…ility coverage (#1478)

Add Prime Directive #10: when you encounter a bug/gap/unenforced capability
that's unrelated to the task or too large to fix in scope, open a GitHub issue
and link it — don't silently expand scope or leave it buried. Corollary: never
advertise or demo a capability the runtime doesn't deliver (declared ≠
enforced). Cites the validation-rule enforcement gap (#1475) as the example.

Co-authored-by: Jack Zhuang <277994282+os-zhuang@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

…estore PageTabsProps (#2978) (#3012)

* fix(spec): stop gen:schema silently unpublishing transform-bearing schemas (#2978)

PageTabsProps vanished from json-schema/ when #2967 added an
ExpressionInputSchema (.transform) field — zod's toJSONSchema cannot
represent transforms in the default output mode, and build-schemas.ts
silently skipped it, so the next gen:docs run would have deleted the
published PageTabsProps reference section.

Two-part fix:

1. io:'input' fallback — when output-mode conversion fails on a
   transform, retry with io:'input'. These JSON Schemas describe what
   authors WRITE, and the input side of a transform pipe is plain data,
   so it is representable (for PageTabsProps.visibleWhen it emits the
   correct `anyOf: [string, expression envelope]` authoring shape).
   Rescued schemas are marked `x-io: "input"`. This restores
   PageTabsProps and 149 other transform-blocked public contracts
   (ObjectSchema, FieldSchema, FlowSchema, PageSchema, ActionSchema, …);
   only 18 truly unrepresentable schemas (function/Date/BigInt/custom)
   remain skipped.

2. Disappearance ratchet — json-schema/ is gitignored, so the committed
   json-schema.manifest.json records every schema key ever emitted.
   A key present in the manifest but absent from a build now fails
   gen:schema loudly with remediation steps; deliberate retirements must
   remove the key in the same PR. Silent skip remains only for types
   that have never been representable.

Also escape literal `|` in the description cell of generated property
tables (build-docs.ts) — rescued schemas surfaced descriptions with
pipes that split GFM table rows.

Closes #2978

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fn6qMKtJeVbs2KzouWDHhB

* docs(references): regen from restored JSON Schemas (#2978)

gen:docs over the post-fix json-schema/ output. PageTabsProps keeps its
section (now including the visibleWhen items shape from #2967), and the
149 schemas rescued by the io:'input' fallback gain reference sections —
previously delivered-but-undeclared contracts (Prime Directive #10).
Existing table rows with literal pipes in descriptions are re-emitted
with GFM escaping.

Verified: `pnpm docs:build` compiles all regenerated MDX.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fn6qMKtJeVbs2KzouWDHhB

* fix(spec): address CodeQL alerts in gen:schema/gen:docs scripts (#3012)

- build-schemas.ts: read the ratchet manifest directly and treat ENOENT
  as first-run bootstrap instead of existsSync-then-read (TOCTOU).
- build-docs.ts: escape backslashes before pipes in table-cell
  descriptions — an existing `\|` would otherwise decay into an escaped
  backslash followed by a live pipe, splitting the GFM cell.

No output changes: regenerated json-schema/ and references/ are
byte-identical.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fn6qMKtJeVbs2KzouWDHhB

---------

Co-authored-by: Claude <noreply@anthropic.com>

…rule

Adversarial verification of my own rewrite turned up the irony: "the
runtime validator enforces all 6" is itself advertising a capability the
runtime doesn't fully deliver — exactly what this directive prohibits.

evaluateValidationRules() has two call sites (engine.ts:2265 insert,
engine.ts:2440 single-id update). The options.multi/updateMany branch
never calls it, so on a bulk update all 6 rule types — plus field-level
requiredWhen and per-option visibleWhen authorization, which live inside
the same evaluator — are silent no-ops. The guard warning there is gated
on needsPriorRecord(), which returns false for format/json_schema, so
those two fail with no signal at all.

#1475's 9-vs-3 gap is genuinely closed; the switch does handle all 6.
But "declared == enforced" was true of the switch, not of the system.
Reworded to say what's true, and filed #3106 for the call-site hole
rather than expanding this docs PR into an engine fix (PD #10).

The example now carries the transferable lesson: a case label is not
enforcement — check the call site.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…rective #10 (#3105)

The example cited "the spec declares 9 validation-rule types but the
write-path validator enforces only 3" as a live gap. #1475 closed that:
the types that could never be enforced (unique/async/custom) were trimmed
and the rest implemented, so ValidationRuleSchema now declares 6 and
rule-validator.ts handles all 6.

Rewritten as a closed loop, which can't drift the way the old claim did —
and which demonstrates all three verbs the directive prescribes ("fix it,
trim it, or file an issue") in one case: filed #1475, trimmed 3,
implemented 3.

The example turned out to still be true one layer down, so the rewrite
says so rather than claiming victory: evaluateValidationRules() is wired
into insert and single-id update only, so a bulk updateMany skips every
rule silently — and for format/json_schema without even the warning,
since it's gated on needsPriorRecord(). Filed as #3106 (bug+security)
rather than fixed here, per this directive. Added lesson: a case label is
not enforcement — check the call site.

A stale example is itself the failure mode the directive warns about —
documentation advertising a state the code no longer has.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…ctstack-ai#15168 (objectstack-ai#15303) (objectstack-ai#15583)

The "Flow actions" paragraph under "Authorization inside an action" still
carried the honesty clause the contract's TSDoc carried before objectstack-ai#15168: that
on the flow face `recordLoadDenied` is "declared but not yet populated" and a
guard on it is "inert (never `true`), never wrong".

That is false on `main`. `dispatchFlowAction` spreads
`actionRecordLoadSignal(subject)` into the context it hands
`automation.execute` (`packages/runtime/src/action-execution.ts:904`), and
both action doors reach it through that one function — the REST `/actions`
route (`packages/runtime/src/domains/actions.ts:732`) and the MCP
`run_action` bridge (`packages/runtime/src/action-execution.ts:1758`), each
passing the whole `ActionSubjectRecordLoad` rather than a bare record.

The direction of the defect is the inverted form of the Prime Directive objectstack-ai#10
corollary: not a doc advertising a capability the runtime does not deliver,
but a doc denying one it now does — so an author reading it would not write
the `runAs: 'system'` guard the two-card sequence exists to enable, and no
gate reports it.

The replacement transcribes the sentence that landed on the contract
(`packages/spec/src/contracts/automation-service.ts:56`), adapted to docs
voice by naming the two doors, which that page's readers otherwise cannot
resolve. The surrounding `runAs: 'user'` / `runAs: 'system'` prose and the
`ctx.record.id` table are untouched.


Claude-Session: https://claude.ai/code/session_012zGPuVVX3deAx9LdjK8jCk

Co-authored-by: Claude <noreply@anthropic.com>

…ion guidance

`PageSchema`'s `visibleWhen` and `permissions` wrong-layer prescriptions both
ended by pointing the author at `assignedProfiles` — "or gate the page with
`assignedProfiles`" and "reach it through `assignedProfiles`". Measured on
2026-09-10, `assignedProfiles` has zero readers in this repo and zero readers in
objectui at `3fbdd4a2d`, so both sentences advertised a capability the runtime
does not deliver, at parse time, in the error whose job is to teach the correct
spelling. That is Prime Directive #10's exact prohibition. The key is also named
for the concept ADR-0090 D2 removed.

Both prescriptions now state only what the platform actually does. The
`assignedProfiles` declaration and the `profiles:` / `assignedTo:` alias entries
are deliberately untouched: the key's disposition needs a ruling and stays open
on #16929. Both edited channels fire only from the `unrecognized_keys` path, so
the accept set is unchanged.

Claude-Session: https://claude.ai/code/session_01MkQhmuuJAVDjmeWNixwDDH
Co-authored-by: Claude <noreply@anthropic.com>