diff --git a/packages/spec/scripts/build-skill-references.ts b/packages/spec/scripts/build-skill-references.ts
index 366f82a360..b7c310ee98 100644
--- a/packages/spec/scripts/build-skill-references.ts
+++ b/packages/spec/scripts/build-skill-references.ts
@@ -125,7 +125,13 @@ const SKILL_MAP: Record<string, string[]> = {
     'api/endpoint.zod.ts',
     'api/auth.zod.ts',
     'api/realtime.zod.ts',
-    'api/rest-server.zod.ts',
+    // `api/rest-server.zod.ts` left this list: the SKILL.md never teaches it.
+    // Nothing in the skill's authored markdown names the file, `RestServerConfig`
+    // or any of its sub-configs, or the words "rest server", while every other
+    // core entry here is reachable from the body by at least one exported name.
+    // An index entry is a POINTER, and pointing at a schema the body cannot help
+    // with sends an agent into `node_modules` for a lesson that does not exist.
+    // The schema keeps existing and stays importable; only the false promise goes.
     'api/websocket.zod.ts',
     'api/errors.zod.ts',
     'api/batch.zod.ts',
@@ -169,6 +175,12 @@ const SKILL_MAP: Record<string, string[]> = {
   ],
   'objectstack-platform': [
     // project setup (was objectstack-quickstart)
+    // The body's main subject: it teaches `defineStack()` and names
+    // `ObjectStackDefinitionSchema`, `ObjectStackDefinition`,
+    // `ObjectStackDefinitionInput` and `ObjectStack` in its own prose, while the
+    // catalog had no pointer to the file that declares them. Taught, never
+    // advertised -- the other direction of the same rule.
+    'stack.zod.ts',
     'kernel/manifest.zod.ts',
     'data/datasource.zod.ts',
     'data/seed.zod.ts',
diff --git a/packages/spec/scripts/lib/skill-map-guards.ts b/packages/spec/scripts/lib/skill-map-guards.ts
index 2628cce06e..77a5524028 100644
--- a/packages/spec/scripts/lib/skill-map-guards.ts
+++ b/packages/spec/scripts/lib/skill-map-guards.ts
@@ -231,6 +231,15 @@ export function checkSingleOwner(map: SkillCoreMap, shared: Record<string, strin
  * whose face someone has actually read should carry one.
  */
 export const TRANSITIVE_ALLOWLIST: Record<string, readonly string[]> = {
+  // Kept iff `skills/objectstack-platform/SKILL.md` names one of the module's
+  // exported names, as an exact word-bounded identifier.
+  'objectstack-platform': [
+    'data/field.zod.ts',
+    'data/hook.zod.ts',
+    'data/object.zod.ts',
+    'security/rls.zod.ts',
+    'ui/app.zod.ts',
+  ],
   // Everything else the closure reaches here is `strictObject()`'s error-message
   // machinery and what that drags behind it -- the Unified Query DSL among them,
   // a different skill's whole subject, shipped into every i18n session with an
diff --git a/skills/objectstack-api/references/_index.md b/skills/objectstack-api/references/_index.md
index 8b33fb0488..a3e50816ce 100644
--- a/skills/objectstack-api/references/_index.md
+++ b/skills/objectstack-api/references/_index.md
@@ -14,7 +14,6 @@ from `node_modules` — there is no local copy in the skill bundle.
 - `node_modules/@objectstack/spec/src/api/endpoint.zod.ts` — Exports: ApiMappingSchema, ApiEndpointSchema, ApiEndpoint
 - `node_modules/@objectstack/spec/src/api/errors.zod.ts` — Standardized Error Codes Protocol
 - `node_modules/@objectstack/spec/src/api/realtime.zod.ts` — Exports: TransportProtocol, RealtimeEventType, SubscriptionEventSchema, SubscriptionSchema, RealtimePresenceSchema
-- `node_modules/@objectstack/spec/src/api/rest-server.zod.ts` — REST API Server Protocol
 - `node_modules/@objectstack/spec/src/api/versioning.zod.ts` — API Versioning Protocol
 - `node_modules/@objectstack/spec/src/api/websocket.zod.ts` — WebSocket Event Protocol
 
diff --git a/skills/objectstack-platform/references/_index.md b/skills/objectstack-platform/references/_index.md
index 425e1c90c6..02b7c7bb75 100644
--- a/skills/objectstack-platform/references/_index.md
+++ b/skills/objectstack-platform/references/_index.md
@@ -18,36 +18,15 @@ from `node_modules` — there is no local copy in the skill bundle.
 - `node_modules/@objectstack/spec/src/kernel/plugin-loading.zod.ts` — Plugin Loading Protocol
 - `node_modules/@objectstack/spec/src/kernel/plugin.zod.ts` — Exports: PluginContextSchema, PluginSchema
 - `node_modules/@objectstack/spec/src/kernel/service-registry.zod.ts` — Service Registry Protocol
+- `node_modules/@objectstack/spec/src/stack.zod.ts` — Exports: DatasourceMappingRuleSchema, ArtifactPackageEntrySchema, AssembledPackageBodySchema, ArtifactPackageSchema, ObjectStackDefinitionSchema
 
 ## Transitive dependencies
 
-- `node_modules/@objectstack/spec/src/api/errors.zod.ts` — Standardized Error Codes Protocol
-- `node_modules/@objectstack/spec/src/data/driver/common.zod.ts` — Shared building blocks for the per-driver `datasource.config` shapes.
-- `node_modules/@objectstack/spec/src/data/driver/config-registry.zod.ts` — The driver-id → `datasource.config` shape registry.
-- `node_modules/@objectstack/spec/src/data/driver/memory.zod.ts` — Memory Driver Configuration Schema
-- `node_modules/@objectstack/spec/src/data/driver/mongo.zod.ts` — MongoDB Standard Driver Protocol
-- `node_modules/@objectstack/spec/src/data/driver/mysql.zod.ts` — MySQL / MariaDB driver configuration — the `config` slot of a `datasource`
-- `node_modules/@objectstack/spec/src/data/driver/postgres.zod.ts` — PostgreSQL driver configuration — the `config` slot of a `datasource` whose
-- `node_modules/@objectstack/spec/src/data/driver/sqlite.zod.ts` — SQLite driver configuration — the `config` slot of a `datasource` whose
-- `node_modules/@objectstack/spec/src/data/driver/turso.zod.ts` — Turso / libSQL Driver Protocol.
-- `node_modules/@objectstack/spec/src/data/field-value.zod.ts` — Field runtime VALUE-shape contract (ADR-0104 D1).
 - `node_modules/@objectstack/spec/src/data/field.zod.ts` — Exports: FieldType, SelectOptionSchema, LocationCoordinatesSchema, CurrencyConfigSchema, CurrencyValueSchema
-- `node_modules/@objectstack/spec/src/data/filter.zod.ts` — Unified Query DSL Specification
-- `node_modules/@objectstack/spec/src/data/hook-body.zod.ts` — Exports: HookBodyCapability, ExpressionBodySchema, ScriptBodySchema, HookBodySchema
-- `node_modules/@objectstack/spec/src/kernel/cluster.zod.ts` — Cluster Protocol
-- `node_modules/@objectstack/spec/src/kernel/metadata-loader.zod.ts` — Metadata Manager Configuration
-- `node_modules/@objectstack/spec/src/kernel/metadata-protection.zod.ts` — Metadata Protection Model — Phase 1 (ADR-0010)
-- `node_modules/@objectstack/spec/src/shared/expression.zod.ts` — Expression Protocol
-- `node_modules/@objectstack/spec/src/shared/identifiers.zod.ts` — Exports: SystemIdentifierSchema, SnakeCaseIdentifierSchema, MetadataItemNameSchema
-- `node_modules/@objectstack/spec/src/shared/metadata-types.zod.ts` — Exports: MetadataFormatSchema, BaseMetadataRecordSchema
-- `node_modules/@objectstack/spec/src/shared/protection.zod.ts` — Package-level metadata protection (ADR-0010 §3.7 — Phase 4.3)
-- `node_modules/@objectstack/spec/src/shared/suggestions.zod.ts` — "Did you mean?" Suggestion Utilities
-- `node_modules/@objectstack/spec/src/shared/value-domain.zod.ts` — Standard value domains: one closed vocabulary and one membership predicate for settings and fields.
-- `node_modules/@objectstack/spec/src/system/tenant.zod.ts` — Tenant Schema (Multi-Tenant Architecture)
-- `node_modules/@objectstack/spec/src/ui/action-params.zod.ts` — The action DISPATCH contract: what the platform validates on the way in, and
-- `node_modules/@objectstack/spec/src/ui/action.zod.ts` — Exports: ActionParamSchema, ActionType, ActionLocationSchema, ActionAiSchema, ActionSchema
+- `node_modules/@objectstack/spec/src/data/hook.zod.ts` — Exports: HookEvent, HookSchema, HookContextSchema
+- `node_modules/@objectstack/spec/src/data/object.zod.ts` — Exports: ApiMethod, ApiOperationSchema, ObjectCapabilities, IndexSchema, TenancyConfigSchema
+- `node_modules/@objectstack/spec/src/security/rls.zod.ts` — Row-Level Security (RLS) Protocol
 - `node_modules/@objectstack/spec/src/ui/app.zod.ts` — Exports: ObjectNavItemSchema, DashboardNavItemSchema, PageNavItemSchema, UrlNavItemSchema, ReportNavItemSchema
-- `node_modules/@objectstack/spec/src/ui/i18n.zod.ts` — Display-label and ARIA-label primitives shared by every `ui/` shape.
 
 ## How to read these