Add the judgment calls to the realm-policy-authoring skill

index.md

@@ -67,7 +67,7 @@ Every skill lives in `skills/` and auto-activates on its description triggers 
 - **[`bxl-authoring/`](skills/bxl-authoring/SKILL.md)** — Writing BXL in a card's `computeVia`: which of the three call-site forms to reach for, what the `derive` profile refuses, aggregating over linked and query-backed collections, and the traps that produce a plausible wrong value instead of an error.
 - **[`query-backed-relationships/`](skills/query-backed-relationships/SKILL.md)** — The `{ query }` form of `linksTo`/`linksToMany`: the bounded page it holds rather than the whole match set, reading `totalMatchCount` instead of counting rows, declaring a larger page, `eager: false`, and when a search component is the right tool instead.
 - **[`card-operations-authoring/`](skills/card-operations-authoring/SKILL.md)** — Declaring named actions on a card as plain data with `@operation` and invoking them through `operations()`: the nine base operations, the typed references, the sugar clauses and the `bxl` escape hatch, `links` and `html` declarations, `nonGrantable`, atomic batches and saved searches and what a policy does to each, hiding a control the caller cannot use with `@context.canInvoke`, what lowering refuses at index time, the refusals a caller sees under a realm policy, and the access posture.
-- **[`realm-policy-authoring/`](skills/realm-policy-authoring/SKILL.md)** — Writing a `RealmPolicy` card that lets callers the realm's permissions decline do particular things: linking it from `realm.json`, rules and grants, file and source-read grants (and why code needs the realm's own read), membership predicates in the `policy` BXL profile, which `query` grants compile to a search filter, `snapshot: true`, every issue code, `validate`, calling `explain` against the live policy or a draft, and the refusals a caller sees.
+- **[`realm-policy-authoring/`](skills/realm-policy-authoring/SKILL.md)** — Writing a `RealmPolicy` card that lets callers the realm's permissions decline do particular things: linking it from `realm.json`, rules and grants, file and source-read grants (and why code needs the realm's own read), membership predicates in the `policy` BXL profile, which `query` grants compile to a search filter, `snapshot: true`, every issue code, `validate`, calling `explain` against the live policy or a draft, the refusals a caller sees, and the judgment calls: named operation or raw `update`, keeping authorization-bearing fields out of a grant's reach, when `snapshot: true` is acceptable, the `read`/`query` split, and reading an explanation.
 - **[`source-code-editing/`](skills/source-code-editing/SKILL.md)** — The `run-realm-code` tool and its `realm.fs` API. Required before writing any file.
 - **[`ember-best-practices/`](skills/ember-best-practices/SKILL.md)** — Ember.js performance + accessibility rules (59 rules across 10 categories) for writing, reviewing, or refactoring Ember code.
 

skills/glossary.md

@@ -392,7 +392,7 @@ Use the namespaced CLI published from the Boxel monorepo through `npx boxel`. Th
 - **`boxel-skill-authoring`** — SKILL.md format contract for user-authored skills: `boxel.kind: skill` frontmatter, tool declarations, verify loop.
 - **`boxel-workspace-cardinal-rules`** — Silent-failure trap checklist (DateField vs DateTimeField formats, external URLs in relationship links, `linksToMany` indexed keys, …); partially overlaps the `boxel` skill's cardinal rules under its own numbering.
 - **`card-operations-authoring`** — Declaring named actions on a card with `@operation` and invoking them through `operations()`: base operations and which def type carries which, `params` and the typed references, the sugar clauses (`append` / `assert` / `set` / `fill` / `item` / `query`) and the `bxl` escape hatch, the `links` and `html` declarations, `nonGrantable`, atomic batches and saved searches and what a policy does to each, `@context.canInvoke` and `_capabilities`, the lowering findings an author hits, the refusals a caller sees (under a realm policy too), and the access posture.
-- **`realm-policy-authoring`** — The reference for a `RealmPolicy` card: the `policy` pointer on `realm.json`, the rule / grant / `where` shape, what a grant admits (types, named operations, the create lane), file and source-read grants, writing `where` in the `policy` BXL profile, which `query` grants compile to a search filter, `snapshot: true` reads, every issue code and its severity, `validate`, calling `explain` (live, draft, search, listing), authorization infrastructure and `nonGrantable`, and the refusals a caller sees.
+- **`realm-policy-authoring`** — The reference for a `RealmPolicy` card: the `policy` pointer on `realm.json`, the rule / grant / `where` shape, what a grant admits (types, named operations, the create lane), file and source-read grants, writing `where` in the `policy` BXL profile, which `query` grants compile to a search filter, `snapshot: true` reads, every issue code and its severity, `validate`, calling `explain` (live, draft, search, listing), authorization infrastructure and `nonGrantable`, the refusals a caller sees, and the judgment calls (named operation or raw `update`, keeping authorization-bearing fields out of reach, when `snapshot: true` is acceptable, the `read`/`query` split, reading an explanation).
 - **`bxl-authoring`** — Writing BXL in a card's `computeVia`: tag choice (plain string / `fx` / `jq`), what the `derive` profile refuses at field-definition time, collecting an aggregate's iterating argument, blank-input and error-value behavior, query-backed aggregation staleness, cyclic graphs, dates, memoization, `{ as: FieldDef }` materialization.
 - **`query-backed-relationships`** — Declaring and sizing the `{ query }` form of `linksTo`/`linksToMany`: the bounded page it holds, `totalMatchCount` vs counting rows, declaring a larger page, `eager: false`, singular-`linksTo` arity, and when a search component is the right tool instead.
 - **`boxel-ui-component-discovery`** — Mandatory catalog Spec search before hand-rolling UI primitives, Pret UI specs first and boxel-ui only where Pret UI has none; enumerate → one broad component-Spec query → read the API (a Pret UI spec's linked `writeup`, a boxel-ui spec's `attributes.readMe`) → self-audit.