feat(qa): resolve platform-checklist symbol anchors against real source - #15159

Fixes #13788

Step (2) of #13482's ruling — the half PR #13786 (step (1), the :NNN strip) deliberately deferred.

⚠️ What a red from this resolver actually reaches — read this first

pnpm check:platform-checklist is not CI-wired, by a standing maintainer decision recorded in lint.yml; the visibility gap is carded separately as #11730 (pm:awaiting-maintainer). ⇒ A red from this resolver reaches whoever runs the gate, not every PR. No CI wiring is touched here — that decision is the maintainer's and #11730 holds it. Stating this plainly is part of the deliverable: overstating a new check's reach would reproduce the very defect this family is closing — a signal that reads as verified while pointing at nothing.

The defect

After step (1) a citation is file plus the symbol it lands in, so nothing rots on an unrelated edit. But nothing resolved it: a symbol renamed or deleted out of the cited file left the citation reading exactly as it did the day it was verified — exit-0 by construction, the same shape the line numbers had, one level up. This PR found one of those live: registerRecordShareEndpoints has not been in rest-server.ts for some time (the record-shares routes are registered inline, under no registrar of their own), and the citation naming it had been reading as verified the whole time.

What landed

1. The citations are re-authored as structured symbol anchors, spelled inline so the prose that carries a citation's reason survives the change:

   packages/core/src/security/platform-admin.ts#parsePlatformAdminEmails

   The #symbol half is the machine-readable pin; everything around it is untouched. Rewriting each citation into a bare object per entry would have thrown the reasons away across the whole ledger.

2. A resolver in scripts/check-platform-checklist.mjs, extending the mechanism the gate already had for enumSource {file, export, expect}. It reds when the cited file is absent, when the extension carries no symbols this gate can read, and when the cited symbol is not in the file outside its comments — every segment of a dotted anchor, not only the first.

   Deliberately dumb, presence-level, house-ledger style: presence-in-code at identifier boundaries, not a declaration analysis. A symbol surviving only in a docblock is absent (prose about a symbol is not a symbol); a symbol inside a string literal counts as present (much of what this ledger cites is a string — capability names, error codes, sys_* machine names). Both directions are stated in the gate header and the README rather than left to be discovered.

3. A shrink-never floor — scripts/checklist-symbol-anchor-baseline.json, one entry per family file, authored from the new read-only --anchor-census mode. Every red this resolver prints has a second, silent remedy: delete the #symbol half and the citation drops back to prose the gate does not read. The floor closes that door, and makes the green say a number instead of meaning nothing once the population reaches zero. Lowering a floor is marked ⛔ MAINTAINER-ONLY per the check:engine-double-contract fires at CI time, not authoring time — four independent PRs tripped it on brand-new test files in one shift, and a pre-warning in the brief did not prevent it #8435 convention; the roster's own size is pinned beside it, since deleting an entry silences a floor as effectively as zeroing it.

4. Two-direction pins for every rule in the gate's existing multi-entry self-test dispatch (141 → 176 assertions), plus the battery roster floor the file's own handshake comment argued for: the flags answer "did this battery reach its verdict", and the roster answers the other half — a battery that reaches its verdict having run fewer assertions reports a smaller number every leg below reads as a pass.

5. Two line-pin spellings step (1) could not reach, measured rather than reasoned while sweeping for anchorable citations: AiChatPage.tsx:~605-615 (the tilde inside the colon form — the battery only ever pinned ~:) and ~L7246-7331, which carries no colon at all. Four survivors, all repaired; the detector gains both branches with a left and right boundary on the L form so SQL2019 / L10n / L1 stay silent.

The census, re-derived (not inherited)

Verification record

Every exit code captured by redirect before any pipe.

The gate's own suite, both halves

EXIT=0 :: node scripts/check-platform-checklist.mjs --self-test    # 176 assertions (was 141)
EXIT=1 :: node scripts/check-platform-checklist.mjs                # 4 problems — see below

⚠️ check-platform-checklist exits 1 on main today, before this branch exists: four capabilities (batch_endpoints, crud_endpoints, metadata_endpoints, route_generation) are UNCLASSIFIED in coverage.json. Measured on a clean worktree at origin/main before the first edit, and the error set after this change is byte-identical to it (diff of the two ✗ lists is empty) — zero new problems, and none of the four is this PR's to fix. Filed as #15167; authoring or waiving four REST capability areas is checklist-author content work, and folding it in here would have made both changes unreviewable.

Derived gate family (node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack, re-derived after the change set grew — same family both times)

EXIT=0 :: node scripts/check-ci-filter-parity.mjs
EXIT=0 :: node scripts/check-closing-keyword-parity.mjs            (+ --self-test)
EXIT=0 :: node scripts/check-comment-mask-corpus.mjs
EXIT=0 :: node scripts/check-self-test-wired.mjs                   (+ --self-test)
EXIT=0 :: node scripts/check-whole-set-label-write.mjs             (+ --self-test)

A first pass exited 3 (PREREQUISITE NOT MET) on three of these — an uninstalled worktree, NOT MEASURED and never a pass. pnpm install --frozen-lockfile (EXIT=0), then re-run: the codes above.

Always-runs tail

EXIT=0 :: pnpm check:pm-dispatch-gates
EXIT=0 :: pnpm check:declared-population-live
EXIT=0 :: pnpm check:ratchet-remedy-authority
EXIT=0 :: pnpm check:nul-bytes
EXIT=0 :: node scripts/check-self-test-wired.mjs
EXIT=0 :: npx eslint scripts/check-platform-checklist.mjs scripts/pm/dispatch-gates.mjs

check:pm-dispatch-gates first failed 1 of 1,343 cases — the new battery owed a COMPOUND_ANCHOR_LEDGER row in scripts/pm/dispatch-gates.mjs. Registered (false, beside its five siblings in the same gate); 1,343/1,343 pass. There is no check:self-test-wired pnpm alias in this repo — the script is invoked directly, and is green both ways.

Ablation — the absent-symbol check

1. an anchor naming a symbol that is not in the cited file, authored into areas/i18n.json → gate EXIT=1, 5 problems, the fifth being ABSENT SYMBOL — …#zzzRetiredSymbolThatIsGone;
2. the same ledger with absentAnchorSegments neutered in memory → 4 problems, 0 non-coverage — proof the red is this check's and nothing else's;
3. both restored → 4 problems, working tree clean against HEAD.

Ablation — the roster floor
Two rows deleted from the symbol-anchor battery → --self-test EXIT=1: battery "selfTestSymbolAnchors…" reported 27 assertions but its floor is 29, and the inline leg refuses too (assertions stopped running, and every leg below would read the smaller count as a pass). Restored → EXIT=0.

Control bytes: all 19 changed files scanned, clean; this body scanned too.

Scope fence

• ⛔ No CI wiring, per the top of this body.
• No governed surface (docs/adr/**, .claude/**, skills/**, AGENTS.md, CLAUDE.md) and nothing under content/docs/releases/.
• One file outside the card's expected surface: scripts/pm/dispatch-gates.mjs, one ledger row, because the dispatch-gates self-test demands the registration — declared rather than done silently.
• No changeset: this diff publishes nothing from any released package (scripts/ + docs/qa/ only), which is what the skip-changeset label is for.

🤖 Generated with Claude Code

https://claude.ai/code/session_01TouCuN9vQdktkP2MAEgnDC