chore(devx): migrate the remaining free line citations and record the residual

The rest of the population #15809 measured, one repair per shape:

- TRACKED TARGETS the surrounding prose already names become file-level
  anchors, and where the prose names the symbol too they become symbol anchors
  the gate now resolves — `packages/objectql/src/plugin.ts#runGovernanceInventory`,
  `packages/plugins/plugin-audit/src/audit-writers.ts#resolveWriteLocale`,
  `scripts/check-system-context-census.mjs#UNENFORCED_TEXT_COUNTS`. A bare
  `engine.ts` was never ambiguous where the prose said which package.
- THIRD-PARTY AND DEPENDENCY SOURCES (`@oclif/core`, `@changesets/pre`) name
  the package, the file and the pinned line as prose. Nothing in this tree can
  resolve them, and a pinned upstream line is provenance, not a pointer.
- ILLUSTRATIONS take the angle-bracket placeholder spelling.

⛔ Again, no number is repaired or repointed: every digit is still on its page.

The residual is 15 citations across six files, and every one of them is a file
another lane holds OPEN — three by PR #16215, one by PR #16202, three by the
in-flight #15776, one by #12511. NOT ONE is a genuinely ambiguous abbreviation.

⚠️ `judgeUntrackedLineAnchors` therefore stays `false`. The fence this work was
dispatched under flips it only when the residual is ZERO and a self-test pins
the flip; flipping it over 15 citations in files this PR may not touch would
make the gate permanently red for the length of somebody else's pull request —
the exact shape the card argued against. `--list-unresolvable` now prints that
residual, so the next author inherits a worklist rather than a count.

Part of #15809.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Vbw3RPgdtqesx4azk9SbW8

Author: claude

scripts/audits/14096-tenancy-ledger-namespace-regexp-census.mjs

@@ -94,7 +94,8 @@ const REPO_ROOT = resolve(HERE, '../..');
 // ---------------------------------------------------------------------------
 // §1. Discover every registered platform-namespace object by AST-lite census
 //     of `ObjectSchema.create(` calls — the same method the ledger's own
-//     header (`platform-object-tenancy.ts:32-37`) documents using.
+//     header (`packages/objectql/src/tenancy/platform-object-tenancy.ts`, its
+//     opening comment — lines 32-37 as measured) documents using.
 // ---------------------------------------------------------------------------
 
 /** Blank out `//` and `/* *\/` comments and string contents (chars only,

scripts/audits/14423-unbound-declarations-before-count.mjs

@@ -59,7 +59,8 @@ const loadStandaloneActions = async () => [...namelessStandaloneOrphans, namedSt
 
 const { warnings, logger } = silentLogger();
 
-// Exactly as ObjectQLPlugin.runGovernanceInventory calls it (plugin.ts:2516),
+// Exactly as ObjectQLPlugin.runGovernanceInventory calls it
+// (`packages/objectql/src/plugin.ts#runGovernanceInventory`),
 // with an empty registered-handler set and no object-embedded actions/registry
 // rung, so the ENTIRE declaration set comes from `loadStandaloneActions`.
 await runActionGovernanceInventory({

scripts/check-adr-links.mjs

@@ -11,8 +11,9 @@
 // checked by nothing, and records link each other heavily: most carry a
 // `**Builds on**:` line with 3-10 relative links in it.
 //
-// That is not a theoretical hole. `0057-erp-authorization-core-business-units-
-// and-scope-depth.md:5` pointed at `./0010-metadata-protection.md`, a file that
+// That is not a theoretical hole.
+// `docs/adr/0057-erp-authorization-core-business-units-and-scope-depth.md`
+// (line 5 as measured) pointed at `./0010-metadata-protection.md`, a file that
 // has never existed (the record is `0010-metadata-protection-model.md`). It sat
 // there long enough that a triage comment inherited the wrong attribution and
 // repeated it. PD #13 sends the next author to "go read that decision"; a dead

scripts/check-changeset-no-major.mjs

@@ -687,7 +687,8 @@ export function render(result) {
     // nothing final ships until `changeset pre exit`. Surface the introduced
     // majors for the RC curator, but do not fail. The guard re-arms once
     // pre-mode exits: `changeset pre exit` rewrites pre.json's mode to `"exit"`
-    // (@changesets/pre@2.0.2, changesets-pre.cjs.js:117), which is not `pre`.
+    // (@changesets/pre@2.0.2, its `changesets-pre.cjs.js` bundle, line 117 as
+    // pinned — a dependency file, outside this tree), which is not `pre`.
     case 'exempt':
       stdout.push(
         `✓ Changesets is in pre-release mode (tag: ${result.tag}) — ` +

scripts/check-cli-test-child-env.mjs

@@ -185,7 +185,8 @@
  * suite stays green, and the comment claiming the built entry stays plausible.
  *
  * `@oclif/core@4.13.3` skips its TypeScript path lookup only when `isProd()`,
- * which `lib/util/util.js:66` defines as a NEGATED membership test -- a leading
+ * which its `lib/util/util.js` (line 66 as pinned -- a dependency file, outside
+ * this tree) defines as a NEGATED membership test -- a leading
  * logical-NOT over `['development', 'test'].includes(process.env.NODE_ENV ?? '')`.
  * Measured directly against `Config.load()` on `packages/cli`, with
  * `packages/cli/dist` present, reading back the root plugin's `commandsDir`:
@@ -1056,7 +1057,8 @@ const BUILT_ENTRYPOINT = 'bin/run.js';
  * The `NODE_ENV` values that send `@oclif/core`'s command lookup to `src/`.
  *
  * `@oclif/core@4.13.3` skips its TypeScript path lookup only when `isProd()`,
- * which `lib/util/util.js:66` defines as a NEGATED membership test:
+ * which its `lib/util/util.js` (line 66 as pinned -- a dependency file, outside
+ * this tree) defines as a NEGATED membership test:
  * `!['development', 'test'].includes(process.env.NODE_ENV ?? '')`. So these two
  * values -- and only these two -- turn the reroute ON. `production` and unset
  * both leave it off, which is why the rule below refuses a SET of values rather

scripts/check-console-injection.mjs

@@ -99,7 +99,8 @@
  *     esbuild re-emits `"…definition's…"`. Same characters, different bytes, so a
  *     literal substring search over source text misses it.
  *   - 19/44 constant-folded concatenation. Source splits a long description as
- *     `'… declares ' + '`_packageId`.'` (api/protocol.zod.ts:341-342 is one);
+ *     `'… declares ' + '`_packageId`.'` (`packages/spec/src/api/protocol.zod.ts`
+ *     is one, lines 341-342 as measured);
  *     the bundler folds it to one literal that exists in no source file.
  *
  * A missed probe here reads as "not expired" — a SILENT PASS, the same failure

scripts/check-dispatcher-error-vocabulary.mjs

@@ -925,7 +925,7 @@ export const OBJECT_LITERAL_CODE_HELPER_BLINDNESS = Object.freeze({
  * for the D6 field-addressed validation catalog in `domains/automation.ts`, and
  * [#14626]'s two newly reached positions in that same file owe NO further rows:
  * they are the identical catalog ternary with the identical values, so they
- * derive the site keys the `:1125` instance already derives.
+ * derive the site keys the instance at line 1125 of that file already derives.
  *
  * ## [#14742] What moved this census, separated from what merely drifted
  *
@@ -1196,7 +1196,8 @@ export const INLINE_LITERAL_EXPRESSION_CENSUS = Object.freeze({
     }),
     // [#14626] The two the card predicted, recovered by the template-literal
     // mode. Same file, same genre, same two values — so they derive the site
-    // keys `:1125` already derives and owe NO further verdict rows. That is the
+    // keys the instance at line 1125 of that file already derives, and owe NO
+    // further verdict rows. That is the
     // measurement, not a convenience: `rowsOwed: 0` here is what says the
     // recovered positions surfaced nothing unregistered.
     Object.freeze({

scripts/check-doc-anchors.mjs

@@ -16,7 +16,8 @@
 // heading lives in one file, the link in another, and until this script nothing
 // in CI related them: a rename that updates the heading and not the inbound
 // `#anchor` shipped green. #7465 exists because exactly that pairing had already
-// drifted once — `cli.mdx:458` pointed at a heading whose text had been correct
+// drifted once — `content/docs/deployment/cli.mdx` (line 458 as measured then)
+// pointed at a heading whose text had been correct
 // in 2024 — and PR #7483 could only catch its own rename by hand, with a slug
 // computed in a REPL and a repo-wide grep. Neither runs on anyone else's PR.
 //

scripts/check-engine-double-contract.mjs

@@ -101,8 +101,9 @@
 //     NO on #7620 for these doubles specifically. So it asks each independent
 //     double a behavioural question instead of handing it an implementation.
 //   - a scoped repository that declares NO repository-only member. Measured on
-//     the corpus this landed against: `packages/runtime/src/action-body-identity
-//     .test.ts:71` is a real scoped facade (`createContext().object(name)`)
+//     the corpus this landed against:
+//     `packages/runtime/src/action-body-identity.test.ts` (line 71 as measured)
+//     is a real scoped facade (`createContext().object(name)`)
 //     spelling only `find`/`count`/`insert`/`update`/`delete`, and it stays in
 //     the ledger. Seeing it would mean reading its parameter NAMES, and `o` is
 //     ambiguous in exactly this repo: `o: string` is the object name in twelve

scripts/check-live-db-isolation.mjs

@@ -214,8 +214,8 @@ const SOLE_INTERPOLATION = /^\$\{\s*([A-Za-z_$][\w$]*)\s*\}$/;
  * Source with block and line comments BLANKED -- replaced space-for-space
  * rather than deleted, so prose is never a hit and the line numbers this gate
  * reports are still the line numbers in the real file. Deleting the comments
- * was the first spelling and it reported `…live-mysql.test.ts:45` for a
- * statement that lives on line 81; a gate that points at the wrong line is a
+ * was the first spelling and it reported the live-mysql isolation test at line
+ * 45 for a statement that lives on line 81; a gate that points at the wrong line is a
  * gate the next author stops believing.
  */
 export function codeOf(source) {