docs(lint): re-anchor the dead tracker citations in packages/lint/src to the commits that decided them

[objectstack-fleet]

Part of #20597
Clause-②: no

The packages/lint stage of the dead-citation sweep: the domain:spec lane's only package (census 5884031174 on #20556, claim 5885046469). Every comment or docblock line in 22 of the 23 claimed packages/lint/src/ files that cited a tracker number answering 404 now cites, in ruling C+D's form C, the commit in this repository's history that decided what the line describes, and says in its own words what was decided. Comments only: 81 lines out, 81 in, across 22 files. No code token, string literal, rule message, hint or rule id moves.

authoring-rules.ts (5 sites) is excluded and left at its base blob: PR #20593 (#20553) edits it and was still open at the last read (2026-09-29T07:34Z). So this PR says Part of: those 5 sites stay for a follow-up once that PR lands, with their anchors already verified (see Acceptance notes).

The census is the gate's own node scripts/check-issue-citations.mjs --census --json, filtered to packages/lint/. Before: base 7a1faf1a5d, 2026-09-29T06:42:03Z to 06:45:24Z, board enumerated (185 pages, frontier #20606). After: head 0c7b847f18, 07:28:22Z to 07:31:52Z (185 pages, frontier #20611).

Measurement

file (under packages/lint/src/)	dead before	after	numbers, then anchor
lint-flow-patterns.ts	9	0	#13681 ×9 to 8ed9c54b4 (#14394 stays, 200)
validate-hook-body-writes.ts	9	0	#8663 ×6 to 192213f66; #13657 ×3 to b003cf2e8
runtime-gate.ts	8	0	#10064 ×5 to def0d3e63; #19370 ×2 to a227afa41 (#19143 stays); #9798 to c7655d472 (#9261 stays)
validate-searchable-fields.ts	7	0	#8404 ×4 to b849e6911, the pre-#8404 control at :312 included; #10001 ×3 to f1b5ad39a
authoring-rules.ts	5	5	excluded: PR #20593 holds the file
validate-expressions.ts	5	0	#6290 ×5 to e9b526597 (#6584, that commit's own PR, stays)
validate-react-page-props.ts	5	0	#11284 ×4 to 5383fa670; #8404 to b849e6911
validate-sortable-fields.ts	5	0	#10001 ×4 to f1b5ad39a; #8404 to b849e6911
validate-flow-node-writes.ts	4	0	#8663 ×4 to 192213f66
validate-page-field-bindings.ts	4	0	#6629 ×2 to cd584d559 (plus the slash-joined :208, see Deviations); #8664 ×2 to 8798cd2a6
validate-translation-references.ts	4	0	#14700 ×3 to de3c52beb (#14253 stays); #6124 to b3c1f3cd5
lint-liveness-properties.ts	3	0	#10262 ×3 to 2aca1bc4c
validate-action-body-writes.ts	3	0	#8663 ×3 to 192213f66
validate-security-posture.ts	3	0	#19370 ×3 to a227afa41 (#8310 stays)
flow-template-grammar.ts	2	0	#11060 ×2 to 815585513
data-model-rules.ts	1	0	#10064 to def0d3e63
reference-integrity-suite.ts	1	0	#13653 to 36d287803
validate-component-types.ts	1	0	#12950 to 225e7690f (#12183 stays)
validate-empty-combinators.ts	1	0	#6528 to 3510e4a25 (#5659 stays)
validate-list-view-field-refs.ts	1	0	#10001 to f1b5ad39a
validate-readonly-action-writes.ts	1	0	#13653 to 36d287803
validate-readonly-flow-writes.ts	1	0	#13653 to 36d287803
validate-readonly-hook-writes.ts	1	0	#13653 to 36d287803
23 files	84	5	21 numbers; 19 removed from the 22 edited files, to 19 distinct shas

Per-file counts at base equal the claim's (census at f11b5f20a2) in all 23 files. A second instrument agrees site for site: every #N in the 23 files, classified by the TypeScript parser as comment, string or code, and each of 360 distinct numbers probed by REST issues/N without following redirects. At base it found 1,323 sites (1,259 comment, 64 string, 0 code); 339 numbers answer 200 and 21 answer 404, the census's 21. Its dead comment sites are the census's 84 plus one slash-joined #5775/#6629 the grammar does not read, and it found one dead string: validate-react-page-props.ts:1198 (see Acceptance notes). At head: 1,243 sites and 344 numbers, the same 339 answer 200, and 5 answer 404, all in authoring-rules.ts comments or that one string. Lit controls #16862, #16847 and #17698 answered 200, and dead controls #16714, #16715 and #16697 answered 404, at every checkpoint (5 at base, 5 at head).

Why each anchor decides its line

Each sha resolves uniquely, is an ancestor of origin/main and of the base, has one parent, and names the number it replaces in its own message (15 of 19) or its own diff (17 of 19); every one does at least one. Each was read for the rule its line states.

• A loop node aborts the entire flow run when one iteration's node fails — a single bad row kills a whole scheduled sweep, and there is no per-iteration containment to opt into #13681 to 8ed9c54b4: lands the per-iteration containment rule PAIR (flow-loop-body-uncontained, flow-try-catch-without-catch) and its measured minimal catch; its diff wrote all nine lines, and its changeset records the measurements the lines cite. flows: lint a loop body with a fallible node and no containment, and a try_catch without catch; document loop { try_catch } as the per-iteration containment spelling (B-branch items 1–2 of #13681) #14394 (the rule card, 200) stays beside it.
• finding: two IMPLICIT_FIELDS sets spread the blanket SYSTEM_FIELDS union with no provenance awareness — candidate sixth/seventh unprovisioned-anchor read sites #8663 to 192213f66: "three write rules ask anchor provenance before exempting a system column"; its body names finding: two IMPLICIT_FIELDS sets spread the blanket SYSTEM_FIELDS union with no provenance awareness — candidate sixth/seventh unprovisioned-anchor read sites #8663 and its diff wrote the [#8663] lines in all three rule files.
• The undeclared-field door sits in FRONT of the hooks, so a key a beforeInsert hook writes has no door at all — and the drivers then disagree (memory stores it, SQL throws a raw statement error) #13657 to b003cf2e8: the post-hook half of the declared-field door, one envelope on every driver; its diff wrote the three lines.
• finding: a publish refusal's issues[].path carries an array index into the gate's private snapshot (objects[417].sharingModel) that no caller can resolve #10064 to def0d3e63: name-keys collection-resident publish-gate finding paths; its body reads "maintainer ruling 2026-08-20: Option A" for finding: a publish refusal's issues[].path carries an array index into the gate's private snapshot (objects[417].sharingModel) that no caller can resolve #10064.
• [Decision] app / position 声明 allowRuntimeCreate: true 而作者期规则零命中 —— 退役这个声明,还是把规则造出来? #19370 to a227afa41: security-role-word crosses to the runtime publish gate, whole, per ruling batch chore(deps)(deps-dev): bump @vitejs/plugin-react from 4.7.0 to 5.1.2 #203 item 3 letter B; it maps position / app and writes the past-tense crossing lines.
• The #4630 unscoped multi-write refusals on sys_comment never fire through the wired engine — per-row dispatch bypasses resolveTargetRows on both verbs #9798 to c7655d472: the change that carried The #4630 unscoped multi-write refusals on sys_comment never fire through the wired engine — per-row dispatch bypasses resolveTargetRows on both verbs #9798 to done (its body names it), restoring the sys_comment unscoped multi-delete refusal that could not fire through the wired engine, the declared-but-unenforced fail-open the line lists beside probeInstallOrganizations answers a failed sys_organization read with a memoised empty list, so system-insert organization resolution fails open #9261 and ADR-0110 D3.
• lint: searchableFields is a FIFTH blanket-SYSTEM_FIELDS read site — a declared anchor on an external object becomes a $searchFields narrowing over a column with no storage #8404 to b849e6911: warns when searchableFields declares an unprovisioned injected anchor, adding the optional provenance index the lines describe; the SORT twin line names it as the SEARCH wiring.
• A standalone ViewItem RECORD's nested config.sort / config.searchableFields is judged by neither list-view field rule — the same runtime-door gap #9313 closed for the flattened overlay, one member over #10001 to f1b5ad39a: a standalone ViewItem record's nested config.sort / config.searchableFields reach the runtime publish gate, the RECORD rung.
• finding: packages/formula 一包两话 —— SCOPE_ROOTS 不含 current_user 而 introspectScope 宣告它;字段级 visibleWhen 的 lint 拒绝还附错误修法「Write record.current_user」 #6290 to e9b526597: current_user joins SCOPE_ROOTS, the field-level rejection becomes its own rule, and option-level visibleWhen is walked for the first time. :770 quotes SCOPE_ROOTS' docblock in packages/formula; the quote now stops at "the last one this list was missing", verbatim, with the commit outside the quotation.
• [Decision] Does react-blocks.ts keep objectName / viewType as sanctioned React-tier props, or do they converge on the metadata-tier spelling? — the carrier objectui#2890's last phase has never had #11284 to 5383fa670: the ListView react-tier vocabulary converges on the metadata-tier spelling, deprecate-first; its changeset reads "([Decision] Does react-blocks.ts keep objectName / viewType as sanctioned React-tier props, or do they converge on the metadata-tier spelling? — the carrier objectui#2890's last phase has never had #11284, maintainer ruling 2026-08-23)".
• validate-page-field-bindings 的 element:record_picker 条目仍列着 #5775 已退役的 displayField / searchFields #6629 to cd584d559: drops the retired displayField / searchFields from the record_picker entry and adds component-field-specs-liveness.test.ts.
• finding: #8340's unprovisionedAnchors comment names check-cross-package-test-inputs as the guard that would notice a caller dropping the index — that gate does not do this #8664 to 8798cd2a6: names what actually guards the unprovisionedAnchors wiring; its diff wrote both lines.
• lint: validate-translation-references builds its _validations universe from top-level rules only, so a nested conditional branch's legitimate bundle entry is reported as an orphan #14700 to de3c52beb: descends into conditional then / otherwise when building the _validations universe; its diff wrote all three lines.
• fix(cli): _views 翻译键改用运行时视图身份命名(#5164 第 1 棒 / cli 段) #6124 to b3c1f3cd5: the squash commit of fix(cli): _views 翻译键改用运行时视图身份命名(#5164 第 1 棒 / cli 段) #6124 itself, leg 1 of the _views key ruling (the CLI i18n extractor keyed by the runtime view identity).
• finding: the liveness author-lint's array fan-out (getNested) has lost its warned subject a SECOND time — the ledger now has ZERO dotted warned entries #10262 to 2aca1bc4c: adds the package-internal test seam for getNested's array fan-out; its diff wrote all three lines.
• Flow field expressions can call no function but NOW()/TODAY() — every other identifier is rewritten to null, so a computed money value can never be rounded to its field's declared scale #11060 to 815585513: its body records "Maintainer ruling on Flow field expressions can call no function but NOW()/TODAY() — every other identifier is rewritten to null, so a computed money value can never be rounded to its field's declared scale #11060 (2026-08-23): option A", the CEL-mirrored six with no second semantics, which the lines quote.
• "A field a hook or flow must write cannot be readonly" has no author-time signal — the strip is silent, and six fields in the reference app carry a hand-written comment as the only protection against re-adding the flag #13653 to 36d287803: gates a hook body's ctx.api write to a readonly field, and shares buildReadonlyIndex from the flow rule, the export :118 describes.
• Phase 2 of #12183: global:search / global:notifications data-source readiness read → keep-or-retire per B; plus author-time rejection for unknown PageComponentSchema.type strings #12950 to 225e7690f: created validate-component-types.ts, the author-time rejection for unknown component types in spec-reserved namespaces (stage 5's anchor for the same number).
• refactor(spec,drivers,lint): one implementation of the filter identity reduction #6528 to 3510e4a25: the squash commit of refactor(spec,drivers,lint): one implementation of the filter identity reduction #6528 itself, one implementation of the filter identity reduction (maintainer ruling 2026-08-06, option 1). The line read PR #6528; it now names the commit.

Rung: no ADR, docs/NORTH-STAR.md or scripts/adr-anchors/ file records any of these 19 decisions (the one lint anchor file, data-model-rules.ts, pins ADR-0120, which none of these lines cites), so the commit rung is the right one, as in #20234's stages.

Mechanical proof

• Token guard (scratch tokcmp.mjs: TypeScript 6.0.3 leaf tokens, JSDoc kinds excluded, controls mutate the head text in memory only). The merge base c96beb2707 against the head, 22 files, 54,508 base tokens (the 22 files are byte-identical at 7a1faf1a5d and at the merge base):
  • Real run: 0 files with a token change (exit 0).
  • Comment-insertion control (runtime-gate.ts): 0 (exit 0).
  • Code-insertion positive control (validate-hook-body-writes.ts): DIFFER at token 216 (exit 1).
  • String positive control (a parser-located StringLiteral in validate-react-page-props.ts): DIFFER at token 5 (exit 1).
• Line balance: every file is +N/−N (81/81 across 22 files), every changed line is comment-shaped, and every line count is equal at base and head.
• Tracker numbers: added-not-removed is empty in every file, and no PR #N stands on an added line. Net-removed: 80 sites (the census's 79 in these files plus the slash-joined one), 19 numbers. The numbers kept on added lines all answer 200: flow-multi-write-unfiltered 不判空组合子:filter: { $and: [] } + multi: true 是整表删除,却零告警 —— 身份归约在 producer 侧有三份,lint 侧不该再抄第四份 #5659, SDUI props 声明与 renderer 不一致:6 处「renderer 兑现但 ComponentPropsMap 未声明」+ 2 处「声明了没人读」(#5068 error 升级的 spec 侧前置) #5775, [3 of #7891] Flip the registration: runtimeTypes gains object + permission/book — whole rule families cross the publish door #8310, lint: view-filter / page-binding field checks resolve against the blanket SYSTEM_FIELDS union, so the #8116 unprovisioned-anchor warning cannot reach filter surfaces #8340, probeInstallOrganizations answers a failed sys_organization read with a memoised empty list, so system-insert organization resolution fails open #9261, [finding] Both field-resolution gates for a list view (searchableFields and sort) are CLI-only — the reference-integrity suite dispatches at the runtime publish gate for flow alone, so a Studio/MCP view write gets neither #9313, Console renders nav:menu / global:search / global:notifications / app:launcher as "Component Placeholder" — four spec-declared PageComponentType members with no renderer #12183, runtime publish gate: the snapshot collection set is hand-listed in five places and only one of them can go red #13390, i18n: three authored display surfaces have no bundle key at all (bulk-action defs, custom validation messages, dataset labels) #14253, flows: lint a loop body with a fallible node and no containment, and a try_catch without catch; document loop { try_catch } as the per-iteration containment spelling (B-branch items 1–2 of #13681) #14394, [finding] a runtime-created dataset reaches ZERO author-time rules — the type declares allowRuntimeCreate: true while nothing declares it in runtimeTypes and TYPE_TO_STACK_KEY has no row #19143, and fix(formula,lint): current_user 收进 SCOPE_ROOTS,字段级拒绝改为按面的真规则 (#6290) #6584 (a pull request, the anchor commit's own PR).
• Shas: 19 distinct on added lines, 0 on removed lines. rev-parse --disambiguate answers 1 object for each; merge-base --is-ancestor exits 0 against origin/main and against the base; each is single-parent; the repository is not shallow; the control leg e9584681a4 exits 0.
• Literal readers: every string or regex literal in the repository that carries one of the 21 numbers (85 literals) was matched against the 23 files' text: no reader of any rewritten line. The lint tests that read these sources as text stay green below. For example, validate-expressions.test.ts strips comments before it matches, and validate-security-posture.runtime-surface.test.ts collects the stack.X reads inside validateSecurityRoleWord, which no added line carries.

Tests and gates (at head 0c7b847f18)

• pnpm exec turbo run build --concurrency=2 --filter=./packages/* --filter=./packages/*/* under os-verify-lock: Tasks 71 successful, 71 total, VERDICT command-exit 0.
• pnpm --filter @objectstack/lint exec vitest run --maxWorkers=2 under the lock: Test Files 115 passed (115), Tests 5363 passed (5363); then pnpm --filter @objectstack/lint typecheck: exit 0, check:test-typecheck OK (2 files / 6 errors / 2 pinned signatures held). VERDICT command-exit 0. The same two runs passed with the same counts on the pre-merge head 2ce32f6b48.
• Lint, a proven narrowing: eslint --no-inline-config --format json over the 22 touched .ts files gives 22 files, 0 errors, 0 warnings. isPathIgnored is false for all 22, read through eslint's API. eslint.config.mjs:327-328 says type-aware linting is never enabled, so a comment edit cannot move an untouched file's verdict. The repo-wide pnpm lint is CI's.
• node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands: 54 families derived, all run, every one exit 0. --ran reads "54 derived, 54 run, 0 NOT-MEASURED, 0 UNRUN", a derived zero (every line carries its exit code). Among them:
  • node scripts/check-issue-citations.mjs (the live diff-scoped run) judged 18 citations across 22 files: 17 answer as issues and 1 answers as a pull request, the kept fix(formula,lint): current_user 收进 SCOPE_ROOTS,字段级拒绝改为按面的真规则 (#6290) #6584; pnpm check:issue-citations (self-test, 114 cases in 8 batteries) passes.
  • pnpm check:doc-authoring: the sibling prose-id baseline holds, 810 pinned sites across 230 files, no growth.
  • pnpm check:nul-bytes: OK over 9,239 tracked text files; a control-byte scan of the 23 changed files finds none.
• No generated page carries a lint docblock: no page under content/docs/references/ names any of the 19 numbers, and no generator reads packages/lint/src, so nothing was regenerated.
• Changeset: patch for @objectstack/lint. files[] ships dist, and the rewritten comments reach it: 12 of the 19 shas appear in the built dist (for example 8ed9c54b4 and def0d3e63 in index.d.ts, b849e6911 in index.js and index.d.ts); the positive control, the unchanged sentence "the near-miss shape: a try_catch that declares no catch" of an exported docblock, is in index.d.ts. Hence patch, not skip-changeset.
• Merge probe: a no-driver merge-tree of the head onto origin/main 0f6dcac5e9, from a bare shared clone with no merge.* config, exits 0. The two commits main gained after the merge touch none of the 23 files.
• No ablation or reverse verification: the change is comment-only, so there is no behaviour to invert.

Hypotheses (measured first)

1. Holds. 84 dead sites, 21 numbers, 23 files at the tip 7a1faf1a5d, equal per file to the claim.
2. Holds. Only comment and docblock lines moved. The one dead number inside a string (validate-react-page-props.ts:1198, a finding message) stays byte-identical; no test or script reads a rewritten line by literal.
3. Holds, and conditions the card. PR feat(lint): os validate refuses an api flow with no per-flow secret #20593 was still open at 07:34Z, so authoring-rules.ts stays at its base blob. At that read, the 9 open PRs' full file lists and the newest Claim: on all 11 pm:dispatched cards name none of the other 23 paths.
4. Holds. validate-searchable-fields.ts:312 pre-#8404 is listed dead before and is gone after.
5. Holds, with nothing to regenerate. No lint docblock projects into a generated page; no release page is touched.

Deviations

• Two changed lines beyond the census's sites. validate-page-field-bindings.ts:208 carried #5775/#6629, a slash-joined dead number the citation grammar does not read; it now reads "the same SDUI props 声明与 renderer 不一致:6 处「renderer 兑现但 ComponentPropsMap 未声明」+ 2 处「声明了没人读」(#5068 error 升级的 spec 侧前置) #5775 residue class (commit cd584d5)", stage 5's precedent for the slash-joined #9972. runtime-gate.ts:780 is the other half of the rewritten :779 sentence and held no number.
• origin/main was merged once (0c7b847f18, merging c96beb2707): the first derivation read STALE TREE because scripts/sdui-manifest.record.json changed on main. The merge was clean, no driver-routed path and no lockfile change, and it touches none of the 23 files; the build, tests and gates above ran after it.
• Commit trailers follow AGENTS.md's model-free pair (Claude-Session plus Co-authored-by: Claude); the pre-push trailer check passed on every push.

Acceptance notes

What stays for this card (why it says Part of): authoring-rules.ts, 5 sites, excluded while PR #20593 holds it. Anchors, verified the same way, for whoever takes it after that PR lands: :198 #10064 to def0d3e63; :1117 #16659 to ecdfc9411 (it added flow-schedule-organization-missing to the registry); :1687 "(PR #8546)" to ba5e957ef, that PR's own squash commit; :1713 and :1733 #19370 to a227afa41.

Form D, not touched: validate-react-page-props.ts:1198 is the react-prop-deprecated finding message, which ends "...is removed after the deprecation window (#11284)." An author sees it, so it takes ruling D (no number), which is a string change and outside this comment-only scope. scripts/doc-authoring-prose-id.baseline.json pins it (#11284: 1 for this file). It needs a form-D carrier.

Outside the census's surface, which blanks strings and defers test files (noted, not swept here):

• packages/lint/src/*.test.ts titles and comments still cite several of these dead numbers (finding: packages/formula 一包两话 —— SCOPE_ROOTS 不含 current_user 而 introspectScope 宣告它;字段级 visibleWhen 的 lint 拒绝还附错误修法「Write record.current_user」 #6290, lint: searchableFields is a FIFTH blanket-SYSTEM_FIELDS read site — a declared anchor on an external object becomes a $searchFields narrowing over a column with no storage #8404, finding: two IMPLICIT_FIELDS sets spread the blanket SYSTEM_FIELDS union with no provenance awareness — candidate sixth/seventh unprovisioned-anchor read sites #8663, A standalone ViewItem RECORD's nested config.sort / config.searchableFields is judged by neither list-view field rule — the same runtime-door gap #9313 closed for the flattened overlay, one member over #10001, finding: a publish refusal's issues[].path carries an array index into the gate's private snapshot (objects[417].sharingModel) that no caller can resolve #10064, finding: the liveness author-lint's array fan-out (getNested) has lost its warned subject a SECOND time — the ledger now has ZERO dotted warned entries #10262, A loop node aborts the entire flow run when one iteration's node fails — a single bad row kills a whole scheduled sweep, and there is no per-iteration containment to opt into #13681, [Decision] app / position 声明 allowRuntimeCreate: true 而作者期规则零命中 —— 退役这个声明,还是把规则造出来? #19370 and others).
• Hand-written docs pages cite them too: content/docs/automation/hook-bodies.mdx (finding: two IMPLICIT_FIELDS sets spread the blanket SYSTEM_FIELDS union with no provenance awareness — candidate sixth/seventh unprovisioned-anchor read sites #8663, The undeclared-field door sits in FRONT of the hooks, so a key a beforeInsert hook writes has no door at all — and the drivers then disagree (memory stores it, SQL throws a raw statement error) #13657), content/docs/automation/flows.mdx (Flow field expressions can call no function but NOW()/TODAY() — every other identifier is rewritten to null, so a computed money value can never be rounded to its field's declared scale #11060) and content/docs/deployment/validating-metadata.mdx ([Decision] app / position 声明 allowRuntimeCreate: true 而作者期规则零命中 —— 退役这个声明,还是把规则造出来? #19370).
• packages/formula/src/cel-engine.ts cites finding: packages/formula 一包两话 —— SCOPE_ROOTS 不含 current_user 而 introspectScope 宣告它;字段级 visibleWhen 的 lint 拒绝还附错误修法「Write record.current_user」 #6290 four times, including the docblock validate-expressions.ts:770 quotes. It is in the census, in another lane's package.

Wording, each true of its commit.

• validate-expressions.ts:571 keeps fix(formula,lint): current_user 收进 SCOPE_ROOTS,字段级拒绝改为按面的真规则 (#6290) #6584 beside e9b526597: fix(formula,lint): current_user 收进 SCOPE_ROOTS,字段级拒绝改为按面的真规则 (#6290) #6584 is that commit's own PR, so "arrived in commit e9b5265, and needed that same change (fix(formula,lint): current_user 收进 SCOPE_ROOTS,字段级拒绝改为按面的真规则 (#6290) #6584) to be noticed" states the one act both old numbers named.
• runtime-gate.ts:362 names the The #4630 unscoped multi-write refusals on sys_comment never fire through the wired engine — per-row dispatch bypasses resolveTargetRows on both verbs #9798 shape in words, as the fail-open that commit c7655d4 ended, next to probeInstallOrganizations answers a failed sys_organization read with a memoised empty list, so system-insert organization resolution fails open #9261 and ADR-0110 D3.
• lint-flow-patterns.ts:343 reads "The measured case commit 8ed9c54 records, exactly: one row with a null owner killed the sweep"; that commit wrote the sentence, and c02f70e13 later fixed the same shape in the showcase flow.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/lint, touching 20 documentable anchor(s). ⚠️ 8 changed file(s) yielded no anchor (packages/lint/src/data-model-rules.ts, packages/lint/src/flow-template-grammar.ts, packages/lint/src/lint-liveness-properties.ts, …), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/permissions/authorization.mdx (via validateSecurityPosture (symbol, a top-level function))

⛔ 2 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v13.mdx (via validateSecurityPosture (symbol, a top-level function))
• content/docs/releases/v16.mdx (via validateStackExpressions (symbol, a top-level function))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 8 changed file(s) yielded no anchor (packages/lint/src/data-model-rules.ts, packages/lint/src/flow-template-grammar.ts, packages/lint/src/lint-liveness-properties.ts, …) — pages documenting those are invisible to this run
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 4 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 0f6dcac5e99d0c6211f0d8a0e150a112d78a776f → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 2309ce232c26867a1869f0df5665e3d49ac6f7e9 — the merge of head 0c7b847f187ff983d52137ef61bb83a27616df23 into base 0f6dcac5e99d0c6211f0d8a0e150a112d78a776f, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 2309ce232c26867a1869f0df5665e3d49ac6f7e9 && git checkout 2309ce232c26867a1869f0df5665e3d49ac6f7e9
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 0f6dcac5e99d0c6211f0d8a0e150a112d78a776f 0c7b847f187ff983d52137ef61bb83a27616df23 && git checkout -B drift-repro 0f6dcac5e99d0c6211f0d8a0e150a112d78a776f && git merge --no-ff 0c7b847f187ff983d52137ef61bb83a27616df23

node scripts/docs-audit/affected-docs.mjs --json 0f6dcac5e99d0c6211f0d8a0e150a112d78a776f

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 0f6dcac5e99d0c6211f0d8a0e150a112d78a776f → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 0c7b847f187ff983d52137ef61bb83a27616df23
Local-runs: none

Read (this act, 2026-09-29T07:45Z to 07:57Z): card #20597 (body; every comment: the claim 5885046469 and the os-dev-report 5885887024), #20556 (body; every comment, in particular the census split 5884031174, the close-out 5884580132 and the cursor-exhaustion pointer 5885710792), ruling C+D 5749154545 on #19123 and its pointer 5856637615 on #20234, stage 6's record 5885205776 on PR #20606 as the method precedent, PR #20612 (body, its one comment 5885856143, the 23-file list, the three commits and the net diff against the merge base c96beb2707, read from the local ref at the head above with -U0 and the base and head blobs of every changed file), the 19 cited commits (identity, message and stat for all; their own diffs of the files they now anchor wherever the subject does not name the number), packages/formula/src/cel-engine.ts at the head for the quoted docblock, docs/adr/**, docs/NORTH-STAR.md, scripts/adr-anchors/ and content/docs/references/** at the head for the 19 numbers, packages/lint/package.json files[] and tsup.config.ts, scripts/check-issue-citations.mjs (declared and deferred surfaces, CITATION_RE), scripts/doc-authoring-prose-id.baseline.json, the lint tests that read their rule's source as text, lint.yml and ci.yml for the job roster, PR #20593 (state, events, file list), cards #20594 to #20596 and the pm-dispatch lane table for packages/formula. Nothing was built, run or re-run: the blobs were compared with a string-, template- and regex-aware comment stripper in scratch (a read of the diff, not a gate), the numbers were probed with REST GET against this repository (a GitHub read), and the check-runs were read for judgment once, at 2026-09-29T07:56:56Z.

① Derived judgments

(a) Scope and file surface: right. 23 files: the 22 packages/lint/src/ files of the claim's 23-file surface, each .ts file on the claim's list, plus the new .changeset/lint-provenance-anchors.md (+11). The 23rd, authoring-rules.ts, is absent from the diff, and rightly: the claim conditions it on PR #20593 having landed before the push, and PR #20593 is still open at every read (events: added_to_merge_queue 06:28:53Z, removed_from_merge_queue 06:59:13Z, nothing after; merged: false at 07:5xZ), its file list holding authoring-rules.ts and index.ts. No other package, no test file, no release page, no gate file, no governed surface is touched. Head repository is the base repository; draft; assignee os-tesla; no auto-merge armed; no reviews; mergeable: true, mergeable_state: blocked (draft); 173 changed lines. First line Part of #20597, no closing keyword, is right: 5 of the card's 84 sites stay on the card by the claim's own condition, and Part-of PR must not also close its card is success. Clause-②: no on the body's second line. Three commits: the rewrite, the changeset, and one two-parent merge of origin/main (c96beb2707); the two authored commits carry the model-free Claude-Session plus Co-authored-by: Claude pair. origin/main (now eb4b17c346) has moved since the merge base; the files it moved (spec sources, plugin-audit, rest, two generated pages, three changesets) intersect the 23 in nothing, so the net diff against current main is the diff judged here.

(b) Comment-only, no code token, string literal, rule message, hint, rule id or test title moves: right. git diff -U0 over the 22 .ts files: 81 lines removed, 81 added, every one of the 162 beginning with //, * or /**. Enclosure and residue, read on the base and head blobs: every removed line lies inside a comment in the base blob and every added line inside a comment in the head blob, 22 of 22 files; the non-comment residue (code, string, template and regex literals kept, comments dropped) is byte-identical base to head in all 22, with every line count equal and every file +N/-N. Controls, mutated in memory only: a comment insertion into validate-react-page-props.ts and into runtime-gate.ts leaves the residue equal; a code edit and a string-literal edit each make it differ. So no message, hint, rule-id constant, export or code token moved in any of the 22 files. validate-react-page-props.ts:1198, the react-prop-deprecated finding message ending "is removed after the deprecation window (#11284)", is byte-identical base to head, the only (#11284) left in the file. No test file is in the diff, so no it/describe title moved; of the nine lint tests that read a rule's source as text, the two that read a touched file (validate-security-posture.test.ts, .runtime-surface.test.ts) strip comments first or slice validateSecurityRoleWord's body for stack.X tokens, which no added line carries, and validate-expressions.test.ts strips comments before matching. The one changed line holding no number, runtime-gate.ts:780, is the second half of the :779 sentence.

(c) Numbers: right. Over the 22 files, added-minus-removed tracker numbers is empty in every file; the changeset carries none; net-removed is exactly 19 numbers on 80 sites (the census's 79 in these files plus the slash-joined #6629 at validate-page-field-bindings.ts:208): #6124, #6290, #6528, #6629, #8404, #8663, #8664, #9798, #10001, #10064, #10262, #11060, #11284, #12950, #13653, #13657, #13681, #14700, #19370. Per file the diff's counts equal the claim's census (lint-flow-patterns 9, hook-body-writes 9, runtime-gate 8 plus the :780 half, searchable-fields 7 with the pre-#8404 control at :312 gone, expressions 5, react-page-props 5, sortable-fields 5, flow-node-writes 4, page-field-bindings 4 plus :208, translation-references 4, liveness-properties 3, action-body-writes 3, security-posture 3, template-grammar 2, and 1 each in the other eight). No PR #N stands on any added line. REST issues/N without redirects, read at 2026-09-29T07:53Z: all 19 removed numbers answer 404; the 12 numbers standing on added lines answer 200 (#5659, #5775, #8310, #8340, #9261, #9313, #12183, #13390, #14253, #14394, #19143 as issues; #6584 as a pull request, the anchor commit's own, allowed beside it as ruling C's convenience link); controls #16862 200, #16714 404, #20597 200, #20612 200. On the slash-joined :208: CITATION_RE's look-behind class excludes /, so #6629 after #5775/ was never read by the gate, which is why the census counts 79 here and the dev's raw instrument 80; the rewrite keeps the live #5775 and names the commit. The dev's census over 360 numbers is otherwise not re-run.

(d) Anchor truth: right, 19 of 19. 19 distinct 9-hex shas stand on added lines and none on removed lines. git rev-parse --disambiguate answers exactly one object for each; git merge-base --is-ancestor exits 0 for all 19 against origin/main; every one is a single-parent commit; the repository is not shallow. Nine name the replaced number in their own subject (a227afa41 #19370, b849e6911 #8404, f1b5ad39a #10001, e9b526597 #6290 and #6584, cd584d559 #6629 and #5775, 8798cd2a6 #8664, b3c1f3cd5 #6124, 2aca1bc4c #10262, 3510e4a25 #5659 and #6528); the other ten are tied by their body or their own diff, and every anchor was read against the sentence it now supports:

• 8ed9c54b4 for A loop node aborts the entire flow run when one iteration's node fails — a single bad row kills a whole scheduled sweep, and there is no per-iteration containment to opt into #13681 (nine sites in lint-flow-patterns.ts): its subject names no number, but its diff wrote 13 lines carrying A loop node aborts the entire flow run when one iteration's node fails — a single bad row kills a whole scheduled sweep, and there is no per-iteration containment to opt into #13681 and created both containment rules; it wrote the very sentences now attributed to it ("row with a null owner killed the sweep" at :343, "measured end to end on the real AutomationEngine" at :1333, "Measured: the container fails through, and the run is byte-identical" at :1468). flows: lint a loop body with a fallible node and no containment, and a try_catch without catch; document loop { try_catch } as the per-iteration containment spelling (B-branch items 1–2 of #13681) #14394 (the rule card, 200) stays beside it. True.
• 192213f66 for finding: two IMPLICIT_FIELDS sets spread the blanket SYSTEM_FIELDS union with no provenance awareness — candidate sixth/seventh unprovisioned-anchor read sites #8663 (13 sites across the three write rules): body "three write rules ask anchor provenance before exempting a system column (finding: two IMPLICIT_FIELDS sets spread the blanket SYSTEM_FIELDS union with no provenance awareness — candidate sixth/seventh unprovisioned-anchor read sites #8663)"; its diff wrote the [#8663] lines in all three files. True.
• b003cf2e8 for The undeclared-field door sits in FRONT of the hooks, so a key a beforeInsert hook writes has no door at all — and the drivers then disagree (memory stores it, SQL throws a raw statement error) #13657 (validate-hook-body-writes.ts:12, :16, :933): the post-hook declared-field door, one envelope on every driver; seven sub-commits name The undeclared-field door sits in FRONT of the hooks, so a key a beforeInsert hook writes has no door at all — and the drivers then disagree (memory stores it, SQL throws a raw statement error) #13657; its diff rewrote 41 lines of that file. True.
• def0d3e63 for finding: a publish refusal's issues[].path carries an array index into the gate's private snapshot (objects[417].sharingModel) that no caller can resolve #10064 (data-model-rules.ts:64, runtime-gate.ts x5): "Fixes finding: a publish refusal's issues[].path carries an array index into the gate's private snapshot (objects[417].sharingModel) that no caller can resolve #10064 (maintainer ruling 2026-08-20: Option A)", name-keyed wire paths, objects[417].sharingModel to objects.acme_invoice.sharingModel; its diff wrote both files' lines. True.
• a227afa41 for [Decision] app / position 声明 allowRuntimeCreate: true 而作者期规则零命中 —— 退役这个声明,还是把规则造出来? #19370 (runtime-gate.ts:173, :264; validate-security-posture.ts:16, :824, :1102): security-role-word crosses to the runtime publish gate, whole; its diff wrote all five lines. True.
• c7655d472 for The #4630 unscoped multi-write refusals on sys_comment never fire through the wired engine — per-row dispatch bypasses resolveTargetRows on both verbs #9798 (runtime-gate.ts:362): "Fixes The #4630 unscoped multi-write refusals on sys_comment never fire through the wired engine — per-row dispatch bypasses resolveTargetRows on both verbs #9798", restores the sys_comment unscoped multi-delete refusal that could not fire through the wired engine, the declared-but-unenforced fail-open the sentence names beside probeInstallOrganizations answers a failed sys_organization read with a memoised empty list, so system-insert organization resolution fails open #9261 and ADR-0110 D3; a plugin-audit commit, which is right, since the line cites the fail-open class, not a lint change. True.
• b849e6911 for lint: searchableFields is a FIFTH blanket-SYSTEM_FIELDS read site — a declared anchor on an external object becomes a $searchFields narrowing over a column with no storage #8404 (validate-searchable-fields.ts x4 including the pre-#8404 control at :312, validate-react-page-props.ts:1237, validate-sortable-fields.ts:172): the unprovisioned-anchor warning and its optional provenance index; its diff wrote the searchable-fields and react-page-props lines, and the sortable-fields line calls it the SEARCH wiring the SORT twin mirrors. True.
• f1b5ad39a for A standalone ViewItem RECORD's nested config.sort / config.searchableFields is judged by neither list-view field rule — the same runtime-door gap #9313 closed for the flattened overlay, one member over #10001 (eight sites): the standalone ViewItem RECORD rung; its diff wrote all of them. True.
• e9b526597 for finding: packages/formula 一包两话 —— SCOPE_ROOTS 不含 current_user 而 introspectScope 宣告它;字段级 visibleWhen 的 lint 拒绝还附错误修法「Write record.current_user」 #6290 (validate-expressions.ts x5): current_user into SCOPE_ROOTS, the field-level rule, option-level visibleWhen walked; its diff touched both cel-engine.ts and validate-expressions.ts. :770 quotes SCOPE_ROOTS' docblock: cel-engine.ts:146 reads "and the last one this list was missing" with "(finding: packages/formula 一包两话 —— SCOPE_ROOTS 不含 current_user 而 introspectScope 宣告它;字段级 visibleWhen 的 lint 拒绝还附错误修法「Write record.current_user」 #6290)" on :147, so the quotation now closing before the number is verbatim, and e9b526597's own diff wrote that formula line, which is what "(commit e9b5265 wrote it)" says. :571 keeps fix(formula,lint): current_user 收进 SCOPE_ROOTS,字段级拒绝改为按面的真规则 (#6290) #6584 beside the commit: fix(formula,lint): current_user 收进 SCOPE_ROOTS,字段级拒绝改为按面的真规则 (#6290) #6584 is the commit's own PR (its subject ends "(finding: packages/formula 一包两话 —— SCOPE_ROOTS 不含 current_user 而 introspectScope 宣告它;字段级 visibleWhen 的 lint 拒绝还附错误修法「Write record.current_user」 #6290) (fix(formula,lint): current_user 收进 SCOPE_ROOTS,字段级拒绝改为按面的真规则 (#6290) #6584)"), so "arrived in commit e9b5265, and needed that same change (fix(formula,lint): current_user 收进 SCOPE_ROOTS,字段级拒绝改为按面的真规则 (#6290) #6584) to be noticed" states the one act. True.
• 5383fa670 for [Decision] Does react-blocks.ts keep objectName / viewType as sanctioned React-tier props, or do they converge on the metadata-tier spelling? — the carrier objectui#2890's last phase has never had #11284 (validate-react-page-props.ts x4): its subject names no number; its diff wrote 23 lines carrying [Decision] Does react-blocks.ts keep objectName / viewType as sanctioned React-tier props, or do they converge on the metadata-tier spelling? — the carrier objectui#2890's last phase has never had #11284, adds react-prop-deprecated, and its changeset names the maintainer ruling; deprecate-first is the body's own word. True.
• cd584d559 for validate-page-field-bindings 的 element:record_picker 条目仍列着 #5775 已退役的 displayField / searchFields #6629 (validate-page-field-bindings.ts:42, :208, :218): drops SDUI props 声明与 renderer 不一致:6 处「renderer 兑现但 ComponentPropsMap 未声明」+ 2 处「声明了没人读」(#5068 error 升级的 spec 侧前置) #5775's retired displayField / searchFields from the record_picker entry; its diff wrote :42 and :218, and :208's "the same SDUI props 声明与 renderer 不一致:6 处「renderer 兑现但 ComponentPropsMap 未声明」+ 2 处「声明了没人读」(#5068 error 升级的 spec 侧前置) #5775 residue class (commit cd584d5) as the record-picker entries below" names the record-picker act. True.
• 8798cd2a6 for finding: #8340's unprovisionedAnchors comment names check-cross-package-test-inputs as the guard that would notice a caller dropping the index — that gate does not do this #8664 (:400, :402): its diff wrote both lines. de3c52beb for lint: validate-translation-references builds its _validations universe from top-level rules only, so a nested conditional branch's legitimate bundle entry is reported as an orphan #14700 (validate-translation-references.ts x3): the conditional then / otherwise descent; its diff wrote the four lint: validate-translation-references builds its _validations universe from top-level rules only, so a nested conditional branch's legitimate bundle entry is reported as an orphan #14700 lines. b3c1f3cd5 for fix(cli): _views 翻译键改用运行时视图身份命名(#5164 第 1 棒 / cli 段) #6124 (:550): PR fix(cli): _views 翻译键改用运行时视图身份命名(#5164 第 1 棒 / cli 段) #6124's own squash commit, defaultListViewKey in packages/cli/src/utils/i18n-extract.ts, leg 1 of the _views key ruling the sentence describes. 2aca1bc4c for finding: the liveness author-lint's array fan-out (getNested) has lost its warned subject a SECOND time — the ledger now has ZERO dotted warned entries #10262 (x3): its diff wrote the seam lines. 815585513 for Flow field expressions can call no function but NOW()/TODAY() — every other identifier is rewritten to null, so a computed money value can never be rounded to its field's declared scale #11060 (flow-template-grammar.ts:34, :104): "Maintainer ruling on Flow field expressions can call no function but NOW()/TODAY() — every other identifier is rewritten to null, so a computed money value can never be rounded to its field's declared scale #11060 (2026-08-23): option A", exactly round/floor/ceil/abs/min/max mirrored 1:1 from the CEL stdlib, no second semantics, which is the quotation :34 carries; a service-automation commit, and the lines now say "the ruling commit 8155855 records", which is what it is. 36d287803 for "A field a hook or flow must write cannot be readonly" has no author-time signal — the strip is silent, and six fields in the reference app carry a hand-written comment as the only protection against re-adding the flag #13653 (x4): the hook ctx.api readonly gate, buildReadonlyIndex shared from the flow rule, 17 lines added to reference-integrity-suite.ts. 225e7690f for Phase 2 of #12183: global:search / global:notifications data-source readiness read → keep-or-retire per B; plus author-time rejection for unknown PageComponentSchema.type strings #12950: created validate-component-types.ts (130 lines), the author-time rejection the docblock describes. 3510e4a25 for refactor(spec,drivers,lint): one implementation of the filter identity reduction #6528: PR refactor(spec,drivers,lint): one implementation of the filter identity reduction #6528's own squash, "one implementation of the filter identity reduction (flow-multi-write-unfiltered 不判空组合子:filter: { $and: [] } + multi: true 是整表删除,却零告警 —— 身份归约在 producer 侧有三份,lint 侧不该再抄第四份 #5659)"; the line read "PR refactor(spec,drivers,lint): one implementation of the filter identity reduction #6528" and now names the commit beside the live flow-multi-write-unfiltered 不判空组合子:filter: { $and: [] } + multi: true 是整表删除,却零告警 —— 身份归约在 producer 侧有三份,lint 侧不该再抄第四份 #5659. All true.
  Rung: no file under docs/adr/**, docs/NORTH-STAR.md or scripts/adr-anchors/ names any of the 19 numbers (the one lint anchor file pins ADR-0120 on data-model-rules.ts, whose invariant text is untouched), so the commit rung is the right rung for all 19, as in packages/spec/src: 1,277 comment lines still cite 170 deleted tracker numbers (1,295 sites) — the staged remainder of ruling C+D on #19123, measured by PR #20226 #20234's stages.

(e) Form C over the whole diff: right. Each rewrite leads with commit 9-hex (or [commit 9-hex] / (commit 9-hex) where the marker form stood) and says in words what was decided; no tracker number and no PR #N is added. Nothing author-shown is touched, so form D does not arise in this diff. Read end to end for sense: runtime-gate.ts:362-363 and :776-781 (dense, true, one sentence each), lint-flow-patterns.ts:58, :343, :1333, :1468, validate-expressions.ts:568-572 and :768-772, flow-template-grammar.ts:33-35 and :102-104, validate-translation-references.ts:547-551 and :983, validate-hook-body-writes.ts:12-18, lint-liveness-properties.ts:458, validate-empty-combinators.ts:10. The citation gate's declared surface is packages/**/src/**/*.ts with string literals blanked and test files deferred, so all 22 files are in the diff-scoped run's population; that run judged the 18 kept-number sites on added lines and is success (see the CI read).

(f) Generated pages: nothing to regenerate, right. No page under content/docs/references/ at the head names any of the 19 numbers, and none of the scripts that mention packages/lint/src is a page generator (they are gates and the docs-drift advisory). The claim's "any generated page those docblocks project into" resolves to none.

② Semver level

patch for @objectstack/lint is right and Clause-②: no is right. The package ships bytes from this diff: files[] is dist, README.md, CHANGELOG.md, and tsup.config.ts emits dts (unless OS_SKIP_DTS), so the docblocks on exported declarations reach dist/index.d.ts and dist/runtime.d.ts (LintIssue at data-model-rules.ts:64, FLOW_TEMPLATE_VALUE_FUNCTIONS at flow-template-grammar.ts:102, the rule-id constants in lint-flow-patterns.ts, buildReadonlyIndex at validate-readonly-flow-writes.ts:118, getNested's seam, among them). (b) shows the non-comment residue identical base to head, so no export, type, value, message or behaviour moves and nothing widens or narrows: a change that moves no public surface stays at patch, the level #20234's stages 1 to 6 took for the same act, and skip-changeset would be wrong because the tarball changes. The changeset names one package, describes only the comment re-anchoring, carries no tracker number and no model identifier; Check Changeset is success at the read.

③ Boundary flags

Blocking: none.

Dev deviations, each answered:

1. Part of #20597, not Fixes, with authoring-rules.ts excluded at its base blob: right, judged in (a); PR feat(lint): os validate refuses an api flow with no per-flow secret #20593 open and out of the queue at the push and at this read.
2. Two changed lines beyond the census's sites (validate-page-field-bindings.ts:208, runtime-gate.ts:780): right, judged in (b) and (c); both files are on the claim's surface and the lines are the dead-number line's own sentence.
3. validate-expressions.ts:770 quotation closing before the number, :571 keeping fix(formula,lint): current_user 收进 SCOPE_ROOTS,字段级拒绝改为按面的真规则 (#6290) #6584 beside the commit: right, judged in (d).
4. One merge of origin/main (c96beb2707): confirmed, the third commit is a two-parent merge; the files main brought intersect the 23 in nothing; no driver-routed path or lockfile change is in the diff.
5. Commit trailers model-free: confirmed on the two authored commits; the merge commit carries git's default message and no trailers, which the pre-push hook is the authority on and which a squash landing does not keep. Non-blocking.
6. The empty probe push, no force-push, worktree cleanup: not observable from here and not this diff's; the PR shows exactly three commits.
   Open questions: the report lists none.

Out-of-scope findings, each judged:

• The 5 authoring-rules.ts sites (:198 finding: a publish refusal's issues[].path carries an array index into the gate's private snapshot (objects[417].sharingModel) that no caller can resolve #10064, :1117 A schedule-triggered flow's notify delivers nothing on a multi-organization install: the run carries no organization, so the tenant-scoped inbox/delivery writes are refused (#8844) while the run reads healthy #16659, :1687 PR feat(lint): permission/book cross the runtime publish gate; object measured dirty stays behind; security-role-word splits to stay behind whole (#8310) #8546, :1713 and :1733 [Decision] app / position 声明 allowRuntimeCreate: true 而作者期规则零命中 —— 退役这个声明,还是把规则造出来? #19370) stay on this card for a round after PR feat(lint): os validate refuses an api flow with no per-flow secret #20593 lands: right carrier, and rightly left out here; the claim's own condition excludes the file. The anchors the dev pre-verified are that round's to re-verify (def0d3e63 and a227afa41 did touch authoring-rules.ts; ecdfc9411 and ba5e957ef were not re-read here).
• validate-react-page-props.ts:1198, the react-prop-deprecated finding message carrying ([Decision] Does react-blocks.ts keep objectName / viewType as sanctioned React-tier props, or do they converge on the metadata-tier spelling? — the carrier objectui#2890's last phase has never had #11284): an author-shown string, so ruling D, a string change outside this comment-only claim; scripts/doc-authoring-prose-id.baseline.json pins it (#11284: 1 for this file) and that baseline is shrink-only, so removing it is a legal later act. Correctly left byte-identical. The carrier the dev leaves unnamed is this card's own later form-D round, as packages/spec/src: 1,277 comment lines still cite 170 deleted tracker numbers (1,295 sites) — the staged remainder of ruling C+D on #19123, measured by PR #20226 #20234 carries its two kept test-string sites; no new filing is owed, and the seat's ACCEPT should say so.
• Lint test titles and comments, content/docs/automation/hook-bodies.mdx, flows.mdx and content/docs/deployment/validating-metadata.mdx still citing these numbers: outside the instrument's declared surface (test files are a deferred surface by design; hand-written docs are not swept), which [finding] dead tracker citations outside packages/spec/src have no carrier: #20234 sweeps only the spec tree, and PR #20554 makes 26 more visible (pre-#N / Pre-#N) in cli, drivers, metadata, objectql, plugins, runtime and types #20556's close-out puts outside this family's scope. Correctly noted, not filed; not this stage's.
• packages/formula/src/cel-engine.ts citing finding: packages/formula 一包两话 —— SCOPE_ROOTS 不含 current_user 而 introspectScope 宣告它;字段级 visibleWhen 的 lint 拒绝还附错误修法「Write record.current_user」 #6290 at :120, :147, :160, :173, including the docblock :770 quotes: packages/formula sits in the domain:engine row of the pm-dispatch lane table, so the carrier is dead tracker citations in the domain:engine packages (645 sites, 160 numbers, 104 files): the ruling C+D stage for this lane (from #20556) #20595 (645 sites, open), not dead tracker citations in the domain:cli packages (689 sites, 166 numbers, 95 files): the ruling C+D stage for this lane (from #20556) #20594 or dead tracker citations in the domain:services packages (629 sites, 112 numbers, 152 files): the ruling C+D stage for this lane (from #20556) #20596. Correctly left: another lane's package, and the card forbids a PR across lanes. The seat's ACCEPT should carry that resolution.

Non-blocking observations: (1) the docs-drift comment 5885856143 lists content/docs/permissions/authorization.mdx via validateSecurityPosture and two release pages read-only, a symbol-anchored advisory on a comment-only diff; Flag docs affected by code changes is success. (2) runtime-gate.ts:362 packs the fail-open, #9261 and ADR-0110 D3 into one parenthesis; true, if dense.

Escalated: none.

CI at this head, the judging read at 2026-09-29T07:56:56Z: 33 check-runs, 28 success, 3 skipped (Build Docs, Console Pin Gate, Packed-tarball smoke (opt-in), path-filtered or opt-in, not this diff's), 0 failure, 2 in progress: Test Core (1/6) and Test Core (5/6), with the Test Core aggregate not yet created. So six of the seven required contexts are success: Lint & Repo Gates (07:55:05Z; it runs the diff-scoped node scripts/check-issue-citations.mjs verdict with pnpm check:issue-citations, check:doc-authoring, pnpm lint and the repo check:* roster), TypeScript Type Check, Build Core, Dogfood Regression Gate, Temporal Conformance (live PG + MySQL) and Governed Surface Queue Guard; the seventh, Test Core (the lint vitest suite rides its shards; 2/6, 3/6, 4/6 and 6/6 are success), is NOT presumed green here and must be read concluded before the PR is armed. Also success: Check Changeset, Type Check · source gates, · workspace, · consumer gates, · debt ledger, Dogfood Verify CLI, Check PR Size, Check Documentation Links, Flag docs affected by code changes, the three claim and closing guards, Auto Label and filter. No red run exists to attribute. Of the dev's 54 derived families, the head's runs answer the citation pass, doc-authoring, lint, changeset, typecheck, build, dogfood, temporal and governed-surface families now; the test family is the open run above. PR is a draft; mergeable: true, mergeable_state: blocked (draft); assignee os-tesla; no auto-merge armed.

Implemented-by: claude/issue-20597-lint-dead-citations
Reviewed-by: session_014EJ1ED8X4MMrT18BhVx4tx

VERDICT: PASS

---

Generated by Claude Code