docs(spec): anchor the request-scoped label cache by its full path

Claude-Session: https://claude.ai/code/session_01Sfe5YjBLwB9J3y8fvm2xq1
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/spec/liveness/analytics_cube.json

@@ -126,7 +126,7 @@
     "refreshKey": {
       "status": "dead",
       "verifiedAt": "2026-09-29",
-      "note": "REMOVED 2026-09-29 (ADR-0049 enforce-or-remove; maintainer ruling on #20637, letter C: retire whole, build no cache) — tombstoned at the schema (retiredKey carries the prescription; authoring it is a tsc error and a parse error) and stripped from sources and stored rows by the protocol-18 conversion `cube-refresh-key-removed` (the D3 entry `cube-refresh-key-retired`). The entry stays because retiredKey keeps the key in the walked shape (the rls.priority precedent). ⚠️ It is a LEAF now: the two rows that were drilled under it — `every` and `sql`, both `dead`, verified 2026-09-17 — left with the subtree, because the gate refuses `children` on a property that is not a container (the connector `health` precedent). Their verdicts are carried here, one reason for both: nothing read the block, and there was nothing for it to key on. Re-measured 2026-09-29 at 0be898499f: `git grep refreshKey` over the non-test sources of packages/services, packages/drivers and packages/rest answers 0 lines (4 for the neighbouring `.public` in the same pathspec); packages/services/service-analytics/src references no ICacheService or IJobService, and its one cache is the request-scoped dimension-labels.ts#withLabelFetchCache — no analytics result is cached, so every query is computed when it is asked. The one author, examples/app-showcase (`every: '1 hour'`), no longer writes it. A refresh cadence is declared again when a result cache exists. The tombstone is packages/spec/src/data/analytics.zod.ts#CubeSchema."
+      "note": "REMOVED 2026-09-29 (ADR-0049 enforce-or-remove; maintainer ruling on #20637, letter C: retire whole, build no cache) — tombstoned at the schema (retiredKey carries the prescription; authoring it is a tsc error and a parse error) and stripped from sources and stored rows by the protocol-18 conversion `cube-refresh-key-removed` (the D3 entry `cube-refresh-key-retired`). The entry stays because retiredKey keeps the key in the walked shape (the rls.priority precedent). ⚠️ It is a LEAF now: the two rows that were drilled under it — `every` and `sql`, both `dead`, verified 2026-09-17 — left with the subtree, because the gate refuses `children` on a property that is not a container (the connector `health` precedent). Their verdicts are carried here, one reason for both: nothing read the block, and there was nothing for it to key on. Re-measured 2026-09-29 at 0be898499f: `git grep refreshKey` over the non-test sources of packages/services, packages/drivers and packages/rest answers 0 lines (4 for the neighbouring `.public` in the same pathspec); packages/services/service-analytics/src references no ICacheService or IJobService, and its one cache is the request-scoped packages/services/service-analytics/src/dimension-labels.ts#withLabelFetchCache — no analytics result is cached, so every query is computed when it is asked. The one author, examples/app-showcase (`every: '1 hour'`), no longer writes it. A refresh cadence is declared again when a result cache exists. The tombstone is packages/spec/src/data/analytics.zod.ts#CubeSchema."
     },
     "public": {
       "status": "live",

packages/spec/src/data/analytics.zod.ts

@@ -424,8 +424,8 @@ export const CubeJoinSchema = lazySchema(() => strictObject(
  * surfaces, the migration notes and one author (`examples/app-showcase`,
  * `every: '1 hour'`). And nothing for it to key on: `service-analytics`
  * references no cache or job service — its one cache is the request-scoped
- * `dimension-labels.ts#withLabelFetchCache` — so every analytics query is
- * computed when it is asked. `sql` was security-adjacent as well: raw SQL run on
+ * `packages/services/service-analytics/src/dimension-labels.ts#withLabelFetchCache`
+ * — so every analytics query is computed when it is asked. `sql` was security-adjacent as well: raw SQL run on
  * a schedule, outside the read-scope machinery every other cube `sql` goes
  * through.
  *