docs(service-package): re-anchor the dead tracker citations to the commits that decided them

[objectstack-fleet]

Part of #20596
Clause-②: no

What changed

This is the tenth stage of the domain:services lane of the dead-citation sweep. It covers packages/services/service-package/src/** and nothing else. By the seat's census at the claim (5901757839), it is the largest package in the lane that no in-flight work holds. Later stages cover the other packages, so this PR says Part of and the card stays open.

Every comment or docblock site in scope that cited a tracker number answering 404 has been rewritten in ruling C+D's form C (comment 5749154545 on #19123), by the method of stages 1 to 9 (PR #20609 as 422db788a, PR #20626 as b80ab579d, PR #20634 as 4d04b6be3, PR #20658 as 9a4b2bb38, PR #20693 as 0e9ad74fb, PR #20708 as 9b384f63a, PR #20717 as cbaf04c1f, PR #20729 as d2820876f, PR #20737 as 4dfff176b). That is 18 sites on 17 lines in 5 files, covering 5 numbers:

• 13 census sites (every census site this package has);
• 5 sites in test comments, which the census defers;
• no site the gate's grammar cannot see (the package has none, see Acceptance notes).

Each rewritten line now cites the commit in origin/main history that decided what the line describes, and says in its own words what was decided: 4 distinct shas. No number in this package has an ADR or ruling record of its own in the repository (a grep of docs/adr/ and scripts/adr-anchors/ for all 5 finds none, and nothing else under docs/ names them), so every anchor is a commit, per ruling C's order. No number was dropped.

Only comments changed. Every touched source file keeps its line count (17 lines out, 17 in, over 5 files), so no line citation into these files moves. Every one of the 17 changed lines carried a dead citation; there is no reflow line. No code token moves (see the guard below).

No citation number is added. The one tracker number on an added line, #10677, was already on the line it replaces (index.ts:234) and resolves. Over the whole diff, added minus removed is 0 for #10677 and negative for the five dead numbers, and no number is new to the diff. No PR number is the citation on an added line: the three PR #N spellings in scope became their pull request's squash commit.

4 dead sites are left on purpose, all of them describe titles (see the list below).

One more file: a patch changeset for @objectstack/service-package, because one rewritten docblock ships (see Changeset below).

Census: service-package, before and after

Instrument (A1). The gate's own node scripts/check-issue-citations.mjs --census --json, read-only and unchanged. The count below is its allocated-but-absent findings under packages/services/service-package/. Each run counts as a reading only because its board frontier equals the newest issue number, read by a separate request just before and just after the run.

reading	tree	board	whole-repo allocated-but-absent	service-package sites	lines	files	numbers
before	base 4dfff176b, run 2026-09-30T00:41:15Z to 00:44:24Z	enumerated, 186 pages, frontier #20741 (newest #20741 before and after), 18,568 numbers	1,082	13	12	1	4
after	head 34ba921e6, run 00:49:33Z to 00:52:49Z	enumerated, 186 pages, frontier #20741 (newest #20741 before and after), 18,568 numbers	1,069	0	0	0	0

The before count matches the seat's census and A1 (13 sites). The whole-repo drop is 13, exactly this diff's census sites. The resolves tally is 33,003 in both runs, and resolves-as-pull-request (1,984) and cross-repo-unjudged (995) did not move either. The after run was taken on 34ba921e6; the head ffd2f1ed2 adds only the changeset. No run was truncated or discarded: both enumerations read 186 pages at the newest frontier.

Supplementary instrument, the whole scope. The census does not read test files or strings, and this stage's scope includes test comments. So a second reading runs the gate's own exported extractCitations (whole-file and comment-prose projections) and namesThisRepository over every .ts file under service-package/src (6 files). It takes its verdicts from the before census's own board reading rather than from a second enumeration: a number is dead when that census reported it allocated-but-absent, and alive when that census judged it on this board anywhere (its --list extraction, 37,065 rows) and did not report it. The one number the census never saw, because it stands only in test files here, was read on its own: #16650 answers 404 on the issues endpoint and on the pulls endpoint.

reading	citations	dead	src comment	test comment	src string	test string
before, 4dfff176b	82	22	13	5	0	4
after, 34ba921e6	64	4	0	0	0	4

Its src-comment column equals the census's 13, which is the control on the second instrument. The 60 live citations are the same in both readings (no cross-repo citation stands in this package), and the drop of 18 citations is exactly the rewritten sites. A third, raw reading (every # followed by 2 to 6 digits, whatever surrounds it) finds 82 occurrences and 22 dead before, 64 and 4 after: the same as the gate's grammar, so nothing here sits beyond it, and it has no unjudged token.

Per-number table

Sites and files count every dead occurrence in scope at the base (comments and strings, tests included). rewritten / left counts the sites rewritten and the sites left. Each anchor was read in its message and diff, not only its subject, and git blame at the base puts every rewritten line in its anchor commit or in a later commit that descends from it (merge-base --is-ancestor exit 0 for all 17 line and anchor pairs).

number	sites / files	rewritten / left	anchor: what it decided
#10965	17/3	13/4	ab47f6974 (PR #11064): get() and list() refuse a storage seam that accepted the query and returned no result set, with a declared ADR-0112 envelope (SERVICE_UNAVAILABLE / 503), and the skipped boot rehydration is logged at warn; a seam that answers with zero rows is unchanged. Its body says Part of #10965 three times, and it is the only commit that wrote the seam guard (git log -S packageSeamUnreadableError). The runtime stage's anchor for the same number
#10788	1/1	1/0	3a7ec2d3b: os migrate duplicates holds a raw-SQL seam that cannot answer to be absent, not empty. The squash commit of the pull request that was #10788 (404 on the pulls endpoint too); #10677, the card it answers, stays beside it. New to the sweep
#10789	1/1	1/0	38bc74ed1: backfillSeedTenancy's read probes hold a seam that cannot answer to be absent, not empty. Its subject names #10789. The runtime stage's anchor for the same number
#10964	1/1	1/0	38bc74ed1: the same commit, the squash commit of the pull request that was #10964 (404 on the pulls endpoint too), so the pair #10789 / PR #10964 became one sha
#16650	2/2	2/0	001a83b04: SqlDriver.execute() declares a backend refusal as DATABASE_ERROR / 500. The squash commit of the pull request that was #16650; its review round (「pin the package-door code flip」) wrote the two [#16019] blocks whose closing sentence these lines are. The rest stage's anchor for the same sentence in package-door-16019-raw-statement-fault-code.test.ts

Every cited sha matches exactly one commit (git rev-parse --disambiguate, count 1 for each of the 4), and every one is an ancestor of the base (merge-base --is-ancestor, exit 0 for all 4; control leg: stage 1's landing 422db788a exit 0; the history is complete, --is-shallow-repository false, 15,149 commits). Each of the 5 numbers answers 404 on the issues endpoint and on the pulls endpoint.

Wordings to check

• Bracket tags. [#10965] became [commit ab47f6974] on 9 lines of index.ts (:208, :286, :304, :327, :451, :476, :502, :517, :626).
• index.ts:223, a section heading: 「(service-package answers "no such package" / "no packages installed" over a driver it never queried — its own normalizeRows maps a non-answering seam onto zero rows #10965)」 became 「(commit ab47f69)」, and its trailing rule was shortened from 11 characters to 2 so the line stays near its old width.
• index.ts:234-235, the two siblings of the seam guard: 「(migrate duplicates: no_sql_seam loud-refusal is dead code for the memory driver (false all-clear) #10677 / PR fix(cli): a raw-SQL seam that cannot answer is absent, not empty (#10677) #10788 for / os migrate duplicates, backfillSeedTenancy reports no-split over a driver it never queried — its own absent branch is unreachable on the memory driver #10789 / PR fix(metadata-protocol): a seam that cannot answer is absent, not empty (#10789) #10964 for backfillSeedTenancy)」 became 「(migrate duplicates: no_sql_seam loud-refusal is dead code for the memory driver (false all-clear) #10677 / commit 3a7ec2d for / os migrate duplicates, commit 38bc74e for backfillSeedTenancy)」. The live #10677 stays beside its fix; the dead issue and its dead pull request became their one squash commit.
• mysql2-tuple.test.ts:26 and :196. 「service-package answers "no such package" / "no packages installed" over a driver it never queried — its own normalizeRows maps a non-answering seam onto zero rows #10965's guard」 and 「(service-package answers "no such package" / "no packages installed" over a driver it never queried — its own normalizeRows maps a non-answering seam onto zero rows #10965's leg」 became 「commit ab47f69's guard」 and 「(commit ab47f69's leg」.
• null-seam.test.ts:4, the file's title line: 「service-package answers "no such package" / "no packages installed" over a driver it never queried — its own normalizeRows maps a non-answering seam onto zero rows #10965 — get() / list() answered over a driver they never queried.」 became 「The card behind commit ab47f69 — …」, so line 8's 「The card established the conflation by READING」 keeps its referent.
• delete-driver-fault.test.ts:319 and publish-driver-fault.test.ts:357. 「The reviewer of PR fix(driver-sql, driver-turso): SqlDriver.execute() declares a backend refusal as DATABASE_ERROR/500 instead of leaking the dialect's error object #16650 required the flip」 became 「The reviewer of commit 001a83b required the flip」, the rest stage's form for the same sentence.

The 4 sites left

• Test strings, 4 sites, all #10965, all describe titles in null-seam.test.ts (:140, :184, :229, :284), left as stages 1 to 9 left theirs.
• No source string, operator log string, assertion message, quoted maintainer ruling or generated file in this package carries a dead number.

Mechanical guard: no code token moves

The guard compares the TypeScript parser's leaf nodes (a forEachChild walk, so comments are trivia and JSDoc nodes are never visited), base 4dfff176b against head. String and template literals are therefore read in full. It ran over all 5 touched .ts files.

• Real run: 3,323 base leaf tokens, 0 files with a token change (exit 0).
• Comment control in index.ts (「Is this the seam refusal above?」 to 「… named above?」): 0 files changed, as expected (exit 0).
• Positive control, a code token added in index.ts (isResultSet(result) given as any in get()): DIFFER (exit 1).
• Positive control, one digit changed inside a kept test title (null-seam.test.ts:140, #10965 to #10966): DIFFER (exit 1).

Every mutation went through scripts/ablation-replace.mjs, and each landed (anchor 1 to 0, blob changed). Each restore was proven byte-identical to the HEAD blob (2555410dd0a7, 0c5bf5e7e190), with git diff HEAD empty and a clean tree afterwards.

Changeset

This change ships bytes, so a patch changeset for @objectstack/service-package (.changeset/20596-service-package-provenance-anchors.md) is included. Its body is stage 9's, word for word, with the package name changed.

Measured on the built package (A3): files[] is dist, README.md and CHANGELOG.md. After the build, ab47f6974 appears once in each of dist/index.d.ts and dist/index.d.cts: the rewritten docblock sits on the exported PACKAGE_SEAM_UNREADABLE_MESSAGE. The other rewritten comments do not reach dist (0 for 3a7ec2d3b, 38bc74ed1 and 001a83b04, and 0 for ab47f6974 in index.js and index.cjs). Positive control: the unchanged line 「Like {@link PACKAGE_PUBLISH_DRIVER_FAULT_MESSAGE}, a CONSTANT that」, in the same docblock, is found once in each declaration file. A never-written negative phrase appears nowhere in dist. None of the 5 dead numbers is left in dist.

Gates (head ffd2f1ed2)

• Citation judging, as CI runs it: pnpm check:issue-citations (self-test, 114 cases, 8 batteries) exits 0. node scripts/check-issue-citations.mjs exits 0: the diff-scoped run judged 1 citation in 1 file and found it on the board: #10677, which already stood on its line.
• Doc authoring: pnpm check:doc-authoring exits 0; the sibling-package prose-id baseline holds (808 pinned sites, no growth).
• Derived gates: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack at ffd2f1ed2 derived 62 commands: all 56 derived at dispatch, plus check:engine-double-contract, check:objectql-double-limit, check:query-options-erasure, check:type-check-coverage, check:type-check-debt and check:where-matcher. Each ran with its exit code captured before any pipe, and all 62 exit 0. --ran, fed each command with its exit code, reports 62 run, 0 NOT MEASURED (a derived zero), 0 unrun, and exits 0. A full turbo run build of ./packages/* and ./packages/*/* ran first under the shared verify lock (71 of 71 tasks, exit 0), so no gate hit an unbuilt workspace.
• Roster families the derivation lists outside its commands (their rosters sit in directories this diff touches): node scripts/check-changeset-fixed.mjs, pnpm check:authz-resolver, pnpm check:error-code-casing and pnpm check:filter-alias-parity, each exit 0.
• Tests and typecheck, under the verify lock:
  • pnpm --filter @objectstack/service-package test: 5 files pass and 79 tests pass. vitest list --filesOnly names 5 files, all the tracked test files, the 4 touched ones included.
  • pnpm --filter @objectstack/service-package typecheck exits 0. tsc --listFiles holds all 6 files under src/, all 5 touched files included.
• Lint, as a proven narrowing: eslint --no-inline-config --format json over the 5 touched .ts files gives 5 files, 0 errors and 0 warnings. All 5 are in eslint's own population (isPathIgnored is false for each; a dist file, as the control, is ignored). eslint.config.mjs never enables type-aware linting (no parserOptions.project, as its own lines 327-328 state), so a comment edit here cannot move the verdict on any untouched file. The repo-wide pnpm lint is CI's run.
• Control bytes: pnpm check:nul-bytes exits 0, and a raw scan of the 6 changed files for control bytes finds none.

Acceptance notes

• The gate-invisible spellings, grepped as the claim asked. CITATION_RE refuses a hyphen after the digits and a / before the # (check-issue-citations closeout (extractor spellings): CITATION_RE refuses a hyphen after the digits, so a dead #N-word citation (#13398-class) is invisible to the diff gate and to the census #20636), and NON_CITATION_HEADS excuses a number after the word 「option」. In this package: #N-word none, #A/#B none, option #N none, at the base and at the head. The raw scan agrees: nothing sits beyond the gate's grammar here.
• 「This card」 phrases are left. 14 comment lines in 5 files of this package speak of 「this card」, 「the card」 or 「The card」. They carry no number and neither instrument sees them. One title line was worded so that its neighbour keeps a referent (null-seam.test.ts:4, above); the rest are unchanged, as in stages 8 and 9.
• The census instrument did not truncate in this stage. Both enumerations read 186 pages at the newest frontier.
• Anchors the next stages can reuse, each checked here: #10788 → 3a7ec2d3b; #10964 → 38bc74ed1. The other three reuse sibling stages' anchors: #10965 → ab47f6974 and #10789 → 38bc74ed1 (the runtime stage), #16650 → 001a83b04 (the rest stage).
• Base. The branch is on main at 4dfff176b. main has since moved four commits (03cdb9a5c, b785c3b11, 5a23096ca, 01e78dcee). Their 40 files touch nothing under service-package, nor scripts/check-issue-citations.mjs or .changeset/config.json; the doc-authoring-prose-id baseline they shrink has no service-package row. So no merge was taken; the merge queue rebuilds on the merged generation.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• 1 name(s) were too generic to anchor anything (single lowercase words)
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 1 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 01e78dceeffb28477bcdbcab26f951b4cbef78ec → packageMentionDocs.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: ffd2f1ed2a6aa8e23a83e3292628109a4d56db80
Local-runs: none

① Derived judgments

Read against main at the merge-base 4dfff176b (stage 9's landing). The PR's recorded base 01e78dcee is four commits on from it (03cdb9a5c, b785c3b11, 5a23096ca, 01e78dcee); none of the four touches packages/services/service-package, scripts/check-issue-citations.mjs or .changeset/config.json, and the two-dot and three-dot stats agree, so the net diff against main is the merge-base diff: 6 files, +27/−17 — 5 source files under packages/services/service-package/src/** (1 module, 4 test files) and one changeset. The head ffd2f1ed2 adds only the changeset on top of 34ba921e6, which holds every source line. The branch was fetched into an owned ref for this record; nothing was built, run or re-run.

• Accept-set: no change — right. No Zod schema, REST handler, query-parameter set, refusal text, log text or runtime string moves. 17 source lines out, 17 in; every one of the 34 changed source lines opens with a comment marker after whitespace (* or //), 0 fall outside one. Each of the 5 touched source files has additions equal to deletions (index.ts 12/12, mysql2-tuple.test.ts 2/2, the other three 1/1), so no line citation into these files moves. The dev's parser leaf-token guard (0 files with a token change; both positive controls DIFFER) says the same and is not repeated here.
• Public surface: no change — right. No export added, removed or renamed; no packages/spec file touched, so no generated artifact is owed.
• Published bytes: changed — right, and it decides ②. @objectstack/service-package (17.5.0, not private, files = dist, README.md, CHANGELOG.md, types = dist/index.d.ts, build = tsup then check-dts-emitted) emits declarations, and one rewritten docblock (index.ts:286) is the docblock of export const PACKAGE_SEAM_UNREADABLE_MESSAGE, which the package entry exports, so dist/index.d.ts and dist/index.d.cts change. The other rewritten comments sit on module-private functions, inside method bodies, or in test files, and do not reach dist. The dev's A3 build reading (the sha once in each declaration file, 0 in the JS entries, positive and negative controls) says the same; this record does not repeat the build.
• The 5 numbers are dead — right. Each of #10965 #10788 #10789 #10964 #16650 answers 404 on the issues endpoint, read one by one for this record; that endpoint serves pull requests too, so a 404 there is a 404 for the pull-request spellings as well. No file under docs/ or scripts/adr-anchors/ names any of the 5 at the head, so ruling C's first rung (an in-repo ADR or ruling record) is empty and a commit is the right anchor for every one.
• The 4 anchors — each right. Each abbreviated sha resolves to exactly one commit (rev-parse --disambiguate, count 1 for all 4) and is an ancestor of the base (merge-base --is-ancestor, exit 0 for all 4; history complete, --is-shallow-repository false). Each commit's message names the number it replaces, and the decision the rewritten lines state is the commit's:
  • #10965 → ab47f6974, the squash commit of PR fix(service-package): refuse get() / list() over a seam that never answered #11064, whose body says Part of #10965 three times: get() and list() refuse a seam that accepted the query and returned no result set, with a declared ADR-0112 envelope (SERVICE_UNAVAILABLE / 503), the skipped boot rehydration logged at warn, and a zero-row answer unchanged. A pickaxe for packageSeamUnreadableError over index.ts finds this one commit, so it is the commit that wrote the guard the 13 rewritten lines describe.
  • #10788 → 3a7ec2d3b, whose subject ends (#10677) (#10788) — the squash commit of the pull request that was fix(cli): a raw-SQL seam that cannot answer is absent, not empty (#10677) #10788: os migrate duplicates holds a raw-SQL seam that cannot answer to be absent, not empty. The live #10677 it answered stays beside it on the line.
  • #10789 and #10964 → 38bc74ed1, whose subject ends (#10789) (#10964): backfillSeedTenancy's read probes hold a seam to the same standard. One commit closed the issue and was the pull request, so the pair "backfillSeedTenancy reports no-split over a driver it never queried — its own absent branch is unreachable on the memory driver #10789 / PR fix(metadata-protocol): a seam that cannot answer is absent, not empty (#10789) #10964" collapsing into one sha is right.
  • #16650 → 001a83b04, whose subject ends (#16650) — the squash commit of that pull request: SqlDriver.execute() declares a backend refusal as DATABASE_ERROR / 500, and its own message records the review round that pinned the package-door code flip, which is the sentence the two test lines carry.
• The wordings — each right. index.ts:223 keeps its section heading with the sha in the number's place and a shortened trailing rule (a comment line; no code token). index.ts:234-235 keeps #10677 (live, HTTP 200 for this record) beside 3a7ec2d3b and folds "backfillSeedTenancy reports no-split over a driver it never queried — its own absent branch is unreachable on the memory driver #10789 / PR fix(metadata-protocol): a seam that cannot answer is absent, not empty (#10789) #10964" into 38bc74ed1. null-seam.test.ts:4 opens "The card behind commit ab47f69 — …" so line 8's "The card established …" keeps its referent; the commit's own message describes exactly that defect. mysql2-tuple.test.ts:26 and :196 say "commit ab47f69's guard" / "leg". delete-driver-fault.test.ts:319 and publish-driver-fault.test.ts:357 say "The reviewer of commit 001a83b required the flip", the rest stage's form for the same sentence and faithful to that commit's message. Every one of the 17 changed lines carried a dead number; there is no reflow line.
• Citation accounting — right. Over the diff: the 17 removed lines carry 18 dead occurrences (#10965 ×13, #16650 ×2, #10788, #10789, #10964) plus the live #10677 once; the added lines carry exactly one tracker number, #10677, on the line it already stood on. No number is new to the diff, none grew, no PR #N stands on an added line, and 4 distinct shas stand on added lines.
• The 4 sites left — right, and the list is exact. A grep of the 5 numbers over service-package/src at the head returns exactly 4 lines, all describe titles in null-seam.test.ts (:140, :184, :229, :284), every one #10965. Titles are string tokens, left as stages 1 to 9 left theirs. No source string, log string, assertion message, generated file or quoted ruling in this package carries a dead number. At the base the same grep returned 21 lines over the 5 files, so the drop is 17 lines, the diff's 17.
• The gate-invisible spellings — right. At the head under service-package/src: 0 #N-word, 0 #A/#B and 0 option #N lines, which is the claim's 0 / 0 / 0.
• Form — consistent with the landed stages 1 to 9 (422db788a … 4dfff176b): the word commit plus the abbreviated sha in the position where the number stood, the decision carried in the sentence. Three of the four anchors are reuses from stages outside this card's thread (ab47f6974 and 38bc74ed1 from the runtime stage, 001a83b04 from the rest stage); this record does not lean on those stages — each anchor is verified above on its own commit.
• Check-runs on the head, the gate verdicts, read at 2026-09-30T01:32Z: 33 check-runs — 28 success, 3 skipped (Build Docs, Console Pin Gate, Packed-tarball smoke (opt-in): paths-filtered or opt-in, not verdicts against), 2 in_progress, 0 failure. Of the seven required contexts, five are success — TypeScript Type Check, Dogfood Regression Gate, Build Core, Temporal Conformance (live PG + MySQL), Governed Surface Queue Guard — and two were not yet concluded at that read: Lint & Repo Gates (which carries check:issue-citations and check:doc-authoring, the two gates this diff answers to) was in_progress, and the Test Core aggregate did not yet exist because one of its six shards (4/6) was still in_progress (1/6, 2/6, 3/6, 5/6, 6/6 are success). Check Changeset, Check PR Size, Part-of PR must not also close its card, The card this PR closes must claim this branch, No other open PR may claim the same issue and No other open PR may claim the same single-writer path are success. Not awaited: the ① judgments above rest on the diff, and the landing separately requires every check green, so the owning seat reads those two before it queues. Nothing was built, run or re-run locally.

② Semver level

• .changeset/20596-service-package-provenance-anchors.md declares '@objectstack/service-package': patch — matches what the diff publishes. The package is released and its two declaration files carry the rewritten docblock of an exported constant, so bytes ship; skip-changeset would be wrong (it is for a diff that publishes nothing from any released package), and the PR carries no such label. Not minor: no accept set widens and no surface is added. The body is truthful (comments only; no type, schema, export, log or refusal text, or runtime behaviour change), carries no tracker number and no model identifier, and is stage 9's landed body word for word with the package name swapped (diffed against main's 20596-plugin-audit-provenance-anchors.md: identical modulo the name); the filename carries the card number. service-package sits in the fixed group of .changeset/config.json beside the nine packages whose stages declared the same level.
• Clause-②: no — right. It is line 2 of the PR body under Part of #20596, and the claim (5901757839) declares the same. The diff widens no accept set, so no arm is owed and no minor is owed. Nothing breaks, so no ADR-0087 marker is owed; Check Changeset on the head is success.
• Not a governed-surface diff (no path under docs/adr/**, .claude/**, skills/**, AGENTS.md, CLAUDE.md); 44 changed lines, under the 5,000-line human-merge threshold; head repo equals base repo; Governed Surface Queue Guard on the head is success. A draft with Part of on line 1 and no closing keyword anywhere in the body, so the card stays open for the remaining stages.

③ Boundary flags

The dev report (5902198509) has open_questions: []. Its eight deviations and one out-of-scope finding, each answered:

1. 5 test-comment sites beyond the census's 13 — answered, in scope. The claim's surface is comment and docblock prose under service-package/src/**; test comments are that, and stages 1 to 9 rewrote theirs. The head grep above confirms the residue is the 4 titles only.
2. Wordings beyond the tag swap (null-seam.test.ts:4, the shortened rule at index.ts:223, the folded pair at index.ts:234-235) — answered, right (① above). Each sits on a line that carried a dead number, every file keeps its line count, and no code token moves.
3. The supplementary and raw instruments judged against the before census's own board reading plus one single-number read (#16650), stage 6's method — answered, immaterial to the diff. The census counts (13 → 0 in this package; whole-repo allocated-but-absent down by exactly 13) rest on the unchanged instrument, and the residue this record's own grep finds equals the body's list key for key.
4. The model-free trailer pair against the harness reminder — answered, right. Both head commits end with the trailer pair AGENTS.md prescribes (the session-URL trailer and Co-authored-by: Claude), no model identifier appears in either message, and the PR body's footer is the session-URL form the PR-body surface keeps. AGENTS.md is the repo's rule.
5. No pre-PR merge of main — answered, right. Verified above: none of the four commits since the base touches a path in this diff or an input the citation gate derives from, so the queue's rebuild has nothing to reconcile by hand.
6. Labels — answered. documentation, size/s, tests, tooling are the labeler's; no skip-changeset, which is right.
7. A scratch probe copied to the worktree root and deleted in the same command, never run or staged — answered, immaterial to the head. The head's tree carries no such file (6 changed paths, none at the root beside the changeset), and the tree was clean at both commits.
8. Worktree and node_modules removed after the report — answered, immaterial. The branch is on the remote at the head this record names.
9. Out-of-scope, "this card" / "the card" / "The card" on 14 comment lines in 5 files — answered, carrier stands. Verified at the head: exactly 14 lines in the 5 files. The phrase carries no number, neither instrument sees it, and the sentences still read; wording only, held in PR docs(service-package): re-anchor the dead tracker citations to the commits that decided them #20742's Acceptance notes with no carrier, as stages 8 and 9 held theirs. Not blocking, and not a filing.

Nothing is escalated. One reading for the seat, not a flag on this PR: Lint & Repo Gates and one Test Core shard were in progress when this record was rendered, so the landing waits on their success as it always does.

Implemented-by: claude/issue-20596-service-package-citations
Reviewed-by: session_01XY5uCwTjZj7884yYtyur4H

VERDICT: PASS

---

Generated by Claude Code

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 36655981069 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Console Pin Gate — 失败步骤: Build the Console SPA at the pinned objectui SHA

  ✗ Neither spec appears in the built console — no @objectstack/spec
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️ 断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• ⚠️ 本次没有可用的聚合签名（日志里没有能解析出测试文件名的 FAIL 行）—— 这不是「没有同签名的其他 PR」，是这一轮没测到。跨 PR 聚合本次不可用，请手工比对其他 PR 的同类评论。
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 7 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)