@@ -299,9 +299,329 @@ jobs:
       - name: Verify Changesets "fixed" group covers every public package
         run: node scripts/check-changeset-fixed.mjs
 
+      # ══════════════════════════════════════════════════════════════════════
+      # POST-VERSION VALIDATION — THE ONLY GATE THE RELEASE COMMIT EVER PASSES
+      # (#11945)
+      # ══════════════════════════════════════════════════════════════════════
+      # The "chore: version packages" PR runs NO CI and cannot be made to.
+      # GitHub does not start workflow runs from events raised by the default
+      # `GITHUB_TOKEN`, and the step below opens and force-pushes that PR with
+      # exactly that token — so it gets no `pull_request` build, and because the
+      # branch is force-pushed there is not even a stable head for a human to
+      # re-run checks against. Two files in this repository already state the
+      # mechanism in their own words rather than inferring it from a sibling:
+      #
+      #   lint.yml — "`changeset version` bumps packages/cli on a release PR
+      #   that (per sync-template-versions.mjs's own header) gets NO CI because
+      #   changesets/action opens it with the default GITHUB_TOKEN — so the bump
+      #   merged green and the gate reddened on the NEXT ordinary PR, naming
+      #   files that author never touched."
+      #
+      #   scripts/sync-protocol-version.mjs — "the lockstep guard
+      #   (protocol-version.test.ts) exists, but release PRs opened by
+      #   changesets/action with the default GITHUB_TOKEN do not trigger CI
+      #   (GitHub's anti-recursion rule), so the guard only fired AFTER the
+      #   merge. Fixing the value at version time is the only spot that cannot
+      #   be skipped."
+      #
+      # That last sentence is the treadmill this block exists to end. Each
+      # version-time output has so far had to buy its own correctness with its
+      # own rewriter and its own self-test — sync-protocol-version.mjs (#2769),
+      # sync-template-versions.mjs, sync-docs-image-tags.mjs (#9064) — because
+      # nothing validated the tree as a whole. Maintainer ruling on the sibling
+      # card (objectui#5397, 2026-08-22, 「接受所有」) chose option A: validate
+      # the POST-VERSION tree HERE, after the version step and before the action
+      # opens or updates the PR. NOT by handing the PR a PAT / GitHub App token
+      # (widens the supply-chain trust surface, adds rotation obligations), and
+      # NOT one artifact at a time (per-artifact guarantees do not generalise).
+      #
+      # THE SCOPE IS MEASURED IN THIS REPOSITORY, NOT INHERITED (2026-08-25)
+      # -------------------------------------------------------------------
+      # The sibling's scope conclusion does NOT transfer. There, the version
+      # step moves no source byte at all. Here `pnpm run version` is four
+      # rewriters, not one, and one of them writes TypeScript. Rendered against
+      # this repository's real tree at 3689991d2 (158 pending changesets,
+      # @objectstack/cli 17.2.0 -> 17.3.0), `pnpm run version` moved 313 paths:
+      #
+      #     158  .changeset/*.md      deleted (consumed by the version)
+      #      76  */package.json       152 changed lines, every one `"version":`
+      #                               — no dependency range moved
+      #      76  */CHANGELOG.md       generated from the changeset bodies
+      #       3  doc surfaces         8 concrete image-tag / npm-pin lines in
+      #                               content/docs/deployment/self-hosting.mdx,
+      #                               content/docs/upgrading.mdx, docker/README.md
+      #
+      # Three more paths can appear at a MAJOR boundary and did not on this
+      # train — packages/spec/src/kernel/protocol-version.ts, and per bundled
+      # template objectstack.config.ts and objectstack.manifest.json. The first
+      # of those is a runtime source file, which is precisely why "the version
+      # step cannot move source" is false here and the sibling's surface list
+      # could not simply be copied. cut-rc.yml's allowlist block carries the
+      # same measurement for the RC lane and agrees path-for-path.
+      #
+      # WHY THE GATE LIST IS DERIVED AND NOT WRITTEN DOWN
+      # -------------------------------------------------
+      # A hand-listed set is the treadmill again, one level up: the day someone
+      # adds a fifth rewriter, the list does not know. So the change set is fed
+      # to scripts/pm/dispatch-gates.mjs, which discovers every check family
+      # from .github/workflows/**  at run time and names the ones whose declared
+      # path filters cover these paths. A new version-time output pulls in its
+      # surface's gates on the day it lands, with nothing here to update.
+      #
+      # ⚠️ The EXPLICIT-PATHS form is required, not stylistic. By default the
+      # script derives its change set from the merge base with origin/main, and
+      # this job checks out `main` itself — measured in a depth-1 clone of main
+      # with a dirty tree, the bare form prints its usage and exits 2, deriving
+      # nothing. Passed the paths as argv it works on any checkout (exit 0), and
+      # on this repository's real 313-path change set both forms name the same
+      # 49 families. `--repo` asserts this checkout really is this repository,
+      # so a wrong-tree answer refuses instead of being plausible.
+      #
+      # THE PRICE (measured on the rendered tree, same container, same state as
+      # this job: `pnpm install --frozen-lockfile` and NO build)
+      # ------------------------------------------------------------------
+      # 49 families derived; 44 run here in 113 s total, every one green on the
+      # post-version tree. The control that makes that number mean something:
+      # the identical sweep on the PRE-version tree gives the identical verdicts
+      # — 44 green, the same 6 red — so the version step changes no gate's mind
+      # on this train, and the 6 reds are this environment, not findings.
+      # At the 6-hourly refresh below that is ~7.5 minutes of runner time a day.
+      #
+      # ⛔ WHAT IS DELIBERATELY NOT RUN, AND WHY IT IS NOT AN OMISSION. Five of
+      # the 49 need a workspace BUILD, and one needs full git history. They are
+      # excluded by name below rather than by silence:
+      #
+      #     check:i18n, check:i18n-coverage, check:dev-prereqs,
+      #     check:doc-formula-expressions, check:doc-security-posture
+      #         All five refuse without built dist ("Nothing was measured" /
+      #         "Fix: pnpm build"). A build on this lane is the ~9 minutes the
+      #         comment below records as deliberately moved to the publish job;
+      #         re-adding it to gate a manifest's `"version"` key would undo
+      #         that. What they read is not what the version step moved: the two
+      #         doc gates judge formula fences and security-posture prose, and
+      #         the only content/** lines the version step touches are the 8
+      #         concrete image tags above.
+      #     check:engine-split-ratio
+      #         An ADR-0076 D7 metric over 90 days of git log. It refuses on a
+      #         shallow checkout by design, and this job's checkout is depth-1.
+      #         It reads history, never the tree, so the version step cannot
+      #         change its answer.
+      #
+      # A gate that later joins one of those families lands in this list's way
+      # and reds the lane rather than passing silently — the safe direction.
+      #
+      # ⛔ WHY check:nul-bytes IS ADDED BY HAND. It is one of lint.yml's
+      # UNCONDITIONAL gates, so no path filter can derive it — and the release
+      # commit is the one commit that never runs lint.yml at all. Its corpus is
+      # every byte in the tree, which includes the 76 generated CHANGELOGs: the
+      # only prose the version step writes that it did not author. 1 s.
+      #
+      # FAILURE SEMANTICS. A red validation fails the job, so the step below
+      # never runs and the standing PR keeps its last VALIDATED content instead
+      # of being force-pushed to a broken one. If the tree stays broken the PR
+      # goes stale — but loudly, on a red run every six hours, which is the
+      # opposite of this card's defect. Nothing here can reach the publish lane:
+      # this whole job is `schedule` / `workflow_dispatch` only.
+      - name: Render the post-version tree
+        id: post_version
+        run: |
+          set -euo pipefail
+          shopt -s nullglob
+
+          # `/^README\.md$/i` is how `@changesets/read` spells its exclusion, so
+          # the count is case-folded rather than matching one spelling.
+          count_pending() {
+            local n=0 file
+            for file in .changeset/*.md .changeset/pre/*.md; do
+              if [ "$(printf '%s' "${file##*/}" | tr '[:upper:]' '[:lower:]')" = 'readme.md' ]; then
+                continue
+              fi
+              n=$((n + 1))
+            done
+            printf '%s' "$n"
+          }
+
+          pending_before=$(count_pending)
+          echo "pending_before=${pending_before}" >> "$GITHUB_OUTPUT"
+
+          # The version PR was just merged, or nothing has landed since. The
+          # action will take its no-changesets branch and do nothing, so there
+          # is no post-version tree to render and nothing to validate. Said out
+          # loud because a validation that silently does nothing is this card's
+          # own failure class.
+          if [ "${pending_before}" -eq 0 ]; then
+            echo 'No pending changesets — the version step would move nothing. Skipping the post-version validation.'
+            {
+              echo '### Post-version validation'
+              echo
+              echo '- pending changesets: `0` — nothing to render, nothing to validate.'
+            } >> "$GITHUB_STEP_SUMMARY"
+            exit 0
+          fi
+
+          pnpm run version
+
+          # Tracked moves (deletions included) plus new untracked files. Read
+          # this way rather than by classifying `git status --porcelain` letters:
+          # a rename arrives as a delete/add pair whose halves are both named
+          # here, so no status code has to be interpreted.
+          {
+            git diff --name-only HEAD
+            git ls-files --others --exclude-standard
+          } | sort -u > "${RUNNER_TEMP}/post-version-paths.txt"
+          moved=$(wc -l < "${RUNNER_TEMP}/post-version-paths.txt" | tr -d ' ')
+
+          {
+            echo '### Post-version validation'
+            echo
+            echo "- rendered from \`${GITHUB_SHA}\`"
+            echo "- pending changesets consumed: \`${pending_before}\`"
+            echo "- paths the version step moved: \`${moved}\`"
+          } >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Validate the post-version tree
+        if: steps.post_version.outputs.pending_before != '0'
+        run: |
+          set -euo pipefail
+
+          mapfile -t MOVED < "${RUNNER_TEMP}/post-version-paths.txt"
+          if [ "${#MOVED[@]}" -eq 0 ]; then
+            echo "::error::changesets were pending but the version step moved no path. Either \`pnpm run version\` did nothing, or it wrote outside the working tree — both are a broken version lane, not an empty diff."
+            exit 1
+          fi
+
+          node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack "${MOVED[@]}" \
+            > "${RUNNER_TEMP}/derived.txt"
+
+          # PARSE GUARD. The list is read out of prose the script writes for a
+          # human, so a format change would otherwise hand this step an empty
+          # gate list and a green run — a validation that validates nothing,
+          # which is the defect this whole block is closing. Both the header and
+          # a non-empty result are therefore asserted before anything runs.
+          if ! grep -q '^Local gates for this card' "${RUNNER_TEMP}/derived.txt"; then
+            echo "::error::dispatch-gates.mjs printed no 'Local gates for this card' block. Its output format changed and this step's parser did not — refusing to report a green validation derived from nothing."
+            exit 1
+          fi
+          awk '
+            /^Local gates for this card/ { on = 1; next }
+            on && /^[^ ]/ { exit }
+            on && /^  - / { sub(/^  - /, ""); sub(/   \[.*/, ""); print }
+          ' "${RUNNER_TEMP}/derived.txt" | sort -u > "${RUNNER_TEMP}/gates.txt"
+
+          derived=$(wc -l < "${RUNNER_TEMP}/gates.txt" | tr -d ' ')
+          if [ "${derived}" -eq 0 ]; then
+            echo "::error::dispatch-gates.mjs derived no gate at all from ${#MOVED[@]} changed path(s). A version pass always moves packages/cli/package.json and the doc surfaces that pin its version, so an empty derivation is a broken parse, not a clean tree."
+            exit 1
+          fi
+
+          # Written with printf rather than a heredoc: a heredoc body has to
+          # start at column 0, which ends the YAML block scalar this script
+          # lives in (caught by parsing this file, not by reading it).
+          printf '%s\n' \
+            'node scripts/check-dev-prereqs.mjs' \
+            'node scripts/check-engine-split-ratio.mjs' \
+            'pnpm check:i18n' \
+            'pnpm check:i18n-coverage' \
+            'pnpm --filter @objectstack/lint run check:doc-formula-expressions' \
+            'pnpm --filter @objectstack/lint run check:doc-security-posture' \
+            > "${RUNNER_TEMP}/excluded.txt"
+
+          failed=()
+          skipped=0
+          ran=0
+          while IFS= read -r gate; do
+            [ -z "${gate}" ] && continue
+            if grep -qxF -- "${gate}" "${RUNNER_TEMP}/excluded.txt"; then
+              echo "skipped (declared exclusion — needs a build or full history): ${gate}"
+              skipped=$((skipped + 1))
+              continue
+            fi
+            echo "::group::${gate}"
+            if bash -c "${gate}"; then
+              ran=$((ran + 1))
+            else
+              failed+=("${gate}")
+            fi
+            echo "::endgroup::"
+          done < "${RUNNER_TEMP}/gates.txt"
+
+          echo "::group::pnpm check:nul-bytes"
+          if pnpm check:nul-bytes; then
+            ran=$((ran + 1))
+          else
+            failed+=('pnpm check:nul-bytes')
+          fi
+          echo "::endgroup::"
+
+          {
+            echo "- gate families derived: \`${derived}\` (+1 unconditional: check:nul-bytes)"
+            echo "- run: \`${ran}\` · declared exclusions skipped: \`${skipped}\` · failed: \`${#failed[@]}\`"
+          } >> "$GITHUB_STEP_SUMMARY"
+
+          if [ "${#failed[@]}" -ne 0 ]; then
+            printf '::error::the post-version tree fails %s gate(s) that no CI run would ever have judged: %s\n' \
+              "${#failed[@]}" "$(printf '%s; ' "${failed[@]}")"
+            exit 1
+          fi
+          echo "Post-version tree validated: ${ran} gate(s) green."
+
+      # ⚠️ LOAD-BEARING — DO NOT DROP THIS STEP. The steps above render the
+      # version into the runner's working tree, and changesets/action picks its
+      # branch from that tree. With `.changeset/` already consumed it finds
+      # `hasChangesets` false, and this lane deliberately passes no `publish:`
+      # input, so `hasPublishScript` is false too — v1 then takes
+      # `case !hasChangesets && !hasPublishScript` (src/index.ts), logs "No
+      # changesets present or were removed by merging release PR" and RETURNS.
+      # The refresh becomes a permanent no-op and #4935 fossilises with nothing
+      # red anywhere: this file's own failure class, one lane over. So the tree
+      # is put back, and the restoration is ASSERTED rather than assumed.
+      - name: Restore the pre-version tree
+        if: always()
+        env:
+          PENDING_BEFORE: ${{ steps.post_version.outputs.pending_before }}
+        run: |
+          set -euo pipefail
+          shopt -s nullglob
+
+          if [ -z "${PENDING_BEFORE}" ] || [ "${PENDING_BEFORE}" = '0' ]; then
+            echo 'Nothing was rendered, so there is nothing to restore.'
+            exit 0
+          fi
+
+          git checkout -- .
+          # Narrow on purpose, and measured: those are the only roots the
+          # version pass writes into. A `git clean` on a lane that can push to
+          # a branch should never be able to reach further than the thing it
+          # undoes.
+          git clean -fdq -- .changeset packages examples content docker
+
+          count_pending() {
+            local n=0 file
+            for file in .changeset/*.md .changeset/pre/*.md; do
+              if [ "$(printf '%s' "${file##*/}" | tr '[:upper:]' '[:lower:]')" = 'readme.md' ]; then
+                continue
+              fi
+              n=$((n + 1))
+            done
+            printf '%s' "$n"
+          }
+
+          pending_after=$(count_pending)
+          dirty=$(git status --porcelain --untracked-files=no | wc -l | tr -d ' ')
+
+          if [ "${pending_after}" != "${PENDING_BEFORE}" ] || [ "${dirty}" -ne 0 ]; then
+            echo "::error::the pre-version tree was NOT restored (${PENDING_BEFORE} pending changeset(s) before, ${pending_after} after; ${dirty} tracked path(s) still modified). changesets/action would read this tree, find nothing pending and no publish script, and return without refreshing the PR — a silent permanent no-op (#11945)."
+            exit 1
+          fi
+          echo "Pre-version tree restored: ${pending_after} pending changeset(s), working tree clean."
+
       # `pnpm run version` = changeset version + sync-protocol-version +
-      # sync-template-versions. All three are pure file rewrites; none reads a
-      # built artifact. The workspace build, the vendored Console build and the
+      # sync-template-versions + sync-docs-image-tags — FOUR rewriters, read
+      # from the root `version` script, not three. The fourth joined in #9064
+      # and this comment did not follow; it is corrected here because the block
+      # above prices what that script moves, and a stale count of the rewriters
+      # is a stale statement of the surface being priced. All four are pure file
+      # rewrites; none reads a built artifact. The workspace build, the vendored Console build and the
       # live hotcrm smoke that used to run here were PRE-PUBLISH gates — they
       # moved to the `publish` job below, where the publish they gate now lives.
       # Leaving them here would gate nothing and cost ~9 minutes of every main