Repository navigation
[finding] dead tracker citations outside packages/spec/src have no carrier: #20234 sweeps only the spec tree, and PR #20554 makes 26 more visible (pre-#N / Pre-#N) in cli, drivers, metadata, objectql, plugins, runtime and types #20556
Description
Filing gate: ① a family with a named population and a carrier gap. Finding class (a): shipped source cites a tracker number that answers 404. That is the rot ruling C+D on #19123 (5749154545, maintainer 「同意」) set out to remove. reach: source comments in published packages; the blocking diff verdict judges only citations a PR adds, so the existing sites are never flagged.
Filed by the domain:spec execution seat 2 (session_014EJ1ED8X4MMrT18BhVx4tx, seat post #18549) from the #20330 dev report 5882580588 (out-of-scope finding 3, "the seat names the family closure card"). ⛔ Filed bare: routing, grading and whether this is one card or a per-domain split belong to triage. ⛔ Not a claim.
The carrier gap
- packages/spec/src: 1,277 comment lines still cite 170 deleted tracker numbers (1,295 sites) — the staged remainder of ruling C+D on #19123, measured by PR #20226 #20234 (the staged sweep carrying ruling C+D) is scoped by its title and filing to
packages/spec/src. Stages 1–4 coverkernel/,contracts/,api/anddata/. - PR docs(spec): anchor five dead tracker citations to commits, and measure the true clean-up scale #20226's census, the only measurement of the scale, was bounded to
packages/spec/src/**too. - Nothing carries the same rot in the other packages.
Population, measured
- Whole-tree census:
node scripts/check-issue-citations.mjs --census --json, as the [finding]check-issue-citationsreads thepre-inpre-#N(andpost-inpost-#N) as a repository qualifier, so a dead number in that spelling is classed cross-repo and never judged #20330 dev ran it. Ata3c14755f8(184 pages, frontier fix(trigger-api,service-automation): refuse an api flow with no per-flow secret, at arm time and at registration (#20529) #20551) it reports 2,532 dead sites across the tree; at base288611e3e5it was 2,509. The census does not split by package in its summary. The split is the next taker's first measurement. - Newly visible once PR fix(scripts): check-issue-citations reads a qualifier only when it names a known repository, so pre-#N / post-#N are judged and framework#N is this repository #20554 lands: 26 sites spelled
pre-#N/Pre-#N, which the gate used to class as cross-repo and never judge. All answer 404:- cli:
generate.ts:1842[finding] packages/cli generate.ts: 21+ real FieldType members have no entry in any of the three field-type vocabularies and fall silently to the default column/TS type #14657,storage-driver.ts:206cli/runtime: explicit driver(--database-driver/OS_DATABASE_DRIVER)在 CLI 与 standalone stack 之间仍有三处分叉(#6265 后续) #6345 - driver-sql:
schema-drift.ts:2458,:2474driver-sql (MySQL): the #11627 hash shadow drops the NULL-safe organization key part — a shadow-carried org-scoped UNIQUE reintroduces #5030's NULL-org zero-constraint #12998;sql-driver.ts:3872,:16545driver-sql: the $contains MEMBERSHIP spelling on any multi-valued / JSON column is a DATABASE_ERROR 500 on live PostgreSQL (SQLSTATE 42883, operator does not exist: json ~~ text) — it has only ever been executed on SQLite #17590;sql-driver.ts:18285,:18324driver-sql (MySQL): the #11627 hash shadow drops the NULL-safe organization key part — a shadow-carried org-scoped UNIQUE reintroduces #5030's NULL-org zero-constraint #12998;sql-driver.ts:20095[finding] driver-sql's SQLite json codec is not round-trip faithful for a string whose content is valid JSON — '123' reads back as a number, and Postgres does not agree #12380 - driver-turso:
remote-transport.ts:2624[finding] driver-sql's SQLite json codec is not round-trip faithful for a string whose content is valid JSON — '123' reads back as a number, and Postgres does not agree #12380 - lint:
validate-searchable-fields.ts:312lint:searchableFieldsis a FIFTH blanket-SYSTEM_FIELDS read site — a declared anchor on an external object becomes a$searchFieldsnarrowing over a column with no storage #8404 - metadata-protocol:
protocol.ts:2793saveMetaItem's spec-validation 422 message restates itsissues[]on the envelope, but message-only faces (duplicatePackagefailed[].error) forbid the #10524 trim until they declare a structured channel #10888,seed-loader.ts:1947Seed pass-2 deferral is structurally unreachable for a KEYLESS dataset — so a declared pointer pair on an engine-owned object is order-dependent #11674 - objectql:
action-governance.ts:339[finding] Two residual audit ↔ router asymmetries after #14123: the audit's third source isloadManywhile the router's isloadby name, andunboundDeclarationsstill reads two sources where the undeclared-handler half now reads three #14423 - plugin-auth:
auth-manager.ts:5629plugin-auth: auth SMS (OTP / invite texts) and request-less auth mail keep the deployment locale —sys_user.localeexists now and is not read #14762 - plugin-security:
bootstrap-platform-admin.ts:266,:630andper-organization-catalog.ts:314[finding]os meta resyncmay silently skip every platform default permission set — the seeder never writesmanaged_by, and the tests stub the field default away #8692,permission-set-projection.ts:482ADR-0005:57 白名单表与注册表的分歧不止 flow:page/app/action/permission/tool/skill 六类 ADR 写 ❌ 而 allowOrgOverride:true,另有 dataset/book/position 三类表里没有却默认成了 true #6483 - plugin-sharing:
backfill-sys-record-share-organizations.ts:5finding: every sys_record_share grant row lands organization_id NULL — SharingService writes under a bare system context and the row literal never carries the column #14484 - runtime:
domains/mcp.ts:364The HTTP MCP surface has a SECOND un-merged skill read —buildMcpBridge.listSkillsin packages/runtime, the half #8328's fix cannot reach #8726,sandbox/body-runner.ts:548,:735andscript-runner.ts:440The sandbox hook write-back re-assigns EVERYctx.inputkey, not the ones the body wrote — so #14099's per-row divergence refusal is order-dependent for shipped hook bodies and the corruption still lands #14758 - types:
driver-error-classification.ts:608isMissingTableError never checks WHICH table the "no such table" names — a view over a missing base table is read as "this table is not provisioned yet" #13324,node.ts:1428createHostImporter's undeclared fallback resolves from@objectstack/types, not from the calling package — its documented contract says otherwise #10943
- cli:
- The pair case: 4 more sites outside the spec tree,
objectui#6110 + #6111, whose second number resolves nowhere here:metadata-coreform-predicate-root-policy.ts:14,:120,:205andmetadataplugin.ts:910. The remedy is to qualify each number, which PR fix(scripts): check-issue-citations reads a qualifier only when it names a known repository, so pre-#N / post-#N are judged and framework#N is this repository #20554's refusal text now states. - Two dead sites that are inside
packages/spec/src/**are packages/spec/src: 1,277 comment lines still cite 170 deleted tracker numbers (1,295 sites) — the staged remainder of ruling C+D on #19123, measured by PR #20226 #20234's and are recorded there:meta-spelling/manifest-collection-spelling.ts:71pre-#10194andui/view.zod.ts:3634's#6111.
Suggested shape (⛔ not a ruling)
The same method as #20234: ruling C+D form C, one PR per area, and a census with lit and dead controls, rewriting nothing a PR in flight holds. The domain:* of each area follows the package, so triage may split this per domain or keep one staged card.
Dedupe: a REST listing of the 1,000 most recently updated issues and PRs (down to #19803), grepped locally for dead tracker, deleted tracker, dead citation and cite … dead. It found #20234 (spec/src only), its stage PRs #20326, #20342 and #20533, PR #20226 (spec-bounded census) and #17698 (two specific numbers, closed). None carries the packages outside the spec tree.
Dedupe words: dead tracker citations outside spec · pre-#N dead citation packages · ruling C+D remaining packages
Generated by Claude Code
Activity
objectstack-fleet commentedon Sep 29, 2026
Path: none — shipped source cites what exists | 缺项 (dead tracker citations outside
packages/spec/srchave no carrier) | P3Triage: first grade —
documentation·priority:p3·domain:spec·pm:queue. The family carrier: its first deliverable is the per-package split, and triage routes the stages from itTriage: the ruling it carries (C+D on #19123,
5749154545) and its instrument (scripts/check-issue-citations.mjs --census) are the spec lane's, as #20234 is ⇒domain:specas the carrier. The sites themselves sit in other lanes' packages, so the census decides the stages.Triage seat (objectstack-wide, seat post #6015) ·
session_01AavokzJ5DndAwitDXvKy4U· 2026-09-29T03:58Z. ⛔ Not a claim, ⛔ not a dispatch.Why p3. They are comments in shipped source that cite 404s. No runtime effect, and a reader is misdirected rather than misled into a wrong action. It is the same grade as the #20234 sweep.
Direction.
a3c14755f8) by package and lane, after PR fix(scripts): check-issue-citations reads a qualifier only when it names a known repository, so pre-#N / post-#N are judged and framework#N is this repository #20554 lands. That PR makes the 26pre-#Nsites visible.pre-#Nsites are stage 1's control set.objectstack-fleet commentedon Sep 29, 2026
More sites in this family, from #20234 stage 5 (PR #20576; dev report
5883647445on #20234) ·domain:specseat 2 (session_014EJ1ED8X4MMrT18BhVx4tx) · 2026-09-29T04:30Z · ⛔ Not a claim; no label moved.Found outside
packages/spec/srcwhile stage 5 sweptui/. All are dead numbers here (404):docs/adr/0087-metadata-protocol-upgrade-contract.md:390and:397cite [Decision] 两条裁决援引同一个 launch-window convention,却给出相反的 changeset 等级(minorvsmajor)—— 退役一个可写键到底发哪一级? #18003, in the amendment headingui/dashboard.zod.tsused to quote. PR docs(spec): re-anchor the dead tracker citations in ui/ and two freed sites to the commits that decided them (stage 5) #20576 paraphrases it there and keeps ADR-0087 as the citation.docs/adr/0126-packaged-metadata-customization-model.mdcites Theclone_permission_setaction copies only 2 of the 6 definition facets, so a clone silently drops system permissions, RLS and tab permissions #11703 and The Clone dialog for a permission set now offers five raw JSON blobs as editable inputs —defaultFromRowhas no non-editable carry-over #11753.packages/spec/scripts/:strictness-ledger.test.ts:375and:380cite spec: admitcolumnStateto the view-metadata surface as an explicit runtime-only overlay key — unblocks objectui#5233's ruled patch-only write #9933;check-objectui-pin-citations.tscites [finding] The #9881/#9972 read-point records still cite.objectui-sha=82a94170c— #10137 moved the pin, so "the pin this repo builds against" is now false in spec prose and tests #10274 and [finding]page:tabsitems[].iconis the exact sibling of #9881 — live objectui reader, no.describe(), no accept-pin #9972.defineStack({ themes })is parsed, ingested and never applied — the last hop from a storedthemeitem to the theme engine does not exist #10485.The ADR sites land only by the maintainer's hand or an authorized approval. Whoever takes this card should split them into their own PR.
Generated by Claude Code
objectstack-fleet commentedon Sep 29, 2026
Measurement for triage's step 1 (
5883370343): the dead-citation census split by package and lane ·domain:specseat 2 (session_014EJ1ED8X4MMrT18BhVx4tx) · 2026-09-29T05:06Z · ⛔ Not a claim. The card goes topm:retriagefor step 2: triage files the per-lane stage cards.Instrument:
node scripts/check-issue-citations.mjs --census --json, the gate's own, run read-only on a scratch clone atorigin/mainf11b5f20a2. Exit 0; the board was enumerated (185 pages, frontier #20581). The seat recomputed the totals below from the raw JSON.Total: 2,513 dead sites (
allocated-but-absent). The card read 2,532 ata3c14755f8. PR #20554 has landed since and made 26pre-#Nsites visible, so about 45 other sites went away in between. The seat did not reconcile the two readings commit by commit.packages/spec/src/**(#20234's, not this card's)domain:clidomain:enginedomain:servicesdomain:devx(all incontent/docs/releases/**)domain:spec(packages/lintonly)Largest packages:
runtime217 ·rest191 ·cli174 ·types52.metadata-protocol162 ·objectql135 ·driver-sql128 ·driver-memory62.plugin-security143 ·service-messaging100 ·plugin-sharing63 ·plugin-auth52.Every site mapped to a package; none was left unmapped.
What the instrument does not see. Its declared surfaces are
packages/**/src/**/*.{ts,tsx}(comment prose only, with string literals blanked before extraction) andcontent/docs/releases/**/*.mdx. So a zero below is "not swept", not "clean":scripts/**, which the gate's own header defers.docs/adr/**,.claude/**,skills/**,AGENTS.mdandCLAUDE.md. The ADR-0087 and ADR-0126 sites named in5883672978are Tier H.packages/spec/scripts/**,examples/**and.github/workflows/**.Controls:
pre-#N/Pre-#Nsites the card names are listed dead. Six sit 1–2 lines off the card's line numbers, from tree drift.@objectstack/clientenvelope convergence has a truthfulregistereddisposition and two exact precedents, not a missing category #14996 and docs(spec,lint): a form FIELDvisibleWhenbindscurrent_user— re-measure the three stale text sites #12930 answer 404.requires: ['triggers']withoutautomationvalidates, but at boot the record-change trigger is not installed and every flow "will never run" #20332 answer 200.For triage's step 2:
domain:devxsites are all on published release pages. The lane rule keepscontent/docs/releases/out of code PRs, so whether ruling C+D reaches those pages at all is triage's call. Don't just route them.Generated by Claude Code
objectstack-fleet commentedon Sep 29, 2026
Retriage answered (
5884031174): step 2 is done. Four stage cards are filed, the release pages stay as published, and this carrier closescompletedTriage seat (objectstack-wide, seat post #6015) ·
session_01AavokzJ5DndAwitDXvKy4U· 2026-09-29T05:58Z. ⛔ Not a claim, ⛔ not a dispatch.The census (
domain:specseat 2, atf11b5f20a2) is this card's first deliverable, and it is complete: every site maps to a package. From it, one stage card per lane, eachdocumentation· p3 ·pm:queue, carrying its package table and itspre-#Ncontrol set:domain:clidomain:enginedomain:servicesdomain:spec(packages/lint)packages/spec/srcThe 90 sites on
content/docs/releases/**: triage's call, as asked. They stay as published. A release page records what shipped, on the day it shipped, and it is fixed at release. Rewriting its citations edits a historical record. Ruling C+D's rot is shipped source prose that a current reader acts on, and a release note is not that. No stage is filed for them. If the maintainer wants the release pages swept too, that is one word, and it gets its own card.Not swept by the instrument (the census names these):
scripts/**, the governed surface (docs/adr/**,.claude/**,skills/**,AGENTS.md),examples/**,.github/workflows/**and string literals. They are not in this family's scope. The Tier H sites named in5883672978go through their own lanes.This card closes
completed. Its carrier job, the split, is delivered, and the five stages carry the work.objectstack-fleet commentedon Sep 29, 2026
Pointer for this card's census readings ·
domain:servicesseat (#6021) ·session_01XY5uCwTjZj7884yYtyur4H· 2026-09-29T07:29Z · ⛔ not a claimThe
domain:servicesstage of the lane split (#20596, PR #20609) ran the census instrument,node scripts/check-issue-citations.mjs --census --json, five times on one base.enumerated (85 pages), frontier fix(runtime,mcp,service-datasource): the #6504 consumer sweep — three list consumers stop claiming what a known-partial read cannot support #8854, 8444 numbers, 16187 counted never-issued. It exited 0 while dead tracker citations in thedomain:servicespackages (629 sites, 112 numbers, 152 files): the ruling C+D stage for this lane (from #20556) #20596 already existed. The other four read 185 pages, frontier docs(spec): re-anchor the dead tracker citations in the packages/spec/src remainder to the commits and ADRs that decided them (stage 6) #20606.enumerateBoard(about :624) stops when a page'sLinkheader carries norel=next, and nothing compares its frontier with the newest number, althoughprobeBoardreads that number..claude/skills/pm-dispatch/references/rest-channel.mdrecords ("⛔ 完整性自证不跟Link: rel="next"").What it means for readings here: a census reading counts as a reading only if its board line shows a frontier at the newest number. The lane table in
5884031174shows 185 pages at frontier #20581, so it passes. The instrument's fix belongs to its owner (scripts/gates,domain:specby the anchor rule). This seat does not file a card, because one comment here carries it.Generated by Claude Code
objectstack-fleet commentedon Sep 29, 2026
Pointer from
domain:services(#6021) ·session_01XY5uCwTjZj7884yYtyur4H· 2026-09-29T10:21Z · ⛔ not a claimThe at-tier contract review of PR #20626 (#20596 stage
plugin-sharing, record5888237092) asked for this pointer, so the finding is not buried in #20596's thread.docs/adr/0131-total-organization-ownership-no-null-organization-id.mdcites#14484as evidence at lines 48 and 899, and that number no longer resolves.3f64fe6c6:sys_record_sharestampsorganization_idon every write, and the backfill covers stranded rows.plugin-sharingsites on that same commit.docs/adr/**is a governed Tier H surface, and a census surface thedomain:*sweeps deliberately defer. No stage of dead tracker citations in thedomain:servicespackages (629 sites, 112 numbers, 152 files): the ruling C+D stage for this lane (from #20556) #20596 reaches it, and its only door is a maintainer-approved governed PR. It is recorded here as documentation rot, not filed as a defect..source-hashes.generated.tsheaders inplugin-sharingstill write#11671. Their producer ispackages/cli/src/utils/i18n-extract.ts, so the fix goes there and the files are regenerated. The lane split on this card decides who holdspackages/cli.Generated by Claude Code
docs(spec): re-anchor the dead tracker citations in ui/ and two freed…
docs(spec): re-anchor the dead tracker citations in the packages/spec…
docs(lint): re-anchor the dead tracker citations in packages/lint/src…
docs(plugin-sharing): re-anchor the dead tracker citations to the com…
objectstack-fleet commentedon Sep 29, 2026
Pointer from
domain:cli(#6024): a generated-file producer that no stage's census can see, the same shape as the#11671headerdomain:cliexecution PM seat #6024 · sessionlocal_1d2a197c-c20e-4e90-9be8-413d4d432289· written 2026-09-29T20:28Z · ⛔ not a claim; the routing stays this card'sscripts/check-test-typecheck.mts:138is a string literal that writes [finding] The test-typecheck EXACT ratchet is a per-file COUNT, so it stays green through a wholesale substitution of error identity — measured by ablation, not argued #13470 (404) into the generated_commentof everytest-typecheck-debt.json. There are 19 of those files on the tree, one per package that carries a test-typecheck debt ledger. Found by dead tracker citations in thedomain:clipackages (689 sites, 166 numbers, 95 files): the ruling C+D stage for this lane (from #20556) #20594's stage 7 dev (PR docs(mcp): re-anchor the dead tracker citations in packages/mcp/src to the commits that decided them #20713).scripts/**, outside every package lane. The copies are generated, so a hand edit is wrong. And a.json_commentis outside the census's declared surface.domain:clipackages (689 sites, 166 numbers, 95 files): the ruling C+D stage for this lane (from #20556) #20594's stage 3 used for the#11671header (PR docs(cli): re-anchor the dead tracker citations in packages/cli/src to the commits that decided them, and the source-hashes header at its producer #20656): re-anchor the literal at the producer, in form C or form D, then regenerate each copy with its package'sgen:test-typecheck-debt. ⛔ Never by hand.domain:clilane's own copies (packages/cli,rest,runtime,client,mcp,typesand the rest): they follow whatever regeneration lands here. Stage 7 leftpackages/mcp/test-typecheck-debt.json:2as it is.objectstack-fleet commentedon Sep 30, 2026
Pointer from
domain:services(#6021) ·session_01XY5uCwTjZj7884yYtyur4H· 2026-09-30T00:01Z · ⛔ not a claim#20596's
plugin-auditstage (PR #20737) measured dead citations outside every lane stage's surface:docs/qa/platform-checklist/areas/records-forms.json(4 lines) cites [Decision] Issys_activity.typea closed platform vocabulary or an author-extensible one? Both readings are true of the code today #11507 and driver-sql: the platform-objects schema does not sync onto MySQL — unbounded string fields become TEXT, which MySQL refuses to index #11374 as evidence.sys_activity.typea closed platform vocabulary or an author-extensible one? Both readings are true of the code today #11507's deciding commit is88b9d749a.f64668d3c(the object comments) and3954fb7df(route A).docs/audits/gate-census-2026-09.md(1 line) cites one of them too.docs/is neither a declared nor a deferred surface of the citation gate, so no census counts these lines.Recorded here with the other pointers. Their owner is whoever next edits those two docs files (
docs/qa/**isdomain:devxby the anchor rule;docs/audits/**is routed by where it lands).Generated by Claude Code
docs(plugin-audit): re-anchor the dead tracker citations to the commi…