@@ -0,0 +1,10 @@
+---
+'@objectstack/skills': patch
+---
+
+docs(skills): the objectstack-platform skill teaches the `demoStaff` `manager` key — another entry's email, written as `manager_id` by the development boot (#26764)
+
+Clause-②: no
+Metadata-protocol: none
+
+The Demo accounts section of `objectstack-platform/SKILL.md` now names a line manager in its `demoStaff` example and says how the key behaves: `manager` is another entry's `email`; `os dev` writes `sys_user.manager_id` itself once every demo account exists and keeps a manager someone set by hand, so no seed hook writes it; a display name, an address no entry has, the entry itself or a loop is refused at load. One eval case in `evals/config-plugins-ops.json` expects the key and forbids a seed writing `manager_id`. Three restatements elsewhere in the skill were cut against the addition, each rule keeping its other home in the file; the remainder raises the file's token ceiling by the measurement.
@@ -507,7 +507,32 @@ export const CEILINGS = new Map([
   // bytes, so the priced text is 23924 -> 23985 bytes -> 5997 tokens, ceiling
   // +16, pinned AT the measurement. Same ruling, same arithmetic rule as above.
   //   ceil(($(wc -c < skills/objectstack-platform/SKILL.md) - 20) / 4) == ceil(23985 / 4)
-  ['skills/objectstack-platform/SKILL.md', 5997],
+  // 5997 -> 6014 (card #26764, the follow-up PR #26763 owed this file): the
+  // Demo accounts example names a line manager (`manager`, another entry's
+  // `email`) and the prose says what the key does — the development boot
+  // writes `manager_id` itself once every account exists and keeps one set by
+  // hand, so no seed hook writes it; a display name, an address no entry has,
+  // the entry itself or a loop is refused at load. Triage 6448202744 ordered
+  // the room made inside the package; the spec seat's note 6445537040 names
+  // the payment path, the standing ruling on this row
+  // 「A:先削重复,余额按实测提高」. PAID DOWN FIRST — three restatements cut, each
+  // rule keeping its other home in the file: the sample refusal output under
+  // the phantom-key sentence (the sentence stays — `check:skill-top-level-keys`
+  // quotes it as the page's contract — and the "Refused" posture bullet says
+  // the top level refuses and names the key), the "bad platform default"
+  // bullet (the "fix is upstream" bullet of the same list), and the
+  // driver-wiring parenthetical "(memory in dev, SQL in prod)" (step 4 of
+  // the boot sequence and the drivers table). The `sys_metadata` clause of
+  // the config-generation sentence was cut too and then restored on the
+  // seat's review: its only other home is references/plugin-development.md,
+  // a different reader from one generating objectstack.config.ts. Arithmetic
+  // in bytes: on `origin/main` the priced text was 23980 bytes (5995 tokens,
+  // headroom 2); the cuts remove 257 and the addition is 332, so the LANDED
+  // priced text is 24055 bytes -> 6014 tokens: the 2 tokens of headroom are
+  // absorbed and the ceiling moves 5997 -> 6014 (+17), the measured
+  // remainder only. Pinned AT the measurement.
+  //   ceil(($(wc -c < skills/objectstack-platform/SKILL.md) - 20) / 4) == ceil(24055 / 4)
+  ['skills/objectstack-platform/SKILL.md', 6014],
   // `skills/objectstack-pm-dispatch/SKILL.md` (9708) and its
   // `rules/dev-template.md` (1838) left this table on 2026-09-10 with the files:
   // the maintainer deleted the published PM skill whole (verbatim:
@@ -949,7 +974,21 @@ export const CEILINGS = new Map([
   // file is 5831 -> 5873 bytes -> 1469 tokens, ceiling +11, pinned AT the
   // measurement.
   //   ceil($(wc -c < skills/objectstack-platform/evals/config-plugins-ops.json) / 4) == ceil(5873 / 4)
-  ['skills/objectstack-platform/evals/config-plugins-ops.json', 1469],
+  // 1469 -> 1690 (card #26764, the eval the SKILL.md row above was paid with):
+  // one case for a demo account that reports to another — expected
+  // `manager: '<the other entry's email>'` on the subordinate's `demoStaff`
+  // entry and nothing else, `os dev` writing `manager_id` itself; NO seed row
+  // or hook writing `manager_id`, NO `reportsTo` alias. Triage 6448202744
+  // (room inside the package first) and the spec seat's note 6445537040 (the
+  // standing ruling, tap A verbatim: 「A:先削重复,余额按实测提高」). PAID DOWN
+  // FIRST: the file's seven fixtures share no sentence, so there was no
+  // duplicate to cut (0 bytes) and the remainder is the whole addition. On
+  // `origin/main` the file was 5873 bytes (1469 tokens, headroom 0); the
+  // fixture adds +885 bytes, so the LANDED file is 6758 bytes -> 1690 tokens,
+  // ceiling +221, pinned AT the measurement. The raising PR's body carries
+  // the same arithmetic.
+  //   ceil($(wc -c < skills/objectstack-platform/evals/config-plugins-ops.json) / 4) == ceil(6758 / 4)
+  ['skills/objectstack-platform/evals/config-plugins-ops.json', 1690],
   // 955 -> 1175: one regression case for the now-anchored comparand (the
   // overdue-by-grace-days prompt) — expected `{ $now: true, addDays: { $field:
   // 'grace_days_offset' } }` as the whole comparand of `$lt`, and NO stored
 
@@ -52,13 +52,7 @@ There is deliberately **no** top-level `workflows` or `approvals` collection:
 an approval is a flow with Approval nodes, and record
 state machines are a `state_machine` validation rule on each object.
 A phantom key like `roles:` or `policies:` is **not** a silent
-no-op — the top level refuses it and the stack fails to load:
-
-```
-defineStack validation failed (1 issue):
-
-  ✗ (root): Unrecognized key(s) on this stack definition: `policies`. …
-```
+no-op — the top level refuses it and the stack fails to load.
 
 Undeclared keys are handled per surface, and the two postures are worth
 keeping straight:
@@ -174,8 +168,6 @@ what the platform owns.
   so it is machine-visible; before resuming, confirm the version you **pin**
   carries the fix (merged upstream ≠ present on your pin) and re-run the
   defect's own reproduction.
-- **A bad platform default is a default to fix**, not something to work around
-  at every call site.
 
 ---
 
@@ -258,11 +250,10 @@ Drivers are the storage layer. Pick based on your environment:
 ### Wiring a driver — you usually do not
 
 Under `os dev` / `os serve` / `os start` the CLI **resolves the driver itself**
-from the database URL and registers `DriverPlugin` for you (memory in dev, SQL
-in prod). Do **not** put a driver in your config's `plugins:` array: no example
-app does, and the `plugins:` key is for plugins the CLI cannot infer (connector
-executors, your own plugins). Pick a driver by setting the DB URL, not by
-writing code.
+from the database URL and registers `DriverPlugin` for you. Do **not** put a
+driver in your config's `plugins:` array: no example app does, and the
+`plugins:` key is for plugins the CLI cannot infer (connector executors, your
+own plugins). Pick a driver by setting the DB URL, not by writing code.
 
 Construct `DriverPlugin` yourself only when **you** own the runtime — embedding
 via `Runtime` / `ObjectKernel`, or a test that boots a kernel directly:
@@ -450,14 +441,19 @@ signing in with the seed password (`--admin-password`, default `admin123`) —
 an entry carries no `password`:
 
 ```typescript
-demoStaff: [{ name: 'Legal Counsel 1', email: 'counsel1@example.com',
-  position: 'legal_counsel', permissionSets: ['contracts_editor'] }],
+demoStaff: [
+  { name: 'Legal Lead', email: 'lead@example.com' },
+  { name: 'Legal Counsel 1', email: 'counsel1@example.com', manager: 'lead@example.com',
+    position: 'legal_counsel', permissionSets: ['contracts_editor'] }],
 ```
 
 `name` is what a seed reference resolves by; `position` / `permissionSets`
 name only what this stack declares (a platform set such as
-`admin_full_access` is refused); `os build` drops the key and a non-dev boot
-creates nothing. `devLogins` creates and grants nothing — it only prints an
+`admin_full_access` is refused); `manager` is another entry's `email` — the
+boot writes `manager_id` itself once every account exists and keeps one set
+by hand, so no seed hook writes it; a display name, an address no entry
+has, the entry itself or a loop is refused at load; `os build` drops the
+key and a non-dev boot creates nothing. `devLogins` creates and grants nothing — it only prints an
 existing account on the boot banner. Pick `demoStaff` whenever the demo
 needs an account to exist.
 
 
@@ -70,6 +70,16 @@
         "must_contain": ["demoStaff", "position", "permissionSets", "os dev"],
         "must_not_contain": ["role:", "admin_full_access"]
       }
+    },
+    {
+      "id": 8,
+      "prompt": "In the contracts demo, Paralegal 1 reports to Legal Counsel 1, so the approval flow's manager step reaches the right person on a fresh `os dev`. Set that up.",
+      "expected_output": "On Paralegal 1's `demoStaff` entry, `manager: 'counsel1@example.com'` — the `email` of Legal Counsel 1's own entry, never the display name — and nothing else: `os dev` writes `sys_user.manager_id` itself once every demo account exists, and leaves a manager an operator set by hand. No seed row or hook writing `manager_id`, no `reportsTo` / `managerEmail` alias (refused, naming `manager`); a manager naming no entry, the entry itself or a loop is refused when the stack loads.",
+      "files": [],
+      "assertions": {
+        "must_contain": ["demoStaff", "manager: '", "os dev"],
+        "must_not_contain": ["manager_id:", "reportsTo:"]
+      }
     }
   ]
 }
Original file line number	Diff line number	Diff line change
`@@ -70,6 +70,16 @@`
`70`	`70`	`"must_contain": ["demoStaff", "position", "permissionSets", "os dev"],`
`71`	`71`	`"must_not_contain": ["role:", "admin_full_access"]`
`72`	`72`	`}`
	`73`	`+ },`
	`74`	`+ {`
	`75`	`+ "id": 8,`
	`76`	+ "prompt": "In the contracts demo, Paralegal 1 reports to Legal Counsel 1, so the approval flow's manager step reaches the right person on a fresh `os dev`. Set that up.",
	`77`	+ "expected_output": "On Paralegal 1's `demoStaff` entry, `manager: 'counsel1@example.com'` — the `email` of Legal Counsel 1's own entry, never the display name — and nothing else: `os dev` writes `sys_user.manager_id` itself once every demo account exists, and leaves a manager an operator set by hand. No seed row or hook writing `manager_id`, no `reportsTo` / `managerEmail` alias (refused, naming `manager`); a manager naming no entry, the entry itself or a loop is refused when the stack loads.",
	`78`	`+ "files": [],`
	`79`	`+ "assertions": {`
	`80`	`+ "must_contain": ["demoStaff", "manager: '", "os dev"],`
	`81`	`+ "must_not_contain": ["manager_id:", "reportsTo:"]`
	`82`	`+ }`
`73`	`83`	`}`
`74`	`84`	`]`
`75`	`85`	`}`