@@ -2265,23 +2265,6 @@ jobs:
         continue-on-error: true
         run: pnpm check:i18n-stale-fill
 
-      # #6319: content/docs/getting-started/quick-reference.mdx is the protocol
-      # index, and each "## <Name> Protocol (N schemas)" heading is a DECLARATION
-      # about the table under it. The page is hand-written (build-docs.ts writes
-      # only content/docs/references/), so the two drift one edit at a time —
-      # #6319 found Kernel claiming 17 over a 15-row table because two kernel
-      # rows had migrated into the Cloud section and only Cloud's heading was
-      # updated. Nothing breaks at runtime; the cost is that content/docs/ is the
-      # corpus humans and AIs copy from, so a miscounted index is read as a fact
-      # about the schema catalog. Declared = enforced.
-      # It lives in this job with the other docs guards: the change that breaks
-      # the count is a docs edit, so a packages/** paths filter would blind it to
-      # its own failure mode.
-      - name: Quick-reference section counts match their tables
-        id: quick-reference-section-counts-match
-        continue-on-error: true
-        run: pnpm check:quick-reference-counts
-
       # #17388: three hand-written pages enumerate @objectstack/spec's importable
       # subpaths or its protocol namespaces, and nothing read any of them. When
       # #16325 step 3 deleted the ./cloud exports entry and added ./marketplace,
@@ -2291,8 +2274,8 @@ jobs:
       # kept advertising cloud and never listed marketplace, until a human swept
       # for them. Step 2 of that same chain was FAILed in review by exactly this
       # class of unlisted counter.
-      # It holds TWO derived sets, not one: the exports map's 16 bare ./<name>
-      # entries, and the 15 of those whose declared CATEGORY_TITLES title ends in
+      # It holds TWO derived sets, not one: the exports map's bare ./<name>
+      # entries, and those of them whose declared CATEGORY_TITLES title ends in
       # " Protocol" (meta-spelling is a subpath and is titled "Vocabulary", not a
       # protocol). Display names come from that same declaration, so the #5853
       # "Qa Protocol" class of wrong-but-stable spelling is a finding here too.
@@ -2998,22 +2981,6 @@ jobs:
       - name: Setup workspace
         uses: ./.github/actions/setup-workspace
 
-      # Lockstep package-count guard (#17039). `.changeset/config.json`'s
-      # `fixed` array is the one true count of packages one stray `major`
-      # promotes; check-changeset-fixed.mjs (release/RC workflows) already
-      # gates that array against the real workspace. Nothing gated the THREE
-      # prose restatements of the array's length — two sentences in
-      # content/docs/protocol/backward-compatibility.mdx and one header
-      # comment in scripts/publish-smoke-pack.mjs — so all three drifted
-      # silently (69 written, 70 true) the day a package joined the group.
-      # Full-repo state, not diff-shaped, so — unlike the changeset-family
-      # self-tests (`lint-docs-code`) —
-      # this runs its real check every time, unconditionally.
-      - name: Lockstep package-count guard
-        id: lockstep-package-count-guard
-        continue-on-error: true
-        run: pnpm check:lockstep-package-count
-
       # Route-ledger census guard (#16758). `packages/runtime/src/route-ledger.ts`
       # is census-shaped: its value is the completeness of a list, and nothing in
       # this tree read its row COUNT. An index-slice edit meant to add two rows
 
@@ -120,7 +120,7 @@ later ships. See [ADR-0070](https://github.com/objectstack-ai/objectstack/blob/m
 | `job` | ❌ | **Also `allowRuntimeCreate: false` since protocol 17** (#4509). `JobSchema.handler` names a function in the compiled bundle's function table, which a runtime writer has no way to reach — so a job created in Studio or through `PUT /meta` parsed, saved, reported success and was never scheduled. The door is closed rather than bridged: `job` stays first-class through `*.job.ts` / `defineStack({ jobs, functions })`, where every schedule shape, `retryPolicy` and `timeout` does reach the scheduler. Existing rows are untouched — they were never scheduled — and `migrateStoredMetadata` reports them `skipped`. |
 | `sharing_rule` | ❌ | **Also `allowRuntimeCreate: false` since protocol 18** (ADR-0131 D6, regime C). A sharing rule has two sources: a package declares it (the stack's `sharingRules`, switched off through the activation ledger), or an organization authors its own through `POST /api/v1/sharing/rules`, behind the same-name guard and the organization wall. A runtime `sys_metadata` item was a third source that bypassed both, so `PUT /meta/sharing_rule/:name` now answers `403 NOT_CREATABLE` (`NOT_OVERRIDABLE` over a declared rule) and names the two sanctioned paths: author an organization rule, or clone the declared one and switch it off. Items stored before the change are still served until deleted. |
 
-Those five are the **complete** `allowEnvironmentOverlay: true` set: of the 29 types in `DEFAULT_METADATA_TYPE_REGISTRY`, every other one is `false`. The ❌ rows above are the `false` types whose *second* tier (`allowRuntimeCreate`) is worth calling out; any type not listed is `allowEnvironmentOverlay: false`.
+The types in the ✅ row are the **complete** `allowEnvironmentOverlay: true` set: every other type in `DEFAULT_METADATA_TYPE_REGISTRY` is `false`. The ❌ rows above are the `false` types whose *second* tier (`allowRuntimeCreate`) is worth calling out; any type not listed is `allowEnvironmentOverlay: false`.
 
 There is no `workflow` metadata type (per [ADR-0020](https://github.com/objectstack-ai/objectstack/blob/main/docs/adr/0020-state-machine-converge-and-enforce.md), record state machines are a `state_machine` validation). Nor is there a standalone `validation` type any more — it was retired in protocol 17 under [ADR-0088](https://github.com/objectstack-ai/objectstack/blob/main/docs/adr/0088-metadata-kind-admission-and-retirement.md) because `ValidationRuleSchema` carries no object-binding key, so a rule authored through that door could never say what it protected; author rules in the object's own `validations[]` instead. The runtime gate is implemented in `OVERLAY_ALLOWED_TYPES` (derived from the registry) and enforced by `SysMetadataRepository.put()`.
 
 
@@ -9,16 +9,16 @@ To navigate the ObjectStack ecosystem effectively, it is helpful to understand t
 ## The Ecosystem
 
 ### ObjectStack
-The umbrella term for the entire suite of protocols and reference implementations. It is organized into **15 protocol namespaces** grouped into three architectural layers.
+The umbrella term for the entire suite of protocols and reference implementations. It is organized into **protocol namespaces** grouped into three architectural layers.
 
 ### Protocol Namespace
-A logical grouping of related schemas and types defined with Zod. ObjectStack has 15 protocol namespaces: Data, UI, System, Automation, AI, API, Identity, Security, Kernel, Marketplace, QA, Contracts, Integration, Studio, and Shared.
+A logical grouping of related schemas and types defined with Zod. ObjectStack has these protocol namespaces: Data, UI, System, Automation, AI, API, Identity, Security, Kernel, Marketplace, QA, Contracts, Integration, Studio, and Shared.
 
 ---
 
 ## The Three Architectural Layers
 
-The 15 namespaces collapse into three top-level layers:
+The namespaces collapse into three top-level layers:
 
 | Layer | Also called | Namespaces it includes | Purpose |
 | :--- | :--- | :--- | :--- |
@@ -30,7 +30,7 @@ Older docs and talks used **ObjectOS** as the name of this control layer. That n
 
 ---
 
-## The 15 Protocol Namespaces
+## The Protocol Namespaces
 
 ### Data Protocol
 Defines the core business data model. Includes Object schema, Field types, Validation rules, Query AST, and Filter conditions. This is the foundation of ObjectQL.
 
@@ -11,18 +11,15 @@ Fast lookup for the ObjectStack protocols organized by category.
 Click on any protocol name to view its complete API reference.
 </Callout>
 
-**Reading the counts.** Every heading below says `(N of M schemas)`. **N** is how many
-protocols this table lists; **M** is how many reference pages the matching
-`content/docs/references/<category>/` directory publishes. These tables are a *curated*
-fast lookup, not a mirror of the reference tree — `N < M` is normal and intended. Both
-numbers are checked by `pnpm check:quick-reference-counts`, so a category that gains or
-loses a page shows up here instead of drifting unnoticed. A row marked ↗ links outside
-its category's reference tree: it is one of the N rows, but it is not one of the M pages.
-Categories that have no section here at all are named under
+**Reading the tables.** Each table below is a *curated* fast lookup, not a mirror of the
+reference tree: it lists the protocols a beginner reaches for first, and a category usually
+publishes more reference pages than its table shows. The complete set for every category is on
+the [reference index](/docs/references). A row marked ↗ links outside its category's reference
+tree. Categories that have no section here at all are named under
 [Categories Without a Section](#categories-without-a-section) — that curation is stated,
 not left implicit.
 
-## Data Protocol (15 of 31 schemas)
+## Data Protocol
 
 Core business logic and data modeling schemas.
 
@@ -44,7 +41,7 @@ Core business logic and data modeling schemas.
 | **[Postgres Driver](/docs/references/data/driver-postgres)** | `driver/postgres.zod.ts` | PostgresConfig | PostgreSQL configuration |
 | **[Mongo Driver](/docs/references/data/driver-mongo)** | `driver/mongo.zod.ts` | MongoConfig | MongoDB configuration |
 
-## UI Protocol (10 of 16 schemas)
+## UI Protocol
 
 Presentation layer - views, forms, dashboards, and app branding.
 
@@ -61,7 +58,7 @@ Presentation layer - views, forms, dashboards, and app branding.
 | **[Chart](/docs/references/ui/chart)** | `chart.zod.ts` | Chart, ChartType | Chart definitions |
 | **[Widget Contract](/docs/protocol/objectui/widget-contract)** ↗ | `widget.zod.ts` | FieldWidgetProps | Props a custom field widget receives — the contract is documented with ObjectUI, outside `references/ui/` |
 
-## Kernel Protocol (17 of 29 schemas)
+## Kernel Protocol
 
 Plugin architecture, manifests, and kernel runtime.
 
@@ -85,7 +82,7 @@ Plugin architecture, manifests, and kernel runtime.
 | **[Metadata Loader](/docs/references/kernel/metadata-loader)** | `metadata-loader.zod.ts` | MetadataLoaderContract | Metadata loading |
 | **[Package Registry](/docs/references/kernel/package-registry)** | `package-registry.zod.ts` | InstalledPackage, InstallPackageRequest | Package resolution |
 
-## System Protocol (16 of 37 schemas)
+## System Protocol
 
 Runtime environment, logging, jobs, caching, and observability.
 
@@ -108,7 +105,7 @@ Runtime environment, logging, jobs, caching, and observability.
 | **[Translation](/docs/references/system/translation)** | `translation.zod.ts` | Translation | i18n support |
 | **[Worker](/docs/references/system/worker)** | `worker.zod.ts` | Worker | Background workers |
 
-## AI Protocol (11 of 12 schemas)
+## AI Protocol
 
 AI/ML capabilities - agents, skills, tools, MCP exposure, RAG, and cost tracking.
 
@@ -126,7 +123,7 @@ AI/ML capabilities - agents, skills, tools, MCP exposure, RAG, and cost tracking
 | **[Usage](/docs/references/ai/usage)** | `usage.zod.ts` | AIUsageRecord, TokenUsage | AI usage and cost tracking |
 | **[Solution Blueprint](/docs/references/ai/solution-blueprint)** | `solution-blueprint.zod.ts` | BlueprintObject, BlueprintApp | Blueprint format for AI app generation |
 
-## API Protocol (17 of 32 schemas)
+## API Protocol
 
 REST endpoints, real-time subscriptions, and discovery.
 
@@ -150,7 +147,7 @@ REST endpoints, real-time subscriptions, and discovery.
 | **[Metadata](/docs/references/api/metadata)** | `metadata.zod.ts` | Metadata | API metadata endpoints |
 | **[Storage](/docs/references/api/storage)** | `storage.zod.ts` | Storage | API storage operations |
 
-## Automation Protocol (3 of 14 schemas)
+## Automation Protocol
 
 Flows, approvals, and integrations. A record's lifecycle transitions are a `state_machine` validation rule on the object (see [State Machine](/docs/protocol/objectql/state-machine)).
 
@@ -160,7 +157,7 @@ Flows, approvals, and integrations. A record's lifecycle transitions are a `stat
 | **[Approval](/docs/references/automation/approval)** | `approval.zod.ts` | ApprovalNodeConfig | Flow approval-node config |
 | **[Webhook](/docs/references/automation/webhook)** | `webhook.zod.ts` | Webhook | Outbound webhooks |
 
-## Security Protocol (3 of 5 schemas)
+## Security Protocol
 
 Access control, permissions, and row-level security.
 
@@ -170,7 +167,7 @@ Access control, permissions, and row-level security.
 | **[RLS](/docs/references/security/rls)** | `rls.zod.ts` | RowLevelSecurityPolicy | Row-level security filters |
 | **[Sharing](/docs/references/security/sharing)** | `sharing.zod.ts` | SharingRule | Record sharing rules |
 
-## Identity Protocol (4 of 5 schemas)
+## Identity Protocol
 
 User identity, organizations, and position management.
 
@@ -181,7 +178,7 @@ User identity, organizations, and position management.
 | **[Position](/docs/references/identity/position)** | `position.zod.ts` | Position | Permission-set distribution (岗位, ADR-0090) |
 | **[SCIM](/docs/references/identity/scim)** | `scim.zod.ts` | SCIMUser, SCIMGroup | SCIM 2.0 provisioning |
 
-## Marketplace Protocol (2 of 4 schemas)
+## Marketplace Protocol
 
 The package & marketplace format — what a package author publishes and what the
 marketplace answers with. (The cloud control plane's own contracts — environments,
@@ -194,7 +191,7 @@ cloud repo beside their producer.)
 | **[Package](/docs/references/marketplace/package)** | `package.zod.ts` | Package, CreatePackageRequest, PackageTranslations | Package identity and listing text |
 | **[Marketplace](/docs/references/marketplace/marketplace)** | `marketplace.zod.ts` | MarketplaceListing, PackageSubmission | Plugin marketplace |
 
-## Integration Protocol (1 of 1 schema)
+## Integration Protocol
 
 External system connectors — one protocol (ADR-0097): a connector entry is
 either a catalog descriptor or a provider-bound instance that a generic
@@ -207,7 +204,7 @@ from the provider itself, not from hand-written spec files.
 |:---------|:-----------|:------------|:--------|
 | **[Connector](/docs/references/integration/connector)** | `connector.zod.ts` | Connector | The connector protocol — auth, sync, webhooks, rate limiting |
 
-## Shared Protocol (5 of 10 schemas)
+## Shared Protocol
 
 Common utilities used across all protocols.
 
@@ -219,7 +216,7 @@ Common utilities used across all protocols.
 | **[Mapping](/docs/references/shared/mapping)** | `mapping.zod.ts` | FieldMapping | Field mapping utilities |
 | **[Connector Auth](/docs/references/integration/connector)** ↗ | `connector-auth.zod.ts` | ConnectorInstanceAuth | Declarative connector auth (ADR-0097). The file sits in `src/shared/` but `@objectstack/spec/shared` does not publish it — it reaches consumers through `@objectstack/spec/integration`, so it is documented on the Connector page |
 
-## QA Protocol (1 of 1 schema)
+## QA Protocol
 
 Testing and quality assurance.
 
@@ -229,14 +226,13 @@ Testing and quality assurance.
 
 ## Categories Without a Section
 
-`content/docs/references/` holds one more category directory that deliberately gets no
+These category directories under `content/docs/references/` deliberately get no
 section above. Curation happens at the category level as well as inside each table, and
-this is where it is stated. The same gate reads this table, so a new category directory —
-or a page landing in this one — goes red until this page is updated.
+this is where it is stated.
 
-| Category directory | Pages | Why it has no section |
-|:---|---:|:---|
-| [`studio`](/docs/references/studio) | 3 | Designer-facing metadata (`flow-builder`, `object-designer`, `plugin`) — Studio's own authoring surfaces, not protocols an app declares. Reach them from the [reference index](/docs/references). |
+| Category directory | Why it has no section |
+|:---|:---|
+| [`studio`](/docs/references/studio) | Designer-facing metadata (`flow-builder`, `object-designer`, `plugin`) — Studio's own authoring surfaces, not protocols an app declares. Reach them from the [reference index](/docs/references). |
 
 ---
 
 
@@ -116,7 +116,7 @@ Read the **Breaking?** column, not the version number: in the 17.x minors every
 1. **RFC (Request for Comments)** — Breaking changes are proposed as GitHub issues with the `protocol:breaking` label.
 2. **Deprecation** — The old behavior is deprecated in a MINOR release (see timeline above).
 3. **Migration Guide** — A detailed migration guide is published before the removal lands, in the release notes for the version that carries it.
-4. **Release** — In the 17.x minors the breaking change shipped in the next **MINOR** version, carrying a changeset entry marked `**BREAKING**`, and `scripts/check-changeset-no-major.mjs` failed a pull request that declared a `major` bump, because under lockstep one `major` would promote all 110 published packages. During the v18 prerelease it shipped in the next `18.0.0-next.N`, because the guard stood aside in pre mode and a pull request could declare a major bump. Changesets has exited pre mode, so the guard fails a `major` bump again. See [how a breaking stage lands on the v18 line](/docs/releases/v18#how-a-breaking-stage-lands-on-this-line).
+4. **Release** — In the 17.x minors the breaking change shipped in the next **MINOR** version, carrying a changeset entry marked `**BREAKING**`, and `scripts/check-changeset-no-major.mjs` failed a pull request that declared a `major` bump, because under lockstep one `major` would promote every published package. During the v18 prerelease it shipped in the next `18.0.0-next.N`, because the guard stood aside in pre mode and a pull request could declare a major bump. Changesets has exited pre mode, so the guard fails a `major` bump again. See [how a breaking stage lands on the v18 line](/docs/releases/v18#how-a-breaking-stage-lands-on-this-line).
 
 ---
 
@@ -196,7 +196,7 @@ The `@objectstack/spec` package provides additional stability guarantees:
 
 ### Which surfaces this covers
 
-**All of them.** It was not scoped to an experimental corner or a pre-release channel: all **110** packages published from this repository belong to a single Changesets `fixed` group, so they share one version number and one policy. No published surface was exempt.
+**All of them.** It was not scoped to an experimental corner or a pre-release channel: every package published from this repository belongs to a single Changesets `fixed` group, so they all share one version number and one policy. No published surface was exempt.
 
 The convention was enforced rather than informal — `scripts/check-changeset-no-major.mjs` failed a pull request that introduced a `major` bump, because under lockstep a single `major` on one package would promote the entire stack. During the v18 prerelease Changesets was in pre mode with the tag `next` and the guard stood aside, so a pull request on the v18 line could declare a major bump. Changesets has exited pre mode, and the guard fails a `major` bump again.