docs: regenerate rules from documentation@2cfb813

[harper-skills-sync]

Automated regeneration of docs-driven skill rules, now synced to HarperFast/documentation@2cfb813.

Why these rules changed

This PR changes each rule below relative to main, where it was last synced from the docs commit shown. The trigger commit is not necessarily what changed a given rule — drift accumulates across every docs commit since the rule’s recorded baseline (below).

• automatic-apis — last synced from docs@677ad21
• deploying-to-harper-fabric — last synced from docs@677ad21
• extending-tables — last synced from docs@ce0ab71
• handling-binary-data — last synced from docs@ce0ab71
• querying-rest-apis — last synced from docs@677ad21
• schema-design-tooling — last synced from docs@677ad21
• using-blob-datatype — last synced from docs@f37a8c4
• v5-upgrade — last synced from docs@677ad21
• enabling-mcp — last synced from docs@d7d2ddb

Docs commits since baseline (ce0ab71..2cfb813)

2cfb8131	Give the fallbacks of a rejected release sentences of their own
f6dab12a	Date canary certification to 5.4.0, and add it to the 5.4 release notes
d2bd2998	Say the canary replaces worker 0
9313a3d8	Wait for the rolling job in CI, and say when a restart goes unchecked or fails closed
7a4a60d0	Badge canary certification for v5.3.2, since v5.3.1 shipped without it
bc6e5969	Tighten four sentences of the canary certification docs
7c51abfc	Say that a worker not yet replaced ignores the release's files until its rollout ends
687d99c8	Document canary certification of a restarting deploy
a79ba2ff	Say a durable session resumes best-effort after a restore or copy, and resets only on pruned history
a75ae2d1	Say that a durable session's positions are checked on the node that saved them
b2c5eda9	Date the checked resume and durable-session changes to 5.4.0, on a new 5.4 release-notes page
6c0b3e2b	Note that each MQTT connection keeps its own Last Will, so a taken-over connection publishes its own
3ad3778d	Badge the durable-sessions section with the release that changed it
175f48f9	Lead each way a durable session resets with a bold label, like the page's other lists
9ebf8c65	Badge the resume-position section with the release that adds it
7e6b92fd	Note that resubscribing continues a durable topic, and that a clean start takes the session over
d70cf417	Document how a durable MQTT session resets when it can no longer catch up
000cf58f	Say a record subscription resumes while its own history is retained
ede39616	Note that a resume position cannot see a transaction committing below it
12f74a1e	Document resuming a subscription from a checked position
9df1db19	Date agent.httpFetch to v5.3.2, and say what it does not bound
4e3da70e	Keep the version note in the http_fetch warning as plain text
e6078e15	Say agent.httpFetch can be set by env var, CLI argument or set_configuration
ee59481e	Document agent.httpFetch: turn off or host-limit the agent's http_fetch
2bf8b1ee	Match a decision to its calibration summary on the population key (#706)
ea7e78ac	Document `models.decide`: decision backends, the generative adapter, likelihood scoring, the `@decide` directive, and durable decisions (#688)
70124a4b	Say a local file: source is unidentified, as HarperFast/harper#2954 records it
d7bffc3a	Scope the install fingerprint to deploys and stages, and document the file: and unreadable-lockfile cases
29c77350	Say that a mutable reference resolves differently between installs, and list every peer_results field precisely
46b5ce5c	Say exactly when a peer's install_matches is null, and name the unidentified source
a9022ee2	Document how a replicated deploy reports what each node installed
c0c27eeb	docs(v4 analytics): mark apply-failures as added in v4.7.39
6cbf28c1	docs(v4 analytics): match the replication rows to what 4.7 records
2848fe0b	docs(v4 analytics): split the apply-failures description into two sentences
54bd7eb4	docs(v4 analytics): list the apply-failures replication metric
76b173f5	Document the optional AWS SDK peer requirement for S3 import/export jobs (v5.3) (#672)
61920abb	docs(mcp): word allowlist filtering for 5.3+, isolate the 5.1/5.2 bug
5ebd3818	docs(mcp): date the allowlist-first dispatch order to v5.3.0
42fcd75c	docs(mcp): split the dispatch-mirroring paragraph into scannable sentences
023715b7	docs(mcp): correct the structure_user and canonical-name filtering rules
8a2fd652	docs(mcp): an `operations` allowlist bounds structure_user in tools/list
a2814921	docs(release-notes): split 5.3 warnings into separate sentences
9a9eee84	docs(release-notes): refine native HNSW eligibility and backport ref
7525342a	docs(release-notes): tighten 5.3 claims per review
0309f0cb	docs(release-notes): complete the 5.3.0 release summary
bf2fc5ec	Date the restore subscription change to 5.3.1, which ships it, instead of 5.3.0
10c0c80c	Say the restore behavior change in plain text instead of a badge at the start of a paragraph
a86e8dc6	Say that a restore which fails before changing anything ends subscriptions with DATABASE_CLOSING
83fbfc41	Document that a restore ends subscriptions opened before it
51d15175	docs(ssh-keys): say the release-noted block starts at its #name line
f0d1d97a	docs(ssh-keys): name the exact IdentityFile path and what delete leaves
7428c029	docs(ssh-keys): document the BEGIN/END lines around each key's ssh config block
fd83d149	docs(ssh-keys): say a clone that can't get its SSH keys stops and retries
20e8c817	docs(ssh-keys): say which enc:v1: values pass through, and list the HostName % rule
10dc8e13	docs(ssh-keys): list a backslash among the refused host values
da77de66	docs(ssh-keys): list generate, name every host rule, and add a 5.3 release note
39207060	docs(ssh-keys): list an SSH certificate among the refused keys
05cf515a	docs(ssh-keys): document which keys and host values add_ssh_key accepts
e7c0ae18	docs(deploy): tighten the kept-release wording, and say an already-live retry restarts every worker
12d2c627	docs(deploy): document returning to a previous release by deployment_id, and retrying an activation
0111884c	docs(deploy): put the no-test-load caveat in a warning block
60633af2	docs(deploy): say a deploy is not test-loaded before it goes live under the default lockdown
0c7ca981	Say a role can store a non-grantable operation name without being granted it
4276e27d	docs(roles): the legacy catchup operation can no longer be granted
68760d9c	docs(roles): give the literal-token caveat its own sentence
44ee4f0b	docs(roles): say which operations a role allowlist can grant
88e29dff	docs(replication): document sendsTo/receivesFrom on Update Node (#684)
e3d3321d	docs(deploy): lead the root-config list items with bold terms, like the rest of the page
5d748ca8	docs(deploy): say when a deploy updates the root config entry
6e8a01cb	docs(roles): state the limits of the operations allowlist (#631)
96371aa5	Keep the version out of the badge in the get_status table
795c12de	Make the other two pages agree about the deploy response and get_status
7c066321	Match the page's version convention, and let the super_user gate stand alone
37a9e653	Correct the deploy response and document the restart it does not do
fb611006	Match the table's own version convention for activated_from
8154e864	Bring the staged-deploy docs to the shape that merged
72e10853	Split the mixed-version warning into single-claim sentences
45ef13f2	Document staging a component build and activating it later
5b2b8bb4	Revert "Document Table.oldestRetainedAuditTime() and the subscription catch-up horizon (#660)"
d33af897	Badge payloadRetention.maxSize with the release it first shipped in (v5.1.15)
e407f312	Document deployment.stagingRetention.maxCount and payloadRetention.maxSize
b1001d72	Add AI review workflows, aimed at the stale-contradiction class (#667)
9e6ecf87	Document mTLS revocation checking when the client certificate's issuer is unavailable (#659)
45a9dcc7	docs(reference): give module loading an owner in reference (#664)
dc1cc0e1	Document route-owned authentication fallthrough (#663)
28bd76e3	docs(rest): address review feedback on pagination count
a145b698	Update reference/rest/headers.md
7e11104b	docs(rest): exact counting is opt-in (default off); GET/HEAD + bounded limit
34f2f017	docs(rest): clarify exactCount scope wording; small querying nits
210ab875	docs(rest): note that pagination count requires a limit()
81219d41	docs(rest): pagination total count (Prefer: count=) and exactCount option
5358de5c	docs(resources): fix four static-verb examples that fail silently on Harper 5 (#658)
0d151a2c	Document Table.oldestRetainedAuditTime() and the subscription catch-up horizon (#660)
e2b84dba	docs(http): correct serializeStream return type - follow-up to #641 (#655)
8ef2ff04	docs(components): document app cleanup on shutdown via scope 'close' (#647)
3356abcd	docs(configuration): pair threads.preload with preloadRequire for dd-trace (#644)
d895f428	docs(reference): use harper-config.yaml consistently in v5 (#661)
c8322454	docs: fix four v5 reference errors surfaced by skills#81 (#662)
c2f80c8e	Document that deploy_component waits for restart: true (#638)
677ad213	docs(learn): link Docker install tab to env var configuration reference (#643)
980e5cb1	Document copy-db's blob companion directory and restore steps (#620)
48f13df2	docs: add Multiple Applications on One Cluster guide (#586)
a563b467	docs(agents): --cherry-mark, not --cherry-pick, to find a back-port
e757d703	docs(agents): ancestry cannot answer the badge question; test for the files
4de5206d	docs(security): fix a policy example that would be rejected, and three gaps
86440d3e	docs(agents): patch tags come off a release branch, so --contains is empty by design
5cda8154	docs(rest): map exported tables to their automatic REST endpoints (#650)
98872e4e	docs: link static plugin implementation as plugin API example (#642)
eb49a16c	docs(http): remove unimplemented deserializeStream handler property (#641)
0841ba68	docs(cli): document the `harper deploy` command (#624)
090ff882	docs(resources): scope static properties schema docs to shipped behavior (#605)
3603b4d8	docs(mcp): custom mcpResources and the harper+rest:// descriptor scheme (#567)
39526f8b	chore: add missing final newlines to config files (#652)
4a7cf94f	ci: deploy on reference/** and historic-redirects.ts changes (#651)
ef9921b6	docs: fix broken anchors and stale HarperDB org URLs (#649)
f0c92c59	docs(components): align package scopes with published npm names (#645)
be934414	docs(cli): object and array-of-object params do work via CLI (#646)
55228e71	style(version-badge): right-align standalone badges onto the heading line (#653)
966c5b88	chore: make Renovate group, automerge, and refresh dependencies (#648)
ca6143ef	Document record-structure dictionary counts and the encoding they measure (#633)
0734027c	Document the built-in agent operations API (#635)
28b62396	Add companion-check workflow: docs PRs auto-merge once their companion code PR lands (#629)
51e315e8	docs: document static loadAsInstance in the v5 Resource API reference (#619)
cd6e102e	docs: replicating the system database with a constrained topology (5.2) (#583)
71bb19e0	docs(analytics): document transaction-commit-time metric (#572)
efa22403	docs: replication.blobGapReconnectMs and bulk-copy cursor flush options (#628)
a455bd46	Document scoped tokens (inline role) for create_authentication_tokens (#627)
fd94430a	docs(storage): document storage.blobRetention (#622)
87f1d209	Document cacheControl directive, identity-floor caching headers, and static plugin cache options (#578)
e52bed3f	docs(security): response-header hardening (app-level controls + #1567 gap) (#560)
c1885b71	docs: clarify that @hidden, @export are not access controls + allowRead trusted-context / filter caveats (#553)
1fd0faa9	docs(agents): verify the tag object before trusting --contains
2dadb894	docs(security): qualify the uniform-rejection claim
9c8a89fa	docs(security): aim the OIDC section at the happy path, add a CLI walkthrough
399338c1	docs: copy edits from review
8a4762f3	docs: OIDC trusted publishing, ops-table anchors, and badge guidance
6bf676d4	docs(deploy): complete the super_user call list for deploy setup
d1f34583	docs: drop a duplicated header and clarify "before it ships"
47d872ad	docs(security): add_ssh_key server-side keygen (v5.2.4)
a74ae3b6	docs(deploy): by-reference deploys and sealed credentials (v5.2.3)
aa74b1cc	Badge node identity change for v5.3.0 and add 5.3 release notes
cca76303	Correct node.hostname docs to match merged rejection behavior
0ca3fbfb	Drop in-doc harper issue/PR links per review
97b3b05f	Document node.hostname config and require a bare hostname
97284557	docs(cli): local authorization applies only when no credential is attached
7b99e1b8	docs(security): give authorizeLocal the facts the CLI page defers to it
05412a63	docs(cli): scope the loopback remediation to a pointer, keep the hazard
964fd165	docs(cli): the socket rule is also the limit of the loopback remediation
9f3b6b03	docs(cli): only authorizeLocal:false closes the loopback exposure, and it needs a restart
c5255853	docs(cli): the loopback case needs configuration, not a result check
4a4b855b	docs(cli): resolve the contradiction the loopback bullet created
c8acc796	docs(cli): loopback targets make a token failure succeed, not fail
e70060ff	docs(cli): point the 403 warning at its tracking issue
a9ecc7eb	docs(cli): state the one-credential-style rule once, up front
43bbafcf	docs(cli): a lost target falls back to the saved login, not straight to local
64a51e58	docs(cli): expiry answers 403 and does not halt the command
86ea5c5e	docs(release-notes): scope the refresh-failure caveat to the CI credential shape
3388ec11	docs(cli): split refresh-failure behavior by credential shape
e6c37f0e	docs(cli): narrow two token-handling claims to what 5.2.4 actually does
030c46ef	docs(cli): a blank token namespace is skipped, not a hard failure
7a9187d8	docs(release-notes): cover CI token credentials in 5.2
7cfed5a8	docs(cli): slot token credentials into the canonical auth precedence
c6838cf2	Document the child_process spawn contract for components (#634)
544f15d1	Separate queue depth coverage and attribution limits
56a9d4e1	Document mixed-engine queue depth undercounting
5ca5352d	Identify the stuck commit log signal
633c0dbd	Clarify raw queue depth alert path
098e548b	Clarify transaction queue depth metric semantics
e70894de	fix(docs): sync maxTransactionQueueTime bypass note and remove stale duplicate wording
dabdad00	fix(analytics): transaction-commit-time is silent on a true wedge, not rising
e0d58b4d	fix(analytics): document transaction-commit-time as the 503 leading indicator
9607b80d	fix(analytics): correct aggregation semantics and doc conventions
1c415a61	fix(analytics): correct transaction queue depth documentation
ab213e59	fix(analytics): satisfy prettier table formatting
ef7d4427	docs(analytics): document transaction queue depth metrics
df4971bc	Fix conflicting storage model in logging.auditLog description
a7ad4a01	Address Codex review: fix LMDB result fields, cross-page log terminology, config default
98b1a99e	Collapse audit-log/transaction-log distinction; fix conflicting messaging
1e9a4d50	Split the scoping notes into bold-led sub-paragraphs
bb794065	Add tool-calling scoping note to the CI-stub section
ebb9e70e	Document operation authorization and explicit row filters (#593)
5cc6c517	Address review round 2: LMDB example gap, WAL clustering row, data-safety admonition, params/results, get_job error example, 5.2 release note
ffe30c44	Address review: job semantics, storage-model consistency, badge placement, type style
f3d66404	Clarify engine scope of the 404 change and document cleanup_deleted_records
22004028	Add Transaction Log Operations section header
71bd2636	Document database-wide-only transaction log deletion on RocksDB
7ddbe0e8	docs(backups): use plain ASCII in blob path notation and shell comments
e93a18d5	docs(http): address review feedback on connectionInfo docs
92719679	docs(http): document request.connectionInfo (forwarded PROXY v2 TLS facts)
f6924587	docs: fastifyRoutes host mount fails to load, not just a warning
f013ba24	docs: note that deploy_component mount options require package
b36d21e7	docs: note what an application mount does not do
d623f458	docs: route applications by host/urlPath in the root config
b2d60531	docs(backups): align with harper#1831 (blobs, verify scope, restore semantics)
a3521397	docs: clarify env var context in CLI auth precedence list
d3631f0a	Document CLI authentication precedence
de314d59	Add missing transaction import to migration example (#606)
a5be7383	chore: migrate to @harperfast/code-guidelines (#615)
8ee6cda7	docs: add Web Application Firewall reference (#603)
a19158fc	docs(schema): correct from+to relationship cardinality to many-to-one (#602)
94a3d5af	docs(backups): clarify engine-specific backup paths and reorder ops
c75d5891	ci: re-enable the pr-preview paths filter (#611)
47b82ca9	feat(ci): deploy docs site to production Harper fabric on main (#610)
024870f6	ci: pin deploy/validate workflow actions to commit SHAs at latest releases (#608)
9a7ae7fc	fix(ci): use admin-scoped token to delete PR preview environments (#607)
dd5fa32b	fix(mcp): correct the exportTypes MCP-gating example (#601)
fcf2c7a5	Document get_deployment_payload / delete_deployment_payload response contracts (#600)
69343c0e	docs(tls): document multi-source cipher/SECLEVEL resolution per listener (#598)
6dff1546	docs(sql): 5.2 SQL engine performance guidance (#588)
aaa7af1b	Document the built-in scheduler component plugin (5.2) (#592)
7eae83cc	docs(models): local-development setup matching production (#597)
03000d39	docs: document middleware host and path routing (#595)
d8d7ba4d	docs(learn): deploying from a CI/CD pipeline into Harper — best practices for private repos and registries (#594)
f0d69516	docs: note cross-database read consistency for sourcedFrom resolvers (#591)
8aba3c31	Document the @expiresAt schema directive (#585)
37dd3476	docs(security): secrets store, secrets operations, and deploy_component registryAuth (#581)
c7e80a74	docs(rest): clarify PATCH is a shallow top-level merge (nested objects replaced, not deep-merged) (#547)
d7d2ddb1	Gate the quota-hook example's counter table off the MCP surface (#576)
65f83584	docs(env-vars): clarify loadEnv/.env cannot shape Harper's instance config (#579)
7e373fa3	fix: correct two example bugs caught by skills#70's review
dcd7d7c5	docs(static-files): document before/after handler ordering (#562)
752cdef8	Restructure backup docs into a dedicated Backups reference section
561160bc	Use snake_case response fields for backup operations (backup_id, file_count)
f7211a60	Address docs review: keep_count wording, target_database CLI example
ff392e0d	Document RocksDB backup & restore operations
c5be2f9c	docs: collection-aware record-scoped allowRead example (super composition + subscribe re-auth)
0bf9867d	docs: subscriptions now filter delivery per event through record-scoped allowRead (#1419)
14daaebe	Rework record-level access control docs: record-scoped allowRead override replaces allowReadRecord
8dd5a54a	docs review: state boolean return contract for vectorFilter and allowReadRecord
cdf55c7a	Document filtered vector search: predicate-aware HNSW traversal, vectorFilter, allowReadRecord, filterExpansion (5.2)
de2aaf1c	gitignore .claude directory
1ca00981	Document threads.preload config option (#561)
dbb3c182	docs: fix incorrect @relation directive to @relationship (#577)
a6bf98c8	Fix Resource post/put/patch data type + document search sort + content-type table (#495)
fda31e10	docs(replication): use hostname in controlled-flow route example (#555)
1e54b713	docs(configuration): document replication.blobSendDrainTimeout (#569)
8c535e4a	Correct custom mcpTools auth wording: invocable anonymously, no login gate
b9c98adc	Document the perClientBurst one-token floor; version refs 5.2.0 (merged to main)
0ac01aa5	Add race-safety caveat to the quota-hook docs (harper#1633 fast-follow)
bb5871e9	Correct cache-disposition docs: target.loadedFromSource only (context mirror reverted) (#570)
27fb8cc8	Document MCP per-client rate limiting and the durable quota hook (harper#1633)
9e49f6ca	docs(config): replicated set_configuration ships in 5.2, not 5.1
a401477e	docs(resources): document loadedFromSource cache disposition (harper#1571/#1575)
e5b276f1	docs(analytics): tighten get_analytics read-behavior wording
d416e162	docs(analytics): note get_analytics reads without a consistent snapshot
8d9710c4	docs(ops): correct stale restart_service service list to v5 values
894f9dfa	docs(config): document replicated: true on set_configuration (HarperFast/harper#1556)
0011798f	docs(models): document config-selectable backends (backend: <module>)
2a761eee	docs(models): clarify fallback-policy and no-candidates wording (review)
774fee32	docs(models): routing shipped in v5.1.15; drop breaking-change release note
055ae36d	docs(models): fix release-note cross-links to reference (add /v5/ segment)
797a05e2	docs(models): namespace registration API + document routing & fallback
d37c9847	docs(models): document registerBackend / defineBackend custom backends (#554)
f37a8c40	docs(resources): use static verb handlers in path-parameter examples
60f6d2e4	docs(resources): document parameterised resource paths and `static path`
3edab38c	docs: thrown Response/status now honored; Long bound; repeatable-read wording
5675b32f	docs: clarify concurrency, read consistency, Long/BigInt, and resource status codes
1172ec68	docs(meta): document issue types, area labels, and release milestones (#546)
25e2580f	chore(intake): issue types, simplified forms, and config (#545)
be709f99	docs(database): add data-safety note for programmatic writes/deletes (#542)
fa62588d	docs: clarify Harper APIs are one live process-wide instance; SSR data access (#543)
e66d44b0	docs(sse): lead with single-method static async *connect(target)
ba576f81	docs(sse): document reading the request in static connect()

Repaired during generation

The first regeneration of these rules failed its checks, and a repair pass fixed it. Check that each restored fact landed where it belongs.

• automatic-apis — 1 repair: restored HEAD, QUERY, connect()
• schema-design-tooling — 1 repair: restored @embed, [Float], model, source
• v5-upgrade — 1 repair: restored applications.allowedSpawnCommands, dependencyLoader: native
• enabling-mcp — 1 repair: restored initialize, mcpResources

Produced by .github/workflows/generate.yaml. Review the diff as you would any rule change — the generator reads the docs build output and rewrites mode: generate / imports mode: direct rule bodies, then reassembles AGENTS.md. See docs/plans/docs-driven-skills.md.

🤖 Generated with Claude Code

[github-actions]

🎉 This PR is included in version 1.14.2 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀