feat(spec)!: flow value slots refuse the {…} template dialect, naming the CEL spelling of each token (#19939, C half)

[objectstack-fleet]

Part of #19939 — this lands the C half for every spelling CEL can write today, and measures the B half empty. What stays open on the card: refusing the two spellings this PR deliberately keeps ({NOW()} / {TODAY() ± N} and {$User.*}), each once CEL can spell it — see "Kept, and why" and the report's open question.

Clause-②: yes (narrowing)

The rulings this executes (quoted, not paraphrased)

• [Deferred by ruling] Unify flow field-expression assignment onto the CEL engine — the B half of the #11060 ruling, awaiting maintainer appetite #11182 ruling D (record 5805777944, maintainer 「11182 D 其他同意」), item 3: "v18 carrier. C (refuse the template dialect at registration, per-spelling remedies: / 100.0, has() guards, a string form for NOW() / TODAY()) and whatever of B is lossless ride the v18 train"; governing text: "ADR-0087 D2 (only lossless mappings ride an automatic conversion — the 12 DIFF spellings the round measured are not lossless)".
• The card body: "B, only where lossless. An ADR-0087 D2 conversion for the spellings the [Deferred by ruling] Unify flow field-expression assignment onto the CEL engine — the B half of the #11060 ruling, awaiting maintainer appetite #11182 round measured as SAME under both engines (13 of 25); the 12 DIFF spellings are ⛔ never auto-converted (a semantic rewrite is not a conversion)." and "this repo's 21 sites migrate in the same wave".
• Triage 6051196407: the card is domain:spec whole; the service-automation and lint files are declared cross-lane on the claim 6052247536. The text-slot interpolation in builtin/template.ts is [v18] flow text slots: read ADR-0032 §3's {{ }} delimiter instead of single-brace {token} (notify title/message and the other flow string slots), converting only what renders the same #22110's and is untouched (one docblock paragraph names the value-slot retirement; no code there changed).
• Release state, re-read at push on origin/main f4bed5834 (merged into this branch): .changeset/pre.json is present ("mode": "pre", "tag": "next" — chore(release): enter Changesets pre mode (next) with one major marker, so v18 opens at 18.0.0-next.0 #22084 entered pre mode at 07:03Z today), so per triage 6038868940 and the dispatch this is graded major, with a BREAKING section and an ADR-0087 registered disposition. It was absent at the claim (959c209d5) and at this branch's first merge of main (7d7943dd0); the changeset moved from minor to major in the commit after the second merge.

What changes

A flow VALUE slot no longer reads the single-brace {…} template dialect. In every value slot — create_record.fields.*, update_record.fields.*, the assignment node's assignments map, and the two legacy assignment shapes the executor still reads (the assignments: [{ variable, value }] array and the bare config) — a string, or a string at any depth of an array or object value, that carries a {…} token the interpolator would resolve is refused, with the CEL spelling of each token. A string with no token is the literal text it spells; a computed value is a CEL value envelope.

One judge, every door — packages/spec/src/automation/flow-value-slot-template.ts:

• valueSlotTemplateRefusals(value) judges one value; flowNodeValueTemplateRefusals(nodeType, config) locates every refusal in a node's config (the ledger's value slots through resolveFlowNodeValueSlots, plus the two legacy assignment shapes normalised exactly as the executor normalises them); VALUE_SLOT_TEMPLATE_REFUSAL is the sentence every refusal leads with.
• The contract says it: celValueSlotSchema composes the judge, so FlowValueSlotSchema, AssignmentValueSchema, CreateRecordConfigSchema and UpdateRecordConfigSchema refuse it at the value's path, and AssignmentConfigSchema's catchall (the bare legacy shape) does too — one new dropped-refinement site, ledgered (automation/AssignmentConfig out.catchall, totals 678 → 679).
• Registration — AutomationEngine.registerFlow (validateFlowExpressions) pushes one located failure per refused string: node 'w' (create_record) create_record field value at config.fields.total: ….
• Build door — @objectstack/lint validateStackExpressions reports the same refusal as expression-invalid at error (the existing rule family; it gates os validate, os compile and the metadata save door). This replaces the warning hint ruling D point 1 put there for 17.x.
• Run time — the create_record / update_record executors refuse it at their own parseNodeConfig (through FlowValueSlotSchema), and the assignment executor calls flowNodeValueTemplateRefusals before it assigns anything; both return a guard refusal, so a fault edge cannot route it.

The remedies, per spelling (the refusal names them for the authored token):

you wrote	the refusal prescribes	what changes
'{record.owner}', '{x}'	{ dialect: 'cel', source: 'record.owner' }	CEL refuses an absent variable or key where the template wrote nothing — the has() guard: has(record.owner) ? record.owner : null, has(vars.x) ? vars.x : null (writes null)
'{list.0}'	source: 'list[0]'	an empty list fails the run
'{$error.message}'	source: 'vars["$error"].message'	a $-named variable is read through vars
'{round(x * 100) / 100}'	source: 'round(x * 100) / 100.0'	/ 100.0: CEL divides two integers as integers (123.46 becomes 123) — every integer divisor is rewritten in the prescription
'Renewal — {contract.number}'	source: "'Renewal — ' + contract.number"	wrap a non-string hole in string(…), one that may be null in coalesce(…, '')
'{"a": 1}' (braces meant literally)	source: "'{\"a\": 1}'"	a CEL string literal

B — measured empty: no spelling is lossless (ADR-0087 D2)

Re-measured on this branch, not copied: every spelling was evaluated through the shipped interpolator (interpolateString) and through the shipped CEL value path (AutomationEngine.evaluateValueEnvelope, the real celScope) over the same variables. The 25-row grid reproduces the #11182 round exactly — 13 SAME / 12 DIFF:

#	spelling and input	template	CEL	verdict
S1–S4	{name}, {amount}, {oppRecord.name}, {oppRecord.amount} — key present	the value	the value	SAME
S5	{userList.0} → userList[0], list non-empty	"u1"	"u1"	SAME
S6	{$error.message} → vars["$error"].message, present	"boom"	"boom"	SAME
S7, S8	Hello {o.name}, Total: {amount} → concatenation, holes present	the text	the text	SAME
S9	{o.owner}, key present with null	null	null	SAME
S10	token-free converted → 'converted'	the text	the text	SAME
S11	{round(… / 100 * 100) / 100}, integer-valued amount	54000	54000	SAME
S12, S13	{rows} (a list), {flag} (a boolean)	the value	the value	SAME
D1, D2	the money spelling, amount 1234.56	123.46, 1111.1	123, 1111	DIFF
D3	{10 / 4}	2.5	2	DIFF
D4, D5	{NOW()} → now(), {TODAY()} → today()	ISO text	a Date (Timestamp)	DIFF
D6	string(now())	ISO text	refused: no string(Timestamp) overload	DIFF
D7	{missing} — variable absent	undefined	fault: unknown variable	DIFF
D8	{oppRecord.owner} — key absent	undefined	fault: no such key	DIFF
D9	{userList.0} — empty list	undefined	fault: index out of bounds	DIFF
D10	Hello {o.owner} — hole null	"Hello "	fault: no overload for string plus null	DIFF
D11	{$User.Id} → current_user.id	the run user id	fault: unknown variable current_user	DIFF
D12	token-free converted read as CEL source	the text	fault: unknown variable	DIFF

The "13 of 25" in the card counted probes, not spellings: S1–S13 are the present-key / integer-valued scenarios of the same spellings whose absent-key, null-hole, decimal and Timestamp scenarios are D1–D12. Read per spelling — the unit a conversion rewrites — every authored spelling has a DIFF input: a path faults where the template wrote nothing (D7–D9), text with holes faults on a null hole (D10), arithmetic truncates (D1–D3), the date macros change type (D4–D6), $User has no binding (D11). Only a token with no variable in it ({1.5}, {100}) maps losslessly, and none is authored in either repository. Controls beyond the 25: a has() guard writes null where the template wrote nothing (X2–X4), so it is a semantic rewrite, not a conversion. So, by D2's letter and the card's own "a semantic rewrite is not a conversion", no D2 conversion is registered; the retirement is the D3 semantic entry flow-value-slot-template-dialect-refused (step 18, rationale fragment order 88). A pin replays the whole conversion chain, retired entries included, over every measured spelling and asserts each value comes out as authored.

Kept, and why — two spellings CEL cannot write yet

A refusal must name what to write instead. For two spellings there is nothing to name, measured:

• The date macros — {NOW()}, {TODAY()}, ± N days. CEL's now() / today() / daysFromNow() / addDays() yield a Timestamp, which reaches the data engine as a Date object (measured through ObjectQL with a recording driver: today() into a date field arrives as Date(2026-10-08T00:00:00.000Z) where the macro wrote "2026-10-08"), and string(today()) is refused for want of an overload. This is the card's own contingency ("a packages/formula sub-card if v18 needs it") — it does.
• The run user — {$User.*}. The flow CEL scope binds no user (current_user.id faults, D11). Binding ADR-0068's canonical current_user there is a contract decision this PR does not take (open question in the report).

A string whose tokens include one of these keeps its 17.x meaning; everything else in it would be refused if moved alone, so the whole string is kept. Their refusal is the remaining half of #19939, after the two prerequisites.

This repository's sites (census at 959c209d5)

A TypeScript-AST walk over git ls-files (every create_record / update_record fields value and assignment value, all three shapes, same-file spreads): 21 authored sites, 20 migrated here, 1 kept.

file:line (base)	before	after
examples/app-crm/src/flows/convert-lead.flow.ts:148	'{account_id}'	source: 'account_id'
examples/app-crm/src/flows/convert-lead.flow.ts:149	'{opportunity_id}'	source: 'opportunity_id'
examples/app-showcase/src/automation/flows/index.ts:115	'{new_assignee}'	source: 'new_assignee'
examples/app-showcase/src/automation/flows/index.ts:1235	'{$error.message}'	source: 'vars["$error"].message'
examples/app-showcase/src/automation/flows/index.ts:1602	'{record.title}'	source: 'record.title'
examples/app-showcase/src/automation/flows/index.ts:1603	'{record.assignee}'	source: 'has(record.assignee) ? record.assignee : null'
examples/app-showcase/src/automation/flows/index.ts:1604	'{record.project}'	source: 'has(record.project) ? record.project : null'
examples/app-todo/src/flows/task.flow.ts:377	'{completedTask.subject}'	source: 'completedTask.subject'
examples/app-todo/src/flows/task.flow.ts:377	'{completedTask.description}'	guarded has(completedTask.description) ? … : null
examples/app-todo/src/flows/task.flow.ts:378	'{completedTask.priority}'	guarded
examples/app-todo/src/flows/task.flow.ts:378	'{completedTask.category}'	guarded
examples/app-todo/src/flows/task.flow.ts:379	'{completedTask.owner}'	guarded
examples/app-todo/src/flows/task.flow.ts:380	'{completedTask.recurrence_type}'	guarded
examples/app-todo/src/flows/task.flow.ts:381	'{completedTask.recurrence_interval}'	guarded
examples/app-todo/src/flows/task.flow.ts:384	'{nextDueDate}'	source: 'nextDueDate'
examples/app-todo/src/flows/task.flow.ts:457	'{subject}'	source: 'subject'
examples/app-todo/src/flows/task.flow.ts:457	'{priority}'	source: 'has(vars.priority) ? vars.priority : null'
examples/app-todo/src/flows/task.flow.ts:457	'{dueDate}'	source: 'has(vars.dueDate) ? vars.dueDate : null'
examples/app-todo/src/flows/task.flow.ts:457	'{category}'	source: 'has(vars.category) ? vars.category : null'
examples/app-todo/src/flows/task.flow.ts:457	'{$User.Id}'	kept (the run user — see above)
packages/verify/src/handle.fixture.ts:191	'{resolution}'	source: 'resolution'

Each guard is a judgment the template made silently: a field a screen may leave empty, or a key a row may not carry, writes null (on insert a field default still applies). Docs code samples migrated too: content/docs/automation/flows.mdx (the assignment and create-record examples, an inline comment, the hot-lead example), content/docs/kernel/runtime-services/examples.mdx (two fields), packages/services/service-automation/README.md (one field), and the test fixture packages/qa/dogfood/test/fixtures/flow-durable-suspend-fixture.ts:81.

hotcrm (public, read-only clone at c529de2, not touched): 91 authored sites (2 of them through the same-file MEMBERSHIP_FIELDS spread) — 71 refused (31 bare references, 36 dotted paths, 4 text with holes) and 20 kept (15 date macros — 8 {NOW()}, 3 {TODAY()}, 3 {TODAY() + N}, 1 {TODAY() + var} — and 5 {$User.Id}, all owner_id on create_record); plus 5 in tests (4 refused, 1 kept). Its two money sites already use the CEL envelope with / 100.0.

H4 — where {var} is still read after this change

• In the three value slots: the interpolator call stays (crud-nodes.ts resolveFieldValues, logic-nodes.ts), reached only by the two kept spellings; on every other literal it is the identity. It is removed when the kept spellings are refused. Pinned: the kept spellings resolve through the executors (logic-nodes.test.ts, crud-fields-value-envelope.test.ts), and value-slot-template-grammar.test.ts drives the interpolator over every kept and refused spelling so the spec's copy of the token grammar cannot drift from resolveToken.
• Outside them, unchanged by this card: text slots ([v18] flow text slots: read ADR-0032 §3's {{ }} delimiter instead of single-brace {token} (notify title/message and the other flow string slots), converting only what renders the same #22110's: notify title / message, screen text, end message), filter values (interpolateFilter, the filter-placeholder hand-off), loop.collection / map.collection (the ledger's flow-template role), and the value-like positions subflow.input, map.input, script.inputs, screen.defaults, a screen field's defaultValue, and http (interpolated whole before its parse).

Wrong guidance (ruling D item 2)

builtin/template.ts and content/docs/automation/flows.mdx already carried / 100.0 on main (#20205). This PR removes the last round(x * 100) / 100 claim in its surface: the comment in flow-field-expression-scale.integration.test.ts that called it "the CEL-identical authoring pattern" (the oracle now runs as a CEL envelope with / 100.0, and the docblock states integer division). skills/objectstack-automation/SKILL.md:232 still reads {round(x * 100) / 100} and teaches {token} in fields; it is Tier H and not in this PR.

BREAKING

An accept-set narrowing on a published authoring surface (Clause-②: yes (narrowing), copied from the claim), graded major on the v18 next pre line; the changeset carries the BREAKING banner, the FROM → TO table above and the ADR-0087 disposition registered flow-value-slot-template-dialect-refused. A stored flow carrying a refused value is refused at registration (skipped at boot with a warn naming it); os validate names each one with its CEL spelling.

Tests and gates

This PR opens at b073d92de. The package suites, typechecks and consumer runs below were read at 31c52e59c (or the commit named); the second merge of main after it changed nothing under packages/spec/src/automation, packages/lint, packages/services/service-automation, packages/triggers, packages/qa, packages/verify or examples (in packages/cli, only its secret-rewrap files), and the spec build, generated-artifact check, spec migration / conversion / automation suites and every gate were re-run at b073d92de. The box is shared, so durations are not quoted. Builds, tests and typechecks ran through scripts/pm/os-verify-lock.sh, each read off its VERDICT command-exit line.

• Package suites (vitest, --maxWorkers=2): @objectstack/spec 679 files, 19605 passed + 1 todo; @objectstack/lint 125 files, 5730 passed; @objectstack/service-automation 176 files, 2157 passed.
• Typecheck (pnpm --filter … run typecheck, exit 0 each): spec, lint, service-automation, trigger-record-change, dogfood, cli, example-todo, example-showcase, example-crm, verify.
• Consumers (after a full turbo run build --concurrency=2, exit 0): trigger-record-change 11 files / 114; trigger-schedule 8 / 174; plugin-approvals 61 / 899; verify 18 / 133; example-todo 7 / 238 (at 0d7eb274c); example-showcase 33 / 408; example-crm 5 / 45; mcp 7 / 74, metadata-protocol 6 / 127 and runtime 20 / 548 — each the files of that package that author these node types or load an example (a narrowing, declared: the rest of those suites is CI's); cli unit 2 / 14 and integration 2 / 14 (the integration project run because this diff edits package-install-local-boot-steps.integration.test.ts; four more cli files I named are integration-tier and declared to CI); dogfood 3 / 25 (flow-trigger-record-credential-mask, flow-durable-suspend, expression-conformance).
• The new pins: packages/spec/src/automation/flow-value-slot-template.test.ts (every refused class with its remedy, the kept spellings, the controls, every value-slot contract, every value position of a node, and the no-conversion replay); packages/lint/src/validate-expressions.fields-value-slot.test.ts (the build door: expression-invalid at error, located, in all three value slots and both legacy shapes; kept spellings and filter clean); packages/services/service-automation/src/builtin/crud-fields-value-envelope.test.ts, logic-nodes.test.ts and assignment-value-envelope.test.ts (registration and the run-time twin, nothing written, kept spellings resolve); value-slot-template-grammar.test.ts (the spec judge against the interpolator, kept and refused spellings and the dispatch-order edges).
• Generated artifacts: pnpm --filter @objectstack/spec check:generated — 15 of 15 current after --fix regenerated api-surface/, export-origins/ and content/docs/references/** on the merged tree, re-read exit 0 at b073d92de after pnpm --filter @objectstack/spec build (exit 0); dropped-refinements.baseline.json hand-edited (one site, totals 678 → 679). At b073d92de the spec's src/migrations, src/conversions, src/automation and scripts suites: 115 files, 3251 passed.
• Gates: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack at b073d92de (47 paths vs merge base f4bed5834) derived 120 commands; all 120 ran with their exit codes captured before any pipe. 119 answered exit 0 on the first pass; check:skill-examples answered exit 3 PREREQUISITE NOT MET (packages/client/dist older than src after the merge — nothing measured), and after pnpm --filter @objectstack/client build (exit 0) it answered exit 0, "262 prose examples type-check across 3 surface(s)". --ran reconciliation: "120 derived famil(ies) accounted for — 120 run, 0 NOT-MEASURED". The printed artifact-roster block (35 roster, 14 checker-health self-tests) and the 11 declared wide-population families ran too: 57 exit 0; check-closing-target-claim, check-partof-closing-keyword and check-single-claim-paths answered exit 2 "NOT WIRED" (they need a PR number / body) — NOT MEASURED there; check-partof-closing-keyword with this body as PR_BODY is in the report.
• Merged main twice through scripts/pm/os-regen-merge.sh (each merge committed first, regeneration as its own commit): at 7d7943dd0 (pnpm install --frozen-lockfile after it), and at f4bed5834, which brought .changeset/pre.json and feat(service-settings,platform-objects)!: the settings cascade's global rung moves to the tenant-less sys_platform_setting (ADR-0131 D7) #22166's step-18 entry (sys-setting-global-rung-moved, rationale order 87 — this PR's fragment keeps 88, the next free one; gen:migration-registry re-run on the merged tree changed nothing). Seven later main commits (to 73a0a6bf1) are not merged: git merge-tree answers clean, their three overlapping files (packages/lint/src/validate-expressions.ts / .test.ts, packages/spec/src/migrations/registry.ts) change other regions, and none adds a {…} value-slot string.

Acceptance notes

• current_user in a flow's CEL — the build doors and the run disagree today, independently of this PR: validateExpression('predicate', "current_user.id == 'u1'", { scope: 'flattened', … }) (the check registerFlow and os validate run on a flow condition) answers ok, and ExpressionEngine.evaluate over the flow's scope shape answers "Unknown variable: current_user" (measured at those two primitives; a door-level run is not part of this PR). Binding ADR-0068's current_user in the flow CEL scope would close that and give {$User.*} its remedy — the open question in the report.
• Value-like {var} positions outside this card's three slots still read the dialect: subflow.input, map.input, script.inputs, screen.defaults, a screen field's defaultValue, and http. Text slots are [v18] flow text slots: read ADR-0032 §3's {{ }} delimiter instead of single-brace {token} (notify title/message and the other flow string slots), converting only what renders the same #22110's; these have no carrier.
• Two findings on one value: validate-flow-template-paths still checks a {record.…} path inside a value-slot string that is now refused anyway, so such a value draws both its path finding and the refusal. Harmless; no carrier.
• The save door: the refusal is a validateStackExpressions finding, the rule the runtime publish gate runs on a flow write, so a Studio / REST / MCP save of such a flow answers 422 INVALID_METADATA by construction — not separately measured in this PR (spec: declare create_record / update_record fields.* as a value-role expression slot in the expression ledger, so the CEL envelope is accepted there (the contract half of #11182 ruling D) #19938 measured that door for the envelope arm of the same rule).
• Kept-spelling fixtures: spec and lint test fixtures that only go through FlowSchema.parse or a non-expression rule (flow.test.ts, validate-field-consumers.test.ts, validate-flow-template-paths.test.ts, validate-readonly-flow-writes.test.ts) still spell a value-slot template; they pass, because FlowSchema judges no value slot and those rules filter by their own id.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 4 package(s): @objectstack/lint, @objectstack/service-automation, @objectstack/spec, @objectstack/verify, touching 45 documentable anchor(s). ⚠️ 6 changed file(s) yielded no anchor (packages/services/service-automation/README.md, packages/services/service-automation/src/builtin/template.ts, packages/spec/api-surface/automation.json, …), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

2 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/automation/flows.mdx (via FlowValueSlotSchema (symbol, a top-level const object))
• content/docs/permissions/system-context.mdx (via registerCrudNodes (symbol, a top-level function))

What this run could not see

• 6 changed file(s) yielded no anchor (packages/services/service-automation/README.md, packages/services/service-automation/src/builtin/template.ts, packages/spec/api-surface/automation.json, …) — pages documenting those are invisible to this run
• 11 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 140 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 335c4737f8269ca7a80c7674e997e75139dec43f → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 1158e495b9daa86f87f4bfdf87a9ee3ccc28cdff — the merge of head b073d92ded5132d710a1c952b858e9308854dfda into base 335c4737f8269ca7a80c7674e997e75139dec43f, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 1158e495b9daa86f87f4bfdf87a9ee3ccc28cdff && git checkout 1158e495b9daa86f87f4bfdf87a9ee3ccc28cdff
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 335c4737f8269ca7a80c7674e997e75139dec43f b073d92ded5132d710a1c952b858e9308854dfda && git checkout -B drift-repro 335c4737f8269ca7a80c7674e997e75139dec43f && git merge --no-ff b073d92ded5132d710a1c952b858e9308854dfda

node scripts/docs-audit/affected-docs.mjs --json 335c4737f8269ca7a80c7674e997e75139dec43f

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 335c4737f8269ca7a80c7674e997e75139dec43f → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: b073d92ded5132d710a1c952b858e9308854dfda
Local-runs: none

Inputs read, and nothing else: card #19939 (body and all 7 comments, the newest os-dev-report 6057667009 and the seat's ACCEPT 6057714005 included); #11182 comment 5805777944 (ruling D) verbatim; PR #22259 body, its 47-file list, its one comment (docs-drift, 6057602791), and the net diff against main (merge base f4bed5834, 16 commits, +1589 / -451); the check-runs on b073d92de, read at 2026-10-08T10:20:22Z and again at 10:24:47Z (tally in ③). PR head read from the API: b073d92ded5132d710a1c952b858e9308854dfda, equal to the brief's head.

① Derived judgments

1. Accept-set narrowing — a flow value slot refuses a {…} token. Right. Where it is said: celValueSlotSchema (so FlowValueSlotSchema, AssignmentValueSchema, CreateRecordConfigSchema.fields.*, UpdateRecordConfigSchema.fields.*) judges every non-envelope value through valueSlotTemplateRefusals, a custom issue at the string's own path; AssignmentConfigSchema's catchall (the bare legacy shape) takes LEGACY_ASSIGNMENT_VALUE with envelopeIsLiteral: true. A string at any depth of an array or object literal is judged; a top-level envelope is left to the envelope rule, as before. Pinned in flow-value-slot-template.test.ts (refused classes with their remedies, kept spellings, controls, every contract, every node position, the no-conversion replay) and builtin-node-config.test.ts.

2. The refusal at each door, and whether they agree. Right — one judge, four doors, one verdict.

   • Zod contract: above.
   • AutomationEngine.registerFlow (engine.ts, the expression pass): flowNodeValueTemplateRefusals(node.type, node.config) pushes one located failure per refused string (node 'w' (create_record) create_record field value at config.fields.total: …), inside the existing aggregated ADR-0032 §1a error; a stored flow carrying one is skipped at boot with a warn, the door's existing shape.
   • os validate / os compile / the metadata save door (@objectstack/lint validateStackExpressions): the same function on the same config, reported as expression-invalid at error, located at the node and config.PATH. The 17.x warning hint (templateExpressionToken, templateExpressionEnvelopeHint, the flow-template-grammar import) is removed — ruling D item 1's 17.x shape, replaced by item 3's refusal. Pinned in validate-expressions.fields-value-slot.test.ts across all three value slots and both legacy assignment shapes.
   • Executors: create_record / update_record refuse through their existing parseNodeConfig (FlowValueSlotSchema now composes the judge — crud-nodes.ts carries comment changes only, the refusal rides the existing parse), pinned by the run-time twin (errorClass: 'guard', nothing written); the assignment executor calls the judge before any variable is set and returns refuseNode, pinned likewise.
   • One asymmetry, pre-existing and not widened here: the Zod contract refuses the legacy assignments ARRAY at assignments itself (ASSIGNMENT_ARRAY_FORM_PRESCRIPTION), while registerFlow, lint and the executor judge each element's value. All four refuse; no door accepts what another refuses.

3. The judge's grammar is the interpolator's. Right. Compared against builtin/template.ts at the head: the token regex /\{([^{}]+)\}/g, dateFnMatch /^(NOW|TODAY)\s*\(\s*\)\s*(?:([+\-])\s*(\S+))?$/, the $User. prefix test, the direct-path regex /^[A-Za-z_$][\w$]*(?:\.(?:[A-Za-z_$][\w$]*|\d+))*$/ and the arithmetic charset (word characters, whitespace, the arithmetic, comparison and logical operator characters, parentheses, ., ,, ?, :, both quote characters and $) are byte-identical, in resolveToken's dispatch order (date macro, $User., path, expression). The drift pin is value-slot-template-grammar.test.ts, which drives interpolateString over the kept and refused spellings and the dispatch-order edges ({$User}, {NOW}, { amount }).

4. The remedies the refusal names. Right, and each is pinned: a path → the same path (list.0 → list[0]; a $-named variable → vars["$error"].message) with a has() guard that writes null; arithmetic → every integer divisor as a double (celExpression: / 100 → / 100.0, a divisor already 100.0 left alone); text with holes → one concatenation with the string(…) / coalesce(…, '') advice; a token that is neither path nor expression → the CEL string-literal escape; an unknown call name → the same text, which the envelope's own CEL check then refuses with a did-you-mean. The rule sentence VALUE_SLOT_TEMPLATE_REFUSAL names no tracker number (pinned).

5. Kept spellings: {NOW()} / {TODAY() ± N} and {$User.*}; a string carrying one is kept whole. Within the ruling, as a staged delivery. Ruling D item 3 names the remedy for the macros as "a string form for NOW() / TODAY()", and the card body names the contingency ("a packages/formula sub-card if v18 needs it"); on this head there is none (measured: now() / today() / daysFromNow() / addDays() yield a Timestamp that reaches the data engine as a Date, and string(today()) has no overload), and a refusal with nothing to name is outside Flow field expressions can call no function but NOW()/TODAY() — every other identifier is rewritten to null, so a computed money value can never be rounded to its field's declared scale #11060 A's loud shape the ruling cites. {$User.*} has no binding in the flow CEL scope (current_user.id faults) and the ruling names no remedy for it. The PR is Part of #19939 with no closing keyword, so the card stays open for this half (the Part-of check-run concluded success). The kept set is declared in the contract text, the changeset, the docs and the D3 entry, and pinned at every door. See ③ for the leak this keeps open.

6. "B measured empty" against the ruling's "whatever of B is lossless". Right, by the letter of both. ADR-0087 D2 lets a conversion ride only a LOSSLESS mapping, and a mapping is lossless over all inputs, not over one probe. The dev re-measured on this branch through the shipped interpolateString and the shipped evaluateValueEnvelope over the same variables and reproduced the [Deferred by ruling] Unify flow field-expression assignment onto the CEL engine — the B half of the #11060 ruling, awaiting maintainer appetite #11182 grid (13 SAME / 12 DIFF); read per spelling — the unit a conversion rewrites — every authored spelling has a DIFF input (absent key → nothing vs fault; null hole → nothing vs fault; integer division; Timestamp; no user binding), and the has() form writes null where the template wrote nothing (X2–X4), so it is a semantic rewrite, which the card itself says "is not a conversion". packages/spec/src/conversions/registry.ts is untouched; the retirement is the D3 semantic entry flow-value-slot-template-dialect-refused at step 18 (entries file plus the generated registry.ts copy, STEP18_RATIONALE order 88 — 87 is feat(service-settings,platform-objects)!: the settings cascade's global rung moves to the tenant-less sys_platform_setting (ADR-0131 D7) #22166's), and the pin replays applyConversionsToFlow(flow, { includeRetired: true }) over ten measured spellings and asserts each comes out as authored. This corrects the card's "13 of 25" premise, which counted probes — escalated in ③.

7. The 20 migrated in-repo sites, each read in the diff. All faithful CEL rewrites, guards included:

   • examples/app-crm/src/flows/convert-lead.flow.ts — account_id, opportunity_id as bare paths (both bound by the preceding screens' idVariable; no guard needed).
   • examples/app-showcase/src/automation/flows/index.ts — new_assignee (a required screen field, unguarded); vars["$error"].message (the $-variable through vars); record.title unguarded, record.assignee and record.project guarded with has() (a webhook body may omit them).
   • examples/app-todo/src/flows/task.flow.ts — create_next_task: completedTask.subject unguarded, description / priority / category / owner / recurrence_type / recurrence_interval guarded, nextDueDate unguarded (the script's raw value, type kept); create_task: subject unguarded (required), priority / dueDate / category guarded through vars.*; owner: '{$User.Id}' is the one KEPT site (21 = 20 + 1).
   • packages/verify/src/handle.fixture.ts — resolution (the screen's required field).
     Every guard is a judgment the template made silently (absent → nothing) now made explicit (absent → null); the comments say so at each site. The doc samples (flows.mdx ×4 regions, kernel/runtime-services/examples.mdx, the service-automation README) and the test fixtures (dogfood flow-durable-suspend-fixture.ts, the credential-mask dogfood test, the cli boot-steps integration test, five trigger-record-change tests, and the service-automation / spec / lint suites) are migrated the same way; record-lookup-expand.integration.test.ts's unexpanded probe correctly changes its expectation from undefined (the template's unresolved token) to 'acc1' (string(record.account), the stored scalar).

8. New public surface on @objectstack/spec (automation namespace, export *). Right and regenerated: VALUE_SLOT_TEMPLATE_REFUSAL, valueSlotTemplateRefusals, flowNodeValueTemplateRefusals, FlowNodeValueTemplateRefusal, ValueSlotTemplateOptions, ValueSlotTemplateRefusal — six names added to api-surface/automation.json and export-origins/automation.json. dropped-refinements.baseline.json carries the one new site (automation/AssignmentConfig out.catchall, totals 678 → 679), hand-edited as the kit allows. Published text that changed meaning is covered by the major: the four slot descriptions, ASSIGNMENT_ARRAY_FORM_PRESCRIPTION, the dialect error on AssignmentExpressionValueSchema, and registerFlow's aggregated-error header.

9. H4 — where the dialect is still read in the value slots. Right and declared: the interpolate() call stays in resolveFieldValues and the assignment executor, reached only by the two kept spellings and the identity on every other literal; pinned (logic-nodes.test.ts, crud-fields-value-envelope.test.ts). Text slots, filter, loop.collection / map.collection and the value-like positions outside the card are unchanged (③).

10. Wrong guidance (ruling D item 2). Right: the last round(x * 100) / 100 claim in this surface is removed (the scale integration test's comment; its oracle now runs the / 100.0 envelope and states integer division). skills/objectstack-automation/SKILL.md is Tier H, not in this PR, and the seat filed its card beside the ACCEPT.

11. Which packages publish. Right: @objectstack/spec, @objectstack/service-automation, @objectstack/lint are the three the changeset grades. @objectstack/verify changes only src/handle.fixture.ts, which src/index.ts (the tsup entry) does not reach — it is imported by handle.test.ts alone — so nothing published moves and no changeset is owed. trigger-record-change and cli change tests only; dogfood and the three examples are private.

② Semver level

• Release state at main, read now: .changeset/pre.json is present ("mode": "pre", "tag": "next"); @objectstack/spec is 17.7.0. Triage 6038868940: a breaking change landing after release(v18): enter Changesets pre mode on main (changeset pre enter next) with one major marker, so the first v18 prerelease is 18.0.0-next.0 — the opening ruled B on #22050 #22080 is graded major. The changeset .changeset/19939-flow-value-slot-template-dialect-refused.md grades @objectstack/spec, @objectstack/service-automation and @objectstack/lint major, carries the **BREAKING** banner, the FROM → TO table with the one-line fix, the affected-sites census, and exactly one marker, adr-0087: registered flow-value-slot-template-dialect-refused, whose id exists in migrations/registry.ts step 18. The level matches what the diff publishes: an accept-set narrowing on three published surfaces (contract, engine, build door), 18.0.0-next.* on the open pre line. Right. Both Check Changeset runs on the head concluded success.
• The declaration line. The claim 6052247536, the PR body and the changeset each carry Clause-②: yes (narrowing) at a line start, byte-identical. Under scripts/pm/clause2-line.mjs that is the declared combination "a diff that widens one surface and narrows another; both facts are true and both are read". Under execution-duties.md line 67 (「判据:本卡放宽接受集或扩大公开面吗」; 公开面 = what the built entry declarations reach) this diff enlarges the public surface — the six @objectstack/spec/automation exports in ①-8 — and narrows the accept set, so yes (narrowing) is the truthful reading. The line 5d5a88eff added (line 105 at main: 「收窄已发布接受集的卡是 Clause-②: no,不移车道;入队前欠一次契约复审档复核。」) governs a card that ONLY narrows; its other two facts hold here regardless — the lane is unchanged (domain:spec, triage 6051196407 A) and this record is the owed contract-review-tier review before the queue. The gate outcome is identical under either value: the (narrowing) arm is BREAKING, takes major in pre mode, and requires the ADR-0087 disposition that is present. The dev's open question 3 is thereby answered A (the claim's line stands; nothing to rewrite).

③ Boundary flags

Dev report 6057667009 (the newest os-dev-report), seat ACCEPT 6057714005 (the newest comment), each flag answered or escalated:

• Surface crossed before reporting (dev deviation 1; the seat accepted it). Judged: the crossing carries no behaviour beyond the card. packages/spec/src/automation/** is the contract door triage 6051196407 itself routed to domain:spec ("the card changes what a metadata slot accepts"); service-automation/src/engine.ts is the registerFlow door the claim mislocated under builtin/; the consumer tests in packages/triggers, packages/qa/dogfood, packages/cli and examples/app-todo/test are fixture migrations the refusal forces; dropped-refinements.baseline.json is the kit's named baseline; the README and kernel/runtime-services/examples.mdx are doc samples of the retired spelling. Nothing in the crossing changes a slot, a door or a package the card does not name. Accepted as recorded.
• Open question 1 — {$User.*}: bind ADR-0068's current_user in the flow CEL scope? Escalated to the seat / decision box, as the seat deferred it to landing. Note for that decision: the dev measured the build check and the run disagreeing today independently of this PR (validateExpression('predicate', "current_user.id == 'u1'", flattened scope) → ok; ExpressionEngine.evaluate over the flow scope → unknown variable). The dev's A is the only option whose refusal names a remedy.
• Open question 2 — the date macros' string form. Escalated: the ruling's own wording ("a string form") and the card's named contingency (a packages/formula sub-card) point at the dev's A; B would change what every Timestamp-returning envelope writes today.
• Open question 3 — the Clause-② conflict. Answered in ②: A.
• The kept-spelling leak. A string that mixes a kept token with any other ('Due {TODAY()} for {name}', 'Owner: {$User.Id}' beside a path) is kept WHOLE, so {name} still resolves through the interpolator in such a string. Declared (judge docblock, changeset, docs) and pinned, and the alternative (refusing the mixed string) would name no remedy for the macro half — but it means the dialect is not closed in the value slots until both kept spellings are refused. The seat places this on the card's open half explicitly.
• null on insert where the template wrote nothing. The guarded example sites and their comments assert "a null on insert is 'no value', and a field default still applies"; the migrated flows run end-to-end in task-recurrence.test.ts over the real todo metadata, but the default-applies reading is not itself pinned in this diff. The examples are private; recorded as a reading for the seat, not a contract defect.
• Card premises corrected by measurement (dev deviation 7): "13 of 25 SAME" counts probes, not spellings (B empty); hotcrm has 91 authored sites, not 92. Escalated: the card body still states both; the seat annotates the card when placing the kept half and filing the hotcrm migration card.
• Value-like {var} positions outside the three slots (subflow.input, map.input, script.inputs, screen.defaults, a screen field's defaultValue, http) still read the dialect — outside the card's "flow assignment / fields.* value" scope, no carrier named. Escalated as a family close-out the seat decides on; not a defect of this PR.
• validate-flow-template-paths double finding on a refused {record.…} value: harmless, no carrier. Accepted.
• The save door not separately measured: by construction the same validateStackExpressions finding the runtime publish gate runs (spec: declare create_record / update_record fields.* as a value-role expression slot in the expression ledger, so the CEL envelope is accepted there (the contract half of #11182 ruling D) #19938 measured that door for the envelope arm of the same rule). Accepted.
• skills/objectstack-automation/SKILL.md still teaches the refused spellings and {round(x * 100) / 100} (class c, named producer, Tier H): seat filed. Accepted.
• B empty, conversions/registry.ts untouched (dev deviation 2): judged right in ①-6.
• One typecheck outside the verify lock; narrowed consumer runs (mcp, metadata-protocol, runtime selected files; four cli integration files declared to CI) (deviations 3–4): the check-runs on the head are the verdict — Type Check · source gates, Type Check · debt ledger, Type Check · workspace, Type Check · consumer gates, Dogfood Verify CLI, Dogfood Regression Gate (1–3/3), Temporal Conformance, Build Core, Build Docs, Spec property liveness, Governed Surface Queue Guard and the claim checks all concluded success by 10:24:47Z; Test Core (1–6/6) and Lint & Repo Gates were still in_progress at that read.
• Seven later main commits not merged (deviation 5): git merge-tree clean per the report, and CI runs the merge of this head into the current base (the docs-drift comment names it: 1158e495b). Accepted.
• Attribution trailer (deviation 6): the dev kept commits free of a model identifier, consistent with the dispatch; no action.
• Check-run tally on b073d92ded5132d710a1c952b858e9308854dfda (2026-10-08). 10:20:22Z: 36 runs — 18 success, 5 skipped, 13 in_progress. 10:24:47Z: 38 runs — 26 success, 5 skipped, 7 in_progress. 10:27:50Z (last read before this post): 38 runs — 29 success, 5 skipped, 4 in_progress (Lint & Repo Gates, Test Core (1/6), (4/6), (6/6)), 0 failed. Their conclusions are the gate verdicts; the seat reads them green before landing, as Prime Directive 14's Tier S condition requires beside this record.

Implemented-by: claude/issue-19939-flow-template-dialect-retire
Reviewed-by: session_01RPo7FUd6bSnAfkWMAKi848

VERDICT: PASS