diff --git a/.changeset/canonical-docs-host-in-runtime-strings.md b/.changeset/canonical-docs-host-in-runtime-strings.md
new file mode 100644
index 0000000000..d005fdfca5
--- /dev/null
+++ b/.changeset/canonical-docs-host-in-runtime-strings.md
@@ -0,0 +1,26 @@
+---
+'@objectstack/platform-objects': patch
+'@objectstack/plugin-security': patch
+'@objectstack/studio': patch
+'@objectstack/setup': patch
+'@objectstack/spec': patch
+'@objectstack/cli': patch
+---
+
+Point every runtime-emitted documentation URL at the canonical host, and retarget the
+metadata-protection `docsUrl` at a page that actually exists.
+
+Two defects, one string. The host half: `docs.objectstack.ai` is an alias that redirects
+to `https://objectstack.ai` path-preservingly, so nothing here was a broken link — it was
+the unratified spelling sitting in the places a user copies from. The CLI's spec-version
+advisory, the Setup and Studio in-app overview pages (English and Chinese alike), and a
+showcase demo action now all name the canonical host.
+
+The path half is the real fix. All 29 `protection.docsUrl` values on the platform's
+system objects and apps pointed at `/adr/0010-metadata-protection`, and `/adr/...` is not
+a route on any host: the docs site mounts `content/docs` under `/docs`, `docs/adr/` is
+not published, and no redirect source lives outside the `/docs` space. The slug was wrong
+too — the record is `0010-metadata-protection-model.md`. Studio renders this URL as a
+link in the lock banner, so an operator asking why an item is locked was being sent
+nowhere. They now point at `https://objectstack.ai/docs/references/shared/protection`,
+the published reference for the very schema that carries the field.
diff --git a/content/docs/references/shared/protection.mdx b/content/docs/references/shared/protection.mdx
index 2afa9f16df..318e9fbe5c 100644
--- a/content/docs/references/shared/protection.mdx
+++ b/content/docs/references/shared/protection.mdx
@@ -31,7 +31,7 @@ export const SETUP_APP: App = {
   protection: {
     lock: 'full',
     reason: 'Core admin UI shipped by @objectstack/platform-objects.',
-    docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+    docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
   },
   // ...
 };
diff --git a/examples/app-showcase/src/ui/actions/index.ts b/examples/app-showcase/src/ui/actions/index.ts
index d3db23e04b..4141ade19f 100644
--- a/examples/app-showcase/src/ui/actions/index.ts
+++ b/examples/app-showcase/src/ui/actions/index.ts
@@ -85,7 +85,7 @@ export const OpenDocsAction = defineAction({
   icon: 'book-open',
   objectName: task,
   type: 'url',
-  target: 'https://docs.objectstack.ai',
+  target: 'https://objectstack.ai',
   locations: ['record_more'],
   refreshAfter: false,
 });
diff --git a/packages/apps/setup/src/setup-overview.doc.ts b/packages/apps/setup/src/setup-overview.doc.ts
index 0a6d57f104..4df0c57ee2 100644
--- a/packages/apps/setup/src/setup-overview.doc.ts
+++ b/packages/apps/setup/src/setup-overview.doc.ts
@@ -28,7 +28,7 @@ export const SETUP_OVERVIEW_DOC: Doc = {
 
 Setup is the administrator app. Its screens are mostly self-explanatory — these
 are the few rules behind them that the UI does not show. For everything else,
-see <https://docs.objectstack.ai>.
+see <https://objectstack.ai>.
 
 - **A user is identity, not access.** Creating a \`sys_user\` lets someone sign
   in; *what* they can do comes entirely from the roles and permission sets you
@@ -43,7 +43,7 @@ see <https://docs.objectstack.ai>.
   is only ever widened by the role hierarchy and sharing rules — never silently
   narrowed.
 
-See <https://docs.objectstack.ai> for the full security model.
+See <https://objectstack.ai> for the full security model.
 `,
   translations: {
     zh: {
@@ -52,7 +52,7 @@ See <https://docs.objectstack.ai> for the full security model.
       content: `# Setup 概览
 
 Setup 是管理员应用。它的界面大多一目了然——下面这几条是界面背后、UI 没有明说的
-规则。其余内容见 <https://docs.objectstack.ai>。
+规则。其余内容见 <https://objectstack.ai>。
 
 - **用户是身份,不是权限。** 创建一条 \`sys_user\` 只是让人能登录;他*能做什么*
   完全由你随后分配的角色和权限集决定。停用用户会收回登录权,但不删除其记录,
@@ -63,7 +63,7 @@ Setup 是管理员应用。它的界面大多一目了然——下面这几条
   *哪类*记录;共享决定*哪些行*。可见性从组织级默认出发,只会被角色层级和共享规则
   *放宽*,绝不会被悄悄收窄。
 
-完整安全模型见 <https://docs.objectstack.ai>。
+完整安全模型见 <https://objectstack.ai>。
 `,
     },
   },
diff --git a/packages/apps/studio/src/studio-overview.doc.ts b/packages/apps/studio/src/studio-overview.doc.ts
index 80bd03abf1..435b6e25f2 100644
--- a/packages/apps/studio/src/studio-overview.doc.ts
+++ b/packages/apps/studio/src/studio-overview.doc.ts
@@ -28,7 +28,7 @@ Studio is the builder app — the workbench for shaping the platform's
 *metadata*: objects, fields, views, flows, agents, and the rest. Most of its
 screens are self-explanatory; this page covers the one rule that is not visible
 on screen but governs everything you do here. For the full reference, see
-<https://docs.objectstack.ai>.
+<https://objectstack.ai>.
 
 ## Metadata-first
 
@@ -56,7 +56,7 @@ overlay so the rest of the tenant sees it. Moving changes between environments
 side effect of publishing — keeping the two distinct is what lets you build
 safely in one environment before shipping.
 
-See <https://docs.objectstack.ai> for drafts, overlays, and deployment in depth.
+See <https://objectstack.ai> for drafts, overlays, and deployment in depth.
 `,
   translations: {
     zh: {
@@ -66,7 +66,7 @@ See <https://docs.objectstack.ai> for drafts, overlays, and deployment in depth.
 
 Studio 是搭建者应用——塑造平台*元数据*的工作台:对象、字段、视图、流程、智能体等。
 它的大多数界面一目了然;本页讲的是那条界面上看不见、却支配你在这里一切操作的规则。
-完整参考见 <https://docs.objectstack.ai>。
+完整参考见 <https://objectstack.ai>。
 
 ## 元数据优先
 
@@ -88,7 +88,7 @@ UI 和 API:你改的是模型,而不是修补某个界面。
 改动(例如开发 → 生产)是单独的**部署**步骤,不是发布的自动副作用——把两者分开,
 才能让你在一个环境里安全搭建、再上线。
 
-草稿、覆盖层与部署的细节见 <https://docs.objectstack.ai>。
+草稿、覆盖层与部署的细节见 <https://objectstack.ai>。
 `,
     },
   },
diff --git a/packages/cli/src/utils/spec-version.test.ts b/packages/cli/src/utils/spec-version.test.ts
index 4045d9b76f..568716b03d 100644
--- a/packages/cli/src/utils/spec-version.test.ts
+++ b/packages/cli/src/utils/spec-version.test.ts
@@ -10,14 +10,14 @@ describe('checkSpecVersionGap', () => {
     expect(gap!.declaredMajor).toBe(12);
     expect(gap!.installedMajor).toBe(14);
     expect(gap!.installedVersion).toBe('14.7.0');
-    expect(gap!.url).toBe('https://docs.objectstack.ai/docs/releases/v14');
-    expect(gap!.hint).toContain('https://docs.objectstack.ai/docs/releases/v14');
+    expect(gap!.url).toBe('https://objectstack.ai/docs/releases/v14');
+    expect(gap!.hint).toContain('https://objectstack.ai/docs/releases/v14');
   });
 
   it('points at the guide for the INSTALLED major, not the declared one', () => {
     // Two-major jump (12 → 14): the guide must be v14, the version on disk.
     const gap = checkSpecVersionGap({ specVersion: '^12.0.0' }, '14.0.0');
-    expect(gap!.url).toBe('https://docs.objectstack.ai/docs/releases/v14');
+    expect(gap!.url).toBe('https://objectstack.ai/docs/releases/v14');
   });
 
   it('is silent when declared major matches the installed platform', () => {
diff --git a/packages/cli/src/utils/spec-version.ts b/packages/cli/src/utils/spec-version.ts
index 9ea8a6aa80..edbef44003 100644
--- a/packages/cli/src/utils/spec-version.ts
+++ b/packages/cli/src/utils/spec-version.ts
@@ -19,7 +19,7 @@ import { createRequire } from 'module';
  * instead of being reverse-engineered from per-package `CHANGELOG.md` files.
  */
 
-const RELEASES_BASE = 'https://docs.objectstack.ai/docs/releases';
+const RELEASES_BASE = 'https://objectstack.ai/docs/releases';
 
 export interface SpecVersionGap {
   /** Major of the `@objectstack/spec` resolved from the app's node_modules. */
diff --git a/packages/platform-objects/src/apps/account.app.ts b/packages/platform-objects/src/apps/account.app.ts
index ee2c38c27f..b705aa57b6 100644
--- a/packages/platform-objects/src/apps/account.app.ts
+++ b/packages/platform-objects/src/apps/account.app.ts
@@ -46,7 +46,7 @@ export const ACCOUNT_APP: App = {
   protection: {
     lock: 'full',
     reason: 'Core self-service security UI shipped by @objectstack/platform-objects — see ADR-0010.',
-    docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+    docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
   },
   branding: {
     primaryColor: '#0ea5e9', // sky-500 — distinct from Setup's slate
diff --git a/packages/platform-objects/src/apps/setup.app.ts b/packages/platform-objects/src/apps/setup.app.ts
index 4d0bba95f4..82fdad66e7 100644
--- a/packages/platform-objects/src/apps/setup.app.ts
+++ b/packages/platform-objects/src/apps/setup.app.ts
@@ -39,7 +39,7 @@ export const SETUP_APP: App = {
   protection: {
     lock: 'full',
     reason: 'Core admin UI shipped by @objectstack/platform-objects — see ADR-0010.',
-    docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+    docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
   },
   branding: {
     primaryColor: '#475569', // Slate-600 — neutral admin palette
diff --git a/packages/platform-objects/src/apps/studio.app.ts b/packages/platform-objects/src/apps/studio.app.ts
index 5f87f93e60..b91b2b2fb0 100644
--- a/packages/platform-objects/src/apps/studio.app.ts
+++ b/packages/platform-objects/src/apps/studio.app.ts
@@ -41,7 +41,7 @@ export const STUDIO_APP: App = {
   protection: {
     lock: 'full',
     reason: 'Core developer workbench shipped by @objectstack/platform-objects — see ADR-0010.',
-    docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+    docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
   },
   // Studio is the metadata-authoring host, so its ambient copilot is
   // pinned to the schema-architect agent. Resolved by the ambient chat
diff --git a/packages/platform-objects/src/identity/sys-account.object.ts b/packages/platform-objects/src/identity/sys-account.object.ts
index 852c6598f8..ca19cf36ef 100644
--- a/packages/platform-objects/src/identity/sys-account.object.ts
+++ b/packages/platform-objects/src/identity/sys-account.object.ts
@@ -23,7 +23,7 @@ export const SysAccount = ObjectSchema.create({
   protection: {
     lock: 'full',
     reason: 'Identity table managed by better-auth — see ADR-0010.',
-    docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+    docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
   },
   description: 'OAuth and authentication provider accounts',
   titleFormat: '{provider_id} - {account_id}',
diff --git a/packages/platform-objects/src/identity/sys-api-key.object.ts b/packages/platform-objects/src/identity/sys-api-key.object.ts
index a4cb07629b..4f0eb591f0 100644
--- a/packages/platform-objects/src/identity/sys-api-key.object.ts
+++ b/packages/platform-objects/src/identity/sys-api-key.object.ts
@@ -42,7 +42,7 @@ export const SysApiKey = ObjectSchema.create({
   protection: {
     lock: 'full',
     reason: 'Identity table managed by better-auth — see ADR-0010.',
-    docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+    docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
   },
   // [#8778, #8707 remainder] Stamp-only organization declaration — NOT a wall.
   //
diff --git a/packages/platform-objects/src/identity/sys-device-code.object.ts b/packages/platform-objects/src/identity/sys-device-code.object.ts
index 563eaa1a55..dd36399db9 100644
--- a/packages/platform-objects/src/identity/sys-device-code.object.ts
+++ b/packages/platform-objects/src/identity/sys-device-code.object.ts
@@ -44,7 +44,7 @@ export const SysDeviceCode = ObjectSchema.create({
   protection: {
     lock: 'full',
     reason: 'Identity table managed by better-auth — see ADR-0010.',
-    docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+    docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
   },
   description: 'OAuth 2.0 Device Authorization Grant (RFC 8628) pending requests',
   nameField: 'user_code', // [ADR-0079] canonical primary-title pointer (single-field titleFormat)
diff --git a/packages/platform-objects/src/identity/sys-invitation.object.ts b/packages/platform-objects/src/identity/sys-invitation.object.ts
index 7edc6eade5..1e96002988 100644
--- a/packages/platform-objects/src/identity/sys-invitation.object.ts
+++ b/packages/platform-objects/src/identity/sys-invitation.object.ts
@@ -28,7 +28,7 @@ export const SysInvitation = ObjectSchema.create({
   protection: {
     lock: 'full',
     reason: 'Identity table managed by better-auth — see ADR-0010.',
-    docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+    docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
   },
   description: 'Organization invitations for user onboarding',
   // Title by invitee email rather than organization_id: the latter is null in
diff --git a/packages/platform-objects/src/identity/sys-jwks.object.ts b/packages/platform-objects/src/identity/sys-jwks.object.ts
index be634405d4..3f66ae651a 100644
--- a/packages/platform-objects/src/identity/sys-jwks.object.ts
+++ b/packages/platform-objects/src/identity/sys-jwks.object.ts
@@ -34,7 +34,7 @@ export const SysJwks = ObjectSchema.create({
   protection: {
     lock: 'full',
     reason: 'Identity table managed by better-auth — see ADR-0010.',
-    docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+    docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
   },
   description: 'Asymmetric key pairs used to sign and verify issued JWTs',
   highlightFields: ['id', 'created_at', 'expires_at'],
diff --git a/packages/platform-objects/src/identity/sys-member.object.ts b/packages/platform-objects/src/identity/sys-member.object.ts
index b422653810..042c632d53 100644
--- a/packages/platform-objects/src/identity/sys-member.object.ts
+++ b/packages/platform-objects/src/identity/sys-member.object.ts
@@ -24,7 +24,7 @@ export const SysMember = ObjectSchema.create({
   protection: {
     lock: 'full',
     reason: 'Identity table managed by better-auth — see ADR-0010.',
-    docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+    docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
   },
   description: 'Organization membership records',
   // Org-independent title: organization_id is null in single-org mode, so a
diff --git a/packages/platform-objects/src/identity/sys-oauth-access-token.object.ts b/packages/platform-objects/src/identity/sys-oauth-access-token.object.ts
index 0b06b8cf3f..1dc440b0d8 100644
--- a/packages/platform-objects/src/identity/sys-oauth-access-token.object.ts
+++ b/packages/platform-objects/src/identity/sys-oauth-access-token.object.ts
@@ -33,7 +33,7 @@ export const SysOauthAccessToken = ObjectSchema.create({
   protection: {
     lock: 'full',
     reason: 'Identity table managed by better-auth — see ADR-0010.',
-    docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+    docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
   },
   description: 'Opaque OAuth access tokens issued to client applications',
   highlightFields: ['client_id', 'user_id', 'expires_at'],
diff --git a/packages/platform-objects/src/identity/sys-oauth-application.object.ts b/packages/platform-objects/src/identity/sys-oauth-application.object.ts
index 05e8b289c1..a6161369a7 100644
--- a/packages/platform-objects/src/identity/sys-oauth-application.object.ts
+++ b/packages/platform-objects/src/identity/sys-oauth-application.object.ts
@@ -30,7 +30,7 @@ export const SysOauthApplication = ObjectSchema.create({
   protection: {
     lock: 'full',
     reason: 'Identity table managed by better-auth — see ADR-0010.',
-    docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+    docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
   },
   description: 'Registered OAuth/OIDC client applications',
   displayNameField: 'name',
diff --git a/packages/platform-objects/src/identity/sys-oauth-client-assertion.object.ts b/packages/platform-objects/src/identity/sys-oauth-client-assertion.object.ts
index db7aeb991f..1804426a1e 100644
--- a/packages/platform-objects/src/identity/sys-oauth-client-assertion.object.ts
+++ b/packages/platform-objects/src/identity/sys-oauth-client-assertion.object.ts
@@ -25,7 +25,7 @@ export const SysOauthClientAssertion = ObjectSchema.create({
   protection: {
     lock: 'full',
     reason: 'Identity table managed by better-auth — see ADR-0010.',
-    docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+    docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
   },
   description: 'Consumed OAuth client-assertion JTIs (RFC 7523 replay prevention)',
   highlightFields: ['expires_at'],
diff --git a/packages/platform-objects/src/identity/sys-oauth-client-resource.object.ts b/packages/platform-objects/src/identity/sys-oauth-client-resource.object.ts
index 2a6c85ee0d..22511f589b 100644
--- a/packages/platform-objects/src/identity/sys-oauth-client-resource.object.ts
+++ b/packages/platform-objects/src/identity/sys-oauth-client-resource.object.ts
@@ -25,7 +25,7 @@ export const SysOauthClientResource = ObjectSchema.create({
   protection: {
     lock: 'full',
     reason: 'Identity table managed by better-auth — see ADR-0010.',
-    docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+    docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
   },
   description: 'Grants allowing an OAuth client to request tokens for a protected resource',
   highlightFields: ['client_id', 'resource_id'],
diff --git a/packages/platform-objects/src/identity/sys-oauth-consent.object.ts b/packages/platform-objects/src/identity/sys-oauth-consent.object.ts
index f236f35cc4..edefe5b9fc 100644
--- a/packages/platform-objects/src/identity/sys-oauth-consent.object.ts
+++ b/packages/platform-objects/src/identity/sys-oauth-consent.object.ts
@@ -29,7 +29,7 @@ export const SysOauthConsent = ObjectSchema.create({
   protection: {
     lock: 'full',
     reason: 'Identity table managed by better-auth — see ADR-0010.',
-    docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+    docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
   },
   description: 'User consent records for OAuth client applications',
   highlightFields: ['client_id', 'user_id', 'scopes'],
diff --git a/packages/platform-objects/src/identity/sys-oauth-refresh-token.object.ts b/packages/platform-objects/src/identity/sys-oauth-refresh-token.object.ts
index f7d14d9bfc..122d514b52 100644
--- a/packages/platform-objects/src/identity/sys-oauth-refresh-token.object.ts
+++ b/packages/platform-objects/src/identity/sys-oauth-refresh-token.object.ts
@@ -32,7 +32,7 @@ export const SysOauthRefreshToken = ObjectSchema.create({
   protection: {
     lock: 'full',
     reason: 'Identity table managed by better-auth — see ADR-0010.',
-    docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+    docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
   },
   description: 'Opaque OAuth refresh tokens (linked to a session)',
   highlightFields: ['client_id', 'user_id', 'expires_at'],
diff --git a/packages/platform-objects/src/identity/sys-oauth-resource.object.ts b/packages/platform-objects/src/identity/sys-oauth-resource.object.ts
index bdc4513196..1f3188faae 100644
--- a/packages/platform-objects/src/identity/sys-oauth-resource.object.ts
+++ b/packages/platform-objects/src/identity/sys-oauth-resource.object.ts
@@ -26,7 +26,7 @@ export const SysOauthResource = ObjectSchema.create({
   protection: {
     lock: 'full',
     reason: 'Identity table managed by better-auth — see ADR-0010.',
-    docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+    docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
   },
   description: 'Registered OAuth protected resources (RFC 8707 resource indicators)',
   displayNameField: 'name',
diff --git a/packages/platform-objects/src/identity/sys-organization.object.ts b/packages/platform-objects/src/identity/sys-organization.object.ts
index 60a433f541..bf8a544428 100644
--- a/packages/platform-objects/src/identity/sys-organization.object.ts
+++ b/packages/platform-objects/src/identity/sys-organization.object.ts
@@ -23,7 +23,7 @@ export const SysOrganization = ObjectSchema.create({
   protection: {
     lock: 'full',
     reason: 'Identity table managed by better-auth — see ADR-0010.',
-    docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+    docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
   },
   description: 'Organizations for multi-tenant grouping',
   displayNameField: 'name',
diff --git a/packages/platform-objects/src/identity/sys-scim-provider.object.ts b/packages/platform-objects/src/identity/sys-scim-provider.object.ts
index beb700a4a4..949ae30f78 100644
--- a/packages/platform-objects/src/identity/sys-scim-provider.object.ts
+++ b/packages/platform-objects/src/identity/sys-scim-provider.object.ts
@@ -55,7 +55,7 @@ export const SysScimProvider = ObjectSchema.create({
   protection: {
     lock: 'full',
     reason: 'Identity table managed by better-auth (@better-auth/scim) — see ADR-0071.',
-    docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+    docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
   },
   description: 'SCIM 2.0 connections (bearer tokens) external IdPs use to provision/deprovision this environment\'s users',
   displayNameField: 'provider_id',
diff --git a/packages/platform-objects/src/identity/sys-session.object.ts b/packages/platform-objects/src/identity/sys-session.object.ts
index 0ff50149d5..8dba60de6e 100644
--- a/packages/platform-objects/src/identity/sys-session.object.ts
+++ b/packages/platform-objects/src/identity/sys-session.object.ts
@@ -58,7 +58,7 @@ export const SysSession = ObjectSchema.create({
   protection: {
     lock: 'full',
     reason: 'Identity table managed by better-auth — see ADR-0010.',
-    docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+    docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
   },
   description: 'Active user sessions',
   displayNameField: 'user_id',
diff --git a/packages/platform-objects/src/identity/sys-sso-provider.object.ts b/packages/platform-objects/src/identity/sys-sso-provider.object.ts
index 4685ba749b..b00700d7f3 100644
--- a/packages/platform-objects/src/identity/sys-sso-provider.object.ts
+++ b/packages/platform-objects/src/identity/sys-sso-provider.object.ts
@@ -62,7 +62,7 @@ export const SysSsoProvider = ObjectSchema.create({
   protection: {
     lock: 'full',
     reason: 'Identity table managed by better-auth (@better-auth/sso) — see ADR-0024.',
-    docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+    docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
   },
   description: 'External SSO identity providers (OIDC / SAML) this environment federates login to',
   displayNameField: 'provider_id',
diff --git a/packages/platform-objects/src/identity/sys-team-member.object.ts b/packages/platform-objects/src/identity/sys-team-member.object.ts
index 821c0dc18a..e13557c46e 100644
--- a/packages/platform-objects/src/identity/sys-team-member.object.ts
+++ b/packages/platform-objects/src/identity/sys-team-member.object.ts
@@ -23,7 +23,7 @@ export const SysTeamMember = ObjectSchema.create({
   protection: {
     lock: 'full',
     reason: 'Identity table managed by better-auth — see ADR-0010.',
-    docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+    docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
   },
   description: 'Team membership records linking users to teams',
   titleFormat: '{user_id} in {team_id}',
diff --git a/packages/platform-objects/src/identity/sys-team.object.ts b/packages/platform-objects/src/identity/sys-team.object.ts
index 7450b5cc99..3ccd4e7749 100644
--- a/packages/platform-objects/src/identity/sys-team.object.ts
+++ b/packages/platform-objects/src/identity/sys-team.object.ts
@@ -23,7 +23,7 @@ export const SysTeam = ObjectSchema.create({
   protection: {
     lock: 'full',
     reason: 'Identity table managed by better-auth — see ADR-0010.',
-    docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+    docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
   },
   description: 'Teams within organizations for fine-grained grouping',
   displayNameField: 'name',
diff --git a/packages/platform-objects/src/identity/sys-two-factor.object.ts b/packages/platform-objects/src/identity/sys-two-factor.object.ts
index 596652ca50..4354b2ef54 100644
--- a/packages/platform-objects/src/identity/sys-two-factor.object.ts
+++ b/packages/platform-objects/src/identity/sys-two-factor.object.ts
@@ -23,7 +23,7 @@ export const SysTwoFactor = ObjectSchema.create({
   protection: {
     lock: 'full',
     reason: 'Identity table managed by better-auth — see ADR-0010.',
-    docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+    docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
   },
   description: 'Two-factor authentication credentials',
   titleFormat: 'Two-factor for {user_id}',
diff --git a/packages/platform-objects/src/identity/sys-user.object.ts b/packages/platform-objects/src/identity/sys-user.object.ts
index 79adba85e9..aa398a0940 100644
--- a/packages/platform-objects/src/identity/sys-user.object.ts
+++ b/packages/platform-objects/src/identity/sys-user.object.ts
@@ -33,7 +33,7 @@ export const SysUser = ObjectSchema.create({
   protection: {
     lock: 'full',
     reason: 'Identity table managed by better-auth — see ADR-0010.',
-    docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+    docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
   },
   description: 'User accounts for authentication',
   displayNameField: 'name',
diff --git a/packages/platform-objects/src/identity/sys-verification.object.ts b/packages/platform-objects/src/identity/sys-verification.object.ts
index 06fd2ddd97..72b982b0f4 100644
--- a/packages/platform-objects/src/identity/sys-verification.object.ts
+++ b/packages/platform-objects/src/identity/sys-verification.object.ts
@@ -29,7 +29,7 @@ export const SysVerification = ObjectSchema.create({
   protection: {
     lock: 'full',
     reason: 'Identity table managed by better-auth — see ADR-0010.',
-    docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+    docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
   },
   description: 'Email and phone verification tokens',
   titleFormat: 'Verification for {identifier}',
diff --git a/packages/plugins/plugin-security/src/objects/sys-capability.object.ts b/packages/plugins/plugin-security/src/objects/sys-capability.object.ts
index a67219b4cb..47d4ccf9c6 100644
--- a/packages/plugins/plugin-security/src/objects/sys-capability.object.ts
+++ b/packages/plugins/plugin-security/src/objects/sys-capability.object.ts
@@ -35,7 +35,7 @@ export const SysCapability = ObjectSchema.create({
   protection: {
     lock: 'no-overlay',
     reason: 'Capability registry schema is platform-defined — see ADR-0066 / ADR-0010.',
-    docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+    docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
   },
   description: 'Authorization capability definitions (ADR-0066 D1). Referenced by name from permission-set systemPermissions and resource requiredPermissions.',
   displayNameField: 'label',
diff --git a/packages/plugins/plugin-security/src/objects/sys-permission-set.object.ts b/packages/plugins/plugin-security/src/objects/sys-permission-set.object.ts
index 29ad2353bd..969d3f7f41 100644
--- a/packages/plugins/plugin-security/src/objects/sys-permission-set.object.ts
+++ b/packages/plugins/plugin-security/src/objects/sys-permission-set.object.ts
@@ -24,7 +24,7 @@ export const SysPermissionSet = ObjectSchema.create({
   protection: {
     lock: 'no-overlay',
     reason: 'RBAC schema is platform-defined — see ADR-0010.',
-    docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+    docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
   },
   description: 'Named permission groupings for fine-grained access control',
   displayNameField: 'label',
diff --git a/packages/plugins/plugin-security/src/objects/sys-position.object.ts b/packages/plugins/plugin-security/src/objects/sys-position.object.ts
index 07d8f2b669..8c2195e613 100644
--- a/packages/plugins/plugin-security/src/objects/sys-position.object.ts
+++ b/packages/plugins/plugin-security/src/objects/sys-position.object.ts
@@ -30,7 +30,7 @@ export const SysPosition = ObjectSchema.create({
   protection: {
     lock: 'no-overlay',
     reason: 'RBAC schema is platform-defined — see ADR-0010.',
-    docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+    docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
   },
   description: 'Position definitions for capability distribution (ADR-0090)',
   displayNameField: 'label',
diff --git a/packages/spec/src/shared/protection.test.ts b/packages/spec/src/shared/protection.test.ts
index 94242cae6b..6179f15b64 100644
--- a/packages/spec/src/shared/protection.test.ts
+++ b/packages/spec/src/shared/protection.test.ts
@@ -48,13 +48,13 @@ describe('applyProtection', () => {
             protection: {
                 lock: 'full',
                 reason: 'Core admin UI',
-                docsUrl: 'https://docs.objectstack.ai/adr/0010',
+                docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
             },
         } as Record<string, unknown>;
         applyProtection(item, { packageId: 'com.objectstack.platform-objects' });
         expect(item._lock).toBe('full');
         expect(item._lockReason).toBe('Core admin UI');
-        expect(item._lockDocsUrl).toBe('https://docs.objectstack.ai/adr/0010');
+        expect(item._lockDocsUrl).toBe('https://objectstack.ai/docs/references/shared/protection');
         expect(item._lockSource).toBe('package');
         expect(item._provenance).toBe('package');
         expect(item._packageId).toBe('com.objectstack.platform-objects');
diff --git a/packages/spec/src/shared/protection.zod.ts b/packages/spec/src/shared/protection.zod.ts
index 979759e94a..8abc830645 100644
--- a/packages/spec/src/shared/protection.zod.ts
+++ b/packages/spec/src/shared/protection.zod.ts
@@ -27,7 +27,7 @@
  *   protection: {
  *     lock: 'full',
  *     reason: 'Core admin UI shipped by @objectstack/platform-objects.',
- *     docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+ *     docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
  *   },
  *   // ...
  * };