@@ -0,0 +1,8 @@
+---
+'@objectstack/skills': patch
+---
+
+Clause-②: no
+Metadata-protocol: none
+
+`objectstack-platform`: § Seed Data now names `ignore` as the seed `mode` default (`SeedMode` defaults to `ignore`, not `upsert`), and § `requires:` says that `--preset minimal` keeps `job` and `queue` when `email`, `approvals` or `auth` is present instead of dropping every always-on token. `objectstack-automation`'s DocuSign eval case no longer forbids a string its own model answer uses, and its model answer now verifies DocuSign Connect's own signature header through `config.signature` instead of polling.
@@ -92,21 +92,21 @@ export default defineStack({
   //   • automation  — AutomationServicePlugin (flow engine + node executors).
   //   • approvals   — ApprovalsServicePlugin, so the `approval` flow node
   //                   (ADR-0019) is contributed to the engine.
-  //   • messaging   — MessagingServicePlugin, so the `notify` node delivers to
-  //                   the inbox channel (`sys_inbox_message` rows) instead of
-  //                   degrading to a logged no-op.
   //   • triggers    — record-change + schedule FlowTrigger plugins, so the
   //                   autolaunched / schedule flows below actually auto-fire.
-  //   • job         — JobServicePlugin, the timing backend the schedule trigger
-  //                   delegates to (interval / cron jobs).
   //   • marketplace — PackageServicePlugin (sys_packages store). Enables the AI
   //                   blueprint flow to auto-create a writable "app package" home
   //                   (ADR-0033 zero-package app building) and the Studio package
   //                   selector to list DB packages.
   //   • mailbox     — MailboxServicePlugin: the inbound-mail objects
   //                   (`sys_mailbox`, `sys_mail_message`, `sys_mail_association`)
   //                   and their read gates, served through the data API.
-  requires: ['ui', 'automation', 'approvals', 'messaging', 'triggers', 'job', 'marketplace', 'webhooks', 'realtime', 'mailbox'],
+  // Not listed: `messaging` (the `notify` node's inbox delivery) and `job` (the
+  // timing backend the schedule trigger delegates to) are always-on core
+  // capabilities that every boot mounts, listed or not. A `--preset minimal`
+  // boot drops `messaging`, and drops `job` only when `email`, `approvals`
+  // or `auth` is absent; there, list what it drops.
+  requires: ['ui', 'automation', 'approvals', 'triggers', 'marketplace', 'webhooks', 'realtime', 'mailbox'],
 
   // Concrete connectors for the `connector_action` node. The baseline engine
   // ships the dispatch node + an empty registry; these plugins populate it.
 
@@ -160,9 +160,9 @@ export const ReassignWizardFlow = defineFlow({
  * recipient + message to the messaging service, which fans out to the user's
  * channels (inbox by default). The `notify` node ships in every automation
  * engine; delivery is backed by `@objectstack/service-messaging`
- * (`MessagingServicePlugin`). Without that plugin the node degrades to a
- * logged no-op instead of failing the flow — install it and this flow starts
- * landing inbox rows with no edit.
+ * (`MessagingServicePlugin`), always-on: every boot mounts it unless
+ * `--preset minimal` drops it. Without that plugin the node degrades to a
+ * logged no-op instead of failing the flow.
  */
 export const TaskAssignedNotifyFlow = defineFlow({
   name: 'showcase_task_assigned_notify',
@@ -420,8 +420,9 @@ export const TaskCompletedSlackFlow = defineFlow({
  * switch or the posture, so a finding here would be false for the default
  * deployment.
  *
- * Install `requires: ['automation', 'triggers', 'job', 'messaging']` for the
- * binding machinery this example demonstrates.
+ * Install `requires: ['automation', 'triggers']` for the binding machinery
+ * this example demonstrates (`job` and `messaging` are always-on; list them
+ * too only under `--preset minimal`).
  */
 export const ScheduledDigestFlow = defineFlow({
   name: 'showcase_scheduled_digest',
@@ -643,8 +644,8 @@ export const ShowcaseMcpConnectorEchoFlow = defineFlow({
  * resumed by an external `resume(runId)` (it never silently no-ops).
  *
  * A short demo delay keeps it observable in-session; a production reminder would
- * use e.g. `timerDuration: 'P3D'`. Install
- * `requires: ['automation', 'triggers', 'job', 'messaging']`.
+ * use e.g. `timerDuration: 'P3D'`. Install `requires: ['automation', 'triggers']`
+ * (`job` and `messaging` are always-on; list them too only under `--preset minimal`).
  */
 export const TaskFollowUpFlow = defineFlow({
   name: 'showcase_task_follow_up',
 
@@ -2999,7 +2999,8 @@ export default class Serve extends Command {
       //    on the SAME decision point (`isMcpServerEnabled`), so serving the
       //    route without also loading the MCP plugin would 501 every request
       //    (#2698: the default must yield a connectable MCP endpoint). Explicit
-      //    `requires: ['mcp']` in config works regardless of the env var.
+      //    `requires: ['mcp']` still mounts the plugin, but with the env var off
+      //    the route is not served: `isMcpServerEnabled()` alone decides it.
       //  - Pinyin search recall (#2486): locale-gated platform capability. When
       //    `OS_SEARCH_PINYIN_ENABLED` is unset, the default derives from the
       //    stack's configured locales (any `zh-*` → on), and the resolved
 
@@ -382,14 +382,14 @@ export const PLATFORM_ALWAYS_ON_CAPABILITIES: readonly string[] = Object.freeze(
   // this slate (its only hard requirement is the ObjectQL engine, which is not
   // a capability token), so it joins the TAIL like any other reader.
   //
-  // ⚠️ SCOPE, measured on `serve`'s capability resolver at c17ff70f3f: a slate
-  // entry is force-appended to every app's `requires`, and the CLI then mounts
-  // it only if `Serve.CAPABILITY_PROVIDERS` keys the token. That registry keys
-  // `marketplace`, not this token, so under `objectstack serve` this entry is
-  // inert until the runtime half of the same ruling lands (#17676 items 2/3/5,
-  // the engine lane). The declaration is deliberately first: it is the single
-  // list both runtimes read, and the thing the runtime half is written
-  // against.
+  // Mounting: a slate entry joins every boot's served tokens
+  // (`resolveServedCapabilities`, `@objectstack/core`) unless the preset is
+  // `minimal`, and the CLI mounts it through `CAPABILITY_PROVIDERS`
+  // (`@objectstack/core`, `capability-providers.ts`). That registry keys this
+  // token at `@objectstack/service-package`'s `PackageServicePlugin`, the
+  // provider `PLATFORM_CAPABILITY_PROVIDERS` declares and the same one
+  // `marketplace` resolves to, so a stock `objectstack serve` boot mounts it;
+  // an app that also declares `marketplace` gets one instance, not two.
   'package-registry',
 ]);
 
 
@@ -4,7 +4,7 @@
     {
       "id": 1,
       "prompt": "Our contract-lifecycle app (objects `contract`, `crm_account`) needs DocuSign: send a contract out for signature, read an envelope's status, and reflect status changes on the record. DocuSign publishes a 4.7 MB Swagger 2.0 document with several hundred operations, authenticates with OAuth 2.0, and its Connect webhooks sign posts with their own HMAC header. Propose what to build and where.",
-      "expected_output": "A declarative instance inside the app, not a platform plugin and not a `connector-esign` family: `defineConnector` with `provider: 'openapi'`, whose `providerConfig.spec` is a packaged OpenAPI 3.x document converted offline from the Swagger 2.0 document and trimmed to the three operations (create envelope, get envelope, list status changes) (or `providerConfig.include` names those three operation keys, the `mcp` provider's allowlist meaning, where a non-array or unknown entry is fatal). Fields on `contract` (`envelope_id`, `signature_status`). Flows dispatch `connector_action`; the callback is an `api` flow with a start-node `secretRef`. `auth` is `{ type: 'oauth2', grant: 'authorization_code', authorizationUrl, tokenUrl, scopes, clientId, credentialRef }`, the client secret only a `credentialRef` (no inline `clientSecret`, no short-lived token parked behind a `bearer` `credentialRef`): the built-in `openapi` provider obtains and refreshes the token per dispatch, and the instance stays degraded \"not connected\" until an administrator holding `manage_connector_connections` connects it once per organization (`POST /api/v1/automation/connectors/docusign/connection`, then the vendor's redirect to `GET …/connectors/oauth/callback`; `DELETE` revokes). One gap is named plainly: DocuSign Connect signs its own header, which the `api` door does not verify, so status is polled until vendor schemes are verified. `connectorConfig.input` is a value slot: the per-contract payload reads the record through a CEL envelope (`envelopeId: { dialect: 'cel', source: 'record.envelope_id' }`), judged against the action's `inputSchema` before dispatch. The answer proposes no `registerConnector` code and no plugin.",
+      "expected_output": "A declarative instance inside the app, not a platform plugin and not a new connector package: `defineConnector` with `provider: 'openapi'`, whose `providerConfig.spec` is a packaged OpenAPI 3.x document converted offline from the Swagger 2.0 document and trimmed to the three operations (create envelope, get envelope, list status changes) (or `providerConfig.include` names those three operation keys, the `mcp` provider's allowlist meaning, where a non-array or unknown entry is fatal). Fields on `contract` (`envelope_id`, `signature_status`). Flows dispatch `connector_action`; the callback is a `type: 'api'` flow with a start-node `secretRef`, and its `config.signature` names DocuSign Connect's own header (`signs: 'body'`, `header: 'X-DocuSign-Signature-1'`, `algorithm: 'hmac-sha256'`, `encoding: 'base64'`), so status changes arrive verified instead of polled. `auth` is `{ type: 'oauth2', grant: 'authorization_code', authorizationUrl, tokenUrl, scopes, clientId, credentialRef }`, the client secret only a `credentialRef` (no inline `clientSecret`, no short-lived token parked behind a `bearer` `credentialRef`): the built-in `openapi` provider obtains and refreshes the token per dispatch, and the instance stays degraded \"not connected\" until an administrator holding `manage_connector_connections` connects it once per organization (`POST /api/v1/automation/connectors/docusign/connection`, then the vendor's redirect to `GET …/connectors/oauth/callback`; `DELETE` revokes). `connectorConfig.input` is a value slot: the per-contract payload reads the record through a CEL envelope (`envelopeId: { dialect: 'cel', source: 'record.envelope_id' }`), judged against the action's `inputSchema` before dispatch. The answer proposes no `registerConnector` code and no plugin.",
       "files": [],
       "assertions": {
         "must_contain": ["defineConnector", "provider: 'openapi'", "credentialRef", "connector_action", "type: 'api'", "secretRef", "Swagger 2.0", "oauth2", "authorization_code", "/connection"],
 
@@ -203,7 +203,7 @@ Drivers are the storage layer:
 | **SQL** | `@objectstack/driver-sql` | Production (PostgreSQL, MySQL, SQLite) | `SqlDriver` — Knex.js under the hood (`pg` / `mysql` / `better-sqlite3` clients) |
 | **MongoDB** | `@objectstack/driver-mongodb` | Production (document store) | `MongoDBDriver` |
 | **SQLite WASM** | `@objectstack/driver-sqlite-wasm` | Browser / WebContainer | `SqliteWasmDriver` — in-process, no server |
-| **Turso** | `@objectstack/driver-turso` | Edge, serverless, multi-tenant | **Cloud / EE only** — ships with the ObjectStack cloud / enterprise distribution, not the open framework. The open-core CLI recognizes `libsql://` URLs but **fails loudly** (`UnsupportedDriverError`) |
+| **Turso** | `@objectstack/driver-turso` | Edge, serverless, multi-tenant | **Cloud / EE only**. The open-core CLI recognizes `libsql://` URLs but **fails loudly** (`UnsupportedDriverError`) |
 
 ### Wiring a driver — you usually do not
 
@@ -293,7 +293,7 @@ CLI: `os serve` / `os dev`
 ### `requires:` — which service plugins boot
 
 Step 4's list is the fixed core. Tokens marked ° are always-on: every boot
-mounts them, listed or not, and `--preset minimal` drops exactly those. Every
+mounts them, listed or not, and `--preset minimal` drops them; `email`, `approvals` or `auth` keeps `job` and `queue`. Every
 other service plugin is opt-in (`requires: [...]` on the stack root turns it on) but the host defaults, mounted under every preset: `mcp` unless `OS_MCP_SERVER_ENABLED=false`, and `pinyin-search` when `i18n` names a `zh-*` locale (`OS_SEARCH_PINYIN_ENABLED` overrides). The CLI expands each
 token through the `CAPABILITY_PROVIDERS` registry in
 `@objectstack/core`:
@@ -363,7 +363,7 @@ The stack's `data:` collection is authored with `defineSeed()`, which
 **objectstack-data** owns — go there for `externalId` matching, `env:` scoping,
 and which keys are derived.
 
-`mode` (`upsert` default · `insert` · `update` · `ignore` · `replace` ⚠️ **data
+`mode` (`ignore` default · `upsert` · `insert` · `update` · `replace` ⚠️ **data
 loss**) decides what a replay does to rows that already exist —
 [Import modes](../objectstack-data/references/seeds.md#import-modes).
Original file line number	Diff line number	Diff line change
`@@ -4,7 +4,7 @@`
`4`	`4`	`{`
`5`	`5`	`"id": 1,`
`6`	`6`	"prompt": "Our contract-lifecycle app (objects `contract`, `crm_account`) needs DocuSign: send a contract out for signature, read an envelope's status, and reflect status changes on the record. DocuSign publishes a 4.7 MB Swagger 2.0 document with several hundred operations, authenticates with OAuth 2.0, and its Connect webhooks sign posts with their own HMAC header. Propose what to build and where.",
`7`		- "expected_output": "A declarative instance inside the app, not a platform plugin and not a `connector-esign` family: `defineConnector` with `provider: 'openapi'`, whose `providerConfig.spec` is a packaged OpenAPI 3.x document converted offline from the Swagger 2.0 document and trimmed to the three operations (create envelope, get envelope, list status changes) (or `providerConfig.include` names those three operation keys, the `mcp` provider's allowlist meaning, where a non-array or unknown entry is fatal). Fields on `contract` (`envelope_id`, `signature_status`). Flows dispatch `connector_action`; the callback is an `api` flow with a start-node `secretRef`. `auth` is `{ type: 'oauth2', grant: 'authorization_code', authorizationUrl, tokenUrl, scopes, clientId, credentialRef }`, the client secret only a `credentialRef` (no inline `clientSecret`, no short-lived token parked behind a `bearer` `credentialRef`): the built-in `openapi` provider obtains and refreshes the token per dispatch, and the instance stays degraded \"not connected\" until an administrator holding `manage_connector_connections` connects it once per organization (`POST /api/v1/automation/connectors/docusign/connection`, then the vendor's redirect to `GET …/connectors/oauth/callback`; `DELETE` revokes). One gap is named plainly: DocuSign Connect signs its own header, which the `api` door does not verify, so status is polled until vendor schemes are verified. `connectorConfig.input` is a value slot: the per-contract payload reads the record through a CEL envelope (`envelopeId: { dialect: 'cel', source: 'record.envelope_id' }`), judged against the action's `inputSchema` before dispatch. The answer proposes no `registerConnector` code and no plugin.",
	`7`	+ "expected_output": "A declarative instance inside the app, not a platform plugin and not a new connector package: `defineConnector` with `provider: 'openapi'`, whose `providerConfig.spec` is a packaged OpenAPI 3.x document converted offline from the Swagger 2.0 document and trimmed to the three operations (create envelope, get envelope, list status changes) (or `providerConfig.include` names those three operation keys, the `mcp` provider's allowlist meaning, where a non-array or unknown entry is fatal). Fields on `contract` (`envelope_id`, `signature_status`). Flows dispatch `connector_action`; the callback is a `type: 'api'` flow with a start-node `secretRef`, and its `config.signature` names DocuSign Connect's own header (`signs: 'body'`, `header: 'X-DocuSign-Signature-1'`, `algorithm: 'hmac-sha256'`, `encoding: 'base64'`), so status changes arrive verified instead of polled. `auth` is `{ type: 'oauth2', grant: 'authorization_code', authorizationUrl, tokenUrl, scopes, clientId, credentialRef }`, the client secret only a `credentialRef` (no inline `clientSecret`, no short-lived token parked behind a `bearer` `credentialRef`): the built-in `openapi` provider obtains and refreshes the token per dispatch, and the instance stays degraded \"not connected\" until an administrator holding `manage_connector_connections` connects it once per organization (`POST /api/v1/automation/connectors/docusign/connection`, then the vendor's redirect to `GET …/connectors/oauth/callback`; `DELETE` revokes). `connectorConfig.input` is a value slot: the per-contract payload reads the record through a CEL envelope (`envelopeId: { dialect: 'cel', source: 'record.envelope_id' }`), judged against the action's `inputSchema` before dispatch. The answer proposes no `registerConnector` code and no plugin.",
`8`	`8`	`"files": [],`
`9`	`9`	`"assertions": {`
`10`	`10`	`"must_contain": ["defineConnector", "provider: 'openapi'", "credentialRef", "connector_action", "type: 'api'", "secretRef", "Swagger 2.0", "oauth2", "authorization_code", "/connection"],`