objectstack-ai · os-elon · Aug 21, 2026 · Aug 21, 2026
diff --git a/.changeset/canonical-docs-host-in-runtime-strings.md b/.changeset/canonical-docs-host-in-runtime-strings.md
@@ -0,0 +1,26 @@
+---
+'@objectstack/platform-objects': patch
+'@objectstack/plugin-security': patch
+'@objectstack/studio': patch
+'@objectstack/setup': patch
+'@objectstack/spec': patch
+'@objectstack/cli': patch
+---
+
+Point every runtime-emitted documentation URL at the canonical host, and retarget the
+metadata-protection `docsUrl` at a page that actually exists.
+
+Two defects, one string. The host half: `docs.objectstack.ai` is an alias that redirects
+to `https://objectstack.ai` path-preservingly, so nothing here was a broken link — it was
+the unratified spelling sitting in the places a user copies from. The CLI's spec-version
+advisory, the Setup and Studio in-app overview pages (English and Chinese alike), and a
+showcase demo action now all name the canonical host.
+
+The path half is the real fix. All 29 `protection.docsUrl` values on the platform's
+system objects and apps pointed at `/adr/0010-metadata-protection`, and `/adr/...` is not
+a route on any host: the docs site mounts `content/docs` under `/docs`, `docs/adr/` is
+not published, and no redirect source lives outside the `/docs` space. The slug was wrong
+too — the record is `0010-metadata-protection-model.md`. Studio renders this URL as a
+link in the lock banner, so an operator asking why an item is locked was being sent
+nowhere. They now point at `https://objectstack.ai/docs/references/shared/protection`,
+the published reference for the very schema that carries the field.
diff --git a/content/docs/references/shared/protection.mdx b/content/docs/references/shared/protection.mdx
@@ -31,7 +31,7 @@ export const SETUP_APP: App = {
  protection: {
  lock: 'full',
  reason: 'Core admin UI shipped by @objectstack/platform-objects.',
- docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+ docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
  },
  // ...
 };

diff --git a/examples/app-showcase/src/ui/actions/index.ts b/examples/app-showcase/src/ui/actions/index.ts
@@ -85,7 +85,7 @@ export const OpenDocsAction = defineAction({
  icon: 'book-open',
  objectName: task,
  type: 'url',
- target: 'https://docs.objectstack.ai',
+ target: 'https://objectstack.ai',
  locations: ['record_more'],
  refreshAfter: false,
 });

diff --git a/packages/apps/setup/src/setup-overview.doc.ts b/packages/apps/setup/src/setup-overview.doc.ts
@@ -28,7 +28,7 @@ export const SETUP_OVERVIEW_DOC: Doc = {
 
 Setup is the administrator app. Its screens are mostly self-explanatory — these
 are the few rules behind them that the UI does not show. For everything else,
-see <https://docs.objectstack.ai>.
+see <https://objectstack.ai>.
 
 - **A user is identity, not access.** Creating a \`sys_user\` lets someone sign
  in; *what* they can do comes entirely from the roles and permission sets you
@@ -43,7 +43,7 @@ see <https://docs.objectstack.ai>.
  is only ever widened by the role hierarchy and sharing rules — never silently
  narrowed.
 
-See <https://docs.objectstack.ai> for the full security model.
+See <https://objectstack.ai> for the full security model.
 `,
  translations: {
  zh: {
@@ -52,7 +52,7 @@ See <https://docs.objectstack.ai> for the full security model.
  content: `# Setup 概览
 
 Setup 是管理员应用。它的界面大多一目了然——下面这几条是界面背后、UI 没有明说的
-规则。其余内容见 <https://docs.objectstack.ai>。
+规则。其余内容见 <https://objectstack.ai>。
 
 - **用户是身份,不是权限。** 创建一条 \`sys_user\` 只是让人能登录;他*能做什么*
  完全由你随后分配的角色和权限集决定。停用用户会收回登录权,但不删除其记录,
@@ -63,7 +63,7 @@ Setup 是管理员应用。它的界面大多一目了然——下面这几条
  *哪类*记录;共享决定*哪些行*。可见性从组织级默认出发,只会被角色层级和共享规则
  *放宽*,绝不会被悄悄收窄。
 
-完整安全模型见 <https://docs.objectstack.ai>。
+完整安全模型见 <https://objectstack.ai>。
 `,
  },
  },

diff --git a/packages/apps/studio/src/studio-overview.doc.ts b/packages/apps/studio/src/studio-overview.doc.ts
@@ -28,7 +28,7 @@ Studio is the builder app — the workbench for shaping the platform's
 *metadata*: objects, fields, views, flows, agents, and the rest. Most of its
 screens are self-explanatory; this page covers the one rule that is not visible
 on screen but governs everything you do here. For the full reference, see
-<https://docs.objectstack.ai>.
+<https://objectstack.ai>.
 
 ## Metadata-first
 
@@ -56,7 +56,7 @@ overlay so the rest of the tenant sees it. Moving changes between environments
 side effect of publishing — keeping the two distinct is what lets you build
 safely in one environment before shipping.
 
-See <https://docs.objectstack.ai> for drafts, overlays, and deployment in depth.
+See <https://objectstack.ai> for drafts, overlays, and deployment in depth.
 `,
  translations: {
  zh: {
@@ -66,7 +66,7 @@ See <https://docs.objectstack.ai> for drafts, overlays, and deployment in depth.
 
 Studio 是搭建者应用——塑造平台*元数据*的工作台:对象、字段、视图、流程、智能体等。
 它的大多数界面一目了然;本页讲的是那条界面上看不见、却支配你在这里一切操作的规则。
-完整参考见 <https://docs.objectstack.ai>。
+完整参考见 <https://objectstack.ai>。
 
 ## 元数据优先
 
@@ -88,7 +88,7 @@ UI 和 API:你改的是模型,而不是修补某个界面。
 改动(例如开发 → 生产)是单独的**部署**步骤,不是发布的自动副作用——把两者分开,
 才能让你在一个环境里安全搭建、再上线。
 
-草稿、覆盖层与部署的细节见 <https://docs.objectstack.ai>。
+草稿、覆盖层与部署的细节见 <https://objectstack.ai>。
 `,
  },
  },

diff --git a/packages/cli/src/utils/spec-version.test.ts b/packages/cli/src/utils/spec-version.test.ts
@@ -10,14 +10,14 @@ describe('checkSpecVersionGap', () => {
  expect(gap!.declaredMajor).toBe(12);
  expect(gap!.installedMajor).toBe(14);
  expect(gap!.installedVersion).toBe('14.7.0');
- expect(gap!.url).toBe('https://docs.objectstack.ai/docs/releases/v14');
- expect(gap!.hint).toContain('https://docs.objectstack.ai/docs/releases/v14');
+ expect(gap!.url).toBe('https://objectstack.ai/docs/releases/v14');
+ expect(gap!.hint).toContain('https://objectstack.ai/docs/releases/v14');
  });
 
  it('points at the guide for the INSTALLED major, not the declared one', () => {
  // Two-major jump (12 → 14): the guide must be v14, the version on disk.
  const gap = checkSpecVersionGap({ specVersion: '^12.0.0' }, '14.0.0');
- expect(gap!.url).toBe('https://docs.objectstack.ai/docs/releases/v14');
+ expect(gap!.url).toBe('https://objectstack.ai/docs/releases/v14');
  });
 
  it('is silent when declared major matches the installed platform', () => {

diff --git a/packages/cli/src/utils/spec-version.ts b/packages/cli/src/utils/spec-version.ts
@@ -19,7 +19,7 @@ import { createRequire } from 'module';
  * instead of being reverse-engineered from per-package `CHANGELOG.md` files.
  */
 
-const RELEASES_BASE = 'https://docs.objectstack.ai/docs/releases';
+const RELEASES_BASE = 'https://objectstack.ai/docs/releases';
 
 export interface SpecVersionGap {
  /** Major of the `@objectstack/spec` resolved from the app's node_modules. */

diff --git a/packages/platform-objects/src/apps/account.app.ts b/packages/platform-objects/src/apps/account.app.ts
@@ -46,7 +46,7 @@ export const ACCOUNT_APP: App = {
  protection: {
  lock: 'full',
  reason: 'Core self-service security UI shipped by @objectstack/platform-objects — see ADR-0010.',
- docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+ docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
  },
  branding: {
  primaryColor: '#0ea5e9', // sky-500 — distinct from Setup's slate

diff --git a/packages/platform-objects/src/apps/setup.app.ts b/packages/platform-objects/src/apps/setup.app.ts
@@ -39,7 +39,7 @@ export const SETUP_APP: App = {
  protection: {
  lock: 'full',
  reason: 'Core admin UI shipped by @objectstack/platform-objects — see ADR-0010.',
- docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+ docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
  },
  branding: {
  primaryColor: '#475569', // Slate-600 — neutral admin palette

diff --git a/packages/platform-objects/src/apps/studio.app.ts b/packages/platform-objects/src/apps/studio.app.ts
@@ -41,7 +41,7 @@ export const STUDIO_APP: App = {
  protection: {
  lock: 'full',
  reason: 'Core developer workbench shipped by @objectstack/platform-objects — see ADR-0010.',
- docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+ docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
  },
  // Studio is the metadata-authoring host, so its ambient copilot is
  // pinned to the schema-architect agent. Resolved by the ambient chat

diff --git a/packages/platform-objects/src/identity/sys-account.object.ts b/packages/platform-objects/src/identity/sys-account.object.ts
@@ -23,7 +23,7 @@ export const SysAccount = ObjectSchema.create({
  protection: {
  lock: 'full',
  reason: 'Identity table managed by better-auth — see ADR-0010.',
- docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+ docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
  },
  description: 'OAuth and authentication provider accounts',
  titleFormat: '{provider_id} - {account_id}',

diff --git a/packages/platform-objects/src/identity/sys-api-key.object.ts b/packages/platform-objects/src/identity/sys-api-key.object.ts
@@ -42,7 +42,7 @@ export const SysApiKey = ObjectSchema.create({
  protection: {
  lock: 'full',
  reason: 'Identity table managed by better-auth — see ADR-0010.',
- docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+ docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
  },
  // [#8778, #8707 remainder] Stamp-only organization declaration — NOT a wall.
  //

diff --git a/packages/platform-objects/src/identity/sys-device-code.object.ts b/packages/platform-objects/src/identity/sys-device-code.object.ts
@@ -44,7 +44,7 @@ export const SysDeviceCode = ObjectSchema.create({
  protection: {
  lock: 'full',
  reason: 'Identity table managed by better-auth — see ADR-0010.',
- docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+ docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
  },
  description: 'OAuth 2.0 Device Authorization Grant (RFC 8628) pending requests',
  nameField: 'user_code', // [ADR-0079] canonical primary-title pointer (single-field titleFormat)

diff --git a/packages/platform-objects/src/identity/sys-invitation.object.ts b/packages/platform-objects/src/identity/sys-invitation.object.ts
@@ -28,7 +28,7 @@ export const SysInvitation = ObjectSchema.create({
  protection: {
  lock: 'full',
  reason: 'Identity table managed by better-auth — see ADR-0010.',
- docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+ docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
  },
  description: 'Organization invitations for user onboarding',
  // Title by invitee email rather than organization_id: the latter is null in

diff --git a/packages/platform-objects/src/identity/sys-jwks.object.ts b/packages/platform-objects/src/identity/sys-jwks.object.ts
@@ -34,7 +34,7 @@ export const SysJwks = ObjectSchema.create({
  protection: {
  lock: 'full',
  reason: 'Identity table managed by better-auth — see ADR-0010.',
- docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+ docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
  },
  description: 'Asymmetric key pairs used to sign and verify issued JWTs',
  highlightFields: ['id', 'created_at', 'expires_at'],

diff --git a/packages/platform-objects/src/identity/sys-member.object.ts b/packages/platform-objects/src/identity/sys-member.object.ts
@@ -24,7 +24,7 @@ export const SysMember = ObjectSchema.create({
  protection: {
  lock: 'full',
  reason: 'Identity table managed by better-auth — see ADR-0010.',
- docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+ docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
  },
  description: 'Organization membership records',
  // Org-independent title: organization_id is null in single-org mode, so a

diff --git a/packages/platform-objects/src/identity/sys-oauth-access-token.object.ts b/packages/platform-objects/src/identity/sys-oauth-access-token.object.ts
@@ -33,7 +33,7 @@ export const SysOauthAccessToken = ObjectSchema.create({
  protection: {
  lock: 'full',
  reason: 'Identity table managed by better-auth — see ADR-0010.',
- docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+ docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
  },
  description: 'Opaque OAuth access tokens issued to client applications',
  highlightFields: ['client_id', 'user_id', 'expires_at'],

diff --git a/packages/platform-objects/src/identity/sys-oauth-application.object.ts b/packages/platform-objects/src/identity/sys-oauth-application.object.ts
@@ -30,7 +30,7 @@ export const SysOauthApplication = ObjectSchema.create({
  protection: {
  lock: 'full',
  reason: 'Identity table managed by better-auth — see ADR-0010.',
- docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+ docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
  },
  description: 'Registered OAuth/OIDC client applications',
  displayNameField: 'name',

diff --git a/packages/platform-objects/src/identity/sys-oauth-client-assertion.object.ts b/packages/platform-objects/src/identity/sys-oauth-client-assertion.object.ts
@@ -25,7 +25,7 @@ export const SysOauthClientAssertion = ObjectSchema.create({
  protection: {
  lock: 'full',
  reason: 'Identity table managed by better-auth — see ADR-0010.',
- docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+ docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
  },
  description: 'Consumed OAuth client-assertion JTIs (RFC 7523 replay prevention)',
  highlightFields: ['expires_at'],

diff --git a/packages/platform-objects/src/identity/sys-oauth-client-resource.object.ts b/packages/platform-objects/src/identity/sys-oauth-client-resource.object.ts
@@ -25,7 +25,7 @@ export const SysOauthClientResource = ObjectSchema.create({
  protection: {
  lock: 'full',
  reason: 'Identity table managed by better-auth — see ADR-0010.',
- docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+ docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
  },
  description: 'Grants allowing an OAuth client to request tokens for a protected resource',
  highlightFields: ['client_id', 'resource_id'],

diff --git a/packages/platform-objects/src/identity/sys-oauth-consent.object.ts b/packages/platform-objects/src/identity/sys-oauth-consent.object.ts
@@ -29,7 +29,7 @@ export const SysOauthConsent = ObjectSchema.create({
  protection: {
  lock: 'full',
  reason: 'Identity table managed by better-auth — see ADR-0010.',
- docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+ docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
  },
  description: 'User consent records for OAuth client applications',
  highlightFields: ['client_id', 'user_id', 'scopes'],

diff --git a/packages/platform-objects/src/identity/sys-oauth-refresh-token.object.ts b/packages/platform-objects/src/identity/sys-oauth-refresh-token.object.ts
@@ -32,7 +32,7 @@ export const SysOauthRefreshToken = ObjectSchema.create({
  protection: {
  lock: 'full',
  reason: 'Identity table managed by better-auth — see ADR-0010.',
- docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+ docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
  },
  description: 'Opaque OAuth refresh tokens (linked to a session)',
  highlightFields: ['client_id', 'user_id', 'expires_at'],

diff --git a/packages/platform-objects/src/identity/sys-oauth-resource.object.ts b/packages/platform-objects/src/identity/sys-oauth-resource.object.ts
@@ -26,7 +26,7 @@ export const SysOauthResource = ObjectSchema.create({
  protection: {
  lock: 'full',
  reason: 'Identity table managed by better-auth — see ADR-0010.',
- docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+ docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
  },
  description: 'Registered OAuth protected resources (RFC 8707 resource indicators)',
  displayNameField: 'name',

diff --git a/packages/platform-objects/src/identity/sys-organization.object.ts b/packages/platform-objects/src/identity/sys-organization.object.ts
@@ -23,7 +23,7 @@ export const SysOrganization = ObjectSchema.create({
  protection: {
  lock: 'full',
  reason: 'Identity table managed by better-auth — see ADR-0010.',
- docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+ docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
  },
  description: 'Organizations for multi-tenant grouping',
  displayNameField: 'name',

diff --git a/packages/platform-objects/src/identity/sys-scim-provider.object.ts b/packages/platform-objects/src/identity/sys-scim-provider.object.ts
@@ -55,7 +55,7 @@ export const SysScimProvider = ObjectSchema.create({
  protection: {
  lock: 'full',
  reason: 'Identity table managed by better-auth (@better-auth/scim) — see ADR-0071.',
- docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+ docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
  },
  description: 'SCIM 2.0 connections (bearer tokens) external IdPs use to provision/deprovision this environment\'s users',
  displayNameField: 'provider_id',

diff --git a/packages/platform-objects/src/identity/sys-session.object.ts b/packages/platform-objects/src/identity/sys-session.object.ts
@@ -58,7 +58,7 @@ export const SysSession = ObjectSchema.create({
  protection: {
  lock: 'full',
  reason: 'Identity table managed by better-auth — see ADR-0010.',
- docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+ docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
  },
  description: 'Active user sessions',
  displayNameField: 'user_id',

diff --git a/packages/platform-objects/src/identity/sys-sso-provider.object.ts b/packages/platform-objects/src/identity/sys-sso-provider.object.ts
@@ -62,7 +62,7 @@ export const SysSsoProvider = ObjectSchema.create({
  protection: {
  lock: 'full',
  reason: 'Identity table managed by better-auth (@better-auth/sso) — see ADR-0024.',
- docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+ docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
  },
  description: 'External SSO identity providers (OIDC / SAML) this environment federates login to',
  displayNameField: 'provider_id',

diff --git a/packages/platform-objects/src/identity/sys-team-member.object.ts b/packages/platform-objects/src/identity/sys-team-member.object.ts
@@ -23,7 +23,7 @@ export const SysTeamMember = ObjectSchema.create({
  protection: {
  lock: 'full',
  reason: 'Identity table managed by better-auth — see ADR-0010.',
- docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+ docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
  },
  description: 'Team membership records linking users to teams',
  titleFormat: '{user_id} in {team_id}',

diff --git a/packages/platform-objects/src/identity/sys-team.object.ts b/packages/platform-objects/src/identity/sys-team.object.ts
@@ -23,7 +23,7 @@ export const SysTeam = ObjectSchema.create({
  protection: {
  lock: 'full',
  reason: 'Identity table managed by better-auth — see ADR-0010.',
- docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+ docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
  },
  description: 'Teams within organizations for fine-grained grouping',
  displayNameField: 'name',

diff --git a/packages/platform-objects/src/identity/sys-two-factor.object.ts b/packages/platform-objects/src/identity/sys-two-factor.object.ts
@@ -23,7 +23,7 @@ export const SysTwoFactor = ObjectSchema.create({
  protection: {
  lock: 'full',
  reason: 'Identity table managed by better-auth — see ADR-0010.',
- docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+ docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
  },
  description: 'Two-factor authentication credentials',
  titleFormat: 'Two-factor for {user_id}',

diff --git a/packages/platform-objects/src/identity/sys-user.object.ts b/packages/platform-objects/src/identity/sys-user.object.ts
@@ -33,7 +33,7 @@ export const SysUser = ObjectSchema.create({
  protection: {
  lock: 'full',
  reason: 'Identity table managed by better-auth — see ADR-0010.',
- docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+ docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
  },
  description: 'User accounts for authentication',
  displayNameField: 'name',

diff --git a/packages/platform-objects/src/identity/sys-verification.object.ts b/packages/platform-objects/src/identity/sys-verification.object.ts
@@ -29,7 +29,7 @@ export const SysVerification = ObjectSchema.create({
  protection: {
  lock: 'full',
  reason: 'Identity table managed by better-auth — see ADR-0010.',
- docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+ docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
  },
  description: 'Email and phone verification tokens',
  titleFormat: 'Verification for {identifier}',

diff --git a/packages/plugins/plugin-security/src/objects/sys-capability.object.ts b/packages/plugins/plugin-security/src/objects/sys-capability.object.ts
@@ -35,7 +35,7 @@ export const SysCapability = ObjectSchema.create({
  protection: {
  lock: 'no-overlay',
  reason: 'Capability registry schema is platform-defined — see ADR-0066 / ADR-0010.',
- docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+ docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
  },
  description: 'Authorization capability definitions (ADR-0066 D1). Referenced by name from permission-set systemPermissions and resource requiredPermissions.',
  displayNameField: 'label',

diff --git a/packages/plugins/plugin-security/src/objects/sys-permission-set.object.ts b/packages/plugins/plugin-security/src/objects/sys-permission-set.object.ts
@@ -24,7 +24,7 @@ export const SysPermissionSet = ObjectSchema.create({
  protection: {
  lock: 'no-overlay',
  reason: 'RBAC schema is platform-defined — see ADR-0010.',
- docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+ docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
  },
  description: 'Named permission groupings for fine-grained access control',
  displayNameField: 'label',

diff --git a/packages/plugins/plugin-security/src/objects/sys-position.object.ts b/packages/plugins/plugin-security/src/objects/sys-position.object.ts
@@ -30,7 +30,7 @@ export const SysPosition = ObjectSchema.create({
  protection: {
  lock: 'no-overlay',
  reason: 'RBAC schema is platform-defined — see ADR-0010.',
- docsUrl: 'https://docs.objectstack.ai/adr/0010-metadata-protection',
+ docsUrl: 'https://objectstack.ai/docs/references/shared/protection',
  },
  description: 'Position definitions for capability distribution (ADR-0090)',
  displayNameField: 'label',