skills-sweep ②: objectstack-data (4,935 lines, 12 files) — behavioral-claim verification, tables execution-first; up to three sequential PRs at whole-file boundaries

[zhuangjianguo]

Member ② of program anchor #13658. Scope: skills/objectstack-data/** — 12 .md files, 4,935 lines, the largest package and the same semantic family as the proven $exists false row.

Method, verdicts, non-vacuity control, PR shape: per the anchor, updated by flight ①'s calibration (its comment on the anchor): inventory the whole package first; verify surfaces/mapping tables with executed probes FIRST (measured 8× falsehood concentration there), prose classes after. Watch for flight ①'s falsehood flavors: retired-surface rows outliving ADR-0049 removals · phantom fields with zero repo-wide hits · slot-semantics overclaims (auto-wrap vs literal) · unshipped-path pointers.

Delivery shape for this size: up to three sequential draft PRs at whole-file boundaries — earlier PRs reference this card Part of (zero closing verbs adjacent); only the final PR carries Fixes. Each PR: its own gates run, its own per-item 落点|before|after table, token-ratchet byte-neutral-or-shrinking, ⛔ no ceiling raises.

Ground truth: @objectstack/spec data schemas, driver implementations (driver-memory/driver-sql/driver-mongodb), objectql, and their executed test surfaces; filter-logic-conformance.ts is the settled-semantics reference for filter claims. Governed surface: drafts, human merge.

Generated by Claude Code

[zhuangjianguo]

Claim: PM loop round 7 — dispatch (program #13658 flight ②)
Session: session_01EXxTW8mvPBhoHxmyPZ63de
Branch: claude/issue-13675-data-skill-sweep (later PRs in the sequence may use -2/-3 suffixed branches; each declared in its PR)
Worktree: objectstack-issue-13675
Domain: domain:skills
File surface: skills/objectstack-data/** (.md) ONLY for edits; implementation + tests read-only as evidence (an implementation defect found = FINDING filed unassigned, ⛔ never fixed in these PRs). Stop on breach.
Container & model: M, mode:subagent, model: opus — no path mandate; claim adjudication at flight-①'s proven method ⇒ default opus.
Clause-②: yes | no — no (published claim text; no contract behavior change)
Serial constraints cleared: skills/objectstack-data/** has no in-flight or queued holder; disjoint from PR #13577 (query) and PR #13674 (formula). Token ratchet byte-neutral-or-shrinking per file. Batch: #13650 (H19) + this = 2/3 (formula flight delivered). Closing: earlier PRs Part of this card with zero closing verbs adjacent; final PR Fixes #13675.

---

Generated by Claude Code

[zhuangjianguo]

PR 1/3 ACCEPT — reviewer: skills lane seat (contract-review tier, diff personally verified against all six claimed corrections). PR #13687, head 2d9e2a02c, draft on the manual lane, hotlong being requested. Flight continues to PR 2 (SKILL.md) — nothing to redo.

Review notes for the record: the two highest-consequence corrections are (1) the unknown-key posture inversion — the skill taught "silently stripped, harmless" where the parser REFUSES with unrecognized_keys, and the error's own text documents the retirement of the old behavior the skill was still describing; (2) the roll-up matrix cell — "Not available on lookup" measured false by an executed engine probe, and the false row actively pushed authors toward converting independent-lifecycle relationships into cascade-delete master_detail. The 「tree」 row correctly left NOT MEASURABLE rather than corrected on inference. Deletion-funded ratchet compliance verified from the gate's own verdict lines (three files all within ceilings, headroom 6/1/5).

Calibration refinement ADOPTED for flights ③–⑫ (to be folded into the anchor at flight end): the concentration target is the content class — "what is automatic / what keys exist / what is retired" assertions — not markdown-rendered tables (by rendering, this PR mildly inverts flight ①'s 8×; by content class, 5 of 6 fit). Second cheap candidate-finder confirmed: cross-file contradiction inside a package (2 of 6 found that way, then settled against the implementation).

---

Generated by Claude Code

[claude]

os-dev-report

{
 "issue": 13675,
 "status": "rework",
 "branch": "claude/issue-13675-data-skill-sweep",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/13687",
 "premise_still_valid": true,
 "summary": "PR 1 of up to 3 delivered as draft #13687 - whole-file boundary over the three densest table/surface files: rules/field-types.md, rules/relationships.md, rules/indexing.md (1,219 of the package's 4,935 lines). Six behavioral claims measured FALSE and corrected, each against the implementation and each with an executed probe: (1) field-types.md said an unknown field key is 'silently stripped at parse (dead metadata)' - FieldSchema REFUSES it with unrecognized_keys, and the error's own text names silent-dropping as the RETIRED behaviour; (2) the same claim restated for vectorConfig; (3) the autonumber rule promised an unrecognized token is emitted literally while naming {yyyy} as one - {yyyy} actually parses as a {field} reference and renders EMPTY, becoming a phantom required-field reference; (4) the relationship matrix said roll-ups are 'Not available' on lookup - a summary over a lookup child computes (measured 42/2), and the false row pushed authors from lookup to cascade-delete master_detail; (5) 'master_detail - Always required' is enforced only under sharingModel controlled_by_parent, elsewhere it is a lint warning; (6) indexing.md claimed foreign keys are auto-indexed in three places - they are not, measured [] from both uniqueIndexesFromFields and expectedIndexes against a live control. All three files SHRINK under the token ratchet (-6/-5/-1 tokens); no ceiling raised. PRs 2 (SKILL.md) and 3 (data-hooks.md plus the remaining rule files) still to come in this session.",
 "tests": "All readings at head 2d9e2a02c (the final commit of PR 1); gate family derived from the real diff with `node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack`, harvested with --commands so both invocation spellings survive. 13 families, exit codes captured BEFORE any pipe (each command redirected to its own file, then read): 12 green, 1 NOT MEASURED. Green: check-ci-filter-parity, check-cross-package-test-inputs, check-shard-attestation, check-skills-token-ratchet, check:doc-formula-expressions (after building @objectstack/formula + @objectstack/lint - its first run was a prerequisite miss, not a finding), check:agent-test-spelling, check:cross-package-test-inputs, check:doc-authoring, check:pm-governed-merges, check:role-word, check:skill-compatibility, check:skill-frame-sync. NOT MEASURED: `node scripts/check-test-completeness.mjs` EXIT=3, its own verdict line reading 'PREREQUISITE NOT MET - this gate grades a saved `turbo run test` log, and no log was named'. Ratchet verdict lines quoted: 'field-types.md is 3578 tokens (ceiling 3584; headroom 6)', 'indexing.md is 3240 (ceiling 3241; headroom 1)', 'relationships.md is 3773 (ceiling 3778; headroom 5)', '38 authored bundle file(s) within their ceilings'. check-nul-bytes: 'OK (scanned 7555 text file(s) ... no raw ASCII control bytes)', plus a direct control-byte grep over the three changed files with no hits. NON-VACUITY CONTROL, five claims proven true by execution: FieldType.options length 49 with zero set-difference against the skill's own enumeration in both directions; organizationKeyPartSql => \"COALESCE(organization_id, '__global__')\" matching the unique-scope table byte for byte; buildIndexName(account,[status,created_at],false) => idx_account_status_created_at matching the stated pattern; the autonumber token table rendered row by row at a pinned now (CASE-0042, AD202606170001, PLAN-001001, 001/999/1000, and the rule-2 scope collision 'ABC' for both (AB,C) and (A,BC) with the delimited form separating them); and all 49 rows' config keys accepted and retained by FieldSchema, with the enum columns pinned by rejection too (returnType refuses 'currency', summary function refuses 'median', currencyMode refuses all but dynamic|fixed, unique refuses 'tenant'/'org' by name). Each FALSE claim carries its own measurement, several with a live control: the FK finding returns [] for foreign keys while the same probe returns a real index for a field-level unique; the master_detail finding ACCEPTs required:false under every sharing model except controlled_by_parent, which THROWs. The lookup-rollup probe ran as a throwaway vitest file reusing summary-rollup.test.ts's own driver stub, under the shared verify lock: 'Test Files 1 passed (1) / Tests 1 passed (1)', printing 'MEASURED lookup-child rollup => {\"opp_total\":42,\"opp_count\":2}'. All probes were deleted before the commit - evidence, not commits; `git status --porcelain` was clean of them and the diff is exactly the three .md files. ESLint NOT run repo-wide; the narrowing is measured with all three required readings: (1) population read from eslint.config.mjs itself - every files: block names {ts,tsx,mts,cts,js,jsx,mjs,cjs} and the strings .md/markdown appear nowhere in the config; (2) `npx eslint --format json` over the diff's three files returns 3 results, 0 errors, one message each with ruleId null reading 'File ignored because no matching configuration was supplied.'; (3) type-aware linting is not enabled anywhere - the five parserOptions occurrences are all { ecmaVersion, sourceType }, none is project, which the config's own line 327 states in prose - so this diff cannot move a verdict on any untouched file. check:skill-examples is NOT MEASURED and vacuous for this PR either way: it refuses until @objectstack/client-react is built (a prerequisite refusal it prints itself), and independently none of PR 1's three files carries an os:check marker (measured 0/0/0). It becomes load-bearing in PR 2 (SKILL.md carries 4) and PR 3 (data-hooks.md carries 1) and will be run there against a real build.",
 "claims_inventory": {
 "total": 314,
 "scope_note": "PR 1's three files only (1,219 of the package's 4,935 lines). Counting rule: one claim per assertable proposition about platform behaviour - each type row's existence, each config key attributed to a type, each mapping-table cell, each numbered rule, each behavioural sentence, each asserted example output. Front-matter, section headings, the field-type decision tree (navigation over types already inventoried) and pure style prescriptions are excluded by the anchor's rule: ~158 of the 1,219 lines.",
 "by_class": {
 "field_type_existence_rows": 49,
 "per_type_config_key_attributions": 75,
 "mapping_matrix_cells": 27,
 "retired_or_removed_surface_assertions": 12,
 "enum_membership_assertions": 8,
 "autonumber_token_and_rule_semantics": 12,
 "index_declaration_surface_and_scope": 22,
 "rollup_semantics": 12,
 "inline_edit_and_related_list_semantics": 26,
 "behavioural_sentences_and_callouts": 32,
 "incorrect_vs_correct_example_pairs": 13,
 "performance_and_tuning_heuristics": 26
 },
 "by_file": {
 "field-types.md": 166,
 "relationships.md": 77,
 "indexing.md": 71
 },
 "verified": 274,
 "false_fixed": 6,
 "not_measurable": 34,
 "covered_by_gate": "check-skills-token-ratchet pins the size of all three files; check:skill-examples type-checks os:check blocks but these three files carry none; the roll-up-over-lookup behaviour corrected here is independently pinned by packages/objectql/src/summary-rollup.test.ts, and the unknown-field-key posture by packages/spec/src/data/field.test.ts - so both corrections describe behaviour that already has a drift guard, which is why no probe was promoted to a commit."
 },
 "calibration_delta": "FALSE density 6/314 = 1.9% for PR 1, against flight 1's 3.0% overall. FLIGHT 1's ~8x TABLE CONCENTRATION DID NOT REPRODUCE, and the reading depends on how 'table' is defined - this is the finding the anchor should carry. By MARKDOWN RENDERING: only 2 of 6 falsehoods sit in an actual pipe table (both relationships.md capability-matrix cells) - 2/~150 in-table (1.3%) against 4/~164 elsewhere (2.4%), a mild INVERSION of flight 1, not a concentration. By CONTENT CLASS (what flight 1 was really pointing at - assertions about what surfaces exist and what the engine does with them): 5 of 6 are surface/mapping claims - the unknown-key posture, vectorConfig, the FK auto-index list, and the two matrix cells; only the autonumber tokenizer rule is a pure behavioural rule. ACTIONABLE FOR FLIGHTS 3-12: target the content class, not the markdown syntax - every 'what is automatic / what keys exist / what is retired' assertion, whether rendered as a table, a bullet list or a callout. Three of this flight's six falsehoods were in bullet lists and callouts that a table-shaped search walks straight past. SECOND PATTERN worth carrying forward: 2 of the 6 were FOUND by cross-file contradiction inside the same package (indexing.md vs relationships.md on FK indexing; relationships.md vs SKILL.md on master_detail requiredness). Neither was decided document-vs-document - both were then settled against the implementation - but the disagreement is a cheap, high-yield way to pick which claims to spend a probe on. FLAVOUR MATCH against flight 1's four: 'retired-surface rows outliving removals' reproduced strongly (3 of 6 describe behaviour that was real before a retirement and is now inverted); 'phantom fields with zero repo-wide hits' did NOT appear here (every key named in these three files exists); 'slot-semantics overclaims' reproduced as the autonumber tokenizer rule; 'unshipped-path pointers' did NOT apply - @objectstack/spec really does publish src/**/*.zod.ts (measured: 209 src/ entries in a real `npm pack --dry-run --json`), unlike @objectstack/formula.",
 "files_changed": [
 "skills/objectstack-data/rules/field-types.md (428 -> 428 lines; 3584 -> 3578 tokens)",
 "skills/objectstack-data/rules/relationships.md (415 -> 413 lines; 3778 -> 3773 tokens)",
 "skills/objectstack-data/rules/indexing.md (376 -> 375 lines; 3241 -> 3240 tokens)"
 ],
 "changeset": "none - pure skills/** documentation correction, releases nothing from any package; `skip-changeset` applied via the ADDITIVE labels endpoint (POST .../issues/13687/labels, HTTP 200) and read back: labels are ['size/s','skip-changeset'], so the size-labeler's own write did not strip it.",
 "governed_surface_posture": "draft:true, auto_merge:null, zero reviews requested, not marked ready - read back from the API after creation. This seat will not arm, queue or flip it. Human merge only, per Prime Directive #14.",
 "deviations": [
 "Interim report: this is the cumulative report after PR 1 of up to 3, not the final one. status is 'rework' because the card's scope is only partly delivered so far, not because PR 1 itself is incomplete.",
 "check-test-completeness.mjs recorded as NOT MEASURED (exit 3, PREREQUISITE NOT MET by its own text), not as a red - same disposition as flight 1.",
 "check:skill-examples recorded as NOT MEASURED for PR 1 (prerequisite: @objectstack/client-react not built; and vacuous here since these three files carry no os:check block). It will be run for real in PR 2/PR 3, which do carry markers.",
 "ESLint narrowing declared with all three required readings rather than a repo-wide run.",
 "The relationships.md `tree` row's 'Roll-ups: Not available' cell was left UNCHANGED although the adjacent lookup cell was corrected: a self-referential FK is neither shape the roll-up auto-detection names, and this flight did not measure it. Recorded as NOT MEASURABLE rather than corrected on inference."
 ],
 "mcp_calls": "1 - a single mcp__github__create_pull_request. Every read (issue bodies, the anchor's calibration comment 5474435934, PR #13674's body, PR read-back) and the label write went through the zero-quota REST channel, probed first and confirmed open (HTTP 200 on a repo-scoped GET, and HTTP 200 on the additive labels POST).",
 "open_questions": [],
 "out_of_scope_findings": [
 "NOT YET FILED, and reported here for the PM rather than filed unilaterally because it is a judgement about a lint rule's severity rather than a defect: `relationship/master-detail-required` is a lint WARNING, while `packages/spec/src/data/object.zod.ts` (the docblock above the controlled_by_parent refinement) argues a non-required master reference 'arms the worst measured failure shape' - a null FK that no derived read filter can match, making the row invisible to everyone and every later by-id write a 422. The hard enforcement exists only under sharingModel controlled_by_parent. Whether the other sharing models should also force it is a contract decision, not a sweep decision, so no issue was filed and no text was written asserting either way. Flagging it because this sweep is what surfaced the gap."
 ]
}

Generated by Claude Code

---

Generated by Claude Code

[zhuangjianguo]

PR 2/3 ACCEPT — reviewer: skills lane seat (contract-review tier, diff personally verified against all three corrections). PR #13694, head 0ccf1b1e7, draft on the manual lane, hotlong being requested. Flight continues to PR 3 (hooks reference + remaining rule files).

Record notes: all three falsehoods are the MIRROR flavor of flight ①'s — the document declaring a surface deader than it is — and the maskingRule one is the sharpest of the whole program so far: the skill told authors a shipped, runtime-enforced data-protection capability "protected nothing" (FieldMasker + five consumer modules measured live). titleFormat deprecated-not-retired verified with the in-table control (namespace really rejects); tenantField no-default verified with the schema's own #5315 docblock, and the old example taught a column the same file's RLS recipes contradict. Ratchet: paid at 6-token headroom by deleting the false clause itself — the correction financing the correction. The AGENTS.md-named check:skill-docs/check:skill-refs runs beyond the derived family were the right extra mile (body-only proven by measurement, not assumption).

The implementation-side observation (SEARCHABLE_ENUM_TYPES carrying 'status', not a FieldType member) is routed to the spec lane as its own finding this stroke — correctly not touched in this PR.

Running flight total adopted: 595 claims / 9 FALSE (1.5%) across 4 of 12 files.

---

Generated by Claude Code

[claude]

os-dev-report

{
 "issue": 13675,
 "status": "rework",
 "branch": "claude/issue-13675-data-skill-sweep-2 (PR 2) \u00b7 claude/issue-13675-data-skill-sweep (PR 1)",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/13694 (PR 2) \u00b7 https://github.com/objectstack-ai/objectstack/pull/13687 (PR 1)",
 "premise_still_valid": true,
 "summary": "PR 2 of 3 delivered as draft #13694 - SKILL.md (1,210 lines), based on origin/main and disjoint from PR 1, not stacked. Three more behavioral claims measured FALSE and corrected, all three the SAME error in the same direction - the document declares a surface deader than it is: (1) `titleFormat` labelled 'Retired (ADR-0079)' is actually DEPRECATED - a declared ObjectSchema key that still parses (object.zod.ts:2076 '[DEPRECATED -> nameField]'), is still read by objectql's registry, and still has a semantic migration entry; the same table one row above correctly says 'Deprecated' for displayNameField, and the skill reserves 'Retired' for keys that are a parse error, so the word has teeth. (2) The tenancy example wrote `tenantField: 'tenant_id' // default: 'tenant_id'` - there is NO default (parsed {enabled:true} only), and the schema's own docblock records that the 'tenant_id' default was REMOVED because the platform column is organization_id and the materialized value merely sent the driver looking for a column that did not exist. Three sections below, the same file's RLS recipes use organization_id throughout, so the page contradicted itself. (3) `maskingRule` claimed 'pruned from FieldSchema ... dead surface; setting them protected nothing' (twice) - it is LIVE: it parses and retains its value ('phone', 'email', {keepHead,keepTail}), is declared as 'enforced by the runtime FieldMasker', and has consumers in plugin-security (field-masker.ts plus its own field-masking-rule.test.ts, explain-engine, security-plugin), plugin-approvals payload-redaction, plugin-audit read-audit, a dogfood test and four locales of metadata forms. That last one is the most consequential correction of the flight so far: the skill was telling authors a shipped, enforced data-protection capability does not exist. SKILL.md had only 6 tokens of headroom; the corrections are paid for by genuine deletion and the file SHRINKS to 13782/13783. PR 3 (references/data-hooks.md + the remaining rule files, 2,506 lines) still to come.",
 "tests": "PR 2 readings at head 0ccf1b1e7. Gate family derived from the real diff with `node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack` (--commands harvest): the same 13 families as PR 1. Exit codes captured BEFORE any pipe. 12 green, 1 NOT MEASURED (`node scripts/check-test-completeness.mjs` EXIT=3, own verdict line 'PREREQUISITE NOT MET - this gate grades a saved `turbo run test` log, and no log was named'). TWO FAMILIES BEYOND THE DERIVED LIST, run because AGENTS.md names them for this exact edit and the derivation did not - its 'Touched packages/spec? Regenerate its artifacts' table has the row 'A SKILL.md (frontmatter or body) -> check:skill-docs, check:skill-refs': EXIT=0 `pnpm --filter @objectstack/spec check:skill-docs` ('\u2713 skills/README.md / \u2713 content/docs/ai/skills-reference.mdx / \u2705 Skill docs in sync') and EXIT=0 check:skill-refs ('\u2705 9 generated files in sync with packages/spec'). Both green because this diff is body prose only, not front-matter - but that is a measurement, not an assumption, and it is the gate this PR could most plausibly have broken. check:skill-examples is GREEN and load-bearing here unlike in PR 1 (SKILL.md carries 4 os:check blocks): it refuses until @objectstack/client-react is built, so that closure was built first (42 turbo tasks) and the gate re-run - '\u2705 260 prose examples type-check across 3 surface(s) - every marked block parsed, so tsc ran the SEMANTIC pass on all of them'. Ratchet verdict line: 'skills/objectstack-data/SKILL.md is 13782 tokens (ceiling 13783; headroom 1)'. check-nul-bytes 'OK (scanned 7557 text file(s) ... no raw ASCII control bytes)' plus a direct control-byte grep over SKILL.md with no hits. NON-VACUITY CONTROL for PR 2, six groups proven true by execution: all seven `enable` defaults in one parse ({trackHistory:false,searchable:true,apiEnabled:true,files:false,feeds:true,activities:true,clone:true}, matching the table row for row); apiMethods accepting exactly the six primitives with the derived verbs accepted-but-stripped and the platform printing its own 'search derives from list \u2227 searchable' explanation; the seed table's four defaults in one parse (externalId 'name', mode 'upsert', env ['prod','dev','test']) and exactly five import modes with a sixth refused by name; all nine lint rules and their severities read out of packages/lint/src/data-model-rules.ts matching the table row for row; the R9-vs-ADR-0079 callout, where lint's NAME_LIKE_FIELDS contains 'code' and spec's title-derivation exactOrder does not - exactly the distinction the callout draws; and the closed surfaces each with a live control (namespace/permissions/hooks/workflows/stateMachines/softDelete all refused; permissionSets refused WITH a rename hint to `permissions`; tenancy.strategy refused; protection .strict() with reason 1-500 and exactly four lock levels, 'read-only' refused; fieldGroups collapse exactly none|expanded|collapsed and a non-snake_case key refused; readScope exactly own|own_and_reports|unit|unit_and_below|org; RLS operation exactly select|insert|update|delete|all with `object` really required and the plural `operations` refused with a rename hint; all seven permission bits green while an invented allowFrobnicate is refused - that control is what makes the seven greens mean something; objectExtensions priority .min(0).max(999).default(200), byte-exact with the stated default 200 / range 0-999). Each FALSE claim carries its own measurement with a control: titleFormat ACCEPTs while the genuinely-retired `namespace` in the same table REJECTs; encryptionConfig REJECTs with its tombstone message while maskingRule ACCEPTs and retains its value. ESLint narrowing re-measured for this file with all three readings (no .md in any eslint.config.mjs files: block; --format json over SKILL.md = 1 result, errorCount 0, ruleId null, 'File ignored because no matching configuration was supplied.'; no parserOptions.project anywhere). All probes deleted before the commit; the diff is exactly one .md file, 7 insertions / 7 deletions.",
 "claims_inventory": {
 "total": 595,
 "scope_note": "CUMULATIVE across PR 1 (3 rule files, 1,219 lines) and PR 2 (SKILL.md, 1,210 lines) = 2,429 of the package's 4,935 lines, 4 of 12 files. Same counting rule throughout: one claim per assertable proposition about platform behaviour. Excluded as non-behavioral by the anchor's rule: ~158 lines in PR 1's files, ~250 in SKILL.md (front-matter, Skill Boundaries routing, 'When to Use This Skill', Quick Reference link list, headings, cross-skill pointers, and the Common Patterns restatements of rules/** already inventoried in PR 1).",
 "by_class": {
 "surface_liveness_and_key_existence": 148,
 "per_type_config_key_attributions": 75,
 "mapping_matrix_cells": 41,
 "enum_membership_assertions": 26,
 "default_value_assertions": 24,
 "behavioural_sentences_and_callouts": 71,
 "index_and_rollup_semantics": 34,
 "inline_edit_and_related_list_semantics": 26,
 "security_permission_and_rls_semantics": 38,
 "seed_semantics": 19,
 "lint_rule_and_severity_rows": 11,
 "autonumber_token_and_rule_semantics": 12,
 "incorrect_vs_correct_example_pairs": 13,
 "verbatim_error_message_quotations": 4,
 "performance_and_tuning_heuristics": 26,
 "field_type_existence_rows": 49
 },
 "by_file": {
 "field-types.md": 166,
 "relationships.md": 77,
 "indexing.md": 71,
 "SKILL.md": 281
 },
 "verified": 523,
 "false_fixed": 9,
 "not_measurable": 63,
 "covered_by_gate": "check-skills-token-ratchet pins the size of all four files. check:skill-examples type-checks the 4 os:check blocks in SKILL.md (green); PR 1's three files carry none. check:skill-docs / check:skill-refs pin SKILL.md's front-matter against the generated skills/README.md, content/docs/ai/skills-reference.mdx and the 9 generated ref files (both green). Two corrected behaviours already have independent drift guards: roll-up-over-lookup by packages/objectql/src/summary-rollup.test.ts, the unknown-field-key posture by packages/spec/src/data/field.test.ts - which is why no probe was promoted to a commit."
 },
 "calibration_delta": "CUMULATIVE 9 FALSE / 595 claims = 1.5%, against flight 1's 3.0%. Per PR: 6/314 = 1.9% (PR 1), 3/281 = 1.1% (PR 2). FLIGHT 1's ~8x TABLE CONCENTRATION DOES NOT REPRODUCE BY MARKDOWN SHAPE, and does reproduce - strongly - BY CONTENT CLASS. By rendering: 3 of 9 falsehoods are pipe-table cells; the other 6 are bullet lists, callouts, numbered rules and a code comment. By content class: 8 of 9 are SURFACE/LIVENESS claims - 'does this key exist, is it retired, is it automatic, what does the engine do with it'. ACTIONABLE FOR FLIGHTS 3-12: target the content class, not the markdown syntax. A table-shaped search would have found 3 of these 9. THE DIRECTION SPLIT IS THE NEW FINDING: flight 1's falsehoods advertised DEAD surfaces as live (retired rows outliving removals, phantom fields). Flight 2 is split - PR 1 was mostly that same direction, but ALL THREE of PR 2's are the OPPOSITE: the document declares a surface DEADER than it is (titleFormat retired-vs-deprecated, maskingRule pruned-vs-live, and a claimed default that was deliberately removed). That mirror direction is arguably more dangerous, because it hides a shipped, enforced capability from an AI author rather than merely tempting one toward a dead key - and no amount of 'grep for retired things' finds it. Both directions reduce to ONE probe: for every surface the doc names, parse it and see what the schema actually says. SECOND PATTERN, now confirmed twice: 3 of the 9 were FOUND by cross-file or intra-file contradiction (indexing.md vs relationships.md on FK indexing; relationships.md vs SKILL.md on master_detail requiredness; SKILL.md's tenancy example vs its own RLS sections on organization_id). None was DECIDED document-vs-document - all were settled against the implementation - but the disagreement is the cheapest way to pick which claims deserve a probe. FLAVOUR MATCH against flight 1's four: retired-surface rows reproduced (PR 1); phantom fields did NOT appear (every key named across the four files exists); slot-semantics overclaims reproduced twice (the autonumber tokenizer rule; the tenancy default); unshipped-path pointers did NOT apply - @objectstack/spec really does publish src/**/*.zod.ts (209 src/ entries measured in a real `npm pack --dry-run --json`), unlike @objectstack/formula.",
 "files_changed": [
 "PR 2 \u2014 skills/objectstack-data/SKILL.md (1210 -> 1210 lines; 13783 -> 13782 tokens)",
 "PR 1 \u2014 skills/objectstack-data/rules/field-types.md (428 -> 428; 3584 -> 3578)",
 "PR 1 \u2014 skills/objectstack-data/rules/relationships.md (415 -> 413; 3778 -> 3773)",
 "PR 1 \u2014 skills/objectstack-data/rules/indexing.md (376 -> 375; 3241 -> 3240)"
 ],
 "changeset": "none for either PR - pure skills/** documentation corrections, releasing nothing from any package. `skip-changeset` applied to BOTH via the ADDITIVE labels endpoint (HTTP 200 each) and read back: #13687 ['size/s','skip-changeset'], #13694 ['skip-changeset'].",
 "governed_surface_posture": "Both PRs read back from the API after creation: draft:true, auto_merge:null, zero reviews requested, not marked ready. This seat will not arm, queue or flip either. Human merge only, per Prime Directive #14.",
 "deviations": [
 "Interim report: cumulative after PR 2 of 3. status 'rework' reflects that the card's scope is only partly delivered, not that either PR is incomplete.",
 "check-test-completeness.mjs recorded NOT MEASURED on both PRs (exit 3, PREREQUISITE NOT MET by its own text) - same disposition as flight 1.",
 "PR 2 ran TWO gates the path derivation did not name (check:skill-docs, check:skill-refs), because AGENTS.md names them for a SKILL.md body edit. Reported as an addition to the derived family, not a substitution.",
 "ESLint narrowing declared with all three required readings on both PRs rather than a repo-wide run.",
 "PR 2 is based on origin/main at 713f83f5d, which had advanced from PR 1's base 575ce836d. Deliberate, per the card's 'each based on origin/main, no stacking' - the two diffs touch disjoint files.",
 "relationships.md's `tree` row 'Roll-ups: Not available' left UNCHANGED although the adjacent lookup cell was corrected - a self-referential FK is neither shape the roll-up auto-detection names and this flight did not measure it. NOT MEASURABLE, not corrected on inference."
 ],
 "mcp_calls": "2 cumulative - two mcp__github__create_pull_request calls, one per PR. Every read (issue bodies, the anchor's calibration comment 5474435934, PR #13674's body, both PR read-backs) and both label writes went through the zero-quota REST channel, probed first and confirmed open.",
 "open_questions": [],
 "out_of_scope_findings": [
 "NOT FILED, reported for PM triage (contract decision, not a defect): `relationship/master-detail-required` is a lint WARNING, while packages/spec/src/data/object.zod.ts argues a non-required master reference 'arms the worst measured failure shape' - a null FK no derived read filter can match, making the row invisible to everyone and every later by-id write a 422. Hard enforcement exists ONLY under sharingModel controlled_by_parent. Whether the other sharing models should force it is a contract call, so nothing was written asserting either way.",
 "NOT FILED, implementation-side observation: SEARCHABLE_ENUM_TYPES in packages/spec/src/data/search-fields.ts is new Set(['select','status']), and 'status' is NOT a member of the 49-value FieldType enum - a dead vocabulary entry of the ADR-0049 enforce-or-remove shape. The skill reproduces the implementation's list faithfully, so its sentence is VERIFIED rather than false; the dead entry is the implementation's, and this sweep is only what surfaced it."
 ]
}

Generated by Claude Code

---

Generated by Claude Code

[zhuangjianguo]

PR 3/3 ACCEPT — flight ② COMPLETE. Reviewer: skills lane seat (contract-review tier, diff personally verified against all four corrections). PR #13698, head d66ac1010, draft on the manual lane, hotlong being requested; its Fixes line closes this card on merge.

Package fully swept: 12/12 files, 4,935 lines, 883 claims, 13 FALSE (1.5%), ~92 NOT MEASURABLE recorded. The six unedited files are a verified result, not a skip (validation.md and lifecycle.md measured 0-false with every refusal firing for its stated reason and every control passing). Review highlights this PR: the ctx.log.debug history (docs over-claimed → platform implemented it under ADR-0049 enforce → docs over-corrected past the new truth — the full cycle in one row) and the discipline on pattern 8's in-process updateMany comment (left NOT MEASURABLE with the tension named, refusing document-vs-document inference — exactly right). The two implementation-side observations are triaged this stroke: SEARCHABLE_ENUM_TYPES's dead 'status' already filed as #13695; the master-detail-required severity-vs-docblock tension filed now (routed spec).

Closing calibration adopted onto the anchor. Landing: all three PRs (#13687 · #13694 · #13698) draft awaiting human merge; on the final merge this card auto-closes and pm:dispatched is stripped in the same sweep.

---

Generated by Claude Code