docs(spec): re-anchor the dead tracker citations in the packages/spec/src remainder to the commits and ADRs that decided them (stage 6)

[objectstack-fleet]

Part of #20234
Clause-②: no

Stage 6 of the staged sweep: the packages/spec/src remainder outside migrations/ and the held files. Its claim is 5884233505, with 22 files named there. Every comment or docblock line in those files that cited a tracker number answering 404 now cites what decided its rule, in ruling C+D's form C. That is the commit on main that decided the rule, or, for one number, the ADR amendment that records the ruling. Each line says in its own words what was decided. Comments only: 66 lines out, 66 in, across 21 files. No code token, string literal, describe() text or message-catalog string moves. Two dead sites stay byte-identical, because a test reads each one by literal.

The census is the gate's own node scripts/check-issue-citations.mjs --census --json, filtered to the 22 paths. Before: base c876a7426d, board enumerated (185 pages, frontier #20590). After: head 9d63cb6548, frontier #20604.

Measurement

file (under packages/spec/src/)	dead before	after	numbers, then anchor
api/rest-server.zod.ts	11	0	#14691 ×9 to b3a63d32c; #14369 ×2 to a3d5724c8
system/i18n-resolver.ts	14	0	#12961 ×6 to 901355c3b; #13218 ×4 to c45d8e6b4; #8460 ×2 to ADR-0029 D9.2a; #10926 to d173125fb; #13109 to 8b236c826
system/operation-message.ts	4	0	#12493 ×4 to aa5994e17 (docblock lines only)
system/translation.zod.ts	2	0	#10926 ×2 to d173125fb
system/core-services.zod.ts	1	0	#6604 to d127ff002
system/dev-login.zod.ts	1	0	#17081 to 24d622b94 (#17556 stays, 200)
system/environment-artifact.zod.ts	1	0	#11333 to e58ea8b38 (#14865 and #13457 stay, 200)
shared/identifiers.zod.ts	7	0	#12245 ×2 to c41b42e8d; #12144 ×2 to 3a04b0125; #12194 and #12176 (:140-141) to 311433f6b; #12176 (:189) to 7986d973f
shared/metadata-collection.zod.ts	1	0	#10485 to 35ad101bc
index.ts (package root)	6	0	#11350 ×5 to ece4dad31 (#11709 stays, 200); #10485 to 35ad101bc
automation/control-flow.zod.ts	1	0	#14419 to c5a7448d5 (#14954 stays, 200)
automation/execution.zod.ts	1	0	#13681 to 18d816a50
automation/index.ts	1	0	#16659 to ecdfc9411
automation/schedule-organization.zod.ts	1	0	#16659 to ecdfc9411
ai/index.ts	1	0	#11350 to ece4dad31
identity/identity.zod.ts	1	1	#8715 kept at :230 (a test reads it); 2c86fe3ea added on :231
security/explain.zod.ts	1	0	#8714 to 42b05af89
security/public-form.ts	1	0	#6640 to 2ab1257c9
data/api-derivation.ts	1	1	#6259 kept at :163 (two tests read it); 6968885ef already on :164; file untouched
data/driver/turso.zod.ts	2	0	#6345 ×2 to e2798fab7
conversions/walk.ts	1	0	#13031 to b799ac553
meta-spelling/metadata-url-spelling.ts	2	0	#10485 ×2 to 35ad101bc
22 files	62	2	26 numbers, 24 removed: 24 distinct shas and 1 ADR

Per-file counts at base equal the claim's (census 5884031174 at f11b5f20a2) in all 22 files. A second instrument agrees site for site: every #N in the 22 files, classified by the TypeScript parser, and each of 201 distinct numbers probed by REST issues/N without redirects. It found 484 sites, all in comments and none in a string, 26 dead numbers and 62 dead sites. Its string-class positive control found 19 string sites in api/rest-server.test.ts. Head: 424 sites and 177 numbers, 175 answer 200 (the same 175), and 2 answer 404 (the two kept sites). Lit controls #16862, #16847 and #17698 answered 200 at every checkpoint (4 at base, 3 at head); dead controls #16714, #16715 and #16697 answered 404 at every checkpoint.

Why each anchor decides its line

Each sha resolves uniquely, is an ancestor of origin/main (and of the base), has one parent, and names the number it replaces in its own message or diff. Each was read for the rule its line states.

• Enforce-or-remove the 15 RestServerConfig rows the liveness ledger now records as dead (#14369's verdicts) — routes.*, crud.patterns, crud.objectParamStyle, metadata.cacheTtl, metadata.endpoints.schema, batch.defaultAtomic, batch.operations.upsertMany #14691 to b3a63d32c: the retirement of the ten inert RestServerConfig keys under ADR-0049 enforce-or-remove. Its own rest-server.zod.ts diff wrote all nine #14691 lines: the tombstones, the dropped CrudEndpointPatternSchema and the routes block.
• [finding] Ten declared RestServerConfig keys are normalized by RestServer and read by nothing — routes.* entirely, crud.patterns / objectParamStyle, metadata.cacheTtl / endpoints.schema, batch.defaultAtomic / operations.upsertMany (ADR-0049 enforce-or-remove candidates) #14369 to a3d5724c8: seeded the four RestServerConfig liveness ledgers "from the census filed with [finding] Ten declared RestServerConfig keys are normalized by RestServer and read by nothing — routes.* entirely, crud.patterns / objectParamStyle, metadata.cacheTtl / endpoints.schema, batch.defaultAtomic / operations.upsertMany (ADR-0049 enforce-or-remove candidates) #14369" (its changeset heading names the number). It records both facts the two lines state: every CRUD route is mounted from hard-coded method/path pairs, and routes is parsed, defaulted and normalized, then never read.
• translatePage stops at region-level components, so copy on components nested in another component's properties.children is authorable but never resolved — 4 KPI labels stay English on hotCRM's zh-CN landing page #12961 to 901355c3b: "Ruled 2026-08-29 (option A)". translatePage descends into declared properties.children; on an id collision a region-level component wins outright, and among nested matches document order decides. Its diff wrote the #12961 lines being replaced.
• [finding] translatePage's addressed-component walk is not exported, so the CLI extractor hand-mirrors its depth cap, cycle guard and collision arbitration — the copy hazard the key list closed, left open for the walk #13218 to c45d8e6b4: exports walkAddressedPageComponents and consumes it from both sides; its changeset reads "([finding] translatePage's addressed-component walk is not exported, so the CLI extractor hand-mirrors its depth cap, cycle guard and collision arbitration — the copy hazard the key list closed, left open for the walk #13218, ruled 2026-08-30)".
• i18n-extract's per-component pass is still region-level only, so the nested-children keys translatePage now resolves are never scaffolded into the skeleton bundle #13109 to 8b236c826: its changeset says the extractor OMITTED keys the resolver reads, and "This matches the second half". The line now says the second half went live and this commit repaired it.
• A package extension's scalar overwrites a tenant's Studio rename inside the object fold, so the rename still reaches no read #8460 to ADR-0029 D9.2a: ruling C's first rung. The amendment "D9.2a — AMENDMENT (2026-08-13)" records the option-A ruling: an extender's scalar applies only while the fold's base still carries the packaged owner's value. It also records that the mechanism is deliberately the same comparison-based one the catalog uses one layer up. The heading marker [#8460] becomes [ADR-0029 D9.2a].
• i18n: component-translation submitLabel copy key lost its only declared carrier when element:form retired (#9249) — decide retire vs re-anchor #10926 to d173125fb: "Option A per the maintainer ruling on i18n: component-translation submitLabel copy key lost its only declared carrier when element:form retired (#9249) — decide retire vs re-anchor #10926 (2026-08-22): drop the key", the submitLabel retirement all three lines describe.
• Operation Message Catalog: add refusal-situation keys for approvals recall and sharing write-denial — two measured hardcoded-English refusals waiting on the one sanctioned mechanism #12493 to aa5994e17: adds record_write_denied and approval_recall_not_submitter ahead of their emitters, with no placeholders. Its diff wrote the four docblock lines. The catalog's rendered strings are untouched, per hypothesis 5.
• ServiceStatus 在 ./api 与 ./system 各有一个不同声明,#4593 的别名补齐卡在这个名字上 #6604 to d127ff002: "Per the maintainer's 2026-08-08 Option-B ruling the kernel side takes the domain-specific name", matching KernelServiceMapSchema.
• The boot banner's "🔑 Dev admin" is the only credential a first-run operator is given, and in any audience-gated app it is the account that sees nothing #17081 to 24d622b94: lands Let an app contribute its own first-run credentials to the boot banner (devHint / devLogins[]) — the platform cannot know which of an app's audiences shows something, and only the app can #17556 as "Suggestion 1 of The boot banner's "🔑 Dev admin" is the only credential a first-run operator is given, and in any audience-gated app it is the account that sees nothing #17081". The line keeps Let an app contribute its own first-run credentials to the boot banner (devHint / devLogins[]) — the platform cannot know which of an app's audiences shows something, and only the app can #17556 and names the parent card in words.
• manifest.permissions is live on its LEGACY string[] arm only — the structured PluginPermissionsSchema (services / hooks / network / fs) has zero readers, and new code is told to prefer it #11333 to e58ea8b38: declares grantedPermissions, described by the commit itself as "the artifact-contract half of manifest.permissions is live on its LEGACY string[] arm only — the structured PluginPermissionsSchema (services / hooks / network / fs) has zero readers, and new code is told to prefer it #11333 option A / the Phase 1 of #11333: wire granted_permissions into PluginPermissionEnforcer (F4) as the load-time gate #13457 batch ruling". The line keeps spec: declare grantedPermissions on EnvironmentArtifactSchema (record of manifest id → PluginPermissions) — the artifact-contract half of #14034 / #11333 Phase 1, which must land BEFORE cloud can write it (plain z.object strips undeclared keys at the artifact door) #14865 and Phase 1 of #11333: wire granted_permissions into PluginPermissionEnforcer (F4) as the load-time gate #13457 and states the ruled option in words.
• SystemIdentifierSchema/EventNameSchema admit the empty-segment dot shapes the item-name grammar refuses (a., a..b, trailing dots) #12245 to c41b42e8d: rewrote this docblock from "the per-surface census (its os-dev-report comment, measured on origin/main @ e2debee)" and carries the 1218-values measurement. The report comment lived on the deleted card, so the commit is now the record, and the line says so.
• The shared identifier schemas declare no maximum length, so every cap on an identifier is a storage accident rather than a contract #12144 to 3a04b0125: wrote the storage-owned length-ceiling note and its storage-column pin; its changeset heads "(The shared identifier schemas declare no maximum length, so every cap on an identifier is a storage accident rather than a contract #12144)".
• D1: declare the metadata item-name grammar in spec and refuse it loudly at the publish door — dotted qualified form becomes enforced (#12176 stage 1) #12194 / Ban / in metadata item names — retire compound-name addressing (maintainer-ruled direction): census, migration surface, staged plan #12176 to 311433f6b (:140-141): stage 1, the item-name grammar declared and refused at the publish door; its message reads "Stage 1 of Ban / in metadata item names — retire compound-name addressing (maintainer-ruled direction): census, migration surface, staged plan #12176". Ban / in metadata item names — retire compound-name addressing (maintainer-ruled direction): census, migration surface, staged plan #12176 to 7986d973f (:189): "Retire compound-name metadata addressing", stage 3 of the maintainer-ruled retirement.
• defineStack({ themes }) is parsed, ingested and never applied — the last hop from a stored theme item to the theme engine does not exist #10485 to 35ad101bc: retires the themes carrier, ThemeSchema and the PLURAL_TO_SINGULAR fold ("Ruled B"). Its own diff wrote all four lines.
• @objectstack/spec's root entry does not re-export three types its own public API's inferred types mention — every consumer inferring through defineStack hits TS2883 #11350 to ece4dad31: "Invariant recorded (maintainer ruling 2026-08-23)". It also points the premise-delta note at @objectstack/spec root entry: two MORE structurally-mentioned types are unnameable through the CHUNKED build (BaseValidationRuleShape, FilterCondition) — a minimal defineStack consumer still hits TS2883 #11709, which is what index.ts:148 now says. This is stage 1's wording for kernel/index.ts:53.
• automation: create_record collapses the engine's DUPLICATE_RECORD envelope to a string, so a flow's try_catch / fault edge still cannot tell "already there" from "the store is down" #14419 to c5a7448d5: create_record surfaces the engine's DUPLICATE_RECORD code and the engine binds it on $error, the founding case the line names. Its message names automation: create_record collapses the engine's DUPLICATE_RECORD envelope to a string, so a flow's try_catch / fault edge still cannot tell "already there" from "the store is down" #14419 as the card it lands.
• A loop node aborts the entire flow run when one iteration's node fails — a single bad row kills a whole scheduled sweep, and there is no per-iteration containment to opt into #13681 to 18d816a50: declares the run-level FlowRunSummary.failed, the spec half of the contained-failure contract.
• A schedule-triggered flow's notify delivers nothing on a multi-organization install: the run carries no organization, so the tenant-scoped inbox/delivery writes are refused (#8844) while the run reads healthy #16659 to ecdfc9411: declares the start-node config.organization key and "the one refusal sentence every enforcement point says". Its sub-commits pin "the three A schedule-triggered flow's notify delivers nothing on a multi-organization install: the run carries no organization, so the tenant-scoped inbox/delivery writes are refused (#8844) while the run reads healthy #16659 consequences", so it is also the commit that closed the defect the second line describes.
• The explain engine has no contributor state for a DEACTIVATED permission set — it just vanishes, where an expired grant says "held until … — expired" #8714 to 42b05af89: "ONE closed contributor-state enumeration", maintainer-ruled 2026-08-18.
• [观察] stripReadonlyForInsert 完全不读 preserveAudit —— readonly 的历史导入豁免在 INSERT 侧是 declared ≠ enforced #6640 to 2ab1257c9: preserveAudit is UPDATE-only (stage 1's anchor for the same rule).
• cli/runtime: explicit driver(--database-driver / OS_DATABASE_DRIVER)在 CLI 与 standalone stack 之间仍有三处分叉(#6265 后续) #6345 to e2798fab7: its own turso.zod.ts diff wrote both lines ("The maintainer's cli/runtime: explicit driver(--database-driver / OS_DATABASE_DRIVER)在 CLI 与 standalone stack 之间仍有三处分叉(#6265 后续) #6345 ruling closes it…", "(cli/runtime: explicit driver(--database-driver / OS_DATABASE_DRIVER)在 CLI 与 standalone stack 之间仍有三处分叉(#6265 后续) #6345 fork 2)"). The wording is stage 3's in config-registry.zod.ts.
• Every view-family conversion walks only the container spellings — a stored ViewItem record (viewKind/config) or flattened overlay escapes applyConversionsToStoredItem('view', ...) entirely #13031 to b799ac553: adds mapViewPayloads to walk.ts, the centralized walk the heading describes. Its message names Every view-family conversion walks only the container spellings — a stored ViewItem record (viewKind/config) or flattened overlay escapes applyConversionsToStoredItem('view', ...) entirely #13031 as the card it lands.
• [finding] The ApiKey reference table documents better-auth's apiKey-plugin schema — a plugin this platform does not load and a shape sys_api_key does not have #8715, kept: 2c86fe3ea ("Maintainer ruling 2026-08-15 (disposition B: delete)"; its diff wrote :230) now sits on :231.

Mechanical proof

• Token guard (my tokcmp.mjs: TypeScript 6.0.3 leaf tokens, JSDoc kinds excluded, controls mutate the head text in memory only). Base c876a7426d against the head, 21 files, 37,539 base tokens:
  • Real run: 0 files with a token change (exit 0).
  • Comment-insertion control (ai/index.ts): 0 (exit 0).
  • Code-insertion positive control (system/i18n-resolver.ts): DIFFER at token 14452 (exit 1).
  • String positive control (a real StringLiteral in system/operation-message.ts, found by the parser): DIFFER at token 5 (exit 1).
  • The first string-control attempt matched a quoted fragment inside a comment and did not fire. It was a vacuous control, not a measurement, and the parser-located control above replaced it.
• Line balance: every file is +N/−N (66/66 across 21 files); every line count is equal at base and head.
• Tracker numbers: added-not-removed is empty in every file, and no PR #N is on an added line. Net-removed: 60 sites, 24 numbers.
• Shas: 24 distinct on added lines, 0 on removed lines.
  • rev-parse --disambiguate answers 1 object for each.
  • merge-base --is-ancestor exits 0 against origin/main e666636fd9 and against the base.
  • Each is single-parent; the repository is not shallow; the control leg e9584681a4 exits 0.
  • Each commit's own message (17 of 24) or diff (all 24) names the number it replaces.
• Literal readers: every string literal in the repository that carries one of the 26 numbers was matched against the 22 files' text. Three hits read these files:
  • data/api-derivation.test.ts:236 splits on [#6259];
  • packages/runtime/src/api-exposure.test.ts:152 splits on #6259;
  • identity/api-key-retirement.test.ts:118 asserts are NOT declared here (#8715.
  • Those lines are the two kept sites. No test or script matches any rewritten line by pattern.

Tests and gates (at head 9d63cb6548)

• pnpm exec turbo run build --concurrency=2 --filter=./packages/* --filter=./packages/*/* under os-verify-lock: Tasks 71 successful, 71 total, VERDICT command-exit 0.
• pnpm --filter @objectstack/spec check:generated: exit 1, check:docs stale (1 of 15). check:generated --fix then regenerated exactly that artifact: 2 pages, 3 lines, each its docblock line verbatim.
  • content/docs/references/automation/schedule-organization.mdx
  • content/docs/references/data/driver-turso.mdx
  • The re-check in the gate run below is exit 0.
• vitest run --maxWorkers=2 over the touched areas (src/api/rest-server.test.ts, src/api/rest-api-config-dead-keys-retirement.test.ts, src/system, src/shared, src/automation, src/ai, src/identity, src/security, src/data/driver, src/conversions, src/meta-spelling): Test Files 159 passed (159), Tests 5163 passed (5163).
• The 23 spec suites outside those areas that read a touched file's source text or name it: Test Files 23 passed (23), Tests 540 passed (540).
  • scripts/{tombstoned-row-status,strictness-ledger,file-description,skill-map-guards,root-index,export-origins,category-title,split-entries,dist-freshness,dist-freshness-adoption,root-entry-type-nameability.pin} tests;
  • src/type-alias-convention.pin, src/contracts/{automation-result-status.pin,automation-service,scoped-context}, src/api/{export-job-family-retirement,api-entry-graph.pin}, src/eager-entry-import, src/integration/connector-author-shape, src/ui/{interaction-config-retirement,notification,strictness-batch14}, src/migrations/migrations.
  • scripts/build-schemas-check-mode.test.ts is left to CI: it imports rather than reads, and rebuilds schemas in a temp tree.
• pnpm --filter @objectstack/spec typecheck: exit 0; check:test-typecheck OK (53 files / 251 errors / 138 pinned signatures held).
• Lint, a proven narrowing: eslint --no-inline-config --format json over the 21 touched .ts files gives 21 files, 0 errors, 0 warnings.
  • isPathIgnored is false for all 21, read through eslint's API.
  • eslint.config.mjs:327-328 says type-aware linting is never enabled, so a comment edit cannot move an untouched file's verdict.
  • The repo-wide pnpm lint is CI's.
• node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands: 108 families derived and run, every one exit 0. --ran reads "108 derived, 108 run, 0 NOT-MEASURED, 0 UNRUN". Among them:
  • pnpm check:issue-citations plus the live diff-scoped node scripts/check-issue-citations.mjs judged 7 citations across 21 files, 7 resolve: the live numbers kept beside the anchors (ADR-0049 candidate: element:form declares a full form contract with no renderer registration found in objectstack/objectui #9249, spec: TryCatchErrorValueSchema silently strips the code key the engine now binds — the declared "ONE shape" and the runtime shape have diverged (#14419 follow-up) #14954, Let an app contribute its own first-run credentials to the boot banner (devHint / devLogins[]) — the platform cannot know which of an app's audiences shows something, and only the app can #17556, spec: declare grantedPermissions on EnvironmentArtifactSchema (record of manifest id → PluginPermissions) — the artifact-contract half of #14034 / #11333 Phase 1, which must land BEFORE cloud can write it (plain z.object strips undeclared keys at the artifact door) #14865, Phase 1 of #11333: wire granted_permissions into PluginPermissionEnforcer (F4) as the load-time gate #13457, and @objectstack/spec root entry: two MORE structurally-mentioned types are unnameable through the CHUNKED build (BaseValidationRuleShape, FilterCondition) — a minimal defineStack consumer still hits TS2883 #11709 twice).
  • pnpm check:doc-authoring: 16,765 customer-facing strings across 1,175 spec sources clean; the sibling baseline holds.
• Changeset: patch for @objectstack/spec. 13 of the 21 touched sources are src/**/*.zod.ts, which files[] ships verbatim, and the rewritten docblocks reach dist. For example, ruled collision arbitration (commit 901355c3b) is in 1 .d.ts, and the unchanged neighbouring sentence in the same exported docblock (the positive control) is in 1 .d.ts.
• Merge probe: a no-driver merge-tree of the head onto origin/main 7a1faf1a5d, from a bare shared clone, exits 0. The 3 commits main gained since the base touch none of this diff's files. No merge was made, as stages 1–4 did.
• No ablation or reverse verification: the change is comment-only, so there is no behaviour to invert.

Hypotheses (measured first)

1. Holds. The population is exactly the claim's 22 files: 62 dead sites at the tip, equal per file to the census at f11b5f20a2.
2. Holds, with nothing to respell. No sibling-qualified pair occurs among the 62 sites; no pre-#N spelling is dead here.
3. Holds. Re-read at 2026-09-29T06:23Z, after the last push and before this PR was opened: all 14 open PRs' full file lists (1,116 files in the version PR alone), and the newest Claim: on all 15 pm:dispatched cards. None names any of this PR's 24 paths. The five exclusions stay excluded.
4. Holds. The two projected pages were regenerated by the generator, never by hand. No other page under content/docs/references/ carries any of the 26 numbers.
5. Holds. No #N in the 22 files is inside a string; the two literal-read sites stay as tokens. In system/i18n-resolver.ts and system/operation-message.ts only docblock and line-comment lines moved.

Deviations

• The file surface is 21 of the 22 named files. data/api-derivation.ts is untouched, because its one dead site is read by literal and its commit already stands on the next line (stage 3's disposition).
• Six changed lines held no dead number. Each is the other half of a rewritten sentence: rest-server.zod.ts:756, identifiers.zod.ts:19, index.ts:133, environment-artifact.zod.ts:137, schedule-organization.zod.ts:82, and identity.zod.ts:231 (the commit placed beside the kept :230).
• Commit trailers follow AGENTS.md's model-free pair (Claude-Session plus Co-authored-by: Claude); the pre-push trailer check passed on every push.

Acceptance notes

What stays for later stages. At the tip 7a1faf1a5d with this PR applied, packages/spec/src holds 260 dead sites (34 numbers). This is the gate's census on this head, with the four spec sources main changed since the base re-extracted and re-probed at the tip. By area:

• migrations/ 233: os migrate meta prints tracker numbers to the author: ADR-0087 migration entries' reason / replacement / acceptanceCriteria text carries ~2,060 of them, 178 dead, which AGENTS.md's runtime-string rule forbids #20233 edits the same entry files; the author-shown fields are its form D.
• conversions/registry.ts 12: held by PRs feat(spec)!: $empty joins FILTER_OPERATORS, and is_empty / is_not_empty lower to it (#20446) #20570 and feat(spec)!: retire the inner name on cube measures and dimensions — the record key is the member's name (#20300) #20458.
• stack.zod.ts 9: free now; PR fix(spec,cli): os validate / os build read the ADR-0087 conversions defineStack applied — --json conversions and --strict see the producer's record #20579 landed as 7a1faf1a5d at 06:02Z, after the claim, so it stayed excluded here.
• data/analytics.zod.ts 3: PR feat(spec)!: retire the inner name on cube measures and dimensions — the record key is the member's name (#20300) #20458.
• integration/connector.zod.ts 1: automation: connector triggers start flows, and a connector action's description / outputSchema reach the flow designer (7 keys) #20287, PR feat(spec)!: retire the connector triggers array — the ConnectorTrigger shape nothing registered, polled or received (#20287) #20587.
• data/api-derivation.ts:163 (DATA_ACTION_TO_API_OPERATION 的 batch: 'bulk' 行在 #5856 之后没有生产者了 —— spec 注释仍称其为「runtime callData action」 #6259) and identity/identity.zod.ts:230 ([finding] The ApiKey reference table documents better-auth's apiKey-plugin schema — a plugin this platform does not load and a shape sys_api_key does not have #8715), 1 each: kept because api-derivation.test.ts:236, packages/runtime/src/api-exposure.test.ts:152 and api-key-retirement.test.ts:118 read them by literal. Removing them is a test-string change, form D, outside this card's comment-only scope.

Carried from earlier stages, outside the gate's census (which blanks strings and defers test files): the dead-number test-title strings, the two why strings, the PROVENANCE_WAIVERS reason, the two AGGREGATION_CASES notes, and the liveness/** notes.

Outside packages/spec/src (#20556's lane): packages/spec/scripts/check-entry-nameability.ts cites #11350 in its header (:14) and PRINTS "recorded on #11350" in its failure text (:727); packages/spec/scripts/root-entry-type-nameability.pin.test.ts cites it too. Commit ece4dad31 is the anchor, already verified here.

Rung. Five of the anchored retirements also have ADR-0087 D3/D2 entries: identity-api-key-schema-retired, metadata-item-name-grammar-enforced, rest-server-config-dead-keys-retired, stack-themes-carrier-retired and translation-component-submit-label-retired. This PR takes the commit rung, as stages 1–5 did. The D3 id is the more durable in-repo record if the ruling's first rung is later read to include those entries.

Wording, each true of its commit.

• dev-login.zod.ts:10 names The boot banner's "🔑 Dev admin" is the only credential a first-run operator is given, and in any audience-gated app it is the account that sees nothing #17081 in words ("suggestion 1 of its parent card").
• environment-artifact.zod.ts:136-137 states manifest.permissions is live on its LEGACY string[] arm only — the structured PluginPermissionsSchema (services / hooks / network / fs) has zero readers, and new code is told to prefer it #11333's option A as "the option the Phase 1 of #11333: wire granted_permissions into PluginPermissionEnforcer (F4) as the load-time gate #13457 batch ruling chose".
• identifiers.zod.ts:18 drops "its os-dev-report comment is the measurement of record", since that comment went with the card, and names the commit as the record.

Observation, not filed (a pre-existing live citation, not a tracker number; carrier: none): environment-artifact.zod.ts:137 and packages/runtime/src/security/artifact-granted-permissions.ts:6 cite "ADR-0025 §3.5 step 2" for the granted set. At the tip, §3.5's numbered step 2 is "Compatibility" and "Permission consent" is step 3.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/spec, touching 11 documentable anchor(s). ⚠️ 14 changed file(s) yielded no anchor (packages/spec/src/ai/index.ts, packages/spec/src/automation/control-flow.zod.ts, packages/spec/src/automation/execution.zod.ts, …), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/concepts/north-star.mdx (via EnvironmentArtifactSchema (symbol, a top-level const))

⛔ 1 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17/17-3.mdx (via EnvironmentArtifactSchema (symbol, a top-level const))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 14 changed file(s) yielded no anchor (packages/spec/src/ai/index.ts, packages/spec/src/automation/control-flow.zod.ts, packages/spec/src/automation/execution.zod.ts, …) — pages documenting those are invisible to this run
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 137 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 7a1faf1a5d213cd3fb3c71320d1fb2f9f25f50d5 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 16a817c5134aa1cec03da062191bc7819599d2af — the merge of head 9d63cb65484db46a7657a435938b86222693c87e into base 7a1faf1a5d213cd3fb3c71320d1fb2f9f25f50d5, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 16a817c5134aa1cec03da062191bc7819599d2af && git checkout 16a817c5134aa1cec03da062191bc7819599d2af
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 7a1faf1a5d213cd3fb3c71320d1fb2f9f25f50d5 9d63cb65484db46a7657a435938b86222693c87e && git checkout -B drift-repro 7a1faf1a5d213cd3fb3c71320d1fb2f9f25f50d5 && git merge --no-ff 9d63cb65484db46a7657a435938b86222693c87e

node scripts/docs-audit/affected-docs.mjs --json 7a1faf1a5d213cd3fb3c71320d1fb2f9f25f50d5

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 7a1faf1a5d213cd3fb3c71320d1fb2f9f25f50d5 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 9d63cb65484db46a7657a435938b86222693c87e
Local-runs: none

Read (this act, 2026-09-29T06:51Z): card #20234 (body; every comment: triage 5856637615 and the ruling it points at, 5749154545 on #19123; the seat-2 pointer 5858331362; stages 1 to 5's claims, reports, records, ACCEPTs and landings, in particular stage 5's claim 5882723856, report 5883647445, record 5883799044 on PR #20576, ACCEPT 5883838119 and landing 5884188565; the stage-6 claim 5884233505 and the report 5884983160), PR #20606 (body, its one comment 5884956320, the 24-file list, the three commits and the net diff against the merge base c876a7426d, read from the local ref at the head above with -U0 and the base and head blobs of every changed file), the 24 cited commits (message and stat for all; their own diffs of the files they now anchor wherever the message does not name the number or the line claims more than the subject), docs/adr/0029-*.md D9.2a and docs/adr/0025-*.md section 3.5, docs/adr/**, docs/NORTH-STAR.md and scripts/adr-anchors/ for the 24 numbers, the two test readers in packages/spec and the one in packages/runtime, packages/spec/package.json files[], lint.yml's job roster, pr-automation.yml's WHICH LEVEL, scripts/check-issue-citations.mjs's declared and deferred surfaces, content/docs/references/** at the head for the removed numbers, and the state of #20556, #19124, #20233 and the four stage cards #20594 to #20597. Nothing was built, run or re-run: the diff and the anchors were read with git, the blobs compared with a comment-stripping residue scan in scratch (a read of the diff, not a gate), the numbers probed with REST GET against this repository (a GitHub read). The check-runs were read for judgment once, at 2026-09-29T06:38Z.

① Derived judgments

(a) Scope and file surface: right. 24 files: 21 .ts files, every one on the claim's 22-file surface; the two generated pages content/docs/references/automation/schedule-organization.mdx (+2/-2) and content/docs/references/data/driver-turso.mdx (+1/-1); the new .changeset/spec-remainder-provenance-anchors.md (+14). The 22nd file, data/api-derivation.ts, is untouched, and rightly: its one dead site [#6259] at :163 is read by literal (judged in (e)) and commit 6968885ef already stands on :164 from stage 3. The five exclusions (conversions/registry.ts, data/analytics.zod.ts, stack.zod.ts, integration/connector.zod.ts, migrations/**) are absent from the diff. No governed surface is touched. origin/main (7a1faf1a5d) is three commits past the merge base and the set of files those three move is disjoint from the 24 (intersection empty), so the net diff against current main is the diff judged here; GitHub reads mergeable: true, mergeable_state: blocked (draft). Head repository is the base repository; first line Part of #20234, no closing keyword; Clause-②: no on the body's second line; draft; assignee os-tesla; no auto-merge armed; no reviews. 152 changed lines.

(b) Comment-only, no code token, string, test title or catalog string moves: right. git diff -U0 over the 21 .ts files: 66 lines added, 66 removed, every one of the 132 begins with //, * or /**. Enclosure and residue, read on the base and head blobs with a string-, template- and regex-aware comment stripper: every changed line falls inside a comment in both blobs, and the non-comment residue of each file is byte-identical base to head, 21 of 21, with every line count equal. Controls, mutated in memory only: a code insertion into i18n-resolver.ts and a string-literal edit in operation-message.ts (its ./i18n-resolver import specifier) each make the residue differ; a comment insertion does not. So in system/i18n-resolver.ts and system/operation-message.ts, the two files carrying author- and user-shown strings, no message-catalog string, .describe() text, exported string or code token moved, only docblock and line-comment bytes. No test file is in the diff, so no it/describe title is touched. The six changed lines that held no dead number (rest-server.zod.ts:756, identifiers.zod.ts:19, index.ts:133, environment-artifact.zod.ts:137, schedule-organization.zod.ts:82, identity.zod.ts:231) are each the other half of a rewritten sentence, inside the 66-for-66 balance. The dev's parser-level token comparison is not re-run and not needed for that verdict.

(c) Numbers: right. Over the 21 .ts files, added-minus-removed tracker numbers is empty for every file; net-removed is exactly 24 numbers on 60 sites: #6345 x2, #6604, #6640, #8460 x2, #8714, #10485 x4, #10926 x3, #11333, #11350 x6, #12144 x2, #12176 x2, #12194, #12245 x2, #12493 x4, #12961 x6, #13031, #13109, #13218 x4, #13681, #14369 x2, #14419, #14691 x9, #16659 x2, #17081. Per file that is the claim's census in all 22 files (60 rewritten plus the 2 kept equals the claim's 62). No PR #N stands on any added line. The two mdx pages lose #16659 and #6345 and gain no number. REST issues/N without redirects, read at 2026-09-29T06:41Z: all 24 removed numbers answer 404; the six numbers standing on added lines answer 200 (#9249, #11709, #13457, #14865, #14954, #17556); lit controls #16862, #16847, #17698 answer 200 and dead controls #16714, #16715, #16697 answer 404, re-read after the run (#16862 200, #16714 404). The dev's census over 201 numbers is otherwise not re-run.

(d) Anchor truth: right, 24 of 24. 24 distinct 9-hex shas stand on added lines and none on removed lines. git rev-parse --disambiguate answers exactly one object for each; git merge-base --is-ancestor exits 0 for all 24 against origin/main 7a1faf1a5d; every one is a single-parent commit; the repository is not shallow. Seventeen name the replaced number in their own message; the seven that do not are tied by their own diff or changeset, and every anchor was read against the sentence it now supports:

• b3a63d32c for Enforce-or-remove the 15 RestServerConfig rows the liveness ledger now records as dead (#14369's verdicts) — routes.*, crud.patterns, crud.objectParamStyle, metadata.cacheTtl, metadata.endpoints.schema, batch.defaultAtomic, batch.operations.upsertMany #14691 (nine sites in rest-server.zod.ts): the ADR-0049 retirement of the ten inert RestServerConfig keys, dropping CrudEndpointPatternSchema and tombstoning routes.*; its own rest-server.zod.ts diff wrote all nine #14691 lines. The tombstone markers, the removed def and the routes selectors sentence at :756-757 are each that act. True.
• a3d5724c8 for [finding] Ten declared RestServerConfig keys are normalized by RestServer and read by nothing — routes.* entirely, crud.patterns / objectParamStyle, metadata.cacheTtl / endpoints.schema, batch.defaultAtomic / operations.upsertMany (ADR-0049 enforce-or-remove candidates) #14369 (:332, :653): seeded the four RestServerConfig liveness ledgers; its changeset heading and every ledger row carry (#14369), and its ledger notes record exactly the two facts the lines state ("every CRUD route is mounted from the hard-coded method/path pairs", the patterns/routes containers "normalized ... and never read"). True.
• 901355c3b for translatePage stops at region-level components, so copy on components nested in another component's properties.children is authorable but never resolved — 4 KPI labels stay English on hotCRM's zh-CN landing page #12961 (six sites in i18n-resolver.ts): "Ruled 2026-08-29 (option A)", the descent into declared properties.children, a root-level component winning an id collision outright and document order deciding among nested matches; its diff wrote the #12961 lines it replaces. True at every site, including :1942's "the slot commit 901355c's ruling named".
• c45d8e6b4 for [finding] translatePage's addressed-component walk is not exported, so the CLI extractor hand-mirrors its depth cap, cycle guard and collision arbitration — the copy hazard the key list closed, left open for the walk #13218 (four sites): exports walkAddressedPageComponents and makes both sides consume it; changeset "([finding] translatePage's addressed-component walk is not exported, so the CLI extractor hand-mirrors its depth cap, cycle guard and collision arbitration — the copy hazard the key list closed, left open for the walk #13218, ruled 2026-08-30)". True.
• 8b236c826 for i18n-extract's per-component pass is still region-level only, so the nested-children keys translatePage now resolves are never scaffolded into the skeleton bundle #13109 (:1700): its changeset names i18n-extract's per-component pass is still region-level only, so the nested-children keys translatePage now resolves are never scaffolded into the skeleton bundle #13109 and says the extractor "OMITTED keys the resolver reads" and "This matches the second half"; the line now reads "the second half went live; commit 8b236c8 fixed it". True.
• d173125fb for i18n: component-translation submitLabel copy key lost its only declared carrier when element:form retired (#9249) — decide retire vs re-anchor #10926 (i18n-resolver.ts:1580, translation.zod.ts:1041, :1072): "Option A per the maintainer ruling on i18n: component-translation submitLabel copy key lost its only declared carrier when element:form retired (#9249) — decide retire vs re-anchor #10926 (2026-08-22): drop the key", the submitLabel retirement all three describe. True.
• aa5994e17 for Operation Message Catalog: add refusal-situation keys for approvals recall and sharing write-denial — two measured hardcoded-English refusals waiting on the one sanctioned mechanism #12493 (four docblock sites in operation-message.ts): adds record_write_denied and approval_recall_not_submitter, no placeholders, "deliberately not record_access_denied restated"; its diff wrote all four lines. True.
• d127ff002 for ServiceStatus 在 ./api 与 ./system 各有一个不同声明,#4593 的别名补齐卡在这个名字上 #6604: "Per the maintainer's 2026-08-08 Option-B ruling the kernel side takes the domain-specific name", matching KernelServiceMapSchema. True.
• 24d622b94 for The boot banner's "🔑 Dev admin" is the only credential a first-run operator is given, and in any audience-gated app it is the account that sees nothing #17081 (dev-login.zod.ts:10): "Fixes Let an app contribute its own first-run credentials to the boot banner (devHint / devLogins[]) — the platform cannot know which of an app's audiences shows something, and only the app can #17556", "Suggestion 1 of The boot banner's "🔑 Dev admin" is the only credential a first-run operator is given, and in any audience-gated app it is the account that sees nothing #17081"; the line keeps Let an app contribute its own first-run credentials to the boot banner (devHint / devLogins[]) — the platform cannot know which of an app's audiences shows something, and only the app can #17556 and says "suggestion 1 of its parent card". True.
• e58ea8b38 for manifest.permissions is live on its LEGACY string[] arm only — the structured PluginPermissionsSchema (services / hooks / network / fs) has zero readers, and new code is told to prefer it #11333 (environment-artifact.zod.ts:136-137): declares grantedPermissions (spec: declare grantedPermissions on EnvironmentArtifactSchema (record of manifest id → PluginPermissions) — the artifact-contract half of #14034 / #11333 Phase 1, which must land BEFORE cloud can write it (plain z.object strips undeclared keys at the artifact door) #14865); its own diff wrote the "artifact-contract half of manifest.permissions is live on its LEGACY string[] arm only — the structured PluginPermissionsSchema (services / hooks / network / fs) has zero readers, and new code is told to prefer it #11333 option A and the Phase 1 of #11333: wire granted_permissions into PluginPermissionEnforcer (F4) as the load-time gate #13457 batch ruling" text the line paraphrases. True (the ADR-0025 §3.5 step 2 pointer on the same line is pre-existing; see ③).
• c41b42e8d for SystemIdentifierSchema/EventNameSchema admit the empty-segment dot shapes the item-name grammar refuses (a., a..b, trailing dots) #12245 (identifiers.zod.ts:18, :69): its message records the per-surface census result ("measured exactly ONE of the eleven", origin/main @ e2debee6), and its diff wrote both #12245 lines and the 1218 count. The report comment lived on the deleted card, so the commit is the record now, which is what :18-19 says. True.
• 3a04b0125 for The shared identifier schemas declare no maximum length, so every cap on an identifier is a storage accident rather than a contract #12144 (:72, :128): wrote the storage-owned length-ceiling note and its storage-column pin; changeset "(The shared identifier schemas declare no maximum length, so every cap on an identifier is a storage accident rather than a contract #12144)". True.
• 311433f6b for D1: declare the metadata item-name grammar in spec and refuse it loudly at the publish door — dotted qualified form becomes enforced (#12176 stage 1) #12194 and Ban / in metadata item names — retire compound-name addressing (maintainer-ruled direction): census, migration surface, staged plan #12176 (:140-141): "Stage 1 of Ban / in metadata item names — retire compound-name addressing (maintainer-ruled direction): census, migration surface, staged plan #12176", declares the item-name grammar and refuses it at the publish door. 7986d973f for Ban / in metadata item names — retire compound-name addressing (maintainer-ruled direction): census, migration surface, staged plan #12176 (:189): "Retire compound-name metadata addressing", stage 3, un-mounts the three section arities, which is the retired convention the sentence names. Both true.
• 35ad101bc for defineStack({ themes }) is parsed, ingested and never applied — the last hop from a stored theme item to the theme engine does not exist #10485 (index.ts:207, metadata-collection.zod.ts:82, metadata-url-spelling.ts:60, :266): "Ruled B (2026-08-21)", deletes ui/theme.zod.ts whole and drops the PLURAL_TO_SINGULAR fold; its diff wrote all four lines. True.
• ece4dad31 for @objectstack/spec's root entry does not re-export three types its own public API's inferred types mention — every consumer inferring through defineStack hits TS2883 #11350 (five sites in index.ts, one in ai/index.ts): "Invariant recorded (maintainer ruling 2026-08-23)", and its third sub-commit "point the nameability pin's premise-delta note at @objectstack/spec root entry: two MORE structurally-mentioned types are unnameable through the CHUNKED build (BaseValidationRuleShape, FilterCondition) — a minimal defineStack consumer still hits TS2883 #11709", which is what index.ts:148 now says. True.
• c5a7448d5 for automation: create_record collapses the engine's DUPLICATE_RECORD envelope to a string, so a flow's try_catch / fault edge still cannot tell "already there" from "the store is down" #14419 (control-flow.zod.ts:351): "Fixes automation: create_record collapses the engine's DUPLICATE_RECORD envelope to a string, so a flow's try_catch / fault edge still cannot tell "already there" from "the store is down" #14419", create_record surfaces the engine's DUPLICATE_RECORD code, the engine copies it onto $error, try_catch preserves it: the founding case the line names. True.
• 18d816a50 for A loop node aborts the entire flow run when one iteration's node fails — a single bad row kills a whole scheduled sweep, and there is no per-iteration containment to opt into #13681: declares run-level FlowRunSummary.failed, "a fold of nodes[].failures, absent is not zero". True.
• ecdfc9411 for A schedule-triggered flow's notify delivers nothing on a multi-organization install: the run carries no organization, so the tenant-scoped inbox/delivery writes are refused (#8844) while the run reads healthy #16659 (automation/index.ts:46, schedule-organization.zod.ts:81-82): declares the start-node config.organization key and "the one refusal sentence every enforcement point says", and fixes the job-tick run that carried no tenant; its sub-commits pin "the three A schedule-triggered flow's notify delivers nothing on a multi-organization install: the run carries no organization, so the tenant-scoped inbox/delivery writes are refused (#8844) while the run reads healthy #16659 consequences". The generated page carries the same sentence. True.
• 42b05af89 for The explain engine has no contributor state for a DEACTIVATED permission set — it just vanishes, where an expired grant says "held until … — expired" #8714: "ONE closed contributor-state enumeration", maintainer-ruled 2026-08-18. 2ab1257c9 for [观察] stripReadonlyForInsert 完全不读 preserveAudit —— readonly 的历史导入豁免在 INSERT 侧是 declared ≠ enforced #6640: preserveAudit is UPDATE-only. e2798fab7 for cli/runtime: explicit driver(--database-driver / OS_DATABASE_DRIVER)在 CLI 与 standalone stack 之间仍有三处分叉(#6265 后续) #6345 (turso.zod.ts:36, :357): one driver vocabulary, the turso contract, fork 2; its diff wrote both lines. b799ac553 for Every view-family conversion walks only the container spellings — a stored ViewItem record (viewKind/config) or flattened overlay escapes applyConversionsToStoredItem('view', ...) entirely #13031: "Fixes Every view-family conversion walks only the container spellings — a stored ViewItem record (viewKind/config) or flattened overlay escapes applyConversionsToStoredItem('view', ...) entirely #13031", adds mapViewPayloads to walk.ts. 2c86fe3ea for [finding] The ApiKey reference table documents better-auth's apiKey-plugin schema — a plugin this platform does not load and a shape sys_api_key does not have #8715 (identity.zod.ts:231): "Maintainer ruling 2026-08-15 (disposition B: delete)", its diff wrote :230. All true.
• #8460 to ADR-0029 D9.2a (i18n-resolver.ts:2517, :2520): ruling C's first rung. docs/adr/0029-*.md:475 is "D9.2a — AMENDMENT (2026-08-13, A package extension's scalar overwrites a tenant's Studio rename inside the object fold, so the rename still reaches no read #8460)": option A, an extender's scalar applies only while the fold's base still carries the packaged owner's value, and "deliberately the same mechanism" the i18n catalog uses one layer up. The docblock's two sentences say exactly that. True.
  Rung: no file under docs/adr/**, docs/NORTH-STAR.md or scripts/adr-anchors/ names any of the other 23 numbers, so the commit rung is the right rung for all 23 shas, as in stages 1 to 5.

(e) The two kept sites: right. data/api-derivation.ts:163 keeps [#6259]: api-derivation.test.ts:236 does split('[#6259]') and packages/runtime/src/api-exposure.test.ts:152 does split('#6259'), both at the head; the file is not in the diff. identity/identity.zod.ts:230 keeps (#8715, byte-identical: identity/api-key-retirement.test.ts:118 asserts toContain('are NOT declared here (#8715') as its anti-vacuity literal, and the head's :230 still carries that text. Adding commit 2c86fe3ea on :231 is within the surface (the file is on the claim's list, the line is the second half of the same sentence, and the claim's rule is the dead-number lines of those files) and true of the commit (judged in (d)). Removing either kept number would be a test-string change, form D, outside this comment-only claim; the census reads 2 left for that reason.

(f) The generated pages: right. schedule-organization.mdx:83-84 and driver-turso.mdx:24 are the schedule-organization.zod.ts:81-82 and turso.zod.ts:36 lines verbatim with the * prefix stripped; the surrounding paragraphs agree line for line, and each page carries the AUTO-GENERATED header. No other page under content/docs/references/ at the head carries any of the 26 numbers. check:docs runs in Type Check · source gates (lint.yml, beside check:authorable-surface and check:generated --reconcile-only), success at the read, which is the generator's own verdict that the committed pages equal its output at this head.

(g) Form C over the whole diff: right. Each rewrite leads with commit 9-hex (or [commit 9-hex] / (commit 9-hex) where the marker form stood) and says in words what was decided; the one ADR site keeps the ADR; no tracker number or PR #N is added. The citation gate judges packages/**/src/**/*.ts and defers test files, so all 21 files are in the diff-scoped run's population. Nothing author-shown is touched, so form D does not arise. Spot-read end to end for sense: rest-server.zod.ts:328-336, :365, :652-653, :756-757; identifiers.zod.ts:18-19, :69, :72, :128, :140-142, :189; i18n-resolver.ts:1580, :1619, :1631, :1672, :1696, :1700, :1749, :1930, :1942, :1971, :1996, :2003, :2517-2520; index.ts:132-144, :148, :158-160, :207. Each reads as one sentence about the act its anchor performed.

② Semver level

patch for @objectstack/spec is right and Clause-②: no is right. The package ships bytes from this diff: files[] carries dist and src/**/*.zod.ts, so the 13 touched .zod.ts sources ship verbatim with their rewritten comments, and the other docblocks reach dist. (b) shows the non-comment residue identical base to head, so no export, key, value or type moves and nothing widens or narrows: WHICH LEVEL (pr-automation.yml, the 2026-09-04 ruling on #15294) keeps a change that moves no public surface at patch, the level stages 1 (21ab410417), 2 (5cf58eb164), 3 (03b19d9cfd), 4 (6154165484) and 5 (2123fcca3b) took for the same act. The changeset names one package, describes only the comment re-anchoring, carries no tracker number and no model identifier, and Check Changeset is success at the read.

③ Boundary flags

Blocking: none.

Dev deviations, each answered:

1. 21 of the 22 named files, data/api-derivation.ts untouched: right, judged in (a) and (e).
2. identity.zod.ts:230 kept, 2c86fe3ea on :231: right, judged in (e).
3. Six changed lines with no dead number: right, judged in (b).
4. Two generated pages beyond the claim's source lines: right, judged in (f); the claim names the class.
5. check:generated exit 1 (stale check:docs) then --fix then exit 0: a dev-side sequence, not a property of the diff; the head's Type Check · source gates is the verdict.
6. No merge of origin/main, three commits behind: confirmed, the three touch none of the 24 files.
7. Commit trailers: all three commits carry Claude-Session plus Co-authored-by: Claude, no model identifier; the PR body ends with the session-URL footer.
8. The empty probe push and three commits, no force-push: the PR shows exactly three commits; the rest is not observable from here and not this diff's.
9. Worktree cleanup: not observable, not this diff's.
   Open questions: the report lists none.

Out-of-scope findings, each judged:

• The two kept sites go to a later form-D test-string stage of this card: right carrier.
• stack.zod.ts (9 sites) is free, PR fix(spec,cli): os validate / os build read the ADR-0087 conversions defineStack applied — --json conversions and --strict see the producer's record #20579 having landed as 7a1faf1a5d at 2026-09-29T06:02Z, after the claim at 2026-09-29T05:26Z; the other held files keep their carriers (os migrate meta prints tracker numbers to the author: ADR-0087 migration entries' reason / replacement / acceptanceCriteria text carries ~2,060 of them, 178 dead, which AGENTS.md's runtime-string rule forbids #20233 open; PRs feat(spec)!: $empty joins FILTER_OPERATORS, and is_empty / is_not_empty lower to it (#20446) #20570, feat(spec)!: retire the inner name on cube measures and dimensions — the record key is the member's name (#20300) #20458, feat(spec)!: retire the connector triggers array — the ConnectorTrigger shape nothing registered, polled or received (#20287) #20587; automation: connector triggers start flows, and a connector action's description / outputSchema reach the flow designer (7 keys) #20287). Right, and rightly left out of this stage.
• packages/spec/scripts/check-entry-nameability.ts cites @objectstack/spec's root entry does not re-export three types its own public API's inferred types mention — every consumer inferring through defineStack hits TS2883 #11350 at :14 and prints "recorded on @objectstack/spec's root entry does not re-export three types its own public API's inferred types mention — every consumer inferring through defineStack hits TS2883 #11350" in its failure text at :727, and root-entry-type-nameability.pin.test.ts cites it: confirmed at the head. The carrier the note names is stale: [finding] dead tracker citations outside packages/spec/src have no carrier: #20234 sweeps only the spec tree, and PR #20554 makes 26 more visible (pre-#N / Pre-#N) in cli, drivers, metadata, objectql, plugins, runtime and types #20556 closed completed at 2026-09-29T05:58Z, before the report, and its close-out (5884580132) files four package-lane stage cards (dead tracker citations in the domain:cli packages (689 sites, 166 numbers, 95 files): the ruling C+D stage for this lane (from #20556) #20594 to dead tracker citations in the domain:spec packages (84 sites, 21 numbers, 23 files): the ruling C+D stage for this lane (from #20556) #20597) for the gate's census population and says scripts/** is "not in this family's scope"; [finding] check-doc-authoring 的两条腿都够不到 packages/spec/scripts/** —— 一条印给作者的拒绝消息里带着 404 的编号,而门禁是绿的 #19124, the ruling's named sibling for exactly this class in packages/spec/scripts/**, closed not_planned. So the finding stands where Prime Directive 10 puts a non-defect, in the PR body's acceptance notes, no filing is owed, and the carrier reads none rather than [finding] dead tracker citations outside packages/spec/src have no carrier: #20234 sweeps only the spec tree, and PR #20554 makes 26 more visible (pre-#N / Pre-#N) in cli, drivers, metadata, objectql, plugins, runtime and types #20556. Non-blocking; the seat's ACCEPT should carry that correction.
• environment-artifact.zod.ts:137 cites "ADR-0025 §3.5 step 2" for the granted set, as does packages/runtime/src/security/artifact-granted-permissions.ts:6. Verified against docs/adr/0025-plugin-package-distribution.md: section 3.5's numbered step 2 is "Compatibility" and "Permission consent (new)" is step 3, and that numbering has stood since the ADR's first commit (896ca9a1d6, 2026-06-01), so the pointer was one step off when e58ea8b38 wrote it. Correctly left here: it is a live ADR citation (form C's first rung), not a tracker number; its twin is in another area; and moving one alone would split the pair. Non-blocking; a two-file docs fix is the natural follow-up, noted rather than filed (not a defect, contract violation or authoring trap).
• Rung: five anchored retirements also have ADR-0087 D3/D2 entries (all five ids exist under packages/spec/src/migrations/entries/ at the head). This PR takes the commit rung as stages 1 to 5 did, precedent-consistent; the D3 id remains the more durable in-repo record if the ruling's first rung is later read to include those entries. Non-blocking.

Non-blocking observations: (1) the docs-drift comment 5884956320 lists north-star.mdx via EnvironmentArtifactSchema, a symbol-anchored advisory on a comment-only diff; Flag docs affected by code changes is success. (2) i18n-resolver.ts:2519-2520 names "the 2026-08-13 ruling" twice, once for the catalog layer and once for D9.2a; both are dated 2026-08-13 and the sentence is true, if dense.

Escalated: none.

CI at this head, the judging read at 2026-09-29T06:38Z: 32 check-runs, 15 success, 2 skipped (Console Pin Gate, Packed-tarball smoke (opt-in)), 0 failure, 15 not concluded. In progress: Lint & Repo Gates, Build Core, Temporal Conformance (live PG + MySQL), Test Core (1/6) through (6/6), Dogfood Regression Gate (1/3) and (2/3), Dogfood Verify CLI, Type Check · workspace, Type Check · consumer gates and Type Check · debt ledger; the Test Core, Dogfood Regression Gate and TypeScript Type Check aggregates had not yet been created. So six of the seven required contexts are NOT presumed green here and must be read concluded before the PR is armed: Lint & Repo Gates (the diff-scoped citation verdict node scripts/check-issue-citations.mjs, check:doc-authoring, pnpm lint and the repo check:* steps), TypeScript Type Check, Test Core, Dogfood Regression Gate, Build Core and Temporal Conformance (live PG + MySQL). Success at the read: Governed Surface Queue Guard (the seventh), Type Check · source gates (the spec artifact gates: check:docs, check:authorable-surface, check:generated --reconcile-only and siblings), Check Changeset, Spec property liveness, Build Docs, Dogfood Regression Gate (3/3), Check PR Size, Check Documentation Links, Flag docs affected by code changes, the three claim and closing guards, Auto Label and filter. No red run exists to attribute. Of the 108 families the dev derived, the head's runs answer the changeset, generated-artifact, liveness, docs-build and governed-surface families now; the citation pass, doc-authoring, lint, typecheck, build, test, dogfood and temporal families are the runs still open above. PR is a draft; mergeable: true, mergeable_state: blocked (draft); assignee os-tesla; no auto-merge armed.

Implemented-by: claude/issue-20234-dead-citations-remainder
Reviewed-by: session_014EJ1ED8X4MMrT18BhVx4tx

VERDICT: PASS

---

Generated by Claude Code

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 36533810671 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (2/6) — 失败步骤: Run this shard's tests

  @objectstack/metadata-protocol:test:  FAIL  src/protocol.metadata-redaction.test.ts > #20552 — the protocol serves the projection and executes the stored body > GET → edit → PUT keeps the stored secre
    ↳ 失败原因: @objectstack/metadata-protocol:test: Error: flow/inbound_hook failed author-time validation: 1 issue — flows[0].nodes[0].config.secret [flow-api-trigger-secret-missing]
  @objectstack/metadata-protocol:test:  FAIL  src/protocol.metadata-redaction.test.ts > #20552 — first save of a registry-only (code-authored) flow keeps its secret > the served body saved straight back
    ↳ 失败原因: @objectstack/metadata-protocol:test: Error: flow/inbound_hook failed author-time validation: 1 issue — flows[0].nodes[0].config.secret [flow-api-trigger-secret-missing]
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️ 断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• src/protocol.metadata-redaction.test.ts — 24h 内已弹出 2 个互相独立的 PR（feat(lint): os validate refuses an api flow with no per-flow secret #20593、docs(spec): re-anchor the dead tracker citations in the packages/spec/src remainder to the commits and ADRs that decided them (stage 6) #20606）。汇总 issue：Queue-flake anchor: src/protocol.metadata-redaction.test.ts #20608（新建）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 9 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)