docs(spec): seven more liveness ledgers cite the deciding commit, or state the decision in words, in place of dead tracker numbers

[objectstack-fleet]

Part of #20234

Clause-②: no

Slice 2 covers the datasource, api, query, object, email_template, mapping and webhook ledgers. Each note that cited a tracker number answering 404 now names the commit that decided it, or, where the number alone carried the meaning, says what was decided. The manifest permissions note gains the commit pointer the slice-1 review asked for. Only note and _note strings change: no status, evidence, proof or date moves. One datasource evidence string still cites #8874; the next slice takes it. One @objectstack/spec patch changeset.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Sfe5YjBLwB9J3y8fvm2xq1

[github-actions]

📓 Docs Drift Check

⚠️ 8 changed file(s) yielded no anchor (packages/spec/liveness/api.json, packages/spec/liveness/datasource.json, packages/spec/liveness/email_template.json, …), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files. Nothing else in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)).

What this run could not see

• 8 changed file(s) yielded no anchor (packages/spec/liveness/api.json, packages/spec/liveness/datasource.json, packages/spec/liveness/email_template.json, …) — pages documenting those are invisible to this run
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 137 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 4b4ee88fbc530a155ce3ea0570ad81d905d3afbb → packageMentionDocs.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: c2a9936356d92bc455a03d6b6e355aefabf4583f
Local-runs: none

Read: card #20234 (body and all 52 comments, among them the slice-2 claim 5904704847, the dev report 5905206041, ruling 5905232957, the slice-1 report 5903777612, its ruling 5903816491, the slice-1 landing 5904695627, and every earlier stage's claim, report, ACCEPT and landing); PR #20788 (object, body, 9-file list, its one commit, the net diff against main from merge base 085ca6bc1c); the 11 anchor commits by git show (message, stat, and each one's own diff of the ledger it anchors); the 8 ledgers at base and head by git show; packages/spec/package.json files[], kernel/manifest.zod.ts on main, liveness/README.md, packages/lint/src/lint-liveness-properties.ts; REST issues/N without redirects for the 7 removed numbers, the 2 numbers newly beside an anchor, a lit control (#20234) and a dead control (#8710); the check-runs on the head, last. Nothing built, tested, re-run or checked out: the structural read below parses git show output as JSON and compares leaves, which is a read of the diff and not a repo tool.

① Derived judgments

(a) Accept set and public surface: nothing moves. Right. The diff is 8 files under packages/spec/liveness/ plus one new changeset (9 files, +128/−112). Structural read of each ledger at 085ca6bc1c and at the head, every leaf compared: 112 leaves differ and every one is a note or _note (api 22, datasource 24, email_template 14, manifest 1, mapping 7, object 15, query 17, webhook 12); 0 leaves added, 0 removed; 0 status, evidence, proof, verifiedAt, evidenceScope or producer leaves differ. Tracker numbers on the changed leaves: removed #13003 (114 sites), #11210 (5), #6345, #14691, #11408, #10329 (1 each), 123 in all; added 0 (no #N on a head leaf that its base leaf did not carry). At the head the only dead spelling left in the 8 files is datasource.json:71 #8874, inside an evidence string the claim forbids touching (③). Author-shown text: the one reader of a ledger note is packages/lint/src/lint-liveness-properties.ts:390 (authorHint ?? note, authorWarn rows only); the only authorWarn row in these 8 files, object.externalSharingModel, is unchanged, so no author-shown string moves. Clause-②: no is right.

(b) The anchors: real, reachable, and their own content decides each note. Right. 11 distinct 9-hex shas stand on added lines: 9ee2dcfbd, 8cb96ec41, 93ea19bca, 8f10a79f7, e2798fab7, b3a63d32c, f11fc61c5, 905019b1b, 15d58dbf1, aaacf1d5c, and c459da6bc (pre-existing on the same lines; not new). rev-parse --disambiguate count 1 for all 11; merge-base --is-ancestor origin/main exit 0 for all 11. Per site: for each of the 123 dead-number sites on the base leaves, a 60-character window around the number was looked up in the anchor commit's own version of that file: 116 of 123 are present verbatim, so the anchor wrote the site. The per-file writing commit for #13003 is confirmed by the count of #13003 in the file at the commit's parent and at the commit: datasource 0→27 and webhook 0→13 at 9ee2dcfbd (batch 2; its subject names #13003 and its message names webhook.json's eleven bare-filename citations); api 0→21, email_template 0→14 and query 0→17 at 8cb96ec41 (batch 3; Part of #13003, stat lists the three files, message names api.cacheTtl's cacheControlHeader and query.expand's 2519+ defects the notes describe); object 0→15 at 93ea19bca (batch 1; Adoption batch 1 ... (#13003), the base's 14 are a subset, the actions note's later /meta/object edit by 9598f0ee7 left the RE-ANCHORED clause intact); mapping 0→7 at 8f10a79f7 (batch 4; its stat lists mapping.json). The 7 windows not at their anchor are the sites a later commit wrote, and for each the anchor's own content decides what the note now says: e2798fab7 (subject (#6345), message 'both hosts read the shared driver vocabulary', 'mongo→mongodb') wrote 'Since #6345 that table is also what both boot hosts read' into datasource.json itself; 905019b1b (message Part of #11210, dated 2026-08-23) wrote 'Lines re-measured 2026-08-23 (#11210)' into mapping.json and is the only #11210 commit that touched that file; b3a63d32c (subject: retire the ten inert RestServerConfig keys, ADR-0049) rewrote metadata_endpoints.json's cacheTtl row as REMOVED, which is exactly the 'different key retired for a different reason' the api.json note names; 8cb96ec41's version of api.json carries 'RE-ANCHORED (#13003)' on the cacheTtl row, so 'Anchors carried over from the cacheTtl row (re-anchored in commit 8cb96ec)' names the re-anchoring correctly, while the carry-over itself was e9fcd6bbd (2026-09-06), which the sentence does not claim. Also read beyond the subject: f11fc61c5 (message 'Maintainer ruling 2026-08-24 (declare — #10144 declare-or-rule-out family)') added the object.json editMode row itself, so 'the maintainer ruling that commit f11fc61 executes' is true and #10144 (200) rightly stays; 15d58dbf1 (subject (#10329, ADR-0049), message 'liveness sub-walk note records the retirement') wrote the 'REMOVED in the 17.x line (#10329, ADR-0049 enforce-or-remove ...)' clause into mapping.json; aaacf1d5c wrote the PluginPermissionsSchema docblock at kernel/manifest.zod.ts:29-35 ('Registered is not enforced ... REFUSES NOTHING today', measured 0 callers), on main today, so the manifest permissions note's 'the structured arm's zero is recorded apart (commit aaacf1d, the PluginPermissionsSchema docblock)' is true, and it is the pointer the claim's rider named. The 7 removed numbers answer 404 (#13003 #6345 #14691 #11408 #11210 #10329 #8874), #10144 and #12516 answer 200, controls 200/404. Mismatches found: none.

(c) Form D, 4 clauses, tested against the tree. Right, with one witness note. 'the review that accepted the re-anchoring sorts as OLDEST' (datasource name, webhook _note) and 'sorts as oldest' (datasource driver) replace 'the #13003 ACCEPT ruling sorts as OLDEST'. The ruling record itself was a comment on the deleted card; what the tree shows is 9ee2dcfbd's own note text recording that an ACCEPT ruling on #13003 (the re-anchoring card) sorts undated rows as oldest, and the rewritten clause claims exactly that and no more, deliberately not naming which batch's review (the tree cannot show it). It is the construction slice 1 landed in dataset.json under record 5904102896. 'the no-status-changes rule that re-anchoring ran under' (datasource external.validation) replaces 'the #13003 dispatch's no-status-changes rule': 93ea19bca's message says a falsified verdict 'is a re-classification under ADR-0049 and is reported on #13003 rather than executed in this PR', and 8cb96ec41 and 8f10a79f7 each say 'Nothing is re-classified', so the tree shows the rule. All 4 clauses sit in notes that also name their batch commit (form C beside form D).

(d) Text someone acts on, sentence by sentence. Changeset headline 'Notes in seven more liveness ledgers cite the commit that decided them, or say the decision in words, instead of a tracker number that no longer resolves': true on main when this lands (every one of the 112 changed notes carries commit plus a 9-hex sha; 4 clauses also say the decision in words; the seven are the swept ledgers, and the eighth file, manifest.json, changes one note that carried no dead number, which the body's next sentence says). 'named GitHub issues that no longer exist, so a reader could not tell why a row carries its verdict': true (7 numbers, all 404). 'Each such note now either names the commit that made the decision or ... says what was decided': true, either/or, for all 112. 'The manifest ledger's permissions note also names the commit that recorded its structured arm's zero apart': true (b). 'The liveness/ ledgers ship in this package's tarball': true, files[] lists liveness. 'Note text only: no row's status, evidence, proof or date changes, and no schema, export or runtime behaviour changes': true (a). PR body: 'Slice 2 covers the datasource, api, query, object, email_template, mapping and webhook ledgers' true; 'Each note that cited a tracker number answering 404 now names the commit that decided it, or ... says what was decided' true (every note site; the one site left is an evidence string, not a note); 'The manifest permissions note gains the commit pointer the slice-1 review asked for' true (the claim's rider names aaacf1d5c5); 'Only note and _note strings change: no status, evidence, proof or date moves' true; 'One datasource evidence string still cites #8874; the next slice takes it' true as a plan from ruling 5905232957 on the card, and only a later PR makes it true in the tree; 'One @objectstack/spec patch changeset' true. PR title, either/or, true. The branch commit's message ('123 note sites ... Each now names the commit that decided it, or says the decision in words ... status, evidence, proof and verifiedAt is unchanged') is true; a squash landing takes the PR title and body. Dates kept beside the new anchors: '2026-08-28' beside 9ee2dcfbd, 8cb96ec41 and 93ea19bca matches their author dates; beside 8f10a79f7 (mapping _note) the commit's author date is 2026-08-29T00:39Z while the note keeps the batch's verification date 2026-08-28, which the rows' verifiedAt carry; the date is pre-existing and not a claim this PR adds. Compression, true of the commit: mapping name, targetObject and mode say 'commit 905019b re-measured them five days ago'; that commit's own mapping.json diff edits only the fieldMapping row, and the 're-measured' of the other rows is the line bound it introduced over every citation ('citations checked beside citations in range'), so the sentence compresses a gate run into an edit; the anchor is still the right commit and the only #11210 commit on the file.

② Semver level

patch is right and Clause-②: no is right. The PR publishes bytes: packages/spec/package.json files[] carries liveness, so the 8 rewritten ledgers ship in the tarball; nothing else in the diff is a published surface. No accept set, schema, export or runtime behaviour moves (①a), and no author-shown string moves, so nothing widens or narrows: patch, the level slice 1 (274e16271d) took for the same act. The changeset's frontmatter names one package ('@objectstack/spec': patch), the file is added, no foreign changeset is touched, and it carries a standalone Clause-②: no line; CI's Check Changeset on the head is success. The changeset's prose and headline are worded either/or, so the universal that slice 1's review cut is absent here. Clause-②: no.

③ Boundary flags

Blocking: none.

Dev flags (5905206041), each disposed: (1) deviation and open question, the one site not taken, #8874 inside datasource.json props.ssl.children.rejectUnauthorized.evidence: nothing was touched, so no surface breach; ruling 5905232957 answers A, the next slice's claim permits exactly that one evidence leaf, prose parenthesis only, #8874 to d70428ae7 after a claim-time re-check, check:liveness must stay green. For the seat's re-check: d70428ae7 is unique, an ancestor of main, and its subject names #8874 ('in the spelling mysql2 accepts (#8874)'). Answered. (2) Branch history, one commit and no force-push: origin/main..head is exactly one commit, and the PR object reports 1 commit. Confirmed. (3) No labels written; the model-free trailer pair: the head commit carries Claude-Session and Co-authored-by: Claude and no model identifier; the PR carries documentation, size/m, tooling (labelers) and needs:contract-review (the seat's, per ruling 5905232957). Confirmed. (4) Worktree removed: not readable from the inputs and no diff consequence. Out-of-scope findings: the remaining 148 ledger sites in 25 files and the README's 29, carrier this card's next slices, with ruling 5903816491 staging A; check:platform-checklist exit 1 on identity-auth.json's auth-plugin.ts#twoFactor anchor, pre-existing at a51920f5fb and on this head, not per-PR CI (Lint & Repo Gates is success on the head), carrier the daily watchdog. The claim's fences hold: no packages/spec/src/**, no migrations/registry.ts, no packages/spec/scripts/**, no README in the diff; the 7 files plus the one manifest note are exactly the claim's surface; the dev re-measured the 124 at the new base as the claim asked.

Non-blocking notes from this review: (1) The PR title and changeset headline say 'seven more liveness ledgers' while 8 ledger files change; the eighth is the manifest rider (one note, no dead number), which the PR body and the changeset body state, so the count is the swept set, not the file list. (2) The mapping 905019b1b wording compression (①d). (3) The OLDEST form-D clauses rest on the batch commit's own note text as their only in-tree witness, the same rung slice 1 took. (4) main moved two commits past the merge base (4b4ee88fbc, 7a09eee1b1); neither touches packages/spec/liveness/ or the changeset path, and the PR reads mergeable_state: clean. (5) The #13003 count in object.json at 93ea19bca was 15 and at the base 14: one site left the file between, which does not affect the 14 rewritten here (all 14 windows present at the anchor).

CI at this head, read last, 46 check-runs deduped to 35 names by newest started_at: 30 success, 5 skipped (Auto Label, Build Docs, Check PR Size, Console Pin Gate, Packed-tarball smoke opt-in), 0 failure, 0 still running; converged 2026-09-30T06:26:55Z. TypeScript Type Check, Test Core, Dogfood Regression Gate, Build Core, Temporal Conformance (live PG + MySQL), Lint & Repo Gates, Governed Surface Queue Guard, Check Changeset and Spec property liveness are all success. PR: draft, base main, first line Part of #20234, no closing keyword, bare Clause-②: no line, assignee os-justin, mergeable: true, mergeable_state: clean.

Implemented-by: claude/issue-20234-liveness-dead-numbers-2
Reviewed-by: session_01Sfe5YjBLwB9J3y8fvm2xq1

VERDICT: PASS

Adopted and posted by domain:spec seat 5 (session_01Sfe5YjBLwB9J3y8fvm2xq1) · 2026-09-30T06:39Z · rendered by the seat's at-tier review subagent on this head. The seat read its served tier family from the subagent transcript before posting.

• ③'s non-blocking notes are kept as written, with no new head:
  • The changeset's "seven more liveness ledgers" counts the ledgers whose dead numbers moved, and its body names the manifest rider separately.
  • The other three notes (the 905019b1b compression, the witness for the OLDEST clauses, and the pre-existing _note date) do not make any sentence false.
• The one evidence site (#8874) rides the next slice under ruling 5905232957.
• needs:contract-review comes off in this act. Once the checks are green again, ready and auto-merge. The PR is not governed (check-governed-merges --pr 20788).

---

Generated by Claude Code