docs(qa): re-point the cli / platform-core / records-forms bad-citation anchors (#18104 cut 3)

docs/qa/platform-checklist/areas/cli.json

@@ -170,9 +170,9 @@
       ],
       "traps": ["stale-dist"],
       "source": [
-        "packages/cli/src/commands/compile.ts#emitJson (the full gate pipeline: Zod parse, #4409 author-time rule registry, #3786 unknown-key advisory, --json shapes, #3782 conversion-notice parity; the human-path catches ending in this.error() — oclif's ExitError 2 — while the --json branch answers through emitJson + this.exit(1)) + build.ts (alias)",
+        "packages/cli/src/commands/compile.ts#Compile (the full gate pipeline: Zod parse, #4409 author-time rule registry, #3786 unknown-key advisory, --json shapes, #3782 conversion-notice parity; the human-path catches ending in this.error() — oclif's ExitError 2 — while the --json branch answers through emitJson + this.exit(1) — re-pointed #18104: emitJson is IMPORTED here from format.ts and only ever called; the pipeline this item means is what the Compile command class this file declares runs) + build.ts (alias)",
         "packages/cli/src/utils/format.ts#CliExitCode (CliExitCode = 0 | 1 — the narrowed emitJson/emitText exit slot, NOT a bound on oclif's own error exit)",
-        "packages/cli/src/utils/format.exit-code.test.ts#emitJson (the #4873 pin: the defect was an argument in the wrong slot — timer.elapsed() landing in emitJson's positional exit code — and a number can no longer reach it at all)",
+        "packages/cli/src/utils/format.exit-code.test.ts#asExitCode (the #4873 pin: the defect was an argument in the wrong slot — timer.elapsed() landing in emitJson's positional exit code — and a number can no longer reach it at all — re-pointed #18104: emitJson is IMPORTED into this test and only called; asExitCode is the binding that carries the rejection, a duration typed into that positional slot under a @ts-expect-error)",
         "cli.flag-command-error-ux (the sibling item that owns oclif's exit 2 — cross-referenced so the two never re-collide)",
         "api-backend.formula-gates, api-backend.enforce-or-remove-authoring-gates (gate content — cross-referenced, not duplicated)"
       ],
@@ -352,7 +352,7 @@
       "automated": { "kind": "unit", "ref": "packages/cli/src/commands/verify-tenancy-posture.test.ts" },
       "source": [
         "packages/cli/src/commands/verify.ts#hardFailures (hardFailures sum, exit contract, resolveVerifyMultiTenant / #5262 / ADR-0105 D1, separate RLS stack rationale)",
-        "packages/verify/src/verify.ts#VALIDATION_FAILED (the six-member status union; 400-VALIDATION_FAILED→needs-fixture vs 5xx→create-failed classification)",
+        "packages/verify/src/verify.ts#ObjectVerifyResult (the six-member status union; 400-VALIDATION_FAILED→needs-fixture vs 5xx→create-failed classification — re-pointed #18104: VALIDATION_FAILED survives in this file only inside a regex literal; the union this item means is declared on ObjectVerifyResult and the classification that reads it is isValidation)",
         "packages/verify/src/rls.ts (#1994 class: you can't write what you can't read)"
       ],
       "history": [
@@ -841,7 +841,7 @@
       "traps": ["hydration-race", "first-boot-cold-start"],
       "source": [
         "content/docs/getting-started/quick-start.mdx ('How you verify' — `npx os validate` and `npx os dev --ui`, then open http://localhost:3000/_console/)",
-        "packages/create-objectstack/src/templates/blank/package.json#objectstack (scripts.dev = `objectstack dev`, with no --ui — correct, see the chain below)",
+        "packages/create-objectstack/src/templates/blank/package.json#scripts.dev (scripts.dev = `objectstack dev`, with no --ui — correct, see the chain below — re-pointed #18104: objectstack is a VALUE in this manifest and never a key; scripts.dev is the key pair this item reads)",
         "packages/cli/src/commands/serve.ts (`ui: Flags.boolean({..., default: true, allowNo: true })` — the console is default-ON here; `--no-ui` is the off switch)",
         "packages/cli/src/commands/dev.ts + (dev declares `ui` with NO default and forwards `...(flags.ui ? ['--ui'] : [])` — it only ever ADDS the flag, never forwards --no-ui, so an unflagged dev inherits serve's default-on)",
         "content/docs/deployment/cli.mdx ('--ui | Force Console UI on (already on by default in dev)') and ('--ui / --no-ui — Toggle Console UI at /_console/ (default on)')",
@@ -1038,7 +1038,7 @@
       "traps": ["absence-inference", "stale-dist"],
       "source": [
         "packages/cli/src/commands/doctor.ts#scanDir (flag; scan block with the scanDir = <cwd>/src, the per-hit warning row, the --verbose `→ replacement`, the #10680 reasoning comment, the two-branch hint and the clean-run success line; DEPRECATED_PATTERNS — retired-lookup pair; scanDeprecatedPatterns — absent-dir [],.ts-only walk +.test.ts filter; walkDir node_modules prune)",
-        "packages/cli/src/commands/doctor-deprecation-hint-commands.test.ts#Doctor (#10680's pin — the class-closing sweep that every `os …` hint doctor can PRINT resolves under src/commands/, plus six end-to-end cases over Doctor.run. Added to source at revision 3 because revision 2's knownGaps asserted this surface had no automated coverage of any kind)",
+        "packages/cli/src/commands/doctor-deprecation-hint-commands.test.ts#unregisteredHintsIn (#10680's pin — the class-closing sweep that every `os …` hint doctor can PRINT resolves under src/commands/, plus six end-to-end cases over Doctor.run. Added to source at revision 3 because revision 2's knownGaps asserted this surface had no automated coverage of any kind — re-pointed #18104: Doctor is IMPORTED here and only driven; unregisteredHintsIn is the sweep itself, the one asserted empty)",
         "content/docs/protocol/backward-compatibility.mdx (the documented workflow, including the admission that the codemod command is not yet available)",
         "packages/cli/README.md §os doctor (documents -v and --scan-deprecations)",
         "packages/create-objectstack/src/templates/blank/ (the scaffold whose src/ the seeds land in)",

docs/qa/platform-checklist/areas/platform-core.json

@@ -463,7 +463,7 @@
       "source": [
         "packages/runtime/src/route-ledger.ts (PUT /meta/:type/:name, GET /meta/_drafts, GET /meta/:type/:name/published, POST /packages/:id/publish-drafts)",
         "packages/spec/src/kernel/metadata-plugin.zod.ts#allowOrgOverride (allowOrgOverride 403 not_overridable contract; validateOnWrite; registry flags per type)",
-        "ADR-0070 via packages/qa/dogfood/test/package-first-authoring.dogfood.test.ts#writable_package_required (writable_package_required)",
+        "ADR-0070 via packages/qa/dogfood/test/package-first-authoring.dogfood.test.ts#WRITABLE_PACKAGE_REQUIRED (the runtime create into a loaded code package refused, with its writable-base control beside it — re-pointed #18104: the lower-case spelling survives here only inside a test title and comments; the code this test actually pins is the SCREAMING_SNAKE one, ADR-0112)",
         "ADR-0033 (drafts / publish)"
       ],
       "history": [
@@ -561,7 +561,7 @@
         "packages/platform-objects/src/apps/studio.app.ts#requiredPermissions (static nav; requiredPermissions studio.access)",
         "packages/platform-objects/src/apps/account.app.ts#requiresObject (no requiredPermissions; hidden from App Switcher; requiresObject/requiresService entry gates)",
         "packages/platform-objects/src/apps/setup-nav.contributions.ts#nav_organizations (nav_organizations requiresService org-scoping; nav_api_keys manage_platform_settings; no nav_jwks — removed in #7544)",
-        "packages/plugins/plugin-auth/src/auth-plugin.ts#Providers (SSO Providers nav_sso_providers contributed only when isSsoWired())",
+        "packages/plugins/plugin-auth/src/auth-plugin.ts#nav_sso_providers (SSO Providers contributed only when isSsoWired() — re-pointed #18104: the bare word Providers is carried in this file only as a substring of longer tokens and label strings; nav_sso_providers is the contributed entry id, the same anchor shape the sibling nav rows use)",
         "ADR-0048 (Setup/Studio/Account as one-app packages com.objectstack.{setup,studio,account}); ADR-0029 (nav contributions); ADR-0066 (sys_jwks private)"
       ],
       "history": [
@@ -819,7 +819,7 @@
       ],
       "traps": ["dispatcher-vs-hono-route", "stale-console-bundle"],
       "source": [
-        "packages/runtime/src/route-ledger.ts#commitId (PATCH /packages/:id/enable|disable, DELETE /packages/:id, POST /packages/:id/publish|publish-drafts, GET /packages/:id/commits, POST /packages/:id/commits/:commitId/revert, POST /packages/:id/revert)",
+        "packages/runtime/src/route-ledger.ts#ROUTE_LEDGER (PATCH /packages/:id/enable|disable, DELETE /packages/:id, POST /packages/:id/publish|publish-drafts, GET /packages/:id/commits, POST /packages/:id/commits/:commitId/revert, POST /packages/:id/revert — re-pointed #18104: commitId is a route PATH PARAMETER, carried in this file only inside a route string)",
         "platform-core.metadata-authoring-roundtrip (the writable probe package this reuses)",
         "ADR-0070 (writable vs read-only packages), ADR-0033 (drafts/publish/commits)"
       ],
@@ -913,7 +913,7 @@
         "objectui packages/app-shell/src/layout/inboxGrouping.ts (groupNotifications — (topic,title) coalescing, #2765)",
         "objectui packages/app-shell/src/layout/AppHeader.tsx (postMarkRead → POST /api/v1/notifications/read[/all]; poll GET /notifications?view=mine)",
         "packages/runtime/src/route-ledger.ts (GET /notifications, POST /notifications/read, POST /notifications/read/all)",
-        "packages/runtime/src/domains/notifications.ts#markRead (markRead upserts sys_notification_receipt; empty/mis-keyed ids → 400)",
+        "packages/runtime/src/domains/notifications.ts#handleNotificationRequest (markRead upserts sys_notification_receipt; empty/mis-keyed ids → 400 — re-pointed #18104: markRead is a PROVIDER METHOD this file only calls off the inbox capability, a member access; the POST /notifications/read branch that validates the body and issues it is in handleNotificationRequest)",
         "ADR-0030 (sys_inbox_message L5 materialization + sys_notification_receipt); ADR-0103 (receipt object api-method lockdown)"
       ],
       "history": [
@@ -1640,7 +1640,7 @@
       "traps": ["dispatcher-vs-hono-route", "cache-staleness"],
       "source": [
         "examples/app-showcase/src/data/extensions/account.extension.ts#AccountExtension (AccountExtension — the shipped fixture, priority 210)",
-        "packages/objectql/src/registry.ts#mergeObjectDefinitions (mergeObjectDefinitions — additive fields fold, the spread) + vicinity via engine: packages/objectql/src/engine.ts#objectExtensions (the objectExtensions loop registering 'extend' contributors)",
+        "packages/objectql/src/registry.ts#mergeObjectDefinitions (mergeObjectDefinitions — additive fields fold, the spread) + vicinity via engine: packages/objectql/src/engine.ts#registerApp (the objectExtensions loop registering 'extend' contributors — re-pointed #18104: objectExtensions is read off the manifest here, a member access; the loop this item means runs inside registerApp, which this file declares)",
         "packages/spec/src/data/object.zod.ts#ObjectExtensionSchema (ObjectExtensionSchema — what an extension may carry, the #4001 silently-dropped history, 'Fields to add/override', priority wins-on-conflict; defineObjectExtension)",
         "packages/metadata-protocol/src/protocol.ts#refusal (the NOT_OVERRIDABLE refusal text and escape hatch)",
         "packages/plugins/plugin-auth/src/managed-extension-fields.ts + managed-extension-fields.test.ts (the build-time collision gate — better-auth-managed objects ONLY; adopted by ADR-0126 §3 as Regime E prior art, NOT a generic gate)",

docs/qa/platform-checklist/areas/records-forms.json

@@ -49,7 +49,7 @@
             }
           },
           "expect": "2xx. `enable.feeds` is stated EXPLICITLY false — unlike files it cannot be omitted, because omission means the spec default `true` (object.zod.ts) and would give a feeds-ENABLED object that scores both probes green for the wrong reason. `sharingModel` is public_read_write ON PURPOSE: the probes must be refused by the CAPABILITY gate, not by record access, and a caller who can read and edit this parent isolates FEEDS_DISABLED from the sibling RECORD_NOT_ACCESSIBLE refusal (packages/plugins/plugin-audit/src/comment-access-hooks.ts).",
-          "source": "`enable.feeds` is the #2707 opt-out, default true (packages/spec/src/data/object.zod.ts#Record: 'Record comments/collaboration feed. Default on; explicit false hides the feed UI and rejects any write that makes a comment target this object (403 FEEDS_DISABLED) — a new comment and an update that re-threads an existing one alike'). `sharingModel` is a TOP-LEVEL object key, enum ['private','public_read','public_read_write','controlled_by_parent'] (packages/spec/src/data/object.zod.ts#query; ADR-0090 D4). `?package=` is read as `query.package` and threaded to saveMetaItem as packageId (packages/runtime/src/domains/meta.ts)"
+          "source": "`enable.feeds` is the #2707 opt-out, default true (packages/spec/src/data/object.zod.ts#Record: 'Record comments/collaboration feed. Default on; explicit false hides the feed UI and rejects any write that makes a comment target this object (403 FEEDS_DISABLED) — a new comment and an update that re-threads an existing one alike'). `sharingModel` is a TOP-LEVEL object key, enum ['private','public_read','public_read_write','controlled_by_parent'] (packages/spec/src/data/object.zod.ts#sharingModel; ADR-0090 D4 — re-pointed #18104: query is not a key this schema declares, and sharingModel is the key this sentence is about). `?package=` is read as `query.package` and threaded to saveMetaItem as packageId (packages/runtime/src/domains/meta.ts)"
         }
       ],
       "teardown": "DELETE /api/v1/packages/com.objectstack.qa.feeds (client `packages.uninstall`, ledgered at rest-route-ledger.ts) — or simply discard the isolated file DB, which is the cheaper path and the one an isolated boot makes free. Any throwaway qa_nofeeds record and any sys_comment row created against it go with the package.",
@@ -349,7 +349,7 @@
       "source": [
         "packages/spec/src/data/field.zod.ts#FieldType (FieldType enum — 49 members, listed exhaustively in variants)",
         "examples/app-showcase/src/data/objects/field-zoo.object.ts",
-        "examples/app-showcase/src/data/seed/index.ts#Specimen (Specimen rows; expense/invoice roll-up expectations)",
+        "examples/app-showcase/src/data/seed/index.ts#fieldZoo (Specimen rows; expense/invoice roll-up expectations — re-pointed #18104: Specimen survives in this file only inside the record names, a substring of a longer string; the rows this item means are the ones the fieldZoo seed declares, with invoices / expenseReports carrying the roll-up expectations)",
         "packages/qa/dogfood/test/field-zoo.matrix.ts",
         "objectui: e2e/live/summary-rollup.spec.ts"
       ],
@@ -1581,7 +1581,7 @@
       "source": [
         "packages/spec/src/ui/action.zod.ts#ACTION_LOCATIONS (ACTION_LOCATIONS — the canonical 6-value enum, single source of truth; `global_nav` was the 7th until #6888 retired it — no product surface rendered it)",
         "examples/app-showcase/src/ui/actions/index.ts#locations (per-location fixture fleet + the record:quick_actions filter note + the two headless `locations: []` declarations)",
-        "packages/lint/src/validate-action-locations.ts#action (the `action-no-placement` rule — this repo's codification of the current contract: an action with no `locations` renders nowhere and is therefore inert, while `locations: []` is the deliberate headless declaration and is NOT flagged)",
+        "packages/lint/src/validate-action-locations.ts#ACTION_NO_PLACEMENT (the `action-no-placement` rule — re-pointed #18104: action is a LOCAL BINDING inside this file's walk, not a declared surface; ACTION_NO_PLACEMENT is the exported rule id — this repo's codification of the current contract: an action with no `locations` renders nowhere and is therefore inert, while `locations: []` is the deliberate headless declaration and is NOT flagged)",
         "objectui: packages/types/src/ui-action.ts `actionRendersAt` (the single placement predicate — a membership test, so an undeclared or empty `locations` matches nothing) + packages/.../action-bar.tsx, its consumer since objectui#3142",
         "cross-ref: bulk dispatch-count semantics live in records-forms.list-view-capabilities (bulk-actions variant); param dialogs in records-forms.action-param-widgets"
       ],
@@ -2441,7 +2441,7 @@
         "objectui: packages/plugin-detail/src/{RecordChatterPanel,CommentInput,MentionAutocomplete,extractMentions}.tsx (compose + @mention)",
         "objectui: packages/app-shell/src/views/RecordDetailView.tsx (mergeFeedRows union-by-id, sys_comment + sys_activity fetch/merge, mentionSuggestions), packages/plugin-detail/src/renderers/recordActivityFeed.ts (activity→feed map)",
         "objectui: packages/collaboration/src/useMentionNotifications.ts (recipient-scoped bell, unreadCount)",
-        "framework: packages/spec/src/data/object.zod.ts#FEEDS_DISABLED (enable.feeds default true → FEEDS_DISABLED, 'a new comment and an update that re-threads an existing one alike'); PENDING-GAPS §B record-discussion-mentions",
+        "framework: packages/spec/src/data/object.zod.ts#enable.feeds (enable.feeds default true → FEEDS_DISABLED — re-pointed #18104: FEEDS_DISABLED is named in this file only inside a describe() string and a comment; the key this item means is enable.feeds, 'a new comment and an update that re-threads an existing one alike'); PENDING-GAPS §B record-discussion-mentions",
         "framework: packages/plugins/plugin-audit/src/audit-writers.ts#enforceFeedsCapability (enforceFeedsCapability, registered on beforeInsert AND beforeUpdate per #10170), packages/plugins/plugin-audit/src/comment-access-hooks.ts#RECORD_NOT_ACCESSIBLE (RECORD_NOT_ACCESSIBLE — the sibling refusal the probes isolate against), packages/plugins/plugin-audit/src/objects/sys-comment.object.ts#thread_id (thread_id is conventionally `{object}:{record_id}`)",
         "framework: packages/spec/src/data/feed.zod.ts#FeedFilterMode (FeedFilterMode, 4 members — pinned above),+ (SYS_ACTIVITY_BUILTIN_TYPES + the #11507 open-vocabulary ruling: built-ins are the floor, never the ceiling); packages/plugins/plugin-audit/src/objects/sys-activity.object.ts#apiMethods (apiMethods ['get','list'] — why the probe cannot direct-POST)",
         "objectui: packages/plugin-detail/src/RecordActivityTimeline.tsx (FeedFilterMode imported from the spec), (the four filter options), (filterItems); packages/plugin-detail/src/renderers/recordActivityFeed.ts (ACTIVITY_TYPE_TO_FEED_TYPE superset map + UNMAPPED_ACTIVITY_FEED_TYPE fallback + its diagnostic; drift held by the objectui#5969 two-directional pin, recordActivityFeed.test.ts)"
@@ -3006,7 +3006,7 @@
         "ref": "objectui: e2e/import-console/import-console-undo.spec.ts, e2e/import-harness/import-undo.spec.ts (both self-gate)"
       },
       "source": [
-        "framework: packages/rest/src/rest-route-ledger.ts#jobId (POST /data/:object/import/jobs; /import/jobs/:jobId/{cancel,undo,results}; GET /import/jobs[/:jobId])",
+        "framework: packages/rest/src/rest-route-ledger.ts#REST_ROUTE_LEDGER (POST /data/:object/import/jobs; /import/jobs/:jobId/{cancel,undo,results}; GET /import/jobs[/:jobId] — re-pointed #18104: jobId is a route PATH PARAMETER, carried in this file only inside a route string)",
         "objectui: e2e/import-console/import-console-undo.spec.ts, e2e/import-harness/import-undo.spec.ts",
         "PENDING-GAPS §C import-job-undo-cancel"
       ],