objectstack-ai · baozhoutao · Sep 6, 2026 · Sep 6, 2026 · Sep 6, 2026 · Sep 6, 2026
diff --git a/scripts/audits/14096-tenancy-ledger-namespace-regexp-census.mjs b/scripts/audits/14096-tenancy-ledger-namespace-regexp-census.mjs
@@ -94,7 +94,8 @@ const REPO_ROOT = resolve(HERE, '../..');
 // ---------------------------------------------------------------------------
 // §1. Discover every registered platform-namespace object by AST-lite census
 //     of `ObjectSchema.create(` calls — the same method the ledger's own
-//     header (`platform-object-tenancy.ts:32-37`) documents using.
+//     header (`packages/objectql/src/tenancy/platform-object-tenancy.ts`, its
+//     opening comment — lines 32-37 as measured) documents using.
 // ---------------------------------------------------------------------------
 
 /** Blank out `//` and `/* *\/` comments and string contents (chars only,

diff --git a/scripts/audits/14423-unbound-declarations-before-count.mjs b/scripts/audits/14423-unbound-declarations-before-count.mjs
@@ -59,7 +59,8 @@ const loadStandaloneActions = async () => [...namelessStandaloneOrphans, namedSt
 
 const { warnings, logger } = silentLogger();
 
-// Exactly as ObjectQLPlugin.runGovernanceInventory calls it (plugin.ts:2516),
+// Exactly as ObjectQLPlugin.runGovernanceInventory calls it
+// (`packages/objectql/src/plugin.ts#runGovernanceInventory`),
 // with an empty registered-handler set and no object-embedded actions/registry
 // rung, so the ENTIRE declaration set comes from `loadStandaloneActions`.
 await runActionGovernanceInventory({

diff --git a/scripts/check-adr-links.mjs b/scripts/check-adr-links.mjs
@@ -11,8 +11,9 @@
 // checked by nothing, and records link each other heavily: most carry a
 // `**Builds on**:` line with 3-10 relative links in it.
 //
-// That is not a theoretical hole. `0057-erp-authorization-core-business-units-
-// and-scope-depth.md:5` pointed at `./0010-metadata-protection.md`, a file that
+// That is not a theoretical hole.
+// `docs/adr/0057-erp-authorization-core-business-units-and-scope-depth.md`
+// (line 5 as measured) pointed at `./0010-metadata-protection.md`, a file that
 // has never existed (the record is `0010-metadata-protection-model.md`). It sat
 // there long enough that a triage comment inherited the wrong attribution and
 // repeated it. PD #13 sends the next author to "go read that decision"; a dead

diff --git a/scripts/check-changeset-no-major.mjs b/scripts/check-changeset-no-major.mjs
@@ -687,7 +687,8 @@ export function render(result) {
     // nothing final ships until `changeset pre exit`. Surface the introduced
     // majors for the RC curator, but do not fail. The guard re-arms once
     // pre-mode exits: `changeset pre exit` rewrites pre.json's mode to `"exit"`
-    // (@changesets/pre@2.0.2, changesets-pre.cjs.js:117), which is not `pre`.
+    // (@changesets/pre@2.0.2, its `changesets-pre.cjs.js` bundle, line 117 as
+    // pinned — a dependency file, outside this tree), which is not `pre`.
     case 'exempt':
       stdout.push(
         `✓ Changesets is in pre-release mode (tag: ${result.tag}) — ` +

diff --git a/scripts/check-cli-test-child-env.mjs b/scripts/check-cli-test-child-env.mjs
@@ -185,7 +185,8 @@
  * suite stays green, and the comment claiming the built entry stays plausible.
  *
  * `@oclif/core@4.13.3` skips its TypeScript path lookup only when `isProd()`,
- * which `lib/util/util.js:66` defines as a NEGATED membership test -- a leading
+ * which its `lib/util/util.js` (line 66 as pinned -- a dependency file, outside
+ * this tree) defines as a NEGATED membership test -- a leading
  * logical-NOT over `['development', 'test'].includes(process.env.NODE_ENV ?? '')`.
  * Measured directly against `Config.load()` on `packages/cli`, with
  * `packages/cli/dist` present, reading back the root plugin's `commandsDir`:
@@ -1056,7 +1057,8 @@ const BUILT_ENTRYPOINT = 'bin/run.js';
  * The `NODE_ENV` values that send `@oclif/core`'s command lookup to `src/`.
  *
  * `@oclif/core@4.13.3` skips its TypeScript path lookup only when `isProd()`,
- * which `lib/util/util.js:66` defines as a NEGATED membership test:
+ * which its `lib/util/util.js` (line 66 as pinned -- a dependency file, outside
+ * this tree) defines as a NEGATED membership test:
  * `!['development', 'test'].includes(process.env.NODE_ENV ?? '')`. So these two
  * values -- and only these two -- turn the reroute ON. `production` and unset
  * both leave it off, which is why the rule below refuses a SET of values rather

diff --git a/scripts/check-console-injection.mjs b/scripts/check-console-injection.mjs
@@ -99,7 +99,8 @@
  *     esbuild re-emits `"…definition's…"`. Same characters, different bytes, so a
  *     literal substring search over source text misses it.
  *   - 19/44 constant-folded concatenation. Source splits a long description as
- *     `'… declares ' + '`_packageId`.'` (api/protocol.zod.ts:341-342 is one);
+ *     `'… declares ' + '`_packageId`.'` (`packages/spec/src/api/protocol.zod.ts`
+ *     is one, lines 341-342 as measured);
  *     the bundler folds it to one literal that exists in no source file.
  *
  * A missed probe here reads as "not expired" — a SILENT PASS, the same failure

diff --git a/scripts/check-dispatcher-error-vocabulary.mjs b/scripts/check-dispatcher-error-vocabulary.mjs
@@ -925,7 +925,7 @@ export const OBJECT_LITERAL_CODE_HELPER_BLINDNESS = Object.freeze({
  * for the D6 field-addressed validation catalog in `domains/automation.ts`, and
  * [#14626]'s two newly reached positions in that same file owe NO further rows:
  * they are the identical catalog ternary with the identical values, so they
- * derive the site keys the `:1125` instance already derives.
+ * derive the site keys the instance at line 1125 of that file already derives.
  *
  * ## [#14742] What moved this census, separated from what merely drifted
  *
@@ -1196,7 +1196,8 @@ export const INLINE_LITERAL_EXPRESSION_CENSUS = Object.freeze({
     }),
     // [#14626] The two the card predicted, recovered by the template-literal
     // mode. Same file, same genre, same two values — so they derive the site
-    // keys `:1125` already derives and owe NO further verdict rows. That is the
+    // keys the instance at line 1125 of that file already derives, and owe NO
+    // further verdict rows. That is the
     // measurement, not a convenience: `rowsOwed: 0` here is what says the
     // recovered positions surfaced nothing unregistered.
     Object.freeze({

diff --git a/scripts/check-doc-anchors.mjs b/scripts/check-doc-anchors.mjs
@@ -16,7 +16,8 @@
 // heading lives in one file, the link in another, and until this script nothing
 // in CI related them: a rename that updates the heading and not the inbound
 // `#anchor` shipped green. #7465 exists because exactly that pairing had already
-// drifted once — `cli.mdx:458` pointed at a heading whose text had been correct
+// drifted once — `content/docs/deployment/cli.mdx` (line 458 as measured then)
+// pointed at a heading whose text had been correct
 // in 2024 — and PR #7483 could only catch its own rename by hand, with a slug
 // computed in a REPL and a repo-wide grep. Neither runs on anyone else's PR.
 //

diff --git a/scripts/check-durability-degradation-log-level.mjs b/scripts/check-durability-degradation-log-level.mjs
@@ -768,8 +768,10 @@ const FAILURE_PROPAGATION_SITES = new Map([
 // that fix — `67 read seam(s) … (7 … discriminated) (1 pass … through) (1
 // baselined)` on both trees, measured by ablating the fix back to its
 // pre-#8895 `catch { continue }` and re-running. And the seam is not merely
-// unseen: plant a `return []` in that same catch and the gate names it
-// (`engine.ts:10084 (in cascadeDeleteRelations())`, red). So it sits IN the
+// unseen: plant a `return []` in that same catch and the gate names it — red,
+// at `packages/objectql/src/engine.ts#cascadeDeleteRelations` (that catch was
+// on line 10084 when this was measured, a dated reading and not a pointer).
+// So it sits IN the
 // census throughout, reported clean while it was broken and reported clean now
 // that it is fixed — what decides visibility is the SHAPE of the exit, never
 // whether the seam is correct. A real fail-open on an integrity guard was
@@ -1176,24 +1178,28 @@ const FAILURE_PROPAGATION_SITES = new Map([
 // THE DISCRIMINATING RUN. Raising `MAX_READ_WRAPPER_DEPTH` from 2 to 6 while
 // leaving `walkSameTickInclusive` in place admits 5 of the same 8 (70 seams: +8
 // / -2, where the 2 are the SAME try lines re-attributed to a different
-// first-matching callee, engine.ts:9407 and :10572). Saturation checked at
+// first-matching callee, both in `packages/objectql/src/engine.ts`, on lines
+// 9407 and 10572 as measured). Saturation checked at
 // depth 50: 70 and 75, i.e. unchanged. So for those 5 the miss is the DEPTH
 // BOUND, not the callback boundary — `walkAll` merely masks the bound by
 // descending lexically through nested DECLARATIONS instead of counting call
 // hops, which reaches the read at depth 1 no matter how many awaits are between.
 //
-// THE 8 DELTA SEAMS, each read at its call site:
-//
-//   | # | seam (try line → wrapper)                                      | why today misses it | invoked now? |
-//   |--:|----------------------------------------------------------------|---------------------|--------------|
-//   | 1 | metadata-protocol protocol.ts:10243 getMetaItemCached→getMetaItem | depth bound       | yes — real   |
-//   | 2 | metadata-protocol protocol.ts:13559 saveMetaItem→getMetaItem      | depth bound       | yes — real   |
-//   | 3 | metadata-protocol protocol.ts:14535 migrateStoredMetadata→saveMetaItem | depth bound   | yes — real   |
-//   | 4 | metadata-protocol protocol.ts:17213 duplicatePackage→saveMetaItem  | depth bound       | yes — real   |
-//   | 5 | metadata-protocol sys-metadata-repository.ts:883 promoteDraft→dropPromotedDraftRow | CALLBACK | yes — real |
-//   | 6 | metadata-protocol sys-metadata-repository.ts:1353 close→terminate  | CALLBACK          | NO — FAKE    |
-//   | 7 | objectql engine.ts:9237 insert→applyAutonumbers                    | CALLBACK          | yes — real   |
-//   | 8 | objectql lifecycle-service.ts:625 sweep→reapObject                 | depth bound       | yes — real   |
+// THE 8 DELTA SEAMS, each read at its call site. ⚠️ The FILE is named as an
+// anchor and the try line sits beside it as DATA: each number is a reading
+// taken on the date above, not a pointer, and a `file:NNN` pointer written
+// here rots silently — the whole finding of #15765.
+//
+//   | # | file                                                  | try line | seam (wrapper)                     | why today misses it | invoked now? |
+//   |--:|-------------------------------------------------------|---------:|------------------------------------|---------------------|--------------|
+//   | 1 | `packages/metadata-protocol/src/protocol.ts`               |    10243 | getMetaItemCached→getMetaItem      | depth bound       | yes — real   |
+//   | 2 | `packages/metadata-protocol/src/protocol.ts`               |    13559 | saveMetaItem→getMetaItem           | depth bound       | yes — real   |
+//   | 3 | `packages/metadata-protocol/src/protocol.ts`               |    14535 | migrateStoredMetadata→saveMetaItem | depth bound       | yes — real   |
+//   | 4 | `packages/metadata-protocol/src/protocol.ts`               |    17213 | duplicatePackage→saveMetaItem      | depth bound       | yes — real   |
+//   | 5 | `packages/metadata-protocol/src/sys-metadata-repository.ts` |      883 | promoteDraft→dropPromotedDraftRow  | CALLBACK          | yes — real   |
+//   | 6 | `packages/metadata-protocol/src/sys-metadata-repository.ts` |     1353 | close→terminate                    | CALLBACK          | NO — FAKE    |
+//   | 7 | `packages/objectql/src/engine.ts`                          |     9237 | insert→applyAutonumbers            | CALLBACK          | yes — real   |
+//   | 8 | `packages/objectql/src/lifecycle/lifecycle-service.ts`     |      625 | sweep→reapObject                   | depth bound       | yes — real   |
 //
 // All 8 were decidable from the call site; none needed provenance. Seams 1-5,
 // 7 and 8 are genuine members the census does not count: every hop is an
@@ -1205,7 +1211,8 @@ const FAILURE_PROPAGATION_SITES = new Map([
 //
 // ⚠️ SEAM 6 IS A FAKE SEAM, AND IT IS THE REASON `walkAll` IS NOT THE FIX.
 // `close()`'s try calls `w.terminate()`. `terminate` resolves BY NAME to the
-// local const arrow at sys-metadata-repository.ts:1246 — a synchronous, void,
+// local const arrow in `packages/metadata-protocol/src/sys-metadata-repository.ts`
+// (line 1246 as measured) — a synchronous, void,
 // in-memory routine whose only call is `self.watchers.delete(subscription)` on
 // `private readonly watchers = new Set<...>()`. `calleeName` reads that as
 // `delete`, and the wrapper recursion resolves `delete` to THIS FILE'S
@@ -1254,8 +1261,10 @@ const FAILURE_PROPAGATION_SITES = new Map([
 //   | probe, with the `delete` wrapper hop refused      |         72 |
 //
 // ⚠️ THE ABLATION IS THE CONTROL, NOT THE FIX. Refusing the `delete` hop
-// outright drops TWO seams — sys-metadata-repository.ts:1353 `close`->
-// `terminate` (the FAKE) and :883 `promoteDraft`->`dropPromotedDraftRow` (a
+// outright drops TWO seams, both in
+// `packages/metadata-protocol/src/sys-metadata-repository.ts` — `close`->
+// `terminate` (the FAKE, line 1353 as measured) and
+// `promoteDraft`->`dropPromotedDraftRow` (line 883, a
 // REAL `await this.delete(ref, …)`). In a summary that is indistinguishable
 // from the correct outcome, which is why the pair is pinned in the self-test.
 //
@@ -1338,7 +1347,8 @@ const FAILURE_PROPAGATION_SITES = new Map([
 //   - THE ADMITTING STEP IS +6 / -0, not "+8 / -2". The 2 in the filing were
 //     two `try` lines re-attributed to a different first-matching callee, never
 //     seams leaving the population. That re-attribution still happens here —
-//     `engine.ts:9741` and `:10906` move from `resolveMasterDetailParent(s)` to
+//     two try lines in `packages/objectql/src/engine.ts` (9741 and 10906 as
+//     measured) move from `resolveMasterDetailParent(s)` to
 //     `mediaValueShapeStrictFor` — but at depth 4, one level ABOVE the level
 //     that admits anything, and it moves no count. The admitting step is clean.
 //
@@ -1347,14 +1357,16 @@ const FAILURE_PROPAGATION_SITES = new Map([
 // rule's vocabulary names. Chains as the recognizer actually resolves them —
 // two of them are NOT the tails the filing predicted:
 //
-//   | # | seam (try line -> first wrapper)                    | chain to the read |
-//   |--:|-----------------------------------------------------|-------------------|
-//   | 1 | metadata-protocol protocol.ts:10497 getMetaItemCached | getMetaItem -> findDraft -> lookup -> engine.findOne |
-//   | 2 | metadata-protocol protocol.ts:13874 saveMetaItem      | getMetaItem -> findDraft -> lookup -> engine.findOne |
-//   | 3 | metadata-protocol protocol.ts:14850 migrateStoredMetadata | saveMetaItem -> refuseUnmintableMetaType -> metaTypeNamespaceExists -> engine.findOne |
-//   | 4 | metadata-protocol protocol.ts:16502 publishPackageDrafts  | promoteDraftForPublish -> lockWriteRefusal -> getEffectiveLock -> engine.findOne |
-//   | 5 | metadata-protocol protocol.ts:17565 duplicatePackage      | saveMetaItem -> refuseUnmintableMetaType -> metaTypeNamespaceExists -> engine.findOne |
-//   | 6 | objectql lifecycle-service.ts:664 sweep                   | reapObject -> archiveObject -> archivePass -> hot.find |
+//   (the FILE is the anchor, the try line beside it is a dated reading)
+//
+//   | # | file                                                  | try line | first wrapper         | chain to the read |
+//   |--:|-------------------------------------------------------|---------:|-----------------------|-------------------|
+//   | 1 | `packages/metadata-protocol/src/protocol.ts`           |    10497 | getMetaItemCached     | getMetaItem -> findDraft -> lookup -> engine.findOne |
+//   | 2 | `packages/metadata-protocol/src/protocol.ts`           |    13874 | saveMetaItem          | getMetaItem -> findDraft -> lookup -> engine.findOne |
+//   | 3 | `packages/metadata-protocol/src/protocol.ts`           |    14850 | migrateStoredMetadata | saveMetaItem -> refuseUnmintableMetaType -> metaTypeNamespaceExists -> engine.findOne |
+//   | 4 | `packages/metadata-protocol/src/protocol.ts`           |    16502 | publishPackageDrafts  | promoteDraftForPublish -> lockWriteRefusal -> getEffectiveLock -> engine.findOne |
+//   | 5 | `packages/metadata-protocol/src/protocol.ts`           |    17565 | duplicatePackage      | saveMetaItem -> refuseUnmintableMetaType -> metaTypeNamespaceExists -> engine.findOne |
+//   | 6 | `packages/objectql/src/lifecycle/lifecycle-service.ts` |      664 | sweep                 | reapObject -> archiveObject -> archivePass -> hot.find |
 //
 // (3 and 5 reach a read through `saveMetaItem`'s OWN precondition check, not
 // through the `getMetaItem` tail the filing assigned them. Same verdict, and
@@ -1378,8 +1390,9 @@ const FAILURE_PROPAGATION_SITES = new Map([
 //   walkAll @ depth 2 admits   7   (was 8 — #12358's guard deleted the fake seam)
 //   depth 3 admits             6
 //   BOTH                       5   <- the claim, reproduced exactly
-//   depth only                 1   protocol.ts:16502 publishPackageDrafts
-//   walkAll only               2   sys-metadata-repository.ts:883, engine.ts:9571
+//   depth only                 1   `packages/metadata-protocol/src/protocol.ts`, line 16502
+//   walkAll only               2   `packages/metadata-protocol/src/sys-metadata-repository.ts`, line 883
+//                                  and `packages/objectql/src/engine.ts`, line 9571
 //
 // So the NUMBER 5 survives and its DENOMINATOR does not: read it as "5 of 7",
 // the eighth having been the fake seam #12358 removed. And one correction the

diff --git a/scripts/check-engine-double-contract.mjs b/scripts/check-engine-double-contract.mjs
@@ -101,8 +101,9 @@
 //     NO on #7620 for these doubles specifically. So it asks each independent
 //     double a behavioural question instead of handing it an implementation.
 //   - a scoped repository that declares NO repository-only member. Measured on
-//     the corpus this landed against: `packages/runtime/src/action-body-identity
-//     .test.ts:71` is a real scoped facade (`createContext().object(name)`)
+//     the corpus this landed against:
+//     `packages/runtime/src/action-body-identity.test.ts` (line 71 as measured)
+//     is a real scoped facade (`createContext().object(name)`)
 //     spelling only `find`/`count`/`insert`/`update`/`delete`, and it stays in
 //     the ledger. Seeing it would mean reading its parameter NAMES, and `o` is
 //     ambiguous in exactly this repo: `o: string` is the object name in twelve

diff --git a/scripts/check-live-db-isolation.mjs b/scripts/check-live-db-isolation.mjs
@@ -214,8 +214,8 @@ const SOLE_INTERPOLATION = /^\$\{\s*([A-Za-z_$][\w$]*)\s*\}$/;
  * Source with block and line comments BLANKED -- replaced space-for-space
  * rather than deleted, so prose is never a hit and the line numbers this gate
  * reports are still the line numbers in the real file. Deleting the comments
- * was the first spelling and it reported `…live-mysql.test.ts:45` for a
- * statement that lives on line 81; a gate that points at the wrong line is a
+ * was the first spelling and it reported the live-mysql isolation test at line
+ * 45 for a statement that lives on line 81; a gate that points at the wrong line is a
  * gate the next author stops believing.
  */
 export function codeOf(source) {

diff --git a/scripts/check-overlay-whitelist-table.mjs b/scripts/check-overlay-whitelist-table.mjs
@@ -173,7 +173,8 @@
  * lines across 13 files. Of those, ~5 are genuine "<type> is <bool>" assertions;
  * the rest are the schema-field reference row, a code sample using an invented
  * type, and sentences ABOUT the flag rather than about any type
- * (`metadata-lifecycle.mdx:121` itself is one). Covering them mechanically
+ * (`content/docs/concepts/metadata-lifecycle.mdx` itself is one, line 121 as
+ * measured). Covering them mechanically
  * means a co-occurrence regex over English plus a per-site allowlist of ~17
  * exceptions to catch ~5 assertions -- a worse gate than none, and the kind
  * whose baseline gets bulk-updated to green. They are left out on purpose, and

diff --git a/scripts/check-platform-checklist.mjs b/scripts/check-platform-checklist.mjs
@@ -1282,7 +1282,8 @@ export const NEIGHBOURING_MAP: Readonly<Record<string, string>> = Object.freeze(
 // half, and the cheap half is the one that removes a false signal today.
 //
 // A citation is a colon-then-digits reached one of two ways, because the ledger
-// spelled it both ways: anchored to a source filename (`manifest.zod.ts:158`),
+// spelled it both ways: anchored to a source filename (`<file>.ts:158`, the
+// placeholder spelling `scripts/symbol-anchors.mjs#ANCHOR_GRAMMAR` uses),
 // or BARE, continuing a filename named earlier in the same sentence
 // (`ManifestSchema id :140 and version :202`). The bare half is why a plain
 // "filename followed by a colon" rule is not enough — and the bare half is the