[worklist] Migrate liveness line citations to symbol anchors — census: 117-173 of 298 live line-cited pairs fail key-proximity at line granularity today

[os-trump]

Origin: the os-dev run for #12516 (symbol-anchor citation grammar). Filed unassigned as the scope report that card's dispatch prescribed — the mechanism + the two measured-rotted entries landed there; adoption across the rest of the ledger is this card.

What exists now

Since #12516's PR, a liveness citation may anchor the consuming symbol — packages/path/file.ts#symbolName — and check:liveness fails red when the symbol leaves the cited file. The anchor lives inside the existing evidence/producer string (no ledger schema change), so adoption is per-citation. Day-one anchored population: the two action.json entries (target, requiredPermissions).

Why adoption is a real worklist, not polish

The remaining ~298 live-entry local line citations still rot IN RANGE (the #12516 class: file exists, line in range, file names the key, consumer moved to another line). Measured on the tree at 2b4178aa5 during the route decision: requiring the property key within a window of the cited line misses 173/298 at W=10, 143/298 at W=20, 117/298 at W=40. That population mixes true in-range drift with matcher limitations (keys read via helpers, destructured locals, citations at declaration sites), and the two cannot be told apart without re-closing each call graph by hand — which is exactly why the window detector was NOT switched on as a gate (the 48-of-227 noise lesson in evidence.mts's header), and why this migration cannot be mechanical.

Shape of the work

Per entry, oldest verifiedAt first, hot files first (action-execution.ts is 1670 lines and drifted twice in one day):

1. Re-close the call graph (read the code, not the diff).
2. Re-cite anchored to the consuming symbol (file.ts#symbol, line optional), stamp verifiedAt.
3. Where the consumer is gone or foreign, take the other two repairs the gate's guidance names (re-attribute with a realm marker, or re-classify under ADR-0049).

Batchable by ledger file; each batch is independently landable. The census script used for the numbers above is reproducible from the #12516 report (window key-proximity over live-entry local citations).

Blocked-by: the #12516 PR (the anchor grammar must be on main first).

Dedup (searched 2026-08-28)

#11210 / #11457 (closed) built the line bound and the key-mention check and each names the in-range residual without covering adoption; #7142 (closed) was the objectui-side citation-repair sweep; #12516 (open) delivers the mechanism and exactly two repoints, and its dispatch explicitly scoped the sweep OUT. No open card covers anchor adoption.

⚠️ Dedup channel deviation: repo-scoped REST reads return HTTP 403 from this dev seat (probed this session: labels and issues endpoints both 403 with the seat token), so the REST-first dedup rule could not be followed; this search used one targeted MCP semantic search (non-empty result set, channel self-validating) over the PM-supplied dedup readings carried by the #12516 dispatch.

---

Generated by Claude Code

[os-trump]

Claim: PM loop round R6 (domain:spec seat)
Session: session_01LpRNHxWZgSUgVnFT9mQQo4
Branch: claude/issue-13003-anchor-adoption (batch branches, if the partial route fires, suffix per ledger: claude/issue-13003-anchor-adoption-<ledger>)
Worktree: objectstack-issue-13003
Domain: domain:spec
File surface: packages/spec/liveness/*.json ONLY (evidence/producer strings re-anchored to file.ts#symbol, verifiedAt stamps) — reading code repo-wide to re-close call graphs, writing nothing outside the ledgers. If any repair path demands a source edit (a re-classification under ADR-0049 that implies removal work), that member is REPORTED on this card, not executed.
Container & model: L, mode:subagent, model: opus — judgment-heavy re-verification (per-entry call-graph closing), no contract-semantics design; the blocker (#12516's PR #13004, the anchor grammar) MERGED 2026-08-28T14:54Z, so Blocked-by is satisfied.
Clause-②: no — the ledgers live at packages/spec/liveness/**, outside the packages/spec/src/** PATH leg, and re-citing evidence changes no accept set. Landing per batch = all checks green → queue (no contract gate expected; if any batch unexpectedly touches src/**, it stops at draft for the chain).
Partial-delivery route PRE-AUTHORIZED (the card's own "batchable by ledger file; each batch independently landable"): Part of #13003 per batch PR, ⛔ never Fixes until the final batch; order = oldest verifiedAt first, hot files first (action-execution.ts citers lead). Do not attempt all ~298 in one run — deliver the first meaningful batch (1–3 ledger files), report, and the seat re-dispatches continuation rounds.
Discipline carried from the card: the window census CANNOT separate true drift from matcher noise — every re-cite is a read-the-code re-closure, never a mechanical shift; where the consumer is gone/foreign, take the gate's other two repairs (realm marker, or ADR-0049 re-classification REPORTED not executed). The gate's --ledger-root self-test machinery from #13004 is available for verification.
Serial constraints cleared: no in-flight claim touches packages/spec/liveness/**; #13030 (drafted, governed hold) and #13029 (deadlock hold) touch neither the ledgers nor any file this card writes.

---

Generated by Claude Code