docs(rest): re-anchor the dead tracker citations in packages/rest/src to the commits that decided them

[objectstack-fleet]

Part of #20594
Clause-②: no

What changed

This is stage 2 of the domain:cli lane of the dead-citation sweep: packages/rest/src/**. Every comment or docblock site in scope that cited a tracker number answering 404 now cites, in ruling C+D's form C (comment 5749154545 on #19123), the commit in this repository's history that decided what the line describes, and says in its own words what that commit decided. PR #20533 is the method and PR #20624 (stage 1, packages/runtime) the precedent this follows line for line. Later stages cover cli, types and the rest of the lane, so this PR says Part of and the card stays open.

That is 457 comment sites on 445 lines in 85 files, covering 74 numbers: the census's 191 sites, 256 more in test comments (which the census defers), and 10 sites whose dead number is the second half of a slash-joined pair the citation grammar does not read (#3984/#6241, #9901/#10255 four times, #10993/#11235/#11292, #11235/#11242 twice, #10993/#11242, #7543/#15071). Each rewritten line cites one of 70 distinct commits.

ADR-0076 D11 is the only ADR that records any of these numbers, and it records #8850 only as the extraction it names as landed in 8664a2c99, so that commit is the anchor there. No other ADR or ruling-record file in docs/adr/ or scripts/adr-anchors/ records the decision behind any of these numbers, so every anchor is a commit. The anchors the landed stages already gave the same numbers are reused where the rest sites describe the same decision (30 numbers, for example 79c46da90 for #9934, 7986d973f / 311433f6b for the compound-name retirement, 6a180e42d for #13279 and cf6e0a193 for #15071), so each number carries one anchor across the tree.

Only comments changed. Every touched file keeps its line count (451 lines out, 451 in, over 85 files), so no line citation into these files moves. Six of the 451 lines held no dead site; each is the other half of a sentence that had to change:

• discovery-schema-conformance.test.ts:343 (「(reaffirmed by」 to 「(which commits」, because line 344 now names the two commits that landed the ruling),
• package-door-16019-raw-statement-fault-code.test.ts:51 and error-response.ts:1485 (a trailing 「PR」 whose number wrapped onto the next line),
• error-response-structured-arm-door-parity.test.ts:463 (「That card added the limb」 to 「That commit」, because line 459's tag now names the commit),
• rest-hook-script-fault-envelope.test.ts:331 (「both sides of that card」 to 「that fix」),
• rest-server.ts:908 (「(test(driver-sql): measure what each dialect materialises for a datetime JS cannot hold (#14078) #14409, landed」 to 「(landed as commit」, the sha 3ecb7dc1a already standing on line 909).

No citation number is added. Every tracker number on an added line was already on the line it replaces. No PR number stands on an added line. One of the 70 shas is on a removed line, and it was there before: rest-14078-invalid-date-total-arm.test.ts:19 read 「PR #14409 (landed 3ecb7dc1a)」 and now reads 「Commit 3ecb7dc drove」. No code token moves (see the guard below).

Three dead comment sites are left on purpose, listed under "The sites left". One more file: a patch changeset for @objectstack/rest, because the rewritten docblocks ship (see Changeset below).

Census: packages/rest, before and after

Instrument. The gate's own node scripts/check-issue-citations.mjs --census --json, read-only and unchanged, run with the fleet token. Its surface is comment prose in packages/**/src/**/*.ts with string literals blanked, and it defers *.test.ts. The count is its allocated-but-absent findings under packages/rest/. Both runs enumerated the whole board (185 pages), so neither read a truncated board.

reading	tree	board	whole-repo allocated-but-absent	rest sites	lines	files	numbers
before	base a186aea996, run 2026-09-29T10:28:18Z to 10:36:06Z	enumerated, 185 pages, frontier #20628, 18,455 numbers	2,015	191	186	14	51
after	head 93e4d69ba6, run 11:11:30Z to 11:17:37Z	enumerated, 185 pages, frontier #20630, 18,457 numbers	1,764	0	0	0	0

The before count equals the card's 191 at f11b5f20a2. The whole-repo drop is 251: this diff's 191, plus the 60 of PR #20626 (packages/plugins/plugin-sharing, 63 to 3), which landed on main in between and came in with the merge. No other package moved.

Supplementary instrument, the whole scope. The census does not read test files or strings, and this stage's scope includes test comments. So a second reading runs the gate's own exported extractCitations (whole-file and comment-prose projections) and classifyCitation over every .ts file under packages/rest/src (256 files), against the board enumerated through the gate's own enumerateBoard. The lit controls #20594, #19123 and #20624 answered 200 and are on both boards; the dead controls #13214, #14541 and #15071 answered 404 and are on neither.

reading	tree	board	citations	dead	src comment	test comment	src string	test string
before, 10:29Z	a186aea996	185 pages, frontier #20628	4,620	577	191	259	1	126
after, 11:21Z	93e4d69ba6	185 pages, frontier #20631	4,174	130	0	3	1	126

Its src-comment column equals the census's 191 and 0, which is the control on the second instrument, and a site-by-site comparison of the two before-readings is identical. Resolving comment citations move by one (1,364 to 1,365 in src): (#10993/#11235/#11292) became (#10993, commit 376c70f98, #11292), so the grammar now reads the live #11292 that the slash hid. The drop is 447 grammar-read sites; the other 10 rewritten sites are the slash-joined ones the grammar never read.

Separately, every one of the 77 numbers was probed on its web endpoint: 76 answer 404 (deleted) and one, #14026, answers 302 to objectstack-ai/objectui#10102 (transferred), which is why it is left (see below).

Per-number table

Sites and files are the dead comment sites in scope at the base, tests and slash-joined halves included. left is a site with no deciding commit (see below). strings kept counts string-literal sites, which are tokens and stay as they were. Every anchor was read in its message or its diff, not only in its subject: it is the commit that made the change the line describes, and its own message or diff names the number it replaces or adds the citation the line carries.

number	comment sites / files	rewritten	left	strings kept	anchor
#6037	5/3	5	0	0	18189983d
#6122	2/2	2	0	0	64cd01082
#6206	1/1	1	0	0	8e13ca876
#6216	6/2	6	0	2	f586f1a89
#6241	10/3 (1 slash-joined)	10	0	1	83a3b1f2e
#6259	2/1	2	0	0	6968885ef
#6303	1/1	1	0	0	465c5fc14
#6306	9/5	9	0	3	fec784863
#6307	4/2	4	0	0	293476148
#6349	4/2	4	0	4	2443bb4c4
#6474	1/1	1	0	0	18189983d
#6535	3/2	3	0	0	a92b1793c
#6640	1/1	1	0	1	2ab1257c9
#6704	5/1	5	0	1	c3f491626
#8641	1/1	0	1	0	—
#8850	3/3	3	0	0	8664a2c99
#8885	6/3	6	0	3	30b1c636a
#8919	7/3	7	0	7	b5378550e
#9741	12/1	12	0	0	2a29caa53
#9805	1/1	1	0	0	45862a53d
#9934	19/10	19	0	4	79c46da90
#9967	2/2	2	0	4	8f266f1cd
#10063	2/2	2	0	1	9e04c3e35
#10178	1/1	1	0	0	38cf397ea
#10179	0/0	0	0	1
#10255	18/4 (4 slash-joined)	18	0	2	6ce58a735
#10340	13/3	13	0	2	26f3588fb
#10345	13/6	13	0	6	cad8b42f0
#10350	1/1	1	0	0	490879ad0
#10485	2/1	2	0	1	35ad101bc
#10537	9/3	9	0	1	e634ecf6a
#10888	2/2	2	0	0	d806081dd
#11006	3/1	3	0	0	cccbe51bf
#11130	1/1	1	0	0	851909530
#11235	4/2 (1 slash-joined)	4	0	0	376c70f98
#11242	3/2 (3 slash-joined)	3	0	0	98ea3443f
#12144	1/1	1	0	0	3a04b0125
#12176	11/7	11	0	2	7986d973f
#12194	15/5	15	0	4	311433f6b
#12195	35/16	35	0	7	7986d973f
#13182	2/2	2	0	0	5b3ff63cc
#13197	1/1	1	0	0	56c093c4d
#13213	2/1	2	0	0	4801296e7
#13214	18/6	18	0	14	cc837dbfe, 889ec5b42, 3d10755f0
#13244	5/2	5	0	1	889ec5b42
#13255	4/1	4	0	6	43028a8f8
#13258	1/1	1	0	0	3d10755f0
#13279	23/5	23	0	5	6a180e42d
#13280	13/4	13	0	2	add6a1b1c
#13282	1/1	1	0	0	43028a8f8
#13377	3/2	3	0	0	e10cf3444
#13378	2/1	2	0	0	82faea03f
#13454	1/1	1	0	0	7ad57e17a
#14026	1/1	0	1	0	—
#14365	1/1	0	1	0	—
#14366	14/4	14	0	2	53cbad9f7
#14369	3/2	3	0	0	a3d5724c8, 53cbad9f7
#14389	7/3	7	0	7	10220a7bf
#14390	1/1	1	0	0	9d7f7259f
#14409	2/2	2	0	0	3ecb7dc1a
#14541	27/4	27	0	5	6d178a408
#14613	2/2	2	0	0	81208086a
#14677	1/1	1	0	0	a4e4d2d78
#14683	8/2	8	0	0	96326040f
#14691	15/2	15	0	2	b3a63d32c
#14704	9/3	9	0	2	1c7adc73d
#14723	7/4	7	0	4	65846bc46
#14725	3/3	3	0	2	f5cc78b63
#14849	3/1	3	0	0	226e72443
#14907	1/1	1	0	0	e1d4f9e3f
#14908	1/1	1	0	0	d5cbb44f3
#15021	2/1	2	0	8	cc238db8b
#15034	6/2	6	0	0	abf9101f1
#15065	1/1	1	0	0	1c7adc73d
#15071	23/4 (1 slash-joined)	23	0	3	cf6e0a193
#16650	1/1	1	0	0	001a83b04
#17058	3/1	3	0	4	94c930248
#18546	3/2	3	0	3	58f60e37e
total	460	457	3	127	70 distinct commits

Every cited sha matches exactly one object (git rev-parse --disambiguate, count 1 for each of the 70), is a commit, has one parent, and is an ancestor of the base (merge-base --is-ancestor, exit 0 for all 70). The checkout is not shallow (--is-shallow-repository false); the control leg 13a6cb4ad exits 0 and the negative control (this branch's first WIP commit, not on main) exits 1. Several numbers are the PR number of their own anchor commit (#6122, #6303, #6474, #11242, #13213, #13244, #13258, #13282, #14409, #14677, #14908, #15065, #16650), so the sha is the same object the number named.

Numbers with more than one anchor, by site:

• #13214 (18 sites) was one card with three commits. cc837dbfe (the ownership gate, the 2026-08-30 ruling) for the 11 sites that describe the gate; 889ec5b42 for the 5 in ui-view-route-identity.measurement.test.ts, the identity measurement it created; 3d10755f0 for the tenancy file's header, the measurement it created; and rest-server.ts:2247, 「Driven and reported on [finding] GET /api/v1/ui/view/:object/:type resolves a UI view with no identity resolution and no anonymous-deny at the REST seam #13214 (PRs test(rest): measure identity resolution at GET /ui/view/:object/:type — seam, downstream producer, and the ratchet blind spot behind it #13244, test(rest): drive the tenancy axis of GET /ui/view/:object/:type — an anonymous caller can name another environment and receive its UI view #13258)」, now reads 「Measured in commits 889ec5b (identity) and 3d10755 (tenancy)」: those PRs are exactly those two commits.
• #14369 (3 sites): a3d5724c8 (the liveness census it recorded) for rest-server.ts:1172 and rest-sub-config-parse-not-cast.test.ts:48. rest-server.ts:4092 said the zero read sites of api.documentation / api.responseFormat came from 「the [finding] Ten declared RestServerConfig keys are normalized by RestServer and read by nothing — routes.* entirely, crud.patterns / objectParamStyle, metadata.cacheTtl / endpoints.schema, batch.defaultAtomic / operations.upsertMany (ADR-0049 enforce-or-remove candidates) #14369 census」, but a3d5724c8 explicitly left api out of that census; the zero was measured by 53cbad9f7 (its changeset: no other read site for either key), which is the anchor there.
• #11235 / #11242 / #10993: 376c70f98 derives the discovery version in metadata-protocol ([finding] a THIRD hardcoded discovery version literal — getDiscovery() in packages/metadata-protocol/src/protocol.ts, identical defect to #10993, different producer/package #11235), and 98ea3443f is fix(runtime): derive /health and discovery version instead of a hardcoded '1.0.0' literal #11242's own squash, which landed the [finding] /api/v1/health reports a hardcoded version: '1.0.0' — a field that exists and lies, so no consumer can use it for artifact identity #10993 ruling on /health and the dispatcher's /discovery. So 「the [finding] /api/v1/health reports a hardcoded version: '1.0.0' — a field that exists and lies, so no consumer can use it for artifact identity #10993 ruling … reaffirmed by [finding] a THIRD hardcoded discovery version literal — getDiscovery() in packages/metadata-protocol/src/protocol.ts, identical defect to #10993, different producer/package #11235/fix(runtime): derive /health and discovery version instead of a hardcoded '1.0.0' literal #11242」 now reads 「the [finding] /api/v1/health reports a hardcoded version: '1.0.0' — a field that exists and lies, so no consumer can use it for artifact identity #10993 ruling, landed by commits 98ea344 and 376c70f」 (rest-server.ts:4528, discovery-schema-conformance.test.ts:343-344). #10993, #11292 and #11297 answer 200 and stay.
• #6037 / #6474: one commit, 18189983d (feat(spec,objectql,metadata-protocol): validate-only data operation — DataProtocol.validateData #6474 is its PR number), so 「([spec] DataProtocol 新增 validate-only 数据校验操作 —— #4633 裁 D 的契约半边(spec 先行) #6037 / PR feat(spec,objectql,metadata-protocol): validate-only data operation — DataProtocol.validateData #6474)」 became 「(commit 1818998)」.

Wordings to check, each true of its commit:

• A commit does not rule. Where a line said a number ruled, it now says what the commit did with the ruling: 「the ruling commit 79c46da landed says it does」, 「the ruling commit cf6e0a1 implemented fences it」, 「the ruling commit 10220a7 implemented」, 「the 2026-08-20 ruling, landed as commit 6ce58a7」, 「recorded in commit 6ce58a7's message (option A)」 (its message reads 「Ruled on POST /datasources/:name/external/validate is the one federation route the #9901 ruling does not name — it stays authentication-only while its four siblings now require a capability #10255 (2026-08-20, option A)」), and 「question was ruled on 2026-08-20 and landed as commit 6ce58a7」 where the line said 「filed as POST /datasources/:name/external/validate is the one federation route the #9901 ruling does not name — it stays authentication-only while its four siblings now require a capability #10255」.
• #14541's contract review: 「the Routes exiting through handleRouteError answer the engine's DUPLICATE_RECORD envelope from resolveErrorResponse's .status passthrough — field and object dropped, mapDataError's structured 409 arms never consulted #14541 contract review (condition N)」 now reads 「the contract review of commit 6d178a4 (condition N)」; that commit's message lists the conditions it carries. 「Routes exiting through handleRouteError answer the engine's DUPLICATE_RECORD envelope from resolveErrorResponse's .status passthrough — field and object dropped, mapDataError's structured 409 arms never consulted #14541's §4」 and 「Routes exiting through handleRouteError answer the engine's DUPLICATE_RECORD envelope from resolveErrorResponse's .status passthrough — field and object dropped, mapDataError's structured 409 arms never consulted #14541 §5」 in error-response-generic-passthrough-object-parity.test.ts are sections of error-response-structured-arm-door-parity.test.ts (the file 6d178a408 created), so they now name that file. 「measured on the Routes exiting through handleRouteError answer the engine's DUPLICATE_RECORD envelope from resolveErrorResponse's .status passthrough — field and object dropped, mapDataError's structured 409 arms never consulted #14541 branch」 reads 「on the branch that landed as commit 6d178a4」.
• A line that named a DEFECT by its number now says so: 「Before commit 9e04c3e the draft→active promotion door could not…」, 「Before commit 26f3588 the /meta doors decided ORGANIZATION SCOPE from the RAW url」, 「the defect commit 2443bb4 fixed」 and 「would be the defect commit 26f3588 fixed」.
• #13255: 「As written for [finding] resolveExecCtx 的 .catch(() => undefined) 把执行上下文解析失败静默降级为「无上下文」— 该行为在包管理门上可达什么错误状态,未测 #13255 this file repaired nothing」 reads 「As first written (commit 43028a8)」, the commit that created the file and answered the measurement; 「CONTEXT-LOST family ([finding] resolveExecCtx 的 .catch(() => undefined) 把执行上下文解析失败静默降级为「无上下文」— 该行为在包管理门上可达什么错误状态,未测 #13255), still unruled」 reads 「first measured by commit 43028a8」 (the ruling on that family never landed, which the line still says).
• #13214 in the identity file: 「the half [finding] GET /api/v1/ui/view/:object/:type resolves a UI view with no identity resolution and no anonymous-deny at the REST seam #13214 marks UNMEASURED」 reads 「the half left UNMEASURED until commit 889ec5b」, and 「[finding] GET /api/v1/ui/view/:object/:type resolves a UI view with no identity resolution and no anonymous-deny at the REST seam #13214 asks for an INDEPENDENT reproduction」 reads 「commit 889ec5b is an INDEPENDENT reproduction」.
• 「the rest emits two error codes outside the closed ADR-0112 vocabulary — FIELD_VISIBILITY_UNRESOLVED has no ledger entry and no test anywhere #8885 sweep」 reads 「the sweep behind commit 30b1c63」, the commit that registered the 9 codes the sweep found; 「[finding] 6 of handleApprovalError's 9 wire-code rows have no live-emission pin — counted, not fixed #14849 predicted」 reads 「The card behind commit 226e724 predicted」; 「the hazard A typed IHttpRequest test builder — 4 ledgered TS2345 in packages/rest are hand-built request literals, and the only in-repo alternative is as any #13377 names」 reads 「the hazard commit e10cf34 was written to remove」; 「The concrete harm [finding] ImportRequest.runAutomations declares .default(false) and documents "off by default for bulk", but POST /data/:object/import defaults it ON #6704 names」 reads 「removed」.
• Quoted ruling: error-response-sandbox-arm-message.test.ts:340 sits inside a verbatim ruling quote, so the commit stands in an editorial bracket (「not from [commit 1c7adc7]'s list」), as PR docs(runtime): re-anchor the dead tracker citations in packages/runtime/src to the commits that decided them #20624 did.
• Two markdown tables in comments (meta-state-route-engine-outage.test.ts:76, objectql-slot-consumer-census.test.ts:43): the rewritten cell is wider than its column, and its padding is reduced rather than widening the four sibling rows.

The sites left

No deciding commit (3 sites, all in test files, so the census does not see them):

• meta-object-owd-gate.test.ts:516 ([Decision] sys_* objects silently default to PUBLIC row visibility — should the platform's own objects keep an unstated default at all, and is isSystem even the right predicate? #8641): 「whether it should stay is [Decision] sys_* objects silently default to PUBLIC row visibility — should the platform's own objects keep an unstated default at all, and is isSystem even the right predicate? #8641's question」, an open decision. The commit that added the citation calls it a pointer to the open decision card, and no commit decides it.
• rest-sub-config-parse-not-cast.test.ts:321 (CrudEndpointsConfigSchema.patterns is an exhaustive enum-keyed z.record — the input type demands all five operations and a partial parses to explicit undefined entries (wants z.partialRecord) #14365): the z.partialRecord question 「deferred to CrudEndpointsConfigSchema.patterns is an exhaustive enum-keyed z.record — the input type demands all five operations and a partial parses to explicit undefined entries (wants z.partialRecord) #14365」 was never taken (git log -S partialRecord); b3a63d32c made it moot by retiring the record, which the other half of the same line now cites.
• import-integration.test.ts:1043 (#14026): not deleted, TRANSFERRED. The web endpoint answers 302 to Re-raise of #4375 with the downstream confirmation it asked for: the console import wizard never sends mappingName and hardcodes writeMode:"insert", so a named mapping's upsert can never reach a user objectui#10102, the REST read follows the redirect, and the board enumeration does not list it, so the census and the supplementary reading both class it allocated-but-absent. The line says how an issue was raised; no commit decides that, so form C has nothing to cite.

String sites kept as tokens (127). 126 are test titles and test-code strings in 41 files. One is a non-test string: the note field of the REST route ledger's GET /api/v1/meta/object/:name/state/:field row at rest-route-ledger.ts:290, which ends 「(#10179)」 (see Acceptance notes).

Mechanical guard: no code token moves

The check compares the TypeScript parser's leaf tokens (TypeScript 6.0.3, JSDoc nodes excluded, comments being trivia) of each touched file at base a186aea996 against the working tree at 93e4d69ba6, over all 85 touched .ts files. Controls mutate the head text in memory only, so nothing on disk moved for them.

• Real run: 272,653 base tokens, 0 files with a token change (exit 0).
• Comment-insertion control (error-response.ts): 0 files changed (exit 0).
• Code-insertion positive control (a declaration in the same file): DIFFER at token 0 (exit 1).
• String positive control (the first string literal past offset 2000 of the same file, one character added inside it): DIFFER at token 26 (exit 1).

Line balance: every touched file is +N/−N (451/451), and every line count is equal at base and head. A raw scan of the 86 changed files for control bytes finds none (its positive control on a scratch file with a U+0001 byte matches).

Changeset

This change ships bytes, so a patch changeset for @objectstack/rest is included, in PR #20624's form and level. It says only that the provenance comments were re-anchored.

Measured on the built package: files[] is dist, README.md and CHANGELOG.md. After pnpm --filter @objectstack/rest build, the rewritten docblocks reach dist: for example 53cbad9f7 appears 4 times in dist/index.d.ts, and 26f3588fb 8 times and b3a63d32c 5 times in dist/index.js. The positive control, the unchanged sentence 「It was VALIDATE-ONLY from #11637」 of the same rest-server.ts docblock whose first line now reads 「[commit 53cbad9] The parsed output is CONSUMED」, is in dist/index.d.ts beside it; a negative control phrase appears nowhere.

Gates (head 93e4d69ba6)

This host has no flock, so os-verify-lock.sh ran in its declared unlocked mode. Its disclosure, verbatim, from each locked run at this head:

os-verify-lock: VERDICT command-exit 0 · UNLOCKED (declared) · no usable `flock` on this host, so the shared verify lock was NEVER taken and NOTHING was serialized · ran 47s · declare it in the PR body · pnpm --filter '@objectstack/rest...' build
os-verify-lock: VERDICT command-exit 0 · UNLOCKED (declared) · no usable `flock` on this host, so the shared verify lock was NEVER taken and NOTHING was serialized · ran 102s (1m42s) · declare it in the PR body · pnpm exec turbo run build --filter='./packages/*' --filter='./packages/*/*' --concurrency=4
os-verify-lock: VERDICT command-exit 0 · UNLOCKED (declared) · no usable `flock` on this host, so the shared verify lock was NEVER taken and NOTHING was serialized · ran 76s (1m16s) · declare it in the PR body · pnpm --filter @objectstack/rest exec vitest run --project local --maxWorkers=2
os-verify-lock: VERDICT command-exit 0 · UNLOCKED (declared) · no usable `flock` on this host, so the shared verify lock was NEVER taken and NOTHING was serialized · ran 2s · declare it in the PR body · pnpm --filter @objectstack/rest exec vitest run --project repo --maxWorkers=2
os-verify-lock: VERDICT command-exit 0 · UNLOCKED (declared) · no usable `flock` on this host, so the shared verify lock was NEVER taken and NOTHING was serialized · ran 9s · declare it in the PR body · pnpm --filter @objectstack/rest typecheck

The branch merged origin/main once (93e4d69ba6, merging 542670da6d) before these runs, as the dispatch orders; origin/main has not moved since (read at 11:19Z). The merge brought PR #20626 and PR #20587 and touched none of this diff's files. The dependency closure was built first (pnpm --filter '@objectstack/rest...' build, 26 packages), then the whole workspace (turbo run build --filter='./packages/*' --filter='./packages/*/*', 71 tasks, 71 successful).

• Tests: vitest run --project local: 227 files, 4,382 tests passed, 50 skipped. --project repo (which holds the touched meta-state-route-doc-spelling.test.ts): 1 file, 8 tests passed. Together they are all 228 test files of the package, so every touched test file ran.
• Typecheck: pnpm --filter @objectstack/rest typecheck exits 0. tsc --listFiles counts 28 src files (no tests) under tsconfig.json and all 228 test files under tsconfig.test.json, which check:test-typecheck judges: 0 files, 0 errors, 0 pinned signatures in the ledger.
• Lint: the repo-wide pnpm lint (eslint . --no-inline-config) exits 0 at 93e4d69ba6 (2026-09-29T11:19:30Z to 11:20:00Z). Not narrowed.
• Citation judging: node scripts/check-issue-citations.mjs --base origin/main exits 0: 19 citations judged across 14 files (18 resolve, 1 resolves as a pull request). These are the live numbers that stay on rewritten lines. It defers *.test.ts, so the added-minus-removed count over the whole diff covers the rest: 0 numbers added.
• Derived gates: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands at 93e4d69ba6 derived 68 families. All 68 exit 0, and --ran over a record carrying each exit code reads 「68 derived, 68 run, 0 NOT-MEASURED, 0 UNRUN」 (a derived zero).
  • check:dual-build-cjs-loads and check:type-check-debt first exited 3 (PREREQUISITE NOT MET, nothing measured) on the closure-only build; after the whole-workspace build both exited 0.
  • Among them: check:doc-authoring, check:nul-bytes, check:rest-log-declared, check:route-envelope, check:system-context-census (106 elevation read sites, the page's 102 symbols held) and check:issue-citations (self-test).
• Artifact rosters: 33 of the 36 non-self-test roster rows exit 0 at 93e4d69ba6, check-changeset-fixed (the one whose roster sits under .changeset/) and check:route-ledger-census among them. The other three, check-closing-target-claim, check-partof-closing-keyword and check-single-claim-paths, answer 「NOT WIRED」 (exit 2) without a pull request's context; they are run against this PR once it exists and reported on the card.

Hypotheses (measured first)

• H0 holds. The filtered census answers 191 dead sites at a186aea996 (186 lines, 14 files, 51 numbers), equal to the card's count at f11b5f20a2: no net drift, although PR fix(rest)!: /import reads a date, datetime or time cell only in ISO 8601, the export shape or a year-first date, on a real day, with a four-digit year (#20534) #20601 (merged as eb4b17c346, before this base) touches four files in packages/rest.
• H1 holds. After the rewrite the filtered census answers 0. The supplementary reading leaves 3 test-comment sites, the three listed above: an open decision, an untaken option and a transferred issue, none with a deciding commit. No site was held for an open PR: the claim's read and this stage's two reads of the open PRs' file lists (10:27:35Z, 7 open PRs; 11:30:34Z, 8 open PRs) found none touching packages/rest.
• H2 holds, by the token guard. A comment-stripped comparison of every touched file (the parser's leaf tokens, JSDoc excluded) is empty, and its code and string controls fire. The emitted dist is not byte-identical, because the docblocks ship, which is why the changeset is patch.

Acceptance notes

• Form D, not touched here. 127 dead numbers stand inside string literals: 126 in test titles and test-code strings, and one in the note of the REST route ledger's legal-next-state row (rest-route-ledger.ts:290, 「([finding] The legacy dispatcher /meta branch still matches the plural objects literal after step ② retires the REST registration #10179)」), which is ledger data, not an author-shown refusal. Ruling D (no number, the lesson in words) is a string change outside this comment-only scope; the card already carries a form-D stage for the lane.
• A transferred issue among the 404s. #14026 answers 302 to Re-raise of #4375 with the downstream confirmation it asked for: the console import wizard never sends mappingName and hardcodes writeMode:"insert", so a named mapping's upsert can never reach a user objectui#10102 on its web endpoint. The census classes it allocated-but-absent (deleted and transferred are only told apart under --probe-cause), and scripts/check-issue-citations.mjs's header says the transferred arm has no positive specimen on this tree; this is one. Noted, not filed.
• The grammar does not read a slash-joined number. CITATION_RE refuses a # preceded by /, so the second number of #A/#B is never judged. In packages/rest/src six such dead numbers stood at 10 comment sites, all rewritten here; one more, #14389 in #14095/#14389, stands inside a string (error-response-structured-arm-door-parity.test.ts:187) and is kept. The same shape PR docs(runtime): re-anchor the dead tracker citations in packages/runtime/src to the commits that decided them #20624 and PR docs(lint): re-anchor the dead tracker citations in packages/lint/src to the commits that decided them #20612 reported. Noted, not filed.
• Outside the scope and the census surface. packages/rest/vitest.config.ts:21 cites [finding] vitest 的 --project 过滤器落空即静默成功 —— 点名一个 integration 文件跑 --project unit,报它是通过的文件、执行零个用例,并把它从文件计数里减掉 #17853, which answers 404; packages/rest/test-typecheck-debt.json, written by gen:test-typecheck-debt, carries [finding] The test-typecheck EXACT ratchet is a per-file COUNT, so it stays green through a wholesale substitution of error identity — measured by ablation, not argued #13470, The 2 remaining ledgered TS2345 in packages/rest are hand-built IHttpResponse literals — they were masked by the request literals, not absent #13454, A typed IHttpRequest test builder — 4 ledgered TS2345 in packages/rest are hand-built request literals, and the only in-repo alternative is as any #13377 and exceljs 4.4.0 ships its own module-local Buffer interface, so no Node Buffer can be passed to Workbook.xlsx.load — 6 sites pay it with as any, the 7th is a ledgered error #13378 in its prose, all 404. Neither is under src/**. The other numbers in vitest.config.ts, tsconfig.json and tsconfig.test.json answer 200.
• Two comments stale on their own, not touched. The anchor research found rest-server.ts's api docblock near :1115 and the 「zero read sites」 sentence at :4092 both overtaken by 80153f5a4, whose own acceptance notes record it. This PR re-anchors their citations and leaves their claims alone.
• An attribution corrected by the anchor. rest-server.ts:4092 credited its zero-read-site count to 「the [finding] Ten declared RestServerConfig keys are normalized by RestServer and read by nothing — routes.* entirely, crud.patterns / objectParamStyle, metadata.cacheTtl / endpoints.schema, batch.defaultAtomic / operations.upsertMany (ADR-0049 enforce-or-remove candidates) #14369 census」, which (a3d5724c8) excluded api; it now cites 53cbad9f7, the commit that measured it.
• Base. One merge of origin/main (93e4d69ba6) before the --base origin/main run, as the dispatch orders.

Deviations

• Ten sites beyond the census's read grammar carry a slash-joined dead number and are rewritten; six more lines are the other half of a rewritten sentence (listed under What changed).
• The whole-workspace build ran with --concurrency=4, not 2, to stay inside the ten-minute foreground cap on this host; it took 1m42s.
• Anchor research for 33 of the 77 numbers ran in three read-only research subagents; every proposal was verified here against the commit's message or diff, and the wording of each changed line was reviewed and corrected by hand in a second pass.
• Commit trailers are AGENTS.md's model-free pair (Claude-Session plus Co-authored-by: Claude), and the pre-push trailer check passed on every push. The merge commit carries git's default message.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/rest, touching 27 documentable anchor(s). ⚠️ 7 changed file(s) yielded no anchor (packages/rest/src/http-request-test-builder.ts, packages/rest/src/http-response-test-builder.ts, packages/rest/src/import-coerce.ts, …), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

11 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/client-sdk.mdx (via data.batch (sdk, the route ledger binds it to POST /api/v1/data/:object/batch, selected by route anchor /data/:object/batch), /:object/import (route, bridged from symbol runImport — its route source's handler names it; bridged from symbol translateMetaItem — its route source's handler names it))
• content/docs/api/data-api.mdx (via /data/:object/batch (route, a path literal in a comment on a changed line))
• content/docs/api/wire-format.mdx (via /:object/import (route, bridged from symbol runImport — its route source's handler names it; bridged from symbol translateMetaItem — its route source's handler names it), /data/:object/batch (route, a path literal in a comment on a changed line))
• content/docs/data-modeling/fields.mdx (via /:object/import (route, bridged from symbol runImport — its route source's handler names it; bridged from symbol translateMetaItem — its route source's handler names it))
• content/docs/data-modeling/import-mappings.mdx (via /:object/import (route, bridged from symbol runImport — its route source's handler names it; bridged from symbol translateMetaItem — its route source's handler names it), /:object/import/jobs (route, bridged from symbol runImport — its route source's handler names it; bridged from symbol translateMetaItem — its route source's handler names it))
• content/docs/permissions/authentication.mdx (via createRestApiPlugin (symbol, a top-level function))
• content/docs/permissions/system-context.mdx (via refusePackageRequest (symbol, a top-level function), registerExternalDatasourceRoutes (symbol, a top-level function))
• content/docs/plugins/packages.mdx (via createRestApiPlugin (symbol, a top-level function))
• content/docs/protocol/kernel/error-handling.mdx (via resolveErrorResponse (symbol, a top-level function), structuredCodeAnswer (symbol, a top-level function))
• content/docs/protocol/kernel/http-protocol.mdx (via /data/:object/batch (route, a path literal in a comment on a changed line))
• content/docs/protocol/objectql/state-machine.mdx (via /:object/import (route, bridged from symbol runImport — its route source's handler names it; bridged from symbol translateMetaItem — its route source's handler names it), /:object/import/jobs (route, bridged from symbol runImport — its route source's handler names it; bridged from symbol translateMetaItem — its route source's handler names it))

⛔ 6 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/implementation-status.mdx (via RestServer (symbol, a top-level class), registerDiscoveryEndpoints (symbol, a method of class RestServer), /data/:object/batch (route, a path literal in a comment on a changed line))
• content/docs/releases/v12.mdx (via RestServer (symbol, a top-level class), /:object/import (route, bridged from symbol runImport — its route source's handler names it; bridged from symbol translateMetaItem — its route source's handler names it))
• content/docs/releases/v16.mdx (via RestServer (symbol, a top-level class), data.batch (sdk, the route ledger binds it to POST /api/v1/data/:object/batch, selected by route anchor /data/:object/batch))
• content/docs/releases/v17/17-3.mdx (via RestServer (symbol, a top-level class), /api/v1/meta/:type/:section/:name (route, a path literal in a comment in REST_ROUTE_LEDGER))
• content/docs/releases/v17/17-4.mdx (via /data/:object/batch (route, a path literal in a comment on a changed line))
• content/docs/releases/v17/17-5.mdx (via RestServer (symbol, a top-level class))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 7 changed file(s) yielded no anchor (packages/rest/src/http-request-test-builder.ts, packages/rest/src/http-response-test-builder.ts, packages/rest/src/import-coerce.ts, …) — pages documenting those are invisible to this run
• 1 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 15 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 542670da6dfc17d3a2ec919139afb7caae018d02 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from ac055adb44b962e15291d7abcb5366a05d869ce9 — the merge of head 93e4d69ba6258a0c873d541b56184fc40517a04e into base 542670da6dfc17d3a2ec919139afb7caae018d02, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin ac055adb44b962e15291d7abcb5366a05d869ce9 && git checkout ac055adb44b962e15291d7abcb5366a05d869ce9
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 542670da6dfc17d3a2ec919139afb7caae018d02 93e4d69ba6258a0c873d541b56184fc40517a04e && git checkout -B drift-repro 542670da6dfc17d3a2ec919139afb7caae018d02 && git merge --no-ff 93e4d69ba6258a0c873d541b56184fc40517a04e

node scripts/docs-audit/affected-docs.mjs --json 542670da6dfc17d3a2ec919139afb7caae018d02

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 542670da6dfc17d3a2ec919139afb7caae018d02 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 93e4d69ba6258a0c873d541b56184fc40517a04e
Local-runs: none

Inputs, and nothing else: card #20594's body and all 7 comments (claim 5886012266, os-dev-report 5887542107, ACCEPT 5888034755, the domain:services pointer 5888293145, landing 5888333088, claim 5888335266, os-dev-report 5889488141); PR #20632's body; its file list (pulls/20632/files?per_page=100: page 1 holds 86 entries, page 2 holds 0, so the list is complete); the net diff against main (application/vnd.github.diff, 4,055 lines, 86 diff --git headers); the check-runs on the head. Every read went through gh api (REST). Two scratch scripts in the record's own directory parsed the saved diff text (pair classification, number and sha extraction, a backtick heuristic). Nothing was checked out, built, run or re-run; the three "left" sites were read at the head through contents/...?ref=93e4d69ba6.

① Derived judgments

(1) Comment-only — right. The diff is 462 removed/added pairs: 11 are the new changeset, the other 451 are in the 85 files under packages/rest/src. Every one of the 451 removed and 451 added lines begins, after whitespace, with //, * or /**: 451 pure comment lines, 0 trailing comments on a code line, 0 unpaired lines, 0 lines outside a comment. The whole of rest-server.ts's diff (107 pairs in 90 hunks) and the whole of rest-route-ledger.ts's diff (5 pairs in 3 hunks) were read line by line: every changed line is a // or * line, and the ledger's note: strings, including (#10179) on the legal-next-state row and the pre-#7526 / #12038 note at :293, stand in the hunks as context, unchanged. No code token, string literal, error message, identifier, describe or it title, or assertion moved anywhere in the diff. The backtick heuristic (an odd count in the hunk before a changed line) flagged three sites, package-door-user-message.test.ts:20, rest-server-meta-read-org-scope.test.ts:799 and rest-server.ts:1453, and each is a docblock code fence or a backticked span split across comment lines, not a template literal. Accept set: unchanged. Public surface: unchanged in kind; only docblock prose that reaches dist moves.

(2) Anchors — right; no wrong or unsupported anchor found. 70 distinct shas stand on added lines; one of them, 3ecb7dc1a, also stood on the removed line at rest-14078-invalid-date-total-arm.test.ts:19, so it is not new. All 70 were probed: commits/SHA answers each, each has exactly one parent, and compare/SHA...main answers ahead with behind_by 0 for every one, so all 70 are on main. The subject, message and file list of 42 anchors were read (patches grepped for three), against sites whose rewritten text was read in the diff. Files whose changed lines were read in full: rest-server.ts, rest-route-ledger.ts, error-response.ts, external-datasource-routes.ts, import-runner.ts, import-coerce.ts, query-multiplicity.ts, package-routes.ts, index.ts, log.ts, rest-api-plugin.ts, http-request-test-builder.ts, http-response-test-builder.ts, xlsx-test-loader.ts, and the tests error-response-structured-arm-door-parity, error-response-sandbox-arm-message, package-door-execctx-fault-reachability, package-door-user-message, ui-view-route-identity.measurement, ui-view-route-tenancy.measurement, rest-sub-config-parse-not-cast, rest-approvals-wire-codes, rest-server-meta-read-org-scope, discovery-schema-conformance, objectql-slot-consumer-census, meta-state-route-engine-outage, rest-14078-invalid-date-total-arm (27 files, 12 of them tests). Sites judged, each supported by its commit:

• rest-server.ts :5, :1374, :1426, :3120 (6a180e42d: "fail loud when a permission-store read fails", the 2026-08-30 ruling verbatim in its message); :114, :235, :239, :282, :3771, :5875, :6474, :6601, :6970, :7144, :7313, :7723 (2a29caa53: records environmentId as transport-level and retires the door casts, PR feat(spec): declare previewDrafts/state on meta-read requests; record environmentId as transport-level; retire REST door casts (#9741) #9804 for [finding] Meta-read request schemas still omit previewDrafts / state / environmentId, so the REST call-site casts survive the organizationId catch-up #9741); :366 (8664a2c99: extracts the ADR-0112 prologue into error-response.ts and log.ts); :908 (3ecb7dc1a: PR test(driver-sql): measure what each dialect materialises for a datetime JS cannot hold (#14078) #14409's own squash, "measure what each dialect materialises for a datetime JS cannot hold"); :1115, :1213, :4065, :4080, :4151, :4177, :4183, :4186 (53cbad9f7: consumes the parsed api sub-config; "eleven" literals and the 14-key re-measure are in its message); :1169, :4245, :4252, :4275, :4287, :4293 (b3a63d32c: retires the ten inert RestServerConfig keys, "[finding] Ten declared RestServerConfig keys are normalized by RestServer and read by nothing — routes.* entirely, crud.patterns / objectParamStyle, metadata.cacheTtl / endpoints.schema, batch.defaultAtomic / operations.upsertMany (ADR-0049 enforce-or-remove candidates) #14369 census" in its message) and :1172 (a3d5724c8: the liveness ledger for the four sub-objects); :2236, :2758, :3097, :8519, :8556, :8582 (cc837dbfe: the ownership gate at GET /ui/view/:object/:type, option C of the 2026-08-30 ruling); :2247-2248 (889ec5b42 is PR test(rest): measure identity resolution at GET /ui/view/:object/:type — seam, downstream producer, and the ratchet blind spot behind it #13244, the identity measurement, and 3d10755f0 is PR test(rest): drive the tenancy axis of GET /ui/view/:object/:type — an anonymous caller can name another environment and receive its UI view #13258, the tenancy measurement — the two PRs the old line named); :2676, :3615, :3820, :6116, :6220, :6229, :6372, :6427 (83a3b1f2e: PR fix(rest): :type 段每 handler 归一一次,复数拼写不再绕过 §6.7 audience 门禁 (#6241) #6348 for GET /meta/books/:name(复数拼写)绕过 ADR-0046 §6.7 audience 门禁 —— 缓存分支的 doc/book 排除写的是字面量比较 #6241, whose message says the cached branch excluded doc/book by literal comparison eight days after /meta 的每个按类型闸门只在单数拼写下生效 —— 复数(PD #3 的规范拼写)整条绕过,含 book audience、app RBAC、dashboard 能力门 #3984); :2969, :3043, :3070 (f586f1a89: the single assembleExecutionContext, PR refactor(core,runtime,rest): one ExecutionContext assembler, two named anonymous entries (#6216) #7259 for finding: ExecutionContext 在 dispatcher / REST / share-link 三处独立组装 —— 收敛为单一共享装配函数前,先裁决匿名面分歧 #6216); :4528, :4540, :4542, :5067 (98ea3443f is PR fix(runtime): derive /health and discovery version instead of a hardcoded '1.0.0' literal #11242 for [finding] /api/v1/health reports a hardcoded version: '1.0.0' — a field that exists and lies, so no consumer can use it for artifact identity #10993, 376c70f98 is PR fix(metadata-protocol): derive discovery version instead of the hardcoded '1.0' literal #11297 for [finding] a THIRD hardcoded discovery version literal — getDiscovery() in packages/metadata-protocol/src/protocol.ts, identical defect to #10993, different producer/package #11235 — the two halves of the old #11235/#11242; the live [finding] /api/v1/health reports a hardcoded version: '1.0.0' — a field that exists and lies, so no consumer can use it for artifact identity #10993 and @objectstack/rest overwrites discovery version with config.api.version ('v1') — the URL path segment served in the schema's "System Identity" field, masking the producer entirely #11292 stay); :5453, :5461, :5512, :6019 (96326040f: the read gate inside getMetaItems, Where does the allowOrgOverride read gate belong for metadata sweeps that read MORE THAN ONE type per request? getMetaItems applies none of its own #14683 in its message); :5474 (abf9101f1); :5578, :6944, :7133, :7305, :7701, :7851, :8005, :8329, :8457 (26f3588fb: "decide /meta org scope on the folded type, not the raw URL spelling", Fixes #10340); :11134, :11912 (79c46da90: the userMessage channel, PR feat(contract): a hook refusal can mark its message user-facing — the userMessage producer-side opt-in channel #9992 for contract: a hook refusal has no way to mark its message user-facing — the console's 403 substitution (ruled in #3821) needs a producer-side opt-in channel #9934); :12552 (5b3ff63cc: registers READ_BACK_FAILED as a named wire row).
• rest-server.ts:4092, the re-attribution the dev flagged: a3d5724c8's ledger text says RestApiConfigSchema (api) "is deliberately not enrolled", and 53cbad9f7's changeset says "the repo has no other read site for either key", so crediting the zero-read-site count to 53cbad9f7 rather than to [finding] Ten declared RestServerConfig keys are normalized by RestServer and read by nothing — routes.* entirely, crud.patterns / objectParamStyle, metadata.cacheTtl / endpoints.schema, batch.defaultAtomic / operations.upsertMany (ADR-0049 enforce-or-remove candidates) #14369's anchor is right.
• rest-route-ledger.ts :281, :283, :295 (7986d973f: PR Retire compound-name metadata addressing — un-mount the three :section arities and unify SDK URL spelling (#12176 stage 3) #12378, "Ban / in metadata item names — retire compound-name addressing (maintainer-ruled direction): census, migration surface, staged plan #12176 stage 3" in its subject) and :299, :308 (311433f6b: PR Declare the metadata item-name grammar in spec and refuse it loudly at the publish door (#12176 stage 1) #12244, "stage 1", D1: declare the metadata item-name grammar in spec and refuse it loudly at the publish door — dotted qualified form becomes enforced (#12176 stage 1) #12194 in its message).
• error-response.ts :7 (8664a2c99); :307, :783, :848, :904, :960, :980, :986, :1220, :1256, :1286, :2127, :2141, :2145, :2197, :2398, :2410 (6d178a408: its message names "Contract-review conditions 2, 4(A), 5 and 7 on Routes exiting through handleRouteError answer the engine's DUPLICATE_RECORD envelope from resolveErrorResponse's .status passthrough — field and object dropped, mapDataError's structured 409 arms never consulted #14541" and "3, 4, 5 and 6", so "contract-review condition 4" and "(condition 7)" are its own words; it created the parity file); :315, :327, :803, :1277, :1378, :2103, :2106, :2116 (cf6e0a193: a sandboxed crash outranks the declared-code arm, "batch chore(deps)(deps): bump zod from 3.25.76 to 4.3.5 #27" in its message); :790, :876, :982, :997, :1050 (10220a7bf: the engine's DUPLICATE_RECORD envelope answered as 409 UNIQUE_VIOLATION); :876, :978, :990 (65846bc46: "Maintainer ruling A (2026-09-03)" in its message); :489, :1322, :1398, :2280 (cad8b42f0: a sandboxed refusal's declared code at every status, rest: the /api/v1/data write path renders code only for 400 — a 409 refusal reaches the client with the status but no machine-readable code #10345's fix); :1384 (8f266f1cd: PR rest: serve a sandboxed body's declared HTTP status on /api/v1/data #10007 for [rest] A sandboxed hook body that declares its own HTTP status is answered 400 on /api/v1/data — the sandbox unwrap outranks the declared-status passthrough #9967); :1486 (64cd01082: PR fix(runtime,types)!: /analytics/query 不再回显 RLS 策略字段名 —— 声明式 server-fault withhold 提升为两个边界共享 (#5811) #6122's own squash); :2051 (30b1c636a); :282 (1c7adc73d); :673, :685, :2281 (79c46da90).
• external-datasource-routes.ts :76, :153, :344, :365, :502 (e634ecf6a: PR fix(rest): POST /datasources/:name/external/validate does URL-scoped work #10960 for POST /datasources/:name/external/validate introspects every federated datasource, not only :name — the route filters validateAll() output after the work is done #10537, scopes POST /external/validate to the URL's datasource) and :129, :142, :145, :228, :274, :280, :497 (6ce58a735: "Ruled on POST /datasources/:name/external/validate is the one federation route the #9901 ruling does not name — it stays authentication-only while its four siblings now require a capability #10255 (2026-08-20, option A)", Fixes #10255; the live security(rest): the external-datasource federation family still admits any authenticated caller, while its declared admin twin now requires a capability #9901 stays on :228).
• import-runner.ts :37, :153, :521 and import-coerce.ts:698 (18189983d: PR feat(spec,objectql,metadata-protocol): validate-only data operation — DataProtocol.validateData #6474 for [spec] DataProtocol 新增 validate-only 数据校验操作 —— #4633 裁 D 的契约半边(spec 先行) #6037, "Import dry run green-lights a row the write then rejects: structured value shapes (address / location) are not pre-checked #4633 ruling D" in its message); import-runner.ts :328, :335 (65846bc46); query-multiplicity.ts :58, :96, :133 and index.ts:52 (293476148: PR fix(rest): refuse a repeated ?version= on GET/DELETE /packages/:id instead of handing the array to PackageService (#6307) #6895 for GET/DELETE /packages/:id 把重复的 ?version= 查询参数(string[])原样交给 PackageService #6307, refuses a repeated ?version=); package-routes.ts :55 (6a180e42d), :210, :228 (79c46da90); rest-api-plugin.ts:551 (fec784863, subject read in the probe: one base for the direct mounts); log.ts:6 (8664a2c99); http-request-test-builder.ts :4, :35 and http-response-test-builder.ts:29 (e10cf3444: the typed request builder, PR test(rest): state IHttpRequest once, in a typed request test builder #13466 for A typed IHttpRequest test builder — 4 ledgered TS2345 in packages/rest are hand-built request literals, and the only in-repo alternative is as any #13377); http-response-test-builder.ts:4 (7ad57e17a: PR fix(rest): state the four IHttpResponse members once, in a test-layer builder #14358 for The 2 remaining ledgered TS2345 in packages/rest are hand-built IHttpResponse literals — they were masked by the request literals, not absent #13454); xlsx-test-loader.ts :5, :38 (82faea03f: PR fix(rest): state the exceljs Buffer-shim assertion once, in a typed test loader #13425 for exceljs 4.4.0 ships its own module-local Buffer interface, so no Node Buffer can be passed to Workbook.xlsx.load — 6 sites pay it with as any, the 7th is a ledgered error #13378).
• Tests: error-response-structured-arm-door-parity.test.ts :4, :495, :520, :534 (6d178a408), :49, :483, :490, :515, :569 (1c7adc73d: PR fix(rest): the by-id /data door stops shipping the QuickJS wrapper out of a declared-code arm #15065 for rest: classifyDataError's structured-code arms ship the QuickJS debug wrapper as error for a sandboxed producer — the mirror of #11588, on the door #11588 did not touch #14704; its message says the parity case is FLIPPED from ACCEPTED DIVERGENCE to CONVERGED), :527, :568, :569, :577, :590, :600, :624, :654 (cf6e0a193); error-response-sandbox-arm-message.test.ts :4, :237, :259, :340 (1c7adc73d; :340 keeps the commit in an editorial bracket inside the verbatim ruling quote), :24, :50, :425 (6d178a408), :39, :66, :236 (cf6e0a193); package-door-execctx-fault-reachability.test.ts :4, :95, :544, :677, :764 (43028a8f8: PR test(rest): measure what a swallowed exec-context resolution reaches, and what the package door answers #13282, the commit that created this file, so "As first written (commit 43028a8)" and "first measured by commit 43028a8" are true of it), :32, :43, :76, :93, :97, :147, :342, :352, :361, :423, :438, :442, :458, :638 (6a180e42d), :108, :400, :761, :809, :819 (add6a1b1c: the sync-throw seam repair); ui-view-route-identity.measurement.test.ts :4, :33, :88, :374, :404 (889ec5b42) and :23, :30 (4801296e7: PR test(rest): census what an absent execution context means at all 72 resolveExecCtx consumers #13213, the 72-consumer census); ui-view-route-tenancy.measurement.test.ts :4 (3d10755f0) and :26, :68, :135, :778 (889ec5b42 for the old PR #13244); rest-sub-config-parse-not-cast.test.ts :43 (53cbad9f7), :48 (a3d5724c8), :47, :144, :155, :213, :232, :248, :302, :321, :325 (b3a63d32c); rest-approvals-wire-codes.test.ts :4, :7, :32 (30b1c636a: "register the 9 unregistered REST wire codes the rest emits two error codes outside the closed ADR-0112 vocabulary — FIELD_VISIBILITY_UNRESOLVED has no ledger entry and no test anywhere #8885 sweep found"), :37, :219, :240 (226e72443: "pin the six approvals wire-code rows with no live emission"), :194 (5b3ff63cc); rest-server-meta-read-org-scope.test.ts :598, :626, :637, :711 (abf9101f1: PR docs(rest): the ?type= diagnostics comment describes today's tree, and names the inner gate it sits above #15619 for rest/meta: the ?type= diagnostics call site still tells the next reader that getMetaItems applies no registry gate — true when it was written, false since #14767 #15034; its patch carries "measured: 6 failed / 24 passed" and "30/30 GREEN", the two readings the rewritten lines credit to it) and :598, :714, :799, :977 (96326040f); discovery-schema-conformance.test.ts:344 (98ea3443f, 376c70f98); objectql-slot-consumer-census.test.ts :4 and meta-state-route-engine-outage.test.ts :10, :409 (58f60e37e: "Part of rest-api-plugin.ts engine slot: run the per-consumer mechanical check, then repair the provider half — the one slot of twelve whose consumer half has landed (split out of #14251) #18546", the mechanical census); meta-state-route-engine-outage.test.ts :76, :261 and objectql-slot-consumer-census.test.ts :43, :330 (add6a1b1c; the widened table cell has its padding trimmed and its sibling rows untouched); rest-14078-invalid-date-total-arm.test.ts:19 (3ecb7dc1a); package-door-user-message.test.ts:20 (79c46da90).
  Where a number is the PR number of its own anchor the subject confirms it: fix(runtime,types)!: /analytics/query 不再回显 RLS 策略字段名 —— 声明式 server-fault withhold 提升为两个边界共享 (#5811) #6122, feat(spec,objectql,metadata-protocol): validate-only data operation — DataProtocol.validateData #6474, fix(runtime): derive /health and discovery version instead of a hardcoded '1.0.0' literal #11242, test(rest): census what an absent execution context means at all 72 resolveExecCtx consumers #13213, test(rest): measure identity resolution at GET /ui/view/:object/:type — seam, downstream producer, and the ratchet blind spot behind it #13244, test(rest): drive the tenancy axis of GET /ui/view/:object/:type — an anonymous caller can name another environment and receive its UI view #13258, test(rest): measure what a swallowed exec-context resolution reaches, and what the package door answers #13282, test(driver-sql): measure what each dialect materialises for a datetime JS cannot hold (#14078) #14409, fix(rest): the by-id /data door stops shipping the QuickJS wrapper out of a declared-code arm #15065 among those read. Form C's "in its own words" holds: a line that said a number ruled now says what the commit did with the ruling ("the ruling commit cf6e0a1 implemented", "landed as commit 6ce58a7"), and no rewritten line attributes a ruling to a commit.

(3) Tracker numbers — right. 98 distinct numbers stand on removed lines and 24 on added lines. 74 are dropped (on a removed line, on no added line), and every one of the 74 answers 404 on repos/objectstack-ai/objectstack/issues/N. Of the 24 kept, 23 answer 200 (#3984, #4633, #4857, #5822, #6551, #6877, #7543, #9901, #10993, #11063, #11095, #11292, #11297, #11588, #11637, #11712, #12005, #12502, #13160, #13476, #13906, #14561, #17551 — issues or pulls), and the 24th, #14365, answers 404 and is the deliberately left site at rest-sub-config-parse-not-cast.test.ts:321, whose other half now cites b3a63d32c. No number is net-added, and in none of the 451 pairs does the added line carry a number its removed line did not. No 200-answering number was removed or rewritten. The 74 dropped numbers are the PR body's 74 rewritten numbers; with the 3 left, 77.

(4) Line counts — right. From the file list: 85 modified files, each with additions equal to deletions (451 and 451 in total), plus one added file, .changeset/rest-provenance-anchors.md, +11/−0. No file is renamed or removed. Every touched file keeps its line count, so no line citation into these files moves.

The three sites left — right. At the head, meta-object-owd-gate.test.ts:516 still says "whether it should stay is #8641's question" (REST 404; an open decision that nothing decided); rest-sub-config-parse-not-cast.test.ts:321 keeps "deferred to #14365" (REST 404; an option never taken) with b3a63d32c on the same line; import-integration.test.ts:1043 keeps "which is exactly how #14026 was raised", and issues/14026 answers 200 after the REST redirect to objectstack-ai/objectui issue 10102, so it is transferred, not deleted. Form C cites the commit that decided what a line describes; none of these three lines describes a decided thing, so leaving them is the ruling's form, not a gap. The first and third files are not in the diff at all.

Check-runs on the head. First read 2026-09-29T11:42:55Z: 31 check-runs, 18 success, 3 skipped, 10 in progress, 0 failure. Second read at 12:05:15Z, at the write: 34 check-runs, newest per name, all completed — 31 success, 3 skipped (Build Docs, Console Pin Gate, Packed-tarball smoke (opt-in)), 0 failure, 0 in progress. Check Changeset, Lint & Repo Gates, Part-of PR must not also close its card, The card this PR closes must claim this branch, No other open PR may claim the same issue, No other open PR may claim the same single-writer path, all six Test Core shards, all three Dogfood Regression Gate shards, Temporal Conformance (live PG + MySQL) and the four Type Check runs are success. Those conclusions are the gate verdicts.

② Semver level

.changeset/rest-provenance-anchors.md grades @objectstack/rest patch and says comments only, "no route, error code, refusal text, type, export or runtime behaviour changes". The diff publishes exactly that: docblocks on exported symbols change (rest-server.ts, error-response.ts, index.ts, query-multiplicity.ts, import-runner.ts, external-datasource-routes.ts, package-routes.ts, rest-api-plugin.ts, log.ts), so the built dist is not byte-identical and a bump is owed; nothing in the accept set, the wire, the types or the exports moves, so patch is both the floor and the ceiling. It is the level and form stage 1 carried for @objectstack/runtime (PR #20624, ACCEPT 5888034755). Check Changeset is success on the head. Not skip-changeset, and rightly not: the prose ships.

Clause-②: no — right. No accept-set widening, no public-surface change, no behaviour change; the PR body's line-initial Clause-②: no matches the diff.

③ Boundary flags

• open_questions in os-dev-report 5889488141: empty. Nothing to answer.
• Dev deviation, ten slash-joined sites and six other-half lines: verified. The ten are comment lines whose second number the citation grammar does not read (for example rest-server.ts :4528, :4540, :5067, external-datasource-routes.ts:228, discovery-schema-conformance.test.ts:343-344), rewritten with the live half kept. The six other-half lines (discovery-schema-conformance.test.ts:343, package-door-16019-raw-statement-fault-code.test.ts:51, error-response.ts:1485, error-response-structured-arm-door-parity.test.ts:463, rest-hook-script-fault-envelope.test.ts:331, rest-server.ts:908) are all comment lines and carry no new number. Right.
• Dev deviation, rest-server.ts:4092 anchored to 53cbad9f7 rather than to [finding] Ten declared RestServerConfig keys are normalized by RestServer and read by nothing — routes.* entirely, crud.patterns / objectParamStyle, metadata.cacheTtl / endpoints.schema, batch.defaultAtomic / operations.upsertMany (ADR-0049 enforce-or-remove candidates) #14369's anchor: supported by both commits' own text (①). Right.
• Dev deviation, anchor research in read-only subagents for 33 numbers: this record's own sample of 42 anchors across 27 files found no wrong or unsupported anchor. Nothing to escalate.
• Dev deviations on turbo --concurrency=4, the commit-trailer pair and the worktree removal describe local verification and hygiene, not the diff; commits and trailers are outside this record's inputs and are not judged here.
• out_of_scope_findings, each named right and none a defect of this change: (a) 127 dead numbers in string literals in packages/rest/src, including rest-route-ledger.ts:290 (#10179) in a note: string, seen unchanged in the ledger hunk's context — form D, on the card's form-D stage per ACCEPT 5888034755; (b) packages/rest/vitest.config.ts:21 ([finding] vitest 的 --project 过滤器落空即静默成功 —— 点名一个 integration 文件跑 --project unit,报它是通过的文件、执行零个用例,并把它从文件计数里减掉 #17853) and packages/rest/test-typecheck-debt.json — outside src/** and the census surface, a later stage of the card; (c) CITATION_RE and slash-joined numbers — the grammar family PR docs(spec): re-anchor the dead tracker citations in data/ to the commits that decided them (stage 3) #20533 names ([finding] check-issue-citations reads the pre- in pre-#N (and post- in post-#N) as a repository qualifier, so a dead number in that spelling is classed cross-repo and never judged #20330); (d) #14026 as a transferred specimen — the gate's owner; (e) the three left sites — stay on the card.
• Card comment 5888293145 (the domain:services pointer): packages/cli/src/utils/i18n-extract.ts:2294 is a string literal in packages/cli, outside this stage's packages/rest/src surface, and rightly untouched here. It is still unanswered on the card and belongs to the packages/cli stage's claim; escalated to the seat as a note for that claim, not a condition on this PR.
• Part of #20594 with no closing keyword — right: the card's direction is one package per PR, largest first, and cli (174), types (52) and the rest of the lane remain; claim 5888335266 orders exactly this. Part-of PR must not also close its card and The card this PR closes must claim this branch are success on the head.
• The claim's file surface holds: nothing outside packages/rest/src/** and the one changeset is touched, and the PR is draft on base main.

Implemented-by: claude/issue-20594-rest-dead-citations
Reviewed-by: local_1d2a197c-c20e-4e90-9be8-413d4d432289

VERDICT: PASS