fix(spec): reconcile SKILL_MAP with the SKILL.md bodies that own each surface, and guard it

[os-justin]

Fixes#14462
Fixes#14466
Fixes#14562
Fixes#14565

One family, one branch, one commit per member. The map that decides what nine published skill indexes point at is reconciled against the bodies that own those surfaces, and the generator gains the guards that keep it reconciled.

skills/** is a governed surface: this PR stays draft for a human merge. It is never flipped ready and no auto-merge is armed.

The rulings this implements, quoted where operative

• Anchor, triage 5506970439: "Ruling: narrow the map, add solution-blueprint. ⛔ Do not widen the body." · "This card carries the census — for each of the [SKILL_MAP] entries, the set difference in both directions against what its SKILL.md teaches — and applies the ruling above uniformly." · "whatever reconciliation lands must make a retired schema in the map impossible, not merely corrected once … If deriving the map from a checkable source is out of reach, say so in the PR rather than hand-fixing eleven lists."
• [finding] The objectstack-automation reference index routes to the ADR-0020-retired state-machine.zod.ts and omits both per-node config schemas — SKILL_MAP in build-skill-references.ts #14466, triage 5506975178: drop automation/state-machine.zod.ts; the two per-node config schemas join — "its retired-schema pointer is a distinct defect worth its own line".
• [finding] The objectstack-formula reference index advertises data/date-macros.zod.ts, a surface the SKILL.md routes to objectstack-query — SKILL_MAP in build-skill-references.ts maps it to both #14562, seat ruling 5536681114: drop data/date-macros.zod.ts from the formula entry; a loud one-owner guard with a negative test.
• [finding] The objectstack-i18n reference index routes 5 of its 7 transitive pointers at schemas unreachable from a translation bundle — the closure step in build-skill-references.ts #14565, triage 5514974653: "decide that feasibility question first and say so in the PR body, because it determines whether this is one fix or three." · "⛔ Do not hand-edit _index.md."
• [finding] The objectstack-formula reference index advertises data/date-macros.zod.ts, a surface the SKILL.md routes to objectstack-query — SKILL_MAP in build-skill-references.ts maps it to both #14562, triage 5515135764: "The class has two mechanisms … ⛔ Do not build the SKILL_MAP-only gate and declare the class closed."

No SKILL.md body was widened. No _index.md was hand-edited — every one is the output of pnpm --filter @objectstack/spec gen:skill-refs.

Answer 1 — does one gate cover both mechanisms? No, and they are in the same file

The class has two mechanisms and they get two guards, in one module, packages/spec/scripts/lib/skill-map-guards.ts. checkSingleOwner and checkCoreEntryShape ask questions of the hand-written core list; checkTransitiveAllowlist constrains the closure. Neither would catch the other's defect: objectstack-i18n's core list is correct and its index was still wrong, and no closure rule would have noticed that two packages both claimed date macros.

Answer 2 — is there a checkable source for "retired"? No. Measured, three ways

The design was gated on this, so it was checked rather than assumed:

1. The ADR-0087 registry (packages/spec/src/migrations/entries/retired-defs/, 94 entries) names defs removed at a major version. StateMachine is not there, and correctly so — the def still exists and still parses, through AgentSchema.lifecycle.
2. The file's own header prose.automation/state-machine.zod.ts states the ADR-0020 retirement, and the same header documents the door that survives. A prose grep flags a file that is live surface for another package.
3. "The owning SKILL.md must mention it." This one looked promising and was measured: the string state machineis in skills/objectstack-automation/SKILL.md — the skill's own description names it. A text-mention gate keeps precisely the pointer this PR removes. It is also vacuous in the other direction, since the stems are single common words (tool, view, app, action, page, context) that match any prose.

The retirement that mattered was package-relative: dead surface for automation authoring, live surface for AI authoring — and nothing in the tree expresses a per-package liveness claim. So the answer the triage said it would accept is the answer: no checkable source exists, it is said here rather than hidden, and the guards that DO ship are the mechanical ones, each with negative tests. The judgement stays a judgement, stated out loud in the map.

Answer 3 — the closure step: reachability rule, or a per-package list?

A per-package list. The general rule is not merely unbuilt, it is unbuildable from this input, and the required outcome is the proof.

objectstack-i18n published eight transitive pointers, and seven arrive through one edge: shared/strict-object.ts imports shared/suggestions.zod.ts for its "did you mean?" text, which imports data/field.zod.ts, which drags in filter, expression, field-value, identifiers and value-domain. That is a schema-building helper's implementation, not the authorable shape of a translation bundle.

Cutting traversal through non-shipping helpers is the precise version of the reachability rule. Measured against what the ruling requires:

pointer	required	what the precise rule does	why
data/filter.zod.ts	drop	drops	reached only through the helper
shared/expression.zod.ts	drop	drops	reached only through the helper
data/field-value.zod.ts	drop	drops	reached only through the helper
shared/suggestions.zod.ts	drop	drops	reached only through the helper
kernel/metadata-protection.zod.ts	drop	keeps	a first-class direct import of system/translation.zod.ts
shared/identifiers.zod.ts	keep	drops	nothing imports it; bundle keys ARE those identifiers

The required set puts a depth-4 pointer reached through a helper on the KEEP side and a depth-1 pointer reached through a schema edge on the DROP side. No predicate over the import graph orders those two that way, because the fact that separates them — what a translation bundle can address, by name string — is not in the graph. system/translation.zod.ts does not import shared/identifiers.zod.ts at all.

So: TRANSITIVE_ALLOWLIST, beside SKILL_MAP, opt-in per package. A package that declares nothing publishes its full closure and its index does not move. It is an allowlist, not a denylist, and that is the half that matters: shared/value-domain.zod.ts joined the i18n index recently and unnoticed, when a new import edge appeared several files away — a denylist misses every new arrival by construction.

data/field.zod.ts was left to this PR's judgement and is kept: FieldTranslationSchema.options is keyed by select-option value, the SKILL.md teaches that keying by example (options: { direct_mail: '直邮' } for options: [{ value: 'direct_mail', … }]), and SelectOptionSchema is the declaration those keys must match.

The census — all nine SKILL_MAP entries

The triage said eleven. There are nine, and nine generated indexes: data · query · ai · api · automation · ui · platform · i18n · formula. 59 core entries.

package	advertised, not taught	taught, not advertised	action
objectstack-ai	conversation, mcp, embedding, knowledge-document, usage (3 with zero consumers outside packages/spec)	ai/solution-blueprint.zod.ts — the schema behind the solution_design built-in skill the body's table names	narrowed + added
objectstack-automation	automation/state-machine.zod.ts — ADR-0020 retired it as a record-lifecycle declaration	automation/builtin-node-config.zod.ts, automation/io-node-config.zod.ts	swapped
objectstack-formula	data/date-macros.zod.ts — both bodies route it to objectstack-query	—	dropped
objectstack-i18n	core list correct; 6 of 8 transitive pointers unreachable from a bundle	—	closure constrained
objectstack-api	api/rest-server.zod.ts — zero mentions of the file or any of its six exported config schemas	—	recorded, no edit — filed as #15264
objectstack-platform	kernel/plugin-capability.zod.ts (thin, not wrong — the body teaches requires: but routes to kernel/platform-capabilities.ts)	stack.zod.ts — the body's whole subject is defineStack and names four of its exports	recorded, no edit — filed as #15264
objectstack-data	none	none	none
objectstack-query	none	none	none
objectstack-ui	none	none	none

The two unedited rows are deliberate and the reasoning is on #15264: every row this PR edited came with a measured consumer census or an explicit ADR retirement, and those two have only the sweep. Deleting or adding a published pointer on a governed customer surface is worth its own decision rather than a rider on a PR a reviewer is already checking four things in.

The guards, and what each negative test drives

All in packages/spec/scripts/lib/skill-map-guards.ts; tests in packages/spec/scripts/skill-map-guards.test.ts (29 assertions). They live in lib/ for the reason export-list.ts and file-description.ts do: the generator self-executes on import.

guard	refuses	negative tests
checkSingleOwner	a schema file in two core lists that is not declared in SHARED_CORE_SCHEMAS with a reason; a declaration with an empty reason; a declaration whose sharing has gone	6, incl. a passing map so an always-red guard cannot survive
checkCoreEntryShape	a core entry that is not a *.zod.ts path — today those are dropped from the index silently, with no missing row and a green --check	3
checkTransitiveAllowlist	a package name the map does not have; a file the closure never reaches; a file already in core; a repeat	6
stripInternalIssueIds	(a publication rule, not a guard) internal tracker ids in a published row	8, incl. five shapes that must survive untouched

A second leg reads build-skill-references.ts and asserts each guard is actually called there, and that the allowlist reaches the emit path. A guard nobody calls is green in a unit test and absent from the gate — which is the state the map was already in.

Deviation 1 — the one-owner guard is not the flat rule it was asked for

The #14562 seat ruling asked for "at most one owner" and refused a duplicate-ownership rule, on the stated ground that there would be "zero legitimate instances after this drop". Measured at this PR's base, that ground does not hold.date-macros was one of four duplicates:

file	packages	deliberate?
data/date-macros.zod.ts	query + formula	no — the defect #14562 filed
data/validation.zod.ts	data + automation	yes — a record's transitions are a state_machine validation rule (ADR-0020), the destination that replaced the retired shape
data/datasource.zod.ts	data + platform	yes — already carrying its reason as a comment in the map (project setup (was objectstack-quickstart))
data/seed.zod.ts	data + platform	yes — same comment

The flat rule refuses origin/main's own map on its first run, and the only ways to satisfy it are to delete three pointers no card has adjudicated, or to keep the gate red. So the guard ships in the shape that is enforceable and keeps the ruling's operational demand — the next duplicate refuses at generation time — with the three measured instances declared rather than deleted. Two further guards keep that ledger from becoming a silent allowlist: a row with no reason is refused, and so is a row whose sharing has gone. A reviewer who prefers the literal rule should say so; reverting to it is a three-pointer deletion, not a code change.

Deviation 2 — internal tracker ids are stripped at the catalog boundary, not at the source

Adding automation/io-node-config.zod.ts turned check:doc-authoring red: the generator publishes the first sentence of a module's doc block, and that file's opens with a bare tracker citation. That gate has no per-passage exemption, by design.

Its prescribed remedy is to strip the id at the source and regenerate. That remedy is not taken here, for three specific reasons: the source is a .zod.ts this card is forbidden to edit; it is a file the package publishes, so editing it would change what @objectstack/spec ships and reopen the changeset decision below; and the same sentence is projected to content/docs/references/automation/io-node-config.mdx, which would pull a second generated tree into a diff whose surface is the skill catalog. Three surfaces to remove one token.

The decisive measurement: the gate does not flag that identical sentence on the docs page. The rule is about the skill catalog specifically — skills/** is loaded whole into customer context windows — so the strip is applied at the boundary into that catalog. Every future pointer row is covered rather than this one being corrected once. The criterion is the gate's own, restated with a pin over the shapes that must and must not match (an ordinal, a hex colour, an over-long number, a doubled hash). A reviewer who wants the source edit instead can have it; it needs a changeset and a docs regeneration.

skills/** net line delta: −9 (budget: not more than +6)

4 lines added, 13 removed, across four of the nine indexes.

index	added	removed	net
objectstack-ai	2	5	−3
objectstack-automation	2	1	+1
objectstack-formula	0	1	−1
objectstack-i18n	0	6	−6

Three of the four added lines are the members' named additions: ai/solution-blueprint.zod.ts, automation/builtin-node-config.zod.ts, automation/io-node-config.zod.ts. The fourth is not a new pointer: ai/embedding.zod.ts moves from the Core section to Transitive in the same file, because knowledge-source.zod.ts composes EmbeddingModelSchema — that pointer IS reachable from the authorable face, which is exactly the test the other four narrowed schemas fail. Net published pointers for objectstack-ai: 20 down to 17.

The other five indexes are byte-identical to origin/main.

Changeset: skip-changeset, and why the named precedent points that way

PR #14737 (the "Sort Node" labelling fix on this same generator, landed 2026-09-03) carried a patch changeset — and its file list says why: it edited packages/spec/src/data/query.zod.ts, which is inside the package's files allowlist (src/**/*.zod.ts). That half is absent here by ruling: no .zod.ts is edited.

This diff is packages/spec/scripts/** (not in the files allowlist, so nothing published) plus skills/** (shipped by npx skills add from the repo, not from any released package). AGENTS.md: the label "is for a diff that publishes nothing from any released package." Five recent skills-only commits on main carry no changeset. check:empty-changeset and check:changeset-gate-self-tests are green.

Measurements — every gate at head eed6bb0f

Derived with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands from the worktree, no path arguments: 53 commands, all exit 0. Exits captured before any pipe. The load-bearing ones:

gate	exit	verdict line
pnpm --filter @objectstack/spec check:skill-refs	0	✅ 9 generated files in sync with packages/spec
pnpm check:doc-authoring	0	✓ doc authoring guard: 46 published skill files clean — no internal issue-id references.
pnpm --filter @objectstack/spec check:skill-examples	0	✅ 257 prose examples type-check across 3 surface(s)
pnpm --filter @objectstack/spec check:llms-txt	0	✓ packages/spec/llms.txt: 97 claim(s) re-derived
pnpm --filter @objectstack/spec typecheck	0	covers tsc --noEmit + check:scripts-typecheck + check:test-typecheck; tsconfig.scripts.json includes scripts/**/*, so the new lib and its test file are both in a checked program
node scripts/check-skills-token-ratchet.mjs	0	✓ 36 authored bundle file(s) within their ceilings; 11 generator-owned file(s) measured, not ratcheted
pnpm check:pm-skill-ratchet	0	✓ check-skill-line-ratchet: declared cross-file moves: 1, total ceilings down 1 line.
pnpm check:nul-bytes	0	✓ check-nul-bytes --self-test: 75 assertions over a temp git repo
node scripts/check-system-context-census.mjs	0	OK — 106 elevation read sites in 20 packages across 45 files, all anchored
pnpm check:changeset-gate-self-tests	0	✓ check-changeset-no-major --self-test: 116 assertions
pnpm check:watch-hint-literal	0	✓ 49 declaration(s) across 4 rostered name(s) … every one an array
node scripts/pm/bare-root-worklist.mjs --self-test	0	OK self-test: 54 live row(s) … none stale, none missing, none contradicted — the pin that holds this generator's ROOT_DIR_WATCH_HINTS declaration honest
pnpm --filter @objectstack/spec exec vitest run scripts/skill-map-guards.test.ts	0	Test Files 1 passed (1) · Tests 29 passed (29)

Four gates first answered PREREQUISITE NOT MET (exit 3 or a build refusal) and were re-run green after pnpm exec turbo run build over the package closure: check:doc-formula-expressions, check:dual-build-cjs-loads, check:type-check-debt, check:skill-examples.

Reverse verification — each guard driven to red, then restored

Predicted direction: red, with a named refusal. Observed, all three:

mutation	exit	the gate's own line
baseline, unmutated head	0	✅ 9 generated files in sync with packages/spec
data/date-macros.zod.ts put back in the formula entry	1	data/date-macros.zod.ts is in the core list of 2 packages (objectstack-query, objectstack-formula) — one schema file, one owning package.
a non-.zod.ts core entry added	1	objectstack-formula → contracts/plugin-lifecycle-events.ts is not a *.zod.ts path — … emits no pointer row at all
TRANSITIVE_ALLOWLIST keyed on a package the map lacks	1	TRANSITIVE_ALLOWLIST names objectstack-i18nn, which is not a SKILL_MAP package — the list would constrain nothing.

Each mutation was confirmed on disk by counting the injected text before the run, and each restore is git checkout HEAD -- against absolute paths with a trap, proven by an empty git diff HEADand a git hash-object match against the HEAD blob. No build or dist/ is involved: tsx and vitest resolve ./lib/skill-map-guards as a relative source path, with no package exports boundary in between, so the mutated bytes are the bytes that ran.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 460134af85f7ab2cf68abc62f1bbb9783b8899dd → packageMentionDocs.

[os-justin]

Seat review: ACCEPT — review of record on the family anchor #14462 (comment 5537457796), domain:spec seat, 2026-09-04T07:56Z; member pointers on #14466, #14562, #14565.

Governed surface (skills/** regenerated together with its generator — check-governed-merges reads that as governed, not as the pure-regeneration exception) ⇒ this PR stays draft. No agent seat flips it ready, enqueues it, or arms auto-merge; a human merge is the review record. Review requested from os-zhuang and hotlong.

For the human merger, what to read:

• The four regenerated indexes: net −9 lines in skills/**; every added pointer is one the members' rulings named (solution-blueprint, the two automation config schemas); the fourth added line is embedding moving from Core to Transitive in the same file.
• Two deviations from seat rulings, both argued in the body and both accepted by the seat with the reasoning in 5537457796: SHARED_CORE_SCHEMAS (three deliberate cross-package duplicates exist on main, so the flat one-owner rule would red the current map) and stripInternalIssueIds at the catalog boundary (the doc-authoring gate is zero-tolerance on skills/** and baseline-held on content/docs). Either can be overruled here; the flat rule is a three-pointer deletion, the source strip is a .zod.ts edit + changeset + docs regeneration.
• data/field.zod.ts stays in the i18n index on the SelectOptionSchema reasoning; state-machine.zod.ts survives only in objectstack-ai's transitive list, through agent.zod.ts.
• skip-changeset is measured: no .zod.ts edited, packages/spec/scripts/** is outside the package's files allowlist, skills/ is in no package.

CI on eed6bb0f at 07:50Z: 17 completed checks green, the long jobs still running; merge when the required checks report on this head.

---

Generated by Claude Code

[os-justin]

Status (seat, 2026-09-04T08:36Z): approved by os-zhuang at 07:53:09Z on eed6bb0f, marked ready at 07:54Z, and every check on that head is green as of 08:12Z (48 check runs: Lint & Repo Gates, all four Type Check jobs, Test Core ×6, Dogfood ×4, Temporal Conformance, Governed Surface Queue Guard re-run after the approval — all success). The PR is not in the merge queue (git ls-remote origin 'refs/heads/gh-readonly-queue/*' at 08:32Z lists #15073 → #15236 → #15251 → #15257 → #15266). Governed surface: the agent seat does not enqueue or arm auto-merge — os-zhuang / hotlong, enabling auto-merge (squash) puts it in the queue, as was done for #15257.

---

Generated by Claude Code

[os-justin]

Fixes#14462
Fixes#14466
Fixes#14562
Fixes#14565

One family, one branch, one commit per member. The map that decides what nine published skill indexes point at is reconciled against the bodies that own those surfaces, and the generator gains the guards that keep it reconciled.

skills/** is a governed surface: this PR stays draft for a human merge. It is never flipped ready and no auto-merge is armed.

The rulings this implements, quoted where operative

• Anchor, triage 5506970439: "Ruling: narrow the map, add solution-blueprint. ⛔ Do not widen the body." · "This card carries the census — for each of the [SKILL_MAP] entries, the set difference in both directions against what its SKILL.md teaches — and applies the ruling above uniformly." · "whatever reconciliation lands must make a retired schema in the map impossible, not merely corrected once … If deriving the map from a checkable source is out of reach, say so in the PR rather than hand-fixing eleven lists."
• [finding] The objectstack-automation reference index routes to the ADR-0020-retired state-machine.zod.ts and omits both per-node config schemas — SKILL_MAP in build-skill-references.ts #14466, triage 5506975178: drop automation/state-machine.zod.ts; the two per-node config schemas join — "its retired-schema pointer is a distinct defect worth its own line".
• [finding] The objectstack-formula reference index advertises data/date-macros.zod.ts, a surface the SKILL.md routes to objectstack-query — SKILL_MAP in build-skill-references.ts maps it to both #14562, seat ruling 5536681114: drop data/date-macros.zod.ts from the formula entry; a loud one-owner guard with a negative test.
• [finding] The objectstack-i18n reference index routes 5 of its 7 transitive pointers at schemas unreachable from a translation bundle — the closure step in build-skill-references.ts #14565, triage 5514974653: "decide that feasibility question first and say so in the PR body, because it determines whether this is one fix or three." · "⛔ Do not hand-edit _index.md."
• [finding] The objectstack-formula reference index advertises data/date-macros.zod.ts, a surface the SKILL.md routes to objectstack-query — SKILL_MAP in build-skill-references.ts maps it to both #14562, triage 5515135764: "The class has two mechanisms … ⛔ Do not build the SKILL_MAP-only gate and declare the class closed."

No SKILL.md body was widened. No _index.md was hand-edited — every one is the output of pnpm --filter @objectstack/spec gen:skill-refs.

Answer 1 — does one gate cover both mechanisms? No, and they are in the same file

The class has two mechanisms and they get two guards, in one module, packages/spec/scripts/lib/skill-map-guards.ts. checkSingleOwner and checkCoreEntryShape ask questions of the hand-written core list; checkTransitiveAllowlist constrains the closure. Neither would catch the other's defect: objectstack-i18n's core list is correct and its index was still wrong, and no closure rule would have noticed that two packages both claimed date macros.

Answer 2 — is there a checkable source for "retired"? No. Measured, three ways

The design was gated on this, so it was checked rather than assumed:

1. The ADR-0087 registry (packages/spec/src/migrations/entries/retired-defs/, 94 entries) names defs removed at a major version. StateMachine is not there, and correctly so — the def still exists and still parses, through AgentSchema.lifecycle.
2. The file's own header prose.automation/state-machine.zod.ts states the ADR-0020 retirement, and the same header documents the door that survives. A prose grep flags a file that is live surface for another package.
3. "The owning SKILL.md must mention it." This one looked promising and was measured: the string state machineis in skills/objectstack-automation/SKILL.md — the skill's own description names it. A text-mention gate keeps precisely the pointer this PR removes. It is also vacuous in the other direction, since the stems are single common words (tool, view, app, action, page, context) that match any prose.

The retirement that mattered was package-relative: dead surface for automation authoring, live surface for AI authoring — and nothing in the tree expresses a per-package liveness claim. So the answer the triage said it would accept is the answer: no checkable source exists, it is said here rather than hidden, and the guards that DO ship are the mechanical ones, each with negative tests. The judgement stays a judgement, stated out loud in the map.

Answer 3 — the closure step: reachability rule, or a per-package list?

A per-package list. The general rule is not merely unbuilt, it is unbuildable from this input, and the required outcome is the proof.

objectstack-i18n published eight transitive pointers, and seven arrive through one edge: shared/strict-object.ts imports shared/suggestions.zod.ts for its "did you mean?" text, which imports data/field.zod.ts, which drags in filter, expression, field-value, identifiers and value-domain. That is a schema-building helper's implementation, not the authorable shape of a translation bundle.

Cutting traversal through non-shipping helpers is the precise version of the reachability rule. Measured against what the ruling requires:

pointer	required	what the precise rule does	why
data/filter.zod.ts	drop	drops	reached only through the helper
shared/expression.zod.ts	drop	drops	reached only through the helper
data/field-value.zod.ts	drop	drops	reached only through the helper
shared/suggestions.zod.ts	drop	drops	reached only through the helper
kernel/metadata-protection.zod.ts	drop	keeps	a first-class direct import of system/translation.zod.ts
shared/identifiers.zod.ts	keep	drops	nothing imports it; bundle keys ARE those identifiers

The required set puts a depth-4 pointer reached through a helper on the KEEP side and a depth-1 pointer reached through a schema edge on the DROP side. No predicate over the import graph orders those two that way, because the fact that separates them — what a translation bundle can address, by name string — is not in the graph. system/translation.zod.ts does not import shared/identifiers.zod.ts at all.

So: TRANSITIVE_ALLOWLIST, beside SKILL_MAP, opt-in per package. A package that declares nothing publishes its full closure and its index does not move. It is an allowlist, not a denylist, and that is the half that matters: shared/value-domain.zod.ts joined the i18n index recently and unnoticed, when a new import edge appeared several files away — a denylist misses every new arrival by construction.

data/field.zod.ts was left to this PR's judgement and is kept: FieldTranslationSchema.options is keyed by select-option value, the SKILL.md teaches that keying by example (options: { direct_mail: '直邮' } for options: [{ value: 'direct_mail', … }]), and SelectOptionSchema is the declaration those keys must match.

The census — all nine SKILL_MAP entries

The triage said eleven. There are nine, and nine generated indexes: data · query · ai · api · automation · ui · platform · i18n · formula. 59 core entries.

package	advertised, not taught	taught, not advertised	action
objectstack-ai	conversation, mcp, embedding, knowledge-document, usage (3 with zero consumers outside packages/spec)	ai/solution-blueprint.zod.ts — the schema behind the solution_design built-in skill the body's table names	narrowed + added
objectstack-automation	automation/state-machine.zod.ts — ADR-0020 retired it as a record-lifecycle declaration	automation/builtin-node-config.zod.ts, automation/io-node-config.zod.ts	swapped
objectstack-formula	data/date-macros.zod.ts — both bodies route it to objectstack-query	—	dropped
objectstack-i18n	core list correct; 6 of 8 transitive pointers unreachable from a bundle	—	closure constrained
objectstack-api	api/rest-server.zod.ts — zero mentions of the file or any of its six exported config schemas	—	recorded, no edit — filed as #15264
objectstack-platform	kernel/plugin-capability.zod.ts (thin, not wrong — the body teaches requires: but routes to kernel/platform-capabilities.ts)	stack.zod.ts — the body's whole subject is defineStack and names four of its exports	recorded, no edit — filed as #15264
objectstack-data	none	none	none
objectstack-query	none	none	none
objectstack-ui	none	none	none

The two unedited rows are deliberate and the reasoning is on #15264: every row this PR edited came with a measured consumer census or an explicit ADR retirement, and those two have only the sweep. Deleting or adding a published pointer on a governed customer surface is worth its own decision rather than a rider on a PR a reviewer is already checking four things in.

The guards, and what each negative test drives

All in packages/spec/scripts/lib/skill-map-guards.ts; tests in packages/spec/scripts/skill-map-guards.test.ts (29 assertions). They live in lib/ for the reason export-list.ts and file-description.ts do: the generator self-executes on import.

guard	refuses	negative tests
checkSingleOwner	a schema file in two core lists that is not declared in SHARED_CORE_SCHEMAS with a reason; a declaration with an empty reason; a declaration whose sharing has gone	6, incl. a passing map so an always-red guard cannot survive
checkCoreEntryShape	a core entry that is not a *.zod.ts path — today those are dropped from the index silently, with no missing row and a green --check	3
checkTransitiveAllowlist	a package name the map does not have; a file the closure never reaches; a file already in core; a repeat	6
stripInternalIssueIds	(a publication rule, not a guard) internal tracker ids in a published row	8, incl. five shapes that must survive untouched

A second leg reads build-skill-references.ts and asserts each guard is actually called there, and that the allowlist reaches the emit path. A guard nobody calls is green in a unit test and absent from the gate — which is the state the map was already in.

Deviation 1 — the one-owner guard is not the flat rule it was asked for

The #14562 seat ruling asked for "at most one owner" and refused a duplicate-ownership rule, on the stated ground that there would be "zero legitimate instances after this drop". Measured at this PR's base, that ground does not hold.date-macros was one of four duplicates:

file	packages	deliberate?
data/date-macros.zod.ts	query + formula	no — the defect #14562 filed
data/validation.zod.ts	data + automation	yes — a record's transitions are a state_machine validation rule (ADR-0020), the destination that replaced the retired shape
data/datasource.zod.ts	data + platform	yes — already carrying its reason as a comment in the map (project setup (was objectstack-quickstart))
data/seed.zod.ts	data + platform	yes — same comment

The flat rule refuses origin/main's own map on its first run, and the only ways to satisfy it are to delete three pointers no card has adjudicated, or to keep the gate red. So the guard ships in the shape that is enforceable and keeps the ruling's operational demand — the next duplicate refuses at generation time — with the three measured instances declared rather than deleted. Two further guards keep that ledger from becoming a silent allowlist: a row with no reason is refused, and so is a row whose sharing has gone. A reviewer who prefers the literal rule should say so; reverting to it is a three-pointer deletion, not a code change.

Deviation 2 — internal tracker ids are stripped at the catalog boundary, not at the source

Adding automation/io-node-config.zod.ts turned check:doc-authoring red: the generator publishes the first sentence of a module's doc block, and that file's opens with a bare tracker citation. That gate has no per-passage exemption, by design.

Its prescribed remedy is to strip the id at the source and regenerate. That remedy is not taken here, for three specific reasons: the source is a .zod.ts this card is forbidden to edit; it is a file the package publishes, so editing it would change what @objectstack/spec ships and reopen the changeset decision below; and the same sentence is projected to content/docs/references/automation/io-node-config.mdx, which would pull a second generated tree into a diff whose surface is the skill catalog. Three surfaces to remove one token.

The decisive measurement: the gate does not flag that identical sentence on the docs page. The rule is about the skill catalog specifically — skills/** is loaded whole into customer context windows — so the strip is applied at the boundary into that catalog. Every future pointer row is covered rather than this one being corrected once. The criterion is the gate's own, restated with a pin over the shapes that must and must not match (an ordinal, a hex colour, an over-long number, a doubled hash). A reviewer who wants the source edit instead can have it; it needs a changeset and a docs regeneration.

skills/** net line delta: −9 (budget: not more than +6)

4 lines added, 13 removed, across four of the nine indexes.

index	added	removed	net
objectstack-ai	2	5	−3
objectstack-automation	2	1	+1
objectstack-formula	0	1	−1
objectstack-i18n	0	6	−6

Three of the four added lines are the members' named additions: ai/solution-blueprint.zod.ts, automation/builtin-node-config.zod.ts, automation/io-node-config.zod.ts. The fourth is not a new pointer: ai/embedding.zod.ts moves from the Core section to Transitive in the same file, because knowledge-source.zod.ts composes EmbeddingModelSchema — that pointer IS reachable from the authorable face, which is exactly the test the other four narrowed schemas fail. Net published pointers for objectstack-ai: 20 down to 17.

The other five indexes are byte-identical to origin/main.

Changeset: skip-changeset, and why the named precedent points that way

PR #14737 (the "Sort Node" labelling fix on this same generator, landed 2026-09-03) carried a patch changeset — and its file list says why: it edited packages/spec/src/data/query.zod.ts, which is inside the package's files allowlist (src/**/*.zod.ts). That half is absent here by ruling: no .zod.ts is edited.

This diff is packages/spec/scripts/** (not in the files allowlist, so nothing published) plus skills/** (shipped by npx skills add from the repo, not from any released package). AGENTS.md: the label "is for a diff that publishes nothing from any released package." Five recent skills-only commits on main carry no changeset. check:empty-changeset and check:changeset-gate-self-tests are green.

Measurements — every gate at head eed6bb0f

Derived with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands from the worktree, no path arguments: 53 commands, all exit 0. Exits captured before any pipe. The load-bearing ones:

gate	exit	verdict line
pnpm --filter @objectstack/spec check:skill-refs	0	✅ 9 generated files in sync with packages/spec
pnpm check:doc-authoring	0	✓ doc authoring guard: 46 published skill files clean — no internal issue-id references.
pnpm --filter @objectstack/spec check:skill-examples	0	✅ 257 prose examples type-check across 3 surface(s)
pnpm --filter @objectstack/spec check:llms-txt	0	✓ packages/spec/llms.txt: 97 claim(s) re-derived
pnpm --filter @objectstack/spec typecheck	0	covers tsc --noEmit + check:scripts-typecheck + check:test-typecheck; tsconfig.scripts.json includes scripts/**/*, so the new lib and its test file are both in a checked program
node scripts/check-skills-token-ratchet.mjs	0	✓ 36 authored bundle file(s) within their ceilings; 11 generator-owned file(s) measured, not ratcheted
pnpm check:pm-skill-ratchet	0	✓ check-skill-line-ratchet: declared cross-file moves: 1, total ceilings down 1 line.
pnpm check:nul-bytes	0	✓ check-nul-bytes --self-test: 75 assertions over a temp git repo
node scripts/check-system-context-census.mjs	0	OK — 106 elevation read sites in 20 packages across 45 files, all anchored
pnpm check:changeset-gate-self-tests	0	✓ check-changeset-no-major --self-test: 116 assertions
pnpm check:watch-hint-literal	0	✓ 49 declaration(s) across 4 rostered name(s) … every one an array
node scripts/pm/bare-root-worklist.mjs --self-test	0	OK self-test: 54 live row(s) … none stale, none missing, none contradicted — the pin that holds this generator's ROOT_DIR_WATCH_HINTS declaration honest
pnpm --filter @objectstack/spec exec vitest run scripts/skill-map-guards.test.ts	0	Test Files 1 passed (1) · Tests 29 passed (29)

Four gates first answered PREREQUISITE NOT MET (exit 3 or a build refusal) and were re-run green after pnpm exec turbo run build over the package closure: check:doc-formula-expressions, check:dual-build-cjs-loads, check:type-check-debt, check:skill-examples.

Reverse verification — each guard driven to red, then restored

Predicted direction: red, with a named refusal. Observed, all three:

mutation	exit	the gate's own line
baseline, unmutated head	0	✅ 9 generated files in sync with packages/spec
data/date-macros.zod.ts put back in the formula entry	1	data/date-macros.zod.ts is in the core list of 2 packages (objectstack-query, objectstack-formula) — one schema file, one owning package.
a non-.zod.ts core entry added	1	objectstack-formula → contracts/plugin-lifecycle-events.ts is not a *.zod.ts path — … emits no pointer row at all
TRANSITIVE_ALLOWLIST keyed on a package the map lacks	1	TRANSITIVE_ALLOWLIST names objectstack-i18nn, which is not a SKILL_MAP package — the list would constrain nothing.

Each mutation was confirmed on disk by counting the injected text before the run, and each restore is git checkout HEAD -- against absolute paths with a trap, proven by an empty git diff HEADand a git hash-object match against the HEAD blob. No build or dist/ is involved: tsx and vitest resolve ./lib/skill-map-guards as a relative source path, with no package exports boundary in between, so the mutated bytes are the bytes that ran.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 460134af85f7ab2cf68abc62f1bbb9783b8899dd → packageMentionDocs.

[os-justin]

Seat review: ACCEPT — review of record on the family anchor #14462 (comment 5537457796), domain:spec seat, 2026-09-04T07:56Z; member pointers on #14466, #14562, #14565.

Governed surface (skills/** regenerated together with its generator — check-governed-merges reads that as governed, not as the pure-regeneration exception) ⇒ this PR stays draft. No agent seat flips it ready, enqueues it, or arms auto-merge; a human merge is the review record. Review requested from os-zhuang and hotlong.

For the human merger, what to read:

• The four regenerated indexes: net −9 lines in skills/**; every added pointer is one the members' rulings named (solution-blueprint, the two automation config schemas); the fourth added line is embedding moving from Core to Transitive in the same file.
• Two deviations from seat rulings, both argued in the body and both accepted by the seat with the reasoning in 5537457796: SHARED_CORE_SCHEMAS (three deliberate cross-package duplicates exist on main, so the flat one-owner rule would red the current map) and stripInternalIssueIds at the catalog boundary (the doc-authoring gate is zero-tolerance on skills/** and baseline-held on content/docs). Either can be overruled here; the flat rule is a three-pointer deletion, the source strip is a .zod.ts edit + changeset + docs regeneration.
• data/field.zod.ts stays in the i18n index on the SelectOptionSchema reasoning; state-machine.zod.ts survives only in objectstack-ai's transitive list, through agent.zod.ts.
• skip-changeset is measured: no .zod.ts edited, packages/spec/scripts/** is outside the package's files allowlist, skills/ is in no package.

CI on eed6bb0f at 07:50Z: 17 completed checks green, the long jobs still running; merge when the required checks report on this head.

---

Generated by Claude Code

[os-justin]

Status (seat, 2026-09-04T08:36Z): approved by os-zhuang at 07:53:09Z on eed6bb0f, marked ready at 07:54Z, and every check on that head is green as of 08:12Z (48 check runs: Lint & Repo Gates, all four Type Check jobs, Test Core ×6, Dogfood ×4, Temporal Conformance, Governed Surface Queue Guard re-run after the approval — all success). The PR is not in the merge queue (git ls-remote origin 'refs/heads/gh-readonly-queue/*' at 08:32Z lists #15073 → #15236 → #15251 → #15257 → #15266). Governed surface: the agent seat does not enqueue or arm auto-merge — os-zhuang / hotlong, enabling auto-merge (squash) puts it in the queue, as was done for #15257.

---

Generated by Claude Code

[os-justin]

Fixes#14462
Fixes#14466
Fixes#14562
Fixes#14565

One family, one branch, one commit per member. The map that decides what nine published skill indexes point at is reconciled against the bodies that own those surfaces, and the generator gains the guards that keep it reconciled.

skills/** is a governed surface: this PR stays draft for a human merge. It is never flipped ready and no auto-merge is armed.

The rulings this implements, quoted where operative

• Anchor, triage 5506970439: "Ruling: narrow the map, add solution-blueprint. ⛔ Do not widen the body." · "This card carries the census — for each of the [SKILL_MAP] entries, the set difference in both directions against what its SKILL.md teaches — and applies the ruling above uniformly." · "whatever reconciliation lands must make a retired schema in the map impossible, not merely corrected once … If deriving the map from a checkable source is out of reach, say so in the PR rather than hand-fixing eleven lists."
• [finding] The objectstack-automation reference index routes to the ADR-0020-retired state-machine.zod.ts and omits both per-node config schemas — SKILL_MAP in build-skill-references.ts #14466, triage 5506975178: drop automation/state-machine.zod.ts; the two per-node config schemas join — "its retired-schema pointer is a distinct defect worth its own line".
• [finding] The objectstack-formula reference index advertises data/date-macros.zod.ts, a surface the SKILL.md routes to objectstack-query — SKILL_MAP in build-skill-references.ts maps it to both #14562, seat ruling 5536681114: drop data/date-macros.zod.ts from the formula entry; a loud one-owner guard with a negative test.
• [finding] The objectstack-i18n reference index routes 5 of its 7 transitive pointers at schemas unreachable from a translation bundle — the closure step in build-skill-references.ts #14565, triage 5514974653: "decide that feasibility question first and say so in the PR body, because it determines whether this is one fix or three." · "⛔ Do not hand-edit _index.md."
• [finding] The objectstack-formula reference index advertises data/date-macros.zod.ts, a surface the SKILL.md routes to objectstack-query — SKILL_MAP in build-skill-references.ts maps it to both #14562, triage 5515135764: "The class has two mechanisms … ⛔ Do not build the SKILL_MAP-only gate and declare the class closed."

No SKILL.md body was widened. No _index.md was hand-edited — every one is the output of pnpm --filter @objectstack/spec gen:skill-refs.

Answer 1 — does one gate cover both mechanisms? No, and they are in the same file

The class has two mechanisms and they get two guards, in one module, packages/spec/scripts/lib/skill-map-guards.ts. checkSingleOwner and checkCoreEntryShape ask questions of the hand-written core list; checkTransitiveAllowlist constrains the closure. Neither would catch the other's defect: objectstack-i18n's core list is correct and its index was still wrong, and no closure rule would have noticed that two packages both claimed date macros.

Answer 2 — is there a checkable source for "retired"? No. Measured, three ways

The design was gated on this, so it was checked rather than assumed:

1. The ADR-0087 registry (packages/spec/src/migrations/entries/retired-defs/, 94 entries) names defs removed at a major version. StateMachine is not there, and correctly so — the def still exists and still parses, through AgentSchema.lifecycle.
2. The file's own header prose.automation/state-machine.zod.ts states the ADR-0020 retirement, and the same header documents the door that survives. A prose grep flags a file that is live surface for another package.
3. "The owning SKILL.md must mention it." This one looked promising and was measured: the string state machineis in skills/objectstack-automation/SKILL.md — the skill's own description names it. A text-mention gate keeps precisely the pointer this PR removes. It is also vacuous in the other direction, since the stems are single common words (tool, view, app, action, page, context) that match any prose.

The retirement that mattered was package-relative: dead surface for automation authoring, live surface for AI authoring — and nothing in the tree expresses a per-package liveness claim. So the answer the triage said it would accept is the answer: no checkable source exists, it is said here rather than hidden, and the guards that DO ship are the mechanical ones, each with negative tests. The judgement stays a judgement, stated out loud in the map.

Answer 3 — the closure step: reachability rule, or a per-package list?

A per-package list. The general rule is not merely unbuilt, it is unbuildable from this input, and the required outcome is the proof.

objectstack-i18n published eight transitive pointers, and seven arrive through one edge: shared/strict-object.ts imports shared/suggestions.zod.ts for its "did you mean?" text, which imports data/field.zod.ts, which drags in filter, expression, field-value, identifiers and value-domain. That is a schema-building helper's implementation, not the authorable shape of a translation bundle.

Cutting traversal through non-shipping helpers is the precise version of the reachability rule. Measured against what the ruling requires:

pointer	required	what the precise rule does	why
data/filter.zod.ts	drop	drops	reached only through the helper
shared/expression.zod.ts	drop	drops	reached only through the helper
data/field-value.zod.ts	drop	drops	reached only through the helper
shared/suggestions.zod.ts	drop	drops	reached only through the helper
kernel/metadata-protection.zod.ts	drop	keeps	a first-class direct import of system/translation.zod.ts
shared/identifiers.zod.ts	keep	drops	nothing imports it; bundle keys ARE those identifiers

The required set puts a depth-4 pointer reached through a helper on the KEEP side and a depth-1 pointer reached through a schema edge on the DROP side. No predicate over the import graph orders those two that way, because the fact that separates them — what a translation bundle can address, by name string — is not in the graph. system/translation.zod.ts does not import shared/identifiers.zod.ts at all.

So: TRANSITIVE_ALLOWLIST, beside SKILL_MAP, opt-in per package. A package that declares nothing publishes its full closure and its index does not move. It is an allowlist, not a denylist, and that is the half that matters: shared/value-domain.zod.ts joined the i18n index recently and unnoticed, when a new import edge appeared several files away — a denylist misses every new arrival by construction.

data/field.zod.ts was left to this PR's judgement and is kept: FieldTranslationSchema.options is keyed by select-option value, the SKILL.md teaches that keying by example (options: { direct_mail: '直邮' } for options: [{ value: 'direct_mail', … }]), and SelectOptionSchema is the declaration those keys must match.

The census — all nine SKILL_MAP entries

The triage said eleven. There are nine, and nine generated indexes: data · query · ai · api · automation · ui · platform · i18n · formula. 59 core entries.

package	advertised, not taught	taught, not advertised	action
objectstack-ai	conversation, mcp, embedding, knowledge-document, usage (3 with zero consumers outside packages/spec)	ai/solution-blueprint.zod.ts — the schema behind the solution_design built-in skill the body's table names	narrowed + added
objectstack-automation	automation/state-machine.zod.ts — ADR-0020 retired it as a record-lifecycle declaration	automation/builtin-node-config.zod.ts, automation/io-node-config.zod.ts	swapped
objectstack-formula	data/date-macros.zod.ts — both bodies route it to objectstack-query	—	dropped
objectstack-i18n	core list correct; 6 of 8 transitive pointers unreachable from a bundle	—	closure constrained
objectstack-api	api/rest-server.zod.ts — zero mentions of the file or any of its six exported config schemas	—	recorded, no edit — filed as #15264
objectstack-platform	kernel/plugin-capability.zod.ts (thin, not wrong — the body teaches requires: but routes to kernel/platform-capabilities.ts)	stack.zod.ts — the body's whole subject is defineStack and names four of its exports	recorded, no edit — filed as #15264
objectstack-data	none	none	none
objectstack-query	none	none	none
objectstack-ui	none	none	none

The two unedited rows are deliberate and the reasoning is on #15264: every row this PR edited came with a measured consumer census or an explicit ADR retirement, and those two have only the sweep. Deleting or adding a published pointer on a governed customer surface is worth its own decision rather than a rider on a PR a reviewer is already checking four things in.

The guards, and what each negative test drives

All in packages/spec/scripts/lib/skill-map-guards.ts; tests in packages/spec/scripts/skill-map-guards.test.ts (29 assertions). They live in lib/ for the reason export-list.ts and file-description.ts do: the generator self-executes on import.

guard	refuses	negative tests
checkSingleOwner	a schema file in two core lists that is not declared in SHARED_CORE_SCHEMAS with a reason; a declaration with an empty reason; a declaration whose sharing has gone	6, incl. a passing map so an always-red guard cannot survive
checkCoreEntryShape	a core entry that is not a *.zod.ts path — today those are dropped from the index silently, with no missing row and a green --check	3
checkTransitiveAllowlist	a package name the map does not have; a file the closure never reaches; a file already in core; a repeat	6
stripInternalIssueIds	(a publication rule, not a guard) internal tracker ids in a published row	8, incl. five shapes that must survive untouched

A second leg reads build-skill-references.ts and asserts each guard is actually called there, and that the allowlist reaches the emit path. A guard nobody calls is green in a unit test and absent from the gate — which is the state the map was already in.

Deviation 1 — the one-owner guard is not the flat rule it was asked for

The #14562 seat ruling asked for "at most one owner" and refused a duplicate-ownership rule, on the stated ground that there would be "zero legitimate instances after this drop". Measured at this PR's base, that ground does not hold.date-macros was one of four duplicates:

file	packages	deliberate?
data/date-macros.zod.ts	query + formula	no — the defect #14562 filed
data/validation.zod.ts	data + automation	yes — a record's transitions are a state_machine validation rule (ADR-0020), the destination that replaced the retired shape
data/datasource.zod.ts	data + platform	yes — already carrying its reason as a comment in the map (project setup (was objectstack-quickstart))
data/seed.zod.ts	data + platform	yes — same comment

The flat rule refuses origin/main's own map on its first run, and the only ways to satisfy it are to delete three pointers no card has adjudicated, or to keep the gate red. So the guard ships in the shape that is enforceable and keeps the ruling's operational demand — the next duplicate refuses at generation time — with the three measured instances declared rather than deleted. Two further guards keep that ledger from becoming a silent allowlist: a row with no reason is refused, and so is a row whose sharing has gone. A reviewer who prefers the literal rule should say so; reverting to it is a three-pointer deletion, not a code change.

Deviation 2 — internal tracker ids are stripped at the catalog boundary, not at the source

Adding automation/io-node-config.zod.ts turned check:doc-authoring red: the generator publishes the first sentence of a module's doc block, and that file's opens with a bare tracker citation. That gate has no per-passage exemption, by design.

Its prescribed remedy is to strip the id at the source and regenerate. That remedy is not taken here, for three specific reasons: the source is a .zod.ts this card is forbidden to edit; it is a file the package publishes, so editing it would change what @objectstack/spec ships and reopen the changeset decision below; and the same sentence is projected to content/docs/references/automation/io-node-config.mdx, which would pull a second generated tree into a diff whose surface is the skill catalog. Three surfaces to remove one token.

The decisive measurement: the gate does not flag that identical sentence on the docs page. The rule is about the skill catalog specifically — skills/** is loaded whole into customer context windows — so the strip is applied at the boundary into that catalog. Every future pointer row is covered rather than this one being corrected once. The criterion is the gate's own, restated with a pin over the shapes that must and must not match (an ordinal, a hex colour, an over-long number, a doubled hash). A reviewer who wants the source edit instead can have it; it needs a changeset and a docs regeneration.

skills/** net line delta: −9 (budget: not more than +6)

4 lines added, 13 removed, across four of the nine indexes.

index	added	removed	net
objectstack-ai	2	5	−3
objectstack-automation	2	1	+1
objectstack-formula	0	1	−1
objectstack-i18n	0	6	−6

Three of the four added lines are the members' named additions: ai/solution-blueprint.zod.ts, automation/builtin-node-config.zod.ts, automation/io-node-config.zod.ts. The fourth is not a new pointer: ai/embedding.zod.ts moves from the Core section to Transitive in the same file, because knowledge-source.zod.ts composes EmbeddingModelSchema — that pointer IS reachable from the authorable face, which is exactly the test the other four narrowed schemas fail. Net published pointers for objectstack-ai: 20 down to 17.

The other five indexes are byte-identical to origin/main.

Changeset: skip-changeset, and why the named precedent points that way

PR #14737 (the "Sort Node" labelling fix on this same generator, landed 2026-09-03) carried a patch changeset — and its file list says why: it edited packages/spec/src/data/query.zod.ts, which is inside the package's files allowlist (src/**/*.zod.ts). That half is absent here by ruling: no .zod.ts is edited.

This diff is packages/spec/scripts/** (not in the files allowlist, so nothing published) plus skills/** (shipped by npx skills add from the repo, not from any released package). AGENTS.md: the label "is for a diff that publishes nothing from any released package." Five recent skills-only commits on main carry no changeset. check:empty-changeset and check:changeset-gate-self-tests are green.

Measurements — every gate at head eed6bb0f

Derived with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands from the worktree, no path arguments: 53 commands, all exit 0. Exits captured before any pipe. The load-bearing ones:

gate	exit	verdict line
pnpm --filter @objectstack/spec check:skill-refs	0	✅ 9 generated files in sync with packages/spec
pnpm check:doc-authoring	0	✓ doc authoring guard: 46 published skill files clean — no internal issue-id references.
pnpm --filter @objectstack/spec check:skill-examples	0	✅ 257 prose examples type-check across 3 surface(s)
pnpm --filter @objectstack/spec check:llms-txt	0	✓ packages/spec/llms.txt: 97 claim(s) re-derived
pnpm --filter @objectstack/spec typecheck	0	covers tsc --noEmit + check:scripts-typecheck + check:test-typecheck; tsconfig.scripts.json includes scripts/**/*, so the new lib and its test file are both in a checked program
node scripts/check-skills-token-ratchet.mjs	0	✓ 36 authored bundle file(s) within their ceilings; 11 generator-owned file(s) measured, not ratcheted
pnpm check:pm-skill-ratchet	0	✓ check-skill-line-ratchet: declared cross-file moves: 1, total ceilings down 1 line.
pnpm check:nul-bytes	0	✓ check-nul-bytes --self-test: 75 assertions over a temp git repo
node scripts/check-system-context-census.mjs	0	OK — 106 elevation read sites in 20 packages across 45 files, all anchored
pnpm check:changeset-gate-self-tests	0	✓ check-changeset-no-major --self-test: 116 assertions
pnpm check:watch-hint-literal	0	✓ 49 declaration(s) across 4 rostered name(s) … every one an array
node scripts/pm/bare-root-worklist.mjs --self-test	0	OK self-test: 54 live row(s) … none stale, none missing, none contradicted — the pin that holds this generator's ROOT_DIR_WATCH_HINTS declaration honest
pnpm --filter @objectstack/spec exec vitest run scripts/skill-map-guards.test.ts	0	Test Files 1 passed (1) · Tests 29 passed (29)

Four gates first answered PREREQUISITE NOT MET (exit 3 or a build refusal) and were re-run green after pnpm exec turbo run build over the package closure: check:doc-formula-expressions, check:dual-build-cjs-loads, check:type-check-debt, check:skill-examples.

Reverse verification — each guard driven to red, then restored

Predicted direction: red, with a named refusal. Observed, all three:

mutation	exit	the gate's own line
baseline, unmutated head	0	✅ 9 generated files in sync with packages/spec
data/date-macros.zod.ts put back in the formula entry	1	data/date-macros.zod.ts is in the core list of 2 packages (objectstack-query, objectstack-formula) — one schema file, one owning package.
a non-.zod.ts core entry added	1	objectstack-formula → contracts/plugin-lifecycle-events.ts is not a *.zod.ts path — … emits no pointer row at all
TRANSITIVE_ALLOWLIST keyed on a package the map lacks	1	TRANSITIVE_ALLOWLIST names objectstack-i18nn, which is not a SKILL_MAP package — the list would constrain nothing.

Each mutation was confirmed on disk by counting the injected text before the run, and each restore is git checkout HEAD -- against absolute paths with a trap, proven by an empty git diff HEADand a git hash-object match against the HEAD blob. No build or dist/ is involved: tsx and vitest resolve ./lib/skill-map-guards as a relative source path, with no package exports boundary in between, so the mutated bytes are the bytes that ran.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 460134af85f7ab2cf68abc62f1bbb9783b8899dd → packageMentionDocs.

[os-justin]

Seat review: ACCEPT — review of record on the family anchor #14462 (comment 5537457796), domain:spec seat, 2026-09-04T07:56Z; member pointers on #14466, #14562, #14565.

Governed surface (skills/** regenerated together with its generator — check-governed-merges reads that as governed, not as the pure-regeneration exception) ⇒ this PR stays draft. No agent seat flips it ready, enqueues it, or arms auto-merge; a human merge is the review record. Review requested from os-zhuang and hotlong.

For the human merger, what to read:

• The four regenerated indexes: net −9 lines in skills/**; every added pointer is one the members' rulings named (solution-blueprint, the two automation config schemas); the fourth added line is embedding moving from Core to Transitive in the same file.
• Two deviations from seat rulings, both argued in the body and both accepted by the seat with the reasoning in 5537457796: SHARED_CORE_SCHEMAS (three deliberate cross-package duplicates exist on main, so the flat one-owner rule would red the current map) and stripInternalIssueIds at the catalog boundary (the doc-authoring gate is zero-tolerance on skills/** and baseline-held on content/docs). Either can be overruled here; the flat rule is a three-pointer deletion, the source strip is a .zod.ts edit + changeset + docs regeneration.
• data/field.zod.ts stays in the i18n index on the SelectOptionSchema reasoning; state-machine.zod.ts survives only in objectstack-ai's transitive list, through agent.zod.ts.
• skip-changeset is measured: no .zod.ts edited, packages/spec/scripts/** is outside the package's files allowlist, skills/ is in no package.

CI on eed6bb0f at 07:50Z: 17 completed checks green, the long jobs still running; merge when the required checks report on this head.

---

Generated by Claude Code

[os-justin]

Status (seat, 2026-09-04T08:36Z): approved by os-zhuang at 07:53:09Z on eed6bb0f, marked ready at 07:54Z, and every check on that head is green as of 08:12Z (48 check runs: Lint & Repo Gates, all four Type Check jobs, Test Core ×6, Dogfood ×4, Temporal Conformance, Governed Surface Queue Guard re-run after the approval — all success). The PR is not in the merge queue (git ls-remote origin 'refs/heads/gh-readonly-queue/*' at 08:32Z lists #15073 → #15236 → #15251 → #15257 → #15266). Governed surface: the agent seat does not enqueue or arm auto-merge — os-zhuang / hotlong, enabling auto-merge (squash) puts it in the queue, as was done for #15257.

---

Generated by Claude Code

[os-justin]

Fixes#14462
Fixes#14466
Fixes#14562
Fixes#14565

One family, one branch, one commit per member. The map that decides what nine published skill indexes point at is reconciled against the bodies that own those surfaces, and the generator gains the guards that keep it reconciled.

skills/** is a governed surface: this PR stays draft for a human merge. It is never flipped ready and no auto-merge is armed.

The rulings this implements, quoted where operative

• Anchor, triage 5506970439: "Ruling: narrow the map, add solution-blueprint. ⛔ Do not widen the body." · "This card carries the census — for each of the [SKILL_MAP] entries, the set difference in both directions against what its SKILL.md teaches — and applies the ruling above uniformly." · "whatever reconciliation lands must make a retired schema in the map impossible, not merely corrected once … If deriving the map from a checkable source is out of reach, say so in the PR rather than hand-fixing eleven lists."
• [finding] The objectstack-automation reference index routes to the ADR-0020-retired state-machine.zod.ts and omits both per-node config schemas — SKILL_MAP in build-skill-references.ts #14466, triage 5506975178: drop automation/state-machine.zod.ts; the two per-node config schemas join — "its retired-schema pointer is a distinct defect worth its own line".
• [finding] The objectstack-formula reference index advertises data/date-macros.zod.ts, a surface the SKILL.md routes to objectstack-query — SKILL_MAP in build-skill-references.ts maps it to both #14562, seat ruling 5536681114: drop data/date-macros.zod.ts from the formula entry; a loud one-owner guard with a negative test.
• [finding] The objectstack-i18n reference index routes 5 of its 7 transitive pointers at schemas unreachable from a translation bundle — the closure step in build-skill-references.ts #14565, triage 5514974653: "decide that feasibility question first and say so in the PR body, because it determines whether this is one fix or three." · "⛔ Do not hand-edit _index.md."
• [finding] The objectstack-formula reference index advertises data/date-macros.zod.ts, a surface the SKILL.md routes to objectstack-query — SKILL_MAP in build-skill-references.ts maps it to both #14562, triage 5515135764: "The class has two mechanisms … ⛔ Do not build the SKILL_MAP-only gate and declare the class closed."

No SKILL.md body was widened. No _index.md was hand-edited — every one is the output of pnpm --filter @objectstack/spec gen:skill-refs.

Answer 1 — does one gate cover both mechanisms? No, and they are in the same file

The class has two mechanisms and they get two guards, in one module, packages/spec/scripts/lib/skill-map-guards.ts. checkSingleOwner and checkCoreEntryShape ask questions of the hand-written core list; checkTransitiveAllowlist constrains the closure. Neither would catch the other's defect: objectstack-i18n's core list is correct and its index was still wrong, and no closure rule would have noticed that two packages both claimed date macros.

Answer 2 — is there a checkable source for "retired"? No. Measured, three ways

The design was gated on this, so it was checked rather than assumed:

1. The ADR-0087 registry (packages/spec/src/migrations/entries/retired-defs/, 94 entries) names defs removed at a major version. StateMachine is not there, and correctly so — the def still exists and still parses, through AgentSchema.lifecycle.
2. The file's own header prose.automation/state-machine.zod.ts states the ADR-0020 retirement, and the same header documents the door that survives. A prose grep flags a file that is live surface for another package.
3. "The owning SKILL.md must mention it." This one looked promising and was measured: the string state machineis in skills/objectstack-automation/SKILL.md — the skill's own description names it. A text-mention gate keeps precisely the pointer this PR removes. It is also vacuous in the other direction, since the stems are single common words (tool, view, app, action, page, context) that match any prose.

The retirement that mattered was package-relative: dead surface for automation authoring, live surface for AI authoring — and nothing in the tree expresses a per-package liveness claim. So the answer the triage said it would accept is the answer: no checkable source exists, it is said here rather than hidden, and the guards that DO ship are the mechanical ones, each with negative tests. The judgement stays a judgement, stated out loud in the map.

Answer 3 — the closure step: reachability rule, or a per-package list?

A per-package list. The general rule is not merely unbuilt, it is unbuildable from this input, and the required outcome is the proof.

objectstack-i18n published eight transitive pointers, and seven arrive through one edge: shared/strict-object.ts imports shared/suggestions.zod.ts for its "did you mean?" text, which imports data/field.zod.ts, which drags in filter, expression, field-value, identifiers and value-domain. That is a schema-building helper's implementation, not the authorable shape of a translation bundle.

Cutting traversal through non-shipping helpers is the precise version of the reachability rule. Measured against what the ruling requires:

pointer	required	what the precise rule does	why
data/filter.zod.ts	drop	drops	reached only through the helper
shared/expression.zod.ts	drop	drops	reached only through the helper
data/field-value.zod.ts	drop	drops	reached only through the helper
shared/suggestions.zod.ts	drop	drops	reached only through the helper
kernel/metadata-protection.zod.ts	drop	keeps	a first-class direct import of system/translation.zod.ts
shared/identifiers.zod.ts	keep	drops	nothing imports it; bundle keys ARE those identifiers

The required set puts a depth-4 pointer reached through a helper on the KEEP side and a depth-1 pointer reached through a schema edge on the DROP side. No predicate over the import graph orders those two that way, because the fact that separates them — what a translation bundle can address, by name string — is not in the graph. system/translation.zod.ts does not import shared/identifiers.zod.ts at all.

So: TRANSITIVE_ALLOWLIST, beside SKILL_MAP, opt-in per package. A package that declares nothing publishes its full closure and its index does not move. It is an allowlist, not a denylist, and that is the half that matters: shared/value-domain.zod.ts joined the i18n index recently and unnoticed, when a new import edge appeared several files away — a denylist misses every new arrival by construction.

data/field.zod.ts was left to this PR's judgement and is kept: FieldTranslationSchema.options is keyed by select-option value, the SKILL.md teaches that keying by example (options: { direct_mail: '直邮' } for options: [{ value: 'direct_mail', … }]), and SelectOptionSchema is the declaration those keys must match.

The census — all nine SKILL_MAP entries

The triage said eleven. There are nine, and nine generated indexes: data · query · ai · api · automation · ui · platform · i18n · formula. 59 core entries.

package	advertised, not taught	taught, not advertised	action
objectstack-ai	conversation, mcp, embedding, knowledge-document, usage (3 with zero consumers outside packages/spec)	ai/solution-blueprint.zod.ts — the schema behind the solution_design built-in skill the body's table names	narrowed + added
objectstack-automation	automation/state-machine.zod.ts — ADR-0020 retired it as a record-lifecycle declaration	automation/builtin-node-config.zod.ts, automation/io-node-config.zod.ts	swapped
objectstack-formula	data/date-macros.zod.ts — both bodies route it to objectstack-query	—	dropped
objectstack-i18n	core list correct; 6 of 8 transitive pointers unreachable from a bundle	—	closure constrained
objectstack-api	api/rest-server.zod.ts — zero mentions of the file or any of its six exported config schemas	—	recorded, no edit — filed as #15264
objectstack-platform	kernel/plugin-capability.zod.ts (thin, not wrong — the body teaches requires: but routes to kernel/platform-capabilities.ts)	stack.zod.ts — the body's whole subject is defineStack and names four of its exports	recorded, no edit — filed as #15264
objectstack-data	none	none	none
objectstack-query	none	none	none
objectstack-ui	none	none	none

The two unedited rows are deliberate and the reasoning is on #15264: every row this PR edited came with a measured consumer census or an explicit ADR retirement, and those two have only the sweep. Deleting or adding a published pointer on a governed customer surface is worth its own decision rather than a rider on a PR a reviewer is already checking four things in.

The guards, and what each negative test drives

All in packages/spec/scripts/lib/skill-map-guards.ts; tests in packages/spec/scripts/skill-map-guards.test.ts (29 assertions). They live in lib/ for the reason export-list.ts and file-description.ts do: the generator self-executes on import.

guard	refuses	negative tests
checkSingleOwner	a schema file in two core lists that is not declared in SHARED_CORE_SCHEMAS with a reason; a declaration with an empty reason; a declaration whose sharing has gone	6, incl. a passing map so an always-red guard cannot survive
checkCoreEntryShape	a core entry that is not a *.zod.ts path — today those are dropped from the index silently, with no missing row and a green --check	3
checkTransitiveAllowlist	a package name the map does not have; a file the closure never reaches; a file already in core; a repeat	6
stripInternalIssueIds	(a publication rule, not a guard) internal tracker ids in a published row	8, incl. five shapes that must survive untouched

A second leg reads build-skill-references.ts and asserts each guard is actually called there, and that the allowlist reaches the emit path. A guard nobody calls is green in a unit test and absent from the gate — which is the state the map was already in.

Deviation 1 — the one-owner guard is not the flat rule it was asked for

The #14562 seat ruling asked for "at most one owner" and refused a duplicate-ownership rule, on the stated ground that there would be "zero legitimate instances after this drop". Measured at this PR's base, that ground does not hold.date-macros was one of four duplicates:

file	packages	deliberate?
data/date-macros.zod.ts	query + formula	no — the defect #14562 filed
data/validation.zod.ts	data + automation	yes — a record's transitions are a state_machine validation rule (ADR-0020), the destination that replaced the retired shape
data/datasource.zod.ts	data + platform	yes — already carrying its reason as a comment in the map (project setup (was objectstack-quickstart))
data/seed.zod.ts	data + platform	yes — same comment

The flat rule refuses origin/main's own map on its first run, and the only ways to satisfy it are to delete three pointers no card has adjudicated, or to keep the gate red. So the guard ships in the shape that is enforceable and keeps the ruling's operational demand — the next duplicate refuses at generation time — with the three measured instances declared rather than deleted. Two further guards keep that ledger from becoming a silent allowlist: a row with no reason is refused, and so is a row whose sharing has gone. A reviewer who prefers the literal rule should say so; reverting to it is a three-pointer deletion, not a code change.

Deviation 2 — internal tracker ids are stripped at the catalog boundary, not at the source

Adding automation/io-node-config.zod.ts turned check:doc-authoring red: the generator publishes the first sentence of a module's doc block, and that file's opens with a bare tracker citation. That gate has no per-passage exemption, by design.

Its prescribed remedy is to strip the id at the source and regenerate. That remedy is not taken here, for three specific reasons: the source is a .zod.ts this card is forbidden to edit; it is a file the package publishes, so editing it would change what @objectstack/spec ships and reopen the changeset decision below; and the same sentence is projected to content/docs/references/automation/io-node-config.mdx, which would pull a second generated tree into a diff whose surface is the skill catalog. Three surfaces to remove one token.

The decisive measurement: the gate does not flag that identical sentence on the docs page. The rule is about the skill catalog specifically — skills/** is loaded whole into customer context windows — so the strip is applied at the boundary into that catalog. Every future pointer row is covered rather than this one being corrected once. The criterion is the gate's own, restated with a pin over the shapes that must and must not match (an ordinal, a hex colour, an over-long number, a doubled hash). A reviewer who wants the source edit instead can have it; it needs a changeset and a docs regeneration.

skills/** net line delta: −9 (budget: not more than +6)

4 lines added, 13 removed, across four of the nine indexes.

index	added	removed	net
objectstack-ai	2	5	−3
objectstack-automation	2	1	+1
objectstack-formula	0	1	−1
objectstack-i18n	0	6	−6

Three of the four added lines are the members' named additions: ai/solution-blueprint.zod.ts, automation/builtin-node-config.zod.ts, automation/io-node-config.zod.ts. The fourth is not a new pointer: ai/embedding.zod.ts moves from the Core section to Transitive in the same file, because knowledge-source.zod.ts composes EmbeddingModelSchema — that pointer IS reachable from the authorable face, which is exactly the test the other four narrowed schemas fail. Net published pointers for objectstack-ai: 20 down to 17.

The other five indexes are byte-identical to origin/main.

Changeset: skip-changeset, and why the named precedent points that way

PR #14737 (the "Sort Node" labelling fix on this same generator, landed 2026-09-03) carried a patch changeset — and its file list says why: it edited packages/spec/src/data/query.zod.ts, which is inside the package's files allowlist (src/**/*.zod.ts). That half is absent here by ruling: no .zod.ts is edited.

This diff is packages/spec/scripts/** (not in the files allowlist, so nothing published) plus skills/** (shipped by npx skills add from the repo, not from any released package). AGENTS.md: the label "is for a diff that publishes nothing from any released package." Five recent skills-only commits on main carry no changeset. check:empty-changeset and check:changeset-gate-self-tests are green.

Measurements — every gate at head eed6bb0f

Derived with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands from the worktree, no path arguments: 53 commands, all exit 0. Exits captured before any pipe. The load-bearing ones:

gate	exit	verdict line
pnpm --filter @objectstack/spec check:skill-refs	0	✅ 9 generated files in sync with packages/spec
pnpm check:doc-authoring	0	✓ doc authoring guard: 46 published skill files clean — no internal issue-id references.
pnpm --filter @objectstack/spec check:skill-examples	0	✅ 257 prose examples type-check across 3 surface(s)
pnpm --filter @objectstack/spec check:llms-txt	0	✓ packages/spec/llms.txt: 97 claim(s) re-derived
pnpm --filter @objectstack/spec typecheck	0	covers tsc --noEmit + check:scripts-typecheck + check:test-typecheck; tsconfig.scripts.json includes scripts/**/*, so the new lib and its test file are both in a checked program
node scripts/check-skills-token-ratchet.mjs	0	✓ 36 authored bundle file(s) within their ceilings; 11 generator-owned file(s) measured, not ratcheted
pnpm check:pm-skill-ratchet	0	✓ check-skill-line-ratchet: declared cross-file moves: 1, total ceilings down 1 line.
pnpm check:nul-bytes	0	✓ check-nul-bytes --self-test: 75 assertions over a temp git repo
node scripts/check-system-context-census.mjs	0	OK — 106 elevation read sites in 20 packages across 45 files, all anchored
pnpm check:changeset-gate-self-tests	0	✓ check-changeset-no-major --self-test: 116 assertions
pnpm check:watch-hint-literal	0	✓ 49 declaration(s) across 4 rostered name(s) … every one an array
node scripts/pm/bare-root-worklist.mjs --self-test	0	OK self-test: 54 live row(s) … none stale, none missing, none contradicted — the pin that holds this generator's ROOT_DIR_WATCH_HINTS declaration honest
pnpm --filter @objectstack/spec exec vitest run scripts/skill-map-guards.test.ts	0	Test Files 1 passed (1) · Tests 29 passed (29)

Four gates first answered PREREQUISITE NOT MET (exit 3 or a build refusal) and were re-run green after pnpm exec turbo run build over the package closure: check:doc-formula-expressions, check:dual-build-cjs-loads, check:type-check-debt, check:skill-examples.

Reverse verification — each guard driven to red, then restored

Predicted direction: red, with a named refusal. Observed, all three:

mutation	exit	the gate's own line
baseline, unmutated head	0	✅ 9 generated files in sync with packages/spec
data/date-macros.zod.ts put back in the formula entry	1	data/date-macros.zod.ts is in the core list of 2 packages (objectstack-query, objectstack-formula) — one schema file, one owning package.
a non-.zod.ts core entry added	1	objectstack-formula → contracts/plugin-lifecycle-events.ts is not a *.zod.ts path — … emits no pointer row at all
TRANSITIVE_ALLOWLIST keyed on a package the map lacks	1	TRANSITIVE_ALLOWLIST names objectstack-i18nn, which is not a SKILL_MAP package — the list would constrain nothing.

Each mutation was confirmed on disk by counting the injected text before the run, and each restore is git checkout HEAD -- against absolute paths with a trap, proven by an empty git diff HEADand a git hash-object match against the HEAD blob. No build or dist/ is involved: tsx and vitest resolve ./lib/skill-map-guards as a relative source path, with no package exports boundary in between, so the mutated bytes are the bytes that ran.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 460134af85f7ab2cf68abc62f1bbb9783b8899dd → packageMentionDocs.

[os-justin]

Seat review: ACCEPT — review of record on the family anchor #14462 (comment 5537457796), domain:spec seat, 2026-09-04T07:56Z; member pointers on #14466, #14562, #14565.

Governed surface (skills/** regenerated together with its generator — check-governed-merges reads that as governed, not as the pure-regeneration exception) ⇒ this PR stays draft. No agent seat flips it ready, enqueues it, or arms auto-merge; a human merge is the review record. Review requested from os-zhuang and hotlong.

For the human merger, what to read:

• The four regenerated indexes: net −9 lines in skills/**; every added pointer is one the members' rulings named (solution-blueprint, the two automation config schemas); the fourth added line is embedding moving from Core to Transitive in the same file.
• Two deviations from seat rulings, both argued in the body and both accepted by the seat with the reasoning in 5537457796: SHARED_CORE_SCHEMAS (three deliberate cross-package duplicates exist on main, so the flat one-owner rule would red the current map) and stripInternalIssueIds at the catalog boundary (the doc-authoring gate is zero-tolerance on skills/** and baseline-held on content/docs). Either can be overruled here; the flat rule is a three-pointer deletion, the source strip is a .zod.ts edit + changeset + docs regeneration.
• data/field.zod.ts stays in the i18n index on the SelectOptionSchema reasoning; state-machine.zod.ts survives only in objectstack-ai's transitive list, through agent.zod.ts.
• skip-changeset is measured: no .zod.ts edited, packages/spec/scripts/** is outside the package's files allowlist, skills/ is in no package.

CI on eed6bb0f at 07:50Z: 17 completed checks green, the long jobs still running; merge when the required checks report on this head.

---

Generated by Claude Code

[os-justin]

Status (seat, 2026-09-04T08:36Z): approved by os-zhuang at 07:53:09Z on eed6bb0f, marked ready at 07:54Z, and every check on that head is green as of 08:12Z (48 check runs: Lint & Repo Gates, all four Type Check jobs, Test Core ×6, Dogfood ×4, Temporal Conformance, Governed Surface Queue Guard re-run after the approval — all success). The PR is not in the merge queue (git ls-remote origin 'refs/heads/gh-readonly-queue/*' at 08:32Z lists #15073 → #15236 → #15251 → #15257 → #15266). Governed surface: the agent seat does not enqueue or arm auto-merge — os-zhuang / hotlong, enabling auto-merge (squash) puts it in the queue, as was done for #15257.

---

Generated by Claude Code

[os-justin]

Fixes#14462
Fixes#14466
Fixes#14562
Fixes#14565

One family, one branch, one commit per member. The map that decides what nine published skill indexes point at is reconciled against the bodies that own those surfaces, and the generator gains the guards that keep it reconciled.

skills/** is a governed surface: this PR stays draft for a human merge. It is never flipped ready and no auto-merge is armed.

The rulings this implements, quoted where operative

• Anchor, triage 5506970439: "Ruling: narrow the map, add solution-blueprint. ⛔ Do not widen the body." · "This card carries the census — for each of the [SKILL_MAP] entries, the set difference in both directions against what its SKILL.md teaches — and applies the ruling above uniformly." · "whatever reconciliation lands must make a retired schema in the map impossible, not merely corrected once … If deriving the map from a checkable source is out of reach, say so in the PR rather than hand-fixing eleven lists."
• [finding] The objectstack-automation reference index routes to the ADR-0020-retired state-machine.zod.ts and omits both per-node config schemas — SKILL_MAP in build-skill-references.ts #14466, triage 5506975178: drop automation/state-machine.zod.ts; the two per-node config schemas join — "its retired-schema pointer is a distinct defect worth its own line".
• [finding] The objectstack-formula reference index advertises data/date-macros.zod.ts, a surface the SKILL.md routes to objectstack-query — SKILL_MAP in build-skill-references.ts maps it to both #14562, seat ruling 5536681114: drop data/date-macros.zod.ts from the formula entry; a loud one-owner guard with a negative test.
• [finding] The objectstack-i18n reference index routes 5 of its 7 transitive pointers at schemas unreachable from a translation bundle — the closure step in build-skill-references.ts #14565, triage 5514974653: "decide that feasibility question first and say so in the PR body, because it determines whether this is one fix or three." · "⛔ Do not hand-edit _index.md."
• [finding] The objectstack-formula reference index advertises data/date-macros.zod.ts, a surface the SKILL.md routes to objectstack-query — SKILL_MAP in build-skill-references.ts maps it to both #14562, triage 5515135764: "The class has two mechanisms … ⛔ Do not build the SKILL_MAP-only gate and declare the class closed."

No SKILL.md body was widened. No _index.md was hand-edited — every one is the output of pnpm --filter @objectstack/spec gen:skill-refs.

Answer 1 — does one gate cover both mechanisms? No, and they are in the same file

The class has two mechanisms and they get two guards, in one module, packages/spec/scripts/lib/skill-map-guards.ts. checkSingleOwner and checkCoreEntryShape ask questions of the hand-written core list; checkTransitiveAllowlist constrains the closure. Neither would catch the other's defect: objectstack-i18n's core list is correct and its index was still wrong, and no closure rule would have noticed that two packages both claimed date macros.

Answer 2 — is there a checkable source for "retired"? No. Measured, three ways

The design was gated on this, so it was checked rather than assumed:

1. The ADR-0087 registry (packages/spec/src/migrations/entries/retired-defs/, 94 entries) names defs removed at a major version. StateMachine is not there, and correctly so — the def still exists and still parses, through AgentSchema.lifecycle.
2. The file's own header prose.automation/state-machine.zod.ts states the ADR-0020 retirement, and the same header documents the door that survives. A prose grep flags a file that is live surface for another package.
3. "The owning SKILL.md must mention it." This one looked promising and was measured: the string state machineis in skills/objectstack-automation/SKILL.md — the skill's own description names it. A text-mention gate keeps precisely the pointer this PR removes. It is also vacuous in the other direction, since the stems are single common words (tool, view, app, action, page, context) that match any prose.

The retirement that mattered was package-relative: dead surface for automation authoring, live surface for AI authoring — and nothing in the tree expresses a per-package liveness claim. So the answer the triage said it would accept is the answer: no checkable source exists, it is said here rather than hidden, and the guards that DO ship are the mechanical ones, each with negative tests. The judgement stays a judgement, stated out loud in the map.

Answer 3 — the closure step: reachability rule, or a per-package list?

A per-package list. The general rule is not merely unbuilt, it is unbuildable from this input, and the required outcome is the proof.

objectstack-i18n published eight transitive pointers, and seven arrive through one edge: shared/strict-object.ts imports shared/suggestions.zod.ts for its "did you mean?" text, which imports data/field.zod.ts, which drags in filter, expression, field-value, identifiers and value-domain. That is a schema-building helper's implementation, not the authorable shape of a translation bundle.

Cutting traversal through non-shipping helpers is the precise version of the reachability rule. Measured against what the ruling requires:

pointer	required	what the precise rule does	why
data/filter.zod.ts	drop	drops	reached only through the helper
shared/expression.zod.ts	drop	drops	reached only through the helper
data/field-value.zod.ts	drop	drops	reached only through the helper
shared/suggestions.zod.ts	drop	drops	reached only through the helper
kernel/metadata-protection.zod.ts	drop	keeps	a first-class direct import of system/translation.zod.ts
shared/identifiers.zod.ts	keep	drops	nothing imports it; bundle keys ARE those identifiers

The required set puts a depth-4 pointer reached through a helper on the KEEP side and a depth-1 pointer reached through a schema edge on the DROP side. No predicate over the import graph orders those two that way, because the fact that separates them — what a translation bundle can address, by name string — is not in the graph. system/translation.zod.ts does not import shared/identifiers.zod.ts at all.

So: TRANSITIVE_ALLOWLIST, beside SKILL_MAP, opt-in per package. A package that declares nothing publishes its full closure and its index does not move. It is an allowlist, not a denylist, and that is the half that matters: shared/value-domain.zod.ts joined the i18n index recently and unnoticed, when a new import edge appeared several files away — a denylist misses every new arrival by construction.

data/field.zod.ts was left to this PR's judgement and is kept: FieldTranslationSchema.options is keyed by select-option value, the SKILL.md teaches that keying by example (options: { direct_mail: '直邮' } for options: [{ value: 'direct_mail', … }]), and SelectOptionSchema is the declaration those keys must match.

The census — all nine SKILL_MAP entries

The triage said eleven. There are nine, and nine generated indexes: data · query · ai · api · automation · ui · platform · i18n · formula. 59 core entries.

package	advertised, not taught	taught, not advertised	action
objectstack-ai	conversation, mcp, embedding, knowledge-document, usage (3 with zero consumers outside packages/spec)	ai/solution-blueprint.zod.ts — the schema behind the solution_design built-in skill the body's table names	narrowed + added
objectstack-automation	automation/state-machine.zod.ts — ADR-0020 retired it as a record-lifecycle declaration	automation/builtin-node-config.zod.ts, automation/io-node-config.zod.ts	swapped
objectstack-formula	data/date-macros.zod.ts — both bodies route it to objectstack-query	—	dropped
objectstack-i18n	core list correct; 6 of 8 transitive pointers unreachable from a bundle	—	closure constrained
objectstack-api	api/rest-server.zod.ts — zero mentions of the file or any of its six exported config schemas	—	recorded, no edit — filed as #15264
objectstack-platform	kernel/plugin-capability.zod.ts (thin, not wrong — the body teaches requires: but routes to kernel/platform-capabilities.ts)	stack.zod.ts — the body's whole subject is defineStack and names four of its exports	recorded, no edit — filed as #15264
objectstack-data	none	none	none
objectstack-query	none	none	none
objectstack-ui	none	none	none

The two unedited rows are deliberate and the reasoning is on #15264: every row this PR edited came with a measured consumer census or an explicit ADR retirement, and those two have only the sweep. Deleting or adding a published pointer on a governed customer surface is worth its own decision rather than a rider on a PR a reviewer is already checking four things in.

The guards, and what each negative test drives

All in packages/spec/scripts/lib/skill-map-guards.ts; tests in packages/spec/scripts/skill-map-guards.test.ts (29 assertions). They live in lib/ for the reason export-list.ts and file-description.ts do: the generator self-executes on import.

guard	refuses	negative tests
checkSingleOwner	a schema file in two core lists that is not declared in SHARED_CORE_SCHEMAS with a reason; a declaration with an empty reason; a declaration whose sharing has gone	6, incl. a passing map so an always-red guard cannot survive
checkCoreEntryShape	a core entry that is not a *.zod.ts path — today those are dropped from the index silently, with no missing row and a green --check	3
checkTransitiveAllowlist	a package name the map does not have; a file the closure never reaches; a file already in core; a repeat	6
stripInternalIssueIds	(a publication rule, not a guard) internal tracker ids in a published row	8, incl. five shapes that must survive untouched

A second leg reads build-skill-references.ts and asserts each guard is actually called there, and that the allowlist reaches the emit path. A guard nobody calls is green in a unit test and absent from the gate — which is the state the map was already in.

Deviation 1 — the one-owner guard is not the flat rule it was asked for

The #14562 seat ruling asked for "at most one owner" and refused a duplicate-ownership rule, on the stated ground that there would be "zero legitimate instances after this drop". Measured at this PR's base, that ground does not hold.date-macros was one of four duplicates:

file	packages	deliberate?
data/date-macros.zod.ts	query + formula	no — the defect #14562 filed
data/validation.zod.ts	data + automation	yes — a record's transitions are a state_machine validation rule (ADR-0020), the destination that replaced the retired shape
data/datasource.zod.ts	data + platform	yes — already carrying its reason as a comment in the map (project setup (was objectstack-quickstart))
data/seed.zod.ts	data + platform	yes — same comment

The flat rule refuses origin/main's own map on its first run, and the only ways to satisfy it are to delete three pointers no card has adjudicated, or to keep the gate red. So the guard ships in the shape that is enforceable and keeps the ruling's operational demand — the next duplicate refuses at generation time — with the three measured instances declared rather than deleted. Two further guards keep that ledger from becoming a silent allowlist: a row with no reason is refused, and so is a row whose sharing has gone. A reviewer who prefers the literal rule should say so; reverting to it is a three-pointer deletion, not a code change.

Deviation 2 — internal tracker ids are stripped at the catalog boundary, not at the source

Adding automation/io-node-config.zod.ts turned check:doc-authoring red: the generator publishes the first sentence of a module's doc block, and that file's opens with a bare tracker citation. That gate has no per-passage exemption, by design.

Its prescribed remedy is to strip the id at the source and regenerate. That remedy is not taken here, for three specific reasons: the source is a .zod.ts this card is forbidden to edit; it is a file the package publishes, so editing it would change what @objectstack/spec ships and reopen the changeset decision below; and the same sentence is projected to content/docs/references/automation/io-node-config.mdx, which would pull a second generated tree into a diff whose surface is the skill catalog. Three surfaces to remove one token.

The decisive measurement: the gate does not flag that identical sentence on the docs page. The rule is about the skill catalog specifically — skills/** is loaded whole into customer context windows — so the strip is applied at the boundary into that catalog. Every future pointer row is covered rather than this one being corrected once. The criterion is the gate's own, restated with a pin over the shapes that must and must not match (an ordinal, a hex colour, an over-long number, a doubled hash). A reviewer who wants the source edit instead can have it; it needs a changeset and a docs regeneration.

skills/** net line delta: −9 (budget: not more than +6)

4 lines added, 13 removed, across four of the nine indexes.

index	added	removed	net
objectstack-ai	2	5	−3
objectstack-automation	2	1	+1
objectstack-formula	0	1	−1
objectstack-i18n	0	6	−6

Three of the four added lines are the members' named additions: ai/solution-blueprint.zod.ts, automation/builtin-node-config.zod.ts, automation/io-node-config.zod.ts. The fourth is not a new pointer: ai/embedding.zod.ts moves from the Core section to Transitive in the same file, because knowledge-source.zod.ts composes EmbeddingModelSchema — that pointer IS reachable from the authorable face, which is exactly the test the other four narrowed schemas fail. Net published pointers for objectstack-ai: 20 down to 17.

The other five indexes are byte-identical to origin/main.

Changeset: skip-changeset, and why the named precedent points that way

PR #14737 (the "Sort Node" labelling fix on this same generator, landed 2026-09-03) carried a patch changeset — and its file list says why: it edited packages/spec/src/data/query.zod.ts, which is inside the package's files allowlist (src/**/*.zod.ts). That half is absent here by ruling: no .zod.ts is edited.

This diff is packages/spec/scripts/** (not in the files allowlist, so nothing published) plus skills/** (shipped by npx skills add from the repo, not from any released package). AGENTS.md: the label "is for a diff that publishes nothing from any released package." Five recent skills-only commits on main carry no changeset. check:empty-changeset and check:changeset-gate-self-tests are green.

Measurements — every gate at head eed6bb0f

Derived with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands from the worktree, no path arguments: 53 commands, all exit 0. Exits captured before any pipe. The load-bearing ones:

gate	exit	verdict line
pnpm --filter @objectstack/spec check:skill-refs	0	✅ 9 generated files in sync with packages/spec
pnpm check:doc-authoring	0	✓ doc authoring guard: 46 published skill files clean — no internal issue-id references.
pnpm --filter @objectstack/spec check:skill-examples	0	✅ 257 prose examples type-check across 3 surface(s)
pnpm --filter @objectstack/spec check:llms-txt	0	✓ packages/spec/llms.txt: 97 claim(s) re-derived
pnpm --filter @objectstack/spec typecheck	0	covers tsc --noEmit + check:scripts-typecheck + check:test-typecheck; tsconfig.scripts.json includes scripts/**/*, so the new lib and its test file are both in a checked program
node scripts/check-skills-token-ratchet.mjs	0	✓ 36 authored bundle file(s) within their ceilings; 11 generator-owned file(s) measured, not ratcheted
pnpm check:pm-skill-ratchet	0	✓ check-skill-line-ratchet: declared cross-file moves: 1, total ceilings down 1 line.
pnpm check:nul-bytes	0	✓ check-nul-bytes --self-test: 75 assertions over a temp git repo
node scripts/check-system-context-census.mjs	0	OK — 106 elevation read sites in 20 packages across 45 files, all anchored
pnpm check:changeset-gate-self-tests	0	✓ check-changeset-no-major --self-test: 116 assertions
pnpm check:watch-hint-literal	0	✓ 49 declaration(s) across 4 rostered name(s) … every one an array
node scripts/pm/bare-root-worklist.mjs --self-test	0	OK self-test: 54 live row(s) … none stale, none missing, none contradicted — the pin that holds this generator's ROOT_DIR_WATCH_HINTS declaration honest
pnpm --filter @objectstack/spec exec vitest run scripts/skill-map-guards.test.ts	0	Test Files 1 passed (1) · Tests 29 passed (29)

Four gates first answered PREREQUISITE NOT MET (exit 3 or a build refusal) and were re-run green after pnpm exec turbo run build over the package closure: check:doc-formula-expressions, check:dual-build-cjs-loads, check:type-check-debt, check:skill-examples.

Reverse verification — each guard driven to red, then restored

Predicted direction: red, with a named refusal. Observed, all three:

mutation	exit	the gate's own line
baseline, unmutated head	0	✅ 9 generated files in sync with packages/spec
data/date-macros.zod.ts put back in the formula entry	1	data/date-macros.zod.ts is in the core list of 2 packages (objectstack-query, objectstack-formula) — one schema file, one owning package.
a non-.zod.ts core entry added	1	objectstack-formula → contracts/plugin-lifecycle-events.ts is not a *.zod.ts path — … emits no pointer row at all
TRANSITIVE_ALLOWLIST keyed on a package the map lacks	1	TRANSITIVE_ALLOWLIST names objectstack-i18nn, which is not a SKILL_MAP package — the list would constrain nothing.

Each mutation was confirmed on disk by counting the injected text before the run, and each restore is git checkout HEAD -- against absolute paths with a trap, proven by an empty git diff HEADand a git hash-object match against the HEAD blob. No build or dist/ is involved: tsx and vitest resolve ./lib/skill-map-guards as a relative source path, with no package exports boundary in between, so the mutated bytes are the bytes that ran.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 460134af85f7ab2cf68abc62f1bbb9783b8899dd → packageMentionDocs.

[os-justin]

Seat review: ACCEPT — review of record on the family anchor #14462 (comment 5537457796), domain:spec seat, 2026-09-04T07:56Z; member pointers on #14466, #14562, #14565.

Governed surface (skills/** regenerated together with its generator — check-governed-merges reads that as governed, not as the pure-regeneration exception) ⇒ this PR stays draft. No agent seat flips it ready, enqueues it, or arms auto-merge; a human merge is the review record. Review requested from os-zhuang and hotlong.

For the human merger, what to read:

• The four regenerated indexes: net −9 lines in skills/**; every added pointer is one the members' rulings named (solution-blueprint, the two automation config schemas); the fourth added line is embedding moving from Core to Transitive in the same file.
• Two deviations from seat rulings, both argued in the body and both accepted by the seat with the reasoning in 5537457796: SHARED_CORE_SCHEMAS (three deliberate cross-package duplicates exist on main, so the flat one-owner rule would red the current map) and stripInternalIssueIds at the catalog boundary (the doc-authoring gate is zero-tolerance on skills/** and baseline-held on content/docs). Either can be overruled here; the flat rule is a three-pointer deletion, the source strip is a .zod.ts edit + changeset + docs regeneration.
• data/field.zod.ts stays in the i18n index on the SelectOptionSchema reasoning; state-machine.zod.ts survives only in objectstack-ai's transitive list, through agent.zod.ts.
• skip-changeset is measured: no .zod.ts edited, packages/spec/scripts/** is outside the package's files allowlist, skills/ is in no package.

CI on eed6bb0f at 07:50Z: 17 completed checks green, the long jobs still running; merge when the required checks report on this head.

---

Generated by Claude Code

[os-justin]

Status (seat, 2026-09-04T08:36Z): approved by os-zhuang at 07:53:09Z on eed6bb0f, marked ready at 07:54Z, and every check on that head is green as of 08:12Z (48 check runs: Lint & Repo Gates, all four Type Check jobs, Test Core ×6, Dogfood ×4, Temporal Conformance, Governed Surface Queue Guard re-run after the approval — all success). The PR is not in the merge queue (git ls-remote origin 'refs/heads/gh-readonly-queue/*' at 08:32Z lists #15073 → #15236 → #15251 → #15257 → #15266). Governed surface: the agent seat does not enqueue or arm auto-merge — os-zhuang / hotlong, enabling auto-merge (squash) puts it in the queue, as was done for #15257.

---

Generated by Claude Code

[os-justin]

Fixes#14462
Fixes#14466
Fixes#14562
Fixes#14565

One family, one branch, one commit per member. The map that decides what nine published skill indexes point at is reconciled against the bodies that own those surfaces, and the generator gains the guards that keep it reconciled.

skills/** is a governed surface: this PR stays draft for a human merge. It is never flipped ready and no auto-merge is armed.

The rulings this implements, quoted where operative

• Anchor, triage 5506970439: "Ruling: narrow the map, add solution-blueprint. ⛔ Do not widen the body." · "This card carries the census — for each of the [SKILL_MAP] entries, the set difference in both directions against what its SKILL.md teaches — and applies the ruling above uniformly." · "whatever reconciliation lands must make a retired schema in the map impossible, not merely corrected once … If deriving the map from a checkable source is out of reach, say so in the PR rather than hand-fixing eleven lists."
• [finding] The objectstack-automation reference index routes to the ADR-0020-retired state-machine.zod.ts and omits both per-node config schemas — SKILL_MAP in build-skill-references.ts #14466, triage 5506975178: drop automation/state-machine.zod.ts; the two per-node config schemas join — "its retired-schema pointer is a distinct defect worth its own line".
• [finding] The objectstack-formula reference index advertises data/date-macros.zod.ts, a surface the SKILL.md routes to objectstack-query — SKILL_MAP in build-skill-references.ts maps it to both #14562, seat ruling 5536681114: drop data/date-macros.zod.ts from the formula entry; a loud one-owner guard with a negative test.
• [finding] The objectstack-i18n reference index routes 5 of its 7 transitive pointers at schemas unreachable from a translation bundle — the closure step in build-skill-references.ts #14565, triage 5514974653: "decide that feasibility question first and say so in the PR body, because it determines whether this is one fix or three." · "⛔ Do not hand-edit _index.md."
• [finding] The objectstack-formula reference index advertises data/date-macros.zod.ts, a surface the SKILL.md routes to objectstack-query — SKILL_MAP in build-skill-references.ts maps it to both #14562, triage 5515135764: "The class has two mechanisms … ⛔ Do not build the SKILL_MAP-only gate and declare the class closed."

No SKILL.md body was widened. No _index.md was hand-edited — every one is the output of pnpm --filter @objectstack/spec gen:skill-refs.

Answer 1 — does one gate cover both mechanisms? No, and they are in the same file

The class has two mechanisms and they get two guards, in one module, packages/spec/scripts/lib/skill-map-guards.ts. checkSingleOwner and checkCoreEntryShape ask questions of the hand-written core list; checkTransitiveAllowlist constrains the closure. Neither would catch the other's defect: objectstack-i18n's core list is correct and its index was still wrong, and no closure rule would have noticed that two packages both claimed date macros.

Answer 2 — is there a checkable source for "retired"? No. Measured, three ways

The design was gated on this, so it was checked rather than assumed:

1. The ADR-0087 registry (packages/spec/src/migrations/entries/retired-defs/, 94 entries) names defs removed at a major version. StateMachine is not there, and correctly so — the def still exists and still parses, through AgentSchema.lifecycle.
2. The file's own header prose.automation/state-machine.zod.ts states the ADR-0020 retirement, and the same header documents the door that survives. A prose grep flags a file that is live surface for another package.
3. "The owning SKILL.md must mention it." This one looked promising and was measured: the string state machineis in skills/objectstack-automation/SKILL.md — the skill's own description names it. A text-mention gate keeps precisely the pointer this PR removes. It is also vacuous in the other direction, since the stems are single common words (tool, view, app, action, page, context) that match any prose.

The retirement that mattered was package-relative: dead surface for automation authoring, live surface for AI authoring — and nothing in the tree expresses a per-package liveness claim. So the answer the triage said it would accept is the answer: no checkable source exists, it is said here rather than hidden, and the guards that DO ship are the mechanical ones, each with negative tests. The judgement stays a judgement, stated out loud in the map.

Answer 3 — the closure step: reachability rule, or a per-package list?

A per-package list. The general rule is not merely unbuilt, it is unbuildable from this input, and the required outcome is the proof.

objectstack-i18n published eight transitive pointers, and seven arrive through one edge: shared/strict-object.ts imports shared/suggestions.zod.ts for its "did you mean?" text, which imports data/field.zod.ts, which drags in filter, expression, field-value, identifiers and value-domain. That is a schema-building helper's implementation, not the authorable shape of a translation bundle.

Cutting traversal through non-shipping helpers is the precise version of the reachability rule. Measured against what the ruling requires:

pointer	required	what the precise rule does	why
data/filter.zod.ts	drop	drops	reached only through the helper
shared/expression.zod.ts	drop	drops	reached only through the helper
data/field-value.zod.ts	drop	drops	reached only through the helper
shared/suggestions.zod.ts	drop	drops	reached only through the helper
kernel/metadata-protection.zod.ts	drop	keeps	a first-class direct import of system/translation.zod.ts
shared/identifiers.zod.ts	keep	drops	nothing imports it; bundle keys ARE those identifiers

The required set puts a depth-4 pointer reached through a helper on the KEEP side and a depth-1 pointer reached through a schema edge on the DROP side. No predicate over the import graph orders those two that way, because the fact that separates them — what a translation bundle can address, by name string — is not in the graph. system/translation.zod.ts does not import shared/identifiers.zod.ts at all.

So: TRANSITIVE_ALLOWLIST, beside SKILL_MAP, opt-in per package. A package that declares nothing publishes its full closure and its index does not move. It is an allowlist, not a denylist, and that is the half that matters: shared/value-domain.zod.ts joined the i18n index recently and unnoticed, when a new import edge appeared several files away — a denylist misses every new arrival by construction.

data/field.zod.ts was left to this PR's judgement and is kept: FieldTranslationSchema.options is keyed by select-option value, the SKILL.md teaches that keying by example (options: { direct_mail: '直邮' } for options: [{ value: 'direct_mail', … }]), and SelectOptionSchema is the declaration those keys must match.

The census — all nine SKILL_MAP entries

The triage said eleven. There are nine, and nine generated indexes: data · query · ai · api · automation · ui · platform · i18n · formula. 59 core entries.

package	advertised, not taught	taught, not advertised	action
objectstack-ai	conversation, mcp, embedding, knowledge-document, usage (3 with zero consumers outside packages/spec)	ai/solution-blueprint.zod.ts — the schema behind the solution_design built-in skill the body's table names	narrowed + added
objectstack-automation	automation/state-machine.zod.ts — ADR-0020 retired it as a record-lifecycle declaration	automation/builtin-node-config.zod.ts, automation/io-node-config.zod.ts	swapped
objectstack-formula	data/date-macros.zod.ts — both bodies route it to objectstack-query	—	dropped
objectstack-i18n	core list correct; 6 of 8 transitive pointers unreachable from a bundle	—	closure constrained
objectstack-api	api/rest-server.zod.ts — zero mentions of the file or any of its six exported config schemas	—	recorded, no edit — filed as #15264
objectstack-platform	kernel/plugin-capability.zod.ts (thin, not wrong — the body teaches requires: but routes to kernel/platform-capabilities.ts)	stack.zod.ts — the body's whole subject is defineStack and names four of its exports	recorded, no edit — filed as #15264
objectstack-data	none	none	none
objectstack-query	none	none	none
objectstack-ui	none	none	none

The two unedited rows are deliberate and the reasoning is on #15264: every row this PR edited came with a measured consumer census or an explicit ADR retirement, and those two have only the sweep. Deleting or adding a published pointer on a governed customer surface is worth its own decision rather than a rider on a PR a reviewer is already checking four things in.

The guards, and what each negative test drives

All in packages/spec/scripts/lib/skill-map-guards.ts; tests in packages/spec/scripts/skill-map-guards.test.ts (29 assertions). They live in lib/ for the reason export-list.ts and file-description.ts do: the generator self-executes on import.

guard	refuses	negative tests
checkSingleOwner	a schema file in two core lists that is not declared in SHARED_CORE_SCHEMAS with a reason; a declaration with an empty reason; a declaration whose sharing has gone	6, incl. a passing map so an always-red guard cannot survive
checkCoreEntryShape	a core entry that is not a *.zod.ts path — today those are dropped from the index silently, with no missing row and a green --check	3
checkTransitiveAllowlist	a package name the map does not have; a file the closure never reaches; a file already in core; a repeat	6
stripInternalIssueIds	(a publication rule, not a guard) internal tracker ids in a published row	8, incl. five shapes that must survive untouched

A second leg reads build-skill-references.ts and asserts each guard is actually called there, and that the allowlist reaches the emit path. A guard nobody calls is green in a unit test and absent from the gate — which is the state the map was already in.

Deviation 1 — the one-owner guard is not the flat rule it was asked for

The #14562 seat ruling asked for "at most one owner" and refused a duplicate-ownership rule, on the stated ground that there would be "zero legitimate instances after this drop". Measured at this PR's base, that ground does not hold.date-macros was one of four duplicates:

file	packages	deliberate?
data/date-macros.zod.ts	query + formula	no — the defect #14562 filed
data/validation.zod.ts	data + automation	yes — a record's transitions are a state_machine validation rule (ADR-0020), the destination that replaced the retired shape
data/datasource.zod.ts	data + platform	yes — already carrying its reason as a comment in the map (project setup (was objectstack-quickstart))
data/seed.zod.ts	data + platform	yes — same comment

The flat rule refuses origin/main's own map on its first run, and the only ways to satisfy it are to delete three pointers no card has adjudicated, or to keep the gate red. So the guard ships in the shape that is enforceable and keeps the ruling's operational demand — the next duplicate refuses at generation time — with the three measured instances declared rather than deleted. Two further guards keep that ledger from becoming a silent allowlist: a row with no reason is refused, and so is a row whose sharing has gone. A reviewer who prefers the literal rule should say so; reverting to it is a three-pointer deletion, not a code change.

Deviation 2 — internal tracker ids are stripped at the catalog boundary, not at the source

Adding automation/io-node-config.zod.ts turned check:doc-authoring red: the generator publishes the first sentence of a module's doc block, and that file's opens with a bare tracker citation. That gate has no per-passage exemption, by design.

Its prescribed remedy is to strip the id at the source and regenerate. That remedy is not taken here, for three specific reasons: the source is a .zod.ts this card is forbidden to edit; it is a file the package publishes, so editing it would change what @objectstack/spec ships and reopen the changeset decision below; and the same sentence is projected to content/docs/references/automation/io-node-config.mdx, which would pull a second generated tree into a diff whose surface is the skill catalog. Three surfaces to remove one token.

The decisive measurement: the gate does not flag that identical sentence on the docs page. The rule is about the skill catalog specifically — skills/** is loaded whole into customer context windows — so the strip is applied at the boundary into that catalog. Every future pointer row is covered rather than this one being corrected once. The criterion is the gate's own, restated with a pin over the shapes that must and must not match (an ordinal, a hex colour, an over-long number, a doubled hash). A reviewer who wants the source edit instead can have it; it needs a changeset and a docs regeneration.

skills/** net line delta: −9 (budget: not more than +6)

4 lines added, 13 removed, across four of the nine indexes.

index	added	removed	net
objectstack-ai	2	5	−3
objectstack-automation	2	1	+1
objectstack-formula	0	1	−1
objectstack-i18n	0	6	−6

Three of the four added lines are the members' named additions: ai/solution-blueprint.zod.ts, automation/builtin-node-config.zod.ts, automation/io-node-config.zod.ts. The fourth is not a new pointer: ai/embedding.zod.ts moves from the Core section to Transitive in the same file, because knowledge-source.zod.ts composes EmbeddingModelSchema — that pointer IS reachable from the authorable face, which is exactly the test the other four narrowed schemas fail. Net published pointers for objectstack-ai: 20 down to 17.

The other five indexes are byte-identical to origin/main.

Changeset: skip-changeset, and why the named precedent points that way

PR #14737 (the "Sort Node" labelling fix on this same generator, landed 2026-09-03) carried a patch changeset — and its file list says why: it edited packages/spec/src/data/query.zod.ts, which is inside the package's files allowlist (src/**/*.zod.ts). That half is absent here by ruling: no .zod.ts is edited.

This diff is packages/spec/scripts/** (not in the files allowlist, so nothing published) plus skills/** (shipped by npx skills add from the repo, not from any released package). AGENTS.md: the label "is for a diff that publishes nothing from any released package." Five recent skills-only commits on main carry no changeset. check:empty-changeset and check:changeset-gate-self-tests are green.

Measurements — every gate at head eed6bb0f

Derived with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands from the worktree, no path arguments: 53 commands, all exit 0. Exits captured before any pipe. The load-bearing ones:

gate	exit	verdict line
pnpm --filter @objectstack/spec check:skill-refs	0	✅ 9 generated files in sync with packages/spec
pnpm check:doc-authoring	0	✓ doc authoring guard: 46 published skill files clean — no internal issue-id references.
pnpm --filter @objectstack/spec check:skill-examples	0	✅ 257 prose examples type-check across 3 surface(s)
pnpm --filter @objectstack/spec check:llms-txt	0	✓ packages/spec/llms.txt: 97 claim(s) re-derived
pnpm --filter @objectstack/spec typecheck	0	covers tsc --noEmit + check:scripts-typecheck + check:test-typecheck; tsconfig.scripts.json includes scripts/**/*, so the new lib and its test file are both in a checked program
node scripts/check-skills-token-ratchet.mjs	0	✓ 36 authored bundle file(s) within their ceilings; 11 generator-owned file(s) measured, not ratcheted
pnpm check:pm-skill-ratchet	0	✓ check-skill-line-ratchet: declared cross-file moves: 1, total ceilings down 1 line.
pnpm check:nul-bytes	0	✓ check-nul-bytes --self-test: 75 assertions over a temp git repo
node scripts/check-system-context-census.mjs	0	OK — 106 elevation read sites in 20 packages across 45 files, all anchored
pnpm check:changeset-gate-self-tests	0	✓ check-changeset-no-major --self-test: 116 assertions
pnpm check:watch-hint-literal	0	✓ 49 declaration(s) across 4 rostered name(s) … every one an array
node scripts/pm/bare-root-worklist.mjs --self-test	0	OK self-test: 54 live row(s) … none stale, none missing, none contradicted — the pin that holds this generator's ROOT_DIR_WATCH_HINTS declaration honest
pnpm --filter @objectstack/spec exec vitest run scripts/skill-map-guards.test.ts	0	Test Files 1 passed (1) · Tests 29 passed (29)

Four gates first answered PREREQUISITE NOT MET (exit 3 or a build refusal) and were re-run green after pnpm exec turbo run build over the package closure: check:doc-formula-expressions, check:dual-build-cjs-loads, check:type-check-debt, check:skill-examples.

Reverse verification — each guard driven to red, then restored

Predicted direction: red, with a named refusal. Observed, all three:

mutation	exit	the gate's own line
baseline, unmutated head	0	✅ 9 generated files in sync with packages/spec
data/date-macros.zod.ts put back in the formula entry	1	data/date-macros.zod.ts is in the core list of 2 packages (objectstack-query, objectstack-formula) — one schema file, one owning package.
a non-.zod.ts core entry added	1	objectstack-formula → contracts/plugin-lifecycle-events.ts is not a *.zod.ts path — … emits no pointer row at all
TRANSITIVE_ALLOWLIST keyed on a package the map lacks	1	TRANSITIVE_ALLOWLIST names objectstack-i18nn, which is not a SKILL_MAP package — the list would constrain nothing.

Each mutation was confirmed on disk by counting the injected text before the run, and each restore is git checkout HEAD -- against absolute paths with a trap, proven by an empty git diff HEADand a git hash-object match against the HEAD blob. No build or dist/ is involved: tsx and vitest resolve ./lib/skill-map-guards as a relative source path, with no package exports boundary in between, so the mutated bytes are the bytes that ran.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 460134af85f7ab2cf68abc62f1bbb9783b8899dd → packageMentionDocs.

[os-justin]

Seat review: ACCEPT — review of record on the family anchor #14462 (comment 5537457796), domain:spec seat, 2026-09-04T07:56Z; member pointers on #14466, #14562, #14565.

Governed surface (skills/** regenerated together with its generator — check-governed-merges reads that as governed, not as the pure-regeneration exception) ⇒ this PR stays draft. No agent seat flips it ready, enqueues it, or arms auto-merge; a human merge is the review record. Review requested from os-zhuang and hotlong.

For the human merger, what to read:

• The four regenerated indexes: net −9 lines in skills/**; every added pointer is one the members' rulings named (solution-blueprint, the two automation config schemas); the fourth added line is embedding moving from Core to Transitive in the same file.
• Two deviations from seat rulings, both argued in the body and both accepted by the seat with the reasoning in 5537457796: SHARED_CORE_SCHEMAS (three deliberate cross-package duplicates exist on main, so the flat one-owner rule would red the current map) and stripInternalIssueIds at the catalog boundary (the doc-authoring gate is zero-tolerance on skills/** and baseline-held on content/docs). Either can be overruled here; the flat rule is a three-pointer deletion, the source strip is a .zod.ts edit + changeset + docs regeneration.
• data/field.zod.ts stays in the i18n index on the SelectOptionSchema reasoning; state-machine.zod.ts survives only in objectstack-ai's transitive list, through agent.zod.ts.
• skip-changeset is measured: no .zod.ts edited, packages/spec/scripts/** is outside the package's files allowlist, skills/ is in no package.

CI on eed6bb0f at 07:50Z: 17 completed checks green, the long jobs still running; merge when the required checks report on this head.

---

Generated by Claude Code

[os-justin]

Status (seat, 2026-09-04T08:36Z): approved by os-zhuang at 07:53:09Z on eed6bb0f, marked ready at 07:54Z, and every check on that head is green as of 08:12Z (48 check runs: Lint & Repo Gates, all four Type Check jobs, Test Core ×6, Dogfood ×4, Temporal Conformance, Governed Surface Queue Guard re-run after the approval — all success). The PR is not in the merge queue (git ls-remote origin 'refs/heads/gh-readonly-queue/*' at 08:32Z lists #15073 → #15236 → #15251 → #15257 → #15266). Governed surface: the agent seat does not enqueue or arm auto-merge — os-zhuang / hotlong, enabling auto-merge (squash) puts it in the queue, as was done for #15257.

---

Generated by Claude Code

[os-justin]

Fixes#14462
Fixes#14466
Fixes#14562
Fixes#14565

One family, one branch, one commit per member. The map that decides what nine published skill indexes point at is reconciled against the bodies that own those surfaces, and the generator gains the guards that keep it reconciled.

skills/** is a governed surface: this PR stays draft for a human merge. It is never flipped ready and no auto-merge is armed.

The rulings this implements, quoted where operative

• Anchor, triage 5506970439: "Ruling: narrow the map, add solution-blueprint. ⛔ Do not widen the body." · "This card carries the census — for each of the [SKILL_MAP] entries, the set difference in both directions against what its SKILL.md teaches — and applies the ruling above uniformly." · "whatever reconciliation lands must make a retired schema in the map impossible, not merely corrected once … If deriving the map from a checkable source is out of reach, say so in the PR rather than hand-fixing eleven lists."
• [finding] The objectstack-automation reference index routes to the ADR-0020-retired state-machine.zod.ts and omits both per-node config schemas — SKILL_MAP in build-skill-references.ts #14466, triage 5506975178: drop automation/state-machine.zod.ts; the two per-node config schemas join — "its retired-schema pointer is a distinct defect worth its own line".
• [finding] The objectstack-formula reference index advertises data/date-macros.zod.ts, a surface the SKILL.md routes to objectstack-query — SKILL_MAP in build-skill-references.ts maps it to both #14562, seat ruling 5536681114: drop data/date-macros.zod.ts from the formula entry; a loud one-owner guard with a negative test.
• [finding] The objectstack-i18n reference index routes 5 of its 7 transitive pointers at schemas unreachable from a translation bundle — the closure step in build-skill-references.ts #14565, triage 5514974653: "decide that feasibility question first and say so in the PR body, because it determines whether this is one fix or three." · "⛔ Do not hand-edit _index.md."
• [finding] The objectstack-formula reference index advertises data/date-macros.zod.ts, a surface the SKILL.md routes to objectstack-query — SKILL_MAP in build-skill-references.ts maps it to both #14562, triage 5515135764: "The class has two mechanisms … ⛔ Do not build the SKILL_MAP-only gate and declare the class closed."

No SKILL.md body was widened. No _index.md was hand-edited — every one is the output of pnpm --filter @objectstack/spec gen:skill-refs.

Answer 1 — does one gate cover both mechanisms? No, and they are in the same file

The class has two mechanisms and they get two guards, in one module, packages/spec/scripts/lib/skill-map-guards.ts. checkSingleOwner and checkCoreEntryShape ask questions of the hand-written core list; checkTransitiveAllowlist constrains the closure. Neither would catch the other's defect: objectstack-i18n's core list is correct and its index was still wrong, and no closure rule would have noticed that two packages both claimed date macros.

Answer 2 — is there a checkable source for "retired"? No. Measured, three ways

The design was gated on this, so it was checked rather than assumed:

1. The ADR-0087 registry (packages/spec/src/migrations/entries/retired-defs/, 94 entries) names defs removed at a major version. StateMachine is not there, and correctly so — the def still exists and still parses, through AgentSchema.lifecycle.
2. The file's own header prose.automation/state-machine.zod.ts states the ADR-0020 retirement, and the same header documents the door that survives. A prose grep flags a file that is live surface for another package.
3. "The owning SKILL.md must mention it." This one looked promising and was measured: the string state machineis in skills/objectstack-automation/SKILL.md — the skill's own description names it. A text-mention gate keeps precisely the pointer this PR removes. It is also vacuous in the other direction, since the stems are single common words (tool, view, app, action, page, context) that match any prose.

The retirement that mattered was package-relative: dead surface for automation authoring, live surface for AI authoring — and nothing in the tree expresses a per-package liveness claim. So the answer the triage said it would accept is the answer: no checkable source exists, it is said here rather than hidden, and the guards that DO ship are the mechanical ones, each with negative tests. The judgement stays a judgement, stated out loud in the map.

Answer 3 — the closure step: reachability rule, or a per-package list?

A per-package list. The general rule is not merely unbuilt, it is unbuildable from this input, and the required outcome is the proof.

objectstack-i18n published eight transitive pointers, and seven arrive through one edge: shared/strict-object.ts imports shared/suggestions.zod.ts for its "did you mean?" text, which imports data/field.zod.ts, which drags in filter, expression, field-value, identifiers and value-domain. That is a schema-building helper's implementation, not the authorable shape of a translation bundle.

Cutting traversal through non-shipping helpers is the precise version of the reachability rule. Measured against what the ruling requires:

pointer	required	what the precise rule does	why
data/filter.zod.ts	drop	drops	reached only through the helper
shared/expression.zod.ts	drop	drops	reached only through the helper
data/field-value.zod.ts	drop	drops	reached only through the helper
shared/suggestions.zod.ts	drop	drops	reached only through the helper
kernel/metadata-protection.zod.ts	drop	keeps	a first-class direct import of system/translation.zod.ts
shared/identifiers.zod.ts	keep	drops	nothing imports it; bundle keys ARE those identifiers

The required set puts a depth-4 pointer reached through a helper on the KEEP side and a depth-1 pointer reached through a schema edge on the DROP side. No predicate over the import graph orders those two that way, because the fact that separates them — what a translation bundle can address, by name string — is not in the graph. system/translation.zod.ts does not import shared/identifiers.zod.ts at all.

So: TRANSITIVE_ALLOWLIST, beside SKILL_MAP, opt-in per package. A package that declares nothing publishes its full closure and its index does not move. It is an allowlist, not a denylist, and that is the half that matters: shared/value-domain.zod.ts joined the i18n index recently and unnoticed, when a new import edge appeared several files away — a denylist misses every new arrival by construction.

data/field.zod.ts was left to this PR's judgement and is kept: FieldTranslationSchema.options is keyed by select-option value, the SKILL.md teaches that keying by example (options: { direct_mail: '直邮' } for options: [{ value: 'direct_mail', … }]), and SelectOptionSchema is the declaration those keys must match.

The census — all nine SKILL_MAP entries

The triage said eleven. There are nine, and nine generated indexes: data · query · ai · api · automation · ui · platform · i18n · formula. 59 core entries.

package	advertised, not taught	taught, not advertised	action
objectstack-ai	conversation, mcp, embedding, knowledge-document, usage (3 with zero consumers outside packages/spec)	ai/solution-blueprint.zod.ts — the schema behind the solution_design built-in skill the body's table names	narrowed + added
objectstack-automation	automation/state-machine.zod.ts — ADR-0020 retired it as a record-lifecycle declaration	automation/builtin-node-config.zod.ts, automation/io-node-config.zod.ts	swapped
objectstack-formula	data/date-macros.zod.ts — both bodies route it to objectstack-query	—	dropped
objectstack-i18n	core list correct; 6 of 8 transitive pointers unreachable from a bundle	—	closure constrained
objectstack-api	api/rest-server.zod.ts — zero mentions of the file or any of its six exported config schemas	—	recorded, no edit — filed as #15264
objectstack-platform	kernel/plugin-capability.zod.ts (thin, not wrong — the body teaches requires: but routes to kernel/platform-capabilities.ts)	stack.zod.ts — the body's whole subject is defineStack and names four of its exports	recorded, no edit — filed as #15264
objectstack-data	none	none	none
objectstack-query	none	none	none
objectstack-ui	none	none	none

The two unedited rows are deliberate and the reasoning is on #15264: every row this PR edited came with a measured consumer census or an explicit ADR retirement, and those two have only the sweep. Deleting or adding a published pointer on a governed customer surface is worth its own decision rather than a rider on a PR a reviewer is already checking four things in.

The guards, and what each negative test drives

All in packages/spec/scripts/lib/skill-map-guards.ts; tests in packages/spec/scripts/skill-map-guards.test.ts (29 assertions). They live in lib/ for the reason export-list.ts and file-description.ts do: the generator self-executes on import.

guard	refuses	negative tests
checkSingleOwner	a schema file in two core lists that is not declared in SHARED_CORE_SCHEMAS with a reason; a declaration with an empty reason; a declaration whose sharing has gone	6, incl. a passing map so an always-red guard cannot survive
checkCoreEntryShape	a core entry that is not a *.zod.ts path — today those are dropped from the index silently, with no missing row and a green --check	3
checkTransitiveAllowlist	a package name the map does not have; a file the closure never reaches; a file already in core; a repeat	6
stripInternalIssueIds	(a publication rule, not a guard) internal tracker ids in a published row	8, incl. five shapes that must survive untouched

A second leg reads build-skill-references.ts and asserts each guard is actually called there, and that the allowlist reaches the emit path. A guard nobody calls is green in a unit test and absent from the gate — which is the state the map was already in.

Deviation 1 — the one-owner guard is not the flat rule it was asked for

The #14562 seat ruling asked for "at most one owner" and refused a duplicate-ownership rule, on the stated ground that there would be "zero legitimate instances after this drop". Measured at this PR's base, that ground does not hold.date-macros was one of four duplicates:

file	packages	deliberate?
data/date-macros.zod.ts	query + formula	no — the defect #14562 filed
data/validation.zod.ts	data + automation	yes — a record's transitions are a state_machine validation rule (ADR-0020), the destination that replaced the retired shape
data/datasource.zod.ts	data + platform	yes — already carrying its reason as a comment in the map (project setup (was objectstack-quickstart))
data/seed.zod.ts	data + platform	yes — same comment

The flat rule refuses origin/main's own map on its first run, and the only ways to satisfy it are to delete three pointers no card has adjudicated, or to keep the gate red. So the guard ships in the shape that is enforceable and keeps the ruling's operational demand — the next duplicate refuses at generation time — with the three measured instances declared rather than deleted. Two further guards keep that ledger from becoming a silent allowlist: a row with no reason is refused, and so is a row whose sharing has gone. A reviewer who prefers the literal rule should say so; reverting to it is a three-pointer deletion, not a code change.

Deviation 2 — internal tracker ids are stripped at the catalog boundary, not at the source

Adding automation/io-node-config.zod.ts turned check:doc-authoring red: the generator publishes the first sentence of a module's doc block, and that file's opens with a bare tracker citation. That gate has no per-passage exemption, by design.

Its prescribed remedy is to strip the id at the source and regenerate. That remedy is not taken here, for three specific reasons: the source is a .zod.ts this card is forbidden to edit; it is a file the package publishes, so editing it would change what @objectstack/spec ships and reopen the changeset decision below; and the same sentence is projected to content/docs/references/automation/io-node-config.mdx, which would pull a second generated tree into a diff whose surface is the skill catalog. Three surfaces to remove one token.

The decisive measurement: the gate does not flag that identical sentence on the docs page. The rule is about the skill catalog specifically — skills/** is loaded whole into customer context windows — so the strip is applied at the boundary into that catalog. Every future pointer row is covered rather than this one being corrected once. The criterion is the gate's own, restated with a pin over the shapes that must and must not match (an ordinal, a hex colour, an over-long number, a doubled hash). A reviewer who wants the source edit instead can have it; it needs a changeset and a docs regeneration.

skills/** net line delta: −9 (budget: not more than +6)

4 lines added, 13 removed, across four of the nine indexes.

index	added	removed	net
objectstack-ai	2	5	−3
objectstack-automation	2	1	+1
objectstack-formula	0	1	−1
objectstack-i18n	0	6	−6

Three of the four added lines are the members' named additions: ai/solution-blueprint.zod.ts, automation/builtin-node-config.zod.ts, automation/io-node-config.zod.ts. The fourth is not a new pointer: ai/embedding.zod.ts moves from the Core section to Transitive in the same file, because knowledge-source.zod.ts composes EmbeddingModelSchema — that pointer IS reachable from the authorable face, which is exactly the test the other four narrowed schemas fail. Net published pointers for objectstack-ai: 20 down to 17.

The other five indexes are byte-identical to origin/main.

Changeset: skip-changeset, and why the named precedent points that way

PR #14737 (the "Sort Node" labelling fix on this same generator, landed 2026-09-03) carried a patch changeset — and its file list says why: it edited packages/spec/src/data/query.zod.ts, which is inside the package's files allowlist (src/**/*.zod.ts). That half is absent here by ruling: no .zod.ts is edited.

This diff is packages/spec/scripts/** (not in the files allowlist, so nothing published) plus skills/** (shipped by npx skills add from the repo, not from any released package). AGENTS.md: the label "is for a diff that publishes nothing from any released package." Five recent skills-only commits on main carry no changeset. check:empty-changeset and check:changeset-gate-self-tests are green.

Measurements — every gate at head eed6bb0f

Derived with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands from the worktree, no path arguments: 53 commands, all exit 0. Exits captured before any pipe. The load-bearing ones:

gate	exit	verdict line
pnpm --filter @objectstack/spec check:skill-refs	0	✅ 9 generated files in sync with packages/spec
pnpm check:doc-authoring	0	✓ doc authoring guard: 46 published skill files clean — no internal issue-id references.
pnpm --filter @objectstack/spec check:skill-examples	0	✅ 257 prose examples type-check across 3 surface(s)
pnpm --filter @objectstack/spec check:llms-txt	0	✓ packages/spec/llms.txt: 97 claim(s) re-derived
pnpm --filter @objectstack/spec typecheck	0	covers tsc --noEmit + check:scripts-typecheck + check:test-typecheck; tsconfig.scripts.json includes scripts/**/*, so the new lib and its test file are both in a checked program
node scripts/check-skills-token-ratchet.mjs	0	✓ 36 authored bundle file(s) within their ceilings; 11 generator-owned file(s) measured, not ratcheted
pnpm check:pm-skill-ratchet	0	✓ check-skill-line-ratchet: declared cross-file moves: 1, total ceilings down 1 line.
pnpm check:nul-bytes	0	✓ check-nul-bytes --self-test: 75 assertions over a temp git repo
node scripts/check-system-context-census.mjs	0	OK — 106 elevation read sites in 20 packages across 45 files, all anchored
pnpm check:changeset-gate-self-tests	0	✓ check-changeset-no-major --self-test: 116 assertions
pnpm check:watch-hint-literal	0	✓ 49 declaration(s) across 4 rostered name(s) … every one an array
node scripts/pm/bare-root-worklist.mjs --self-test	0	OK self-test: 54 live row(s) … none stale, none missing, none contradicted — the pin that holds this generator's ROOT_DIR_WATCH_HINTS declaration honest
pnpm --filter @objectstack/spec exec vitest run scripts/skill-map-guards.test.ts	0	Test Files 1 passed (1) · Tests 29 passed (29)

Four gates first answered PREREQUISITE NOT MET (exit 3 or a build refusal) and were re-run green after pnpm exec turbo run build over the package closure: check:doc-formula-expressions, check:dual-build-cjs-loads, check:type-check-debt, check:skill-examples.

Reverse verification — each guard driven to red, then restored

Predicted direction: red, with a named refusal. Observed, all three:

mutation	exit	the gate's own line
baseline, unmutated head	0	✅ 9 generated files in sync with packages/spec
data/date-macros.zod.ts put back in the formula entry	1	data/date-macros.zod.ts is in the core list of 2 packages (objectstack-query, objectstack-formula) — one schema file, one owning package.
a non-.zod.ts core entry added	1	objectstack-formula → contracts/plugin-lifecycle-events.ts is not a *.zod.ts path — … emits no pointer row at all
TRANSITIVE_ALLOWLIST keyed on a package the map lacks	1	TRANSITIVE_ALLOWLIST names objectstack-i18nn, which is not a SKILL_MAP package — the list would constrain nothing.

Each mutation was confirmed on disk by counting the injected text before the run, and each restore is git checkout HEAD -- against absolute paths with a trap, proven by an empty git diff HEADand a git hash-object match against the HEAD blob. No build or dist/ is involved: tsx and vitest resolve ./lib/skill-map-guards as a relative source path, with no package exports boundary in between, so the mutated bytes are the bytes that ran.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 460134af85f7ab2cf68abc62f1bbb9783b8899dd → packageMentionDocs.

[os-justin]

Seat review: ACCEPT — review of record on the family anchor #14462 (comment 5537457796), domain:spec seat, 2026-09-04T07:56Z; member pointers on #14466, #14562, #14565.

Governed surface (skills/** regenerated together with its generator — check-governed-merges reads that as governed, not as the pure-regeneration exception) ⇒ this PR stays draft. No agent seat flips it ready, enqueues it, or arms auto-merge; a human merge is the review record. Review requested from os-zhuang and hotlong.

For the human merger, what to read:

• The four regenerated indexes: net −9 lines in skills/**; every added pointer is one the members' rulings named (solution-blueprint, the two automation config schemas); the fourth added line is embedding moving from Core to Transitive in the same file.
• Two deviations from seat rulings, both argued in the body and both accepted by the seat with the reasoning in 5537457796: SHARED_CORE_SCHEMAS (three deliberate cross-package duplicates exist on main, so the flat one-owner rule would red the current map) and stripInternalIssueIds at the catalog boundary (the doc-authoring gate is zero-tolerance on skills/** and baseline-held on content/docs). Either can be overruled here; the flat rule is a three-pointer deletion, the source strip is a .zod.ts edit + changeset + docs regeneration.
• data/field.zod.ts stays in the i18n index on the SelectOptionSchema reasoning; state-machine.zod.ts survives only in objectstack-ai's transitive list, through agent.zod.ts.
• skip-changeset is measured: no .zod.ts edited, packages/spec/scripts/** is outside the package's files allowlist, skills/ is in no package.

CI on eed6bb0f at 07:50Z: 17 completed checks green, the long jobs still running; merge when the required checks report on this head.

---

Generated by Claude Code

[os-justin]

Status (seat, 2026-09-04T08:36Z): approved by os-zhuang at 07:53:09Z on eed6bb0f, marked ready at 07:54Z, and every check on that head is green as of 08:12Z (48 check runs: Lint & Repo Gates, all four Type Check jobs, Test Core ×6, Dogfood ×4, Temporal Conformance, Governed Surface Queue Guard re-run after the approval — all success). The PR is not in the merge queue (git ls-remote origin 'refs/heads/gh-readonly-queue/*' at 08:32Z lists #15073 → #15236 → #15251 → #15257 → #15266). Governed surface: the agent seat does not enqueue or arm auto-merge — os-zhuang / hotlong, enabling auto-merge (squash) puts it in the queue, as was done for #15257.

---

Generated by Claude Code

[os-justin]

Fixes#14462
Fixes#14466
Fixes#14562
Fixes#14565

One family, one branch, one commit per member. The map that decides what nine published skill indexes point at is reconciled against the bodies that own those surfaces, and the generator gains the guards that keep it reconciled.

skills/** is a governed surface: this PR stays draft for a human merge. It is never flipped ready and no auto-merge is armed.

The rulings this implements, quoted where operative

• Anchor, triage 5506970439: "Ruling: narrow the map, add solution-blueprint. ⛔ Do not widen the body." · "This card carries the census — for each of the [SKILL_MAP] entries, the set difference in both directions against what its SKILL.md teaches — and applies the ruling above uniformly." · "whatever reconciliation lands must make a retired schema in the map impossible, not merely corrected once … If deriving the map from a checkable source is out of reach, say so in the PR rather than hand-fixing eleven lists."
• [finding] The objectstack-automation reference index routes to the ADR-0020-retired state-machine.zod.ts and omits both per-node config schemas — SKILL_MAP in build-skill-references.ts #14466, triage 5506975178: drop automation/state-machine.zod.ts; the two per-node config schemas join — "its retired-schema pointer is a distinct defect worth its own line".
• [finding] The objectstack-formula reference index advertises data/date-macros.zod.ts, a surface the SKILL.md routes to objectstack-query — SKILL_MAP in build-skill-references.ts maps it to both #14562, seat ruling 5536681114: drop data/date-macros.zod.ts from the formula entry; a loud one-owner guard with a negative test.
• [finding] The objectstack-i18n reference index routes 5 of its 7 transitive pointers at schemas unreachable from a translation bundle — the closure step in build-skill-references.ts #14565, triage 5514974653: "decide that feasibility question first and say so in the PR body, because it determines whether this is one fix or three." · "⛔ Do not hand-edit _index.md."
• [finding] The objectstack-formula reference index advertises data/date-macros.zod.ts, a surface the SKILL.md routes to objectstack-query — SKILL_MAP in build-skill-references.ts maps it to both #14562, triage 5515135764: "The class has two mechanisms … ⛔ Do not build the SKILL_MAP-only gate and declare the class closed."

No SKILL.md body was widened. No _index.md was hand-edited — every one is the output of pnpm --filter @objectstack/spec gen:skill-refs.

Answer 1 — does one gate cover both mechanisms? No, and they are in the same file

The class has two mechanisms and they get two guards, in one module, packages/spec/scripts/lib/skill-map-guards.ts. checkSingleOwner and checkCoreEntryShape ask questions of the hand-written core list; checkTransitiveAllowlist constrains the closure. Neither would catch the other's defect: objectstack-i18n's core list is correct and its index was still wrong, and no closure rule would have noticed that two packages both claimed date macros.

Answer 2 — is there a checkable source for "retired"? No. Measured, three ways

The design was gated on this, so it was checked rather than assumed:

1. The ADR-0087 registry (packages/spec/src/migrations/entries/retired-defs/, 94 entries) names defs removed at a major version. StateMachine is not there, and correctly so — the def still exists and still parses, through AgentSchema.lifecycle.
2. The file's own header prose.automation/state-machine.zod.ts states the ADR-0020 retirement, and the same header documents the door that survives. A prose grep flags a file that is live surface for another package.
3. "The owning SKILL.md must mention it." This one looked promising and was measured: the string state machineis in skills/objectstack-automation/SKILL.md — the skill's own description names it. A text-mention gate keeps precisely the pointer this PR removes. It is also vacuous in the other direction, since the stems are single common words (tool, view, app, action, page, context) that match any prose.

The retirement that mattered was package-relative: dead surface for automation authoring, live surface for AI authoring — and nothing in the tree expresses a per-package liveness claim. So the answer the triage said it would accept is the answer: no checkable source exists, it is said here rather than hidden, and the guards that DO ship are the mechanical ones, each with negative tests. The judgement stays a judgement, stated out loud in the map.

Answer 3 — the closure step: reachability rule, or a per-package list?

A per-package list. The general rule is not merely unbuilt, it is unbuildable from this input, and the required outcome is the proof.

objectstack-i18n published eight transitive pointers, and seven arrive through one edge: shared/strict-object.ts imports shared/suggestions.zod.ts for its "did you mean?" text, which imports data/field.zod.ts, which drags in filter, expression, field-value, identifiers and value-domain. That is a schema-building helper's implementation, not the authorable shape of a translation bundle.

Cutting traversal through non-shipping helpers is the precise version of the reachability rule. Measured against what the ruling requires:

pointer	required	what the precise rule does	why
data/filter.zod.ts	drop	drops	reached only through the helper
shared/expression.zod.ts	drop	drops	reached only through the helper
data/field-value.zod.ts	drop	drops	reached only through the helper
shared/suggestions.zod.ts	drop	drops	reached only through the helper
kernel/metadata-protection.zod.ts	drop	keeps	a first-class direct import of system/translation.zod.ts
shared/identifiers.zod.ts	keep	drops	nothing imports it; bundle keys ARE those identifiers

The required set puts a depth-4 pointer reached through a helper on the KEEP side and a depth-1 pointer reached through a schema edge on the DROP side. No predicate over the import graph orders those two that way, because the fact that separates them — what a translation bundle can address, by name string — is not in the graph. system/translation.zod.ts does not import shared/identifiers.zod.ts at all.

So: TRANSITIVE_ALLOWLIST, beside SKILL_MAP, opt-in per package. A package that declares nothing publishes its full closure and its index does not move. It is an allowlist, not a denylist, and that is the half that matters: shared/value-domain.zod.ts joined the i18n index recently and unnoticed, when a new import edge appeared several files away — a denylist misses every new arrival by construction.

data/field.zod.ts was left to this PR's judgement and is kept: FieldTranslationSchema.options is keyed by select-option value, the SKILL.md teaches that keying by example (options: { direct_mail: '直邮' } for options: [{ value: 'direct_mail', … }]), and SelectOptionSchema is the declaration those keys must match.

The census — all nine SKILL_MAP entries

The triage said eleven. There are nine, and nine generated indexes: data · query · ai · api · automation · ui · platform · i18n · formula. 59 core entries.

package	advertised, not taught	taught, not advertised	action
objectstack-ai	conversation, mcp, embedding, knowledge-document, usage (3 with zero consumers outside packages/spec)	ai/solution-blueprint.zod.ts — the schema behind the solution_design built-in skill the body's table names	narrowed + added
objectstack-automation	automation/state-machine.zod.ts — ADR-0020 retired it as a record-lifecycle declaration	automation/builtin-node-config.zod.ts, automation/io-node-config.zod.ts	swapped
objectstack-formula	data/date-macros.zod.ts — both bodies route it to objectstack-query	—	dropped
objectstack-i18n	core list correct; 6 of 8 transitive pointers unreachable from a bundle	—	closure constrained
objectstack-api	api/rest-server.zod.ts — zero mentions of the file or any of its six exported config schemas	—	recorded, no edit — filed as #15264
objectstack-platform	kernel/plugin-capability.zod.ts (thin, not wrong — the body teaches requires: but routes to kernel/platform-capabilities.ts)	stack.zod.ts — the body's whole subject is defineStack and names four of its exports	recorded, no edit — filed as #15264
objectstack-data	none	none	none
objectstack-query	none	none	none
objectstack-ui	none	none	none

The two unedited rows are deliberate and the reasoning is on #15264: every row this PR edited came with a measured consumer census or an explicit ADR retirement, and those two have only the sweep. Deleting or adding a published pointer on a governed customer surface is worth its own decision rather than a rider on a PR a reviewer is already checking four things in.

The guards, and what each negative test drives

All in packages/spec/scripts/lib/skill-map-guards.ts; tests in packages/spec/scripts/skill-map-guards.test.ts (29 assertions). They live in lib/ for the reason export-list.ts and file-description.ts do: the generator self-executes on import.

guard	refuses	negative tests
checkSingleOwner	a schema file in two core lists that is not declared in SHARED_CORE_SCHEMAS with a reason; a declaration with an empty reason; a declaration whose sharing has gone	6, incl. a passing map so an always-red guard cannot survive
checkCoreEntryShape	a core entry that is not a *.zod.ts path — today those are dropped from the index silently, with no missing row and a green --check	3
checkTransitiveAllowlist	a package name the map does not have; a file the closure never reaches; a file already in core; a repeat	6
stripInternalIssueIds	(a publication rule, not a guard) internal tracker ids in a published row	8, incl. five shapes that must survive untouched

A second leg reads build-skill-references.ts and asserts each guard is actually called there, and that the allowlist reaches the emit path. A guard nobody calls is green in a unit test and absent from the gate — which is the state the map was already in.

Deviation 1 — the one-owner guard is not the flat rule it was asked for

The #14562 seat ruling asked for "at most one owner" and refused a duplicate-ownership rule, on the stated ground that there would be "zero legitimate instances after this drop". Measured at this PR's base, that ground does not hold.date-macros was one of four duplicates:

file	packages	deliberate?
data/date-macros.zod.ts	query + formula	no — the defect #14562 filed
data/validation.zod.ts	data + automation	yes — a record's transitions are a state_machine validation rule (ADR-0020), the destination that replaced the retired shape
data/datasource.zod.ts	data + platform	yes — already carrying its reason as a comment in the map (project setup (was objectstack-quickstart))
data/seed.zod.ts	data + platform	yes — same comment

The flat rule refuses origin/main's own map on its first run, and the only ways to satisfy it are to delete three pointers no card has adjudicated, or to keep the gate red. So the guard ships in the shape that is enforceable and keeps the ruling's operational demand — the next duplicate refuses at generation time — with the three measured instances declared rather than deleted. Two further guards keep that ledger from becoming a silent allowlist: a row with no reason is refused, and so is a row whose sharing has gone. A reviewer who prefers the literal rule should say so; reverting to it is a three-pointer deletion, not a code change.

Deviation 2 — internal tracker ids are stripped at the catalog boundary, not at the source

Adding automation/io-node-config.zod.ts turned check:doc-authoring red: the generator publishes the first sentence of a module's doc block, and that file's opens with a bare tracker citation. That gate has no per-passage exemption, by design.

Its prescribed remedy is to strip the id at the source and regenerate. That remedy is not taken here, for three specific reasons: the source is a .zod.ts this card is forbidden to edit; it is a file the package publishes, so editing it would change what @objectstack/spec ships and reopen the changeset decision below; and the same sentence is projected to content/docs/references/automation/io-node-config.mdx, which would pull a second generated tree into a diff whose surface is the skill catalog. Three surfaces to remove one token.

The decisive measurement: the gate does not flag that identical sentence on the docs page. The rule is about the skill catalog specifically — skills/** is loaded whole into customer context windows — so the strip is applied at the boundary into that catalog. Every future pointer row is covered rather than this one being corrected once. The criterion is the gate's own, restated with a pin over the shapes that must and must not match (an ordinal, a hex colour, an over-long number, a doubled hash). A reviewer who wants the source edit instead can have it; it needs a changeset and a docs regeneration.

skills/** net line delta: −9 (budget: not more than +6)

4 lines added, 13 removed, across four of the nine indexes.

index	added	removed	net
objectstack-ai	2	5	−3
objectstack-automation	2	1	+1
objectstack-formula	0	1	−1
objectstack-i18n	0	6	−6

Three of the four added lines are the members' named additions: ai/solution-blueprint.zod.ts, automation/builtin-node-config.zod.ts, automation/io-node-config.zod.ts. The fourth is not a new pointer: ai/embedding.zod.ts moves from the Core section to Transitive in the same file, because knowledge-source.zod.ts composes EmbeddingModelSchema — that pointer IS reachable from the authorable face, which is exactly the test the other four narrowed schemas fail. Net published pointers for objectstack-ai: 20 down to 17.

The other five indexes are byte-identical to origin/main.

Changeset: skip-changeset, and why the named precedent points that way

PR #14737 (the "Sort Node" labelling fix on this same generator, landed 2026-09-03) carried a patch changeset — and its file list says why: it edited packages/spec/src/data/query.zod.ts, which is inside the package's files allowlist (src/**/*.zod.ts). That half is absent here by ruling: no .zod.ts is edited.

This diff is packages/spec/scripts/** (not in the files allowlist, so nothing published) plus skills/** (shipped by npx skills add from the repo, not from any released package). AGENTS.md: the label "is for a diff that publishes nothing from any released package." Five recent skills-only commits on main carry no changeset. check:empty-changeset and check:changeset-gate-self-tests are green.

Measurements — every gate at head eed6bb0f

Derived with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands from the worktree, no path arguments: 53 commands, all exit 0. Exits captured before any pipe. The load-bearing ones:

gate	exit	verdict line
pnpm --filter @objectstack/spec check:skill-refs	0	✅ 9 generated files in sync with packages/spec
pnpm check:doc-authoring	0	✓ doc authoring guard: 46 published skill files clean — no internal issue-id references.
pnpm --filter @objectstack/spec check:skill-examples	0	✅ 257 prose examples type-check across 3 surface(s)
pnpm --filter @objectstack/spec check:llms-txt	0	✓ packages/spec/llms.txt: 97 claim(s) re-derived
pnpm --filter @objectstack/spec typecheck	0	covers tsc --noEmit + check:scripts-typecheck + check:test-typecheck; tsconfig.scripts.json includes scripts/**/*, so the new lib and its test file are both in a checked program
node scripts/check-skills-token-ratchet.mjs	0	✓ 36 authored bundle file(s) within their ceilings; 11 generator-owned file(s) measured, not ratcheted
pnpm check:pm-skill-ratchet	0	✓ check-skill-line-ratchet: declared cross-file moves: 1, total ceilings down 1 line.
pnpm check:nul-bytes	0	✓ check-nul-bytes --self-test: 75 assertions over a temp git repo
node scripts/check-system-context-census.mjs	0	OK — 106 elevation read sites in 20 packages across 45 files, all anchored
pnpm check:changeset-gate-self-tests	0	✓ check-changeset-no-major --self-test: 116 assertions
pnpm check:watch-hint-literal	0	✓ 49 declaration(s) across 4 rostered name(s) … every one an array
node scripts/pm/bare-root-worklist.mjs --self-test	0	OK self-test: 54 live row(s) … none stale, none missing, none contradicted — the pin that holds this generator's ROOT_DIR_WATCH_HINTS declaration honest
pnpm --filter @objectstack/spec exec vitest run scripts/skill-map-guards.test.ts	0	Test Files 1 passed (1) · Tests 29 passed (29)

Four gates first answered PREREQUISITE NOT MET (exit 3 or a build refusal) and were re-run green after pnpm exec turbo run build over the package closure: check:doc-formula-expressions, check:dual-build-cjs-loads, check:type-check-debt, check:skill-examples.

Reverse verification — each guard driven to red, then restored

Predicted direction: red, with a named refusal. Observed, all three:

mutation	exit	the gate's own line
baseline, unmutated head	0	✅ 9 generated files in sync with packages/spec
data/date-macros.zod.ts put back in the formula entry	1	data/date-macros.zod.ts is in the core list of 2 packages (objectstack-query, objectstack-formula) — one schema file, one owning package.
a non-.zod.ts core entry added	1	objectstack-formula → contracts/plugin-lifecycle-events.ts is not a *.zod.ts path — … emits no pointer row at all
TRANSITIVE_ALLOWLIST keyed on a package the map lacks	1	TRANSITIVE_ALLOWLIST names objectstack-i18nn, which is not a SKILL_MAP package — the list would constrain nothing.

Each mutation was confirmed on disk by counting the injected text before the run, and each restore is git checkout HEAD -- against absolute paths with a trap, proven by an empty git diff HEADand a git hash-object match against the HEAD blob. No build or dist/ is involved: tsx and vitest resolve ./lib/skill-map-guards as a relative source path, with no package exports boundary in between, so the mutated bytes are the bytes that ran.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 460134af85f7ab2cf68abc62f1bbb9783b8899dd → packageMentionDocs.

[os-justin]

Seat review: ACCEPT — review of record on the family anchor #14462 (comment 5537457796), domain:spec seat, 2026-09-04T07:56Z; member pointers on #14466, #14562, #14565.

Governed surface (skills/** regenerated together with its generator — check-governed-merges reads that as governed, not as the pure-regeneration exception) ⇒ this PR stays draft. No agent seat flips it ready, enqueues it, or arms auto-merge; a human merge is the review record. Review requested from os-zhuang and hotlong.

For the human merger, what to read:

• The four regenerated indexes: net −9 lines in skills/**; every added pointer is one the members' rulings named (solution-blueprint, the two automation config schemas); the fourth added line is embedding moving from Core to Transitive in the same file.
• Two deviations from seat rulings, both argued in the body and both accepted by the seat with the reasoning in 5537457796: SHARED_CORE_SCHEMAS (three deliberate cross-package duplicates exist on main, so the flat one-owner rule would red the current map) and stripInternalIssueIds at the catalog boundary (the doc-authoring gate is zero-tolerance on skills/** and baseline-held on content/docs). Either can be overruled here; the flat rule is a three-pointer deletion, the source strip is a .zod.ts edit + changeset + docs regeneration.
• data/field.zod.ts stays in the i18n index on the SelectOptionSchema reasoning; state-machine.zod.ts survives only in objectstack-ai's transitive list, through agent.zod.ts.
• skip-changeset is measured: no .zod.ts edited, packages/spec/scripts/** is outside the package's files allowlist, skills/ is in no package.

CI on eed6bb0f at 07:50Z: 17 completed checks green, the long jobs still running; merge when the required checks report on this head.

---

Generated by Claude Code

[os-justin]

Status (seat, 2026-09-04T08:36Z): approved by os-zhuang at 07:53:09Z on eed6bb0f, marked ready at 07:54Z, and every check on that head is green as of 08:12Z (48 check runs: Lint & Repo Gates, all four Type Check jobs, Test Core ×6, Dogfood ×4, Temporal Conformance, Governed Surface Queue Guard re-run after the approval — all success). The PR is not in the merge queue (git ls-remote origin 'refs/heads/gh-readonly-queue/*' at 08:32Z lists #15073 → #15236 → #15251 → #15257 → #15266). Governed surface: the agent seat does not enqueue or arm auto-merge — os-zhuang / hotlong, enabling auto-merge (squash) puts it in the queue, as was done for #15257.

---

Generated by Claude Code