feat(spec)!: flow text slots read the {{ }} delimiter, refusing a single-brace token with its hole spelling (#22110)

[objectstack-fleet]

Fixes #22110
Clause-②: yes (narrowing: the text slots' single-brace tokens are refused, while {{ }} holes now render there and a $ variable gains a hole spelling; corrected from the lossless-conversion reading by the seat in comment 6063190355)

The line above is the claim's, copied verbatim as the dispatch requires. Its parenthetical predates the measurement: no spelling measured lossless, so this PR registers no D2 conversion (step 2 below). Every single-brace token in a text slot is refused with its remedy. The changeset carries the same value (Clause-②: yes) without the parenthetical, so the published changelog does not state a conversion that does not exist. The direction is a narrowing, graded major on the v18 pre line, and the changeset carries the ADR-0087 disposition registered flow-text-slot-single-brace-refused.

The rulings this executes

• ADR-0032 (Accepted), Decision 3: "One delimiter, {{ }}; single { } deleted." (docs/adr/0032-unified-expression-layer.md:78). Its representation table names the text-template role: notify.title/body, titleFormat, email/notification.
• ADR-0087 D2: a spelling converts automatically only where it renders the same; "A spelling that renders differently is refused at registration with its remedy, ⛔ never converted."

Measurement first

Step 1: the slots the single-brace interpolator reads (this repo, at the merge base 238222d8c)

The census is a TypeScript-AST walk over git ls-files '*.ts': every object literal carrying id, type and config, every string leaf under config, with a nested node counted on its own. Source sites are listed below. Test sites are counted separately, and the census script is in the report.

slot	role	source strings / tokens
notify.title	text, stringifyForTemplate(interpolate(…))	19 / 22
notify.message	text	11 / 16
screen.description	text, interpolateText	1 / 1
screen.title	text	0
end.message (refused)	text, interpolateText	0
notify.recipients / recipients[]	value: hands an id or a list over	23 / 23
notify.sourceId · actionUrl · source.*	value / reference	11 · 5 · 4
screen.defaults.* · recordId · field defaultValue	value	3 · 0 · 0
subflow.input.* · script.inputs.* · map.input.*	value	5 · 9 · 0
loop.collection · map.collection	value: a list, by type	6 · 7
http.* (whole config)	value (interpolated before its parse)	4
*.filter.*	filter (interpolateFilter)	9
create_record.fields.* · assignments.*	value slots, CEL's (#19939)	1 (the kept {$User.Id}) · 0

The five text slots are the positions whose rendered value is only ever text. Every other position hands its resolved value over with its type: a whole-string {x} returns the raw value. The template engine always returns a string, so moving any of them would change what a value position accepts (the dispatch's value-slot stop condition). They keep the single brace. The interpolator serves no slot outside flows: it is not exported from @objectstack/service-automation, and the messaging and email renderers have their own {{ }} readers.

In-tree text-slot sites: examples/app-showcase (24 strings, 30 tokens) and examples/app-todo (5 strings, 7 tokens). All 37 tokens are paths, one of them {$error.message}. The card's "46 in 2 files" counted a {record.…} pattern across all notify keys, including recipients and sourceId.

Step 2: the lossless check (H2)

Each spelling was rendered through the shipped interpolator (the notify path stringifyForTemplate(interpolate(…)), and the screen / end path interpolateText) and through the shipped templateEngine.evaluate over the same variables, with {x} rewritten to {{ x }}. Abridged; the full 90-row grid is in the report.

spelling	input	17.x interpolator	template engine	verdict
Hello {record.name} and {record.name}, {record.owner.name}, {rows.0}, {summary}, {n1.result}	string, number, 0, boolean, null, absent, '', ISO date string, object, array	the text	the same text	SAME
any path	a Date value (what a CEL now() / today() assignment stores)	"2026-10-08T09:30:00.000Z" (quotes included)	2026-10-08T09:30:00.000Z	DIFF
{x} as a whole screen / end text	an object · an array · a Date	[object Object] · x,y · Thu Oct 08 2026 …	JSON · JSON · ISO	DIFF
{$error.message}	any	the message	refused: $ was not a hole character	DIFF
{n1} with only n1.result set		empty text	{"result":"r"}	DIFF
{amount * 2}, {round(x)}, {NOW()}, {TODAY() + 1}, {$User.Id}		a value	refused: logic or a non-variable, not a hole	no spelling
a stored {{record.name}}		{Acme} (outer braces kept)	Acme	DIFF (the lint used to warn)

Verdict: no spelling is lossless. Every path spelling has a DIFF input (a Date), the whole-slot screen / end case also differs on objects and arrays, and the rest have no hole spelling. Per the dispatch's stop condition, no conversion is registered. Every spelling is refused with its remedy, and the D3 record is the semantic entry flow-text-slot-single-brace-refused. The card's second pin therefore reads as its "(when lossless)" allows: a stored Hello {record.name} is refused at registration with Hello {{ record.name }} named.

The PM's hypotheses

• H1, holds with a correction. The interpolator is builtin/template.ts (interpolateString, now around :357). The text slots it serves are notify title / message, screen title / description and the refusing end message. It reads many more positions than the card's "every other flow string slot" suggests, and all of those are value-like (the step 1 table).
• H2, falsified. The engine is packages/formula/src/template-engine.ts, but no spelling renders the same on every input (step 2). It also could not read a $-named variable at all.
• H3, holds. NOTIFY_TEMPLATE_PLACEHOLDER is the one constant both notify refusals and the blank-envelope refusal read, and it flips to {{ record.name }}. EXPRESSION_SLOT_TYPES lacked the two internal constructors, and both are added. The stale TemplateExpressionInputSchema comment in notify-node.ts is rewritten.
• H4, holds with a different shape. flow-double-brace-interpolation was the only rule teaching the single brace on these slots. It does not flip to flag single braces: the build door already refuses them at error through the spec's one judge, and a second reading would repeat it. Instead it exempts the text slots (a {{ }} there is the spelling), names them in its hint, and its bare-$ sibling reads a text slot outside its holes with a hole prescription.

What changes

• Renderer (package-internal to @objectstack/service-automation, builtin/template.ts; the package exports . only, so its public surface does not move): renderTextSlot(value, variables) is the ONE text renderer, used by notify title / message, screen title / description and the end refusal message. It replaces interpolateText and notify's stringifyForTemplate(interpolate(…)). It runs templateEngine.evaluate over textTemplateScope(variables): each flow variable is a root, a dotted node-output key is nested, a declared variable wins over a flat key sharing its head (the interpolator's precedence), and a variable's own object is never written into. If the slot renders no text at all the result is undefined, so a screen still falls back to its node label. A template that does not compile throws FlowTextTemplateError, a guard refusal. A screen's recordId keeps the single brace, through a local ref that does what interpolateText did.

• Judge (@objectstack/spec/automation, new flow-text-slot-template.ts): FLOW_NODE_TEXT_SLOTS, flowNodeTextSlotSources, textSlotTemplateRefusal and TEXT_SLOT_TEMPLATE_REFUSAL. It refuses every {…} the 17.x interpolator substituted, ignoring the inside of a {{ }} hole. Remedies by token kind:

  • a path: the whole text rewritten with holes;
  • logic: an assignment CEL envelope, keeping every integer divisor a double, then {{ v }};
  • a date macro or $User: an assignment whose value slot still reads that spelling (it is kept there, [v18] retire the {var} template dialect in flow assignment slots: refuse at registration with per-spelling remedies (the C half of #11182 ruling D, on the v18 train) #19939), then {{ v }};
  • junk: delete it.

  Nothing is kept, so a text slot never mixes the two dialects.

• Shared grammar: the interpolator's token grammar moved from flow-value-slot-template.ts into a package-internal flow-template-token.ts that both judges import, so the dialect is read in one place. The value-slot judge's behaviour is unchanged, and its suites are green.

• Doors:

  • NotifyConfigSchema (inside its existing superRefine), ScreenConfigSchema (a new superRefine; one dropped-refinement site, ledgered 679 → 680) and EndConfigSchema refuse a single brace at the key. The end refusal also lands at FlowSchema.parse.
  • registerFlow and validateStackExpressions run the same judge, then compile each slot with validateExpression('template', …). {{ a + b }}, an unknown formatter or an unbalanced hole is refused before a run.

• @objectstack/formula: PATH_ONLY_RE admits $ so that {{ $error.message }} is a hole. This is a widening of the hole grammar; an unbound $ path renders nothing. Landing note: this file is outside the claim's surface. Measurement put the producer of the $error gap here, and the fault-handler spelling had no {{ }} form without it.

• Contract text: NOTIFY_TEMPLATE_PLACEHOLDER is now {{ record.name }}. The notify, screen and end .describe()s, the notify and screen descriptor help (the Studio inspector text), and the docblocks that taught the single brace (shared/expression.zod.ts, shared/typed-expression-input.ts, builtin-node-config.zod.ts, flow-node-expression-paths.ts) are rewritten.

• Ledger: the D3 semantic entry flow-text-slot-single-brace-refused and its step-18 rationale fragment (order 89). There is no D2 conversion and no tombstone, because no key is removed.

• In-tree sites: all 29 example strings, the docs (content/docs/automation/flows.mdx gains a "Text slots read double-brace holes" section, plus content/docs/getting-started/common-patterns.mdx and packages/services/service-automation/README.md), and the test fixtures that register flows (two dogfood fixtures and seven service-automation test files) now use {{ }}.

Tests and gates (at 11bdb8c96 unless noted)

Builds, tests and typechecks ran through scripts/pm/os-verify-lock.sh, each read from its VERDICT line. The box is shared.

• New pins:
  • packages/spec/src/automation/flow-text-slot-template.test.ts: the slot list, every token kind's remedy, the hole and $ paths passing, and the screen contract.
  • packages/services/service-automation/src/builtin/text-slot-template.test.ts: the card's three pins.
    • Hello {{ record.name }} renders the name.
    • A stored Hello {record.name} is refused at registration with its hole spelling.
    • Control: {{ record.name }} == 'Acme Corp' in an edge condition is refused at registration.
    • It also covers every text slot at the door, compile errors at the door and past it (a guard, nothing sent), {{ $error.message }} on a fault edge, a screen's holes beside a single-brace recordId, and the renderer's measured SAME/DIFF rows.
  • packages/lint/src/validate-expressions.text-slot.test.ts: the build door through runAuthoringRules('validate', …).
  • In existing files: the formula $-path test, the lint double-brace / bare-$ text-slot cases, and a validate-flow-template-paths case proving a typo inside a hole is still reported.
• Suites: @objectstack/service-automation 177 files / 2171 passed; @objectstack/lint 128 / 5850; @objectstack/formula 43 / 1258; @objectstack/example-todo 7 / 238; @objectstack/example-showcase 33 / 408; @objectstack/dogfood 7 named files / 58 (expression-conformance, the two schedule-organization files, seed-ownership-claim-dispatch, automation-flow-clone-door, flow-durable-suspend, flow-trigger-record-credential-mask); @objectstack/spec src/automation src/shared src/conversions src/migrations 84 / 2658, plus the repo-project step18-rationale-merge / conversions-major18-merge 2 / 21. The non-spec suites were read at d54cc713d. The second main merge (11bdb8c96) touched none of these packages' sources except packages/spec/src/migrations/registry.ts (a sibling's step-18 entry), so the spec subset and the two merge tests were re-run there with the counts above.
• Typecheck (exit 0 each, at d54cc713d): spec, formula, service-automation, lint, dogfood, example-todo, example-showcase.
• Generated artifacts: pnpm --filter @objectstack/spec check:generated reports all 15 current at 11bdb8c96, after pnpm --filter @objectstack/spec build (exit 0). Before that, --fix regenerated api-surface/, export-origins/ and content/docs/references/automation/**. dropped-refinements.baseline.json was hand-edited (one site).
• Gates: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 119 commands at d54cc713d, the same list as at f94f92250. All 119 ran with their exit codes captured before any pipe. 118 answered exit 0 on the first pass at f94f92250. check:doc-authoring answered exit 1: two #22110 ids in the dogfood ledger's prose. Those ids were stripped (d54cc713d) and the gate re-ran with exit 0, alongside check:nul-bytes, check:cross-package-test-inputs, check:issue-citations and check:published-readme-links. The --ran reconciliation reports: "119 derived famil(ies) accounted for — 119 run, 0 NOT-MEASURED". check-changeset-no-major reads the Clause-② axis from a PR payload, so locally that axis is NOT MEASURED (no PR); CI reads this body. After the second merge, check-adr-0087-registration, check-changeset-no-major, check-empty-changeset, check:migration-registry, check:spec-changes, check:upgrade-guide and check:nul-bytes were re-run at 11bdb8c96 (exit 0 each), together with the 15-artifact check:generated.
• Narrowing, declared: other flow-registering consumers (trigger-record-change, plugin-approvals, runtime, cli, metadata-protocol, the rest of dogfood) were not run locally. They carry no single-brace text-slot site by the census and a line grep. CI runs them.

Acceptance notes

• hotcrm (69 single-brace tokens per the card) could not be read from this container. Every hotcrm text-slot token will be refused at registration until it is rewritten. Each refusal names its hole spelling, and a stored flow is skipped at boot with a warn naming it.
• skills/** (Tier H, not in this PR): these files now teach a spelling the doors refuse.
  • skills/objectstack-automation/SKILL.md:108-109 (a notify title / message example in {record.title} / {$User.Id}).
  • skills/objectstack-automation/SKILL.md:224-236 (lists "notify message/title" among the single-brace values, and marks {{ }} as wrong).
  • skills/objectstack-automation/evals/flows-triggers-approvals.json:17 (expects "title with single-brace interpolation").
• objectui: the Studio editors for these slots insert the single brace. The card names this as the follow-up for triage's objectui round.
• Observations, not filed:
  • AutomationEngine.celScope nests a flat dotted key (n1.result) into an existing variable's own object, which mutates the flow variable. The text renderer builds fresh containers instead. No defect was reproduced; no carrier.
  • The template engine reads its formatter locale from extra.locale, so a flow variable named locale sets the text slots' formatter locale. This is documented on the package-internal text renderer.
  • validate-flow-template-paths judges the path of a {{ path | formatter }} hole like a bare one (patch round 2), and a bracket-indexed path ({{ rows[0].subjcet }}) with each [i] read as .i, the way the formula engine's resolvePath resolves it (patch round 3). A quoted index (['x']) stays unjudged, as an arithmetic token.
  • packages/services/service-automation/README.md's expressions table still says field values interpolate with braces, which [v18] retire the {var} template dialect in flow assignment slots: refuse at registration with per-spelling remedies (the C half of #11182 ruling D, on the v18 train) #19939 made false. That row is not this card's.

Patch round 2 (contract review FAIL 6063558021 → seat order 6063702421 → 0b094026d)

Written into this body by the domain:spec seat 2 from the dev's report 6065199188; the role file reserves a later body edit to the seat.

• (1) packages/spec/src/shared/expression.zod.ts: the TemplateExpressionInputSchema docblock's closing sentence names {{var}} for a notify node's title / message too. The {var} clause is gone. New pin: src/shared/template-expression-input-canon.test.ts.
• (2) packages/spec/src/automation/flow-text-slot-template.ts: singleBraceTokens drops a token that touches a brace on either side. A hole missing one brace (Total {{ amount }, Total { amount }}) gets no rewrite from the judge, and the compile step every door runs next reports it as an unbalanced template (invalid-template at config.title, pinned at the objectstack validate door with no three-brace text in the message).
• (3) packages/lint/src/validate-flow-template-paths.ts templateRefsIn and its docblock: inside a {{ }} hole, the path before an optional | formatter is judged like a bare one. The docblock describes both dialects, because the single-brace interpolator still renders the value-like positions (interpolate); this PR deleted only interpolateText.
• (4) The changeset describes the package-internal renderer and the guard refusal instead of naming renderTextSlot / FlowTextTemplateError.
• Ablations, one per code fix, each restored to the HEAD blob: (1) reddens template-expression-input-canon.test.ts; (2) reddens flow-text-slot-template.test.ts > prescribes no rewrite for a token touching exactly one brace; (3) reddens validate-flow-template-paths.test.ts > judges the path of a {{ path | formatter }} hole like a bare one.
• Readings at 0b094026d: spec src/automation + src/shared 70 files / 2020 passed; lint whole suite 128 files / 5852 passed; service-automation text-slot tests 4 files / 46 passed; typecheck exit 0 for spec and lint; check:generated 15 / 15 current. dispatch-gates --ran: 119 derived, 119 run, 0 NOT-MEASURED. check-changeset-no-major --event: LEVEL AXIS … yes (narrowing). check-adr-0087-registration: registered flow-text-slot-single-brace-refused.

Patch round 3 (contract review FAIL 6065484352 → seat order 6065501303 → 5bfa9ae1f)

Written into this body by the domain:spec seat 2 at 2026-10-08T20:27Z from the dev's report 6068392390 (the comments before it on this PR are read: the two contract reviews are what rounds 2 and 3 answer, and the CI note 6067723298 is carried into the CI line below); the role file reserves a later body edit to the seat.

• 171cea002, the four items:
  • (1) packages/spec/src/shared/expression.zod.ts, the tmpl docblock: the notify bullet that prescribed {record.x} is gone. The {{record.x}} bullet says that since protocol 18 a notify node's title / message read {{record.x}}, and that a single brace is refused at every door.
  • (2) In the same file, TYPED_EXPRESSION_SOURCE_REQUIRED's docblock says the notify slots prescribe the same {{ }} hole.
  • (3) template-expression-input-canon.test.ts holds the three docblocks with one predicate. The spec-wide sweep found no other docblock or describe that prescribes {var} for a notify, screen or end text slot.
  • (4) packages/lint/src/validate-flow-template-paths.ts templateRefsIn reads [i] as .i inside a hole, with one finding pin and one no-finding pin.
• c673c8635: the bracket pin spreads a typed record, so check:test-typecheck holds. This repaired the Type Check · workspace red at 171cea002.
• b5d3cd532: expression-dialect-docs.pin.test.ts pinned the old tmpl relation, which item (1) necessarily turned red. It now pins the protocol-18 relation.
• 0788b58e1 / 5bfa9ae1f: origin/main 3599fef12 merged via os-regen-merge.sh. The only conflict was service-automation engine.ts's import block, resolved as the union. The regeneration restores main's builtinNodeConfigKeysJudged export beside this branch's text-slot exports. Range-diff: commits 1–16 show =. The PR's line multiset is identical before and after the merge (54 files, 2261 lines).
• Ablations, each restored to the HEAD blob: (1) reddens both tmpl pins (2 failed / 10 passed); (2) 1 failed / 5 passed; (4) 1 failed / 63 passed. The CI repro (lint test typecheck) exits 1.
• Readings at 5bfa9ae1f, after a full build (73 / 73):
  • spec src/shared + automation + migrations: 74 files / 2239 passed;
  • lint: 128 / 5853;
  • service-automation text-slot and fix(spec,service-automation)!: an undeclared config key on 10 more builtin node types is refused at the build doors; one judge per type #22319 engine tests: 8 / 108;
  • typecheck exit 0 for spec, lint and service-automation;
  • check:generated: 15 / 15 current;
  • dispatch-gates --ran: 119 derived, 119 run, 0 NOT-MEASURED;
  • check-changeset-no-major --event: exit 0 (narrowing arm);
  • check-adr-0087-registration: exit 0.
• CI at 5bfa9ae1f (seat note 6067723298):
  • Test Core (6/6) is the timing-drift step (finding(ci): the shard-timings dataset rests on ONE scheduled run, and records @objectstack/spec at 1134.86 s against 1573–1651 s executed — #16468's 25%-headroom ceilings built on it would red every PR that runs spec #22014), not a test.
  • Test Core (2/6) is connector-author-shape.test.ts:194 at its 60 s budget, the margin hourly full run: red on main (CI) #22292 records on main. Interleaved runs, head vs main 3599fef12: 19.3 / 25.2 / 26.9 s against 23.5 / 27.6 / 24.9 s. tsc on the test's probes: +0.03% instantiations, equal check time. The head is not slower.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

45 anchor(s) derived from 4 changed package(s); no hand-written page names any of them. ⚠️ 8 changed file(s) yielded no anchor (packages/services/service-automation/README.md, packages/spec/api-surface/automation.json, packages/spec/dropped-refinements.baseline.json, …), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

What this run could not see

• 8 changed file(s) yielded no anchor (packages/services/service-automation/README.md, packages/spec/api-surface/automation.json, packages/spec/dropped-refinements.baseline.json, …) — pages documenting those are invisible to this run
• 11 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 140 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 05c7c3fa3b074e00e8cb60c70c15944228d3c0eb → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 8f93b51d0c2c8fe3f4af52c03e762ba086533eef — the merge of head ce4f6519fc9aad5d8665bb6da8615b8f75bed191 into base 05c7c3fa3b074e00e8cb60c70c15944228d3c0eb, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 8f93b51d0c2c8fe3f4af52c03e762ba086533eef && git checkout 8f93b51d0c2c8fe3f4af52c03e762ba086533eef
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 05c7c3fa3b074e00e8cb60c70c15944228d3c0eb ce4f6519fc9aad5d8665bb6da8615b8f75bed191 && git checkout -B drift-repro 05c7c3fa3b074e00e8cb60c70c15944228d3c0eb && git merge --no-ff ce4f6519fc9aad5d8665bb6da8615b8f75bed191

node scripts/docs-audit/affected-docs.mjs --json 05c7c3fa3b074e00e8cb60c70c15944228d3c0eb

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 73b682847b6ac2b4be13e9a650eb0ea13bf45794
Local-runs: none

Inputs, and nothing else: card #22110 (body and all eight comments), PR #22315 (body, the 51-file list, the net diff dc4a5c630..73b682847, +1666 / -374), and the check-runs on the head, read twice; the second reading is the one recorded under ③. The branch head fetched into a review ref is the PR head. Governing text re-read at origin/main: ADR-0032 Decision 3 and ADR-0087 D2 / D3. Rendered at 2026-10-08T15:41Z by an isolated subagent of the seat session named below; the dispatching seat's own conclusions were not an input.

① Derived judgments

1. NotifyConfigSchema title / message (bare string, or a template envelope's source): the accept set narrows — every {…} token the 17.x interpolator substituted is refused at the key, inside the existing superRefine, through the one judge textSlotTemplateRefusal; {{ }} holes, a $-named path and a formatter pass. Right. ADR-0032 §3's representation table names notify.title/body as the template role, the refusal leads with one sentence and names the hole spelling of each token (§1d), and the pins in io-node-config.test.ts cover both spellings.
2. ScreenConfigSchema title / description: a new root superRefine with the same judge; recordId, defaults and a field defaultValue keep the single brace (each hands a resolved value over, not text — pinned). Right. The one hand-edited ledger line (dropped-refinements.baseline.json, automation/ScreenConfig root, 679 to 680) is the ratchet's own designed route — its header: a new gap has to be a reviewed line in a diff — and matches the NotifyConfig / EndConfig precedent and the sibling growth in [v18] retire the {var} template dialect in flow assignment slots: refuse at registration with per-spelling remedies (the C half of #11182 ruling D, on the v18 train) #19939's landing. Reviewed here: right.
3. EndConfigSchema message on a refused outcome: the same judge, also reached at FlowSchema.parse (pinned at nodes.1.config.message). Right.
4. Value slots untouched. flow-value-slot-template.ts moves its token grammar onto the package-internal flow-template-token.ts (not exported from automation/index.ts); the regexes move byte-identical and valueSlotTemplateRefusals still returns nothing for the kept kinds (pinned). Right, and keeping that grammar off the barrel is right: a published copy of a retired dialect would be new public surface.
5. The two doors. registerFlow (engine.ts) and validateStackExpressions run the judge on every slot flowNodeTextSlotSources finds and then compile it with validateExpression('template', …), at error. Both validateStackExpressions and lintFlowPatterns are registered with commands: ALL in authoring-rules.ts, so objectstack validate, build and lint all refuse the single brace — the H4 exemption in flow-double-brace-interpolation loses no command its signal. Right (ADR-0032 §1a).
6. Public surface, @objectstack/spec/automation: +6 exports (FLOW_NODE_TEXT_SLOTS, FlowNodeTextSlot, FlowNodeTextSlotSource, TEXT_SLOT_TEMPLATE_REFUSAL, flowNodeTextSlotSources, textSlotTemplateRefusal), api-surface/automation.json and export-origins/automation.json regenerated to match. Right: one judge shared by three contracts, the engine and lint has to be public.
7. @objectstack/formula PATH_ONLY_RE admits $: a hole-grammar widening; an unbound $ path renders nothing; buildScope assigns extra last, so a flow variable overrides a built-in root. Right, at the producer, outside the claim's surface and declared by the seat. The dev's note that extra.locale sets the formatters' locale is read off the engine and is accurate.
8. @objectstack/service-automation: interpolateText deleted; renderTextSlot, textTemplateScope and FlowTextTemplateError added. All package-internal — src/index.ts and builtin/index.ts re-export nothing from builtin/template.ts, and the exports map is . alone — so this package's public surface does not move; what publishes is the renderer change. Right that the changeset names no removed export. One renderer for the three text slots keeps the service-automation: honour outcome: 'refused' on the flow end node — a terminal refused run status (distinct from failed) with the interpolated message persisted on the run (lane 2 of the #14945 ruling 2′) #15788 ruling; textTemplateScope never writes into a variable's own object and the declared-variable precedence is pinned. Right.
9. NOTIFY_TEMPLATE_PLACEHOLDER flips to {{ record.name }}, and the rider's three items (6048446951) are all delivered: the placeholder, the two names added to EXPRESSION_SLOT_TYPES, the stale TemplateExpressionInputSchema comment in notify-node.ts rewritten. Right.
10. Lint: flow-double-brace-interpolation exempts the five text slots, its hint names them, and a text-slot bare-$ check outside the holes prescribes the hole. Right as built.
11. No D2 conversion; D3 semantic entry flow-text-slot-single-brace-refused plus the step-18 rationale fragment (order 89). Right. D2's scope is losslessly mappable changes only, semantic changes excluded; the measurement is pinned in text-slot-template.test.ts (a Date renders JSON-quoted under 17.x and as ISO text under the engine; a whole-slot object renders [object Object] against JSON), and a metadata conversion cannot know a variable's run-time type. The card's second pin reads with its own "when lossless" qualifier: refused with the exact rewrite.
12. In-tree sites. All 29 example strings, the docs, the dogfood fixtures and the registering test fixtures are rewritten. A residue sweep at the head (git grep over ts / mdx / md / json / yaml, non-test and test files, outside the diff) finds no single-brace text-slot site left, except the Tier H skill text named under ③. Right.
13. Wrong — canon. packages/spec/src/shared/expression.zod.ts:402-403, inside the TemplateExpressionInputSchema docblock this very diff edits, still closes with: write the spelling the slot's renderer reads — {{var}} on this schema's slots, {var} on a notify node's. That sits seven lines under the bullet the diff rewrote to say the opposite, and it ships as the hover text of the spec tarball's .d.ts. ADR-0032 Decision 4, the same ADR this card executes: fix the canon first — remove every anti-pattern from the spec's own JSDoc before shipping the contract, the model emits what it is shown. One-line fix: drop the {var} clause.
14. Wrong — an edge of the one judge. textSlotTemplateRefusal on a hole with exactly one stray brace — Total {{ amount } or { amount }} — reads the inner { amount } as a single-brace PATH token (singleBraceTokens drops a token only when BOTH neighbours are braces) and prescribes Total {{{ amount }} / {{ amount }}}. The engine then refuses that as an invalid hole (loud), but the prescription is a wrong correct-form, and ADR-0032 §1d makes the message contract part of the interface. Every door prints it. Fix: a token touching exactly one stray brace is an unbalanced hole — skip the token refusal so the compile step reports it; the pinned Total {{ amount and the balanced cases are unaffected.

② Semver level

• Changeset .changeset/22110-flow-text-slot-double-brace.md: @objectstack/spec major, @objectstack/service-automation major, @objectstack/lint major, @objectstack/formula minor; Clause-②: yes (narrowing) in the fixed spelling; ADR-0087 marker registered flow-text-slot-single-brace-refused, which names the D3 entry the diff adds. No skip-changeset. Check Changeset is green on the head.
• The Clause-②: line agrees in all three carriers. The claim's line was corrected to yes (narrowing) by the seat (6063190355); the PR body carries yes (narrowing: …), and clause2-line.mjs's readArmToken takes the first word inside the parenthetical, so it reads narrowing — the same reading the dev's --event run reported.
• yes is right: the public face widens (+6 spec exports; {{ }} holes now render in five text slots; the formula hole grammar admits $). (narrowing) is right: three node contracts' accept set shrinks on a published authoring surface. The reader's own description of yes (narrowing) — a diff that widens one surface and narrows another, both facts true and both read — is this diff.
• major on the v18 line is right. .changeset/pre.json on main is mode: pre, tag: next, so the no-major guard stands down for the pre window and a breaking narrowing grades major (18.0.0-next); byte-for-byte the grading of [v18] retire the {var} template dialect in flow assignment slots: refuse at registration with per-spelling remedies (the C half of #11182 ruling D, on the v18 train) #19939's landed 19939-flow-value-slot-template-dialect-refused.md (spec / service-automation / lint major, yes (narrowing)). formula: minor for a pure widening is right. The breaking body carries the FROM / TO table, the one-line fix and the four token kinds' remedies, as a breaking changeset must.
• Prose nit, no grading effect: the changeset and PR body cite renderTextSlot as if it were a public symbol of @objectstack/service-automation; it is package-internal (①.8).

③ Boundary flags

• open_questions A / B — A, judged independently of the seat: ADR-0087 D2 admits only lossless mappings and the Date / whole-slot rows are pinned in the diff; B would need a maintainer ruling that accepts a rendering change, and nothing pulls for one. Answered; not escalated.
• Deviations, each: the Clause-② parenthetical — resolved by the seat's correction and the changeset's line (②); the file surface beyond the claim — each a producer measurement showed (formula $, the two new spec modules, the screen / end contracts, the engine's end render point, the dogfood ledger, common-patterns.mdx, the README): accepted; H4 as an exemption: accepted (①.5, ①.10); no D2 entry: right (①.11); the background-build and lock-queue narration: process, no effect on the diff; two os-regen-merge.sh merges with the regeneration as its own commit, and Type Check · source gates green on the head: right; worktree cleanup: not a review matter.
• out_of_scope_findings, each: skills/objectstack-automation/SKILL.md:108-109 and :224-236 plus evals/flows-triggers-approvals.json:17 still teach the single brace (confirmed at the head) — Tier H, out of this PR's reach, and the seat files that card on landing (recorded); the Studio editors for these slots — triage's objectui round, as the card names; hotcrm's 69 tokens — the repo:hotcrm seat; AutomationEngine.celScope nesting into a variable's object — pre-existing, no defect reproduced, not this card; the README's stale field-value row — pre-existing since [v18] retire the {var} template dialect in flow assignment slots: refuse at registration with per-spelling remedies (the C half of #11182 ruling D, on the v18 train) #19939, not this card.
• Escalated — needs a carrier, not 承接者:无: validate-flow-template-paths skips a hole carrying a formatter. Verified: its token reader at :203 is /\{([^{}]+)\}/g, which captures the inner text of a {{ }} hole, and a | then fails the path parse silently, so {{ record.subjcet | upper }} draws no finding while the bare hole does (the diff pins only the bare one). This blind spot is NEW: the single-brace dialect had no formatter syntax, so until this change every path in a text slot was judged. A typo in a formatted hole passes objectstack validate and renders empty at run time with no log — a metadata-authoring trap under Prime Directive chore: version packages #10, which takes a filed card. The seat files it (lint lane); not blocking for this PR.
• Checked and not a gap: validate-field-consumers reads record.x inside a {{ }} hole through its .x reference shape, and its template-range scan matches the inner { record.x }, so a notify text consumer is still credited under the new spelling.
• Serial: [v18] retire the {var} template dialect in flow assignment slots: refuse at registration with per-spelling remedies (the C half of #11182 ruling D, on the v18 train) #19939 pass 1 (0e9e7b706) is an ancestor of the merge base dc4a5c630; the pass-2 overlap is declared serial by the claim. Right.
• Governed surfaces: none in the file list (Governed Surface Queue Guard green); 2040 changed lines, under the 5000 threshold; head repo is the base repo.
• Check-runs on the head, second reading: 19 success — among them Build Core, Governed Surface Queue Guard, Check Changeset, Check PR Size, Spec property liveness, Type Check · consumer gates, Type Check · source gates, Type Check · debt ledger, Dogfood Regression Gate (2/3), Dogfood Verify CLI, Build Docs; 2 skipped (Console Pin Gate, Packed-tarball smoke); 0 failed; and 11 still in_progress, named: Lint & Repo Gates, Test Core (1/6), (2/6), (3/6), (4/6), (5/6), (6/6), Dogfood Regression Gate (1/3), (3/3), Temporal Conformance (live PG + MySQL), Type Check · workspace. A run in progress is not a pass: five of the seven required contexts had not concluded on this head at this reading, and they were not waited for.

Implemented-by: claude/issue-22110-flow-text-slot-double-brace
Reviewed-by: session_01DhTqaEHqPVSVnAkjG3jywn

VERDICT: FAIL

Two reasons, both in the diff's own text, both one-line: ①.13 (the stale {var} sentence in expression.zod.ts:402-403, against ADR-0032 D4) and ①.14 (the wrong prescription for a one-stray-brace hole in textSlotTemplateRefusal, against ADR-0032 §1d). Every other judgment above holds, and the semver reading stands as written. A patch round touching those two files with their pins, green check-runs, and a record on the new head is what stands between this diff and PASS. The escalated lint blind spot is a filed card, not a condition on this PR.

---

Generated by Claude Code

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 0b094026dcb0c8fef22e0572d510a8a8c9d4d8e7
Local-runs: none

Inputs, and nothing else: card #22110 (body and all eleven comments, the two rulings 6063190355 / 6063702421 and the earlier record included), PR #22315 (body, the 53-file list, the net diff 4e4111ca0..0b094026d, +1792 / -380, and the round-2 diff e899a2c81..0b094026d, 8 files, +130 / -10), the earlier ## Contract review on this PR (6063558021, FAIL at 73b682847b), and the check-runs on the head, read at 2026-10-08T17:20:50Z. The PR head was fetched into a review ref of its own and read with git show / git grep; the merge base is the PR's base sha. Governing text re-read on origin/main: ADR-0032 Decisions 1a / 1d / 3 / 4 and the representation table, ADR-0087 D2 / D3, AGENTS.md Prime Directives #10 / #12 / #14 and the changeset rules. This is a review of the WHOLE PR at this head, rendered by an isolated subagent of the seat session named below; the dispatching seat's own conclusions were not an input.

① Derived judgments

The earlier record's two FAIL reasons, at this head:

1. ①.13 of 6063558021 — resolved. packages/spec/src/shared/expression.zod.ts:402-403, the closing sentence of the TemplateExpressionInputSchema docblock, now reads: write the spelling the slot's renderer reads, {{var}} on this schema's slots and on a notify node's title / message alike. The {var} clause is gone. Pinned by the new packages/spec/src/shared/template-expression-input-canon.test.ts, a source-text read of exactly that docblock (same package, seeded from import.meta.url, so check:cross-package-test-inputs is untouched): no notify sentence names a single-brace {var} unless it says "refused". Right — for that docblock. See ①.17 and ①.18 for the two sentences the pin's scope does not reach.
2. ①.14 of 6063558021 — resolved. packages/spec/src/automation/flow-text-slot-template.ts:121-124 singleBraceTokens now drops a token that touches a brace on EITHER side, so Total {{ amount }, Total { amount }}, {{x} and {x}} draw no token refusal (pinned: the judge returns undefined for all four) and the compile step every door runs next reports the unbalanced hole. Pinned at the objectstack validate door (validate-expressions.text-slot.test.ts): one finding, rule expression-invalid, severity error, where naming notify title at config.title, message containing "unbalanced", NOT led by TEXT_SLOT_TEMPLATE_REFUSAL, no three-brace text, and the compile code invalid-template. A genuine token beside a stray brace (Total {{ amount } by {owner}) still gets its own rewrite with nothing three-braced (pinned). Right. The earlier wrong correct-form is gone. Observation, not a gap: both doors continue past the compile step once the judge refuses (engine.ts:10700, validate-expressions.ts:1767), so for that mixed text the unbalanced hole surfaces on the author's second run; the sentence the first run prints is correct about the token it names, which is what ADR-0032 §1d asks. Running the compile step regardless would land both findings in one round — optional, no finding.
3. The escalated flag of 6063558021 — fixed in-round, and right. packages/lint/src/validate-flow-template-paths.ts:214-220 templateRefsIn: inside a {{ }} hole (a brace on both sides of the match) the path before an optional | formatter is judged like a bare one; in a single-brace token a | stays unjudged as before. Pinned in both directions (Case {{ caseRecord.subjcet | upper }} draws flow-template-unknown-field; {{ caseRecord.subject | truncate:'40' }} draws nothing). The docblock now describes both dialects, which is accurate: the interpolator was not deleted — only interpolateText was — and at this head interpolate / interpolateString / interpolateFilter still render every value-like position (the call sites: crud-nodes filter and fields, http whole config, logic-nodes assignment values, loop / map collection and map input, notify recipients / sourceObject / sourceId / templateData / actionUrl / payload / actorId, screen recordId / defaults / field defaultValue / script inputs, subflow input). The seat's own correction (6065269979) says the same.
4. The wording fix — right. The changeset no longer names renderTextSlot / FlowTextTemplateError as if public; it says "one renderer inside @objectstack/service-automation (package-internal; the package's public exports do not change)" — true: the package's exports map is . alone and neither src/index.ts nor builtin/index.ts re-exports anything from builtin/template.ts. Its new sentence "a hole that does not compile fails the node with a guard refusal, which a fault edge does not route" is true at this head: FlowTextTemplateError calls markGuardRefusal(this) (template.ts:372-383), and engine.ts:11146 sets faultEdge to undefined when isGuardRefusal(execErr) and rethrows. The PR body carries the same correction plus a ## Patch round 2 section, written by the seat as the role file requires.

The whole PR's accept-set and public-surface changes, each confirmed at this head:

5. NotifyConfigSchema title / message (bare string or template envelope source): narrowed — every {…} token the 17.x interpolator substituted is refused at the key inside the existing superRefine through the one judge textSlotTemplateRefusal; {{ }} holes, a $-named path and a formatter pass (io-node-config.zod.ts:396-416, pinned in io-node-config.test.ts). Right: ADR-0032 §3 names notify.title/body as the template role; the refusal leads with one sentence and names the hole spelling of every path token (§1d).
6. ScreenConfigSchema title / description: narrowed by a new root superRefine with the same judge; recordId, defaults and a field defaultValue keep the single brace (each hands a resolved value over, pinned). Right. The one hand-edited ratchet line (dropped-refinements.baseline.json, automation/ScreenConfig root site, 679 to 680) is the ledger's designed route for a reviewed new gap and matches the NotifyConfig / EndConfig precedent — reviewed here, right.
7. EndConfigSchema message on a refused outcome: the same judge, also reached at FlowSchema.parse (pinned at nodes.1.config.message). Right.
8. The value slots are untouched. The token grammar moved byte-identical from flow-value-slot-template.ts into the package-internal flow-template-token.ts (absent from automation/index.ts, and rightly: a published copy of a retired dialect would be new public surface); valueSlotTemplateRefusals still keeps the date macros and $User (pinned). Right.
9. The two doors. registerFlow (engine.ts:10688-10708) and validateStackExpressions (validate-expressions.ts:1756-1774) run the judge on every slot flowNodeTextSlotSources finds — nested region nodes included, by the region-prefixed where — then compile each with validateExpression('template', …) at error. Right (ADR-0032 §1a); the H4 exemption in flow-double-brace-interpolation loses no command its signal, since validateStackExpressions runs under every command.
10. @objectstack/spec/automation public surface: +6 exports (FLOW_NODE_TEXT_SLOTS, FlowNodeTextSlot, FlowNodeTextSlotSource, TEXT_SLOT_TEMPLATE_REFUSAL, flowNodeTextSlotSources, textSlotTemplateRefusal), api-surface/automation.json and export-origins/automation.json regenerated to match. Right: one judge shared by three contracts, the engine and lint has to be public.
11. @objectstack/formula PATH_ONLY_RE admits $: a hole-grammar widening for every consumer of the template engine; an unbound $ path renders nothing (pinned). Right, at the producer, declared by the seat on the engine lane.
12. @objectstack/service-automation: interpolateText deleted; renderTextSlot, textTemplateScope, FlowTextTemplateError added — all package-internal, so the public surface does not move; what publishes is the renderer change. One renderer for the five text slots keeps the service-automation: honour outcome: 'refused' on the flow end node — a terminal refused run status (distinct from failed) with the interpolated message persisted on the run (lane 2 of the #14945 ruling 2′) #15788 ruling (pinned byte-identical for end and screen); textTemplateScope never writes into a variable's own object and the declared-variable precedence is pinned. Right.
13. The slot enumeration holds: exactly five text slots. Measured against the executors at this head (the call-site list in ①.3): every other interpolated position hands its resolved value over with its type, and the approval contract interpolates no text slot (its message: lines are refusal text in addIssue). The examples/app-showcase message: 'Task "{record.title}" is done.' left single-brace at :738 is a subflow.input value, which the child's notify renders as {{ message }} — right.
14. NOTIFY_TEMPLATE_PLACEHOLDER is {{ record.name }}, and the rider's three items (6048446951) are delivered: the placeholder; templateExpressionInput and cronExpressionInput added to EXPRESSION_SLOT_TYPES; the stale TemplateExpressionInputSchema comment in notify-node.ts rewritten. Right.
15. No D2 conversion; D3 semantic entry flow-text-slot-single-brace-refused with the step-18 rationale fragment (order 89). Right. D2 admits lossless mappings only; the Date and whole-slot-object rows are pinned in text-slot-template.test.ts, and a metadata conversion cannot know a variable's run-time type. The card's second pin reads with its own "when lossless" qualifier: refused with the exact rewrite.
16. In-tree sites. All 29 example strings, the docs (flows.mdx's new section and table, common-patterns.mdx, the regenerated references, the README row), the dogfood fixtures and ledger entry, the descriptor help and the registering test fixtures are rewritten. A residue sweep at this head over ts / mdx / md / json, outside skills/** and generated trees, finds no single-brace text-slot authoring site left; the single-brace strings that remain in lint-flow-patterns.test.ts:1516/1554/1579 and validate-flow-template-paths.test.ts are fixtures of other rules' graph walks and of the single-brace reader, never fed to a door; the conversions/registry.ts:1105-1154 pairs are the graduated 11.x flow-node-notify-config-aliases entry's before / after fixtures — history by design, with the 18 D3 entry carrying the remedy. Right.
17. Wrong — canon, the same class the earlier record failed on (①.13), one file, a second docblock. packages/spec/src/shared/expression.zod.ts:512-515, the docblock of the exported tmpl helper — the helper the notify title / message .describe() names as the way to write the envelope, so its hover is the first thing an author of a notify envelope reads — still says: {record.x} — a notify flow node's title / message are rendered by the flow interpolator, which reads single braces only; a {{record.x}} keeps its outer braces in the sent text, and the build's flow-double-brace-interpolation rule flags it. All three claims are false at this head (the renderer is the template engine, {{record.x}} is the spelling, and the rule now exempts the text slots), and the sentence is a prescription of the refused form. Pre-existing text (merge base :514), outside the round-2 pin's one-docblock scope, in the file this diff edits twice; it ships in the spec tarball's .d.ts. ADR-0032 Decision 4: remove every anti-pattern from the spec's own JSDoc before shipping the contract — the model emits what it is shown. One-line fix: rewrite the bullet (since protocol 18 a notify node's title / message read {{record.x}} too, and a single-brace token there is refused).
18. Wrong — canon, same file. packages/spec/src/shared/expression.zod.ts:297-299, the docblock of the exported TYPED_EXPRESSION_SOURCE_REQUIRED: "The notify node's title / message, rendered by the flow interpolator, prescribe {record.name} (automation/io-node-config.zod.ts)." False at this head: NOTIFY_TEMPLATE_PLACEHOLDER is {{ record.name }} and the renderer is the template engine. Pre-existing, same class, same fix shape: one sentence (the notify slots take their own sentences so they can name the key; they prescribe the same {{ }} hole). Pin for ①.17 and ①.18: widen template-expression-input-canon.test.ts to read the docblocks above export function tmpl and export const TYPED_EXPRESSION_SOURCE_REQUIRED with the same predicate (a notify sentence naming a single-brace placeholder, not saying "refused"), so the canon in this file is held as one set.

② Semver level

• Changeset .changeset/22110-flow-text-slot-double-brace.md: @objectstack/spec major, @objectstack/service-automation major, @objectstack/lint major, @objectstack/formula minor; Clause-②: yes (narrowing) in the fixed spelling; ADR-0087 marker registered flow-text-slot-single-brace-refused, naming the D3 entry the diff adds. No skip-changeset. Check Changeset is success on the head, twice (15:57Z, and 17:19Z after the seat's body edit).
• The Clause-②: line agrees in all three carriers. The claim's line was corrected to yes (narrowing) (6063190355); the PR body's first lines carry yes (narrowing: …), which scripts/pm/clause2-line.mjs readArmToken reads as narrowing — the arm regex takes the first word inside the parenthetical and the colon after it is neither an identifier character nor a pipe; the changeset carries yes (narrowing).
• yes is right: the public face widens (+6 spec exports; {{ }} holes now render in five text slots; the formula hole grammar admits $). (narrowing) is right: three node contracts' accept set shrinks on a published authoring surface, and objectstack validate refuses what it accepted. major on the v18 line is right: .changeset/pre.json on main is mode: pre, tag: next, so a breaking narrowing grades major (18.0.0-next), byte-for-byte the grading of [v18] retire the {var} template dialect in flow assignment slots: refuse at registration with per-spelling remedies (the C half of #11182 ruling D, on the v18 train) #19939's landed sibling changeset; formula: minor for a pure widening is right. The breaking body carries the FROM / TO table, the one-line fix and the four token kinds' remedies, as a breaking changeset must, and after round 2 names no package-internal symbol as public.
• examples/app-showcase, examples/app-todo and packages/qa/dogfood are private: true, so no changeset is owed for them. ①.17 / ①.18 are docblock prose with no grading effect.

③ Boundary flags

• open_questions: round 2 declares none. Round 1's A / B stands answered A, judged independently: ADR-0087 D2 admits only lossless mappings, the Date / whole-slot rows are pinned, and B would need a maintainer ruling that accepts a rendering change, which nothing pulls for.
• Round-2 deviations, each: the dev did not edit the PR body — right under the role file, and the seat wrote the body edit (the ## Patch round 2 section and the package-internal wording are there, read at this head); item (2) pinned as "no refusal" at the spec function and by code / path at the lint door — right, the spec has no code of its own for an unbalanced hole; item (1)'s new same-package canon pin — right, and its scope is the gap ①.17 / ①.18 name; the lock-queue and killed-build narration — process, no effect on the diff.
• Round-2 out_of_scope_findings, each: (a) validate-flow-template-paths skips a hole whose path uses bracket indexing ({{ rows[0].subjcet }}) — escalated: this takes a filed card (lint lane), not "the next PR to edit the file". This PR's own docs (flows.mdx's new section) and changeset teach {{ rows[0].subject }} as a text-slot spelling, so an author following the shipped text reaches it; under 17.x rows[0].x was unresolvable (not a VARIABLE_PATH, and square brackets are outside ARITHMETIC_CHARSET), so no working text-slot path escaped the rule before this change and a documented one does now — the same class the earlier record escalated for formatters. A misspelt field under it passes objectstack validate and renders empty with no log: a metadata-authoring trap under Prime Directive chore: version packages #10. Warning-severity rule, not blocking; one-line fix for the card: inside a hole, normalise [n] to .n before the dotted-path test. (b) "the order said the interpolator is deleted; only interpolateText was" — answered, right (①.3).
• Round-1 flags, standing: skills/objectstack-automation/SKILL.md :108-109, :224-236 and evals/flows-triggers-approvals.json:17 still teach the single brace (confirmed at this head) — Tier H, out of this PR's reach under Prime Directive feat: Comprehensive CRM example demonstrating all ObjectStack protocol features #14; the seat's card. Noted for sequencing: authoring stays open to every seat, so that skills PR can be opened now and the maintainer's word requested in the next batch, which is how ADR-0032 Decision 4's "skills … before shipping the contract" is met before the 18 line leaves pre mode. The Studio editors — triage's objectui round; hotcrm's 69 tokens — the repo:hotcrm seat; AutomationEngine.celScope nesting and the README's stale field-value row — pre-existing, not this card.
• Serial: [v18] retire the {var} template dialect in flow assignment slots: refuse at registration with per-spelling remedies (the C half of #11182 ruling D, on the v18 train) #19939 pass 1 is an ancestor of the merge base; the pass-2 overlap is declared serial. Right.
• Governed surfaces: none in the 53-file list (Governed Surface Queue Guard success); 2172 changed lines, under the 5000 threshold; head repo is the base repo; draft; mergeable clean against main at the reading.
• Check-runs on 0b094026d, read at 17:20:50Z: 42 runs, all completed — 38 success, 4 skipped (the re-run Auto Label and Check PR Size after the body edit, Console Pin Gate, Packed-tarball smoke (opt-in)), 0 failed, 0 in progress. The seven required contexts all success: Lint & Repo Gates, TypeScript Type Check, Test Core (and its six shards), Dogfood Regression Gate (and its three), Build Core, Temporal Conformance (live PG + MySQL), Governed Surface Queue Guard. Their conclusions are the gate verdicts; nothing was run locally.

Implemented-by: claude/issue-22110-flow-text-slot-double-brace
Reviewed-by: session_01DhTqaEHqPVSVnAkjG3jywn

VERDICT: FAIL

Two reasons, one file, both one-sentence: ①.17 (packages/spec/src/shared/expression.zod.ts:512-515, the tmpl docblock still prescribing {record.x} for a notify title / message) and ①.18 (:297-299, the TYPED_EXPRESSION_SOURCE_REQUIRED docblock still saying the notify slots prescribe {record.name}), both against ADR-0032 Decision 4 and both the class the earlier record failed on; the round-2 pin holds one docblock and these are the other two in the same file. Both earlier FAIL reasons and the escalated lint flag are resolved at this head, the semver reading stands, and the check-runs are green. A patch round rewriting those two sentences, widening the canon pin to those two docblocks, green check-runs and a record on the new head is what stands between this diff and PASS. The bracket-index blind spot is a filed card, not a condition on this PR.

---

Generated by Claude Code

[objectstack-fleet]

CI on f84cd82d2 (the merge-main round after #22014 closed): Lint & Repo Gates is red on a repo-wide gate, not this PR · domain:spec seat 2 (#18549) · session session_01DhTqaEHqPVSVnAkjG3jywn · 2026-10-09T05:31Z.

• What fails: the failing step is 35, "PM dispatch-gates self-test" (job 113681876149), with ✗ dispatch-gates self-test: 1 of 2011 case(s) failed.
• The case: no mkdtempSync site in this tree takes a base the scan cannot read, on packages/qa/dogfood/test/security-catalog-cold-boot-environment-holder.dogfood.test.ts:108. That line is mkdtempSync(join(process.cwd(), …)), which arrived with PR feat(objectql)!: a cold boot refuses a package-held position or permission-set name the environment catalog already holds, as a hot install does (ADR-0048 N.3) #22365.
• Why it is not this PR's:
  • this PR does not touch that file;
  • the same case is red on main at e75dceddd (job 113666891682), and on PRs feat(core,cli,verify): bootStack composes what serve composes — item 1 stage 2 of #22301 (HELD at stop conditions) #22381 and fix(auth,services): the services-lane in-process session reads stop renewing a cookie session (#22258) #22396;
  • this seat filed it as ci(pm): check:pm-dispatch-gates is red on main — its live-tree case reads mkdtempSync(join(process.cwd(), …)) in a #22365 dogfood test as an unresolved temp base #22422.
• The fix: none exists yet. ci(pm): check:pm-dispatch-gates is red on main — its live-tree case reads mkdtempSync(join(process.cwd(), …)) in a #22365 dogfood test as an unresolved temp base #22422 awaits triage's routing, either to the test site or to the scan.
• When it is green: once ci(pm): check:pm-dispatch-gates is red on main — its live-tree case reads mkdtempSync(join(process.cwd(), …)) in a #22365 dogfood test as an unresolved temp base #22422 lands, this branch merges main again. No re-run op is available to this seat, and the PR stays watched until it is green.
• The other red, now cleared: Test Core (6/6)'s timing-drift step was the one this PR waited on. On this head it reads success, judged against finding(ci): the shard-timings dataset rests on ONE scheduled run, and records @objectstack/spec at 1134.86 s against 1573–1651 s executed — #16468's 25%-headroom ceilings built on it would red every PR that runs spec #22014's multi-run dataset (PR chore(ci): refresh the Test Core shard-timings dataset #22368), which arrived in this merge. Shards 1–5 were still running at this stamp.

---

Generated by Claude Code

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 4e275f15df0e5c991442b0b49ab4b02800678f4a
Local-runs: none

Inputs, and nothing else: card #22110 (body and all fifteen comments — the claim 6059160333, the rulings 6063190355 / 6063702421 / 6065501303, the four dev reports including the merge report 6076389514, and the three seat ACCEPTs), PR #22315 (body, the 54-file list, and the net diff 3054516ef..4e275f15d, +1854 / −407, 2261 changed lines — the merge base of this head against origin/main is the PR's own base sha 3054516ef, so that diff is the net diff), the three earlier ## Contract review records on this PR (6063558021 FAIL, 6065484352 FAIL, 6068757622 PASS at 5bfa9ae1f) with the seat's CI notes (6067723298, 6069399520, 6074946922), and the 35 check-runs plus the combined commit status on the head, read at 2026-10-09T07:41Z. The head was fetched into a private ref (refs/review/pr-22315-b) and read with git show / git diff / git grep; the shared checkout was not touched (0 dirty paths before and after); nothing was built, run or re-run. Governing text re-read on origin/main: ADR-0032 Decisions 3 and 4 and its representation table, ADR-0087 D2 / D3, AGENTS.md Prime Directives #10 / #12 / #14 and the changeset rules. A whole-PR review at this head by an isolated subagent of the seat session named below; the dispatch order and the seat's own conclusions were not inputs.

① Derived judgments

This head against the PASS head 5bfa9ae1f — what the merges changed. Three merges of origin/main sit between them, each through the merge script with no conflict markers: bff973d87 (main c6fc938ce), f84cd82d2 (main ca135dcc4 — the 39 commits including #22380, #22392, #22393, #22406, #22368), 4e275f15d (main 3054516ef — four commits including #22416's 27a8b33de). The seat's "twice" counts the merge round's two; the first merge was the seat's own re-run push.

1. The PR's delta is byte-identical across the merges. The sorted +/− line multiset of git diff -U0 3599fef12 5bfa9ae1f (the PASS head against its merge base) equals that of git diff -U0 3054516ef 4e275f15d — 2269 lines each, an empty interdiff — and the 54-file set is the same. So nothing this PR adds or removes moved; what remains is whether main's own edits to the seven files both sides touched combine with it correctly at this head. Each read at the head, not taken from the merge report:
2. packages/spec/src/migrations/registry.ts — right. STEP18_RATIONALE is the union: 107 fragments, ids in C-sorted order (verified over the whole list at the head; scripts/step18-rationale-merge.test.ts runs inside the green Test Core). This branch's flow-text-slot-single-brace-refused sits at order 89 between flow-script-subflow-config-undeclared-keys-refused (87) and flow-value-slot-template-dialect-refused (88), tied at 89 with flow-builtin-node-config-undeclared-keys-refused and main's platform-global-object-organization-column-retired; main's sys-view-definition-retired and try-catch-and-retry-policy-undeclared-keys-refused (fix(spec)!: close the shared retry policy, and judge try_catch config keys at the build doors #22380) sit at 90 in their sorted places. The list's own docblock allows the tie and renders ties by id. The three D3 semantic entries (this branch's and main's two) are all present in step18. check:generated runs inside the green TypeScript Type Check, so the migration, spec-changes and upgrade-guide artifacts are current for this union. Observation, no finding: fix(spec)!: close the shared retry policy, and judge try_catch config keys at the build doors #22380's fragment opens "Then the retry policy closes" as a continuation of the builtin-keys fragment, and at order 90 it renders after three order-89 fragments instead of the two it followed on main — a prose join main had already made with platform-global…; the docblock and the merge test accept it.
3. packages/lint/src/validate-expressions.ts — right, and the question the dispatch asked. fix(lint)!: os build and the object save door refuse a select option's visibleWhen that reads an unbound ctx/os member (#22274) #22392 / fix(lint)!: os build and the object save door refuse a select option's visibleWhen that reads parent (#22157) #22268's option-visibleWhen root and member verdicts (OPTION_VISIBLE_WHEN_BOUND_ROOTS / OPTION_VISIBLE_WHEN_BOUND_MEMBERS, optionVisibleWhenRootIssue, about :1119-1270, called from the objects' fields walk about :2298) and this PR's text-slot pass (about :1982-1992, inside the flows' node walk, right after flowNodeValueTemplateRefusals) are disjoint passes over different metadata. No continue main added precedes the text-slot pass in the node loop — the three continues above it are inside the declared-slot sub-loop. The pass still runs under validateStackExpressions, registered commands: ALL (authoring-rules.ts about :557-560), so validate, build and lint all refuse the single brace. Nothing this PR refuses or prescribes at the build door changed.
4. packages/services/service-automation/src/engine.ts — right. The import union holds both sides (flowNodeTextSlotSources / textSlotTemplateRefusal at :54, main's builtinNodeConfigKeysJudged at :59). fix(spec)!: close the shared retry policy, and judge try_catch config keys at the build doors #22380 makes the undeclared-key walk stand aside for every builtin (if (builtinNodeConfigKeysJudged(node.type)) continue; at :10347), but that continue lives in validateNodeConfigKeys (:10331), while this PR's text-slot pass (:10735-10745) lives in validateFlowExpressions (:10570), inside the collectFlowGraphs walk (:10703, so region nodes are judged with their scope prefix); registerFlow calls both (:4412, :4424). The stand-aside does not bypass the text-slot judge. fix(service-automation, objectql): runAs refusal and run-setup warning texts hold on both kernels #22390 changed only the runAs warn text and comments; the end render point (renderTextSlot(endConfig.message, variables), about :11005) is intact.
5. content/docs/automation/flows.mdx — right. Main's fix(spec)!: close the shared retry policy, and judge try_catch config keys at the build doors #22380 added the closed-retry paragraph (about :803) and reworded the config-key row and paragraph for try_catch; this PR's "Text slots read double-brace holes" section (about :284-330), the dialect-table row (about :1998) and callout item 4 (about :2029) are intact. The fault-edge variable table — the PASS record's ①.18 residue — is byte-identical, moved from :1618 to :1624 by the added paragraph.
6. The other three overlap files — right. examples/app-showcase/src/automation/flows/index.ts: main changed one comment on InboundTaskWebhookFlow; the 23 text-slot rewrites are intact, and the two single-brace residues a grep finds there (:51 script inputs, :1223 http body) are value-like positions. packages/lint/src/validate-expressions.test.ts: disjoint hunks — this PR adds slot to the meta-test's receiver allowlist, main adds the finding(lint): a select option's visibleWhen reading parent passes os build and the object save door, and the server's option gate then faults open ("allowed through; the option's gate was NOT enforced") #22157 / lint: a select option's visibleWhen reading a member the option check never binds (os.org.id, os.env, ctx.locale) passes os build and the save door, and the server's option gate then faults open #22274 option suites. packages/services/service-automation/README.md: main dropped RunProvenanceContext from a type list (fix(service-automation)!: retire RunProvenanceContext; pre-D5 principal-less readings outside packages/spec say D5 refuses it #22357); this PR's dialect-table row is intact.

The whole PR's accept-set and public-surface changes, each confirmed at this head — the delta is the one the PASS record judged, re-read here rather than adopted:

7. NotifyConfigSchema title / message (bare string or template envelope source): narrowed — inside the existing superRefine, after the blank-envelope refusal and its continue, textSlotTemplateRefusal(value.source) adds a custom issue at the key; {{ }} holes, a $-named path and a formatter pass. Pinned in io-node-config.test.ts for both spellings, the message led by TEXT_SLOT_TEMPLATE_REFUSAL and naming the hole spelling. Right: ADR-0032's representation table names notify.title/body as the text-template role whose IR is {dialect:'template'}, and Decision 3 deletes the single brace there.
8. ScreenConfigSchema title / description: narrowed by a new root superRefine with the same judge; recordId, defaults and a field defaultValue keep the single brace (pinned; each hands a resolved value over). The hand-edited ratchet line (dropped-refinements.baseline.json, the root site under automation/ScreenConfig, 679 to 680) is the ledger's designed route for a reviewed new gap, and the refinement reaches the runtime through parseNodeConfig. Right.
9. EndConfigSchema message on a refused outcome: the judge runs after the required-message refusal, with a return added so the two never double-report; reached at FlowSchema.parse (pinned at nodes.1.config.message). Right.
10. Value slots untouched. The token grammar moved from flow-value-slot-template.ts into the package-internal flow-template-token.ts byte-identical (TEMPLATE_TOKEN, DATE_MACRO, VARIABLE_PATH, ARITHMETIC_CHARSET, EXPRESSION_SHAPE, celPath, celExpression — compared hunk against hunk); the module is absent from automation/index.ts, rightly, and valueSlotTemplateRefusals still keeps the date macros and $User (pinned). Right.
11. The two doors (③ and ④): judge, then compile with validateExpression('template', …) at error; a slot the judge refuses skips its compile (continue), so for a text mixing a path token with an unbalanced hole the second finding surfaces on the author's next run — an observation the earlier record made, not a gap: the first sentence is right about the token it names (ADR-0032 §1d).
12. @objectstack/spec/automation public surface: +6 exports (FLOW_NODE_TEXT_SLOTS, FlowNodeTextSlot, FlowNodeTextSlotSource, TEXT_SLOT_TEMPLATE_REFUSAL, flowNodeTextSlotSources, textSlotTemplateRefusal); api-surface/automation.json and export-origins/automation.json carry exactly those six against main (main's builtinNodeConfigKeysJudged is on both sides, so it is rightly absent from the diff). Right: one judge shared by three contracts, the engine and lint has to be public.
13. @objectstack/formula PATH_ONLY_RE admits $: a hole-grammar widening for every consumer of the engine; an unbound $ path renders nothing (pinned). Right, at the producer, declared on the engine lane by the seat; graded minor.
14. @objectstack/service-automation: interpolateText deleted; renderTextSlot, textTemplateScope, FlowTextTemplateError added — package-internal (exports is . alone at the head; neither src/index.ts nor builtin/index.ts re-exports from builtin/template.ts), so the public surface does not move and what publishes is the renderer change. One renderer for the five slots keeps the service-automation: honour outcome: 'refused' on the flow end node — a terminal refused run status (distinct from failed) with the interpolated message persisted on the run (lane 2 of the #14945 ruling 2′) #15788 ruling (the end / screen byte-identity probes are rewritten to engine-specific shapes); textTemplateScope writes only into fresh containers and a declared variable wins over a flat dotted key sharing its head (pinned); FlowTextTemplateError is marked a guard refusal, so a fault edge does not route it (pinned: nothing is sent). Two rendering edges, read off the code and declared in the diff's own text: a slot that renders no text at all returns undefined, so a screen title falls back to the node label (its .describe() says so) and a notify title meets its existing "title is required" guard exactly as a null-resolving token did before; a flow variable named locale is the formatters' locale. Right.
15. NOTIFY_TEMPLATE_PLACEHOLDER is {{ record.name }}, and the rider 6048446951's three items are delivered: the placeholder; templateExpressionInput and cronExpressionInput added to EXPRESSION_SLOT_TYPES; the stale comment in notify-node.ts rewritten. Right.
16. Lint: flow-double-brace-interpolation scans the config withoutTextSlots (the five keys by node type), its hint names those five as the only {{ }} positions, and the text-slot bare-$ check reads outside the holes and prescribes the hole; the spec: a notify node's refused title / message is told to write '{{record.name}}', the spelling the build's flow-double-brace-interpolation rule then flags on the same node and the notify renderer does not resolve #22081 round-trip pin's control moved to the node's single-brace actionUrl. Right as built — H4 as an exemption, because ③ already refuses at error and a second reading would double-report.
17. No D2 conversion; D3 semantic entry flow-text-slot-single-brace-refused plus the step-18 fragment. ADR-0087 D2's scope is "losslessly mappable changes only" and "semantic changes are excluded … it goes to D3"; the measured DIFF rows (a Date rendered JSON-quoted by the 17.x interpolator and as ISO text by the engine; a whole-slot object rendered String(value) against JSON) are pinned in text-slot-template.test.ts, and a metadata conversion cannot know a variable's run-time type. The card's second pin reads with its own "when lossless" qualifier: refused with the exact rewrite. Right.
18. Canon (ADR-0032 Decision 4) holds at this head. The three expression.zod.ts docblocks (TemplateExpressionInputSchema, tmpl, TYPED_EXPRESSION_SOURCE_REQUIRED) say a notify title / message reads {{var}} and that a single brace there is refused; the canon pin holds them as one set, and the moved expression-dialect-docs.pin.test.ts pins the protocol-18 relation with its anti-vacuity test kept. A sweep of packages/spec/src (non-test) for a single-brace placeholder beside a notify, screen or end text slot finds two lines, both saying it is refused (builtin-node-config.zod.ts:41, expression.zod.ts:511). The .describe()s, the descriptor help in notify-node.ts / screen-nodes.ts and the regenerated references all teach the hole. Right.
19. The one-stray-brace edge and the lint path reader — right. singleBraceTokens drops a token touching a brace on either side (pinned at the spec function and at the objectstack validate door: invalid-template, no three-brace text); templateRefsIn judges a hole's path before | and reads [i] as .i, pinned both ways.
20. In-tree sites. A sweep at this head over examples/**, packages/**/src, packages/qa and content/docs (non-test, outside the generated references and skills/**) for a single-brace token in a title / message / description string finds only JS ${…} template literals, the docs line that names the refused form as refused (flows.mdx:2029) and the two showcase value-like positions of ⑥. Right.
21. Residue standing from the PASS record, unchanged, not conditions: the flows.mdx fault-edge variable table (⑤) still writes {$error} / {$error.message} with no position named — true of every value-like position, and the page's own section teaches the hole for a text slot; stringifyForTemplate's docblock (template.ts about :326-337) still motivates itself with a fault handler's {$error.message} — package-internal, no hover text. Carriers as the PASS record recorded them.

② Semver level

• Changeset .changeset/22110-flow-text-slot-double-brace.md: @objectstack/spec major, @objectstack/service-automation major, @objectstack/lint major, @objectstack/formula minor; Clause-②: yes (narrowing) in the fixed spelling; the ADR-0087 marker registered flow-text-slot-single-brace-refused names the D3 entry the diff adds. The breaking body carries the FROM / TO table, the one-line fix, the four token kinds' remedies and the measured "not converted" rows, and names no package-internal symbol as public. No skip-changeset. Check Changeset is success on the head.
• The Clause-②: line agrees in all three carriers. The claim's line was corrected to yes (narrowing) in 6063190355; the PR body's second line is Clause-②: yes (narrowing: …), whose arm clause2-line.mjs reads as narrowing; the changeset carries yes (narrowing).
• yes is right: the public face widens (+6 spec exports; {{ }} holes now render in five text slots; the formula hole grammar admits $). (narrowing) is right: three node contracts' accept set shrinks on a published authoring surface, and objectstack validate refuses what it accepted. major is right: the four packages are at 17.7.0 on main and .changeset/pre.json is mode: pre, tag: next, so a breaking narrowing grades major on the 18 pre line, as [v18] retire the {var} template dialect in flow assignment slots: refuse at registration with per-spelling remedies (the C half of #11182 ruling D, on the v18 train) #19939's landed sibling was graded; formula: minor for a pure widening is right. @objectstack/example-showcase, @objectstack/example-todo and @objectstack/dogfood are private: true, so no changeset is owed for them. The merges changed no package this PR publishes from, and the file list carries exactly one added changeset and no modified or deleted one of main's.

③ Boundary flags

• open_questions: the merge-round report 6076389514 and rounds 2 and 3 declare none. Round 1's A / B stands answered A, judged independently: ADR-0087 D2 admits only lossless mappings and sends semantic changes to D3, the Date / whole-slot rows are pinned, and B would need a maintainer ruling that accepts a rendering change, which nothing pulls for. Answered; not escalated.
• The merge-round report, each claim read against the head: three merges rather than the two it counts — the report describes its own round, and the earlier bff973d87 was the seat's re-run push (CI note 6069399520); no conflict markers and no regeneration owed — consistent with the empty interdiff and the green generated-artifact gates; the STEP18_RATIONALE union of 107 fragments in id order — verified (②); "merge 2 overlapped no file the branch edits" — right, 3054516ef's four commits touch none of the 54. The report carries no deviations list; its process notes (lock queue-timeouts re-run, a build-first ordering) have no effect on the diff. Not escalated.
• Rounds 2 and 3 deviations and out_of_scope_findings: judged by the earlier records and standing — the expression-dialect-docs.pin.test.ts move (necessary, anti-vacuity kept), the order-89 tie (allowed), the PR body written by the seat (right under the role file; the ## Patch round 2 / 3 sections are in the body at this head), the sweep's near-misses (context-tokens.zod.ts's {recordId} and the 17.x fixtures in conversions/registry.ts describe value positions and history, still true).
• Standing Tier H flag: skills/objectstack-automation/SKILL.md :107-109 (a notify title / message example in single braces) and :238-241 (lists notify title / message among the single-brace text slots and calls {{x}} the other dialect), plus evals/flows-triggers-approvals.json:17 — confirmed at this head; text this PR makes false, outside its reach under Prime Directive feat: Comprehensive CRM example demonstrating all ObjectStack protocol features #14; the seat's card at landing, which ADR-0032 Decision 4 wants opened before the 18 line leaves pre mode. The Studio editors — triage's objectui round, as the card names; hotcrm's 69 tokens — the repo:hotcrm seat; AutomationEngine.celScope nesting and the README's stale field-value row — pre-existing, not this card.
• Serial: [v18] retire the {var} template dialect in flow assignment slots: refuse at registration with per-spelling remedies (the C half of #11182 ruling D, on the v18 train) #19939 pass 1 (0e9e7b706) and fix(spec,service-automation)!: an undeclared config key on 10 more builtin node types is refused at the build doors; one judge per type #22319 (2f70c2222) are ancestors of the merge base 3054516ef; the [v18] retire the {var} template dialect in flow assignment slots: refuse at registration with per-spelling remedies (the C half of #11182 ruling D, on the v18 train) #19939 pass-2 overlap is declared serial by the claim. Right.
• Governed surfaces: none in the 54-file list (no path under docs/adr/, docs/NORTH-STAR.md, .claude/, skills/, AGENTS.md or CLAUDE.md); Governed Surface Queue Guard success; 2261 changed lines, under the 5,000 threshold; head repo is the base repo; draft.
• Check-runs on 4e275f15d, 35, all completed: 33 success, 2 skipped (Console Pin Gate, Packed-tarball smoke (opt-in)), 0 failure, 0 pending; the combined commit status is success (Vercel). The seven required contexts are all success: Lint & Repo Gates (the ci(pm): check:pm-dispatch-gates is red on main — its live-tree case reads mkdtempSync(join(process.cwd(), …)) in a #22365 dogfood test as an unresolved temp base #22422 self-test red of f84cd82d2 is cleared by 27a8b33de in this head), TypeScript Type Check (with the spec generated-artifact gates), Test Core and its six shards ((2/6) green; (6/6)'s timing-drift step green against the dataset chore(ci): refresh the Test Core shard-timings dataset #22368 refreshed), Dogfood Regression Gate and its three, Build Core, Temporal Conformance (live PG + MySQL), Governed Surface Queue Guard. Those conclusions are the gate verdicts; nothing was run here. No check is red or pending on this head.

Implemented-by: claude/issue-22110-flow-text-slot-double-brace
Reviewed-by: session_01DhTqaEHqPVSVnAkjG3jywn

VERDICT: PASS

The three merges changed nothing this PR refuses or prescribes: its delta is byte-identical to the PASS-judged one, and in each of the seven files both sides edited, main's changes sit in different passes, methods or paragraphs from this PR's — above all, #22380's builtin key-walk stand-aside in validateNodeConfigKeys does not reach the text-slot judge in validateFlowExpressions, and #22392's option verdicts walk objects, not flows. Every accept-set and public-surface change is right at this head, the semver reading stands across the three carriers, no boundary flag escalates, and every check on the head is green. The Tier H skills residue is the seat's card at landing.

---

Generated by Claude Code

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: ce4f6519fc9aad5d8665bb6da8615b8f75bed191
Local-runs: none

Inputs, and nothing else: card #22110 (body and all sixteen comments — the claim 6059160333, the rulings 6063190355 / 6063702421 / 6065501303, the five dev reports including the merge reports 6076389514 and 6077810372, and the three seat ACCEPTs), PR #22315 (body, the 54-file list, and the net diff 05c7c3fa3..ce4f6519f, +1854 / −407, 2261 changed lines — the merge base of this head against origin/main is the head's own main parent 05c7c3fa3, so that diff is the net diff), the four earlier ## Contract review records on this PR (6063558021 FAIL, 6065484352 FAIL, 6068757622 PASS at 5bfa9ae1f, 6076666309 PASS at 4e275f15d) with the seat's CI notes, and the 35 check-runs plus the combined commit status on the head, read at 2026-10-09T09:10Z. The head was fetched into a private ref (refs/review/pr-22315-d) and read with git show / git diff / git grep; the shared checkout was not touched (0 dirty paths before and after); nothing was built, run or re-run. A whole-PR review at this head by an isolated subagent of the seat session named below; the dispatch order and the seat's own conclusions were not inputs.

① Derived judgments

This head against the PASS head 4e275f15d — what the one merge changed. ce4f6519f is one merge of origin/main 05c7c3fa3 (7 commits, #22427 = 46692c118 among them) onto 4e275f15d, with one conflict. Each read at the head, not taken from the merge report:

1. The PR's own delta is unchanged. The sorted +/− line multiset of git diff -U0 3054516ef 4e275f15d (the PASS head against its merge base) equals that of git diff -U0 05c7c3fa3 ce4f6519f — 2261 lines each, an empty interdiff; the 54-file set is the same, and GitHub's file list for the PR is that same set; git range-diff shows = for all 17 commits. So nothing this PR adds or removes moved, and what remains is whether main's edits to the files both sides touched combine with it correctly.
2. packages/lint/src/validate-expressions.ts — right, and the question the dispatch asked. lint/objectql: a select option's visibleWhen reading current_user.roles (gone since ADR-0090 D3) or a computed key passes both doors and faults open at the server — the EvalUser-member level of the #22157 / #22274 family #22394's option-visibleWhen member verdicts, brought by fix(lint)!: os build and the object save door refuse a select option's visibleWhen that reads an unbound member of the acting user (#22394) #22427, are the helpers at about :1118–:1480 (OPTION_VISIBLE_WHEN_USER_ROOTS, OPTION_CHECK_ACTING_USER, the memoised optionVisibleWhenUserMembers, tickedList, membersReadUnder / membersReadThrough, optionVisibleWhenNamespaceMemberIssue, optionVisibleWhenUserMemberIssue), called from the OBJECTS' option pass (optionVisibleWhenRootIssue at about :2506), plus a docblock sentence in StackExpressionOptions and one comment. This PR's text-slot pass (about :2188–:2198) sits in the FLOWS' node walk, directly after flowNodeValueTemplateRefusals. Disjoint passes over different metadata. Both import blocks are present at the head (buildScope :87, RelationshipTraversalAnalysis :89, EvalUserSchema :121; flowNodeTextSlotSources / textSlotTemplateRefusal :96–:97). Between the node-loop head (:2070) and the text-slot pass the only continues are the three inside the declared-slot sub-loop (for (const found of resolveFlowNodeExpressions…)), so no path main added skips the judge. validateStackExpressions is still registered commands: ALL (authoring-rules.ts about :557–:560), so validate, build and lint all refuse the single brace. Nothing this PR refuses or prescribes at the build door changed.
3. packages/lint/src/validate-expressions.test.ts — the one conflict, resolved right. The hunk is the PLUMBING receiver-excuse set of the receiver-scan meta-test (about :3414), not a test case. At the head the set carries this PR's 'slot' entry (with its four-line comment) AND main's five ('declaredUserMembers', 'boundUserMembers', 'listedNames', 'tickedNames', 'membersRead', with theirs); no entry is duplicated; the file's delta against 05c7c3fa3 is exactly the five-line 'slot' hunk, and against 4e275f15d it is main's 210 added lines (the lint/objectql: a select option's visibleWhen reading current_user.roles (gone since ADR-0090 D3) or a computed key passes both doors and faults open at the server — the EvalUser-member level of the #22157 / #22274 family #22394 describe and its seven cases). Order-free set, no assertion changed, each side's excuse kept — the union.
4. The other overlap files — right. content/docs/automation/flows.mdx: the "Text slots read double-brace holes" section (:284), its link definition (:330), the dialect-table row (:1998) and callout item 4 (:2029) are intact; main's 403 row and trigger-route rewording sit outside them. examples/app-showcase/src/automation/flows/index.ts: main re-typed InquiryPurgeFlow to type: 'screen'; its one notify carries a token-free title / message and it has no screen node, so no text-slot judge reaches it; the 23 text-slot rewrites are intact, and the one single-brace message a grep finds (:738) is a subflow.input value. packages/spec/src/migrations/registry.ts: STEP18_RATIONALE is 107 fragments, ids C-sorted over the whole list; this branch's flow-text-slot-single-brace-refused (order 89) sits between flow-script-subflow-config-undeclared-keys-refused and flow-value-slot-template-dialect-refused; the D3 entry is present once in each list. The merge report's "no regeneration owed" is consistent with the empty interdiff and with check:generated running green inside TypeScript Type Check.

The whole PR's accept-set and public-surface changes, each confirmed at this head — re-read here rather than adopted from the earlier PASS records:

5. NotifyConfigSchema title / message (bare string or template envelope source): narrowed — inside the existing superRefine, after the blank-envelope refusal and its continue, textSlotTemplateRefusal(value.source) adds a custom issue at the key; {{ }} holes, a $-named path and a formatter pass. Pinned in io-node-config.test.ts for both spellings, the message led by TEXT_SLOT_TEMPLATE_REFUSAL and naming the hole spelling. Right: ADR-0032's representation table names notify.title/body as the text-template role, and Decision 3 deletes the single brace there.
6. ScreenConfigSchema title / description: narrowed by a new root superRefine with the same judge; recordId, defaults and a field defaultValue keep the single brace (pinned; each hands a resolved value over). The hand-edited ratchet line (dropped-refinements.baseline.json, the "" root site under automation/ScreenConfig, 679 to 680) is the ledger's designed route for a reviewed new gap, and the refinement reaches the runtime through parseNodeConfig. Right.
7. EndConfigSchema message on a refused outcome: the judge runs after the required-message refusal, with a return so the two never double-report; reached at FlowSchema.parse (pinned at nodes.1.config.message). Right.
8. Value slots untouched. The token grammar moved from flow-value-slot-template.ts into the package-internal flow-template-token.ts byte-identical (TEMPLATE_TOKEN, DATE_MACRO, VARIABLE_PATH, ARITHMETIC_CHARSET, EXPRESSION_SHAPE, celPath, celExpression, compared hunk against hunk); the module is absent from automation/index.ts, rightly, and valueSlotTemplateRefusals still keeps the date macros and $User (pinned). Right.
9. The two doors. registerFlow calls validateNodeConfigKeys (:4412) and validateFlowExpressions (:4424); the text-slot pass (:10735) lives in the latter, inside the collectFlowGraphs walk, so region nodes are judged with their scope prefix; the builtinNodeConfigKeysJudged stand-aside (:10347) lives in the former and does not reach it. Both doors judge, then compile with validateExpression('template', …) at error; a slot the judge refuses skips its compile (continue), so for a text mixing a path token with an unbalanced hole the second finding surfaces on the author's next run — an observation, not a gap: the first sentence is right about the token it names (ADR-0032 §1d). Right.
10. @objectstack/spec/automation public surface: +6 exports (FLOW_NODE_TEXT_SLOTS, FlowNodeTextSlot, FlowNodeTextSlotSource, TEXT_SLOT_TEMPLATE_REFUSAL, flowNodeTextSlotSources, textSlotTemplateRefusal); api-surface/automation.json and export-origins/automation.json carry exactly those six against main. Right: one judge shared by three contracts, the engine and lint has to be public.
11. @objectstack/formula PATH_ONLY_RE admits $: a hole-grammar widening for every consumer of the engine; an unbound $ path renders nothing (pinned). Right, at the producer, declared on the engine lane by the seat; graded minor.
12. @objectstack/service-automation: interpolateText deleted; renderTextSlot, textTemplateScope, FlowTextTemplateError added — package-internal (the exports map is . alone at the head; neither src/index.ts nor builtin/index.ts re-exports from builtin/template.ts), so the public surface does not move and what publishes is the renderer change. One renderer for the five slots keeps the service-automation: honour outcome: 'refused' on the flow end node — a terminal refused run status (distinct from failed) with the interpolated message persisted on the run (lane 2 of the #14945 ruling 2′) #15788 ruling; textTemplateScope writes only into fresh containers and a declared variable wins over a flat dotted key sharing its head (pinned); FlowTextTemplateError is marked a guard refusal, so a fault edge does not route it (pinned: nothing is sent). A slot that renders no text returns undefined, so a screen title falls back to the node label and a notify title meets its existing "title is required" guard. Right.
13. NOTIFY_TEMPLATE_PLACEHOLDER is {{ record.name }}, and the rider 6048446951's three items are delivered: the placeholder; templateExpressionInput and cronExpressionInput in EXPRESSION_SLOT_TYPES (check-doc-formula-expressions.mjs:1013–:1014); the stale comment in notify-node.ts rewritten. Right.
14. Lint: flow-double-brace-interpolation scans the config withoutTextSlots (the five keys by node type), its hint names those five as the only {{ }} positions, and the text-slot bare-$ check reads outside the holes and prescribes the hole; the spec: a notify node's refused title / message is told to write '{{record.name}}', the spelling the build's flow-double-brace-interpolation rule then flags on the same node and the notify renderer does not resolve #22081 round-trip pin's control moved to the node's single-brace actionUrl. Right as built — H4 as an exemption, because ⑨ already refuses at error and a second reading would double-report.
15. No D2 conversion; D3 semantic entry flow-text-slot-single-brace-refused plus the step-18 fragment. ADR-0087 D2 admits losslessly mappable changes only and sends semantic changes to D3; the measured DIFF rows (a Date rendered JSON-quoted by the 17.x interpolator and as ISO text by the engine; a whole-slot object rendered String(value) against JSON) are pinned in text-slot-template.test.ts, and a metadata conversion cannot know a variable's run-time type. The card's second pin reads with its own "when lossless" qualifier: refused with the exact rewrite. Right.
16. Canon (ADR-0032 Decision 4) holds at this head. The three expression.zod.ts docblocks (TemplateExpressionInputSchema, tmpl, TYPED_EXPRESSION_SOURCE_REQUIRED) say a notify title / message reads {{var}} and that a single brace there is refused; the canon pin holds them as one set, and the moved expression-dialect-docs.pin.test.ts pins the protocol-18 relation with its anti-vacuity test kept. A sweep of packages/spec/src (non-test) for a single-brace placeholder on a line naming a notify, screen or end text slot finds only lines saying it is refused (builtin-node-config.zod.ts:41, expression.zod.ts:511), the graduated 11.x alias fixtures in conversions/registry.ts, and a script.inputs value. The .describe()s, the descriptor help in notify-node.ts / screen-nodes.ts and the regenerated references all teach the hole. Right.
17. The one-stray-brace edge and the lint path reader — right. singleBraceTokens drops a token touching a brace on either side (pinned at the spec function and at the objectstack validate door: invalid-template, no three-brace text); templateRefsIn judges a hole's path before | and reads [i] as .i, pinned both ways.
18. In-tree sites. A sweep at this head over examples/**, packages/**/src, packages/qa and content/docs (non-test, outside the generated references and skills/**) for a single-brace token in a title / message / description string finds only the docs line that names the refused form as refused (flows.mdx:2029), the showcase subflow.input value of ④, descriptor help of value-like keys (crud-nodes.ts:702, screen-nodes.ts:125 / :150) and the 11.x fixtures. Right.
19. Residue standing from the earlier PASS records, unchanged, not conditions: the flows.mdx fault-edge variable table (:1624) still writes the error variables single-braced with no position named — true of every value-like position, and the page's own section teaches the hole for a text slot; stringifyForTemplate's docblock (template.ts about :332–:335) still motivates itself with a fault handler's single-brace $error path — package-internal, no hover text. Carriers as recorded before.

② Semver level

• Changeset .changeset/22110-flow-text-slot-double-brace.md: @objectstack/spec major, @objectstack/service-automation major, @objectstack/lint major, @objectstack/formula minor; the fixed spelling Clause-②: yes (narrowing); the ADR-0087 marker registered flow-text-slot-single-brace-refused names the D3 entry the diff adds. The breaking body carries the FROM / TO table, the one-line fix, the four token kinds' remedies and the measured "not converted" rows, and names no package-internal symbol as public. No skip-changeset. Check Changeset is success on the head.
• The Clause-②: line agrees in all three carriers. The claim's line was corrected to yes (narrowing) in 6063190355; the PR body's second line is Clause-②: yes (narrowing: …), whose arm scripts/pm/clause2-line.mjs readArmToken reads as narrowing — its exact pattern takes the arm word and refuses only an identifier character or a pipe after it, and the colon is neither; the changeset carries yes (narrowing).
• yes is right: the public face widens (+6 spec exports; {{ }} holes now render in five text slots; the formula hole grammar admits $). (narrowing) is right: three node contracts' accept set shrinks on a published authoring surface, and objectstack validate refuses what it accepted. major is right: the four packages are at 17.7.0 on main and .changeset/pre.json at 05c7c3fa3 is mode: pre, tag: next, so a breaking narrowing grades major on the 18 pre line, as [v18] retire the {var} template dialect in flow assignment slots: refuse at registration with per-spelling remedies (the C half of #11182 ruling D, on the v18 train) #19939's landed sibling was graded; formula: minor for a pure widening is right. @objectstack/example-showcase, @objectstack/example-todo and @objectstack/dogfood are private: true, so no changeset is owed for them. The merge changed no package this PR publishes from, and the file list carries exactly one added changeset and no modified or deleted one of main's.

③ Boundary flags

• open_questions: the merge-round reports 6076389514 / 6077810372 and rounds 2 and 3 declare none. Round 1's A / B stands answered A, judged independently: ADR-0087 D2 admits only lossless mappings and sends semantic changes to D3, the Date / whole-slot rows are pinned, and B would need a maintainer ruling that accepts a rendering change, which nothing pulls for. Answered; not escalated.
• The merge report 6077810372, each claim read against the head: one conflicted file, the PLUMBING set, resolved as the verbatim union — verified (③); the three auto-merged overlap files disjoint — verified (②, ④); "the PR's delta against main is unchanged by this merge" — verified (①); no regeneration owed — consistent with the empty interdiff and the green generated-artifact gates; the five text-slot door cases and main's seven lint/objectql: a select option's visibleWhen reading current_user.roles (gone since ADR-0090 D3) or a computed key passes both doors and faults open at the server — the EvalUser-member level of the #22157 / #22274 family #22394 cases both kept — the test file's two deltas say so. Its process notes (two lock queue-timeouts on a targeted re-run, the spec / formula / service-automation tiers not re-run this round and declared to CI) have no effect on the diff; CI ran those packages and is green. Not escalated.
• Rounds 1–3 deviations and out_of_scope_findings: judged by the earlier records and standing — the expression-dialect-docs.pin.test.ts move (necessary, anti-vacuity kept), the order-89 tie (allowed by the list's docblock, ties rendered by id), the PR body written by the seat (right under the role file; the ## Patch round 2 / 3 sections are in the body at this head), the sweep's near-misses (context-tokens.zod.ts's {recordId} and the 17.x fixtures describe value positions and history, still true). Nothing new this round.
• Standing Tier H flag: skills/objectstack-automation/SKILL.md :108–:109 (a notify title / message example in single braces) and :239–:241 (lists the single-brace template and calls {{x}} the other dialect), plus evals/flows-triggers-approvals.json:17 ("title with single-brace interpolation") — confirmed at this head; text this PR makes false, outside its reach under Prime Directive feat: Comprehensive CRM example demonstrating all ObjectStack protocol features #14; the seat's card at landing, which ADR-0032 Decision 4 wants opened before the 18 line leaves pre mode. The Studio editors — triage's objectui round, as the card names; hotcrm's 69 tokens — the repo:hotcrm seat; AutomationEngine.celScope nesting and the README's stale field-value row — pre-existing, not this card.
• Serial: [v18] retire the {var} template dialect in flow assignment slots: refuse at registration with per-spelling remedies (the C half of #11182 ruling D, on the v18 train) #19939 pass 1 (0e9e7b706), fix(spec,service-automation)!: an undeclared config key on 10 more builtin node types is refused at the build doors; one judge per type #22319 (2f70c2222) and fix(lint)!: os build and the object save door refuse a select option's visibleWhen that reads an unbound member of the acting user (#22394) #22427 (46692c118) are ancestors of the merge base 05c7c3fa3; the [v18] retire the {var} template dialect in flow assignment slots: refuse at registration with per-spelling remedies (the C half of #11182 ruling D, on the v18 train) #19939 pass-2 overlap is declared serial by the claim. Right.
• Governed surfaces: none in the 54-file list (no path under docs/adr/, docs/NORTH-STAR.md, .claude/, skills/, AGENTS.md or CLAUDE.md); Governed Surface Queue Guard success; 2261 changed lines, under the 5,000 threshold; head repo is the base repo; draft; mergeable state clean at the reading.
• Check-runs on ce4f6519f, 35, all completed: 33 success, 2 skipped (Console Pin Gate, Packed-tarball smoke (opt-in)), 0 failure, 0 in_progress, 0 queued; the combined commit status is success (Vercel). The seven required contexts are all success: Lint & Repo Gates, TypeScript Type Check (with the four Type Check · lanes), Test Core and its six shards, Dogfood Regression Gate and its three, Build Core, Temporal Conformance (live PG + MySQL), Governed Surface Queue Guard. Those conclusions are the gate verdicts; nothing was run here. Five app check-suites (vercel, fly-io, claude, cloudflare-workers-and-pages, objectstack-fleet) sit queued with no check-run under them — they are not checks, named so nobody reads them as pending gates. No check is red or pending on this head.

Implemented-by: claude/issue-22110-flow-text-slot-double-brace
Reviewed-by: session_01DhTqaEHqPVSVnAkjG3jywn

VERDICT: PASS

The merge changed nothing this PR refuses or prescribes: its delta is byte-identical to the one the PASS records judged, and in validate-expressions.ts #22394's option-member verdicts walk objects while this PR's text-slot pass walks flows, with both import sets present and no new short-circuit between the node-loop head and the judge; the one conflict, the PLUMBING set, is the verbatim union of both sides. Every accept-set and public-surface change is right at this head, the semver reading stands across the three carriers, no boundary flag escalates, and every check on the head is green. The Tier H skills residue is the seat's card at landing.