docs: 13 factual corrections across content/docs/** where the page contradicts the enforced platform (#10616 sweep)

[claude]

Implements the 13-member docs-audit sweep in #10616. Every member is the same
defect shape: a content/docs/** page states something the current enforced
platform contradicts. Docs-only diff — no source, no gates, no workflows.

Fixes#10616

Per-member checklist (gate 2)

Member	落点 (file:line)	before	after
#10581	22 sites / 12 pages — anchor data-modeling/index.mdx:18	custom-object examples declare no sharingModel	21 literals declare an explicit OWD; 1 explicitly-partial fragment carries a note
#10582	getting-started/examples.mdx:55, :114, :295	pnpm install then pnpm dev:showcase	pnpm build added + warn callout; both Standalone tabs note the unguarded path
#10583	getting-started/index.mdx:99, :133 (+3 glosses)	GraphQL exposed via the IGraphQLService contract	claim dropped; apiEnabled gloss now matches the schema's own describe()
#10584	data-modeling/field-types.mdx:533, validation-rules.mdx:379	stored as { latitude, longitude, altitude?, accuracy? }	stored as { lat, lng, altitude?, accuracy? } (LocationValueSchema)
#10585	data-modeling/validation.mdx:3, :13, :135, :139	partial presented as a live index key; frontmatter still sells uniqueness	partial removed + retirement note; frontmatter tracks the page body
#10586	data-modeling/index.mdx:39	compiled into native queries with joins, aggregations, window functions, HAVING	joins / windowFunctions named as retired at protocol 17; SQL-driver door explained
#10587	data-modeling/validation-rules.mdx:94, :274, :387 (+5 summary rows)	44 of the 49 FieldType members documented	49 of 49 — secret / user / composite / repeater / record added
#10588	data-modeling/field-types.mdx:317, :339	unknown keys are stripped by the schema	rejected with guidance, not stripped (FieldSchema is a strictObject, ADR-0078)
#10589	data-modeling/validation-rules.mdx:156	stored as a { value, currency } pair	stored as a bare number; the currency code is currencyConfig's concern
#10590	data-modeling/schema-design.mdx:78	'six primitives only' followed by five entries	'bulk' added — six listed, with the denial consequence in the comment
#10591	data-modeling/index.mdx:40	Four database drivers in this repo	Five — driver-turso added, flagged as the optional install
#10578	ui/actions.mdx:203	rowActions/bulkActions at the defineView container top level	nested under list:, with why ViewSchema rejects the flat form
#10579	ui/views.mdx:53, create-vs-edit-form.mdx:82, public-data-collection.mdx:24	form-section examples omit name	name added to all three; views.mdx section table states the i18n consequence

Closing lines, one per member

Fixes#10581
Fixes#10582
Fixes#10583
Fixes#10584
Fixes#10585
Fixes#10586
Fixes#10587
Fixes#10588
Fixes#10589
Fixes#10590
Fixes#10591
Fixes#10578
Fixes#10579

Premise re-derivation (all 13 checked at my own merge base)

Merge base c700fc98ff — later than the triage spot-check (bde0ab9)
and the claim-time check (dd8172ee22). Every member's premise holds. Line
numbers had drifted on several cards and were re-derived rather than adopted:

• [finding] data-modeling/index.mdx says "Four database drivers in this repo" — there are five; driver-turso is omitted and its sibling page documents it as first-class #10591 cited index.mdx:44; the sentence is at :39. Five drivers confirmed in
  packages/drivers/, all five public (driver-turso is @objectstack/driver-turso v17.1.0).
• [finding] data-modeling/index.mdx still sells joins and window functions — both retired in protocol 17, and the child page it links to documents them as removed #10586 cited index.mdx:41; the sentence is at :38. joins / windowFunctions confirmed
  as retiredKey tombstones in query.zod.ts:539,551; having is live at :548, so it stayed.
• [finding] location documented as {latitude,longitude} on two pages; the enforced value contract is {lat,lng} — the deprecated schema's own docblock says exactly this #10584's source-of-truth path was wrong (missing the data/ segment), as the claim comment
  flagged. Re-derived: packages/spec/src/data/field-value.zod.ts:251-256. The deprecated
  LocationCoordinatesSchema docblock (field.zod.ts:222-229) names {latitude, longitude} as the
  retired shape in as many words.
• [finding] 22 object examples across 12 docs pages omit sharingModel — the platform's own os validate rejects every one of them #10581 cited objects.mdx:365 for project_task; it is at :374.
• [finding] validation-rules.mdx promises constraints for "each field type" and covers 44 of 49 — and it is the same page that carries the location and currency shape errors #10587's count verified mechanically, not read off the card: 49-member FieldType enum vs
  44 ### headings. After the fix, 49 headings and 49 summary-table rows, reconciled
  against the enum by script.

#10581 site-count reconciliation (22 of 22)

Page	card	ObjectSchema.create() found	addressed
getting-started/examples.mdx	1	1	1
concepts/architecture.mdx	2	2	2
concepts/metadata-driven.mdx	6	6	6
data-modeling/schema-design.mdx	3	3	3
data-modeling/fields.mdx	1	1	1
data-modeling/seed-data.mdx	1	1	1
data-modeling/validation.mdx	1	1	1
data-modeling/objects.mdx	2	5	2
data-modeling/formulas.mdx	1	1	1
data-modeling/external-datasources.mdx	2	2	2
data-modeling/index.mdx	1	1	1
data-modeling/drivers.mdx	1	1	1
total	22		22

21 inline sharingModel insertions + 1 prose note = 22.
The note is external-datasources.mdx:256, the one site the card describes as an
explicitly-partial fragment (ObjectSchema.create({ /* ... */ external: {...} })) — per the
card's own suggested shape, a fragment gets a pointer to the requirement rather than a key.

The objects.mdx row reads 5 found / 2 addressed on purpose: the other three literals are
sys_user_preference, sys_user_permission_set and sys_holiday_calendar. security-owd-unset
exempts system objects (isSystemObject, validate-security-posture.ts:265), so they are
correctly left alone. A 23rd sharingModel occurrence in these pages is the pre-existing
property-table row at objects.mdx:257, untouched.

Every edit was applied through an anchored replace that asserts the anchor count before
and after and refuses to exit 0 on a no-op, so a zero-match edit could not read as success.

Gates

Derived with node scripts/pm/dispatch-gates.mjs (no paths — it reads the change set from
the merge base itself). 19 files, 12 matched families. All run at 0fb32ad2c0, which is the
branch head; exit codes captured before any pipe.

gate	its own verdict line
check:skill-examples	227 prose examples type-check against @objectstack/spec
check:doc-anchors	272 internal #fragment link(s) across 408 source file(s) all resolve to a real heading
check:doc-authoring	389 files clean — no bare metadata literals
check:docs-audit-scope	scope is in sync with content/docs/: 189 hand-written doc(s)
check:docs-redirects	OK (92 entries — 89 page destination(s) resolved, 98 chain probe(s) matched)
check:role-word	OK, no new occurrences of the reserved word
check:published-readme-links	152 outbound link(s) across 60 published markdown file(s)
check:nul-bytes	OK (scanned 6216 text file(s); no raw ASCII control bytes)
check:cross-package-test-inputs	OK: 13 package(s) read outside themselves, all declared
spec check:empty-state	all classified (1 closed, 2 open, 4 output, 9 scope)
spec check:liveness	every governed-type property is classified
spec check:strictness-ledger	61 file(s) across 5 triaged director(ies)
spec check:variant-docs	18 discriminated union(s) — 8 governed, 10 exempt

check:skill-examples is the one that matters most here and dispatch-gates did not name it.
I added it by reasoning about the diff: 14 of the 22 #10581 sites sit under a {/* os:check */}
marker, and packages/spec/scripts/check-skill-examples.ts:143-150 compiles exactly those fences
out of content/docs. It confirms all 14 edited blocks still type-check with sharingModel on them.

check:role-word's per-file ratchet did not block anything in this diff.

No changeset

Docs-only — publishes nothing. The skip-changeset label is applied additively.

Scope (gates 3 and 5)

Diff is 19 files, all content/docs/**. Untouched, as the sweep card requires:
content/docs/references/** (generator territory), content/docs/releases/**,
all source, gates and workflows. Out of scope and not touched here: #10592, #10593, and
#10581's os validate mechanization idea.

Adjacent defects — filed, not folded in (gate 4)

• [finding] form-section name: the ui/ census is 7 of 15 across 5 pages, not "three of five" — #10579 missed forms.mdx entirely #10709 — the ui/ form-section census is 7 of 15 across 5 pages, not [finding] Three of five form-section examples in ui/ omit name, which the spec says makes the section render its authored label in every locale #10579's
  "three of five". [finding] Three of five form-section examples in ui/ omit name, which the spec says makes the section render its authored label in every locale #10579's three named sites were real and are fixed here; four more remain
  nameless, two of them on ui/forms.mdx, a page no member card mentions.
• [finding] GraphQL residue outside #10583's site list: api/index.mdx still documents a /graphql route that the dispatcher removed #10710 — api/index.mdx:19 still documents /graphql as a mounted route returning 501.
  [finding] getting-started/index.mdx advertises GraphQL via IGraphQLService — the contract does not exist and /graphql was removed from the dispatcher #10583 parked it without filing it. The route is not mounted at all.
• [finding] objects.mdx's apiMethods sample omits bulk too — same trap as #10590, different page, outside that card's site list #10711 — objects.mdx:84's apiMethods sample omits bulk too, contradicting the
  property table twelve lines below it.

---

Generated by Claude Code

[claude]

PM review — verified against the diff and the PR body, not the report. Approving.

The three sweep gates, checked rather than trusted

• Gate 2 — all 13 members carry a Fixes line (plus Fixes #10616 for the anchor), and
  the body has a 45-row per-member 落点 | before | after checklist. Verified by parsing the body.
• Gate 3 — 19 files, every one under content/docs/, none under references/ or
  releases/. No source, no gates, no workflows. Verified against the file list.
• Gate 4 — three out-of-scope discoveries filed rather than folded in: [finding] form-section name: the ui/ census is 7 of 15 across 5 pages, not "three of five" — #10579 missed forms.mdx entirely #10709, [finding] GraphQL residue outside #10583's site list: api/index.mdx still documents a /graphql route that the dispatcher removed #10710, [finding] objects.mdx's apiMethods sample omits bulk too — same trap as #10590, different page, outside that card's site list #10711.

⭐ The judgement that mattered most: two cards understate their own defect, and you did not widen

• [finding] Three of five form-section examples in ui/ omit name, which the spec says makes the section render its authored label in every locale #10579 says "three of five form-section examples". The real ui/ census is 7 nameless
  of 15 across 5 pages, and the card misses content/docs/ui/forms.mdx entirely.
• [finding] schema-design.mdx's apiMethods sample says "six primitives only" and lists five — copying it silently denies bulk #10590's sibling trap exists on a second page the card does not list.

The tempting move is to fix what is actually broken. You fixed only the sites the cards name
(gate 3) and filed the remainders (gate 4). That is the harder and correct call: a sweep whose
diff exceeds its checklist stops being reviewable against the checklist, and the anchor card's
gates exist precisely to keep that property. #10710 is the same shape — GraphQL residue that
#10583parked without filing, now filed with its own sites.

Premises re-derived, not adopted

All 13 re-verified at your own merge base c700fc98ff, later than both triage's spot-check and my
claim-time check. Several line numbers had drifted and were re-derived — #10591:44→:39,
#10586:41→:38, #10581's project_task:365→:374.

And #10584's source-of-truth path was wrong exactly as my claim comment flagged — the real
anchor is packages/spec/src/data/field-value.zod.ts:251-256, not the card's data/-less
citation. That is why the brief said to treat every citation as a clue rather than a spec: 1 of
the 2 I spot-checked was broken, and you found the rest the same way.

Instrumentation

The void-mutation defence is built into the edit path, not applied afterwards. Every one of
~45 edits went through an anchored replace helper that asserts the anchor's before-count equals
the expected n, asserts the file actually changed, and asserts the replacement count moved by
exactly n — exiting 1 rather than 0 on a no-op. With #10581 alone spanning 22 sites across
12 pages, a sweep silently landing 18 of 22 was the single most likely failure here, and it is
closed off by construction rather than by care.

#10587 was reconciled mechanically rather than by eye: the 49-member FieldType enum against
the page's ### headings and its summary table, scoped to the table region — 44/44 before,
49/49 and 49/49 after. A prose claim of "each field type" is exactly the kind that gets
re-checked by counting, not by reading.

check:skill-examples was reasoned in, and it is the load-bearing gate here.dispatch-gates
did not name it, but 14 of the 22 #10581 sites sit under a {/* os:check */} marker and
packages/spec/scripts/check-skill-examples.ts:143-150 compiles exactly those fences out of
content/docs — so it is the gate that proves the edited blocks still type-check with
sharingModel on them. 227 prose examples green. Adding sharingModel to 21 literals without
that gate would have been an unverified change to compiled code.

check:role-word's per-file ratchet blocked nothing, which I had flagged as a possible obstacle.

And the small one I want to name because it is the same rule in an unusual place: script names
were verified to exist in packages/spec/package.json first, since a zero-match pnpm --filter
exits 0 having run nothing. That is the void-mutation signature applied to a package filter
rather than an editor.

No ablation, correctly — a prose/example diff introduces no new guard to prove failable.

Arming once the remaining checks clear.

---

Generated by Claude Code