docs(runtime): re-anchor the dead tracker citations in packages/runtime/src to the commits that decided them

[objectstack-fleet]

Part of #20594
Clause-②: no

What changed

This is stage 1 of the domain:cli lane of the dead-citation sweep: packages/runtime/src/**, the lane's largest package. Every comment or docblock site in scope that cited a tracker number answering 404 now cites, in ruling C+D's form C (comment 5749154545 on #19123), the commit in this repository's history that decided what the line describes, and says in its own words what that commit decided. PR #20533 is the method and PR #20609 the closest sibling. Later stages cover rest, cli, types and the rest of the lane, so this PR says Part of and the card stays open.

That is 513 comment sites on 508 lines in 118 files, covering 96 numbers: 194 of the census's 217 sites, and 319 more in test comments, which the census defers. Three more sites carried a slash-joined dead number the citation grammar does not read (#10629/#10630, #5811/#12281, #8421/#12194), and they are rewritten too. Each rewritten line cites one of 95 distinct commits.

No ADR or ruling-record file in docs/adr/ or scripts/adr-anchors/ records the decision behind any of these numbers. ADR-0126 and ADR-0131 name #10243 only as the incident, ADR-0126 names #11513 only for the flow-clone half, and ADR-0112 names #12281 only as another card. So every anchor is a commit. The anchors the landed stages already gave the same numbers are reused (24 numbers, for example f19475c0a for #14143, e2798fab7 for #6345 and 79c46da90 for #9934), so each number carries one anchor across the tree.

Only comments changed. Every touched file keeps its line count (508 lines out, 508 in, over 118 files), so no line citation into these files moves. Seven of the 508 lines held no census site. Five are the other half of a sentence that had to change: action-governance-scope-divergence.test.ts:6 (「the card names」 to 「that diverged」, because line 4 no longer names the card), action-record-load-denied.test.ts:560, dispatcher-5xx-demoted-code-withhold.test.ts:45 (「that card's change」 to 「that commit's change」), hook-input-writeback-readonly-provenance.integration.test.ts:380 (「that card」 to 「that commit」) and standalone-stack-seeder-declaration-copy.test.ts:88 (a trailing 「PR」 whose number wrapped onto line 89). Two carry only a slash-joined number: dispatcher-plugin.ts:688 and meta-compound-arity-mint-door.test.ts:4. No code token moves (see the guard below).

No citation number is added. Every tracker number on an added line was already on the line it replaces. No PR number stands on an added line, and none of the 95 shas is on a removed line.

Twenty-eight dead comment sites are left on purpose:

• 20 in domains/meta.ts. PR fix(service-automation,metadata-protocol,runtime): withhold the remaining stored flow-credential positions at every depth, and answer a /meta list fault as itself (#20590) #20615 ([security] closeout: two stored-credential positions outside #20552's projection still reach a served read unredacted (a flow http node's signingSecret; the /meta list read's raw fallback) #20590's) opened at 2026-09-29T08:12:40Z, after this stage's claim and first read, and edits that file. So the file went back to its base blob (b4ddb362cc) in a5cdfd8a46, as PR docs(lint): re-anchor the dead tracker citations in packages/lint/src to the commits that decided them #20612 did with authoring-rules.ts. The anchors are verified and listed below for the follow-up.
• 8 with no deciding commit, or with a literal reader. See "The sites left" below.

One more file: a patch changeset for @objectstack/runtime, because the rewritten docblocks ship (see Changeset below).

Census: packages/runtime, before and after

Instrument. The gate's own node scripts/check-issue-citations.mjs --census --json, read-only and unchanged, run with the fleet token. Its surface is comment prose in packages/**/src/**/*.ts with string literals blanked, and it defers *.test.ts. The count is its allocated-but-absent findings under packages/runtime/. Both runs enumerated the whole board (185 pages), so neither read a truncated board.

reading	tree	board	whole-repo allocated-but-absent	runtime sites	lines	files	numbers
before	base eb4b17c346, run 2026-09-29T07:55:51Z to 08:05:47Z	enumerated, 185 pages, frontier #20614, 18,441 numbers	2,397	217	216	29	59
after	head a5cdfd8a46, run 09:08:23Z to 09:14:11Z	enumerated, 185 pages, frontier #20623, 18,450 numbers	2,027	23	23	4	12

The before count equals the card's 217 at f11b5f20a2. The 23 left are the 20 held domains/meta.ts sites and 3 deliberate ones (api-exposure.ts:108, domains/mcp.ts:360, route-ledger.ts:300). The whole-repo drop is 370: this diff's 194, plus the 97 and 79 of PR #20609 and PR #20612, which landed on main in between and came in with the merge.

Supplementary instrument, the whole scope. The census does not read test files or strings, and this stage's scope includes test comments. So a second reading runs the gate's own exported extractCitations (whole-file and comment-prose projections) and classifyCitation over every .ts file under packages/runtime/src (373 files), against a board probed by REST for every number cited there. The lit controls #16862, #16847 and #17698 answered 200 and the dead controls #16714, #16715 and #16697 answered 404 in both runs.

reading	tree	citations	dead	src comment	test comment	src string	test string
before, 08:17:55Z	eb4b17c346	5,364	641	217	324	5	95
after, 09:24:24Z	a5cdfd8a46	4,851	128	23	5	5	95

Its src-comment column equals the census's 217 and 23, which is the control on the second instrument. The 4,499 resolving citations, the 195 that resolve as pull requests and the 29 cross-repo ones are the same in both readings. The drop is 513, exactly this diff's grammar-read sites.

Per-number table

Sites and files are the dead comment sites in scope at the base, tests included. held is domains/meta.ts (see above) and left is a site with no deciding commit or with a literal reader. strings kept counts string-literal sites, which are tokens and stay as they were. Every anchor was read in its message or its diff, not only in its subject: it is the commit that made the change the line describes, and its own message or diff names the number it replaces.

number	comment sites / files	rewritten	held	left	strings kept	anchor
#6065	1/1	1	0	0	0	026101660
#6123	1/1	1	0	0	0	59d1933f9
#6206	5/2	5	0	0	0	8e13ca876
#6216	2/1	2	0	0	1	f586f1a89
#6220	1/1	1	0	0	0	83df2fd73
#6238	2/2	2	0	0	2	c8d6f6e08
#6259	4/2	3	0	1	1	6968885ef
#6265	12/2	12	0	0	4	cfb549db8
#6268	9/3	9	0	0	0	68f5eccb1
#6287	1/1	1	0	0	0	84c86fb45
#6307	1/1	1	0	0	0	293476148
#6316	6/3	6	0	0	0	448ac9565
#6345	10/3	10	0	0	0	e2798fab7
#6361	4/2	4	0	0	6	90bbf2510
#6363	6/2	6	0	0	2	17d095413
#6483	3/2	3	0	0	0	ee58392e1
#8722	1/1	0	0	1	0	—
#8724	1/1	1	0	0	0	ff4ba6a06
#8726	8/4	7	1	0	1	e783e163d
#8796	13/3	13	0	0	4	a4331227b
#8848	3/2	1	2	0	1	4fc4a3c0b
#8919	1/1	0	1	0	0	b5378550e (held file)
#9934	17/7	17	0	0	4	79c46da90
#9967	1/1	1	0	0	0	8f266f1cd
#10179	1/1	0	0	1	2	—
#10243	40/13	40	0	0	9	266436a7f, 02b41232d
#10293	3/3	3	0	0	0	92a69d813
#10338	1/1	1	0	0	0	d2619fd0c
#10340	3/2	2	1	0	1	26f3588fb
#10380	12/2	12	0	0	0	dd8172ee2
#10485	3/3	3	0	0	0	35ad101bc
#10503	8/2	3	5	0	1	67ceb9aef
#10537	2/1	2	0	0	0	e634ecf6a
#10554	1/1	1	0	0	0	6abc4df03
#10629	75/23	75	0	0	0	13a6cb4ad
#10630	4/1	4	0	0	0	dd8172ee2
#10789	2/1	2	0	0	1	38bc74ed1
#10886	1/1	1	0	0	1	809e61221
#10888	3/3	2	1	0	1	d806081dd
#10961	5/3	5	0	0	3	222d06fc1
#10965	2/1	2	0	0	1	ab47f6974
#10978	1/1	1	0	0	0	4c9780c7a
#10983	3/2	3	0	0	0	6a4e929f5
#11006	4/4	3	1	0	0	cccbe51bf
#11015	3/1	3	0	0	0	82cb6e849
#11166	8/3	8	0	0	4	735f5c709
#11333	1/1	1	0	0	0	ea4d16420
#11504	3/2	3	0	0	0	f90e82024
#11513	2/2	2	0	0	0	e170b0ae5
#11703	8/3	8	0	0	1	5cb62d88b
#12010	1/1	1	0	0	0	77b91bdb4
#12176	5/5	5	0	0	0	7986d973f
#12194	11/4	8	3	0	0	311433f6b
#12195	9/4	4	5	0	10	7986d973f
#12281	20/5	20	0	0	5	0783d7b80
#12943	7/3	7	0	0	0	090f2302e
#13037	8/2	8	0	0	5	e7dfb1d69
#13233	5/1	5	0	0	0	3800e4293
#13241	5/4	5	0	0	1	a21d2a9cf
#13273	11/3	11	0	0	0	3a86a65e7
#13279	3/2	3	0	0	0	6a180e42d
#13325	3/1	3	0	0	0	2e0b7b18f
#13644	5/4	5	0	0	1	34ce8e7db
#13657	13/1	13	0	0	1	b003cf2e8
#14143	26/8	26	0	0	4	f19475c0a
#14390	1/1	1	0	0	0	9d7f7259f
#14398	3/1	3	0	0	0	317132495
#14403	6/1	6	0	0	0	93d2d679b
#14421	2/1	2	0	0	0	bd8795ea1
#14422	4/2	4	0	0	4	dc7c226b9
#14423	3/1	3	0	0	1	a56baa2bd
#14474	1/1	1	0	0	0	df657d9df
#14667	2/1	2	0	0	0	dc7c226b9
#14678	2/1	2	0	0	2	73ad0bba7
#14683	2/2	2	0	0	0	96326040f
#14723	1/1	1	0	0	0	65846bc46
#14745	1/1	0	0	1	0	—
#14748	1/1	1	0	0	1	92b5d7f00
#14758	15/5	15	0	0	1	84199cb87
#14760	6/2	6	0	0	2	ee32e1cb8
#14864	3/3	3	0	0	3	066dd3bd0
#14878	2/1	2	0	0	1	29db3cd2a
#14908	3/2	3	0	0	0	d5cbb44f3
#14921	2/1	2	0	0	0	c1d274de7
#15063	2/1	2	0	0	0	ad35745e8
#15068	2/2	2	0	0	4	8744de9e9
#15071	5/2	5	0	0	0	cf6e0a193
#16610	3/1	3	0	0	0	316a20fc5
#16649	4/1	4	0	0	0	44c917a47, 613bfbd3d
#16755	1/1	1	0	0	0	44c849c7d
#16758	1/1	1	0	0	0	6e9bee640
#16783	1/1	1	0	0	0	854639b31
#16919	1/1	1	0	0	0	2cd4c548e
#17038	1/1	0	0	1	0	—
#17039	1/1	1	0	0	0	edf59e359
#17041	2/2	0	0	2	0	—
#17114	2/2	2	0	0	2	4af758d47
#17147	1/1	1	0	0	0	aaacf1d5c
#17148	1/1	0	0	1	0	—
#17195	1/1	1	0	0	0	d2c1d1980
#17219	1/1	1	0	0	0	706ad0fcc
#19364	2/2	2	0	0	0	ada701220
#19394	5/2	5	0	0	0	0862063ba

Every cited sha matches exactly one object (git rev-parse --disambiguate, count 1 for each of the 95), is a commit, has one parent, and is an ancestor of the base (merge-base --is-ancestor, exit 0 for all 95). The checkout is not shallow (--is-shallow-repository false), and the control leg 13a6cb4ad exits 0 too.

Numbers with more than one anchor, by site:

• #10243 (40 sites): 266436a7f for the 26 sites that describe the 2026-08-23 ruling it implements (the enablement door joins the manage_metadata write set, with the trigger exclusion), and 02b41232d for the 14 that name the leak itself (「the leak commit 02b4123 measured」). That commit recorded the measurement over HTTP and says it is part of that card.
• #16649 (4 sites): 613bfbd3d for the first half (the fourteen remaining boot-refusal rows registered) and 44c917a47 for the second (the face refusal widened to every published package, and boot-refusal retired).
• #12176, #12194, #12195: the stages of one ruled retirement. 311433f6b is stage 1 (the item-name grammar refused at the publish door) and 7986d973f is stage 3 (the compound arities un-mounted). These are the anchors the spec stages gave.

Wordings to check, each true of its commit:

• #10293 (3 sites) cited the p1 flake whose signature had the expected-noise lines lifted into it. They now read 「(a vitest teardown race, fixed by commit 92a69d8)」. 92a69d813 names that number in its subject and fixed the flake by disarming vitest's console-forwarding teardown race, which is why the noise pointed the dispatch at the wrong mechanism.
• #16755 and #16783 each cited an open PR that held a file at the time. They now read 「the change that landed as commit 44c849c held that file」 and 「then held by the change that landed as commit 854639b」. Each commit's diff edits the named file (domains/automation.ts, seed-loader.test.ts).
• Quoted rulings keep their words. dispatcher-plugin.declared-5xx-prose-withhold.test.ts:13 and dispatcher-plugin.declared-user-message.test.ts:35 quote the 2026-08-27 ruling, and dispatcher-5xx-demoted-code-withhold.test.ts:281 quotes an older note. There the commit stands in an editorial bracket ([commit 79c46da90], [commit 0783d7b80]) in place of the number.
• #9934's 「second constraint」 and 「third constraint」 now read 「the ruling's second constraint, commit 79c46da」. That commit's own diff calls status-agnosticism 「the ruling's second constraint」.
• domains/packages.ts:841 read 「declares, since feat(spec): the /packages doors declare the query parameters they execute, and retire the two they never did #19364:」 above the enabled line, but that line predates ada701220 (feat(spec): the /packages doors declare the query parameters they execute, and retire the two they never did #19364's commit). It now reads 「declares — a key commit ada7012 kept rather than retired:」.
• route-ledger.ts:288: 「[finding] An index-slice edit silently deleted 105 lines of route-ledger.ts and exited 0 — nothing in the file's own gates noticed; it was caught by an unrelated gate reddening #16758 filed the second kind」 now reads 「Commit 6e9bee6 gated the second kind」, because that commit added the row census after the index-slice incident the sentence goes on to describe.
• flow-clone.ts:7 and domains/automation.ts:2403 cite e170b0ae5 for Studio save of a package-declared permission set forks it into a silent, undiscoverable overlay #11513: the commit that landed 「lock package-declared permission sets at the save door; clone to customize」, whose changeset names the number.

The sites left

No deciding commit, or a literal reader (8 sites):

• api-exposure.ts:108 (DATA_ACTION_TO_API_OPERATION 的 batch: 'bulk' 行在 #5856 之后没有生产者了 —— spec 注释仍称其为「runtime callData action」 #6259): api-exposure.test.ts:152 splits this @param block on the literal '#6259', so rewriting the comment would change what the test measures. Its deciding commit is 6968885ef, which the three test-comment sites of the same number now cite.
• domains/mcp.ts:360 (Should the sys_metadata overlay merge move down into MetadataService.list(), so every consumer gets merged rows? #8722): a wider contract change 「archived unscheduled」. It never landed, so no commit decided it.
• domains/meta-state-plural-tolerance.test.ts:130 ([finding] The legacy dispatcher /meta branch still matches the plural objects literal after step ② retires the REST registration #10179): an untaken option on a tracking card. The only commit naming the card, 53a48c93f, recorded the opposite state.
• package-door-namespace-conflict-code.test.ts:30 ([finding] Three residues left by PR #14738's contract review: the new vocabulary row's why over-generalises why its siblings are door: none, the row's reachability has no permanent pin, and the changeset's "not narrowed, not widened" reads against its own bullets #14745): a residue item on a review card. The only commit carrying the token is the one that added this file.
• route-ledger.conformance.test.ts:33 (docs(runtime,automation): document the run-lifecycle doors, and turn two ledger notes into a decision #17038): an ablation measured on a PR whose squash commit, 6a7910abb, neither records nor performs it.
• route-ledger.conformance.test.ts:38 and route-ledger.ts:300 ([finding] The route-ledger conformance suite asserts only at DOMAIN granularity, so ANY single route row can vanish from ANY of the 11 ledgers with nothing red — measured by deleting one #17041): a maintainer decision the lines call open.
• security/artifact-granted-permissions.test.ts:291 (Reading needed from the cloud side: can ArtifactKernelFactory serve an artifact that declares grantedPermissions but carries NO packages array? #17148): a question the line itself says is unsettled.

Held with domains/meta.ts (20 sites), anchors verified for the follow-up: #8726 :116 to e783e163d; #8848 :200, :1398 to 4fc4a3c0b; #8919 :1247 to b5378550e; #10340 :1309 to 26f3588fb; #10503 :14, :1143, :1159, :1250, :1308 to 67ceb9aef; #10888 :1337 to d806081dd; #11006 :103 to cccbe51bf; #12194 :831, :1050, :1173 to 311433f6b; #12195 :819, :827, :1046, :1167, :1960 to 7986d973f. PR #20615's one hunk there is at :1874, disjoint from these lines, but the rule is file-level.

String sites kept as tokens (100). 95 are test titles and test-code strings in 43 files. Five are non-test strings: the route-ledger.ts note fields at :435, :441 and :505, a string at dispatcher-error-vocabulary.ts:349, and the enablement door's refusal text at domains/activation-gate.ts:279, which ends 「(#10243).」 (see Acceptance notes).

Mechanical guard: no code token moves

The check compares the TypeScript parser's leaf tokens (TypeScript 6.0.3, JSDoc nodes excluded, so template literals are read in context) of each touched file at base eb4b17c346 against the working tree at a5cdfd8a46, over all 118 touched .ts files. Controls mutate the head text in memory only, so nothing on disk moved for them.

• Real run: 301,081 base tokens, 0 files with a token change (exit 0).
• Comment-insertion control (domains/activation-gate.ts): 0 files changed (exit 0).
• Code-insertion positive control (a declaration in the same file): DIFFER at token 34 (exit 1).
• String positive control ((#10243) to (#10244) inside the kept refusal string): DIFFER at token 339 (exit 1).

Line balance: every touched file is +N/−N (508/508), and every line count is equal at base and head. A raw scan of the 119 changed files for control bytes finds none.

Changeset

This change ships bytes, so a patch changeset for @objectstack/runtime is included, in PR #20609's form and level. It says only that the provenance comments were re-anchored.

Measured on the built package: files[] is dist, README.md and CHANGELOG.md. After pnpm --filter @objectstack/runtime build, the rewritten docblocks reach dist: for example e2798fab7 appears 3 times and 68f5eccb1 6 times in dist/index.d.ts, and f19475c0a 4 times in dist/index.js. The positive control, the unchanged sentence 「drags @libsql/client (native bindings included)」 of the same turso-driver-factory.ts docblock, is in dist/index.d.ts, and a negative control phrase appears nowhere. The only dead number left in dist is the kept refusal string's #10243.

Gates (head a5cdfd8a46)

This host has no flock, so os-verify-lock.sh ran in its declared unlocked mode. Its disclosure, verbatim, from each locked run at this head:

os-verify-lock: VERDICT command-exit 0 · UNLOCKED (declared) · no usable `flock` on this host, so the shared verify lock was NEVER taken and NOTHING was serialized · ran 5s · declare it in the PR body · pnpm --filter @objectstack/runtime build
os-verify-lock: VERDICT command-exit 0 · UNLOCKED (declared) · no usable `flock` on this host, so the shared verify lock was NEVER taken and NOTHING was serialized · ran 99s (1m39s) · declare it in the PR body · pnpm --filter @objectstack/runtime exec vitest run --project local --maxWorkers=2
os-verify-lock: VERDICT command-exit 0 · UNLOCKED (declared) · no usable `flock` on this host, so the shared verify lock was NEVER taken and NOTHING was serialized · ran 6s · declare it in the PR body · pnpm --filter @objectstack/runtime exec vitest run --project repo --maxWorkers=2
os-verify-lock: VERDICT command-exit 0 · UNLOCKED (declared) · no usable `flock` on this host, so the shared verify lock was NEVER taken and NOTHING was serialized · ran 8s · declare it in the PR body · pnpm --filter @objectstack/runtime typecheck

The dependency closure and the whole workspace were built first, at the merge head ca6d13d6ab, the same way: turbo run build --filter='@objectstack/runtime...' (30 tasks, exit 0) and turbo run build --filter='./packages/*' --filter='./packages/*/*' (71 tasks, exit 0). a5cdfd8a46 differs from that head only in domains/meta.ts, which went back to base bytes, and @objectstack/runtime was rebuilt at a5cdfd8a46.

• Tests: vitest run --project local: 288 files, 4,190 tests passed, 1 skipped. --project repo (which holds the touched action-owner-key-single-source.test.ts): 3 files, 727 tests passed. Together they cover every touched test file.
• Typecheck: pnpm --filter @objectstack/runtime typecheck exits 0. tsc --listFiles counts 82 src files (no tests) under tsconfig.json and all 291 test files under tsconfig.test.json, which check:test-typecheck judges: 27 files, 190 errors, 68 pinned signatures held.
• Lint: the repo-wide pnpm lint (eslint . --no-inline-config) exits 0 at a5cdfd8a46 (2026-09-29T09:23:06Z to 09:23:36Z). A narrowed run over the 118 touched .ts files through eslint's API agrees: 118 linted, 0 ignored, 0 errors, 0 warnings.
• Citation judging: node scripts/check-issue-citations.mjs --base origin/main exits 0. The diff-scoped run judged 23 citations across 28 files, and all 23 resolve. These are the live numbers that stay on rewritten lines. It defers *.test.ts, so the added-minus-removed count over the whole diff covers the rest: 0 numbers added.
• Derived gates: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands at a5cdfd8a46 derived 67 families, the same set as at the merge head. All 67 exit 0. --ran reads 「67 derived, 67 run, 0 NOT-MEASURED, 0 UNRUN」.
  • At the merge head, check:dual-build-cjs-loads and check:type-check-debt first exited 3 (PREREQUISITE NOT MET) on a partly built workspace. After the whole-workspace build both exited 0, and both exit 0 at the final head.
  • Among them: check:doc-authoring (the sibling prose-id baseline holds, 810 pinned sites, no growth), check:nul-bytes (9,250 files, no raw control bytes), check:route-ledger-census, check:dispatcher-error-vocabulary and check:issue-citations (self-test, 114 cases in 8 batteries).
• Artifact rosters: 38 of the 41 non-self-test roster rows exit 0 at the merge head. The other three, check-closing-target-claim, check-partof-closing-keyword and check-single-claim-paths, answer 「NOT WIRED」 (exit 2) without a pull request's context, and are run against this PR and reported on the card.

Hypotheses (measured first)

• H0 holds. The filtered census answers 217 dead sites at eb4b17c346 (29 files, 59 numbers), equal to the card's count at f11b5f20a2: no drift.
• H1 holds, with the listed exceptions. After the rewrite the filtered census answers 23: the 20 sites held with domains/meta.ts for an open PR, and 3 deliberate ones (a literal reader, a card never landed, an open decision). The supplementary reading adds 5 test-comment sites of the same two kinds.
• H2 holds, by the token guard. A comment-stripped comparison of every touched file (the parser's leaf tokens, JSDoc excluded) is empty, and its controls fire. The emitted dist is not byte-identical, because the docblocks ship, which is why the changeset is patch.

Acceptance notes

• The held file. The claim's read (07:51Z) and this stage's first read of the open PRs' file lists (08:06:32Z, 8 open PRs) found none touching packages/runtime/src. PR fix(service-automation,metadata-protocol,runtime): withhold the remaining stored flow-credential positions at every depth, and answer a /meta list fault as itself (#20590) #20615 opened at 08:12:40Z and edits domains/meta.ts. The re-read at 09:07:08Z (7 open PRs) found it, and it is the only open PR touching the package. The file went back to its base blob in a5cdfd8a46, and git hash-object equals b4ddb362cc, the blob at the base and at origin/main. The 20 anchors above are ready for the follow-up once that PR lands.
• Form D, not touched here. domains/activation-gate.ts:279 is part of the enablement door's refusal message and ends 「(Decide whether POST /api/v1/automation/:name/toggle belongs in the manage_metadata write set — it mutates flow enablement with no authoring capability #10243).」. An author sees it, so it is ruling D's (no number, the lesson in words), a string change outside this comment-only scope. It needs a form-D carrier. The other four non-test string sites are ledger note data and a gate's own string.
• The grammar does not read a slash-joined number. CITATION_RE refuses a # preceded by /, so the second number of #A/#B is never judged. In packages/runtime/src, 3 such dead numbers exist (#10630, #12281, #12194), and all 3 are rewritten here. The other 36 distinct slash-joined numbers there were probed by REST and answer 200. One more dead one, #17219, stands slash-joined inside a test title, a string, and is kept. This is the same shape as PR docs(lint): re-anchor the dead tracker citations in packages/lint/src to the commits that decided them #20612's slash-joined #5775/#6629. It is noted, not filed.
• Outside the scope and the census surface. packages/runtime/vitest.config.ts:54 cites #17853, which answers 404. The file is outside src/**, so it is left for whoever owns the package's config. The other numbers there, and those in tsup.config.ts and README.md, answer 200.
• Base. The branch merged origin/main once (ca6d13d6ab, merging c1d8051e0a) before the --base origin/main run, as the dispatch orders. That merge brought PR docs(service-messaging): re-anchor the dead tracker citations to the commits that decided them #20609's and PR docs(lint): re-anchor the dead tracker citations in packages/lint/src to the commits that decided them #20612's landed stages and touched none of this diff's files. origin/main has since moved to ed6f7348f9, one commit that touches only packages/cli, so there was no second merge.
• Anchors shared with the landed stages. 24 numbers keep the anchor the spec, lint or service-messaging stages already gave them, for example f19475c0a (action dispatcher stamps ctx.record.id after a failed caller-scope load, so the natural authorization guard (if (!ctx.record?.id) refuse()) is always true on a row the caller cannot read #14143), b003cf2e8 (The undeclared-field door sits in FRONT of the hooks, so a key a beforeInsert hook writes has no door at all — and the drivers then disagree (memory stores it, SQL throws a raw statement error) #13657), 311433f6b (D1: declare the metadata item-name grammar in spec and refuse it loudly at the publish door — dotted qualified form becomes enforced (#12176 stage 1) #12194), 8e13ca876 (同族第三处组装:share-link 路由把授权信封裁成 4 个字段后直接当 enforcement context 喂给 engine.find —— group 租户姿态下 Layer 0 墙恒判否 #6206) and 17d095413 (notification 响应侧:unreadCount 声明「总未读数」实测只数 limit 窗口内;响应 cursor 从无 producer 发出 #6363).

Deviations

• Three changed lines hold only a slash-joined dead number, beyond the census's sites (see Acceptance notes). Five more are the other half of a rewritten sentence (listed under What changed).
• Commit trailers are AGENTS.md's model-free pair (Claude-Session plus Co-authored-by: Claude), and the pre-push trailer check passed on every push. The merge commit carries git's default message.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/runtime, touching 46 documentable anchor(s). ⚠️ 7 changed file(s) yielded no anchor (packages/runtime/src/api-mapping.ts, packages/runtime/src/domains/activation-gate.ts, packages/runtime/src/domains/ui.ts, …), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

14 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/client-sdk.mdx (via FLOW_INPUT_SCHEMA_INVALID (literal, a string literal in a comment on a changed line))
• content/docs/api/declarative-endpoints.mdx (via FLOW_INPUT_SCHEMA_INVALID (literal, a string literal in a comment on a changed line))
• content/docs/api/environment-routing.mdx (via createStandaloneStack (symbol, a top-level function))
• content/docs/api/plugin-endpoints.mdx (via FLOW_INPUT_SCHEMA_INVALID (literal, a string literal in a comment on a changed line))
• content/docs/automation/flows.mdx (via FLOW_INPUT_SCHEMA_INVALID (literal, a string literal in a comment on a changed line))
• content/docs/automation/hook-bodies.mdx (via ScriptContext (symbol, a top-level interface), applyMutationsToInput (symbol, a top-level function))
• content/docs/data-modeling/drivers.mdx (via createStandaloneStack (symbol, a top-level function))
• content/docs/deployment/single-project-mode.mdx (via createStandaloneStack (symbol, a top-level function))
• content/docs/permissions/authorization.mdx (via buildMcpBridge (symbol, a top-level function))
• content/docs/permissions/system-context.mdx (via handleActionsRequest (symbol, a top-level function), handleAutomationRequest (symbol, a top-level function), handlePackagesRequest (symbol, a top-level function))
• content/docs/plugins/index.mdx (via createStandaloneStack (symbol, a top-level function))
• content/docs/protocol/kernel/http-protocol.mdx (via FLOW_INPUT_SCHEMA_INVALID (literal, a string literal in a comment on a changed line))
• content/docs/protocol/kernel/index.mdx (via resolveExecutionContext (symbol, a top-level function))
• content/docs/ui/actions.mdx (via FLOW_INPUT_SCHEMA_INVALID (literal, a string literal in a comment on a changed line))

⛔ 1 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17/17-3.mdx (via FLOW_INPUT_SCHEMA_INVALID (literal, a string literal in a comment on a changed line), automation.toggle (sdk, the route ledger binds it to POST /automation/:name/toggle, selected by route anchor /:name/toggle), /:name/toggle (route, a path literal in a comment on a changed line), /automation/:name/toggle (route, a path literal in a comment in isFlowAuthoringWrite))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 7 changed file(s) yielded no anchor (packages/runtime/src/api-mapping.ts, packages/runtime/src/domains/activation-gate.ts, packages/runtime/src/domains/ui.ts, …) — pages documenting those are invisible to this run
• 3 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 26 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json e651556e2df1713873ad72f87e673b8e60174e66 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from a43f9595157be6e584254bf22a6d9da57f17d0fb — the merge of head a5cdfd8a46bb2f37c952f73e7a5a51c2c778df27 into base e651556e2df1713873ad72f87e673b8e60174e66, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin a43f9595157be6e584254bf22a6d9da57f17d0fb && git checkout a43f9595157be6e584254bf22a6d9da57f17d0fb
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin e651556e2df1713873ad72f87e673b8e60174e66 a5cdfd8a46bb2f37c952f73e7a5a51c2c778df27 && git checkout -B drift-repro e651556e2df1713873ad72f87e673b8e60174e66 && git merge --no-ff a5cdfd8a46bb2f37c952f73e7a5a51c2c778df27

node scripts/docs-audit/affected-docs.mjs --json e651556e2df1713873ad72f87e673b8e60174e66

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs e651556e2df1713873ad72f87e673b8e60174e66 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: a5cdfd8a46bb2f37c952f73e7a5a51c2c778df27
Local-runs: none

Inputs read: card #20594 (body and both comments, 5886012266 claim and 5887542107 os-dev-report), ruling 5749154545 on #19123, PR #20624 (body, file list over pulls/20624/files?per_page=100 pages 1 to 3 — 100 + 19 + 0 = 119 entries, and the net diff — 4,739 lines, 119 diff --git headers), and the check-runs on a5cdfd8a46 (two reads, the second at 2026-09-29T09:59:45Z governs). Everything below was measured with gh api REST over the fetched diff and file list; nothing was checked out, built or run.

Sampled, exactly: the whole diff was machine-scanned line by line (every +/- line classified as comment or not; every #N and every 9-to-40-hex token on removed and added lines collected). Read by eye: the changeset, the whole of domains/activation-gate.ts's diff, the whole of api-exposure.test.ts, route-ledger.ts and domains/mcp.ts's diffs, sandbox/script-runner.ts's five hunks, and the removed/added pairs for 27 numbers (#10243, #10629, #14143, #6345, #14758, #6363, #14421, #10293, #16755, #16783, #9934, #19364, #19394, #16758, #11513, #12281, #8796, #10630, #10380, #14422, #14667, #14678, #16649, #13325, #14908, #14683, #6361, #6265, #12194, #12195, #16919, #17039, #8726) across 36 files. For those, 33 anchor commits were fetched (message, file list, patch).

① Derived judgments

Accept sets and public surfaces: none move — right. No route, error code, schema, export, type, identifier, string literal, error message or test assertion changes anywhere in the 118 .ts files. What changes in the shipped artefact is docblock prose in dist/index.d.ts and dist/index.js (tsup dts is on, files[] is dist, README.md, CHANGELOG.md), and that is a published-bytes change, not a surface change — which is what the patch changeset says (see ②).

(1) Comment-only: yes. Of the 508 removed and 508 added lines in the 118 runtime files, 504 pairs start with //, /*, * or */ after whitespace. The other 4 are two trailing // comments on code lines, and the code before the // is byte-identical on each side: action-governance-scope-divergence.test.ts:209 (lookupRegistryAction: () = followed by undefined,) and notifications.hono.integration.test.ts:436 (expect(before.data.unreadCount).toBe(TOTAL);). No code token, string literal, error message, identifier or test assertion moved. domains/activation-gate.ts's whole diff is five hunks (lines 28, 67, 96, 152, 249), each inside a docblock; ACTIVATION_DENY_CODE, the exported functions and the refusal text at :279 (which still ends (#10243).) are untouched. api-exposure.test.ts's three sites are // [#6259] comment lines; the '#6259' literal the test splits on is not on any changed line, and api-exposure.ts itself is not in the file list (its :108 site is kept, as the PR says). domains/mcp.ts:360 (#8722) is not on any changed line (the string 8722 does not occur in the diff). The PR's parser-token guard was not re-run (read-only); the line-level reading agrees with it.

(2) Anchors: 95 distinct shas on added lines, 0 on removed lines — all verified, all supported in the sample. Every one of the 95 exists as a commit (commits/SHA 200), has exactly one parent, and compare/SHA...main answers ahead with behind_by 0 for all 95. The sample of rewritten sites, each read against its commit's subject, message and diff (file:line is the head file):

• domains/activation-gate.ts:96 and :249, domains/actions.ts:122, action-activation-posture-gate.test.ts:282 — Decide whether POST /api/v1/automation/:name/toggle belongs in the manage_metadata write set — it mutates flow enablement with no authoring capability #10243 → 266436a7f «POST /automation/:name/toggle joins the manage_metadata write set»; body: «Implements the maintainer ruling of 2026-08-23 on Decide whether POST /api/v1/automation/:name/toggle belongs in the manage_metadata write set — it mutates flow enablement with no authoring capability #10243 (option A)». Supported.
• domains/activation-gate.ts:28, :67, :152, activation-gate-positions-name-authority.test.ts:20, :206 — Decide whether POST /api/v1/automation/:name/toggle belongs in the manage_metadata write set — it mutates flow enablement with no authoring capability #10243 → 02b41232d «record the measured cross-organization reach of the automation toggle»; body records tenant A's toggle read back by tenant B and the platform admin, «Part of Decide whether POST /api/v1/automation/:name/toggle belongs in the manage_metadata write set — it mutates flow enablement with no authoring capability #10243». «the leak commit 02b4123 measured» is exactly that. Supported.
• app-plugin.job-data-reach.test.ts:113, batch-row-driver-text-real-driver.integration.test.ts:77 (75 sites, 23 files) — [finding] 15 more PASSING @objectstack/runtime tests print the same refused a read on feature — 134 lines after #10380 quiets its two, led by notifications.hono.integration.test.ts (52) #10629 → 13a6cb4ad «withhold and assert the expected refused a read on noise in 16 passing pins ([finding] 15 more PASSING @objectstack/runtime tests print the same refused a read on feature — 134 lines after #10380 quiets its two, led by notifications.hono.integration.test.ts (52) #10629)»; the commit edits those fixtures. Supported.
• action-execution.ts:1687, :1700, action-record-load-denied.test.ts:1, script-runner.ts:305 — action dispatcher stamps ctx.record.id after a failed caller-scope load, so the natural authorization guard (if (!ctx.record?.id) refuse()) is always true on a row the caller cannot read #14143 → f19475c0a «tell an action handler when its caller-scope record load was refused»; adds ctx.recordLoadDenied and the one shared producer; action dispatcher stamps ctx.record.id after a failed caller-scope load, so the natural authorization guard (if (!ctx.record?.id) refuse()) is always true on a row the caller cannot read #14143 is in its patch; «The recordId stamp is deliberately kept» matches «Unchanged by commit f19475c». Supported.
• resolve-project-database.ts:237, standalone-stack.ts:380, turso-driver-factory.ts:25 — cli/runtime: explicit driver(--database-driver / OS_DATABASE_DRIVER)在 CLI 与 standalone stack 之间仍有三处分叉(#6265 后续) #6345 → e2798fab7 «one driver vocabulary — os start and os migrate stop disagreeing (cli/runtime: explicit driver(--database-driver / OS_DATABASE_DRIVER)在 CLI 与 standalone stack 之间仍有三处分叉(#6265 后续) #6345)»; the fork-2 refusals are in its body. Supported.
• sandbox/body-runner.ts:527, :668, :732, script-runner.ts:440, quickjs-runner.ts:420, hook-input-writeback-readonly-provenance.integration.test.ts:1 (the card's control-set sites) — The sandbox hook write-back re-assigns EVERY ctx.input key, not the ones the body wrote — so #14099's per-row divergence refusal is order-dependent for shipped hook bodies and the corruption still lands #14758 → 84199cb87 «carry back only the keys a sandboxed hook body wrote»; «an unavailable recorder falls back to the full assign» is the fail-open the lines describe; The sandbox hook write-back re-assigns EVERY ctx.input key, not the ones the body wrote — so #14099's per-row divergence refusal is order-dependent for shipped hook bodies and the corruption still lands #14758 is in its patch. Supported.
• notifications.hono.integration.test.ts:409, :436, notification-schema-conformance.integration.test.ts:515 — notification 响应侧:unreadCount 声明「总未读数」实测只数 limit 窗口内;响应 cursor 从无 producer 发出 #6363 → 17d095413 «listInbox unreadCount counts total unread (notification 响应侧:unreadCount 声明「总未读数」实测只数 limit 窗口内;响应 cursor 从无 producer 发出 #6363)»; body: «Maintainer ruling (2026-08-07, Option A): make the declaration true». Supported.
• action-governance-scope-divergence.test.ts:13, :209 — «PR fix(objectql): the action-governance audit resolves declarations through the router's rungs #14421» (404) → bd8795ea1 «the action-governance audit resolves declarations through the router's rungs (fix(objectql): the action-governance audit resolves declarations through the router's rungs #14421)»; body: ObjectQLPlugin injects the registry rung. Supported.
• expected-read-refusal-noise.ts:49, metadata-list-ambient-vs-bare-transaction.integration.test.ts:92, notification-schema-conformance.integration.test.ts:108 — CI flake: @objectstack/example-showcase#test fails on mass sys_* Find operation failed + Acquire connection error: operation timed out — hit a merge-queue build and a PR run within 2h on unrelated prose-only diffs #10293 → 92a69d813 «disarm the vitest console-forwarding teardown race that reddens a green suite (CI flake: @objectstack/example-showcase#test fails on mass sys_* Find operation failed + Acquire connection error: operation timed out — hit a merge-queue build and a PR run within 2h on unrelated prose-only diffs #10293, finding: any late console.* in a vitest worker can fail a fully green suite — the #9371 amplifier is upstream and still live #10374)». «a vitest teardown race, fixed by commit 92a69d8» is true of it. Supported.
• domains/scoped-service-miss-attribution.test.ts:352 — «PR feat(runtime): give the two operator run-lifecycle verbs a door (cancel, restore-suspension) #16755» → 44c849c7d «give the two operator run-lifecycle verbs a door (feat(runtime): give the two operator run-lifecycle verbs a door (cancel, restore-suspension) #16755)»; its files include packages/runtime/src/domains/automation.ts, the file the line says was held. Supported.
• app-plugin.seed-locale-producer.test.ts:33 — «PR feat(engine)!: findOne, update and delete declare what they answer, and their hook seams are guarded (#16231) #16783» → 854639b31 «findOne, update and delete declare what they answer… ([finding] ObjectQL.findOne / update / delete return hookContext.result under a Promise[any] declaration — nothing to guard, because nothing is declared #16231) (feat(engine)!: findOne, update and delete declare what they answer, and their hook seams are guarded (#16231) #16783)»; its 31 files include packages/runtime/src/seed-loader.test.ts. Supported.
• dispatcher-plugin.ts:712, :771, http-dispatcher.permission-denied-user-message.test.ts:21, dispatcher-plugin.declared-user-message.test.ts:43 — contract: a hook refusal has no way to mark its message user-facing — the console's 403 substitution (ruled in #3821) needs a producer-side opt-in channel #9934 → 79c46da90 «producer-side user-facing marking for hook refusal messages — userMessage channel (contract: a hook refusal has no way to mark its message user-facing — the console's 403 substitution (ruled in #3821) needs a producer-side opt-in channel #9934)»; its diff carries the line «Status-agnostic on purpose (the ruling's second constraint)», the words the rewrite uses. Supported.
• domains/packages.ts:841, packages-list-enabled-filter.test.ts:42 — feat(spec): the /packages doors declare the query parameters they execute, and retire the two they never did #19364 → ada701220 «the /packages doors declare the query parameters they execute, and retire the two they never did (feat(spec): the /packages doors declare the query parameters they execute, and retire the two they never did #19364)»; its files retire ListInstalledPackagesRequest cursor and limit (the «request half») and keep enabled (the «key kept rather than retired»). Supported; the new wording also removes a «since feat(spec): the /packages doors declare the query parameters they execute, and retire the two they never did #19364» that the PR says was chronologically wrong.
• domains/packages.ts:836 — Ruling item 2 of #17667: the runtime packages door must read the enabled query parameter the spec door now declares #19394 → 0862063ba «GET /api/v1/packages honours the declared enabled query parameter»; body «Fixes Ruling item 2 of #17667: the runtime packages door must read the enabled query parameter the spec door now declares #19394 … Ruling item 2 of The /packages read doors' declared request schemas and their actual query reads diverge in BOTH directions — ?limit= and ?cursor= are declared and never read, ?type= is read and never declared #17667». Supported exactly.
• route-ledger.ts:288 — [finding] An index-slice edit silently deleted 105 lines of route-ledger.ts and exited 0 — nothing in the file's own gates noticed; it was caught by an unrelated gate reddening #16758 → 6e9bee640 «gate the route-ledger row census so a silent deletion reds»; body: «An index-slice edit meant to add two rows removed 105 lines»; [finding] An index-slice edit silently deleted 105 lines of route-ledger.ts and exited 0 — nothing in the file's own gates noticed; it was caught by an unrelated gate reddening #16758 is in its patch. «gated the second kind» is right. Supported.
• flow-clone.ts:7, domains/automation.ts:2403 — Studio save of a package-declared permission set forks it into a silent, undiscoverable overlay #11513 → e170b0ae5 «lock package-declared permission sets at the save door; clone to customize»; its changeset line ends «(Studio save of a package-declared permission set forks it into a silent, undiscoverable overlay #11513)». Supported.
• dispatcher-plugin.declared-5xx-prose-withhold.test.ts:1, :13, dispatcher-5xx-demoted-code-withhold.test.ts:279, :281, :284, analytics-query-read-scope-withhold.test.ts:44 — runtime: a declared 5xx carrying NO code keeps its prose on /analytics/query where /data withholds it unconditionally #12281 → 0783d7b80 «withhold the message of every declared 5xx at the dispatcher exit (runtime: a declared 5xx carrying NO code keeps its prose on /analytics/query where /data withholds it unconditionally #12281)»; body: «Maintainer ruling 2026-08-27 on [Decision] Is ADR-0112's declaredCode channel in scope for 5xx sanitisation at all — and the answer must be applied to all three doors at once #12509 (option D)». Supported; the [commit 0783d7b80] bracket inside the quoted older note at :281 is the editorial substitution the PR declares.
• domains/automation-resume-envelope.test.ts:1, :10, domains/automation.ts:2569 — automation resume: the request body's OUTER envelope is lenient — an unknown top-level key is silently ignored and the submission is treated as empty #8796 → a4331227b «the resume body's outer envelope becomes a closed set»; body: «(maintainer ruling 2026-08-15, Option A on automation resume: the request body's OUTER envelope is lenient — an unknown top-level key is silently ignored and the submission is treated as empty #8796)». Supported.
• metadata-list-ambient-vs-bare-transaction.integration.test.ts:75 ([finding] Two PASSING @objectstack/runtime tests print Acquire connection error and ~150 ERROR-level sql-driver DATABASE_ERROR lines into the shared Test Core log — they were adopted verbatim as a p1 flake signature #10380) and expected-read-refusal-noise.ts:3, :124 («PR test(runtime): withhold and assert the expected error noise in two passing pins #10630») → dd8172ee2 «withhold and assert the expected error noise in two passing pins (test(runtime): withhold and assert the expected error noise in two passing pins #10630)», «Fixes [finding] Two PASSING @objectstack/runtime tests print Acquire connection error and ~150 ERROR-level sql-driver DATABASE_ERROR lines into the shared Test Core log — they were adopted verbatim as a p1 flake signature #10380», touching exactly those two test files. One anchor for the issue and its PR is right.
• action-owner-key-single-source.test.ts:1 ([finding] The standalone-action owner-key ladder (objectName → object → global) is spelled three times — engine module, runtime, and a private ObjectQLPlugin copy — held in lockstep only by docblocks #14422), :184, :260 (refactor(objectql,runtime): give the standalone-action owner-key ladder one spelling #14667), http-dispatcher.actions-global-key.test.ts:9 → dc7c226b9 «give the standalone-action owner-key ladder one spelling (refactor(objectql,runtime): give the standalone-action owner-key ladder one spelling #14667)»; body names the private ObjectQLPlugin.actionObjectKey. :26, :157 ([finding] Three residual bare 'global' spellings in packages/runtime/src/action-execution.ts after #14422 converged the plugin's — the runtime side kept the literal the constant exists to replace #14678) → 73ad0bba7 «spell the object-less action key as the constant ([finding] Three residual bare 'global' spellings in packages/runtime/src/action-execution.ts after #14422 converged the plugin's — the runtime side kept the literal the constant exists to replace #14678)». Supported.
• dispatcher-error-vocabulary.ts:187, :308, :321 — spec: register the 14 remaining door: 'none' (boot-refusal) codes that ship in dist — the rest of the #16404 class after #16449 #16649 → 44c917a47 «widen the vocabulary gate's face refusal to every published package and retire boot-refusal» for the retirement half and 613bfbd3d «register the fourteen remaining door:'none' error codes» for the fourteen; the split matches the subjects. Supported.
• notification-schema-conformance.integration.test.ts:65, :88 — [finding] Two inline copies of the expected-read-refusal capture still wrap only the engine error channel — one of them can no longer fire since #13273 moved the frame to debug #13325 → 2e0b7b18f «migrate the notification-conformance fixture onto the shared read-refusal capture», one file (this one), «measured on this tree». :481–:499, notification-schema-conformance.test.ts:198 — GET /api/v1/notifications 从不解析它声明的请求 schema —— cursor 被静默丢弃(SDK 分页永远第一页),limit 默认 20 声明 vs 50 实现 #6361 → 90bbf2510 «retire the notification-list cursor on both halves (GET /api/v1/notifications 从不解析它声明的请求 schema —— cursor 被静默丢弃(SDK 分页永远第一页),limit 默认 20 声明 vs 50 实现 #6361)», «ruled jointly with notification 响应侧:unreadCount 声明「总未读数」实测只数 limit 窗口内;响应 cursor 从无 producer 发出 #6363». Supported.
• domains/packages.ts:2303 — fix(metadata-protocol): gate getMetaItem's overlay read on the metadata registry #14908 → d5cbb44f3 «gate getMetaItem's overlay read on the metadata registry (fix(metadata-protocol): gate getMetaItem's overlay read on the metadata registry #14908)»; packages-seed-apply-org-scope.test.ts:24 — Where does the allowOrgOverride read gate belong for metadata sweeps that read MORE THAN ONE type per request? getMetaItems applies none of its own #14683 → 96326040f «apply the allowOrgOverride read gate inside getMetaItems (Where does the allowOrgOverride read gate belong for metadata sweeps that read MORE THAN ONE type per request? getMetaItems applies none of its own #14683)». Supported.
• domains/mcp.ts:318, :344, :364, :412, :644 (the card's control-set site) — The HTTP MCP surface has a SECOND un-merged skill read — buildMcpBridge.listSkills in packages/runtime, the half #8328's fix cannot reach #8726 → e783e163d «read MCP skill prompts from the protocol's merged listing (The HTTP MCP surface has a SECOND un-merged skill read — buildMcpBridge.listSkills in packages/runtime, the half #8328's fix cannot reach #8726)». Supported.
• route-ledger.conformance.test.ts:41 — Two branches bumping the same hand-maintained counter merge clean and produce a wrong sum with zero conflict — measured on system-context.mdx (106→107 twice, tree holds 108) #16919 → 2cd4c548e «generate system-context.mdx's declared counts instead of hand-typing them», backward-compatibility.mdx still says "69" published packages in the lockstep group — the fixed group and the workspace both hold 70 #17039 → edf59e359 «Generate the lockstep package count instead of hand-typing it»; the sentence is about eliminating hand-typed counts. Supported.
• standalone-stack.ts:96 — runtime(standalone-stack): mysql:// 与 #5820 的 libsql 同族 —— os migrate 抛 Unsupported scheme,而 OS_DATABASE_DRIVER 的未知值(含 mysql)静默落到 SQLite #6265 → cfb549db8 «standalone stack dispatches mysql:// and validates OS_DATABASE_DRIVER (runtime(standalone-stack): mysql:// 与 #5820 的 libsql 同族 —— os migrate 抛 Unsupported scheme,而 OS_DATABASE_DRIVER 的未知值(含 mysql)静默落到 SQLite #6265)». meta-compound-arity-mint-door.test.ts and siblings — D1: declare the metadata item-name grammar in spec and refuse it loudly at the publish door — dotted qualified form becomes enforced (#12176 stage 1) #12194 → 311433f6b «…(Ban / in metadata item names — retire compound-name addressing (maintainer-ruled direction): census, migration surface, staged plan #12176 stage 1)», D3: retire compound-name addressing — remove the mounted compound arities, unify SDK URL spelling, close out the five broken methods (#12176 stage 3) #12195 → 7986d973f «…(Ban / in metadata item names — retire compound-name addressing (maintainer-ruled direction): census, migration surface, staged plan #12176 stage 3)». Supported.

No sampled anchor is wrong or unsupported. Where one sha stands for two numbers (dd8172ee2, dc7c226b9, 7986d973f, 13a6cb4ad) it is an issue and the PR that closed it, or one commit that two lines describe — right, not a collision.

(3) Live numbers kept, none added — right. 119 distinct numbers stand on removed lines, 23 on added lines. The 96 dropped all answer 404 by REST (96/96). The 23 kept (#3899, #5811, #5906, #6270, #6430, #6504, #6551, #7543, #8328, #8421, #9416, #10025, #10145, #12156, #12509, #13598, #13906, #13909, #14099, #15168, #17273, #17667, #18070) all answer 200, all closed issues, and no hunk drops one of them from its own removed lines. No number appears on an added line that was not on that hunk's removed lines: 0 added. No sha appears on a removed line.

(4) Line counts hold — right. All 118 files under packages/runtime/src have additions equal to deletions in the file list (total 508/508); the only unequal entry is the new .changeset/runtime-provenance-anchors.md (+11/−0). Non-runtime files in the diff: that changeset only.

Check-runs on a5cdfd8a46, read 2026-09-29T09:59:45Z (newest run per name): 34 names, 34 completed, 0 in progress. 31 success — Auto Label, Build Core, Check Changeset, Check Documentation Links, Check PR Size, Dogfood Regression Gate and its 3 shards, Dogfood Verify CLI, Flag docs affected by code changes, Governed Surface Queue Guard, Lint & Repo Gates, No other open PR may claim the same issue, No other open PR may claim the same single-writer path, Part-of PR must not also close its card, Temporal Conformance (live PG + MySQL), Test Core and its 6 shards, The card this PR closes must claim this branch, Type Check · consumer gates / debt ledger / source gates / workspace, TypeScript Type Check, filter. 3 skipped — Build Docs, Console Pin Gate, Packed-tarball smoke (opt-in). 0 failures. (At the first read, 09:37Z, 32 names with 6 still in progress; none of those turned red.) mergeable_state is clean.

② Semver level

.changeset/runtime-provenance-anchors.md: '@objectstack/runtime': patch, text says comments only, no route, error code, refusal text, type, export or runtime behaviour change. Right (5). The rewritten docblocks ship (dts on, files[] is dist), so skip-changeset would be wrong and a changeset is owed; nothing on the public surface moves, so patch is the ceiling and the floor. No skip-changeset label; Check Changeset is green.

Clause-②: no — right. No accept set moves anywhere in the diff, and ruling 5749154545 itself says «Clause-②: no for the line rewrites (prose only, no accept set moves)».

③ Boundary flags

open_questions: [] — nothing to answer.

(6) Part of #20594, no closing keyword — right. The body carries Part of #20594 and no Fixes/Closes/Resolves anywhere; the card names rest, cli, types and the rest of the lane as later stages, so it must stay open; «Part-of PR must not also close its card» is green. domains/meta.ts at its base blob — right. PR #20615 (claude/issue-20590-credential-positions-closeout, open, draft, created 2026-09-29T08:12:40Z, after the 07:51Z claim) edits packages/runtime/src/domains/meta.ts (+16/−2); meta.ts is absent from #20624's file list; «No other open PR may claim the same single-writer path» is green. The rule is file-level, the 20 sites and their anchors are listed on the PR body for the follow-up, and the card carries them.

Dev deviations, each answered:

1. meta.ts held — right, above.
2. Three slash-joined dead numbers (#10629/#10630, #5811/#12281, #8421/#12194) and five sentence-halves rewritten beyond the census — all comment lines inside the card's stated reach (comment prose in packages/runtime/src/**); the live halves #5811 and #8421 are kept on the added lines. Accepted.
3. CI flake: @objectstack/example-showcase#test fails on mass sys_* Find operation failed + Acquire connection error: operation timed out — hit a merge-queue build and a PR run within 2h on unrelated prose-only diffs #10293 anchored to 92a69d813; feat(runtime): give the two operator run-lifecycle verbs a door (cancel, restore-suspension) #16755 / feat(engine)!: findOne, update and delete declare what they answer, and their hook seams are guarded (#16231) #16783 worded «the change that landed as commit X held that file» — each verified against the commit above. Accepted.
4. Model-free trailer pair per AGENTS.md instead of the harness reminder — a process note outside the contract; the head's checks are green. Not escalated.
5. First label-write call exited 3 and was rerun under the fleet token — no effect on the diff. Noted.
6. Anchor research delegated to read-only subagents and reviewed — the sample above is the independent check; it holds.

Out-of-scope findings, each answered:

• domains/activation-gate.ts:279 refusal string ends (#10243). — an author-shown runtime string, so ruling D's (the lesson in words, no number). Leaving it untouched in a comment-only stage is right; confirmed untouched in the diff. Escalated to the seat: this is form D, which the ruling orders first, and no carrier names runtime strings yet — attach it to dead tracker citations in the domain:cli packages (689 sites, 166 numbers, 95 files): the ruling C+D stage for this lane (from #20556) #20594 or [finding] dead tracker citations outside packages/spec/src have no carrier: #20234 sweeps only the spec tree, and PR #20554 makes 26 more visible (pre-#N / Pre-#N) in cli, drivers, metadata, objectql, plugins, runtime and types #20556 rather than leaving it as a PR-body note.
• packages/runtime/vitest.config.ts:54 cites [finding] vitest 的 --project 过滤器落空即静默成功 —— 点名一个 integration 文件跑 --project unit,报它是通过的文件、执行零个用例,并把它从文件计数里减掉 #17853 (404) — outside src/** and outside the census surface; right to leave for a later stage or the config owner.
• CITATION_RE never judges the second number of #A/#B — the grammar family PR docs(spec): re-anchor the dead tracker citations in data/ to the commits that decided them (stage 3) #20533 names ([finding] check-issue-citations reads the pre- in pre-#N (and post- in post-#N) as a repository qualifier, so a dead number in that spelling is classed cross-repo and never judged #20330); not this PR's.
• The 20 meta.ts sites — stay on the card; right.

Implemented-by: claude/issue-20594-runtime-dead-citations
Reviewed-by: local_1d2a197c-c20e-4e90-9be8-413d4d432289

VERDICT: PASS