docs(runtime): re-anchor the 20 dead tracker citations in domains/meta.ts to the commits that decided them

[objectstack-fleet]

Part of #20594
Clause-②: no

What changed

This is stage 5 of the domain:cli lane of the dead-citation sweep: the 20 comment sites in packages/runtime/src/domains/meta.ts that stage 1 (PR #20624) held while PR #20615 edited the file. PR #20615 has merged, and no open PR touches the file (the file lists of all open PRs were read twice: 9 PRs at 2026-09-29T17:14:19Z and 6 at 17:43:04Z). Every one of the 20 sites cited a tracker number that answers 404. Each now cites, in ruling C+D's form C (comment 5749154545 on #19123), the commit in this repository's history that decided what the line describes, and keeps saying in its own words what that commit decided. PR #20533 is the method and PR #20624 the precedent. The card stays open for the lane's remaining stages, so this PR says Part of.

That is 20 sites on 20 lines, covering 9 numbers, rewritten to 9 distinct commits. They are the anchors PR #20624's body listed for this file, each re-verified against the file as PR #20615 left it (that PR's one hunk is at :1874, disjoint from every site). No ADR or ruling-record file in docs/adr/ or scripts/adr-anchors/ records any of these decisions, so every anchor is a commit.

One more line changed: :1976, the other half of the :1974 sentence. It read "This tail was unreachable until this card", and "this card" was the number :1974 cited. It now reads "until that commit".

Only comments changed: 21 lines out, 21 in, and the file keeps its 1,991 lines, so no line citation into it moves. No citation number is added. Every tracker number on an added line was already on the line it replaces (21 line pairs, added-minus-removed empty), and no PR number stands on an added line.

There is no changeset. This diff publishes no byte from @objectstack/runtime, so it takes skip-changeset (see Changeset below). That departs from the dispatch, which ordered a changeset on stage 1's precedent. The measurement is below.

Census: domains/meta.ts, before and after

Instrument. The gate's own node scripts/check-issue-citations.mjs --census --json, read-only and unchanged, run with the fleet token. The count is its allocated-but-absent findings for packages/runtime/src/domains/meta.ts. Both runs enumerated the whole board, so neither read a truncated board.

reading	tree	board	whole-repo allocated-but-absent	meta.ts sites	lines	numbers	packages/runtime
before	base 6981abfd26, run 2026-09-29T17:10:45Z to 17:16:23Z	enumerated, 186 pages, frontier #20686, 18,513 numbers	1,318	20	20	9	23
after	7cdd37d1f8, run 17:17:15Z to 17:23:01Z	enumerated, 186 pages, frontier #20686, 18,513 numbers	1,298	0	0	0	3

The whole-repo drop is exactly these 20 sites: a site-by-site diff of the two JSON outputs differs only in domains/meta.ts. The 3 left in packages/runtime are stage 1's deliberate sites (api-exposure.ts:108, domains/mcp.ts:360, route-ledger.ts:300). meta.ts is byte-identical at 7cdd37d1f8 and at the head (blob 8201775c6d).

A REST probe of every number cited in the file (44 distinct) found 35 answering 200 and 9 answering 404. The 9 are exactly the census's 9, all in comments. So no dead number stands in a string literal in this file.

Per-site table

Every anchor was read in its message or diff, not only its subject, and git blame at the base ties each line to the commit that wrote it.

number	sites (base line)	anchor: what it decided
#10503	:14, :1143, :1159, :1250, :1308	67ceb9aef: the dispatcher /metadata transport folds the URL segment through canonicalMetaUrlType before the org-scope decision, and at the /published code-store fallback. Its diff adds four of these five tags.
#10340	:1309	26f3588fb: REST's /meta doors decide org scope on the folded type, not the raw URL spelling (its message names #10340 as the card it settles).
#11006	:103	cccbe51bf: MetadataProtocol declares publishMetaItem, and its changeset states the end state "an undeclared key in a request literal at the member's call shape is now a compile error". The wording is the one stage 1 gave domains/packages.ts:138.
#8726	:116	e783e163d: domains/mcp.ts narrows the protocol slot to a type picked from the declared MetadataProtocol contract (the docblock at mcp.ts:321 blames to it).
#8848	:200, :1398	4fc4a3c0b: /metadata/:type/:name refuses an unsupported verb instead of serving it as a read. Both lines blame to it.
#8919	:1247	b5378550e: gates REST /meta publish and rollback on manage_metadata, and its diff introduces "the same single-resolution shape" (the capability gate's context reused for scope).
#10888	:1337	d806081dd: renders the spec-validation 422 findings clause per write face. The line blames to it.
#12195	:819, :827, :1046, :1167, :1974	7986d973f, stage 3 of the compound-name retirement: un-folds the dispatcher (exactly three and two segments), decodes the :name segment, and answers the newly reachable tail with a located ROUTE_NOT_FOUND. All five lines blame to it.
#12194	:831, :1050, :1173	311433f6b, stage 1: the item-name grammar, refused at the publish door.

Every cited sha matches exactly one object (git rev-parse --disambiguate, count 1 for each of the 9), is a commit, has one parent, and is an ancestor of the base (merge-base --is-ancestor, exit 0 for all 9). The checkout is not shallow. The control leg f5a9bc2f3 (2026-08-10, older than the oldest anchor e783e163d of 2026-08-14) exits 0, and the negative control, this branch's own 7cdd37d1f8, exits 1. All 9 anchors are the ones the landed stages already give these numbers, so each number carries one anchor across the tree.

Wordings to check, each true of its commit:

• :831 keeps its quotation: "breaking commit 311433f's landed acceptance criterion that 'reads and deleteMetaItem still answer for pre-grammar residue rows...'". The quoted words are the criterion's own. That commit's changeset states the same criterion: "Reads and deleteMetaItem deliberately stay open, so any pre-grammar residue row remains listable and clearable."
• :1250 was written by 15eb2c97f, the org-presentation capability commit, which moved the fold earlier so that the capability verdict reads it too. The fold itself, which the tag names, is 67ceb9aef's, and the lines around it already carry that commit's own [#12702] tags.
• :1050 and :1173 keep "stage 1" beside the commit, because the sentences contrast the retirement's stage 1 with the fold that stage 3 removed.

Mechanical guard: no code token moves

H2 holds on both counts. The comment-stripped diff is empty, and the emitted dist is byte-identical.

Token guard. It compares the TypeScript parser's leaf tokens (TypeScript 6.0.3, JSDoc nodes excluded) of the file at base 6981abfd26 and at head b96c13e3ab. Controls mutate the head text in memory only.

• Real run: 6,794 tokens on both sides, 0 differing (exit 0).
• Comment-insertion control: 0 differing (exit 0).
• Code-insertion control: differs at token 0 (exit 1).
• String control ('Not found' to 'Not founD' in the code literal at :495): 1 differing StringLiteral at token 1338 (exit 1). A first string control anchored on the first occurrence of that text, which is inside a comment at :465, so it was a second comment control. It read 0, and it was re-anchored on the code literal.

Emitted dist. @objectstack/runtime was built fresh with pnpm --filter @objectstack/runtime build at the base (in a throwaway detached worktree at 6981abfd26) and at 7cdd37d1f8, with the same dependency builds. All six dist files (index.js, index.cjs, their maps, index.d.ts, index.d.cts) have equal sha256.

• Positive control: in the base tree, a one-character change to the code string 'Save not supported' in this file (through scripts/ablation-replace.mjs, which verified that the anchor hit and that the blob restored to HEAD) changes the sha256 of index.js and index.cjs. So the build reads this file, and its comments simply never reach dist.
• None of the file's comment text appears in dist, changed or unchanged: 0 hits for "is the FOLD this transport was missing", "Percent-decode the", "A LOCATED refusal, not a bare" and "A throw here is a FAULT". Its code does appear (function decodeMetaNameSegment, METADATA_ITEM_METHODS).

The line count is 1,991 at base and head. A raw scan of the file for control bytes finds none (a positive probe on a scratch file matched).

Changeset

None; skip-changeset instead. @objectstack/runtime's files[] is dist, README.md and CHANGELOG.md, and the build above emits byte-identical dist at base and head. So this diff publishes nothing from a released package, which is what the label is for (AGENTS.md's Post-Task Checklist, step 3).

The dispatch ordered a patch changeset matching .changeset/runtime-provenance-anchors.md. Stage 1 shipped that changeset because its rewritten docblocks reached dist. For this file they do not. The dropped changeset stands in 7cdd37d1f8: if the seat rules for it, git checkout 7cdd37d1f8 -- .changeset/runtime-meta-provenance-anchors.md restores it. Stage 1's changeset, still pending, already describes re-anchored provenance comments under src/ in general terms.

Gates (head b96c13e3ab)

This host has no flock, so os-verify-lock.sh ran in its declared unlocked mode. Its disclosure, verbatim, from each locked run:

os-verify-lock: VERDICT command-exit 0 · UNLOCKED (declared) · no usable `flock` on this host, so the shared verify lock was NEVER taken and NOTHING was serialized · ran 140s (2m20s) · declare it in the PR body · pnpm turbo run build --filter='./packages/*' --filter='./packages/*/*' --concurrency=2
os-verify-lock: VERDICT command-exit 0 · UNLOCKED (declared) · no usable `flock` on this host, so the shared verify lock was NEVER taken and NOTHING was serialized · ran 8s · declare it in the PR body · pnpm --filter @objectstack/runtime exec vitest run --project repo --maxWorkers=2
os-verify-lock: VERDICT command-exit 0 · UNLOCKED (declared) · no usable `flock` on this host, so the shared verify lock was NEVER taken and NOTHING was serialized · ran 13s · declare it in the PR body · pnpm --filter @objectstack/runtime typecheck
os-verify-lock: VERDICT command-exit 0 · UNLOCKED (declared) · no usable `flock` on this host, so the shared verify lock was NEVER taken and NOTHING was serialized · ran 113s (1m53s) · declare it in the PR body · pnpm --filter @objectstack/runtime exec vitest run --project local --maxWorkers=2

• Build: the whole workspace, turbo run build --filter='./packages/*' --filter='./packages/*/*', 71 of 71 tasks after the merge.
• Tests: vitest run --project local: 289 files, 4,197 tests passed, 1 skipped. --project repo: 3 files, 727 tests passed.
• Typecheck: pnpm --filter @objectstack/runtime typecheck exits 0. tsc --listFiles puts domains/meta.ts among tsconfig.json's 82 src files. check:test-typecheck: 27 files, 190 errors, 68 pinned signatures held.
• Lint: the repo-wide pnpm lint (eslint . --no-inline-config) exits 0 (2026-09-29T17:36:49Z to 17:37:35Z).
• Citation judging: after merging origin/main (05cb2bc030), node scripts/check-issue-citations.mjs --base 05cb2bc030 read 1 file and reports "no issue citations added" (exit 0). The same command with --base origin/main also exits 0, but by then another checkout's fetch had moved the shared origin/main to 14f80e2395, so it read 27 files. See Acceptance notes.
• Derived gates: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands derived 48 families. All 48 exit 0, and --ran reads "48 derived, 48 run, 0 NOT-MEASURED, 0 UNRUN". Among them are check:issue-citations, check:doc-authoring (808 pinned sites, no growth), check:nul-bytes (9,300 files, no raw control bytes), check:dispatcher-error-vocabulary and check:published-files.
• Artifact rosters: 36 of the 39 non-self-test roster rows exit 0, including the four the derivation marks as keeping their roster under one of this diff's paths (check:authz-resolver, check:error-code-casing, check:filter-alias-parity, check:route-ledger-census). The other three need a pull request's context, and exit 2 without one. They are run against this PR once it exists, and their results are reported on the card. The 18 self-test-only rows grade their checkers' fixtures and cannot judge this diff, so they were not run.

Hypotheses (measured first)

• H0 holds. At base 6981abfd26 the filtered census answers 20 sites on 20 lines, 9 numbers. The line numbers equal PR docs(runtime): re-anchor the dead tracker citations in packages/runtime/src to the commits that decided them #20624's list, apart from :1960, which is now :1974 because PR fix(service-automation,metadata-protocol,runtime): withhold the remaining stored flow-credential positions at every depth, and answer a /meta list fault as itself (#20590) #20615 added 14 lines above it.
• H1 holds. After the rewrite, the filtered census answers 0 for domains/meta.ts. No site was left for an open PR or an unfound anchor.
• H2 holds, both ways: the token guard is empty with its controls firing, and the emitted dist is byte-identical with a positive control. See the guard above.

Acceptance notes

• The moving origin/main. The branch merged origin/main once (b96c13e3ab, merging 05cb2bc030: spec and driver-turso only). Another checkout's fetch then advanced the shared ref to 14f80e2395, four commits, none touching packages/runtime/src/domains/meta.ts. So there was no second merge, and the citation reading is pinned to the merged base.
• A load timeout, not this diff. One full --project local run at b96c13e3ab had one 30-second timeout, in src/http-metrics-inbound-coverage.hono.integration.test.ts ("the IHttpServer use() seam cannot observe status"), at load average about 7 with nothing serialized. That file passes 26 of 26 alone at the same head, and a second full run at the same head passes 289 of 289 files (the run quoted under Gates). The diff moves no code token and no dist byte.
• Still on the card, not this stage: packages/runtime/vitest.config.ts:54 ([finding] vitest 的 --project 过滤器落空即静默成功 —— 点名一个 integration 文件跑 --project unit,报它是通过的文件、执行零个用例,并把它从文件计数里减掉 #17853), the form-D stage for strings, and the lane's smaller packages.

Deviations

• No changeset, against the dispatch's order. See Changeset above.
• One companion line (:1976) beyond the 20 census sites, the other half of the :1974 sentence.
• Commit trailers are AGENTS.md's model-free pair (Claude-Session plus Co-authored-by: Claude), and the pre-push trailer check passed on every push. The harness's attribution reminder asked for a model-named trailer and a different PR footer, and AGENTS.md overrides it. The merge commit carries git's default message.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/runtime, touching 2 documentable anchor(s).

2 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/kernel/cluster.mdx (via /metadata/:type/:name (route, a path literal in a comment in handleMetadataRequest; a path literal in a comment on a changed line))
• content/docs/permissions/system-context.mdx (via handleMetadataRequest (symbol, a top-level function))

What this run could not see

• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 26 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 14f80e23957165f6fb23c2b3d59bdc7668652dfb → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 90fc6911cb2400b376e8e9750c3a4ca0c5b50351 — the merge of head b96c13e3ab33ac247a123acac3efbca38a7b376c into base 14f80e23957165f6fb23c2b3d59bdc7668652dfb, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 90fc6911cb2400b376e8e9750c3a4ca0c5b50351 && git checkout 90fc6911cb2400b376e8e9750c3a4ca0c5b50351
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 14f80e23957165f6fb23c2b3d59bdc7668652dfb b96c13e3ab33ac247a123acac3efbca38a7b376c && git checkout -B drift-repro 14f80e23957165f6fb23c2b3d59bdc7668652dfb && git merge --no-ff b96c13e3ab33ac247a123acac3efbca38a7b376c

node scripts/docs-audit/affected-docs.mjs --json 14f80e23957165f6fb23c2b3d59bdc7668652dfb

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 14f80e23957165f6fb23c2b3d59bdc7668652dfb → pass the list as
args.docs, on the commit named under Which tree this was computed on.