[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and publish to npm yourself or setup this action to publish automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

The changelog information of each package has been omitted from this message, as the content exceeds the size limit.

@objectstack/cli@18.3.0

@objectstack/client@18.3.0

@objectstack/connector-mcp@18.3.0

@objectstack/connector-openapi@18.3.0

@objectstack/formula@18.3.0

@objectstack/lint@18.3.0

@objectstack/metadata@18.3.0

@objectstack/metadata-core@18.3.0

@objectstack/metadata-protocol@18.3.0

@objectstack/objectql@18.3.0

@objectstack/platform-objects@18.3.0

@objectstack/plugin-approvals@18.3.0

@objectstack/plugin-auth@18.3.0

@objectstack/plugin-email@18.3.0

@objectstack/plugin-security@18.3.0

@objectstack/plugin-sharing@18.3.0

@objectstack/rest@18.3.0

@objectstack/runtime@18.3.0

@objectstack/service-analytics@18.3.0

@objectstack/service-automation@18.3.0

@objectstack/service-i18n@18.3.0

@objectstack/service-messaging@18.3.0

@objectstack/skills@18.3.0

@objectstack/spec@18.3.0

@object-ui/console@18.3.0

@object-ui/cli@18.3.0

@object-ui/components@18.3.0

@object-ui/core@18.3.0

@object-ui/i18n@18.3.0

@object-ui/layout@18.3.0

@object-ui/plugin-calendar@18.3.0

@object-ui/plugin-dashboard@18.3.0

@object-ui/plugin-detail@18.3.0

@object-ui/plugin-form@18.3.0

@object-ui/plugin-gantt@18.3.0

@object-ui/plugin-grid@18.3.0

@object-ui/plugin-kanban@18.3.0

@object-ui/plugin-list@18.3.0

@object-ui/plugin-map@18.3.0

@object-ui/plugin-timeline@18.3.0

@object-ui/plugin-tree@18.3.0

@object-ui/plugin-view@18.3.0

@object-ui/react@18.3.0

@object-ui/types@18.3.0

@objectstack/hono@18.3.0

@objectstack/account@18.3.0

@objectstack/setup@18.3.0

@objectstack/studio@18.3.0

@objectstack/client-react@18.3.0

@objectstack/cloud-connection@18.3.0

@objectstack/connector-rest@18.3.0

@objectstack/connector-slack@18.3.0

@objectstack/core@18.3.0

create-objectstack@18.3.0

@objectstack/driver-memory@18.3.0

@objectstack/driver-mongodb@18.3.0

@objectstack/driver-odata@18.3.0

@objectstack/driver-sql@18.3.0

@objectstack/driver-sqlite-wasm@18.3.0

@objectstack/driver-turso@18.3.0

@objectstack/mcp@18.3.0

@objectstack/metadata-fs@18.3.0

@objectstack/observability@18.3.0

@objectstack/embedder-openai@18.3.0

@objectstack/knowledge-memory@18.3.0

@objectstack/knowledge-ragflow@18.3.0

@objectstack/organizations@18.3.0

@objectstack/plugin-audit@18.3.0

@objectstack/plugin-dev@18.3.0

@objectstack/plugin-hono-server@18.3.0

@objectstack/plugin-pinyin-search@18.3.0

@objectstack/plugin-webhooks@18.3.0

@objectstack/service-cache@18.3.0

@objectstack/service-cluster@18.3.0

@objectstack/service-cluster-redis@18.3.0

@objectstack/service-datasource@18.3.0

@objectstack/service-job@18.3.0

@objectstack/service-knowledge@18.3.0

@objectstack/service-mailbox@18.3.0

@objectstack/service-package@18.3.0

@objectstack/service-print@18.3.0

@objectstack/service-queue@18.3.0

@objectstack/service-realtime@18.3.0

@objectstack/service-settings@18.3.0

@objectstack/service-sms@18.3.0

@objectstack/service-storage@18.3.0

@objectstack/trigger-api@18.3.0

@objectstack/trigger-record-change@18.3.0

@objectstack/trigger-schedule@18.3.0

@objectstack/types@18.3.0

@objectstack/verify@18.3.0

@object-ui/auth@18.3.0

@object-ui/collaboration@18.3.0

@object-ui/create-plugin@18.3.0

@object-ui/data-objectstack@18.3.0

@object-ui/fields@18.3.0

@object-ui/mobile@18.3.0

@object-ui/permissions@18.3.0

@object-ui/plugin-charts@18.3.0

@object-ui/plugin-chatbot@18.3.0

@object-ui/plugin-designer@18.3.0

@object-ui/plugin-editor@18.3.0

@object-ui/plugin-markdown@18.3.0

@object-ui/plugin-report@18.3.0

@object-ui/providers@18.3.0

@object-ui/react-runtime@18.3.0

@objectstack/connector-imap@18.3.0

@objectstack/console@18.3.0

@objectstack/sdui-parser@18.3.0

@object-ui/app-shell@18.3.0

@objectstack/example-crm@4.0.103

@objectstack/example-multi-package@0.0.10

@objectstack/example-showcase@0.3.25

@objectstack/example-todo@4.0.103

@objectstack/example-embed-objectql@0.0.43

@objectstack/dogfood@0.0.51

@objectstack/downstream-contract@0.0.49

@objectstack/http-conformance@0.1.11

[objectstack-fleet]

triage#1 · os-sales · session_01L6bhgV4fMGJHSdSdx3u9mK

Contract-review-claim: session_01L6bhgV4fMGJHSdSdx3u9mK · head 0dee0ad · 2026-10-29T15:21Z

---

Generated by Claude Code

[objectstack-fleet]

triage#1 · os-sales · session_01L6bhgV4fMGJHSdSdx3u9mK

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 0dee0ad54e5296b11715a02a4a8a89d553cece27
Local-runs: none
Scope: skills/objectstack-ai/SKILL.md, skills/objectstack-api/SKILL.md, skills/objectstack-automation/SKILL.md, skills/objectstack-data/SKILL.md, skills/objectstack-formula/SKILL.md, skills/objectstack-i18n/SKILL.md, skills/objectstack-platform/SKILL.md, skills/objectstack-query/SKILL.md, skills/objectstack-ui/SKILL.md, skills/objectstack-upgrade/SKILL.md, skills/objectui/SKILL.md + scripts/check-skill-compatibility-version.mjs, package.json (root version script), .changeset/config.json, .github/workflows/release.yml (version-pr post-version validation), packages/skills/scripts/sync-catalog.mjs, packages/spec/package.json, packages/skills/package.json

① Derived judgments

• Accept set: unchanged — right. The eleven hits hunks are one line each, metadata.version "18.2.0" → "18.3.0". No rule text, no schema, no example moves; every SKILL.md body at the head is byte-identical to its parent commit apart from that line. No accept set widens or narrows.
• Public surface: the catalog's self-declared version moves to 18.3.0 — right, and derived. packages/skills/scripts/sync-catalog.mjs copies skills/** byte for byte into @objectstack/skills dist, so the stamp ships inside @objectstack/skills@18.3.0 (and from main as the next channel). scripts/check-skill-compatibility-version.mjs derives metadata.version from CATALOG_VERSION_PACKAGE = @objectstack/spec, whose packages/spec/package.json reads 18.3.0 at this head; packages/skills/package.json reads 18.3.0 too (the fixed group in .changeset/config.json holds both). Stamp, anchor and catalog package agree.
• compatibility: lines: unchanged — right. deriveFrontmatter repins @objectstack/PKG N.x only when that package's workspace major moves; spec, core and formula are all 18.3.0 at the head, so every pin stays 18.x. The upgrade skill (the one EXEMPT file, pinning no major) is stamped like the rest because the exemption covers the absence of a pin, never the stamp — the head does exactly that.
• Coverage: complete. readSkillFiles walks skills/NAME/SKILL.md one level deep; the head holds eleven skill directories, eleven SKILL.md files, eleven stamps at "18.3.0", double-quoted as the writer spells them. git grep 18.2.0 over skills/ at the head returns nothing.
• Gate verdicts on the head. Check-runs on 0dee0ad5: zero. That is the documented shape, not a gap in this head: changesets/action pushes changeset-release/main with the default GITHUB_TOKEN, and GITHUB_TOKEN events start no workflow (.github/workflows/publish-smoke.yml and release.yml both state it). The one gate the release commit passes is the version-pr job's post-version validation in release.yml, which runs pnpm check:skill-compatibility on the rendered tree and refuses the force-push on red — so the head existing at all is that gate's green. The commit status publish-smoke / packed-tarballs on this head: eleven completed runs, every one success (latest completed 2026-10-29T15:18:32Z, "Fresh install of the release candidate: auth + CRUD green"); at review time a twelfth run (40901458893, started by a later Release run) was in_progress, so the combined status read pending. The twelve github-actions check-suites read action_required (Actions awaiting approval on a bot PR) and carry no run.

② Semver level

• The PR carries no changeset of its own and no skip-changeset label: it is the consuming side. .changeset/ at the head holds README.md and config.json only; 342 changeset files are removed. Tallied from the removed files' frontmatter: 178 minor entries, 496 patch entries, 0 major. The highest level across the fixed group is therefore minor, and the group moves 18.2.0 → 18.3.0 — the level the diff publishes. Packages outside the group (examples, dogfood, conformance) take patch through updateInternalDependencies, as configured.
• Every package.json hunk is a "version" line, with one expected exception: packages/create-objectstack/src/templates/blank/package.json, whose nine @objectstack/* ranges move 18.2.0 → 18.3.0 through sync-template-versions.mjs in the root version script. No dependency range elsewhere moves.
• The Check Changeset gate (pr-automation.yml) exempts exactly this head: branch changeset-release/main and author github-actions[bot], pinned together so a hand-pushed branch cannot borrow it.
• Clause-②: line: none on the PR body — the body is the Changesets action's template, and no changeset of this PR's own exists to carry one. The face here is the rules face, decided by paths (skills/** sits in the governed register), so the tier is not read off a Clause-②: line; the consumed changesets carry their own Clause-②: and Metadata-protocol: lines, judged on the PRs that introduced them, and the @objectstack/skills CHANGELOG at the head reproduces them verbatim.

③ Boundary flags

• Author login. The PR's author is github-actions[bot], not objectstack-fleet[bot]: changesets/action opens and force-pushes the PR with the default GITHUB_TOKEN, and that login is the one pr-automation.yml pins for the release-PR exemption. Expected identity; no escalation.
• Zero check-runs. Structural (see ①); the record's gate reading is the version-pr validation that produced the head plus the publish-smoke commit status. Nothing to fix on this head.
• Staleness — escalated, should-fix at the seat's discretion, not a defect of the tree. The head was rendered from d4ff1a02 (main at 2026-10-29 11:36Z). origin/main is now 18 commits ahead with 15 new changesets (358 pending on main against the 342 this head consumes), and skills/ moved on main in nine files — bodies only (for example the inventory-count deletions of docs: hand-written inventory counts are deleted across skills, docs, READMEs and code comments; the names and the source of truth stay #27542 and the automation recipes of skills(automation): integrations are declared, not coded — rule section, per-archetype recipes, three evals #27322), no version line. A merge of this head keeps main's bodies (merge, not reset) and leaves the 15 changesets to the next train; release-integrity warns of every unconsumed changeset. If 18.3.0 is meant to carry them, dispatch Release with refresh_version_pr before merging; the next 6-hourly tick does the same.
• Commit status in motion. The combined status read pending at review time because run 40901458893 was in progress; the eleven completed runs on this head all concluded success. The seat should see it settle before merging.
• No dev flags and no open_questions exist: bot-authored PR, no card.

④ Design judgment

Judged for every hits file against the code it cites and the scenario it is accepted against: the stamp's reader (check:skill-compatibility, which requires metadata.version to equal @objectstack/spec's workspace version), its pricer (check-skills-token-ratchet, which leaves the one stamp line unpriced), and its consumer (sync-catalog.mjs, which ships the file verbatim in @objectstack/skills@18.3.0).

• skills/objectstack-ai/SKILL.md — stamp "18.3.0"; pin @objectstack/spec 18.x stands against spec 18.3.0. Holds.
• skills/objectstack-api/SKILL.md — same shape. Holds.
• skills/objectstack-automation/SKILL.md — same shape. Holds.
• skills/objectstack-data/SKILL.md — same shape. Holds.
• skills/objectstack-formula/SKILL.md — stamp "18.3.0"; pins @objectstack/spec 18.x and @objectstack/formula 18.x stand against spec and formula 18.3.0. Holds.
• skills/objectstack-i18n/SKILL.md — same shape as ai. Holds.
• skills/objectstack-platform/SKILL.md — stamp "18.3.0"; pins @objectstack/spec 18.x and @objectstack/core 18.x stand against spec and core 18.3.0. Holds.
• skills/objectstack-query/SKILL.md — same shape as ai. Holds.
• skills/objectstack-ui/SKILL.md — same shape as ai. Holds.
• skills/objectstack-upgrade/SKILL.md — stamp "18.3.0"; no pin, exempt by the at the TARGET major rationale, which the live text still carries. Stamped anyway, as the exemption covers the pin and not the stamp. Holds.
• skills/objectui/SKILL.md — stamp "18.3.0"; pin @objectstack/spec 18.x stands. Holds.

Attempts to break it: a skill directory without a SKILL.md (none — eleven directories, eleven files); a nested or extra SKILL.md the walk would miss (the walk is one level and the tree has no deeper SKILL.md under skills/); a stale 18.2.0 left anywhere under skills/ (none); a pin naming a package at a different major than 18 (none); single-quoted or bare stamps (all double-quoted, the writer's spelling); a body byte moved beside the stamp (none — each file differs from its parent by the one line). The change is exactly what node scripts/check-skill-compatibility-version.mjs --fix produces on a tree whose spec is 18.3.0, which is what the root version script runs last.

Must-fix: none. Should-fix: none on the hits files; the staleness escalation in ③ is the seat's call on timing, not a defect of this head.

Implemented-by: changeset-release/main
Reviewed-by: session_01L6bhgV4fMGJHSdSdx3u9mK

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

triage#1 · os-sales · session_01L6bhgV4fMGJHSdSdx3u9mK

Contract-review-claim: session_01L6bhgV4fMGJHSdSdx3u9mK · head 0cf7d96 · 2026-10-29T18:19Z

---

Generated by Claude Code

[objectstack-fleet]

triage#1 · os-sales · session_01L6bhgV4fMGJHSdSdx3u9mK

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 0cf7d96948aa2da58b21f234a879013f8d49bddf
Local-runs: none
Scope: skills/objectstack-ai/SKILL.md, skills/objectstack-api/SKILL.md, skills/objectstack-automation/SKILL.md, skills/objectstack-data/SKILL.md, skills/objectstack-formula/SKILL.md, skills/objectstack-i18n/SKILL.md, skills/objectstack-platform/SKILL.md, skills/objectstack-query/SKILL.md, skills/objectstack-ui/SKILL.md, skills/objectstack-upgrade/SKILL.md, skills/objectui/SKILL.md + scripts/check-skill-compatibility-version.mjs, scripts/check-skills-token-ratchet.mjs, package.json (root version script), .changeset/config.json, .github/workflows/release.yml (version-pr), .github/workflows/publish-smoke.yml, packages/skills/scripts/sync-catalog.mjs, packages/spec/package.json, packages/skills/package.json, packages/core/package.json, packages/formula/package.json

Delta record. The previous record on this PR is comment 6500953854 (PASS, head 0dee0ad54e5296b11715a02a4a8a89d553cece27, rendered from main d4ff1a02). The Changesets action's 6-hourly version-pr run (Release run 40927996621, schedule, 18:08Z to 18:11Z) regenerated changeset-release/main on main 524befb18e (17:00Z); the new head 0cf7d969 is that one commit on top of 524befb1. What moved between the two heads, read locally from git log and git diff 0dee0ad5 0cf7d969, splits cleanly: 29 commits of main's own (d4ff1a02..524befb1: 498 files, 58 new changesets, and body-only edits in eleven skills/** files, among them the bodies of objectstack-automation/SKILL.md, objectstack-data/SKILL.md and objectstack-query/SKILL.md and a CEILINGS move in scripts/check-skills-token-ratchet.mjs for skills/objectui/evals/page-builder.json, 560 to 684), and one commit of the PR's own, the re-rendered chore: version packages. The PR's net diff against its base (GET /pulls/26517/files, seven pages, 650 files: 400 changesets removed, 118 package.json, 117 CHANGELOG.md, 11 SKILL.md, 4 docs/docker image-tag files) agrees with git diff 524befb1 0cf7d969 file for file. Every item the move touches is judged afresh below; what it leaves alone stands as judged in record 6500953854.

① Derived judgments

• Accept set: unchanged — right (re-judged). The eleven hits hunks are still one line each, metadata.version "18.2.0" to "18.3.0", double-quoted as the writer spells them. Against the head's own base 524befb1, each SKILL.md differs by that line alone (git diff 524befb1 0cf7d969 -- skills/: 11 files, 11 insertions, 11 deletions). The body edits visible in a whole-range diff of the three SKILL.md files (automation, data, query) are main's own commits between d4ff1a02 and 524befb1, carried over by the regeneration; they are not this PR's and are not reviewed here. No rule text, no schema, no example moves in the PR's own diff.
• Public surface: the catalog's self-declared version moves to 18.3.0 — right, and derived (re-judged). scripts/check-skill-compatibility-version.mjs at the head still derives metadata.version from CATALOG_VERSION_PACKAGE = '@objectstack/spec'; packages/spec/package.json reads 18.3.0 at this head, as do packages/skills/package.json, packages/core/package.json and packages/formula/package.json (all in the 108-member fixed group of .changeset/config.json). packages/skills/scripts/sync-catalog.mjs is unchanged since the previous head and ships skills/** verbatim into @objectstack/skills@18.3.0. Stamp, anchor and catalog package agree.
• compatibility: lines: unchanged — right. Spec, core and formula are all at major 18 at the head, so every 18.x pin stands; the upgrade skill's EXEMPT entry (rationale: /at\s+the\s+TARGET\s+major/i) still matches its live compatibility: text, which the carry-over did not touch. Stands as judged in record 6500953854.
• Coverage: complete (re-checked on the new head). git ls-tree on 0cf7d969 shows eleven skill directories and eleven SKILL.md files, none deeper; git grep 18.2.0 0cf7d969 -- skills/ returns nothing. The change is exactly what the root version script's last step, node scripts/check-skill-compatibility-version.mjs --fix, writes on a tree whose spec is 18.3.0.
• Gate verdicts on the head. Check-runs on 0cf7d969: zero, the documented shape for a GITHUB_TOKEN push (release.yml and publish-smoke.yml both say so); the 17 check-suites are 12 github-actions suites at action_required and five queued third-party apps, none carrying a run. The gate the release commit passes is the version-pr job's post-version validation (pnpm check:skill-compatibility on the rendered tree), which refuses the force-push on red, so the head's existence is that gate's green. The commit status publish-smoke / packed-tarballs on this head is NOT green yet: three runs so far, 40928442108 and 40929621775 both closed as pending reading "Cancelled before a verdict (superseded by a newer smoke)", and 40929816413 in_progress since 18:20:08Z. In-progress is pending, not green; see ③.
• Outside the hits (lane seat's ACCEPT, named here only). Every package.json hunk other than packages/create-objectstack/src/templates/blank/package.json is a "version" line; that template's nine @objectstack/* ranges move to 18.3.0 through sync-template-versions.mjs. The four non-package files (content/docs/deployment/self-hosting.mdx, content/docs/upgrading.mdx, docker/README.md, content/docs/releases/index.mdx) are the ghcr.io/objectstack-ai/objectstack:18.3.0 image tags and the "current series: 18.3.0, released 2026-10-29" line that sync-docs-image-tags.mjs and sync-release-index-currency.mjs in the root version script write. Derived, not reviewed.

② Semver level

• The PR carries no changeset of its own and no skip-changeset label: it is the consuming side. .changeset/ at the head holds README.md and config.json only; 400 changeset files are removed (the 342 the previous head consumed plus the 58 main added between d4ff1a02 and 524befb1). Tallied from the removed files' frontmatter at 524befb1: 188 minor entries, 588 patch entries, 0 major (317 files patch-only, 74 minor-only, 9 mixed). The highest level across the fixed group is minor, so the group moves 18.2.0 to 18.3.0 — the level the diff publishes.
• Breaking-marked subjects, checked for a hidden major. 73 of the 400 changesets open with a ! subject (feat!:, fix(rest)!:, fix(cli)!: and the like). Every one declares patch or minor and carries its own Clause-②: line, no (narrowing) or yes (narrowing), naming the refusal it tightens; the two carried in by the move, 27500-27489-rest-door-refuse-malformed.md (@objectstack/rest: patch) and 27259-validate-seed-record-values.md (cli, objectql: minor), both read Clause-②: no (narrowing) — refusals added at a door, nothing widened. None declares major; 18.3.0 is right. The levels themselves were judged on the PRs that introduced them and the @objectstack/skills CHANGELOG at the head reproduces the entries verbatim.
• The Check Changeset gate (pr-automation.yml) exempts exactly this head: branch changeset-release/main and author github-actions[bot], pinned together. Unchanged since the previous record.
• Clause-②: line: none on the PR body — the body is the Changesets action's template. The face is the rules face, decided by paths (skills/** sits in the governed register), so the tier is not read off a Clause-②: line.

③ Boundary flags

• Author login. The PR's author is github-actions[bot]: changesets/action opens and force-pushes the PR with the default GITHUB_TOKEN, and that is the login pr-automation.yml pins for the release-PR exemption. Expected identity; no escalation.
• Zero check-runs. Structural (see ①); the gate reading is the version-pr validation that produced the head plus the publish-smoke commit status.
• Commit status not yet green — escalated, the seat waits. Unlike the previous head (eleven completed success smokes), this head has no completed success on publish-smoke / packed-tarballs: two smokes were superseded before a verdict and the third (run 40929816413) is in progress. The combined status reads pending. Not a defect of the tree, but the seat must see a success on 0cf7d969 before merging; if the run is superseded again, the one that follows it is the verdict.
• Staleness — smaller than last time, still present. origin/main (50d05cb1, 17:10Z) is 4 commits ahead of the head's base 524befb1, adding 4 changesets (27471, 27519, 27583, 27602) and touching no skills/** path: 404 pending on main against the 400 this head consumes. A merge now leaves those four to the next train; release-integrity warns of each. If 18.3.0 is meant to carry them, dispatch Release with refresh_version_pr before merging; the next 6-hourly tick does the same.
• Main's carry-over does not break the stamp. The three SKILL.md body edits that rode in (automation line 51, data lines 38 and 294, query lines 22 and 235) sit below the frontmatter and leave the metadata: map, the version: key and the compatibility: line as they were; the version-pr validation ran the stamp reader on exactly this tree and passed. The ratchet ceiling move for skills/objectui/evals/page-builder.json is main's ([skills-docs owed] no objectui skill eval exercises an action block's variant, so the destructive → danger rename (#26779) is untaught to an agent #27243), prices an eval bundle and not a hits file, and leaves the stamp line unpriced as before.
• No dev flags and no open_questions exist: bot-authored PR, no card.

④ Design judgment

Judged for every hits file against the code it cites and the scenario it is accepted against: the stamp's reader (check:skill-compatibility, which requires metadata.version to equal @objectstack/spec's workspace version), its pricer (check-skills-token-ratchet, which excludes the one stamp line from the priced bytes), and its consumer (sync-catalog.mjs, which ships the file verbatim in @objectstack/skills@18.3.0). All three are read at 0cf7d969; only the ratchet's CEILINGS table moved since the previous head, and not for any hits file.

• skills/objectstack-ai/SKILL.md — stamp "18.3.0"; pin @objectstack/spec 18.x stands against spec 18.3.0. One line changed against the base. Holds.
• skills/objectstack-api/SKILL.md — same shape. Holds.
• skills/objectstack-automation/SKILL.md — stamp "18.3.0", one line changed against the base; the body edit at line 51 is main's (d4ff1a02..524befb1), not this PR's. Holds.
• skills/objectstack-data/SKILL.md — stamp "18.3.0", one line changed against the base; body edits at lines 38 and 294 are main's. Holds.
• skills/objectstack-formula/SKILL.md — stamp "18.3.0"; pins @objectstack/spec 18.x and @objectstack/formula 18.x stand against spec and formula 18.3.0. Holds.
• skills/objectstack-i18n/SKILL.md — same shape as ai. Holds.
• skills/objectstack-platform/SKILL.md — stamp "18.3.0"; pins @objectstack/spec 18.x and @objectstack/core 18.x stand against spec and core 18.3.0. Holds.
• skills/objectstack-query/SKILL.md — stamp "18.3.0", one line changed against the base; body edits at lines 22 and 235 are main's. Holds.
• skills/objectstack-ui/SKILL.md — same shape as ai. Holds.
• skills/objectstack-upgrade/SKILL.md — stamp "18.3.0"; no pin, exempt by the at the TARGET major rationale, which the live compatibility: text still carries. Stamped anyway, as the exemption covers the pin and not the stamp. Holds.
• skills/objectui/SKILL.md — stamp "18.3.0"; pin @objectstack/spec 18.x stands. Holds.

Attempts to break it on this head: a skill directory without a SKILL.md (none — eleven directories, eleven files); a nested or extra SKILL.md the one-level walk would miss (none under skills/); a stale 18.2.0 anywhere under skills/ (none); a pin naming a package at a major other than 18 (none); a single-quoted or bare stamp (all double-quoted); a body byte moved beside the stamp in the PR's own diff (none — each file differs from 524befb1 by the one line); a major hidden behind a ! subject that would have made the right stamp 19.0.0 (none — all 73 declare patch or minor, each with a narrowing Clause-②:); a frontmatter break from main's carry-over body edits (none — all below the closing ---, and the version-pr validation passed on this tree). The previous record's findings on the unchanged reader, consumer and config stand.

Must-fix: none. Should-fix: none on the hits files; the pending smoke status and the four-changeset staleness in ③ are the seat's call on timing, not defects of this head.

Implemented-by: changeset-release/main
Reviewed-by: session_01L6bhgV4fMGJHSdSdx3u9mK

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

triage#1 · os-sales · session_01L6bhgV4fMGJHSdSdx3u9mK

Contract-review-claim: session_01L6bhgV4fMGJHSdSdx3u9mK · head 4efdd9db4dc53cfd0fea190c52e890548b1896ef · 2026-10-30T00:33Z

---

Generated by Claude Code

[objectstack-fleet]

triage#1 · os-sales · session_01L6bhgV4fMGJHSdSdx3u9mK

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 4efdd9db4dc53cfd0fea190c52e890548b1896ef
Local-runs: none
Scope: skills/objectstack-ai/SKILL.md, skills/objectstack-api/SKILL.md, skills/objectstack-automation/SKILL.md, skills/objectstack-data/SKILL.md, skills/objectstack-formula/SKILL.md, skills/objectstack-i18n/SKILL.md, skills/objectstack-platform/SKILL.md, skills/objectstack-query/SKILL.md, skills/objectstack-ui/SKILL.md, skills/objectstack-upgrade/SKILL.md, skills/objectui/SKILL.md + scripts/check-skill-compatibility-version.mjs, scripts/check-skills-token-ratchet.mjs, package.json (root version script), .changeset/config.json, .github/workflows/release.yml (version-pr), .github/workflows/publish-smoke.yml, .github/workflows/pr-automation.yml (Check Changeset), packages/skills/scripts/sync-catalog.mjs, packages/spec/package.json, packages/skills/package.json, packages/core/package.json, packages/formula/package.json, skills/objectstack-data/rules/field-types.md (main's carry-over, read)

Delta record. The previous record on this PR is comment 6505032837 (PASS, head 0cf7d96948aa2da58b21f234a879013f8d49bddf, rendered on main 524befb1). The Changesets action's 6-hourly version-pr run (Release run 40978852993, schedule, 00:18Z to 00:20Z on 2026-10-30) regenerated changeset-release/main on main 3cc4563e (23:42Z); the new head 4efdd9db is that one commit, chore: version packages, on top of 3cc4563e. The run's Version PR maintenance job closed success with every step green, among them Validate the post-version tree, which runs pnpm check:skill-compatibility on the rendered tree and refuses the force-push on red. What moved between the two heads, read locally from git log 0cf7d969..4efdd9db (82 commits) and git diff 0cf7d969 4efdd9db (622 files), splits cleanly: 81 commits of main's own (524befb1..3cc4563e: 584 files, 71 new changesets, two changesets re-declared by #27671, a root package.json edit to the check:platform-checklist script, and a two-line edit in skills/objectstack-data/rules/field-types.md from #27533), and one commit of the PR's own, the re-rendered version commit, whose part of the move outside main's range is 110 CHANGELOG.md files and content/docs/releases/index.mdx alone. The PR's net diff against its base (GET /pulls/26517/files, eight pages, 721 files: 471 changesets removed, 118 package.json, 117 CHANGELOG.md, 11 SKILL.md, 4 docs/docker image-tag files) agrees with git diff 3cc4563e 4efdd9db file for file. Every item the move touches is judged afresh below; what it leaves alone stands as judged in record 6505032837.

① Derived judgments

• Accept set: unchanged — right (re-judged). The eleven hits hunks are still one line each, metadata.version "18.2.0" to "18.3.0", double-quoted as the writer spells them. Against the head's own base 3cc4563e, each SKILL.md differs by that line alone (git diff 3cc4563e 4efdd9db -- skills/: 11 files, 11 insertions, 11 deletions; the only added lines are eleven version: "18.3.0", the only removed lines eleven version: "18.2.0"). The eleven SKILL.md files are byte-identical between 0cf7d969 and 4efdd9db (git diff 0cf7d969 4efdd9db -- 'skills/*/SKILL.md' is empty), so unlike the previous move, main carried no SKILL.md body edit into this head. No rule text, no schema, no example moves in the PR's own diff.
• Public surface: the catalog's self-declared version moves to 18.3.0 — right, and derived (re-judged). scripts/check-skill-compatibility-version.mjs at the head is the same blob as at 0cf7d969 and still derives metadata.version from CATALOG_VERSION_PACKAGE = '@objectstack/spec'; packages/spec/package.json reads 18.3.0 at this head, as do packages/skills/package.json, packages/core/package.json and packages/formula/package.json (all in the 108-member fixed group of .changeset/config.json, also unchanged). packages/skills/scripts/sync-catalog.mjs is unchanged and ships skills/** verbatim into @objectstack/skills@18.3.0. Stamp, anchor and catalog package agree.
• compatibility: lines: unchanged — right. Spec, core and formula are all at major 18 at the head, so every 18.x pin stands; the upgrade skill's EXEMPT entry (rationale: /at\s+the\s+TARGET\s+major/i) still matches its live compatibility: text, which nothing in the move touched. Stands as judged in record 6505032837.
• Coverage: complete (re-checked on the new head). git ls-tree on 4efdd9db shows eleven skill directories beside skills/README.md and eleven SKILL.md files, none deeper; git grep 18.2.0 4efdd9db -- skills/ returns nothing. The change is exactly what the root version script's last step, node scripts/check-skill-compatibility-version.mjs --fix, writes on a tree whose spec is 18.3.0; the root version script itself is unchanged by main's root package.json edit, which touches check:platform-checklist only.
• Main's carry-over into the skills tree, read and placed. One file under skills/ moved between the two bases: skills/objectstack-data/rules/field-types.md, two lines (summaryOperations row now spells field? (omit for count), and the sum example drops its "ignored for count" comment), from fix(spec): a count roll-up saves without summaryOperations.field #27533 with changeset 27462-count-rollup-without-field.md (@objectstack/skills: minor, Clause-②: yes (widening), Skills-docs: updated here). It is a rules file, not a hits file, and not this PR's; it is priced by the ratchet at its own ceiling (['skills/objectstack-data/rules/field-types.md', 3158], unchanged), and the changeset states the file's size is unchanged. It is named here because it is the one skills-tree edit this release carries that the previous head did not, and the @objectstack/skills CHANGELOG at the head reproduces its entry (fbb8bec: fix(spec): a count roll-up saves without summaryOperations.field), 28 entries under 18.3.0 against 27 at 0cf7d969.
• Gate verdicts on the head. Check-runs on 4efdd9db: zero, the documented shape for a GITHUB_TOKEN push (release.yml and publish-smoke.yml both say so); the 17 check-suites are 12 github-actions suites at action_required and five queued third-party apps, none carrying a run. The gate the release commit passes is the version-pr job's post-version validation (check:skill-compatibility, check:template-version-sync, check:docs-image-tag-sync, check:release-index-currency-sync, check:release-notes and the rest of its run_gate list on the rendered tree), which refuses the force-push on red, so the head's existence is that gate's green; run 40978852993's step log shows it success. The commit status publish-smoke / packed-tarballs on this head is NOT green: four smokes so far, 40979111447, 40979268048 and 40979871505 each closed cancelled and wrote pending reading "Cancelled before a verdict (superseded by a newer smoke, timed out, or stopped by hand) — nothing measured", and 40980745830 (after Release run b83baed2) in_progress since 00:37:07Z, its Build step running. In-progress is pending, not green; see ③.
• Outside the hits (lane seat's ACCEPT, named here only). 109 package.json hunks are the fixed group's "version": "18.3.0" line alone; eight private workspaces outside the group (examples/app-crm, app-multi-package, app-showcase, app-todo, embed-objectql, packages/qa/dogfood, downstream-contract, http-conformance) take their own dependency-driven patch bumps (0.0.9 to 0.0.10, 4.0.102 to 4.0.103 and the like); packages/create-objectstack/src/templates/blank/package.json moves its nine @objectstack/* ranges to 18.3.0 through sync-template-versions.mjs. The four non-package files (content/docs/deployment/self-hosting.mdx, content/docs/upgrading.mdx, docker/README.md, content/docs/releases/index.mdx) are the ghcr.io/objectstack-ai/objectstack:18.3.0 image tags, OS_CLI_VERSION=18.3.0, @objectstack/cli@18.3.0, and the "current series: 18.3.0, released 2026-10-30" line that sync-docs-image-tags.mjs and sync-release-index-currency.mjs in the root version script write (the release date moved from 2026-10-29 to 2026-10-30 with the re-render, the only index.mdx change between the two heads). Derived, not reviewed.

② Semver level

• The PR carries no changeset of its own and no skip-changeset label: it is the consuming side. .changeset/ at the head holds README.md and config.json only; 471 changeset files are removed (the 400 the previous head consumed plus the 71 main added between 524befb1 and 3cc4563e). Tallied from the removed files' frontmatter at 3cc4563e: 206 minor entries, 690 patch entries, 0 major (380 files patch-only, 80 minor-only, 11 mixed). The highest level across the fixed group is minor, so the group moves 18.2.0 to 18.3.0 — the level the diff publishes.
• Breaking-marked subjects, checked for a hidden major. 83 of the 471 changesets open with a ! subject. Every one declares patch or minor and carries its own Clause-②: line; none is missing one and none declares major. Twelve of the 83 are new or re-declared in the move: 27123-plugin-packaging-bundled-only (minor, no (narrowing)), 27442-explain-empty-user-id, 27484-blank-search-fields-refused, 27501-import-job-unknown-object, 27506-api-action-door-forward, 27582-secret-field-own-ref-only, 27683-search-fields-names-a-field, 27722-datasource-create-credentials-ref (all patch, no (narrowing)), 27478-field-group-related-list-body-tables and 27505-analytics-empty-cube (minor, no (narrowing)), and the two docs(changeset): declare the #27277 and #27425 changesets as Clause-② yes (narrowing) #27671 re-declared, 27277-plugin-driver-floor and 27425-phantom-owner-anchor-fails-closed (both patch, now yes (narrowing), each naming the one export or read it widens beside the refusal it tightens). Refusals added at doors, exports added, nothing removed or renamed; 18.3.0 is right. The levels themselves were judged on the PRs that introduced them.
• The one carried-in changeset naming @objectstack/skills (27462, minor, Clause-②: yes (widening)) is a widening of the spec (count may omit summaryOperations.field) with its skills half in rules/field-types.md; minor is right for a widening, and it does not raise the group's level.
• The Check Changeset gate (pr-automation.yml) exempts exactly this head: branch changeset-release/main and author github-actions[bot], pinned together. Unchanged since the previous record.
• Clause-②: line: none on the PR body — the body is the Changesets action's template. The face is the rules face, decided by paths (skills/** sits in the governed register), so the tier is not read off a Clause-②: line.

③ Boundary flags

• Author login. The PR's author is github-actions[bot]: changesets/action opens and force-pushes the PR with the default GITHUB_TOKEN, and that is the login pr-automation.yml pins for the release-PR exemption. Expected identity; no escalation.
• Zero check-runs. Structural (see ①); the gate reading is the version-pr validation that produced the head plus the publish-smoke commit status.
• Commit status not yet green — escalated, the seat waits. This head has no completed success on publish-smoke / packed-tarballs: three smokes were superseded before a verdict (each a Release run on a newer main cancelling the one before it, by cancel-in-progress) and the fourth, run 40980745830, is in progress. The combined status reads pending. Not a defect of the tree, but the seat must see a success on 4efdd9db before merging; a failure is a new input this record did not see and asks for a fresh record. If the run is superseded again, the one that follows it is the verdict. The smoke checks out the release PR's headRefOid and reports to it, so a run started by a later main push still smokes and judges this head.
• Staleness — smaller than last time, still present. GitHub main is 5 commits ahead of the head's base 3cc4563e (ca167f6d, c5f4a064, 684f2f65, 63fc9472, b83baed2), adding 2 changesets (27549-chunked-init-declared-shape, 27661-owner-anchor-one-reader) and touching no skills/** path: 473 pending on main against the 471 this head consumes. A merge now leaves those two to the next train; release-integrity warns of each. If 18.3.0 is meant to carry them, dispatch Release with refresh_version_pr before merging; the next 6-hourly tick does the same, and each regeneration re-runs the smoke from scratch.
• Main's carry-over does not break the stamp. No SKILL.md body moved between the two bases; the one skills-tree edit (rules/field-types.md, two lines) sits outside every SKILL.md and outside the stamp reader's walk, and the version-pr validation ran the stamp reader on exactly this tree and passed. The ratchet's CEILINGS table is unchanged since the previous head.
• No dev flags and no open_questions exist: bot-authored PR, no card.

④ Design judgment

Judged for every hits file against the code it cites and the scenario it is accepted against: the stamp's reader (check:skill-compatibility, which requires metadata.version to equal @objectstack/spec's workspace version), its pricer (check-skills-token-ratchet, which excludes the one stamp line from the priced bytes), and its consumer (sync-catalog.mjs, which ships the file verbatim in @objectstack/skills@18.3.0). All three are read at 4efdd9db and are the same blobs as at 0cf7d969, so the previous record's reading of them carries over unchanged.

• skills/objectstack-ai/SKILL.md — stamp "18.3.0"; pin @objectstack/spec 18.x stands against spec 18.3.0. One line changed against the base; byte-identical to the previous head. Holds.
• skills/objectstack-api/SKILL.md — same shape. Holds.
• skills/objectstack-automation/SKILL.md — stamp "18.3.0", one line changed against the base; no body edit rode in this time. Holds.
• skills/objectstack-data/SKILL.md — stamp "18.3.0", one line changed against the base; the carried-in edit in its rules/field-types.md is a sibling file, not this one, and teaches what the spec at the head now accepts (count without field), so the skill and the spec it teaches agree. Holds.
• skills/objectstack-formula/SKILL.md — stamp "18.3.0"; pins @objectstack/spec 18.x and @objectstack/formula 18.x stand against spec and formula 18.3.0. Holds.
• skills/objectstack-i18n/SKILL.md — same shape as ai. Holds.
• skills/objectstack-platform/SKILL.md — stamp "18.3.0"; pins @objectstack/spec 18.x and @objectstack/core 18.x stand against spec and core 18.3.0. Holds.
• skills/objectstack-query/SKILL.md — stamp "18.3.0", one line changed against the base; no body edit rode in this time. Holds.
• skills/objectstack-ui/SKILL.md — same shape as ai. Holds.
• skills/objectstack-upgrade/SKILL.md — stamp "18.3.0"; no pin, exempt by the at the TARGET major rationale, which the live compatibility: text still carries. Stamped anyway, as the exemption covers the pin and not the stamp. Holds.
• skills/objectui/SKILL.md — stamp "18.3.0"; pin @objectstack/spec 18.x stands. Holds.

Attempts to break it on this head: a skill directory without a SKILL.md (none — eleven directories, eleven files); a nested or extra SKILL.md the one-level walk would miss (none under skills/); a stale 18.2.0 anywhere under skills/ (none); a pin naming a package at a major other than 18 (none); a single-quoted or bare stamp (all double-quoted); a body byte moved beside the stamp in the PR's own diff (none — each file differs from 3cc4563e by the one line, and from 0cf7d969 by nothing); a major hidden behind a ! subject that would have made the right stamp 19.0.0 (none — all 83 declare patch or minor, each with a Clause-②: line); a carried-in skills change the catalog ships without a changeset (none — the one skills-tree edit is declared by 27462, which names @objectstack/skills, and the CHANGELOG at the head carries its entry); a reader, pricer or consumer that moved under the stamp (none — all three blobs unchanged). The previous record's findings on the unchanged reader, consumer and config stand.

Must-fix: none. Should-fix: none on the hits files; the pending smoke status and the two-changeset staleness in ③ are the seat's call on timing, not defects of this head.

Implemented-by: changeset-release/main
Reviewed-by: session_01L6bhgV4fMGJHSdSdx3u9mK

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

triage#1 · os-sales · session_01L6bhgV4fMGJHSdSdx3u9mK

Contract-review-claim: session_01L6bhgV4fMGJHSdSdx3u9mK · head 3de50edb3cd17d08dc67c213b86b593552922a42 · 2026-10-30T06:32Z

---

Generated by Claude Code

[objectstack-fleet]

triage#1 · os-sales · session_01L6bhgV4fMGJHSdSdx3u9mK

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 3de50edb3cd17d08dc67c213b86b593552922a42
Local-runs: none
Scope: skills/objectstack-ai/SKILL.md, skills/objectstack-api/SKILL.md, skills/objectstack-automation/SKILL.md, skills/objectstack-data/SKILL.md, skills/objectstack-formula/SKILL.md, skills/objectstack-i18n/SKILL.md, skills/objectstack-platform/SKILL.md, skills/objectstack-query/SKILL.md, skills/objectstack-ui/SKILL.md, skills/objectstack-upgrade/SKILL.md, skills/objectui/SKILL.md + scripts/check-skill-compatibility-version.mjs, scripts/check-skills-token-ratchet.mjs (CEILINGS), package.json (root version script), .changeset/config.json, .github/workflows/release.yml (version-pr, Validate the post-version tree), .github/workflows/publish-smoke.yml, .github/workflows/pr-automation.yml (Check Changeset), packages/skills/scripts/sync-catalog.mjs, packages/skills/CHANGELOG.md, packages/spec/package.json, packages/skills/package.json, packages/core/package.json, packages/formula/package.json, packages/drivers/driver-odata/package.json, packages/spec/src/ui/app.zod.ts (ReportNavItemSchema), skills/objectstack-ui/rules/navigation.md, skills/objectstack-data/rules/security.md, skills/objectstack-data/evals/hooks-security-seeds-datasources.json, skills/objectstack-ui/evals/views-apps-actions-pages.json, skills/objectui/guides/app-composition.md, skills/objectui/guides/data-integration.md, skills/objectui/guides/schema-expressions.md, skills/objectui/rules/protocol.md, skills/objectui/evals/data-integration.json, skills/objectui/evals/schema-expressions.json (main's carry-over, read)

Delta record. The previous record on this PR is comment 6512045446 (PASS, head 4efdd9db4dc53cfd0fea190c52e890548b1896ef, rendered on main 3cc4563e). The Changesets action's 6-hourly version-pr run (Release run 41012641034, schedule, 06:11:35Z to 06:14:55Z on 2026-10-30) regenerated changeset-release/main on main fece7812 (05:26Z); the new head is that one commit, chore: version packages (06:14:41Z), whose parent is fece7812. The PR API names 5f6dc96c as the base: that is main's tip at the PR's last update, one commit after fece7812 (#27963, 7 files, one new changeset, no skills/** path), and it is not in the head's tree; the merge base of the head with main is fece7812, and the net diff the files endpoint returns (eight pages, 785 files: 533 changesets removed, 119 package.json, 118 CHANGELOG.md, 11 SKILL.md, 4 docs/docker image-tag files) agrees with git diff fece7812 3de50edb file for file (785 files, 28760 insertions, 8671 deletions). The run's Version PR maintenance job closed success with every step green, among them Verify Changesets "fixed" group covers every public package, Validate the post-version tree (which runs check:skill-compatibility, check:template-version-sync, check:docs-image-tag-sync, check:release-index-currency-sync, check:release-notes and the rest of its run_gate list on the rendered tree and refuses the force-push on red) and Assert the read rehearsal found nothing left to version.

What moved between the two heads: the local clone is shallow at 9cd54faa, so the range is counted through the compare endpoint — 83 commits of main's own between 3cc4563e and fece7812 (84 to 5f6dc96c) — and read as tree diffs locally, which need no history. git diff 4efdd9db 3de50edb is 563 files; main's carry-over git diff 3cc4563e fece7812 is 515 files, of which 62 are new changesets the head consumes (so they appear in neither head) and 11 are under skills/; the move's 110 files outside main's carry-over are all CHANGELOG.md, the PR's own re-render. Unlike the previous move, content/docs/releases/index.mdx did not change between the heads (the release date already read 2026-10-30) and the root package.json did not change. Every item the move touches is judged afresh below; what it leaves alone stands as judged in record 6512045446, naming it.

① Derived judgments

• Accept set: unchanged — right (re-judged). The eleven hits hunks are still one line each, metadata.version "18.2.0" to "18.3.0", double-quoted as the writer spells them. Against the head's own base fece7812, each SKILL.md differs by that line alone (git diff fece7812 3de50edb -- skills/: 11 files, 11 insertions, 11 deletions; the only added lines are eleven version: "18.3.0", the only removed lines eleven version: "18.2.0"). No rule text, no schema, no example moves in the PR's own diff.
• Main's carry-over into a hits file, read and placed. This time one SKILL.md body line rode in through main: skills/objectstack-ui/SKILL.md differs from the previous head by one table row (git diff 4efdd9db 3de50edb -- 'skills/*/SKILL.md': 1 file, 1 insertion, 1 deletion) — the navigation item table's report row now reads reportName? and "A report; no reportName = the app's report index" where it read reportName and "Link to a report". It is main's change, not this PR's (the same row moves in git diff 3cc4563e fece7812), declared by changeset 27609-skills-report-index-nav.md (@objectstack/skills: patch, Clause-②: no), together with rules/navigation.md (the index entry beside the named one), objectui/guides/app-composition.md ({type:'report'} to /reports) and eval case 10 in evals/views-apps-actions-pages.json. Judged against the spec it teaches at the head: packages/spec/src/ui/app.zod.ts ReportNavItemSchema declares reportName: z.string().optional() and its docblock says { type: 'report' } opens the app's report index and the console draws an index entry only where the navigation declares one. The row and the schema agree; see ④. The ten other SKILL.md files are byte-identical between the two heads.
• Main's other skills-tree carry-over, read and placed. Ten more files under skills/ moved between the two bases (95 insertions, 102 deletions in all): objectstack-data/rules/security.md (one presence-only rule beside the secret example, paid for by folding four passages the package holds elsewhere) and its evals/hooks-security-seeds-datasources.json (one case), from 27660-skills-credential-presence-only.md; objectui/rules/protocol.md, guides/schema-expressions.md and evals/schema-expressions.json (bare-string predicates are CEL: === to ==), from 27587-objectui-skill-teaches-cel-predicates.md; objectui/guides/data-integration.md and evals/data-integration.json (the MSW plugin removed in 12.0 is no longer taught), from 27678-objectui-skill-msw-removed.md; and the three 27609 files above. All four changesets are @objectstack/skills: patch, Clause-②: no, Metadata-protocol: none, and the @objectstack/skills CHANGELOG at the head carries their four entries (61c3fdd, 9122271, 9b85162, d4064cc), 32 entries under 18.3.0 against 28 at the previous head. No carried-in skills edit lacks a changeset naming the catalog package.
• The pricer moved under three of those files, and the arithmetic holds. scripts/check-skills-token-ratchet.mjs differs between the heads in its CEILINGS table alone (48 lines, main's): rules/security.md 3687 to 3698, evals/hooks-security-seeds-datasources.json 1573 to 1674, evals/views-apps-actions-pages.json 2009 to 2108, each pinned at its stated byte count (14791, 6695, 8432 bytes), which is exactly what the files measure at the head (ceil(bytes / 4) equals the ceiling in all three). Every other carried-in file sits at or under its unchanged ceiling: navigation.md 9092 bytes = 2273 (ceiling 2273), field-types.md 12631 = 3158 (3158), app-composition.md 4312 = 1078 (1079), schema-expressions.md 26275 = 6569 (6571), protocol.md 17456 = 4364 (4368), data-integration.md 17209 = 4303 (4451), the two objectui evals 466 (471) and 531 (536). The hits file objectstack-ui/SKILL.md is 15412 bytes with its 20-byte stamp line; the ratchet's one exclusion drops that line, 15392 bytes = 3848 tokens against a ceiling of 3851 (it was 3840 at the previous head; the report row added 34 bytes). Nothing in the skills tree the head ships is over its ceiling; the ratchet is a PR gate, so it judged each edit on the PR that landed it, and the version commit cannot move a stamped file's count by design.
• Public surface: the catalog's self-declared version moves to 18.3.0 — right, and derived (re-judged). scripts/check-skill-compatibility-version.mjs at the head is the same blob as at 4efdd9db and still derives metadata.version from CATALOG_VERSION_PACKAGE = '@objectstack/spec'; packages/spec/package.json reads 18.3.0 at this head, as do packages/skills/package.json, packages/core/package.json and packages/formula/package.json. packages/skills/scripts/sync-catalog.mjs is unchanged and ships skills/** verbatim into @objectstack/skills@18.3.0. Stamp, anchor and catalog package agree. The root version script is unchanged; its last step, node scripts/check-skill-compatibility-version.mjs --fix, is what wrote the eleven lines.
• The fixed group grew by one — right, main's, and covered. .changeset/config.json differs between the heads by one line, main's: @objectstack/driver-odata joins the fixed group (109 members). The package is new since the previous head (absent at 3cc4563e; 27741-driver-odata.md and three sibling changesets declare it), so the PR's file list gains packages/drivers/driver-odata/package.json (18.2.0 to 18.3.0, the group's version) and packages/drivers/driver-odata/CHANGELOG.md (its first section, 18.3.0, opening with the 0a4b0fb entry that creates the package), the one-up in the package.json and CHANGELOG.md counts. The version-pr job's Verify Changesets "fixed" group covers every public package step passed on this tree. Lane seat's scope; named here because it explains the count.
• compatibility: lines: unchanged — right. Spec, core and formula are all at major 18 at the head, so every 18.x pin stands; the upgrade skill's EXEMPT entry (rationale: /at\s+the\s+TARGET\s+major/i) still matches its live compatibility: text, which nothing in the move touched. Stands as judged in record 6512045446.
• Coverage: complete (re-checked on the new head). git ls-tree on 3de50edb shows eleven skill directories beside skills/README.md and eleven SKILL.md files, all at depth three, none deeper; git grep 18.2.0 3de50edb -- skills/ returns nothing; the only version: lines under skills/*/SKILL.md are the eleven stamps plus the version: '1.0.0' inside the platform skill's code block, which the stamp writer does not touch and the ratchet prices as authored text.
• Gate verdicts on the head. Check-runs on 3de50edb: zero, the documented shape for a GITHUB_TOKEN push (release.yml and publish-smoke.yml both say so); the 17 check-suites are 12 github-actions suites at action_required and five queued third-party apps, none carrying a run. The gate the release commit passes is the version-pr job's post-version validation, which refuses the force-push on red, so the head's existence is that gate's green; run 41012641034's steps all read success. The commit status publish-smoke / packed-tarballs on this head is NOT green: of the smokes that reported to it, 41012969056, 41013578140, 41013727740 and 41014288297 each closed cancelled and wrote pending reading "Cancelled before a verdict (superseded by a newer smoke, timed out, or stopped by hand) — nothing measured", and 41015095745 (after Release run 41014968536 on main 1c87beb9) is in_progress since 06:37:42Z, its Build step running. The combined status reads pending. In-progress is pending, not green; see ③.
• Outside the hits (lane seat's ACCEPT, named here only). 110 package.json hunks are the fixed group's "version": "18.3.0" line alone (109 members, the odata driver among them); eight private workspaces outside the group take their own dependency-driven patch bumps (4.0.102 to 4.0.103, 0.0.9 to 0.0.10, 0.3.24 to 0.3.25, 0.0.42 to 0.0.43, 0.0.50 to 0.0.51, 0.0.48 to 0.0.49, 0.1.10 to 0.1.11); packages/create-objectstack/src/templates/blank/package.json moves its @objectstack/* ranges to 18.3.0 through sync-template-versions.mjs. The four non-package files are the ghcr.io/objectstack-ai/objectstack:18.3.0 image tags, OS_CLI_VERSION=18.3.0, @objectstack/cli@18.3.0 and the "current series: 18.3.0, released 2026-10-30" line, all unchanged since the previous head. Derived, not reviewed.

② Semver level

• The PR carries no changeset of its own and no skip-changeset label: it is the consuming side. .changeset/ at the head holds README.md and config.json only; 533 changeset files are removed, which is every changeset present at the head's base fece7812 (the 471 the previous head consumed plus the 62 main added between 3cc4563e and fece7812; none dropped). Tallied from the removed files' frontmatter at fece7812: 213 minor entries, 793 patch entries, 0 major (436 files patch-only, 85 minor-only, 12 mixed). The highest level across the fixed group is minor, so the group moves 18.2.0 to 18.3.0 — the level the diff publishes.
• Breaking-marked subjects, checked for a hidden major. 94 of the 533 changesets open with a ! subject. Every one declares patch or minor and carries its own Clause-②: line; none is missing one and none declares major. Eleven of the 94 are new in the move: 27606-public-form-option-subset, 27669-clone-overrides-stray-keys, 27676-import-job-every-row-failed, 27728-27729-import-doors-object-existence, 27801-chunked-init-filename-min1, 27829-search-fields-credential-refused (patch, no (narrowing)), 27705-searchable-credential-fields (minor and patch, no (narrowing)), 27762-datasource-meta-save-credentials-ref, 27810-plugin-publish-parses-compiled-manifest, 27818-datasource-restore-publish-credentials-ref (minor, no (narrowing)) and 27686-plugin-install-parses-compiled-manifest (minor, yes (narrowing)). Refusals added at doors, nothing removed or renamed; 18.3.0 is right. The levels themselves were judged on the PRs that introduced them.
• Thirty-one changesets name @objectstack/skills: 27 carried from the previous head (judged there) and the four new ones in ①, all patch, all Clause-②: no, each a teaching change with no schema, key or behaviour change. Patch is right for each and none raises the group's level; the one carried @objectstack/skills: minor (27462, a spec widening) stands as judged in record 6512045446.
• The Check Changeset gate (pr-automation.yml) exempts exactly this head: branch changeset-release/main and author github-actions[bot], pinned together. Unchanged since the previous record.
• Clause-②: line: none on the PR body — the body is the Changesets action's template. The face is the rules face, decided by paths (skills/** sits in the governed register), so the tier is not read off a Clause-②: line.

③ Boundary flags

• Author login. The PR's author is github-actions[bot]: changesets/action opens and force-pushes the PR with the default GITHUB_TOKEN, and that is the login pr-automation.yml pins for the release-PR exemption. Expected identity; no escalation.
• Zero check-runs. Structural (see ①); the gate reading is the version-pr validation that produced the head plus the publish-smoke commit status.
• Commit status not yet green — escalated, the seat waits. This head has no completed success on publish-smoke / packed-tarballs: four smokes were superseded before a verdict (each a Release run on a newer main cancelling the one before it, by cancel-in-progress) and the fifth, run 41015095745, is in progress. The combined status reads pending. Not a defect of the tree, but the seat must see a success on 3de50edb before merging; a failure is a new input this record did not see and asks for a fresh record. If the run is superseded again, the one that follows it is the verdict. The smoke resolves the open release PR's headRefOid and reports to that sha, so a run started by a later main push still smokes and judges this head. Main was moving at roughly one merge every few minutes while this record was written, which is why four smokes in a row were cancelled.
• Staleness — larger than last time. GitHub main (5e1342a6) is 9 commits ahead of the head's parent fece7812 (5f6dc96c, d5951c8e, 0a52b7dd, 4a5396b8, b6db3692, 3986f9fb, e15a87c4, 1c87beb9, 5e1342a6), adding 8 changesets (27430-metric-tile-description-caption, 27559-extension-rule-tenant-rewrite-wins, 27763-create-form-initial-states, 27861-registry-ref-cell-label, 27868-rollback-carries-item-failures, 27875-datasource-secret-resolver-service, 27899-batch-op-exposure-object-read, 27921-hono-node-server-advisory) and touching no skills/** path: 541 pending on main against the 533 this head consumes. A merge now leaves those eight to the next train; release-integrity warns of each. If 18.3.0 is meant to carry them, dispatch Release with refresh_version_pr before merging; the next 6-hourly tick does the same, and each regeneration re-runs the smoke from scratch and asks for a fresh record.
• Base sha on the PR object. The API's base.sha (5f6dc96c) is one commit past the head's parent; the net diff is against the merge base fece7812, and this record read it there. No effect on the hits.
• Main's carry-over does not break the stamp. The one SKILL.md body row that moved sits in the navigation table, outside the frontmatter the stamp reader parses; the version-pr validation ran check:skill-compatibility on exactly this tree and passed. Every carried-in skills file is at or under its ratchet ceiling at the head (arithmetic in ①), the three raised ceilings are pinned at the landed byte counts, and the catalog package's CHANGELOG declares every carried-in skills edit.
• No dev flags and no open_questions exist: bot-authored PR, no card.

④ Design judgment

Judged for every hits file against the code it cites and the scenario it is accepted against: the stamp's reader (check:skill-compatibility, which requires metadata.version to equal @objectstack/spec's workspace version), its pricer (check-skills-token-ratchet, which excludes the one stamp line from the priced bytes), and its consumer (sync-catalog.mjs, which ships the file verbatim in @objectstack/skills@18.3.0). Reader and consumer are the same blobs as at 4efdd9db; the pricer differs in its CEILINGS table alone, read above.

• skills/objectstack-ai/SKILL.md — stamp "18.3.0"; pin @objectstack/spec 18.x stands against spec 18.3.0. One line changed against the base; byte-identical to the previous head. Holds.
• skills/objectstack-api/SKILL.md — same shape. Holds.
• skills/objectstack-automation/SKILL.md — same shape. Holds.
• skills/objectstack-data/SKILL.md — stamp "18.3.0", one line changed against the base, byte-identical to the previous head; the carried-in edits in its rules/security.md and evals/hooks-security-seeds-datasources.json are sibling files, not this one, and teach what the engine at the head does (a credential column is refused as a filter, sort, group-by or matchFields key with 400 INVALID_FIELD, so only a presence check is allowed), so the skill and the runtime it teaches agree. Holds.
• skills/objectstack-formula/SKILL.md — stamp "18.3.0"; pins @objectstack/spec 18.x and @objectstack/formula 18.x stand against spec and formula 18.3.0. Holds.
• skills/objectstack-i18n/SKILL.md — same shape as ai. Holds.
• skills/objectstack-platform/SKILL.md — stamp "18.3.0"; pins @objectstack/spec 18.x and @objectstack/core 18.x stand against spec and core 18.3.0. Holds.
• skills/objectstack-query/SKILL.md — same shape as ai. Holds.
• skills/objectstack-ui/SKILL.md — stamp "18.3.0", one line changed against the base; one body row moved against the previous head, main's (skills: objectstack-ui teaches only the named report navigation item, not the report-index form #27566 adds #27609), making reportName optional in the report navigation item and naming what omitting it opens. Against the spec at the head, ReportNavItemSchema is one variant whose reportName is .optional() and whose docblock reads { type: 'report' } opens the app's report index (reports), the console drawing an index entry only where the navigation declares one — the row teaches exactly that, and rules/navigation.md shows both entries with the "the console adds none itself" note the schema's comment makes. Against the ratchet, the file prices at 3848 tokens under a 3851 ceiling after the stamp line is excluded, so the row fit the existing headroom without a raise. Against the eval, case 10 in evals/views-apps-actions-pages.json asks for an app's report index entry and expects { type: 'report' } with no reportName, which the row now lets an agent write. Holds.
• skills/objectstack-upgrade/SKILL.md — stamp "18.3.0"; no pin, exempt by the at the TARGET major rationale, which the live compatibility: text still carries. Stamped anyway, as the exemption covers the pin and not the stamp. Holds.
• skills/objectui/SKILL.md — stamp "18.3.0"; pin @objectstack/spec 18.x stands; byte-identical to the previous head. The carried-in edits in its guides/, rules/protocol.md and two evals are sibling files declared by 27587, 27609 and 27678 and are not this file. Holds.

Attempts to break it on this head: a skill directory without a SKILL.md (none — eleven directories, eleven files); a nested or extra SKILL.md the one-level walk would miss (none under skills/); a stale 18.2.0 anywhere under skills/ (none); a pin naming a package at a major other than 18 (none); a single-quoted or bare stamp (all double-quoted); a body byte moved beside the stamp in the PR's own diff (none — each file differs from fece7812 by the one line); a body byte moved by main that the catalog ships without a changeset (none — the one SKILL.md row and the ten sibling files are declared by four @objectstack/skills changesets whose CHANGELOG entries the head carries); a carried-in skills file over its ceiling, or a ceiling raised past its landed measurement (none — all twelve measured at or under, the three raised ones pinned at their stated bytes); a SKILL.md row that teaches a shape the spec at the head refuses (none — reportName is optional in ReportNavItemSchema); a major hidden behind a ! subject that would have made the right stamp 19.0.0 (none — all 94 declare patch or minor, each with a Clause-②: line); a new fixed-group member left out of the version pass (none — the odata driver takes 18.3.0 and the covers-every-public-package step passed); a reader or consumer that moved under the stamp (none — both blobs unchanged). The previous record's findings on the unchanged reader, consumer and workflows stand.

Must-fix: none. Should-fix: none on the hits files; the pending smoke status and the eight-changeset staleness in ③ are the seat's call on timing, not defects of this head.

Implemented-by: changeset-release/main
Reviewed-by: session_01L6bhgV4fMGJHSdSdx3u9mK

VERDICT: PASS

---

Generated by Claude Code