docs(qa): re-point the eight stale platform-checklist anchors at what the files declare now

[objectstack-fleet]

Fixes #23593
Clause-②: no

What

pnpm check:platform-checklist was red on main (42718df38) with exactly the 8 problems the watchdog card lists, in three area files. Each cited symbol was removed by a refactor. For each one this PR read the item's steps against main, then moved the citation to the code that holds the behaviour now. Where the behaviour itself had moved, the item was re-authored. Nothing under packages/**, scripts/symbol-anchors.mjs or scripts/checklist-symbol-anchor-baseline.json changes, and no floor is lowered.

Problem line	Where the symbol went	Disposition
access-security.json: protocol.ts#anonymousFormIntakeOrgScopeRefusal (x1)	deleted by b389e4355 (PR #22515, ADR-0131 D6 stage S4)	item access-security.public-form-withdrawal-layers re-authored, revision 1 to 2
access-security.json: protocol.ts#anonymousFormIntakeReopenRefusal (x2)	deleted by b389e4355: every organization-scoped write is now refused by organizationScopedWriteRefusal	same item; the write-door citation now names organizationScopedWriteRefusal
access-security.json: protocol.ts#envWideRawViewRows (x2)	deleted by b389e4355	same item; the list the doors read now names getMetaItems, and the package-less stand-in names servedViewExpansion
attachments-storage.json: attachment-access-hooks.ts#canEdit	removed by ce3d0ad41 (PR #22513): the gate reads the tri-state checkEdit through one composition	re-pointed to #mayEditParent, revision 5 to 6
attachments-storage.json: floor 27 of 28	the lost anchor above	28 of 28 again
search.json: protocol.ts#countable	deleted by 55382dc02 (PR #22857): a paged search now counts its total	clause 2 of search.rls-both-personas re-authored, anchor #findData, revision 6 to 7

Why the public-form item is re-authored, not re-pointed

Every clause of revision 1 composed a withdrawal against an organization overlay. ADR-0131 retired that layer:

• the /meta doors hand the protocol no organization (PR feat(metadata-core,rest,runtime,plugin-email,spec)!: the /meta doors carry no organization; organization-admin metadata authoring closes (ADR-0131 D6, #15206 S3) #22447);
• the protocol refuses every organization-scoped write, and b389e4355 deleted the three symbols the item anchored;
• the sys_metadata family declares no organization column (PR feat(metadata-core,metadata-protocol)!: the sys_metadata family declares no organization column; indexes re-keyed (ADR-0131 D6/D7, C7b S2) #23469);
• the anonymous doors read the environment alone (C7).

So revision 1's steps 4 to 10 PUT saves that now land environment-wide. Its clauses 0, 1 and 3 describe a layer that can no longer be written. A re-point by name alone would have kept those clauses reading as live.

Revision 2 keeps the capability the id names: a withdrawal that no other layer re-opens. It states that capability on the layers main has.

• Stock, end to end (oracle api). It follows the dogfood pin, which the ADR-0131 PRs had already re-authored. An organization-active administrator's save is environment-wide, and its withdrawal closes both doors. The open control lands in the organization.
• Package layers (oracle test, no stock fixture). These are one item per package of a view name in the environment's list, a package's shipped false, and the package-less copy as the switch. They are scored from the rest, metadata-protocol and metadata-core pins that replaced the deleted cases.
  • The clause "a withdrawal in any package's body closes the form in every package" is new as a clause. Revision 1 deliberately left two packages of one name unscored while security(metadata): tighten the draft publish gate and package identity for org view overlays (follow-up to #21864) #21934 was open, and security(metadata): tighten the draft publish gate and package identity for org view overlays (follow-up to #21864) #21934 has since landed.
• The ruled known limit of revision 1 (an overlay stored before the withdrawal) has no stage left to occur on. It is recorded in knownGaps as retired, not as a gap.

The alternative, retiring the item, was weighed and not taken (see the report on the card). It would drop checklist coverage of rules that are live and pinned on main.

Verification (head b7774745e, which merges origin/main c5dd7fce3)

• pnpm check:platform-checklist exit 0. The verdict line, trimmed: check-platform-checklist: OK — 16 areas, 279 items (274 active, 1 planned); … symbol anchors: 732/742 resolved by symbol-anchors.mjs … 10 on the named #16898 residual, 18 file floors held. On the base it exited 1 with the 8 problems.
• Anchor census (--anchor-census), base to head: access-security.json 62 to 69 (floor 44), attachments-storage.json 27 to 28 (floor 28), search.json 17 to 18 (floor 14).
• Derived gates (dispatch-gates --commands --repo objectstack-ai/objectstack, change set from the merge base): 13 derived, and each was run with its exit captured before any pipe. All 13 exit 0. --ran reports 13 run, 0 NOT-MEASURED, 0 UNRUN.
  • The first run of check:doc-formula-expressions exited 3 (PREREQUISITE NOT MET: the formula and lint dist were not built). It was rebuilt under the verify lock and re-run: exit 0.
• The pins the re-authored clauses cite were run at this head, each case name confirmed in the verbose output:
  • metadata-core anonymous-form-intake.test.ts: 46 passed;
  • metadata-protocol protocol.org-scoped-write-refused.test.ts: 297 passed;
  • rest public-form-withdrawal.test.ts with list-search-total-door.test.ts: 33 passed.
• NOT MEASURED: showcase-public-form-withdrawal-layers.dogfood.test.ts. Reason: its closure is the full showcase boot, and main's full battery runs it. Its three cases were read at this head, and the item's end-to-end clauses follow them.
• No package is touched, so there is no build closure or package suite to run for this diff. docs/qa/** ships in no package's files[], so there is no changeset, and this PR takes skip-changeset.

Acceptance notes

• content/docs/ui/public-data-collection.mdx section 4 still describes the anonymous doors as reading the Default Organization's legacy copy, including its "Known limit: legacy copies". rest-server.ts registerFormEndpoints and the pin [ADR-0131 C7] no view read names an organization, whatever the tenancy answers: one environment read per door say that read was deleted. This is docs drift and is not filed: no public door returns a wrong answer from it. The re-authored item's source entry says so. Carrier: none.
• attachments-storage.attach-requires-parent-edit has no clause for the limb PR fix(service-storage,plugin-audit,plugin-security)!: the attachment and comment parent gates judge a controlled_by_parent parent through its master #22513 added: an abstaining parent is judged by its master's write check (controlled_by_parent). This is a coverage observation for a later checklist-author sweep, not a defect. Carrier: none.
• Why this kept recurring, and a proposal for a pre-merge signal that is not a new CI gate: in the report on the card.

---

Generated by Claude Code

[objectstack-fleet]

席位核对 · domain:devx seat 1 · session_01ESFcvW3staenyBCGq7kcDH · 2026-10-15T10:21Z

Verdict: ACCEPT for #23593, on head b7774745e. Read against GitHub and the tree, not the report.

1. Shape.
   • Draft PR on main. The body opens with Fixes #23593; that is its only closing keyword.
   • Three files, +69 / −57 (get_files), exactly the claimed surface: the three area files.
   • Nothing changed in scripts/symbol-anchors.mjs, the anchor baseline, or any packages/** source.
   • check-governed-merges --pr 23651: NOT governed, 126 changed lines.
   • skip-changeset: docs/qa/** publishes nothing.
2. Premises, measured by the seat.

   • The red is gone, by the gate itself. At origin/main 42718df38, node scripts/check-platform-checklist.mjs exited 1 with the card's 8 problems. At this PR's head b7774745e, in the seat's own worktree, it exits 0: check-platform-checklist: OK — 16 areas, 279 items (274 active, 1 planned) ….

   • The cited code really moved; the citations follow it. git log -S on each removed symbol:

     Removed symbol	Removed by
     anonymousFormIntakeReopenRefusal	b389e4355 (feat(metadata-protocol,runtime,service-automation,spec)!: the protocol refuses every organization-scoped write; an uninstall is environment-wide (ADR-0131 D6/D12) #22515, ADR-0131 D6/D12)
     countable	55382dc02 (fix(objectql,metadata-protocol,spec): a paged search reports the counted total #22857)
     canEdit	ce3d0ad41 (fix(service-storage,plugin-audit,plugin-security)!: the attachment and comment parent gates judge a controlled_by_parent parent through its master #22513)

   • The new anchors exist on the tree: attachment-access-hooks.ts mayEditParent, protocol.ts organizationScopedWriteRefusal and findData.

   • Item lifecycle per the README.

     • attachments-storage.attach-requires-parent-edit rev 5 → 6, re-pointed, assertions unchanged.
     • search.rls-both-personas rev 6 → 7. Clause 2 is re-authored to the counted total.
     • access-security.public-form-withdrawal-layers rev 1 → 2. It is re-authored because its organization-overlay clauses describe a layer ADR-0131 retired.
     • Each revision carries a dated change entry naming the removing commit. The data is changed because the behaviour changed, not to green the gate.

   • Floor. attachments-storage.json is back to 28 of 28 through the re-point, with no unrelated anchor added and no floor lowered.

3. Gates (check-runs on b7774745e).
   • All 43 runs are success or skipped, including Lint & Repo Gates, TypeScript Type Check, Test Core and Governed Surface Queue Guard. check-expected-skips --pr 23651: OK, 11 skips, every one on the roster.
   • check:platform-checklist is out of per-PR CI by decision, so the seat's own exit 0 above is its pre-merge reading.
   • main's last two hourly full runs (08:01Z, 09:01Z) are green.
4. Accepted deviations.
   • The re-authored public-form item scores one clause revision 1 had deferred (a withdrawal in any package's body closes the name in every package), inside the claimed item.
   • The dogfood pin for its stock half is NOT MEASURED locally (full showcase boot); main's full battery runs it.
5. Out of scope, where it goes.
   • Docs drift in content/docs/ui/public-data-collection.mdx section 4: Acceptance notes, carrier none.
   • The attachments controlled_by_parent limb has no clause yet: Acceptance notes, carrier none.
   • The recurrence proposal (the report's open question, option A) is the "why it keeps coming back" triage asked for on the card. It proposes a path-scoped mode on the existing checklist gate plus one derivation input, measured: dispatch-gates --commands names the checklist 0 times for protocol.ts, and 344 files are anchored. It touches the frozen dispatch-gates, so it is filed as its own card for triage to grade, not built here.
6. Landing. The seat flips the PR ready and arms auto-merge. The card closes on the merge. The next watchdog sweep (51 2 * * * UTC) is the card's second Done reading.

---

Generated by Claude Code