docs(spec): re-anchor the dead tracker citations in data/ to the commits that decided them (stage 3)

[objectstack-fleet]

Part of #20234
Clause-②: no

What changed

This is stage 3 of the staged sweep. It covers packages/spec/src/data/** and nothing else. It leaves out the files an open PR or an in-flight claim holds: data-engine.zod.ts, data-engine.test.ts, hook.form.ts, analytics*.ts, cube-member-inner-name-retirement.test.ts, driver/turso.zod.ts and filter-subtree-provenance.ts, as the claim names them. It also leaves out four files that open PRs started editing after the claim: driver/turso.test.ts (PR #20504, #20437's, opened 2026-09-28T20:08Z), object.form.ts (PR #20519, #20432's, 21:55Z), object.zod.ts (PR #20521, #20494's, 22:10Z) and filter-logic-conformance.ts (PR #20523, #20444's, 22:39Z). See Acceptance notes. Later stages cover the other areas, so this PR says Part of.

Every comment or docblock site in scope that cited a tracker number answering 404 has been rewritten in ruling C+D's form C (comment 5749154545 on #19123). That is 163 sites on 161 lines in 44 files, covering 40 numbers. Each rewritten line now cites the commit in origin/main history that decided what the line describes, and it says in its own words what that commit decided.

No ADR or ruling-record file in docs/adr/ or scripts/adr-anchors/ records the decision behind any of the 43 dead numbers in scope. ADR-0104 names #12380 only as a reference, and ADR-0055 states the rule that #8772's ruling enforced, not the ruling itself. So every anchor is a commit: 38 distinct shas. One number was dropped rather than anchored: #17286, a tracking card that recorded an axis as undecided, under which no commit landed. The sentence keeps its reason in words.

Three comment sites in scope are left on purpose (see Acceptance notes). Two are the [#6259] marker in api-derivation.ts:163, which a test string reads, and the test comment that names that marker. The third is field.zod.ts:370, whose #6111 is objectui's number.

Only comments changed. Every source file keeps its line count (174 lines out, 174 in, over 45 files), so no line citation into these files moves. Thirteen of those 174 lines held no dead citation. Eleven are the other half of a sentence that had to be reflowed or rewritten. One is a table header (value-roundtrip-conformance.ts:20, 「card」 to 「card or commit」, because its row now holds a commit). One is api-derivation.ts:164, which now carries the [#6259] sentence's commit. No code token moves (see the guard below). The 41 string-literal sites that carry a dead number are tokens, so they are left as they were and listed below.

No citation number is added. Every tracker number on an added line was already on the line it replaces. No PR number stands on an added line.

Two more kinds of file change, both mechanical:

• One regenerated reference page. Two of the rewritten docblock lines (feed.zod.ts:15, :18) project into content/docs/references/data/feed.mdx. check:docs proved that page stale, and pnpm --filter @objectstack/spec check:generated --fix regenerated only it. The diff is two lines, each the same substitution as its source line. No page a held file projects into (analytics.mdx, data-engine.mdx, hook.mdx, driver-turso.mdx) moved.
• A patch changeset for @objectstack/spec (see Changeset below).

Census: data/, before and after

Instrument. This is the instrument of stages 1 and 2. It sends REST GET /repos/objectstack-ai/objectstack/issues/N without following redirects, for every distinct number cited in packages/spec/src/data. The population is:

• the citation gate's own exported CITATION_RE and NON_CITATION_HEADS, kept when the qualifier is none, objectstack, objectstack-ai/objectstack, framework, pre- or post-;
• widened here to the capitalised spellings of those qualifiers (Pre-, POST-, Framework: 7 sites, one of them dead), which stage 2's case-sensitive set did not read;
• N of 100 or more, excluding summon heads.

Each site is classified by the TypeScript parser as a line comment, a docblock, a block comment or a string.

Controls. The lit controls were #16862, #16847 and #17698. The dead controls were #16714, #16715 and #16697. They were probed at the start, after every 100 numbers and at the end. They read 24 of 24 lit (200) and 24 of 24 dead (404) over 8 checkpoints in both runs.

reading	tree	numbers probed	200	404	301 or other	dead sites, all of data/	in scope	excluded (held files)	in-scope lines	in-scope files	dead numbers in scope
before	base 9bf5e67af, probed 2026-09-28T19:32Z to 19:36Z	618	571	47	0	240	207	33	204	47	43
after	head 96fd49caa2, probed 2026-09-28T23:19Z to 23:23Z	600	571	29	0	77	44	33	43	16	21

Before, in scope, by class. 92 non-test docblock sites and 13 non-test line comments. 16 test docblock sites and 45 test line comments. 39 test string sites. 2 non-test string sites.

After, in scope. 41 string sites and 3 comment sites remain, all three deliberate. The head probe found no number newly dead since the base probe: the same 571 numbers answer 200.

PR #20226's area table read data 239 at an earlier base; this census reads 240 at 9bf5e67af. The 33 excluded sites sit in object.zod.ts (15), analytics.zod.ts (3), analytics-strictness-batchd.test.ts (2), analytics-date-range-two-bound-window.test.ts (1), driver/turso.zod.ts (2), driver/turso.test.ts (3), filter-subtree-provenance.ts (3), filter-logic-conformance.ts (3) and object.form.ts (1). data-engine.* and hook.form.ts carry none.

Per-number table

The counts are in-scope sites and files at the base. rewritten / left gives comment sites rewritten and sites left. Every anchor was read in its diff or message, not only in its subject: it is the commit that made the change the line now describes, and its own diff or message names the number it replaces.

number	sites / files	rewritten / left	anchor: what it decided
#6111 (objectui)	1/1	0/1	objectui's number, left: see Acceptance notes
#6259	5/2	1/4	6968885ef: retires the producer-less batch: 'bulk' row of DATA_ACTION_TO_API_OPERATION and the prose calling batch a runtime action. The marker and 2 test strings stay (see Acceptance notes)
#6345	18/5	17/1	e2798fab7: one driver vocabulary; both boot hosts read the shared table; mongo to mongodb; turso a builtin; the fork-1 and fork-2 refusals
#6571	10/2	8/2	2f3e79351: $between endpoints accept the ISO/clock strings the platform produces, as a bare string (rider ①)
#8495	9/2	6/3	4bfe1a539: refuses ${…} placeholders in memory persistence.path / persistence.key at publish
#8656	1/1	0/1	a test title only
#8696	20/8	17/3	90a12fb18, the card's mongodb arm: a bound secret rides beside an unmodified url as MongoClient auth. Its own pins carry the multi-host form new URL() cannot parse and the bound secret outranking options.auth
#8772	3/2	3/0	75b7c240a: Direction 2 of the 2026-08-16 maintainer ruling. The builder forces required: true on a master_detail under controlled_by_parent, and raw parse stays tolerant. ADR-0055 stays cited beside it
#8778	1/1	1/0	7901b2dd2: stamp-only tenancy.organizationField, declared by sys_api_key
#8794	2/1	2/0	1850ebbb0: corrects the reuse-safety claim on the filter-subtree mark from the survey's measurement, and routes a mechanism change to a spec-seat ruling (stage 1's anchor too)
#8836	2/1	2/0	1850ebbb0: the same commit, which pins the invariant (one line carries both numbers)
#8873	6/3	6/0	096106522: a bound credentialsRef reaches the postgres server on the DSN branch. Its diff records that pg sends a password only when the server asks
#8874	1/1	1/0	d70428ae7: a declared mysql ssl reaches mysql2 as its own TLS options object, because mysql2 rejects a bare boolean
#8876	9/5	6/3	d634e665b: exports urlUserinfoUsername, and its diff states the asymmetry that a username is not credential material
#9040	20/6	14/6	24206416a: refuses a credential in the mongo options passthrough at publish, and redacts the passthrough secret paths on read
#9041	22/2	17/5	d491625c1: refuses a bound credentialsRef with a user-less mongo config.url, with the triage's fences
#10165	5/1	1/4	801296050: ttl.onlyWhen with the canonical null predicate (maintainer ruling 2026-08-20, option A)
#10274	1/1	1/0	d1ba685ec: re-measures the objectui pin citations and gates the class
#10329	6/2	6/0	15d58dbf1: retires the import lookup transform's steering params (ADR-0049)
#10347	2/1	2/0	530c1df65: the Archiver honours a declared ttl (maintainer ruling 2026-08-20)
#10527	2/1	1/1	5649efbf9: refuses a diverging retention + ttl + archive triple at parse time
#11065	7/3	5/2	20950404c: a boolean aggregand counts as 1 or 0 in avg and sum, the first face aligned. No commit message names the card; this is where the number first entered the tree
#11195	3/1	2/1	b37231883: UserActionsConfigSchema adopts group / hideFields / rowColor
#11215	1/1	1/0	42a117b88: documents NoSQLIndexSchema.unique's deliberate scope-vocabulary omission
#11350	1/1	1/0	ece4dad31: records the 2026-08-23 maintainer ruling on entry nameability (stage 1's anchor too)
#11408	2/1	1/1	f11fc61c5: declares editMode (maintainer ruling 2026-08-24)
#11507	5/2	5/0	88b9d749a: declares sys_activity.type an open, author-extensible vocabulary (maintainer ruling 2026-08-24, direction 4)
#11658	1/1	1/0	1a6a19c31: opens RecordActivityProps.types to author-contributed kinds
#12380	4/2	4/0	4045b954d: makes the SQLite Field.json codec injective; its message carries the measured boundary
#12868	1/1	0/1	a test title only. Its comment site sits in object.form.ts, now held by PR #20519; its deciding commit is c459da6bc (see Acceptance notes)
#13156	1/1	1/0	fd289be45: strips tracker ids from function-declaration-built refusal prose (the card's A half)
#13644	3/2	2/1	34ce8e7db: declares ctx.referentialFieldClear on HookContextSchema
#14426	2/2	1/1	40a44b91b: the undefined-comparand refusal prescribes the null predicate by its ruled spellings, position-safe
#14676	1/1	1/0	13c48c2a5: retires connector.errorMapping; its test states the same assertion-set reasoning
#16126	2/2	2/0	859ded3ec: refuses a whitespace-only reference on lookup / master_detail
#16685	4/2	4/0	ed7243d52: accepts boolean / toggle for sum / avg / min / max (decision batch #80)
#16867	3/2	2/1	0ee32edef: notNull / not_null prescribe storage.notNull, not required
#17014	3/2	2/1	80aef8032: the one-day date-range presets prescribe a one-day window, and the table states its end-token convention
#17286	1/1	1/0	dropped: a tracking card with no landing. The sentence now says the card is gone and to measure driver-memory for the open set
#17348	1/1	1/0	51efbf116: pins the driver-memory temporal text-operator divergence by name in that driver's conformance suite
#17590	1/1	1/0	e04a0aff2: $contains on a JSON column is a per-dialect membership test (director-seat ruling 2026-09-12)
#18012	8/3	7/1	176b03582: $between requires two non-blank endpoints (decision batch #146 item 5, letter A)
#19377	6/2	6/0	a60c913de: refuses a { $field } reference as a $between endpoint at the runtime filter door

Every cited sha matches exactly one commit (git rev-parse --disambiguate, count 1), and every one is an ancestor of the base (merge-base --is-ancestor, exit 0). That is 38 distinct shas.

Wordings to check, each true of its commit:

• datasource.zod.ts:352 names only the card's mongo arm (90a12fb18) for "the defect class … closed", because the paragraph is about mongo. The card's mysql arm (72050cc47) is not cited anywhere in this stage.
• datasource.zod.ts:354: 「the triage's, as commit d491625 landed them」. d491625c1's message lists the fences as "per triage".
• filter.zod.ts:1021-1025: the #17286 pointer becomes 「was measured on a tracking card … That card is gone: measure driver-memory for the open set, ⛔ not this text.」 The warning that this paragraph is not the authority is kept.

The 41 string sites left as tokens

• Test titles and test-code strings (39 sites). driver/driver-credential-refusal.test.ts 14, object.test.ts 6, datasource-credential-redaction.test.ts 3, driver/driver-placeholder-refusal.test.ts 3, filter.test.ts 3, api-derivation.test.ts 2 (the split('[#6259]') literal and its message), field.test.ts 2, and 1 each in date-range-presets.test.ts, driver/postgres.test.ts, field-rows-option-description.test.ts, filter-comparand-type.test.ts, hook.test.ts and object-strictness-batch20.test.ts.
• Non-test strings (2 sites). aggregation-conformance.ts:398 and :407, the note of two exported AGGREGATION_CASES rows (#11065, #11151). They ship as data. Their only readers are driver conformance suites, which print a note as the assertion message when a case fails, to a driver developer and never to a metadata author. So they are neither comments nor form D author-shown text. This is the same disposition stage 1 gave the two why strings and stage 2 the PROVENANCE_WAIVERS reason.

No author-shown text in data/ carries a dead number, so nothing here is #20233's form D.

Mechanical guard: no code token moves

The check compares leaf tokens with comments stripped, base 9bf5e67af against head 96fd49caa2. It uses the TypeScript parser's leaf tokens, so template literals are scanned in context, and it excludes JSDoc nodes. It ran over all 45 touched .ts files.

• Real run: 140,379 base tokens, 0 files with a token change (exit 0).
• Comment-insertion control: 0 files changed, as expected (exit 0).
• Positive control (a declaration inserted into feed.zod.ts): 1 file reads DIFFER (exit 1).
• Positive control (one digit changed inside the split('[#6259]') string in api-derivation.test.ts): 1 file reads DIFFER (exit 1).

Changeset

This change ships bytes, so a patch changeset for @objectstack/spec is included. It says only that the provenance comments were re-anchored.

Measured on the built package: 14 of the touched sources are src/**/*.zod.ts, which files[] ships verbatim. The rewritten docblocks also reach dist. 88b9d749a, e2798fab7 and 24206416a each appear in 1 declaration file. 24206416a appears in 20 bundled .js files and 2f3e79351 in 28. The positive control, a pre-existing feed.zod.ts docblock sentence, appears in dist/data/index.d.ts.

Gates (head 96fd49caa2)

• Citation judging pass, run as CI runs it: pnpm check:issue-citations && node scripts/check-issue-citations.mjs exits 0. The self-test passes 73 cases in 7 batteries. The live run judged 11 citations across 25 files, and all 11 resolve.
• Doc authoring: pnpm check:doc-authoring exits 0.
• Derived gates: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack at the final head derived 108 families, and all 108 exit 0. --ran reports 108 run, 0 NOT MEASURED, 0 unrun, and exits 0. (check:i18n was derived at the earlier heads from object.form.ts, and left the set when that file went back to base.)
  • At an earlier head, four gates first exited 3 (PREREQUISITE NOT MET) because the workspace was unbuilt: check:doc-formula-expressions, check:doc-security-posture, check:skill-examples and check:docs-transcript-drift. At the final head a full turbo run build of ./packages/* ran first (71 tasks, exit 0, under the shared verify lock), and every gate exited 0 on its first run.
  • check:generated was run under the lock against that build: all 15 artifacts are up to date.
• Build, tests, typecheck and lint:
  • pnpm --filter @objectstack/spec build exits 0.
  • vitest run --maxWorkers=2 src/data in packages/spec at the final head: 107 files and 3,517 tests pass (1 todo), covering every touched test file.
  • The 12 spec suites outside src/data that read data/ source text pass at the final head: 12 files, 503 tests. These are scripts/{file-description,root-index,skill-map-guards,strictness-ledger}.test.ts, src/api/api-entry-graph.pin.test.ts, src/contracts/scoped-context.test.ts, src/shared/{alias-integrity,evaluated-slot-population,retired-key-migrate-sentence}.test.ts, src/system/constants/platform-object-names.test.ts, src/type-alias-convention.pin.test.ts and src/ui/dashboard.test.ts.
  • pnpm --filter @objectstack/spec typecheck at the final head exits 0, including check:test-typecheck (53 files, 251 errors, 138 pinned signatures held).
  • Lint, as a proven narrowing at the final head: eslint --no-inline-config --format json over the 45 touched .ts files gives 45 files, 0 errors and 0 warnings. All 45 are in eslint's own population (isPathIgnored is false for each). eslint.config.mjs never enables type-aware linting (no parserOptions.project, which its own line 328 states), so a comment edit here cannot move the verdict on any untouched file. The repo-wide pnpm lint is CI's run.

Acceptance notes

• The [#6259] marker. api-derivation.test.ts:236 splits DATA_ACTION_TO_API_OPERATION's TSDoc on the literal [#6259], and a test string may not change here. So the marker line api-derivation.ts:163 is byte-identical to the base, and the test comment at :232 that names the marker stays too. The sentence's deciding commit sits on the next line instead: 「(both by commit 6968885)」. A first attempt wrote the commit onto the marker line itself. The diff-scoped check-issue-citations then read the kept #6259 as an added citation and exited 1, so it was moved one line down (commit b93f08f8d0).
• objectui's #6111. field.zod.ts:370 reads 「objectui#6110 + v17 GA 交付物:AI 一键升级客户元数据项目(升级 skill,骑在 D2 conversions 之上) #6111 (section)」. The qualifier covers only the first number, so the citation grammar reads #6111 as this repository's (404 here). It is objectui's number: its introducing commit f887e5249 writes (objectui#6111) in the same diff, and objectstack-ai/objectui answers REST 200 for v17 GA 交付物:AI 一键升级客户元数据项目(升级 skill,骑在 D2 conversions 之上) #6111 to this session (and for docs(changeset): vendored console 条目里给 flow 几何迁移补回 BREAKING (v17) 标注 (#6106) #6110 and dogfood: simulate a brand-new developer's first-run journey — README → create an app → skills-driven AI build → validate & test #10264). objectui has no refs/pull/6111/head, so it is an issue there, not a PR. The line is left unchanged. This is [finding] check-issue-citations reads the pre- in pre-#N (and post- in post-#N) as a repository qualifier, so a dead number in that spelling is classed cross-repo and never judged #20330's grammar family, the same as stage 2's objectui PR #10264, and it is noted there, not filed.
• Capitalised qualifiers. CITATION_RE classes Pre-#N, POST-#N and Framework#N (7 sites in data/) as cross-repo and never judges them. This census read them as this repository's. One was dead and is rewritten here (object.test.ts:223, POST-#10347). This is the same [finding] check-issue-citations reads the pre- in pre-#N (and post- in post-#N) as a repository qualifier, so a dead number in that spelling is classed cross-repo and never judged #20330 family as stage 1's pre- / post- finding.
• Four files held after the claim. Each joined the exclusions and went back to the base bytes (hypothesis 2 of the dispatch). Each PR's hunks were disjoint from this PR's lines, but the dispatch's rule is file-level.
  • driver/turso.test.ts: PR fix(spec,driver-turso)!: refuse a forced mode replica with no syncUrl at authoring and at construction (#20437) #20504 (turso: a datasource config with mode: 'replica' on a file: url and no syncUrl is accepted at authoring and at construction, then runs as a plain local database that never syncs #20437's) opened at 2026-09-28T20:08Z and edits it. Its two comment sites (:4, :58, both #6345) went back to blob 7fe99ebf9 in commit 86463ed0a1. A no-driver merge-tree of that head with PR fix(spec,driver-turso)!: refuse a forced mode replica with no syncUrl at authoring and at construction (#20437) #20504's head 5dfa45e9f exits 0.
  • object.form.ts: PR fix(driver-sql): a declared index that can never be built is logged at error and reported in drift #20519 ([finding] a misspelt field name in a field's relatedListColumns, lookupColumns, lookupFilters[].field or dependsOn passes every authoring door, and fails only at view or picker time #20432's) opened at 21:55Z and edits it. Its one comment site (:256, #12868, whose deciding commit is c459da6bc) went back to blob 60713e06f in commit 3479600dda.
  • object.zod.ts: PR fix(spec): activityMilestones[].type describe states the real default (#20494) #20521 ([finding] activityMilestones[].type is documented as defaulting to "completed", but a milestone without type writes updated #20494's) opened at 22:10Z and edits one line at :2123. Its 15 comment sites (#8772, #10165, #10347, #10527, #11195, #11408, #13608) went back to blob befde04ca in commit 96fd49caa2. Their deciding commits are 75b7c240a, 801296050, 530c1df65, 5649efbf9, b37231883, f11fc61c5 and fc9ba76a5, all read for this stage.
  • filter-logic-conformance.ts: PR feat(drivers,formula,objectql): the engine's filter faces answer the staged $empty operator (#20444) #20523 (filter: the engine's compile surfaces answer $empty by the field's declared type (driver-sql and heirs, turso remote, driver-memory, driver-mongodb, formula, objectql having) — ruling A on #20399 #20444's) opened at 22:39Z. Its 3 comment sites (#13195) went back to blob c9b32acba in the same commit. Their deciding commit is 9dac1ae01, with PR #13529 as the link.
• What stays for later stages.
  • The 33 dead sites in the held files listed above. The later stage can reuse the deciding commits named for them here.
  • The 41 string sites and the 3 deliberate comment sites above.
  • The data/ numbers that also appear in packages/spec/src/migrations/**. Those are os migrate meta prints tracker numbers to the author: ADR-0087 migration entries' reason / replacement / acceptanceCriteria text carries ~2,060 of them, 178 dead, which AGENTS.md's runtime-string rule forbids #20233's form D, or the migrations stage.
• The rung. Several anchored changes also have ADR-0087 entries in packages/spec/src/migrations. Examples are cbp-master-detail-required-forced for A controlled_by_parent object may declare its master reference without required, so the master-access guard is the only thing preventing an unreachable orphan detail row #8772, filter-between-blank-endpoint-refused for spec(ui): FieldOperatorsSchema accepts a $between range with a blank bound — {$between: [1, '']} parses green, so a half-filled range is not refused at the authoring door #18012, the datasource-* entries for mongo config.options.auth.password is a fourth spelling of an inline credential — authorable, persisted cleartext, unredacted, and read by the client #9040, Nothing refuses the contradictory pair "external.credentialsRef bound + a config.url naming no user" — the binding is a silent no-op at connect #9041 and A bound external.credentialsRef reaches the knex config but NOT the server on the postgres DSN branch — pg overrides it with the connection string #8873, and the mapping-lookup-params-removed conversion for spec(data): mapping lookup transform params (object / fromField / toField / autoCreate) are authorable and read by nothing #10329. This PR takes the commit rung, as stages 1 and 2 did, so it is precedent-consistent. The D3 id is the more durable in-repo record, if the ruling's first rung is later read to include those entries.
• The citation gate's reach. It defers packages/**/*.test.ts, so 20 of the 45 touched .ts files never enter its judging population. The added-minus-removed count over the whole diff covers them: 0 numbers added.
• Base. The branch is 22 commits behind origin/main (1378ec7c0c, read at 2026-09-29T00:18Z). Four of those commits touch data/, all in excluded files: fix(spec): hook condition row declares expression, not javascript #20475's hook.form.ts, feat(spec,objectql,metadata-protocol): grouped and aggregated queries honour search #20487's data-engine.*, and, since this stage excluded them, PR fix(spec): activityMilestones[].type describe states the real default (#20494) #20521's object.zod.ts (9e1689f8e2) and filter: the engine's compile surfaces answer $empty by the field's declared type (driver-sql and heirs, turso remote, driver-memory, driver-mongodb, formula, objectql having) — ruling A on #20399 #20444's filter-logic-conformance.ts (fb386074f5). None touches a file in this diff, and a no-driver merge-tree of the head onto 1378ec7c0c exits 0. So there was no merge. The open-PR file lists were re-read at 00:18Z: 11 open PRs, none touching a file in this diff.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/spec, touching 17 documentable anchor(s). ⚠️ 13 changed file(s) yielded no anchor (packages/spec/src/data/aggregate-field-type-compatibility.ts, packages/spec/src/data/api-derivation.ts, packages/spec/src/data/datasource-credential-redaction.ts, …), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

13 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/concepts/metadata-driven.mdx (via FieldSchema (symbol, a top-level const))
• content/docs/data-modeling/drivers.mdx (via MongoConfigSchema (symbol, a top-level const), MysqlConfigSchema (symbol, a top-level const))
• content/docs/data-modeling/external-datasources.mdx (via FieldSchema (symbol, a top-level const))
• content/docs/data-modeling/field-types.mdx (via FieldSchema (symbol, a top-level const))
• content/docs/data-modeling/validation-rules.mdx (via FieldSchema (symbol, a top-level const))
• content/docs/deployment/troubleshooting.mdx (via FieldSchema (symbol, a top-level const))
• content/docs/deployment/validating-metadata.mdx (via FieldSchema (symbol, a top-level const))
• content/docs/getting-started/quick-reference.mdx (via FieldSchema (symbol, a top-level const))
• content/docs/kernel/contracts/data-engine.mdx (via FieldSchema (symbol, a top-level const))
• content/docs/protocol/backward-compatibility.mdx (via FieldSchema (symbol, a top-level const))
• content/docs/protocol/objectql/types.mdx (via FieldSchema (symbol, a top-level const))
• content/docs/protocol/objectui/concept.mdx (via FieldSchema (symbol, a top-level const))
• content/docs/ui/forms.mdx (via FieldSchema (symbol, a top-level const))

⛔ 2 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17/17-0.mdx (via DatasourceSchema (symbol, a top-level const), FieldSchema (symbol, a top-level const), HookContextSchema (symbol, a top-level const))
• content/docs/releases/v17/17-1.mdx (via FieldSchema (symbol, a top-level const))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 13 changed file(s) yielded no anchor (packages/spec/src/data/aggregate-field-type-compatibility.ts, packages/spec/src/data/api-derivation.ts, packages/spec/src/data/datasource-credential-redaction.ts, …) — pages documenting those are invisible to this run
• 1 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 137 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 1378ec7c0cce7f77155ec84eec06ab41e0ec9268 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 6dee3f05c6b667049827c3f5b9a9378b117755ce — the merge of head 96fd49caa2e88a14b1c4a598323b5cf245c79e20 into base 1378ec7c0cce7f77155ec84eec06ab41e0ec9268, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 6dee3f05c6b667049827c3f5b9a9378b117755ce && git checkout 6dee3f05c6b667049827c3f5b9a9378b117755ce
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 1378ec7c0cce7f77155ec84eec06ab41e0ec9268 96fd49caa2e88a14b1c4a598323b5cf245c79e20 && git checkout -B drift-repro 1378ec7c0cce7f77155ec84eec06ab41e0ec9268 && git merge --no-ff 96fd49caa2e88a14b1c4a598323b5cf245c79e20

node scripts/docs-audit/affected-docs.mjs --json 1378ec7c0cce7f77155ec84eec06ab41e0ec9268

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 1378ec7c0cce7f77155ec84eec06ab41e0ec9268 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 96fd49caa2e88a14b1c4a598323b5cf245c79e20
Local-runs: none

Read: card #20234 (body; every comment: triage 5856637615, the seat-2 pointer 5858331362, the stage-1 claim 5859418643, report 5860236501, ACCEPT 5860414140 and landing 5860571318, the stage-2 claim 5860586561, report 5861177436, contract review 5861396181, ACCEPT 5861418146 and landing 5861600944, the stage-3 claim 5876941555 and report 5881236928), PR #20533 (body, its one comment 5881210559, the 47-file list, the six commits and the net diff against the merge base 9bf5e67af, read from the local ref at the head above), the 38 cited commits (subject, message and stat for all; the diff wherever a rewritten line claims more than the subject), packages/spec/package.json files[], the citation gate's grammar and deferred surfaces, lint.yml's job roster, and the other 11 open PRs' file lists. Nothing was built, run or re-run; the diff was read with git, the anchors with git show, the numbers with grep. The check-runs were read for judgment once, at 2026-09-29T00:36:35Z; an input-gathering read nine minutes earlier, right after the PR opened, is not repeated here.

① Derived judgments

(a) Scope and file surface: right. 47 files: 45 .ts under packages/spec/src/data/**, the generated content/docs/references/data/feed.mdx, and .changeset/spec-data-provenance-anchors.md. Every claim exclusion is at the base blob on the head (data-engine.zod.ts, data-engine.test.ts, hook.form.ts, all five analytics* files, cube-member-inner-name-retirement.test.ts, driver/turso.zod.ts, filter-subtree-provenance.ts: base oid equals head oid, 11 of 11), and so are the four post-claim exclusions (driver/turso.test.ts 7fe99ebf9, object.form.ts 60713e06f, object.zod.ts befde04ca, filter-logic-conformance.ts c9b32acba). PR #20504 does edit driver/turso.test.ts and driver/turso.zod.ts, PR #20519 does edit object.form.ts, and object.zod.ts and filter-logic-conformance.ts have moved on origin/main since the merge base, so the four holds were real. The 12 open PRs at the judging read (11 plus #20536, opened after the dev's re-read) touch none of this diff's 47 files. origin/main is 23 commits ahead of the merge base; of the five data/ files it moved, none is in this diff. No governed surface is touched; 363 changed lines.

(b) Comment-only, no test string moves: right. git diff -U0 over the 45 .ts files: 174 lines added, 174 removed, and every added or removed line begins with a comment marker except one pair in object.test.ts:313, where the code half { revoked_at: { $nin: [null] } }, is byte-identical on both sides and only its trailing // comment changes. So no string literal, test title or code token moves anywhere in the diff, the 20 test files included; the dev's parser-level token comparison is not re-run and not needed for that verdict. Every file keeps its line count. Read by eye in full: datasource.zod.ts, driver/config-registry.zod.ts, driver/common.zod.ts, driver/driver-credential-refusal.test.ts, object.test.ts, filter.zod.ts, value-roundtrip-conformance.ts, api-derivation.ts and its test, feed.zod.ts, mapping.zod.ts, datasource-credential-redaction.ts, aggregation-conformance.ts, aggregate-field-type-compatibility.ts, and every remaining hunk.

(c) Anchor truth: right. 38 distinct sha-shaped tokens stand on added lines and none on removed lines; every one is a commit, rev-parse --disambiguate answers exactly one object for each, and all 38 are ancestors of origin/main at 31d281d3b2 (38 of 38). For all 39 sha-to-number pairs in the dev's table, the commit's own message or diff names the number it replaces (grep over git show; the message alone for 30, the diff for the rest). Sampled beyond the subject, across different numbers:

• #8696 to 90a12fb18: subject names A bound external.credentialsRef is silently dropped on the DSN branches of the mysql and mongodb driver arms #8696; its diff adds the mongodb DSN-branch pins (#8696 — mongodb: a bound secret reaches the client on the DSN branch), removes #8696 stays open for it, and the message states the rule the lines now describe (the credential rides beside an unmodified url as MongoClient auth, multi-host and +srv forms unharmed). It is the card's mongodb arm, and every rewritten site is about mongo. True anchor.
• #11065 to 20950404c: no commit message on origin/main names avg over a boolean field returns null on driver-memory and a number on sqlite — same rows, same dataset, same executor #11065 except two later ones; git log -S shows this commit is where the string first entered the tree, and its own changeset and tests say avg and sum over a boolean answer the SQL numbers instead of null and 0 (#11065). It decides the rule. True anchor.
• #9041 to d491625c1: subject names Nothing refuses the contradictory pair "external.credentialsRef bound + a config.url naming no user" — the binding is a silent no-op at connect #9041; its diff writes the datasource-level refusal, its tests and the migration entry, and the message lists the fences per triage. True anchor; the datasource.zod.ts:354 wording (the triage's fences, as this commit landed them) is true of it.
• #6345 to e2798fab7: the one-driver-vocabulary landing (mongo to mongodb, turso builtin, both hosts reading one table, fork-1 and fork-2 refusals), 83 mentions in its diff. True.
• #8772 to 75b7c240a: message says Direction 2 of the #8772 maintainer ruling; the builder forces required: true under controlled_by_parent, raw parse tolerant. True, and ADR-0055 stays cited beside it.
• #10165 to 801296050 and #10347 to 530c1df65: each message quotes the maintainer ruling it implements (ttl.onlyWhen with the canonical null predicate; the Archiver honouring a declared ttl). True; object.test.ts:313 ($nin unchanged by that commit) is true of 8012960.
• #12380 to 4045b954d: Part of #12380, makes the SQLite Field.json codec injective and its message carries the measured 13-of-17 boundary the v_json block encodes. True.
• #17590 to e04a0aff2, #19377 to a60c913de, #11658 to 1a6a19c31: each says Fixes the number and lands the rule the line describes. True.
• #13156 to fd289be45, #10274 to d1ba685ec, #14426 to 40a44b91b, #8794/#8836 to 1850ebbb0, #11350 to ece4dad31, #17348 to 51efbf116: subjects name other numbers, so each diff was read: fd289be is [finding] A FIFTH customer-facing refusal population in packages/spec — prose built inside plain function DECLARATIONS — 47 literals / 51 ids / 14 files, structurally invisible to Rule 3's sink pass #13156's A-half strip of tracker ids from function-declaration refusal prose; d1ba685 Fixes #10274 and gates the objectui-pin class; 40a44b9 writes the position-safe #14426 prescription and its pin; 1850ebb wrote both the [#8836] pin blocks and the [finding] The filter-subtree provenance mark is permanent and per-object, so a reused filter object can carry a stale author vouch past a boundary that would otherwise withhold #8794 survey correction the two lines describe; ece4dad records the maintainer ruling on nameability that hook-api.ts cites; 51efbf1 wrote the very field-value.zod.ts sentence being rewritten and pinned the driver-memory divergence by name in that driver's conformance suite. None is a sha that merely touched the number in passing.
  No ADR or scripts/adr-anchors/ file records a decision behind any of the 40 numbers (ADR-0104 mentions [finding] driver-sql's SQLite json codec is not round-trip faithful for a string whose content is valid JSON — '123' reads back as a number, and Postgres does not agree #12380 only as a reference), so the commit rung is the right rung for all 38, as it was for stages 1 and 2.

(d) Form C and D: right. Added-minus-removed tracker numbers is empty for every file, tests included: 50 distinct numbers on removed lines, 40 net-removed (163 sites), the other 10 (#7596, #7990, #8082, #8336, #8586, #9138, #9147, #11151, #11535, #14477) re-appear exactly as often as they were removed, on their own lines. No PR #N stands on any added line. Each rewrite says in words what the commit decided, in the form the stage-1 and stage-2 precedents used (commit 9-hex, or [commit 9-hex] where the marker form was used). The #17286 drop is within the ruling: no commit on origin/main names #17286 as a landing (the only two mentioning it are e04a0af, which cites the tracking card, and PR #20226's commit), the string entered the tree with e04a0af's own docblock, and filter.zod.ts:1021-1025 keeps the reason in words (a tracking card that recorded the semantics as undecided; measure driver-memory for the open set) while the warning that the paragraph is not the authority stays. Nothing author-shown is touched, so form D does not arise here. check:issue-citations runs in Lint & Repo Gates (success at the read); the 20 test files it defers are covered by the added-minus-removed count above.

(e) feed.mdx projection: right. Of every removed docblock line in the diff, exactly two fragments occur in a reference page at the base, both in feed.mdx (feed.zod.ts:15 and :18), and the page's two changed lines are those substitutions verbatim with the * prefix stripped; no other page under content/docs/references/ holds text this diff rewrote. driver-turso.mdx:24 still reads #6345, and rightly: it projects from the excluded driver/turso.zod.ts, unchanged here. check:docs runs in Type Check · source gates, success at the read, which is the generator's own verdict that the committed page equals its output at this head.

(f) Left-behind sites: right. api-derivation.test.ts:236 splits the TSDoc on the literal [#6259] and :237 asserts the history half is non-empty, so api-derivation.ts:163 is byte-identical and the commit sits on :164 (a line that held no number). field.zod.ts:370 reads objectui#6010 (field) and objectui#6110 + #6111 (section): the sentence's own grammar makes #6111 objectui's, so it is not a dead citation of this repository and leaving it is right (the #20330 grammar family, carrier named). aggregation-conformance.ts:398 and :407 are note strings of exported AGGREGATION_CASES rows: string tokens, which the claim's no code token moves already forbids touching, and their only readers print them as vitest assertion messages (memory-aggregation-conformance.test.ts:153, :164; mongodb-aggregation-translation.test.ts:113), never to an author; the same disposition stages 1 and 2 gave their shipped strings. The test titles #8656 (field.test.ts:1433) and #12868 (field-rows-option-description.test.ts:192) are strings, left by the claim's rule.

(g) Census arithmetic: the diff's own count is 163 sites over 40 numbers in 44 files, equal to the dev's totals row by row; four of the numbers were spot-probed (#8696, #17286, #9041, #11065 answer 404; controls #16862 200, #16714 404). The dev's REST census is otherwise not re-run.

② Semver level

patch for @objectstack/spec is right and Clause-②: no is right. The package ships bytes from this diff: files[] carries dist and src/**/*.zod.ts, and 14 of the 45 touched sources are .zod.ts files that ship verbatim, with their docblocks reaching dist. (b) shows no export, key, value or type moves, so nothing widens or narrows: the level that publishes docblock text and no surface is patch, the same level stages 1 (21ab410417) and 2 (5cf58eb164) took for the same act. The changeset names one package, carries no tracker number and no model identifier, and Check Changeset is success at the read.

③ Boundary flags

Blocking: none.

Dev flags, each answered:

1. Four exclusions beyond the claim's list: measured right in (a); the two files whose PRs have since landed (object.zod.ts 15 sites, filter-logic-conformance.ts 3 sites) are a later stage's, with the anchors recorded in the PR body.
2. The [#6259] marker line kept byte-identical, the sha one line down: verified in (f).
3. Thirteen collateral lines with no number (reflow halves, the card or commit table header at value-roundtrip-conformance.ts:20, the :164 carrier): all comment text, all inside the 174-for-174 balance.
4. The census instrument and the earlier-head gate incidents (exit 3 before the closure build, a runner timeout, lock queue timeouts): none is a verdict; the head's check-runs answer every family that matters here.
5. The dev unshallowed the shared repository and fetched a scratch ref: the checkout reads not shallow now, and refs/os-review/ is empty, so the ref was deleted as stated. A side effect on the common .git, benign, not this diff's; noted.
6. Commit trailers: all six commits carry the model-free pair Claude-Session plus Co-authored-by: Claude, no model identifier.
7. No merge of origin/main: right; 23 behind at the read, 0 of them touching a file in this diff.
8. Six commits, no force-push; 9. worktree cleanup: not observable from here, not this diff's.
   Open questions: the report lists none. Out-of-scope findings: the [finding] check-issue-citations reads the pre- in pre-#N (and post- in post-#N) as a repository qualifier, so a dead number in that spelling is classed cross-repo and never judged #20330 grammar family (capitalised qualifiers, objectui#6110 + #6111) has its carrier named; the two note strings and the two freed files go to a later stage of this card.

Non-blocking wording, each true of its commit: mapping.zod.ts:89-90 now says the triage ruling that commit 15d58db landed confirms the declined dialect, and that commit's own changeset and docblock record exactly that (the #10329 triage ruling declined again, confirms that posture). field-value.zod.ts:125 credits 51efbf1 with the pinning, which is exact, though the divergence it pins was filed as its own card. datasource.zod.ts:352 names 90a12fb for the defect class closed for mongo only, which is the arm the paragraph is about. The PR's docs-drift comment 5881210559 flags 13 changed files with no documentation anchor; it is the bot's advisory on a comment-only diff, and Flag docs affected by code changes is success.

Escalated: none.

CI at this head, the judging read: 34 check-runs, 31 success, 2 skipped (Console Pin Gate, Packed-tarball smoke (opt-in)), 0 failure, 1 not concluded: Test Core (5/6) was still in progress and its Test Core aggregate had not yet been created, so the required Test Core context is NOT presumed green here and must be read concluded before the PR is armed. The other required contexts are success: Lint & Repo Gates, TypeScript Type Check (with its four lanes), Dogfood Regression Gate, Build Core, Temporal Conformance (live PG + MySQL), Governed Surface Queue Guard. No red run exists to attribute. Gate families the dev derived (108) are answered here by Lint & Repo Gates (the repo check:* steps, pnpm lint, the diff-scoped citation pass, doc-authoring), Type Check · source gates (the spec check:generated family: docs, api-surface, authorable-surface, liveness and siblings), Type Check · workspace (typecheck), Type Check · debt ledger, Type Check · consumer gates, Build Core, the Test Core shards, Spec property liveness and Check Changeset. PR is a draft, mergeable_state blocked (draft), first line Part of #20234, no closing keyword, Clause-②: no present.

Implemented-by: claude/issue-20234-dead-citations-data
Reviewed-by: session_014EJ1ED8X4MMrT18BhVx4tx

VERDICT: PASS

---

Generated by Claude Code