docs(skills): the data skill's current_user table names a declared membership key (#25586)

<!-- claude-projects-attribution: {"github_login":"os-tesla"} -->
_Requested by **Tesla** · [project
thread](https://claude.ai/code/project/chan_01AXsQkLFKRdQCqQ3RTr6Jao?thread=cmsg_01AXsQkLFKRdQCqQ3RTr6JaoJLr1A7TYy1k6cGE23eo9VQ)_
Part of #25234

The Tier H follow-up to ruling A on #25234 (landing plan 6370632236). It
is governed (`skills/**`), so a maintainer merges it. #25528 made a
declared membership key (`ObjectSchema.membershipKeys`) live, and #25550
made its authoring refusals live. The data skill's `current_user.*`
placeholder table still listed only the kernel's keys, so an author
reading the bundle alone had no way to learn that a declared key
resolves.

## The change

- `skills/objectstack-data/rules/security.md` gains one row in the
placeholder table:

> | `current_user.KEY` | the set an object's `membershipKeys.KEY`
declares (for `IN`) |

- `scripts/check-skills-token-ratchet.mjs`: the file's ceiling goes from
2543 to 2563, with the ruling quoted in the row's comment.

## The maintainer ruling

Tesla, 2026-10-24T01:28:57Z, project decision list item 9, verbatim and
untranslated (the same message also approved item 8, whose line is
elided here):

> 9. 技能文档 security.md 的 token 上限 2543 → 2563 … 同意

## Why the row is shorter than the one proposed with the ruling

The ruling was asked for a 20-token raise with the shorter row from
report 6374979058, measured at 2563 against the file as it stood then.
#25429 (0949fe5) then landed on this file and brought it to 2541,
leaving 2 tokens of headroom. The proposed row now measures 2602, which
is 39 over the ruled ceiling. So the row is trimmed to fit the ruled
2563 exactly, rather than asking for a second raise. The trimmed row
drops the resolution detail (the roster's `valueField` and `userField`,
the caller's organisation, and the 1,000-value bound that fails closed).
That detail is in `rls.zod.ts`'s "Where a membership key comes from"
section, which the table's own Source line points to, and in the
`membershipKeys` describe in `object.zod.ts`.

## Checks

- `node scripts/check-skills-token-ratchet.mjs`: `security.md` is 2563
tokens, ceiling 2563, headroom 0, exit 0. `--self-test`: 79 cases pass.
- `node scripts/pm/dispatch-gates.mjs --commands --repo
objectstack-ai/objectstack` derives 52 families on this head (11 changed
lines). All 52 ran one at a time under `os-verify-lock.sh`, exit 0.

---

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01M4rJHRAZDFqLYQ9dHMH339

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]

.changeset/25234-skills-membership-key-row.md

@@ -0,0 +1,9 @@
+---
+'@objectstack/skills': patch
+---
+
+docs(skills): the objectstack-data skill's `current_user` placeholder table names a declared membership key
+
+Clause-②: no
+
+The security rules' table of the `current_user.*` placeholders the RLS compiler resolves listed only the kernel's keys. It now has a row for `current_user.KEY`, the set an object's `membershipKeys.KEY` declares (for `IN`), so an author reading the catalog alone learns that a declared key resolves.

scripts/check-skills-token-ratchet.mjs

@@ -544,7 +544,15 @@ export const CEILINGS = new Map([
   // schema alone writes the refused shape. +63 tokens, zero headroom to absorb
   // any of it, ceiling +63. Maintainer ruling 2026-09-17 (recorded on #17359 as
   // comment 5710537499), verbatim and untranslated: 「security.md 允许增加到 2543」.
-  ['skills/objectstack-data/rules/security.md', 2543],
+  // 2543 -> 2563 (#25234): the `current_user.*` placeholder table gains the
+  // declared membership key row (`ObjectSchema.membershipKeys`, staged per
+  // request since #25528), which the table did not teach, so an author reading
+  // the bundle alone had no way to know a declared key resolves. +22 tokens on
+  // a landed 2541, 2 absorbed by headroom, ceiling +20. Maintainer ruling
+  // 2026-10-24 (project decision list item 9), verbatim and untranslated, the
+  // line for item 8 of the same message elided:
+  // 「9. 技能文档 security.md 的 token 上限 2543 → 2563 … 同意」.
+  ['skills/objectstack-data/rules/security.md', 2563],
   // 3024 -> 3109 (2026-08-31 app-repo-principles raise, see the block above).
   // Severity Levels listed the three values and left the CHOICE unstated: a
   // block rests on a judgement a person made, so a machine-inferred signal — a

skills/objectstack-data/rules/security.md

@@ -106,6 +106,7 @@ bridge (warns). The compiler resolves these
 | `current_user.organization_id` | the caller's tenant |
 | `current_user.org_user_ids` | ids of users in the same org (for `IN`) |
 | `current_user.positions` | the caller's positions (for `IN`; ADR-0090 D3) |
+| `current_user.KEY` | the set an object's `membershipKeys.KEY` declares (for `IN`) |
 
 - Source: `node_modules/@objectstack/spec/src/security/rls.zod.ts` (policy
   shape, predicate grammar, `check` composition).