@@ -0,0 +1,10 @@
+---
+'@objectstack/skills': patch
+---
+
+docs(skills): the platform skill's `requires:` table marks the always-on tokens
+
+Clause-②: no
+Metadata-protocol: none
+
+`objectstack-platform`'s `### requires:` no longer calls every listed service opt-in. The table marks each token of `PLATFORM_ALWAYS_ON_CAPABILITIES` (`queue`, `job`, `cache`, `settings`, `email`, `storage`, `sms`, `sharing`, `messaging`, `analytics`, `package-registry`) with °, and the lead says every boot mounts them, listed or not, while `--preset minimal` drops exactly those. The `auth` → `email` rule now says it holds under `--preset minimal` too, and the `triggers` + `job` pairing is scoped to `--preset minimal`. The `queues` / `assignmentRules` paragraph no longer says `sharing` must be in `requires:`. The skill's evals for silent scheduled flows and notifications, and for an ownership queue, no longer expect `job`, `messaging` or `sharing` in `requires:`, and a new eval case asks whether an always-on service must be listed. The platform behaviour already shipped; this release only teaches it.
@@ -52,8 +52,8 @@ objectstack-data): named sets of people a new record of an `ownership: 'user'`
 object sits in until a member claims it. `assignmentRules` (`defineAssignmentRule`,
 `@objectstack/spec/automation`; objectstack-automation) routes each inserted
 ownerless row into a queue — parked, `round_robin` or `least_loaded` — or to one
-user. Both need the ownership-queue service `@objectstack/plugin-sharing` registers
-(`sharing` in `requires`): a stack declaring either without it is refused at boot.
+user. Both need the ownership-queue service `@objectstack/plugin-sharing` registers:
+a stack declaring either without it is refused at boot.
 
 Undeclared keys are handled per surface, in two postures:
 
@@ -294,18 +294,19 @@ production fails loudly): [Ports & networking](./references/operations.md#ports-
 
 ### `requires:` — which service plugins boot
 
-Step 4's list is the fixed core. Every other service plugin is opt-in, and
-`requires: [...]` on the stack root is what turns it on. The CLI expands each
+Step 4's list is the fixed core. Tokens marked ° are always-on: every boot
+mounts them, listed or not, and `--preset minimal` drops exactly those. Every
+other service plugin is opt-in: `requires: [...]` on the stack root turns it on. The CLI expands each
 token through the `CAPABILITY_PROVIDERS` registry in
 `@objectstack/core`:
 
 | Token | Provider package |
 |:--|:--|
 | `automation` | `@objectstack/service-automation` — flows, and any declarative `connectors:` entry |
-| `analytics` `cache` `storage` `queue` `job` `messaging` `realtime` `settings` `sms` `push` | `@objectstack/service-` + the token ([the `push` block](./references/operations.md#mobile-push)) |
+| `analytics`° `cache`° `storage`° `queue`° `job`° `messaging`° `realtime` `settings`° `sms`° `push` | `@objectstack/service-` + the token ([the `push` block](./references/operations.md#mobile-push)) |
 | `mailbox` | `@objectstack/service-mailbox` — inbound mail |
-| `marketplace` `package-registry` | `@objectstack/service-package` |
-| `audit` `email` `sharing` `approvals` `webhooks` | `@objectstack/plugin-` + the token |
+| `marketplace` `package-registry`° | `@objectstack/service-package` |
+| `audit` `email`° `sharing`° `approvals` `webhooks` | `@objectstack/plugin-` + the token |
 | `pinyin-search` | `@objectstack/plugin-pinyin-search` |
 | `mcp` | `@objectstack/mcp` |
 | `triggers` | `@objectstack/trigger-record-change`, plus `trigger-schedule` and `trigger-api` |
@@ -315,8 +316,7 @@ through it:
 
 - **Tier-gated** — `ai`, `ai-studio`, `i18n`, `ui`, `auth` have no provider
   entry; dedicated blocks in `serve.ts` `run()` open their tier instead
-  (`ai`/`ai-studio` through the intent-driven AI block, the other three through
-  their tier blocks).
+  (`ai`/`ai-studio` through the intent-driven AI block).
 - **Enterprise / cloud** — `hierarchy-security` has no open-edition provider and
   ships in `@objectstack/security-enterprise`, loaded through `plugins[]`;
   `ai-seat` and `governance` are resolved only by cloud's objectos-runtime.
@@ -332,14 +332,14 @@ Five rules that change what you write:
 - **Declaring is a demand.** A capability YOU declared whose provider package is
   absent is a hard boot error; one the platform auto-injects for you stays
   best-effort (warn and continue).
-- **`auth` implies `email`.** Auth callbacks need the mail service, so the CLI
-  appends `email` whenever `auth` is required.
+- **`auth` implies `email`**, even under `--preset minimal`: auth callbacks
+  need the mail service.
 - **Keep `automation` whenever `plugins:` lists a connector** — connector
-  executors register their provider factories with it, and without it they have
-  nowhere to register and boot fails.
-- **Pair `triggers` with `job`.** `triggers` alone arms record-change triggers;
-  schedule and time-relative triggers run on the job service, so autolaunched
-  scheduled flows stay silent without `job`.
+  executors register their provider factories with it, and without it boot
+  fails.
+- **Under `--preset minimal`, pair `triggers` with `job`:** `triggers` alone
+  arms record-change triggers; schedule and time-relative ones run on the job
+  service, so scheduled flows stay silent.
 
 ### `onEnable` — where an app binds runtime code
 
 
@@ -42,14 +42,13 @@
     {
       "id": 3,
       "prompt": "Our scheduled flows never launch, and `notify` reports success but nobody receives anything.",
-      "expected_output": "`requires: ['automation', 'triggers', 'job', 'messaging']` on the stack root: `triggers` alone arms record-change triggers, schedule and time-relative ones run on the `job` service, and without `messaging` notify returns success with `skipped: true`. Declaring is a demand (missing provider = hard boot error); `defineStack` rejects an unknown token at authoring time.",
+      "expected_output": "`requires: ['automation', 'triggers']` on the stack root: `triggers` arms the start bindings, and schedule and time-relative ones run on the `job` service. `job` and `messaging` are always-on: a default boot mounts both, listed or not. Only a `--preset minimal` boot drops them; there, list `job` too (else scheduled flows stay silent) and `messaging` (else notify returns success with `skipped: true`). Declaring is a demand (missing provider = hard boot error); `defineStack` rejects an unknown token at authoring time.",
       "files": [],
       "assertions": {
         "must_contain": [
           "requires",
-          "job",
-          "messaging",
-          "triggers"
+          "triggers",
+          "--preset minimal"
         ],
         "must_not_contain": [
           "plugins: [new ServiceJobPlugin",
@@ -148,14 +147,15 @@
     {
       "id": 9,
       "prompt": "Add a `crm_support_intake` queue staffed by the `crm_service_agent` position and route every new `crm_case` into it (`requires: ['automation', 'triggers']`).",
-      "expected_output": "Two stack collections: `queues: [defineQueue({ name: 'crm_support_intake', label: 'Support Intake', members: [{ type: 'position', value: 'crm_service_agent' }] })]` and `assignmentRules: [defineAssignmentRule(...)]` with one entry, `assignTo: { type: 'queue', value: 'crm_support_intake' }`; plus `'sharing'` in `requires`: the keys need `@objectstack/plugin-sharing`'s ownership-queue service (`queue` is the job queue), else the boot is refused.",
+      "expected_output": "Two stack collections: `queues: [defineQueue({ name: 'crm_support_intake', label: 'Support Intake', members: [{ type: 'position', value: 'crm_service_agent' }] })]` and `assignmentRules: [defineAssignmentRule(...)]` with one entry, `assignTo: { type: 'queue', value: 'crm_support_intake' }`; no `requires` change: the keys need `@objectstack/plugin-sharing`'s ownership-queue service (`queue` is the job queue), and `sharing` is always-on, so a default boot mounts it unlisted. Only under `--preset minimal` must `'sharing'` be listed, else the boot is refused.",
       "files": [],
       "assertions": {
         "must_contain": [
           "queues:",
           "assignmentRules:",
           "defineQueue",
-          "'sharing'"
+          "sharing",
+          "--preset minimal"
         ],
         "must_not_contain": [
           "assigned_to",
@@ -333,6 +333,20 @@
           "defineAgent("
         ]
       }
+    },
+    {
+      "id": 20,
+      "prompt": "Uploads and settings must work in our app. Do I have to list `storage` and `settings` in `requires:`?",
+      "expected_output": "No. `storage` and `settings` are always-on (`PLATFORM_ALWAYS_ON_CAPABILITIES`): every boot mounts them, listed or not, and listing one is harmless. Only `--preset minimal` drops the always-on tokens, and there they must be listed. A token outside that set, such as `automation` or `mailbox`, mounts only when `requires:` lists it.",
+      "files": [],
+      "assertions": {
+        "must_contain": [
+          "--preset minimal"
+        ],
+        "must_not_contain": [
+          "requires: ['storage', 'settings']"
+        ]
+      }
     }
   ]
 }