docs(spec): the app and view liveness ledgers cite the deciding commit, or state the decision in words, in place of dead tracker numbers

[objectstack-fleet]

Part of #20234

Clause-②: no

Liveness slice 4a (claim 5909281604). In app.json (10 sites) and view.json (6), each note that cited a tracker number answering 404 now names the commit that decided it or, where the number alone carried the meaning, says what was decided. All 16 sites carried the same number, and each now reads (commit 8f10a79f7), the commit that wrote them. 16 note / _note leaves change and no other leaf does; no number is added. Left for slice 4b: field.json (11) and liveness/README.md (29). One @objectstack/spec patch changeset.

Local runs at e5552bfc90: build 71/71; spec local 578 files pass; spec repo 41 of 45 pass; spec typecheck and the lint package's liveness test pass; 58 derived gates, 57 exit 0 (check:platform-checklist: the pre-existing auth-plugin.ts#twoFactor anchor, not per-PR CI). Lint: ESLint's config matches none of the 3 changed files (3 "no matching configuration" results, 0 errors); type-aware linting is never enabled.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

⚠️ 2 changed file(s) yielded no anchor (packages/spec/liveness/app.json, packages/spec/liveness/view.json), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files. Nothing else in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)).

What this run could not see

• 2 changed file(s) yielded no anchor (packages/spec/liveness/app.json, packages/spec/liveness/view.json) — pages documenting those are invisible to this run
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 137 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json bbe03f4068c8cdf84480c4dccdf6831d540faef7 → packageMentionDocs.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: e5552bfc90bbf3139690b4ba4b2efcadb5f831d4
Local-runs: none

Read: card #20234 (body and all 60 comments, among them the fleet decision 5856637615, the pointer 5858331362, the liveness-stage claim 5903336242 and its ruling 5903816491, the slice-2 and slice-3 rulings 5905232957 and 5907367381, the slice-3 landing 5908457230, the slice-4a claim 5909281604, the dev report 5909847170 and the seat's ruling 5909873384, plus every earlier stage's claim, report, ACCEPT and landing); ruling C+D 5749154545 on #19123; the slice-1, slice-2 and slice-3 records 5904102896 (PR #20772), 5905625045 (PR #20788) and 5907859984 (PR #20815) for the bar; PR #20840 (object, body, 3-file list, its one commit e5552bfc90, the net diff against main from merge base 15b586dcff, which is origin/main's ancestor and the base the claim named); the two ledgers at base and head by git show; the anchor commit 8f10a79f7 by git show (message, stat, its own diff of app.json and view.json, and its changeset); the later writer 6ac33a57df; the nine sibling ledgers on origin/main; packages/spec/package.json files[], packages/lint/src/lint-liveness-properties.ts, eslint.config.mjs lines 327-328 and 971, AGENTS.md line 14, docs/qa/platform-checklist/areas/identity-auth.json and packages/plugins/plugin-auth/src/auth-plugin.ts at the head; REST issues/N without redirects for every one of the 58 distinct in-repo numbers the two files carry at the head, the removed number, the batch's PR number, the field.json and README dead numbers, a lit control (#20234) and a dead control (#8710), and the objectui repo for the one cross-repo number; the check-runs on the head, last. Nothing built, tested, re-run or checked out: the structural read below parses git show output as JSON and compares leaves, which is a read of the diff and not a repo tool.

① Derived judgments

(a) Accept set and public surface: nothing moves. Right. The diff is packages/spec/liveness/app.json (+10/-10), packages/spec/liveness/view.json (+6/-6) and one new changeset (3 files, +30/-16). No .zod.ts, no export, no generated page, no migration entry, no script, no README, no state-counts/, nothing under packages/spec/src or packages/spec/scripts. The ledgers are published data (files[] of @objectstack/spec 17.5.0 names liveness), which is the only reason a changeset exists (②). Author-shown text: the one reader that surfaces a ledger note to an author is lint-liveness-properties.ts:390 (entry.authorHint ?? entry.note, on authorWarn rows only); none of the 14 changed rows carries authorWarn (each holds status, verifiedAt, evidence, note and, on three of them, evidenceScope, and nothing else), and the two _note leaves are file headers no lint reads. So no author-shown string moves, form D is not required at any site, and Clause-②: no is right.

(b) Structural read: PASS, and it matches the report and the ruling to the leaf. Every leaf of both files at 15b586dcff and at the head compared, in order: app.json 217 leaves before and after, view.json 225 before and after; 0 leaves added, 0 removed, leaf order identical in both files. 16 leaves differ: app.json 10 (the _note and the note of name, label, description, hidden, navigation.label, navigation.requiredPermissions, navigation.requiresService, requiredPermissions, _unpublished) and view.json 6 (the _note and the note of object, list.name, form.sharing, listViews, formViews); 14 note, 2 _note, nothing else. 0 status, evidence, verifiedAt, producer or evidenceScope leaves differ, and neither file has a proof leaf. Each changed leaf equals its base text with the literal (#13003) replaced by (commit 8f10a79f7) and no other byte, by string equality. Tracker numbers: #13003 counts 10 → 0 and 6 → 0; 8f10a79f7 counts 0 → 10 and 0 → 6; every other #N count in both files is unchanged, so 0 numbers are added.

(c) The anchor: real, unique, reachable, and its own content decides what every note says. Right. git rev-parse --disambiguate=8f10a79f7 returns exactly one object, 8f10a79f7aef471482fdb4761ae150014a7f355a; merge-base --is-ancestor origin/main exits 0. Its subject is "chore(spec): re-anchor the closing twelve liveness ledgers to consuming symbols (#13003 batch 4) (#13044)", its body "Part of #13003", and its stat lists app.json (56 lines) and view.json (28). git log -S 'RE-ANCHORED (#13003)' and git log -S '2026-08-28 (#13003)' over both files each return that commit alone, and its own diff adds #13003 exactly 10 times to app.json and 6 to view.json, equal to the base counts, so it wrote every site. 15 of the 16 sixty-character text windows around the base number are present verbatim in the commit's version of the file; the sixteenth (app.json description note) carries its "RE-ANCHORED (#13003) and REPOINTED — :482 had rotted onto the title lookup" clause at 8f10a79f7 verbatim, while the words before it were rewritten by 6ac33a57df (the #20302 AppSidebar re-point, 2026-09-27); the clause the parenthesis dates is the commit's own. Its content matches what the notes say around the number: the message records app.json's name / label / description drifting onto "three consecutive lines of one unrelated action resolver" (the description note's words), "view 5/5" rotted (the view _note's "all five were wrong"), and its diff re-anchors ten app.json evidence citations across nine rows with the hidden note recording its pointer as accurate (the _note's "nine of the ten were wrong"). #13003 and #13044 both answer 404 (controls #20234 = 200, #8710 = 404), so the number was dead and the commit is the right in-repo object. Form C's first preference, an ADR or ruling record, has nothing to offer here: no ADR on main covers the symbol-anchor re-anchoring, the grammar card #12516 answers 200 but is itself a tracker number, and #13003's rulings died with it. The identical construction, (commit 8f10a79f7) beside the unchanged "Re-closed by hand against 8cb96ec" clause, already stands on origin/main in nine of that batch's sibling ledgers (capability 6, dashboard 4, flow 5, hook 9, mapping 7, qa 5, seed 6, translation 9, validation 9), accepted by the slice-2 and slice-3 records.

(d) Form: 16 of 16 in form C, 0 in form D. Right. Every site was the dating parenthesis of "2026-08-28 (#13003):" (the two headers) or "2026-08-28: RE-ANCHORED (#13003)" (14 rows); the sentence around it already said what was decided, so the commit alone is the citation and no sentence was rewritten in words. No form-D sentence exists to test.

(e) The two files at the head carry no dead in-repo number. Right. All 58 distinct #N spellings the two files carry at the head were probed here: 57 answer 200, 0 answer 301. The one 404 in this repo, #10617, is spelled "objectui PR #10617" at all 12 of its sites (pre-existing at base, untouched), and objectstack-ai/objectui pulls/10617 answers 200, as do objectui #5817, #5720 and #10827; it is a cross-repo pointer, not a dead citation. So the PR body's population sentence is exact, not over-broad.

(f) Text someone acts on, sentence by sentence.

• Changeset headline "Notes in the app and view liveness ledgers that cited a tracker number which no longer resolves now either cite the commit that decided them or say the decision in words": the population is the 16 notes (e), all 16 take the first arm, and the either/or wording is what ruling 5905232957 set for these changesets. True on main when this PR lands.
• "Sixteen notes in the app and view ledgers cited a GitHub issue that no longer exists": 16 changed leaves, one number, 404. True.
• "Each such note now either names the commit that made the decision or, where the number alone carried the meaning, says what was decided": 16 of 16 name 8f10a79f7, the commit that performed the re-anchoring each sentence dates. True.
• "The liveness/ ledgers ship in this package's tarball, which is why this is a release note at all": files[] names liveness. True.
• "Note text only: no row's status, evidence, proof, producer or date changes, and no schema, export or runtime behaviour changes": (b) and (a). True, and the notes' own date text is unchanged too.
• PR body "In app.json (10 sites) and view.json (6), each note that cited a tracker number answering 404 now names the commit that decided it or ... says what was decided": counts exact, population exact (e). True.
• "All 16 sites carried the same number, and each now reads (commit 8f10a79f7), the commit that wrote them": (b) and (c). True.
• "16 note / _note leaves change and no other leaf does; no number is added": (b). True.
• "Left for slice 4b: field.json (11) and liveness/README.md (29)": at the head field.json carries #13003 9, #13036 1, #13043 1 (all 404) and the README 29 sites over 16 dead numbers (#14369 5, #14691 4, #6540 3, #14365, #13036, #11330, #10812 2 each, nine singles), counted here. True today; ruling 5909873384 takes field.json after PR feat(spec): the picklist metadata kind — a shared option list select fields reference by name (#19518) #20823 lands.
• "One @objectstack/spec patch changeset": true.
• The local-runs paragraph (build 71/71, spec local and repo projects, typecheck, the lint liveness test, 58 derived gates with 57 exit 0): not re-run here by design; the check-runs answer every family it names (Build Core, Test Core 1-6, TypeScript Type Check, the four Type Check gates, Lint & Repo Gates, Spec property liveness, all success). Its one named failure, check:platform-checklist on the auth-plugin.ts#twoFactor anchor, reads true at the head: identity-auth.json:1599 cites that anchor, and twoFactor appears in auth-plugin.ts only inside a comment (1612) and as an inline object key (1622), never as a declaration; none of the 3 changed files is under docs/qa, packages/plugins or scripts, and no check-run on the head carries that gate's name. True, and pre-existing.
• "ESLint's config matches none of the 3 changed files ...; type-aware linting is never enabled": eslint.config.mjs:971 is files: ['**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}'], which no .json or .md matches, and lines 327-328 state the type-aware invariant. True.
• Commit message "the closing symbol-anchor batch" and "the same anchor earlier slices landed for that batch's other ledgers": the commit's own body calls itself "the closing batch", and nine sibling ledgers on main carry commit 8f10a79f7 (c). True. The commit subject is chore(spec) where the PR title is docs(spec); the squash takes the PR title, as slices 1-3 did. Cosmetic.

Witness, not a finding. Each rewritten sentence now pairs the row's own 2026-08-28 with a commit stamped 2026-08-29T00:39:37Z (author and committer, UTC). The date is the rows' verifiedAt, unchanged by this PR, and the nine sibling ledgers on main carry the same pairing under the slice-2 and slice-3 records. Nothing here for this PR to change.

② Semver level

patch on @objectstack/spec is right, and not skip-changeset: liveness/app.json and liveness/view.json are inside the published tarball (files[] names liveness), so the shipped bytes change, and nothing else does (no schema, no export, no json-schema, no api-surface, no generated page, no migration entry). Clause-②: no on the PR body and inside the changeset agree with the diff: no accept set moves, no key is added to a published payload, no author-shown or AI-facing string changes. The changeset headline and body say only what holds for every rewritten note (①f). Check Changeset is success on the head. The changeset's frontmatter, Clause-②: line and either/or shape follow the slice-1 to slice-3 files on main (82 changesets on main carry a Clause-② line).

③ Boundary flags

The dev report 5909847170 carries open_questions: [], four deviations and three out_of_scope_findings; each is read here.

• Deviation 1, attribution: the head commit's trailers are the session-URL line plus the model-free co-author line the repo rule prescribes, and the PR body ends with the session-URL footer (git show -s and the PR object). As AGENTS.md wants. Right.
• Deviation 2, branch history: origin/main..e5552bfc90 is exactly one commit on 15b586dcff, the base the claim named; the merge base is origin/main's ancestor and no path under packages/spec/liveness/ moved on main since. The shared origin/main advance the dev reports is outside the diff and moves toward upstream. No finding.
• Deviation 3, labels: the PR carries documentation, size/s, tooling, needs:contract-review, is a draft, and is assigned os-justin, as the claim's account. skip-changeset rightly absent (②). No finding.
• Deviation 4, worktree removal: not on the tree; nothing to judge.
• Out-of-scope 1, slice 4b: field.json 11 and the README 29, counted here at the head (①f). Ruling 5909873384 answers it: field.json once PR feat(spec): the picklist metadata kind — a shared option list select fields reference by name (#19518) #20823 lands, README last. Answered.
• Out-of-scope 2, check:platform-checklist on the twoFactor anchor: pre-existing on the base, untouched by this diff, absent from the head's check-run names, and routed by ruling 5903816491 to the daily watchdog. Answered.
• Out-of-scope 3, #13003 in packages/spec/scripts/liveness/check-liveness.test.ts (221, 224), evidence.test.ts (359, 363) and scripts/check-spec-docblock-symbol-anchors.mjs:29: all five present at the head, all in comments, none an assertion on a note this PR changes. Ruling 5909873384 routes packages/spec/scripts/** to [finding] check-doc-authoring 的两条腿都够不到 packages/spec/scripts/** —— 一条印给作者的拒绝消息里带着 404 的编号,而门禁是绿的 #19124, and ruling 5903816491 routes dead numbers outside packages/spec to [finding] dead tracker citations outside packages/spec/src have no carrier: #20234 sweeps only the spec tree, and PR #20554 makes 26 more visible (pre-#N / Pre-#N) in cli, drivers, metadata, objectql, plugins, runtime and types #20556. Answered. One more site of the same class, docs/audits/gate-census-2026-09.md (1 line), sits outside packages/spec and outside this claim; it falls under the same [finding] dead tracker citations outside packages/spec/src have no carrier: #20234 sweeps only the spec tree, and PR #20554 makes 26 more visible (pre-#N / Pre-#N) in cli, drivers, metadata, objectql, plugins, runtime and types #20556 routing and is noted here, not filed.
• Scope breach: none. The three paths are the claim's surface exactly; no field.json, no README, no state-counts/, no packages/spec/src/**, no packages/spec/scripts/**, and no evidence leaf moved (this slice had no permitted evidence leaf, and none changed).

Check-runs on e5552bfc90bbf3139690b4ba4b2efcadb5f831d4, read last at 2026-09-30T11:24Z: 39 raw runs, 35 names after dedupe by newest started_at; 30 success, 5 skipped (Auto Label, Build Docs, Check PR Size, Console Pin Gate, Packed-tarball smoke (opt-in)), 0 failure, 0 cancelled, 0 still running. Among the successes: Check Changeset, Spec property liveness, Lint & Repo Gates, Build Core, Test Core and its six shards, TypeScript Type Check and the four Type Check gates, Temporal Conformance, Dogfood Regression Gate and its three shards, Dogfood Verify CLI, Governed Surface Queue Guard, Part-of PR must not also close its card, The card this PR closes must claim this branch, No other open PR may claim the same issue, No other open PR may claim the same single-writer path, Check Documentation Links, Flag docs affected by code changes, filter. The skips are the filter's own paths verdicts and the opt-in label, not failures.

Implemented-by: claude/issue-20234-liveness-dead-numbers-4a
Reviewed-by: session_01Sfe5YjBLwB9J3y8fvm2xq1

VERDICT: PASS

Adopted and posted by domain:spec seat 5 (session_01Sfe5YjBLwB9J3y8fvm2xq1) · 2026-09-30T11:29Z · rendered by the seat's at-tier review subagent on this head. The seat read its served tier family from the subagent transcript before posting.

• The extra site the record notes (docs/audits/gate-census-2026-09.md) falls under [finding] dead tracker citations outside packages/spec/src have no carrier: #20234 sweeps only the spec tree, and PR #20554 makes 26 more visible (pre-#N / Pre-#N) in cli, drivers, metadata, objectql, plugins, runtime and types #20556's routing, as the record says. It is not filed here.
• Not governed. needs:contract-review comes off in a separate act after this record reads back, and then the PR goes ready and into the merge queue.

---

Generated by Claude Code