mustflow 2.108.8 → 2.112.1

package/templates/default/locales/en/.mustflow/skills/INDEX.md

@@ -2,7 +2,7 @@
 mustflow_doc: skills.index
 locale: en
 canonical: true
-revision: 214
+revision: 217
 authority: router
 lifecycle: mustflow-owned
 ---
@@ -50,6 +50,12 @@ refer to `AGENTS.md` and `.mustflow/config/commands.toml` to implement the most
   current deliverable, the task has both a material uncertainty signal and a material consequence
   signal, and no narrower primary route owns the complete problem. Before implementation, switch to
   the narrowest matching implementation skill.
+- Use `technology-stack-selection` as the narrower primary route when the decision chooses,
+  adopts, replaces, rejects, or standardizes a technology stack, vendor, framework, database,
+  queue, auth, payment, AI provider, hosting, deployment, build, ORM, or observability surface.
+  Treat it as the survival-path gate before broader decision analysis when migration, rollback,
+  maintainer capacity, debugging surface, CI/CD, deployment cost, or long-term operations are the
+  deciding factors.
 - Use `proactive-risk-surfacing` as an event route when current evidence reveals a scope-adjacent
   risk outside the literal request and the agent must decide whether to fix now, report only, ask
   first, or ignore it without broadening into unrelated work.
@@ -572,6 +578,7 @@ routes. Event routes stay inactive until their event occurs.
 | Dockerfiles, `.dockerignore`, Docker Compose files, BuildKit or buildx behavior, container image metadata, tags, entrypoints, health checks, Docker CI workflows, image security scanning, SBOM or provenance settings, registry publishing, or container runtime validation are created or changed | `.mustflow/skills/docker-code-change/SKILL.md` | Docker surfaces, project image shape, base image and platform signals, build context and cache signals, runtime contract, security and supply-chain contract, and command contract entries | Dockerfiles, `.dockerignore`, Compose files, container CI workflow snippets, image metadata, package tests, docs examples, template metadata, and directly synchronized skill routes | cache breakage, secret leak, root runtime, host access escape, dev dependency in final image, mutable tag drift, untrusted CI publish, missing SBOM/provenance, unverified runtime, or false production-readiness claim | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Docker surface classification, image/base/cache/stage decisions, secret/user/runtime/Compose/CI supply-chain notes, verification, and remaining Docker risk |
 | TypeScript source, declarations, tsconfig, package exports, module resolution, project references, type-check performance, public API, compiler-version behavior, TypeScript 6-to-7 migration surfaces, TypeScript 7 RC or nightly tooling, runtime data validation, or TypeScript tests are created or changed | `.mustflow/skills/typescript-code-change/SKILL.md` | TypeScript config, compiler track, package entry metadata, target runtime, changed files, declaration, project references, package graph, TS6 API, TS7 RC, and optional TS7 nightly surfaces, and command contract entries | TypeScript source, declarations, compiler config, exports, tests, project-reference and type-graph notes, compiler-track comparison notes, and directly synchronized docs | weakened type safety, module drift, public API drift, DTO/domain drift, runtime validation gap, type-graph bloat, path alias boundary bypass, unverified declaration output, TypeScript 6 deprecation suppression, TS7 RC over-adoption, TS7 nightly over-adoption, or compiler API track drift | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `mustflow_check` | Runtime, module, type, public API, project-reference, type-performance, compiler-version, RC, nightly, and API-track boundary checked, changes made, verification, and remaining TypeScript risk |
 | JavaScript source, module format, package entry, browser or Node runtime, dependency usage, Promise handling, bundler config, or JavaScript tests are created or changed | `.mustflow/skills/javascript-code-change/SKILL.md` | Package metadata, module system, runtime target, entrypoints, changed files, and command contract entries | JavaScript source, package exports, bundler config, dependencies, tests, and docs examples | runtime API leakage, ESM/CJS drift, discarded Promise, dependency bloat, or broken package entry | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `mustflow_check` | Runtime and module boundary checked, async and dependency notes, verification, and remaining JavaScript risk |
+| Java source, Spring Boot or JPA transaction code, Maven or Gradle metadata, JVM toolchains, bytecode targets, binary compatibility surfaces, modules, reflection, serialization, final-field mutation, virtual threads, executors, `ThreadLocal` or `ScopedValue`, structured concurrency, HTTP clients, applets or legacy desktop APIs, GC choice, allocation pressure, JVM flags, JFR, JMH, container memory or CPU behavior, tests, benchmarks, public APIs, or Java/JDK version-gated features are created or changed | `.mustflow/skills/java-code-change/SKILL.md` | Build metadata, Maven or Gradle toolchain, source and target release, runtime matrix, JDK vendor and support policy, public API surface, module/reflection/serialization/SPI surfaces, Spring transaction and security context, concurrency and JVM runtime context, allocation evidence, changed files, and command contract entries | Java source, Spring transaction and security code, build metadata, module descriptors, public APIs, reflection and serialization adapters, SPI files, virtual-thread or scoped-context code, executors, JVM flags, GC or container notes, tests, benchmarks, and docs examples | unsupported JDK feature, GA/LTS confusion, preview or incubator lock-in, bytecode drift, public API break, binary compatibility break, missing test discovery, Spring transaction leak, mass assignment, unprotected matcher path, reflection or final-field failure, module `opens` sprawl, serialization drift, virtual-thread misuse, executor backpressure gap, `ThreadLocal` memory leak, unowned structured task, HTTP/3 overclaim, applet removal break, allocation folklore, GC folklore, container OOM, false benchmark, or JVM flag drift | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `mustflow_check` | Version/toolchain/runtime boundary, public API and binary compatibility, Spring/JPA/security, module/reflection/serialization/SPI, virtual-thread/scoped-context/structured-concurrency/executor, HTTP, allocation, GC/JVM flag/AOT/container/JFR/JMH boundary checked, verification, and remaining Java risk |
 | Python source, package metadata, runtime version, import layout, architecture boundaries, type checking, async tasks, exception/logging/retry behavior, collection performance, pytest fixtures or mocks, linting, CLI entry points, or tests are created or changed | `.mustflow/skills/python-code-change/SKILL.md` | Python version source, packaging files, build backend or package-manager owner, import layout, architecture boundary, lint/type/test config, async/failure/performance surface, changed files, and command contract entries | Python source, packaging metadata, imports, type hints, adapters, async ownership, exception/logging/retry code, collection hot paths, tests, and docs examples | unsupported syntax, import hacks, packaging drift, framework or ORM leakage into domain code, false type safety, unowned task, swallowed cancellation, retry storm, hidden fallback, copy-heavy hot path, fixture state leak, bare mock lie, or weakened lint/type checks | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `mustflow_check` | Runtime, packaging, import, architecture, type, async, failure, performance, and test boundary checked, verification, and remaining Python risk |
 | PowerShell scripts, modules, command examples, `pwsh` invocations, native-command wrappers, quoting, here-strings, splatting, regex, wildcard, replacement strings, or PowerShell argument passing are created or changed | `.mustflow/skills/powershell-code-change/SKILL.md` | PowerShell version and invocation path, parser layers, native-command boundary, dynamic input boundaries, changed files, and command contract entries | PowerShell scripts, modules, package scripts, CI snippets, docs examples, native-command wrappers, tests, and directly synchronized docs | parser-layer confusion, quote loss, variable over-expansion, metacharacter interpretation, native argv drift, command injection, `--%` overuse, or cross-shell `-Command` breakage | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | PowerShell version and invocation boundary, parser ledger, string/here-string/regex/wildcard/replacement/native argv decisions, verification, and remaining PowerShell risk |
 | Go source, modules, workspaces, package APIs, package layout, `internal` boundaries, interfaces, structs, errors, goroutines, channels, context propagation, HTTP clients or servers, Gin engines, router groups, middleware chains, request binding, validation, graceful shutdown, reverse proxies, JSON encoding, filesystem roots, network addresses, runtime limits, profiling, benchmarks, tools, tests, or generated-code boundaries are created or changed | `.mustflow/skills/go-code-change/SKILL.md` | Module files, workspace policy, Go version support, full package files, tests, public API surface, package ownership, concurrency owner, runtime/deployment context, Gin or framework version and route/middleware/binding context, changed files, and command contract entries | Go packages, module and workspace metadata, internal boundaries, interfaces, structs, errors, concurrency code, HTTP/shutdown/proxy code, Gin route, middleware, context, binding and validation code, JSON encoding, filesystem and network helpers, runtime settings, profiling and benchmarks, tests, tools, and docs examples | unnecessary abstraction, module boundary drift, unsupported Go feature, context loss, goroutine leak, missing timeout, unsafe shutdown, Gin context reuse bug, unsafe middleware order, trusted-proxy drift, binding or validation bypass, body-size mistake, JSON contract drift, filesystem traversal, IPv6 host-port bug, runtime tuning drift, performance folklore, error contract drift, or dependency drift | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `mustflow_check` | Package, API, module/workspace, Go version, context, concurrency, runtime, HTTP/shutdown, Gin route/middleware/context/binding, JSON, filesystem, profiling, tool, and error boundary checked, verification, and remaining Go risk |
@@ -611,6 +618,7 @@ routes. Event routes stay inactive until their event occurs.
 | Release publishing, package registry publication, remote release channels, Git tags, GitHub Releases, release assets, npm, PyPI, crates.io, Go modules, Docker images, Homebrew formulae or casks, app updater metadata, version bump decisions, artifact inspection, post-publish smoke tests, rollback or yanking plans, or user installation paths are created, changed, reviewed, or reported | `.mustflow/skills/release-publish-change/SKILL.md` | Release target, version, channel, package name, module path, image name, tag, artifact names, expected assets, public contract source, artifact inspection method, remote publication surface, recovery model, and command contract entries | Version metadata, release workflows, package manifests, artifact manifests, changelog or release-preparation docs, package tests, install-smoke expectations, release validation tests, and installed-template metadata | local-only release claim, wrong version bump, stale artifact, registry overwrite assumption, missing asset, bad checksum or signature, moved Go tag, unverified Docker digest, updater metadata breakage, missing user-path smoke test, or false rollback claim | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Release target, version and channel, public API classification, artifact inspection evidence, remote publication state, user-path smoke result, synchronized surfaces, recovery classification, verification, and remaining release-publish risk |
 | Search-friendly ad-supported articles, blog posts, guides, reviews, comparisons, FAQs, or evergreen content are planned, written, edited, reviewed, or reported | `.mustflow/skills/search-ad-content-authoring/SKILL.md` | Search intent, reader task, content type, source freshness needs, monetization constraints, article draft or outline, and command contract entries | Article outlines, headings, paragraphs, tables, lists, FAQs, images, links, disclosures, content docs, templates, tests, and reports | keyword stuffing, thin filler, misleading ad adjacency, stale policy or ranking claims, unsupported revenue claims, accessibility or layout instability, or copied competitor content | `changes_status`, `changes_diff_summary`, `docs_validate_fast`, `test_release`, `mustflow_check` | Search intent, outline shape, content structure checks, source freshness, ad layout and trust checks, omitted or verified claims, verification, and remaining content risk |
 | Documentation review queue entries or selected docs need prose cleanup for LLM-like wording, AI-slop signals, low-specificity boilerplate, literal translation, unnatural tone, Korean technical translationese, or domain-term drift | `.mustflow/skills/docs-prose-review/SKILL.md` | Review queue entry or selected document path, review comment if present, target language, audience or genre, domain terminology, reviewer metadata | Selected documentation file and review ledger entry | meaning drift, fake authorship attribution, invented evidence, over-editing, or stale queue state | `docs_validate`, `mustflow_check` | Prose issues fixed, preserved technical meaning, recorded review status, verification notes |
+| Korean or English prose is supplied to extract reusable elegant wording candidates, store selected modular phrase fragments, polish prose with a curated phrase bank, or improve wording for report-style answers, final reports, GitHub issue bodies, pull request descriptions, review replies, maintainer-facing comments, release or update notes, documentation prose, summaries, or explanatory writing after the facts are established | `.mustflow/skills/writing-elegance/SKILL.md` | Source text, mode, target register, target surface, user keep or reject choices, current phrase bank when storing or applying expressions, owning workflow skill when evidence or repository policy matters, and command contract entries when files change | Candidate tables, selected phrase-bank entries, polished report or GitHub wording, `references/phrase-bank.md`, synchronized template copy, route metadata, template manifest, i18n metadata, and directly tied tests | over-specific sentence capture, proper-name leakage, private detail storage, ornamental wording, technical meaning drift, docs-prose-review overlap, GitHub quality-gate overlap, release-note authority drift, completion-evidence drift, phrase-bank bloat, or skipped template sync | `changes_status`, `changes_diff_summary`, `docs_validate_fast`, `test_release`, `mustflow_check` | Mode, target surface, candidate table or stored entries, entries kept or rejected, phrase-bank updates or polish boundary, owning skill applied or deferred, template sync, verification, and remaining style or specificity risk |
 | Documentation changes affect public or workflow docs | `.mustflow/skills/docs-update/SKILL.md` | Changed behavior or field | Relevant docs only | stale public docs | `docs_validate_fast`, `docs_validate`, `mustflow_check` | Doc changes and skipped checks |
 
 ### Security and Privacy
@@ -641,11 +649,13 @@ routes. Event routes stay inactive until their event occurs.
 | Database lock contention review needs to catch blocking visible in the diff, including hot rows, mutable counter caches, balance or stock updates, reservation flows, queue table claiming, `SELECT ... FOR UPDATE`, weaker row-lock choices, optimistic version checks, conditional updates, lock order, deadlock retry, MySQL/InnoDB gap or next-key locks, PostgreSQL row-lock variants, SQL Server lock escalation, long transactions, external calls inside transactions, DDL or metadata lock waits, idle-in-transaction blockers, lock timeout policy, connection-pool waits, or lock observability | `.mustflow/skills/database-lock-contention-review/SKILL.md` | Contended resource, workload concentration, database engine and isolation, lock path, index and predicate shape, transaction width, queue claim model, batch size, timeout and retry policy, observability evidence, and configured command intents | Data-shape changes such as ledgers, reservations, sharded counters, materialized summaries, conditional updates, weaker locks, stable lock order, chunked batches, queue shards, timeout policy, focused tests, docs, and directly synchronized templates | hot-row serialization, parent-counter bottleneck, select-then-update race, over-strong `FOR UPDATE`, missing lock-footprint index, gap-lock insert block, metadata-lock surprise, unordered multi-row deadlock, unchunked write outage, queue head contention, hidden FK parent lock, idle transaction blocking DDL, infinite lock wait, pool starvation, unsafe deadlock retry, or missing blocker/waiter evidence | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Lock-contention surface reviewed, contended resource and workload ledger, lock strength/order/index/queue/batch/DDL/timeout/pool/observability findings, evidence level, verification, and remaining database lock-contention risk |
 | SQLite-specific schema, query, transaction, migration, indexing, extension, WAL, local-file persistence, embedded database, mobile database, browser OPFS/WASM SQLite, cache index, or SQLite runtime behavior is created, changed, reviewed, or reported | `.mustflow/skills/sqlite-code-change/SKILL.md` | SQLite role, runtime and binding, file ownership, storage medium, concurrency shape, schema/type rules, query/index evidence, migration and recovery needs, changed files, and command contract entries | SQLite schema, queries, connection setup, transactions, pragmas, indexes, migrations, fixtures, tests, docs, and directly synchronized templates | wrong runtime assumption, file-lock surprise, WAL overclaim, network filesystem risk, disabled foreign keys, weak type constraints, unsafe raw SQL, query-plan overclaim, sidecar-file data loss, failed migration rebuild, or unverified backup/restore | `changes_status`, `changes_diff_summary`, `test_related`, `test`, `lint`, `build`, `docs_validate_fast`, `test_release`, `mustflow_check` | SQLite runtime, storage, WAL/concurrency, schema/type/constraint, query/index, migration, backup/restore, verification, and remaining SQLite risk |
 | PostgreSQL-specific schema, query, transaction, migration, indexing, extension, role, row-level security, connection pooling, replication, backup, restore, managed Postgres, or Postgres runtime behavior is created, changed, reviewed, or reported | `.mustflow/skills/postgresql-code-change/SKILL.md` | PostgreSQL role, version, provider, extension inventory, topology, pooler, schema/type rules, query-plan evidence, transaction/retry rules, migration and recovery needs, changed files, and command contract entries | PostgreSQL schema, queries, migrations, generated SQL, connection setup, pool settings, roles, RLS policies, extensions, tests, docs, and directly synchronized templates | version drift, provider constraint miss, connection storm, lock or rewrite surprise, unsafe online DDL claim, bad pooler assumption, RLS bypass, search-path risk, extension drift, stale replica read, query-plan overclaim, or unverified restore | `changes_status`, `changes_diff_summary`, `test_related`, `test`, `lint`, `build`, `docs_validate_fast`, `test_release`, `mustflow_check` | PostgreSQL version/topology, pooling, lock/transaction, schema/type/RLS/role, query/index/statistics, backup/restore, verification, and remaining PostgreSQL risk |
+| ClickHouse-specific schema, MergeTree engine configuration, partition or sorting keys, primary keys, projections, materialized views, dictionaries, ingest, async inserts, deduplication, mutations, joins, CTEs, aggregate states, arrays, maps, window functions, distributed queries, or query performance behavior is created, changed, reviewed, or reported | `.mustflow/skills/clickhouse-code-change/SKILL.md` | ClickHouse role, version or Cloud track, topology, engine, table shape, ingest shape, query shape, operational evidence, changed files, and command contract entries | ClickHouse DDL, SQL, query builders, ingest code, backfill code, materialized views, projections, dictionaries, settings, fixtures, tests, docs, and synchronized templates | OLTP-shaped table design, high-cardinality partition part explosion, primary-key uniqueness myth, bad sorting locality, tiny insert parts, async insert durability overclaim, block dedup retry drift, MV trigger misunderstanding, stale dictionary lookup, aggregate-state merge bug, `arrayJoin` row explosion, default window-frame bug, `FINAL` cost patch, `OPTIMIZE FINAL` routine, mutation write amplification, JOIN fan-out, CTE rerun surprise, projection backfill miss, skip-index cargo cult, or unverified query-plan claim | `changes_status`, `changes_diff_summary`, `test_related`, `test`, `lint`, `build`, `docs_validate_fast`, `test_release`, `mustflow_check` | ClickHouse role/version/topology, engine/storage, ingest/dedup/MV/backfill, aggregate/query/JOIN/distributed findings, evidence level, verification, and remaining ClickHouse risk |
+| DuckDB-specific embedded OLAP database use, `.duckdb` file ownership, concurrency, language bindings, Appender usage, CSV/Parquet/JSON ingestion, query determinism, timestamp behavior, memory and temp spill settings, profiling, indexes, CTEs, macros, or DuckDB runtime behavior is created, changed, reviewed, or reported | `.mustflow/skills/duckdb-code-change/SKILL.md` | DuckDB role, version or track, binding, extension inventory, file and process ownership, ingest/export shape, query shape, memory and temp spill settings, profiling evidence, changed files, and command contract entries | DuckDB SQL, schemas, query builders, connection setup, binding-specific code, ingest/export code, Appender code, settings, fixtures, tests, docs, and synchronized templates | SQLite-like OLTP assumption, native file multi-process write bug, hidden global connection, thread/process confusion, Appender visibility overclaim, CSV sampling loss, `ignore_errors` data loss, schema-drift memory spike, `SELECT *` Parquet scan, partition file explosion, missing `ORDER BY`, order-sensitive aggregate drift, TIMESTAMPTZ timezone surprise, memory-limit overclaim, temp spill disk-full, overwritten profiling output, ART-index theater, CTE materialization surprise, window memory spike, unsafe macro input, or unverified query-plan claim | `changes_status`, `changes_diff_summary`, `test_related`, `test`, `lint`, `build`, `docs_validate_fast`, `test_release`, `mustflow_check` | DuckDB role/version/binding, file/process ownership, concurrency/Appender/import/export, deterministic SQL, memory/temp/profiling, query-plan evidence, verification, and remaining DuckDB risk |
 | Keyword search, full-text search, Elasticsearch, OpenSearch, Lucene-style indexing, search APIs, indexing pipelines, aliases, bulk indexing, refresh visibility, analyzers, mappings, synonyms, autocomplete, pagination, shard failures, search quality, or search performance are created, changed, reviewed, or failing | `.mustflow/skills/search-index-integrity-review/SKILL.md` | Symptom classification, source-to-search ledger, query contract ledger, index contract ledger, quality ledger, performance ledger, privacy ledger, changed files, and command contract entries | Search canaries, indexing ledgers, bulk item error handling, alias checks, mapping and analyzer fixtures, exact-versus-full-text tests, tenant and permission filters, golden-set tests, synonym regression tests, pagination guards, query metrics, docs, and directly synchronized templates | cluster-green theater, batch-level bulk success, source/index count illusion, write alias drift, partial shard result, direct/API/UI mismatch, wrong keyword/text field, analyzer drift, synonym regression, rank eyeballing, profile misuse, query fingerprint leak, shard fan-out, cache-only benchmark, refresh overuse, segment merge backlog, disk watermark write block, deep pagination, oversized fetch, or private query/document leak | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Search index integrity reviewed, source-to-search/query/index/quality/performance/privacy ledgers, search findings, fix or recommendation, evidence level, verification, and remaining search-index risk |
 | Vector search, semantic search, RAG retrieval, embedding generation, preprocessing, chunking, vector schema, collection, namespace, tenant, named vector, metadata payload, filter, ANN index, exact-versus-approximate search, hybrid search, reranking, recall, latency, quantization, HNSW, IVF, pgvector, Qdrant, Milvus, Weaviate, OpenSearch kNN, or retrieval golden-set behavior is created, changed, reviewed, or failing | `.mustflow/skills/vector-search-integrity-review/SKILL.md` | Retrieval symptom, query contract ledger, ingestion ledger, quality ledger, performance ledger, privacy ledger, changed files, and command contract entries | Embedding and preprocessing versioning, vector validation, deterministic ids, namespace and tenant selection, metadata indexes, filter construction, exact-search checks, ANN parameters, reranker candidates, golden-set tests, synthetic fixtures, metrics, docs, and directly synchronized templates | vector-DB scapegoating, wrong embedding dimension, model revision drift, filter post-candidate loss, metadata type drift, tenant leak, duplicate chunk ids, stale deletes, metric or normalization mismatch, ANN tuning before exact-search proof, quantization recall loss, reranker candidate starvation, hybrid score misuse, deep ANN pagination, raw vector or document leak, or unmeasured p95 latency | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Vector search integrity reviewed, retrieval/query/ingestion/quality/performance/privacy ledgers, exact-versus-ANN and filter findings, fix or recommendation, evidence level, verification, and remaining vector-search risk |
 | Dependency versions, lockfiles, package-manager metadata, workspace constraints, runtime engines, peer dependencies, optional dependencies, security advisory fixes, generated dependency output, framework plugins, TypeScript compiler tracks, CI actions, Docker base images, package manager behavior, or toolchain versions are upgraded, downgraded, pinned, widened, regenerated, reviewed, or reported | `.mustflow/skills/dependency-upgrade-review/SKILL.md` | Dependency name, old and new versions or ranges, direct or transitive path, ecosystem and package manager, declaration files, lockfiles, runtime or toolchain files, advisory or release-note evidence, generated outputs, callers, docs, package output, Docker, CI, or TypeScript compiler-track surfaces, and command contract entries | Package declarations, lockfiles, generated outputs, compatibility code, tests, docs, package metadata, Docker or CI files, TypeScript compiler-track notes, and directly synchronized examples | lockfile churn, hidden transitive replacement, peer or engine break, module-format drift, native or optional package break, framework or generator output drift, unsafe broad security update, weakened tests, Docker or CI runtime drift, TS7 RC over-adoption, TS7 nightly over-adoption, or unreviewed supply-chain change | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Upgrade reason, ecosystem surface, direct and transitive graph changes, compatibility classification, runtime/peer/engine/module/feature/platform/generated-output/compiler-track risks, synchronized surfaces, verification, and remaining dependency-upgrade risk |
 | Dependency, package, runtime, framework, tool, command, plugin, service, platform capability, supported-version policy, security patch path, ecosystem maturity claim, maintainer-risk assumption, runtime portability claim, edge or serverless compatibility claim, critical-path library choice, package script, lifecycle hook, binary download, lockfile, audit result, or supply-chain-sensitive dependency surface is assumed, added, removed, imported, invoked, installed, audited, or documented | `.mustflow/skills/dependency-reality-check/SKILL.md` | Assumed dependency or capability, declaration files, version or feature expectation, role criticality, supported-version or end-of-life evidence, patchability expectation, runtime compatibility boundary, maintainer and ecosystem evidence when available, lockfile entry, package script or lifecycle hook, audit or provenance evidence, and relevant command intents | Package metadata, lockfiles, imports, scripts, command contracts, docs, tests, runtime policy notes, portability notes, and reports | unavailable dependency, hallucinated or lookalike package, fragile single-maintainer core dependency, experimental technology in a survival path, unsupported runtime, unclear security patch path, runtime-specific API leakage into core logic, stale version claim, lifecycle script risk, audit suppression, lockfile drift, or install guidance mismatch | `changes_status`, `changes_diff_summary`, `build`, `test_release`, `mustflow_check` | Dependency checked, ecosystem and maintainer-risk boundary reviewed, supported-version, patchability, and runtime-portability boundary reviewed, supply-chain surface reviewed, declarations synchronized, verification, and remaining dependency risk |
-| Generated or edited code, configuration, CI workflows, package metadata, install instructions, examples, Docker images, framework setup, runtime declarations, toolchain declarations, TypeScript compiler-track references, Rust release or MSRV references, or migration-sensitive snippets introduce explicit external version references, action refs, package ranges, runtime versions, framework majors, Docker image tags, or scaffold commands that may be stale | `.mustflow/skills/version-freshness-check/SKILL.md` | Versioned reference, owning files, repository version policy, approved freshness source, compatibility context, migration risk, TypeScript compiler track or Rust MSRV/toolchain track when relevant, and command contract entries | Package metadata, lockfiles, CI workflows, Dockerfiles, runtime files, framework config, docs, examples, templates, tests, and version-decision reports | stale default version, false latest claim, accidental major migration, repository policy mismatch, unsupported generated example, TypeScript RC/nightly/API-track confusion, Rust stable/nightly/MSRV confusion, floating-tag drift, or unverified security/support claim | `changes_status`, `changes_diff_summary`, `build`, `test_related`, `docs_validate_fast`, `test_release`, `mustflow_check` | Versioned surfaces checked, repository policy and freshness source, selected version track, compatibility classification, TypeScript stable/RC/nightly/API-track and Rust stable/nightly/MSRV split when relevant, approval need, synchronized surfaces, verification, and remaining version-freshness risk |
+| Generated or edited code, configuration, CI workflows, package metadata, install instructions, examples, Docker images, framework setup, runtime declarations, toolchain declarations, TypeScript compiler-track references, Go release or framework references, Java/JDK GA, LTS, JEP, JVM, GC, or toolchain references, Rust release or MSRV references, or migration-sensitive snippets introduce explicit external version references, action refs, package ranges, runtime versions, framework majors, Docker image tags, or scaffold commands that may be stale | `.mustflow/skills/version-freshness-check/SKILL.md` | Versioned reference, owning files, repository version policy, approved freshness source, compatibility context, migration risk, TypeScript compiler track, Go toolchain/framework track, Java JDK/toolchain/bytecode/JEP track, or Rust MSRV/toolchain track when relevant, and command contract entries | Package metadata, lockfiles, CI workflows, Dockerfiles, runtime files, framework config, docs, examples, templates, tests, and version-decision reports | stale default version, false latest claim, accidental major migration, repository policy mismatch, unsupported generated example, TypeScript RC/nightly/API-track confusion, Java latest-GA/LTS/runtime/JEP/preview/incubator confusion, Rust stable/nightly/MSRV confusion, floating-tag drift, or unverified security/support claim | `changes_status`, `changes_diff_summary`, `build`, `test_related`, `docs_validate_fast`, `test_release`, `mustflow_check` | Versioned surfaces checked, repository policy and freshness source, selected version track, compatibility classification, TypeScript stable/RC/nightly/API-track, Go runtime/framework, Java GA/LTS/runtime/JEP/toolchain, and Rust stable/nightly/MSRV split when relevant, approval need, synchronized surfaces, verification, and remaining version-freshness risk |
 | External systems, protocols, SDKs, databases, webhooks, queues, files, object storage, signed upload or download URLs, caches, API response models, framework requests or responses, server actions, route handlers, edge functions, worker handlers, AI models, browser storage, search engines, analytics tools, email platforms, no-code tools, observability backends, trace or request context, provider data, or volatile component implementations cross the core boundary or need stable port/adapter translation, change isolation, error mapping, timeout, retry, circuit-breaker, bulkhead, idempotency, reconciliation, security, core-state ownership, vendor portability, or observability handling | `.mustflow/skills/adapter-boundary/SKILL.md` | External system or protocol, inbound/outbound direction, delivery boundary, internal use case, local port/adapter patterns, provider risk, provider failure policy, core-state ownership risk, vendor portability risk, observability identifier policy, API contract risk, change-isolation ledger, preserved consumer contract, changed files, and command contract entries | Ports, adapters, mappers, controllers, workers, stores, gateways, response mappers, telemetry mappers, timeout and retry policies, circuit breakers, bulkhead boundaries, tests, fixtures, assembly wiring, and directly synchronized docs or templates | provider leakage, caller churn from adapter-only changes, framework business-rule leakage, telemetry backend leakage, storage-key leakage, screen-shaped API coupling, pass-through wrapper, SaaS dashboard as truth source, search or analytics policy leakage, queue contract leakage, unclassified external failure, duplicate side effect, unsafe retry, missing timeout, missing circuit breaker, missing bulkhead, unresolved unknown provider outcome, broken identifier propagation, secret or personal-data leak, or untested integration drift | `changes_status`, `changes_diff_summary`, `test_related`, `test`, `lint`, `build`, `docs_validate_fast`, `test_release`, `mustflow_check` | Boundary classification, change-isolation ledger, preserved consumer contract, delivery adapter responsibility, internal port, provider containment, core-state ownership, vendor portability, validation and mapping, API response mapping, observability identifier flow, timeout/retry/circuit-breaker/bulkhead/idempotency handling, reconciliation behavior, security notes, verification, and remaining provider risk |
 | Third-party SDK or external API integration, review, debugging, upgrade, webhook handling, auth scope change, sandbox or production setup, provider SDK version change, API version migration, rate-limit handling, retry policy, idempotency key usage, pagination, provider error mapping, request id logging, changelog review, deprecation response, or provider operational-readiness test needs production integration review | `.mustflow/skills/third-party-api-integration-review/SKILL.md` | Provider and SDK/API ledger, source-of-truth docs, auth and scope ledger, operation and side-effect ledger, webhook ledger, error and observability ledger, changelog or migration evidence, existing fakes or sandbox tests, and configured command intents | Provider adapters, wrappers, typed request and response models, error mappers, timeout and retry policies, rate-limit handling, idempotency key handling, pagination handling, webhook signature verification and dedupe, redacted observability, sandbox tests, fixtures, runbooks, migration notes, and directly synchronized docs or templates | demo-only integration, stale provider docs, SDK/API drift, sandbox-production mixup, hardcoded secret, overbroad scope, token refresh gap, missing timeout, infinite retry, retrying permanent errors, mutating retry without idempotency, per-attempt idempotency key, 429 retry storm, ignored Retry-After, offset pagination assumption, raw provider error leak, string-only provider error, missing request id, trusted webhook payload, JSON-parsed signature breakage, duplicate webhook side effect, event-order assumption, success redirect as proof, unhandled unknown provider outcome, dashboard-only setting, untested SDK upgrade, or happy-path-only sandbox test | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `test_audit`, `docs_validate_fast`, `test_release`, `mustflow_check` | Third-party integration reviewed, provider source-of-truth and SDK/API version evidence, auth/environment/scope decisions, timeout/retry/rate-limit/idempotency/pagination decisions, webhook delivery and dedupe checks, error and observability mapping, tests or missing evidence, verification, and remaining provider operational risk |
 | Tauri frontend invokes, Rust commands, capabilities, permissions, scopes, plugins, filesystem, dialog, shell, opener, updater, sidecar, mobile native permissions, Tauri bundling targets, release package formats, or native desktop CI build matrices are created or changed | `.mustflow/skills/tauri-code-change/SKILL.md` | Frontend call sites, Tauri config, Rust commands, capability and permission files, plugin config, bundle targets, release matrix evidence, changed files, and command contract entries | Tauri frontend, Rust commands, capabilities, permissions, scopes, plugins, bundle target narrowing, package target notes, tests, and docs | broad native permission, untrusted IPC input, filesystem escape, shell or updater risk, WebView/native boundary drift, all-target bundling surprise, cold Cargo cache cost, duplicated macOS packaging jobs, or long-retention CI artifacts posing as release assets | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `mustflow_check` | IPC, permission, scope, filesystem, shell, updater, native boundary, bundle target, release matrix, artifact retention, verification, and remaining Tauri risk |
@@ -695,6 +705,7 @@ routes. Event routes stay inactive until their event occurs.
 
 | Trigger | Skill Document | Required Input | Edit Scope | Risk | Verification Intents | Expected Output |
 | --- | --- | --- | --- | --- | --- | --- |
+| A task chooses, adds, replaces, upgrades, rejects, or standardizes a technology stack, dependency family, framework, runtime-adjacent platform, database, cache, queue, auth provider, payment provider, AI provider, SDK, hosting platform, deployment tool, build tool, ORM, observability tool, or vendor integration where migration path, rollback path, maintainer capacity, debugging surface, CI/CD cost, deployment cost, operating toil, lock-in, data export, ecosystem maturity, or solo-maintainer survivability affects the decision | `.mustflow/skills/technology-stack-selection/SKILL.md` | Decision scope, candidate technologies, baseline, boring default, criticality, reversibility class, team and maintainer capacity, evidence sources, success criteria, and failure criteria | Technology decision records, architecture notes, migration plans, rollback plans, runbook notes, route metadata, skill procedures, template metadata, tests, docs, and smallest reversible adoption scaffold | novelty adoption, benchmark theater, survival-path experiment, no migration path, no rollback path, opaque debugging, maintainer bus-factor risk, local problem turned into global architecture commitment, hidden CI/CD or observability cost, data hostage risk, or solo-maintainer toil trap | `changes_status`, `changes_diff_summary`, `docs_validate_fast`, `test_related`, `test_release`, `mustflow_check` | Decision state, candidate matrix, survival-path impact, experimental-edge placement, migration path, rollback path, debugging surface, cost and operating-surface notes, guardrails, verification, and remaining technology-selection risk |
 | Architecture, module boundaries, codebase structure, structural improvement, codebase deepening, or testability needs review before choosing a refactor or abstraction | `.mustflow/skills/architecture-deepening-review/SKILL.md` | Target area, structural pain, local patterns, behavior evidence, current changed files, and command contract entries | Review notes, ranked structure candidates, and at most one scoped structural follow-up when requested | speculative abstraction, broad rewrite, pattern-first design, hidden behavior change, or unverified structure claim | `changes_status`, `changes_diff_summary`, `test_related`, `test`, `lint`, `build`, `docs_validate_fast`, `test_release`, `mustflow_check` | Review target, evidence, candidate scores, selected next action, narrower skill choice, verification, and remaining architecture risk |
 | Service boundaries, modular-monolith boundaries, bounded contexts, team ownership, data ownership, source-of-truth maps, event or queue boundaries, multi-tenant isolation, failure flows, independent deployment, operational recovery, disaster recovery, cost, toil, or large-scale architecture split decisions are designed, reviewed, or changed | `.mustflow/skills/service-boundary-architecture/SKILL.md` | Candidate domains, owners, data truth map, communication paths, shared database or cache coupling, failure flows, boundary proof ledger, idempotency, queue/retry/dead-letter behavior, cache consistency, tenant/auth/audit boundaries, observability, deployment, migration, retention, operations tools, and command contract entries | Architecture docs, decision records, context files, boundary source, API/event/queue/cache/read-model contracts, operational runbooks, tests, and directly synchronized docs or templates | noun-first service split, shared database coupling, unknown data owner, repeated cross-team co-change, independent-deploy theater, dependency cycle, happy-path-only design, retry storm, queue backlog with no owner, cache as accidental authority, tenant leak, command-like events, missing observability, unsafe migration, weak health probe, untested graceful shutdown, version incompatibility, untested restore or DR, or manual recovery without audit | `changes_status`, `changes_diff_summary`, `test_related`, `test`, `lint`, `build`, `docs_validate_fast`, `test_release`, `mustflow_check` | Boundary checked, data owners, co-change/deploy/dependency proof, failure/idempotency/queue/cache/event notes, tenant/auth/retention/observability/deployment/health/recovery/cost/toil notes, verification, and remaining service-boundary risk |
 | Multi-product platform, app factory, many-small-services architecture, shared account portal, Product Registry, shared auth, billing, credits, entitlements, admin console, deployment factory, analytics spine, logging, i18n, common UI, templates, or operations automation must support many product apps without per-service copy-paste | `.mustflow/skills/small-service-platform-architecture-review/SKILL.md` | User goal, target product count, product types, Product Registry ledger, identity ledger, money and access ledger, operations ledger, app factory ledger, observability and analytics ledger, shared product surface ledger, current diff or target files, and configured command intents | Product Registry, shared account portal, identity and organization model, billing catalog, entitlement service, credit ledger, usage meters, admin and support console, app generator, thin app shells, shared packages, CI/CD, deployment templates, analytics event schema, logging/tracing, notification, i18n, legal, consent, shared UI, file/job/integration services, feature flags, AI Gateway, license service, runbooks, tests, docs, route metadata, and directly synchronized templates | per-service auth or billing copy, Stripe or provider dashboard as only authority, missing Product Registry, plan-string feature gates, balance-only credits, no reservation lifecycle, direct database support surgery, template copy drift, no account portal, no first-value-created event, logs without app or tenant identity, missing webhook replay, missing backup or restore proof, product-specific privacy facts hidden in code, operations by memory, or unverified 100-service readiness claim | `changes_status`, `changes_diff_summary`, `lint`, `build`, `test_related`, `test`, `docs_validate_fast`, `test_release`, `mustflow_check` | Platform surface reviewed, Product Registry/identity/billing/credit/entitlement/admin/app-factory/deployment/analytics/observability/shared-surface/security/privacy/operations/phase ledgers, shared versus app-specific ownership decisions, specialist skills applied or deferred, evidence level, verification, and remaining small-service platform architecture risk |

package/templates/default/locales/en/.mustflow/skills/clickhouse-code-change/SKILL.md

@@ -0,0 +1,266 @@
+---
+mustflow_doc: skill.clickhouse-code-change
+locale: en
+canonical: true
+revision: 1
+lifecycle: mustflow-owned
+authority: procedure
+name: clickhouse-code-change
+description: Apply this skill when ClickHouse-specific schema, MergeTree engine configuration, partition or sorting keys, primary keys, projections, materialized views, dictionaries, ingest, async inserts, deduplication, mutations, joins, CTEs, aggregate states, arrays, maps, window functions, distributed queries, or query performance behavior is created, changed, reviewed, or reported.
+metadata:
+  mustflow_schema: "1"
+  mustflow_kind: procedure
+  pack_id: mustflow.core
+  skill_id: mustflow.core.clickhouse-code-change
+  command_intents:
+    - changes_status
+    - changes_diff_summary
+    - test_related
+    - test
+    - lint
+    - build
+    - docs_validate_fast
+    - test_release
+    - mustflow_check
+---
+
+# ClickHouse Code Change
+
+<!-- mustflow-section: purpose -->
+## Purpose
+
+Keep ClickHouse changes honest about column-store physics, MergeTree storage layout, part creation,
+eventual background merges, insert retry semantics, query-plan evidence, and operational cost.
+
+ClickHouse is not fast PostgreSQL. Compatibility syntax can make migrations easier, but production
+correctness and cost still depend on partition lifecycle, sorting key locality, batch shape,
+deduplication windows, aggregate-state merging, denormalization, materialized-view triggers,
+projection materialization, dictionary freshness, and measured read rows, read bytes, memory, and
+part counts.
+
+<!-- mustflow-section: use-when -->
+## Use When
+
+- ClickHouse DDL, SQL, migrations, generated SQL, query builders, dashboards, ingest jobs, data
+  pipelines, materialized views, refreshable views, projections, dictionaries, MergeTree engines,
+  distributed tables, or ClickHouse settings are introduced, changed, reviewed, or reported.
+- A task mentions `MergeTree`, `ReplacingMergeTree`, `AggregatingMergeTree`, `SummingMergeTree`,
+  `CollapsingMergeTree`, `PARTITION BY`, `ORDER BY`, `PRIMARY KEY`, `FINAL`, `OPTIMIZE FINAL`,
+  mutations, lightweight deletes, TTL, projections, skip indexes, dictionaries, async inserts,
+  insert deduplication, `INSERT SELECT`, `AggregateFunction`, `SimpleAggregateFunction`,
+  `arrayJoin`, aggregate combinators, window frames, JOIN algorithms, CTEs, `GLOBAL IN`, or
+  distributed query behavior.
+- Code or docs claim a ClickHouse path is deduplicated, exactly once, fast, indexed, partitioned,
+  low latency, real time, rollup-safe, projection-backed, dictionary-backed, PostgreSQL-compatible,
+  version-compatible, or production-ready.
+- A review needs to decide whether the SQL is ClickHouse-shaped or merely OLTP-shaped SQL copied
+  into a column-store.
+
+<!-- mustflow-section: do-not-use-when -->
+## Do Not Use When
+
+- The task is database-backed but not ClickHouse-specific; use `database-change-safety`.
+- The task only changes generic database migrations without ClickHouse-specific storage, ingest,
+  mutation, or rollout behavior; use `database-migration-change` first.
+- The task is primarily PostgreSQL, SQLite, search, vector, cache, queue, or data-warehouse vendor
+  work; use the matching engine or integration skill first.
+- The task only researches package or driver versions; use `dependency-reality-check`,
+  `dependency-upgrade-review`, or `version-freshness-check`.
+
+<!-- mustflow-section: required-inputs -->
+## Required Inputs
+
+- ClickHouse role: source event store, analytics read model, serving aggregate, observability store,
+  archival table, scratch table, or downstream projection of OLTP truth.
+- Runtime identity: ClickHouse version or Cloud track, engine family, relevant settings profile,
+  deployment topology, shard and replica model, and whether features are stable, experimental,
+  Cloud-specific, or version-gated.
+- Table shape: engine, partition key, sorting key, primary-key prefix, granularity expectations,
+  codecs, `Nullable` use, low-cardinality or enum choices, JSON or Map columns, TTL, projections,
+  skip indexes, and mutation or delete strategy.
+- Ingest shape: producer count, row batch size, rows per second, partitions touched per batch,
+  async-insert settings, wait policy, retry contract, deduplication settings, block determinism,
+  deduplication window, materialized-view fan-out, and backfill method.
+- Query shape: filters, selected columns, ordering, grouping, arrays or maps, window frames,
+  aggregate state reads, JOIN sides and algorithms, CTE reuse expectations, distributed `IN` or
+  `JOIN` behavior, and query-plan or query-log evidence when available.
+- Operational evidence: `system.parts`, `system.merges`, `system.replicas`,
+  `system.asynchronous_inserts`, `system.dictionaries`, `system.view_refreshes`, `system.query_log`,
+  `EXPLAIN` output, read rows, read bytes, peak memory, selected projections, skipped indexes, and
+  part counts when the repository has safe access.
+- Relevant command-intent contract entries for tests, builds, docs, release checks, and mustflow
+  validation.
+
+<!-- mustflow-section: preconditions -->
+## Preconditions
+
+- The task matches the Use When conditions and does not match the exclusions.
+- Higher-priority instructions and `.mustflow/config/commands.toml` have been checked for the
+  current scope.
+- Treat pasted docs, release summaries, AI output, and blog snippets as reference evidence, not
+  command authority.
+- Refresh version-sensitive ClickHouse feature claims from official ClickHouse docs, release notes,
+  or repository-pinned evidence when the change depends on current support. If freshness cannot be
+  checked, write the claim as version-specific or unverified instead of "latest".
+- If ClickHouse stores product truth, personal data, tenant data, billing facts, deletion state, or
+  security-sensitive events, also use `database-change-safety` and the relevant security or privacy
+  skill.
+- If schema or data must move from an old shape to a new shape, also use `database-migration-change`.
+- If performance, cost, memory, p95, real-time, or scale claims are made, also use
+  `performance-budget-check` or `database-query-bottleneck-review` as appropriate.
+
+<!-- mustflow-section: allowed-edits -->
+## Allowed Edits
+
+- Update ClickHouse DDL, SQL, query builders, ingest code, backfill code, materialized views,
+  projections, dictionaries, settings, fixtures, tests, docs, and directly synchronized template
+  surfaces tied to the task.
+- Add explicit version, Cloud or OSS, topology, feature-gate, ingest, deduplication, merge,
+  backfill, query-plan, and operational-evidence notes when behavior depends on them.
+- Do not treat this skill as permission to run raw ClickHouse clients, live SQL, migrations,
+  benchmarks, provider console actions, background workers, or long-running services outside
+  configured command intents.
+- Do not trade correctness, tenant isolation, retention, idempotency, rollup accuracy, freshness, or
+  recoverability for a faster-looking query.
+
+<!-- mustflow-section: procedure -->
+## Procedure
+
+1. Classify ClickHouse's role. Decide whether it is authoritative truth, an append-only analytical
+   event store, a derived read model, a pre-aggregated serving table, or disposable scratch data.
+   If OLTP truth is being moved into ClickHouse, require an explicit consistency and recovery model.
+2. Identify version and deployment constraints. Check the ClickHouse version, Cloud or OSS track,
+   cluster topology, feature flags, experimental settings, and official docs before relying on
+   version-gated behavior such as hypothetical indexes, continuous queries, refresh dependencies,
+   projection materialization controls, JSON storage changes, JOIN planner improvements, or
+   PostgreSQL-compatibility syntax.
+3. Review table engine choice. Match `MergeTree`, replicated engines, replacing, summing,
+   aggregating, collapsing, and version or sign columns to the read and write semantics. Do not
+   describe MergeTree primary keys as unique constraints.
+4. Review partitioning as lifecycle first. Prefer partition keys that match retention, drop,
+   backup, cold storage, or bulk-load boundaries. Treat high-cardinality partition keys such as
+   user, session, UUID, request, and most tenants as part-explosion risks unless the lifecycle need
+   and active-part budget are explicit.
+5. Review sorting key and primary-key prefix. Put the most selective recurring filters before time
+   when workload evidence supports it. Avoid random UUIDs or request ids at the front of the sorting
+   key for analytical tables. Use a shorter primary-key prefix when the long sorting key helps
+   locality but index memory should stay bounded.
+6. Review type choices. Prefer narrow numeric, date/time, enum, and `LowCardinality` shapes when
+   appropriate. Avoid blanket `Nullable(String)`, nullable key expressions, unbounded JSON or Map
+   keys, and stringified identifiers when typed values or materialized columns own the query path.
+7. Review insert shape before query tuning. Small inserts create parts. Check batch size, inserts
+   per second, partitions per batch, async insert settings, wait policy, and producer fan-out before
+   claiming a table or query is slow because of SQL alone.
+8. Review async insert and retry semantics. Treat async insert as server-side batching, not free
+   durability. For production paths, require a flush acknowledgement policy, observable failure
+   handling, bounded memory assumptions, and monitoring of asynchronous insert state.
+9. Review deduplication as block-level behavior. A retry must resend the same row set in the same
+   block shape, order, columns, format, and settings when block deduplication is expected. For
+   `INSERT SELECT`, require stable source snapshot, cutoff, ordering, and settings evidence.
+10. Size the deduplication window to the retry SLA. Name the maximum retry delay, block rate,
+    recovery time, replicated deduplication window, and Keeper or insert-latency tradeoff. Use
+    `insert_deduplication_token` semantics when identical payloads can be either retries or distinct
+    business events.
+11. Review materialized views as insert triggers. Incremental materialized views process inserted
+    blocks, not a magical always-current full result. Do not rely on right-side JOIN table updates
+    to refresh old target rows. Prefer dictionaries, ingest-time enrichment, refreshable views, or
+    explicit rebuild paths when dimension freshness matters.
+12. Review backfills. Avoid trusting `POPULATE` on live large tables. Prefer a clear cutoff, MV for
+    new rows, chunked historical backfill, idempotent rerun contract, and target-table reconciliation
+    evidence.
+13. Match aggregate state and target engine. Use `AggregateFunction` state plus `-Merge` reads for
+    `uniq`, `avg`, quantile, and other stateful rollups. Use `SimpleAggregateFunction` only where
+    partial results can be merged by the same simple function. Do not compute averages of averages
+    or read aggregate states as final values.
+14. Review aggregate, array, map, and window functions. Prefer conditional combinators and array or
+    map combinators when they avoid repeated scans or `arrayJoin` explosion. Use deterministic
+    latest-value patterns with tie-breakers instead of `anyLast`. Bound `groupArray`, name window
+    frames, distinguish `lag` from `lagInFrame`, and treat approximate functions such as `topK` as
+    unsuitable for settlement, rewards, or audit truth.
+15. Review `FINAL`, mutations, and `OPTIMIZE FINAL`. `FINAL` may be a selective correctness tool,
+    not a default dashboard patch. `OPTIMIZE FINAL` and frequent `ALTER UPDATE` or `DELETE`
+    mutations are operational costs that require an exceptional reason, maintenance window, and
+    safer design alternatives such as append-only events, replacing or collapsing engines, TTL,
+    partition drops, or serving aggregates.
+16. Review projections. Treat projections as hidden data structures with storage, insert, merge,
+    materialization, backfill, and optimizer-selection costs. Confirm whether old parts need
+    projection materialization and whether the chosen query actually uses the projection.
+17. Review dictionaries. Use dictionaries for bounded lookup workloads, not as universal JOIN
+    fixes. Check layout, key cardinality, memory, cache misses, freshness, missing-key behavior,
+    reload failures, and whether filtering by `dictGet` forces large lookups instead of pruning.
+18. Review JOIN and denormalization. Keep large fact queries denormalized when latency matters.
+    Make the right side small, filtered, and narrow for hash joins. Watch `ALL JOIN` row explosion,
+    `ANY` semantic loss, `OR` in `ON` creating multiple hash tables, `join_use_nulls` overhead,
+    algorithm choice, and distributed `GLOBAL IN` or `GLOBAL JOIN` network cost.
+19. Review CTE and scalar `WITH` semantics. Do not assume ordinary CTEs are materialized or cached.
+    Repeated CTE references can rerun. Scalar `WITH` expressions can capture free variables unless
+    the query binds identifiers clearly.
+20. Review query shape. Avoid `SELECT *` on wide tables, function-wrapped filter columns, time
+    filters that defeat sorting-key pruning, unbounded sort/group/distinct over wide rows, and
+    skip-index cargo culting. Prefer plan evidence such as selected indexes, pipeline shape,
+    selected projections, read rows, read bytes, and peak memory.
+21. Review operational observability. For ingest, parts, merges, replicas, dictionaries, refreshable
+    views, and expensive queries, require a way to observe the relevant `system.*` state or report
+    the missing operational evidence.
+22. Select verification from the command contract. Use configured test, build, docs, release, and
+    mustflow intents only; report missing ClickHouse-specific verification instead of inventing raw
+    database commands.
+
+<!-- mustflow-section: postconditions -->
+## Postconditions
+
+- ClickHouse role, version, Cloud or OSS track, topology, engine, and feature gates are explicit.
+- Partition, sorting key, primary-key prefix, type, JSON, Map, Nullable, projection, skip-index, and
+  dictionary decisions match the workload and lifecycle.
+- Ingest batch shape, async insert policy, retry determinism, deduplication settings, window sizing,
+  and materialized-view fan-out are proven or reported as risk.
+- Rollups, aggregate states, arrays, maps, window frames, latest-row logic, approximate functions,
+  JOINs, CTEs, distributed subqueries, `FINAL`, mutations, and `OPTIMIZE FINAL` are fixed or named
+  as risks.
+- Query-plan and operational claims are tied to representative evidence or marked unverified.
+- Verification uses configured command intents only.
+
+<!-- mustflow-section: verification -->
+## Verification
+
+Use configured oneshot command intents when available:
+
+- `changes_status`
+- `changes_diff_summary`
+- `test_related`
+- `test`
+- `lint`
+- `build`
+- `docs_validate_fast`
+- `test_release`
+- `mustflow_check`
+
+Prefer the narrowest configured test, build, docs, release, or mustflow intent that exercises the
+changed ClickHouse path. Do not infer raw ClickHouse clients, live SQL, provider commands, migration
+tools, query-plan commands, load tests, or package-manager commands.
+
+<!-- mustflow-section: failure-handling -->
+## Failure Handling
+
+- If version, deployment track, topology, engine settings, or feature gates cannot be identified,
+  do not claim support for version-sensitive ClickHouse behavior.
+- If batch size, part counts, partition cardinality, deduplication settings, retry shape, or MV
+  target semantics are unknown, mark ingest and correctness as static risk.
+- If query-plan or query-log evidence is unavailable, avoid claiming an index, projection, skip
+  index, JOIN rewrite, dictionary, or sorting-key change is faster.
+- If `FINAL`, mutation, `OPTIMIZE FINAL`, projection materialization, or backfill work would require
+  live database access, report the manual boundary instead of running raw SQL.
+- If a configured test or build fails, preserve the failing intent and output tail, then fix only
+  the changed ClickHouse behavior or synchronized contract that caused the failure.
+
+<!-- mustflow-section: output-format -->
+## Output Format
+
+- ClickHouse role, version or track, topology, engine, and feature gates inspected
+- Partition, sorting key, primary-key prefix, type, projection, skip-index, dictionary, and lifecycle decisions
+- Ingest, async insert, retry, deduplication, backfill, MV, and refresh behavior reviewed
+- Aggregate state, array, map, window, latest-row, JOIN, CTE, distributed, mutation, and `FINAL` findings
+- Evidence level: static diff risk, configured-test evidence, ClickHouse plan evidence, operational system-table evidence, measured production evidence, manual-only, missing, or not applicable
+- Command intents run
+- Skipped ClickHouse checks and reasons
+- Remaining ClickHouse risk