feat(spec,service-automation,lint)!: a loop's and a map's collection is a value slot — a CEL envelope or an inline array, a string refused (#19939 pass 4, S3)

[objectstack-fleet]

Part of #19939
Clause-②: yes (narrowing: a string is refused at loop.collection and map.collection, a {…} token and a variable's bare name alike; widening: both accept a CEL value envelope they refused, their published JSON Schema and inferred types gain the envelope arm, and FlowCollectionSlotSchema is a new export)

Pass 4, stage S3 of #19939 (stage plan 6096263424, claim 6110982937), under ruling D on #11182 and ADR-0032 Decisions 2 and 3. The list a loop (with a body) and a map iterate, their collection, becomes a value slot: a CEL value envelope the executor evaluates in the run's scope, or an inline array, iterated as written. A string there is refused: a single-brace {…} token, naming its CEL spelling, and a variable's bare name, the arm the contract declared and the structured executors never read, naming that variable in an envelope. #19939 stays open for stages S4 to S7, so this PR uses Part of.

What lands

The contract (@objectstack/spec).

• FlowCollectionSlotSchema is the one contract both keys take: a list, or a CEL value envelope (AssignmentExpressionValueSchema). It is a union, like screen.recordId's, so the published JSON Schema and the inferred types keep the list arm and lose string.
• A string is refused with a sentence that names what to write. A {…} token gets the value-slot judge's own refusal, word for word. A bare name gets the rule, then the envelope naming it (rows becomes { dialect: 'cel', source: 'rows' }). A malformed envelope leads with VALUE_ENVELOPE_REFUSAL, as in every value slot. Before this change an envelope here was refused with zod's default "Invalid input".
• LoopConfigSchema.collection and MapConfigSchema.collection take it. Each describe() is restated. LoopConfigSchema drops its xExpression: 'template' meta (see the ledger).

The ledger.

• FLOW_NODE_EXPRESSION_PATHS' loop.collection and map.collection rows move from the flow-template role to value, in place.
• loop.collection carries a new optional field, onlyWithKey: 'body'. Both walks (resolveFlowNodeExpressions, resolveFlowNodeValueSlots) skip the row on a body-less loop: that is the legacy flat-graph form, which reads collection as a bare variable name into $loopItems / $loopIndex, and no door judges it. It is the ledger's statement of the contract map's parsedWhen, and a test holds the two equal.
• The flow-template role recorded these two slots and no other, so it leaves FlowNodeExpressionRole. The ratchet's ROLE_BY_MARKER drops template, so a descriptor that marks a slot xExpression: 'template' again fails as an unknown marker. This is the same defect class, a mechanical removal in a file this claim holds, and the same gate family.
• The marker rides the DESCRIPTOR channel for both slots (xExpression: 'value' on the loop and map descriptors' collection; it was 'template'). The contract carries none, so MapConfigSchema, which the spec channel projects, does not declare map.collection a second time. One slot, one channel, as S1 kept it.

The judge.

• flowNodeValueTemplateRefusals judges a collection with a new option, valueSlotTemplateRefusals(value, { collection: true }). Only the value itself is judged. An inline array's strings are data: the executors never interpolated one, so a {…} inside one is not refused.
• The collection's remedy is its own. A whole variable path is that path in an envelope, and where the list may be absent the guard answers [], which iterates nothing: has(vars.rows) ? vars.rows : []. The value slots' usual guard answers null, and a null collection fails the node, so that guard is never offered here. Any other token (text with holes, an expression, a date macro, the run user) never computed a list, and the refusal says so instead of spelling a concatenation or a date.
• The build doors' value arm (flowNodeConfigRefusals) refuses a token-free string at collection in the contract's words, as it refuses recordId: 42. A token is left to the judge, a malformed envelope to the envelope pass, as before.

The executors (@objectstack/service-automation).

• resolveCollectionSlot (builtin/value-slot-map.ts) is the one reader. An envelope goes to AutomationEngine.evaluateValueEnvelope in the run's scope and context, like every value slot. An inline array is the list as written: it is never handed to the interpolator, whose recursion would resolve a {…} the executors never resolved. No ?? fallback was added.
• loop (with a body) and map call it, and fail the node on anything but a list with a returned failure naming what the envelope evaluated to and its source. The token and bare-name arms, and the dead fallback to a variable lookup, are deleted. A body-less loop is unchanged.
• The loop and map descriptors restate collection: xExpression: 'value', no type (an envelope object or a list; a string is refused), like a screen field's defaultValue.
• AutomationEngine.evaluateValueEnvelope's docblock lists every caller (the S1 carry). The registration failure header no longer says template slots such as loop.collection require braces. The validateFlowExpressions comments no longer describe the retired role.

The lint (@objectstack/lint, patch).

• validate-flow-template-paths infers a loop iterator's object from an envelope collection naming a variable, as it did from the token. Without this, every migrated loop would have lost its {iterator.field} path checks without a word.
• validate-expressions.ts: one comment restated. The value-slot pass reaches the collection through the ledger with no lint source change, so objectstack validate refuses a token and a bare name and reads an envelope's roots like any value slot's.

ADR-0087. The step-18 D3 entry 18.flow-value-slot-template-dialect-refused is amended: its surface widens to the two collections, and its replacement, reason and acceptance criteria say what the list must evaluate to, what an absent one does, and why the bare name is refused rather than rewritten. There is no D2 (below). registry.ts is generated at build and gitignored, so it is not in the diff. The changeset marker is not-required (already-registered flow-value-slot-template-dialect-refused), and check-adr-0087-registration accepts it.

Premises measured at the base 55382dc02a

Measured through the shipped AutomationEngine with a throwaway probe (installBuiltinNodes, registerFlow, execute), deleted after the run.

• Today's contract. LoopConfigSchema.collection was z.union([z.string().min(1), z.array(z.unknown())]) with xExpression: 'template', "a {token} template or bare variable name … or an inline array"; MapConfigSchema.collection was z.union([z.string(), z.array(z.unknown())]). FlowSchema.parse (and registerFlow, which parses first) reached them through flowNodeConfigRefusals, whose contract map parses loop only with a body (parsedWhen). The ledger rows were role flow-template, which every validator skipped.
• The family finding holds. A bare name failed the structured loop and map at every run while registration accepted it:

config	loop (with body)	map
'{rows}', rows = [1, 2]	iterates 1, 2	iterates
'rows', rows = [1, 2]	fails, NODE_FAILURE "collection 'rows' did not resolve to an array"	fails, same
['a', 'b']	iterates	iterates
['{a}'], a = 'resolved'	iterates the text '{a}' (never interpolated)	—
{ dialect: 'cel', source: 'rows' }	refused at registerFlow: "Invalid input"	refused, same
'{rows}', rows absent or null	fails, NODE_FAILURE "did not resolve to an array"	fails, same
body-less loop, 'rows'	$loopItems = [1, 2], $loopIndex = 0	—
body-less loop, '{rows}' or an envelope	nothing set, success	—

• The D2 question: D3 only. Neither spelling maps losslessly.
  • {name} to { dialect: 'cel', source: 'name' }: a present list gives the same list, and a present non-list or null fails the node either way with a returned failure. An absent variable does not: the template failed the node with a returned failure (NODE_FAILURE), and evaluateValueEnvelope throws "Unknown variable: rows", a step EXECUTION_ERROR. A fault edge routes both, but the step and the run record them differently. Not lossless.
  • A bare name to the same envelope: on a structured loop or map the bare name never iterated and the envelope iterates, so the rewrite changes what the flow does. On a body-less loop the bare name works and the envelope is ignored. Not lossless in either direction.

The reach

Re-derived at HEAD; the positive control is the base's 9 token sites in shipped surfaces, which read 0 at HEAD (the two remaining string mentions are prose describing the refused bare name).

• Migrated in this PR: examples/app-showcase (the showcase_batch_reminders and showcase_nested_fan_out_reminders loops, the showcase_release_signoff map), examples/app-todo (the task_reminder and overdue_escalation loops), content/docs/automation/flows.mdx (three samples, the value-slot list, and a new paragraph on the collection), and packages/services/service-automation/README.md. Each was a whole {name} token on a structured node. No shipped flow wrote a bare name. packages/platform-objects and packages/qa/dogfood write no collection.
• Test fixtures: 163 whole-path tokens across spec, lint, service-automation and metadata-protocol tests, rewritten mechanically to the envelope; 13 bare names on structured nodes (lint and spec) to the envelope; eight of those, incidental loop / map fixtures in validate-expressions.test.ts, then to inline arrays, because the lint now refuses an envelope naming a variable the flow never binds. Body-less loop fixtures keep their strings.
• hotcrm (read-only clone at 1d7148bf2d, deleted after): eleven structured loops in nine flow files, and one test fixture, write a whole {name} token (one is a template literal); none writes a bare name, and none is a map. It is on @objectstack/spec 17.7.0, so nothing there moves until it upgrades.
• objectui at the pin 4997995022: the designer's offline field groups render collection as a single-brace picker (flow-node-config.ts:684 for loop, :700 for map, placeholders {leadList} / {items}, refMode: 'template'), and json-schema-to-fields.ts:255 maps xExpression: 'template' to that picker. FlowNodeInspector.loopItemVariable-9340.test.tsx parses LoopConfigSchema / MapConfigSchema with collection: '{leadList}' / '{items}' and asserts success, so it reds when objectui installs this spec. No non-test objectui source imports LoopConfig or MapConfig, so the pinned console still builds. Carried by the seat to the objectui companion card.

Pins, and the ablations that turn them red

• collection-value-slots.test.ts (service-automation, 21 engine pins, both positions): a token and a bare name refused at registerFlow and by the executor's contract parse; a body-less loop judged nowhere, with $loopItems / $loopIndex unchanged; an envelope iterates, a computed one too (rows.filter(r, r > 1)); an inline array iterates as written; an absent variable fails with EXECUTION_ERROR naming it; a guard answering [] iterates nothing; null and a string fail the node with NODE_FAILURE naming what the envelope evaluated to.
• Spec: judge pins (flow-value-slot-template.test.ts: the remedy reads clean, no null guard is offered, a dotted path is guarded a step at a time, other tokens never computed a list, an inline array is data, the contract and the judge use the same words), ledger pins (flow-node-expression-paths.test.ts, including the onlyWithKey / parsedWhen agreement), build-door pins (flow-builtin-node-config-values.test.ts).
• Lint: validate-expressions.test.ts (refused token and bare name, a clean envelope and array, an unbound root, a body-less loop) and validate-flow-template-paths.test.ts (the envelope spelling resolves the iterator).
• Re-judged in place, each with a comment: the role-union pin, the ledger census, the map.collection pins, the descriptor marker pins (loop-node.test.ts, map-node.test.ts, config-schemas.test.ts, control-flow.test.ts), the ratchet's required-slot cross-check, and the lint test that called the bare name "the spelling loop-node.ts falls back to".
• Ablations, at 8f0b85818a, each through scripts/ablation-replace.mjs in WRAP mode: the anchor hit once, the blob changed, and the restore was proven with the blob equal to HEAD and git diff HEAD empty.
  1. The token arm restored in the loop executor (a string collection read as a variable instead of refused): loop: the executor's contract parse refuses both as a guard went red, 1 of 21.
  2. The judge's collection table emptied (the collection judged as a generic value slot): 9 judge pins went red, 186 green.
  3. The ledger's onlyWithKey: 'body' deleted: 5 pins went red in two files. The first attempt was refused by the tool as a no-op (its replacement was a prefix of its anchor, so the replacement count could not rise) and restored; the re-run used --delete.
  • Not ablated at dist level: the service-automation and lint pins read @objectstack/spec's dist. Ablations 2 and 3 turned the same functions red at source.

Measurements, at HEAD 3e6eedc786

3e6eedc786 merges origin/main 0253192f76 through scripts/pm/os-regen-merge.sh; the merge left nothing to regenerate, and check:generated --fix then rebuilt packages/spec and read all 14 generated artifacts up to date. Every lock reading below is a shared-box figure.

• Suites (each through scripts/pm/os-verify-lock.sh, each part's exit captured on its own):
  • @objectstack/spec test (the local project): 648 files, 19394 passed, 1 todo, exit 0.
  • @objectstack/service-automation: 187 files, 2421 passed, exit 0, run at 0510e4ad0a. No service-automation file changed after it. The merge brought three spec/src files (description text in automation/approval.zod.ts, contracts/approval-service.ts, ui/component.zod.ts), and the suite was not re-run over them; CI runs it.
  • @objectstack/lint: 137 files, 6471 passed, exit 0, after the merge.
  • @objectstack/metadata-protocol, the three edited files: 113 passed, exit 0.
  • CLI: the closure build (turbo run build --filter='@objectstack/cli^...' --filter=@objectstack/cli, 59 tasks) then --project integration test/migrate-meta-engine-guidance.test.ts: 3 passed, exit 0. The amended D3 entry prints with no tracker number.
• Typecheck, exit 0 each: @objectstack/spec (with check:test-typecheck), @objectstack/service-automation, @objectstack/lint, @objectstack/metadata-protocol, @objectstack/example-showcase, @objectstack/example-todo.
• Lint, narrowed: eslint --no-inline-config --format json over the 77 changed .ts files (the population eslint.config.mjs's **/*.{ts,…} blocks select); the JSON reports 77 files, 0 errors, 0 warnings. The config never enables type-aware linting (no parserOptions.project, no typed rules), so this diff cannot move a verdict on an untouched file. The repo-wide pnpm lint is CI's.
• Gates: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 117 commands from the 87 changed paths (1834 changed lines, under 3000). 116 ran: 114 exited 0 at once; check:skill-examples and check:i18n-coverage exited 3 (prerequisite not met: @objectstack/client-react and the example closures unbuilt), and after those builds both exited 0. --ran reads 117 derived, 116 run, 0 NOT-MEASURED, 1 UNRUN: check:dual-build-cjs-loads, NOT MEASURED, reason: it needs a whole-workspace build, which the dispatch excludes.
  • This includes check-adr-0087-registration --base origin/main (not-required (already-registered)), check-changeset-no-major (pre mode next), check-empty-changeset, check:doc-authoring, check:examples-live-imports, check:nul-bytes, check:type-check-debt, check:durability-log-level, check:cross-package-test-inputs, check:test-source-alias, and the spec gates check:generated, check:api-surface, check:export-origins, check:docs, check:spec-changes, check:upgrade-guide, check:authorable-surface, check:liveness.
• Artifact rosters (the no-path run's block, 50 commands): 47 exited 0. The three PR-context guards (check-closing-target-claim, check-partof-closing-keyword, check-single-claim-paths) are not wired without a pull request; check-partof-closing-keyword on this body read clean before the create, and the three are re-run wired to this PR after it opens.

Out of the claim's file surface, and why

• packages/lint/src/validate-flow-template-paths.ts (+ test): the collection reader in the lint, see above. A lint patch is in the changeset.
• packages/lint/src/validate-expressions.ts: one comment this diff made false.
• packages/spec/src/automation/flow-node-config-refusals.ts, flow-text-slot-template.ts, schemaless-node-config.zod.ts: comments this diff made false.
• packages/services/service-automation/src/engine.ts: comments, the registration failure header, and the evaluateValueEnvelope docblock (S1's carry to this stage).
• Test fixtures in packages the claim did not name (metadata-protocol, lint), each a collection spelling.
• The generated artifacts check:generated --fix proved stale: api-surface/, export-origins/, declaration-map/, json-schema.manifest/ (the new export) and the references.

Acceptance notes

• STEP18_RATIONALE's fragment for this entry (registry.ts.template) still names only the assignment values and the CRUD fields; S1 and S2 left it so as well. It is incomplete, not false. Carrier: S7 (the canon fixes).
• engine.ts's value-role comment in validateFlowExpressions still says "a plain string there is {token} interpolation", false since the first pass. Carrier: S7.
• The published skill (skills/objectstack-automation/SKILL.md:65) names config.collection and no dialect. It is not false; the seat's skills(objectstack-automation): SKILL.md still teaches {$User.<path>} as a kept value-slot spelling and the text-slot run-user remedy through it, which #19939 pass 2 (PR #22563) refuses #22585 pointer can add the envelope.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 3 package(s): @objectstack/lint, @objectstack/service-automation, @objectstack/spec, touching 33 documentable anchor(s). ⚠️ 7 changed file(s) yielded no anchor (packages/services/service-automation/README.md, packages/spec/api-surface/automation.json, packages/spec/declaration-map/automation.json, …), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

⛔ 3 release-owned page(s) name something this change touched. These are read-only:

• content/docs/releases/v16.mdx (via AutomationEngine (symbol, a top-level class))
• content/docs/releases/v17/17-0.mdx (via AutomationEngine (symbol, a top-level class))
• content/docs/releases/v17/17-6.mdx (via AutomationEngine (symbol, a top-level class))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 7 changed file(s) yielded no anchor (packages/services/service-automation/README.md, packages/spec/api-surface/automation.json, packages/spec/declaration-map/automation.json, …) — pages documenting those are invisible to this run
• 5 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 139 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 3fdb92db00b3380bb166e749f377960c42db0831 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 9899cc1aa567e370ead60d1d8cbbda2ff9cc4b8c — the merge of head 817bde9da3402971acdb908eca09f6a7960565a2 into base 3fdb92db00b3380bb166e749f377960c42db0831, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 9899cc1aa567e370ead60d1d8cbbda2ff9cc4b8c && git checkout 9899cc1aa567e370ead60d1d8cbbda2ff9cc4b8c
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 3fdb92db00b3380bb166e749f377960c42db0831 817bde9da3402971acdb908eca09f6a7960565a2 && git checkout -B drift-repro 3fdb92db00b3380bb166e749f377960c42db0831 && git merge --no-ff 817bde9da3402971acdb908eca09f6a7960565a2

node scripts/docs-audit/affected-docs.mjs --json 3fdb92db00b3380bb166e749f377960c42db0831

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 3fdb92db00b3380bb166e749f377960c42db0831 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 817bde9da3402971acdb908eca09f6a7960565a2
Local-runs: none

Read, and nothing else: card #19939's stage plan 6096263424 (S3's row and its family finding), the S1 and S2 landing records 6101473453 / 6109915858, S2's contract review FAIL 6109203893 and its order 6109208049, this stage's claim 6110982937, the dev's reports 6112804256 and 6114354985, the seat's sync order 6112829060 and the ACCEPT 6114388191 (read for what they assert, not adopted); PR #22883's body and the net diff git diff 45e206e498 817bde9da3 (merge base with origin/main; 87 files, +1389 / −445, equal to the PR's file list, 26 non-test, 61 test); ADR-0032 Decisions 2 and 3, the contract table and Sequencing 6, ADR-0087 D2 and D3, scripts/pm/clause2-line.mjs, check-adr-0087-registration.mjs (CATEGORIES, breakingDeclaration), check-changeset-no-major.mjs (the pre-mode exemption) and .changeset/pre.json, all on origin/main 63739521d8; the hop 3e6eedc786..817bde9da3; the head's check-runs, polled from 2026-10-11T22:10Z until every run had a conclusion. Read-only throughout: no worktree, no build, no test, no gate re-run; python3 -I parsed the API JSON and git read the refs.

① Derived judgments

• Accept set. LoopConfigSchema.collection goes from z.union([z.string().min(1), z.array(z.unknown())]) with xExpression: 'template' to FlowCollectionSlotSchema; MapConfigSchema.collection from z.union([z.string(), z.array(z.unknown())]) to the same. FlowCollectionSlotSchema (builtin-node-config.zod.ts, imported into control-flow.zod.ts) is z.union([z.array(z.unknown()), AssignmentExpressionValueSchema]): a list, or a CEL value envelope. A string is refused, every string: the union's error hands a non-envelope input to collectionLiteralRefusal, which gives a {…} token the value-slot judge's own refusal (valueSlotTemplateRefusals(value, { collection: true }), word for word) and a bare name the rule plus the envelope naming it ({ dialect: 'cel', source: celPath(name) }); a malformed envelope leads with VALUE_ENVELOPE_REFUSAL. The three doors are the same parse: registerFlow and objectstack validate through flowNodeConfigRefusals (the contract map parses map always and loop only with a body, parsedWhen), the executor through parseNodeConfig against the same schemas. At the base an envelope at either key failed the union with zod's default message, verified by reading the base contract. RIGHT (ADR-0032 Decision 2: a computed value is whole-field CEL; Decision 3: the single brace deleted; Sequencing 6; the stage plan's S3 row and family finding).
• The legacy loop. loop-node.ts's body-less branch is byte-unchanged: it reads raw.collection as a bare name into $loopItems / $loopIndex and parses nothing. The ledger's new onlyWithKey: 'body' on the loop collection row is read by readOn (config[key] != null) in both walks, which is the contract map's parsedWhen (config.body != null) spelled in the ledger; flow-node-expression-paths.test.ts holds the two equal over configs with and without a body, and pins that no other entry carries the field. RIGHT.
• No other position moved. The ledger diff moves exactly the two collection rows (flow-template → value, plus onlyWithKey on loop); resolveFlowNodeExpressions' simplification (entry.role === 'predicate' dropped from two guards) is equivalent once the role union is 'predicate' | 'value'; valueSlotTemplateRefusals branches only under options.collection === true; guardOf gains a defaulted parameter; the judge closure's boolean became an options object with every caller migrated to the same value; FlowValueSlotSchema and the callee and screen slots are untouched; atOrInsideJudgedLedgerSlot changes a comment only. api-surface/automation.json adds three names and removes none. RIGHT.
• The judge. COLLECTION_SLOTS keys the two ledger entries; flowNodeValueTemplateRefusals judges a collection before the callee and screen arms with { collection: true }, so only the value itself is read: an inline array's strings are data (the executors never interpolated one). collectionRemedy names the envelope for a whole path and a guard answering [] (has(vars.rows) ? vars.rows : []), never the value slots' null guard, since null fails the node; any other token "never computed a list". The build doors' value arm refuses a token-free string in the contract's words (flow-builtin-node-config-values.test.ts), a token is left to the judge, as before. Pinned both ways (flow-value-slot-template.test.ts: the contract and the judge use the same words). RIGHT.
• The executors. resolveCollectionSlot (value-slot-map.ts) is isExpressionEnvelopeShaped(value) ? engine.evaluateValueEnvelope(value, variables, 'collection', context) : value: an envelope is evaluated in the run's scope; an inline array is returned as written and never reaches interpolate. loop (structured) and map call it and fail the node with collectionNotAList, which names what the envelope evaluated to and its source. The token arm, the bare-name arm and the variables.get fallback are deleted from both executors; interpolate is no longer imported by either. No ?? was added. The 21 engine pins (collection-value-slots.test.ts) cover both positions: refused at registerFlow and at the executor's parse; an envelope iterates, a computed one too; an inline array iterates as written; absent → EXECUTION_ERROR "Unknown variable: rows"; [] guard iterates nothing; null and a string → NODE_FAILURE naming the kind and the source; the legacy loop unchanged. RIGHT.
• Readers left that interpret a string collection. In the executors, none: the structured loop and map parse first and a string never reaches the resolver. Two readers remain outside them, each by design: (i) the legacy body-less loop, which reads a bare name and is judged nowhere (the contract and the stage plan both keep it); (ii) the lint's validate-flow-template-paths.ts, whose collectionListText reads an envelope's source and falls back to loneTokenBody (a lone {…} token or a bare name) for a source written before this change, only to infer the iterator's object and keep that rule's findings on a flow every door now refuses. It runs nothing and evaluates nothing, so it is not a PD Add comprehensive test suite for Zod schema validation #12 dialect fallback; S7's resolver deletion can take the fallback with the residual calls. Acceptable, named here so it is not mistaken for a surviving arm.
• The retired role and the ratchet. 'flow-template' leaves FlowNodeExpressionRole; the ratchet's ROLE_BY_MARKER (config-expression-ledger.test.ts) drops template, and a new pin walks every descriptor and schemaless JSON Schema and asserts no slot carries that marker, so a 'template' marker fails roleOf as unknown. The loop and map descriptors carry xExpression: 'value' on collection; the contract carries no marker, so map.collection is declared on one channel (pinned). At the head no non-test source carries xExpression: 'template' (one stale docblock, below). True and in scope: the role recorded these two slots and nothing else, and the stage that empties it is the one to retire it.
• The lint's collection reader. validate-flow-template-paths.ts infers a loop iterator's object from an envelope naming a variable, as it did from the token; without it every migrated loop's {iterator.field} path checks would have gone silent. Pinned (an envelope resolves; a computed source is silent). The @objectstack/lint patch is right for a fix with no authoring surface. True and in scope.
• The reach. Shipped sites migrated in this diff: examples/app-showcase (showcase_batch_reminders and showcase_nested_fan_out_reminders loops, showcase_release_signoff map), examples/app-todo (task_reminder, overdue_escalation) — five, each a whole {name} token on a structured node; content/docs/automation/flows.mdx (three samples, the value-slot list, a new paragraph, the legacy-loop sentence); packages/services/service-automation/README.md (:191 row, :211 paragraph, the sample). Spot-checked with git grep at the head over examples, packages/platform-objects, packages/qa/dogfood, content/docs, apps, skills and the README: 0 string-valued collection: (two prose mentions of the refused bare name); the same grep at the merge base reads 9, the positive control. The generated references (control-flow.mdx, builtin-node-config.mdx, index.mdx) describe the new union. No shipped flow is newly refused. .objectui-sha does not move (4997995022), so Console Pin Gate's skip is expected; the local objectui checkout (2a48bd408d) has no non-test import of LoopConfig / MapConfig, so the pinned console keeps building; the designer's collection pickers and FlowNodeInspector.loopItemVariable-9340.test.tsx are the seat's objectui companion, as the plan assigns. hotcrm is NOT MEASURED here (no clone); the dev's reading (eleven structured loops on spec 17.7.0) goes on the seat ledger, the plan's carrier. RIGHT.
• The sync hop 3e6eedc786 → 817bde9da3: three commits — f7ee0386ed (merge of origin/main 40bc51f3f9), 8f0446c6e8 (one path, content/docs/references/index.mdx, regenerated), 817bde9da3 (merge of origin/main 45e206e498). 114 hop paths; 112 byte-identical to main at 45e206e498; the two that differ are the two hop paths this PR also touches, index.mdx and packages/lint/src/validate-approval-approvers.test.ts, and on each the PR's own hunk is identical before and after the hop (index.mdx differs only by the schema count main moved, 1520 → 1522). 85 of the 87 PR files are blob-equal across the hop. No PR source moved. main has since gained 4 commits (to 63739521d8) touching none of the PR's 87 paths; GitHub reads mergeable: true. RIGHT.
• Out of the claim's file surface, each declared in the PR and each the class the claim admits: the lint reader and its test; comment-only edits (validate-expressions.ts, flow-node-config-refusals.ts, flow-text-slot-template.ts, schemaless-node-config.zod.ts, engine.ts incl. the evaluateValueEnvelope docblock S1 carried here and the registration failure header, which no longer says template slots require braces); collection fixtures in metadata-protocol and lint tests; the four generated artifacts and the references. No governed surface is in the file list. RIGHT.
• Sentences this diff makes false and does not touch, both internal docblocks of the class S1's PASS carried forward (S1 carried the evaluateValueEnvelope docblock to this stage): packages/spec/src/automation/node-executor.zod.ts:268 — "Slots marked xExpression: 'template' are recorded but not checked: no validator implements the single-brace {var} dialect" (no slot carries the marker now and the ratchet refuses it; :276's "a plain string there stays {var} interpolation" has been false since S1); and packages/spec/src/automation/flow.zod.ts:1455 — "A flow-template slot's blank is untouched". Carrier: S7 (the canon fixes), beside the engine.ts value-role comment and the STEP18_RATIONALE fragment the PR already carries there. Non-blocking.
• One site the census grep did not cover: packages/spec/src/conversions/registry.ts (tracked, ships in the package) writes collection: '{tasks}' / '{rows}' / '{items}' in the flow-node-map-flow-alias fixture's before and after (:1375–:1393) and '{leads}' in a loop fixture (:15481, :15533). These are D2 fixture pairs for other conversions, exercised by conversions.test.ts structurally (toEqual on after, a notice count), never parsed by a door, so nothing is newly refused; S1 left the same class there (input: { caseId: '{record.id}' } at :1432 / :1448, inputs at :3697 / :3712). Not a shipped flow. Noted for S7's canon pass. Non-blocking.

② Semver level

• Packages. @objectstack/spec and @objectstack/service-automation are the published packages whose src/** moves; @objectstack/lint moves one source file (the reader) and one comment; @objectstack/metadata-protocol moves tests only; the examples are private; docs are no package. The changeset names exactly those three. RIGHT.
• Level. .changeset/pre.json on main is { mode: pre, tag: next }, so check-changeset-no-major returns exempt on a major; S1 and S2 graded the same two packages major on this line. major for spec and service-automation, patch for lint: RIGHT. The ! in the title, the **BREAKING** banner, the FROM → TO table (six rows, the [] guard and the legacy loop included), the one-line fix: present. Check Changeset is green on this head.
• Clause-②: yes (narrowing: …; widening: …) — RIGHT on the value and on the arm, and judged here on the diff, not on the seat's ruling. matchValueToken reads yes (followed by a space, not |); readArmToken reads (narrowing as the arm, since : is outside the token class, so the reader returns { declared, yes, narrowing }: "a diff that widens one surface and narrows another. Both facts are true and both are read." Measured on the diff: the narrowing is a string refused at two published authoring keys; the widening is a CEL value envelope newly accepted at both (the base unions had no object arm), the published JSON Schema (any[] | { dialect, source, … }) and the inferred LoopConfig['collection'] / MapConfig['collection'] gaining that arm, and three new exports on api-surface/automation.json (FlowCollectionSlot, FlowCollectionSlotParsed, FlowCollectionSlotSchema, origin builtin-node-config.zod.ts). The claim's no (narrowing) rested on the plan's premise, which the measured diff falsified, exactly as S2's recordId did (6109203893). The line is byte-identical on both carriers (PR body line 2, changeset line 9). One precision, non-blocking: the published FlowNodeExpressionRole loses the 'flow-template' member and the published FlowNodeExpressionPath gains an optional onlyWithKey — both stated in the changeset's kit, neither named in the line's parenthetical; the arm and the level already cover them.
• ADR-0087 marker. not-required (already-registered flow-value-slot-template-dialect-refused): the category is in the gate's closed vocabulary, and the id resolves at the head and existed at the base (the entry file is M, added by S1), which is what already-registered re-validates. Exactly one marker in the changeset body, which also carries the Clause-② line the gate reads the arm from. check-adr-0087-registration is the dev's exit 0 and Check Changeset's green. RIGHT.

③ Boundary flags

• D3 only, no D2 — RIGHT. Neither spelling maps losslessly, verified on the code, not from the report: at the base interpolate(rawCollection) on an absent {rows} returned null, variables.has('{rows}') was false, and the executor returned { success: false, error: "… did not resolve to an array" }, a returned failure (NODE_FAILURE); at the head evaluateValueEnvelope throws on the absent variable and the step records EXECUTION_ERROR "Unknown variable: rows" (pinned). A bare name: on a legacy loop it works today (the unchanged branch reads variables.get(name)); on a structured loop or map the base's interpolate('rows') was the identity, collection == null was false, the variables.get fallback never fired, and the node failed every run — so rows → { dialect: 'cel', source: 'rows' } turns a node that never iterated into one that does. ADR-0087 D2 takes losslessly mappable changes only and sends semantic changes to D3. No src/conversions/* source moves (one test fixture file only).
• The D3 amendment of 18.flow-value-slot-template-dialect-refused.ts: the header comment, surface (the two collections, "any string value: a single-brace template token, or a variable's bare name"), replacement (the envelope, the inline array as written, the bare name as that name in an envelope, the [] guard), reason (the NODE_FAILURE / EXECUTION_ERROR difference, the bare name's semantic change, the untouched legacy loop) and acceptanceCriteria (decide whether the loop should run at all before rewriting a bare name). One entry per retirement family, amended, not duplicated — the S1/S2 way. migrations/registry.ts is gitignored and regenerated at build, so its absence from the diff is right; STEP18_RATIONALE in registry.ts.template is unchanged and carried to S7, as S1 and S2 left it. RIGHT.
• Dev deviations (6112804256, 6114354985), each answered: the Clause-② line written against the claim — measured, recorded in the PR, judged right above; the flow-template role retired in a file the claim holds — in scope, above; the lint reader and comment-only crossings — mechanical, above; the classifier refusal of a bash -c gate loop re-issued as two literal commands — process, no removal involved, no finding; one misdirected command in the shared checkout that wrote nothing — process, no finding; the service-automation suite re-run at the final head in the sync round, closing round 0's gap; the index regeneration folded into 8f0446c6e8 rather than a separate commit — the hop analysis above shows one regenerated path and no source moved; main moving past the verified head with zero path overlap — verified above, still zero at 63739521d8.
• Carriers, each judged right: skills(objectstack-automation): SKILL.md still teaches {$User.<path>} as a kept value-slot spelling and the text-slot run-user remedy through it, which #19939 pass 2 (PR #22563) refuses #22585 for SKILL.md:65 (skills/** is Tier H and names no dialect — not false); the objectui companion for the designer's pickers and the parsing test (the plan's carrier; at the pin the console builds); the seat ledger for hotcrm (NOT MEASURED, the plan's carrier); S7 for STEP18_RATIONALE, the engine.ts value-role comment, and — added by this review — node-executor.zod.ts:268 / :276, flow.zod.ts:1455, the lint's loneTokenBody fallback, and the conversions/registry.ts fixtures. release(changesets): four merged pending changesets state behaviour that later PRs on the same v18 train changed; correct them in place through check-empty-changeset's DELIBERATE CORRECTION path before the release #22586 (the v18 changesets correction) still waits on the card; this changeset's "supersedes that line" sentence follows S2's accepted precedent.
• CI on 817bde9da3, polled from 2026-10-11T22:10Z every minute until every run had a conclusion (2026-10-11T22:32Z): 35 runs, 35 completed — 33 success, 2 skipped, 0 failure, none still running. The two skips are expected: Console Pin Gate (.objectui-sha does not move in this diff) and Packed-tarball smoke (opt-in). Green among them: Build Core, Test Core 1–6 and the roll-up, Dogfood Regression Gate 1–3 and the roll-up, Dogfood Verify CLI, Temporal Conformance (live PG + MySQL), Lint & Repo Gates, Type Check · source gates / · consumer gates / · workspace / · debt ledger and the TypeScript Type Check roll-up, Check Changeset, Spec property liveness, Governed Surface Queue Guard, Build Docs, Check Documentation Links, Check PR Size, Flag docs affected by code changes, Auto Label, filter, and the four PR-claim guards. No required check is red, skipped unexpectedly, or running.

Nothing on this head needs a change before the queue. The landing is the owning seat's, through the queue, with this record on the head and every check green.

Implemented-by: claude/issue-19939-p4-s3-collection
Reviewed-by: session_01KNKBCRDJCu5tGy3TEbvtrF

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

Landing pre-checks at 817bde9da3, by the owning seat: all green, queued

domain:spec seat 3 (#18883) · zhuangjianguo · session session_01KNKBCRDJCu5tGy3TEbvtrF · 2026-10-11T22:35Z · holder of claim 6110982937 on #19939.

• The review: the seat's ACCEPT 6114388191 on [v18] retire the {var} template dialect in flow assignment slots: refuse at registration with per-spelling remedies (the C half of #11182 ruling D, on the v18 train) #19939, and the contract review at CONTRACT_REVIEW_TIER, 6114638534 (PASS), both on this head. The review's five flags are non-blocking and carried: the two stale internal docblocks, the D2 fixture strings in conversions/registry.ts, and the lint's collectionListText fallback go to S7; the published-type precision is already covered by the changeset kit; hotcrm stays in seat post [PM seat] domain:spec · seat 3 — 🟢 zhuangjianguo · session_01KNKBCRDJCu5tGy3TEbvtrF #18883's ledger.
• CI: 35 check-runs, 33 success and 2 skipped. check-expected-skips --pr 22883 reads both skips (Console Pin Gate, Packed-tarball smoke (opt-in)) in the roster.
• Governed: check-governed-merges --pr objectstack-ai/objectstack#22883 reads NOT governed: 0 of 87 paths, +1389 / −445.
• Closing keywords: the body opens with Part of #19939 and carries no closing keyword, and no commit message carries one.
• main drift since the merge base 45e206e498: main (now 3f694715ee) moved 28 paths, none of them the PR's, and git merge-tree against it exits 0. GitHub reports clean.

pr_ready and automerge_enable follow.

---

Generated by Claude Code