@@ -0,0 +1,7 @@
+---
+'@objectstack/cli': minor
+---
+
+Ratify `./hook-body` as a public subpath export — `extractHookBody`, `HookBodyExtractionError`, `HookBodyRefusalKind` and `ExtractedBody` were reachable as a deep `dist/utils/extract-hook-body.js` import until #13123 sealed the surface, and an app's hook-body fidelity harness (hotcrm's `test/helpers/action-sandbox.ts`) consumes them to run the SAME body-only lowering `os build` ships through the real QuickJS runner, so a test executes what production executes rather than a lookalike. The #13123 body names exactly this remedy for an out-of-repo consumer — ratify the subpath as public surface rather than read `dist/` paths — and 17.3.0 applied it to `./console` for cloud's `objectos-runtime`; this applies it to the second consumer (#15325). `@objectstack/cli/hook-body` is a dedicated entry that re-exports those four names and nothing else; the deep `dist/` path stays sealed. Also admits `./package.json`, so the ordinary tooling idiom of reading a dependency's own manifest resolves again.
+
+`minor`, not `patch`: a new subpath on a published package's `exports` map is a purely additive widening of its public surface — a new accepted key — which takes at least `minor` under the maintainer's 2026-09-04 rule (decision batch #35, on #15294) in the Check Changeset step's "WHICH LEVEL" prose; the commit type never lowers it.
@@ -4684,6 +4684,39 @@ jobs:
       - name: Build workspace packages
         run: pnpm exec turbo run build --filter='./packages/*' --filter='./examples/*^...'
 
+      # CLI transcripts in content/docs are bound to the registries they quote
+      # (#15373). `content/docs` teaches with pasted CLI output, and some of those
+      # lines quote a number the CLI derives from a live registry at runtime —
+      # `Running author-time rules (42)...` is `authoringRulesFor(<command>).length`.
+      # The page wrote it as a literal; nothing derived it and nothing compared it,
+      # so it drifted on every rule added. Four published pages carried 41 against a
+      # registry holding 42, and what surfaced it was a customer-simulation upgrade
+      # run noticing the CLI printed something else. PR #15369 fixed the four
+      # numbers; this is the mechanism.
+      #
+      # ⚠ ORDER / PLACEMENT — this step is HERE, and not with the other docs gates
+      # in the `Lint & Repo Gates` job, for a measured reason. It derives the number
+      # the way the CLI does, by importing the BUILT @objectstack/lint, so it needs
+      # a dist/:
+      #
+      #   · `Lint & Repo Gates` runs `pnpm install` and NEVER builds. Placed there
+      #     the gate would exit 3 (PREREQUISITE NOT MET) on every CI run forever —
+      #     a gate that never measures, which is the shape #4642 named.
+      #   · ci.yml's `Build Core` builds, and hosts `check:dual-build-cjs-loads` for
+      #     exactly this reason, but it is gated on the `core` paths filter, which
+      #     does not include `content/**` — so it would skip the docs-only PRs that
+      #     ADD a stale transcript, the direction this gate exists for.
+      #   · This lane has NO paths filter, sits behind the required `TypeScript Type
+      #     Check` context, and the step above already built packages/lint.
+      #
+      # So it must stay AFTER `Build workspace packages`. It adds no build and no CI
+      # minutes; the scan is ~405 pages plus one dynamic import, ~0.4s. The gate's
+      # own header is the authority on the declaration syntax (fence meta, measured
+      # against the real fumadocs/MDX pipeline) and on why this is a COMPARE rather
+      # than a stamp. Runs its own --self-test first, through the alias.
+      - name: CLI transcripts in content/docs match the registry they quote
+        run: pnpm check:docs-transcript-drift
+
       # The per-package `typecheck` scripts the coverage gate above requires
       # (#4311). tsc resolves workspace imports through each dependency's built
       # dist/*.d.ts, so the task carries `dependsOn: ^build` in turbo.json —
 
@@ -444,7 +444,7 @@ os compile --json                    # JSON output for CI pipelines
 - `--json` — Output compile result as JSON (for CI)
 
 **Output example:**
-```
+```text transcript=os-build
 ◆ Compile
 ────────────────────────────────────────
   → Loading configuration...
 
@@ -548,7 +548,7 @@ runs the other two.
 
 A clean run walks the registry and reports timing:
 
-```
+```text transcript=os-validate
 ◆ Validate
 ────────────────────────────────────────
   → Loading configuration...
 
@@ -259,7 +259,7 @@ visible: 'status != "resolved"'
 
 `npm run validate` (which `AGENTS.md` tells the agent to run) refuses it:
 
-```
+```text transcript=os-validate
 ◆ Validate
 ────────────────────────────────────────
   → Validating against ObjectStack Protocol...
 
@@ -372,7 +372,7 @@ too:
 objectstack validate
 ```
 
-```
+```text transcript=os-validate
 ◆ Validate
 ────────────────────────────────────────
   → Loading configuration...