@@ -56,7 +56,7 @@ index plus the relevant [Architecture](../../docs/architecture/) doc.
 | [implement-task](implement-task/SKILL.md) | The default entry point for substantive work — scope, implement, self-check, run linter + tests, update docs, commit, produce a review-agent prompt. |
 | [start-task](start-task/SKILL.md) | Lightweight scoping-only entry point. Reading order + alignment check. Use when you don't need the full end-to-end workflow. |
 | [write-adr](write-adr/SKILL.md) | Capturing a one-time architectural decision. Uses Decision Drivers + Considered Options template. |
-| [commit-and-pr](commit-and-pr/SKILL.md) | Conventional Commit + AI trailer + PR body conventions. |
+| [commit-and-pr](commit-and-pr/SKILL.md) | Conventional Commit + applicable trailers + PR body conventions. |
 | [update-glossary](update-glossary/SKILL.md) | Introducing a new project-specific term anywhere in the corpus. |
 
 ### Review
 
@@ -86,7 +86,7 @@ authority.
 | Owning module | Yes | Determines DbContext, namespace, migration project. |
 | Org-scoped? | Yes | `false` = tenant-wide; `true` = needs `OrganizationId` + org RLS. |
 | Soft-deletable? | Yes | Decides the **query filter**, not the columns: `AuditableEntity<TId>` implements `ISoftDelete` unconditionally, so `deleted_at` / `deleted_by` are on every derived table either way ([Database Standards § Audit Columns](../../../docs/standards/05-database.md)). |
-| Strongly-typed id | Yes | Even simple entities use `<Name>Id : strongly-typed Guid` per [02-backend-coding.md](../../../docs/standards/02-backend-coding.md). |
+| Strongly-typed id | For roots and surrogate-key entities | Use `<Name>Id : strongly-typed Guid` per [02-backend-coding.md](../../../docs/standards/02-backend-coding.md). Contained translation satellites use their accepted natural composite key, with no surrogate id ([Database Standards § Translation satellite tables](../../../docs/standards/05-database.md#translation-satellite-tables)). |
 
 ## Workflow
 
@@ -139,12 +139,15 @@ Rules:
 - `OrganizationId` is nullable on every `[OrganizationScoped]` entity — null means
   tenant-wide — and `Every_OrgScoped_Entity_HasOrgIdAndFilter` fails a mapped
   `organization_id` that is not nullable (Step 4).
-  > **Open in Phase 02d.** Whether a child or satellite row carries its parent's
-  > organization, and what forces it to at insert, is G7 in
-  > [Phase 02d's decision register](../../../docs/roadmap/phase-02d-walking-skeleton.md#the-decision-register).
-  > The pass that closes it edits this rule with its answer.
+  A child whose scope mirrors its parent derives both tenant and organization in its
+  factory. The independent INSERT/UPDATE parent-scope trigger, immutable organization
+  guard and composite tenant foreign key enforce that relation in the database; use
+  [Database Standards § Parent organization mirrors](../../../docs/standards/05-database.md#parent-organization-mirrors).
 - Use `AuditableEntity<<Name>Id>` for mutable aggregates. **Never** `Entity<TId>`
   unless the aggregate is append-only (e.g. `AuditEntry`).
+  A contained translation satellite uses its natural key as a plain entity, with no
+  independent audit timestamps, row version or soft-delete lifecycle; changes belong
+  to its owning root ([Translation satellite tables](../../../docs/standards/05-database.md#translation-satellite-tables)).
 - Domain events for state changes; don't write to other aggregates from this one.
 - Mark PII properties `[PiiSensitive]`. From Packet 9 the audit capture replaces a
   marked — or name-token-matched — value with `SensitiveTokenCatalog.RedactedValue` in
@@ -264,7 +267,8 @@ dotnet ef migrations add add_<name> \
 
 `--output-dir` is not optional, and this is the skill that needs it most: EF
 defaults the output to `Migrations/` when the project has no sibling migration to
-reuse, which is six of the seven module assemblies today. `make migrate`,
+reuse. Content, Identity and Media are the three module assemblies without a
+migration chain after P02d-1 Step 2. `make migrate`,
 `backend/.editorconfig` and `Migrate_Target_Covers_Every_Migration_Chain` all key
 on `Persistence/Migrations` — a chain landing one directory up is skipped by the
 Makefile loop in silence and is invisible to the architecture test written for
@@ -366,24 +370,28 @@ what you pasted — a reviewer will:
   nothing may *write* outside its own. `WITH CHECK` is not sufficient on its own for
   that guarantee — PostgreSQL has no `WITH CHECK` for `DELETE`, and `USING` is also
   what selects the rows an `UPDATE` may target — which is why the two `AS RESTRICTIVE`
-  guards above are part of the template and not an optional extra. One write path stays
-  open — the organization arm of `WITH CHECK` admits `organization_id IS NULL` from any
-  session, so an organization-scoped session can `INSERT` a tenant-wide row; its status
-  is in
+  guards above are part of the template and not an optional extra. The tenant-wide
+  arm of `WITH CHECK` also requires an unset or empty `app.organization_id`, so an
+  organization-scoped session cannot `INSERT` a tenant-wide row. Copy the accepted
+  [ADR-0003 Amendment 6](../../../docs/decisions/0003-tenant-isolation-defense-in-depth.md#amendment-6--insert-scope-and-parent-mirrors-2026-09-14)
+  predicate from
   [05-database.md § Tenant-Owned and Organization-Scoped Tables](../../../docs/standards/05-database.md#tenant-owned-and-organization-scoped-tables).
 - **The composite `UNIQUE (tenant_id, id)` and the composite foreign keys** — referential
   integrity is checked on behalf of the table owner and bypasses RLS entirely, so a
   single-column FK is a cross-tenant reference waiting to happen, invisible to every
   policy. See
   [05-database.md § Foreign keys between tenant-owned tables](../../../docs/standards/05-database.md).
 
-Two obligations the policy block does not carry, both in
+Three obligations the policy block does not carry, all in
 [05-database.md](../../../docs/standards/05-database.md): the `BEFORE UPDATE`
 organization immutability trigger on every org-scoped table (the rule after the
-template), and an index supporting every foreign key
-([§ Indexes](../../../docs/standards/05-database.md#indexes)). Neither makes a child's
-or satellite's mirrored `organization_id` equal its parent's at insert — see
-[§ Translation satellite tables](../../../docs/standards/05-database.md#translation-satellite-tables).
+template), an index supporting every foreign key
+([§ Indexes](../../../docs/standards/05-database.md#indexes)), and the independent
+INSERT/UPDATE [parent-scope trigger](../../../docs/standards/05-database.md#parent-organization-mirrors)
+for a child whose scope mirrors its parent. Derive that child's tenant and organization
+from the parent in its factory; retain the composite tenant foreign key as a separate
+database control. The shared immutability function assumes no surrogate `id`, because
+contained translation satellites have none.
 
 Always call `current_setting` with the second argument `true`. Without it an unset
 context raises inside a pooled connection instead of simply filtering the row out.
@@ -420,14 +428,20 @@ Two gaps remain, and both are yours to close by hand:
 - **A marker-gated rule cannot catch a missing marker.** It iterates what it
   finds. An entity you forget to mark is invisible to both rules, and the
   isolation test in Step 5 is the net for it.
-- **The sweep covers every module in `Modules.Scoped`** — Tenancy, Customization and
-  Audit today. A module with a schema that is missing from that list fails
+- **The sweep covers every module in `Modules.Scoped`** — Tenancy, Customization,
+  Audit and Education after P02d-1 Step 2. A module with a schema that is missing
+  from that list fails
   `Every_Module_With_A_Schema_Is_Swept`, so add yours there.
 
 Also live against your migration: `Every_Foreign_Key_Has_A_Supporting_Index` and
 the schema sweeps in `TenancySchemaTests` — row security enabled *and* forced,
 no second permissive policy for one command, snake_case identifiers, and the exact
-grant matrix. Those run against the applied schema.
+grant matrix. Those run against the applied schema. P02d-1 Step 2's
+[EducationStructureTests](../../../backend/tests/LearnStack.Tests.Integration/Database/EducationStructureTests.cs)
+also exercises the parent-mirror and Pattern A detectors with planted violations;
+[EducationPersistenceTests](../../../backend/tests/LearnStack.Tests.Integration/Database/EducationPersistenceTests.cs)
+proves natural-key satellite persistence, owning-root concurrency and contained audit
+capture through the actual composition roots.
 
 If you're adding a *new* marker attribute or a *new* isolation pattern, write a
 new architecture test (see
@@ -471,8 +485,8 @@ public sealed class <Name>IsolationTests(SchemaFixture schema)
 
 There is no `TestFixture`, no `CreateTenantAsync` and no `AsTenant(...)` helper —
 an earlier version of this file used all three. The shipped fixtures are
-`PostgresFixture` (container + the four roles) and `SchemaFixture` (both migration
-chains, every table seeded for two tenants), shared with
+`PostgresFixture` (container + the four roles) and `SchemaFixture` (all five migration
+chains, tenant-owned tables seeded for two tenants), shared with
 `[Collection(SharedSchema.Name)]`. The fixture must seed **both** tenants: a count
 of zero against a table nothing populated passes whatever the policy says.
 
 
@@ -2,9 +2,9 @@
 name: commit-and-pr
 description: >
   Format LearnStack commits and pull requests to the project's conventions —
-  Conventional Commits + AI co-author trailer + scope-correct PR body. USE FOR:
+  Conventional Commits + scope-correct PR body. USE FOR:
   preparing a commit, opening a PR, picking the right scope for a doc-only change,
-  adding the AI co-author trailer correctly. DO NOT USE FOR: deciding whether a
+  adding applicable trailers correctly. DO NOT USE FOR: deciding whether a
   change is ready to commit (that's a code-review concern, not a commit-format
   concern), force-pushing, or changing what an Accepted ADR decides (write a new
   ADR that supersedes it — amendments and the bounded corrections in
@@ -25,7 +25,7 @@ move fast and `git log --grep` stays useful.
 
 - Producing one or more commits at the end of a unit of work.
 - Opening a pull request against `main`.
-- Adding trailers (ADR refs, module list, AI co-author).
+- Adding trailers (ADR refs, module list, i18n keys).
 
 ## When not to use
 
@@ -81,20 +81,8 @@ Trailers go at the **end** of the body (after a blank line). The supported set:
 | `ADR: NNNN[, NNNN]` | The commit implements or derives from one or more ADRs. **Bare numbers** — `ADR: 0040, 0003` — never `ADR: ADR-0040`: `git log --grep='ADR: 0017'` is what the trailer exists for, and the prefixed form does not match it. A `feat` commit that creates a schema an ADR decides carries this too; the trailer is about the *derivation*, not the commit type. |
 | `Module: <list>` | Multi-module change; list every module touched. |
 | `I18n: <keys>` | Added / renamed / removed user-facing i18n keys. |
-| `Co-Authored-By: …` | Required for AI-assisted commits. |
 
-### Step 4: AI co-author trailer
-
-Pick the trailer that matches the agent that did material work:
-
-- Claude Code session:
-  `Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>`
-- OpenAI Codex session:
-  `Co-Authored-By: Codex Opus 4.7 (1M context) <noreply@anthropic.com>`
-
-Multiple assistants: include one trailer per assistant.
-
-### Step 5: HEREDOC the message
+### Step 4: HEREDOC the message
 
 Always pass the message via a HEREDOC so newlines and quotes survive:
 
@@ -107,35 +95,47 @@ access shares the per-learner entitlement read path with free access.
 
 ADR: 0010
 Module: Enrollment, Billing
-Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
 EOF
 )"
 ```
 
-### Step 6: Pull request
+### Step 5: Pull request
 
 The PR body uses the structure in
 [14-git-workflow.md § Pull Requests](../../../docs/standards/14-git-workflow.md).
-Minimum sections:
+Use that standard's canonical sections; `Approach` is needed only when non-obvious
+and `Migration / Rollback` for schema or configuration changes. The template below
+also includes this skill's existing supplements: the `Risk` section, used as described
+below, and the assistant attribution footer. Those supplements are not canonical
+sections defined by Standard 14.
 
 ```markdown
 ## Summary
 - <1-3 bullet points: what changed and why>
 
-## Test plan
-- [ ] <Concrete checks the reviewer can run>
+## Approach
+<Only when non-obvious>
+
+## Tests
+<Completed checks and concrete checks the reviewer can run>
 
 ## Risk
 - <Anything that could ripple: schema, contract, perf>
 
-🤖 Generated with [Claude Code](https://claude.com/claude-code)
+## Migration / Rollback
+<For schema or configuration changes>
+
+## Related
+<Links to the relevant issues, ADRs and standards>
+
+Prepared with <assistant used>.
 ```
 
 If the change touches the Hub HTTPS surface, the entitlement projection, or any
 tenant-isolation boundary, the PR description **must** call it out under "Risk" and
 reference the relevant ADR.
 
-### Step 7: Open the PR
+### Step 6: Open the PR
 
 ```bash
 gh pr create --title "<imperative subject>" --body "$(cat <<'EOF'
@@ -151,9 +151,9 @@ The PR title follows the **same** rules as the commit subject (imperative mood,
 
 - `git log --pretty=format:'%s' main..HEAD` shows commits in
   `type(scope): subject` form.
-- Every AI-assisted commit carries the `Co-Authored-By` trailer.
 - `git log --grep='ADR: 0017'` finds commits that implemented ADR-0017.
-- PR title matches the convention; PR body has Summary + Test plan + Risk.
+- PR title matches the convention; PR body follows § Description's canonical
+  sections and includes this skill's applicable Risk disclosure.
 - No commit on the branch force-pushes after review starts.
 
 ## Common pitfalls
 
@@ -223,8 +223,7 @@ Run [commit-and-pr](../commit-and-pr/SKILL.md). Concretely:
 - Subject imperative, ≤ 72 chars.
 - Body: one short paragraph saying *why* (not *what* — the diff is what).
 - Trailers in this order: `ADR:` (if applicable), `Module:` (if multi-module),
-  `I18n:` (if applicable), `Co-Authored-By:` (the AI assistant doing the
-  work — Claude / Codex / both).
+  `I18n:` (if applicable).
 - HEREDOC every multi-line message.
 
 Do **not** push or open a PR unless the user has asked. Default = local
 
@@ -194,12 +194,22 @@ pnpm test -t "shows danger tone"  # name filter
 ### Step 8: Coverage (optional)
 
 ```bash
-dotnet test --collect:"XPlat Code Coverage"
-reportgenerator -reports:"**/coverage.cobertura.xml" \
-                -targetdir:"coverage-html" \
+# From the repository root; collect behavioral suites separately.
+dotnet test backend/tests/LearnStack.Tests.Unit \
+  --collect:"XPlat Code Coverage" --results-directory coverage/unit
+dotnet test backend/tests/LearnStack.Tests.Integration \
+  --collect:"XPlat Code Coverage" --results-directory coverage/integration
+dotnet test backend/tests/LearnStack.Tests.Architecture
+reportgenerator -reports:"coverage/**/coverage.cobertura.xml" \
+                -targetdir:"coverage/html" \
                 -reporttypes:Html
 ```
 
+Keep the architecture suite uninstrumented. In P02d-1, a solution-wide Coverlet
+run injected a tracker type that NetArchTest's IL/reflection sweep could not resolve,
+raising `TypeLoadException`; unit and integration coverage plus a normal architecture
+run passed. Do not skip or weaken the structural test to make coverage succeed.
+
 Targets per
 [06-testing.md § Coverage Targets](../../../docs/standards/06-testing.md): Domain
 ≥ 90% line and ≥ 80% branch, Application ≥ 80% line, Infrastructure adapters
 
@@ -309,7 +309,6 @@ domain the diff doesn't touch.
 
 #### `14-git-workflow.md`
 - [ ] `type(scope): subject` commit format; subject imperative ≤ 72 chars.
-- [ ] AI-assisted commit carries `Co-Authored-By` trailer (Claude or Codex).
 - [ ] `ADR:` / `Module:` / `I18n:` trailers where applicable.
 - [ ] No `--force` on `main`; no `--amend` on a published commit.
 
 
@@ -25,10 +25,12 @@ Configure these in **GitHub → Settings → Branches → Branch protection rule
 > force pushes, no direct pushes — is live today. Only the two named settings
 > are deferred.
 >
-> **Two required-check edits are outstanding**, both flagged in the list below:
-> the `meta` check is required under a name nothing reports any more, and
-> `backend integration (Testcontainers)` runs on every pull request and is not
-> required at all. The first blocks every merge; the second gates nothing.
+> **Required checks repaired — 2026-09-14 (P02d-1).** The live rule now requires
+> the current `meta` name and `backend integration (Testcontainers)`. A fresh API
+> read verified all five check names and their GitHub Actions attribution, with
+> strict up-to-date checking and every other protection setting preserved.
+> [P02d-1's delivery record](../docs/roadmap/phase-02d-walking-skeleton.md#step-3--packet-completion-2026-09-14)
+> carries the dated verification.
 
 - **Require a pull request before merging**
   - Require approvals: **1** (raise to 2 once the team grows past two
@@ -41,21 +43,13 @@ Configure these in **GitHub → Settings → Branches → Branch protection rule
     - `backend (build + unit + arch + contract)`
     - `frontend (typecheck + lint + build + test)`
     - `secret scan (leakwatch)`
-    - `meta (compose + commit hygiene + link audit)` — ⚠️ **the live rule still
-      requires the pre-rename name** `meta (commit hygiene + link audit)`, which
-      nothing reports. GitHub matches by name, so that required check never
-      arrives and **every** pull request sits at "Expected — waiting for status to
-      be reported". Re-require it under the current name; the job itself is green.
-      This is the failure the warning below describes, in the direction that
-      blocks rather than the one that waves through.
+    - `meta (compose + commit hygiene + link audit)`
     - `backend integration (Testcontainers)` — **activated in Phase 02a Packet 6**
       with the four-role provisioning suite, one packet earlier than planned:
       Packet 6 ships the first Docker-bound test and is therefore the packet that
       has to split them. The job carries no `vars.ENABLE_*` gate and no placeholder
-      step, so it already runs on every pull request. **Adding it to the live
-      branch-protection rule is the one remaining edit**, and it is a repository
-      setting rather than a file in this repo — until it is made, the job runs and
-      gates nothing. Once it is made the check cannot pass empty: both backend jobs
+      step, so it runs on every pull request. **Required since P02d-1,
+      2026-09-14.** The check cannot pass empty: both backend jobs
       end with `scripts/assert-tests-ran.py`, which fails a run whose filter matched
       no test — `dotnet test --filter` exits 0 when nothing matches, and a renamed
       `Requires=Docker` trait would otherwise leave the whole Docker suite unrun
@@ -101,21 +95,15 @@ Per CLAUDE.md § Commit conventions:
 
 - **Conventional Commits**: `type(scope): subject` with subject in
   imperative mood, ≤ 72 chars.
-- AI-assisted commits carry the trailer
-  `Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>`
-  (replace the model name when authoring with a different assistant).
 - `docs(scope)` for doc-only commits; scope ∈ `architecture | decisions |
   standards | roadmap` or omitted for cross-cutting changes.
 
 ## Pull requests
 
 - Title mirrors the primary commit's subject.
-- Description has three sections:
-  1. **What** — bullet list of changes grouped by area.
-  2. **Why** — one paragraph; link to the ADR / phase / issue.
-  3. **Verification** — what suites you ran locally, what manual checks
-     you walked.
-- Link the related ADR / phase doc with relative paths (`../docs/...`).
+- Follow [Git Workflow § Description](../docs/standards/14-git-workflow.md#description)
+  for the canonical structure, including migration/rollback details for schema or
+  configuration changes and links to the related ADR / phase documents.
 
 ## Local checks before pushing