docs(skills): the security rule states a grant's uniqueness by the declared unique: 'organization' index, in place of the retired permission_set_id column

`skills/objectstack-data/rules/security.md`'s grant paragraph closed with a
sentence naming `permission_set_id` as a legacy column not to write. The
grant object no longer declares that column (a write naming it is refused
`400 INVALID_FIELD`), so the sentence taught an AI author a key the declared
shape does not have. One line replaces it: one grant per user, set and
organization, enforced by the join object's `unique: 'organization'` index
on (`user_id`, `permission_set`, `organization_id`). Net 0 lines; the
token ratchet reads 2494 -> 2502 against ceiling 2543. The file ships in
`@objectstack/skills` (`dist/skills/**` via sync-catalog), so a patch
changeset accompanies it.

Co-authored-by: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VqGhCg9wdsBXPz54uAEWg7

Author: claude

.changeset/23615-grant-unique-index-skill.md

@@ -0,0 +1,9 @@
+---
+'@objectstack/skills': patch
+---
+
+docs(skills): the `objectstack-data` security rule states a grant's uniqueness as the declared `unique: 'organization'` index holds it, in place of the retired `permission_set_id` column (#23615)
+
+Clause-②: no
+
+`skills/objectstack-data/rules/security.md`'s grant paragraph closed with "`permission_set_id` is a legacy column: do not write it." The grant object `sys_user_permission_set` no longer declares that column, so a write naming it is refused `400 INVALID_FIELD` as an undeclared field, and the sentence taught an AI author a key the declared shape does not have. The sentence is replaced by the rule the declared shape holds: one grant per user, set and organization, enforced by the join object's `unique: 'organization'` index on (`user_id`, `permission_set`, `organization_id`). The by-name reference — `permission_set` takes the set's `name` — and its refusals are unchanged. No behaviour changes; nothing an author writes changes.

skills/objectstack-data/rules/security.md

@@ -46,7 +46,7 @@ insert — never author it.
 ⚠️ **`permission_set` takes the set's `name`, never a record id** — a name the
 security catalog does not hold is refused `400 VALIDATION_FAILED`
 (`reference_not_found`), and a row with no name is refused `required`.
-`permission_set_id` is a legacy column: do not write it.
+One grant per user, set and organization: enforced by the `unique: 'organization'` index.
 
 Assignment is one call: `POST /api/v1/data/sys_user_permission_set` with
 `{ user_id, permission_set: '<name>', organization_id }`. Only a tenant admin —