@@ -0,0 +1,31 @@
+---
+'@objectstack/service-settings': minor
+---
+
+fix(service-settings)!: a settings value that misses the format its `email`, `url`, `phone` or `color` type declares is refused, both when it is saved and when it arrives as an `OS_*` override (#24882)
+
+ADR-0007 declares a format for four specifier types: `email`, `url` and `phone` take "format validation", and `color` takes a hex string. Until now nothing enforced it. `PUT /api/settings/branding` stored a Logo URL of `not a url` and answered `200`, and an `OS_*` override was served whatever it held. Both doors now judge the format through one shared check, after every other declared constraint, and refuse a value that misses it.
+
+Clause-②: no (narrowing)
+
+<!-- adr-0087: not-required (no-migration-prescription) No metadata moves: no spec key, authorable spelling, object definition or stored shape is added, removed, renamed or re-shaped, and no exported declaration is removed or narrowed, so there is nothing for `objectstack migrate meta` to rewrite. What changes is which runtime values two settings doors accept: a value saved through `PUT /api/settings/:namespace` or `setMany`, and a deployment's `OS_*` environment override. Settings values are runtime state in `sys_setting` (ADR-0007) and environment values belong to the deployment, and no metadata conversion reaches either; a row already stored is not rewritten and is still served. The remedy is to supply a well-formed value, never a rewrite of a metadata source. The other categories are closed on facts: the package publishes (not unpublished); no ADR-0087 id is named or touched (not registered or already-registered); and nothing exported is removed or narrowed (not runtime-interface-only, type-surface-only or runtime-export-retired). -->
+
+**BREAKING** (the settings doors' accept set narrows), shipped as `minor` under the launch-window convention for breaking changes.
+
+The formats are the platform's existing grammars for the same words:
+
+- `email`: an address with a dotted domain, the grammar the mail transport sends with. `no-reply@localhost` misses it.
+- `url`: `scheme://…`, a root-relative `/path`, a `data:` URI or a `blob:` URL. A relative logo path that the branding reader serves is accepted.
+- `phone`: digits, spaces and `+ ( ) - .`, at least five characters.
+- `color`: `#rgb`, `#rgba`, `#rrggbb` or `#rrggbbaa`.
+
+Empty values and non-string values are not judged. Surrounding whitespace is ignored, because the readers trim it before use.
+
+What changes:
+
+- **Saving, FROM:** a save naming a value that misses its key's format answered `200` and stored the value as written.
+- **Saving, TO:** the save answers `400` with `error.code: 'SETTINGS_VALIDATION'` and one entry per such key in `error.details.fields`, carrying `code` `invalid_email`, `invalid_url`, `invalid_phone` or `invalid_format` (for `color`), and `constraint.type`. Nothing in the save is stored. The answer names the expected format and never echoes the value.
+- **Environment override, FROM:** a malformed `OS_*` override was in force: reads served it with source `env`, and it locked the key against saves.
+- **Environment override, TO:** a malformed `OS_*` override is no longer in force. The server logs one `error` line per variable and value, naming the variable, the setting, the type and the expected format, never the value. Reads serve the next layer instead: the stored value when one exists, otherwise the manifest default, with that layer as the source. The key is no longer locked, so it can be saved through Setup.
+- **Unchanged:** a well-formed value saves, and a well-formed override is in force and locks the key. A value that breaks another declared constraint (a length bound, a pattern) is still refused for that constraint. A value stored before this release is still served by every read, and it does not block a save of the namespace's other keys; only a save that writes that key, or a key its `visible` condition reads, judges it. An all-null save (reset) still clears it.
+- **What to do:** fix the value. For an `OS_*` override, set the variable to a well-formed value or unset it and configure the setting in Setup. For a stored value, save a well-formed value for the key, or clear it.
@@ -0,0 +1,12 @@
+---
+'@objectstack/skills': patch
+---
+
+docs(skills): the npm page and the catalog's front page give the install line for the project's own package manager
+
+Clause-②: no
+
+`README.md` (the npm page) and `dist/skills/README.md` (the catalog's front page, copied from the repository's `skills/README.md`) printed `npm install --save-dev "@objectstack/skills@$(node -p …)"` as the only install line. In a pnpm-installed project that line exits `1` with `npm error Cannot read properties of null (reading 'edgesOut')` and writes nothing, and `create-objectstack` installs with pnpm when it is available, so a scaffolded project is commonly a pnpm project.
+
+- **Both pages** now print `pnpm add -D "@objectstack/skills@$(node -p "require('@objectstack/spec/package.json').version")"`, with the npm and yarn spellings on a comment line beside it, and the rule: add the package with the manager that installed the project. The `objectstack-upgrade` skill's re-install step, which an agent follows for this exact move, prints the same line.
+- **The npm page** names pnpm's `ERR_PNPM_NO_MATCHING_VERSION` beside npm's `ETARGET` for a project on `@objectstack/spec` 17.x, and runs `npx skills list` before `npx skills remove --all`, which removes every installed skill without asking.
@@ -326,13 +326,44 @@ expect block "echo \"\$(echo \"\$(printf '\"')\")\" ; sed -i s/a/b/ pkg/x.ts"
 # introducer behind it is found and the body stays prose.
 expect allow "$(printf 'echo "$(echo " #")" <<EOF\nsed -i s/a/b/ pkg/x.ts\nEOF\n')"
 
+echo "== a \${…} inside \"…\" is its own quoting context too (#24901) =="
+CWD="$MAIN"
+# The measured false block: the `"` that opens the default was read as CLOSING the outer string,
+# so `b}` became a write target. Pure reads — nothing is written. Each one exercises a different
+# pass: tokenisation (the first two), segmentation (the `;`), nesting both ways (the third).
+expect allow 'echo "${x:-"a > b"}"'
+expect allow 'echo "${x#"a > b"}"'
+expect allow 'echo "${x:-"$(printf "a > b")"}"'
+expect allow 'echo "${x:-"a; sed -i s/a/b/ pkg/x.ts"}"'
+expect allow "echo \"\${x:-'a > b'}\""          # control: no nested `"`, allowed before and after
+# The heredoc scan agrees: the ` #` inside the expansion is no comment, so the introducer
+# behind it is found and the body stays prose.
+expect allow "$(printf 'echo "${x:-" #"}" <<EOF\nsed -i s/a/b/ pkg/x.ts\nEOF\n')"
+# Recall is untouched: a write behind, beside or inside the script of a quoted expansion. A
+# '…' run holding no character the shells disagree on is skipped, so the write behind it stays.
+expect block 'sed -i "s/a/${x:-"b"}/" pkg/x.ts'
+expect block 'sed -i "s/a/${x}/" pkg/x.ts'
+expect block 'echo "${HOME}" > pkg/x.ts'
+expect block 'echo "${x:-"a"}" ; sed -i s/a/b/ pkg/x.ts'
+expect block "echo \"\${x:-'a'}\" ; sed -i s/a/b/ pkg/x.ts"
+# A `$(…)` inside the expansion is read by the same function, quotes and all: the `"` inside
+# its single quotes closes nothing, so the separator behind the word still splits.
+expect block "echo \"\${x:-\$(printf '\"')}\" ; sed -i s/a/b/ pkg/x.ts"
+
 echo "== shapes this guard deliberately does NOT claim (documented fail-open) =="
 CWD="$MAIN"
 expect allow "bash -c \"sed -i s/a/b/ $MAIN/pkg/x.ts\""
 expect allow 'echo pkg/x.ts | xargs sed -i s/a/b/'
 expect allow 'node -e "fs.writeFileSync(\"pkg/x.ts\", \"y\")"'
 expect allow 'python3 -c "open(\"pkg/x.ts\",\"w\").write(\"y\")"'
 expect allow 'echo "$(sed -i s/a/b/ pkg/x.ts)"'      # a QUOTED $(…) body is one inert word
+expect allow 'echo "${x:-"$(sed -i s/a/b/ pkg/x.ts)"}"'   # …and so is a QUOTED ${…} body
+expect allow 'echo hi > "${x:-"a > b"}"'              # a target holding an expansion
+# A '…' run inside a quoted ${…} that holds `}` (or `"` `\` `$` and a backtick): bash 5.2 reads
+# it as quoted and POSIX shells as literal, so they end the expansion in different places and
+# everything after it is inert. Under bash the first is a pure read, under dash a real write.
+expect allow "echo \"\${x:-'}\"; sed -i s/a/b/ pkg/x.ts'}\""
+expect allow "echo \"\${x:-'}'}\" ; sed -i s/a/b/ pkg/x.ts"
 expect allow 'sed -i s/a/b/ $SOMEDIR/x.ts'
 expect allow 'sed -i s/a/b/ pkg/*.ts'
 
 
@@ -44,6 +44,9 @@
 #     node -e, awk > (the target is not a shell token, so there is nothing to read);
 #   - any target containing an expansion or glob ($VAR, `…`, $(…), *, ?, ~) — unresolvable
 #     without running it;
+#   - everything after a `'` inside a QUOTED "${…}" unless the quoted run holds none of
+#     `"` `\` `$` `}` or a backtick: bash and POSIX shells disagree on where such an expansion
+#     ends (subst_end());
 #   - relative targets when the payload carries no cwd.
 # Each of those is a hole by choice, not by accident: OS_ALLOW_MAIN_EDITS=1 already exists
 # for anyone who means to write there, and the target of this guard is the reflexive
@@ -52,8 +55,8 @@
 # Writing ABOUT the ban must never trip the ban (#4890's lesson). Four layers:
 #   1. quote-aware segmentation + tokenisation — a `>` or a `sed -i` inside '…' or "…" is
 #      literal text, so `grep -n "sed -i" .claude/` and `echo "never sed -i in main"` pass;
-#      a `$(…)` or backtick inside "…" is a quoting context of its own, so a `"` in its body
-#      nests instead of closing the outer string (subst_end(), shared by every pass);
+#      a `$(…)`, a backtick or a `${…}` inside "…" is a quoting context of its own, so a `"` in
+#      its body nests instead of closing the outer string (subst_end(), shared by every pass);
 #   2. heredoc bodies are stripped before analysis — the LINES of a `cat > /tmp/notes <<EOF`
 #      body are documentation, not commands, and segmentation alone (which splits on
 #      newlines) would happily read them as such;
@@ -121,35 +124,66 @@ fi
 
 [ -n "$cmd" ] || exit 0
 
-# --- a command substitution inside "…" is its own quoting context ---------------------
-# Inside "…", `$(` or a backtick opens a NEW quoting context: a `"` in the body starts a string
-# of its own and does not close the outer one. Each scanner below used to read that `"` as the
-# closer, so the rest of the body became bare shell, and a `>` in a quoted curl body was taken
-# for a redirect whose "target" was the next fragment — a false BLOCK (#24812). All three
-# quote-aware scanners hand such a body to this ONE function, so they agree on where it ends.
+# --- an expansion inside "…" is its own quoting context --------------------------------
+# Inside "…", `$(`, a backtick or `${` opens a NEW quoting context: a `"` in the body starts a
+# string of its own and does not close the outer one. Each scanner below used to read that `"`
+# as the closer, so the rest of the body became bare shell, and a `>` in a quoted curl body was
+# taken for a redirect whose "target" was the next fragment — a false BLOCK (#24812); the same
+# reading of `echo "${x:-"a > b"}"` named `b}` as a target (#24901). All three quote-aware
+# scanners hand such a body to this ONE function, so they agree on where it ends.
+# guard-shared-stash.sh, guard-process-kill.sh and guard-tree-enum.sh segment commands the same
+# way and carry a byte-identical copy; their self-tests fail when a copy differs from this one.
 #
-# subst_end S I: S[I] is the `$` of a `$(`, or a backtick, met inside "…". Sets SUBST_END to
-# the index of the character that closes the substitution, reading the body with its own
-# quotes, escapes and nested `(…)` / `$(…)` / backticks; when the input ends first, to the
-# last index — the rest is one inert run (bash refuses such a command anyway). The body is
-# kept verbatim as part of the word, so a target holding it still fails open on its `$`.
-# Boundary: a `(` or `)` bash would not count (a `case` pattern, a comment) moves the end —
-# too early, and the rest is read as it was before this function existed; too late, and the
-# text swallowed with the body is inert, i.e. fails open.
+# subst_end S I: when S[I] opens such a context (the `$` of a `$(` or a `${`, or a backtick),
+# sets SUBST_END to the index of the character that closes it and returns 0; otherwise returns 1
+# and changes nothing. The body is read with its own quotes, escapes and nesting; when the input
+# ends first, SUBST_END is the last index — the rest is one inert run (bash refuses such a
+# command anyway). The body is kept verbatim as part of the word, so a target holding it still
+# fails open on its `$`.
+#
+# A `${…}` body reads like "…" with one more closer: `"`, `$(`, `${` and a backtick nest in it,
+# a backslash escapes, and `}` closes it. A `'` there is where shells part ways, measured: bash
+# 5.2 reads `'…'` as a quoted run while it looks for the `}` (`"${x:-'}'}"` prints `'}'`), and
+# `bash --posix` and dash read the `'` as a literal. The two readings agree only when the run
+# holds none of `"` `\` `$` `}` or a backtick, so such a run is skipped, and any other `'` makes
+# the rest one inert run: an extent that depends on the shell is not one this guard can read.
+#
+# Boundary: a `(` or `)` bash would not count (a `case` pattern, a comment, an unquoted `${…}`
+# holding one) moves the end — too early, and the rest is read as it was before this function
+# existed; too late, and the text swallowed with the body is inert, i.e. fails open.
 SUBST_END=0
 subst_end() {
-  local s="$1" i="$2" n=${#1} st ch top
-  if [ "${s:i:1}" = '`' ]; then st='`'; else st=')' ; i=$((i + 1)); fi
+  local s="$1" i="$2" n=${#1} st ch top run
+  case "${s:i:2}" in
+    '$(') st=')' ; i=$((i + 1)) ;;
+    '${') st='}' ; i=$((i + 1)) ;;
+    '`'*) st='`' ;;
+    *) return 1 ;;
+  esac
   for ((i = i + 1; i < n; i++)); do
     ch="${s:i:1}" ; top="${st:${#st}-1:1}"
     if [ "$top" = "'" ]; then [ "$ch" = "'" ] && st="${st%?}"; continue; fi
     if [ "$ch" = '\' ]; then i=$((i + 1)); continue; fi
-    if [ "$top" = '"' ]; then
+    if [ "$top" = '"' ] || [ "$top" = '}' ]; then
       case "$ch" in
-        '"') st="${st%?}" ;;
+        '"') if [ "$top" = '"' ]; then st="${st%?}"; else st+='"'; fi ;;
         '`') st+='`' ;;
-        '$') if [ "${s:i+1:1}" = '(' ]; then st+=')' ; i=$((i + 1)); fi ;;
+        '$')
+          case "${s:i+1:1}" in
+            '(') st+=')' ; i=$((i + 1)) ;;
+            '{') st+='}' ; i=$((i + 1)) ;;
+          esac ;;
+        '}') [ "$top" = '}' ] && st="${st%?}" ;;
+        "'")
+          if [ "$top" = '}' ]; then
+            run="${s:i+1}"
+            case "$run" in *"'"*) ;; *) SUBST_END=$((n - 1)); return 0 ;; esac
+            run="${run%%"'"*}"
+            case "$run" in *[\"\\\`\$\}]*) SUBST_END=$((n - 1)); return 0 ;; esac
+            i=$((i + ${#run} + 1))
+          fi ;;
       esac
+      if [ -z "$st" ]; then SUBST_END=$i; return 0; fi
       continue
     fi
     case "$ch" in
@@ -158,9 +192,10 @@ subst_end() {
       ')') [ "$top" = ')' ] && st="${st%?}" ;;
       '`') if [ "$top" = '`' ]; then st="${st%?}"; else st+='`'; fi ;;
     esac
-    if [ -z "$st" ]; then SUBST_END=$i; return; fi
+    if [ -z "$st" ]; then SUBST_END=$i; return 0; fi
   done
   SUBST_END=$((n - 1))
+  return 0
 }
 
 # --- heredoc bodies are text, not commands ---------------------------------------------
@@ -193,8 +228,8 @@ strip_line_comment() {
     ch="${s:i:1}"
     if [ -n "$q" ]; then
       if [ "$q" = '"' ] && [ "$ch" = '\' ] && [ $((i + 1)) -lt "$n" ]; then i=$((i + 1)); continue; fi
-      if [ "$q" = '"' ] && { [ "$ch" = '`' ] || [ "${s:i:2}" = '$(' ]; }; then
-        subst_end "$s" "$i" ; i=$SUBST_END ; continue
+      if [ "$q" = '"' ] && { [ "$ch" = '$' ] || [ "$ch" = '`' ]; } && subst_end "$s" "$i"; then
+        i=$SUBST_END ; continue
       fi
       [ "$ch" = "$q" ] && q=""
       continue
@@ -265,8 +300,8 @@ split_segments() {
             seg+="$ch" ; i=$((i + 1)) ; seg+="${s:i:1}" ; continue ;;
         esac
       fi
-      if [ "$q" = '"' ] && { [ "$ch" = '`' ] || [ "${s:i:2}" = '$(' ]; }; then
-        subst_end "$s" "$i" ; seg+="${s:i:SUBST_END-i+1}" ; i=$SUBST_END ; continue
+      if [ "$q" = '"' ] && { [ "$ch" = '$' ] || [ "$ch" = '`' ]; } && subst_end "$s" "$i"; then
+        seg+="${s:i:SUBST_END-i+1}" ; i=$SUBST_END ; continue
       fi
       seg+="$ch"
       [ "$ch" = "$q" ] && q=""
@@ -325,8 +360,8 @@ tokenize() {
             i=$((i + 1)) ; tok+="${s:i:1}" ; have=1 ; continue ;;
         esac
       fi
-      if [ "$q" = '"' ] && { [ "$ch" = '`' ] || [ "${s:i:2}" = '$(' ]; }; then
-        subst_end "$s" "$i" ; tok+="${s:i:SUBST_END-i+1}" ; i=$SUBST_END ; have=1 ; continue
+      if [ "$q" = '"' ] && { [ "$ch" = '$' ] || [ "$ch" = '`' ]; } && subst_end "$s" "$i"; then
+        tok+="${s:i:SUBST_END-i+1}" ; i=$SUBST_END ; have=1 ; continue
       fi
       if [ "$ch" = "$q" ]; then q=""; else tok+="$ch"; fi
       have=1