@@ -0,0 +1,14 @@
+---
+"create-objectstack": patch
+---
+
+fix(create-objectstack): the blank template's `engines.protocol` is stamped from the protocol major, not the package major
+
+Clause-②: no
+
+`engines.protocol` in the scaffolded `objectstack.config.ts` is the range the runtime's protocol handshake checks before it loads the project.
+
+- The release stamp (`scripts/sync-template-versions.mjs`) used to write it from create-objectstack's own major. It now writes the major of `PROTOCOL_VERSION`, the value the handshake compares against. The two differ while the protocol moves ahead of a release: in that window the unreleased template declared `'^17'` beside a protocol-18 runtime, which refused to load the project it scaffolded.
+- The template now declares `'^18'`, written by that stamp rather than by hand.
+- Unchanged: `specVersion` and the `@objectstack/*` dependency ranges still carry the package range.
+- No released version shipped the mismatch. A project you scaffolded earlier keeps its own range; to move it to protocol 18, run `objectstack migrate meta --from 17 --write`, which rewrites `engines.protocol` with the rest of the step.
@@ -16,6 +16,7 @@ import { copyDir, TEMPLATE_FILE_ALIASES } from './template-copy.js';
 import { TEMPLATES } from './template-registry.js';
 import { gitFreeEnv } from '../../../scripts/git-env.mjs';
 import { SKILLS_CATALOG, SKILLS_INSTALL_COMMAND } from './skills-install.js';
+import { PROTOCOL_MAJOR, PROTOCOL_VERSION } from '@objectstack/spec/kernel';
 
 const pkgRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const repoRoot = path.resolve(pkgRoot, '..', '..');
@@ -191,7 +192,17 @@ describe('bundled template declared version surfaces', () => {
     // `objectstack.manifest.json` — the two were conflated in this suite's own
     // naming and in the sync script's log strings, and that conflation is part
     // of how the sibling key below went unwatched for eleven majors.
-    it("objectstack.config.ts stamps engines.protocol at the scaffolder's major (ADR-0087 D1)", () => {
+    //
+    // NOTE the value: the PROTOCOL major, judged against `PROTOCOL_VERSION` —
+    // the constant the runtime's ADR-0087 D1 handshake compares a scaffolded
+    // project's range to — and NOT against this package's own major. The two
+    // differ for the whole pre-mode window in which the protocol moves ahead of
+    // the version pass (packages at 17.x beside protocol 18): judged against the
+    // package major, a template the runtime refuses at boot stayed green here.
+    // `@objectstack/spec/kernel` resolves to the spec's SOURCE through this
+    // package's vitest alias, so the verdict needs no build — it runs on the
+    // release path's post-version tree, where nothing has been built.
+    it('objectstack.config.ts stamps an engines.protocol that PROTOCOL_VERSION satisfies (ADR-0087 D1)', () => {
       const config = readTemplateFile('objectstack.config.ts');
       const match = /engines:\s*\{\s*protocol:\s*'\^(\d+)'\s*\}/.exec(config);
       expect(
@@ -200,9 +211,10 @@ describe('bundled template declared version surfaces', () => {
       ).not.toBeNull();
       expect(
         Number(match![1]),
-        `${template} stamps engines.protocol '^${match![1]}' but create-objectstack is v${ownMajor} — ` +
-          'scripts/sync-template-versions.mjs re-stamps this at version time; keep them in lockstep',
-      ).toBe(ownMajor);
+        `${template} stamps engines.protocol '^${match![1]}', which PROTOCOL_VERSION ${PROTOCOL_VERSION} does not ` +
+          'satisfy: every project it scaffolds is refused at the protocol handshake by the runtime it ships ' +
+          'with. Run `node scripts/sync-template-versions.mjs` — it stamps this key from PROTOCOL_VERSION\'s major.',
+      ).toBe(PROTOCOL_MAJOR);
     });
 
     // The key #9264 is about. Required by TemplateManifestSchema, read by the
 
@@ -25,7 +25,10 @@
 // re-found the day a second template ships.
 //
 // The same fixture is deliberately built STALE (pinning ^17 while its
-// scaffolder reads 42.0.0). That makes the import-safety assertion non-vacuous
+// scaffolder reads 42.0.0 and its PROTOCOL_VERSION reads 43.0.0 — two majors,
+// because `engines.protocol` is stamped from the protocol constant and every
+// other surface from the package, and with the two equal a stamp read from the
+// wrong source would pass). That makes the import-safety assertion non-vacuous
 // in the one way that matters: an unguarded module imported against a stale
 // tree REWRITES it, so "the files are byte-identical after import" is evidence
 // only when there was something for a rewrite to do. Byte-identity over an
@@ -62,6 +65,7 @@ type SyncModule = {
   findTemplateDirs: (templateRoot?: string) => string[];
   stampedPaths: (options?: { root?: string }) => string[];
   loadScaffolderVersion: (file?: string) => { version: string; major: string; range: string };
+  loadProtocolMajor: (file?: string) => { source: string; protocolMajor: string };
 };
 
 const loadSync = async (file = SYNC_SCRIPT): Promise<SyncModule> =>
@@ -75,6 +79,11 @@ let fixtureScript: string;
 
 /** Deliberately not the live version, so a stamp that ran is unmistakable. */
 const FIXTURE_VERSION = '42.0.0';
+/**
+ * The fixture's PROTOCOL major — one ahead of its package major, the shape the
+ * pre-mode window leaves in the real tree. `engines.protocol` must move to THIS.
+ */
+const FIXTURE_PROTOCOL_MAJOR = '43';
 /** Deliberately stale: every fixture surface pins this and must move to 42. */
 const STALE_MAJOR = '17';
 
@@ -140,6 +149,11 @@ beforeAll(() => {
     path.join(fixture, 'packages', 'create-objectstack', 'package.json'),
     JSON.stringify({ name: 'create-objectstack', version: FIXTURE_VERSION }, null, 2) + '\n',
   );
+  // The protocol major's one source, in the shape the real constant spells it.
+  writeFixtureFile(
+    path.join(fixture, 'packages', 'spec', 'src', 'kernel', 'protocol-version.ts'),
+    `export const PROTOCOL_VERSION = '${FIXTURE_PROTOCOL_MAJOR}.0.0';\n`,
+  );
 
   for (const template of FIXTURE_TEMPLATES) {
     const dir = fixtureTemplateDir(template);
@@ -215,6 +229,7 @@ describe('sync-template-versions.mjs is import-safe', () => {
     expect(typeof sync.stampedPaths).toBe('function');
     expect(typeof sync.findTemplateDirs).toBe('function');
     expect(typeof sync.loadScaffolderVersion).toBe('function');
+    expect(typeof sync.loadProtocolMajor).toBe('function');
     expect(Array.isArray(sync.TEXT_STAMPS)).toBe(true);
     expect(sync.TEXT_STAMPS.length).toBeGreaterThan(0);
     expect(sync.TEMPLATE_DIR).toBe('packages/create-objectstack/src/templates');
@@ -249,9 +264,10 @@ describe('the entry-point guard leaves the CLI path working', () => {
         'a non-@objectstack dependency is never touched',
       ).toBe('^6.0.0');
 
-      expect(fs.readFileSync(path.join(dir, 'objectstack.config.ts'), 'utf8')).toContain(
-        "engines: { protocol: '^42' }",
-      );
+      expect(
+        fs.readFileSync(path.join(dir, 'objectstack.config.ts'), 'utf8'),
+        `${template}/objectstack.config.ts engines.protocol moves to the PROTOCOL major, not the package major`,
+      ).toContain(`engines: { protocol: '^${FIXTURE_PROTOCOL_MAJOR}' }`);
 
       const manifest = fs.readFileSync(path.join(dir, 'objectstack.manifest.json'), 'utf8');
       expect(manifest).toContain('"specVersion": "^42.0.0"');
 
@@ -36,7 +36,7 @@ export default defineStack({
     // match the ObjectStack version you installed — change it when you
     // deliberately move to a new protocol major, not to silence a mismatch.
     // Guide: https://objectstack.ai/docs/upgrading
-    engines: { protocol: '^17' },
+    engines: { protocol: '^18' },
   },
 
   // `automation` backs flow execution and materializes any declarative