@@ -88,8 +88,8 @@ conditions freshly after every push.
    across all pages has `isResolved: true`, and every check has finished and passed, stop —
    report the outcome (see "Reporting" below) and skip the rest of this list.
 
-2. **If the PR has a merge conflict**, merge `origin/staging`, resolve the conflicts, run the
-   usual pre-push checks, push, and go to step 8 to re-trigger review.
+2. **If the PR has a merge conflict**, merge `origin/staging`, resolve the conflicts, run `/ship`
+   steps 4–6 on the merge result, push, and go to step 8 to re-trigger review.
 
 3. **If no review has run yet** (fresh PR, no bot comments): both run automatically on PR open —
    confirm via `gh pr checks <n>` (look for `Greptile Review` and `cubic · AI code reviewer`) and
 
@@ -7,7 +7,7 @@ argument-hint: "[scope] [fix=true|false]"
 # Cleanup
 
 Arguments:
-- scope: what to review (default: your current changes). Examples: "diff to main", "PR #123", "src/components/", "whole codebase"
+- scope: what to review (default: your current changes). Examples: "diff to staging", "PR #123", "src/components/", "whole codebase"
 - fix: whether to apply fixes (default: true). Set to false to only propose changes.
 
 User arguments: $ARGUMENTS
 
@@ -34,7 +34,7 @@ Never put expand and contract in the same PR. If this PR both removes the code t
 | Change a column type | add a new column of the new type; dual-write | backfill, swap reads, drop old |
 | Add FK / CHECK | `ADD CONSTRAINT ... NOT VALID` | `VALIDATE CONSTRAINT` separately |
 | Index an existing table | `COMMIT;` breakpoint → `SET lock_timeout = 0` → `CREATE INDEX CONCURRENTLY IF NOT EXISTS` (see `packages/db/scripts/migrate.ts`) | — |
-| Drop an index | `COMMIT;` breakpoint → `DROP INDEX CONCURRENTLY` — plain `DROP INDEX` takes ACCESS EXCLUSIVE on the table | — |
+| Drop an index | `COMMIT;` breakpoint → `DROP INDEX CONCURRENTLY IF EXISTS` — plain `DROP INDEX` takes ACCESS EXCLUSIVE on the table | — |
 | Backfill data | batched + idempotent `UPDATE` (keyset/`WHERE`, bounded) | — |
 
 A `CREATE INDEX`, `ADD COLUMN`, or `ADD CONSTRAINT` against a table **created in the same migration** is always safe (no rows, no live traffic) — the lint already suppresses those.
@@ -53,6 +53,7 @@ workspaceId: text('workspace_id'),
 Format: `contract-pending(<precondition>): <what to drop> — <why it's safe once the precondition holds>`. The precondition names the PR/release that removes the last reader and **must be fully deployed** before the contract ships.
 
 - **The TODO list is a grep** — always accurate, never drifts: `grep -rn "contract-pending" packages/db apps/sim`. Run it when starting migration work to see what is owed.
+- While a drop is pending, tag each doomed column `@deprecated` and make every read of that table name its columns: no argless `select().from(t)`, `findFirst()` without `columns`, argless `.returning()`, or bare `getTableColumns(t)` — use `omit(getTableColumns(t), [...])`. `check:pending-drop-tables` enforces this.
 - For anything with a real owner or schedule, also open a tracking issue and put its number in the marker.
 - **Close the loop in the contract PR:** the contract migration's `-- migration-safe:` annotation references the expand, and you **delete the `contract-pending` marker** in the same PR:
   ```sql
@@ -74,8 +75,8 @@ The lint flags risky *shapes*; it cannot know whether a given drop is *safe righ
 1. Edit `packages/db/schema.ts`, then `cd packages/db && bunx drizzle-kit generate` to produce the SQL. If this is an expand that defers a drop, leave a `contract-pending` marker on the legacy column (see "Tracking the contract"). If this is the contract, delete the marker it resolves.
 2. Hand-edit the generated SQL where the playbook requires it: `CONCURRENTLY` + `COMMIT;` breakpoint for indexes on existing tables, `NOT VALID` for constraints, batching for backfills.
 3. Run `bun run check:migrations` (base defaults to `origin/staging`).
-   - **Hard errors** (`add-not-null-no-default`, `rename`, `index-not-concurrent`, `constraint-not-valid`, …): rewrite into expand/contract. Do **not** try to annotate them away — the lint won't accept it.
-   - **Annotate tier** (`drop-table`, `drop-column`, `drop-default`, `set-not-null`, `alter-type`, `drop-index`): only after you've confirmed steps 1–3 above, add a comment on the line directly above the statement:
+   - **Hard errors** (`add-not-null-no-default`, `rename`, `index-not-concurrent`, `concurrent-index-not-idempotent`, `concurrent-index-no-commit`, `drop-index-not-concurrent`, `concurrent-drop-index-not-idempotent`, `concurrent-drop-index-no-commit`, `constraint-not-valid`, …): rewrite into expand/contract. Do **not** try to annotate them away — the lint won't accept it.
+   - **Annotate tier** (`drop-table`, `drop-column`, `drop-constraint`, `drop-default`, `set-not-null`, `alter-type`): only after you've confirmed steps 1–3 above, add a comment on the line directly above the statement:
      ```sql
      -- migration-safe: `secret` read removed in v0.6.1 (#1234), shipped two deploys ago
      ALTER TABLE "webhook" DROP COLUMN "secret";
 
@@ -72,9 +72,7 @@ For those, require all three:
 - skip oversize at listing (`stubOrSkipBySize` with the reported size) and again at fetch time (overflow -> `markSkipped`), since the listing size can be missing or under-reported
 - never drop/truncate silently — oversized files become content-less failed rows carrying `skippedReason`, so they stay visible in the KB UI instead of vanishing from the index
 
-Skip the pattern when the source already bounds the payload:
-- pure API/structured-data connectors (Jira, Linear, Notion, Confluence, Sentry, Slack, Zendesk, Gmail, ...) — paginated JSON/text; apply normal pagination + concurrency bounds instead of a per-file byte cap
-- native-document connectors capped by the platform (Google Docs ~50 MB, Google Sheets via `MAX_ROWS`, Evernote ~25 MB/note) — a 100 MB cap can never fire, and wrapping a `response.json()`/Thrift parse in `readBodyWithLimit` is cargo-culting
+Skip the *per-file `CONNECTOR_MAX_FILE_BYTES` + skipped-row* pattern when the source bounds the item count (paginated JSON: Jira, Linear, Sentry, Slack, Zendesk, Gmail, ...). Every response body is still read through `readBodyWithLimit` with a connector-specific budget (`MAX_DOCS_RESPONSE_BYTES` in google-docs, `MAX_CONTENT_BYTES` in google-sheets, a remaining-bytes budget in notion). Confluence attachments use the full file pattern.
 
 Litmus test: "Can a user make this one fetch arbitrarily large, with nothing upstream stopping it?" Yes -> use the pattern. No (platform hard-cap, or already paginated) -> a per-file byte cap adds noise, not safety. Borderline: a user-configured/self-hosted endpoint with no platform cap (e.g. Obsidian) — bound it only if the content is genuinely unbounded.
 
 
@@ -166,7 +166,7 @@ Do not create internal-, public-, or Copilot-specific versions of the same seman
 
 Choose principal kinds from actual behavior. Do not accept every principal merely because the use case is shared. Workspace API keys have a write ceiling and cannot satisfy admin operations. The operation definition must fail fast when its role, workspace-key policy, and principal kinds disagree.
 
-`capability` is required — name the permission-group capability that governs the operation, or `'none'` with a `// permission-group-exempt: <reason>` comment directly above it. `defineWorkspaceOperation` throws at definition time when it is absent. See `add-permission-group-item`.
+`capability` is required: a static, operation-declarable capability (not parameterized, not principal-wide), or `'none'` with a `// permission-group-exempt: <reason>` comment directly above it. If `principalKinds` includes `oauth_access_token`, `oauthScope` (`api:read` | `api:write` | `search:read`) is required. `defineWorkspaceOperation` throws at definition time on any violation. See `add-permission-group-item`.
 
 Route declarations, tool adapters, and use cases must use the same literal operation. Runtime operation selection is permitted only from a trusted, code-defined registry. Never accept an operation ID or permission tag from an HTTP body, model argument, or other untrusted input.
 
@@ -317,7 +317,7 @@ Stop and report a missing design rather than weakening identity, authorization,
 
 ## Test each risk at one boundary
 
-Run the `test-audit` authoring gate before writing any test. Own each risk at exactly one boundary:
+Run the `test-audit` authoring gate before writing any test. Prefer one E2E/integration run over the real boundary; where a use-case unit test is justified, list its failure modes before writing code (CLAUDE.md → Testing). Own each risk at exactly one boundary:
 
 - Application use-case tests own authorization, principal-kind rejection before canonical loading, workspace assertion mismatch, delegated scope, not found, conflict, no-op, audit derived from authoritative results, and infrastructure failures (storage, rate-limit, provider, or database errors raised by delegated services) propagating as 5xx-mapped errors — never converted to not-found or forbidden.
 - One `*.integration.ts` owns repository semantics: canonical active lookup, workspace-predicated writes, archived resources, authoritative affected rows, and database error propagation.
@@ -335,7 +335,7 @@ Run at minimum:
 bun run --cwd apps/sim test <focused test files>
 bunx biome check <changed source and test files>
 bunx turbo run type-check --filter=@sim/app --filter=@sim/auth
-bun run check:api-validation:strict
+bun run check:audits
 git diff --check
 ```
 
 
@@ -45,6 +45,7 @@ When the user runs `/ship`:
   - Then run root `bun run test` from the repo root. It chains `test:scripts` (the `scripts/*.test.ts` suite CI runs) before every workspace suite; workspace-scoped runs skip it, which is how a `scripts/check-*.test.ts` failure has reached CI. A failing test aborts ship.
 5. **Run migration safety** — only if the diff touches `packages/db/migrations/**` or `packages/db/schema.ts`:
   - Run `/db-migrate` to review the migration for zero-downtime safety (expand/contract phasing, backward-compatibility with the deployed app version).
+  - `cd packages/db && bunx drizzle-kit generate` must leave `git status --porcelain packages/db/migrations` empty (CI's schema/migration sync step).
   - `bun run check:migrations origin/staging` must pass (staging is the PR base). Do not silence a flagged statement with a `-- migration-safe:` annotation unless `/db-migrate` confirmed the old code no longer depends on it; otherwise split the destructive change into a later deploy.
 6. **Run pre-ship checks** from the repo root before staging. This has two phases: first **regenerate** every committed artifact so generated files never drift into a CI failure (this is what catches things like `agent-stream-docs` going stale after a `models.ts` edit), then run the **full audit suite** CI's `Lint and Test` job enforces. Both phases parallelize — but only across commands that write **disjoint** outputs — and a bare `wait` swallows child exit codes, so both phases below explicitly collect each job's status and abort ship if any failed.
 
 
@@ -17,19 +17,9 @@ mechanics (global mocks, `@sim/testing`, performance rules).
 
 ## The three rules
 
-1. **Never write unit tests after you write code.** A test written to describe code that already
-   exists restates the implementation, passes on the first run, and proves nothing. If the change
-   needs proof, prove it end to end.
-2. **Prefer E2E tests; use them to verify complex features.** Exercise the real boundary — real
-   Postgres/Redis (`*.integration.ts`), a running app over real HTTP, or the packaged desktop app
-   (Playwright). Every E2E run ends with a **verifiable, repeatable artifact**: a JSON report of
-   checks with pass/fail and durations, an HTTP status log, a trace, or a screenshot, written to a
-   path the caller controls (`<SUITE>_REPORT_PATH`) and uploaded by CI on failure.
-   `apps/sim/scripts/test-scim-e2e.ts` is the reference shape.
-3. **If you must test a system in isolation, write the failure modes down first, then write the
-   code.** List every way the unit can fail (bad input, boundary, concurrency, partial failure,
-   permission denial, resource cap). Each listed mode becomes one test that fails before the code
-   exists. A mode you cannot list is not a test you should write.
+CLAUDE.md → Testing sets them: no unit tests after the code; prefer E2E at the real boundary,
+ending in a verifiable artifact; list failure modes before testing in isolation. A mode you cannot
+list is not a test you should write. This skill enforces them.
 
 ## Authoring gate