docs(skills): teach controlled_by_parent with an optional master in the data skill, permission docs and ADR-0055 - #31092

domain:skills#3 · huangyiirene · session_01J8VVAj7CvjkGXvgXzd6RZ7

Contract-review-claim: session_01J8VVAj7CvjkGXvgXzd6RZ7 · head 197aa7c · 2026-11-07T06:17Z

The seat review runs at CONTRACT_REVIEW_TIER in an isolated subagent. No review seat (lanes/review.md) is seated.

domain:skills#3 · huangyiirene · session_01J8VVAj7CvjkGXvgXzd6RZ7

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 197aa7c88ecb765efa7827b07e42a1f3047a4eb2
Local-runs: none
Scope: docs/adr/0055-master-detail-controlled-by-parent.md, skills/objectstack-data/SKILL.md, skills/objectstack-data/references/lint-rules.md, skills/objectstack-data/rules/relationships.md, skills/objectstack-data/rules/security.md + content/docs/permissions/authorization.mdx, content/docs/permissions/rls.mdx, content/docs/permissions/sharing-rules.mdx, content/docs/permissions/permissions-matrix.mdx, content/docs/permissions/index.mdx, .changeset/data-skill-optional-master.md, skills/objectstack-data/evals/*.json; cited code, read on origin/main 51992dff6 (none of these paths moved since merge base 719a502b2): packages/spec/src/data/controlled-by-parent-master.ts, packages/spec/src/data/object.zod.ts (forceCbpMasterDetailRequired, refuseControlledByParentWithoutOneMaster), packages/plugins/plugin-security/src/security-plugin-cbp-read-filter.ts, packages/plugins/plugin-security/src/security-plugin-cbp-write-gate.ts, packages/lint/src/data-model-rules.ts (cbpMasterReferenceFinding), packages/lint/src/validate-security-posture.ts (cbpMasterCandidates), packages/lint/src/validate-membership-key-declarations.ts, packages/qa/scenarios/src/score/scenario-tags.ts, packages/spec/src/contracts/security-service.ts, packages/verify/src/parent-write-reach.ts, scripts/check-skills-token-ratchet.mjs, scripts/pm/check-governed-merges.mjs, scripts/pm/check-governed-queue-guard.mjs; and the other content/docs pages that still teach a required-only master (error-handling.mdx, error-catalog.mdx, cli.mdx)

① Derived judgments

Inputs: card #30907 (body; the triage; the card-2 carry-over 6702057019; the unlock; the claim), sibling #30906 with PR #31082 (its body and its changeset 30906-cbp-null-master-write-gate.md), the PR body, its 11-file list and the net diff against merge base 719a502b2. Each taught fact was checked against the code on main:

• Which master_detail may be required: false. TRUE. controlledByParentMasterOf: exactly one required: true wins; otherwise the object's only master_detail, if it is === false, is the optional master. Refused: readonly/system on the one master, required or optional (master-not-writable). An omitted required is forced to true by ObjectSchema.create() (forceCbpMasterDetailRequired). Two master_detail with none required is refused (several-masters). The skill's "Refused beside a second master_detail" is true at create(), which throws for required: false beside any other master_detail. That is the door the skill teaches. (A raw parse admits it beside a required master as an ordinary parent, and that is not the master. Not a finding.) The lint-rules row matches cbpMasterReferenceFinding (soleMasterDetail && required === false passes; flags still reported).
• Who reads a null-master row. TRUE. computeControlledByParentFilter: nullMasterArm is {fk: null} under hasSuperuserReadBypass (View All or Modify All on the detail). Otherwise it is {fk: null} AND owner_id = caller when ownerColumn, else no arm. The master arm is OR-ed beside it. Skill, rls.mdx, sharing-rules.mdx, permissions-matrix.mdx and SKILL.md all say "the owner and View All".
• Who writes one. TRUE. nullMasterRowWritable admits hasSuperuserWriteBypass (Modify All), else owner_id non-null and equal to the caller. With no owner column, Modify All only. View All alone is refused (nullMasterOwnerDenied, leg master_chain).
• An insert naming no master is admitted. TRUE. if (masterId == null && rel.optional) { if (operation === 'insert') return; …. Batch rows that do name a master are still asked.
• Emptying a master asks edit on the stored master, and ownerMayEdit does not cover it. TRUE in code. masterId is the stored master, so the §3 walk asks edit on it. The owner leg carries !(rel.optional && bodyEmptiesMasterReference(opCtx.data, rel.fk)), and askBodyNamedMaster lets an optional master's null through. The ADR amendment, the PR body and the changeset all state it plainly. ⛔ must-fix M1, rules/relationships.md § Optional master: "emptying one asks edit on the stored master, ownerMayEdit aside." Read in the usual sense of "X aside" ("apart from X"), this makes ownerMayEdit an exception, so an opted-in owner would be able to empty with only read on the master. That is false, and it inverts the one fact card 2 pinned with its own ablation (A2). This file is what authors and agents read, so the sentence must say it directly. Suggested: "…asks edit on the stored master, even under ownerMayEdit." That is about +1 token, and the file has 8 of headroom.
• Chain hop. TRUE. assertControlledByParentChainEditable: nextMasterId == null && nextRel.optional, then nullMasterRowWritable on the master's own object, else master_chain. "Ends there under the same rule" is accurate.
• Membership-key line. TRUE. columnOf maps id to an empty meta slice, so valueFieldFault reports a non-reference and the rule is membership-key-value-field-invalid.
• authorization.mdx lint bullet. TRUE against cbpMasterCandidates: required masters first; with none, the spec's optional master. no-relation covers none, two none-required, an omitted required, and a required lookup. ambiguous-relation covers two or more required.
• ADR-0055 §3 amendment against what card 2 shipped. It matches the feat(security, verify): a controlled_by_parent row with no master is written by its owner or by Modify All on the detail #31082 body and changeset point for point: the owner rule, insert, by-id and predicate writes, setting (owner rule then edit on the new master), emptying (the §3 walk, opt-in excluded), chains, on-behalf-of (each pass its own principal), checkControlledByParentWrite answering allow/deny on master_chain (never unresolvable), proof via parent-write-reach.ts masters: 'none' (present on main), and a required master unchanged (422). It does not overclaim the chain-hop proof (plugin-security suite only, per feat(security, verify): a controlled_by_parent row with no master is written by its owner or by Modify All on the detail #31082).
• In-place marks. They are honest. Each of the four 2026-11-06 sentences (the status line; Ruling "amended again for §3 then"; Fail-closed "the write gate is unchanged"; What is unchanged "§3, the chain walk") keeps its original text byte for byte, with a dated ⚠️ note appended. The §3 rule line gains a second ⚠️ note beside the 2026-10-26 one. No history is rewritten.
• The five docs pages. They agree with the code and with each other (owner + View All reads; owner + Modify All writes). index.mdx's comment cites "ADR-0055 §1" for ownership. It is loose (the owner rule is §2/§3) but not false.
• Deleted restatements. All 11 were checked against their named homes, and each home carries the fact. relationships.md: the intro line repeats the H1 and ToC. The Delete Behaviors fence is covered by "cascade or restrict only; an authored set_null is refused". "Never summed on the client" is covered by "server-side". "Pairs naturally…" is covered by "inside the same transaction" plus Inline Editing's "one atomic transaction". "No form-view config…" and "primary, zero-config path" are covered by "on the relationship, in the data model — not in a form view". The ❌ comment is covered by the fence's own comment. The ✅ fence is the same object as the § One-to-Many: master_detail fence (invoice_line_item, required, cascade). security.md: the RLS comments are covered by the using/check prose directly above. "Rather than on a person or a position" is covered by the "Choose by what the rows are keyed on" list. SKILL.md: the dropped link is the Quick Reference L42 link. No unique fact is lost.
• Scorer (read-only). scenario-tags.ts L393 accepts any def.sharingModel === 'controlled_by_parent' without reading required, so no change is needed. That is correct.
• should-fix S1, rules/relationships.md § Owner edits: "every write needs edit access on the master" and "insert … still need master edit" now contradict the next subsection for a row that names no optional master (an insert is admitted; the owner rule governs). Qualify them, e.g. "of a row that names its master". Token headroom is tight; a same-file restatement deletion can pay for it.
• should-fix S2, ADR-0055 2026-11-07 amendment, owner-rule bullet: "Everyone else, View All included, is refused 403" is the gate's verdict. A principal who cannot read the row meets the read door's 404 RECORD_NOT_FOUND at step 2.7 first (pinned in feat(security, verify): a controlled_by_parent row with no master is written by its owner or by Modify All on the detail #31082). Narrow it to "everyone else who reaches the gate" or add the 404.

② Semver level

'@objectstack/skills': patch is right. Only skill prose ships (packages/skills is the published package, in the fixed group); content/docs and docs/adr do not publish, and the platform behaviour shipped in #30940/#31082. This matches the triage's prescription and the precedent for skill-text changesets. Clause-②: no and Metadata-protocol: none are right (no schema, contract or metadata meaning moves), and they are line-initial in both the PR body and the changeset.

③ Boundary flags

• Diff against the claim. The diff stays inside the claim: the four data-skill files, the five permissions pages, ADR-0055 and one changeset. No eval file changed, the ratchet file is unchanged against main, and packages/spec is untouched (security-service.ts included).
• Additional sentences in the 2026-11-06 amendment. They are within "the ADR". The claim's parenthetical names only the header line, but they are the same file, and carry-over item 1 names those body sentences ("still says §3 is unchanged and 'is amended again for §3 then'"). All edits are append-only marks.
• Tier. check-governed-merges GOVERNED_SURFACES: skills/** (row skills-catalog) and docs/adr/** (row adr) are GOVERNED_TIER_H. One Tier H path makes the whole PR Tier H. Landing needs a human merge or an approval from GOVERNED_APPROVERS (os-zhuang, hotlong). The PR body says so, and mergeable_state is blocked.
• Spec jsdoc owed in the PR body. The wording is accurate against security-service.ts on main. L342–348 master_chain omits the record-itself null-master refusal and the optional hop. L377–378 master_reference_missing should say "required". L1064–1065 checkControlledByParentWrite should name the owner/Modify All alternative. Each matches the gate (nullMasterOwnerDenied → master_chain; MasterReferenceMissingError is only reached for a required master).
• should-fix S3, the other-docs list in the PR body is incomplete:
  • error-handling.mdx L286, 559–562 and 590–596, error-catalog.mdx 189–196, 214–216 and 1014, and cli.mdx L2142 are correct as listed.
  • Missing: content/docs/deployment/cli.mdx L2707–2711. The --parent-write-reach paragraph says a write is "admitted exactly when the caller holds that verb … and can edit its master", but verify now also proves null-master rows by the owner rule.
  • Missing: content/docs/protocol/kernel/error-handling.mdx L568–577. The declaration table lists required shapes only, and "Only the first row is a declaration the parse accepts" no longer holds: required: false on the sole master_detail is accepted, and emptying it is admitted under the owner rule.
  • Add both to the list and to the follow-up.
• should-fix S4, carry-over item 2. The claim says the seat files the spec-lane card for the security-service.ts jsdoc, but no such card is linked on controlled_by_parent admits an optional master (3/3): docs and the authoring skills teach it instead of a copied owner field #30907's thread. File it and link it from the card or the PR before merge, so the owed wording does not get lost.

④ Design judgment

• One home per rule. Yes. The optional master has one home, rules/relationships.md § Optional master. security.md's chooser line, SKILL.md's OWD row and lint-rules.md's row point to it or summarise it in one clause. The ADR keeps the mechanism and the docs pages carry one-line summaries.
• Token budget. ceil(bytes/4), SKILL.md version line excluded, ceilings read from check-skills-token-ratchet.mjs on main, no row raised:

All four are within ceiling; the readings match the PR body.

• Eval sweep. No case pins a required master for the optional-master scenario, and none pins a copied owner field. objects-fields-relationships.json ✨ Set up Copilot instructions #2 keeps required: true on an invoice line (right: a line always has its invoice), and its "every other write still needs master edit" is true for a required master. hooks-security-seeds-datasources.json Add metamodel interfaces for ObjectQL/ObjectUI contract #1 is a search mirror, not an owner copy, and Migrate from npm to pnpm #6 (membership keys, "no owner stamp per order") is still right.
• Against the card's scenario. "A rep sees the contacts of the accounts they own; a contact need not have an account" is taught as account: { type: 'master_detail', reference: 'account', required: false } on a controlled_by_parent contact. That is what main admits and serves. It is sound apart from M1's wording.
• Check-runs on this head, read 2026-11-07T06:23Z: 43 runs, 29 success, 12 skipped, 0 failed. Test Core (1/8) and Test Core (2/8) are still in progress.

Must-fix: M1. Should-fix: S1, S2, S3, S4.

Implemented-by: claude/project-thread-6r15z0
Reviewed-by: session_01J8VVAj7CvjkGXvgXzd6RZ7

VERDICT: FAIL

domain:skills#3 · huangyiirene · session_01J8VVAj7CvjkGXvgXzd6RZ7

Contract-review-claim: session_01J8VVAj7CvjkGXvgXzd6RZ7 · head 9cea5ad · 2026-11-07T06:41Z

Delta review against the FAIL at head 197aa7c (comment 6703355433: must-fix M1, should-fixes S1–S4). The delta is one commit to relationships.md and ADR-0055 answering M1, S1 and S2, plus the PR body (patched by the seat). S3 and S4 are filed as #31095 and #31094. The seat review runs at CONTRACT_REVIEW_TIER in an isolated subagent.

domain:skills#3 · huangyiirene · session_01J8VVAj7CvjkGXvgXzd6RZ7

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 9cea5ade1ac2b88a4bfe249ce0252266d842d300
Local-runs: none
Scope: docs/adr/0055-master-detail-controlled-by-parent.md, skills/objectstack-data/SKILL.md, skills/objectstack-data/references/lint-rules.md, skills/objectstack-data/rules/relationships.md, skills/objectstack-data/rules/security.md + the delta 197aa7c88..9cea5ade1 (relationships.md, ADR-0055); the PR body as patched; issues #31094 and #31095; code read on origin/main b63157335 (it moved from 51992dff6, touching none of skills, docs/adr, content/docs, plugin-security, spec, lint, verify, the ratchet or check-governed-merges): packages/plugins/plugin-security/src/security-plugin-cbp-write-gate.ts (assertControlledByParentWrite, nullMasterRowWritable, bodyEmptiesMasterReference, the owner leg, askBodyNamedMaster, the chain walk), packages/plugins/plugin-security/src/security-plugin-authz-middleware.ts (step 2.7, callerCannotReadAddressedRow, recordNotFoundError), packages/spec/src/contracts/security-service.ts, scripts/check-skills-token-ratchet.mjs

① Derived judgments

This is a delta review against the FAIL at 197aa7c88 (M1, S1–S4). There is one new commit, 9cea5ade1, with 4 lines changed in 2 files (relationships.md, ADR-0055). The net diff against main is still the same 11 files, and no other file moved.

• M1: answered, TRUE. § Optional master now reads "emptying one asks edit on the stored master, even under ownerMayEdit". On main, the owner leg carries !(rel.optional && bodyEmptiesMasterReference(opCtx.data, rel.fk)), so an emptying body skips the read-on-master leg. It then takes assertControlledByParentChainEditable on the stored masterId, which is edit on the master. The ambiguous reading is gone.
• S1: answered, TRUE. The § Owner edits sentences are now scoped to rows that name a master.
  • "every write of a row naming a master needs edit on it": the gate asks the walk of the stored master on a by-id write, of each master a predicate write selects, and of the master an insert names. A re-pointed body is also asked of its new master (askBodyNamedMaster).
  • "insert, delete, predicate (multi: true) updates and on-behalf-of writes under a master still need its edit": the owner leg is by-id update only, and !opCtx.context.onBehalfOf.userId. Every other shape under a master takes the walk.
  • Neither sentence now contradicts § Optional master, where an insert naming no master is admitted and the owner rule governs a null-master row.
• S2: answered, TRUE for the shape it names. The owner-rule bullet now says 403 "to everyone else who reaches the gate". It adds that a principal who cannot read the row meets the read door first (404 RECORD_NOT_FOUND, step 2.7). On main, step 2.7 (security-plugin-authz-middleware.ts, security(data): a by-id write answers 403 for a row the caller cannot read and 404 for an id that does not exist, for principals the write pre-image check does not bind: an existence signal the read door withholds #21771) asks callerCannotReadAddressedRow for the by-id write the caller addressed, and throws recordNotFoundError before the 2.8 gate runs. This holds for every principal class, which is the "as for every hidden row" the sentence claims. A principal whose read of the whole object is refused gets that refusal instead, and a predicate write never selects a row its caller cannot read. The sentence speaks of "the row", an addressed row, so neither case makes it false. Not a finding.
• New false or over-broad claims added by the delta: none. The three changed sentences were each read against the code above, and the rest of the delta is the same text.
• should-fix S5 (it predates this round; this delta did not add it; it does not block): § Owner edits still opens with "reads are scoped to accessible masters". That is incomplete for an optional master's null-master row, which its owner and View All read (computeControlledByParentFilter's nullMasterArm). This is the read twin of S1. The next subsection states the read rule, so the gap is one hop away. relationships.md has 2 tokens of headroom, so a fix needs a same-file deletion. Fix it here or carry it with docs: error-handling, error-catalog and cli pages still say a controlled_by_parent master is always required (optional master, cards #30905/#30906) #31095.

② Semver level

Unchanged from round 1. The changeset is still '@objectstack/skills': patch, with Clause-②: no and Metadata-protocol: none line-initial in the body and the changeset. The delta is skill and ADR prose only. That is right.

③ Boundary flags

• The delta stays inside the claim. It touches relationships.md and ADR-0055, both claimed files. packages/spec is untouched, no eval file changed, and the ratchet script is identical to main.
• S3: carried by docs: error-handling, error-catalog and cli pages still say a controlled_by_parent master is always required (optional master, cards #30905/#30906) #31095. Adequate. The issue is open and labelled finding. It lists every site from round 1, including the two this review added: error-handling.mdx L568–577 (the declaration table and "Only the first row…") and cli.mdx L2707–2711. It also has the original error-handling L286/559–562/590–596, error-catalog L189–196/214–216/1014, and cli L2142. It says what changed on the platform, excludes release pages, and names this PR's pages as the wording to agree with. The cli L2707–2711 entry names the paragraph but not its stale clause ("admitted exactly when … can edit its master"). The line range is enough to find it.
• S4: carried by spec: security-service contract jsdoc still describes a controlled_by_parent master as always required (optional master, cards #30905/#30906) #31094. Adequate. The issue is open and labelled finding. Its three owed rewordings match the ones verified in round 1 against security-service.ts and the write gate (master_chain L342–348, master_reference_missing L377–378, checkControlledByParentWrite L1064–1065). It routes the work to the spec lane, jsdoc only. It proposes an '@objectstack/spec': patch with Clause-②: no, which triage confirms.
• The body points to both issues and drops the two inline lists.
• Tier: unchanged, H. skills/** and docs/adr/** need a human merge or an approval from os-zhuang or hotlong, and the PR's mergeable_state is blocked.

④ Design judgment

• Token budget (ceil(bytes/4), ceilings read from main, no row raised):

relationships.md matches the claimed 3871/3873, a delta of +6 with no deletion. The SKILL.md figure has its version line excluded.

• The body matches the diff.
  • The token table row is updated (3865 → 3871).
  • The "Review round 1" section describes M1, S1 and S2 exactly as committed: one new commit, no force-push. 197aa7c88 is an ancestor of the new head.
  • S3 and S4 point to docs: error-handling, error-catalog and cli pages still say a controlled_by_parent master is always required (optional master, cards #30905/#30906) #31095 and spec: security-service contract jsdoc still describes a controlled_by_parent master as always required (optional master, cards #30905/#30906) #31094.
  • The gate section names head 9cea5ade1.
  • The rest of the body (taught-facts table, deletions, eval sweep, scorer) is unchanged and still true at this head.
• One home per rule: unchanged. The delta adds no restatement.
• Check-runs on this head (read 2026-11-07T06:43Z): 45 runs, 19 success, 14 skipped, 0 failed.
  • Still in progress (12): Build Core, Build Docs, Check Changeset, the four Lint jobs (CI, release & engine gates; ESLint; docs & code guards; repo & tooling gates), Test Core (1/8), (2/8) and (3/8), and Type Check · consumer gates and · source gates.
  • Test Core (1/8) and (2/8), which were pending at round 1's head, finished success there.

Must-fix: none. Should-fix: S5 (it predates this round and does not block). Round 1's M1, S1 and S2 are answered in the diff, and S3 and S4 are carried by #31095 and #31094.

Implemented-by: claude/project-thread-6r15z0
Reviewed-by: session_01J8VVAj7CvjkGXvgXzd6RZ7

VERDICT: PASS

domain:skills#3 · huangyiirene · session_01J8VVAj7CvjkGXvgXzd6RZ7

Contract-review-claim: session_01J8VVAj7CvjkGXvgXzd6RZ7 · head a60b01a · 2026-11-07T06:57Z

Delta review against the PASS at head 9cea5ad (comment 6703520499). The delta is one commit to relationships.md answering that review's S5 (the owner-edit section's read rule scoped to rows that name a master), plus the PR body (patched by the seat). The seat review runs at CONTRACT_REVIEW_TIER in an isolated subagent.

domain:skills#3 · huangyiirene · session_01J8VVAj7CvjkGXvgXzd6RZ7

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: a60b01a6eaddce9cd91fc9b7db1773dc45d1b4d4
Local-runs: none
Scope: docs/adr/0055-master-detail-controlled-by-parent.md, skills/objectstack-data/SKILL.md, skills/objectstack-data/references/lint-rules.md, skills/objectstack-data/rules/relationships.md, skills/objectstack-data/rules/security.md + the delta 9cea5ade1..a60b01a6e (relationships.md § Owner edits); the PR body as patched; code read on origin/main b63157335: packages/plugins/plugin-security/src/security-plugin-cbp-read-filter.ts (computeControlledByParentFilter, its master arm and nullMasterArm), packages/plugins/plugin-security/src/security-plugin-cbp-write-gate.ts (assertControlledByParentWrite, the owner leg, the masterId == null && rel.optional block), scripts/check-skills-token-ratchet.mjs

① Derived judgments

This is delta review 2, against the PASS at 9cea5ade1, which carried one should-fix, S5. The delta is one commit, a60b01a6e, with 2 lines changed in relationships.md § Owner edits. The net diff against main is still the same 11 files, and nothing else moved. 197aa7c88 and 9cea5ade1 are ancestors of this head, so nothing was force-pushed.

• S5: closed, TRUE. The opening sentence now reads "A controlled_by_parent detail row naming a master inherits its access: reads are scoped to accessible masters and every write needs edit on the master". The subject is now a row that names a master, so both halves speak of that row.
  • The read half: such a row is matched only by the master arm, { fk: { $in: ReadableIds.of(master) } }. The null-master arm matches only { fk: null }, and the two arms never share a row.
  • The write half: a by-id write of such a row takes the walk on its stored master, a predicate write takes the walk on each selected master, and an insert naming one is asked of it. A re-pointing body is also asked of its new master. The only exception is the ownerMayEdit leg, which the very next sentence introduces as the opt-in. So "every write needs edit on the master" holds as the default the section then narrows. It matches S1's former qualifier, which moved into the subject.
• Consistent with the rest of the file and with security.md.
  • § Optional master still states the null-master rules: the owner or View All reads, the owner or Modify All writes, an insert naming none is admitted, emptying asks edit on the stored master even under ownerMayEdit, and a chain hop ends under the same rule.
  • "Nothing else widens — … writes under a master still need its edit" is unchanged and agrees with the new subject.
  • security.md's chooser line ("a parent's owner, parent optional → an optional master") is unchanged and does not conflict.
• New false or over-broad claims: none. The delta is this one sentence, re-read against both functions above.

② Semver level

Unchanged. The changeset is still '@objectstack/skills': patch, with Clause-②: no and Metadata-protocol: none line-initial in the body and the changeset. The delta is skill prose only. That is right.

③ Boundary flags

• The delta stays inside the claim. It touches one claimed file. packages/spec is untouched, no eval file changed, and scripts/check-skills-token-ratchet.mjs is identical to main, so no ratchet row moved.
• S3 and S4 are still carried by docs: error-handling, error-catalog and cli pages still say a controlled_by_parent master is always required (optional master, cards #30905/#30906) #31095 and spec: security-service contract jsdoc still describes a controlled_by_parent master as always required (optional master, cards #30905/#30906) #31094, as judged in delta review 1.
• Tier: unchanged, H. The PR needs a human merge or an approval from os-zhuang or hotlong, and its mergeable_state is blocked.

④ Design judgment

• Token budget (ceil(utf8 bytes / 4), the convention the ratchet's own header states):

relationships.md is 3870 of 3873, which holds the claimed reading (−1 from 3871). The figures were measured from git show bytes under the read-only shape, not by running the script on a worktree; the arithmetic is the script's.

• Line cap 120 B: holds. The two changed lines are 89 B and 70 B. No added line anywhere in the net diff exceeds 120 B.
• The body matches the diff. The token row is updated (3871 → 3870). The "Review round 2" section quotes the committed sentence exactly and states −1 token with no ratchet move. The gate section names head a60b01a6e.
• One home per rule: unchanged.
• Check-runs on this head (read 2026-11-07T06:58Z): 45 runs, 18 success, 14 skipped, 0 failed.
  • Still in progress (13): Build Core, Build Docs, Check Changeset, the four Lint jobs, Live E2E UI, Test Core (1/8), (2/8) and (3/8), and Type Check · consumer gates and · source gates.
  • The previous head 9cea5ade1 finished green: 34 success, 14 skipped, 0 failed.

Must-fix: none. Should-fix: none. S5 is closed. Round 1's M1, S1 and S2 stay answered, and S3 and S4 stay carried by #31095 and #31094.

Implemented-by: claude/project-thread-6r15z0
Reviewed-by: session_01J8VVAj7CvjkGXvgXzd6RZ7

VERDICT: PASS

domain:skills#3 · huangyiirene · session_01J8VVAj7CvjkGXvgXzd6RZ7

维护者速读

• 改了什么: 数据技能(skills/objectstack-data 的 rules/relationships.md、rules/security.md、references/lint-rules.md、SKILL.md)、五个权限文档页和 ADR-0055 改教「可选主表」:controlled_by_parent 子对象的唯一 master_detail 可写成 required: false,不再教「复制属主字段再用钩子同步」。没挂主表的行归属主读写;挂主表要对新主记录有编辑权，清空主表要对原主记录有编辑权(ownerMayEdit 不覆盖)。ADR-0055 新增 2026-11-07 的 §3 修订。另加 '@objectstack/skills': patch changeset。11 个文件。
• 为什么改: 您对 controlled_by_parent admits an optional master (1/3): spec, lint and the read owner branch: a null-master detail row is readable by its owner only #30905 的裁决「A」分三张卡落地，第 1、2 张(PR feat(spec,security): a controlled_by_parent object may declare an optional master #30940、feat(security, verify): a controlled_by_parent row with no master is written by its owner or by Modify All on the detail #31082)已合并，平台已支持；技能和文档还在教老路。这是第 3 张(controlled_by_parent admits an optional master (3/3): docs and the authoring skills teach it instead of a copied owner field #30907)。
• 风险与回滚: 只改技能文字、文档、ADR,无运行时影响；四个技能文件都在 token 天花板内，棘轮行不动。可整 PR revert。
• 先看: skills/objectstack-data/rules/relationships.md 的「Optional master」小节，以及 ADR-0055 末尾的 2026-11-07 修订。
• 两分钟验证: node scripts/check-skills-token-ratchet.mjs,exit 0。
• 需要你做的: skills/** 和 docs/adr/** 是受治理 Tier H 面，需 os-zhuang 或 hotlong 在 GitHub 上 Approve 一次。达档复核：全量 6703355433 FAIL(M1 + S1–S4),增量 6703520499 PASS(S5),增量 6703659321 PASS,Head-sha a60b01a6eaddce9cd91fc9b7db1773dc45d1b4d4。批准后本席落地。
• 席位意见: ACCEPT。

席位核对 — ACCEPT · domain:skills#3 · head a60b01a6eaddce9cd91fc9b7db1773dc45d1b4d4

1. 形态: draft → main,Fixes #30907;'@objectstack/skills': patch,Clause-②: no,Metadata-protocol: none;作者 objectstack-fleet[bot];11 个文件，在认领面之内(四个技能文件、五个权限文档页、ADR-0055、changeset)。
2. 前提实测: 复核逐项对照 main 代码:object.zod.ts 的 master-not-required 细化、security-plugin.ts 的 computeControlledByParentFilter 空主表分支与写门、相关 lint 规则；scenario-tags.ts 只读核对结果见 PR 正文。
3. 门禁(钉 head a60b01a6): dev 派生门禁 75 条全部 exit 0,0 条未测;check-runs 48 条:34 success、14 skip、0 失败;棘轮读数 relationships.md 3870/3873、SKILL.md 6071/6078、security.md 3696/3698、lint-rules.md 958/970,无行变动;新增行均 ≤ 120 B。check-governed-merges --pr 31092:Tier H(skills/**、docs/adr/**)。
4. 接受的偏差: 无。首轮 FAIL 的 M1、S1、S2 与增量一的 S5 已在新提交改正并经增量复核确认;PR 正文由本席按新 diff 更新。
5. 范围外去向: S3 → docs: error-handling, error-catalog and cli pages still say a controlled_by_parent master is always required (optional master, cards #30905/#30906) #31095(其他 content/docs 页),S4 → spec: security-service contract jsdoc still describes a controlled_by_parent master as always required (optional master, cards #30905/#30906) #31094(security-service.ts jsdoc,spec 车道)。
6. 落地条款: Tier H。保持 draft,挂 pm:awaiting-merge,请 os-zhuang、hotlong 审批;获批后本席过落地前检、清标、ready、auto-merge;维护者直合亦可。