docs(spec): re-anchor the dead tracker citations left in data/ to the commits that decided them (stage 4)

[objectstack-fleet]

Part of #20234
Clause-②: no

What changed

This is stage 4 of the staged sweep: the data/ remainder. It covers the six packages/spec/src/data/ files stage 3 (PR #20533, landed 03b19d9cfd) left out because an open PR held them, and nothing else. They are object.zod.ts, filter-logic-conformance.ts, object.form.ts, data-engine.zod.ts, data-engine.test.ts and hook.form.ts. Later stages cover the other areas, so this PR says Part of.

The census below measured all six. Three of them carry comment or docblock sites that cite a tracker number answering 404. data-engine.zod.ts, data-engine.test.ts and hook.form.ts carry none, so they are not in the diff.

Every such site has been rewritten in ruling C+D's form C (comment 5749154545 on #19123). That is 19 sites on 19 lines in 3 files, covering 9 numbers. Each rewritten line now cites the commit in origin/main history that decided what the line describes, and it says in its own words what that commit decided. Where a PR number was already on the line (PR #13529), it stays beside the commit as the link.

No ADR or ruling-record file in docs/adr/ or scripts/adr-anchors/ records the decision behind any of the 9 numbers: a search for each number, with and without #, finds nothing there. So every anchor is a commit: 9 distinct shas. Stage 3 had already read these commits and recorded them in PR #20533's body. They were not copied from there. Each one was re-read against the current line it anchors: its own message or diff names the number it replaces, and it made the change the line describes. object.zod.ts and filter-logic-conformance.ts moved on main after stage 3 read them (PRs #20521 and #20523). Each site was therefore re-read at this base, 03b19d9cfd.

Only comments changed. Every source file keeps its line count (20 lines out, 20 in, over 3 files), so no line citation into these files moves. One of the 20 lines held no dead citation: filter-logic-conformance.ts:249, the first half of a sentence reflowed onto :250. No code token moves (see the guard below).

No tracker number is added. Every tracker number on an added line was already in the hunk it replaces. PR #13529 stands on three added lines, and on the three removed lines of the same hunks. It is the link beside commit 9dac1ae01, which stage 3 recorded the same way.

No reference page under content/docs/references/ moved: none of the rewritten docblocks projects into one (check:docs at the head: 226 generated files in sync). The PR adds one patch changeset for @objectstack/spec (see Changeset below).

Census: the six files, before and after

Instrument. This is the instrument of stages 1 to 3. It sends REST GET /repos/objectstack-ai/objectstack/issues/N without following redirects, for every distinct number cited in packages/spec/src/data. The population is:

• the citation gate's own exported CITATION_RE and NON_CITATION_HEADS, kept when the qualifier is none, objectstack, objectstack-ai/objectstack, framework, pre- or post-;
• widened case-insensitively to Pre-, POST- and Framework, as in stage 3;
• N of 100 or more, excluding summon heads.

Each site is classified by the TypeScript parser as a line comment, a docblock, a block comment or a string.

Two cross-checks close the population. First, a raw #N count in each of the six files equals the census rows plus the cross-repo rows in five files. In the other two it is one higher, and the extra is a second number after a slash inside a string (#5322/#5134 in a note, #6262/#6433 in a test title). Both answer 200. Second, no spelled citation (issue N, PR N, card N) occurs in any of the six.

Controls. The lit controls were #16862, #16847 and #17698. The dead controls were #16714, #16715 and #16697. They were probed at the start, after every 100 numbers and at the end: 24 of 24 lit (200) and 24 of 24 dead (404) over 8 checkpoints in the base run, and 21 of 21 lit and 21 of 21 dead over 7 checkpoints in the head run.

reading	tree	numbers probed	200	404	301 or other	dead sites, all of data/	dead sites, the six files	lines	files	numbers
before	base 03b19d9cfd, probed 2026-09-29T01:11:59Z to 01:15:49Z	601	572	29	0	77	19	19	3	9
after	head 53c9070dfd, probed 2026-09-29T01:25:55Z to 01:29:35Z	597	572	25	0	58	0	0	0	0

The head probe found no number newly dead since the base probe: the same 572 numbers answer 200. The base reading of 77 equals stage 3's after reading at 96fd49caa2.

Per file. Cited sites here are every in-repo citation the population reads, live or dead.

file	cited sites (base)	dead sites before	by class	dead sites after
object.zod.ts	120	15	8 docblock, 7 line comment	0
filter-logic-conformance.ts	97	3	2 docblock, 1 line comment	0
object.form.ts	31	1	1 line comment	0
data-engine.zod.ts	48	0		0
data-engine.test.ts	29	0		0
hook.form.ts	0	0		0

None of the 19 sites is a string, so this stage leaves no string token behind.

Per-number table

number	sites / lines	anchor: what it decided
#8772	4 / 4, object.zod.ts:2718, :2731, :2744, :2910	75b7c240a: Direction 2 of the 2026-08-16 maintainer ruling. ObjectSchema.create() forces required: true on a master_detail reference under controlled_by_parent and refuses an explicit required: false. Raw parse stays tolerant, and runtime tolerance is the ruling's other half. Its changeset records the measurement that only the security gate closed that shape while the declaration surface accepted it (:2731). ADR-0055 stays cited beside it. It is the same anchor stage 3 gave object.test.ts
#10165	2 / 2, object.zod.ts:818, :1036	801296050: ttl.onlyWhen with the canonical null predicate (maintainer ruling 2026-08-20, option A). One shared onlyWhen union, and both of retention.onlyWhen's conflicts mirrored. Its diff wrote both [#10165] blocks
#10347	3 / 3, object.zod.ts:1006, :1042, :1049	530c1df65: the Archiver honours a declared ttl. It selects by the ttl cutoff on ttl.field when ttl is declared, and by created_at / archive.after otherwise (maintainer ruling 2026-08-20)
#10527	1 / 1, object.zod.ts:1005	5649efbf9: refuses a diverging retention + ttl + archive triple at parse time. Its diff wrote this very paragraph
#11195	1 / 1, object.zod.ts:1791	b37231883: UserActionsConfigSchema adopts group / hideFields / rowColor (the "last three" the line names)
#11408	1 / 1, object.zod.ts:2189	f11fc61c5: declares editMode on the object document (maintainer ruling 2026-08-24, the #10144 declare-or-rule-out family, which stays cited)
#13608	3 / 3, object.zod.ts:2317, :2354, :2366	fc9ba76a5: publicSharing.eligibility is held at redemption, not only at mint, fail-closed, with the undifferentiated null refusal. Its changeset heads with #13608. It is the same anchor stage 1 gave contracts/share-link-service.ts
#13195	3 / 3, filter-logic-conformance.ts:190, :250, :525	9dac1ae01, PR #13529's squash commit, which stays as the link: $exists means has-a-value on driver-memory's live mingo path, its analytics face and driver-mongodb's translateFilter (the "last three key-presence exits")
#12868	1 / 1, object.form.ts:256	c459da6bc: narrows the per-option default key out of the form-view options vocabulary, which offered a key nothing on that surface read. Commit e808890958, which wrote this line, names #12868 as the same offer-vs-door class

The shas were checked at the base and again at origin/main 288611e3e5. Every one matches exactly one commit (git rev-parse --disambiguate, count 1). Every one is an ancestor (git merge-base --is-ancestor, exit 0 for 9 of 9). The control leg e9584681a4 also exits 0, and the repository is not shallow. For each commit, a grep of its own message or diff finds the number it replaces. Seven of the nine name it in the message. fc9ba76a5 names it in its diff (20 lines, including its changeset heading), and so does c459da6bc (8 lines, including its changeset heading).

Wordings to check, each true of its commit:

• object.zod.ts:2731 now reads 「closes that shape, and commit 75b7c24 records that the declaration and the enforcement disagree」. The measurement was the card's. The commit's changeset records it: "only the security gate closed that shape while the declaration surface accepted it".
• object.zod.ts:2189 reads 「Declared here by commit f11fc61's maintainer ruling」, and :2744 reads 「the other half of commit 75b7c24's ruling」. This is stage 3's wording for the same relation (object.test.ts, 「the other half of commit 75b7c24's ruling」): the commit that landed the ruling and quotes it.
• object.zod.ts:1049 reads 「That is the whole of what [commit 530c1df] changed here」. Commit 52db1d1f2a wrote the paragraph. 530c1df65 is the change it describes.

Mechanical guard: no code token moves

The check compares leaf tokens with comments stripped, base 03b19d9cfd against head 53c9070dfd. It uses the TypeScript parser's leaf tokens (TypeScript from the head's lockfile), so template literals are scanned in context, and it excludes JSDoc nodes. It ran over all 3 touched .ts files. It is the stage-3 instrument, unchanged.

• Real run: 13,624 base tokens (object.zod.ts 8,774, object.form.ts 3,226, filter-logic-conformance.ts 1,624), 0 files with a token change (exit 0).
• Comment-insertion control (object.form.ts): 0 files changed, as expected (exit 0).
• Positive control (a declaration inserted into object.zod.ts): 1 file reads DIFFER at token 1629 (exit 1).
• Positive control (one digit changed inside the #5322/#5134 note string in filter-logic-conformance.ts): 1 file reads DIFFER at token 889 (exit 1).

Line balance: object.zod.ts +15 / -15, filter-logic-conformance.ts +4 / -4, object.form.ts +1 / -1. Line counts are equal at base and head: 3,240, 621 and 751.

Changeset

This change ships bytes, so a patch changeset for @objectstack/spec is included. It says only that the provenance comments were re-anchored. Clause-②: no: no export, key, value or type moves (the guard above).

Measured on the head's built package: object.zod.ts is src/**/*.zod.ts, which files[] ships verbatim. The rewritten comments also reach dist:

• 9dac1ae01 appears in dist/data/index.d.ts (the filter-logic-conformance.ts docblock) and in 4 bundled .js files;
• fc9ba76a5, f11fc61c5 and b37231883 each appear in 22 bundled .js files, and c459da6bc in 12;
• the positive control, the pre-existing object.zod.ts sentence 「Fail-CLOSED at both points」, appears in 11 bundled .js files.

Gates (head 53c9070dfd)

• Citation judging pass, run as CI runs it: pnpm check:issue-citations && node scripts/check-issue-citations.mjs exits 0. The self-test passes 73 cases in 7 batteries. The live run judged 6 citations across 3 files: 3 resolve (#9138 twice, #11410) and 3 resolve as a pull request (#13529, the link).
• Doc authoring: pnpm check:doc-authoring exits 0.
• Derived gates: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack at the head derived 79 families, and all 79 exit 0. --ran reports 79 run, 0 NOT MEASURED, 0 unrun, and exits 0. A full turbo run build of ./packages/* ran first, under the shared verify lock: 71 of 71 tasks, VERDICT command-exit 0. So no gate met an unbuilt prerequisite.
• pnpm --filter @objectstack/spec run check:generated: under the lock against that build, All 15 generated artifacts are up to date, VERDICT command-exit 0.
• Tests and typecheck:
  • pnpm --filter @objectstack/spec exec vitest run --maxWorkers=2 src/data under the lock: Test Files 107 passed (107), Tests 3527 passed, 1 todo (3528), VERDICT command-exit 0. It covers every test in data/, among them object.test.ts, which reads these schemas.
  • The 13 spec suites outside src/data that read the touched files' source text or pin their line numbers, under the lock: Test Files 13 passed (13), Tests 544 passed (544). They are stage 3's 12 (scripts/{file-description,root-index,skill-map-guards,strictness-ledger}.test.ts, src/api/api-entry-graph.pin.test.ts, src/contracts/scoped-context.test.ts, src/shared/{alias-integrity,evaluated-slot-population,retired-key-migrate-sentence}.test.ts, src/system/constants/platform-object-names.test.ts, src/type-alias-convention.pin.test.ts, src/ui/dashboard.test.ts) plus src/shared/union-author-message-pins.test.ts, which pins data/object.zod.ts:855.
  • pnpm --filter @objectstack/spec typecheck under the lock exits 0, including check:test-typecheck (53 files, 251 errors, 138 pinned signatures held).
• Lint, as a proven narrowing at the head: eslint --no-inline-config --format json over the 3 touched .ts files gives 3 files, 0 errors and 0 warnings. All 3 are in eslint's own population (isPathIgnored is false for each). eslint.config.mjs never enables type-aware linting (no parserOptions.project, which its own line 328 states), so a comment edit here cannot move the verdict on any untouched file. The repo-wide pnpm lint is CI's run.

Acceptance notes

• Base. The branch forked from 03b19d9cfd, stage 3's landing. origin/main then moved two commits (05077d4c26, PR fix(spec): shard the generated liveness and strictness counts so PRs moving different units stop conflicting on a committed total #20532, and 288611e3e5, PR fix(spec): os migrate meta guidance for the rest-*, analytics-*, view-*, package-*, object-*, sharing-*, audit-*, flow-* and http-* migration entries states each lesson in words, not tracker numbers (stage 6) #20536), and neither touches data/. dispatch-gates flagged its derivation as stale because scripts/regen-artifacts.mjs had moved, so origin/main was merged in (53c9070dfd, a clean merge with no driver-deferred path) before the gates ran. The PR's delta against origin/main is exactly its 4 files. origin/main has since moved two more commits: 7e36a3cd7c (PR spec(object-timeline): items describe names objectui as the item-shape owner #20531) and ba5927f714 (PR feat(spec,cli)!: one stack authoring shape — os validate / os build refuse a default export defineStack did not build #20460). Neither touches data/ or anything the gate derivation reads, and a re-derivation prints the same 79 commands. A no-driver merge-tree of the head onto ba5927f714, from a bare shared clone, exits 0. So there is no second merge.
• Open PRs, re-read at 2026-09-29T02:01Z: 9 open PRs, and none touches any of the six files. The data/ files open PRs touch are feat(spec)!: retire the inner name on cube measures and dimensions — the record key is the member's name (#20300) #20458's analytics* files, fix(spec,driver-turso)!: refuse a forced mode replica with no syncUrl at authoring and at construction (#20437) #20504's driver/turso.*, and fix(spec)!: a boolean, a Date or an array compared against a number field is refused like a non-numeric string (#20502) #20545's filter-number-comparand-declared-type.*, which is disjoint. Since the claim, PR feat(spec,cli)!: one stack authoring shape — os validate / os build refuse a default export defineStack did not build #20460 has landed (ba5927f714) without touching filter-subtree-provenance.ts. That file's 3 dead sites are outside this claim's fence, so they are left for a later stage.
• The rung. Two anchored changes also have ADR-0087 entries in packages/spec/src/migrations: cbp-master-detail-required-forced for A controlled_by_parent object may declare its master reference without required, so the master-access guard is the only thing preventing an unreachable orphan detail row #8772, and form-view-option-default-retired for Narrow the per-option default key OUT of the form-view options vocabulary — the object-field face keeps it (enforced, #7246), the form-view face parses-and-ignores it (ruled on objectui#6263) #12868. The second entry's own header names commit c459da6bc. This PR takes the commit rung, as stages 1 to 3 did. The D3 id is the more durable in-repo record, if the ruling's first rung is later read to include those entries.
• What stays in data/ after this stage: 58 dead sites.
  • 12 comment sites in files other open work still holds. analytics.zod.ts, analytics-strictness-batchd.test.ts and analytics-date-range-two-bound-window.test.ts hold 5 (spec(analytics): retire the inner name on cube measures and dimensions; the record key is the identity (2 keys) #20300, PR feat(spec)!: retire the inner name on cube measures and dimensions — the record key is the member's name (#20300) #20458). driver/turso.zod.ts and driver/turso.test.ts hold 4 (turso: a datasource config with mode: 'replica' on a file: url and no syncUrl is accepted at authoring and at construction, then runs as a plain local database that never syncs #20437, PR fix(spec,driver-turso)!: refuse a forced mode replica with no syncUrl at authoring and at construction (#20437) #20504). filter-subtree-provenance.ts holds 3. It was held by [finding] os validate runs only the stack schema parse, so a config that exports a plain object (no defineStack() call) skips every defineStack cross-field refusal and passes #20367 and is now free (see above).
  • 3 comment sites stage 3 left on purpose. They are the test-read [#6259] marker at api-derivation.ts:163, the test comment at api-derivation.test.ts:232 that names it, and field.zod.ts:370, whose #6111 is objectui's number.
  • 43 string sites, left as tokens: 41 test strings (2 of them in the held analytics and turso test files) and the 2 exported AGGREGATION_CASES note strings in aggregation-conformance.ts (:398, :407, avg over a boolean field returns null on driver-memory and a number on sqlite — same rows, same dataset, same executor #11065), which aggregate sum / avg over 3+ fractional addends: SQLite native adds with compensation (0.1+0.2+0.3 = 0.6), every other face and the rows path naively (0.6000000000000001), so having $eq 0.6 keeps the group on SQLite native only #20489's claim holds.
  • Outside data/, the card's other remaining items are unchanged: the migrations and ui areas, the liveness/** notes, the why strings, the PROVENANCE_WAIVERS reason, and rest-server.zod.ts.
• The citation gate's reach. It defers packages/**/*.test.ts. No test file is touched here, so all 3 touched files are in its judging population.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/spec, touching 5 documentable anchor(s).

5 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/concepts/metadata-driven.mdx (via ObjectSchemaBase (symbol, a top-level const object))
• content/docs/data-modeling/objects.mdx (via userActions (symbol, a field of const object ObjectSchemaBase, an authorable key of data/Object))
• content/docs/permissions/system-context.mdx (via publicSharing (symbol, a field of const object ObjectSchemaBase, an authorable key of data/Object))
• content/docs/protocol/objectql/security.mdx (via publicSharing (symbol, a field of const object ObjectSchemaBase, an authorable key of data/Object))
• content/docs/protocol/objectui/index.mdx (via userActions (symbol, a field of const object ObjectSchemaBase, an authorable key of data/Object))

⛔ 5 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v14.mdx (via userActions (symbol, a field of const object ObjectSchemaBase, an authorable key of data/Object))
• content/docs/releases/v16.mdx (via userActions (symbol, a field of const object ObjectSchemaBase, an authorable key of data/Object))
• content/docs/releases/v17/17-0.mdx (via userActions (symbol, a field of const object ObjectSchemaBase, an authorable key of data/Object))
• content/docs/releases/v17/17-3.mdx (via publicSharing (symbol, a field of const object ObjectSchemaBase, an authorable key of data/Object))
• content/docs/releases/v17/17-4.mdx (via publicSharing (symbol, a field of const object ObjectSchemaBase, an authorable key of data/Object))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 1 anchor(s) matched too much of the corpus to be a work list: ObjectSchema (symbol, 37 pages)
• 1 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 137 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json ba5927f714af7516105706b36a05cedf34d5fa1b → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 32efa96a1663277a26465db97c03c318c4937197 — the merge of head 53c9070dfdc8165eed3e552a612fe42e05336c19 into base ba5927f714af7516105706b36a05cedf34d5fa1b, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 32efa96a1663277a26465db97c03c318c4937197 && git checkout 32efa96a1663277a26465db97c03c318c4937197
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin ba5927f714af7516105706b36a05cedf34d5fa1b 53c9070dfdc8165eed3e552a612fe42e05336c19 && git checkout -B drift-repro ba5927f714af7516105706b36a05cedf34d5fa1b && git merge --no-ff 53c9070dfdc8165eed3e552a612fe42e05336c19

node scripts/docs-audit/affected-docs.mjs --json ba5927f714af7516105706b36a05cedf34d5fa1b

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs ba5927f714af7516105706b36a05cedf34d5fa1b → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 53c9070dfdc8165eed3e552a612fe42e05336c19
Local-runs: none

Read: card #20234 (body; every comment: triage 5856637615 and the ruling it points at, 5749154545 on #19123; the seat-2 pointer 5858331362; the stage-1 claim 5859418643, report 5860236501, ACCEPT 5860414140 and landing 5860571318; the stage-2 claim 5860586561, report 5861177436, record 5861396181, ACCEPT 5861418146 and landing 5861600944; the stage-3 claim 5876941555, report 5881236928, record 5881413052 on PR #20533, ACCEPT 5881425268 and landing 5881658422; the stage-4 claim 5881696480 and report 5882273687), PR #20548 (body, its one comment 5882252546, the 4-file list, the 3 commits and the net diff against the merge base 288611e3e5, read from the local ref at the head above with -U0 and -U6), the nine cited commits (message and stat for all; the diff wherever the message does not name the number or the line claims more than the subject), packages/spec/package.json files[], pr-automation.yml's WHICH LEVEL, the citation gate's deferred surfaces, docs/adr/**, docs/NORTH-STAR.md and scripts/adr-anchors/ for the nine numbers, content/docs/references/** for the removed fragments, and the 10 open PRs' file lists. Nothing was built, run or re-run: the diff was read with git, the anchors with git show, the numbers with grep, and the tracker numbers with REST GET (a GitHub read, not a local run). The check-runs were read for judgment once, at 2026-09-29T02:15:17Z.

① Derived judgments

(a) Scope and file surface: right. 4 files: object.zod.ts (+15/-15), filter-logic-conformance.ts (+4/-4), object.form.ts (+1/-1) and the new .changeset/spec-data-rest-provenance-anchors.md (+12). All three sources are on the claim's six-file list; the other three (data-engine.zod.ts, data-engine.test.ts, hook.form.ts) are byte-identical base to head, and rightly so: every tracker number they cite answers 200 (under (c)). None of the claim's exclusions is in the file list (aggregation-conformance.ts, filter.zod.ts, filter-empty-operator.ts, driver/turso.*, filter-subtree-provenance.ts, analytics*, cube-member-inner-name-retirement.test.ts), and the two sets that open PRs still hold are still held (#20504 edits driver/turso.zod.ts and driver/turso.test.ts; #20458 edits analytics.zod.ts, analytics.test.ts, analytics-strictness-batchd.test.ts and cube-member-inner-name-retirement.test.ts). Of the 10 open PRs at 2026-09-29T02:11:57Z, none but this one touches any of the six files; the only other data/ files open PRs touch are #20545's filter-number-comparand-declared-type.*, disjoint. GitHub's main equals the local origin/main and the PR's base, ba5927f714, at the read, so the net diff judged here is the diff against current main; the branch is 2 commits behind it (7e36a3cd7c, ba5927f714), neither touching packages/spec/src/data/. No governed surface is touched; 52 changed lines. Every line count is preserved (3,240 / 621 / 751 at base, head and main).

(b) Comment-only, no code token or test string moves: right. git diff -U0 over the three .ts files: 20 lines added, 20 removed, every one of them a docblock line ( * ...) or a // line, and the -U6 context places each inside an open /** ... */ block or an unbroken // run: filter-logic-conformance.ts:190, :249-250 (the docblock at :184-256) and :525 (the // run between two FILTER_LOGIC_CASES rows, whose note: strings on :521 and :532 are untouched); object.form.ts:256 (the // run inside defineForm); object.zod.ts:818 (the docblock above the onlyWhen union), :1005-1006, :1036, :1042, :1049 (the // runs inside the LifecycleSchema superRefine), :1791 (the // run inside guidance), :2189, :2317, :2354, :2366, :2718, :2731, :2744 (docblocks) and :2910 (the // run inside ObjectSchema). No .describe() string, note: string, test title or code token is on any changed line, so the dev's parser-level token comparison is not re-run and not needed for that verdict.

(c) Census: right. The 133 distinct numbers (100 or more) cited in the six files at head were probed with REST issues/N without redirects, 2026-09-29T02:13:16Z to 2026-09-29T02:14:08Z: 133 answer 200, 0 answer anything else; lit controls #16862 and #16847 answered 200 and dead controls #16714 and #16715 answered 404 at the start, after 50, after 100 and at the end. The nine removed numbers (#8772, #10165, #10347, #10527, #11195, #11408, #13608, #13195, #12868) each answer 404; #13529 answers 200 as a pull request. No spelled citation (issue N, PR N, card N) occurs in the six files. Net added numbers per file: empty; net removed: exactly the nine, in the files and counts the dev's table gives (7 numbers on 15 lines in object.zod.ts, #13195 on 3 lines in filter-logic-conformance.ts, #12868 on 1 line in object.form.ts). Dead sites in the six files at head: 0. The dev's REST census over all of data/ is otherwise not re-run.

(d) Anchor truth: right, 9 of 9. Nine sha-shaped tokens stand on added lines and none on removed lines; git rev-parse --disambiguate answers exactly one object for each, and git merge-base --is-ancestor exits 0 for all nine against origin/main ba5927f714. No ADR, docs/NORTH-STAR.md or scripts/adr-anchors/ file names any of the nine numbers, so the commit rung is the right rung for all nine, as it was in stages 1 to 3. Each commit, read against the line it now anchors:

• 75b7c240a for A controlled_by_parent object may declare its master reference without required, so the master-access guard is the only thing preventing an unreachable orphan detail row #8772 (object.zod.ts:2718, :2731, :2744, :2910): PR feat(spec): builder forces required: true on a master_detail reference under controlled_by_parent (#9138) #9206's squash for card spec builder: force required: true on a master_detail reference under controlled_by_parent (ruled Direction 2 of #8772) #9138, whose message opens Direction 2 of the #8772 maintainer ruling (2026-08-16, comment 5306089973) and lands exactly what the docblock states (create() forces required: true on a master_detail reference under controlled_by_parent, refuses an explicit required: false, raw parse stays tolerant, runtime untouched as separate ruled slices). :2731 now says the commit records that the declaration and the enforcement disagree: its changeset reads #8772 measured that only the security gate closed that shape while the declaration surface accepted it, so records is exact where measured would not have been. :2744 the other half of commit 75b7c240a's ruling is the wording stage 3 accepted for object.test.ts. spec builder: force required: true on a master_detail reference under controlled_by_parent (ruled Direction 2 of #8772) #9138 stays on :2718 and :2910 and answers 200.
• 801296050 for lifecycle ttl accepts no row filter, so a transient object with terminal rows in-band cannot spare them — give ttl an onlyWhen mirroring retention.onlyWhen #10165 (:818, :1036): message Maintainer ruling 2026-08-20 (option A, #10165), one shared onlyWhen union and the mirrored conflicts; its own object.zod.ts diff wrote both [#10165] blocks being rewritten.
• 530c1df65 for finding(objectql): a lifecycle declaring both ttl and archive parses, but the ttl policy is silently inert — reapObject returns into archiveObject before the ttl reap runs #10347 (:1006, :1042, :1049, the three Since [commit ...] and what [commit ...] changed here sites): message the Archiver honours a declared ttl (#10347), Maintainer ruling 2026-08-20: what the author declared is what executes; its lifecycle-service.ts diff is dueField = lc.ttl ? lc.ttl.field : 'created_at' and where: { [dueField]: { $lt: cutoff } } with no onlyWhen spread, which is precisely the window-yes, filter-no claim :1042-1049 makes. It is the commit that made that change, so Since is true of it.
• 5649efbf9 for finding(objectql): with retention + ttl + archive all declared, only the ttl cutoff bounds the hot store #10527 (:1005): PR fix(spec): refuse a diverging retention + ttl + archive lifecycle triple at parse time #10643's squash for card finding(objectql): with retention + ttl + archive all declared, only the ttl cutoff bounds the hot store #10527; its object.zod.ts diff wrote the whole :1005-1016 paragraph and the refine beneath it.
• b37231883 for spec(ui): UserActionsConfigSchema adopts group / hideFields / rowColor — the three toolbar affordances ListView honours but no spec-valid document can declare (ruled A on objectui#5435) #11195 (:1791): PR spec(ui): UserActionsConfigSchema adopts group / hideFields / rowColor (ruled A on objectui#5435) #11458's squash for card spec(ui): UserActionsConfigSchema adopts group / hideFields / rowColor — the three toolbar affordances ListView honours but no spec-valid document can declare (ruled A on objectui#5435) #11195, UserActionsConfigSchema adopts group / hideFields / rowColor; its object.zod.ts diff wrote the the last three adopted at #11195 clause, so adopted by commit b37231883 names the three keys' adopting commit exactly.
• f11fc61c5 for spec: editMode is read off the object document by objectui's runtime but the strict parse rejects it — declare or rule out #11408 (:2189): PR feat(spec): declare editMode?: 'modal' | 'page' on the object document #12208's squash for card spec: editMode is read off the object document by objectui's runtime but the strict parse rejects it — declare or rule out #11408, message Maintainer ruling 2026-08-24 (declare - #10144 declare-or-rule-out family), declares editMode; its diff wrote :2189. spec: the object document's client-facing type is spec's to own — declare (or explicitly rule out) titleFormat, list_views/listViews, icon, which shipped objectui runtime reads today #10144 stays and answers 200.
• fc9ba76a5 for sharing: publicSharing.eligibility is evaluated only at mint — a link keeps serving a record after it stops being eligible #13608 (:2317, :2354, :2366): the message names no number, the diff does, 20 lines: its changeset heads hold publicSharing.eligibility at redemption, not only at mint (#13608), and its object.zod.ts diff wrote :2354 (holds it at BOTH points in a link's life (#13608):) and :2366 (shipped before #13608.) verbatim. It is the commit that introduced the redemption-time hold, so shipped before commit fc9ba76a5 names the right boundary; :2317 (written under [Decision] What does turning publicSharing.enabled off mean for an ALREADY-MINTED share link? — the parent switch is mint-only while its own child predicate is now a standing policy #14033, which stays and answers 200) points at that block. The same anchor stage 1 gave contracts/share-link-service.ts.
• 9dac1ae01 for $exists still reads KEY-PRESENCE rather than has-value on driver-memory's live mingo path and driver-mongodb — the #5499 freeze that excused it dissolved, #13166 explicitly excludes it, so it is now unexcused AND untracked #13195 (filter-logic-conformance.ts:190, :250, :525): PR fix(drivers): $exists means HAS A VALUE on the live mingo path, the analytics face and translateFilter #13529's squash (subject ends (#13529)), message invert the two #13195 pins in place onto the ruled answer, changeset heads (#13195) and says the maintainer ruled on 2026-08-30 that all three align. They now do, naming the live mingo path, the analytics face and translateFilter, the last three key-presence exits the lines describe. since commit 9dac1ae01 ... moved is true of it.
• c459da6bc for Narrow the per-option default key OUT of the form-view options vocabulary — the object-field face keeps it (enforced, #7246), the form-view face parses-and-ignores it (ruled on objectui#6263) #12868 (object.form.ts:256): the message names no number, the diff does, 8 lines: its changeset heads narrow the per-option default key OUT of the form-view options vocabulary ... (#12868), maintainer ruling 2026-08-28, and says the key parsed clean and nothing read it, which is the offer-vs-door class the sentence names. The line itself was written by e808890958's diff (that commit's message names neither Narrow the per-option default key OUT of the form-view options vocabulary — the object-field face keeps it (enforced, #7246), the form-view face parses-and-ignores it (ruled on objectui#6263) #12868 nor Field designer form still offers 'Set null' for a master_detail's deleteBehavior — a choice #9689 makes a publish-time rejection #11410; the PR body's names #12868 is true of its diff, wording only). Field designer form still offers 'Set null' for a master_detail's deleteBehavior — a choice #9689 makes a publish-time rejection #11410 stays and answers 200.

(e) Form C: right. Every rewrite leads with the commit (commit 9-hex, or [commit 9-hex] where the marker form stood), keeps or states in words what it decided, and adds no tracker number. PR #13529 stands on three added lines, in parentheses after commit 9dac1ae01, and on the three removed lines of the same hunks: that is a PR number as the convenience link beside the citation, which ruling C allows by name, and it is the squash PR of that very commit (200 as a pull). No other PR #N is on an added line. The :249-250 reflow moves PR #13529 one line down inside one hunk so that the commit leads; :249 held no dead number and is comment text within the +4/-4 balance. Nothing author-shown is touched (no .describe(), refusal or migration-entry text), so form D does not arise. The citation gate defers packages/**/*.test.ts; no test file is touched, so all three files are in its judging population.

(f) Projection: right. No page under content/docs/references/ at origin/main holds any of the nine numbers or any removed docblock fragment (holds it at BOTH points in a link, shipped before #13608, Declared here by the #11408, the last three key-presence exits, the onlyWhen union heading), so no generated page had to move, and Type Check · source gates (the spec check:generated family, check:docs included) is success at the read.

② Semver level

patch for @objectstack/spec is right and Clause-②: no is right. The package ships bytes from this diff: files[] carries dist and src/**/*.zod.ts, so object.zod.ts ships verbatim with its rewritten comments, and the filter-logic-conformance.ts docblocks reach dist through the bundle. (b) shows no export, key, value or type moves, so nothing widens or narrows: WHICH LEVEL (pr-automation.yml, the 2026-09-04 ruling on #15294) keeps a change that moves no public surface at patch, the level stages 1 (21ab410417), 2 (5cf58eb164) and 3 (03b19d9cfd) took for the same act. The changeset names one package, carries no tracker number and no model identifier, and Check Changeset is success at the read. Clause-②: no is on the PR body's second line.

③ Boundary flags

Blocking: none.

Dev deviations, each answered:

1. One merge of origin/main (53c9070dfd, at 288611e3e5): the net diff against the merge base is the 4 files and GitHub's file list agrees; the two commits main has since gained touch nothing under data/. Right.
2. filter-logic-conformance.ts:249-250 reflow: verified in (e).
3. The over-broad first test run, terminated by the dev (exit 143, NOT MEASURED) and replaced by two narrow runs: a dev-side incident, not a verdict; the head's Test Core shards are the verdict and are read under CI below.
4. The throwaway .tmp-ignored.mjs: not in the diff (4 files).
5. check:generated run though not derived: harmless; the family is answered by Type Check · source gates.
6. Commit trailers: all three commits carry Claude-Session plus Co-authored-by: Claude, no model identifier.
7. Three commits (two plus the merge), no force-push: the PR reports 3 commits.
8. Worktree cleanup: not observable from here, not this diff's.
   Open questions: the report lists none. Out-of-scope findings: filter-subtree-provenance.ts (3 dead docblock sites, freed by PR feat(spec,cli)!: one stack authoring shape — os validate / os build refuse a default export defineStack did not build #20460's landing) and the migration-entry text carrying A controlled_by_parent object may declare its master reference without required, so the master-access guard is the only thing preventing an unreachable orphan detail row #8772 and Narrow the per-option default key OUT of the form-view options vocabulary — the object-field face keeps it (enforced, #7246), the form-view face parses-and-ignores it (ruled on objectui#6263) #12868 (migrations/entries/semantic/18.cbp-master-detail-required-forced.ts, the generated migrations/registry.ts, conversions/registry.ts:8803): carriers named (a later stage of packages/spec/src: 1,277 comment lines still cite 170 deleted tracker numbers (1,295 sites) — the staged remainder of ruling C+D on #19123, measured by PR #20226 #20234; os migrate meta prints tracker numbers to the author: ADR-0087 migration entries' reason / replacement / acceptanceCriteria text carries ~2,060 of them, 178 dead, which AGENTS.md's runtime-string rule forbids #20233 for form D), not this diff's; right.

Non-blocking: (1) Rung: two of the anchored changes also have ADR-0087 entries in packages/spec/src/migrations (cbp-master-detail-required-forced for #8772, form-view-option-default-removed for #12868, the latter's header naming c459da6bc); this PR takes the commit rung exactly as stages 1 to 3 did, precedent-consistent, and the D3 id is the more durable in-repo record if the ruling's first rung is later read to include those entries. (2) The docs-drift comment 5882252546 lists 5 hand-written pages via ObjectSchemaBase, userActions and publicSharing: a symbol-anchored advisory on a comment-only diff; Flag docs affected by code changes is success; its note that the runner's checkout carried uncommitted changes is about the bot's own checkout. (3) PR body wording: Commit e808890958 ... names #12868 is true of that commit's diff, not its message.

Escalated: none.

CI at this head, the judging read at 2026-09-29T02:15:17Z: 33 check-runs, 23 success, 3 skipped (Build Docs, Console Pin Gate, Packed-tarball smoke (opt-in)), 0 failure, 7 not concluded: Lint & Repo Gates, Type Check · workspace, Test Core (1/6), (3/6), (4/6), (5/6) and (6/6) were in progress, and the Test Core and TypeScript Type Check aggregates had not yet been created. So three required contexts are NOT presumed green here and must be read concluded before the PR is armed: Lint & Repo Gates (the repo check:* steps, pnpm lint, the diff-scoped citation pass and check:doc-authoring), TypeScript Type Check (its workspace lane) and Test Core. Success at the read: Build Core, Dogfood Regression Gate and its three shards, Temporal Conformance (live PG + MySQL), Governed Surface Queue Guard, Type Check · source gates, Type Check · debt ledger, Type Check · consumer gates, Test Core (2/6), Spec property liveness, Check Changeset, Check PR Size, Dogfood Verify CLI, the three claim and closing guards and the labelers. No red run exists to attribute. Of the 79 families the dev derived, the head's runs answer the changeset family (Check Changeset), the generated-artifact family (Type Check · source gates), build, dogfood, temporal, liveness, the governed-surface guard, the debt and consumer typecheck lanes and one Test Core shard; the citation pass, doc-authoring, lint and the other repo check:* steps (Lint & Repo Gates), the workspace typecheck and five Test Core shards are the ones still open. PR is a draft, mergeable_state blocked (draft), first line Part of #20234, no closing keyword.

Implemented-by: claude/issue-20234-dead-citations-data-rest
Reviewed-by: session_014EJ1ED8X4MMrT18BhVx4tx

VERDICT: PASS

---

Generated by Claude Code