@@ -658,7 +658,24 @@ export const CEILINGS = new Map([
   // moves: no existing row is raised, the population is unchanged, and
   // `evals/**` stays priced.
   ['skills/objectstack-ai/evals/skills-tools-knowledge.json', 1074],
-  ['skills/objectstack-api/evals/endpoints-auth-routes.json', 1042],
+  // 1042 -> 1234 (card #26299, the objectstack-api row of the skills gap
+  // audit): one eval for the import mapping's `applyOn: 'create'` — the
+  // published teaching is the only place an author meets the column policy
+  // before a re-run upsert reverts an admin's edit, and this fixture is the
+  // instrument that makes the wrong answer fail at scoring. Maintainer ruling
+  // 2026-10-27 on the seat's decision card 「skills 修复卡的教学和 eval 都撞
+  // token 天花板,怎么付?」, his tap verbatim and untranslated:
+  // 「A:先削重复,余额按实测提高」. Paid down first, as the ruling asks: the
+  // file's five fixtures share no sentence, so there was no duplicate to cut
+  // (0 bytes). Arithmetic in bytes, because that is what this convention
+  // divides: on `origin/main` the file was 4156 bytes (1039 tokens, headroom
+  // 3); the fixture adds +780 bytes, so the LANDED file is 4936 bytes -> 1234
+  // tokens: the 3 tokens of headroom are absorbed and the ceiling moves
+  // 1042 -> 1234 (+192). Pinned AT the measurement — zero headroom, so the
+  // next token added here is paid for by deleting one from this file.
+  // Independently reproducible without running this script:
+  //   ceil($(wc -c < skills/objectstack-api/evals/endpoints-auth-routes.json) / 4) == ceil(4936 / 4)
+  ['skills/objectstack-api/evals/endpoints-auth-routes.json', 1234],
   ['skills/objectstack-automation/evals/flows-triggers-approvals.json', 1255],
   // 894 -> 1095 (#26179): one regression case for the field permission `when`
   // (the contract prompt: lock the legal terms for finance from approval on,
 
@@ -101,6 +101,15 @@ organization to offer it again. For the full contract, read
 `node_modules/@objectstack/spec/src/ui/sharing.zod.ts` (`SharingConfigSchema`
 with `enabled` / `allowAnonymous` / `publicLink`).
 
+A form open to anonymous intake declares no file field. A section field whose
+object type is in `FILE_REFERENCE_TYPES` (`image`, `file`, `avatar`, `video`,
+`audio`) is refused by the gating lint rule `public-form-file-field` — at
+`os validate` / `os build` / `os lint`, and at the view's publish — because a
+visitor has no upload door to mint a `sys_file` id. A form published before that
+rule meets the same refusal at submit: a file value answers the flat `400
+VALIDATION_FAILED` with `fields[].code: 'invalid_value'`. Collect the file on a
+signed-in form instead.
+
 ---
 
 ## Declarative Endpoints (`apis:`) — no handler code
@@ -257,6 +266,14 @@ eight extra verbs are never declared in `apiMethods`:
 derive — the trash surface is retired. Declaring any derived verb in
 `apiMethods` is stripped at parse with a FROM → TO warning.
 
+`POST /data/{object}/import` takes `mapping` as `{ Column: field }` or as
+`FieldMappingEntry[]` (`api/export.zod.ts`); only the entry form carries
+`applyOn`. `'always'` (default) writes the column on every row the import
+creates or updates; `'create'` writes it only when the row is created, so a
+re-run `upsert` refreshes the `always` columns and leaves a value an admin set
+since (an owner, a stage) as it is. A create-only column is still read for
+matching. Any other value is `400 INVALID_REQUEST`.
+
 ---
 
 ## Discovery & Health
@@ -352,6 +369,16 @@ ledger and composes the two checks itself — `envelopeViolations(body)` for the
 SHAPE, `makeApiErrorSchema(yourCodes)` for the VOCABULARY (both in
 `api/contract.zod.ts`). What no repo may do is emit a code in no ledger at all.
 
+A flow door — `POST /api/v1/automation/{name}/trigger`, resume, `/actions`, a
+declared `type: 'flow'` endpoint — answers a failed run with `400 FLOW_FAILED`;
+its `error.details` is `FlowFailureDetailsSchema` (`api/automation-api.zod.ts`):
+`errorMessage?` (the flow author's text), `summary?` (which node failed) and
+`innerRefusal?`, the `{ code, message }` a node's write was refused with, `code`
+in its wire spelling (`UNIQUE_VIOLATION`, `VALIDATION_FAILED`,
+`PERMISSION_DENIED`). Render it as a record form renders a refused save:
+top-level `userMessage`, then `details.innerRefusal`, then `message`. Absent
+keys mean the run produced none — never invent an empty.
+
 ---
 
 ## Best Practices
 
@@ -50,6 +50,16 @@
         "must_contain": ["apiMethods", "/batch", "trackHistory", "lifecycle"],
         "must_not_contain": ["'search'", "'restore'"]
       }
+    },
+    {
+      "id": 6,
+      "prompt": "Our nightly CSV upsert of `supplier` rows by `tax_id` keeps resetting the `owner` column that sales reassigns by hand. Fix the import body.",
+      "expected_output": "Sends `mapping` as a `FieldMappingEntry[]` (the `{ Column: field }` shorthand cannot carry it) with `{ sourceField: 'Owner', targetField: 'owner', applyOn: 'create' }`: the column is written when the upsert creates the row and left out of the patch when it matches one; the other columns keep the default `applyOn: 'always'`. Keeps `writeMode: 'upsert'` and `matchFields: ['tax_id']`.",
+      "files": [],
+      "assertions": {
+        "must_contain": ["applyOn", "'create'", "sourceField", "targetField"],
+        "must_not_contain": ["writeMode: 'insert'"]
+      }
     }
   ]
 }
Original file line number	Diff line number	Diff line change
`@@ -50,6 +50,16 @@`
`50`	`50`	`"must_contain": ["apiMethods", "/batch", "trackHistory", "lifecycle"],`
`51`	`51`	`"must_not_contain": ["'search'", "'restore'"]`
`52`	`52`	`}`
	`53`	`+ },`
	`54`	`+ {`
	`55`	`+ "id": 6,`
	`56`	+ "prompt": "Our nightly CSV upsert of `supplier` rows by `tax_id` keeps resetting the `owner` column that sales reassigns by hand. Fix the import body.",
	`57`	+ "expected_output": "Sends `mapping` as a `FieldMappingEntry[]` (the `{ Column: field }` shorthand cannot carry it) with `{ sourceField: 'Owner', targetField: 'owner', applyOn: 'create' }`: the column is written when the upsert creates the row and left out of the patch when it matches one; the other columns keep the default `applyOn: 'always'`. Keeps `writeMode: 'upsert'` and `matchFields: ['tax_id']`.",
	`58`	`+ "files": [],`
	`59`	`+ "assertions": {`
	`60`	`+ "must_contain": ["applyOn", "'create'", "sourceField", "targetField"],`
	`61`	`+ "must_not_contain": ["writeMode: 'insert'"]`
	`62`	`+ }`
`53`	`63`	`}`
`54`	`64`	`]`
`55`	`65`	`}`