docs(service-settings): re-anchor the dead tracker citations to the commits that decided them

[objectstack-fleet]

Part of #20596
Clause-②: no

What changed

This is the fifteenth stage of the domain:services lane of the dead-citation sweep. It covers packages/services/service-settings/src/** and nothing else. By the seat's claim (5908460751), it is the largest package left in the lane. Later stages cover the other packages, so this PR says Part of and the card stays open.

Every comment or docblock site in scope that cited a tracker number answering 404 has been rewritten in ruling C+D's form C (comment 5749154545 on #19123), by the method of stages 1 to 14 (the latest is PR #20816, landed as 73155fedc). That is 11 sites on 11 lines in 9 files, covering 4 numbers:

• 4 census sites (every census site this package has at the base);
• 7 sites in test comments, which the census defers. One of their numbers, #11318, stands only in test files here; it was read on its own and answers 404.

Each rewritten line now cites the commit in this repository that decided what the line describes, and says in its own words what was decided: 4 distinct commit shas. No ADR records any of the four decisions (see the per-number table), so ruling C's commit rung applies. No number was dropped.

Only comments changed. Every touched source file keeps its line count (11 lines out, 11 in, over 9 files), so no line citation into these files moves. All 11 changed lines carried a dead citation. No code token moves (see the guard below).

No citation number is added. The only tracker number on an added line is the live #10251, once, in settings-prebind-read-warning.test.ts:17. It already stood on that line, and it now sits beside the sha as the convenience link ruling C allows: 「(commit 1ec36b7, PR #10251)」. 1ec36b730 is that pull request's squash commit.

2 dead sites are left on purpose: a test title and a test assertion message (see the list below).

One more file: a patch changeset for @objectstack/service-settings, because the rewritten prose ships (see Changeset below).

Census: service-settings, before and after

Instrument (A1). The gate's own node scripts/check-issue-citations.mjs --census --json, read-only and unchanged. The count below is its allocated-but-absent findings under packages/services/service-settings/. Each run counts as a reading only because its board frontier equals the newest issue or pull-request number, read by a separate request just before and just after the run.

reading	tree	board	whole-repo allocated-but-absent	service-settings sites	lines	files	numbers
before	base 73155fedc, run 2026-09-30T09:39:38Z to 09:43:17Z	enumerated, 187 pages, frontier #20830 (newest #20830 before and after)	752	4	4	4	3
after	head ac05607d6, run 10:02:17Z to 10:06:00Z	enumerated, 187 pages, frontier #20834 (newest #20834 before and after)	748	0	0	0	0

The whole-repo drop is 4, exactly this diff's census sites. The resolves tally is 33,134 in both runs, and resolves-as-pull-request (1,985) and cross-repo-unjudged (1,018) did not move either. Neither run was truncated or discarded: both enumerations read 187 pages at the newest frontier. The seat's census counted 4 here at 6bff748b, and the base agrees: 6bff748b is an ancestor of the base, and no commit between them touches this package's src.

Supplementary instrument, the whole scope. The census does not read test files or strings, and this stage's scope includes test comments. So a second reading runs the gate's own exported extractCitations (whole-file and comment-prose projections) and namesThisRepository over every .ts file under service-settings/src (64 files). It takes its verdicts from the before census's own board reading rather than from a second enumeration: a number is dead when that census reported it allocated-but-absent, and alive when the gate's own census-scope extraction judged it and the census did not report it. 10 numbers are covered by neither, because they stand only in test files, or as the second number of an #A/#B pair. Each was read on its own through the read-only tools. 1 answers 404 (#11318, on the issue and the pull-request endpoint alike); 6 answer as issues; 3 answer as pull requests (#7554, #10251, #5133). The probe's control: the known issue #11352 answers 404 on the pull-request endpoint.

reading	citations	dead	src comment	test comment	src string	test string
before, 73155fedc	534	13	4	7	0	2
after, ac05607d6	523	2	0	0	0	2

Its src-comment column equals the census's 4, which is the control on the second instrument. The 519 live citations and 2 cross-repo citations are the same in both readings, and the drop of 11 citations is exactly the rewritten sites. A third, raw reading (every # followed by 2 to 6 digits, whatever surrounds it) finds 547 occurrences before and 536 after, the same drop of 11. The 13 tokens beyond the gate's grammar are the same before and after, and none is dead (see Acceptance notes).

Per-number table

Sites and files count every dead occurrence in scope at the base (comments and strings, tests included). rewritten / left counts the sites rewritten and the sites left. Each anchor was read in its message and diff, not only its subject.

number	sites / files	rewritten / left	anchor: what it decided
#13279	4/4	4/0	6a180e42d (PR #13475): resolveAuthzContext raises AuthzStoreUnavailableError (SERVICE_UNAVAILABLE, 503) when a permission-store read throws, instead of answering an outage as a caller with zero capabilities, and each production transport's fail-closed catch re-raises that brand. The settings plugin's verifiedContextFromRequest is one of them. Its message names #13279 4 times and its diff 54 times; git blame puts settings-service-plugin.ts:307 in it, and the other three lines were written by ac9376a74 (PR #16580), a descendant, which describes that re-raise. Stage 6's anchor, reused by the storage, datasource and analytics stages
#10159	3/2	3/0	1ec36b730 (PR #10251): a settings write issued before the engine is bound is refused with SETTINGS_ENGINE_NOT_BOUND (503). Its message states that every read in any state is unchanged, which is the "left reads open" all three lines describe. The message does not name #10159, but its own diff does, once, in its changeset ("refused loudly instead of resolving successfully while nothing reaches sys_setting (#10159)"), and settings-prebind-read-warning.test.ts:17 already paired the two numbers. git blame puts the three lines in a24b7fa4d (PR #11044), the later read-half fix, a descendant. New to the sweep
#17062	3/2	2/1	50b6f17d4 (PR #17071): adds the package-local route-ledger conformance guard beside the dogfood live-mount parity gate, and updates the ledger header that had said such a guard was deliberately omitted. Its message does not name #17062; its diff does, on 3 added lines, which are the three sites here (git blame puts all three in it). New to the sweep
#11318	3/1	2/1	99ccbb9c8 (PR #11467): the Settings, AI "Test connection" fallback keeps its mount instruction on all three real-provider branches and gains the cloud-only boundary read from PLATFORM_CAPABILITY_PROVIDERS.ai. Its own changeset states that "the embedder hint at the fourth site is deliberately left alone ... and pinned by a contrast test", which is the fence :339 describes. Its message's trailer names #11318 as the issue it answers, its diff names the number 3 times, and git blame puts all three lines in it. New to the sweep

Every cited sha matches exactly one commit (git rev-parse --disambiguate, count 1 for each of the 4), and all 4 are ancestors of the base (merge-base --is-ancestor, exit 0 for each; reverse leg, base against each anchor, exit 1 for each; control legs exit 0: stage 1's landing 422db788a, and the repository's root commit, which lies deeper than every anchor; the history is complete, --is-shallow-repository false, 15,193 commits). Each of the 4 numbers answers 404 on the issues endpoint, which serves pull requests too, read one by one.

No ADR, scripts/adr-anchors/ file or other docs/ page records the decision of any of the 4: docs/adr names none of the numbers, and none of their mechanisms (AuthzStoreUnavailableError, SETTINGS_ENGINE_NOT_BOUND, engineBindPending, the settings route ledger, the AI hint's edition boundary).

Wordings to check

• Tag swaps in place. 「[[finding] a permission-store read failure resolves as an AUTHENTICATED caller holding ZERO capabilities — the package door answers 403 FORBIDDEN, byte-identical to a genuine capability denial #13279]」 became 「[commit 6a180e4]」 (settings-service-plugin.ts:307); 「([finding] a permission-store read failure resolves as an AUTHENTICATED caller holding ZERO capabilities — the package door answers 403 FORBIDDEN, byte-identical to a genuine capability denial #13279)」 became 「(commit 6a180e4)」 on 2 lines; 「[finding] a permission-store read failure resolves as an AUTHENTICATED caller holding ZERO capabilities — the package door answers 403 FORBIDDEN, byte-identical to a genuine capability denial #13279's permission-store re-raise」 became 「commit 6a180e4's permission-store re-raise」. These are the forms the storage and datasource stages used for the same sha.
• #10159. 「is why SettingsService accepts a write before its engine is bound and answers "resolved" while nothing reaches sys_setting — every kernel:ready hook registered from init() is inside that window #10159's fix deliberately left reads open」 became 「is why commit 1ec36b7's write refusal deliberately left reads open」; 「(SettingsService accepts a write before its engine is bound and answers "resolved" while nothing reaches sys_setting — every kernel:ready hook registered from init() is inside that window #10159's fix left reads open on purpose)」 became 「(commit 1ec36b7 left reads open on purpose)」; 「(SettingsService accepts a write before its engine is bound and answers "resolved" while nothing reaches sys_setting — every kernel:ready hook registered from init() is inside that window #10159 / PR fix(service-settings): refuse a settings write issued before the engine is bound #10251)」 became 「(commit 1ec36b7, PR fix(service-settings): refuse a settings write issued before the engine is bound #10251)」, with the pull-request number kept as the convenience link beside its own squash commit.
• #17062. 「Two layers, since [finding] service-settings' route ledger has no conformance guard — the pattern every sibling ledger follows is silently missing here #17062.」 became 「Two layers, since commit 50b6f17.」 The docblock goes on to describe the conformance test that commit added as the second layer.
• Two headers keep the antecedent of the prose below them, the form stage 14 used:
  • settings-route-ledger.conformance.test.ts:4: 「Settings route-ledger conformance ([finding] service-settings' route ledger has no conformance guard — the pattern every sibling ledger follows is silently missing here #17062)」 became 「Settings route-ledger conformance (the issue behind commit 50b6f17)」, because :25 of the same docblock says 「(per the issue)」.
  • manifests/ai.manifest.test.ts:277: 「The AI settings manifest tells an operator at runtime to mount @objectstack/service-ai, which the capability roster declares cloud-only (no open-edition version to install) #11318 —」 became 「The card behind commit 99ccbb9:」, because :288 「the very claim this card is about」 and :329 「The un-followable form this card retired」 speak of that card.
• ai.manifest.test.ts:339. 「deliberately not edited — The AI settings manifest tells an operator at runtime to mount @objectstack/service-ai, which the capability roster declares cloud-only (no open-edition version to install) #11318 fences this site out by name」 became 「... — commit 99ccbb9 fences this site out by name」. The commit's own changeset names that site (quoted in the table).

The 2 sites left

• Test strings, 2 sites on 2 lines, left as stages 1 to 14 left theirs:
  • manifests/ai.manifest.test.ts:292, a describe title (#11318);
  • settings-route-ledger.conformance.test.ts:88, the assertion message a failing run prints (#17062). It is a string, not a comment, and form C does not touch strings.
• No operator log string, runtime refusal, quoted maintainer ruling or generated file in this package carries a dead number.
• Outside src, listed and left, not edited in this stage:
  • the shipping README.md names only the live #8026;
  • vitest.config.ts names only live numbers (#8020, #8030, #8063, #8104, #10374);
  • tsconfig.json and package.json name none;
  • the release-owned CHANGELOG.md names #13279 and #10159 on 2 lines, the entries of 6a180e4 and 1ec36b7, which are this PR's anchors.

Mechanical guard: no code token moves

The guard compares, base 73155fedc against head, over all 9 touched .ts files:

• Reading 1, the TypeScript parser's leaf nodes (a forEachChild walk, so comments are trivia and JSDoc nodes are never visited). String and template literals are therefore read in full.
• Reading 2, the full token stream in parser context (a getChildren walk, so punctuation and keywords are included; JSDoc nodes skipped).

Results:

• Real run at the final head ac05607d6: 9,999 base leaf tokens, 0 files with a token change on either reading (exit 0). The first commit ff7ef46f4 gave the same, and no .ts path changed after it.
• Comment control in settings-service.ts (「deliberately left reads open.」 to 「deliberately kept reads open.」): 0 files changed, as expected (exit 0).
• Positive control, a code token renamed in settings-service-plugin.ts (isAuthzStoreUnavailableError(err) to isAuthzStoreUnavailableErrorX(err)): DIFFER on the identifier (exit 1).
• Positive control, one digit changed inside the kept test title ai.manifest.test.ts:292 (#11318 to #11319): DIFFER on the string literal (exit 1).

Every mutation went through scripts/ablation-replace.mjs (wrap mode) under a shell trap that restores by absolute path, and each landed (anchor 1 to 0, blob changed). Each restore was proven byte-identical to the HEAD blob (1248149a428d, a2fac9ad1f0b, 79c2b40a48a6), with git diff HEAD empty and a clean tree afterwards.

Changeset

This change ships bytes, so a patch changeset for @objectstack/service-settings (.changeset/20596-service-settings-provenance-anchors.md) is included. Its body is stages 12 and 13's commit-anchor text, word for word, with the package name changed.

Measured on the built package (A3), after a full workspace build in which this package was a cache miss (71 of 71 tasks, 0 cached, at ff7ef46f4, which holds every source-line change): files[] is dist, README.md and CHANGELOG.md, and the package is not private.

• The rewritten settings-service.ts:685 docblock, on the pre-bind read reporter, is in all four entries: dist/index.js, dist/index.cjs, dist/index.d.ts and dist/index.d.cts (once each).
• The other three rewrites (settings-route-ledger.ts:17, settings-routes.ts:72, settings-service-plugin.ts:307) are stripped by the bundle, and the other seven sit in test files.
• Positive controls, the unchanged line beside each rewrite, land exactly where their neighbours do: the line before settings-service.ts:685 once in each of the four entries, and the neighbours of the three stripped rewrites 0 everywhere.
• A never-written negative phrase appears nowhere in dist, and none of the four old numbers is left there.

The later commit adds only the changeset.

Gates (final head ac05607d6)

• Citation judging, as CI runs it: pnpm check:issue-citations exits 0 (self-test, 114 cases, 8 batteries). node scripts/check-issue-citations.mjs exits 0: 「no issue citations added against 73155fe (4 file(s) read)」.
• Doc authoring: pnpm check:doc-authoring exits 0 (the sibling-package prose-id baseline holds, no growth).
• Derived gates: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack at ac05607d6 derived 63 commands, the same 63 as at dispatch.
  • Each ran with its exit code captured before any pipe, and all 63 exit 0; none exited 3.
  • --ran, fed each command with its exit code, reports 63 run, 0 NOT MEASURED (a derived zero), 0 unrun, and exits 0.
  • The full turbo run build above ran first under the shared verify lock, so no gate hit an unbuilt workspace.
• Roster families the derivation lists outside its commands (their rosters sit in directories this diff touches): node scripts/check-changeset-fixed.mjs, pnpm check:authz-resolver, pnpm check:error-code-casing and pnpm check:filter-alias-parity, each exit 0.
• Tests and typecheck, under the verify lock, at ac05607d6:
  • pnpm --filter @objectstack/service-settings test: 33 files pass and 584 tests pass, which is every tracked test file under src/, the 5 touched ones included.
  • pnpm --filter @objectstack/service-settings typecheck (tsc --noEmit) exits 0, and tsc --listFiles puts all 9 touched files in the program.
• Lint, as a proven narrowing: eslint with inline config disabled, over the 9 touched .ts files, gives 9 files, 0 errors and 0 warnings (its --format json output). All 9 are in eslint's own population (none reported ignored; dist/index.js, the control, reads ignored). eslint.config.mjs never enables type-aware linting (no parserOptions.project, as its own lines 327-328 state), so a comment edit here cannot move the verdict on any untouched file. The repo-wide pnpm lint is CI's run.
• Control bytes: pnpm check:nul-bytes exits 0, and a raw scan of the 10 changed files for control bytes finds none.

Acceptance notes

• The gate-invisible spellings, grepped as the claim asked (check-issue-citations closeout (extractor spellings): CITATION_RE refuses a hyphen after the digits, so a dead #N-word citation (#13398-class) is invisible to the diff gate and to the census #20636, including the clause #N position). At the base, #N-word is on 0 lines. #A/#B is on 11 lines (12 second numbers), and every second number is live: #6580, #5094, #11230, #5480, #5932, #6199 and #5204 by the census's own judgement, and #5133 read on its own as a pull request. option #N, clause #N and URL-spelled links are on 0 lines. So the claim's 0 / 11 / 0 / 0 hold, and nothing dead hides behind them. The one other raw token beyond the grammar is the colour literal '#6366f1' in manifests/branding.manifest.ts:32.
• 「The card」 phrases. 38 lines in 18 files under this package's src speak of 「the card」 or 「this card」. They carry no number, and neither instrument sees them. The ones whose antecedent this diff would have removed are handled above; the rest are unchanged, as in stages 8 to 14.
• The census instrument did not truncate in this stage. Both enumerations read 187 pages at the newest frontier.
• Anchors the next stages can reuse, each checked here: #10159 → 1ec36b730; #17062 → 50b6f17d4; #11318 → 99ccbb9c8; and the reused #13279 → 6a180e42d.
• Base. The branch is on main at 73155fedc. main has since moved two commits (4b45afaed, 15b586dcf). Neither touches packages/services/service-settings, scripts/check-issue-citations.mjs, .changeset/config.json or a path in this diff. 15b586dcf moves packages/spec/liveness/**, a gate input this comment-only diff cannot interact with. No merge was taken; the merge queue rebuilds on the merged generation.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/service-settings, touching 1 documentable anchor(s). ⚠️ 2 changed file(s) yielded no anchor (packages/services/service-settings/src/settings-route-ledger.ts, packages/services/service-settings/src/settings-routes.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

3 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/data-modeling/drivers.mdx (via SettingsService (symbol, a top-level class))
• content/docs/protocol/kernel/config-resolution.mdx (via SettingsService (symbol, a top-level class))
• content/docs/protocol/kernel/index.mdx (via SettingsService (symbol, a top-level class))

What this run could not see

• 2 changed file(s) yielded no anchor (packages/services/service-settings/src/settings-route-ledger.ts, packages/services/service-settings/src/settings-routes.ts) — pages documenting those are invisible to this run
• 1 name(s) were too generic to anchor anything (single lowercase words)
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 8 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 15b586dcffa88471afeaba4dbf560223692ad944 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 65554518b7d6fabd1fe3b3ae0522509c21e910e7 — the merge of head ac05607d619c76e107db022098f8abee535615d3 into base 15b586dcffa88471afeaba4dbf560223692ad944, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 65554518b7d6fabd1fe3b3ae0522509c21e910e7 && git checkout 65554518b7d6fabd1fe3b3ae0522509c21e910e7
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 15b586dcffa88471afeaba4dbf560223692ad944 ac05607d619c76e107db022098f8abee535615d3 && git checkout -B drift-repro 15b586dcffa88471afeaba4dbf560223692ad944 && git merge --no-ff ac05607d619c76e107db022098f8abee535615d3

node scripts/docs-audit/affected-docs.mjs --json 15b586dcffa88471afeaba4dbf560223692ad944

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 15b586dcffa88471afeaba4dbf560223692ad944 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: ac05607d619c76e107db022098f8abee535615d3
Local-runs: none

① Derived judgments

Read against main at the merge-base 73155fedc (stage 14's landing). origin/main stands two commits past it (4b45afaed, 15b586dcf); the 15 files those two touch are under packages/metadata-protocol, packages/runtime, packages/qa/dogfood, packages/spec/liveness and two removed .changeset/*.md files — none under packages/services/service-settings, none a path in this diff, and neither scripts/check-issue-citations.mjs nor .changeset/config.json — so the net diff against main is the merge-base diff: 10 files, +21/−11 — 9 source files under packages/services/service-settings/src/** (4 modules, 5 test files) and one changeset. The head ac05607d6 adds only the changeset on top of ff7ef46f4, which holds every source line.

• Accept-set: no change — right. No Zod schema, REST handler, query-parameter set, refusal text, log text or runtime string moves. 11 source lines out, 11 in; every one of the 22 changed source lines opens with a comment marker after whitespace (//, *, /**), 0 fall outside one. Each of the 9 touched source files has additions equal to deletions, so no line citation into these files moves. The dev's parser token guard (0 files with a token change over 9 files; both positive controls DIFFER) says the same and is not repeated here.
• Public surface: no change — right. No export added, removed or renamed; no packages/spec file touched, so no generated artifact is owed.
• Published bytes: changed — right, and it decides ②. @objectstack/service-settings (17.5.0, not private, files = dist, README.md, CHANGELOG.md, types = dist/index.d.ts; the shared tsup.config.ts emits declarations unless OS_SKIP_DTS is set, and the package's build then runs check-dts-emitted). The rewritten line at settings-service.ts:685 sits in the JSDoc of a member of SettingsService, which src/index.ts:8 exports, so dist/index.d.ts changes. The other three source rewrites (settings-route-ledger.ts:17, settings-routes.ts:72, settings-service-plugin.ts:307) are on internal lines, and the remaining seven sit in test files. The dev's A3 build reading (all four dist entries, positive and negative controls) says the same; this record does not repeat the build.
• The 4 numbers are dead — right. Each of #13279 #10159 #17062 #11318 answers 404 on the issues endpoint (which serves pull requests too), read one by one for this record; the controls #10251, #11352 and #20596 answer 200. No file under docs/adr/ or scripts/adr-anchors/ at the head names any of the four numbers or their mechanisms (AuthzStoreUnavailableError, SETTINGS_ENGINE_NOT_BOUND, engineBindPending, the settings route ledger), so ruling C's first rung is empty and a commit is the right anchor for every one.
• The 4 anchors — each right. Each abbreviated sha resolves to exactly one commit (rev-parse --disambiguate, count 1 for all 4) and is an ancestor of the base (merge-base --is-ancestor, exit 0 for all 4; the history is complete, --is-shallow-repository false). #13279 → 6a180e42d (the squash of PR fix(core,rest,services): fail loud when a permission-store read fails #13475): its message names #13279 four times and its diff on 54 added lines; resolveAuthzContext raises AuthzStoreUnavailableError (SERVICE_UNAVAILABLE, 503) when a permission-store read throws, and the settings plugin's fail-closed catch re-raises the brand — git blame at the base puts settings-service-plugin.ts:307 in this commit and the other three lines (settings-routes.ts:72, settings-routes.authz-outage-relay.test.ts:12, settings-admission-tenancy-posture.test.ts:617) in ac9376a74 (PR service-storage / service-settings: an authorization-store outage reaches the wire as its declared 503 SERVICE_UNAVAILABLE #16580), its descendant. It is the anchor stages 2, 5, 6 and 8 gave the same number. #10159 → 1ec36b730 (the squash of PR fix(service-settings): refuse a settings write issued before the engine is bound #10251): its message does not name the number, its own diff does, once, in .changeset/settings-write-before-engine-bind.md; its message states that every read in any state is unchanged, which is the 「left reads open」 all three lines describe; blame puts the three lines in a24b7fa4d (PR fix(settings): declare the settings ordering edge and make the pre-bind read audible #11044), its descendant. New to the sweep. #17062 → 50b6f17d4 (PR test(service-settings): add settings-route-ledger conformance guard #17071): its message does not name the number; its diff names it on exactly 3 added lines, and they are the three sites (settings-route-ledger.ts:17, settings-route-ledger.conformance.test.ts:4, :88); blame puts all three in it; the package-local route-ledger conformance guard is what it adds. New to the sweep. #11318 → 99ccbb9c8 (PR fix(service-settings): say the AI runtime is cloud-only instead of telling operators to mount it #11467): its message trailer names the number and its diff names it 3 times; its changeset states that the embedder hint at the fourth site is deliberately left alone, which is the fence ai.manifest.test.ts:339 describes; blame puts :277, :292 and :339 in it. New to the sweep.
• The wordings — each right. Tag swaps in place ([#13279] → [commit 6a180e42d], (#13279) → (commit 6a180e42d), #13279's → commit 6a180e42d's) are the forms stages 5 and 6 used for the same sha. settings-service.ts:685 turns 「SettingsService accepts a write before its engine is bound and answers "resolved" while nothing reaches sys_setting — every kernel:ready hook registered from init() is inside that window #10159's fix」 into 「commit 1ec36b7's write refusal」, which names what that commit did. (#10159 / PR #10251) → (commit 1ec36b730, PR #10251): the pull-request number kept is the anchor's own squash number, live (200), already on that line — a convenience link beside the citation, and the citation on the line is now the commit. The two header lines keep the antecedent of the prose below them: settings-route-ledger.conformance.test.ts:4 「the issue behind commit 50b6f17」 for :25 「(per the issue)」, and ai.manifest.test.ts:277 「The card behind commit 99ccbb9:」 for :288 「this card」 and :329 「this card」 — all three antecedent lines read at the head; stage 14's form, and stage 10's for the same phrase.
• Citation accounting — right. Over the diff: the 11 removed source lines carry the 11 dead occurrences (#13279 ×4, #10159 ×3, #17062 ×2, #11318 ×2) plus the live #10251 once; the added lines carry #10251 once and no other tracker number; 4 distinct shas stand on added lines (6a180e42d ×4, 1ec36b730 ×3, 50b6f17d4 ×2, 99ccbb9c8 ×2). No number is new to the diff and none grew.
• The 2 sites left — right, and the list is exact. A grep of the four numbers over packages/services/service-settings at the head returns exactly two lines under src — manifests/ai.manifest.test.ts:292 (a describe title, #11318) and settings-route-ledger.conformance.test.ts:88 (an assertion message, #17062) — plus two lines of the release-owned CHANGELOG.md (the 6a180e4 and 1ec36b7 entries). Both src residues are string tokens, left as stages 1 to 14 left theirs.
• The gate-invisible spellings — right. At the head under service-settings/src: 0 #N-word lines; 11 #A/#B lines whose second numbers (#5094 #5133 #5204 #5480 #5932 #6199 #6580 #11230) all answer 200 (seven as issues, #5133 as a pull request); 0 option #N, 0 clause #N, 0 URL-spelled. Outside src, README.md names #8026 and vitest.config.ts names #8020 #8030 #8063 #8104 #10374, all 200; tsconfig.json and package.json name none.
• Form — consistent with the landed stages 1 to 14 (the latest 73155fedc): the word commit plus the abbreviated sha where the number stood, the decision carried in the sentence.
• Check-runs on the head, the gate verdicts (read 2026-09-30T10:28Z): 32 check-runs, latest per name — 25 success, 3 skipped (Build Docs, Console Pin Gate, Packed-tarball smoke (opt-in): paths-filtered or opt-in, not verdicts against), 4 in_progress, 0 failure. Of the seven required contexts, four are success — Build Core, Dogfood Regression Gate, Temporal Conformance (live PG + MySQL), Governed Surface Queue Guard — and three had not concluded at that read: Lint & Repo Gates (which carries check:issue-citations and check:doc-authoring, the two gates this diff answers to) was in_progress, and the two needs-gated aggregates TypeScript Type Check and Test Core were not yet created (Type Check · workspace and Test Core shards 1 and 3 still running; shards 2, 4, 5 and 6 and the other three Type Check jobs success). Check Changeset, Check PR Size, Part-of PR must not also close its card and The card this PR closes must claim this branch are success. Not awaited, per the brief: the ① judgments rest on the diff, and the landing separately requires every check green, so the owning seat reads those three before it queues. Nothing was built, run or re-run locally.
• The PR's only comment is the advisory Docs Drift Check, which lists three pages that name SettingsService; a comment-only diff changes no documented behaviour, so nothing there is owed.

② Semver level

• .changeset/20596-service-settings-provenance-anchors.md declares '@objectstack/service-settings': patch — matches what the diff publishes. The package is released and dist/index.d.ts carries the rewritten docblock, so bytes ship; skip-changeset would be wrong (it is for a diff that publishes nothing from any released package), and the PR carries no such label (its labels are documentation, size/s, tests, tooling, the labeler's). Not minor: no accept set widens and no surface is added. The body is truthful (comments only; no type, schema, export, log or refusal text, or runtime behaviour change), carries no tracker number and no model identifier, follows stage 14's landed form word for word with the package name swapped, and the filename carries the card number. service-settings sits in the fixed group beside the packages whose stages declared the same level; Check Changeset on the head is success.
• Clause-②: no — right. It is line 2 of the PR body under Part of #20596, and the claim (5908460751) declares the same. The diff widens no accept set, so no arm is owed and no minor is owed. Nothing breaks, so no ADR-0087 marker is owed.
• Not a governed-surface diff (no path under docs/adr/**, .claude/**, skills/**, AGENTS.md, CLAUDE.md); 32 changed lines, far under the 5,000-line human-merge threshold; head repo equals base repo; Governed Surface Queue Guard on the head is success. A draft with Part of on line 1 and no closing keyword anywhere in the body (Part-of PR must not also close its card is success), so the card stays open for the remaining stages.

③ Boundary flags

The dev report (5909275235) has open_questions: []. Its eleven deviations and three out-of-scope findings, and the note the seat's ACCEPT (5909308642) carried, each answered:

1. 7 test-comment sites beyond the census's 4, #11318 standing only in test files — answered, in scope. The claim's surface is comment and docblock prose under service-settings/src/**; test comments are that, and stages 1 to 14 rewrote theirs. The head grep above confirms the residue is two strings.
2. Two header lines re-worded to keep the antecedent of the prose below them — answered, right (① above). Each carried a dead site, all three antecedent lines were read at the head, and every file keeps its line count.
3. PR #10251 kept beside 1ec36b730 — answered, right. It is the anchor's own squash number, live, and it already stood on the line; a pull-request number is a convenience link and never the citation, and the citation on that line is now the commit. The diff adds no citation number; Lint & Repo Gates on the head is the gate's verdict of record.
4. A void first eslint dist control (no build yet) — answered, immaterial. Discarded before any reading was taken from it; Lint & Repo Gates on the head is the verdict this record reads.
5. The supplementary before-figures reclassified from the base run's own rows — answered, immaterial here. This record rests on the census instrument's own 4 → 0 (the whole-repo allocated-but-absent drop 752 → 748 equals this diff's 4 census sites), on the head grep above, and on single-number reads taken for this record — not on the dev's reclassification.
6. The detached build and gate batch awaited by their recorded PIDs — answered, immaterial. A process note; the head's check-runs are the gate verdicts.
7. The attribution trailer pair — answered, right. Both head commits end with the model-free trailer pair AGENTS.md prescribes and no model identifier appears in either message; the PR body's footer is the session-URL form the PR-body surface keeps.
8. No pre-PR merge, main two commits ahead — answered, right (① above). None of the 15 files those commits touch is under this package or in this diff, and neither scripts/check-issue-citations.mjs nor .changeset/config.json moved, so the queue's rebuild has nothing to reconcile by hand.
9. Labels — answered. The four are the labeler's; no skip-changeset, which is right.
10. The stray git stash list in one shell line — answered, nothing to escalate. The list form is read-only and is one the stash hook allows by name; no stash was pushed, popped, applied or dropped, and the dev's tree was clean at each commit. The rule stands as written, and the ACCEPT already says the next orders keep naming it.
11. Cleanup of the worktree after the report — answered, immaterial to the head.
12. Out-of-scope 1, the two test strings (settings-route-ledger.conformance.test.ts:88, an assertion message naming #17062; ai.manifest.test.ts:292, a describe title naming #11318) — answered. Form C does not touch strings, as stages 1 to 14 held; the anchors are recorded (50b6f17d4, 99ccbb9c8) for whoever next edits those tests. Not blocking.
13. Out-of-scope 2, 「the card」 / 「this card」 on 38 comment lines in 18 files — answered. Wording only, no number, seen by neither instrument; the three whose antecedent this diff would have removed keep it through the two headers (① above). The same disposition as stages 8 to 14.
14. Out-of-scope 3, CHANGELOG.md names #13279 and #10159 on 2 lines — answered, right to leave. The file is release-owned and is never edited in a code PR; the two lines are the entries of this PR's own anchors 6a180e4 and 1ec36b7, which is exactly where a reader who greps the number lands.

Nothing is escalated. One reading for the seat, not a flag on this PR: Lint & Repo Gates, TypeScript Type Check and Test Core had not concluded when this record was rendered, so the landing waits on their success as it always does.

Implemented-by: claude/issue-20596-service-settings-citations
Reviewed-by: session_01XY5uCwTjZj7884yYtyur4H

VERDICT: PASS