-line-ratchet: AGENTS.md is 1157 lines (ceiling 1162; headroom 5).
✓ check-skill-line-ratchet: declared cross-file moves: 1, total ceilings down 1 line.

Gates

Family re-derived after the commit from the real changeset — node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack — which named 20 families for this path; the dispatch list named those 20 plus check:skill-docs. The union of 21 was run. Verification run head: 09802409, tree clean, diff exactly one file (8 insertions, 8 deletions).

Each exit code was captured before any pipe; each line below is the gate's own verdict text.

Gate	Verdict line
check-ci-filter-parity	OK: all 135 declared cross-package glob(s) (95 unique) are covered by \core` or `crosspkg`, every `crosspkg` entry still covers one, and the `test` job's `if:` still names both filters.`
check-closing-keyword-parity	check-closing-keyword-parity: OK (3 parsers agree on all 9 keywords and both measured separators; sweep found 5 file(s) carrying the grammar across 8180 tracked file(s), all registered).
check-comment-mask-corpus	✓ comment-mask corpus sweep [scripts/js-comment-mask.mjs]: 5833 files, 0 disagree, 0 unparseable, 42.4s (comparator self-test: 12 cases pass).
check-cross-package-test-inputs (node)	OK: 25 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob.
check-shard-attestation	✓ check-shard-attestation: 2 aggregate gate(s) count 3 declared leg(s) across 3 attesting job(s).
check-skills-token-ratchet	✓ check-skills-token-ratchet: 36 authored bundle file(s) within their ceilings; 11 generator-owned file(s) measured, not ratcheted.
check-test-completeness	NOT MEASURED, in the gate's own words — see below
check:doc-formula-expressions	✓ check:doc-formula-expressions (spec TSDoc, #6763): 9 @example(s) judged clean across 1137 packages/spec/src files — rls-predicate=8, hook-record-condition=1, record-formula=0; 0 exempt.
check:skill-docs	✅ Skill docs in sync
check:agent-test-spelling	✓ check-agent-test-spelling: 0 violations — 432 file(s) · 5850 bare \--` token(s) · 1390 launcher-rooted run(s) · 9 separator(s) JUDGED · 5 vitest-backed script name(s) derived from 81 manifest(s)`
check:corpus-claim-drift	check-corpus-claim-drift: OK, no new claim sites beside a pinned spelling.
check:cross-package-test-inputs (pnpm)	All 117 self-test cases passed. / OK: 25 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob.
check:doc-authoring	✓ doc authoring guard: 46 published skill files clean — no internal issue-id references.
check:nul-bytes	check-nul-bytes: OK (scanned 8173 text file(s) -- 8173 tracked, 0 untracked-not-ignored; skipped 7 binary; no raw ASCII control bytes).
check:pm-governed-merges	✓ check-governed-merges --self-test: 245 assertions (…) / live: the real generator declared 9 output(s) and certified this tree — the enumeration in the middle is elided here for length only
check:refd-timer-probe	OK check-refd-timer-probe: 5828 source file(s) swept; the process-global timer probe is read in packages/qa/refd-timer-testkit/src/index.ts and nowhere else.
check:role-word	check-role-word: OK, no new occurrences of the reserved word.
check:skill-compatibility	✓ check-skill-compatibility-version: 11 SKILL.md file(s) reconciled against 79 workspace packages
check:skill-frame-sync	✓ check-skill-frame-sync: 2 copies of the decision frame are structurally isomorphic across 2 files
check:skill-identifier-liveness	check-skill-identifier-liveness OK — Leg 1: 465 citation(s) over 46 published file(s) checked against 94464 implementation word tokens (3 ledgered exemption(s)); Leg 2: 8 registered exhaustive section(s), 0 ledgered gap(s).
check:watch-hint-literal	✓ check-watch-hint-literal: 48 declaration(s) across 4 rostered name(s) … no unrostered spelling of the idiom in the tree.

20 green, 1 NOT MEASURED.check-test-completeness exited 3, which is that gate's prerequisite code, not a finding's 1. Its own text:

check-test-completeness: PREREQUISITE NOT MET — this gate grades a saved `turbo run test` log, and no log was named.
⚠ Arrived here from the gate family `scripts/pm/dispatch-gates.mjs` derives?
That list names this script with NO argument, which is this branch. There is no
local log to hand it, so the local reading for this gate is NOT MEASURED.
⛔ It is not a red, and there is nothing here to fix.

check:doc-formula-expressions first exited 3 the same way (PREREQUISITE NOT MET — the workspace package @objectstack/formula is not built, then the same for @objectstack/lint). That one was fixable locally: pnpm exec turbo run build --filter=@objectstack/formula and --filter=@objectstack/lint, after which it was re-run and produced the real green quoted above. It is reported as measured; check-test-completeness is not, because nothing local can produce the log it grades.

Heavy runs went through scripts/pm/os-verify-lock.sh (slot issue-15011): the 21-gate sweep held the lock 75s, waited 0s.

Scope and landing

Governed surface (skills/**) — opened as a draft, no reviewers requested, auto-merge not armed, ready not flipped; the dispatching seat reviews in-seat and requests the approvers, and the landing is the maintainer's.

skip-changeset: this diff publishes nothing from any package — it changes one Markdown file inside the published skills catalog, which ships as documentation rather than as a released package artifact. Same reading the recent skills PRs on this path used.

---

Generated by Claude Code

[claude]

Fixes#15011

The rule-type table under "Available Rule Types" in skills/objectstack-data/rules/validation.md said what each type is for and when it fails, but never which record the predicate is evaluated on — and the answer is not uniform across the six. An author who reads "use a script rule for an invariant" and reasonably generalises it to "validations[] holds invariants" reaches for format to enforce a stored-data invariant and gets a write gate instead: no error, no signal, and legacy rows never checked.

One column added, Judged against, one short cell per row. Table only — no new prose section, no new heading, no example block, no change to the tool-choice paragraph at the head of Script Validation (merged at c454640a), no second file. Net 0 lines; the column is added to the eight existing table lines.

Before

| Type | Purpose | When Validation Fails |
|:-----|:--------|:---------------------|
| `script` | CEL predicate over the record | When predicate evaluates to `true` |
| `state_machine` | Legal state transitions | When transition not allowed |
| `format` | Regex or built-in format | When format doesn't match |
| `cross_field` | CEL predicate comparing fields | When predicate evaluates to `true` |
| `json_schema` | Validate JSON field | When JSON doesn't match schema |
| `conditional` | Apply nested rule when a predicate holds | When nested rule fails |

After

| Type | Purpose | When Validation Fails | Judged against |
|:-----|:--------|:---------------------|:---------------|
| `script` | CEL predicate over the record | When predicate evaluates to `true` | Merged record — prior row plus this write |
| `state_machine` | Legal state transitions | When transition not allowed | Written value vs the prior row's, only when the write sets the field (insert: `initialStates`) |
| `format` | Regex or built-in format | When format doesn't match | Write payload only — an omitted field is never judged |
| `cross_field` | CEL predicate comparing fields | When predicate evaluates to `true` | Merged record — prior row plus this write |
| `json_schema` | Validate JSON field | When JSON doesn't match schema | Write payload only — an omitted field is never judged |
| `conditional` | Apply nested rule when a predicate holds | When nested rule fails | Its `when` on the merged record; the nested rule as its own type |

Engine evidence, per row

Every cell is measured on this branch from packages/objectql/src/validation/rule-validator.ts, not copied from the card. The context the dispatch hands out is built at :2000-2012:

const previous = mode === 'update' && priorRecord ? materializeDeclaredFields({ ...priorRecord }, fields) : priorRecord;
const merged = { ...(previous ?? {}), ...data }; // type annotation elided: see the note below
if (groundTruth) materializeDeclaredFields(merged, fields);
const ctx: RuleContext = { data, merged, previous, mode, ... };

The one type annotation elided above is the plain record-map type; it is dropped only because a tag-shaped fragment does not survive this platform's body sanitizer. RuleContext's own docblock (:271-275) states the split independently: "data is the raw incoming write (a PATCH on update); merged overlays it on the prior record … Field-scoped rules (state_machine, format, json_schema) key off data to decide whether the write actually touched their field."

evaluateRule's switch is at :2177-2191:

Row	Dispatch, evaluateRule	Checker	Record handed to it
script	checkPredicate(rule, ctx.merged, ctx.previous, …)	checkPredicate:2332	ctx.merged — the prior row overlaid with the write. Bound as CEL record, with previous alongside.
cross_field	same case as script, same call	checkPredicate:2332	ctx.merged, identically
format	checkFormat(rule, ctx.data, …)	checkFormat:2384	ctx.data — opens if (!(rule.field in data)) return null, then reads data[rule.field], so an omitted field is not judged
json_schema	checkJsonSchema(rule, ctx.data, …)	checkJsonSchema:2451	ctx.data — same field in data guard, then data[rule.field]
state_machine	checkStateMachine(rule, ctx.mode, ctx.data, ctx.previous, ctx)	checkStateMachine:2209	update leg: same field in data guard, then from = previous[rule.field], to = data[rule.field]. Insert leg: data[rule.field] against rule.initialStates, no prior row.
conditional	checkConditional(rule, ctx)	checkConditional:2499	its when on ctx.merged (record: ctx.merged, previous: ctx.previous), then evaluateRule(branch, ctx) re-dispatches the nested rule through the same switch with the same ctx — so a nested format still reads the payload

All six agree with the reading the card predicted; no row had to be written against it.

Six rows is still the complete set.ValidationRuleSchema (packages/spec/src/data/validation.zod.ts:351-359) is a discriminatedUnion over exactly ScriptValidationSchema, StateMachineValidationSchema, FormatValidationSchema, CrossFieldValidationSchema, JSONValidationSchema, ConditionalValidationSchema — the six z.literal types at :179, :194, :211, :293, :314, :545. No seventh type, so the "There is no other type" sentence under the table stands untouched.

Ratchet and size readings

Both readings the published-skills contract asks for, lines and tokens (ceil(utf8 bytes / 4), the ratchet's own unit):

Reading	Before	After	Delta
Whole filerules/validation.md — lines	342	342	0
Whole filerules/validation.md — tokens	2499	2601	+102
Whole packageskills/**, all 46 .md — lines	13599	13599	0
Whole packageskills/**, all 46 .md — tokens	152000	152102	+102
Whole package, the 11 SKILL.md alone — lines / tokens	6835 / 79239	6835 / 79239	0 / 0

The SKILL.md sum is unmoved because the edited file is a rules/ file, not a SKILL.md; the all-.md row is the reading that actually moves and is reported beside it rather than instead of it.

Ceiling untouched. The gate's own line, after the change:

✓ check-skills-token-ratchet: skills/objectstack-data/rules/validation.md is 2601 tokens (ceiling 3109; headroom 508).
✓ check-skills-token-ratchet: 36 authored bundle file(s) within their ceilings; 11 generator-owned file(s) measured, not ratcheted.

+102 of the 610 tokens of headroom, leaving 508. No ceiling edited, no lines bought — so nothing is owed to the "delete content to pay the ratchet" rule.

The sibling line ratchet was run to confirm it does not cover this path, and it does not — its population is .claude/** plus the two repo-root instruction files:

✓ check-skill-line-ratchet: AGENTS.md is 1157 lines (ceiling 1162; headroom 5).
✓ check-skill-line-ratchet: declared cross-file moves: 1, total ceilings down 1 line.

Gates

Family re-derived after the commit from the real changeset — node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack — which named 20 families for this path; the dispatch list named those 20 plus check:skill-docs. The union of 21 was run. Verification run head: 09802409, tree clean, diff exactly one file (8 insertions, 8 deletions).

Each exit code was captured before any pipe; each line below is the gate's own verdict text.

Gate	Verdict line
check-ci-filter-parity	OK: all 135 declared cross-package glob(s) (95 unique) are covered by \core` or `crosspkg`, every `crosspkg` entry still covers one, and the `test` job's `if:` still names both filters.`
check-closing-keyword-parity	check-closing-keyword-parity: OK (3 parsers agree on all 9 keywords and both measured separators; sweep found 5 file(s) carrying the grammar across 8180 tracked file(s), all registered).
check-comment-mask-corpus	✓ comment-mask corpus sweep [scripts/js-comment-mask.mjs]: 5833 files, 0 disagree, 0 unparseable, 42.4s (comparator self-test: 12 cases pass).
check-cross-package-test-inputs (node)	OK: 25 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob.
check-shard-attestation	✓ check-shard-attestation: 2 aggregate gate(s) count 3 declared leg(s) across 3 attesting job(s).
check-skills-token-ratchet	✓ check-skills-token-ratchet: 36 authored bundle file(s) within their ceilings; 11 generator-owned file(s) measured, not ratcheted.
check-test-completeness	NOT MEASURED, in the gate's own words — see below
check:doc-formula-expressions	✓ check:doc-formula-expressions (spec TSDoc, #6763): 9 @example(s) judged clean across 1137 packages/spec/src files — rls-predicate=8, hook-record-condition=1, record-formula=0; 0 exempt.
check:skill-docs	✅ Skill docs in sync
check:agent-test-spelling	✓ check-agent-test-spelling: 0 violations — 432 file(s) · 5850 bare \--` token(s) · 1390 launcher-rooted run(s) · 9 separator(s) JUDGED · 5 vitest-backed script name(s) derived from 81 manifest(s)`
check:corpus-claim-drift	check-corpus-claim-drift: OK, no new claim sites beside a pinned spelling.
check:cross-package-test-inputs (pnpm)	All 117 self-test cases passed. / OK: 25 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob.
check:doc-authoring	✓ doc authoring guard: 46 published skill files clean — no internal issue-id references.
check:nul-bytes	check-nul-bytes: OK (scanned 8173 text file(s) -- 8173 tracked, 0 untracked-not-ignored; skipped 7 binary; no raw ASCII control bytes).
check:pm-governed-merges	✓ check-governed-merges --self-test: 245 assertions (…) / live: the real generator declared 9 output(s) and certified this tree — the enumeration in the middle is elided here for length only
check:refd-timer-probe	OK check-refd-timer-probe: 5828 source file(s) swept; the process-global timer probe is read in packages/qa/refd-timer-testkit/src/index.ts and nowhere else.
check:role-word	check-role-word: OK, no new occurrences of the reserved word.
check:skill-compatibility	✓ check-skill-compatibility-version: 11 SKILL.md file(s) reconciled against 79 workspace packages
check:skill-frame-sync	✓ check-skill-frame-sync: 2 copies of the decision frame are structurally isomorphic across 2 files
check:skill-identifier-liveness	check-skill-identifier-liveness OK — Leg 1: 465 citation(s) over 46 published file(s) checked against 94464 implementation word tokens (3 ledgered exemption(s)); Leg 2: 8 registered exhaustive section(s), 0 ledgered gap(s).
check:watch-hint-literal	✓ check-watch-hint-literal: 48 declaration(s) across 4 rostered name(s) … no unrostered spelling of the idiom in the tree.

20 green, 1 NOT MEASURED.check-test-completeness exited 3, which is that gate's prerequisite code, not a finding's 1. Its own text:

check-test-completeness: PREREQUISITE NOT MET — this gate grades a saved `turbo run test` log, and no log was named.
⚠ Arrived here from the gate family `scripts/pm/dispatch-gates.mjs` derives?
That list names this script with NO argument, which is this branch. There is no
local log to hand it, so the local reading for this gate is NOT MEASURED.
⛔ It is not a red, and there is nothing here to fix.

check:doc-formula-expressions first exited 3 the same way (PREREQUISITE NOT MET — the workspace package @objectstack/formula is not built, then the same for @objectstack/lint). That one was fixable locally: pnpm exec turbo run build --filter=@objectstack/formula and --filter=@objectstack/lint, after which it was re-run and produced the real green quoted above. It is reported as measured; check-test-completeness is not, because nothing local can produce the log it grades.

Heavy runs went through scripts/pm/os-verify-lock.sh (slot issue-15011): the 21-gate sweep held the lock 75s, waited 0s.

Scope and landing

Governed surface (skills/**) — opened as a draft, no reviewers requested, auto-merge not armed, ready not flipped; the dispatching seat reviews in-seat and requests the approvers, and the landing is the maintainer's.

skip-changeset: this diff publishes nothing from any package — it changes one Markdown file inside the published skills catalog, which ships as documentation rather than as a released package artifact. Same reading the recent skills PRs on this path used.

---

Generated by Claude Code

[claude]

Fixes#15011

The rule-type table under "Available Rule Types" in skills/objectstack-data/rules/validation.md said what each type is for and when it fails, but never which record the predicate is evaluated on — and the answer is not uniform across the six. An author who reads "use a script rule for an invariant" and reasonably generalises it to "validations[] holds invariants" reaches for format to enforce a stored-data invariant and gets a write gate instead: no error, no signal, and legacy rows never checked.

One column added, Judged against, one short cell per row. Table only — no new prose section, no new heading, no example block, no change to the tool-choice paragraph at the head of Script Validation (merged at c454640a), no second file. Net 0 lines; the column is added to the eight existing table lines.

Before

| Type | Purpose | When Validation Fails |
|:-----|:--------|:---------------------|
| `script` | CEL predicate over the record | When predicate evaluates to `true` |
| `state_machine` | Legal state transitions | When transition not allowed |
| `format` | Regex or built-in format | When format doesn't match |
| `cross_field` | CEL predicate comparing fields | When predicate evaluates to `true` |
| `json_schema` | Validate JSON field | When JSON doesn't match schema |
| `conditional` | Apply nested rule when a predicate holds | When nested rule fails |

After

| Type | Purpose | When Validation Fails | Judged against |
|:-----|:--------|:---------------------|:---------------|
| `script` | CEL predicate over the record | When predicate evaluates to `true` | Merged record — prior row plus this write |
| `state_machine` | Legal state transitions | When transition not allowed | Written value vs the prior row's, only when the write sets the field (insert: `initialStates`) |
| `format` | Regex or built-in format | When format doesn't match | Write payload only — an omitted field is never judged |
| `cross_field` | CEL predicate comparing fields | When predicate evaluates to `true` | Merged record — prior row plus this write |
| `json_schema` | Validate JSON field | When JSON doesn't match schema | Write payload only — an omitted field is never judged |
| `conditional` | Apply nested rule when a predicate holds | When nested rule fails | Its `when` on the merged record; the nested rule as its own type |

Engine evidence, per row

Every cell is measured on this branch from packages/objectql/src/validation/rule-validator.ts, not copied from the card. The context the dispatch hands out is built at :2000-2012:

const previous = mode === 'update' && priorRecord ? materializeDeclaredFields({ ...priorRecord }, fields) : priorRecord;
const merged = { ...(previous ?? {}), ...data }; // type annotation elided: see the note below
if (groundTruth) materializeDeclaredFields(merged, fields);
const ctx: RuleContext = { data, merged, previous, mode, ... };

The one type annotation elided above is the plain record-map type; it is dropped only because a tag-shaped fragment does not survive this platform's body sanitizer. RuleContext's own docblock (:271-275) states the split independently: "data is the raw incoming write (a PATCH on update); merged overlays it on the prior record … Field-scoped rules (state_machine, format, json_schema) key off data to decide whether the write actually touched their field."

evaluateRule's switch is at :2177-2191:

Row	Dispatch, evaluateRule	Checker	Record handed to it
script	checkPredicate(rule, ctx.merged, ctx.previous, …)	checkPredicate:2332	ctx.merged — the prior row overlaid with the write. Bound as CEL record, with previous alongside.
cross_field	same case as script, same call	checkPredicate:2332	ctx.merged, identically
format	checkFormat(rule, ctx.data, …)	checkFormat:2384	ctx.data — opens if (!(rule.field in data)) return null, then reads data[rule.field], so an omitted field is not judged
json_schema	checkJsonSchema(rule, ctx.data, …)	checkJsonSchema:2451	ctx.data — same field in data guard, then data[rule.field]
state_machine	checkStateMachine(rule, ctx.mode, ctx.data, ctx.previous, ctx)	checkStateMachine:2209	update leg: same field in data guard, then from = previous[rule.field], to = data[rule.field]. Insert leg: data[rule.field] against rule.initialStates, no prior row.
conditional	checkConditional(rule, ctx)	checkConditional:2499	its when on ctx.merged (record: ctx.merged, previous: ctx.previous), then evaluateRule(branch, ctx) re-dispatches the nested rule through the same switch with the same ctx — so a nested format still reads the payload

All six agree with the reading the card predicted; no row had to be written against it.

Six rows is still the complete set.ValidationRuleSchema (packages/spec/src/data/validation.zod.ts:351-359) is a discriminatedUnion over exactly ScriptValidationSchema, StateMachineValidationSchema, FormatValidationSchema, CrossFieldValidationSchema, JSONValidationSchema, ConditionalValidationSchema — the six z.literal types at :179, :194, :211, :293, :314, :545. No seventh type, so the "There is no other type" sentence under the table stands untouched.

Ratchet and size readings

Both readings the published-skills contract asks for, lines and tokens (ceil(utf8 bytes / 4), the ratchet's own unit):

Reading	Before	After	Delta
Whole filerules/validation.md — lines	342	342	0
Whole filerules/validation.md — tokens	2499	2601	+102
Whole packageskills/**, all 46 .md — lines	13599	13599	0
Whole packageskills/**, all 46 .md — tokens	152000	152102	+102
Whole package, the 11 SKILL.md alone — lines / tokens	6835 / 79239	6835 / 79239	0 / 0

The SKILL.md sum is unmoved because the edited file is a rules/ file, not a SKILL.md; the all-.md row is the reading that actually moves and is reported beside it rather than instead of it.

Ceiling untouched. The gate's own line, after the change:

✓ check-skills-token-ratchet: skills/objectstack-data/rules/validation.md is 2601 tokens (ceiling 3109; headroom 508).
✓ check-skills-token-ratchet: 36 authored bundle file(s) within their ceilings; 11 generator-owned file(s) measured, not ratcheted.

+102 of the 610 tokens of headroom, leaving 508. No ceiling edited, no lines bought — so nothing is owed to the "delete content to pay the ratchet" rule.

The sibling line ratchet was run to confirm it does not cover this path, and it does not — its population is .claude/** plus the two repo-root instruction files:

✓ check-skill-line-ratchet: AGENTS.md is 1157 lines (ceiling 1162; headroom 5).
✓ check-skill-line-ratchet: declared cross-file moves: 1, total ceilings down 1 line.

Gates

Family re-derived after the commit from the real changeset — node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack — which named 20 families for this path; the dispatch list named those 20 plus check:skill-docs. The union of 21 was run. Verification run head: 09802409, tree clean, diff exactly one file (8 insertions, 8 deletions).

Each exit code was captured before any pipe; each line below is the gate's own verdict text.

Gate	Verdict line
check-ci-filter-parity	OK: all 135 declared cross-package glob(s) (95 unique) are covered by \core` or `crosspkg`, every `crosspkg` entry still covers one, and the `test` job's `if:` still names both filters.`
check-closing-keyword-parity	check-closing-keyword-parity: OK (3 parsers agree on all 9 keywords and both measured separators; sweep found 5 file(s) carrying the grammar across 8180 tracked file(s), all registered).
check-comment-mask-corpus	✓ comment-mask corpus sweep [scripts/js-comment-mask.mjs]: 5833 files, 0 disagree, 0 unparseable, 42.4s (comparator self-test: 12 cases pass).
check-cross-package-test-inputs (node)	OK: 25 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob.
check-shard-attestation	✓ check-shard-attestation: 2 aggregate gate(s) count 3 declared leg(s) across 3 attesting job(s).
check-skills-token-ratchet	✓ check-skills-token-ratchet: 36 authored bundle file(s) within their ceilings; 11 generator-owned file(s) measured, not ratcheted.
check-test-completeness	NOT MEASURED, in the gate's own words — see below
check:doc-formula-expressions	✓ check:doc-formula-expressions (spec TSDoc, #6763): 9 @example(s) judged clean across 1137 packages/spec/src files — rls-predicate=8, hook-record-condition=1, record-formula=0; 0 exempt.
check:skill-docs	✅ Skill docs in sync
check:agent-test-spelling	✓ check-agent-test-spelling: 0 violations — 432 file(s) · 5850 bare \--` token(s) · 1390 launcher-rooted run(s) · 9 separator(s) JUDGED · 5 vitest-backed script name(s) derived from 81 manifest(s)`
check:corpus-claim-drift	check-corpus-claim-drift: OK, no new claim sites beside a pinned spelling.
check:cross-package-test-inputs (pnpm)	All 117 self-test cases passed. / OK: 25 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob.
check:doc-authoring	✓ doc authoring guard: 46 published skill files clean — no internal issue-id references.
check:nul-bytes	check-nul-bytes: OK (scanned 8173 text file(s) -- 8173 tracked, 0 untracked-not-ignored; skipped 7 binary; no raw ASCII control bytes).
check:pm-governed-merges	✓ check-governed-merges --self-test: 245 assertions (…) / live: the real generator declared 9 output(s) and certified this tree — the enumeration in the middle is elided here for length only
check:refd-timer-probe	OK check-refd-timer-probe: 5828 source file(s) swept; the process-global timer probe is read in packages/qa/refd-timer-testkit/src/index.ts and nowhere else.
check:role-word	check-role-word: OK, no new occurrences of the reserved word.
check:skill-compatibility	✓ check-skill-compatibility-version: 11 SKILL.md file(s) reconciled against 79 workspace packages
check:skill-frame-sync	✓ check-skill-frame-sync: 2 copies of the decision frame are structurally isomorphic across 2 files
check:skill-identifier-liveness	check-skill-identifier-liveness OK — Leg 1: 465 citation(s) over 46 published file(s) checked against 94464 implementation word tokens (3 ledgered exemption(s)); Leg 2: 8 registered exhaustive section(s), 0 ledgered gap(s).
check:watch-hint-literal	✓ check-watch-hint-literal: 48 declaration(s) across 4 rostered name(s) … no unrostered spelling of the idiom in the tree.

20 green, 1 NOT MEASURED.check-test-completeness exited 3, which is that gate's prerequisite code, not a finding's 1. Its own text:

check-test-completeness: PREREQUISITE NOT MET — this gate grades a saved `turbo run test` log, and no log was named.
⚠ Arrived here from the gate family `scripts/pm/dispatch-gates.mjs` derives?
That list names this script with NO argument, which is this branch. There is no
local log to hand it, so the local reading for this gate is NOT MEASURED.
⛔ It is not a red, and there is nothing here to fix.

check:doc-formula-expressions first exited 3 the same way (PREREQUISITE NOT MET — the workspace package @objectstack/formula is not built, then the same for @objectstack/lint). That one was fixable locally: pnpm exec turbo run build --filter=@objectstack/formula and --filter=@objectstack/lint, after which it was re-run and produced the real green quoted above. It is reported as measured; check-test-completeness is not, because nothing local can produce the log it grades.

Heavy runs went through scripts/pm/os-verify-lock.sh (slot issue-15011): the 21-gate sweep held the lock 75s, waited 0s.

Scope and landing

Governed surface (skills/**) — opened as a draft, no reviewers requested, auto-merge not armed, ready not flipped; the dispatching seat reviews in-seat and requests the approvers, and the landing is the maintainer's.

skip-changeset: this diff publishes nothing from any package — it changes one Markdown file inside the published skills catalog, which ships as documentation rather than as a released package artifact. Same reading the recent skills PRs on this path used.

---

Generated by Claude Code

[claude]

Fixes#15011

The rule-type table under "Available Rule Types" in skills/objectstack-data/rules/validation.md said what each type is for and when it fails, but never which record the predicate is evaluated on — and the answer is not uniform across the six. An author who reads "use a script rule for an invariant" and reasonably generalises it to "validations[] holds invariants" reaches for format to enforce a stored-data invariant and gets a write gate instead: no error, no signal, and legacy rows never checked.

One column added, Judged against, one short cell per row. Table only — no new prose section, no new heading, no example block, no change to the tool-choice paragraph at the head of Script Validation (merged at c454640a), no second file. Net 0 lines; the column is added to the eight existing table lines.

Before

| Type | Purpose | When Validation Fails |
|:-----|:--------|:---------------------|
| `script` | CEL predicate over the record | When predicate evaluates to `true` |
| `state_machine` | Legal state transitions | When transition not allowed |
| `format` | Regex or built-in format | When format doesn't match |
| `cross_field` | CEL predicate comparing fields | When predicate evaluates to `true` |
| `json_schema` | Validate JSON field | When JSON doesn't match schema |
| `conditional` | Apply nested rule when a predicate holds | When nested rule fails |

After

| Type | Purpose | When Validation Fails | Judged against |
|:-----|:--------|:---------------------|:---------------|
| `script` | CEL predicate over the record | When predicate evaluates to `true` | Merged record — prior row plus this write |
| `state_machine` | Legal state transitions | When transition not allowed | Written value vs the prior row's, only when the write sets the field (insert: `initialStates`) |
| `format` | Regex or built-in format | When format doesn't match | Write payload only — an omitted field is never judged |
| `cross_field` | CEL predicate comparing fields | When predicate evaluates to `true` | Merged record — prior row plus this write |
| `json_schema` | Validate JSON field | When JSON doesn't match schema | Write payload only — an omitted field is never judged |
| `conditional` | Apply nested rule when a predicate holds | When nested rule fails | Its `when` on the merged record; the nested rule as its own type |

Engine evidence, per row

Every cell is measured on this branch from packages/objectql/src/validation/rule-validator.ts, not copied from the card. The context the dispatch hands out is built at :2000-2012:

const previous = mode === 'update' && priorRecord ? materializeDeclaredFields({ ...priorRecord }, fields) : priorRecord;
const merged = { ...(previous ?? {}), ...data }; // type annotation elided: see the note below
if (groundTruth) materializeDeclaredFields(merged, fields);
const ctx: RuleContext = { data, merged, previous, mode, ... };

The one type annotation elided above is the plain record-map type; it is dropped only because a tag-shaped fragment does not survive this platform's body sanitizer. RuleContext's own docblock (:271-275) states the split independently: "data is the raw incoming write (a PATCH on update); merged overlays it on the prior record … Field-scoped rules (state_machine, format, json_schema) key off data to decide whether the write actually touched their field."

evaluateRule's switch is at :2177-2191:

Row	Dispatch, evaluateRule	Checker	Record handed to it
script	checkPredicate(rule, ctx.merged, ctx.previous, …)	checkPredicate:2332	ctx.merged — the prior row overlaid with the write. Bound as CEL record, with previous alongside.
cross_field	same case as script, same call	checkPredicate:2332	ctx.merged, identically
format	checkFormat(rule, ctx.data, …)	checkFormat:2384	ctx.data — opens if (!(rule.field in data)) return null, then reads data[rule.field], so an omitted field is not judged
json_schema	checkJsonSchema(rule, ctx.data, …)	checkJsonSchema:2451	ctx.data — same field in data guard, then data[rule.field]
state_machine	checkStateMachine(rule, ctx.mode, ctx.data, ctx.previous, ctx)	checkStateMachine:2209	update leg: same field in data guard, then from = previous[rule.field], to = data[rule.field]. Insert leg: data[rule.field] against rule.initialStates, no prior row.
conditional	checkConditional(rule, ctx)	checkConditional:2499	its when on ctx.merged (record: ctx.merged, previous: ctx.previous), then evaluateRule(branch, ctx) re-dispatches the nested rule through the same switch with the same ctx — so a nested format still reads the payload

All six agree with the reading the card predicted; no row had to be written against it.

Six rows is still the complete set.ValidationRuleSchema (packages/spec/src/data/validation.zod.ts:351-359) is a discriminatedUnion over exactly ScriptValidationSchema, StateMachineValidationSchema, FormatValidationSchema, CrossFieldValidationSchema, JSONValidationSchema, ConditionalValidationSchema — the six z.literal types at :179, :194, :211, :293, :314, :545. No seventh type, so the "There is no other type" sentence under the table stands untouched.

Ratchet and size readings

Both readings the published-skills contract asks for, lines and tokens (ceil(utf8 bytes / 4), the ratchet's own unit):

Reading	Before	After	Delta
Whole filerules/validation.md — lines	342	342	0
Whole filerules/validation.md — tokens	2499	2601	+102
Whole packageskills/**, all 46 .md — lines	13599	13599	0
Whole packageskills/**, all 46 .md — tokens	152000	152102	+102
Whole package, the 11 SKILL.md alone — lines / tokens	6835 / 79239	6835 / 79239	0 / 0

The SKILL.md sum is unmoved because the edited file is a rules/ file, not a SKILL.md; the all-.md row is the reading that actually moves and is reported beside it rather than instead of it.

Ceiling untouched. The gate's own line, after the change:

✓ check-skills-token-ratchet: skills/objectstack-data/rules/validation.md is 2601 tokens (ceiling 3109; headroom 508).
✓ check-skills-token-ratchet: 36 authored bundle file(s) within their ceilings; 11 generator-owned file(s) measured, not ratcheted.

+102 of the 610 tokens of headroom, leaving 508. No ceiling edited, no lines bought — so nothing is owed to the "delete content to pay the ratchet" rule.

The sibling line ratchet was run to confirm it does not cover this path, and it does not — its population is .claude/** plus the two repo-root instruction files:

✓ check-skill-line-ratchet: AGENTS.md is 1157 lines (ceiling 1162; headroom 5).
✓ check-skill-line-ratchet: declared cross-file moves: 1, total ceilings down 1 line.

Gates

Family re-derived after the commit from the real changeset — node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack — which named 20 families for this path; the dispatch list named those 20 plus check:skill-docs. The union of 21 was run. Verification run head: 09802409, tree clean, diff exactly one file (8 insertions, 8 deletions).

Each exit code was captured before any pipe; each line below is the gate's own verdict text.

Gate	Verdict line
check-ci-filter-parity	OK: all 135 declared cross-package glob(s) (95 unique) are covered by \core` or `crosspkg`, every `crosspkg` entry still covers one, and the `test` job's `if:` still names both filters.`
check-closing-keyword-parity	check-closing-keyword-parity: OK (3 parsers agree on all 9 keywords and both measured separators; sweep found 5 file(s) carrying the grammar across 8180 tracked file(s), all registered).
check-comment-mask-corpus	✓ comment-mask corpus sweep [scripts/js-comment-mask.mjs]: 5833 files, 0 disagree, 0 unparseable, 42.4s (comparator self-test: 12 cases pass).
check-cross-package-test-inputs (node)	OK: 25 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob.
check-shard-attestation	✓ check-shard-attestation: 2 aggregate gate(s) count 3 declared leg(s) across 3 attesting job(s).
check-skills-token-ratchet	✓ check-skills-token-ratchet: 36 authored bundle file(s) within their ceilings; 11 generator-owned file(s) measured, not ratcheted.
check-test-completeness	NOT MEASURED, in the gate's own words — see below
check:doc-formula-expressions	✓ check:doc-formula-expressions (spec TSDoc, #6763): 9 @example(s) judged clean across 1137 packages/spec/src files — rls-predicate=8, hook-record-condition=1, record-formula=0; 0 exempt.
check:skill-docs	✅ Skill docs in sync
check:agent-test-spelling	✓ check-agent-test-spelling: 0 violations — 432 file(s) · 5850 bare \--` token(s) · 1390 launcher-rooted run(s) · 9 separator(s) JUDGED · 5 vitest-backed script name(s) derived from 81 manifest(s)`
check:corpus-claim-drift	check-corpus-claim-drift: OK, no new claim sites beside a pinned spelling.
check:cross-package-test-inputs (pnpm)	All 117 self-test cases passed. / OK: 25 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob.
check:doc-authoring	✓ doc authoring guard: 46 published skill files clean — no internal issue-id references.
check:nul-bytes	check-nul-bytes: OK (scanned 8173 text file(s) -- 8173 tracked, 0 untracked-not-ignored; skipped 7 binary; no raw ASCII control bytes).
check:pm-governed-merges	✓ check-governed-merges --self-test: 245 assertions (…) / live: the real generator declared 9 output(s) and certified this tree — the enumeration in the middle is elided here for length only
check:refd-timer-probe	OK check-refd-timer-probe: 5828 source file(s) swept; the process-global timer probe is read in packages/qa/refd-timer-testkit/src/index.ts and nowhere else.
check:role-word	check-role-word: OK, no new occurrences of the reserved word.
check:skill-compatibility	✓ check-skill-compatibility-version: 11 SKILL.md file(s) reconciled against 79 workspace packages
check:skill-frame-sync	✓ check-skill-frame-sync: 2 copies of the decision frame are structurally isomorphic across 2 files
check:skill-identifier-liveness	check-skill-identifier-liveness OK — Leg 1: 465 citation(s) over 46 published file(s) checked against 94464 implementation word tokens (3 ledgered exemption(s)); Leg 2: 8 registered exhaustive section(s), 0 ledgered gap(s).
check:watch-hint-literal	✓ check-watch-hint-literal: 48 declaration(s) across 4 rostered name(s) … no unrostered spelling of the idiom in the tree.

20 green, 1 NOT MEASURED.check-test-completeness exited 3, which is that gate's prerequisite code, not a finding's 1. Its own text:

check-test-completeness: PREREQUISITE NOT MET — this gate grades a saved `turbo run test` log, and no log was named.
⚠ Arrived here from the gate family `scripts/pm/dispatch-gates.mjs` derives?
That list names this script with NO argument, which is this branch. There is no
local log to hand it, so the local reading for this gate is NOT MEASURED.
⛔ It is not a red, and there is nothing here to fix.

check:doc-formula-expressions first exited 3 the same way (PREREQUISITE NOT MET — the workspace package @objectstack/formula is not built, then the same for @objectstack/lint). That one was fixable locally: pnpm exec turbo run build --filter=@objectstack/formula and --filter=@objectstack/lint, after which it was re-run and produced the real green quoted above. It is reported as measured; check-test-completeness is not, because nothing local can produce the log it grades.

Heavy runs went through scripts/pm/os-verify-lock.sh (slot issue-15011): the 21-gate sweep held the lock 75s, waited 0s.

Scope and landing

Governed surface (skills/**) — opened as a draft, no reviewers requested, auto-merge not armed, ready not flipped; the dispatching seat reviews in-seat and requests the approvers, and the landing is the maintainer's.

skip-changeset: this diff publishes nothing from any package — it changes one Markdown file inside the published skills catalog, which ships as documentation rather than as a released package artifact. Same reading the recent skills PRs on this path used.

---

Generated by Claude Code

[claude]

Fixes#15011

The rule-type table under "Available Rule Types" in skills/objectstack-data/rules/validation.md said what each type is for and when it fails, but never which record the predicate is evaluated on — and the answer is not uniform across the six. An author who reads "use a script rule for an invariant" and reasonably generalises it to "validations[] holds invariants" reaches for format to enforce a stored-data invariant and gets a write gate instead: no error, no signal, and legacy rows never checked.

One column added, Judged against, one short cell per row. Table only — no new prose section, no new heading, no example block, no change to the tool-choice paragraph at the head of Script Validation (merged at c454640a), no second file. Net 0 lines; the column is added to the eight existing table lines.

Before

| Type | Purpose | When Validation Fails |
|:-----|:--------|:---------------------|
| `script` | CEL predicate over the record | When predicate evaluates to `true` |
| `state_machine` | Legal state transitions | When transition not allowed |
| `format` | Regex or built-in format | When format doesn't match |
| `cross_field` | CEL predicate comparing fields | When predicate evaluates to `true` |
| `json_schema` | Validate JSON field | When JSON doesn't match schema |
| `conditional` | Apply nested rule when a predicate holds | When nested rule fails |

After

| Type | Purpose | When Validation Fails | Judged against |
|:-----|:--------|:---------------------|:---------------|
| `script` | CEL predicate over the record | When predicate evaluates to `true` | Merged record — prior row plus this write |
| `state_machine` | Legal state transitions | When transition not allowed | Written value vs the prior row's, only when the write sets the field (insert: `initialStates`) |
| `format` | Regex or built-in format | When format doesn't match | Write payload only — an omitted field is never judged |
| `cross_field` | CEL predicate comparing fields | When predicate evaluates to `true` | Merged record — prior row plus this write |
| `json_schema` | Validate JSON field | When JSON doesn't match schema | Write payload only — an omitted field is never judged |
| `conditional` | Apply nested rule when a predicate holds | When nested rule fails | Its `when` on the merged record; the nested rule as its own type |

Engine evidence, per row

Every cell is measured on this branch from packages/objectql/src/validation/rule-validator.ts, not copied from the card. The context the dispatch hands out is built at :2000-2012:

const previous = mode === 'update' && priorRecord ? materializeDeclaredFields({ ...priorRecord }, fields) : priorRecord;
const merged = { ...(previous ?? {}), ...data }; // type annotation elided: see the note below
if (groundTruth) materializeDeclaredFields(merged, fields);
const ctx: RuleContext = { data, merged, previous, mode, ... };

The one type annotation elided above is the plain record-map type; it is dropped only because a tag-shaped fragment does not survive this platform's body sanitizer. RuleContext's own docblock (:271-275) states the split independently: "data is the raw incoming write (a PATCH on update); merged overlays it on the prior record … Field-scoped rules (state_machine, format, json_schema) key off data to decide whether the write actually touched their field."

evaluateRule's switch is at :2177-2191:

Row	Dispatch, evaluateRule	Checker	Record handed to it
script	checkPredicate(rule, ctx.merged, ctx.previous, …)	checkPredicate:2332	ctx.merged — the prior row overlaid with the write. Bound as CEL record, with previous alongside.
cross_field	same case as script, same call	checkPredicate:2332	ctx.merged, identically
format	checkFormat(rule, ctx.data, …)	checkFormat:2384	ctx.data — opens if (!(rule.field in data)) return null, then reads data[rule.field], so an omitted field is not judged
json_schema	checkJsonSchema(rule, ctx.data, …)	checkJsonSchema:2451	ctx.data — same field in data guard, then data[rule.field]
state_machine	checkStateMachine(rule, ctx.mode, ctx.data, ctx.previous, ctx)	checkStateMachine:2209	update leg: same field in data guard, then from = previous[rule.field], to = data[rule.field]. Insert leg: data[rule.field] against rule.initialStates, no prior row.
conditional	checkConditional(rule, ctx)	checkConditional:2499	its when on ctx.merged (record: ctx.merged, previous: ctx.previous), then evaluateRule(branch, ctx) re-dispatches the nested rule through the same switch with the same ctx — so a nested format still reads the payload

All six agree with the reading the card predicted; no row had to be written against it.

Six rows is still the complete set.ValidationRuleSchema (packages/spec/src/data/validation.zod.ts:351-359) is a discriminatedUnion over exactly ScriptValidationSchema, StateMachineValidationSchema, FormatValidationSchema, CrossFieldValidationSchema, JSONValidationSchema, ConditionalValidationSchema — the six z.literal types at :179, :194, :211, :293, :314, :545. No seventh type, so the "There is no other type" sentence under the table stands untouched.

Ratchet and size readings

Both readings the published-skills contract asks for, lines and tokens (ceil(utf8 bytes / 4), the ratchet's own unit):

Reading	Before	After	Delta
Whole filerules/validation.md — lines	342	342	0
Whole filerules/validation.md — tokens	2499	2601	+102
Whole packageskills/**, all 46 .md — lines	13599	13599	0
Whole packageskills/**, all 46 .md — tokens	152000	152102	+102
Whole package, the 11 SKILL.md alone — lines / tokens	6835 / 79239	6835 / 79239	0 / 0

The SKILL.md sum is unmoved because the edited file is a rules/ file, not a SKILL.md; the all-.md row is the reading that actually moves and is reported beside it rather than instead of it.

Ceiling untouched. The gate's own line, after the change:

✓ check-skills-token-ratchet: skills/objectstack-data/rules/validation.md is 2601 tokens (ceiling 3109; headroom 508).
✓ check-skills-token-ratchet: 36 authored bundle file(s) within their ceilings; 11 generator-owned file(s) measured, not ratcheted.

+102 of the 610 tokens of headroom, leaving 508. No ceiling edited, no lines bought — so nothing is owed to the "delete content to pay the ratchet" rule.

The sibling line ratchet was run to confirm it does not cover this path, and it does not — its population is .claude/** plus the two repo-root instruction files:

✓ check-skill-line-ratchet: AGENTS.md is 1157 lines (ceiling 1162; headroom 5).
✓ check-skill-line-ratchet: declared cross-file moves: 1, total ceilings down 1 line.

Gates

Family re-derived after the commit from the real changeset — node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack — which named 20 families for this path; the dispatch list named those 20 plus check:skill-docs. The union of 21 was run. Verification run head: 09802409, tree clean, diff exactly one file (8 insertions, 8 deletions).

Each exit code was captured before any pipe; each line below is the gate's own verdict text.

Gate	Verdict line
check-ci-filter-parity	OK: all 135 declared cross-package glob(s) (95 unique) are covered by \core` or `crosspkg`, every `crosspkg` entry still covers one, and the `test` job's `if:` still names both filters.`
check-closing-keyword-parity	check-closing-keyword-parity: OK (3 parsers agree on all 9 keywords and both measured separators; sweep found 5 file(s) carrying the grammar across 8180 tracked file(s), all registered).
check-comment-mask-corpus	✓ comment-mask corpus sweep [scripts/js-comment-mask.mjs]: 5833 files, 0 disagree, 0 unparseable, 42.4s (comparator self-test: 12 cases pass).
check-cross-package-test-inputs (node)	OK: 25 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob.
check-shard-attestation	✓ check-shard-attestation: 2 aggregate gate(s) count 3 declared leg(s) across 3 attesting job(s).
check-skills-token-ratchet	✓ check-skills-token-ratchet: 36 authored bundle file(s) within their ceilings; 11 generator-owned file(s) measured, not ratcheted.
check-test-completeness	NOT MEASURED, in the gate's own words — see below
check:doc-formula-expressions	✓ check:doc-formula-expressions (spec TSDoc, #6763): 9 @example(s) judged clean across 1137 packages/spec/src files — rls-predicate=8, hook-record-condition=1, record-formula=0; 0 exempt.
check:skill-docs	✅ Skill docs in sync
check:agent-test-spelling	✓ check-agent-test-spelling: 0 violations — 432 file(s) · 5850 bare \--` token(s) · 1390 launcher-rooted run(s) · 9 separator(s) JUDGED · 5 vitest-backed script name(s) derived from 81 manifest(s)`
check:corpus-claim-drift	check-corpus-claim-drift: OK, no new claim sites beside a pinned spelling.
check:cross-package-test-inputs (pnpm)	All 117 self-test cases passed. / OK: 25 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob.
check:doc-authoring	✓ doc authoring guard: 46 published skill files clean — no internal issue-id references.
check:nul-bytes	check-nul-bytes: OK (scanned 8173 text file(s) -- 8173 tracked, 0 untracked-not-ignored; skipped 7 binary; no raw ASCII control bytes).
check:pm-governed-merges	✓ check-governed-merges --self-test: 245 assertions (…) / live: the real generator declared 9 output(s) and certified this tree — the enumeration in the middle is elided here for length only
check:refd-timer-probe	OK check-refd-timer-probe: 5828 source file(s) swept; the process-global timer probe is read in packages/qa/refd-timer-testkit/src/index.ts and nowhere else.
check:role-word	check-role-word: OK, no new occurrences of the reserved word.
check:skill-compatibility	✓ check-skill-compatibility-version: 11 SKILL.md file(s) reconciled against 79 workspace packages
check:skill-frame-sync	✓ check-skill-frame-sync: 2 copies of the decision frame are structurally isomorphic across 2 files
check:skill-identifier-liveness	check-skill-identifier-liveness OK — Leg 1: 465 citation(s) over 46 published file(s) checked against 94464 implementation word tokens (3 ledgered exemption(s)); Leg 2: 8 registered exhaustive section(s), 0 ledgered gap(s).
check:watch-hint-literal	✓ check-watch-hint-literal: 48 declaration(s) across 4 rostered name(s) … no unrostered spelling of the idiom in the tree.

20 green, 1 NOT MEASURED.check-test-completeness exited 3, which is that gate's prerequisite code, not a finding's 1. Its own text:

check-test-completeness: PREREQUISITE NOT MET — this gate grades a saved `turbo run test` log, and no log was named.
⚠ Arrived here from the gate family `scripts/pm/dispatch-gates.mjs` derives?
That list names this script with NO argument, which is this branch. There is no
local log to hand it, so the local reading for this gate is NOT MEASURED.
⛔ It is not a red, and there is nothing here to fix.

check:doc-formula-expressions first exited 3 the same way (PREREQUISITE NOT MET — the workspace package @objectstack/formula is not built, then the same for @objectstack/lint). That one was fixable locally: pnpm exec turbo run build --filter=@objectstack/formula and --filter=@objectstack/lint, after which it was re-run and produced the real green quoted above. It is reported as measured; check-test-completeness is not, because nothing local can produce the log it grades.

Heavy runs went through scripts/pm/os-verify-lock.sh (slot issue-15011): the 21-gate sweep held the lock 75s, waited 0s.

Scope and landing

Governed surface (skills/**) — opened as a draft, no reviewers requested, auto-merge not armed, ready not flipped; the dispatching seat reviews in-seat and requests the approvers, and the landing is the maintainer's.

skip-changeset: this diff publishes nothing from any package — it changes one Markdown file inside the published skills catalog, which ships as documentation rather than as a released package artifact. Same reading the recent skills PRs on this path used.

---

Generated by Claude Code