docs(objectql,cloud-connection): mark the two remaining out-of-repo app paths

[os-musk]

Fixes #15297

Clause-②: no

Two source comments still named apps/cloud / apps/objectos-ee as live paths in this
repository. Both apps were deleted from here and live in objectstack-ai/cloud; #14634
swept three such sites and #14806 swept six more, and these two were in neither census.
This marks both, using a spelling that already exists in the tree rather than a new one.

Census, and its positive control

Re-measured on origin/main efd6b43ace in this worktree, greping the paths
apps/objectos / apps/cloud — never the bare tokens (objectos.ai,
cloud.objectos.ai, DEFAULT_CLOUD_URL, the root-domain guard, the dev seed address
and the plugin ids objectos-ee / objectos-runtime / objectos-environment /
objectos-stack are all correct, several of them literal plugin ids inside serve.ts).

The claim being checked is a negative, so it is run with the card's own positive control
in the same run:

$ git ls-tree origin/main -- apps/
040000 tree 9339b4c890d633fa853fc4814a3ff506bad63c78	apps/docs

apps/ is not empty, so "apps/cloud is not in this tree" is a reading and not a broken
query. 87 path hits total; every one outside the two sites below is a CHANGELOG.md /
ROADMAP.md / docs/adr/** historical record, a _console/apps/cloud_control/...
Console route (a different path), or already marked out-of-repo.

Line numbers are a property of a tree. All four anchors below were re-read on
efd6b43ace rather than trusted from the card, which quoted plugin.ts:142 — the
sentence has since drifted to :163, and the serve.ts house spelling has now been
recorded at three different offsets (branch → :4557 → :4663) with its content
unchanged.

Site 1 — packages/objectql/src/plugin.ts:163, the main repair

TSDoc on ObjectQLPluginOptions.skipSchemaSync. Present tense, unmarked, and an
imperative: it tells the reader DDL is managed out-of-band and names a concrete
script this repo does not contain.

It is the same sentence, about the same script, as serve.ts's migrate-and-exit note at
:4663 — the two were written as a pair and drifted apart because only one of them had
ever been in a census. So the marker is copied verbatim from its pair:

which lives in the separate objectstack-ai/cloud repo and is NOT a path in this one

placed at the end of the existing sentence rather than mid-clause, because the original
reads "an apps/cloud/scripts/migrate.ts run" — a noun phrase an inserted relative
clause would break. The referent is genuine, so the disposition is to mark it, not to
rename or delete it.

Site 2 — .../marketplace-install-local-seed-replayer.test.ts:16

A test's rationale, weaker than site 1; the value is consistency. It uses the older terse
in-repo precedent from multi-node-gate-mount.ts:9 — (…, cloud repo) — because
that is the form its siblings use. The path sits outside the parentheses only because
this sentence needs it as its grammatical subject; the marker text is unchanged.

⚠️ Correction to the card's supporting count. The card says site 2's apps/objectos-ee
mention has "three siblings". On efd6b43ace there are seven other non-historical
mentions, not three — the card omits packages/cli/test/serve-organizations-host-resolution.e2e.test.ts:88,
packages/cloud-connection/src/cloud-connection-plugin.ts:23,
packages/rest/src/single-kernel-isolated-api-key-matrix.test.ts:21 and
packages/rest/src/single-kernel-isolated-session-org-claim-matrix.test.ts:10.
The card's substantive claim survives: all seven mark the app as living elsewhere, so
site 2 was indeed the only unmarked one. Only the enumeration was short.

Changeset — decided on a measurement, not on "it's only a comment"

skip-changeset is a real mechanism in this repo, and it would have been wrong here.
What the diff publishes was measured rather than assumed:

$ grep -c 'objectstack-ai/cloud` repo and is NOT a path in this one' packages/objectql/dist/index.d.ts
1
$ npm pack --dry-run --json   # @objectstack/objectql@17.3.0
dist/core.d.mts dist/core.d.ts dist/index.d.mts dist/index.d.ts …   (18 files)

The edited TSDoc is emitted into dist/index.d.ts and dist/index.d.mts, both of which
are inside the published tarball (files: ["dist", "README.md", "CHANGELOG.md"]). It is
the text an IDE shows on hover over skipSchemaSync. ⇒ @objectstack/objectql gets a
patch changeset.

The cloud-connection half publishes nothing — its tarball is 10 files and contains no
test file — so it is not in the changeset:

$ npm pack --dry-run --json   # @objectstack/cloud-connection@17.3.0
CHANGELOG.md LICENSE README.md dist/index.cjs dist/index.cjs.map dist/index.d.cts
dist/index.d.ts dist/index.js dist/index.js.map package.json

Clause-②: no holds independently of that: publishing is not the Clause-② test. The
diff adds no exported symbol and no key on any published payload — it is comment prose,
which the carrier rules place with spelling and formatting.

验收备注

Observations from the census, deliberately not swept in and not filed — none is a
reproducible defect, a declared-contract violation, or a metadata-authoring trap:

• packages/cli/src/commands/serve.ts — the observability env-knob note the card routes
  to a separate card has drifted from the card's :133 to :149 on efd6b43ace.
  That site is untouched here and remains open elsewhere; [question] serve.ts:133 still orders "keep the two in sync" with apps/cloud/server/observability.ts — does that mirror still exist in objectstack-ai/cloud? #15295 is not addressed here.
• packages/observability/README.md:39 — the card lists it for completeness and
  explicitly does not assert it as a defect (it already reads "handled in apps/cloud —
  see that repo's exporter"). Optional tightening; left alone.
• .gitignore:121 carries apps/cloud/artifacts/, an ignore pattern for a directory
  this repo no longer has. Dead config, matches nothing, harmless.
• packages/spec/prompts/architecture.md:26 is a product-strategy inventory that makes
  no claim about this tree; _console/apps/cloud_control/... matches are a Console route
  on a different path; CHANGELOG.md / ROADMAP.md / docs/adr/** hits are historical
  records. All untouched.

No apps/cloud or apps/objectos directory was created, and no bare-token sweep was run.

Verification

COVERAGE and VERDICTS are stated separately below; they are different claims.

Everything below was measured on the final commit 4789f1d. Exit codes are captured by
redirect-then-$?, never across a pipe, and each verdict quotes the line the gate itself
printed rather than a bare $?.

COVERAGE — what was measured

Gate families derived	node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack → 57
Reconciled	--ran → 57 derived, 57 run, 0 NOT-MEASURED, 0 UNRUN
Beyond the union	the 4 roster families the derivation flagged as keeping their roster inside a directory one of my paths is in — silence there is evidence in neither direction, so they were run rather than read as clear
Affected packages	@objectstack/objectql (typecheck + tests), @objectstack/cloud-connection (tests; it declares no typecheck script)
Built first	turbo run build --filter='./packages/*' --filter='./packages/*/*' --concurrency=2 — 72/72 tasks, so no gate read a stale dist/

Repo-wide pnpm lint is CI's run, not this PR's. The narrowing is declared, with all
three readings rather than an assertion:

1. Population, read from ESLint's own config (ESLint#isPathIgnored over git ls-files,
   not a hand-written glob): 8396 tracked, 2016 ignored → population 6380. Both edited
   files report ignored=false, so they are inside it.
2. File count, read from --format json: 2 files linted, 0 errors, 0 warnings.
3. Invariance for untouched files: calculateConfigForFile reports type-aware=false
   for both files, matching eslint.config.mjs's own declaration that this repo "never
   enables type-aware linting (no parserOptions.project, no typed @typescript-eslint
   rules) for ANY file, test or not". With no type-aware rule anywhere, a comment edit in
   these two files cannot move the verdict on a file it did not touch.

VERDICTS — what the measurements said

Check	Exit	The line the gate printed
57 derived gate families	all 0	✓ dispatch-gates --ran: 57 derived famil(ies) accounted for — 57 run, 0 NOT-MEASURED.
pnpm --filter @objectstack/objectql test	0	Test Files 287 passed (287) · Tests 4826 passed (4826)
pnpm --filter @objectstack/objectql typecheck	0	check:test-typecheck: OK — @objectstack/objectql's test layer compiles under packages/objectql/tsconfig.test.json
pnpm --filter @objectstack/cloud-connection test	0	Test Files 29 passed (29) · Tests 374 passed (374)
targeted eslint --no-inline-config	0	2 files, 0 errors, 0 warnings

Two families first returned exit 3 PREREQUISITE NOT MET — check:dual-build-cjs-loads
("this gate reads built output, and some package has no dist/") and check:type-check-debt
("1 workspace dependenc(ies) … have no built type entry point on disk"). ⛔ Neither was read
as a pass. Both were re-run after the 72-task build and returned real verdicts:

✓ check:dual-build-cjs-loads — 104 published require entry point(s) across 67 package(s)
  load; 620 emitted CommonJS file(s) parse; …
check-type-check-coverage --re-measure: OK — 5 ledger entr(ies) re-measured in 115.0s,
  55 raw tsc error(s) total, none above its recorded number.

⚠️ One thing worth passing on: check:type-check-debt reds with exit 3 under a tighter
heap than CI's. Run inside a batch carrying NODE_OPTIONS=--max-old-space-size=4096 it OOMs
and refuses to record (tsc exited null … refusing to record 0); the gate pins its own
CI-shaped 6144 MB ceiling and needs to be left alone to do it. Its exit 3 there was an
artifact of the harness, not a reading of this diff — the run above is the reading.

Ablation — inapplicable, and deliberately not invented

This diff adds no guard, no rule, no check and no test. There is nothing whose failure mode
could be demonstrated by mutating it, so no ablation is reported. The claim this PR makes is
a census, and its falsifiable half is the positive control at the top, which fired.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

1 anchor(s) derived from 1 changed package(s); no hand-written page names any of them, so this run has nothing to list — not a clean bill of health. This check sees only pages that NAME a derived anchor: one that documents this change in prose, or enumerates it in an authoring dialect, names none and stays invisible to it on every run.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 16 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 50dc2141aed8d6b99e42f3a47dcd80892f133ac6 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from d78fbc430e26d661d92cb22604b56b078e0862fd — the merge of head 4789f1dc3db9642ba7c74d363efb4a69386905bb into base 50dc2141aed8d6b99e42f3a47dcd80892f133ac6, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin d78fbc430e26d661d92cb22604b56b078e0862fd && git checkout d78fbc430e26d661d92cb22604b56b078e0862fd
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 50dc2141aed8d6b99e42f3a47dcd80892f133ac6 4789f1dc3db9642ba7c74d363efb4a69386905bb && git checkout -B drift-repro 50dc2141aed8d6b99e42f3a47dcd80892f133ac6 && git merge --no-ff 4789f1dc3db9642ba7c74d363efb4a69386905bb

node scripts/docs-audit/affected-docs.mjs --json 50dc2141aed8d6b99e42f3a47dcd80892f133ac6

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.