diff --git a/.changeset/25234-skills-membership-key-row.md b/.changeset/25234-skills-membership-key-row.md
new file mode 100644
index 00000000000..f59da9a75c5
--- /dev/null
+++ b/.changeset/25234-skills-membership-key-row.md
@@ -0,0 +1,9 @@
+---
+'@objectstack/skills': patch
+---
+
+docs(skills): the objectstack-data skill's `current_user` placeholder table names a declared membership key
+
+Clause-②: no
+
+The security rules' table of the `current_user.*` placeholders the RLS compiler resolves listed only the kernel's keys. It now has a row for `current_user.KEY`, the set an object's `membershipKeys.KEY` declares (for `IN`), so an author reading the catalog alone learns that a declared key resolves.
diff --git a/scripts/check-skills-token-ratchet.mjs b/scripts/check-skills-token-ratchet.mjs
index 5e3435686bf..60c216d5986 100644
--- a/scripts/check-skills-token-ratchet.mjs
+++ b/scripts/check-skills-token-ratchet.mjs
@@ -544,7 +544,15 @@ export const CEILINGS = new Map([
   // schema alone writes the refused shape. +63 tokens, zero headroom to absorb
   // any of it, ceiling +63. Maintainer ruling 2026-09-17 (recorded on #17359 as
   // comment 5710537499), verbatim and untranslated: 「security.md 允许增加到 2543」.
-  ['skills/objectstack-data/rules/security.md', 2543],
+  // 2543 -> 2563 (#25234): the `current_user.*` placeholder table gains the
+  // declared membership key row (`ObjectSchema.membershipKeys`, staged per
+  // request since #25528), which the table did not teach, so an author reading
+  // the bundle alone had no way to know a declared key resolves. +22 tokens on
+  // a landed 2541, 2 absorbed by headroom, ceiling +20. Maintainer ruling
+  // 2026-10-24 (project decision list item 9), verbatim and untranslated, the
+  // line for item 8 of the same message elided:
+  // 「9. 技能文档 security.md 的 token 上限 2543 → 2563 … 同意」.
+  ['skills/objectstack-data/rules/security.md', 2563],
   // 3024 -> 3109 (2026-08-31 app-repo-principles raise, see the block above).
   // Severity Levels listed the three values and left the CHOICE unstated: a
   // block rests on a judgement a person made, so a machine-inferred signal — a
diff --git a/skills/objectstack-data/rules/security.md b/skills/objectstack-data/rules/security.md
index b425fed8e87..27da8bfefd4 100644
--- a/skills/objectstack-data/rules/security.md
+++ b/skills/objectstack-data/rules/security.md
@@ -106,6 +106,7 @@ bridge (warns). The compiler resolves these
 | `current_user.organization_id` | the caller's tenant |
 | `current_user.org_user_ids` | ids of users in the same org (for `IN`) |
 | `current_user.positions` | the caller's positions (for `IN`; ADR-0090 D3) |
+| `current_user.KEY` | the set an object's `membershipKeys.KEY` declares (for `IN`) |
 
 - Source: `node_modules/@objectstack/spec/src/security/rls.zod.ts` (policy
   shape, predicate grammar, `check` composition).