docs(lint): re-anchor the five dead tracker citations in authoring-rules.ts to the commits that decided them

[objectstack-fleet]

Part of #20597
Clause-②: no

Stage 2 of the packages/lint dead-citation sweep (claim 5888191846). Stage 1 (PR #20612) left packages/lint/src/authoring-rules.ts at its base blob while PR #20593 held the file. That PR has landed (e651556e2d). Each of the file's five comment and docblock lines that cited a tracker number answering 404 now cites, in ruling C+D's form C, the commit in this repository's history that decided what the line states. Each line still says what was decided. Comments only: 5 lines out, 5 in, in one file, plus one @objectstack/lint patch changeset.

This PR says Part of: the form-D finding-message string at validate-react-page-props.ts:1198 ((#11284), shown to authors) stays on the card as a separate decision. It is byte-identical here (see Acceptance notes).

Measurement

The instrument is the gate's own node scripts/check-issue-citations.mjs --census --json, filtered to packages/lint/.

• Before: base 1322cc72c9, 2026-09-29T10:18:50Z to 10:22:33Z, board enumerated (185 pages, frontier [finding] release.yml: release-integrity reads "cli on npm" as "the publish is complete", so a landing during a publish starts the docker backfill before the fixed group is on npm, and it goes red #20627). Repo-wide allocated-but-absent 2,209.
• After: head 2e1955b492, 11:13:21Z to 11:16:47Z (185 pages, frontier fix(spec): os migrate meta guidance for the remaining migration-entry families states each lesson in words, not tracker numbers (stage 9) #20630). Repo-wide allocated-but-absent 2,204, exactly 5 fewer. No finding at head is absent at base.

site in authoring-rules.ts	before	after	anchor
:201 (the AuthoringFinding.path docblock)	#10064	commit	def0d3e63
:1123	#16659	commit	ecdfc9411
:1722	(PR #8546)	commit	ba5e957ef
:1748	[#19370]	commit	a227afa41
:1768	[ADR-0090 D3 / #8310 → #19370]	commit	a227afa41 (ADR-0090 D3 and #8310 stay)
packages/lint total	5	0	4 numbers, to 4 distinct shas

The five lines on origin/main e651556e2d are the same lines at the base: packages/lint is byte-identical between e651556e2d and 1322cc72c9.

Why each anchor decides its line

Each sha resolves uniquely (rev-parse --disambiguate gives 1 object). Each is single-parent. merge-base --is-ancestor exits 0 against origin/main and against the base, and the repository is not shallow. Each commit's own diff was read for the rule its line states.

• finding: a publish refusal's issues[].path carries an array index into the gate's private snapshot (objects[417].sharingModel) that no caller can resolve #10064 to def0d3e63: "key collection-resident publish-gate finding paths by name, not the private snapshot index". Its body names finding: a publish refusal's issues[].path carries an array index into the gate's private snapshot (objects[417].sharingModel) that no caller can resolve #10064 as the card it lands, "(maintainer ruling 2026-08-20: Option A)". Its own diff wrote this very docblock: the positional-as-rules-emit-it sentence, the objects.acme_invoice.sharingModel example and the pointer to nameKeyFindingPath, which the same commit introduced in runtime-gate.ts.
• A schedule-triggered flow's notify delivers nothing on a multi-organization install: the run carries no organization, so the tenant-scoped inbox/delivery writes are refused (#8844) while the run reads healthy #16659 to ecdfc9411: the squash commit that declares a time-triggered flow's acting organization. Its diff adds FLOW_SCHEDULE_ORGANIZATION_MISSING (flow-schedule-organization-missing, at warning) to validate-flow-trigger-readiness.ts. It also wrote the authoring-rules.ts sentence "... added a sixth id, flow-schedule-organization-missing, at warning" that this line opens, and its sub-commits name A schedule-triggered flow's notify delivers nothing on a multi-organization install: the run carries no organization, so the tenant-scoped inbox/delivery writes are refused (#8844) while the run reads healthy #16659. The live [Decision] 平台自带的四个定时示例流一个都声明不了组织 —— 而新规则要求它们必须声明 #17396 retirement beside it stays.
• (PR #8546) to ba5e957ef: PR feat(lint): permission/book cross the runtime publish gate; object measured dirty stays behind; security-role-word splits to stay behind whole (#8310) #8546's own squash commit, "permission/book cross the runtime publish gate; object measured dirty stays behind". Its authoring-rules.ts diff changes runtimeTypes: ['seed'] to ['seed', 'permission', 'book'], which is [3 of #7891] Flip the registration: runtimeTypes gains object + permission/book — whole rule families cross the publish door #8310 slice 1 as the line states. The live [3 of #7891] Flip the registration: runtimeTypes gains object + permission/book — whole rule families cross the publish door #8310 stays.
• [Decision] app / position 声明 allowRuntimeCreate: true 而作者期规则零命中 —— 退役这个声明,还是把规则造出来? #19370 to a227afa41 (two sites): "security-role-word crosses to the runtime publish gate, whole". Its body names [Decision] app / position 声明 allowRuntimeCreate: true 而作者期规则零命中 —— 退役这个声明,还是把规则造出来? #19370 as the card it lands. Its own authoring-rules.ts diff wrote both lines: "[[Decision] app / position 声明 allowRuntimeCreate: true 而作者期规则零命中 —— 退役这个声明,还是把规则造出来? #19370] It has since crossed, also whole, on its own entry" and the [ADR-0090 D3 / #8310 → #19370] marker. Stage 1 cited the same commit for the same number in runtime-gate.ts and validate-security-posture.ts.

Rung: no file under docs/adr/**, docs/NORTH-STAR.md or scripts/adr-anchors/ names any of the four numbers. So the commit rung is right, as in stage 1. ADR-0090 D3 already stands on :1768 and is kept.

Mechanical proof

• Token and residue guard. A scratch instrument on the TypeScript 6.0.3 parser compares the base blob with the head blob at two levels. The first is leaf AST tokens, with JSDoc nodes excluded. The second is the non-comment residue: every comment range dropped, everything else compared byte for byte. The controls mutate the head text in memory only.
  • Real run: 3,543 tokens at base and at head, tokens EQUAL, residue EQUAL (exit 0).
  • Dark control, a whole comment line inserted: tokens EQUAL, residue EQUAL, comment ranges 957 to 958 (exit 0).
  • Lit control, a code statement inserted: DIFFER at token 0, residue DIFFER (exit 1).
  • Lit control, one character inserted into a parser-located string literal: DIFFER at token 5, residue DIFFER (exit 1). The first string control was a no-op and is void: it searched by text and landed in a comment, reading EQUAL. It was re-anchored on a parser-located literal and re-run. The mutation was confirmed landed.
• Line balance: +5/−5, and every changed line is comment-shaped. The file has 2,011 lines at base and at head.
• Tracker numbers: removed finding: a publish refusal's issues[].path carries an array index into the gate's private snapshot (objects[417].sharingModel) that no caller can resolve #10064, A schedule-triggered flow's notify delivers nothing on a multi-organization install: the run carries no organization, so the tenant-scoped inbox/delivery writes are refused (#8844) while the run reads healthy #16659, feat(lint): permission/book cross the runtime publish gate; object measured dirty stays behind; security-role-word splits to stay behind whole (#8310) #8546 and [Decision] app / position 声明 allowRuntimeCreate: true 而作者期规则零命中 —— 退役这个声明,还是把规则造出来? #19370 ×2. The added lines carry only the live [3 of #7891] Flip the registration: runtimeTypes gains object + permission/book — whole rule families cross the publish door #8310 ×2, which stands on both the removed and the added side of :1722 and :1768. So added-not-removed is empty, and no PR #N stands on an added line. There are 215 #N tokens at base and 210 at head.
• Shas: 4 distinct on added lines (a227afa41 ×2), none on removed lines.
• Literal readers: scripts/doc-authoring-prose-id.baseline.json pins this file's string sites as [runtime/metadata] 作者时规则只存在于 CLI:Studio/REST/MCP 的运行时授权面是第四扇门,26 条规则一条不跑——#4409 修完后最大的敞口 #4463, [P2] 运行时授权门扩到 object 写入 + 全量 runtime-safe 规则快照(#4463 P1 之后) #4716, [P2/P3] 运行时授权门的 advisory findings 要进响应并被 Studio 渲染 + docs「the gate」补第四列(#4463 收尾) #4717, [finding] The four views[] visibility-predicate rules are CLI-only — a Studio/REST/MCP view write bypasses all of them; if they move to runtime-publish, they must move together #7220, [2 of #7891] permission/book wiring: TYPE_TO_STACK_KEY entries + the cross-collection snapshot the three comparison rules need #8309 and lint: a sharing rule declared on an object whose effective sharing model is public is statically detectable and unreported until boot #9698, none of them these four numbers. check-docs-transcript-drift loads the registry module, not its comments.

Tests and gates (at head 2e1955b492)

• Build under os-verify-lock: pnpm exec turbo run build --concurrency=2 --filter=./packages/* --filter=./packages/*/*. The last run printed Tasks 71 successful, 71 total, and VERDICT command-exit 0. It took three attempts inside a 270 s timeout on a shared box. The first two were cut off at 39 of 46 and 66 of 68 tasks, and turbo's cache carried their finished tasks forward.
• pnpm --filter @objectstack/lint exec vitest run --maxWorkers=2 under the lock: Test Files 115 passed (115), Tests 5379 passed (5379), VERDICT command-exit 0.
• pnpm --filter @objectstack/lint typecheck under the lock: exit 0. check:test-typecheck OK (2 files, 6 errors, 2 pinned signatures held). VERDICT command-exit 0.
• Lint, as a proven narrowing: eslint --no-inline-config --format json packages/lint/src/authoring-rules.ts reports 1 file, 0 errors, 0 warnings. isPathIgnored is false, read through eslint's API. eslint.config.mjs:327-328 says type-aware linting is never enabled, so a comment edit cannot move an untouched file's verdict. The repo-wide pnpm lint is CI's.
• node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands derived 54 families, and all 54 ran with exit 0. --ran reads "54 derived, 54 run, 0 NOT-MEASURED, 0 UNRUN", a derived zero. Among them:
  • node scripts/check-issue-citations.mjs, the live diff-scoped run, judged 2 citations in 1 file, the kept [3 of #7891] Flip the registration: runtimeTypes gains object + permission/book — whole rule families cross the publish door #8310 ×2, and both answer as issues. pnpm check:issue-citations passes its self-test (114 cases in 8 batteries).
  • pnpm check:doc-authoring: the sibling prose-id baseline holds, 810 pinned sites across 230 files, no growth.
  • pnpm check:nul-bytes: OK over 9,253 tracked text files. A control-byte scan of both changed files finds none.
• Generated pages: none to regenerate. No page under content/docs/references/ names the four numbers, AuthoringFinding or nameKeyFindingPath, and no generator reads packages/lint/src.
• Changeset: patch for @objectstack/lint, a new file (stage 1's lint-provenance-anchors.md is untouched). files[] ships dist, and the rewritten comments reach it:
  • commit def0d3e63 is in the AuthoringFinding docblock of dist/runtime-*.d.ts, beside the unchanged "Positional as RULES emit it", the positive control.
  • commit ba5e957ef (cited only here) and commit a227afa41 are in dist/index.js and dist/index.cjs.
  • None of the four numbers remains in dist.
• Merge probe: a no-driver merge-tree of the head onto origin/main 542670da6d, from a bare shared clone with no merge.* config, exits 0. None of the three commits main gained since the base touches packages/lint.
• No ablation or reverse verification: the change is comment-only, so there is no behaviour to invert.

Hypotheses (measured first)

1. Holds. At the base the census reads exactly 5 dead sites in packages/lint, all in authoring-rules.ts, and after the change it reads 0. The card's sixth site, the (#11284) string at validate-react-page-props.ts:1198, is outside the census because the census blanks string literals. It was read directly: still present, and the file is byte-identical from base to head.
2. Holds. The five sites read :201 finding: a publish refusal's issues[].path carries an array index into the gate's private snapshot (objects[417].sharingModel) that no caller can resolve #10064, :1123 A schedule-triggered flow's notify delivers nothing on a multi-organization install: the run carries no organization, so the tenant-scoped inbox/delivery writes are refused (#8844) while the run reads healthy #16659, :1722 (PR #8546), :1748 and :1768 [Decision] app / position 声明 allowRuntimeCreate: true 而作者期规则零命中 —— 退役这个声明,还是把规则造出来? #19370, on e651556e2d and at the base alike. All four anchors were re-verified above from their own diffs, not copied.
3. Holds. PR feat(lint): os validate refuses an api flow with no per-flow secret #20593's new lines cite After #20529, authoring surfaces still teach or pass an api flow with no secret: skills/objectstack-automation calls it optional, and os validate passes it #20553, Seam: the /meta save path runs the runtime authoring gate on the redacted body, before #20552's stored-secret carry-forward, so flow-api-trigger-secret-missing cannot run at the runtime surface #20611 and [security] a flow's inbound-hook secret (config.secret on the start node) is served in cleartext by the flow-definition read; after #20529 every armed hook carries one #20552 (and ADR-0041). All three answer 200, and the census finds no dead site on them. None of the five lines' sentences changed in meaning. The one adjacency is described under Acceptance notes.

Deviations

• Commit trailers follow AGENTS.md's model-free pair (Claude-Session plus Co-authored-by: Claude), not the model-named trailer the harness reminder suggested. The pre-push trailer check passed on both pushes.
• The first lit string control was a no-op: it searched by text and landed in a comment. It is reported void above and was re-run on a parser-located literal.

Acceptance notes

Form D, not touched (why this PR says Part of): validate-react-page-props.ts:1198 is the react-prop-deprecated finding message. It ends "...is removed after the deprecation window (#11284)." An author sees it, so it takes ruling D (no number). That is a string change, outside this comment-only claim. scripts/doc-authoring-prose-id.baseline.json pins it (#11284: 1 for that file), and that baseline is shrink-only.

An ordinal beside PR #20593's insertion, kept verbatim: the paragraph above :1123 now ends "#20553 made it five", counting the rules that emit error. :1123 reads "Commit ecdfc94 added a sixth id", an ordinal that commit wrote itself. The two count different things: rules that emit error, and ids in the rule file. The ordinal is also imprecise on its own terms, because validate-flow-trigger-readiness.ts exported six ids before ecdfc9411, so the new one was its seventh. This PR moves only the tracker number, so the word stays as written.

Outside the census's surface (noted, not swept): stage 1 notes that lint test titles and hand-written docs still cite these numbers. content/docs/deployment/validating-metadata.mdx cites #19370 at :472, :483 and :515.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/lint, touching 2 documentable anchor(s).

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/deployment/validating-metadata.mdx (via AUTHORING_RULES (symbol, a top-level const object))

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 4 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 542670da6dfc17d3a2ec919139afb7caae018d02 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 341e0c67bcdab06c29d43d115ca09aa90b671993 — the merge of head 2e1955b492a89555e2d39d254ff16ef9d6c7449d into base 542670da6dfc17d3a2ec919139afb7caae018d02, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 341e0c67bcdab06c29d43d115ca09aa90b671993 && git checkout 341e0c67bcdab06c29d43d115ca09aa90b671993
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 542670da6dfc17d3a2ec919139afb7caae018d02 2e1955b492a89555e2d39d254ff16ef9d6c7449d && git checkout -B drift-repro 542670da6dfc17d3a2ec919139afb7caae018d02 && git merge --no-ff 2e1955b492a89555e2d39d254ff16ef9d6c7449d

node scripts/docs-audit/affected-docs.mjs --json 542670da6dfc17d3a2ec919139afb7caae018d02

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 542670da6dfc17d3a2ec919139afb7caae018d02 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 2e1955b492a89555e2d39d254ff16ef9d6c7449d
Local-runs: none

Read (this act, stamped 2026-09-29T11:34Z): card #20597 (body; every one of its 7 comments: the stage-1 claim 5885046469, the stage-1 report 5885887024, the ACCEPT 5886175996, the landing and park record 5886592368, the unlock 5887336767, the stage-2 claim 5888191846 and the stage-2 os-dev-report 5889251130), ruling C+D 5749154545 on #19123, PR #20612 with its at-tier record 5886146186 as the worked example, PR #20631 (body, its one comment 5889210495, the 2-file list, both commits and the net diff against the merge base 1322cc72c9, read from the local ref at the head above, plus the base and head blobs of authoring-rules.ts), the four anchors (identity, parents, ancestry, message, stat, and each one's own diff of authoring-rules.ts; def0d3e63's diff of runtime-gate.ts; the exported ids of validate-flow-trigger-readiness.ts at ecdfc9411 and its parent), e651556e2d (PR #20593's squash) for what it inserted into the file, docs/adr/**, docs/NORTH-STAR.md, scripts/adr-anchors/, and the rest of docs/** and content/** on origin/main for the four numbers and the four rules by name, ADR-0090 D3 and ADR-0094's #8310 amendment, content/docs/references/** at the head, packages/lint/package.json files[] and tsup.config.ts, scripts/check-issue-citations.mjs (declared surfaces, CITATION_RE, the PR #N case), scripts/doc-authoring-prose-id.baseline.json, and the check-runs on the head, read once. Nothing was built, run or re-run: the two blobs were compared with a string-, template- and regex-aware comment stripper in scratch (a read of the diff, not a gate, as the stage-1 record did), the numbers were probed with REST GET issues/N against this repository (GitHub reads), and no gate, test or census was executed.

① Derived judgments

(a) Scope and file surface: right. Two files: packages/lint/src/authoring-rules.ts (+5/−5; 2,011 lines at base and head) and the new .changeset/20597-lint-authoring-rules-provenance-anchors.md (+11). The changed lines are exactly :201, :1123, :1722, :1748 and :1768, the claim's five sites at their e651556e2d positions: packages/lint is byte-identical from e651556e2d to the base 1322cc72c9 and from the base to origin/main 542670da6d (the three commits main gained, PR #20587, PR #20626 and PR #20624, touch nothing under packages/lint), so the net diff against current main is the diff judged here and no merge of main was owed. No other file, no test, no generated page, no gate, no release page, no governed surface. Head repository is the base repository; draft; assignee os-tesla; no auto-merge; mergeable: true, mergeable_state: blocked (draft); labels documentation, size/s, tooling (the auto-labelers'). First line Part of #20597, second line Clause-②: no. Two commits (rewrite, changeset), no merge commit, model-free trailers. validate-react-page-props.ts is not in the diff and its blob f5684f077 is the same on main and at the head, so the form-D finding message at :1198 ending "(#11284)" is byte-identical and stays on the card; Part of, not Fixes, is therefore right, and Part-of PR must not also close its card is success.

(b) Comment-only, no code token, string literal, rule message, hint, rule id, surfaceReason or export moves: right. All 10 changed lines lie inside comments on both sides: :201 inside the AuthoringFinding.path JSDoc block opened at :196 and closed at :203; the other four are // line comments. The non-comment residue (code plus string, template and regex literals kept; comments dropped) is byte-identical base to head, with 957 comment ranges on each side and every line count equal. Controls, mutated in memory only: a whole comment line inserted leaves the residue equal modulo the inserted line's whitespace; a code token inserted (pathX: string;) makes it differ; one character changed inside the runtimeTypes string literal of the validateSecurityPosture entry makes it differ. Each changed line differs from its base line in the replaced token and nothing else. No test file is in the diff, so no it/describe title moved.

(c) Numbers: right. Removed: #10064, #16659, #8546 (spelled (PR #8546)) and #19370 x2. The added lines carry only #8310 x2, on the same two lines (:1722, :1768) where it stood at base, so added-not-removed is empty; no PR #N stands on an added line; 4 distinct 9-hex shas stand on added lines (a227afa41 twice), none on removed lines. CITATION_RE never reads commit 9-hex, and the gate's own self-test holds that a PR #N head is a citation, so (PR #8546) was rightly a census site. REST GET issues/N, no redirects: #10064, #16659, #8546 and #19370 all answer 404; #8310 answers 200 (closed issue) and the context line's #17396 answers 200; #11284 answers 404 (form D, untouched); controls #20553 and #20552 200 (closed), #20611 200 (open). Total #N tokens in the file fall by exactly 5 (213 to 208 on this read's regex; the dev's 215 to 210 counts a wider digit class, same net).

(d) Anchor truth: right, 4 of 4. Each sha resolves to exactly one object under rev-parse --disambiguate, has one parent, and merge-base --is-ancestor exits 0 against origin/main and against the base; the checkout is not shallow.

• def0d3e63 for finding: a publish refusal's issues[].path carries an array index into the gate's private snapshot (objects[417].sharingModel) that no caller can resolve #10064 (:201): squash of PR feat(lint): key collection-resident publish-gate finding paths by name, not the private snapshot index #10296; body "Fixes finding: a publish refusal's issues[].path carries an array index into the gate's private snapshot (objects[417].sharingModel) that no caller can resolve #10064 (maintainer ruling: Option A)"; its own diff of authoring-rules.ts replaced the one-line path docblock with the six-line one now there, verbatim down to "see nameKeyFindingPath in runtime-gate.ts", and its runtime-gate.ts diff introduced nameKeyFindingPath (absent in its parent). It decided the rule the line states. True.
• ecdfc9411 for A schedule-triggered flow's notify delivers nothing on a multi-organization install: the run carries no organization, so the tenant-scoped inbox/delivery writes are refused (#8844) while the run reads healthy #16659 (:1123): squash of PR fix(triggers,spec,service-automation)!: a time-triggered flow declares its acting organization and the run executes as it #17334; its sub-commits name A schedule-triggered flow's notify delivers nothing on a multi-organization install: the run carries no organization, so the tenant-scoped inbox/delivery writes are refused (#8844) while the run reads healthy #16659 ("pin the three A schedule-triggered flow's notify delivers nothing on a multi-organization install: the run carries no organization, so the tenant-scoped inbox/delivery writes are refused (#8844) while the run reads healthy #16659 consequences", "register the A schedule-triggered flow's notify delivers nothing on a multi-organization install: the run carries no organization, so the tenant-scoped inbox/delivery writes are refused (#8844) while the run reads healthy #16659 proof"); its diff added the 8-line paragraph beginning "A schedule-triggered flow's notify delivers nothing on a multi-organization install: the run carries no organization, so the tenant-scoped inbox/delivery writes are refused (#8844) while the run reads healthy #16659 added a sixth id, flow-schedule-organization-missing, at warning" and added FLOW_SCHEDULE_ORGANIZATION_MISSING to validate-flow-trigger-readiness.ts (six exported ids before, seven after). The rewritten clause is the "added" clause; the "[Decision] 平台自带的四个定时示例流一个都声明不了组织 —— 而新规则要求它们必须声明 #17396 RETIRED it" clause keeps its live number. True.
• ba5e957ef for (PR #8546) (:1722): subject ends "([3 of #7891] Flip the registration: runtimeTypes gains object + permission/book — whole rule families cross the publish door #8310) (feat(lint): permission/book cross the runtime publish gate; object measured dirty stays behind; security-role-word splits to stay behind whole (#8310) #8546)", that PR's own squash; its diff moved runtimeTypes: ['seed'] to ['seed', 'permission', 'book'] on the validateSecurityPosture entry and wrote "[3 of #7891] Flip the registration: runtimeTypes gains object + permission/book — whole rule families cross the publish door #8310 (this state): runtimeTypes gains permission + book", the fact the line states as slice 1; the live [3 of #7891] Flip the registration: runtimeTypes gains object + permission/book — whole rule families cross the publish door #8310 stays on the line. True.
• a227afa41 for [Decision] app / position 声明 allowRuntimeCreate: true 而作者期规则零命中 —— 退役这个声明,还是把规则造出来? #19370 (:1748, :1768): subject "([Decision] app / position 声明 allowRuntimeCreate: true 而作者期规则零命中 —— 退役这个声明,还是把规则造出来? #19370) (feat(lint): security-role-word crosses to the runtime publish gate, whole (#19370) #19486)", body "Fixes [Decision] app / position 声明 allowRuntimeCreate: true 而作者期规则零命中 —— 退役这个声明,还是把规则造出来? #19370"; its diff wrote both lines, "[[Decision] app / position 声明 allowRuntimeCreate: true 而作者期规则零命中 —— 退役这个声明,还是把规则造出来? #19370] It has since crossed, also whole, on its own entry" and the marker "[ADR-0090 D3 / [3 of #7891] Flip the registration: runtimeTypes gains object + permission/book — whole rule families cross the publish door #8310 → [Decision] app / position 声明 allowRuntimeCreate: true 而作者期规则零命中 —— 退役这个声明,还是把规则造出来? #19370]", and flipped the validateSecurityRoleWord entry to CLI_AND_RUNTIME with the five runtimeTypes. True on both.
  Rung: no file under docs/adr/**, docs/NORTH-STAR.md or scripts/adr-anchors/ names any of the four numbers, nameKeyFindingPath, flow-schedule-organization-missing or security-role-word. ADR-0090 D3 records the vocabulary freeze itself and already stands on :1768; the crossing is [Decision] app / position 声明 allowRuntimeCreate: true 而作者期规则零命中 —— 退役这个声明,还是把规则造出来? #19370's act, whose ruling (batch chore(deps)(deps-dev): bump @vitejs/plugin-react from 4.7.0 to 5.1.2 #203 item 3, letter B, comment 5754204759) lived on the deleted card and is in-repo nowhere. ADR-0094's amendment records [3 of #7891] Flip the registration: runtimeTypes gains object + permission/book — whole rule families cross the publish door #8310's slice 2 (object crosses, the R2 arm retired), which :1724 to :1734 already cite; slice 1 (permission + book) is in no ADR. finding: a publish refusal's issues[].path carries an array index into the gate's private snapshot (objects[417].sharingModel) that no caller can resolve #10064's ruling and A schedule-triggered flow's notify delivers nothing on a multi-organization install: the run carries no organization, so the tenant-scoped inbox/delivery writes are refused (#8844) while the run reads healthy #16659's decision are in no ADR either. So the commit rung is the right rung for all four, as in stage 1. The four dead numbers' only remaining in-repo mentions outside packages/lint are content/docs/deployment/validating-metadata.mdx:472, :483 and :515 ([Decision] app / position 声明 allowRuntimeCreate: true 而作者期规则零命中 —— 退役这个声明,还是把规则造出来? #19370; hand-written; outside the surface).

(e) Form C and sense: right. Each rewrite leads with commit 9-hex, or keeps the marker form where a marker stood ([commit a227afa41], [ADR-0090 D3 / #8310 → commit a227afa41]), as stage 1 did, and each line still says what was decided. On the :1123 ordinal: the paragraph at :1105 to :1123 now reads "Four rules answer yes and emit error ... #20553 made it five ... flow-trigger-unknown-object deliberately stayed warning, as did flow-draft-status-ambiguous", then "Commit ecdfc94 added a sixth id, flow-schedule-organization-missing, at warning; #17396 RETIRED it". Two counts: PR #20593's "five" counts the error-emitting rules; "sixth" is ecdfc9411's own ordinal over the file's ids, and it was already imprecise when written (the file exported six ids before that commit, so the new one was its seventh, and the paragraph itself had named six). Judged: fine as two statements about different things, not misleading about the rule the line states, which is that the id was added at warning and later retired, both true, with the load-bearing retirement clause carrying its live #17396; the ordinal is decorative and read no better on main before this PR. Moving only the number keeps the diff a pure token swap and the five-site scope exact; rewriting "a sixth id" to "an id" would have been inside the site and is not owed. Non-blocking; the next edit of that paragraph should drop the ordinal.

(f) Generated pages: nothing to regenerate, right. No page under content/docs/references/ at the head names the four numbers, nameKeyFindingPath or AuthoringFinding, and the scripts that name authoring-rules.ts (check-system-context-census.mjs, check-docs-transcript-drift.mjs, which loads the registry module, and the prose-id baseline) are gates and a baseline, not page generators. The docs-drift comment 5889210495 lists content/docs/deployment/validating-metadata.mdx via the AUTHORING_RULES symbol, an advisory on a comment-only diff; Flag docs affected by code changes is success.

② Semver level

patch for @objectstack/lint is right and Clause-②: no is right. files[] is dist, README.md, CHANGELOG.md; tsup.config.ts emits esm and cjs for index and runtime with dts on (unless OS_SKIP_DTS). So the AuthoringFinding.path docblock, on an exported interface, reaches the shipped .d.ts, and the bundle carries the source's line comments, which is where the dev found commit ba5e957ef and commit a227afa41 in dist/index.js and dist/index.cjs. That is comment text the bundler preserved, not a runtime string: (b) shows no string, template or regex literal byte differs base to head, so nothing an author is shown or the runtime reads has changed, and no export, type, value, message, severity or behaviour moves; nothing widens or narrows. The tarball's bytes do change, so skip-changeset would be wrong and patch is the level, the one stage 1 and #20234's stages took for the same act. The changeset names one package, describes only the re-anchoring, and carries no tracker number and no model identifier; Check Changeset is success. The 20597- prefix is the changeset's filename, not shipped text (a227afa41's own 19370-role-word-crosses-whole.md is the precedent).

③ Boundary flags

Blocking: none.

Dev deviations, each answered:

1. Model-free trailers (Claude-Session plus Co-authored-by: Claude) on both commits: confirmed; AGENTS.md's pair, as stage 1. Non-blocking.
2. The first lit string control void and re-run on a parser-located literal: rightly reported; this read's own string control (one character inside the runtimeTypes literal) differs, agreeing with the re-run.
3. The runner's 580 s timeout killing check:slot-lookup mid-run and its re-run to exit 0: not observable from here; the head's Lint & Repo Gates run is the run of record and is named below as not concluded.
4. No merge of origin/main: right, judged in (a); packages/lint is unchanged from the base to main.
5. The empty probe push, scratch and worktree cleanup: not observable from here; the PR shows exactly two commits and no force-push is visible.
   Open questions: the report lists none.

Out-of-scope findings, each judged:

• validate-react-page-props.ts:1198, the react-prop-deprecated finding message carrying "([Decision] Does react-blocks.ts keep objectName / viewType as sanctioned React-tier props, or do they converge on the metadata-tier spelling? — the carrier objectui#2890's last phase has never had #11284)": author-shown, so ruling D, a string change outside this comment-only claim; pinned #11284: 1 in the shrink-only prose-id baseline. Correctly left byte-identical. Carrier: this card's own form-D round, as the ACCEPT 5886175996 resolved; no new filing.
• The :1123 ordinal beside PR feat(lint): os validate refuses an api flow with no per-flow secret #20593's "made it five": judged in (e); no carrier owed.
• content/docs/deployment/validating-metadata.mdx citing [Decision] app / position 声明 allowRuntimeCreate: true 而作者期规则零命中 —— 退役这个声明,还是把规则造出来? #19370 three times: hand-written, outside the instrument's declared surface, as stage 1's notes and [finding] dead tracker citations outside packages/spec/src have no carrier: #20234 sweeps only the spec tree, and PR #20554 makes 26 more visible (pre-#N / Pre-#N) in cli, drivers, metadata, objectql, plugins, runtime and types #20556's close-out put it; correctly noted, not filed, and not this stage's.

Non-blocking observations: the claim's "stop on breach" clause was not tripped; no breach. Escalated: none.

CI at this head, the judging read, taken once at 2026-09-29T11:25Z: 31 check-runs, 15 success, 3 skipped (Build Docs, Console Pin Gate, Packed-tarball smoke (opt-in): path-filtered or opt-in, not this diff's), 0 failure, 13 in progress. Success: Build Core, Governed Surface Queue Guard, Check Changeset, Type Check · source gates, Type Check · debt ledger, Dogfood Verify CLI, Check PR Size, Check Documentation Links, Flag docs affected by code changes, The card this PR closes must claim this branch, No other open PR may claim the same issue, No other open PR may claim the same single-writer path, Part-of PR must not also close its card, Auto Label, filter. NOT concluded at that read and NOT presumed green here: Lint & Repo Gates (the run of record for the diff-scoped citation verdict, check:doc-authoring, pnpm lint and the check:* roster), Test Core 1/6 to 6/6 (the lint vitest suite rides these; the aggregate not yet created), Dogfood Regression Gate 1/3 to 3/3, Temporal Conformance (live PG + MySQL), Type Check · workspace and Type Check · consumer gates (the TypeScript Type Check aggregate not yet created). No red run exists to attribute. Of the dev's 54 derived families, the concluded runs answer the build, changeset, governed-surface, docs-links, PR-size and claim-guard families now; the citation, doc-authoring, lint, typecheck, test, dogfood and temporal families are the open runs above, which the owning seat reads concluded before this PR is armed. What the diff-scoped citation run will judge, read here: 2 citations on added lines, #8310 x2, both answering 200.

Implemented-by: claude/issue-20597-lint-dead-citations-authoring-rules
Reviewed-by: session_014EJ1ED8X4MMrT18BhVx4tx

VERDICT: PASS

---

Generated by Claude Code