@@ -0,0 +1,10 @@
+---
+'@objectstack/skills': patch
+---
+
+docs(skills): objectstack-automation carries the flow-authoring judgment the hosted build agent learned — option values in conditions and writes, a named hour with its time zone, who an approval-outcome cascade runs as
+
+Clause-②: no
+Metadata-protocol: none
+
+Card 1 of the cloud#3659 ruling A split, the `objectstack-automation` port — the judgment the schema cannot express and the published skill did not yet state. `SKILL.md` § Valid-but-silently-wrong: a `select` is compared and written by its option `value`, never the label the request speaks, in the start `condition` and every `fields` / `filter` entry. `references/examples-flows.md`: a wall-clock hour the request names is written as said with its IANA `timezone` on the start node's `config.schedule`, never converted to UTC by hand (a bare expression runs in UTC and records no zone); the schedule example carries one. `references/state-machines-and-approvals.md`: a flow reacting to the mirrored `approvalStatusField` runs as the person who acted and stays `runAs: 'user'`; only the SLA auto-decision and the dead-run release carry no user, so a flow that must react to those declares `runAs: 'system'` — the hosted corpus's blanket "declare system" is corrected against the approval service on `main`. The same file's three Chinese glosses are gone: the shipped skill text is English-only. Three eval cases pin the teachings (flows-triggers-approvals 17–19).
@@ -501,7 +501,22 @@ export const CEILINGS = new Map([
   // 6426 after the click-through default's three tokens landed on main and
   // the "A Flow is a directed graph of nodes" opener was cut (the node tables
   // and the `nodes` + `edges` FlowSchema line already say it).
-  ['skills/objectstack-automation/SKILL.md', 6426],
+  // 6426 -> 6527 (card #31155, the objectstack-automation port of cloud's private
+  // authoring rules): § Valid-but-silently-wrong gains item 4 — a `select` is
+  // compared and written by its option `value`, never the label the request
+  // speaks, in the start `condition` and every `fields` / `filter` entry (the
+  // condition leg otherwise stages clean and never fires; the `fields` /
+  // `filter` leg fails the run as `invalid_option`). No same-file restatement
+  // was left to pay it; the comment says so honestly. Arithmetic in priced
+  // bytes (stamp line excluded), against `main`'s 25654: 25654 -> 26108 (+454)
+  // -> ceil(26108 / 4) = 6527; headroom was 12 tokens, so the ceiling moves +101,
+  // pinned AT the measurement. Authorised by the ruling of record that orders
+  // this text into the published skills: objectstack-ai/cloud#3659, letter A,
+  // ruling comment 6682024726 (2026-11-06): "How to write valid, working
+  // metadata lives in the public skills … The private corpus's rules of that
+  // kind move there". The raise path is the standing 2026-10-27 ruling (ruling
+  // record 6513306068), quoted verbatim and untranslated in the PR body.
+  ['skills/objectstack-automation/SKILL.md', 6527],
   // 13783 -> 13892 (2026-08-31 app-repo-principles raise, see the block above).
   // The invariant-vs-transition-gate choice, placed in the field-conditional-rule
   // bullet list where the tool is actually picked. Both wrong picks are silent:
@@ -934,7 +949,19 @@ export const CEILINGS = new Map([
   // (whose row is RE-LOCKED above), pinned AT its landed count — no headroom,
   // because a split that arrives with budget is a raise wearing a new path.
   // The package deltas are the pointer lines and the four new file titles only.
-  ['skills/objectstack-automation/references/examples-flows.md', 1436],
+  // 1436 -> 1494 (card #31155, the objectstack-automation port of cloud's private
+  // authoring rules): a wall-clock hour the request names is written as said
+  // with its IANA `timezone` on the start node's `config.schedule`, never
+  // converted to UTC by hand (a bare expression runs in UTC and records no
+  // zone) — the schedule example and the time-relative cadence comment carry
+  // one. Paid down first, one restatement cut: the `requires: ['automation',
+  // 'triggers']` / always-on `job` sentence (SKILL.md § Prerequisite's table
+  // says it), now a pointer. 5685 -> 5976 bytes (+291 net) -> ceil(5976 / 4)
+  // = 1494; headroom was 14 tokens, so the ceiling moves +58, pinned AT the
+  // measurement. Same authority as the SKILL.md row above: cloud#3659 letter A
+  // (ruling comment 6682024726) orders the text in; the raise path is the
+  // standing 2026-10-27 ruling (record 6513306068), quoted in the PR body.
+  ['skills/objectstack-automation/references/examples-flows.md', 1494],
   // NEW FILE (card #27223): one recipe per integration archetype — OpenAPI with
   // a static key, remote MCP with a static header, plain REST, the vendor
   // callback, a hand-written document for a spec-less vendor — plus the two
@@ -1026,7 +1053,30 @@ export const CEILINGS = new Map([
   // bytes, 0 tokens, so the ceiling moves +143, pinned AT the measurement.
   // Same maintainer ruling as the SKILL.md row above (2026-10-27, verbatim and
   // untranslated): 「A:先削重复,余额按实测提高」.
-  ['skills/objectstack-automation/references/state-machines-and-approvals.md', 5730],
+  // 5730 -> 5838 (card #31155, the objectstack-automation port of cloud's private
+  // authoring rules): Approval Best Practices gains item 4 — a flow reacting
+  // to the mirrored `approvalStatusField` runs as the person who acted and
+  // stays `runAs: 'user'`; only the SLA auto-decision and the dead-run release
+  // carry no user, so a flow that must react to those declares
+  // `runAs: 'system'` (the approval service's attributed mirror write on
+  // `main`, which corrects the hosted corpus's blanket "declare system").
+  // Paid down first: the discount-approval example's four-line trigger comment
+  // (a restatement of SKILL.md § Trigger Configuration) is one pointer line;
+  // the three Chinese glosses left the file — the shipped skill text is
+  // English-only (the approver's review on #31223); and the three legacy
+  // "(the old …)" glosses in § Branching, side-effects & rejection, naming
+  // approval-process keys that have no author since ADR-0019, are gone. Two
+  // one-word corrections ride along: the mirrored statuses list `returned`
+  // (send-back writes it), and the dynamic-approval example's condition reads
+  // `record.status`. Base is `main`'s 22908 — #31322 had added 24 bytes to
+  // this file (`record.amount != null && `) under the first pin, which CI
+  // measured on the merge result as 5844 against a 5838 row. 22908 -> 23299
+  // bytes (+391 net) -> ceil(23299 / 4) = 5825; headroom was 3 tokens, so the
+  // ceiling moves +95, pinned AT the measurement. Same authority as the
+  // SKILL.md row above: cloud#3659 letter A (ruling comment 6682024726) orders
+  // the text in; the raise path is the standing 2026-10-27 ruling (record
+  // 6513306068), quoted in the PR body.
+  ['skills/objectstack-automation/references/state-machines-and-approvals.md', 5825],
   // 1779 -> 1769 (#26297): RE-LOCK at the landed count after a net cut — two
   // stale `{ type: 'lookup', reference: 'user' }` fields (an object that does
   // not exist) became `type: 'user'`; -10 tokens, the row follows the
 
@@ -288,6 +288,13 @@ write them right the first time:
    } });
    ```
 
+4. **A `select` is compared and written by its option `value`, never its label.**
+   The request speaks the label ("Lost"); the row stores the `value` (`lost`).
+   `condition: "record.status == 'Lost'"` parses, matches no row: the flow
+   stages clean and never fires; `fields: { status: 'Lost' }` / a `filter`
+   fails the run (`invalid_option`). Read the field's `options`; write the
+   `value` in the `condition` AND every `fields` / `filter` entry.
+
 ---
 
 → State Machines & Approvals: [references/state-machines-and-approvals.md](./references/state-machines-and-approvals.md) — its state-introspection route is `GET /api/v1/meta/object/:name/state/:field?from=:state`.
 
@@ -293,6 +293,63 @@
           "type: 'record:alert'"
         ]
       }
+    },
+    {
+      "id": 17,
+      "prompt": "`customer.status` 的选项是 `{ value: 'active', label: '活跃' }` 和 `{ value: 'lost', label: '已流失' }`。当客户状态变成「已流失」时，自动创建一条 `followup_task`：标题是「流失回访: 」加客户名，`customer` 指回这个客户，负责人是该客户的负责人。",
+      "expected_output": "A `record_change` flow bound on the `start` node `config` (`objectName: 'customer'`, `triggerType: 'record-after-update'`) whose bare-CEL condition compares the option VALUE the field stores — `previous.status != 'lost' && record.status == 'lost'` — never the label the request speaks; one `create_record` on `followup_task` whose `fields` are CEL value envelopes: `subject: { dialect: 'cel', source: \"'流失回访: ' + record.name\" }`, `customer: { dialect: 'cel', source: 'record.id' }`, `owner_id: { dialect: 'cel', source: 'record.owner_id' }` — never a single-brace token over the record, which is refused at save; `edges` start → create → end.",
+      "files": [],
+      "assertions": {
+        "must_contain": [
+          "record-after-update",
+          "previous.",
+          "== 'lost'",
+          "dialect: 'cel'",
+          "create_record"
+        ],
+        "must_not_contain": [
+          "== '已流失'",
+          "status: '已流失'",
+          "{record."
+        ]
+      }
+    },
+    {
+      "id": 18,
+      "prompt": "Every morning at 9, Shanghai time, send the `crm_sales` queue's members an inbox digest of `opportunity` records whose `close_date` falls this week.",
+      "expected_output": "A `type: 'schedule'` flow, `runAs: 'system'` (a schedule run has no trigger user), the cadence on the START node's `config.schedule` written as the request said it, with its IANA zone: `{ type: 'cron', expression: '0 9 * * *', timezone: 'Asia/Shanghai' }` — never the hour converted to UTC by hand: a bare expression runs in UTC and records no zone, so the next reader takes the converted hour as the intended one; a `get_record` over `opportunity` with a `close_date` window and a `notify` to the queue's members.",
+      "files": [],
+      "assertions": {
+        "must_contain": [
+          "type: 'schedule'",
+          "timezone: 'Asia/Shanghai'",
+          "0 9 * * *",
+          "runAs: 'system'",
+          "notify"
+        ],
+        "must_not_contain": [
+          "0 1 * * *",
+          "UTC+8"
+        ]
+      }
+    },
+    {
+      "id": 19,
+      "prompt": "Our `invoice` approval flow mirrors its outcome onto `invoice.approval_status`. When that field becomes `approved`, create a `payment_task` for the finance queue. Should this reacting flow run as system?",
+      "expected_output": "No. The mirror write is elevated but attributed to the person who decided, so a `record_change` flow on `invoice` (`triggerType: 'record-after-update'`, condition `previous.approval_status != 'approved' && record.approval_status == 'approved'`) stays `runAs: 'user'` and runs with the approver's own grants; its `create_record` on `payment_task` is judged as them. Only an SLA `escalation` auto-decision or the release of a record whose run died carries no user — a flow that must react to those too declares `runAs: 'system'`.",
+      "files": [],
+      "assertions": {
+        "must_contain": [
+          "runAs: 'user'",
+          "record-after-update",
+          "approval_status == 'approved'",
+          "create_record"
+        ],
+        "must_not_contain": [
+          "type: 'approval'",
+          "sys_approval_request"
+        ]
+      }
     }
   ]
 }
@@ -25,10 +25,13 @@ export const EscalateOverdueCasesFlow = defineFlow({
     {
       id: 'start',
       type: 'start',
-      label: 'Daily at 09:00',
+      label: 'Daily at 09:00 Shanghai time',
       // The cadence lives HERE — FlowSchema has NO top-level `schedule` key (a
       // named parse error). A bare cron string also works; a cron`…` tag does not.
-      config: { schedule: { type: 'cron', expression: '0 9 * * *' } },
+      // A bare expression runs in UTC. A wall-clock hour the request names is
+      // written AS SAID with its IANA `timezone` — never converted to UTC by hand:
+      // the arithmetic may be right, but nothing then records which zone was meant.
+      config: { schedule: { type: 'cron', expression: '0 9 * * *', timezone: 'Asia/Shanghai' } },
     },
     {
       id: 'escalate_overdue',
@@ -98,8 +101,8 @@ day, a threshold is never missed.
           filter: { status: 'active' },  // optional, ANDed with the date window
           // maxRecords: 1000            // optional per-sweep cap (default 1000)
         },
-        // Optional sweep cadence; omit for daily 08:00 UTC. Plain shape only:
-        // schedule: { type: 'cron', expression: '0 8 * * *' }
+        // Optional sweep cadence; omit for daily 08:00 UTC. Plain shape only, a
+        // named hour with its zone: schedule: { type: 'cron', expression: '0 8 * * *', timezone: 'Asia/Shanghai' }
       },
     },
     // …downstream nodes (notify, update_record, …)
@@ -128,7 +131,6 @@ fires once, idempotent, no guard field. Each bound is a CEL value envelope
 query placeholder such as `{today}` is refused there (`expression-invalid`).
 For "days remaining" in a message, use `daysBetween(today(), record.end_date)`.
 
-`timeRelative` ships in `@objectstack/trigger-schedule` — needs
-`requires: ['automation', 'triggers']` (the sweep cadence
-runs on the always-on `job` service). Full descriptor schema:
+`timeRelative` ships in `@objectstack/trigger-schedule` (its `requires` tokens:
+SKILL.md § Prerequisite). Full descriptor schema:
 `node_modules/@objectstack/spec/src/automation/time-relative-trigger.zod.ts`.