docs(skills): readonly is stripped from any non-system write, not only an UPDATE payload

[claude]

Part of #14147 — the governed-prose half, landing separately by the ruling's own
instruction (comment 5522734749: the two skills/** edits "are a governed surface
and land as a separate draft PR requesting review from os-zhuang and hotlong,
human merge, cross-linked from the code PR").

⛔ Human merge. Not to be flipped ready, enqueued or auto-merged by an agent.

What changed, and why the old sentence is now false

The maintainer ruled on 2026-09-03 (option C, verbatim 「同意」, presented as
overturning their own 2026-07-24 "INSERT (all callers) exempt" row) that a static
readonly field is stripped from a non-system caller's INSERT payload inside
engine.insert, by the same stripReadonlyFields that already runs on
engine.update. The published catalog described the strip as an UPDATE-payload
rule, which understated it on exactly the write where an author is most likely to
seed a protected column — a create.

file	before	after
skills/objectstack-data/SKILL.md	"the field silently stripped from an UPDATE payload"	"the field stripped from any non-system write"
skills/objectstack-automation/SKILL.md	"silently strips a readonly field from an update_record payload"	"strips a readonly field from any non-system write — create_record and update_record alike … and the drop is named in the step's warnings"

silently is deleted rather than reworded: the same ruling made it false. A
non-system create now reports the drop through droppedFields and, in a flow,
through the step's own warnings.

Ratchet accounting

New text is paid for by deleting text in the same file — never by re-wrapping.

measurement	before	after	ceiling
skills/objectstack-data/SKILL.md (lines)	851	851	—
skills/objectstack-automation/SKILL.md (lines)	949	950	—
whole published bundle, all SKILL.md (lines)	6835	6836	—
skills/objectstack-data/SKILL.md (tokens)	10009	10004	10009
skills/objectstack-automation/SKILL.md (tokens)	12287	12289	12768

The token ratchet is the one that gates (check:skills-token-ratchet), and the
data skill is now 5 tokens under its ceiling rather than at it. An earlier draft
of this edit measured 10021 — 12 over — and was rewritten down rather than
granted a ceiling raise; ceilings here are shrink-only and MAINTAINER-ONLY.

Gates — per family, with exit codes

43 families derived from the actual change set with
node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack, all run
individually. 40 exit 0, including every skills family:
check:pm-skill-ratchet 0 · check:skills-token-ratchet 0 (run directly) ·
check:skill-compatibility 0 · check:skill-frame-sync 0 ·
check:skill-identifier-liveness 0 · check:pm-governed-prose 0 ·
check:doc-authoring 0 · check:nul-bytes 0 · check:spec-changes 0 ·
check:partof-closing-keyword 0 · check:corpus-claim-drift 0.

Three did not measure, none of them a verdict on this diff:

family	exit	why
check:doc-formula-expressions	3	PREREQUISITE NOT MET — @objectstack/formula unbuilt in this worktree
check:react-declaration-parity	1	"MANIFEST is not set" — needs an objectui checkout and a browser dump
check:published-readme-exports	1	reads dist/*.d.ts of packages this fresh worktree has not built

CI builds first and runs the farm exactly once, which is where these three get
their real reading.

Verification

The behaviour these two paragraphs now describe is pinned by the code PR, not by
prose: packages/objectql/src/engine-insert-static-readonly-strip.test.ts (16
cases, real ObjectQL) and
packages/services/service-automation/src/builtin/create-record-readonly-drop.test.ts
(a real flow run whose create_record step reports the drop, and whose
runAs: 'system' sibling still seeds the column).

---

Generated by Claude Code

[claude]

Cross-link: the code half of #14147 is #15395 — engine + metadata-protocol + lint + service-automation. It is draft, labelled needs:contract-review, and awaiting a PASS at CONTRACT_REVIEW_TIER: ⛔ not enqueued, ⛔ no auto-merge, and only a seat at that tier releases it afterwards.

The sentence these files now carry is pinned by that PR, not by prose: packages/objectql/src/engine-insert-static-readonly-strip.test.ts (16 cases against a real ObjectQL) and packages/services/service-automation/src/builtin/create-record-readonly-drop.test.ts (a real flow run whose non-system create_record step reports the drop, and whose runAs: 'system' sibling still seeds the column).

---

Generated by Claude Code