[claude]

Part of #14361
Clause-②: no
Nothing this diff touches is an accept/reject surface: no schema, no validator, no guard predicate and no error code moves. Comments, doc comments, one operator-facing refusal sentence and four translation leaves move, and the only runtime string that changes is the ADR number inside a message whose condition, status and code are untouched.

Segments 2 and 3 of the card. Segment 1 (ADR-0071 → ADR-0134) landed as #18098 and the card was returned to pm:queue for these two.

The governing ruling

The director's amendment (comment 5507573601), not the ruling 14 minutes before it. The amendment changed both the target — a local ADR number for the open mechanism half, ⛔ not a cloud ADR-NNNN spelling — and the scope: 0071 + 0024 + 0081, one trip. Its three Blocked-by: mirror ADRs were released by the H19 unlock double-check (5594577301), and all three records are on main today: ADR-0133 (mirrors cloud 0081 D1/D3/D4), ADR-0134 (mirrors cloud 0071), ADR-0135 (mirrors cloud 0024's open half).

The classification rule, written down before any edit

ADR-0024 names two unrelated decisions from this repository's point of view, and the split is not guessable from a path. Three objective criteria decided every line:

1. The local record has no D-letters at all. docs/adr/0024-mcp-connectors.md numbers its Decision section §1–§5 and contains zero occurrences of SSO, ai_seat or D5.2. So any ADR-0024 Dk citation is, mechanically, not about the local record.
2. ADR-0135 publishes the mirror boundary itself. Its Decision section restates cloud ADR-0024's D1, D2, D4, D5, D5.2, D6, D7 and D9, keeping the cloud record's lettering on purpose — "The lettering is the cloud record's, kept so that a citation of cloud ADR-0024 D5.2 and a citation of this record's D5.2 name the same clause." Its "What stays in cloud ADR-0024" table names D3, D5.1, D8, D10 and V1 and states the rule: "code in this repository that means one of them must keep citing cloud ADR-0024".
3. The ② spelling is identified by name. ADR-0135 D6: "Domain verification is opt-in — the clause this repository's code cites as ADR-0024 ②." So ADR-0024 ② becomes ADR-0135 D6, which is letter-checkable where ② was not.

ADR-0024 — the three-way split, which adds up

Measured per citation line with the anchors gate's own regex (ADR_CITATION in scripts/check-adr-anchors.mjs), pnpm-lock.yaml excluded, on merge base 1bdbf82cb.

Class	Lines	Disposition
Points correctly at the local MCP record	15	⛔ untouched — byte-identical to main
Points at a clause ADR-0135 restates	73	re-pointed to ADR-0135 with its letter
Points at a clause that stays in cloud	6	re-pointed to cloud ADR-0024
Published archive — 7 package CHANGELOGs	36	⛔ untouched (the ruling's fence)
Governed surface — docs/adr/**	22	⛔ untouched (Prime Directive #14)
Undeterminable	0	—
Total	152

The dispatch brief's figure was 151, taken 2026-09-14. Re-measured today it is 152; the one added line is inside docs/adr/0135-*.md, which this diff does not enter.

Letters written, each cross-checked against the record's own decision index: D4 ×4 (source-of-truth marking), D5.2 ×27 (the break-glass invariant), D6 ×40 (SSO per environment, including the ② clause), D9 ×2 (environment users and org membership) — 73. Cloud-qualified: cloud ADR-0024 V1 ×1 (the SSO default-role provisioning — the very site ADR-0135's own consequence paragraph names as belonging to cloud) and cloud ADR-0024 §7 ×5 (the ai_seat synthesis).

⚠️ §7 is a judgement, stated plainly rather than buried. It is in neither of ADR-0135's two lists — not restated, and not in the "stays in cloud" table. It is provably not the local record (which has no §7 and no seat concept), and ai_seat appears zero times anywhere under docs/adr/. cloud ADR-0024 §7 is the only spelling that is true; re-pointing it at ADR-0135 would have put a pointer on a record that does not carry the clause. ⛔ No decision was invented — if the reviewer prefers a different disposition, these are 5 lines.

ADR-0081 — nothing is owed, and that is the finding

87 bare citation lines today (the brief said 86). Read per line, the split is not the ADR-0071 shape at all:

Class	Lines
Points correctly at the local record (0081-trusted-react-page-tier.md — the kind:'react' tier)	22
Published archive — 8 package CHANGELOGs	41
Governed surface — docs/adr/** (incl. 17 lines that deliberately quote the historical bare label)	21
Identity/org meaning, inside a dated history[] revision entry in docs/qa/platform-checklist/areas/identity-auth.json	1
Points at the wrong record in live code	0
Total	87

The identity re-pointing for 0081 already landed — d1c86a745, "docs(adr): qualify the pre-repo ADR-0081 citations as cloud ADR-0081, letter-checked per site" (#15612, 2026-09-07). Every live ADR-0081 D1 / D2 site across platform-objects, plugin-auth, organizations, verify, plugin-security and publish-smoke.sh already carries the cloud qualifier; bare ADR-0081 D1 in those two package trees, excluding CHANGELOGs, measures zero, with cloud ADR-0081 D1 reading 7 as the firing control.

The one history-entry line is left alone deliberately: docs/qa/platform-checklist/README.md states that run records pin the revision they ran against and that the history exists to make old run records interpretable — the same archive class as a CHANGELOG.

Measurement controls

Every zero carries a firing control and a dark control, because a zero from a dead instrument looks identical to a real one.

Reading	Value	Firing control	Dark control
bare ADR-0024	152 lines / 53 files	ADR-0069 → 431 lines, ADR-0079 → 214	ADR-9024 → 0; git grep ADR-0024ZZZ → 0 files
bare ADR-0081	87 lines / 41 files	same	ADR-9081 → 0; git grep ADR-0081ZZZ → 0 files
bare ADR-0081 D1 in platform-objects + plugin-auth, non-CHANGELOG	0	cloud ADR-0081 D1 → 7	cloud ADR-0081ZZZ D1 → 0

Gate strength provably did not fall — it rose

check:adr-anchors, run on the merge base and on this branch, and every delta accounted:

merge base 1bdbf82cb : 133 decision number(s); 35559 citation(s) across 4538 file(s) resolve; 1022 decision-letter citation(s)
this branch 5e2bfda81 : 133 decision number(s); 35572 citation(s) across 4539 file(s) resolve; 1036 decision-letter citation(s)

• +13 citations / +1 file = exactly the changeset file this PR adds (7 ADR-0024 + 6 ADR-0135 mentions in its prose). Nothing else in the corpus moved.
• +14 decision-letter citations = the new ADR-0135 Dk in the two anchored files (auth-manager.ts 10, auth-plugin.ts 4). Those 14 are now letter-checked against ADR-0135's decision index, where the bare ADR-0024 Dk they replaced was checked against nothing.
• Bare ADR-0024 still resolves exactly as before: the 15 MCP-meaning lines are byte-identical to main.

Ablations — three legs, restores settled by blob hash, never by an exit code

Each mutation is proved on disk by a before/after grep -c on the exact text, read before any result is read. Restores are settled by git hash-object equality with the HEAD blob plus an empty git diff HEAD; the trap was kept only as a crash-path convenience. No permanent test file was left by any leg. These gates read tracked source text, not dist/, so no rebuild sits between mutation and reading.

Leg	Mutation	Expected	Observed
A1	ADR-0135 D5.2 → ADR-0135 D3 in auth-manager.ts	red	exit 0 — did NOT fire. See the finding below
A2	ADR-0135 D5.2 → ADR-0135 D99 in auth-manager.ts	red	exit 1 — ADR-0135 D99 is cited by 1 file(s), but ADR-0135 declares no D99
B	ADR-0024 §2 → ADR-9024 §2 in mcp-connector.ts (an untouched local-MCP line)	red	exit 1 — ADR-9024 is cited by 1 file(s) but names no record

A2 is the leg that matters: the letter check does fire on the citations this PR writes, so the 73 re-pointed letters are validated rather than decorative. B shows the resolution check still reads the 15 lines this PR deliberately left alone.

⚠️ Finding surfaced by leg A1 — filed, ⛔ not fixed here

decisionIndexFor() in scripts/check-adr-anchors.mjs harvests a decision letter from any markdown table cell (DECISION_TABLE_CELL). ADR-0135's "What stays in cloud ADR-0024" table has rows | D3 |, | D5.1 |, | D8 |, | D10 | — the table whose whole purpose is to say those clauses are not recorded here. They land in ADR-0135's decision index anyway, so ADR-0135 D3 passes the letter check even though a reader following it lands on a row that explicitly disclaims the clause. That is the same "resolves, but not to what the citation says" family this card is about, one layer down. It is ⛔ not fixed here: the fix has to distinguish a table of decisions a record MAKES from a table of clauses it DISCLAIMS, which is a design call and not a mechanical edit. ADR-0133 has the same shape for cloud 0081 D2. This PR is unaffected — every letter it writes (D4, D5.2, D6, D9) is a real ### Dk heading.

Reverse read — which existing sentence does this change make false?

⛔ Not zero, and all of it lands on docs/adr/**, which this lane may not edit (Prime Directive #14). Filed, not fixed:

1. docs/adr/0135-*.md:196 — "the clause this repository's code cites as ADR-0024 ②" is present tense and is now false: no code cites ADR-0024 ② any more. This PR is what falsifies it.
2. docs/adr/0135-*.md consequence paragraph — "auth-manager.ts cites ADR-0024 V1" now reads stale: that site says cloud ADR-0024 V1. Its neighbouring "Until then the citation still resolves to docs/adr/0024-mcp-connectors.md" has had its "until then" end.
3. The reverse direction — docs/adr/0133-*.md:40 — "The code still carries the pre-repo labels. Several files in packages/platform-objects and packages/plugins/plugin-auth cite ADR-0081 D1 in comments today" was already false on main before this diff, falsified by docs(adr): qualify the pre-repo ADR-0081 citations as cloud ADR-0081, letter-checked per site #15612 on 2026-09-07. Independent of this change.

Statements with a rev or a date attached were checked and are not stale: ADR-0135's "measured 64 citing lines on the commit that introduced it" is anchored to that commit and stays true.

Changeset — measured, not assumed

The only criterion is whether published bytes move; files[] ships dist in all five. Measured against the built tree with a positive control:

Package	What moves	User-visible?
@objectstack/plugin-auth	the operator-facing break-glass refusal detail, and the guard's registration log	yes — ⚠️ a deployment grepping that message for ADR-0024 should grep ADR-0135
@objectstack/platform-objects	sys_sso_provider field help + protection.reason, and the matching leaf in all four shipped locales	yes
@objectstack/spec	the ssoDomainVerification doc comment, shipped in dist/ and as src/**/*.zod.ts	no behaviour
@objectstack/core, @objectstack/cli	doc comments in dist/ only	no behaviour

So skip-changeset is wrong here and the label is not applied; a patch changeset naming all five is included.

The four locale files are not hand-edited generated output

packages/platform-objects/src/apps/translations/*.objects.generated.ts carry the ADR-0024 ② citation in a translated help leaf. Their own header is the rule: "Edit translations in place… Merge only fills gaps: correcting a source label/description does not push the correction into a leaf here that already holds a translation… Re-translate it by hand when its source changes." Re-running the extractor would have been a no-op on these four leaves. The producer (sys-sso-provider.object.ts) was corrected as well, and check:i18n-coverage reports 13 config(s), 621 baselined untranslated string(s), none new.

No generated reference doc carries ADR-0024 (grep over content/docs/references/ reads 0), so nothing under content/docs/references/ needed regenerating — the spec site changed is a /** */ doc comment, not a .describe() string.

Verification

• Gates: 117 of 117 derived families accounted, 0 NOT-MEASURED, 0 UNRUN. node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --ran RECORDFILE at 5e2bfda81, every exit code captured before any pipe and recorded as COMMAND :: exit CODE (the literal word exit, then the numeric code). Three families first returned exit 3 / exit 1 PREREQUISITE NOT MET because sibling packages had no dist (check:skill-examples, check:dual-build-cjs-loads, check:i18n-coverage); after a full pnpm build all three were re-run whole and are green. ⛔ None of the three is counted as a finding or as a green measurement in its refused state.
• Also run, outside the derivation: check:adr-anchors, check:adr-links, check:adr-symbol-anchors — all green.
• Tests: spec 477 files / 13611 tests · core 51 / 1316 · platform-objects 40 / 575 · plugin-security 113 / 2181 · plugin-auth 111 / 2360 — 792 files, 20043 tests, 0 failures (VERDICT command-exit 0, 464s under the shared verify lock). @objectstack/cli --project unit: 207 files / 2971 tests, 0 failures. The integration tier is declared to CI — this diff touches no spawn entry, only a comment in serve.ts.
• Typecheck: spec, core, platform-objects, plugin-auth, plugin-security, cli — VERDICT command-exit 0, 0 error TS. ⚠️ An earlier run of the same command reported TS7016 against packages/spec/dist/**; that run raced the concurrent gate sweep over dist/ and is reported as the artefact it was, not as a finding — the clean re-run after pnpm build is the reading.
• Lint: not narrowed. The full union eslint . --no-inline-config --format json at 5e2bfda81: 6756 files eslint itself selected, 0 errors, 0 warnings. eslint.config.mjs carries no parserOptions.project and no typed rules, so no edit here could move a verdict on an untouched file.
• Build: full pnpm build green before the final measurements.

Why this is Part of and not Fixes

Segment 2 is done. Segment 3 is measured to owe zero edits, but that is a reading a human should ratify rather than a seat closing the card on its own — and the residue the card still names is the three docs/adr/** sentences above, a governed surface this lane ⛔ may not touch. Closing is the PM's call.

⛔ Draft on purpose. ⛔ No auto-merge armed, not flipped out of draft, not queued.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 5 package(s): @objectstack/cli, @objectstack/core, @objectstack/platform-objects, @objectstack/plugin-auth, @objectstack/spec, touching 18 documentable anchor(s). ⚠️ 5 changed file(s) yielded no anchor (packages/cli/src/utils/merge-boot-config.ts, packages/plugins/plugin-auth/src/auth-schema-config.ts, packages/plugins/plugin-auth/src/member-role-canonical.ts, …), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

23 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json 1bdbf82cb58119132d667713ae35099f388a3479.

⛔ 8 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 5 changed file(s) yielded no anchor (packages/cli/src/utils/merge-boot-config.ts, packages/plugins/plugin-auth/src/auth-schema-config.ts, packages/plugins/plugin-auth/src/member-role-canonical.ts, …) — pages documenting those are invisible to this run
• 1 anchor(s) matched too much of the corpus to be a work list: sys_user (symbol, 36 pages)
• 4 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 60 of 215 client-bound route-ledger rows — the other 155 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 155: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 100 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 149 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 1bdbf82cb58119132d667713ae35099f388a3479 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 69efdbed9814ea14a93ccace1f43be6541ff5fe8 — the merge of head 5e2bfda81c2e06f053b02a9a9fad68437472960e into base 1bdbf82cb58119132d667713ae35099f388a3479, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 69efdbed9814ea14a93ccace1f43be6541ff5fe8 && git checkout 69efdbed9814ea14a93ccace1f43be6541ff5fe8
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 1bdbf82cb58119132d667713ae35099f388a3479 5e2bfda81c2e06f053b02a9a9fad68437472960e && git checkout -B drift-repro 1bdbf82cb58119132d667713ae35099f388a3479 && git merge --no-ff 5e2bfda81c2e06f053b02a9a9fad68437472960e

node scripts/docs-audit/affected-docs.mjs --json 1bdbf82cb58119132d667713ae35099f388a3479

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 1bdbf82cb58119132d667713ae35099f388a3479 → pass the list as
args.docs, on the commit named under Which tree this was computed on.