feat(spec,automation): create_record / update_record fields.* accept the CEL value envelope — declared and evaluated together

[objectstack-fleet]

Fixes #19938
Fixes #11182
Clause-②: yes

One branch, one PR, spec commit first, one merge: maintainer ruling B on #19938 (record 5816929495, 「19938 同意」), which folds the #11182 engine half into this change. #11182 ruling D (5805777944, 「11182 D 其他同意」) governs the content.

What changes

A value in a create_record or update_record node's fields map may now be a CEL value envelope, { dialect: 'cel', source: '…' }, under the same shape and dialect rules the assignment node's assignments map already has. The slot is declared in the expression ledger and evaluated by the executor in the same merge, so it is never declared without being evaluated. A plain string in fields.* is still a {token} template and means what it meant in 17.x. No spelling changes meaning (ruling D).

Commit 1 (de7c28942): spec, the contract half (#19938)

• Expression ledger (flow-node-expression-paths.ts): two new value rows, create_record.fields.* and update_record.fields.*. The census grows from five rows to seven. The prose that called the assignment map the only value slot is corrected, and so is the shipped predicateSlotRefusal sentence that named it as the only value-role spelling.
• Value contract (builtin-node-config.zod.ts): CreateRecordConfigSchema / UpdateRecordConfigSchema fields values take FlowValueSlotSchema. One factory builds every value slot's contract, so the shape rule is stated once. It is declared above the CRUD schemas: OS_EAGER_SCHEMAS=1 runs every lazy factory at module load, and a schema declared further down would be in its temporal dead zone there.
• Q2, the seat's reading: the refusal sentence is slot-neutral. VALUE_ENVELOPE_REFUSAL reads "A value carrying a dialect key is read as an expression envelope, and this one is not a valid CEL value envelope." The published ASSIGNMENT_VALUE_ENVELOPE_REFUSAL is kept and is the same string, and AssignmentExpressionValueSchema's dialect message is neutral too. A refused field value is no longer told it is "an assignment value".
• Ratchet channel: LEDGER_DECLARED_NODE_CONFIG_SCHEMAS carries both CRUD contracts. Their descriptors publish fields as additionalProperties: true, exactly like assignment, so the marker rides the spec Zod.
• resolveFlowNodeValueSlots: every authored value of a value slot, strings included, located by the ledger's own walk. The lint hint uses it, so lint never re-spells the path shapes.
• Generated artefacts are regenerated, never hand-edited: api-surface, export-origins, declaration-map, json-schema manifest and reference docs. The three new dropped-refinement sites (CreateRecordConfig, UpdateRecordConfig, FlowValueSlot) are declared, with the ledger header totals 207 → 210 and 574 → 577, the build's own reading.
• Pins: the census, the fields entries, the value-slot resolver, the CRUD value contract (accept, preserve, refuse at the field's path, slot-neutral sentence), and the ratchet pin in config-expression-ledger.test.ts.

Commit 2 (8e37b80ff): engine, the executor half (#11182)

• Executor (crud-nodes.ts, the resolveFieldValues function): each top-level fields value that is envelope-shaped goes through AutomationEngine.evaluateValueEnvelope, the call the assignment executor makes (one evaluator, one CEL scope, one notion of malformed). Every other value goes through interpolate() exactly as the whole map used to. A malformed envelope, or one that faults on the live values, fails the node and writes nothing.
• Consumers: engine.ts valueEnvelopeRefusals and lint checkDeclaredValue read the slot-neutral FlowValueSlotSchema / VALUE_ENVELOPE_REFUSAL. Comments in engine.ts, logic-nodes.ts, node-executor.zod.ts and validate-expressions.ts no longer call assignments.* the only value slot.
• Author-time hint (ruling D point 1): objectstack validate warns (never errors) when any value slot holds a {…} template expression, meaning arithmetic or a call to one of the six functions, and points it at the envelope. The warning states the one conversion trap: / 100 becomes / 100.0.
• Wrong guidance fixed (ruling D point 2): the template.ts docblock and the shipped round() arity refusal now prescribe round(x * 100) / 100.0. Measured on this tree: CEL answers 1234 for round(x * 100) / 100 and 1234.57 for / 100.0 at x = 1234.5678, while the template dialect answers 1234.57 for both. / 100.0 is right in both dialects. The arity pin in template-functions.test.ts asserts the new prescription and the measured reason.
• Docs (flows.mdx): value slots, the envelope in the Create Record example, the three refusal doors (the stale "faults at run time, tracked in spec/formula: ExpressionSchema accepts an ast-only envelope that no engine can evaluate — it validates, it registers, it faults at run time #15430" paragraph is corrected), the dialect table's scale-2 row, and a CEL-envelope row.
• Changeset: minor for @objectstack/spec, @objectstack/service-automation and @objectstack/lint, with Clause-②: yes (widening) (Q3, the seat's reading). It names what newly passes, what newly refuses, and the nested and literal rule.
• skills/objectstack-automation/SKILL.md (Tier H) is untouched, per ruling D point 2.

The merge of origin/main (94216fb72) went through scripts/pm/os-regen-merge.sh. It resolved without conflicts, check:generated stayed at 15/15 current afterwards, and the branch's delta against main contains only this change.

Why the hint covers only template expressions

The hint covers arithmetic and the six functions, where CEL is a strict superset and the only conversion trap is stated in the warning itself. It does not cover:

• a plain {var} / {var.path} reference: CEL adds nothing, and an absent key would flip from undefined to a fault;
• NOW() / TODAY(): CEL's now() / today() are timestamps with no string(timestamp), and the string form is the v18 carrier's ([v18] retire the {var} template dialect in flow assignment slots: refuse at registration with per-spelling remedies (the C half of #11182 ruling D, on the v18 train) #19939) to add;
• $User.*: the flow's CEL scope binds no user.

Hinting any of these would steer authors toward metadata that the runtime honours but that makes the value worse. Census, a heuristic scan of object-literal fields / assignments blocks: the hint fires on 0 flow sites outside tests in objectstack (94216fb72) and on 2 in HotCRM (2f7b232, the two quote-generation.flow.ts money fields #11182 measured).

Measured: the 42-row probe grid, base against after

The grid is 7 values × {create_record, update_record} × {number, text, json} columns. The doors are FlowSchema.safeParse, the os validate pipeline (normalizeStackInput → unknown-key lints → ObjectStackDefinitionSchema → runAuthoringRules('validate')), registerFlow, and a run over a real ObjectQL with a recording driver.

• Base (455dcc060) reproduces the prior report exactly. Every envelope passes every door and is written as a literal object: text and JSON columns report success, and the number column is refused by the data engine.
• After:
  • The 18 template and literal rows are byte-identical to base.
  • The 6 valid-envelope rows are evaluated (price * 2 writes 42 on the number, text and JSON columns).
  • The 18 malformed rows (no source, non-parsing CEL, a template dialect) are refused at validate (error / expression-invalid) and at registerFlow, located at config.fields.FIELD with the slot-neutral sentence.
  • FlowSchema.parse is unchanged, because node config is an open record.
• Runtime publish gate (metadata-protocol), not measured before and measured now through saveMetaItem over the protocol's stub-engine harness:
  • A malformed fields.* envelope goes from SAVED to 422 INVALID_METADATA with expression-invalid at the node.
  • A valid envelope still saves.
  • A {round(price * 100) / 100} template saves with the hint as an advisory, in all three value slots.
  • The assignment control rows were refused before and after; only the sentence changed.
• Nested values (mechanism assumption 3): only the top-level value of a field is judged. An envelope-shaped object nested in a JSON value or an array is data, is interpolated as before, and is written verbatim, which the executor test pins. A top-level JSON value that is itself an object with a string dialect is now an envelope; the changeset states the rule and the escape (bind it to a variable and write '{thatVariable}'). No flow in this repo or HotCRM writes an envelope-shaped object into fields. The heuristic scan found 0 outside tests; its control leg found 14 envelope-shaped assignments values in objectstack tests.

Reverse verification (one-off, from the committed state)

• The executor half was reverted to the old whole-map interpolate() at both sites through scripts/ablation-replace.mjs: anchor 2 → 0, blob a292a5ac9181 → 1d6328c8d76d. The executor test went from 26/26 to 8 failed / 18 passed: the six evaluation pins and two run-time-fault pins went red, and the preservation and registration pins stayed green because registration is ledger-driven. The restore was proven: the blob equals HEAD and git diff HEAD is empty.
• The lint hint was short-circuited. The lint test went to 4 failed / 22 passed, all four of them the hinted cases, and the restore was proven.
• The two ledger rows were deleted. The spec pins went to 6 failed / 127 passed (census, the two slot declarations, the two field resolutions, the value-slot resolver), and the restore was proven.

Verification at 94216fb72

• node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 110 commands. --ran reports 110 derived, 110 run, 0 NOT-MEASURED, 0 UNRUN. Three gates first refused with exit 3 (prerequisite not met) and passed after the builds they asked for: check:skill-examples, check:dual-build-cjs-loads and check:type-check-debt, the last one re-run after direct rebuilds because the ablation restores had touched mtimes.
• Package suites, all command-exit 0:
  • @objectstack/spec: 541 files, 15924 tests
  • @objectstack/service-automation: 146 files, 1757 tests
  • @objectstack/lint: 109 files, 4209 tests
  • @objectstack/metadata-protocol: 189 files passed, 3 skipped (2700 tests)
• typecheck is green for all four.
• The other direct consumers of the changed exports are green: examples/app-showcase/test/predicate-write-bulk-intent.test.ts (17/17, parses with UpdateRecordConfigSchema) and packages/cli/src/flow-node-undeclared-field-write.integration.test.ts (7/7, drives registerCrudNodes).

Acceptance notes

• registerFlow has no ADR-0112 envelope. Every expression refusal there throws one aggregated plain Error with no code or status, and this is pre-existing and door-wide. The registration pins therefore assert the located message substance (node, slot, path, sentence). The os validate pins assert the rule id expression-invalid and severity error, and the publish gate answers 422 / INVALID_METADATA.
• One excuse was added to the validate-expressions.test.ts meta-guard: grammar. It is an import-specifier artefact, not a receiver. The guard's scan RULE_CODE.matchAll(/\b([a-z][\w$]*)\??\.[A-Za-z_$]/g) reads grammar.js inside './flow-template-grammar.js' as a receiver, the same artefact it already excuses as scope, fields and guards. The import is already a named import, so the construct the scanner misreads is the module path itself. My new locals were renamed instead of excused: the value-slot loop reuses the excused found (the same resolver-result shape), and the token scan uses a RegExp.exec loop with no lowercase receiver. What the guard checks for real receivers is unchanged. The engine commit was amended so that this fix sits inside it and each commit is green on its own.
• File surface beyond the claims' lists, each a test of a claimed file:
  • template-functions.test.ts: the arity-refusal prescription pin for template.ts;
  • validate-expressions.test.ts: the meta-guard entry above;
  • two new test files: crud-fields-value-envelope.test.ts and validate-expressions.fields-value-slot.test.ts.
• Observations, not filed:
  • flow-field-expression-scale.integration.test.ts:23 still calls round(x * 100) / 100 "the CEL-identical authoring pattern" in a test comment. The oracle it runs is the template dialect, where that is correct. Carrier: [v18] retire the {var} template dialect in flow assignment slots: refuse at registration with per-spelling remedies (the C half of #11182 ruling D, on the v18 train) #19939.
  • dropped-refinements.baseline.json's unpinned measured.refinementSitesThatDidProject reads 369 while the build measures 409. It was already stale before this change and is left as found.
  • A number written into a text column is accepted by ObjectQL, for literal 42 at base as well. This carries the prior report's observation forward.

---

Generated by Claude Code

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 94216fb725b92eb71f0d129130b72057a5496b38

_{Read: cards #19938 (body, all 6 comments incl. 5811746886 / 5811795518 / 5816929495) and #11182 (body, all 8 incl. 5805777944 / 5795796051); PR #20205 object, body, 25-file list, full delta vs merge-base 560b724 (2107 diff lines), its 3 commits; at the head: the expression ledger, builtin-node-config.zod.ts, schemaless-node-config.zod.ts, crud-nodes.ts, logic-nodes.ts, engine.ts (valueEnvelopeRefusals / evaluateValueEnvelope), template.ts (interpolate, requireArity), validate-expressions.ts and its meta-guard test, metadata-protocol runtime-authoring-gate.ts, cli validate.ts, flows.mdx, the changeset, dropped-refinements.baseline.json and the build's checkDroppedRefinements, the changeset gates' headers (check-changeset-no-major, check-adr-0087-registration, check-empty-changeset, check-widening-tells, pr-automation WHICH LEVEL). Ran: detached worktrees at the head and at merge-base 560b724, pnpm install --frozen-lockfile, turbo builds of the service-automation / lint / metadata-protocol / cli closures under os-verify-lock (VERDICT command-exit 0 each), a 72-row door probe (12 values x 2 node types x 3 column types; doors FlowSchema.parse, the os validate rule path, registerFlow, a real run over ObjectQL with a recording driver, evaluateRuntimeAuthoringGate) on both trees and diffed, the real objectstack validate --json over all four example stacks at the head, the PR's new and changed test files at the head (64 + 26 + 1 + 133 passed), a driver-free merge-tree of the head onto current main, a read-only grep census of HotCRM at 2f7b2326e. NOT MEASURED: any HotCRM flow run; objectstack validate at the base (base CLI closure not built; the head result alone excludes a new failure); the Studio / REST / MCP wire path (the gate function was driven directly, not saveMetaItem over HTTP); the execute-time contract parse of a malformed envelope already stored in sys_metadata; whole-package suites and every derived check:* gate family (not re-run by rule); the merge queue's rebuilt generation.}

① Derived judgments

(a) Ruling D point 1, measured on the built trees (base 560b724 vs head): a valid envelope { dialect: 'cel', source: 'price * 2' } in fields.* is EVALUATED at run time on both nodes and all three columns (number, text, json each receive 42, run success true); at the base the same rows wrote the literal object into text and json with success true and were refused by the data engine on the number column. The 30 rows for a sole-token template '{price}', a text template 'Total: {price}', the literal 42, a JSON literal with a nested envelope-shaped object, and an array of envelope-shaped members are byte-identical between base and head on every door and at run time (identical JSON rows). A template expression '{round(price * 100) / 100}' writes 21 on both trees. A malformed envelope (no source, non-parsing CEL, template dialect) never reaches the executor at the head: refused at registration. An envelope that parses but faults on the live values fails the run loudly (fields.COL: value expression failed to evaluate as CEL … source: …) and writes nothing. The per-key resolveFieldValues is interpolate() per entry for every non-envelope value, and interpolate() on a plain object is exactly that per-entry recursion (template.ts:397-421), so the preservation holds by construction as well as by measurement. PASS.

(b) No door disagrees at this head. The os validate rule path (runAuthoringRules('validate'), rule expression-invalid, severity error, located at config.fields.FIELD), AutomationEngine.registerFlow (one aggregated refusal naming node 'w' (create_record) create_record field value at config.fields.FIELD), the metadata-protocol publish gate (evaluateRuntimeAuthoringGate → 422 / INVALID_METADATA with the same error/expression-invalid issue) and the run time all draw the envelope line with the same imported predicate isExpressionEnvelopeShaped and the same shape rule FlowValueSlotSchema, and every one of the 72 rows agrees across them. FlowSchema.parse accepts every row on both trees because node config is an open record — it is not a door for this slot (nor for assignments.* today), so it declares nothing the runtime does not honour. The one ledgered class of disagreement is the published JSON Schema for CreateRecordConfig / UpdateRecordConfig / FlowValueSlot, which is wider than the Zod (the .superRefine does not project): declared in dropped-refinements.baseline.json and stamped x-dropped-refinements on the artifact, the same class AssignmentValue already sits in; not a new window. PASS.

(c) Only the TOP-level field value is judged: measured, a nested { dialect: 'cel', source } inside a JSON literal or an array is interpolated as data and written verbatim on both trees. A top-level JSON literal that merely carries a string dialect key (probed: { dialect: 'en-US', label: 'x' }) IS misread as an envelope at the head — and the consequence is a loud refusal at every door (two expression-invalid errors, registration refused, 422), never a silent rewrite; at the base it was written verbatim. A top-level literal that happens to be a valid CEL envelope is evaluated instead of stored. The changeset states the rule ("Only the top-level value of each field is judged…", "A JSON column whose intended literal value is itself an object with a string dialect key is now read as an envelope") and the escape (bind it to a variable, write '{thatVariable}'), and names the measured census (0 in this repo and HotCRM; my grep of HotCRM src at 2f7b2326e and of examples/ at the head finds no envelope-shaped fields value). Judged safe on the #14149 precedent: the edge is the same one assignments.* accepted, and it is loud. PASS.

(d) {var} keeps its 17.x meaning: the 30 template/literal rows are byte-identical; the four example stacks validate at the head with exit 0 (app-crm 9 warnings, app-multi-package 3, app-showcase 84, app-todo 7; 0 errors each). The hint is severity warning (probe: validate warning, publish gate advisory only, registerFlow OK, run identical; splitBySeverity puts it in advisories and os validate exits 0 without --strict). It fires on 0 sites in the four example stacks at the head and on 0 in-repo non-test flows; no existing in-repo flow newly fails validation. HotCRM at 2f7b2326e carries exactly the two quote-generation money sites the ruling measured (round(... * 100) / 100), which would receive the warning and no error. PASS.

(e) Ruling D point 2: template.ts docblock (the scale-2 pattern now reads round(x * 100) / 100.0 with the measured integer-division reason) and the shipped round() arity refusal (requireArity, "for N-decimal rounding write round(x * 100) / 100.0 … / 100 drops the decimals there") both prescribe / 100.0; the flows.mdx dialect row for create_record / update_record field values prescribes {round(x * 100) / 100.0} and says why; template-functions.test.ts pins the prescription and the measured 1234 vs 1234.57. No remaining "CEL idiom" / "identical in CEL" claim in either file. skills/**: 0 files in the diff. PASS.

(f) Q2: VALUE_ENVELOPE_REFUSAL is slot-neutral ("A value carrying a dialect key…"); ASSIGNMENT_VALUE_ENVELOPE_REFUSAL is kept as a published export and is the same string; AssignmentValueSchema, AssignmentExpressionValueSchema, AssignmentValue, AssignmentValueParsed, AssignmentExpressionValue(Parsed) all remain exported; api-surface/automation.json: 5 added, 0 removed. Measured: a refused field value's message contains no "assignment". PASS.

(g) The grammar meta-guard excuse is a genuine import-specifier artefact: at the head the only occurrences of grammar in validate-expressions.ts are the named import from './flow-template-grammar.js' (line 119) and the docblock's flow-template-grammar.ts (line 146) — the scan /\b([a-z][\w$]*)\??\.[A-Za-z_$]/g reads grammar.j / grammar.t there; no local is named grammar. Every other receiver the change introduces is either uppercase (TEMPLATE_*_RE, SAFE_EXPRESSION_RE, FLOW_TEMPLATE_VALUE_FUNCTIONS) or an already-excused local (found, issues); READ_SURFACES / NOT_A_SINGLE_SHAPE / the tabled set are untouched, so the guard is unchanged for real receivers. The guard test passes at the head (1 passed, 336 skipped under -t). PASS.

(h) dropped-refinements.baseline.json: its header says it is hand-edited on purpose with no gen: script, and that adding a site fails build-schemas.ts until the line moves with it. The gate is the spec build itself (checkDroppedRefinements: undeclared / miscounted / repaired / vanished / unreasoned over entries), which runs in the required Build Core and TypeScript Type Check jobs; the three new entries (automation/CreateRecordConfig fields.valueType, automation/UpdateRecordConfig fields.valueType, automation/FlowValueSlot "") are exactly what the new superRefine sites require, and the head's spec build succeeded with them (turbo cache HIT keyed on this exact tree, then the PR's spec tests green). Correction to the PR's Acceptance note: NONE of the measured totals is pinned — readDroppedRefinementsBaseline reads entries only — so the edited 207→210 / 574→577 are informational prose exactly like the stale refinementSitesThatDidProject 369 the note leaves as found. Non-blocking. PASS.

(i) Other published changes: ASSIGNMENT_VALUE_ENVELOPE_REFUSAL's VALUE changed (stated in the changeset, with the warning that matching on the old literal text breaks); AssignmentExpressionValueSchema's dialect error text is neutral now; predicateSlotRefusal's shipped sentence gained "a create_record / update_record node's fields map" (not named in the changeset; wording only); CreateRecordConfigSchema / UpdateRecordConfigSchema fields values are FlowValueSlotSchema (input type still unknown; JSON Schema gains the description and xExpression: 'value'); LEDGER_DECLARED_NODE_CONFIG_SCHEMAS +2 keys; FLOW_NODE_EXPRESSION_PATHS +2 rows (census 5→7); new exports VALUE_ENVELOPE_REFUSAL, FlowValueSlotSchema / FlowValueSlot / FlowValueSlotParsed, resolveFlowNodeValueSlots; the lint's new advisory rides the existing rule id expression-invalid at warning. No other accept set or export moves. PASS.

② Semver level

Clause-②: yes (widening) with minor for @objectstack/spec, @objectstack/service-automation and @objectstack/lint is consistent with the gates' stated rules: the level axis of check-changeset-no-major requires a declared yes to grade at least one moved package minor or above (three do); the WHICH LEVEL prose grades an additive widening of a published surface minor and the commit type (feat() does not lower it; no major; no BREAKING banner, so check-adr-0087-registration asks for no disposition marker; at most one arm is claimed. The PR body carries Clause-②: yes; the arm lives in the changeset. The changeset names what newly passes (a valid envelope as a top-level fields value, evaluated; before, written verbatim or refused by the data engine) and what newly refuses (a top-level object with a string dialect that is not a valid CEL value envelope — missing / empty / whitespace source, ast-only, template or cron dialect, non-parsing CEL — at every door, located at config.fields.FIELD), states that this is the malformed-envelope edge the assignments map accepted when it gained the envelope (the #14149 edge, not cited by number), and states the nested / literal rule and its escape. The wider read — that a JSON literal carrying a string dialect is thereby refused — is inside that stated edge and matches the ruling record's Q3 reading; it is not a (narrowing) claim. Omissions, wording-only: the predicateSlotRefusal text change and the advisory's rule id. Judged: correct level, correct arm, complete on the two questions asked.

③ Boundary flags

Blocking: the head cannot land as it stands — it is unmergeable against current main and no CI exists for it. Main moved 5 commits past the merge-base 560b724 (4db1bf1 07:42Z … 1c8b320 08:40Z) before the dev's 08:05Z merge commit, which merged the stale 560b724 (the moving-origin/main hazard); a driver-free merge-tree of 94216fb onto 1c8b320 conflicts on content/docs/references/index.mdx (generated; main's 4db1bf1 retired ScheduleState and re-counted), and api-surface/automation.json / json-schema.manifest/automation.json text-merge but must be regenerated per §10/§11. GitHub read the PR as mergeable: false / dirty and builds no merge ref for a conflicting PR, so the pull_request workflows never ran: 0 check-runs, 0 Actions runs on the head. The remedy is the os-regen-merge lap (merge current main, check:generated --fix, push) — which produces a NEW head, so this record certifies 94216fb only and the new head needs its own record and its own green.
Non-blocking: (1) commit order is as ruled — de7c289 (spec, parent 455dcc0 on main) then 8e37b80 (engine), then the merge; the four Acceptance-note items hold: registerFlow's plain aggregated Error with no ADR-0112 code/status is pre-existing and door-wide (measured); the grammar excuse is an artefact (① g); the extra files are tests of claimed files plus the baseline the build requires; the three observations are pre-existing — with the correction in ① h that no measured total in the baseline is pinned. (2) skills/objectstack-automation/SKILL.md:236 still prescribes / 100 — Tier H, deliberately untouched under ruling D point 2, so the wrong guidance stays published there until its own draft lands. (3) After the re-merge, api-surface/automation.json will differ from the head's (ScheduleState gone on main) — expected, regenerated, not this PR's doing. (4) Three --force-with-lease reshapes before any PR existed are declared and met the five criteria. (5) The advisory reuses rule id expression-invalid for a warning; existing practice in the same rule, but a gate keyed on that id at any severity would count it. (6) Draft PR, no labels, assignee os-sales, auto-merge not armed, 1438 changed lines.

CI at this head: absent — GET /commits/94216fb72…/check-runs returns total_count 0 (read at 09:15Z and again at 09:38Z), GET /actions/runs?head_sha= returns 0, the five check-suites (vercel, fly-io, claude, cloudflare-workers-and-pages, objectstack-fleet) are queued with 0 runs, and the only commit status is Vercel: success; none of the seven required contexts (Lint & Repo Gates, TypeScript Type Check, Test Core, Dogfood Regression Gate, Build Core, Temporal Conformance, Governed Surface Queue Guard) has started, because the PR is unmergeable (see Blocking). Not red — not run. Every sibling draft PR opened in the same minutes (#20204, #20207–#20210) carries 16–36 check-runs. Closing keywords: the body closes exactly #19938 and #11182 (Fixes #19938, Fixes #11182; no other closing keyword).

Implemented-by: claude/issue-19938-fields-value-slot
Reviewed-by: session_01CiCTczDo7tGhafXjf61dUJ

VERDICT: PASS

[github-actions]

📓 Docs Drift Check

This PR changes 3 package(s): @objectstack/lint, @objectstack/service-automation, @objectstack/spec, touching 35 documentable anchor(s). ⚠️ 5 changed file(s) yielded no anchor (packages/spec/api-surface/automation.json, packages/spec/declaration-map/automation.json, packages/spec/dropped-refinements.baseline.json, …), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

19 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json ab820016b3e9691870e24a9bbb867336ee5e8f72.

⛔ 4 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 5 changed file(s) yielded no anchor (packages/spec/api-surface/automation.json, packages/spec/declaration-map/automation.json, packages/spec/dropped-refinements.baseline.json, …) — pages documenting those are invisible to this run
• 4 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 136 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json ab820016b3e9691870e24a9bbb867336ee5e8f72 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 4f0f80e5f8a07d1507268fec938e379b78d30d84 — the merge of head 68123f42859e2fa7e3a8346a664c2e155e3ee0a2 into base ab820016b3e9691870e24a9bbb867336ee5e8f72, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 4f0f80e5f8a07d1507268fec938e379b78d30d84 && git checkout 4f0f80e5f8a07d1507268fec938e379b78d30d84
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin ab820016b3e9691870e24a9bbb867336ee5e8f72 68123f42859e2fa7e3a8346a664c2e155e3ee0a2 && git checkout -B drift-repro ab820016b3e9691870e24a9bbb867336ee5e8f72 && git merge --no-ff 68123f42859e2fa7e3a8346a664c2e155e3ee0a2

node scripts/docs-audit/affected-docs.mjs --json ab820016b3e9691870e24a9bbb867336ee5e8f72

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs ab820016b3e9691870e24a9bbb867336ee5e8f72 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 56f77479e557cac2c17e3cc4f5a26455317178bb

_{Delta over record 5854753486 (PASS at 94216fb). Read: that record; the patch-round report 5856232231 on #19938; PR #20205 object (twice, first and last), body, its 8 commits, the 35 check-runs / 12 Actions runs / combined status on 56f7747, the main ruleset's 7 required contexts, the two gate jobs' step lists, the docs-drift-check comment 5854858210 (edited 11:57Z); .gitattributes merge=os-regen lines at the head; dropped-refinements.baseline.json at 560b724, 94216fb, e7f69db, 3875ae6, 805af4f, 56f7747 and its pin packages/spec/scripts/dropped-refinements.test.ts; check-generated.ts's GATED ledger and the lint.yml / ci.yml steps that run its gates; main's 21 first-parent commits 560b724..805af4f (211 files) and its 6 commits since (to 3cb84d0). Ran, read-only in the shared checkout on refs/pr-review/20205: per-file normalized-diff and blob comparison of git diff 560b724c9 94216fb72 against git diff 805af4f29 56f77479e (25 files); a Python recount of the ledger at the six refs; a per-merge blob-origin check of the three merges and the two regen commits; a semantic grep of main's diff between the bases; a driver-free git merge-tree --write-tree 3cb84d084 56f77479e; node scripts/docs-audit/affected-docs.mjs --json 805af4f29… at HEAD 56f7747 in a detached worktree under the scratchpad (the shared checkout's HEAD is 1c8b320, older than the base, where the prescribed invocation --json 56f77479e… returns 0 docs / 0 anchors, so the head's own tree was needed; the bot's merge commit 0fae3a0 has the same tree since the base is its ancestor) and a grep plus spot-read of the 23 pages it lists. NOT MEASURED: any build, test run or check:generated (not re-run by rule); the declaration-map artefact's currency, which no CI step at this head checks (see ① b); the merge queue's rebuilt generation; HotCRM; the semantic judgments of the earlier record, carried over unchanged because every non-generated, non-ledger blob is identical to the one it read.}

① Derived judgments

(a) Same change. Both diffs list the same 25 files with the same name-status, +1223 / −215 on each side. Excluding the 6 merge=os-regen paths and the ledger, the 18 remaining files (the changeset, flows.mdx, 5 lint files, 8 service-automation files, 5 spec source/test files) have a byte-identical normalized diff each (index lines dropped, hunk offsets blanked), identical head blobs (94216fb vs 56f7747) and identical base blobs (560b724 vs 805af4f), so main did not touch any of them; the whole-set normalized-diff hash is 05efa004e2fe0daa on both sides. Files whose diff differs: content/docs/references/index.mdx (generated; main re-counted the base from 1538 to 1522 schemas, the PR's +1 / 74 to 75 hunk is the same) and packages/spec/dropped-refinements.baseline.json (the ledger, ① c). The four automation.json artefacts have identical normalized diffs on blobs that moved with main. PASS.

(b) Generated paths. Against main at 805af4f the PR changes 6 generated files, +35 / −10. The 10 removed lines are the same ten as at the reviewed head, each replaced by a + line that carries the old content plus this PR's addition: the two import lists gain FlowValueSlotSchema / FlowValueSlot, the envelope description reads "the slot" for "the variable", the two fields rows gain the value contract, index.mdx's three count lines go 1522 to 1523 / 74 to 75 and its builtin-node-config schema list gains FlowValueSlot. No main-side line is dropped. Currency at this head, from its CI: Check generated reference docs are in sync with the spec, Check the export-origins baseline resolves as recorded, Check the authorable key surface is recorded and nothing vanished, Check spec-changes.json …, Check the protocol upgrade guide …, Check the meta-url-spelling data module is current (all in Type Check · source gates, success), Check @objectstack/spec public API surface (check:api-surface, Type Check · consumer gates, success), and the spec build with its json-schema.manifest ratchet (Build Core, Type Check · workspace, success). check:declaration-map has no CI step at this head; the artefact's currency rests on the fact that no spec generator changed on main between the bases (git diff --name-only 560b724c9 805af4f29 -- packages/spec/scripts, non-test: empty), its hunk is byte-identical to the one that passed at 94216fb, and the dev's check:generated 15/15 reading, which I did not re-run. PASS.

(c) The hand-resolved ledger. Recounted from the file: old base 207 schemas / 574 sites; old head 210 / 577; main parents e7f69db 207 / 574, 3875ae6 207 / 577, 805af4f 207 / 588; new head 210 / 591, and at every one of the six refs the header equals len(entries) and sum(sites). The PR's added (schema, site) pairs are identical at both heads: automation/CreateRecordConfig fields.valueType, automation/UpdateRecordConfig fields.valueType, automation/FlowValueSlot "". Main added 14 sites and removed none between the bases (the manifest.datasets.element.filter / measures.element.filter family under four Package projections, the $ne family under three); all 14 are present at the new head, no main site is missing, none resurrected, and the new head's entry set equals main's union the PR's three exactly; keys and sites stay sorted; the other header fields (zod 4.4.3, refinementSitesThatDidProject 369, refinementSitesWithNoJsonFormToCompare 0) and the description are byte-equal to main's. Correction to the earlier record's ① h: the two totals ARE pinned — packages/spec/scripts/dropped-refinements.test.ts, "the committed ledger … its header totals match its body", present since before the old base, included by spec's vitest scripts/**/*.test.ts and run in Test Core (success at this head) — so the dev's recount is a gate, not prose, and it is right. PASS.

(d) Merge integrity. Three merges, eac6351 (main e7f69db), d283101 (main 3875ae6), 56f7747 (main 805af4f). In each, every non-generated, non-ledger file the merge changed relative to its branch parent equals main's blob exactly (80, 72 and 41 files), none is content-merged or kept branch-side, and no main-side file's blob at the merge differs from main's except the generated / ledger paths named next. Content-merged: only the ledger, in merges 2 and 3 (judged in ① c). Merge 1 kept the branch's five stale generated blobs (the four automation.json artefacts and index.mdx, the os-regen driver's doing) and 9670123 regenerated exactly those (−17 / +8: the ScheduleState lines main retired in #20194 leave the automation artefacts, index.mdx re-counts); merge 2 kept index.mdx and 7af0516 regenerated it (−5 / +5). Both regen commits touch only generated paths. Main's 21 first-parent commits between the bases touch 211 files, none of the PR's 18 source files; in the PR's neighbourhood they touch packages/lint/src/index.ts (a new validateMappingTargetFields export, #20150), service-automation/README.md (the retired GET /api/v1/automation route, #19543), spec/src/automation/execution.zod.ts (ScheduleState retirement) and three unrelated lint rules; a grep of main's whole diff for predicateSlotRefusal, FlowValueSlot, VALUE_ENVELOPE_REFUSAL, evaluateValueEnvelope, valueEnvelopeRefusals, isExpressionEnvelopeShaped, resolveFlowNodeValueSlots, FLOW_NODE_EXPRESSION_PATHS, LEDGER_DECLARED_NODE_CONFIG_SCHEMAS, resolveFieldValues, crud-nodes, validate-expressions, fields.* and "value slot" hits only the data protocol's $ne "one-value slot" comparand text (#20204), unrelated. No merged main change touches flow-node-expression-paths.ts, the fields.* value slot, predicateSlotRefusal or the engine half. PASS.

(e) Docs drift. Re-derived at the head against 805af4f: 23 docs (19 hand-written, 4 release-owned), 35 anchors, 5 anchorless files — the bot's counts exactly. 18 of the 19 hand-written pages are listed only because they spell the literal node type create_record / update_record (an anchor from LEDGER_DECLARED_NODE_CONFIG_SCHEMAS's new keys) or registerCrudNodes (permissions/system-context.mdx); automation/flows.mdx is listed via FlowValueSlotSchema and is the PR's own edit, unchanged since the reviewed head. A grep of the other 22 pages for dialect, envelope, assignments, round(, / 100, "only value", "value slot", expression-invalid, AssignmentValue, interpolat finds no page that calls fields.* template-only, names the assignment map the only value slot, or prescribes / 100. Spot-read: kernel/runtime-services/examples.mdx:95 writes fields: { line_count: '{totals.line_count}', amount_total: '{totals.total}' } on an update_record node — plain-string templates, which mean at this head exactly what they meant; automation/hooks.mdx:34-37 says an update_record node's fields is structural config os validate checks for "template dialects, declared expression slots", which the declared slot makes more true, not false; releases/v17/17-4.mdx:382 ("An assignment value may be a CEL envelope, validated at registerFlow …") is release-owned history and still true. No listed page states something this PR made false. PASS.

② Semver level

Unchanged from the earlier record: minor for @objectstack/spec, @objectstack/service-automation and @objectstack/lint, Clause-②: yes (widening), the body carries Clause-②: yes. The changeset blob at 56f7747 is the one the earlier record read; Check Changeset is green at this head; no main change between the bases touches any file of this PR or its published surface (① a, ① d), so nothing in the delta moves the level or the arm.

③ Boundary flags

Blocking: none. The earlier record's blocking flag (unmergeable, no CI at 94216fb) is resolved by this delta: the three os-regen-merge laps landed, GitHub reads mergeable: true / clean, and the head has a full green run.
Non-blocking: (1) The dev's note — every spec PR that adds or removes a dropped-refinement site re-conflicts on the ledger's header totals when main moves — is real but not blocking for THIS head: at the time of reading main has moved 6 commits past the base (to 3cb84d0, 12:55Z) and none of them touches the ledger, any PR file or the PR's generated files; a driver-free git merge-tree --write-tree 3cb84d084 56f77479e is conflict-free (tree dfef258a6). It becomes a conflict again only when a main commit changes a site count; the queue admits this head as it stands. (2) check:declaration-map has no CI step at this head, so the declaration-map artefact's currency is not CI-measured (① b); a gap in the gate farm, not in this PR. (3) The earlier record's ① h ("none of the measured totals is pinned") is reversed by ① c: the two totals are pinned by dropped-refinements.test.ts; the earlier verdict is unaffected because the totals were right there too. (4) Draft PR, labels documentation, size/xl, tests, tooling, auto-merge not armed; the ready-for-review flip is the seat's. (5) skills/objectstack-automation/SKILL.md:236 still prescribes / 100 (Tier H, deliberately untouched under ruling D point 2), carried forward.

CI at this head: 35 check-runs on 56f7747, all completed — 33 success, 2 skipped (Console Pin Gate, Packed-tarball smoke (opt-in), both skip by design). All 7 required contexts in the main ruleset are success: TypeScript Type Check, Test Core (and its 6 shards), Dogfood Regression Gate (and its 3 shards), Build Core, Temporal Conformance (live PG + MySQL), Lint & Repo Gates, Governed Surface Queue Guard. The rest: Auto Label, Build Docs, Check Changeset, Check Documentation Links, Check PR Size, Dogfood Verify CLI, Flag docs affected by code changes, No other open PR may claim the same issue, No other open PR may claim the same single-writer path, Part-of PR must not also close its card, Spec property liveness, The card this PR closes must claim this branch, Type Check · consumer gates / debt ledger / source gates / workspace, filter — all success. 12 pull_request workflow runs, 11 success, 1 skipped (Pack Smoke, opt-in). Combined commit status: Vercel success. mergeable: true, mergeable_state: clean, merge commit 0fae3a0, read at the start and again at the end; the head did not move during this review. Closing keywords: the body closes exactly #19938 and #11182 (Fixes #19938, Fixes #11182; no other closing keyword), and the three claim guards are green.

Implemented-by: claude/issue-19938-fields-value-slot
Reviewed-by: session_01CiCTczDo7tGhafXjf61dUJ

VERDICT: PASS

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 68123f42859e2fa7e3a8346a664c2e155e3ee0a2

_{Delta over record 5856341116 at 56f7747: one new commit, the merge 68123f4 (second parent ab82001, the PR's merge base); read with git fetch/diff/show of refs/pr-review/20205 against origin/main and the GitHub REST API (PR, check-runs, combined status, main's ruleset); ran only git, curl, sha256 hashing and a JSON recount. NOT MEASURED: no build, no test suite, no regeneration of the merge=os-regen paths, no re-run of any derived gate; the prior record's whole-set hash 05efa004e2fe0daa was not reproduced (its normalization is not stated), per-file byte equality decides (a) instead.}

① Derived judgments

(a) Same change. git diff --name-status of 68123f4 against ab82001 lists the same 25 paths as 56f7747 against 805af4f: 18 source/test/docs/changeset files, 6 merge=os-regen paths, the ledger. Each of the 18 files' diff, normalized (index line dropped, hunk offsets blanked), is byte-identical old vs new; whole-set sha256-16 is cf83039fc9a069dc at both heads, and the raw unnormalized whole diff of the 18 is 5a90b32a395523dd at both. The 18 blobs at 68123f4 equal the 18 blobs at 56f7747, since main touched none of them between the two bases. No file differs, nothing to read.

(b) Merges. One merge commit, 68123f4, merges ab82001 into 56f7747; ab82001 is the merge base. Its diff against its first parent is exactly main's 103 files between 805af4f and ab82001, and every one of those files' head blob equals main's blob except the ledger. The whole-tree diff of head against main is the 25 PR paths only. The six generated paths: main changed none of them between the bases, and the head-vs-main diff equals the reviewed diff (api-surface/automation.json +5/-0, declaration-map/automation.json +2/-0, export-origins/automation.json +5/-0, json-schema.manifest/automation.json +1/-0, references/automation/builtin-node-config.mdx +12/-5, references/index.mdx +5/-5). Every minus line is replaced by its superset line: the two import lines gain FlowValueSlotSchema / FlowValueSlot, "the variable takes" becomes "the slot takes", the two fields rows gain the value description, index counts move 1522 to 1523 and 74 to 75. No main line dropped, and nothing stale, because main's automation regen inputs did not change. Nine main commits arrived: 6d2571f (#19957), 93cfc3f (#20222), 615c468 (#20224), fc91239 (#19637), 66e266c (#20226), 3cb84d0 (#20227), c02fa12 (#20218), ca753c0 (#20223), ab82001 (#20232). None touches packages/spec/src/automation, packages/services/service-automation or packages/lint/src; none touches flow-node-expression-paths.ts, builtin-node-config.zod.ts, crud-nodes.ts, engine.ts, logic-nodes.ts, node-executor.zod.ts, validate-expressions.ts, template.ts or flows.mdx; main's delta contains no predicateSlotRefusal, FlowValueSlot, evaluateValueEnvelope, VALUE_ENVELOPE_REFUSAL or LEDGER_DECLARED_NODE_CONFIG_SCHEMAS text. Only ca753c0 (#20223, refuse scale on a currency inline grid column) intersects the PR's paths, and only on the ledger. Judgment: no merged main change touches this PR's semantics.

(c) Ledger. The head-vs-main diff of packages/spec/dropped-refinements.baseline.json is exactly the PR's three pairs, automation/CreateRecordConfig [fields.valueType], automation/FlowValueSlot [""], automation/UpdateRecordConfig [fields.valueType], plus the two header totals. Every entry main added or changed since 805af4f (#20223's new data/InlineGridColumn entry and its 12 inlineColumns.element sites across api/AssembledInstalledPackage, api/GetInstalledPackageResponse, api/InstalledPackageAtEitherStage, api/ListInstalledPackagesResponse, api/ObjectDefinitionResponse, data/Field, data/Object, data/ObjectExtension, system/AddFieldOperation, system/ChangeSet, system/CreateObjectOperation, system/MigrationOperation) is present byte-equal in head; no main key lost; keys still sorted; description and the other measured fields equal main. Recount from the head file: 211 entries, 604 sites; the header reads 211 / 604, MATCH, which is what packages/spec/scripts/dropped-refinements.test.ts lines 369-371 pin. A clean git merge-tree of the two parents conflicts only on the two totals (PR 210/591 against main 208/601); the hand resolution 211/604 is main's 208 plus 3 and 601 plus 3, and the head differs from the auto-merge tree in nothing else.

(d) CI at 68123f4: 35 check-runs, 33 success, 2 skipped, 0 failure or neutral; mergeable true, mergeable_state clean; combined status Vercel success. The body's closing keywords are Fixes #19938 and Fixes #11182 and no other (#15430 and #19939 appear only as prose references). Both issues are open. The head did not move during the review (68123f4 at start and at the end).

② Semver level

minor, unchanged from the reviewed change: the changeset at head declares @objectstack/spec, @objectstack/service-automation and @objectstack/lint minor with Clause-②: yes (widening), and the merge adds nothing of this PR's own. Main's own ! commits (#19957, #19637, #20227, #20223) carry their own changesets and are not this PR's level.

③ Boundary flags

Blocking: none
Non-blocking: the prior record's whole-set hash 05efa004e2fe0daa was not reproduced because its normalization is not stated; per-file byte equality of the 18 normalized diffs and blob equality of the 18 files across the two heads decide (a) instead. Two check-runs are skipped, Console Pin Gate and Packed-tarball smoke (opt-in); neither is in main's ruleset required list. origin/main has already moved past the merge base (e0f17a3 at review time) while mergeable_state is still clean at this head, so this ledger may re-conflict again if main's next landing touches it.

CI at this head: 35/35 completed. Required by main's ruleset, all success: TypeScript Type Check, Test Core, Dogfood Regression Gate, Build Core, Temporal Conformance (live PG + MySQL), Lint & Repo Gates, Governed Surface Queue Guard. The other 26 are success (Auto Label, Build Docs, Check Changeset, Check Documentation Links, Check PR Size, Dogfood Regression Gate 1/3 2/3 3/3, Dogfood Verify CLI, Flag docs affected by code changes, No other open PR may claim the same issue, No other open PR may claim the same single-writer path, Part-of PR must not also close its card, Spec property liveness, Test Core 1/6 through 6/6, The card this PR closes must claim this branch, Type Check consumer gates, Type Check debt ledger, Type Check source gates, Type Check workspace, filter) and 2 are skipped (Console Pin Gate, Packed-tarball smoke (opt-in)). Vercel status success. mergeable true, mergeable_state clean.

Implemented-by: claude/issue-19938-fields-value-slot
Reviewed-by: session_01CiCTczDo7tGhafXjf61dUJ

VERDICT: PASS