From 5b8f2d881ae9b91c7d8796c8d031d894dc6e8dbe Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 1 Sep 2026 20:02:24 +0000
Subject: [PATCH 1/2] docs(adr): migrate rotted line anchors to resolver-gated
 symbol anchors (#13556)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The #13556 census enumerated every line anchor in `docs/adr/**` — 343 across
35 of the 134 records, plus 52 continuation anchors — and resolved each against
main. Excluding 4 HISTORICAL and 2 EXTERNAL, 243 of 337 live anchors were
broken: 72.1%, declared as a one-way LOWER bound. Rot tracked target-file CHURN
rather than record age: the four hottest targets were 100% broken across 50
anchors. A rotted line anchor does not fail — it silently points a reader at
unrelated code inside the document whose purpose is to be a durable record.

Maintainer ruling 2026-09-01 (总监批 #27), option A: migrate the corpus to
symbol anchors behind a resolver gate that reds on an absent symbol, in ONE
migration with no transition period, sharing a single resolver with #13788.

- `scripts/symbol-anchors.mjs` — the SHARED core: grammar, extractor and the
  resolution rule. A corpus is a `defineCorpus` registration, so #13788 joins
  by registering rather than by forking the resolver.
- `scripts/check-adr-symbol-anchors.mjs` — the `docs/adr/**` registration.
- 469 occurrences rewritten across 35 records: 188 became symbol anchors (173
  resolved at a declaration site, 15 as a quoted data identifier), 211 dropped
  to file level, 15 to cross-repo file level, 10 dead paths lost their number,
  24 duplicate or orphaned continuations were removed, and 6 HISTORICAL /
  EXTERNAL anchors carry an inline exemption marker.

Resolution is deliberately stricter than the census: comments are stripped
before matching, so a symbol named only in a comment does not resolve, and a
token that merely repeats the anchor's own path is refused. That strictness is
what confirms 72.1% was a floor — `object.zod.ts` was credited with
`stateMachines` by the census, and the only occurrence today is a comment
saying that map no longer exists.

Nine spellings of a line reference are recognised, three of which the census's
own extractor could not see: comma and slash lists, the trailing `+` form, bare
anchors in running prose, fenced comment headers, and the tilde form.

⛔ No ADR's decision content changes; only anchor form does. ADR-0113's Context
row is known to state the inverse of today's mechanism — carded as #14193,
deliberately NOT repaired here, with a note in the record pointing at it.

Refs #13556

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Mszp61SetNhQfVGvWh9bNn
---
 .github/workflows/lint.yml                    |  56 ++
 .../0005-metadata-customization-overlay.md    |   6 +-
 .../0015-external-datasource-federation.md    |   6 +-
 ...16-studio-package-authoring-and-publish.md |   2 +-
 docs/adr/0019-approval-as-flow-node.md        |   4 +-
 ...0020-state-machine-converge-and-enforce.md |  14 +-
 .../0021-analytics-dataset-semantic-layer.md  |   4 +-
 ...metadata-naming-and-namespace-isolation.md |  16 +-
 ...ship-and-platform-objects-decomposition.md | 128 ++--
 docs/adr/0032-unified-expression-layer.md     |  10 +-
 .../0049-no-unenforced-security-properties.md |  10 +-
 .../0052-audit-is-not-the-activity-feed.md    |  14 +-
 docs/adr/0053-date-and-datetime-semantics.md  |  34 +-
 ...0055-master-detail-controlled-by-parent.md |  14 +-
 ...6-permission-model-landing-verification.md |  26 +-
 ...ion-core-business-units-and-scope-depth.md |  52 +-
 docs/adr/0061-record-search-architecture.md   |   4 +-
 docs/adr/0065-sdui-styling-model.md           |  10 +-
 docs/adr/0070-package-first-authoring.md      |   4 +-
 .../0072-reference-scope-and-resolvability.md |  26 +-
 docs/adr/0079-record-display-name.md          |  46 +-
 docs/adr/0080-ai-authored-ui-jsx-source.md    |  10 +-
 ...-boundary-and-cross-package-composition.md |  60 +-
 .../0089-unify-visibility-predicate-naming.md |  20 +-
 ...96-execution-surface-identity-admission.md |  30 +-
 ...e-adjudicated-tiering-and-external-rung.md |  14 +-
 ...0104-field-runtime-value-shape-contract.md |  24 +-
 ...nancy-posture-and-first-class-org-scope.md |  28 +-
 .../0112-error-code-vocabulary-and-ledger.md  |  28 +-
 ...red-write-contract-vs-column-constraint.md |  20 +-
 .../0117-owning-business-unit-record-stamp.md |  16 +-
 docs/adr/0118-non-user-actor-contract.md      |  10 +-
 ...le-transactions-and-honest-atomic-batch.md |  28 +-
 ...6-packaged-metadata-customization-model.md |  20 +-
 ...che-invalidation-contract-and-ttl-bound.md |   8 +-
 ...lease-artifact-as-co-ownership-boundary.md |  78 +-
 package.json                                  |   1 +
 scripts/check-adr-symbol-anchors.mjs          | 241 ++++++
 scripts/symbol-anchors.mjs                    | 707 ++++++++++++++++++
 39 files changed, 1423 insertions(+), 406 deletions(-)
 create mode 100644 scripts/check-adr-symbol-anchors.mjs
 create mode 100644 scripts/symbol-anchors.mjs

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index b09e86486f..ba5645eb35 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -2148,6 +2148,62 @@ jobs:
       - name: ADR anchors + number uniqueness (governed code names its decision)
         run: pnpm check:adr-anchors
 
+      # #13556 ADR SYMBOL ANCHORS — the other direction of the same contract.
+      # `check:adr-anchors` above asks whether governed CODE still names its
+      # ADR; this asks whether an ADR's pointer INTO code still resolves.
+      #
+      # The census on #13556 enumerated every line anchor in docs/adr/** — 343
+      # across 35 records, plus 52 continuation anchors, a 395-anchor surface —
+      # and found 243 of 337 live anchors BROKEN: 72.1%, declared as a one-way
+      # LOWER bound because the census's own test accepted a symbol appearing
+      # in a comment. Rot tracked target-file CHURN, not ADR age: the four
+      # hottest targets were 100% broken across 50 anchors. A line number into
+      # a 16,000-line file has a lifetime measured in days, and it does not
+      # fail loudly — it silently points a reader at unrelated code.
+      #
+      # Maintainer ruling 2026-09-01 (总监批 #27), option A: migrate the whole
+      # corpus to symbol anchors with a resolver that reds on an absent symbol,
+      # in ONE migration with no transition period (「C 不作过渡」). That is why
+      # a surviving `path:NNN` is a hard finding rather than a warning here.
+      #
+      # ⭐ The mechanism is SHARED, by the same ruling (「共享同一个 resolver,
+      # ⛔ 不造第二套」): scripts/symbol-anchors.mjs holds the grammar, extractor
+      # and resolution rule, and this gate is a `defineCorpus` registration.
+      # #13788 (1,647 platform-checklist citations) joins by registering its own
+      # corpus — ⛔ not by forking the resolver.
+      #
+      # Invoked as `node` rather than a pnpm alias per the GATE INVOCATION IDIOM
+      # at the top of this file; the gate's own --self-test asserts BOTH lines
+      # below are present, so rewiring it silently reddens it.
+      #
+      # ⚠️ The two self-tests go through a `run_self_test` COLLECTOR, not a bare
+      # sequence. Under `bash -e` the first non-zero exit aborts the step, so a
+      # chained second self-test is neither green nor red — it never runs
+      # (#10814). The collector runs both unconditionally and fails at the end
+      # naming every one that broke.
+      - name: ADR symbol anchors resolve (no line numbers survive)
+        run: |
+          failed=""
+          run_self_test() {
+            echo "-- $*"
+            if "$@"; then
+              echo "PASS  $*"
+            else
+              echo "FAIL  $*"
+              failed="${failed}  $*"$'\n'
+            fi
+            return 0
+          }
+          run_self_test node scripts/symbol-anchors.mjs --self-test
+          run_self_test node scripts/check-adr-symbol-anchors.mjs --self-test
+          if [ -n "$failed" ]; then
+            echo ""
+            echo "ADR symbol-anchor self-tests — the following FAILED:"
+            printf "%s" "$failed"
+            exit 1
+          fi
+          node scripts/check-adr-symbol-anchors.mjs
+
       # NOTE: the standing platform test checklist (docs/qa/platform-checklist/)
       # is validated by `pnpm check:platform-checklist`, but by MAINTAINER
       # DECISION it is NOT wired into CI — it runs on a periodic manual cadence
diff --git a/docs/adr/0005-metadata-customization-overlay.md b/docs/adr/0005-metadata-customization-overlay.md
index 77ac9fa7c3..32f1c13cd6 100644
--- a/docs/adr/0005-metadata-customization-overlay.md
+++ b/docs/adr/0005-metadata-customization-overlay.md
@@ -77,8 +77,8 @@ Studio ships an in-browser editor for views and dashboards. Customers expect "Sa
 Until today, the runtime did not:
 
 1. `PUT /api/v1/meta/view/<name>` in **project-kernel mode** updated only the in-memory registry and returned `200 { success: true, message: "Saved to memory registry (project kernel — sys_metadata is control-plane only)" }`. The change vanished on restart.
-2. `GET /api/v1/meta/view/<name>` skipped `sys_metadata` entirely in project-kernel mode (`packages/objectql/src/protocol.ts:357`, `:369`).
-3. `loadMetaFromDb()` returned `{ loaded: 0 }` early in project-kernel mode (`:1230`), so even if rows existed they would never be hydrated.
+2. `GET /api/v1/meta/view/<name>` skipped `sys_metadata` entirely in project-kernel mode (`packages/metadata-protocol/src/protocol.ts#sys_metadata`).
+3. `loadMetaFromDb()` returned `{ loaded: 0 }` early in project-kernel mode (`#loadMetaFromDb`), so even if rows existed they would never be hydrated.
 
 Worse, a separate detour — Studio's "Duplicate View" calls `POST /api/v1/data/sys_view` — wrote rows to a **physical projection table** (`sys_view`, 21 flat columns) that has nothing to do with the metadata protocol path. The same applies to `sys_flow`, `sys_agent`, `sys_tool`, `sys_object`. Each of these tables duplicates a Zod schema already defined in `@objectstack/spec` (`ui/view.zod.ts`, `automation/flow.zod.ts`, etc.) and goes out of sync the moment the spec evolves.
 
@@ -330,7 +330,7 @@ Implementation (`packages/objectql/src/protocol.ts`):
 - `saveMetaItem` runs `safeParse`. On failure, throws an error with
   `code='invalid_metadata'`, `status=422`, and a structured `issues` array
   carrying `path/message/code` for each Zod issue. REST layer
-  (`packages/rest/src/rest-server.ts:973-979`) already propagates `status`
+  (`packages/rest/src/rest-server.ts`) already propagates `status`
   and `code` to the response.
 - The persisted document is the **original** `request.item`, NOT
   `parsed.data`. Studio attaches auxiliary fields (`isPinned`,
diff --git a/docs/adr/0015-external-datasource-federation.md b/docs/adr/0015-external-datasource-federation.md
index c41c5d8c17..9dc622686d 100644
--- a/docs/adr/0015-external-datasource-federation.md
+++ b/docs/adr/0015-external-datasource-federation.md
@@ -16,7 +16,7 @@ The protocol already includes:
 
 - `Datasource` (`packages/spec/src/data/datasource.zod.ts`) — connection
   + driver + capabilities (transactions, queryFilters, readOnly, …).
-- `Object.datasource` (`packages/spec/src/data/object.zod.ts:432`) — per-object
+- `Object.datasource` (`packages/spec/src/data/object.zod.ts#datasource`) — per-object
   routing key, defaulting to `'default'`.
 - `ISchemaDiffService` (`packages/spec/src/contracts/schema-diff-service.ts`) —
   introspect → diff → migration plan.
@@ -386,8 +386,8 @@ if (datasource.schemaMode !== 'managed') {
 }
 ```
 
-**Concretely** — `packages/drivers/driver-sql/src/sql-driver.ts:1064`
-and `:1084` (current `createTable` / `alterTable` call sites) gain a
+**Concretely** — `packages/drivers/driver-sql/src/sql-driver.ts`
+and `packages/drivers/driver-sql/src/sql-driver.ts` (current `createTable` / `alterTable` call sites) gain a
 guard at the top. The `applyMigrations` implementation (forthcoming
 in `service-migration` per ADR-0008) also calls this guard.
 
diff --git a/docs/adr/0016-studio-package-authoring-and-publish.md b/docs/adr/0016-studio-package-authoring-and-publish.md
index 0fd9e2e182..c28e0530c2 100644
--- a/docs/adr/0016-studio-package-authoring-and-publish.md
+++ b/docs/adr/0016-studio-package-authoring-and-publish.md
@@ -42,7 +42,7 @@ authoring loop:
 
 But the **authoring → publish closed loop is not yet implemented**. Today:
 
-1. Studio create/edit (`ResourceEditPage.tsx:733`) calls
+1. Studio create/edit (`objectui:ResourceEditPage.tsx`) calls
    `client.save(type, name, item, { force, mode:'draft' })` with **no
    `packageId`**. Per ADR-0003 this produces a **runtime/overlay** row
    (`env_id` set, `package_id` NULL, loaded under sentinel `'sys_metadata'`,
diff --git a/docs/adr/0019-approval-as-flow-node.md b/docs/adr/0019-approval-as-flow-node.md
index bd28228ed9..e9691a9357 100644
--- a/docs/adr/0019-approval-as-flow-node.md
+++ b/docs/adr/0019-approval-as-flow-node.md
@@ -27,7 +27,7 @@ The platform is not launched; there is no production approval data and no legacy
 ADR-0018 §Context argued — correctly — that *multiple authoring paradigms are fine; multiple execution vocabularies are not*. Approval is where that line is currently crossed at the **engine** level, not just the vocabulary level:
 
 - `@objectstack/plugin-approvals` is ~1500 LOC of runtime: an 816-line `approval-service.ts` state machine, a **313-line parallel `action-executor.ts`**, 250-line lifecycle hooks, and a 128-line plugin.
-- The contract is explicit that this is a separate engine: [`spec/contracts/approval-service.ts:11`](../../packages/spec/src/contracts/approval-service.ts#L11) — *"Sits on top of (but does not depend on) `IWorkflowService` … driven by humans rather than transition rules."*
+- The contract is explicit that this is a separate engine: [`packages/spec/src/contracts/approval-service.ts`](../../packages/spec/src/contracts/approval-service.ts) — *"Sits on top of (but does not depend on) `IWorkflowService` … driven by humans rather than transition rules."*
 - The parallel `action-executor.ts` re-implements `field_update` / `inbox_notify` / `webhook` and carries the **same** `connector_action` / `script` / `email_alert` "unimplemented, logged + skipped" stubs that ADR-0018 set out to retire.
 - It has its **own** ADR-0009 execution pinning (`process_hash` → `getByHash`), parallel to Flow's.
 - It registers its own lifecycle hooks: `afterInsert` auto-trigger, `beforeUpdate` record-lock ([`plugin-approvals/src/lifecycle-hooks.ts`](../../packages/plugins/plugin-approvals/src/lifecycle-hooks.ts)).
@@ -68,7 +68,7 @@ There is **one** execution loop: the Flow engine. The engine core owns a generic
 The Approval node is registered through the **ADR-0018 open registry** (`registerNodeExecutor`), by a slimmed-down approval plugin — **not** baked into `service-automation` core. Rationale:
 
 - It is the ADR-0018 thesis applied to ourselves: the engine is the substrate, capabilities are contributed nodes.
-- **Layering.** Approver resolution depends on the org / sharing model — `sys_team`, `sys_department` (recursive BFS), `sys_user.manager_id`, `sys_department_member` ([`plugin-approvals/src/approval-service.ts:175`](../../packages/plugins/plugin-approvals/src/approval-service.ts#L175)). The Flow engine core must **not** depend on the org model; the approval plugin may. So approval cannot live in core.
+- **Layering.** Approver resolution depends on the org / sharing model — `sys_team`, `sys_department` (recursive BFS), `sys_user.manager_id`, `sys_department_member` ([`packages/plugins/plugin-approvals/src/approval-service.ts#sys_team`](../../packages/plugins/plugin-approvals/src/approval-service.ts)). The Flow engine core must **not** depend on the org model; the approval plugin may. So approval cannot live in core.
 - `service-automation` stays lean; approval becomes a well-behaved node provider that rides the engine instead of a parallel engine.
 
 ### D3 — Deprecate `ApprovalProcessSchema` as a top-level authoring type; re-home its concepts
diff --git a/docs/adr/0020-state-machine-converge-and-enforce.md b/docs/adr/0020-state-machine-converge-and-enforce.md
index 475bebe72d..6261ae62fb 100644
--- a/docs/adr/0020-state-machine-converge-and-enforce.md
+++ b/docs/adr/0020-state-machine-converge-and-enforce.md
@@ -34,22 +34,22 @@ The design intent is a **runtime guardrail**: declare which `status` transitions
 
 | # | Where | Schema | Reference |
 |---|-------|--------|-----------|
-| 1 | Top-level `workflow` metadata type | `StateMachineSchema` (XState-style: hierarchical/parallel states, entry/exit actions, guards, context) | [`metadata-type-schemas.ts:85`](../../packages/spec/src/kernel/metadata-type-schemas.ts#L85), [`metadata-plugin.zod.ts:90`](../../packages/spec/src/kernel/metadata-plugin.zod.ts#L90), [`metadata-plugin.zod.ts:612`](../../packages/spec/src/kernel/metadata-plugin.zod.ts#L612) |
-| 2 | Object-embedded | `object.stateMachines: Record<string, StateMachineSchema>` ("parallel lifecycles: status, payment, approval") | [`object.zod.ts:534`](../../packages/spec/src/data/object.zod.ts#L534) |
-| 3 | Validation rule | `state_machine` rule: `transitions: { fromState: [toStates] }` | [`validation.zod.ts:105`](../../packages/spec/src/data/validation.zod.ts#L105) |
+| 1 | Top-level `workflow` metadata type | `StateMachineSchema` (XState-style: hierarchical/parallel states, entry/exit actions, guards, context) | [`packages/spec/src/kernel/metadata-type-schemas.ts`](../../packages/spec/src/kernel/metadata-type-schemas.ts), [`packages/spec/src/kernel/metadata-plugin.zod.ts`](../../packages/spec/src/kernel/metadata-plugin.zod.ts) |
+| 2 | Object-embedded | `object.stateMachines: Record<string, StateMachineSchema>` ("parallel lifecycles: status, payment, approval") | [`packages/spec/src/data/object.zod.ts`](../../packages/spec/src/data/object.zod.ts) |
+| 3 | Validation rule | `state_machine` rule: `transitions: { fromState: [toStates] }` | [`packages/spec/src/data/validation.zod.ts#transitions`](../../packages/spec/src/data/validation.zod.ts) |
 
 **Zero enforcement — verified across `packages/{runtime,objectql,services,core,metadata*,plugins}` and the whole repo:**
 
-- `IWorkflowService` (`packages/spec/src/contracts/workflow-service.ts:58` — unlinked: the contract file was deleted on 2026-08-01 by #4451 / #4473, which retired the `workflow` service slot outright, closing the follow-up this record left open below) has **no concrete implementation**.
+- `IWorkflowService` (`packages/spec/src/contracts/workflow-service.ts:58` <!-- anchor-exempt: HISTORICAL --> — unlinked: the contract file was deleted on 2026-08-01 by #4451 / #4473, which retired the `workflow` service slot outright, closing the follow-up this record left open below) has **no concrete implementation**.
 - There is **no XState interpreter** anywhere (no `createMachine` / `interpret` / transition engine).
 - The write-path validator [`validateRecord`](../../packages/objectql/src/validation/record-validator.ts#L198) reads only `objectSchema.fields` and validates **field data types** (string/number/date/…). It **never reads `objectSchema.validations`** at all — so *not one* of the nine validation-rule types (`state_machine`, `cross_field`, `script`, `unique`, `format`, `json_schema`, `async`, `custom`, `conditional`) is enforced by it.
 - **Nothing reads `object.stateMachines`.**
 
-So the guardrail goal is currently unmet at runtime. The only artefacts that exist are declarations — e.g. `examples/app-crm/src/workflows/stale-opportunity.workflow.ts:19` (`StateMachineConfig`; unlinked — this file describes the pre-ADR state and was itself removed by this record's own implementation, see the checklist below), which additionally **mixes orchestration into the machine** (it carries `email_alert` / `task_creation` actions that no engine executes — that orchestration belongs to a record-triggered Flow per ADR-0019).
+So the guardrail goal is currently unmet at runtime. The only artefacts that exist are declarations — e.g. `examples/app-crm/src/workflows/stale-opportunity.workflow.ts:19` <!-- anchor-exempt: HISTORICAL --> (`StateMachineConfig`; unlinked — this file describes the pre-ADR state and was itself removed by this record's own implementation, see the checklist below), which additionally **mixes orchestration into the machine** (it carries `email_alert` / `task_creation` actions that no engine executes — that orchestration belongs to a record-triggered Flow per ADR-0019).
 
 #### The prior-state plumbing gap (the real implementation constraint)
 
-A transition check needs **both** the prior and the new state. But the write path can't supply the prior state today: on update, [`engine.ts:1850`](../../packages/objectql/src/engine.ts#L1850) calls `validateRecord(schema, hookContext.input.data, 'update')` — passing only the **PATCH payload**, not the prior record. On `PATCH { status: 'done' }` there is no way to know the *from*-state without a read. So enforcing `state_machine` is not just "add a dispatch branch"; it requires **plumbing the prior (or merged) record into the rule-evaluation step**. This is a shared need: `cross_field` and `script` rules are equally crippled by receiving only the patch — so the fix should land **once for the whole `validations` union**, not as a `state_machine`-only patch (see D3).
+A transition check needs **both** the prior and the new state. But the write path can't supply the prior state today: on update, [`packages/objectql/src/engine.ts#validateRecord`](../../packages/objectql/src/engine.ts) calls `validateRecord(schema, hookContext.input.data, 'update')` — passing only the **PATCH payload**, not the prior record. On `PATCH { status: 'done' }` there is no way to know the *from*-state without a read. So enforcing `state_machine` is not just "add a dispatch branch"; it requires **plumbing the prior (or merged) record into the rule-evaluation step**. This is a shared need: `cross_field` and `script` rules are equally crippled by receiving only the patch — so the fix should land **once for the whole `validations` union**, not as a `state_machine`-only patch (see D3).
 
 ### The design-center shift: AI is the author — optimise naming for the model's priors
 
@@ -84,7 +84,7 @@ The introspectability is the upgrade that serves the two design centers: **UI**
 
 ### Where it lives: one of nine validation-rule types
 
-`state_machine` is one variant of the `ValidationRuleSchema` discriminated union ([`validation.zod.ts:362`](../../packages/spec/src/data/validation.zod.ts#L362)), alongside `script`, `unique`, `format`, `cross_field`, `json_schema`, `async`, `custom`, and `conditional`. It shares `BaseValidationSchema` (name/label/message/severity) and the same write-time enforcement semantics as its siblings. This is *why it stays in `validations`* (D1) rather than becoming a standalone metadata type or file: it is, precisely, a write-time validation whose payload happens to be a transition graph.
+`state_machine` is one variant of the `ValidationRuleSchema` discriminated union ([`packages/spec/src/data/validation.zod.ts#ValidationRuleSchema`](../../packages/spec/src/data/validation.zod.ts)), alongside `script`, `unique`, `format`, `cross_field`, `json_schema`, `async`, `custom`, and `conditional`. It shares `BaseValidationSchema` (name/label/message/severity) and the same write-time enforcement semantics as its siblings. This is *why it stays in `validations`* (D1) rather than becoming a standalone metadata type or file: it is, precisely, a write-time validation whose payload happens to be a transition graph.
 
 ## Decision
 
diff --git a/docs/adr/0021-analytics-dataset-semantic-layer.md b/docs/adr/0021-analytics-dataset-semantic-layer.md
index f545eae0fa..cda80e86cc 100644
--- a/docs/adr/0021-analytics-dataset-semantic-layer.md
+++ b/docs/adr/0021-analytics-dataset-semantic-layer.md
@@ -11,7 +11,7 @@
 
 ## TL;DR
 
-The platform's **query *schema*** (`QuerySchema`, [`query.zod.ts:586`](../../packages/spec/src/data/query.zod.ts#L586)) already *describes* `joins` (inner/left/right/full + strategies + subquery + cross-datasource), `aggregations`, `groupBy` (with date bucketing), `having`, and `windowFunctions`.
+The platform's **query *schema*** (`QuerySchema`, [`packages/spec/src/data/query.zod.ts#QuerySchema`](../../packages/spec/src/data/query.zod.ts)) already *describes* `joins` (inner/left/right/full + strategies + subquery + cross-datasource), `aggregations`, `groupBy` (with date bucketing), `having`, and `windowFunctions`.
 
 > **Correction (revised 2026-05-31).** An implementation scan found the *runtime* does **not** match the schema: `groupBy` + `aggregations` execute (single-object only), but `joins` / `having` / `windowFunctions` are **schema-only — not executed** by `IDataEngine` or the SQL driver. A separate, already-implemented **Cube semantic layer** (`IAnalyticsService` + `CubeSchema`) is the *only* path that emits cross-object joins today (and it bypasses RLS/tenant). This reframes the work and the naming — see the "Implementation scan" section. The decisions below stand; the cost and the build-vs-reuse choice change.
 
@@ -357,7 +357,7 @@ So "revenue by `account.region`" — the headline dataset use case — **cannot
 
 ### Finding 2 — a parallel semantic layer already exists (must reconcile)
 
-`data/analytics.zod.ts` `CubeSchema` + `contracts/analytics-service.ts` `IAnalyticsService` are **implemented** (`AnalyticsService` in `service-analytics`, `MemoryAnalyticsService` in `driver-memory`): a Cube.io-style `{ measures, dimensions, timeDimensions }` layer — conceptually the same "semantic layer" this ADR proposes. Its `NativeSQLStrategy` is the **only** code that emits cross-object `LEFT JOIN` (single-hop), but via raw `engine.execute()` which **bypasses the sharing-middleware RLS and tenant isolation** ([`engine.ts:2077`](../../packages/objectql/src/engine.ts#L2077) warns explicitly). It loads opt-in (`requires: ['analytics']`), and its grammar is **disjoint from `QuerySchema`** — nothing compiles `QuerySchema.joins/having/window` to execution.
+`data/analytics.zod.ts` `CubeSchema` + `contracts/analytics-service.ts` `IAnalyticsService` are **implemented** (`AnalyticsService` in `service-analytics`, `MemoryAnalyticsService` in `driver-memory`): a Cube.io-style `{ measures, dimensions, timeDimensions }` layer — conceptually the same "semantic layer" this ADR proposes. Its `NativeSQLStrategy` is the **only** code that emits cross-object `LEFT JOIN` (single-hop), but via raw `engine.execute()` which **bypasses the sharing-middleware RLS and tenant isolation** ([`packages/objectql/src/engine.ts`](../../packages/objectql/src/engine.ts) warns explicitly). It loads opt-in (`requires: ['analytics']`), and its grammar is **disjoint from `QuerySchema`** — nothing compiles `QuerySchema.joins/having/window` to execution.
 
 **Implication:** do not build a *third* semantic layer. Either (b) adopt/extend Cube as the dataset, or (c) compile `dataset` → `AnalyticsQuery` and reuse the Cube runtime (then harden its RLS/tenant). Both are far cheaper than teaching `IDataEngine` to join.
 
diff --git a/docs/adr/0028-metadata-naming-and-namespace-isolation.md b/docs/adr/0028-metadata-naming-and-namespace-isolation.md
index 48c2ef5190..682e8e34ff 100644
--- a/docs/adr/0028-metadata-naming-and-namespace-isolation.md
+++ b/docs/adr/0028-metadata-naming-and-namespace-isolation.md
@@ -63,16 +63,16 @@ unmanaged for everything except objects.
 
 | Area | Finding | Location |
 |:--|:--|:--|
-| Prefix enforcement | `validateNamespacePrefix()` iterates **only `config.objects`** (`if (!ns || !config.objects) return`). The other ~23 collections are unchecked. | `spec/src/stack.zod.ts:459` |
-| Authoring style | Object names are the **hand-written full literal** `crm_account`; docs explicitly forbid a `ns('task')` helper. | `spec/src/kernel/manifest.zod.ts:28-76` |
-| Storage chokepoint | `StorageNameMapping.resolveTableName({name})` already exists, but is a **pass-through** (`todo_task → todo_task`, strips legacy `__`). Every SQL driver routes table names through it. | `spec/src/system/constants/system-names.ts:169`; `driver-sql/src/sql-driver.ts:610,1028` |
+| Prefix enforcement | `validateNamespacePrefix()` iterates **only `config.objects`** (`if (!ns || !config.objects) return`). The other ~23 collections are unchecked. | `packages/spec/src/stack.zod.ts#validateNamespacePrefix` |
+| Authoring style | Object names are the **hand-written full literal** `crm_account`; docs explicitly forbid a `ns('task')` helper. | `packages/spec/src/kernel/manifest.zod.ts` |
+| Storage chokepoint | `StorageNameMapping.resolveTableName({name})` already exists, but is a **pass-through** (`todo_task → todo_task`, strips legacy `__`). Every SQL driver routes table names through it. | `packages/spec/src/system/constants/system-names.ts#StorageNameMapping`; `packages/drivers/driver-sql/src/sql-driver.ts` |
 | Object identity | `MetaRef = (org, type, name)` and `SchemaRegistry` already model ownership + namespace. | `metadata-core/src/types.ts`; `objectql/src/registry.ts` |
-| Ownership model | `own`/`extend` fully implemented: one owner enforced (`throw`), extenders merge by `priority` (owner 100, extender 200). **No package actually extends a `sys_` object today.** | `objectql/src/registry.ts:406-518`; `object.zod.ts:856-897` |
-| Connector collisions | Re-registering a connector name only `logger.warn('… replaced')` then overwrites — **silent last-wins**. | `services/service-automation/src/engine.ts:441` |
+| Ownership model | `own`/`extend` fully implemented: one owner enforced (`throw`), extenders merge by `priority` (owner 100, extender 200). **No package actually extends a `sys_` object today.** | `packages/objectql/src/registry.ts`; `packages/spec/src/data/object.zod.ts` |
+| Connector collisions | Re-registering a connector name only `logger.warn('… replaced')` then overwrites — **silent last-wins**. | `packages/services/service-automation/src/engine.ts` |
 | API routes | Route conflict detection exists with 4 strategies, but matches routes by **exact string** (`:id` vs `:userId` not detected). | `core/src/api-registry.ts` |
-| Kernel namespace | `sys` is a **shared** namespace co-claimed by ~14 packages (`namespaceRegistry: Map<ns, Set<pkgId>>`); `RESERVED_NAMESPACES = {'base','system'}` does **not** include `sys`. | `objectql/src/registry.ts:13,346-389` |
+| Kernel namespace | `sys` is a **shared** namespace co-claimed by ~14 packages (`namespaceRegistry: Map<ns, Set<pkgId>>`); `RESERVED_NAMESPACES = {'base','system'}` does **not** include `sys`. | `packages/objectql/src/registry.ts#RESERVED_NAMESPACES` |
 | Kernel definitions | All `sys_*` objects are in fact **defined centrally in `platform-objects`**, even though `plugin-auth`/`service-job`/`service-settings` manifests each declare `namespace:'sys'` — ownership *declaration* is split from *definition*. | `platform-objects/src/**` |
-| Boundary enforcement | "Apps may reference `sys_*` but never define them" is **documented intent only** — no validator enforces it; the `sys_` check only *exempts*, it does not *forbid*. | `manifest.zod.ts:66-70` |
+| Boundary enforcement | "Apps may reference `sys_*` but never define them" is **documented intent only** — no validator enforces it; the `sys_` check only *exempts*, it does not *forbid*. | `packages/spec/src/kernel/manifest.zod.ts` |
 | Kernel cross-refs | ~60 lookup fields across identity/audit/security/metadata/system (and `service-ai`'s `ai_conversations.user_id`) point at the **hub objects `sys_user` / `sys_organization`**. | scan, see §"Why unified" |
 
 ### How mainstream metadata/low-code platforms name things
@@ -240,7 +240,7 @@ reference target. It is:
   packages claiming the same namespace** — already modeled by
   `NamespaceConflictError`. Catches binary artifacts that bypass `defineStack`.
 - **Runtime registries** unify their duplicate semantics: the connector registry
-  stops silently overwriting (`engine.ts:441`) and uses the same conflict policy
+  stops silently overwriting (`packages/services/service-automation/src/engine.ts`) and uses the same conflict policy
   as objects/routes.
 
 ---
diff --git a/docs/adr/0029-kernel-object-ownership-and-platform-objects-decomposition.md b/docs/adr/0029-kernel-object-ownership-and-platform-objects-decomposition.md
index 066880a140..5516d832b6 100644
--- a/docs/adr/0029-kernel-object-ownership-and-platform-objects-decomposition.md
+++ b/docs/adr/0029-kernel-object-ownership-and-platform-objects-decomposition.md
@@ -52,12 +52,12 @@ The codebase scan found the kernel is a monolith with split ownership:
 | Finding | Evidence |
 |:--|:--|
 | **All `sys_*` objects are defined in `platform-objects`** — identity, audit, security, metadata, system domains. | `platform-objects/src/{identity,audit,security,metadata,system}/**` |
-| Plugins **declare** `namespace:'sys'`, `scope:'system'` but **define no objects** — the data model lives in `platform-objects`. | `plugin-auth/src/manifest.ts:58-67`; `service-job`, `service-settings` manifests |
-| `sys` is a **shared** namespace co-claimed by ~14 packages with no arbiter at the namespace level. | `objectql/src/registry.ts:346-389` (`namespaceRegistry: Map<ns, Set<pkgId>>`) |
-| The `own`/`extend` ownership model is fully implemented: **one owner per object** (second `own` throws), extenders merge by `priority` (owner 100, extender 200). **No package extends a `sys_` object today.** | `objectql/src/registry.ts:406-518`; `object.zod.ts:856-897` |
+| Plugins **declare** `namespace:'sys'`, `scope:'system'` but **define no objects** — the data model lives in `platform-objects`. | `packages/plugins/plugin-auth/src/manifest.ts#namespace`; `service-job`, `service-settings` manifests |
+| `sys` is a **shared** namespace co-claimed by ~14 packages with no arbiter at the namespace level. | `packages/objectql/src/registry.ts#namespaceRegistry` (`namespaceRegistry: Map<ns, Set<pkgId>>`) |
+| The `own`/`extend` ownership model is fully implemented: **one owner per object** (second `own` throws), extenders merge by `priority` (owner 100, extender 200). **No package extends a `sys_` object today.** | `packages/objectql/src/registry.ts`; `packages/spec/src/data/object.zod.ts` |
 | ~60 lookup fields converge on the **hub objects `sys_user` / `sys_organization`**, referenced from every domain (incl. `service-ai`'s `ai_conversations.user_id`). | scan |
-| `RESERVED_NAMESPACES = {'base','system'}` — `sys` is **not** reserved. "Apps may reference but never define `sys_*`" is documented intent with **no enforcing validator**. | `registry.ts:13`; `manifest.zod.ts:66-70` |
-| `scope: cloud\|system\|project` and `managedBy: platform\|config\|system\|append-only\|better-auth` already mark system data. | `manifest.zod.ts:133`; `object.zod.ts:354-385` |
+| `RESERVED_NAMESPACES = {'base','system'}` — `sys` is **not** reserved. "Apps may reference but never define `sys_*`" is documented intent with **no enforcing validator**. | `packages/objectql/src/registry.ts#RESERVED_NAMESPACES`; `packages/spec/src/kernel/manifest.zod.ts` |
+| `scope: cloud\|system\|project` and `managedBy: platform\|config\|system\|append-only\|better-auth` already mark system data. | `packages/spec/src/kernel/manifest.zod.ts`; `packages/spec/src/data/object.zod.ts#managedBy` |
 | The **`setup` admin app is a static monolith** that hard-references every `sys_*` object as nav entries — and its own comment notes it was made static *because* the objects were centralized (the older `@objectstack/plugin-setup` that assembled it at runtime was deleted). | `platform-objects/src/apps/setup.app.ts` |
 | `manifest.contributes.menus` exists in the schema but is **consumed nowhere** — a vestigial, unimplemented contribution point. No app-navigation merge / `appExtensions` analog to `objectExtensions` exists. | `manifest.zod.ts` (`contributes.menus`); no consumer found |
 
@@ -350,20 +350,20 @@ is unchanged. What changes is that a tenant overlay stops *borrowing* that slot.
 ### 1. What the code does today, measured
 
 An object's registry entry is a list of `ObjectContributor`s keyed by name
-(`packages/objectql/src/registry.ts:38-44`), and `registerObject` accepts exactly
-two kinds — `own` and `extend` (`:1070-1075`, the vocabulary at
-`packages/spec/src/data/object.zod.ts:2435`).
+(`packages/objectql/src/registry.ts#registerObject`), and `registerObject` accepts exactly
+two kinds — `own` and `extend` (`packages/objectql/src/registry.ts`, the vocabulary at
+`packages/spec/src/data/object.zod.ts`).
 
 A tenant overlay of an `object` reaches that verb through two seams, and both
 pass **two arguments only**, so `ownership` takes its default `'own'`:
 
 | seam | call | when |
 |:--|:--|:--|
-| `applyObjectRegistryMutation` | `packages/metadata-protocol/src/protocol.ts:7897-7911` | every `saveMetaItem` write-through |
-| `loadMetaFromDb` | `packages/metadata-protocol/src/protocol.ts:11670-11673` | **every boot**, no authorization gate |
+| `applyObjectRegistryMutation` | `packages/metadata-protocol/src/protocol.ts#applyObjectRegistryMutation` | every `saveMetaItem` write-through |
+| `loadMetaFromDb` | `packages/metadata-protocol/src/protocol.ts#loadMetaFromDb` | **every boot**, no authorization gate |
 
 When the row's `package_id` equals the packaged owner's id, `registerObject`
-takes the re-registration branch at `registry.ts:1157-1160` and **splices the
+takes the re-registration branch at `packages/objectql/src/registry.ts#registerObject` and **splices the
 packaged contributor out of the list**. The packaged definition is *destroyed at
 write time* — it is not shadowed, and no second copy exists anywhere in the
 registry. Four consequences follow, all measured end-to-end in the 08:12Z report
@@ -375,24 +375,24 @@ on #6853 (P0-P6) and re-read in the source here:
 2. **It re-happens on every boot** (P6), through `loadMetaFromDb`, silently:
    `{"loaded":1,"errors":0,"invalid":0}` with no warning.
 3. **`isArtifactBacked` starts lying.** It asks `getArtifactItem('object', …)`
-   (`protocol.ts:7535-7540`), whose object branch resolves the **merged** object
-   and rejects it when `_provenance === 'org'` (`registry.ts:1727-1733`, predicate
-   at `:844-846`). Since the overlay is now the *owner*, the merged body carries
+   (`packages/metadata-protocol/src/protocol.ts#isArtifactBacked`), whose object branch resolves the **merged** object
+   and rejects it when `_provenance === 'org'` (`packages/objectql/src/registry.ts`, predicate
+   at `packages/objectql/src/registry.ts`). Since the overlay is now the *owner*, the merged body carries
    the tenant's provenance, so the predicate answers `false` for a name a code
    package still ships.
 4. **Two gates that read that predicate silently disarm.** `saveMetaItem`'s
-   two-tier gate (`protocol.ts:8460-8472`) stops refusing — `object` declares
+   two-tier gate (`packages/metadata-protocol/src/protocol.ts`) stops refusing — `object` declares
    `allowOrgOverride: false, allowRuntimeCreate: true`
-   (`packages/spec/src/kernel/metadata-plugin.zod.ts:628`), so the *first* write
+   (`packages/spec/src/kernel/metadata-plugin.zod.ts#allowOrgOverride`), so the *first* write
    is refused and every later one is admitted through the wrong tier. And tier 3
-   of `restoreArtifactRegistryView` (`protocol.ts:8259-8272`), whose comment says
+   of `restoreArtifactRegistryView` (`packages/metadata-protocol/src/protocol.ts#restoreArtifactRegistryView`), whose comment says
    in as many words that it never retires a code-shipped object, fires:
    `objectContributors` goes empty, `getObject` answers `null`, and data CRUD
    404s on a table the package still ships, until the process restarts (P3/P6).
 
 A fifth shape belongs to the same mechanism. When the row's `package_id`
-**differs** from the packaged owner's, the ownership rule at `:1149-1155` throws,
-the throw is caught and `console.warn`-ed at `protocol.ts:7906-7910`, and
+**differs** from the packaged owner's, the ownership rule at `#package_id` throws,
+the throw is caught and `console.warn`-ed at `packages/metadata-protocol/src/protocol.ts`, and
 `saveMetaItem` still reports success — the write-side silent discard filed as
 [#6995](https://github.com/objectstack-ai/objectstack/issues/6995), which the
 ruling requires this model to answer (§ D9.6).
@@ -407,13 +407,13 @@ layer's body as a replay of the same one.
 The borrowed slot carries authority the overlay measurably never uses:
 
 - **It claims no namespace.** `registerObject` calls `registerNamespace` only when
-  a namespace argument is passed (`:1136-1138`); both overlay seams pass none, so
+  a namespace argument is passed (`packages/metadata-protocol/src/protocol.ts`); both overlay seams pass none, so
   `namespaceRegistry` keeps the package's entry. What the splice *does* destroy is
   the owner contributor's own `namespace` field (measured `''` where the package
   had `'myapp'`, P5) — inert today only because `computeFQN` is identity
-  (`:61-63`).
+  (`#packageId`).
 - **It does not decide package membership.** `getAllObjects(packageId)` matches
-  *any* contribution's `packageId` (`:1307`), owner or not.
+  *any* contribution's `packageId` (`#packageId`), owner or not.
 - **It owns no table.** The physical table is the packaged owner's, created by
   its schema sync; an overlay's new fields ride ADR-0045 additive materialization.
 
@@ -427,20 +427,20 @@ question, and D9 answers it as one.
 #### D9.1 — a third contributor kind, loader-set and never authorable
 
 `ObjectContributor.ownership` gains `'overlay'`, and the vocabulary
-`ObjectOwnershipEnum` (`packages/spec/src/data/object.zod.ts:2435`) gains it too
+`ObjectOwnershipEnum` (`packages/spec/src/data/object.zod.ts#ObjectOwnershipEnum`) gains it too
 — one vocabulary, not a parallel list (Prime Directive #8).
 
 That enum is **loader-facing, not author-facing**, and this amendment binds it to
 stay that way. Measured: `ObjectOwnershipEnum` has no runtime consumer at all in
 this repo (`registry.ts` imports only the `ObjectOwnership` *type*), and the two
 existing kinds are set at exactly three call sites — `own` by the package loader
-(`packages/objectql/src/engine.ts:2920`, `:2933`, `:3147`, `:3157`) and `extend`
-by the `objectExtensions` loop (`engine.ts:2956`, priority from the manifest
+(`packages/objectql/src/engine.ts`, `packages/objectql/src/engine.ts`, `packages/objectql/src/engine.ts`, `packages/objectql/src/engine.ts`) and `extend`
+by the `objectExtensions` loop (`packages/objectql/src/engine.ts`, priority from the manifest
 entry). No author ever writes `ownership: 'own'`; a package author declares
 `objectExtensions: [{ extend: '…' }]` and the loader picks the kind. `'overlay'`
 is therefore set by the two hydration seams and by nothing else, and the enum's
 docblock must say so alongside the existing warning that separates it from the
-record-`ownership` model (`object.zod.ts:1385-1392`).
+record-`ownership` model (`packages/spec/src/data/object.zod.ts#ownership`).
 
 This is the "hard to get wrong" property doing real work: the new kind adds **no
 authoring surface**, so no hand-written or AI-written metadata can reach for it,
@@ -448,7 +448,7 @@ correctly or otherwise.
 
 #### D9.2 — resolution: the overlay replaces the BASE layer; extenders still fold on top
 
-`resolveObject` (`registry.ts:1206-1234`) selects its base layer as
+`resolveObject` (`packages/objectql/src/registry.ts#resolveObject`) selects its base layer as
 `overlay ?? owner` instead of `owner`, then folds `extend` contributions exactly
 as it does today.
 
@@ -463,8 +463,8 @@ That is the argument for replace-semantics over the two alternatives, and it is
 the one the ruling asked for:
 
 - **Overlay as `extend` is refused.** `mergeObjectDefinitions` merges fields
-  additively (`registry.ts:86-108`; `merged.fields = { ...base.fields,
-  ...extension.fields }` at `:91`) and has no expression for *removal* at all.
+  additively (`packages/objectql/src/registry.ts#mergeObjectDefinitions`; `merged.fields = { ...base.fields,
+  ...extension.fields }` at `packages/objectql/src/registry.ts`) and has no expression for *removal* at all.
   An overlay that drops a packaged field would silently stop dropping it — the
   measured overlay body carried `overlay_only` and neither `amount` nor
   `packaged_only`; as an extender the resolved object would carry all three.
@@ -536,21 +536,21 @@ Binding consequences:
 
 #### D9.3 — selection is by KIND; priority stays descriptive
 
-`contributors.sort((a, b) => a.priority - b.priority)` (`:1189`) totals the whole
+`contributors.sort((a, b) => a.priority - b.priority)` (`#contributors`) totals the whole
 list, so the overlay needs a priority for deterministic ordering:
 `DEFAULT_OVERLAY_PRIORITY = 150`, between `DEFAULT_OWNER_PRIORITY = 100` and
-`DEFAULT_EXTENDER_PRIORITY = 200` (`:31-32`), so a `getObjectContributors()` read
+`DEFAULT_EXTENDER_PRIORITY = 200` (`#getObjectContributors`), so a `getObjectContributors()` read
 lists the stack in layer order.
 
 It is **not** the selection rule. Base selection asks the kind, never "highest
 priority wins", because extender priority is author-declared (`ext.priority ?? 200`,
-`engine.ts:2944`) and a package could otherwise re-rank a tenant's overlay by
+`packages/objectql/src/engine.ts`) and a package could otherwise re-rank a tenant's overlay by
 declaring `priority: 140`. Declared numbers order *peers*; they must not be able
 to change *which layer is the base*.
 
 #### D9.4 — `computeFQN` is untouched, and the namespace loss is repaired for free
 
-`computeFQN` is identity (`:61-63`); the overlay layer shares the owner's key and
+`computeFQN` is identity (`packages/objectql/src/engine.ts`); the overlay layer shares the owner's key and
 this amendment introduces **no namespace dimension** — an overlay is a layer over
 one object name, not a second object. The measured namespace loss (P5) is not
 fixed by a rule but by subtraction: the packaged owner's contributor is no longer
@@ -560,7 +560,7 @@ overlay slot per object, unchanged.
 
 #### D9.5 — `assertSingleOwnerPerObject` is unchanged, and gains one violation class
 
-`assertSingleOwnerPerObject` (`:1355-1379`) counts `ownership === 'own'`. Overlays
+`assertSingleOwnerPerObject` (`packages/objectql/src/engine.ts`) counts `ownership === 'own'`. Overlays
 are not owners, so it keeps reading exactly one owner per object name — literally
 the D3 sentence, with no exemption list. This matters beyond tidiness: ADR-0028's
 D5/D6 (reserved `sys`, single-owner-per-object, apps-cannot-define-kernel)
@@ -581,7 +581,7 @@ This is the clause that makes `isArtifactBacked` stop lying, and it is **not**
 implied by D9.2 — it has to be decided, because D9.2 deliberately leaves the
 merged body identical, `_provenance: 'org'` included.
 
-`getArtifactItem(type, name)`'s object branch (`registry.ts:1727-1733`) currently
+`getArtifactItem(type, name)`'s object branch (`packages/objectql/src/registry.ts#getArtifactItem`) currently
 resolves `getObject(name)` — the merged body — and applies the
 `_packageId`/`isTenantAuthored` test to it. Under D9 it applies that test to the
 **owner contributor's definition**. Consequences:
@@ -602,7 +602,7 @@ evidence it admits every subsequent write through the `allowRuntimeCreate` tier.
 So this is the declared contract being enforced consistently, not a new
 restriction; but a deployment that has been living in the post-first-write state
 will see writes start being refused. The documented operator hatch
-(`OS_METADATA_WRITABLE=object`, `protocol.ts:7380`) is the same one door as
+(`OS_METADATA_WRITABLE=object`, `packages/metadata-protocol/src/protocol.ts#OS_METADATA_WRITABLE`) is the same one door as
 before, and it now has to stay open for the *life* of the customization rather
 than only for its first save. Deployments that cannot accept that must move the
 customization into a package — which is the position ADR-0005's whitelist has
@@ -621,11 +621,11 @@ always taken for `object`.
   moment the information is still in hand — **write time, where the packaged
   owner is one lookup away — instead of delete time, where it has been
   destroyed.**
-- **Removing the object** (`unregisterObject`, `:1482-1520`) keeps its ADR-0029
+- **Removing the object** (`unregisterObject`, `packages/metadata-protocol/src/protocol.ts`) keeps its ADR-0029
   extender guard verbatim. Tier 3 of `restoreArtifactRegistryView` then reads:
   a packaged `own` survives → remove the overlay layer only; no packaged owner →
   remove the entry, as today.
-- **Uninstalling the owning package** (`unregisterObjectsByPackage`, `:1385-1415`)
+- **Uninstalling the owning package** (`unregisterObjectsByPackage`, `packages/metadata-protocol/src/protocol.ts`)
   takes the object's overlay layer with the owner it layers over. Nothing durable
   is lost: the layer is a runtime projection of a `sys_metadata` row that is not
   touched, and a re-install re-hydrates it. D9.5's orphan violation is the
@@ -648,7 +648,7 @@ Both seams — `applyObjectRegistryMutation` and `loadMetaFromDb` — sit **afte
 package registration in the real boot order (measured in P6), so the lookup is
 answerable. The same discriminator is owed to the two metadata-service ingest
 paths that also register `'own'` from a reloaded body
-(`packages/objectql/src/plugin.ts:688-693`, `:765-770`); left alone they re-open
+(`packages/objectql/src/plugin.ts`, `packages/objectql/src/plugin.ts`); left alone they re-open
 the splice through a third door.
 
 #### D9.9 — #6995: the row's `package_id` is provenance on the layer, never an ownership claim
@@ -662,7 +662,7 @@ binding `P` against the packaged owner's id `O`:
 |:--|:--|
 | `P == O` | the normal case — one overlay layer over `O`'s object. |
 | `P` empty / absent (the `'sys_metadata'` sentinel) | **accepted.** A package-less env-wide overlay is ADR-0005's platform-global shape; the row addresses the object by name and the registry knows who owns it. Today this throws (measured, P2) — that refusal was an artefact of the borrowed slot, not a decision. |
-| `P == Q`, some other package | **refused at the producer, loudly.** On the write path `saveMetaItem` returns an error (an ADR-0112-registered code minted by the implementation card) instead of a success receipt; at boot the row is not layered and is counted in `loadMetaFromDb`'s per-record `errors` with its reason — which that seam already does today (`protocol.ts:11706-11708`), and which is why #6995 is a **write-path** divergence and not a boot-path one. |
+| `P == Q`, some other package | **refused at the producer, loudly.** On the write path `saveMetaItem` returns an error (an ADR-0112-registered code minted by the implementation card) instead of a success receipt; at boot the row is not layered and is counted in `loadMetaFromDb`'s per-record `errors` with its reason — which that seam already does today (`packages/metadata-protocol/src/protocol.ts#saveMetaItem`), and which is why #6995 is a **write-path** divergence and not a boot-path one. |
 
 The last row is a real decision, not bookkeeping, and the reason is a store
 asymmetry worth recording: the overlay-uniqueness index keys on
@@ -685,9 +685,9 @@ The ruling named the alternative as "a new ownership kind" — a contributor tha
 *also* owns, with `assertSingleOwnerPerObject` taught to accept two. Rejected:
 
 - **It grants authority nothing consumes.** § 2 measured what ownership carries
-  (namespace registration, the `_packageId` stamp at `:1314`, the table) and the
+  (namespace registration, the `_packageId` stamp at `packages/metadata-protocol/src/protocol.ts`, the table) and the
   overlay uses none of it.
-- **It makes D3 conditional.** Every consumer of `getObjectOwner` (`:1332-1335`)
+- **It makes D3 conditional.** Every consumer of `getObjectOwner` (`packages/metadata-protocol/src/protocol.ts`)
   would have to be re-read to decide *which* owner it means, and ADR-0028's
   D5/D6 rest on D3 being unconditional. An assertion with an exemption clause is
   an assertion that has to be re-litigated at every call site.
@@ -705,25 +705,25 @@ does to it:
 
 | site | today | under D9 |
 |:--|:--|:--|
-| `registry.ts:1075` default priority | `own ? 100 : 200` | third arm, `DEFAULT_OVERLAY_PRIORITY = 150` |
-| `registry.ts:1116-1130` `provisionPrimary` / `provisionSearchCompanion` | gated on `own` | **gate becomes "is this a BASE layer" (`own` or `overlay`)**. Missing this is a silent regression: the overlay body *is* the resolved base, so skipping title provisioning would change `nameField` on every overlaid object. |
-| `:1148-1155` second-owner throw | overlay hits it (#6995) | unreachable from the overlay seams |
-| `:1157-1160` same-package `own` splice | **destroys the packaged body** | untouched; the overlay never enters this branch |
-| `:1167-1170` same-package `extend` splice | — | mirrored for `overlay`: at most one layer, replaced on re-write |
-| `:1217` base selection | `find(own)` | `find(overlay) ?? find(own)` |
-| `:1228` extender fold | folds `extend` | unchanged |
-| `:1314` `getAllObjects` `_packageId` stamp | the overlay's id | the packaged owner's id (the same value whenever `P == O`) |
-| `:1332-1335` `getObjectOwner` | — | unchanged; keeps meaning "the package that owns the table" |
-| `:1355-1379` `assertSingleOwnerPerObject` | — | unchanged + orphan-overlay class (D9.5) |
-| `:1385-1415` `unregisterObjectsByPackage` | — | overlay layer leaves with its base (D9.7) |
-| `:1482-1520` `unregisterObject` | — | extender guard unchanged; tier 3 calls the layer-addressed verb first |
-| `:1727-1733` `getArtifactItem` object branch | reads the merged body | reads the owner contributor (D9.6) |
-| `spec/data/object.zod.ts:2435` | `['own','extend']` | third value + the "loader-set, never authored" clause |
-| `protocol.ts:7897-7911`, `:11670-11673` | register `'own'` | D9.8 discriminator |
-| `objectql/src/plugin.ts:688`, `:765` | register `'own'` | D9.8 discriminator |
-
-`ObjectContributor` is exported (`packages/objectql/src/index.ts:28`,
-`core.ts:24`), so the widened union is a public type change for `objectui` /
+| `packages/objectql/src/registry.ts#DEFAULT_OVERLAY_PRIORITY` default priority | `own ? 100 : 200` | third arm, `DEFAULT_OVERLAY_PRIORITY = 150` |
+| `packages/objectql/src/registry.ts` `provisionPrimary` / `provisionSearchCompanion` | gated on `own` | **gate becomes "is this a BASE layer" (`own` or `overlay`)**. Missing this is a silent regression: the overlay body *is* the resolved base, so skipping title provisioning would change `nameField` on every overlaid object. |
+| `packages/objectql/src/registry.ts` second-owner throw | overlay hits it (#6995) | unreachable from the overlay seams |
+| `packages/objectql/src/registry.ts` same-package `own` splice | **destroys the packaged body** | untouched; the overlay never enters this branch |
+| `packages/objectql/src/registry.ts` same-package `extend` splice | — | mirrored for `overlay`: at most one layer, replaced on re-write |
+| `packages/objectql/src/registry.ts` base selection | `find(own)` | `find(overlay) ?? find(own)` |
+| `packages/objectql/src/registry.ts` extender fold | folds `extend` | unchanged |
+| `#getAllObjects` `getAllObjects` `_packageId` stamp | the overlay's id | the packaged owner's id (the same value whenever `P == O`) |
+| `#getObjectOwner` `getObjectOwner` | — | unchanged; keeps meaning "the package that owns the table" |
+| `#assertSingleOwnerPerObject` `assertSingleOwnerPerObject` | — | unchanged + orphan-overlay class (D9.5) |
+| `#unregisterObjectsByPackage` `unregisterObjectsByPackage` | — | overlay layer leaves with its base (D9.7) |
+| `#unregisterObject` `unregisterObject` | — | extender guard unchanged; tier 3 calls the layer-addressed verb first |
+| `#getArtifactItem` `getArtifactItem` object branch | reads the merged body | reads the owner contributor (D9.6) |
+| `packages/spec/src/data/object.zod.ts` | `['own','extend']` | third value + the "loader-set, never authored" clause |
+| `packages/metadata-protocol/src/protocol.ts`, `packages/metadata-protocol/src/protocol.ts` | register `'own'` | D9.8 discriminator |
+| `packages/objectql/src/plugin.ts`, `packages/objectql/src/plugin.ts` | register `'own'` | D9.8 discriminator |
+
+`ObjectContributor` is exported (`packages/objectql/src/index.ts`,
+`packages/objectql/src/core.ts`), so the widened union is a public type change for `objectui` /
 `cloud` consumers and belongs in a minor with a changeset.
 
 ### 6. Deliberately left open for the implementation card
@@ -769,7 +769,7 @@ does to it:
 - The honest gate refuses repeat overlay writes that today succeed (D9.6). This
   is the declared contract, and it is still a behaviour change a live deployment
   can feel.
-- Two ingest paths (`plugin.ts:688`, `:765`) must adopt the discriminator or the
+- Two ingest paths (`packages/objectql/src/plugin.ts`, `packages/objectql/src/plugin.ts`) must adopt the discriminator or the
   splice returns through a third door — a coupling that is easy to miss because
   those paths are about metadata-service reloads, not about tenant overlays.
 
@@ -785,8 +785,8 @@ does to it:
 `packages/objectql/src/registry.ts` is registered against ADR-0029 in
 `scripts/adr-anchors.json` by this change. It was **unanchored**, which is the
 recurrence shape Prime Directive #13 names and the same one #6825's amendment
-found for ADR-0005: the file that implements D3 (the `own` splice at `:1157-1160`,
-`assertSingleOwnerPerObject` at `:1355`, the extender guard at `:1490`) never said
+found for ADR-0005: the file that implements D3 (the `own` splice at `packages/objectql/src/registry.ts`,
+`assertSingleOwnerPerObject` at `#assertSingleOwnerPerObject`, the extender guard at) never said
 which decision an author editing it was standing on — so the splice could be read
 as an ordinary re-registration convenience, which is precisely how it came to
 destroy a packaged definition.
diff --git a/docs/adr/0032-unified-expression-layer.md b/docs/adr/0032-unified-expression-layer.md
index ffb0bb590d..ac1b3a3a6a 100644
--- a/docs/adr/0032-unified-expression-layer.md
+++ b/docs/adr/0032-unified-expression-layer.md
@@ -40,8 +40,8 @@ What the incident actually was — established by reproducing it end-to-end agai
 
 Supporting facts (verified in source):
 
-- **Loose contract + coercion.** `ExpressionInputSchema` (`spec/shared/expression.zod.ts:84`) transforms any bare string into `{dialect:'cel', source}`; `flow.zod.ts` only *consumes* it. A `condition: string` is silently treated as CEL with no opportunity to reject a bad form.
-- **The spec teaches the bad form.** `automation/flow.zod.ts:212-214`'s own `FlowSchema` JSDoc example uses `condition: "{amount} < 500"` / `"{amount} >= 500"` — the **exact single-brace-in-CEL pattern that silently fails**. This is the concrete answer to *"why did the AI write it wrong"*: not a missing skill — an actively wrong authoritative example the model faithfully copied.
+- **Loose contract + coercion.** `ExpressionInputSchema` (`packages/spec/src/shared/expression.zod.ts#ExpressionInputSchema`) transforms any bare string into `{dialect:'cel', source}`; `flow.zod.ts` only *consumes* it. A `condition: string` is silently treated as CEL with no opportunity to reject a bad form.
+- **The spec teaches the bad form.** `packages/spec/src/automation/flow.zod.ts#FlowSchema`'s own `FlowSchema` JSDoc example uses `condition: "{amount} < 500"` / `"{amount} >= 500"` — the **exact single-brace-in-CEL pattern that silently fails**. This is the concrete answer to *"why did the AI write it wrong"*: not a missing skill — an actively wrong authoritative example the model faithfully copied.
 - **Three syntaxes coexist, at scale.** Across `../templates` (10 packages, 30 flows): only **6** flow `condition`s, but **191** single-brace `{…}` template usages and **40+** double-brace `{{…}}` (titleFormat/notification). So by volume the dominant expression surface is *interpolation*, not predicates — and the single-brace delimiter is the one that collides with CEL. (Date helpers also split: template `TODAY()`/`NOW()` vs CEL `today()`/`daysFromNow(int)`.)
 - **Inconsistent failure policy.** The same evaluation-failure decision is made five different ways: `seed-loader` (loud fail), hook-wrappers (warn + false), rule-validator (warn + skip → null), the engine's formula projection (silent null), flow `evaluateCondition` (silent false). No single declared policy.
 
@@ -81,7 +81,7 @@ Rationale (AI-first): the #1 LLM error is *mode over-generalization* — copying
 
 ### 4. Correctness is training data.
 
-- **Fix the canon first.** Remove every anti-pattern from the spec's own JSDoc (`flow.zod.ts:212-214`'s `{amount} < 500`), skills, and guides **before** shipping the contract — the model emits what it is shown.
+- **Fix the canon first.** Remove every anti-pattern from the spec's own JSDoc (`packages/spec/src/automation/flow.zod.ts`'s `{amount} < 500`), skills, and guides **before** shipping the contract — the model emits what it is shown.
 - **Ship a golden example set** per field role (predicate / template / computed value), copy-pasteable and correct, that authoring agents are pointed at.
 - **Make the contract self-describing** (Decision 1e) so the agent *discovers* the rule rather than inferring it from priors.
 
@@ -121,9 +121,9 @@ Out of scope (separate surfaces, intentionally **not** unified): query-filter op
 
 ## Sequencing (roadmap, ordered by AI-safety ROI)
 
-1. **Stop the silent failure + fix the canon (ship first, decisive).** One `EvalResult` policy: parse → build error, runtime fault → loud attributed failure; delete every `error→false/null` swallow (`evaluateCondition` + the other four). Simultaneously remove the anti-pattern examples from spec JSDoc/skills (`flow.zod.ts:212-214`). This alone kills the #1491/#1429 class.
+1. **Stop the silent failure + fix the canon (ship first, decisive).** One `EvalResult` policy: parse → build error, runtime fault → loud attributed failure; delete every `error→false/null` swallow (`evaluateCondition` + the other four). Simultaneously remove the anti-pattern examples from spec JSDoc/skills (`packages/spec/src/automation/flow.zod.ts`). This alone kills the #1491/#1429 class.
 2. **Build-time parse validation + error-message contract.** CLI/registration parses every expression; failures carry `file:line`, source, and the *corrective* message (1d).
-3. **Contract/types.** `spec`: expression fields become typed (`Predicate` / `Template` / `Expr<T>`); remove bare-string acceptance + the `shared/expression.zod.ts:84` coercion. Land `` cel`` `` / `` tpl`` `` builders. Two shapes, no single brace.
+3. **Contract/types.** `spec`: expression fields become typed (`Predicate` / `Template` / `Expr<T>`); remove bare-string acceptance + the `packages/spec/src/shared/expression.zod.ts#Predicate` coercion. Land `` cel`` `` / `` tpl`` `` builders. Two shapes, no single brace.
 4. **Schema-aware validation (v1)** — project resolved object schema into the CEL type env; field-existence + bool-return. (v2: full type inference.)
 5. **Agent tooling** — expose `validate_expression` + field-dialect/scope introspection; feed schema into the authoring context.
 6. **Template engine** — `{{ }}` holes (paths + formatter whitelist) with defined value→string semantics; delete the single-brace resolver; unify date helpers under CEL stdlib.
diff --git a/docs/adr/0049-no-unenforced-security-properties.md b/docs/adr/0049-no-unenforced-security-properties.md
index 1f274f834e..921bf39bc3 100644
--- a/docs/adr/0049-no-unenforced-security-properties.md
+++ b/docs/adr/0049-no-unenforced-security-properties.md
@@ -1,6 +1,6 @@
 # ADR-0049: Spec must not declare security properties the runtime does not enforce (enforce-or-remove gate)
 
-**Status**: Accepted (2026-06-15) — implemented: fail-closed `DESTRUCTIVE_OPERATIONS` (`permission-evaluator.ts:37,122`), lifecycle bits RBAC-gated, `apiEnabled` enforced (`runtime/src/api-exposure.ts`), `PolicySchema` removed, EXPERIMENTAL tag convention live. Two gate-valid disposition deviations: agent access-control shipped experimental-tagged (not enforced), `flow.runAs` kept + enforced (not removed). `action.disabled` CEL enforcement to confirm in objectui.
+**Status**: Accepted (2026-06-15) — implemented: fail-closed `DESTRUCTIVE_OPERATIONS` (`packages/plugins/plugin-security/src/permission-evaluator.ts#DESTRUCTIVE_OPERATIONS`), lifecycle bits RBAC-gated, `apiEnabled` enforced (`runtime/src/api-exposure.ts`), `PolicySchema` removed, EXPERIMENTAL tag convention live. Two gate-valid disposition deviations: agent access-control shipped experimental-tagged (not enforced), `flow.runAs` kept + enforced (not removed). `action.disabled` CEL enforcement to confirm in objectui.
 **Deciders**: ObjectStack Protocol Architects
 **Builds on**: [ADR-0005](./0005-metadata-customization-overlay.md) (artifact vs runtime overlay), [ADR-0010](./0010-metadata-protection-model.md) (package provenance), [ADR-0027](./0027-metadata-authoring-lifecycle.md) (authoring lifecycle)
 **Consumers**: `@objectstack/spec` (security/identity schemas), `@objectstack/plugin-security` (`PermissionEvaluator`, `SecurityPlugin`), spec authors, the metadata-property liveness audit follow-ups (#1878 P0 cluster).
@@ -35,7 +35,7 @@ Shipping a security property in a fourth state — *parsed, unmarked, unenforced
 
 A second, roadmap-independent defect compounds the first: `PermissionEvaluator`
 **fails open** for operations it doesn't recognise
-(`permission-evaluator.ts:35`, `if (!permKey) return true`). Any future
+(`packages/plugins/plugin-security/src/permission-evaluator.ts#permKey`, `if (!permKey) return true`). Any future
 destructive operation added without registering it in `OPERATION_TO_PERMISSION`
 is silently ungated. The evaluator must **fail closed** for the destructive
 operation class.
@@ -46,13 +46,13 @@ operation class.
 
 - Evidence: `docs/audits/2026-06-security-identity-property-liveness.md` and the
   cross-type synthesis in `docs/audits/README.md` (cluster #1).
-- The CRUD path *is* enforced: `SecurityPlugin` (`security-plugin.ts:326`)
+- The CRUD path *is* enforced: `SecurityPlugin` (`packages/plugins/plugin-security/src/security-plugin.ts#SecurityPlugin`)
   resolves permission sets and calls `PermissionEvaluator.checkObjectPermission`,
   which maps the ObjectQL operation to an `ObjectPermission` key via
-  `OPERATION_TO_PERMISSION` (`permission-evaluator.ts:8-16`).
+  `OPERATION_TO_PERMISSION` (`packages/plugins/plugin-security/src/permission-evaluator.ts#OPERATION_TO_PERMISSION`).
 - That map covers only `find/findOne/count/aggregate/insert/update/delete`. The
   three destructive permission bits in the spec
-  (`permission.zod.ts:28-30` — `allowTransfer`/`allowRestore`/`allowPurge`)
+  (`packages/spec/src/security/permission.zod.ts#allowTransfer` — `allowTransfer`/`allowRestore`/`allowPurge`)
   have **no operation pointing at them**, and the operations they describe
   (`transfer`/`restore`/`purge`) **do not yet exist** as ObjectQL operations.
   So the bits are dangling, and the `if (!permKey) return true` default means
diff --git a/docs/adr/0052-audit-is-not-the-activity-feed.md b/docs/adr/0052-audit-is-not-the-activity-feed.md
index 6af69eeb6a..0fc5e94918 100644
--- a/docs/adr/0052-audit-is-not-the-activity-feed.md
+++ b/docs/adr/0052-audit-is-not-the-activity-feed.md
@@ -16,7 +16,7 @@ and *"SOC 2, HIPAA, GDPR"* currently **registers five objects across five
 bounded contexts**:
 
 ```ts
-// packages/plugins/plugin-audit/src/audit-plugin.ts:40
+// packages/plugins/plugin-audit/src/audit-plugin.ts
 objects: [SysAuditLog, SysActivity, SysComment, SysAttachment, SysNotification]
 ```
 
@@ -71,7 +71,7 @@ default-loaded, it became the path of least resistance for anything
   and a denormalized activity row:
 
   ```ts
-  // packages/plugins/plugin-audit/src/audit-writers.ts:328-329
+  // packages/plugins/plugin-audit/src/audit-writers.ts#auditRow
   await sys.object('sys_audit_log').create(auditRow);
   await sys.object('sys_activity').create(activityRow);
   ```
@@ -79,7 +79,7 @@ default-loaded, it became the path of least resistance for anything
   The two objects are 80% the same event at different fidelities —
   `sys_audit_log` is *"immutable, compliance-grade"*, `sys_activity` is
   *"denormalized, human-readable summaries shown [in the UI]"*
-  (`audit-writers.ts:43-45`).
+  (`packages/plugins/plugin-audit/src/audit-writers.ts`).
 
 - **Homeless objects parked in the audit manifest.** `sys_comment` is *defined*
   by `plugin-audit` but **written by the UI directly** (the audit writer never
@@ -88,7 +88,7 @@ default-loaded, it became the path of least resistance for anything
   way, and the code **says so**:
 
   ```ts
-  // packages/plugins/plugin-audit/src/audit-plugin.ts:6-11
+  // packages/plugins/plugin-audit/src/audit-plugin.ts
   // Registered here but still owned by platform-objects (the plugin contributes
   //   - sys_attachment    — a file↔record link belonging with service-storage's …
   //   - sys_notification  — … belonging with messaging
@@ -102,9 +102,9 @@ default-loaded, it became the path of least resistance for anything
 
 - **Runtime cross-context coupling.** The same writer lazily resolves the
   messaging service to emit collaboration notifications
-  (`audit-plugin.ts:96-99`), and a regression test exists specifically to stop
+  (`packages/plugins/plugin-audit/src/audit-plugin.ts`), and a regression test exists specifically to stop
   the audit writer from auditing its own writes
-  (`audit-writers.test.ts:9`) — evidence the coupling already bites.
+  (`packages/plugins/plugin-audit/src/audit-writers.test.ts`) — evidence the coupling already bites.
 
 ## 2. The design flaws (what we are correcting)
 
@@ -155,7 +155,7 @@ needs). Audit no longer dual-writes.
 
 `sys_audit_log` is the only object whose contract is *governance*: every field
 `readonly: true`, `managedBy: 'append-only'`
-(`sys-audit-log.object.ts:22`), retention policy, security-gated read. Per
+(`packages/plugins/plugin-audit/src/objects/sys-audit-log.object.ts#managedBy`), retention policy, security-gated read. Per
 ADR-0049 (enforce-or-remove), those properties must be enforced at audit's own
 boundary — which is only possible once mutable co-tenants (`sys_comment`) leave.
 Audit **remains a default platform capability**: compliance is foundational,
diff --git a/docs/adr/0053-date-and-datetime-semantics.md b/docs/adr/0053-date-and-datetime-semantics.md
index 9c3d775e60..b8f200dfcf 100644
--- a/docs/adr/0053-date-and-datetime-semantics.md
+++ b/docs/adr/0053-date-and-datetime-semantics.md
@@ -16,9 +16,9 @@ timestamp** — an *instant*. That is the textbook "date-as-instant" mistake, an
 it produces two failures:
 
 1. **Silent equality miss.** The write path stores the full timestamp
-   (`formatInput` does not normalize — `sql-driver.ts:1967`), but the filter path
+   (`formatInput` does not normalize — `packages/drivers/driver-sql/src/sql-driver.ts#formatInput`), but the filter path
    normalizes the query value to `YYYY-MM-DD` (`coerceFilterValue` —
-   `sql-driver.ts:1543`). So `date == <date-only>` compares
+   `packages/drivers/driver-sql/src/sql-driver.ts#coerceFilterValue`). So `date == <date-only>` compares
    `"2026-08-15T17:24Z"` against `"2026-08-15"` → never equal. Range filters
    (`$gte`/`$lt`) only work by accident of lexicographic ISO ordering.
 2. **Off-by-one across timezones.** A date stored as UTC-midnight
@@ -27,8 +27,8 @@ it produces two failures:
    timezone-naive string and never converting it to an instant.
 
 A third, related defect: `daysFromNow(n)`/`daysAgo(n)` keep the current
-**wall-clock time** (`addDaysUtc` — `stdlib.ts:36`), unlike `today()` which
-truncates to UTC midnight (`startOfDayUtc` — `stdlib.ts:19`). And `today()`
+**wall-clock time** (`addDaysUtc` — `packages/formula/src/stdlib.ts#addDaysUtc`), unlike `today()` which
+truncates to UTC midnight (`startOfDayUtc` — `packages/formula/src/stdlib.ts#startOfDayUtc`). And `today()`
 is computed in **UTC**, not the user/org timezone, even though a
 `sys-user-preference.timezone` exists but is never read by the engine.
 
@@ -54,10 +54,10 @@ is computed in **UTC**, not the user/org timezone, even though a
 
 | Layer | Treatment of `Field.date` | Evidence |
 |-------|---------------------------|----------|
-| Column | `date` → `table.date()` (SQLite has no real DATE type — TEXT affinity) | `sql-driver.ts:1816` |
-| **Write** | **no normalization** — the JS `Date` is stored verbatim, keeping its time | `formatInput`, `sql-driver.ts:1967` |
+| Column | `date` → `table.date()` (SQLite has no real DATE type — TEXT affinity) | `packages/drivers/driver-sql/src/sql-driver.ts` |
+| **Write** | **no normalization** — the JS `Date` is stored verbatim, keeping its time | `formatInput`, `packages/drivers/driver-sql/src/sql-driver.ts#formatInput` |
 | Read | no normalization — returns the stored string with its time | empirical: `dev.db` holds `"2026-07-15T17:24:56.533Z"` |
-| **Filter** | **normalizes the query value to `YYYY-MM-DD`** (date-only string compare) | `coerceFilterValue`, `sql-driver.ts:1543-1554` |
+| **Filter** | **normalizes the query value to `YYYY-MM-DD`** (date-only string compare) | `coerceFilterValue`, `packages/drivers/driver-sql/src/sql-driver.ts#coerceFilterValue` |
 | Formula | the stored string is hydrated to a `Date` (date-only → UTC midnight) and compared against the time-function `Date` | `applyFormulaPlan` (`engine.ts`), `hydrateOverloadStrings` (`cel-engine.ts`) |
 
 The write/filter mismatch is the proximate cause: the filter layer already
@@ -65,9 +65,9 @@ The write/filter mismatch is the proximate cause: the filter layer already
 
 ### The time functions disagree with each other
 
-- `today()` → start-of-day **UTC** (`startOfDayUtc`, `stdlib.ts:19,57`).
+- `today()` → start-of-day **UTC** (`startOfDayUtc`, `packages/formula/src/stdlib.ts#startOfDayUtc`).
 - `daysFromNow(n)`/`daysAgo(n)` → `now() ± n*24h`, **keeping wall-clock time**
-  (`addDaysUtc`, `stdlib.ts:36`). Two calls a minute apart differ.
+  (`addDaysUtc`, `packages/formula/src/stdlib.ts#addDaysUtc`). Two calls a minute apart differ.
 - CEL's only temporal type is `google.protobuf.Timestamp` (a UTC instant) —
   there is no `PlainDate`. So a date field flowing into CEL is forced into an
   instant, which is exactly what we want to avoid.
@@ -107,7 +107,7 @@ between them is precisely "does this concept depend on a timezone?"
    lexicographically = chronologically, so range comparisons stay correct.
    `today()`/`daysFromNow()` used against a date field are compared date-only.
 4. **No change to `Field.datetime`** — it keeps full-instant semantics
-   (`datetimeFields`, stored as UTC ms — `sql-driver.ts:1500`).
+   (`datetimeFields`, stored as UTC ms — `packages/drivers/driver-sql/src/sql-driver.ts#datetimeFields`).
 
 After Phase 1, `date == daysFromNow(n)` works (both sides are the same calendar
 day), `$in` of dates works, and the day-window range pattern keeps working. The
@@ -262,7 +262,7 @@ consistent with all three boundaries (CEL hydration, driver filter, Phase-1 stor
 > UTC-midnight-hydrated field — the silent-miss bug returns.
 
 Bonus: making `daysFromNow(n)`/`daysAgo(n)` compute `calendarDay ± n → UTC-midnight`
-**also fixes the "keeps wall-clock time" defect** (`stdlib.ts:36`) for free. The
+**also fixes the "keeps wall-clock time" defect** (`packages/formula/src/stdlib.ts#addDaysUtc`) for free. The
 `now() + duration("Nh")` escape hatch remains for genuine sub-day instants.
 
 **D2 — tz-aware analytics buckets in-memory (JS), uniformly; do not emit
@@ -346,14 +346,14 @@ paths are byte-for-byte today's behavior — the safe default and the rollback t
 
 ADR-0053 fixed the `date`-as-string-vs-instant family (#1874) on the driver CRUD
 path, and Phase 1 explicitly left `Field.datetime` stored as UTC epoch ms
-(`sql-driver.ts:1500`, decision step 4). But analytics has a **second filter
+(`packages/drivers/driver-sql/src/sql-driver.ts#datetimeFields`, decision step 4). But analytics has a **second filter
 surface that never touches that coercion**: `NativeSQLStrategy` builds raw SQL and
 runs it via `engine.execute`, bypassing the driver's dialect-aware
-`coerceFilterValue` (`sql-driver.ts:1543`). `buildFilterClause` emits
+`coerceFilterValue` (`packages/drivers/driver-sql/src/sql-driver.ts#coerceFilterValue`). `buildFilterClause` emits
 `${col} <op> $N` and binds the comparand directly
-(`native-sql-strategy.ts:385-425`); the only type recovery was
+(`packages/services/service-analytics/src/strategies/native-sql-strategy.ts`); the only type recovery was
 `coerceFilterValueForSql`, which re-derives a type by **regex on the value's
-shape** — no schema type, no date branch (`filter-normalizer.ts:127-140`).
+shape** — no schema type, no date branch (`packages/services/service-analytics/src/strategies/filter-normalizer.ts`).
 
 So a dashboard relative-date token resolved to an ISO string (`"2025-06-18"`),
 filtered against a `Field.datetime` column stored as an INTEGER epoch on SQLite,
@@ -373,8 +373,8 @@ reach. The first increment — commit `6f4cf856e` (branch
 `fix/analytics-datetime-epoch-filter`) — exposes the driver's coercion to
 analytics via a new `StrategyContext.coerceTemporalFilterValue(object, field,
 value)` hook delegating to the driver, applied across `gte/lte/gt/lt/equals`,
-`in/notIn`, and the `dateRange`/timeDimension path (`native-sql-strategy.ts:371`,
-`:88-106`). SQLite `datetime` → epoch ms; `date` text and native-timestamp
+`in/notIn`, and the `dateRange`/timeDimension path (`packages/services/service-analytics/src/strategies/native-sql-strategy.ts`,
+`packages/services/service-analytics/src/strategies/native-sql-strategy.ts`). SQLite `datetime` → epoch ms; `date` text and native-timestamp
 dialects (Postgres/MySQL) pass through unchanged. **Record this PR as ledger
 evidence** — the same enforce-resolution pattern D3 uses for the dead schedule
 fields.
diff --git a/docs/adr/0055-master-detail-controlled-by-parent.md b/docs/adr/0055-master-detail-controlled-by-parent.md
index 5c798494d1..03b01e6855 100644
--- a/docs/adr/0055-master-detail-controlled-by-parent.md
+++ b/docs/adr/0055-master-detail-controlled-by-parent.md
@@ -19,11 +19,11 @@ A **master-detail detail** record today is access-controlled entirely on its own
 
 ## Context — the mechanisms this builds on (verified)
 
-1. **Read-path RLS injection.** `security-plugin.ts:481-495` AND-s an RLS filter into the query AST (`opCtx.ast.where = { $and: [where, rlsFilter] }`) before the driver runs. The builder `computeRlsFilter` (`security-plugin.ts:753-788`) is **async** and shared by the engine find-path and the analytics raw-SQL path (`getReadFilter`).
-2. **Pre-resolved membership (§7.3.1) already exists.** The RLS compiler recognizes `field IN (current_user.<key>)` and resolves `<key>` against `ExecutionContext.rlsMembership` — "the runtime resolves set-membership that would otherwise need a subquery … and stages each set here under a stable key" (`execution-context.zod.ts:74-91`; merge at `rls-compiler.ts:79-99`). **This is the seam controlled_by_parent plugs into — no new compiler form.**
-3. **By-id write pre-image check (#1994).** `security-plugin.ts:341-400` already re-reads the target row under the write-op RLS filter before an update/delete and denies if invisible. This is the exact hook to extend with a master-access check.
-4. **`sharingModel` enforcement seam.** `sharing-service.ts:53-62` reads `object.sharingModel`; `buildReadFilter` (`:101-143`) gates on it (`effectiveSharingModel(schema) !== 'private'`). A `controlled_by_parent` baseline plugs in here / in the security middleware.
-5. **Master-detail storage.** A `master_detail` field's **key is the FK column**; its `reference` (`field.zod.ts:386-400`) names the master object. Given a detail row, the master id is `row[masterFieldKey]`.
+1. **Read-path RLS injection.** `packages/plugins/plugin-security/src/security-plugin.ts#rlsFilter` AND-s an RLS filter into the query AST (`opCtx.ast.where = { $and: [where, rlsFilter] }`) before the driver runs. The builder `computeRlsFilter` (`packages/plugins/plugin-security/src/security-plugin.ts#computeRlsFilter`) is **async** and shared by the engine find-path and the analytics raw-SQL path (`getReadFilter`).
+2. **Pre-resolved membership (§7.3.1) already exists.** The RLS compiler recognizes `field IN (current_user.<key>)` and resolves `<key>` against `ExecutionContext.rlsMembership` — "the runtime resolves set-membership that would otherwise need a subquery … and stages each set here under a stable key" (`packages/spec/src/kernel/execution-context.zod.ts#rlsMembership`; merge at `packages/plugins/plugin-security/src/rls-compiler.ts`). **This is the seam controlled_by_parent plugs into — no new compiler form.**
+3. **By-id write pre-image check (#1994).** `packages/plugins/plugin-security/src/security-plugin.ts#sharingModel` already re-reads the target row under the write-op RLS filter before an update/delete and denies if invisible. This is the exact hook to extend with a master-access check.
+4. **`sharingModel` enforcement seam.** `packages/plugins/plugin-sharing/src/sharing-service.ts#buildReadFilter` reads `object.sharingModel`; `buildReadFilter` gates on it (`effectiveSharingModel(schema) !== 'private'`). A `controlled_by_parent` baseline plugs in here / in the security middleware.
+5. **Master-detail storage.** A `master_detail` field's **key is the FK column**; its `reference` (`packages/spec/src/data/field.zod.ts#reference`) names the master object. Given a detail row, the master id is `row[masterFieldKey]`.
 6. **Spec inconsistency (to fix either way).** `OWDModel` (`sharing.zod.ts`) includes `controlled_by_parent`; the object's authorable `sharingModel` (`object.zod.ts`) is a different enum `['private','read','read_write','full']` that omits it.
 
 ## Decision
@@ -47,13 +47,13 @@ This composes with the detail's own tenant/owner RLS (all AND-ed) and flows to a
 
 | Option | Verdict | Why |
 |---|---|---|
-| (a) query-time subquery join (`masterFK IN (SELECT id FROM master WHERE …)`) | ✗ rejected | the RLS compiler **deliberately has no subquery support** (`rls-compiler.ts:129-138`); the query AST has no EXISTS/sub-select form. Would require extending both. |
+| (a) query-time subquery join (`masterFK IN (SELECT id FROM master WHERE …)`) | ✗ rejected | the RLS compiler **deliberately has no subquery support** (`packages/plugins/plugin-security/src/rls-compiler.ts`); the query AST has no EXISTS/sub-select form. Would require extending both. |
 | **(b) pre-resolved accessible-master-id set** | ✓ **chosen** | reuses the `rlsMembership` + IN-form path with **zero compiler changes**; resolution is one async pre-query per request, composes with existing RLS, reaches analytics. |
 | (c) materialized accessible-ids column | ✗ rejected | dual-write maintenance; goes stale the moment access rules/shares change mid-session — a correctness hazard for a security primitive. |
 
 ### 3. Write mechanism — extend the #1994 pre-image check
 
-In the pre-image block (`security-plugin.ts:341-400`), for a `controlled_by_parent` detail `update`/`delete`/`create`:
+In the pre-image block (`packages/plugins/plugin-security/src/security-plugin.ts#controlled_by_parent`), for a `controlled_by_parent` detail `update`/`delete`/`create`:
 - resolve the target's master id (`row[masterFieldKey]`; for `create`, the master id in the incoming body), and
 - re-read the master under its **edit** write-filter (`findOne(master, { where: { $and: [{id: masterId}, masterWriteFilter] } })`); a `null` result ⇒ deny.
 - **Rule:** editing/deleting/creating a detail requires **edit** access to its master (Salesforce master-detail semantics). Reading a detail requires **read** access to its master (§2).
diff --git a/docs/adr/0056-permission-model-landing-verification.md b/docs/adr/0056-permission-model-landing-verification.md
index a7f3083f1b..840f042f2c 100644
--- a/docs/adr/0056-permission-model-landing-verification.md
+++ b/docs/adr/0056-permission-model-landing-verification.md
@@ -50,25 +50,25 @@ Legend — **E** enforced · **P** partial · **U** declared-but-unenforced (fai
 
 | # | Primitive | Enforced? | Enforcement site (evidence) | Proven e2e? | Verdict |
 | :-- | :-- | :-: | :-- | :-: | :-- |
-| 1 | Object CRUD (`allowRead/Create/Edit/Delete`) | **E** | `plugin-security/security-plugin.ts` ~`326` checkObjectPermission (fail-closed 403) | partial (delete ✗pf) | OK; add DELETE proof |
-| 2 | FLS read-mask / write-deny | **E** | `security-plugin.ts` ~`441`/`530`, `field-masker.ts` | unit only ✗pf | OK; **prove FLS+RLS composition** |
-| 3 | RLS `using` (read) | **E** | `security-plugin.ts` ~`504` AND-inject; `rls-compiler.ts` | ✓ `rls-fixture` | OK |
+| 1 | Object CRUD (`allowRead/Create/Edit/Delete`) | **E** | `packages/plugins/plugin-security/src/security-plugin.ts` checkObjectPermission (fail-closed 403) | partial (delete ✗pf) | OK; add DELETE proof |
+| 2 | FLS read-mask / write-deny | **E** | `packages/plugins/plugin-security/src/security-plugin.ts`, `field-masker.ts` | unit only ✗pf | OK; **prove FLS+RLS composition** |
+| 3 | RLS `using` (read) | **E** | `packages/plugins/plugin-security/src/security-plugin.ts` AND-inject; `rls-compiler.ts` | ✓ `rls-fixture` | OK |
 | 4 | RLS `check` (insert/update) | **E** | `security-plugin.ts` write path | ✓ `rls-fixture` | OK |
-| 5 | RLS by-id write (#1994) | **E** | `security-plugin.ts` ~`361` pre-image re-read | ✓ `rls-fixture` | OK |
+| 5 | RLS by-id write (#1994) | **E** | `packages/plugins/plugin-security/src/security-plugin.ts` pre-image re-read | ✓ `rls-fixture` | OK |
 | 6 | RLS compiler grammar | **P** | `rls-compiler.ts` — only `=`(id/email/org)/`IN`/literal/`1=1`; **uncompilable predicates silently dropped** | unit | **D4: no silent drop** |
 | 7 | `current_user.*` vars | **P** | resolves `id`,`email`,`organization_id`,`org_user_ids`,`rlsMembership`; **`name` excluded by design** | unit | OK (documented) |
-| 8 | OWD `private` (owner-only) | **P** | `plugin-sharing/sharing-service.ts` ~`53` `effectiveSharingModel` — **only if sharing plugin loaded** | ✓ `rls-fixture` | **D1/D3** |
+| 8 | OWD `private` (owner-only) | **P** | `packages/plugins/plugin-sharing/src/sharing-service.ts#effectiveSharingModel` `effectiveSharingModel` — **only if sharing plugin loaded** | ✓ `rls-fixture` | **D1/D3** |
 | 9 | OWD `read` / `public_read` | **U** | `read` handled; `public_read` falls through to "public" (no filter) | ✗pf | **D1** |
 | 10 | OWD `read_write`/`full`/`public_read_write` | **U** | all collapse to default-ALLOW; no distinction | ✗pf | **D1 (fail-open)** |
-| 11 | `controlled_by_parent` | **E** | `security-plugin.ts` ~`864`/`908` (read+write) | ✓ `controlled-by-parent`, `showcase-invoice-cbp` | OK (ADR-0055) |
-| 12 | Ownership `owner_id` stamp + scope | **E** | `security-plugin.ts` ~`479` auto-stamp; owner RLS | ✓ `rls-fixture` | OK |
-| 13 | Manual record shares (`sys_record_share`) | **E** | `sharing-service.ts` ~`117` buildReadFilter | unit ✗pf | OK; add proof |
+| 11 | `controlled_by_parent` | **E** | `packages/plugins/plugin-security/src/security-plugin.ts` (read+write) | ✓ `controlled-by-parent`, `showcase-invoice-cbp` | OK (ADR-0055) |
+| 12 | Ownership `owner_id` stamp + scope | **E** | `packages/plugins/plugin-security/src/security-plugin.ts` auto-stamp; owner RLS | ✓ `rls-fixture` | OK |
+| 13 | Manual record shares (`sys_record_share`) | **E** | `sharing-service.ts` buildReadFilter | unit ✗pf | OK; add proof |
 | 14 | Sharing rules (criteria/owner) | **P** | rules materialize into `sys_record_share`; **spec CEL `condition`+recipients diverge from runtime `criteria_json`** | unit ✗pf | **D5 (spec↔runtime reconcile, per 0049)** |
-| 15 | Role hierarchy widening (`parent`) | **N** | `sharing-rule-service.ts` ~`253` `expandRecipient` has no `role_and_subordinates` case (declared in the enum, never expanded); `team-graph.ts:27` flat; no consumer of `Role.parent` | ✗ | **D6: implement or `experimental`** |
-| 16 | Multi-tenant org isolation | **E** | `plugin-org-scoping` ~`129` stamp + wildcard RLS + field-existence fail-closed | ✓ `rls-multitenant` | OK |
+| 15 | Role hierarchy widening (`parent`) | **N** | `packages/plugins/plugin-sharing/src/sharing-rule-service.ts#expandRecipient` `expandRecipient` has no `role_and_subordinates` case (declared in the enum, never expanded); `packages/plugins/plugin-sharing/src/team-graph.ts` flat; no consumer of `Role.parent` | ✗ | **D6: implement or `experimental`** |
+| 16 | Multi-tenant org isolation | **E** | `plugin-org-scoping` stamp + wildcard RLS + field-existence fail-closed | ✓ `rls-multitenant` | OK |
 | 17 | Anonymous / unauthenticated | **P/U** | `rest-server.ts` `requireAuth` **defaults false**; no context ⇒ checks skipped ⇒ reads unscoped data | unit ✗pf | **D2 (fail-open, HIGH)** |
-| 18 | `systemPermissions` / tab-app gating | **E** | `rest-server.ts` ~`1069` filterAppForUser (server-side) | ✗pf | OK; add proof |
-| 19 | Default/fallback provisioning | **P** | `security-plugin.ts` ~`724` hardcoded `member_default`; **not app-declarable** | unit ✗pf | **D7** |
+| 18 | `systemPermissions` / tab-app gating | **E** | `packages/rest/src/rest-server.ts#filterAppForUser` filterAppForUser (server-side) | ✗pf | OK; add proof |
+| 19 | Default/fallback provisioning | **P** | `packages/plugins/plugin-security/src/security-plugin.ts` hardcoded `member_default`; **not app-declarable** | unit ✗pf | **D7** |
 | 20 | `allowTransfer/Restore/Purge`, `Policy`, flow `runAs` | **(removed)** | — | — | already 0049 → M2, leave |
 | 21 | Compliance / Encryption / Masking / `RLSConfig` / DataClassification | **U** | declared in `spec/system/*`; no runtime consumer found | ✗ | **D8: triage per 0049** |
 
@@ -116,7 +116,7 @@ The spec declares `CriteriaSharingRuleSchema`/`OwnerSharingRuleSchema` with a CE
 
 ### D6 — Role-hierarchy widening: implement, or mark `experimental`
 
-`Role.parent` exists and is documented as "managers see subordinates," but no code consumes it: `expandRecipient` (`sharing-rule-service.ts:253`) resolves a `role` recipient to its **direct** members only and has **no `role_and_subordinates` branch** (the enum value ships, unexpanded). It is **silently a no-op** — a 0049 violation. (Department hierarchy *is* walked — `department-graph.ts:32` — so the gap is role-specific.)
+`Role.parent` exists and is documented as "managers see subordinates," but no code consumes it: `expandRecipient` (`packages/plugins/plugin-sharing/src/sharing-rule-service.ts#expandRecipient`) resolves a `role` recipient to its **direct** members only and has **no `role_and_subordinates` branch** (the enum value ships, unexpanded). It is **silently a no-op** — a 0049 violation. (Department hierarchy *is* walked — `department-graph.ts` — so the gap is role-specific.)
 
 - **Decision: mark `Role.parent`'s visibility-rollup semantics `[EXPERIMENTAL — not enforced]`** in the spec now (it is not on the critical path for v1), with a roadmap entry to implement it as a `rlsMembership` pre-resolution (`current_user.subordinate_user_ids`) reusing the ADR-0055 IN-form — **no compiler change**. (Implementing now is acceptable if cheap; the default is honest-tagging over a silent no-op.)
 
diff --git a/docs/adr/0057-erp-authorization-core-business-units-and-scope-depth.md b/docs/adr/0057-erp-authorization-core-business-units-and-scope-depth.md
index 19066b579e..1e022cc0e8 100644
--- a/docs/adr/0057-erp-authorization-core-business-units-and-scope-depth.md
+++ b/docs/adr/0057-erp-authorization-core-business-units-and-scope-depth.md
@@ -69,14 +69,14 @@ object, which an AI author cannot reliably produce and ADR-0049 forbids shipping
 
 - **`sys_role` is ObjectStack-native**, not better-auth. better-auth's 18 managed tables do not include
   it; better-auth only owns the `role` *string* on `sys_member`
-  (`packages/platform-objects/src/identity/sys-member.object.ts:152`, `managedBy:'better-auth'`, enum
+  (`packages/platform-objects/src/identity/sys-member.object.ts#managedBy`, `managedBy:'better-auth'`, enum
   owner/admin/member) and `sys_user`. The word "role" collides; the *table* does not. The platform may
   own the concept outright.
 - **Scope-depth and rollup need no RLS-compiler change.** The compiler already compiles
   `field IN (current_user.<key>)` against arbitrary pre-resolved sets supplied through
-  `ExecutionContext.rlsMembership` (`packages/plugins/plugin-security/src/rls-compiler.ts:126`, `:225`);
+  `ExecutionContext.rlsMembership` (`packages/plugins/plugin-security/src/rls-compiler.ts`, `packages/plugins/plugin-security/src/rls-compiler.ts`);
   `org_user_ids` is the existing precedent
-  (`packages/runtime/src/security/resolve-execution-context.ts:260`). New scopes resolve into new keys;
+  (`packages/runtime/src/security/resolve-execution-context.ts`). New scopes resolve into new keys;
   the engine's existing AND-injection (`packages/plugins/plugin-security/src/security-plugin.ts ~504`)
   applies them.
 
@@ -100,7 +100,7 @@ as pre-resolved `IN` sets, never compiler subqueries. One decision per gap.
 
 ### D1 — Scope-depth on object grants (the ERP core)
 
-Extend `ObjectPermissionSchema` (`packages/spec/src/security/permission.zod.ts:17`) so each per-object
+Extend `ObjectPermissionSchema` (`packages/spec/src/security/permission.zod.ts#ObjectPermissionSchema`) so each per-object
 grant carries a **read scope** and a **write scope** drawn from a canonical enum:
 
 ```
@@ -151,7 +151,7 @@ subordinate_user_ids   -> users below me on the sys_user.manager_id chain (manag
 ```
 
 - Sourced by `BusinessUnitGraphService` (D2) and the existing `managerOf` chain
-  (`packages/plugins/plugin-sharing/src/team-graph.ts:94`). Bounded (hard cap + cache, mirroring the
+  (`packages/plugins/plugin-sharing/src/team-graph.ts#managerOf`). Bounded (hard cap + cache, mirroring the
   `org_user_ids` cap) and **org-scoped**.
 - Rollup is **additive only** (widens, never restricts) and respects tenant isolation. It powers both
   D1's `unit*` scopes and sharing-rule recipients (D6). Because it is pure pre-resolution, the choice
@@ -165,13 +165,13 @@ role".
 
 - `resolve-execution-context` resolves `ctx.roles` from `sys_user_role` (union `sys_member.role` during
   a transition window), replacing the current sole dependence on the better-auth membership string
-  (`packages/runtime/src/security/resolve-execution-context.ts:226`).
+  (`packages/runtime/src/security/resolve-execution-context.ts`).
 - `sys_member.role` is **reframed to org-administration only** (owner/admin/member) and **relabelled**
   in ObjectStack's projection to `org_membership_level` (the underlying better-auth column/API param
   stays `role`; we relabel the platform schema projection in
   `packages/plugins/plugin-auth/src/auth-schema-config.ts`).
 - Continue feeding declared role names to better-auth `additionalOrgRoles`
-  (`packages/plugins/plugin-auth/src/auth-manager.ts:657`) **only** so invitations to those role names
+  (`packages/plugins/plugin-auth/src/auth-manager.ts`) **only** so invitations to those role names
   are accepted — never as the authority for RBAC.
 
 ### D5 — `sys_role` is a *job role* (capability bundle), not a second hierarchy
@@ -182,7 +182,7 @@ permission sets** (via the existing `sys_role_permission_set`) plus an optional
 `sys_role`.** Therefore:
 
 - **Retire the broken `sys_role.parent` path.** `role-graph.ts`'s `childRoles` query targets a `parent`
-  column `sys_role` does not have (`packages/plugins/plugin-sharing/src/role-graph.ts:52`; the ADR-0056
+  column `sys_role` does not have (`packages/plugins/plugin-sharing/src/role-graph.ts`; the ADR-0056
   D6 "landed" claim was proven only against a mock engine). Rather than add the missing column, the
   `role_and_subordinates` sharing recipient is **re-homed onto the BU subtree** (D2/D3) and renamed
   `unit_and_subordinates`, with `role_and_subordinates` kept as a deprecated alias that resolves
@@ -202,12 +202,12 @@ activate — closing the #2077 "decorative metadata" gap.
   UI-created rows. Home: `plugin-security` (sibling to `bootstrapPlatformAdmin`,
   `packages/plugins/plugin-security/src/bootstrap-platform-admin.ts`).
 - **Sharing rules -> `sys_sharing_rule`**: seed inside `SharingServicePlugin.start()`'s `kernel:ready`
-  **before** `listRules()`/`bindRuleHooks` (`packages/plugins/plugin-sharing/src/sharing-plugin.ts:168`)
+  **before** `listRules()`/`bindRuleHooks` (`packages/plugins/plugin-sharing/src/sharing-plugin.ts#bindRuleHooks`)
   so hooks bind to a populated table.
 - **#1887 / ADR-0056 D5 — pick the canonical sharing-rule shape.** The spec `SharingRuleSchema` (CEL
   `condition`, `ownedBy`, `sharedWith` enum incl. `group`/`guest`) diverges from the runtime
   `sys_sharing_rule` (`criteria_json` JSON filter, `recipient_type`/`recipient_id`) and is flagged
-  `EXPERIMENTAL — NOT ENFORCED` (`packages/spec/src/security/sharing.zod.ts:97`). Decision: the
+  `EXPERIMENTAL — NOT ENFORCED` (`packages/spec/src/security/sharing.zod.ts`). Decision: the
   **runtime shape is canonical**. The seeder translates the directly-mappable authoring fields
   (`object`->`object_name`, `accessLevel`->`access_level`,
   `sharedWith{type,value}`->`recipient_type`/`recipient_id` for user/role/unit-and-subordinates), and
@@ -301,19 +301,19 @@ sharing recipient e2e** (a manager + their unit subordinates gain access via the
 
 - ADRs: 0010, 0049, 0054, 0055, 0056. Issues: #2077 (seed roles/rules), #1887 (SharingRuleSchema
   disconnected).
-- Capability shape: `packages/spec/src/security/permission.zod.ts:17` (`allow*` +
+- Capability shape: `packages/spec/src/security/permission.zod.ts#ObjectPermissionSchema` (`allow*` +
   `viewAllRecords`/`modifyAllRecords`).
-- RLS IN-form + membership injection: `packages/plugins/plugin-security/src/rls-compiler.ts:126`,
-  `packages/runtime/src/security/resolve-execution-context.ts:226`.
+- RLS IN-form + membership injection: `packages/plugins/plugin-security/src/rls-compiler.ts`,
+  `packages/runtime/src/security/resolve-execution-context.ts`.
 - BU tree: `packages/platform-objects/src/identity/sys-department.object.ts`,
   `packages/plugins/plugin-sharing/src/department-graph.ts`.
 - Role concept: `packages/plugins/plugin-security/src/objects/sys-role.object.ts` (no `parent`),
-  `packages/plugins/plugin-sharing/src/role-graph.ts:52` (broken walk).
-- better-auth boundary: `packages/platform-objects/src/identity/sys-member.object.ts:152`,
-  `packages/plugins/plugin-auth/src/auth-manager.ts:657`,
+  `packages/plugins/plugin-sharing/src/role-graph.ts` (broken walk).
+- better-auth boundary: `packages/platform-objects/src/identity/sys-member.object.ts#managedBy`,
+  `packages/plugins/plugin-auth/src/auth-manager.ts`,
   `packages/plugins/plugin-auth/src/auth-schema-config.ts`.
 - Seeding precedent: `packages/plugins/plugin-security/src/bootstrap-platform-admin.ts`; sharing boot:
-  `packages/plugins/plugin-sharing/src/sharing-plugin.ts:168`.
+  `packages/plugins/plugin-sharing/src/sharing-plugin.ts#bindRuleHooks`.
 
 ---
 
@@ -371,7 +371,7 @@ open/paid resolver seam). It did **not** settle how the three org-shaped objects
 - `sys_team` (better-auth) — the **flat collaboration grouping**.
 
 Left unaddressed, all three land flat in the Setup `group_people_org` menu
-(`packages/platform-objects/src/apps/setup-nav.contributions.ts:48-55`) and read as three
+(`packages/platform-objects/src/apps/setup-nav.contributions.ts#group_people_org`) and read as three
 competing "organisation" concepts — the ambiguity is sharpest in a single-tenant install,
 where `sys_organization` is a single, un-creatable row. This addendum closes that gap. One
 decision per gap (ADR-0049 discipline); no model change, only surfacing + one denormalised
@@ -426,14 +426,14 @@ migration; BU stays usable as owning-unit coordinate, explicit sharing recipient
 people-picker filter even when its nav is hidden). Only the **nav entries** tier:
 
 - **Business Units.** `nav_business_units` today carries `requiresObject: 'sys_business_unit'`
-  (`setup-nav.contributions.ts:50`), but `platform-objects` registers that object
+  (`packages/platform-objects/src/apps/setup-nav.contributions.ts`), but `platform-objects` registers that object
   unconditionally, so the gate is **inert (always true)**. Move the entry **out** of
   `SETUP_NAV_CONTRIBUTIONS` and contribute it from the capability that gives BU teeth —
   the hierarchy-security capability (`@objectstack/security-enterprise` when present), or an
   explicit app opt-in feature `business-units` — exactly the ADR-0029 K2 pattern already
   used for webhooks/approvals/sharing ("nav lives and dies with the capability").
 - **Organizations / Invitations.** `nav_organizations` / `nav_invitations`
-  (`setup-nav.contributions.ts:52-53`) carry no gate at all today. Add a
+  (`packages/platform-objects/src/apps/setup-nav.contributions.ts#nav_organizations`) carry no gate at all today. Add a
   `multiOrgEnabled != false` visibility gate (same predicate as the create action).
 - **Mechanism gap to close first (ADR-0049 — gated, never silently inert).** The
   `create_organization` *action* gates via a `visible` CEL string, but a `NavigationItem`
@@ -443,7 +443,7 @@ people-picker filter even when its nav is hidden). Only the **nav entries** tier
 
 ### D11 — Resolve the `team` naming collision: drop `team` from `sys_business_unit.kind`
 
-`sys_business_unit.kind` includes `team` (`sys-business-unit.object.ts:96`,
+`sys_business_unit.kind` includes `team` (`packages/platform-objects/src/identity/sys-business-unit.object.ts#sys_business_unit`,
 `company | division | department | team | office | cost_center`), colliding head-on with the
 first-class `sys_team`: a `kind='team'` BU walks `BusinessUnitGraphService` (hierarchical)
 while `sys_team` walks `TeamGraphService` (flat) — two "teams", different semantics, no UI
@@ -568,15 +568,15 @@ Both consumers that need it still terminate in `sys_member.role` only, and neith
 `sys_user_role`:
 
 - **plugin-approvals** — `expandApprovers` dispatches a `role` approver to
-  `expandRoleUsers` (`approval-service.ts:306`), which queries `find('sys_member', { filter: { role } })`
-  (`approval-service.ts:380-389`; the doc comment at `:286` even pins the semantics to
+  `expandRoleUsers` (`packages/plugins/plugin-approvals/src/approval-service.ts#sys_member`), which queries `find('sys_member', { filter: { role } })`
+ (`packages/plugins/plugin-approvals/src/approval-service.ts#sys_member`; the doc comment at even pins the semantics to
   "`sys_member.role = value`"). No `sys_role` / `sys_user_role` read.
 - **plugin-sharing** — a `role` recipient resolves via `teamGraph.expandRoleUsers`
-  (`role-graph.ts:100`, `team-graph.ts:144`), whose terminal query is
-  `find('sys_member', …)` (`team-graph.ts:70-80`; comment `:25` "`sys_member.role` for
+  (`role-graph.ts`, `packages/plugins/plugin-sharing/src/team-graph.ts#expandRoleUsers`), whose terminal query is
+ `find('sys_member', …)` (`packages/plugins/plugin-sharing/src/team-graph.ts#sys_member`; comment "`sys_member.role` for
   tenant role expansion"). Sharing is *partially* further along — its
   `RoleHierarchyGraph` walks `sys_role.parent` to find subordinate roles
-  (`role-graph.ts:57`) — but the final role→**user** hop is still `sys_member`.
+  (`role-graph.ts`) — but the final role→**user** hop is still `sys_member`.
 
 Note `plugin-approvals` is **not** in this ADR's Consumers list; `plugin-sharing` **is**.
 That both behave identically is the key signal below.
diff --git a/docs/adr/0061-record-search-architecture.md b/docs/adr/0061-record-search-architecture.md
index 5ec40ba56f..4030cf5f95 100644
--- a/docs/adr/0061-record-search-architecture.md
+++ b/docs/adr/0061-record-search-architecture.md
@@ -17,14 +17,14 @@ Decision: **enforce** record search as one **metadata-driven, server-resolved**
 ## Context
 
 ### The declared-but-unenforced failure, again
-ObjectStack's defining risk is not a crash but a primitive that is *declarable* yet *inert* (ADR-0049, ADR-0060). Record search is a clean instance: the `docs/audits/2026-06-record-search-liveness.md` evidence shows `$search` (`spec/.../query.zod.ts:454`) parsed but executed by no driver (`driver-sql`/`memory` both `fullTextSearch: false`), so it returns rows unfiltered. AI authorship amplifies this — a model emits `searchableFields` that *looks* wired and nothing reads it.
+ObjectStack's defining risk is not a crash but a primitive that is *declarable* yet *inert* (ADR-0049, ADR-0060). Record search is a clean instance: the `docs/audits/2026-06-record-search-liveness.md` evidence shows `$search` (`packages/spec/src/data/query.zod.ts`) parsed but executed by no driver (`driver-sql`/`memory` both `fullTextSearch: false`), so it returns rows unfiltered. AI authorship amplifies this — a model emits `searchableFields` that *looks* wired and nothing reads it.
 
 ### The requirement is platform-wide, not "lookup multi-field search"
 Search surfaces, all sending the same `$search` today:
 - **Lookup picker** (`fields/LookupField`, `RecordPickerDialog`) — type-ahead + dialog.
 - **List quick-search** (`plugin-list/ListView`) — already sends `$searchFields` (drift).
 - **Global / ⌘K** (`app-shell/CommandPalette` → `react/useRecordSearch`) — client fan-out + client ranking.
-- **Public-form picker** (`rest-server.ts:3751`) — the only working, scoped path.
+- **Public-form picker** (`packages/rest/src/rest-server.ts`) — the only working, scoped path.
 - **Structured filters** (FilterUI, grid/report filter bars) — `$filter`/`$contains`, *not* full-text; out of scope here.
 - **Knowledge / RAG / vector** — separate semantic subsystem; out of scope here.
 
diff --git a/docs/adr/0065-sdui-styling-model.md b/docs/adr/0065-sdui-styling-model.md
index 33c473b079..8ee6456bf4 100644
--- a/docs/adr/0065-sdui-styling-model.md
+++ b/docs/adr/0065-sdui-styling-model.md
@@ -1,6 +1,6 @@
 # ADR-0065: SDUI styling model — scoped style-objects over arbitrary Tailwind classes
 
-**Status**: Accepted (2026-06-22) — open-mechanism half implemented: `style`/`responsiveStyles` on the spec UI envelope (`page.zod.ts:97,106`), reference scoped-styles compiler + four-property test (objectui `core/src/styling/scoped-styles.ts(.test)`), token/Tailwind lint (`lint/validate-responsive-styles.ts`). Cloud tier-policy + VLM gate remain the cloud half.
+**Status**: Accepted (2026-06-22) — open-mechanism half implemented: `style`/`responsiveStyles` on the spec UI envelope (`packages/spec/src/ui/page.zod.ts#responsiveStyles`), reference scoped-styles compiler + four-property test (objectui `core/src/styling/scoped-styles.ts(.test)`), token/Tailwind lint (`lint/validate-responsive-styles.ts`). Cloud tier-policy + VLM gate remain the cloud half.
 **Deciders**: ObjectStack Protocol Architects
 **Builds on**: [ADR-0026](./0026-client-ui-plugin-distribution.md) (client UI distribution), [ADR-0016](./0016-studio-package-authoring-and-publish.md) (package authoring/publish), [ADR-0049](./0049-no-unenforced-security-properties.md) (spec must not promise what the runtime can't deliver)
 **Consumers**: `@objectstack/spec` (UI component envelope), the objectui renderers (`@object-ui/components`), cloud SDUI page authoring, the AI metadata-authoring agents.
@@ -20,7 +20,7 @@ Three independent failure axes, any one of which is disqualifying, all bite at o
 
 1. **Compilation.** Tailwind is JIT-compiled at *build* time, scanning *source*.
    The renderer (objectui Console) is a shipped, frozen artifact whose CSS scans
-   only objectui's own `src` (`objectui: apps/console/src/index.css:12-19`),
+   only objectui's own `src` (`objectui: `objectui:apps/console/src/index.css``),
    **never** the page metadata. There is **no safelist**. So a class in metadata
    produces CSS *only if it coincidentally also appears in objectui source*.
    (The Pricing page renders today purely because all 16 of its classes happen
@@ -62,7 +62,7 @@ platform.
 ### What we have
 
 UI components carry a loose `className` passthrough. The objectui renderers apply
-it directly — e.g. `objectui: packages/components/src/renderers/basic/elements.tsx:87`
+it directly — e.g. `objectui: `objectui:packages/components/src/renderers/basic/elements.tsx``
 (`cn(VARIANT_CLASS, ALIGN_CLASS, schema?.className)`). The spec does **not** even
 formally model a styling field (`packages/spec/src/ui/component.zod.ts` defines
 per-component `properties` + `children`, no `style`). So styling today is "write
@@ -93,11 +93,11 @@ Builder.io solves exactly this shape (visual content authored separately,
 rendered into arbitrary host stacks) and **does not bet on Tailwind classes**:
 
 - Styles are CSS **objects**, per breakpoint —
-  `Builder.io SDK: packages/sdks/src/types/builder-block.ts:42`
+  `Builder.io SDK: packages/sdks/src/types/builder-block.ts:42` <!-- anchor-exempt: EXTERNAL -->
   (`responsiveStyles?: { large?, medium?, small?, xsmall?: Partial<CSSStyleDeclaration> }`).
 - Responsive is an **explicit breakpoint map in the data model** (desktop-first:
   `large` is base, smaller sizes override via `@media (max-width: …)` —
-  `Builder.io SDK: packages/sdks/src/constants/device-sizes.ts:34`), **not**
+  `Builder.io SDK: packages/sdks/src/constants/device-sizes.ts:34` <!-- anchor-exempt: EXTERNAL -->), **not**
   `md:` utility variants the author writes.
 - At render, each block's styles compile to **id-scoped CSS** —
   `Builder.io SDK: packages/sdks/src/helpers/css.ts` (`createCssClass` emits
diff --git a/docs/adr/0070-package-first-authoring.md b/docs/adr/0070-package-first-authoring.md
index d301a302e7..a471305992 100644
--- a/docs/adr/0070-package-first-authoring.md
+++ b/docs/adr/0070-package-first-authoring.md
@@ -40,7 +40,7 @@ Built across the three surfaces and verified end-to-end in a real environment vi
 |---|---|---|---|---|
 | **Kernel** `protocol.saveMetaItem` (`@objectstack/objectql`) | `?package=` passed by caller; for a `runtime-only` write whose target is a *loaded code package*, the binding is **coerced to `null`** (`isLoadedPackage` guard, #2252) | **Yes** — by design today (the coercion *creates* nulls) | guarded (won't stamp into a loaded code pkg) | **[existing]** |
 | **Studio UI** (`../objectui`) | the package **selector** (`StudioHomePage`/`DirectoryPage`/`ResourceListPage` read `?package=`); a "Local / Custom" scope (`sys_metadata`) surfaces the null bucket (#1946); `PackagesPage` *can* create a writable package, but the create flow doesn't **require** one | **Yes** — default scope is a code pkg or the null bucket | partially (object becomes read-only — fixed for editability, not for *where it lives*) | **[existing]** |
-| **AI authoring** (`../cloud` `service-ai-studio`) | `resolvePackageId` (`metadata-tools.ts:268-328`): explicit `packageId` -> target item's pkg -> conversation active pkg -> single-app pkg -> **auto-create `com.workspace`**; read-only pkgs **rejected** (`:319`); `create_package` / `set_active_package` / `apply_blueprint` (`ensureAppPackage`) exist | **Soft** — auto-defaults into a catch-all instead of requiring a choice | **rejected** (`metadata-tools.ts:319`) | **[existing]** — most advanced of the three |
+| **AI authoring** (`../cloud` `service-ai-studio`) | `resolvePackageId` (`metadata-tools.ts`): explicit `packageId` -> target item's pkg -> conversation active pkg -> single-app pkg -> **auto-create `com.workspace`**; read-only pkgs **rejected** (); `create_package` / `set_active_package` / `apply_blueprint` (`ensureAppPackage`) exist | **Soft** — auto-defaults into a catch-all instead of requiring a choice | **rejected** (`metadata-tools.ts`) | **[existing]** — most advanced of the three |
 
 The primitives already exist on every surface (a package concept; a way to create one; a read-only/writable distinction in cloud). **What is missing is a single, enforced contract** so the three surfaces agree, and so authored metadata always has a managed home.
 
@@ -68,7 +68,7 @@ The kernel exposes a single predicate — *is this package writable?* — reused
 Every authoring surface follows the same contract; none silently defaults into a catch-all:
 
 - **Studio UI** [new]: the scope selector defaults to a *writable* package (the user's most-recent base) or, when none exists, the create entry points (`新建`) **prompt to create a base** (reuse the existing `PackagesPage` create dialog) before opening the designer. New items are bound to the active writable package. The "Local / Custom" (`sys_metadata`) scope is removed as a create destination (see D5).
-- **AI authoring** [new] (`../cloud` `service-ai-studio`): `resolvePackageId` **drops the auto-`com.workspace` fallback** (`metadata-tools.ts:304`) and the `applyDraft` re-bind (`:568-573`); when no writable package is resolvable it returns an actionable error directing the agent to `create_package` or `set_active_package`. `apply_blueprint` requires a package context (its `ensureAppPackage` is invoked only after an explicit create/confirm). Skill prompts (`metadata-authoring-skill.ts`, `solution-design-skill.ts`) are updated to make "establish the base first" a hard step, not a hint.
+- **AI authoring** [new] (`../cloud` `service-ai-studio`): `resolvePackageId` **drops the auto-`com.workspace` fallback** (`metadata-tools.ts`) and the `applyDraft` re-bind (); when no writable package is resolvable it returns an actionable error directing the agent to `create_package` or `set_active_package`. `apply_blueprint` requires a package context (its `ensureAppPackage` is invoked only after an explicit create/confirm). Skill prompts (`metadata-authoring-skill.ts`, `solution-design-skill.ts`) are updated to make "establish the base first" a hard step, not a hint.
 - **Kernel** [new]: D1 is the backstop — even if a surface regresses, the write is rejected, not orphaned.
 
 ### D4 — The package is the lifecycle unit (delete / export / snapshot / duplicate) [new]
diff --git a/docs/adr/0072-reference-scope-and-resolvability.md b/docs/adr/0072-reference-scope-and-resolvability.md
index 502e23adfe..db1654455f 100644
--- a/docs/adr/0072-reference-scope-and-resolvability.md
+++ b/docs/adr/0072-reference-scope-and-resolvability.md
@@ -36,7 +36,7 @@ These are the same class of bug: **referencing something that is not actually in
 
 ### Evidence — how the runtime actually seeds references
 
-**Flow / edge / decision conditions** (`packages/services/service-automation/src/engine.ts:946-964`): the engine seeds `$record` + `record` = the **raw** trigger record, **flattens** its fields to top-level (so bare `status`/`budget` resolve), and adds `previous`, flow `variables`, prior-node outputs, `$runId`/`$flowName`. Crucially the record is injected verbatim:
+**Flow / edge / decision conditions** (`packages/services/service-automation/src/engine.ts#variables`): the engine seeds `$record` + `record` = the **raw** trigger record, **flattens** its fields to top-level (so bare `status`/`budget` resolve), and adds `previous`, flow `variables`, prior-node outputs, `$runId`/`$flowName`. Crucially the record is injected verbatim:
 
 ```js
 variables.set('record', context.record);
@@ -50,22 +50,22 @@ for (const [k, v] of Object.entries(context.record))
 
 | Surface | Evaluator (file:line) | In-scope references | Token shape |
 | :-- | :-- | :-- | :-- |
-| Flow / edge / decision | `service-automation/src/engine.ts:946-964` | `record`,`previous`, **flattened record fields**, flow `variables`, node outputs, `$runId`/`$flowName` | bare **and** `record.x` |
-| Formula field (`Field.expression`) | `objectql/src/engine.ts:119` | `{ now, timezone, user, org, record }` | `record.x` only |
-| Validation (`script`/`cross_field`/`when`) | `objectql/src/validation/rule-validator.ts:289` | `{ record: {...previous,...patch}, previous }` | `record.x` only |
-| Field `visibleWhen`/`requiredWhen`/`readonlyWhen` | `objectql/src/validation/rule-validator.ts:178-190` | merged `record`, `previous`, (`parent` for master-detail — server-bound for `readonlyWhen` since #4889; the client grid binds it for all three) | `record.x` only |
-| Hook lifecycle `condition` | `objectql/src/hook-wrappers.ts:84` | `{ record }` | `record.x` only |
-| RLS `using`/`check` (compile→filter) | `plugin-security/src/rls-compiler.ts:259` | `current_user.*` (+ pre-resolved membership), record field names | field operands; pushdown subset only |
-| Sharing-rule `condition` (compile→filter) | `plugin-sharing/src/bootstrap-declared-sharing-rules.ts:61` | record fields only | field operands; pushdown subset only |
-| Action/view/app `visible` | framework UI layer; roots in `@objectstack/formula cel-engine.ts:52-62` | `record`,`os`,`user`,`ctx`,`features`,… | `record.x` / namespaced |
+| Flow / edge / decision | `packages/services/service-automation/src/engine.ts#variables` | `record`,`previous`, **flattened record fields**, flow `variables`, node outputs, `$runId`/`$flowName` | bare **and** `record.x` |
+| Formula field (`Field.expression`) | `packages/objectql/src/engine.ts#expression` | `{ now, timezone, user, org, record }` | `record.x` only |
+| Validation (`script`/`cross_field`/`when`) | `packages/objectql/src/validation/rule-validator.ts#cross_field` | `{ record: {...previous,...patch}, previous }` | `record.x` only |
+| Field `visibleWhen`/`requiredWhen`/`readonlyWhen` | `packages/objectql/src/validation/rule-validator.ts#readonlyWhen` | merged `record`, `previous`, (`parent` for master-detail — server-bound for `readonlyWhen` since #4889; the client grid binds it for all three) | `record.x` only |
+| Hook lifecycle `condition` | `packages/objectql/src/hook-wrappers.ts#condition` | `{ record }` | `record.x` only |
+| RLS `using`/`check` (compile→filter) | `packages/plugins/plugin-security/src/rls-compiler.ts` | `current_user.*` (+ pre-resolved membership), record field names | field operands; pushdown subset only |
+| Sharing-rule `condition` (compile→filter) | `packages/plugins/plugin-sharing/src/bootstrap-declared-sharing-rules.ts` | record fields only | field operands; pushdown subset only |
+| Action/view/app `visible` | framework UI layer; roots in `@objectstack/formula packages/formula/src/cel-engine.ts` | `record`,`os`,`user`,`ctx`,`features`,… | `record.x` / namespaced |
 
-The canonical CEL scope roots the engine recognises are declared in `@objectstack/formula cel-engine.ts:52-62`: `record, previous, input, output, os, vars, variables, automation, context, args, item, env, user, step, result, trigger, event, payload, data, params, config, settings, ctx, features, parent`.
+The canonical CEL scope roots the engine recognises are declared in `@objectstack/formula packages/formula/src/cel-engine.ts`: `record, previous, input, output, os, vars, variables, automation, context, args, item, env, user, step, result, trigger, event, payload, data, params, config, settings, ctx, features, parent`.
 
 Two consequences for the picker model:
 - **Token shape is surface-specific** (flow = bare-or-dotted; everything else = dotted). The picker must know the surface.
 - There is **one canonical root allowlist** the validator should reuse, instead of a hand-rolled one.
 
-**`outputSchema` today** (`packages/spec/src/automation/flow.zod.ts:129-132`): `Record<string, { type: 'string'|'number'|'boolean'|'object'|'array'; description?: string }>`, **optional**, carries **no `objectName`**, is **not consumed by the engine**, and is read by the designer only for connector/Tool display. So it cannot, today, tell the picker *which object* an `object`-typed output holds. The reliable signal is the **producing node's `config.objectName`** (required on CRUD nodes) found by walking the graph back — exactly the walk the objectui picker already does (`@object-ui/app-shell` · `inspectors/flow-scope.ts` `flowAncestors`).
+**`outputSchema` today** (`packages/spec/src/automation/flow.zod.ts#outputSchema`): `Record<string, { type: 'string'|'number'|'boolean'|'object'|'array'; description?: string }>`, **optional**, carries **no `objectName`**, is **not consumed by the engine**, and is read by the designer only for connector/Tool display. So it cannot, today, tell the picker *which object* an `object`-typed output holds. The reliable signal is the **producing node's `config.objectName`** (required on CRUD nodes) found by walking the graph back — exactly the walk the objectui picker already does (`@object-ui/app-shell` · `inspectors/flow-scope.ts` `flowAncestors`).
 
 ### What already shipped (Slice 0/1, objectui #1934)
 
@@ -83,7 +83,7 @@ The flow data-picker and its inline validator already landed in objectui: graph-
 
 **D4 — Relationships are a guided fetch, never a lookup dot-walk.** Because the engine does not expand lookups (Evidence), `record.<lookup>.<field>` is **forbidden** from the picker. When an author wants a related record's fields, the picker offers the lookup as a leaf (`record.account`, an id) plus an affordance — *"Account is a related record — add a Get Records step to load it"* — that scaffolds a `get_record` node whose output is then drillable (`account_data.*`). This is the Salesforce-Flow pattern and the only runtime-honest relational story.
 
-**D5 — Validation pairs with the picker and reuses the engine's truth.** Inline validation flags (a) ADR-0032 brace/shape errors (deterministic, scope-free) and (b) scope-aware unknown roots. Its allowlist of "known roots" MUST track the engine's canonical scope roots (`@objectstack/formula cel-engine.ts:52-62`) rather than a private list, and it MUST skip surfaces/positions where it cannot decide without a fetch (e.g. the start node's bare trigger fields) to keep false positives at zero. Flow-level issues also surface as Problems-panel rows + canvas badges (ADR-0058 fail-policy: authoring-time guidance, non-blocking).
+**D5 — Validation pairs with the picker and reuses the engine's truth.** Inline validation flags (a) ADR-0032 brace/shape errors (deterministic, scope-free) and (b) scope-aware unknown roots. Its allowlist of "known roots" MUST track the engine's canonical scope roots (`@objectstack/formula packages/formula/src/cel-engine.ts`) rather than a private list, and it MUST skip surfaces/positions where it cannot decide without a fetch (e.g. the start node's bare trigger fields) to keep false positives at zero. Flow-level issues also surface as Problems-panel rows + canvas badges (ADR-0058 fail-policy: authoring-time guidance, non-blocking).
 
 **D6 — `outputSchema` evolves into the authoritative output-typing channel.** Add an optional `objectName` (and array-item type) to `FlowNode.outputSchema` entries so an `object`-typed output can name its object — making D3 work for *any* producer, including connectors and subflows that have no `config.objectName`. Built-in CRUD executors populate it from their `objectName`; the designer prefers `outputSchema.objectName`, falling back to the graph-walk. Until then, D3 runs on `config.objectName`. (Spec change owned by this repo; coordinate the designer change in objectui.)
 
@@ -116,7 +116,7 @@ The flow data-picker and its inline validator already landed in objectui: graph-
 
 1. **Auto-expand lookups (`record.account.name`).** Rejected — the engine does not expand lookups (Evidence); every such token would resolve to `undefined`, violating D1. This is the literal #1934 follow-up ask; the investigation that killed it is the reason for this ADR.
 2. **Pre-fetch the whole schema graph and show a flat list.** Rejected — N+M fetches on open, hundreds of entries, and still can't represent relationships honestly. The lazy tree (D3) scales and stays quiet.
-3. **A private "known globals" allowlist in the validator.** Rejected for the long term — drifts from the engine. D5 reuses `cel-engine.ts:52-62`.
+3. **A private "known globals" allowlist in the validator.** Rejected for the long term — drifts from the engine. D5 reuses `packages/formula/src/cel-engine.ts`.
 4. **Designer-only `outputSchema` typing (no spec change).** Rejected as the end state — connectors/subflows have no `config.objectName`; D6 makes typing authoritative and plugin-extensible.
 
 ## Open questions
diff --git a/docs/adr/0079-record-display-name.md b/docs/adr/0079-record-display-name.md
index c3edf88f36..aeb222f08b 100644
--- a/docs/adr/0079-record-display-name.md
+++ b/docs/adr/0079-record-display-name.md
@@ -73,7 +73,7 @@ opens.
 The specific defects the implementation names:
 
 - **`titleFormat` is unqueryable by construction.** It is a render-only
-  template. `packages/lint/src/validate-record-title.ts:92` states the
+  template. `packages/lint/src/validate-record-title.ts` states the
   consequence: *"titleFormat is a render-only template the server cannot return
   or query"*. A title the server cannot return cannot be sorted on, searched,
   or sent in a notification body — so a title expressed only as a template is
@@ -98,7 +98,7 @@ Not a template, not a client-side composition.
 > "A record's human title is a STRUCTURAL INVARIANT: every object has exactly
 > one primary title field, which is a real STORED field (text / autonumber /
 > formula whose result is text)."
-> — `packages/spec/src/data/display-name.ts:6-8`
+> — `packages/spec/src/data/display-name.ts`
 
 ### D2 — `nameField` is canonical; `displayNameField` is a deprecated alias
 
@@ -108,20 +108,20 @@ contract:
 
 - `ObjectSchema.parse` / `.safeParse` / `.create()` copy `displayNameField` onto
   `nameField` when `nameField` is absent
-  (`normalizeNameFieldAlias`, `packages/spec/src/data/object.zod.ts:2082-2095`,
-  installed on the parse path at `:2149-2158` and reached by `create()` at
-  `:2204`).
+  (`normalizeNameFieldAlias`, `packages/spec/src/data/object.zod.ts#normalizeNameFieldAlias`,
+  installed on the parse path at `packages/spec/src/data/object.zod.ts` and reached by `create()` at
+  `packages/spec/src/data/object.zod.ts`).
 - **Both keys are preserved on the parsed output** — deliberately, for
   cross-repo consumers and older tests that still read the old spelling
-  (`object.zod.ts:2084-2085`).
+  (`packages/spec/src/data/object.zod.ts#displayNameField`).
 - The schema's own text marks the direction: `displayNameField` describes
-  itself as `[DEPRECATED → nameField]` (`object.zod.ts:1698`).
+  itself as `[DEPRECATED → nameField]` (`packages/spec/src/data/object.zod.ts#nameField`).
 
 This is the alias mechanic ADR-0085 later adopted verbatim: *"Mechanics follow
 ADR-0079's `displayNameField → nameField` precedent exactly: `compactLayout` is
 accepted as a parse-time alias, copied onto `highlightFields`, both preserved on
 output, describe marks the old key deprecated."*
-(`docs/adr/0085-object-semantic-roles-over-surface-hint-blocks.md:57`)
+(`docs/adr/0085-object-semantic-roles-over-surface-hint-blocks.md`)
 
 ### D3 — `titleFormat` is retired in favour of `nameField`
 
@@ -139,8 +139,8 @@ the diagnostic is advisory, not an error:
 **Migration is stated, not left to the author**: a single-field title becomes
 `nameField: '<field>'`; a **composite** title becomes a `formula` field with
 `returnType: 'text'`, designated as the `nameField`
-(`validate-record-title.ts:91-96`; the worked example is
-`content/docs/data-modeling/formulas.mdx:94-102`).
+(`packages/lint/src/validate-record-title.ts`; the worked example is
+`content/docs/data-modeling/formulas.mdx`).
 
 ### D4 — One resolution order, shared by every consumer
 
@@ -161,10 +161,10 @@ Derivation, restricted to title-eligible fields, is ranked:
 The two runtime seams that consume it compute it identically, and each says so
 where it does:
 
-- `packages/objectql/src/engine.ts:5212` — *"[ADR-0079] `nameField` is the
+- `packages/objectql/src/engine.ts` — *"[ADR-0079] `nameField` is the
   canonical primary-title pointer; `displayNameField` is the deprecated alias
   (still honored)"*, feeding `expandSearchToFilter`.
-- `packages/metadata-protocol/src/protocol.ts:4793` — *"[ADR-0079] Same
+- `packages/metadata-protocol/src/protocol.ts` — *"[ADR-0079] Same
   precedence the engine's search expansion applies"*, feeding the REST
   `$searchFields` ingress gate.
 
@@ -184,16 +184,16 @@ Two judgement calls are recorded rather than left implicit:
 
 - **`email` is eligible, `phone` is not.** *"`phone` is deliberately excluded (a
   phone number is not a title); `email` IS eligible (commonly the human handle
-  on identity-ish objects)"* (`display-name.ts:71-72`).
+  on identity-ish objects)"* (`packages/spec/src/data/display-name.ts`).
 - **`autonumber` is a valid primary but is never *derived*.** *"an autonumber is
   a valid primary only when an author points at it explicitly … not something we
-  silently pick"* (`display-name.ts:66-68`).
+  silently pick"* (`packages/spec/src/data/display-name.ts`).
 
 ### D6 — A record never renders as "Untitled"; the floor is `Record #<id>`
 
 `resolveRecordDisplayName` returns the value at the resolved field, and falls
 back to a stable `Record #<id>` — *"NEVER a bare 'Untitled'"*
-(`display-name.ts:13-14`). A view may override the object's choice for one
+(`packages/spec/src/data/display-name.ts#viewTitleField`). A view may override the object's choice for one
 render via `viewTitleField` (e.g. a list view labelling rows by another column);
 that override is per-render and does not change the object's title.
 
@@ -201,7 +201,7 @@ that override is per-render and does not change the object's title.
 
 `SchemaRegistry.registerObject` runs `provisionPrimary(schema, { synthesize:
 false })` — for **owned** objects only, after `applySystemFields`
-(`packages/objectql/src/registry.ts:1079-1090`).
+(`packages/objectql/src/registry.ts`).
 
 - Where a title-eligible field already exists, `nameField` is **designated** —
   so it is reliably populated for normal / user-built / AI-built objects.
@@ -223,18 +223,18 @@ returns `status: 'none'`) — and **never errors**:
 
 > "Both are warnings: the auto-provision transform and the id floor mean a green
 > build never ships a fully title-less object."
-> — `packages/lint/src/validate-record-title.ts:26-27`
+> — `packages/lint/src/validate-record-title.ts`
 
 It runs on `os build` / `os validate` / `os lint`, the MCP authoring surface and
 hand authoring — *not* only on the cloud graph-lint path. That is ADR-0078's
 "not cloud-only" principle applied
-(`validate-record-title.ts:12-14`, `packages/lint/src/authoring-rules.ts:668-678`).
+(`packages/lint/src/validate-record-title.ts`, `packages/lint/src/authoring-rules.ts`).
 
 ### D9 — There is exactly one title pointer; a second is not a tolerable alias
 
 `primaryField` was read as a title pointer by two lint rules and was **removed**,
 not declared, in #6326. The reasoning is recorded at
-`packages/lint/src/data-model-rules.ts:404-409`:
+`packages/lint/src/data-model-rules.ts`:
 
 > "The maintainer ruled remove, not declare: `nameField` is ADR-0079's one
 > canonical title pointer and a second parallel pointer contradicts 'one Zod
@@ -253,12 +253,12 @@ contract. Same-looking code, opposite verdicts.
 Search-adjacent consumers read the resolved display field, but it does not
 buy the field an exemption from their own exclusion rules. `$search` field
 resolution leads with the display field **as ordering, never as membership**
-(`packages/spec/src/data/search-fields.ts:75-92`, #4483) — the concrete failure
+(`packages/spec/src/data/search-fields.ts`, #4483) — the concrete failure
 that forced the distinction being D7's designate-only pass setting `nameField:
 'id'` on tables whose only textual column is the primary key, which had turned
 `$search` into a substring scan over the primary key. The ADR-0098 pinyin
 companion column likewise takes *only* the resolved display field as its source
-(`packages/objectql/src/search-companion.ts:19`, `:104`).
+(`packages/objectql/src/search-companion.ts`, `packages/objectql/src/search-companion.ts`).
 
 ---
 
@@ -283,7 +283,7 @@ them needs a maintainer, and — for the first three — probably the cloud orig
 
 1. **When, if ever, does `nameField` become required?** #2434 recorded "No hard
    `.refine()` requiring a title (would reject existing metadata)" and
-   `object.zod.ts:1684-1685` still says *"Optional at the schema level for now
+   `packages/spec/src/data/object.zod.ts` still says *"Optional at the schema level for now
    (a hard required-refine is staged)"*. Two months on, "staged" names no
    trigger and no criterion. Nothing in the tree says what would make it fire.
 
@@ -303,7 +303,7 @@ them needs a maintainer, and — for the first three — probably the cloud orig
    word.
 
 4. **`code` is name-like to lint and not to spec.** `packages/lint/src/data-
-   model-rules.ts:36`'s `NAME_LIKE_FIELDS` includes `code`; spec's derivation
+   model-rules.ts`'s `NAME_LIKE_FIELDS` includes `code`; spec's derivation
    set (`display-name.ts:NAME_ISH_EXACT`) does not. So an object whose only
    name-ish field is `code` passes lint's R9 "has a title face" check while
    `resolveDisplayField` will not derive `code` as its title (it may still be
diff --git a/docs/adr/0080-ai-authored-ui-jsx-source.md b/docs/adr/0080-ai-authored-ui-jsx-source.md
index 96247e2f10..f6cff748b0 100644
--- a/docs/adr/0080-ai-authored-ui-jsx-source.md
+++ b/docs/adr/0080-ai-authored-ui-jsx-source.md
@@ -7,7 +7,7 @@
 
 **Premise**: the current SDUI page metadata is a fixed-shape, slotted schema. To let AI customize pages with real layout freedom we need a richer authoring surface — but the three obvious richer surfaces each fail a hard constraint, and the failure modes are exactly the ones ADR-0077/0078 warn about (ambiguous surface + silent wrongness). This ADR pins the surface, the contract, and where compilation runs, **before** the AI authors a large body of pages against an ambiguous one. It adds almost no runtime to the renderer: it adds a *source format* and a *compiler in front of the existing pipeline*.
 
-> **Trigger**: a design review of "the page metadata can't express AI-flexible layouts; HTML can't reach our component library; React needs a build/deploy and is unsafe to execute." The investigation found that the renderer is **already** a recursive tree interpreter over a registered component set (`@object-ui/react` `SchemaRenderer` → `ComponentRegistry.get(type)` → `React.createElement`, children recurse), and that the registry **already declares component props** at registration (`ComponentInput` in `packages/core/src/registry/Registry.ts:13`). So the missing piece is not the runtime — it is the *authoring format* (AI is fluent in JSX/Tailwind, not in hand-written JSON trees) and the *contract projection* that makes AI output checkable. The wrong fix — store the JSON tree as the thing AI edits, or lift every component's props into the framework Zod spec — was considered and rejected (see Decision §3, §5).
+> **Trigger**: a design review of "the page metadata can't express AI-flexible layouts; HTML can't reach our component library; React needs a build/deploy and is unsafe to execute." The investigation found that the renderer is **already** a recursive tree interpreter over a registered component set (`@object-ui/react` `SchemaRenderer` → `ComponentRegistry.get(type)` → `React.createElement`, children recurse), and that the registry **already declares component props** at registration (`ComponentInput` in `objectui:packages/core/src/registry/Registry.ts`). So the missing piece is not the runtime — it is the *authoring format* (AI is fluent in JSX/Tailwind, not in hand-written JSON trees) and the *contract projection* that makes AI output checkable. The wrong fix — store the JSON tree as the thing AI edits, or lift every component's props into the framework Zod spec — was considered and rejected (see Decision §3, §5).
 
 ---
 
@@ -17,7 +17,7 @@
 
 1. **[model] AI authors a constrained *JSX text*, not a JSON tree.** The JSON `SchemaNode` tree is a fine *compile target* and a terrible *edit surface* — verbose, out-of-distribution for the model, noisy to diff, and it loses manual tweaks on every regeneration. AI reads/edits JSX+Tailwind (its strength); the tree is **derived**, never hand-edited. (This is how v0/Markdoc/MDX keep source = code, output = compiled.)
 2. **[ruled] parse ≠ execute (the Markdoc model).** The JSX text is **parsed** to an AST and **interpreted** by mapping tags to registered components — no JS is ever run. This is categorically different from real React (`import`/bundle/eval): it keeps multi-tenant-as-data, needs no build/deploy, and never executes untrusted code. A stored string that is *parsed* is still data; a stored module that is *executed* is not. Looks like React, is not React.
-3. **[ruled] The component registry is the authoritative contract — do not duplicate it into the framework Zod spec.** `ComponentInput` already carries `name / type / required / enum / description / defaultValue / isContainer / slot`. That is enough to (a) codegen the JSX type surface (`.d.ts` → `JSX.IntrinsicElements`) and (b) validate AI output at the level that catches the real errors (unknown component, unknown/missing prop, wrong coarse type, illegal enum value). The framework spec owns only the **tree envelope** (page/region/children recursion) and **consumes** a serialized manifest of the registry — it must **not** re-declare per-component props. (`page.zod.ts:85` is today `properties: z.record(z.unknown())` — ungated, the same `z.record` escape as the flow-node-config debt; the fix is the registry manifest, not a parallel hand-authored Zod copy.)
+3. **[ruled] The component registry is the authoritative contract — do not duplicate it into the framework Zod spec.** `ComponentInput` already carries `name / type / required / enum / description / defaultValue / isContainer / slot`. That is enough to (a) codegen the JSX type surface (`.d.ts` → `JSX.IntrinsicElements`) and (b) validate AI output at the level that catches the real errors (unknown component, unknown/missing prop, wrong coarse type, illegal enum value). The framework spec owns only the **tree envelope** (page/region/children recursion) and **consumes** a serialized manifest of the registry — it must **not** re-declare per-component props. (`packages/spec/src/ui/page.zod.ts#defaultValue` is today `properties: z.record(z.unknown())` — ungated, the same `z.record` escape as the flow-node-config debt; the fix is the registry manifest, not a parallel hand-authored Zod copy.)
 4. **[model] capability ≠ contract.** All ~244 registered types remain a rendering *capability*. Only a **curated public tier (~35 blocks)** — shaped like Salesforce's App Builder standard components, object-centric, generated from a `tier:'public'` flag — is what gets type-checking, the api-surface ratchet, customer docs, and the AI vocabulary. Do not freeze 244 internal/admin/studio components into a versioned contract.
 5. **[ruled] Authoritative parse + sanitize + validate + compile runs *server-side at save*; the client renders the *compiled tree*, not the JSX.** Sanitization cannot be client-trusted; binding-correctness needs server-only object schemas; the completeness gate (ADR-0078) and draft-gating (ADR-0033) are already server-side. Store `{ source, compiledTree, requires }` — **source is truth, tree is derived cache.** The client ships **no parser on the render path** (web/mobile render the same pre-validated tree); a client-side copy of the shared parser exists **only** for the live edit/preview loop and is re-validated server-side at save — it is never the trust boundary.
 6. **[staging] Two coupled deliverables, neither blocking the other.** (a) *Complete the registry `inputs`* for the ~35 public blocks (closes existing designer-contract gaps too); (b) *add a JSX-source page kind* (additive — the existing tree page stays; designer round-trip to JSX is deferred). They meet through a codegen'd `.d.ts` (author-time type-check) and a serialized manifest (save-time validate). v1 ships with shallow inputs-validation; depth (nested shapes, binding-against-object-schema) is added incrementally on the public tier only.
@@ -33,8 +33,8 @@ The SDUI runtime is **not** the thing that needs to change:
 | Capability | Where it already lives |
 |---|---|
 | Recursive tree interpreter (`type` → component, children recurse) | `@object-ui/react` `SchemaRenderer` → `ComponentRegistry.get()` → `React.createElement` |
-| Recursive node schema (`{ type, props, children }`, `className`/`style`, `visibleOn`) | `@object-ui/types` `BaseSchema` / discriminated `LayoutSchema` (`packages/types/src/layout.ts:639`, literal `type` discriminants) |
-| Per-component prop declaration | `ComponentInput[]` on `register()` (`packages/core/src/registry/Registry.ts:13`) |
+| Recursive node schema (`{ type, props, children }`, `className`/`style`, `visibleOn`) | `@object-ui/types` `BaseSchema` / discriminated `LayoutSchema` (`objectui:packages/types/src/layout.ts`, literal `type` discriminants) |
+| Per-component prop declaration | `ComponentInput[]` on `register()` (`objectui:packages/core/src/registry/Registry.ts`) |
 | Conflict-free styling channels | typed primitive props → safelisted class map (`ResponsiveGrid.tsx`), and **scoped per-node CSS** (ADR-0065, `packages/core/src/styling/scoped-styles.ts`) |
 | Enumerable catalog across ~40 plugins | `ComponentRegistry.getAllConfigs()` / `getAllTypes()` |
 | An HTML escape hatch (today unsafe) | `renderers/basic/html.tsx` — raw `dangerouslySetInnerHTML`, no sanitize |
@@ -84,7 +84,7 @@ The parser whitelists tags to the registry type set; strips `<script>`, `dangero
 - **Do not lift per-component props into `@objectstack/spec`.** A parallel hand-authored Zod copy is a second source of truth that will drift (the same class of debt as the `${}`-vs-CEL split and the `z.record` flow-node-config escape). `page.zod.ts` changes from `properties: z.record(z.unknown())` to: own the **tree envelope** (recursion, region rules, the JSX-source field) and **reference** the manifest for prop validation.
 - **The object-binding check lives framework-side regardless** — only the framework knows whether `object="account"`/`field="revenue"` resolve. This is the highest-value check and is inherently server-side.
 
-For **core** components with literal-discriminant schemas (`LayoutSchema`, `layout.ts:639`), the `JSX.IntrinsicElements` table can be **derived by a TS mapped type** with zero codegen (`{ [S in Concrete as S['type']]: Omit<S,'type'> }`); **exclude `BaseSchema`** (its `type: string` would emit an index signature that makes every tag valid). Plugin components codegen into the **same** intrinsic surface from the manifest. Tag name === `type` discriminant === registry key.
+For **core** components with literal-discriminant schemas (`LayoutSchema`, `objectui:layout.ts`), the `JSX.IntrinsicElements` table can be **derived by a TS mapped type** with zero codegen (`{ [S in Concrete as S['type']]: Omit<S,'type'> }`); **exclude `BaseSchema`** (its `type: string` would emit an index signature that makes every tag valid). Plugin components codegen into the **same** intrinsic surface from the manifest. Tag name === `type` discriminant === registry key.
 
 ### 4. capability ≠ contract — the curated public tier
 
diff --git a/docs/adr/0086-authz-metadata-config-boundary-and-cross-package-composition.md b/docs/adr/0086-authz-metadata-config-boundary-and-cross-package-composition.md
index 0b734267fb..d7340ef913 100644
--- a/docs/adr/0086-authz-metadata-config-boundary-and-cross-package-composition.md
+++ b/docs/adr/0086-authz-metadata-config-boundary-and-cross-package-composition.md
@@ -54,11 +54,11 @@ scope-fix, P1 framework `bootstrapDeclaredPermissions`, P2 two-door + overlay).
 ### The trigger, and why it is not a one-off
 
 The Access pillar renders `<AccessPillar/>` with **zero props**, so it never receives the
-route's `packageId` (`objectui StudioDesignSurface.tsx:589`). Its matrix loads **all** objects
-via `client.list('object')` with no filter (`PermissionMatrixEditor.tsx:171`) — the "84
+route's `packageId` (`objectui `objectui:StudioDesignSurface.tsx``). Its matrix loads **all** objects
+via `client.list('object')` with no filter (`objectui:PermissionMatrixEditor.tsx`) — the "84
 objects" — and **saves the whole permission-set record**, including its full `objects` dict
-(`:289`). Every other pillar already scopes by `client.list('object', { packageId })`
-(Interfaces `:822`, Data `:1377`); Access simply never got the same treatment. So the surface
+(). Every other pillar already scopes by `client.list('object', { packageId })`
+(Interfaces , Data ); Access simply never got the same treatment. So the surface
 is doing three wrong things at once: it edits an **environment-level** thing from a **package**
 door, with **no package scope**, and **no composition model** to say what "the package's
 access" even means. The last one is the actual gap — the UI can't be scoped correctly until
@@ -68,30 +68,30 @@ the model says which permission bits belong to the package and which to the envi
 
 - **Permission sets are environment-level today, with no owning-package field.**
   `sys_permission_set` is `managedBy: 'config'` on the object-affordance axis
-  (`plugin-security/objects/sys-permission-set.object.ts:20`); `PermissionSetSchema`
-  (`spec/security/permission.zod.ts:108`) has **no `packageId`**. Grants live **inline as flat
-  dicts** on the record: `objects: Record<name, ObjectPermission>` (`:120`) and
-  `fields: Record<"object.field", FieldPermission>` (`:122`). **One record holds every
+  (`packages/plugins/plugin-security/src/objects/sys-permission-set.object.ts`); `PermissionSetSchema`
+  (`packages/spec/src/security/permission.zod.ts#packageId`) has **no `packageId`**. Grants live **inline as flat
+  dicts** on the record: `objects: Record<name, ObjectPermission>` (`#ObjectPermission`) and
+  `fields: Record<"object.field", FieldPermission>` (`#FieldPermission`). **One record holds every
   package's grants.**
 - **Object api names are package-namespaced and collision-proof** (`crm_account`, `todo_task`);
   the prefixed name is the physical table name, so two packages cannot collide
-  (`manifest.zod.ts:142-179`). ⭐ *This is what makes cross-package composition conflict-free at
+  (`packages/spec/src/kernel/manifest.zod.ts#namespace`). ⭐ *This is what makes cross-package composition conflict-free at
   the key level* — a package's grants are exactly the `objects.<namespace>_*` keys.
 - **Runtime resolution is a most-permissive UNION** across a user's assigned sets
-  (`permission-evaluator.ts:64-101`, `'*'` wildcard fallback `:40`); assignment resolution
-  user→roles→sets→union in `core/security/resolve-authz-context.ts:84-252`.
+  (`packages/plugins/plugin-security/src/permission-evaluator.ts#OPERATION_TO_PERMISSION`, `'*'` wildcard fallback `packages/plugins/plugin-security/src/permission-evaluator.ts`); assignment resolution
+  user→roles→sets→union in `packages/core/src/security/resolve-authz-context.ts`.
 - **No package-shipped access exists.** `bootstrapDeclaredRoles` seeds a package manifest's
-  `roles` into `sys_role` (`bootstrap-declared-roles.ts:61`), but there is **no
+  `roles` into `sys_role` (`bootstrap-declared-roles.ts`), but there is **no
   `bootstrapDeclaredPermissions`**. `stack.permissions: PermissionSetSchema[]`
-  (`stack.zod.ts:235`, "Permission Sets and Profiles") is **declarable but never migrated**
-  into `sys_permission_set`. The manifest's `permissions` field (`manifest.zod.ts:264`) is
+  (`packages/spec/src/stack.zod.ts#permissions`, "Permission Sets and Profiles") is **declarable but never migrated**
+  into `sys_permission_set`. The manifest's `permissions` field (`packages/spec/src/kernel/manifest.zod.ts#permissions`) is
   **plugin install-consent scopes** (ADR-0025), *not* RBAC grants. → **a package cannot ship
   default access for its own objects, and the metadata it *can* declare is silently inert** —
   a live ADR-0078 violation. (ADR-0066 **D5** named this "gap to close"; this ADR closes it.)
 - **The vocabulary for the boundary already exists** — two `managedBy` axes:
   provenance/layer `managedBy: 'package' | 'platform' | 'user'`
-  (`metadata-persistence.zod.ts:72`) and the object CRUD-affordance bucket
-  `'platform' | 'config' | 'system' | 'append-only' | 'better-auth'` (`object.zod.ts:408`).
+  (`packages/spec/src/system/metadata-persistence.zod.ts#managedBy`) and the object CRUD-affordance bucket
+  `'platform' | 'config' | 'system' | 'append-only' | 'better-auth'` (`packages/spec/src/data/object.zod.ts`).
   We build on the **provenance** axis, not a parallel one.
 
 ### Governing precedent (do not re-litigate)
@@ -203,7 +203,7 @@ so Shape B loses no flexibility.
 Runtime composition semantics (unchanged, now stated as the contract): **grants UNION
 most-permissively across all of a user's assigned sets; keys never collide because object api
 names are package-namespaced; the flattened per-user effective grant is served at
-`GET /api/v1/auth/me/permissions` (`objectui MePermissionsProvider.tsx:56`).** Precedence with
+`GET /api/v1/auth/me/permissions` (`objectui `objectui:MePermissionsProvider.tsx``).** Precedence with
 AND-gates (`private` posture, `requiredPermissions`) and RLS OR/AND is per ADR-0066's
 *Precedence / combination semantics* — this ADR does not change it.
 
@@ -211,8 +211,8 @@ AND-gates (`private` posture, `requiredPermissions`) and RLS OR/AND is per ADR-0
 
 Installing a package **should** grant working default access to **its own** objects.
 Implement `bootstrapDeclaredPermissions` — the exact sibling of `bootstrapDeclaredRoles`
-(`plugin-security/security-plugin.ts:719`) — that migrates `stack.permissions`
-(`stack.zod.ts:235`) into `sys_permission_set` as `managedBy:'package'` + `packageId`,
+(`packages/plugins/plugin-security/src/security-plugin.ts`) — that migrates `stack.permissions`
+(`packages/spec/src/stack.zod.ts#packageId`) into `sys_permission_set` as `managedBy:'package'` + `packageId`,
 **idempotently** and **upgrade-aware** (re-seed the package's own slice on version bump; never
 clobber env-authored `platform`/`user` sets). This:
 
@@ -252,10 +252,10 @@ each door only writes what it owns.
 ## Change list (phased — each phase independently shippable)
 
 ### P0 — objectui, low-risk (closes the leak + the data-loss trap) — mirrors objectui#2197
-- Pass the route `packageId` into `<AccessPillar/>` (`StudioDesignSurface.tsx:589`).
-- Scope the matrix rows to `client.list('object', { packageId })` (`PermissionMatrixEditor.tsx:171`)
-  and fields likewise (`:208`) — render **only this package's object rows**.
-- **Slice-merge on save** (`:289`): persist `{ ...original.objects, ...editedPackageKeys }` so
+- Pass the route `packageId` into `<AccessPillar/>` (`objectui:StudioDesignSurface.tsx`).
+- Scope the matrix rows to `client.list('object', { packageId })` (`objectui:PermissionMatrixEditor.tsx`)
+  and fields likewise () — render **only this package's object rows**.
+- **Slice-merge on save** (): persist `{ ...original.objects, ...editedPackageKeys }` so
   editing the package's slice **never deletes other packages' grants** from the shared record.
   The namespaced keys make the package's slice unambiguous.
 - Keep the left rail global (permission sets are still env-level under the current model).
@@ -338,14 +338,14 @@ each door only writes what it owns.
   ADR-0048 (namespace isolation), ADR-0078 (no inert metadata), ADR-0016 / ADR-0033
   (draft/publish), ADR-0084 + `docs/design/builder-ui.md` §7 & §3.5 (Access pillar; defers
   composition), ADR-0025 (manifest consent scopes ≠ grants), ADR-0010 (metadata protection).
-- Framework: `spec/security/permission.zod.ts`, `spec/stack.zod.ts:235`,
-  `spec/system/metadata-persistence.zod.ts:72`, `spec/data/object.zod.ts:408`,
-  `spec/kernel/manifest.zod.ts:142-179,264`, `plugin-security/bootstrap-declared-roles.ts`,
+- Framework: `spec/security/permission.zod.ts`, `packages/spec/src/stack.zod.ts`,
+  `packages/spec/src/system/metadata-persistence.zod.ts`, `packages/spec/src/data/object.zod.ts`,
+  `packages/spec/src/kernel/manifest.zod.ts`, `plugin-security/bootstrap-declared-roles.ts`,
   `plugin-security/default-permission-sets.ts`, `plugin-security/permission-evaluator.ts`,
   `core/security/resolve-authz-context.ts`, `dogfood/test/authz-conformance.matrix.ts`.
-- objectui: `StudioDesignSurface.tsx` (`AccessPillar` `:589`, Interfaces `:822`, Data `:1377`),
-  `metadata-admin/PermissionMatrixEditor.tsx` (`:171`, `:208`, `:289`),
-  `permissions/MePermissionsProvider.tsx:56`.
+- objectui: `StudioDesignSurface.tsx` (`AccessPillar` `packages/qa/dogfood/test/authz-conformance.matrix.ts`, Interfaces `packages/qa/dogfood/test/authz-conformance.matrix.ts`, Data `packages/qa/dogfood/test/authz-conformance.matrix.ts`),
+  `metadata-admin/PermissionMatrixEditor.tsx` (`packages/qa/dogfood/test/authz-conformance.matrix.ts`, `packages/qa/dogfood/test/authz-conformance.matrix.ts`, `packages/qa/dogfood/test/authz-conformance.matrix.ts`),
+  `objectui:permissions/MePermissionsProvider.tsx`.
 - Related issues: objectui#2196 (trigger), objectui#2197 (Interfaces scope-fix template),
   framework#1828 (ADR-0048), #1892/#1893 (aspirational-metadata hygiene), #2377 (ADR-0049
   enforce-or-remove), #1883 (permission lifecycle ops ungated).
@@ -373,7 +373,7 @@ flagged inline below.
 |---|---|---|
 | **D1** classification on the provenance axis | **Adopted**; table vocabulary now stale — see "revised table" below | Principle intact. Rows renamed/removed by ADR-0090 (Profile gone, role→position). |
 | **D2** DEFINITION↔ASSIGNMENT principle | **Adopted, reinforced** | ADR-0090 D2 leans on it to justify removing Profile; ADR-0091 dates the *assignment* rows only (`valid_from`/`valid_until`), confirming they are env data. |
-| **D3** `packageId` + provenance `managedBy` on the set | **Implemented** | `spec/security/permission.zod.ts:167` (`packageId`, tagged `[ADR-0086 D3]`) + `:178` (`managedBy` enum); record fields `package_id`/`managed_by`/`customized` + index on `sys-permission-set.object.ts:217-266`. |
+| **D3** `packageId` + provenance `managedBy` on the set | **Implemented** | `packages/spec/src/security/permission.zod.ts#managedBy` (`packageId`, tagged `[ADR-0086 D3]`) + (`managedBy` enum); record fields `package_id`/`managed_by`/`customized` + index on `packages/plugins/plugin-security/src/objects/sys-permission-set.object.ts#managedBy`. |
 | **D4** Shape B (packages ship own sets; union; shared slices env-only) | **Adopted, reinforced; subtract layer upgraded** | ADR-0090 D9 / Alt #6 reject package-written shared/builtin sets for the same reasons. Composition is now anchored at the **position** ("bind several packages' sets to one position"), ADR-0094 D5. **Subtract layer changed** — see ⚠️ below. |
 | **D5** `bootstrapDeclaredPermissions` | **Implemented; `isDefault` semantics refined by ADR-0090 D5** | `plugin-security/src/bootstrap-declared-permissions.ts` (invoked at `kernel:ready`, `security-plugin.ts`); seeds `managed_by:'package'` + `package_id`, idempotent/upgrade-aware; closes the ADR-0078 inert-metadata smell the D5 header calls out. `isDefault` no longer means "profile fallback": app-level default sets **auto-bind to the `everyone` position**; package-level default sets materialize a `sys_audience_binding_suggestion` an admin confirms (new object). |
 | **D6** package Access door under draft/publish | **Implemented** | objectui writes the package door as `mode:'draft', packageId` (`PermissionMatrixEditor.tsx`); env door stays live and, per ADR-0094 D3, that "live" save is itself redirected into a metadata overlay. |
diff --git a/docs/adr/0089-unify-visibility-predicate-naming.md b/docs/adr/0089-unify-visibility-predicate-naming.md
index a3698696ea..9b7e348bf6 100644
--- a/docs/adr/0089-unify-visibility-predicate-naming.md
+++ b/docs/adr/0089-unify-visibility-predicate-naming.md
@@ -15,9 +15,9 @@ different ways depending on which layer you are in:
 
 | Layer | Key today | Location |
 |---|---|---|
-| Data field / field option | `visibleWhen` | `packages/spec/src/data/field.zod.ts:592, 108` |
-| View form section / field | `visibleOn` | `packages/spec/src/ui/view.zod.ts:762, 781` |
-| Page component | `visibility` | `packages/spec/src/ui/page.zod.ts:109` |
+| Data field / field option | `visibleWhen` | `packages/spec/src/data/field.zod.ts#visibleWhen` |
+| View form section / field | `visibleOn` | `packages/spec/src/ui/view.zod.ts#visibleOn` |
+| Page component | `visibility` | `packages/spec/src/ui/page.zod.ts#visibility` |
 
 Because every one is `.optional()` and the schemas run zod's default **strip** mode, a
 key placed on the wrong layer — `visibleOn` on a data field, `visibleWhen` on a form
@@ -32,13 +32,13 @@ a **loud** error instead of a silent no-op. The boolean `visible` (Tab on/off) i
 different type and concept and is explicitly **out of scope**.
 
 This is not a new pattern — it is the exact move already made for
-`conditionalRequired → requiredWhen` (`field.zod.ts:594-598`), applied to visibility.
+`conditionalRequired → requiredWhen` (`packages/spec/src/data/field.zod.ts#requiredWhen`), applied to visibility.
 
 ## Context
 
 ### The `*When` family already exists — and `visibleWhen` is in it
 
-`field.zod.ts:592-594` defines a coherent conditional-rule triad on data fields:
+`packages/spec/src/data/field.zod.ts` defines a coherent conditional-rule triad on data fields:
 
 ```ts
 visibleWhen:  ExpressionInputSchema.optional(),  // shown when TRUE
@@ -55,10 +55,10 @@ binding environment (`record` + `current_user`), and an enforcement path.
 
 The repo has already run this exact consolidation once. `requiredWhen` is the canonical
 name; `conditionalRequired` is retained as a `@deprecated` alias
-(`field.zod.ts:594-598`), and the enforcer resolves the pair with a coalesce:
+(`packages/spec/src/data/field.zod.ts#requiredWhen`), and the enforcer resolves the pair with a coalesce:
 
 ```ts
-// packages/objectql/src/validation/rule-validator.ts:378
+// packages/objectql/src/validation/rule-validator.ts#requiredWhen
 const pred = def?.requiredWhen ?? def?.conditionalRequired;
 ```
 
@@ -71,7 +71,7 @@ Three compounding traps:
 
 1. **Same concept, name switches by layer.** `visibleWhen` (data) vs `visibleOn` (view)
    vs `visibility` (page). The docs already need a disambiguation paragraph
-   (`content/docs/protocol/objectui/layout-dsl.mdx:796-798`) — a sign the surface, not
+   (`objectui:content/docs/protocol/objectui/layout-dsl.mdx`) — a sign the surface, not
    the reader, is the problem.
 
 2. **`visibleOn` has two binding roots.** In runtime forms it binds the live record
@@ -83,7 +83,7 @@ Three compounding traps:
    (only two `.passthrough()` sites exist in `view.zod.ts`, none relevant here), so a
    mis-layered key is discarded with no diagnostic. ADR-0085 already deleted one
    consumer-less `visibleOn` from `fieldGroups` under the enforce-or-remove rule
-   (`object.zod.ts:227-230`); this ADR closes the general case.
+   (`packages/spec/src/data/object.zod.ts#visibleOn`); this ADR closes the general case.
 
 ### Why unify to `visibleWhen` and not `visibleOn`
 
@@ -128,7 +128,7 @@ silently inert):
     form predicate).
 
 **D4 — the boolean `visible` is out of scope.**
-`view.zod.ts:276` `visible: z.boolean()` (Tab on/off) is a static flag, not a predicate.
+`packages/spec/src/ui/view.zod.ts` `visible: z.boolean()` (Tab on/off) is a static flag, not a predicate.
 Folding it into `visibleWhen` would create a new type ambiguity (boolean vs expression).
 It keeps its name and type. `hidden` (field boolean) and `visibleFields` (gallery card
 array) are likewise unrelated and untouched.
diff --git a/docs/adr/0096-execution-surface-identity-admission.md b/docs/adr/0096-execution-surface-identity-admission.md
index c13b572aba..632bb416ff 100644
--- a/docs/adr/0096-execution-surface-identity-admission.md
+++ b/docs/adr/0096-execution-surface-identity-admission.md
@@ -176,23 +176,23 @@ All trace to the same `positions==0 && permissions==0 && !userId → skip` predi
 
 | Site | Surface | Note |
 |:---|:---|:---|
-| `plugin-security/security-plugin.ts:626` | find/write middleware | the original seam (#2849) |
-| `plugin-security/security-plugin.ts:1689` | `getReadFilter` (analytics / reports / raw-SQL RLS compile) | returns `undefined` = *no filter*; the analytics mirror of :626 |
+| `packages/plugins/plugin-security/src/security-plugin.ts#getReadFilter` | find/write middleware | the original seam (#2849) |
+| `packages/plugins/plugin-security/src/security-plugin.ts#getReadFilter` | `getReadFilter` (analytics / reports / raw-SQL RLS compile) | returns `undefined` = *no filter*; the analytics mirror of :626 |
 | `objectql/engine.ts` Layer-0 + `driver-sql` `applyTenantScope` (opt-in on `tenantId`) | tenant scoping | Layer-0 is computed **after** the :626 skip, and the driver scope is opt-in → a principal-less context gets **no tenant filter at either layer** (cross-tenant read/write) |
-| `rest/rest-server.ts:4317` (+ lookup `:4744`) | guest / public-form routes | bypass `enforceAuth`; fall open when `guest_portal` unregistered (partly mitigated by the `publicFormGrant`) |
-| `runtime/http-dispatcher.ts:4231,4236,4240` | custom `object_operation` API endpoints | **accidental** — `callData` invoked with no `executionContext` (every sibling threads it) |
-| `runtime/sandbox/body-runner.ts:155` | authored action/hook **body** interior facade | the inside of #2849 — only the *invoke* is gated (#2964); the body's `api.object().find/insert/...` run context-less |
-| `mcp/mcp-server-runtime.ts:335` | MCP resource `…/records/{id}` | record read with no session identity |
+| `packages/rest/src/rest-server.ts#enforceAuth` (+ lookup) | guest / public-form routes | bypass `enforceAuth`; fall open when `guest_portal` unregistered (partly mitigated by the `publicFormGrant`) |
+| `packages/runtime/src/http-dispatcher.ts#executionContext` | custom `object_operation` API endpoints | **accidental** — `callData` invoked with no `executionContext` (every sibling threads it) |
+| `packages/runtime/src/sandbox/body-runner.ts` | authored action/hook **body** interior facade | the inside of #2849 — only the *invoke* is gated (#2964); the body's `api.object().find/insert/...` run context-less |
+| `packages/mcp/src/mcp-server-runtime.ts` | MCP resource `…/records/{id}` | record read with no session identity |
 | `service-messaging/messaging-service.ts` (+ recipient resolver) | notification read/write + recipient-role lookup | unscoped reads of `sys_notification*` and `sys_user`/`sys_member` |
-| minor: `http-dispatcher.ts:1322` (env-member), `plugin-webhooks/auto-enqueuer.ts:175`, `objectql/engine.ts:722` (`visibleWhen`) | system plumbing | rely on the *implicit* fall-open; should carry an **explicit** grant so they survive the D5 flip |
+| minor: `packages/runtime/src/http-dispatcher.ts` (env-member), `packages/plugins/plugin-webhooks/src/auto-enqueuer.ts`, `packages/objectql/src/engine.ts` (`visibleWhen`) | system plumbing | rely on the *implicit* fall-open; should carry an **explicit** grant so they survive the D5 flip |
 
 ### E2 — Trusted-implicit surfaces (ignore the caller / fall back to system) — confirmed exploitable, spun out
 
 | Instance | Verdict | Issue |
 |:---|:---|:---|
 | Reports `getReport`/`deleteReport`/`listReports` discard the caller and query with `SYSTEM_CTX`; routes only `enforceAuth` → cross-user/cross-tenant IDOR (read+delete any report) | CONFIRMED exploitable | #2980 |
-| Scheduled reports (`report-service.ts:425` `dispatchDue`) run `executeReport(..., {isSystem:true})` → a member-owned schedule emails the target object's **entire** table, RLS bypassed | CONFIRMED exploitable | #2980 |
-| Knowledge/RAG `applyPermissionFilter` (`knowledge-service.ts:312`) returns **all** hits when `ctx` is missing/system; `chatWithTools`'s `ToolExecutionContext.actor` is optional with a system fallback → agent retrieval escapes the data ceiling | CONFIRMED (framework); exposure gated on cloud impl | #2981 |
+| Scheduled reports (`packages/plugins/plugin-reports/src/report-service.ts#isSystem` `dispatchDue`) run `executeReport(..., {isSystem:true})` → a member-owned schedule emails the target object's **entire** table, RLS bypassed | CONFIRMED exploitable | #2980 |
+| Knowledge/RAG `applyPermissionFilter` (`packages/services/service-knowledge/src/knowledge-service.ts#applyPermissionFilter`) returns **all** hits when `ctx` is missing/system; `chatWithTools`'s `ToolExecutionContext.actor` is optional with a system fallback → agent retrieval escapes the data ceiling | CONFIRMED (framework); exposure gated on cloud impl | #2981 |
 
 These are *not* the :626 fall-open (they use an unconditional `SYSTEM_CTX`), but they are exactly what a D4 conformance row (`caller-scoped?` proof) + the D2 audit would have flagged. Fixed independently of the mechanism, tracked as the mechanism's motivating evidence.
 
@@ -200,14 +200,14 @@ These are *not* the :626 fall-open (they use an unconditional `SYSTEM_CTX`), but
 
 | Site | Note |
 |:---|:---|
-| `objectql/engine.ts:641` `executeAction` | handler invoked **directly**, not via `executeWithMiddleware` — an action touching the driver gets no RLS/FLS/CRUD/tenant |
-| `objectql/engine.ts:2793` `engine.execute()` / `driver-sql:1371` `driver.execute()` | raw SQL, documented tenant-bypass; caller trusted to inline the filter |
-| `objectql/engine.ts:2956/2991` `getDriverByName`/`getDriverForObject` | hand out the raw driver — middleware-free read/write |
-| bulk `update({multi:true})`/`deleteMany` on pure-OWD `private` objects (`sharing-plugin.ts:391`, `security-plugin.ts:821`) | single-id owner check not applied to multi-writes → members modify peers' rows | (#2982)
+| `packages/objectql/src/engine.ts#executeAction` `executeAction` | handler invoked **directly**, not via `executeWithMiddleware` — an action touching the driver gets no RLS/FLS/CRUD/tenant |
+| `packages/objectql/src/engine.ts` `engine.execute()` / `driver-sql:1371` `driver.execute()` | raw SQL, documented tenant-bypass; caller trusted to inline the filter |
+| `packages/objectql/src/engine.ts#getDriverByName` `getDriverByName`/`getDriverForObject` | hand out the raw driver — middleware-free read/write |
+| bulk `update({multi:true})`/`deleteMany` on pure-OWD `private` objects (`packages/plugins/plugin-sharing/src/sharing-plugin.ts`, `packages/plugins/plugin-security/src/security-plugin.ts`) | single-id owner check not applied to multi-writes → members modify peers' rows | (#2982)
 
 ### E4 — Unknown seams (identity not visibly threaded — investigate, then register)
 
-`runtime/http-dispatcher.ts:1488` **GraphQL** (passes only `{request}`, not the resolved `ec`); `service-realtime` **websocket** delivery (no per-subscriber RLS re-check); attachment **blob-level** RLS; the `chatWithTools` contract's optional actor. Each becomes a D4 matrix row in state `experimental`/`UNKNOWN` with a follow-up.
+`packages/runtime/src/http-dispatcher.ts` **GraphQL** (passes only `{request}`, not the resolved `ec`); `service-realtime` **websocket** delivery (no per-subscriber RLS re-check); attachment **blob-level** RLS; the `chatWithTools` contract's optional actor. Each becomes a D4 matrix row in state `experimental`/`UNKNOWN` with a follow-up.
 
 ### E5 — The D2 migration is large but has a prototype
 
@@ -269,6 +269,6 @@ Everything else — the D3 signature migration, strict-mode-ON-in-CI per package
 - framework#2308 / #1888 — the flow instance of the same class; the lint idiom D3/D6 reuse
 - framework#2845 / #2843 — the agent action surface whose safety framing this ADR makes true by construction
 - framework#2980 / #2981 / #2982 — the confirmed-exploitable instances the Evidence sweep surfaced (reports IDOR + scheduled-report RLS bypass; knowledge/RAG retrieval fall-open; bulk-write OWD gap) — fixed independently; this ADR's motivating evidence
-- `packages/plugins/plugin-security/src/security-plugin.ts` — the empty-principal seam (`:626` middleware, `:1689` getReadFilter) (D5's target)
+- `packages/plugins/plugin-security/src/security-plugin.ts` — the empty-principal seam (`packages/plugins/plugin-security/src/security-plugin.ts` middleware, `packages/plugins/plugin-security/src/security-plugin.ts` getReadFilter) (D5's target)
 - `packages/runtime/src/http-dispatcher.ts` — `buildActionEngineFacade` (both facades), `invokeBusinessAction`
 - `packages/qa/dogfood/test/authz-conformance.matrix.ts` — the ADR-0056 D10 matrix D4 extends
diff --git a/docs/adr/0099-posture-adjudicated-tiering-and-external-rung.md b/docs/adr/0099-posture-adjudicated-tiering-and-external-rung.md
index c988261c8a..61c936c079 100644
--- a/docs/adr/0099-posture-adjudicated-tiering-and-external-rung.md
+++ b/docs/adr/0099-posture-adjudicated-tiering-and-external-rung.md
@@ -65,12 +65,12 @@ The chain today, end to end:
   *receives* the derived rung.
 - **Nothing consumes it.** The Layer 0 exemption gate re-derives platform-ness
   from a capability probe (`hasPlatformAdminPosture`,
-  `security-plugin.ts:2390` — checking `manage_metadata` /
+  `packages/plugins/plugin-security/src/security-plugin.ts#manage_metadata` — checking `manage_metadata` /
   `manage_platform_settings` / `studio.access` / `manage_users`); the
   Layer 1 superuser bypass reads the raw super-bits; the explain engine reads
   `ctx.posture` when present but replicates the derivation when absent
   (#2949's patch). The comment above the probe
-  (`security-plugin.ts:71-77`) still gives "the field is NOT plumbed" as the
+  (`packages/plugins/plugin-security/src/security-plugin.ts`) still gives "the field is NOT plumbed" as the
   reason for probing — **that reason expired with #2956**; the probe is now a
   choice, not a necessity.
 
@@ -195,7 +195,7 @@ its visibility; misconfiguration can only narrow. What this ADR adds is the
    fail-closed, never fall-through to the member rule.
 3. **Write side**: edit requires an explicit share granting edit; the
    `owner`-type sharing rules currently marked
-   `[experimental — not enforced]` (`sharing.zod.ts:104`, ADR-0049 marker)
+   `[experimental — not enforced]` (`packages/spec/src/security/sharing.zod.ts`, ADR-0049 marker)
    stay outside the EXTERNAL rung until separately enforced — an external
    principal's visibility never depends on an unenforced construct.
 4. **Matrix first**: the `EXTERNAL × layer` cells land with this ADR
@@ -241,7 +241,7 @@ Strictly serial, each step behind the matrix:
   EXTERNAL dead-branch cells). Pure test additions; no behavior change.
 - **P1** — flip the Layer 0 exemption gate and explain to read the carried
   rung (probe demoted to fallback; stale comment at
-  `security-plugin.ts:71-77` retired). Behavior-preserving under P0's gate.
+  `packages/plugins/plugin-security/src/security-plugin.ts` retired). Behavior-preserving under P0's gate.
   Unblocked today (#2956); small.
 - **P2** *(superseded — rejected at adjudication, replaced by P2′; see the
   Amendment)* — the original "Layer 1 short-circuit reads posture for tier"
@@ -314,12 +314,12 @@ Strictly serial, each step behind the matrix:
 - Landed substrate: #2920 B2/B4 (`posture-ladder.ts`, derivation), #2956
   (posture carried on `ExecutionContext` — closes #2947), #2957 (readonly
   write guard, I6), cloud#835/#836 (multi-org / position-anchor e2e gates).
-- Code (current state): `packages/plugins/plugin-security/src/security-plugin.ts:2390`
-  (`hasPlatformAdminPosture` probe; stale rationale at `:71-77`),
+- Code (current state): `packages/plugins/plugin-security/src/security-plugin.ts#hasPlatformAdminPosture`
+  (`hasPlatformAdminPosture` probe; stale rationale at `#hasPlatformAdminPosture`),
   `packages/core/src/security/posture-ladder.ts`,
   `packages/core/src/security/resolve-authz-context.ts` (derivation),
   `packages/plugins/plugin-security/src/explain-engine.ts` (carried-value
-  preference), `packages/spec/src/security/sharing.zod.ts:104` (`owner`-rule
+  preference), `packages/spec/src/security/sharing.zod.ts` (`owner`-rule
   experimental marker), `packages/spec/src/kernel/execution-context.zod.ts`
   (`posture` field).
 
diff --git a/docs/adr/0104-field-runtime-value-shape-contract.md b/docs/adr/0104-field-runtime-value-shape-contract.md
index c811e54779..38309b0d3c 100644
--- a/docs/adr/0104-field-runtime-value-shape-contract.md
+++ b/docs/adr/0104-field-runtime-value-shape-contract.md
@@ -52,10 +52,10 @@ lists in three packages, or silently corrupting data.
 The spec does export three per-type value schemas — and they make things
 worse, not better, because **all three are dead and two contradict reality**:
 
-- `CurrencyValueSchema` (`field.zod.ts:151`) declares `{value, currency}`;
+- `CurrencyValueSchema` (`packages/spec/src/data/field.zod.ts#CurrencyValueSchema`) declares `{value, currency}`;
   the validator, the SQL driver, import-coerce, and the field-zoo round-trip
   all treat currency as a **bare number**.
-- `LocationCoordinatesSchema` (`field.zod.ts:121`) declares
+- `LocationCoordinatesSchema` (`packages/spec/src/data/field.zod.ts#LocationCoordinatesSchema`) declares
   `{latitude, longitude}`; the field-zoo oracle stores `{lat, lng}`.
 - `AddressSchema` is imported by nothing but its own tests.
 
@@ -74,29 +74,29 @@ Three concrete failure classes motivated this design:
 2. **Untyped action handlers**: the declared `params[]` contract (`type`,
    `required`, `multiple`, `accept`, `maxSize`, `options`) informs **only the
    client dialog**. The server passes `reqBody.params` through raw
-   (`http-dispatcher.ts:3882`; same on the MCP path, line 1093), the sandbox
-   exposes it as `input: unknown` (`script-runner.ts:60`), and handlers are
-   registered as `(ctx: any) => any` (`objectql/src/engine.ts:678`). Every
+   (`packages/runtime/src/http-dispatcher.ts`; same on the MCP path, line 1093), the sandbox
+   exposes it as `input: unknown` (`packages/runtime/src/sandbox/script-runner.ts`), and handlers are
+   registered as `(ctx: any) => any` (`packages/objectql/src/engine.ts`). Every
    shipped handler does unchecked casts
    (`(params?.selectedIds ?? []) as string[]`,
-   `examples/app-todo/src/actions/task.handlers.ts:63`). `required`,
+   `examples/app-todo/src/actions/task.handlers.ts`). `required`,
    option membership, `maxSize` — none of it is enforced where it matters.
 3. **File fields bypass the platform's own file primitive.** There are two
    disconnected file worlds. `Field.file` / `image` / `avatar` / `video` /
    `audio` values are inline JSON blobs (`{url, name, size}` — a shape no spec
    schema defines, no validator checks) stored in the record column
-   (`sql-driver.ts:59`). Meanwhile `service-storage` already ships a
+   (`packages/drivers/driver-sql/src/sql-driver.ts`). Meanwhile `service-storage` already ships a
    first-class file object — `sys_file` with opaque `fileId`, status
    lifecycle, tombstone/reap GC (ADR-0057), and parent-derived download
    authorization — but it is wired **only** to the Attachments panel
-   (`sys_attachment`), and `attachment-lifecycle.ts:27-29` explicitly notes
+   (`sys_attachment`), and `packages/services/service-storage/src/attachment-lifecycle.ts#sys_attachment` explicitly notes
    field values "reference files from record columns the join-row count cannot
    see". Consequences: no reference integrity, no GC (clearing a `Field.image`
    leaks the blob forever), anonymous capability URLs for everything that
    isn't attachments-scoped, no `accept`/`maxSize` anywhere in `FieldSchema`
    (the audit: "no size/type/virus enforcement in write path"), and
    `client.storage.upload()` doesn't even return the `fileId` (the
-   `/upload/complete` response omits it, `storage-routes.ts:231-241`).
+   `/upload/complete` response omits it, `packages/services/service-storage/src/storage-routes.ts`).
 
 The common root cause: **the runtime value shape of a field is nobody's
 contract.** This ADR makes it the spec's.
@@ -131,7 +131,7 @@ Directive #2. It exports:
      `lookup` → the related record object; `file` → the spec-owned
      `FileValueSchema` (D3). For types without an expansion, `expanded` ≡
      `stored`. This names the lookup polymorphism that already exists
-     (`engine.ts:2092-2098` overwrites the field in place) instead of leaving
+     (`packages/objectql/src/engine.ts` overwrites the field in place) instead of leaving
      every consumer to branch on `typeof val === 'object'`.
 3. **`FieldValue<T>`** — the inferred TS types, so handlers and SDK code can
    speak the same shapes at compile time (D2).
@@ -179,7 +179,7 @@ Action params are already fields-lite (`ActionParamSchema` mirrors `FieldType`,
 free. Three changes:
 
 1. **Server-side enforcement at dispatch.** `handleActions` (REST,
-   `http-dispatcher.ts:3797`) and `invokeBusinessAction` (MCP, line 1080)
+   `packages/runtime/src/http-dispatcher.ts`) and `invokeBusinessAction` (MCP, line 1080)
    resolve the invoked action's declared `params[]` (field-backed params
    resolve through the referenced object field, as the dialog already does)
    and validate `reqBody.params` against a Zod object built from
@@ -320,7 +320,7 @@ rediscoveries.
   is quiet.
 - **R3 — unknown-param-key rejection will hit real callers.** Dispatch itself
   merges `recordId` / `objectName` into `params`
-  (`http-dispatcher.ts:3944`), and programmatic integrators send loose bags.
+  (`packages/runtime/src/http-dispatcher.ts`), and programmatic integrators send loose bags.
   D2 needs a built-in-key allowlist and the same warn-then-error window;
   "unknown key" errors must name the key and the declared param list.
 - **R4 — GC mis-deletion is irreversible data loss.** During the D3 migration
diff --git a/docs/adr/0105-group-tenancy-posture-and-first-class-org-scope.md b/docs/adr/0105-group-tenancy-posture-and-first-class-org-scope.md
index c4af108121..e21f0e4f41 100644
--- a/docs/adr/0105-group-tenancy-posture-and-first-class-org-scope.md
+++ b/docs/adr/0105-group-tenancy-posture-and-first-class-org-scope.md
@@ -68,7 +68,7 @@ all plants' data. Two requirements are *inherent* to the shape, not optional:
 ### Today's two postures, and the unsupported middle
 
 - **`single`** (ADR-0093): one logical tenant. Layer 0 inert
-  (`plugin-security/src/tenant-layer.ts:87`). Factories can be modeled as
+  (`packages/plugins/plugin-security/src/tenant-layer.ts`). Factories can be modeled as
   business units in one tree — group visibility and approvals are native, but
   there is no per-factory membership/invitation boundary, and org scoping
   relies entirely on authored configuration.
@@ -77,9 +77,9 @@ all plants' data. Two requirements are *inherent* to the shape, not optional:
   business-RLS change, sharing rule, or superuser bit can widen it (W1/W2).
   Correct for legal-entity isolation — and structurally hostile to the two
   inherent requirements above: one active org per session
-  (`core/src/security/resolve-authz-context.ts:125`), org-scoped approver
-  resolution (`plugin-approvals/src/approval-node.ts:118`, other-tenant
-  position holders excluded — `approval-service.test.ts:263-265`), no
+  (`packages/core/src/security/resolve-authz-context.ts`), org-scoped approver
+  resolution (`packages/plugins/plugin-approvals/src/approval-node.ts`, other-tenant
+  position holders excluded — `packages/plugins/plugin-approvals/src/approval-service.test.ts`), no
   cross-org query path short of `isSystem` mirroring.
 
 The middle — organizations as *membership boundaries* over one shared dataset —
@@ -90,7 +90,7 @@ orgs + `organization_id` columns + authored RLS, without
 ### Findings (verified, file:line)
 
 - **F1 — authored org policies are silently stripped.**
-  `collectRLSPolicies` (`plugin-security/src/security-plugin.ts:2785-2791`)
+  `collectRLSPolicies` (`packages/plugins/plugin-security/src/security-plugin.ts#collectRLSPolicies`)
   drops **any** policy whose `using` contains the substring
   `current_user.organization_id` whenever the `org-scoping` service is absent.
   The intent was to strip the platform's own wildcard tenant policies in
@@ -99,7 +99,7 @@ orgs + `organization_id` columns + authored RLS, without
   ADR-0049 class of defect ("declared but unenforced").
 - **F2 — wildcard VAMA is contained only by the wall.** `organization_admin`
   carries `'*': { viewAllRecords: true, modifyAllRecords: true }`
-  (`plugin-security/src/objects/default-permission-sets.ts:150-160`) and is
+  (`packages/plugins/plugin-security/src/objects/default-permission-sets.ts#viewAllRecords`) and is
   auto-granted to every owner/admin member (`auto-org-admin-grant.ts`). The
   superuser bit short-circuits Layer 1 business RLS and sharing; in the
   isolated posture Layer 0 contains it (the #2937 fix), but in any wall-less
@@ -108,10 +108,10 @@ orgs + `organization_id` columns + authored RLS, without
   environment-wide superuser while operating in an org where they hold
   owner/admin.
 - **F3 — dead spec surface on the org axis.**
-  `PermissionSet.contextVariables` (`spec/src/security/permission.zod.ts:282`)
+  `PermissionSet.contextVariables` (`packages/spec/src/security/permission.zod.ts#PermissionSet`)
   has zero runtime consumers; `ExecutionContext.rlsMembership`
-  (`spec/src/kernel/execution-context.zod.ts:165`, merged at
-  `plugin-security/src/rls-compiler.ts:164-177`) has no production resolver —
+  (`packages/spec/src/kernel/execution-context.zod.ts#ExecutionContext`, merged at
+  `packages/plugins/plugin-security/src/rls-compiler.ts#org_user_ids`) has no production resolver —
   only `org_user_ids` is populated; `spec/src/security/territory.zod.ts` has
   no runtime object or stack field. All three violate ADR-0049
   enforce-or-remove.
@@ -164,7 +164,7 @@ into a first-class `ExecutionContext.accessible_org_ids`, sibling to
 ADR-0095 D1 mandates: **AND-first, independent compiler, no shared bypass bit**
 (W1/W2 preserved; only the predicate widens from equality to set membership).
 Empty set ⇒ `RLS_DENY_FILTER` (fail closed), mirroring
-`tenant-layer.ts:103`. The active organization keeps its current meaning
+`packages/plugins/plugin-security/src/tenant-layer.ts`. The active organization keeps its current meaning
 (default write target, UI context); it no longer bounds *read* reach in
 `group` posture — membership does.
 
@@ -187,7 +187,7 @@ the org predicate in any posture where one applies (this is already true in
 wall-less postures get a de-VAMA'd `organization_admin` variant from
 `auto-org-admin-grant` so the F2 amplification path (personal orgs) closes.
 Crossing org scope remains exclusively the `PLATFORM_ADMIN` rung on
-posture-permitting objects (`tenant-layer.ts:54,100`), unchanged.
+posture-permitting objects (`packages/plugins/plugin-security/src/tenant-layer.ts`), unchanged.
 
 **D5 — Group-mode stamping and write validation move into the engine.**
 On insert in `group`/`isolated` postures the engine stamps `organization_id`
@@ -195,7 +195,7 @@ from `ctx.tenantId` (active org) when absent, and **validates** any explicit
 value against `accessible_org_ids` (group) / equality (isolated) — the
 write-side twin of the read wall, alongside the existing Layer-0 post-image
 check (#2937). `tenancy.enabled: false` objects
-(`spec/src/data/object.zod.ts:240-256`) remain exempt: platform-global by
+(`packages/spec/src/data/object.zod.ts`) remain exempt: platform-global by
 declaration, business RLS as their only scoping — the sanctioned escape hatch
 for cross-org catalogs.
 
@@ -214,7 +214,7 @@ reporting/grouping dimension only**. Two red lines, both lint-enforced:
    and ADR-0090 D3 finalized for positions; it stays retired for
    organizations.
 2. **BU trees remain org-internal.** `sys_business_unit` is org-scoped
-   (`plugin-sharing/src/business-unit-graph.ts:174-177`; the enterprise
+   (`packages/plugins/plugin-sharing/src/business-unit-graph.ts#sys_business_unit`; the enterprise
    resolver org-predicates all lookups). Every BU mechanism —
    `unit_and_subordinates` sharing, `adminScope` delegation, depth scopes —
    operates within one organization. There is no cross-org tree.
@@ -311,7 +311,7 @@ reserves the concept and its place in Phase 2.
 - `ExecutionContext.rlsMembership`: **productize** the seam — a registered
   membership-resolver extension point (service contract) that plugins/apps
   implement; resolved sets merge under their declared keys
-  (`rls-compiler.ts:164-177` already merges). `accessible_org_ids` (D2) is
+  (`packages/plugins/plugin-security/src/rls-compiler.ts` already merges). `accessible_org_ids` (D2) is
   core-resolved, not an app resolver.
 - `spec/src/security/territory.zod.ts`: **remove**. Matrix requirements are
   served today by multi-position × BU anchoring; a generalized dimension
diff --git a/docs/adr/0112-error-code-vocabulary-and-ledger.md b/docs/adr/0112-error-code-vocabulary-and-ledger.md
index b186e1c8ff..1edf7068dc 100644
--- a/docs/adr/0112-error-code-vocabulary-and-ledger.md
+++ b/docs/adr/0112-error-code-vocabulary-and-ledger.md
@@ -27,11 +27,11 @@ This is a **deliberate, recorded deviation** from Prime Directive #3 ("machine n
 
 ### The drift
 
-`packages/spec/src/api/errors.zod.ts:51` declares `StandardErrorCode` as a closed enum of **51 lowercase snake_case** codes (`validation_error`, `unauthenticated`, `permission_denied`, …). It is the declared type of `FieldErrorSchema.code` and `EnhancedApiErrorSchema.code`, and `content/docs/api/error-catalog.mdx` documents it as *the* catalog.
+`packages/spec/src/api/errors.zod.ts#StandardErrorCode` declares `StandardErrorCode` as a closed enum of **51 lowercase snake_case** codes (`validation_error`, `unauthenticated`, `permission_denied`, …). It is the declared type of `FieldErrorSchema.code` and `EnhancedApiErrorSchema.code`, and `content/docs/api/error-catalog.mdx` documents it as *the* catalog.
 
-The wire disagrees. Counting distinct `code: '…'` literals in non-test source under `packages/` at the time of #3841: **≈140 SCREAMING_SNAKE** (`AUTH_REQUIRED`, `FILE_NOT_FOUND`, `ATTACHMENT_DOWNLOAD_DENIED`, `UPLOAD_SESSION_NOT_FOUND`, …) vs **≈100 lowercase** (`validation_error`, `driver_missing`, …; count includes some false positives). Exact numbers move week to week — nothing stops them — but the split's shape is not in doubt, and it runs through single request paths: `http-dispatcher.ts:1424` parks `{ code: 'PERMISSION_DENIED' }` in `details` while the enum names the same condition `permission_denied`.
+The wire disagrees. Counting distinct `code: '…'` literals in non-test source under `packages/` at the time of #3841: **≈140 SCREAMING_SNAKE** (`AUTH_REQUIRED`, `FILE_NOT_FOUND`, `ATTACHMENT_DOWNLOAD_DENIED`, `UPLOAD_SESSION_NOT_FOUND`, …) vs **≈100 lowercase** (`validation_error`, `driver_missing`, …; count includes some false positives). Exact numbers move week to week — nothing stops them — but the split's shape is not in doubt, and it runs through single request paths: `packages/runtime/src/http-dispatcher.ts` parks `{ code: 'PERMISSION_DENIED' }` in `details` while the enum names the same condition `permission_denied`.
 
-Nothing arbitrates because the enforced schema never references the enum: `packages/spec/src/api/contract.zod.ts:12` declares `ApiErrorSchema.code` as `z.string()`. The catalog is a declaration no route validates against — ADR-0078's silently-inert trap, on the error contract.
+Nothing arbitrates because the enforced schema never references the enum: `packages/spec/src/api/contract.zod.ts#ApiErrorSchema` declares `ApiErrorSchema.code` as `z.string()`. The catalog is a declaration no route validates against — ADR-0078's silently-inert trap, on the error contract.
 
 ### Three homes for the semantic code
 
@@ -40,21 +40,21 @@ Worse than two spellings: the code has three possible wire locations, and consum
 | Location | Producer | Example |
 |---|---|---|
 | `error.code` | `@objectstack/rest` flat envelope; most services | `DELETE_RESTRICTED`, `AUTH_REQUIRED` |
-| `error.details.code` | runtime dispatcher — `error.code` itself is **occupied by the HTTP status number** (`http-dispatcher.ts:475-484`) | `{ code: 400, details: { code: 'VALIDATION_FAILED' } }` |
-| `error.type` (undeclared field) | dispatcher 404/405 paths (`http-dispatcher.ts:530-541`, `dispatcher-plugin.ts:340-349`, `domains/ai.ts`, `domains/mcp.ts`) | `type: 'ROUTE_NOT_FOUND'` |
+| `error.details.code` | runtime dispatcher — `error.code` itself is **occupied by the HTTP status number** (`packages/runtime/src/http-dispatcher.ts`) | `{ code: 400, details: { code: 'VALIDATION_FAILED' } }` |
+| `error.type` (undeclared field) | dispatcher 404/405 paths (`packages/runtime/src/http-dispatcher.ts`, `packages/runtime/src/dispatcher-plugin.ts`, `domains/ai.ts`, `domains/mcp.ts`) | `type: 'ROUTE_NOT_FOUND'` |
 
-The client SDK is the living cost: `packages/client/src/index.ts:4455-4459` probes all three locations in priority order, under a comment explaining that the branch our own docs teach (`if (err.code === 'VALIDATION_FAILED')`) *never matched* on dispatcher-served surfaces before the probe existed.
+The client SDK is the living cost: `packages/client/src/index.ts` probes all three locations in priority order, under a comment explaining that the branch our own docs teach (`if (err.code === 'VALIDATION_FAILED')`) *never matched* on dispatcher-served surfaces before the probe existed.
 
 ### Consumers branch on these strings
 
-- objectui `packages/app-shell/src/views/RecordAttachmentsPanel.tsx:103-108` maps `ATTACHMENT_DOWNLOAD_DENIED` / `AUTH_REQUIRED` to user-facing copy.
+- objectui `objectui:packages/app-shell/src/views/RecordAttachmentsPanel.tsx` maps `ATTACHMENT_DOWNLOAD_DENIED` / `AUTH_REQUIRED` to user-facing copy.
 - `packages/qa/dogfood/test/attachments-permission-matrix.dogfood.test.ts` asserts on the same codes.
 - `packages/client` exposes `err.code` as the programmatic branch point and documents it.
 
 Every consumer that exists today branches on the **SCREAMING** dialect. No consumer branch on the lowercase dialect has been found (to be re-verified per service during the sweep — see Rollout).
 
 > **Corrected during batch 2 (#4003).** The re-verification the sentence above asks for found three lowercase consumer branches that the original survey missed, all in-repo:
-> `packages/runtime/src/domains/automation.ts:240,243` reads `forbidden` and `invalid_signal` from `service-automation`'s resume result; `packages/metadata-protocol/src/protocol.ts:4353` re-reads its own thrown `destructive_change`; and `packages/spec/src/contracts/automation-service.ts` *documents* `code: 'forbidden'` as the contract. Each was renamed atomically with its emitter. The lesson generalises: grep for `code === '…'` (comparison), not only `code: '…'` (emission), before each service's sweep — a rename that misses the comparison side does not fail any test, it silently stops matching.
+> `packages/runtime/src/domains/automation.ts` reads `forbidden` and `invalid_signal` from `service-automation`'s resume result; `packages/metadata-protocol/src/protocol.ts` re-reads its own thrown `destructive_change`; and `packages/spec/src/contracts/automation-service.ts` *documents* `code: 'forbidden'` as the contract. Each was renamed atomically with its emitter. The lesson generalises: grep for `code === '…'` (comparison), not only `code: '…'` (emission), before each service's sweep — a rename that misses the comparison side does not fail any test, it silently stops matching.
 
 #### Sweep checklist (earned in batch 2)
 
@@ -74,7 +74,7 @@ Also rebuild dependent packages before trusting a cross-package suite: a stale `
 
 ### The field-level vocabulary is a third thing entirely
 
-`FieldErrorSchema.code` declares `StandardErrorCode`, but field-level emitters use vocabularies of their own: `packages/objectql/src/validation/record-validator.ts` and `rule-validator.ts` emit `required`, `max_length`, `invalid_email`, … (of which only `invalid_format` is in the enum); `packages/rest/src/import-coerce.ts` adds `reference_ambiguous`, `reference_not_found`; `packages/rest/src/rest-server.ts:89-96` passes **raw Zod issue codes** (`invalid_type`, `too_small`) straight through. The wire array is named `fields`, not the declared `fieldErrors`, and no schema validates it. This is a separate decision with different consumers (form UIs) and different emitters (validators), and jamming it into this ADR would either block the top-level fix or force a hasty field-level one.
+`FieldErrorSchema.code` declares `StandardErrorCode`, but field-level emitters use vocabularies of their own: `packages/objectql/src/validation/record-validator.ts` and `rule-validator.ts` emit `required`, `max_length`, `invalid_email`, … (of which only `invalid_format` is in the enum); `packages/rest/src/import-coerce.ts` adds `reference_ambiguous`, `reference_not_found`; `packages/rest/src/rest-server.ts` passes **raw Zod issue codes** (`invalid_type`, `too_small`) straight through. The wire array is named `fields`, not the declared `fieldErrors`, and no schema validates it. This is a separate decision with different consumers (form UIs) and different emitters (validators), and jamming it into this ADR would either block the top-level fix or force a hasty field-level one.
 
 ### Why now
 
@@ -101,7 +101,7 @@ Nine rulings, D1–D9.
 
 **D1 — Top-level `error.code` speaks SCREAMING_SNAKE.** The value space is `^[A-Z][A-Z0-9_]*$`. This matches ≈140 of ≈240 existing distinct literals, every consumer branch in existence, and the genre. The ≈100 lowercase emitters are swept in follow-up batches (Rollout, batch 2).
 
-**D2 — `StandardErrorCode` members are renamed in place (breaking).** Same 51 concepts, SCREAMING spelling (`permission_denied` → `PERMISSION_DENIED`). The enum remains the small, closed **standard catalog**: codes with platform-wide HTTP semantics (the `ErrorCategory`/status mapping). It does not try to swallow service-specific codes. `@objectstack/client` re-exports the type (`client/src/index.ts:12`) and uses it in `StandardError` (`:243`) — the client updates in the same PR.
+**D2 — `StandardErrorCode` members are renamed in place (breaking).** Same 51 concepts, SCREAMING spelling (`permission_denied` → `PERMISSION_DENIED`). The enum remains the small, closed **standard catalog**: codes with platform-wide HTTP semantics (the `ErrorCategory`/status mapping). It does not try to swallow service-specific codes. `@objectstack/client` re-exports the type (`packages/client/src/index.ts#StandardError`) and uses it in `StandardError` — the client updates in the same PR.
 
 > **Amendment (2026-08-18, [#9266](https://github.com/objectstack-ai/objectstack/issues/9266)) — the three batch-operation members are retired: `BATCH_PARTIAL_FAILURE`, `BATCH_COMPLETE_FAILURE`, `TRANSACTION_FAILED` leave the standard catalog.** The catalog's warrant (D2) is "codes with platform-wide HTTP semantics"; these three never earned it. Measured on 2026-08-18 (#9266's dev report is the evidence of record): no producer has ever emitted any of them — outside the enum declaration the only occurrences in the whole repo were two spec tests using them as arbitrary fixture strings, and `git log -S` over `packages/` shows they have never had a producer since this ADR introduced the vocabulary. The batch write path reports exactly these conditions with **more** information than an envelope code could carry: a rolled-back atomic batch marks each row `errors[0].code = ROLLED_BACK`, rows the abort never reached `NOT_ATTEMPTED`, and the causal row keeps its own error — both codes ledger-registered (D3), both answered at HTTP 200, which also means no doc-publishable HTTP status ever existed for the three (the `check:error-status-conformance` census that found them ungraded is what filed the card).
 >
@@ -121,7 +121,7 @@ Nine rulings, D1–D9.
 >
 > **Where it is pinned.** `resolveThrownHttpError` and `demotedDeclaredCode` (`packages/types/src/thrown-http-error.ts`, anchored in `scripts/adr-anchors/`) are the ONE definition of both spellings for every **door** emission of the pair; all three dispatcher exits (`HttpDispatcher.errorFromThrown`, `dispatcher-plugin`'s `errorResponseBase`, `endpoint-executor`'s `endpointErrorAnswer`) read them rather than restating the rule. The demote is pinned end to end in `packages/runtime/src/domains/actions-validation-envelope.test.ts` (the actions door, with the tenant witness `DUPLICATE`), `packages/runtime/src/package-door-error-parity.test.ts` and `packages/runtime/src/error-envelope.conformance.test.ts` (which asserts, for every body the door emits, that a present `declaredCode` is never a vocabulary member and never a copy of `code`).
 >
-> ⚠️ **Scope correction (2026-08-29, [#12948](https://github.com/objectstack-ai/objectstack/issues/12948)) — “one definition” is a claim about DOORS, and there is exactly ONE declared non-door emission.** The word *door* above is load-bearing and was added by this correction. Read as universal, the sentence was measurably false: `packages/cloud-connection/src/cloud-connection-plugin.ts:382` writes `declaredCode` **by hand**, inside a hand-built body on a hard-coded **400**, calling neither function. That site is a **relay**, not a door — it forwards an upstream RFC 8628 device-authorization spelling (`expired_token`, `access_denied`, …) verbatim, beside the registered `DEVICE_CODE_FAILED` its own route chose. It is declared here so that a reader auditing “everything that emits this field” audits a **complete** population. ⛔ It is not a mistake to tidy away: the choice is deliberate and documented at that file’s `:370`.
+> ⚠️ **Scope correction (2026-08-29, [#12948](https://github.com/objectstack-ai/objectstack/issues/12948)) — “one definition” is a claim about DOORS, and there is exactly ONE declared non-door emission.** The word *door* above is load-bearing and was added by this correction. Read as universal, the sentence was measurably false: `packages/cloud-connection/src/cloud-connection-plugin.ts#declaredCode` writes `declaredCode` **by hand**, inside a hand-built body on a hard-coded **400**, calling neither function. That site is a **relay**, not a door — it forwards an upstream RFC 8628 device-authorization spelling (`expired_token`, `access_denied`, …) verbatim, beside the registered `DEVICE_CODE_FAILED` its own route chose. It is declared here so that a reader auditing “everything that emits this field” audits a **complete** population. ⛔ It is not a mistake to tidy away: the choice is deliberate and documented at that file’s.
 >
 > **Why the relay is EXEMPT rather than converted — measured, not asserted.** Routing it through the shared pair was measured on 2026-08-29 and **changes the wire on 5 of 5 realistic inputs**. `resolveThrownHttpError` **derives** the closed `code` from the throw or the status; no RFC 8628 spelling is a ledger member (probed `expired_token`, `access_denied`, `authorization_pending`, `slow_down`, `invalid_grant` — all **0** hits in `error-code-ledger.zod.ts`, against positive control `DEVICE_CODE_FAILED` — **1**), so the derived answer is `standardErrorCodeForHttpStatus(400)` = `VALIDATION_ERROR`. Converting the site would therefore replace a registered, domain-meaningful code with a generic 400 bucket that is also semantically wrong — an upstream device-authorization refusal is not a validation failure — on a route the Console polls. The shared rule cannot express this shape, because it **derives** the code a boundary emits while a relay legitimately **chooses** one. ⇒ Conversion is a wire change needing its own ruling, not a cleanup.
 >
@@ -163,11 +163,11 @@ Nine rulings, D1–D9.
 
 The line that decides all three of D6/D6b/D6c: **the catalog governs the code a failing request answers with.** A code that is field-addressed (D6), persisted (D6b), or shipped inside a successful response (D6c) is a different vocabulary with different consumers, and sweeping it in buys churn plus a migration nobody asked for. When in doubt, ask what reads it — a client branching on why its call failed, or something else.
 
-**D7 — `error-catalog.mdx` is generated from the spec.** The hand-written catalog is how docs and wire drifted apart in the first place (`docs/audits/2026-06-handwritten-docs-accuracy-followups.md:230` catalogues the casing drift; `:106` found a documented-only vocabulary with zero emitters). Generated docs are the only docs that cannot lie — and for AI authors, docs *are* context.
+**D7 — `error-catalog.mdx` is generated from the spec.** The hand-written catalog is how docs and wire drifted apart in the first place (`docs/audits/2026-06-handwritten-docs-accuracy-followups.md` catalogues the casing drift; `docs/audits/2026-06-handwritten-docs-accuracy-followups.md` found a documented-only vocabulary with zero emitters). Generated docs are the only docs that cannot lie — and for AI authors, docs *are* context.
 
 **D8 — Recorded deviation from Prime Directive #3.** PD#3 says machine names (data values) are `snake_case`. Error codes are ruled to be machine **constants**, a different lexical category from data values and metadata identifiers. The deviation is deliberate and buys visual disambiguation: in a platform where objects and fields are `snake_case` (`account`, `validation_rule`), an ALL-CAPS token is recognizably a platform constant and cannot be confused with a field API name. Genre precedent (Salesforce, gRPC) and AI-prior alignment reinforce it. This ruling covers **error codes only** — it is not a general license to deviate from PD#3.
 
-**D9 — Adjacent spec-internal cleanups ride along.** Two same-class defects found while evaluating #3841 are folded into the batches because they share the fix surface: (a) `packages/spec` exports **two mutually incompatible** `ErrorCategory` and `RetryStrategy` types (`api/errors.zod.ts:29-39,147-152` vs `integration/connector.zod.ts:409-420,346-353`) — the connector-side pair gets renamed (`ConnectorErrorCategory`, `ConnectorRetryStrategy`) so one name means one thing; (b) the client reads `category`/`retryable` from the wrong nesting level (`client/src/index.ts:4473-4475` reads top-level where the contract puts them inside `error`) — fixed when the probe area is touched in batch 3.
+**D9 — Adjacent spec-internal cleanups ride along.** Two same-class defects found while evaluating #3841 are folded into the batches because they share the fix surface: (a) `packages/spec` exports **two mutually incompatible** `ErrorCategory` and `RetryStrategy` types (`packages/spec/src/api/errors.zod.ts#ErrorCategory` vs `packages/spec/src/integration/connector.zod.ts#ConnectorErrorCategory`) — the connector-side pair gets renamed (`ConnectorErrorCategory`, `ConnectorRetryStrategy`) so one name means one thing; (b) the client reads `category`/`retryable` from the wrong nesting level (`packages/client/src/index.ts#retryable` reads top-level where the contract puts them inside `error`) — fixed when the probe area is touched in batch 3.
 
 ---
 
@@ -203,6 +203,6 @@ Rename `StandardErrorCode` members; introduce the error-code ledger + generated
 For each service: verify no consumer branches on its lowercase codes; convert emitters to registered SCREAMING codes; that service's conformance suite now passes value assertions. No cross-repo coordination needed — consumers already read SCREAMING.
 
 **Batch 3 — location convergence (D5).**
-Dispatcher: semantic code moves into `error.code`, numeric status stops occupying it (`http-dispatcher.ts:475`), `error.type` retired as a code carrier; update the #3687 pin in `http-dispatcher.test.ts` from "documents the deviation" to "asserts the fix". objectui ships tolerant dual-read first where needed (objectui#2869 pattern). Then delete the client three-location probe and fix the `category`/`retryable` nesting read (D9b).
+Dispatcher: semantic code moves into `error.code`, numeric status stops occupying it (`packages/runtime/src/http-dispatcher.ts`), `error.type` retired as a code carrier; update the #3687 pin in `http-dispatcher.test.ts` from "documents the deviation" to "asserts the fix". objectui ships tolerant dual-read first where needed (objectui#2869 pattern). Then delete the client three-location probe and fix the `category`/`retryable` nesting read (D9b).
 
 Batches 2 and 3 are independent of each other; both depend on batch 1.
diff --git a/docs/adr/0113-required-write-contract-vs-column-constraint.md b/docs/adr/0113-required-write-contract-vs-column-constraint.md
index 1cbfe9c765..97725a6522 100644
--- a/docs/adr/0113-required-write-contract-vs-column-constraint.md
+++ b/docs/adr/0113-required-write-contract-vs-column-constraint.md
@@ -16,8 +16,20 @@ verified sites:
 | Meaning | Where it lives today |
 |---|---|
 | a write must provide the value | `objectql/validation/record-validator.ts` |
-| the COLUMN is `NOT NULL` | `driver-sql/sql-driver.ts:4901` — `if (field.required) col.notNullable()` |
-| required-vs-nullable divergence is DRIFT | `driver-sql/schema-drift.ts:249-277` — metadata-required + nullable column ⇒ expected `NOT NULL`, and imposing `NOT NULL` over possibly-null data is the classifier's `destructive` class |
+| the COLUMN is `NOT NULL` | `packages/drivers/driver-sql/src/sql-driver.ts` — `if (field.required) col.notNullable()` |
+| required-vs-nullable divergence is DRIFT | `packages/drivers/driver-sql/src/schema-drift.ts` — metadata-required + nullable column ⇒ expected `NOT NULL`, and imposing `NOT NULL` over possibly-null data is the classifier's `destructive` class |
+
+> ⚠️ **Anchor note (#13556).** The three anchors above were line numbers into
+> `sql-driver.ts` and had rotted; they are file-level anchors now, per the
+> 2026-09-01 ruling on #13556 (line anchors → symbol anchors, resolver-gated).
+> ⛔ Re-anchoring did **not** touch what this table says, and the row about the
+> `NOT NULL` column is **known to be stale about today's code**: the physical
+> constraint now keys off `storage.notNull`, not `field.required` — the inverse
+> predicate. That is a separate defect, carded as
+> [#14193](https://github.com/objectstack-ai/objectstack/issues/14193), and it is
+> deliberately **not** repaired here: this record's Context describes the
+> PRE-decision state, and rewriting it inside an anchor migration would edit a
+> decision record's substance under cover of a formatting change.
 
 Because all three ride one flag, **tightening any invariant on a deployed
 object is a destructive migration, blocked by the very legacy nulls that
@@ -44,7 +56,7 @@ becomes a recognized posture: *new writes must provide; old rows may rest.*
 ### The tri-binding, concretely
 
 Authoring `required: true` on a field of a **new** object is unremarkable: the
-column is created `NOT NULL` (sql-driver.ts:4901), the validator enforces
+column is created `NOT NULL` (packages/drivers/driver-sql/src/sql-driver.ts), the validator enforces
 presence, the form shows the marker, drift never fires. The knob works —
 until the object has deployed data.
 
@@ -127,7 +139,7 @@ without buying into it.
 
 `required: true` + nullable column stops being drift (it is the D1 posture).
 `storage.notNull: true` + nullable column IS drift, destructive class,
-unchanged. The `schema-drift.ts:249` comparison reads the storage property
+unchanged. The `packages/drivers/driver-sql/src/schema-drift.ts` comparison reads the storage property
 instead of `required`.
 
 ### D4 — the UI marker follows the write contract
diff --git a/docs/adr/0117-owning-business-unit-record-stamp.md b/docs/adr/0117-owning-business-unit-record-stamp.md
index ed08274b0d..daed232a80 100644
--- a/docs/adr/0117-owning-business-unit-record-stamp.md
+++ b/docs/adr/0117-owning-business-unit-record-stamp.md
@@ -22,13 +22,13 @@
 - `owner_id` —— 人。由 registry 按 `ownership` 轴自动注入
   （`packages/objectql/src/registry.ts` `applySystemFields`），SecurityPlugin 在插入时
   盖章，改动受 `allowTransfer` / `modifyAllRecords` 约束。
-- `organization_id` —— 租户墙。列无条件注入（`registry.ts:305-313`，除显式
+- `organization_id` —— 租户墙。列无条件注入（`packages/objectql/src/registry.ts#organization_id`，除显式
   `systemFields.tenant === false` / `tenancy.enabled === false` 外），值由多组织运行时
   权威盖章。
 
 **中间的一层——"这条记录属于哪个部门 / 哪个法人"——不存在。** 它今天是从所有者
 *推导*的：层级深度档位（`unit` / `unit_and_below` / `own_and_reports`）最终编译成
-`owner_id IN (…)`（`packages/plugins/plugin-sharing/src/sharing-service.ts:47,151,214`），
+`owner_id IN (…)`（`packages/plugins/plugin-sharing/src/sharing-service.ts#owner_id`），
 即"这条记录归属于当前在该组织单元里的某个人"。
 
 ### 这个推导带来三个问题
@@ -44,7 +44,7 @@
 
 - **Dataverse**：每条记录带 `owningbusinessunit`，与 `ownerid` 并存；表分
   User/Team-owned 与 Organization-owned 两类——与本仓既有的
-  `ownership: 'user' | 'org' | 'none'`（`packages/spec/src/data/object.zod.ts:818`）
+  `ownership: 'user' | 'org' | 'none'`（`packages/spec/src/data/object.zod.ts#ownership`）
   同构。
 - **SAP**：凭证同时携带成本中心与公司代码，法定报表按公司代码出。
 
@@ -52,10 +52,10 @@
 
 | 部件 | 位置 |
 |---|---|
-| 记录归属轴声明 `ownership` | `packages/spec/src/data/object.zod.ts:800-823` |
+| 记录归属轴声明 `ownership` | `packages/spec/src/data/object.zod.ts#ownership` |
 | 系统字段注入管线 `applySystemFields` | `packages/objectql/src/registry.ts` |
-| BU 树与子树遍历 | `packages/platform-objects/src/identity/sys-business-unit.object.ts:127`、`packages/plugins/plugin-sharing/src/business-unit-graph.ts` |
-| 用户主 BU 投影（**注意：这是用户属性，不是记录戳**） | `packages/platform-objects/src/identity/sys-user.object.ts:690`、`plugin-sharing/src/primary-bu-projection.ts` |
+| BU 树与子树遍历 | `packages/platform-objects/src/identity/sys-business-unit.object.ts`、`packages/plugins/plugin-sharing/src/business-unit-graph.ts` |
+| 用户主 BU 投影（**注意：这是用户属性，不是记录戳**） | `packages/platform-objects/src/identity/sys-user.object.ts`、`plugin-sharing/src/primary-bu-projection.ts` |
 | 私有+层级对象必须带 org 列的门 | EE `hierarchy/tenant-scope-gate.ts` |
 
 ## 决策
@@ -121,7 +121,7 @@ company 祖先。本 ADR **提供框架侧解析helper，不新增物化列**。
 现契约只能表达所有者集合：
 
 ```ts
-// packages/spec/src/contracts/sharing-service.ts:315-320
+// packages/spec/src/contracts/sharing-service.ts#resolveOwnerIds
 resolveOwnerIds(ctx, scope): Promise<string[]>
 ```
 
@@ -135,7 +135,7 @@ type ScopeResolution =
 resolveScope(ctx, scope): Promise<ScopeResolution>
 ```
 
-`sharing-service.ts:47` 的 `OWNER_FIELD` 硬编码随之解除。这是**破坏性契约变更**，
+`packages/plugins/plugin-sharing/src/sharing-service.ts#OWNER_FIELD` 的 `OWNER_FIELD` 硬编码随之解除。这是**破坏性契约变更**，
 唯一实现方是企业版层级解析器，需与其同步发布。收益：谓词从"数千用户"缩短为
 "几十个 BU"，归属漂移消除，且为公司轴（`organization_id`）留出同形位置。
 
diff --git a/docs/adr/0118-non-user-actor-contract.md b/docs/adr/0118-non-user-actor-contract.md
index 933093299a..4e99665295 100644
--- a/docs/adr/0118-non-user-actor-contract.md
+++ b/docs/adr/0118-non-user-actor-contract.md
@@ -21,10 +21,10 @@ AI 工具的服务端调用。每到这种时刻，系统都要回答同一个
 
 | 现场 | 当前答案 | 毛病 |
 |---|---|---|
-| `sys_metadata_history.recorded_by`（#4556） | `lookup('sys_user')` 列里存哨兵字符串 `'system'`（声明：`packages/metadata-core/src/objects/sys-metadata-history.object.ts:156`；写入：`packages/metadata-protocol/src/sys-metadata-repository.ts:423,545`） | 类型撒谎：声明是外键、存的不是 id，join 断；读侧被迫 `?? 'unknown'` 兜底（同文件 `:317`、`:824`） |
-| AI `ToolExecutionContext`（#2991） | 契约曾把「缺 actor」文档化为 system 级缺省 | fall-open：忘传上下文 = 拿到最高权限。契约文本已改为 fail-closed（`packages/spec/src/contracts/ai-service.ts:394-404`），执行器逐一验证仍未闭合 |
+| `sys_metadata_history.recorded_by`（#4556） | `lookup('sys_user')` 列里存哨兵字符串 `'system'`（声明：`packages/metadata-core/src/objects/sys-metadata-history.object.ts#recorded_by`；写入：`packages/metadata-protocol/src/sys-metadata-repository.ts#recorded_by`） | 类型撒谎：声明是外键、存的不是 id，join 断；读侧被迫 `?? 'unknown'` 兜底（同文件、） |
+| AI `ToolExecutionContext`（#2991） | 契约曾把「缺 actor」文档化为 system 级缺省 | fall-open：忘传上下文 = 拿到最高权限。契约文本已改为 fail-closed（`packages/spec/src/contracts/ai-service.ts#ToolExecutionContext`），执行器逐一验证仍未闭合 |
 | SQL driver（#4560） | `current_user` 框架令牌被原样发射成列 DEFAULT | 框架层概念泄漏进存储层：数据库自己往 user lookup 列写非 id |
-| 引擎 `isSystem`（#3166） | 特权内部写自愿声明 `isSystem`（如 `packages/objectql/src/lifecycle/lifecycle-service.ts:39` 的 `SYSTEM_CTX`；#4441 写路径守卫的 isSystem 豁免） | 惯例成立但自愿：不声明也没人拦 |
+| 引擎 `isSystem`（#3166） | 特权内部写自愿声明 `isSystem`（如 `packages/objectql/src/lifecycle/lifecycle-service.ts#isSystem` 的 `SYSTEM_CTX`；#4441 写路径守卫的 isSystem 豁免） | 惯例成立但自愿：不声明也没人拦 |
 
 ### 为什么这是一个问题，不是四个
 
@@ -43,7 +43,7 @@ AI 工具的服务端调用。每到这种时刻，系统都要回答同一个
 
 Salesforce 用 Automated Process 伪用户行，ServiceNow 用 system 用户行。**本仓不能抄**，
 有一个仓库特有的硬约束：`sys_user` 是 `managedBy: 'better-auth'` 的表
-（`packages/spec/src/data/object.zod.ts:824-831`，ADR-0092）——身份驱动拥有全部写路径，
+（`packages/spec/src/data/object.zod.ts#managedBy`，ADR-0092）——身份驱动拥有全部写路径，
 密码哈希、令牌签发、邀请流都从它走。往里播种一行「永不登录的伪用户」等于绕过身份驱动
 写身份表；且该账号从此要在用户列表、邀请流程、许可计数、权限选择器等**每一个**面被
 排除，漏一处就是 bug——可被引用进权限授予时，是安全 bug。
@@ -67,7 +67,7 @@ Salesforce 用 Automated Process 伪用户行，ServiceNow 用 system 用户行
 - `isSystem: true` → 系统上下文（RLS 旁路），显式、可 grep 的提权；
 - **两者皆无 → 匿名上下文（RLS 开、什么都看不见），永远不是 system。**
 
-该语义已在 AI 工具边界落为契约文本（`ai-service.ts:394-404`，#2991 的契约面修复）。
+该语义已在 AI 工具边界落为契约文本（`packages/spec/src/contracts/ai-service.ts`，#2991 的契约面修复）。
 本条把它升为**全平台规则**：任何执行路径——工具执行器、REST 处理器、任务运行器——
 不得把「上下文缺失」解释为特权。「没有身份」永远不是授权。
 
diff --git a/docs/adr/0119-plugin-reachable-transactions-and-honest-atomic-batch.md b/docs/adr/0119-plugin-reachable-transactions-and-honest-atomic-batch.md
index 731ddf008f..315f576e93 100644
--- a/docs/adr/0119-plugin-reachable-transactions-and-honest-atomic-batch.md
+++ b/docs/adr/0119-plugin-reachable-transactions-and-honest-atomic-batch.md
@@ -26,41 +26,41 @@ So this ADR does not pick one of the three. It separates what the four consumers
 
 #4612 prices option 1 as "a real design project, not a plumbing task", naming middleware/hook semantics inside a transaction, cache invalidation on rollback, and cross-driver support. That was the correct price in the abstract. It is not the price here, because ADR-0034 already paid it:
 
-`ObjectQL.transaction()` (`packages/objectql/src/engine.ts:4934-4973`) opens a driver transaction and runs the callback inside an `AsyncLocalStorage` store; `buildDriverOptions` (`:1257-1275`) lifts that ambient handle onto **every** driver call. The consequence is precisely the hard part the issue budgets for: a hook body, a validation predicate, an FK-resolution read, or any nested `engine.*` call issued during a transactional write automatically binds to that transaction's connection. ADR-0034 exists because *not* doing this deadlocked SQLite's single-connection pool — the failure was found, fixed, and pinned.
+`ObjectQL.transaction()` (`packages/objectql/src/engine.ts#transaction`) opens a driver transaction and runs the callback inside an `AsyncLocalStorage` store; `buildDriverOptions` (`#buildDriverOptions`) lifts that ambient handle onto **every** driver call. The consequence is precisely the hard part the issue budgets for: a hook body, a validation predicate, an FK-resolution read, or any nested `engine.*` call issued during a transactional write automatically binds to that transaction's connection. ADR-0034 exists because *not* doing this deadlocked SQLite's single-connection pool — the failure was found, fixed, and pinned.
 
-The issue's second premise is also stale in this repo: it cites `driver-turso` primitives at `turso-driver.ts:764-776` and `remote-transport.ts:430-443` as evidence the capability exists but is unsurfaced. There is no Turso driver here — only `docs/design/driver-turso.md` (Status: Proposal). The in-repo drivers need no surfacing work either:
+The issue's second premise is also stale in this repo: it cites `driver-turso` primitives at `turso-driver.ts:764-776` <!-- anchor-exempt: HISTORICAL --> and `remote-transport.ts:430-443` <!-- anchor-exempt: HISTORICAL --> as evidence the capability exists but is unsurfaced. There is no Turso driver here — only `docs/design/driver-turso.md` (Status: Proposal). The in-repo drivers need no surfacing work either:
 
 > **Editorial note (2026-08-05, #4645):** the sentence above was true when this ADR was written. `@objectstack/driver-turso` has since been migrated back into this repo at `packages/drivers/driver-turso`. The *decision* recorded here is unaffected — Turso extends `SqlDriver` and inherits the same `beginTransaction` / `commit` / `rollback` members the argument turns on, so it needs no surfacing work either.
- `beginTransaction` / `commit` / `rollback` are **required** members of `IDataDriver` (`packages/spec/src/contracts/data-driver.ts:221-235`), implemented by driver-sql (`sql-driver.ts:2214+`), driver-memory (`:595+`), and driver-mongodb (`:545+`).
+ `beginTransaction` / `commit` / `rollback` are **required** members of `IDataDriver` (`packages/spec/src/contracts/data-driver.ts#beginTransaction`), implemented by driver-sql (`packages/drivers/driver-sql/src/sql-driver.ts#beginTransaction`), driver-memory, and driver-mongodb.
 
 ### The gap that is real: declared reach
 
 `IObjectQLEngine` (`packages/spec/src/contracts/objectql-engine.ts`) is the contract of the `objectql` service slot — what a plugin sees through `ctx.getService('objectql')`. It declares 25 members and not `transaction`. `IDataEngine`, behind the `data` slot, has no transaction member either. So a plugin typed to either contract cannot see the primitive, and the consumers that need it reach around the type system:
 
-- `packages/metadata-protocol/src/protocol.ts:2289` — the `/discovery` capability probe, `typeof (this.engine as { transaction?: unknown })?.transaction === 'function'`;
-- `:7455-7458` — `publishPackageDrafts`' `inTxn`, a `typeof` probe plus `as unknown as { transaction: <R>(fn) => Promise<R> }`;
+- `packages/metadata-protocol/src/protocol.ts` — the `/discovery` capability probe, `typeof (this.engine as { transaction?: unknown })?.transaction === 'function'`;
+- `#publishPackageDrafts` — `publishPackageDrafts`' `inTxn`, a `typeof` probe plus `as unknown as { transaction: <R>(fn) => Promise<R> }`;
 - `packages/metadata-protocol/src/sys-metadata-repository.ts` — a hand-declared local `transaction?` member on its own engine stub.
 
 Each is an honest but **unchecked** claim about a class none of them import. This is the exact problem the contract file was created to end: its header records seven such local surfaces being merged into one checkable declaration, and states the bar for admitting a member — *"a member is declared here only where a CROSS-PACKAGE consumer already calls it through the service slot … Widening this is for whoever needs more, with the call site to prove it."* Three call sites already prove it. The evidence was there; nobody recorded it.
 
-Below plugin space it is worse. A migration-class tool runs behind `McpDataBridge` (`packages/mcp/src/mcp-http-tools.ts:48-81`) — one record per call, no transaction, no batch — or behind `IObjectQLEngine`. The wire has an atomic cross-object route (`POST {basePath}/batch`, ADR-0034's D4 deliverable), but a route is not callable in-process. Hence the issue's accurate observation that plugin-visible multi-row mutation is a JS loop of single-row writes.
+Below plugin space it is worse. A migration-class tool runs behind `McpDataBridge` (`packages/mcp/src/mcp-http-tools.ts#McpDataBridge`) — one record per call, no transaction, no batch — or behind `IObjectQLEngine`. The wire has an atomic cross-object route (`POST {basePath}/batch`, ADR-0034's D4 deliverable), but a route is not callable in-process. Hence the issue's accurate observation that plugin-visible multi-row mutation is a JS loop of single-row writes.
 
 ### Why transactions alone still do not close #4612
 
 Granting every consumer `transaction()` would not let the four queued tools delete their journals:
 
 - A **million-row backfill** (ADR-0117 D8's shape) cannot hold one write transaction for its duration — on SQLite that is the single writer lock for the whole run.
-- `driver-memory.beginTransaction` deep-clones the entire database (`memory-driver.ts:595-630`), so it is O(database) per begin.
-- `ObjectQL.transaction()` binds only the **default** driver (`engine.ts:4950`). Objects routed elsewhere by `setDatasourceMapping` are written outside the transaction, silently.
+- `driver-memory.beginTransaction` deep-clones the entire database (`packages/drivers/driver-memory/src/memory-driver.ts#beginTransaction`), so it is O(database) per begin.
+- `ObjectQL.transaction()` binds only the **default** driver (`packages/objectql/src/engine.ts#transaction`). Objects routed elsewhere by `setDatasourceMapping` are written outside the transaction, silently.
 - A **process crash** — as opposed to a thrown error — defeats in-process compensation entirely. The issue says this plainly and it is the decisive point: no amount of transaction plumbing produces recoverability across a `SIGKILL` mid-run.
 
 The honest shape is therefore *both*: the transaction is the unit of atomicity for a chunk; a durable journal is what makes a multi-chunk run recoverable. That is what the four consumers keep independently rediscovering, and what D2 standardizes.
 
 ### Rot found on the way
 
-**`IDataEngine.batch?`** (`packages/spec/src/contracts/data-engine.ts:97-100`) — the member #4612 opens with. Optional, so nothing must implement it; no engine does. Its entire specification is the three-word comment `Batch Operations (Transactional)` — nothing about partial failure, ordering, cross-object references, rollback scope, or what `transaction: false` means. `DataEngineRequest` is imported by exactly one non-spec file: the contract declaring it. Its request union (`packages/spec/src/data/data-engine.zod.ts:706-717`) even nests batches recursively, a shape nobody designed against because nobody built it. The only test (`contracts/data-engine.test.ts:162-177`) constructs an ad-hoc literal with a `batch` property and asserts it is defined — it pins the type, not an implementation.
+**`IDataEngine.batch?`** (`packages/spec/src/contracts/data-engine.ts#IDataEngine`) — the member #4612 opens with. Optional, so nothing must implement it; no engine does. Its entire specification is the three-word comment `Batch Operations (Transactional)` — nothing about partial failure, ordering, cross-object references, rollback scope, or what `transaction: false` means. `DataEngineRequest` is imported by exactly one non-spec file: the contract declaring it. Its request union (`packages/spec/src/data/data-engine.zod.ts#DataEngineRequest`) even nests batches recursively, a shape nobody designed against because nobody built it. The only test (`packages/spec/src/contracts/data-engine.test.ts`) constructs an ad-hoc literal with a `batch` property and asserts it is defined — it pins the type, not an implementation.
 
-**`batchData`'s `atomic` flag** (`packages/metadata-protocol/src/protocol.ts:5220-5323`) — advertised as *"rollback entire batch on any failure (transaction mode)"*. It opens no transaction. It breaks the loop (`:5302-5305`):
+**`batchData`'s `atomic` flag** (`packages/metadata-protocol/src/protocol.ts#batchData`) — advertised as *"rollback entire batch on any failure (transaction mode)"*. It opens no transaction. It breaks the loop :
 
 ```ts
 if (options?.atomic) {
@@ -71,7 +71,7 @@ if (options?.atomic) {
 
 Everything already written stays written, and the response reports those rows `success: true` under a flag whose one job is to guarantee they were undone. This is #4346's class exactly — a write-path guarantee that is declared and not enforced, silent and destructive when it matters — and #4612 cites #4346 as evidence this write path is sharp. It is the same edge.
 
-The declaration is inconsistent with itself too: `BatchOptionsSchema.atomic` declares `.default(true)` (`packages/spec/src/api/batch.zod.ts:62`) while no enforcement site delivers atomicity, and the REST route deliberately forwards the original body rather than the parsed output, so the declared default never reaches the loop. The same file already tombstoned `validateOnly` for this exact shape — a flag promising a data-safety guarantee it did not keep — calling it *"the worst shape of 'declared ≠ enforced'"*.
+The declaration is inconsistent with itself too: `BatchOptionsSchema.atomic` declares `.default(true)` (`packages/spec/src/api/batch.zod.ts#BatchOptionsSchema`) while no enforcement site delivers atomicity, and the REST route deliberately forwards the original body rather than the parsed output, so the declared default never reaches the loop. The same file already tombstoned `validateOnly` for this exact shape — a flag promising a data-safety guarantee it did not keep — calling it *"the worst shape of 'declared ≠ enforced'"*.
 
 ## Decision
 
@@ -87,7 +87,7 @@ verbatim from the class, so `ObjectQL implements IObjectQLEngine` continues to t
 
 The three cast sites drop their casts. The two narrow host surfaces that must stay tolerant of stubs — `MetadataHostEngine` and the sys-metadata repository's engine — declare their member as `transaction?: IObjectQLEngine['transaction']`, optional locally but **typed from the contract**, so a narrow surface can no longer drift from the real signature.
 
-Two caveats are written into the contract TSDoc as part of the member's declared meaning rather than left as behaviour a caller discovers: `transaction()` covers only the **default driver**, and when that driver lacks `beginTransaction` the callback runs **without a transaction and without rollback** (`engine.ts:4952-4954`). Declaring a caveat is not fixing it; tightening these is #4619. A caller that cannot tolerate silent degradation must fail closed itself — which is what D4 does.
+Two caveats are written into the contract TSDoc as part of the member's declared meaning rather than left as behaviour a caller discovers: `transaction()` covers only the **default driver**, and when that driver lacks `beginTransaction` the callback runs **without a transaction and without rollback** (`packages/objectql/src/engine.ts#transaction`). Declaring a caveat is not fixing it; tightening these is #4619. A caller that cannot tolerate silent degradation must fail closed itself — which is what D4 does.
 
 ### D2 — the migration-journal runner is framework-owned (specified here, implemented in #4617)
 
@@ -115,7 +115,7 @@ Mechanical removal is #4618, following the `spec-property-retirement` playbook's
 
 `batchData` honours `options.atomic === true` by running the whole batch inside one `engine.transaction()`. The first failure aborts and rolls back every prior write, and — the part that makes it honest — **the response says so**: `succeeded: 0`, and every row reports failure, with rows before the failure marked `ROLLED_BACK:`, the failing row carrying its causal error, and rows never reached marked `NOT_ATTEMPTED:`. A response claiming `success: true` for a row that was rolled back is the bug, not merely a missing transaction.
 
-Where the runtime **cannot** roll back — no `transaction()` on the engine, or a default driver without `beginTransaction` — an atomic request is **refused** with `501 NOT_IMPLEMENTED` rather than silently degrading to best-effort. This follows the cross-object `/batch` route's existing precedent (`rest-server.ts:7166-7171`) and uses the standard error catalog, so no new code enters the ADR-0112 ledger. Refusing is the whole point: silent degradation is how the flag came to lie in the first place, and a caller that asked for atomicity is exactly the caller who must not receive best-effort without being told.
+Where the runtime **cannot** roll back — no `transaction()` on the engine, or a default driver without `beginTransaction` — an atomic request is **refused** with `501 NOT_IMPLEMENTED` rather than silently degrading to best-effort. This follows the cross-object `/batch` route's existing precedent (`packages/rest/src/rest-server.ts#NOT_IMPLEMENTED`) and uses the standard error catalog, so no new code enters the ADR-0112 ledger. Refusing is the whole point: silent degradation is how the flag came to lie in the first place, and a caller that asked for atomicity is exactly the caller who must not receive best-effort without being told.
 
 `atomic` takes precedence over `continueOnError` — whose own description already scopes it to `atomic=false`, making this precedence documented rather than new. In atomic mode the upsert path's defensive `catch { insert }` fallback rethrows instead of retrying, because inside an aborted transaction the fallback insert can only fail with a secondary error that masks the real cause.
 
@@ -133,7 +133,7 @@ The declared default is aligned to the enforced one: `BatchOptionsSchema.atomic`
 
 **Implement `IDataEngine.batch?` rather than retire it.** No caller has ever wanted its shape; D1 and D4 deliver its stated purpose with semantics somebody actually specified.
 
-**Do nothing and bless the hand-rolled pattern (#4612's option 3).** Rejected on the issue's own evidence: four consumers converging independently on the same shape is a platform gap, and the copies differ in exactly the places that matter — `ImportUndoLog` (`packages/rest/src/import-runner.ts:48-59`) journals per-row before-images; the publish path (`protocol.ts:7400-7424`) captures a revert plan; `batchData` captured nothing at all and said it did.
+**Do nothing and bless the hand-rolled pattern (#4612's option 3).** Rejected on the issue's own evidence: four consumers converging independently on the same shape is a platform gap, and the copies differ in exactly the places that matter — `ImportUndoLog` (`packages/rest/src/import-runner.ts#ImportUndoLog`) journals per-row before-images; the publish path (`packages/metadata-protocol/src/protocol.ts#batchData`) captures a revert plan; `batchData` captured nothing at all and said it did.
 
 ## Consequences
 
diff --git a/docs/adr/0126-packaged-metadata-customization-model.md b/docs/adr/0126-packaged-metadata-customization-model.md
index 9a593c8467..90e8eb5d20 100644
--- a/docs/adr/0126-packaged-metadata-customization-model.md
+++ b/docs/adr/0126-packaged-metadata-customization-model.md
@@ -74,9 +74,9 @@ admitted by naming its regime under §3's rule, or it is not admitted.
 
 The survey ([#12049 comment 5406807988](https://github.com/objectstack-ai/objectstack/issues/12049#issuecomment-5406807988))
 enumerated all **27 declared metadata types** (`DEFAULT_METADATA_TYPE_REGISTRY`,
-`packages/spec/src/kernel/metadata-plugin.zod.ts:654` — the total universe per #8586, plus the
+`packages/spec/src/kernel/metadata-plugin.zod.ts#DEFAULT_METADATA_TYPE_REGISTRY` — the total universe per #8586, plus the
 dynamic-kind channel for plugin-registered kinds such as `connector`). The write door partitions
-them into three tiers by flags × item provenance (`packages/metadata-protocol/src/protocol.ts:13227-13260`):
+them into three tiers by flags × item provenance (`packages/metadata-protocol/src/protocol.ts`):
 
 | Tier | Types | A packaged item can be… |
 |:--|:--|:--|
@@ -87,12 +87,12 @@ them into three tiers by flags × item provenance (`packages/metadata-protocol/s
 Three real mechanisms operate across those tiers, each invented separately:
 
 - **Org overlay** (ADR-0005): tier A only. Per-org rows for any other type are **phantom writes**
-  — the #6190 measured defect (`packages/metadata-core/src/meta-write-org-scope.ts:16-24`).
+  — the #6190 measured defect (`packages/metadata-core/src/meta-write-org-scope.ts`).
 - **Clone-to-customize** (#11513, permission sets only): server-side lock on the packaged base
   (`packaged-permission-set-lock.ts`), a clone action demanding a new name, and — the piece this
   ADR generalizes — the ruling that **switching a packaged artifact off is row state, not a
-  definition write** (`permission-set-projection.ts:1128-1145`, #4669).
-- **Extend** (`objectExtensions`, `packages/spec/src/data/object.zod.ts:2920`; navigation
+  definition write** (`packages/plugins/plugin-security/src/permission-set-projection.ts`, #4669).
+- **Extend** (`objectExtensions`, `packages/spec/src/data/object.zod.ts`; navigation
   contributions, ADR-0029 D7): a package adds fields/validations/indexes to another package's
   object, or nav items to another package's app, merged at boot. Package-grain, additive,
   upgrade-safe.
@@ -115,9 +115,9 @@ consume it instead of re-litigating it.
 ### 1.3 The shipped promise
 
 Two published pages promise post-install customization generically —
-`content/docs/capabilities/integrations.mdx:17` (*"install complete apps … objects, views, flows,
+`content/docs/capabilities/integrations.mdx` (*"install complete apps … objects, views, flows,
 dashboards, and seed data included, **then customize in Studio**"*) and
-`content/docs/build-without-code.mdx:37` (*"ready to customize in Studio"*). Measured against the
+`content/docs/build-without-code.mdx` (*"ready to customize in Studio"*). Measured against the
 tier table, the promise is keepable today for views and dashboards, and for **no tier-B type**.
 This is stronger pull than any wish-list: it is a shipped claim the platform cannot keep, and the
 flows half of it is the #11665 breach specifically.
@@ -277,7 +277,7 @@ read at each runtime's own consult point; an empty ledger changes nothing anywhe
    instrument grepped the module's **schema** names, and that set genuinely does read zero outside
    `packages/spec`, positive controls included — but it was blind to the module's exported **type**
    names, and one of those has a real build-against consumer: `packages/metadata`'s
-   `metadata-manager.ts:45` imports `type MetadataOverlay` from `@objectstack/spec/kernel` and
+   `packages/metadata/src/metadata-manager.ts` imports `type MetadataOverlay` from `@objectstack/spec/kernel` and
    backs a working three-layer overlay limb (in-memory map at 315-316; `getOverlay` /
    `saveOverlay` / `removeOverlay` / `getEffective` at 2166-2249). The corrected predicate is
    **one unreachable build-against consumer, zero served-surface consumers**: no route serves the
@@ -348,8 +348,8 @@ callers first, or don't), and preserves "packaged code calls what it names".
 
 - **Leaning D2 — a Setup page for packaged automation** (final call rides this ADR's merge):
   packaged flows with their activation state and the enable/disable and clone actions,
-  contributed the way `nav_permission_sets` is (`security-plugin.ts:974`). The maintainer
-  corrected the record here: automation UI is **Studio-only today** (`studio.app.ts:234-239`),
+  contributed the way `nav_permission_sets` is (`packages/plugins/plugin-security/src/security-plugin.ts#nav_permission_sets`). The maintainer
+  corrected the record here: automation UI is **Studio-only today** (`packages/platform-objects/src/apps/studio.app.ts`),
   so this page is new work, and the Setup permission-set page is the precedent shape. Studio
   keeps the editing; Setup gets the operational state. Minimum honest content per packaged flow:
   **on/off for this scope** — that is all the ledger knows (§4), and the page claims nothing
diff --git a/docs/adr/0127-authorization-cache-invalidation-contract-and-ttl-bound.md b/docs/adr/0127-authorization-cache-invalidation-contract-and-ttl-bound.md
index 9549067acb..0113aa4d67 100644
--- a/docs/adr/0127-authorization-cache-invalidation-contract-and-ttl-bound.md
+++ b/docs/adr/0127-authorization-cache-invalidation-contract-and-ttl-bound.md
@@ -111,7 +111,7 @@ Without it, "expires at T" silently becomes "expires at T rounded up by the TTL"
 
 [#4785](https://github.com/objectstack-ai/objectstack/issues/4785) fixed the answer to "where is the session of record?": **it is always `sys_session`, the database.** That ruling **stands**, and this record does not reopen it.
 
-The mechanism, which is why no performance argument reaches it: handing better-auth a `secondaryStorage` moves the session of record into it — `createSession` skips the `sys_session` row and `findSession` answers from the cached snapshot — while ObjectStack revokes sessions **by writing that row** ([ADR-0069](./0069-enterprise-authentication-hardening.md) **D4**: `revoked_at` plus a past `expires_at`). Idle-timeout, absolute-max and concurrent-cap revocation then **silently stop taking effect**. `cookieCache` is the sibling key into the same rejected read-path, and it fails in the same **direction** — for as long as the cookie answers, a revoked session keeps authenticating and nobody gets an error — but ⚠️ **not with the same result**. The difference is measured rather than argued (`packages/plugins/plugin-auth/src/auth-manager.ts:1403-1421`, read against the installed better-auth `1.7.1`): the session of record **stays** in `sys_session`, because `cookieCache` is read-side only — so admin session lists, the concurrent-cap count and D4's audit trail all stay correct; the staleness window is **bounded and per-client** at `cookieCache.maxAge` (default 300s), and cannot be extended without a database read, because better-auth force-disables the stateless `refreshCache` whenever a `database` is configured, which ObjectStack always does; and better-auth's own sensitive-operation path already re-reads with `disableCookieCache: true`. ⛔ Smaller is not harmless — a bounded window in which a revoked session still authenticates is a tolerance D4 never granted, so D7's ruling covers this door too. It is the **reach** the two doors do not share, not the direction.
+The mechanism, which is why no performance argument reaches it: handing better-auth a `secondaryStorage` moves the session of record into it — `createSession` skips the `sys_session` row and `findSession` answers from the cached snapshot — while ObjectStack revokes sessions **by writing that row** ([ADR-0069](./0069-enterprise-authentication-hardening.md) **D4**: `revoked_at` plus a past `expires_at`). Idle-timeout, absolute-max and concurrent-cap revocation then **silently stop taking effect**. `cookieCache` is the sibling key into the same rejected read-path, and it fails in the same **direction** — for as long as the cookie answers, a revoked session keeps authenticating and nobody gets an error — but ⚠️ **not with the same result**. The difference is measured rather than argued (`packages/plugins/plugin-auth/src/auth-manager.ts#secondaryStorage`, read against the installed better-auth `1.7.1`): the session of record **stays** in `sys_session`, because `cookieCache` is read-side only — so admin session lists, the concurrent-cap count and D4's audit trail all stay correct; the staleness window is **bounded and per-client** at `cookieCache.maxAge` (default 300s), and cannot be extended without a database read, because better-auth force-disables the stateless `refreshCache` whenever a `database` is configured, which ObjectStack always does; and better-auth's own sensitive-operation path already re-reads with `disableCookieCache: true`. ⛔ Smaller is not harmless — a bounded window in which a revoked session still authenticates is a tolerance D4 never granted, so D7's ruling covers this door too. It is the **reach** the two doors do not share, not the direction.
 
 ⇒ ⛔ **Caching better-auth's own session read is not available to a performance card.** If it is ever wanted, it is a **decision card that re-opens [#4785](https://github.com/objectstack-ai/objectstack/issues/4785)** with the revocation rewrite that option always required — never a caching card. The maintainer's own reason, recorded verbatim on that card: 「撤销从一次写变成两处一致性，AI 生成的新管控极易只写一半」.
 
@@ -146,10 +146,10 @@ Two further pin obligations follow from D5 and D3 respectively, because nothing
 
 **This record does not claim a latency target is met.** The lineage carries a per-request cost gate owned by the cloud repo. The measurements behind this design count **queries and legs, not milliseconds**, and placement is a separate half that was not measured. ⛔ Nothing here should be read as clearing that gate.
 
-⚠️ **Two doors into D7's rejected architecture, both disclosed — and ⛔ neither boot-refused by ObjectStack.** The ruled posture is **opt-in with the cost stated, on both doors**, and adding a refusal to either needs a new maintainer ruling. It is recorded in the module this paragraph is about, at `packages/plugins/plugin-auth/src/secondary-storage.ts:47-49`: *"⛔ Neither door is boot-refused by ObjectStack, and that is the ruled posture, not a gap: opt-in with the cost stated."* What each door actually carries, cited so a version bump is re-checkable one grep at a time:
+⚠️ **Two doors into D7's rejected architecture, both disclosed — and ⛔ neither boot-refused by ObjectStack.** The ruled posture is **opt-in with the cost stated, on both doors**, and adding a refusal to either needs a new maintainer ruling. It is recorded in the module this paragraph is about, at `packages/plugins/plugin-auth/src/secondary-storage.ts`: *"⛔ Neither door is boot-refused by ObjectStack, and that is the ruled posture, not a gap: opt-in with the cost stated."* What each door actually carries, cited so a version bump is re-checkable one grep at a time:
 
-- **`secondaryStorage` — reachable, and the unbounded one.** `cacheSecondaryStorage()` is deliberately exported and a host-supplied value is passed straight through, so the cache *becomes* the session of record. The default composition does throw at boot — but ⚠️ that throw is **better-auth 1.7's, not this repository's**: better-auth hard-refuses `secondaryStorage` without `session.storeSessionInDatabase`, and reaches the configuration only because the OIDC provider is enabled by default. `session-of-record.test.ts:410` gets to the cache-backed session store by passing `plugins: { oidcProvider: false }` and changing nothing else, and `session-of-record.test.ts:528` pins that third-party refusal **as an observation**, not as a guard this repository owns. ⛔ **The other boot throw in that module is a different one and must not be generalised into this door**: `secondary-storage.ts:87-89` records that better-auth throws at boot when `rateLimit.storage: 'secondary-storage'` is configured without an `increment` implementation. That throw is real — it is a **rate-limit configuration requirement**, and it says nothing about the session-cache door.
-- **`cookieCache` — bounded, and not reachable through ObjectStack config at all, by construction rather than by refusal.** `AuthConfigSchema.session` (`packages/spec/src/system/auth-config.zod.ts`) declares `expiresIn` / `updateAge` only, and `auth-manager.ts` reads only those two, so the key is **dropped, not honoured**; the one way in is `authInstance`, where the host has replaced this whole config. The door is neither unmeasured nor absent from the tree: it carries the measured cost note at `auth-manager.ts:1382-1438` and an **end-of-chain observation pin** at `session-of-record.test.ts:479` that goes red the day someone plumbs it through. ⛔ That pin is a tripwire, not a rejection.
+- **`secondaryStorage` — reachable, and the unbounded one.** `cacheSecondaryStorage()` is deliberately exported and a host-supplied value is passed straight through, so the cache *becomes* the session of record. The default composition does throw at boot — but ⚠️ that throw is **better-auth 1.7's, not this repository's**: better-auth hard-refuses `secondaryStorage` without `session.storeSessionInDatabase`, and reaches the configuration only because the OIDC provider is enabled by default. `packages/plugins/plugin-auth/src/session-of-record.test.ts#secondaryStorage` gets to the cache-backed session store by passing `plugins: { oidcProvider: false }` and changing nothing else, and `packages/plugins/plugin-auth/src/session-of-record.test.ts#secondaryStorage` pins that third-party refusal **as an observation**, not as a guard this repository owns. ⛔ **The other boot throw in that module is a different one and must not be generalised into this door**: `packages/plugins/plugin-auth/src/secondary-storage.ts#cacheSecondaryStorage` records that better-auth throws at boot when `rateLimit.storage: 'secondary-storage'` is configured without an `increment` implementation. That throw is real — it is a **rate-limit configuration requirement**, and it says nothing about the session-cache door.
+- **`cookieCache` — bounded, and not reachable through ObjectStack config at all, by construction rather than by refusal.** `AuthConfigSchema.session` (`packages/spec/src/system/auth-config.zod.ts`) declares `expiresIn` / `updateAge` only, and `auth-manager.ts` reads only those two, so the key is **dropped, not honoured**; the one way in is `authInstance`, where the host has replaced this whole config. The door is neither unmeasured nor absent from the tree: it carries the measured cost note at `packages/plugins/plugin-auth/src/auth-manager.ts#authInstance` and an **end-of-chain observation pin** at `packages/plugins/plugin-auth/src/session-of-record.test.ts` that goes red the day someone plumbs it through. ⛔ That pin is a tripwire, not a rejection.
 
 That is the ruled posture with its cost written down, not a gap in the guard — and D7 decides the ruling either way. It is recorded here so that a future reader finds the posture **and** the asymmetry between the two doors, rather than rediscovering either or inferring a refusal from the rate-limit throw.
 
diff --git a/docs/adr/0130-release-artifact-as-co-ownership-boundary.md b/docs/adr/0130-release-artifact-as-co-ownership-boundary.md
index 4b09051125..acae989c08 100644
--- a/docs/adr/0130-release-artifact-as-co-ownership-boundary.md
+++ b/docs/adr/0130-release-artifact-as-co-ownership-boundary.md
@@ -52,11 +52,11 @@ N manifests inside it, register N packages in dependency-topological order at lo
 
 The load-bearing insight is that the runtime registry was **already built multi-package**:
 namespaces are stored as `Map<namespace, Set<packageId>>`
-(`packages/objectql/src/registry.ts:1456`), registration is per-manifest
-(`ObjectQL.registerApp`, `packages/objectql/src/engine.ts:4746`), uninstall is per-package
-(`SchemaRegistry.unregisterObjectsByPackage`, `registry.ts:2679`), and objects already carry a
+(`packages/objectql/src/registry.ts#registerApp`), registration is per-manifest
+(`ObjectQL.registerApp`, `packages/objectql/src/engine.ts#registerApp`), uninstall is per-package
+(`SchemaRegistry.unregisterObjectsByPackage`, `packages/objectql/src/registry.ts#unregisterObjectsByPackage`), and objects already carry a
 per-item owner. **The only gate is `installPackage`** — and that gate's criterion
-(`owner !== manifest.id`, `registry.ts:3583`) is a *proxy*. What it means to ask is "do these
+(`owner !== manifest.id`, `packages/objectql/src/registry.ts`) is a *proxy*. What it means to ask is "do these
 packages have the same owner?"; what it actually asks is "are they the same package?". This
 record corrects the proxy to its intent: **the release artifact itself is the co-ownership
 declaration**, because everything inside one artifact is delivered atomically by one publisher.
@@ -106,7 +106,7 @@ group nodes).
 
 That asymmetry is structural, and re-verified here: the object document has **no** grouping,
 module, category or section key — the only `group` spelling in
-`packages/spec/src/data/object.zod.ts:1779` is a *rejection-guidance* entry redirecting the
+`packages/spec/src/data/object.zod.ts#userActions` is a *rejection-guidance* entry redirecting the
 author to the view's `userActions`. There is nothing for Studio to group by.
 
 **(b) The context budget has no module boundary.** The product promise is that a CRM sales
@@ -124,7 +124,7 @@ package as the sales module. Commercially it does not exist as a thing.
 | --- | --- | --- |
 | **Add a `module` tag to objects/flows** | A pure grouping key priced at ~1,100–1,200 tokens across 190 authored files — **70–75% of the downstream ratchet's remaining headroom**, for zero enforcement. Raising the ceiling is a maintainer floor item, not an agent's. | The absence it would fill is real (§1.3a); the ratchet itself is a downstream-app script, see §7. |
 | **Split into packages with separate namespaces** | This is **rename-on-install by another name**. `${namespace}_${shortName}` is kernel-validated and the object `name` **is** the table name, the REST path, the formula token and the saved-view key (ADR-0129 D1–D2). `crm_account` → `sales_account` breaks all of them. | ADR-0048 §3.5 and its Non-goals (line 171) already record this as an explicit non-goal: *"Namespace rename-on-install is an explicit non-goal for now (deep rewrite of every object name, cross-reference, and formula)."* |
-| **Merge with the existing `composeStacks`** | It **flattens**, and flattening is the whole loss. Its `manifest` option is `z.union([z.enum(['first','last']), z.number().int().min(0)]).default('last')` — it *picks one manifest and drops the rest*. Running the full refactor through it lands back on one 30-object flat package: the benefit evaporates exactly where it was supposed to appear. | `packages/spec/src/stack.zod.ts:1759`, with the doc comment above it stating the selection semantics ("Which manifest to keep when multiple stacks provide one"). |
+| **Merge with the existing `composeStacks`** | It **flattens**, and flattening is the whole loss. Its `manifest` option is `z.union([z.enum(['first','last']), z.number().int().min(0)]).default('last')` — it *picks one manifest and drops the rest*. Running the full refactor through it lands back on one 30-object flat package: the benefit evaporates exactly where it was supposed to appear. | `packages/spec/src/stack.zod.ts#composeStacks`, with the doc comment above it stating the selection semantics ("Which manifest to keep when multiple stacks provide one"). |
 
 ### 1.5 What the runtime already does (the reason this is small)
 
@@ -132,15 +132,15 @@ Re-verified in this worktree, not taken from the proposal:
 
 | Fact | Anchor |
 | --- | --- |
-| Namespace ownership is stored **many-to-one**: `private namespaceRegistry = new Map<string, Set<string>>();` | `packages/objectql/src/registry.ts:1456` |
-| `getNamespaceOwners()` returns an **array** of package ids | `registry.ts:1540` |
-| Registration is **per manifest** — `registerApp(manifest)` stamps each object with that manifest's id/namespace | `packages/objectql/src/engine.ts:4746` |
-| Uninstall is **per package**, not a namespace sweep | `registry.ts:2679` (`unregisterObjectsByPackage`) |
-| The one place a second package is refused | `registry.ts:3575` `installPackage`, gate at `3583`, throw at `3595` |
-| The load-time call site that registers exactly one manifest | `packages/objectql/src/plugin.ts:405` (`ql.registerApp(manifest)`) |
-| `validateSingleApp` constrains only `type: 'app'` — it returns `[]` for every other type | `packages/spec/src/stack.zod.ts:854` |
-| Shareable namespaces are `{base, system}` plus `sys` | `registry.ts:45` + `registry.ts:1116` (`isShareableNamespace`) |
-| The artifact's `manifest` key is **singular and optional** on the schema `os compile` validates and writes | `packages/spec/src/stack.zod.ts:240`; `packages/cli/src/commands/compile.ts:271` (parse) and `:596` (write); `os build` is an alias of `os compile` (`packages/cli/src/commands/build.ts:6`) |
+| Namespace ownership is stored **many-to-one**: `private namespaceRegistry = new Map<string, Set<string>>();` | `packages/objectql/src/registry.ts#namespaceRegistry` |
+| `getNamespaceOwners()` returns an **array** of package ids | `packages/objectql/src/registry.ts#getNamespaceOwners` |
+| Registration is **per manifest** — `registerApp(manifest)` stamps each object with that manifest's id/namespace | `packages/objectql/src/engine.ts#registerApp` |
+| Uninstall is **per package**, not a namespace sweep | `packages/objectql/src/registry.ts#unregisterObjectsByPackage` (`unregisterObjectsByPackage`) |
+| The one place a second package is refused | `packages/objectql/src/registry.ts#installPackage` — the gate and the throw are inside it |
+| The load-time call site that registers exactly one manifest | `packages/objectql/src/plugin.ts` (`ql.registerApp(manifest)`) |
+| `validateSingleApp` constrains only `type: 'app'` — it returns `[]` for every other type | `packages/spec/src/stack.zod.ts#validateSingleApp` |
+| Shareable namespaces are `{base, system}` plus `sys` | `packages/objectql/src/registry.ts#isShareableNamespace` + `packages/objectql/src/registry.ts#isShareableNamespace` (`isShareableNamespace`) |
+| The artifact's `manifest` key is **singular and optional** on the schema `os compile` validates and writes | `packages/spec/src/stack.zod.ts`; `packages/cli/src/commands/compile.ts` (parse) and `packages/cli/src/commands/compile.ts` (write); `os build` is an alias of `os compile` (`packages/cli/src/commands/build.ts`) |
 
 #14122 also measured the authoring side: a sub-package declaring `namespace: 'crm'`, defining
 `crm_*` objects and injecting navigation through `navigationContributions` is ACCEPTED by
@@ -165,7 +165,7 @@ Therefore the install gate's criterion is corrected from *"is this the same pack
 *"are these co-owners within one artifact?"*. This is not a new permission being granted; it is
 an existing check being asked the question it was always meant to ask. The 2026-08-06 ruling
 recorded in ADR-0048's addendum already located ownership at the **publisher**, not the package
-(addendum D2, `0048-cross-package-metadata-collision.md:459`); one artifact is the smallest
+(addendum D2, `docs/adr/0048-cross-package-metadata-collision.md`); one artifact is the smallest
 publisher-atomic unit the runtime can observe without a new field.
 
 ### D2 — The consumer model does not move; the artifact stops at the control plane
@@ -175,19 +175,19 @@ still installs one thing, opens one thing, uninstalls one thing: the single `typ
 The other packages in the artifact are `type: module` / `plugin` — ADR-0019 D2's "internal
 contribution" tier, which that record defines as *"the 'frameworks inside the `.app` bundle':
 they ship inside an App or are operator-provisioned, and are never independently browsed or
-installed by a consumer"* (`0019-app-as-consumer-unit.md:68`). `isConsumerInstallable(type)`
+installed by a consumer"* (`docs/adr/0019-app-as-consumer-unit.md`). `isConsumerInstallable(type)`
 already filters them out of the consumer marketplace and
 `MarketplaceListingSchema.packageType` already cannot represent a non-App listing — neither
 changes.
 
 D4 of ADR-0019 accommodates this case in its own words, unchanged: *"An App declares and owns
-**a set of namespaces**; uninstall is atomic over that set"* (`0019-app-as-consumer-unit.md:81`,
-`:83`) — a **set**, and its parenthetical already cites the very `Map<namespace, Set<packageId>>`
-this record leans on (`:85–86`).
+**a set of namespaces**; uninstall is atomic over that set"* (`docs/adr/0019-app-as-consumer-unit.md`,
+`docs/adr/0019-app-as-consumer-unit.md`) — a **set**, and its parenthetical already cites the very `Map<namespace, Set<packageId>>`
+this record leans on (`docs/adr/0019-app-as-consumer-unit.md`).
 
 ⛔ **The line this must not cross.** The artifact is a **control-plane and publishing** noun. The
 moment it becomes something a consumer browses, installs or uninstalls, it is the **suite**
-ADR-0019 D3 removed by name, and that record's Apple argument (`:73–79`, `:44–46`) applies
+ADR-0019 D3 removed by name, and that record's Apple argument (`docs/adr/0019-app-as-consumer-unit.md`, `docs/adr/0019-app-as-consumer-unit.md`) applies
 unaltered: *"there is no user-visible container above the app"*. The artifact must never appear
 in the consumer marketplace, never be an install target a consumer selects, and never be a unit
 a consumer can partially uninstall. It has exactly one consumer-visible consequence — the App
@@ -210,9 +210,9 @@ part specified as a machine constraint rather than an instruction.
 Today's namespace exclusivity is **carrying a second guarantee for free**. ADR-0048's own TL;DR
 says why: objects *"dodge collisions because their names are namespace-prefixed (`crm_account`)
 and map to physical tables; a clash fails **loudly** at the DB"*
-(`0048-cross-package-metadata-collision.md:20–23`), and §3.2 grounds the gate on exactly that:
+(`docs/adr/0048-cross-package-metadata-collision.md`), and §3.2 grounds the gate on exactly that:
 *"two packages with namespace `crm` both try to create `crm_account` and the second fails at the
-DB"* (`:208–210`). So "no two packages share a namespace" has been silently proxying for **"no
+DB"* (`docs/adr/0048-cross-package-metadata-collision.md`). So "no two packages share a namespace" has been silently proxying for **"no
 two packages define the same object name."**
 
 Relax the first without adding the second, and two packages in one artifact both defining
@@ -245,7 +245,7 @@ legibly.
 ### D4 — Artifact schema: `packages: [...]` is additive, and both shapes are read
 
 `ObjectStackDefinitionSchema` gains an **optional** `packages` key carrying an array of
-manifests. `manifest` (singular, `stack.zod.ts:240`) is **retained**, and the load path reads
+manifests. `manifest` (singular, `packages/spec/src/stack.zod.ts`) is **retained**, and the load path reads
 both:
 
 - `packages` present → iterate it.
@@ -257,7 +257,7 @@ second branch and its behaviour is unchanged. A *replacement* of `manifest` by `
 break every artifact already built — the schema shape is the compatibility mechanism.
 
 Forward compatibility rides on the mechanism that already exists: `manifest.engines.protocol`
-(`packages/spec/src/kernel/manifest.zod.ts:70`, ADR-0025). A new-format artifact declares a new
+(`packages/spec/src/kernel/manifest.zod.ts`, ADR-0025). A new-format artifact declares a new
 protocol range and an older runtime **refuses it cleanly** rather than mis-parsing it into a
 half-registered install. ⛔ No new version-negotiation mechanism is introduced.
 
@@ -284,7 +284,7 @@ the extension simply does not take effect. A silent failure that a reviewer cann
 failure the tests must own.
 
 ⛔ **Reuse `resolvePluginOrder`; do not write a second ordering mechanism.**
-`packages/core/src/plugin-order.ts:66` is the platform's single topological sorter, and
+`packages/core/src/plugin-order.ts#resolvePluginOrder` is the platform's single topological sorter, and
 [ADR-0116](./0116-plugin-ordering-declared-contract.md) already established that ordering is a
 **declared** contract resolved from `dependencies` / `optionalDependencies` — with the failure
 mode ADR-0116 exists for being precisely "correctness rode on which array slot each caller put it
@@ -342,7 +342,7 @@ The field becomes **necessary** the day a module ships as its own artifact and m
 across artifacts *"I have the same publisher as HotCRM."* That is exactly the moment D6's cost
 bites, and it is exactly the case ADR-0048's 2026-08-08 addendum already has a home for: **D2
 holds the namespace reservation at the `publisherOrgId`, not at the package**
-(`0048-cross-package-metadata-collision.md:459–463`). When the field lands, it aligns with that
+(`docs/adr/0048-cross-package-metadata-collision.md`). When the field lands, it aligns with that
 key rather than inventing a parallel identity. Until then it is not built.
 
 This deferral is a decision, recorded so the next author finds a reason instead of an absence.
@@ -354,8 +354,8 @@ It is listed again under Non-goals.
 
 - **A manifest `owner` / `publisher` field.** Deferred, D8. Aligns with ADR-0048 addendum D2 when
   it lands.
-- **Namespace rename-on-install.** Unchanged non-goal — ADR-0048 §3.5 and Non-goals (`:171`,
-  `:261–267`). This record's entire value is that it does **not** require a rename; it must never
+- **Namespace rename-on-install.** Unchanged non-goal — ADR-0048 §3.5 and Non-goals (,
+  ). This record's entire value is that it does **not** require a rename; it must never
   become the wedge that reintroduces one.
 - **The artifact as a consumer-visible unit.** D2's ⛔ line. Not a suite, not a browse target, not
   an install target, not partially uninstallable.
@@ -407,8 +407,8 @@ It is listed again under Non-goals.
 | # | Change | Size | Repo |
 | --- | --- | --- | --- |
 | 1 | Artifact schema: optional `packages: [...]`, both shapes read (D4) | The one substantive change | objectstack |
-| 2 | Load path: `ql.registerApp(manifest)` at `packages/objectql/src/plugin.ts:405` becomes an iteration, **topologically ordered** (D5) | A loop plus the sorter call | objectstack |
-| 3 | `composeStacks`: add a **preserve** mode alongside today's deliberate pick semantics; default `'last'` unchanged (`stack.zod.ts:1759`) | Small, additive | objectstack |
+| 2 | Load path: `ql.registerApp(manifest)` at `packages/objectql/src/plugin.ts` becomes an iteration, **topologically ordered** (D5) | A loop plus the sorter call | objectstack |
+| 3 | `composeStacks`: add a **preserve** mode alongside today's deliberate pick semantics; default `'last'` unchanged (`packages/spec/src/stack.zod.ts#composeStacks`) | Small, additive | objectstack |
 | 4 | `installPackage` namespace gate accepts co-owners within one artifact (D1) | ~One criterion | objectstack |
 | 5 | **Install-time per-object-name uniqueness check — same PR as #4, with the pairing gate test** (D3) | Small, **not omittable** | objectstack |
 | 6 | Studio package picker lists project-domain `module` packages (today only `app.objectstack.hotcrm` shows; 22 system plugins are filtered out) | UI, separate card | **objectui** |
@@ -436,7 +436,7 @@ turn into a mechanism, and it does not become one until the cards above ship.
    non-goal, and under ADR-0129 D1 the object `name` is the table name, so the rename reaches
    every customer's data plane.
 3. **`composeStacks` as-is.** Rejected: it flattens by design and drops N−1 manifests
-   (`stack.zod.ts:1759`), destroying the sub-package identity that is the whole point.
+   (`packages/spec/src/stack.zod.ts#composeStacks`), destroying the sub-package identity that is the whole point.
 4. **Add the `owner` field now, alongside the gate change.** Rejected for now as scope the pull
    does not justify (D8): within one artifact the field restates what delivery already proves,
    and a second source of truth for ownership can drift from the first. It is deferred with a
@@ -468,8 +468,8 @@ informed act rather than a rubber stamp:
 Recorded rather than silently corrected, because the proposal is this record's evidence base and
 a reader deserves to know which of its anchors were re-measured:
 
-- **`objectql/src/engine.ts:4745` is off by one.** `registerApp(manifest: any)` is declared at
-  **`:4746`**; line 4745 is the closing `*/` of its doc block. The claim it supports —
+- **`packages/objectql/src/engine.ts#registerApp` is off by one.** `registerApp(manifest: any)` is declared at
+  **`#registerApp`**; line 4745 is the closing `*/` of its doc block. The claim it supports —
   registration is per-manifest and stamps that manifest's id/namespace — holds exactly as
   described.
 - **`scripts/check-source-token-ratchet.mjs` does not exist in this repository.** The token
@@ -479,11 +479,11 @@ a reader deserves to know which of its anchors were re-measured:
   this repo — which does not weaken §1.3b's argument (the *absence* of a module boundary is a
   platform fact, verified here in §1.3a) but does change who owns the number.
 - Every other anchor cited by #14122 and re-checked while drafting was found exactly as
-  described: `registry.ts:1456`, the `installPackage` gate at `:3575`/`:3583`/`:3595`,
-  `getNamespaceOwners` at `:1540`, `unregisterObjectsByPackage` at `:2679`,
-  `plugin.ts:405`, `stack.zod.ts:240` / `:854` / `:1759`, `RESERVED_NAMESPACES` at
-  `registry.ts:45` with `isShareableNamespace` at `:1116`, and ADR-0048's rename-on-install
-  non-goal in all three of its recorded places (`:57–59`, `:171`, `:261–267`).
+  described: `packages/objectql/src/registry.ts#installPackage` with its gate and its throw,
+  `#getNamespaceOwners`, `#unregisterObjectsByPackage`,
+  `packages/objectql/src/plugin.ts`, `packages/spec/src/stack.zod.ts#composeStacks`, `RESERVED_NAMESPACES` at
+  `packages/objectql/src/registry.ts#RESERVED_NAMESPACES` with `#isShareableNamespace`, and ADR-0048's rename-on-install
+  non-goal in all three of its recorded places (`docs/adr/0048-cross-package-metadata-collision.md`).
 
 ---
 
diff --git a/package.json b/package.json
index b2f7666356..e9641c9be8 100644
--- a/package.json
+++ b/package.json
@@ -82,6 +82,7 @@
     "check:turbo-task-graph": "node scripts/check-turbo-task-graph.mjs --self-test && node scripts/check-turbo-task-graph.mjs",
     "check:adr-anchors": "node scripts/check-adr-anchors.mjs --self-test && node scripts/check-adr-anchors.mjs",
     "check:adr-links": "node scripts/check-adr-links.mjs --self-test && node scripts/check-adr-links.mjs",
+    "check:adr-symbol-anchors": "node scripts/symbol-anchors.mjs --self-test && node scripts/check-adr-symbol-anchors.mjs --self-test && node scripts/check-adr-symbol-anchors.mjs",
     "check:platform-checklist": "node scripts/checklist-select.mjs --self-test && node scripts/check-platform-checklist.mjs",
     "check:org-identifier": "node scripts/check-org-identifier.mjs --self-test && node scripts/check-org-identifier.mjs",
     "check:runner-env-posture": "node scripts/check-runner-env-posture.mjs --self-test && node scripts/check-runner-env-posture.mjs",
diff --git a/scripts/check-adr-symbol-anchors.mjs b/scripts/check-adr-symbol-anchors.mjs
new file mode 100644
index 0000000000..1b999bfd3f
--- /dev/null
+++ b/scripts/check-adr-symbol-anchors.mjs
@@ -0,0 +1,241 @@
+#!/usr/bin/env node
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * check-adr-symbol-anchors (#13556) -- the `docs/adr/**` registration of the
+ * shared symbol-anchor resolver.
+ *
+ *   node scripts/check-adr-symbol-anchors.mjs
+ *   node scripts/check-adr-symbol-anchors.mjs --list
+ *   node scripts/check-adr-symbol-anchors.mjs --self-test
+ *
+ * ⚠️ THE MECHANISM IS NOT HERE. The grammar, the extractor and the resolution
+ * rule all live in `scripts/symbol-anchors.mjs`, whose header is authoritative
+ * and worth reading before this one. This file is a `defineCorpus` call, a
+ * population declaration and an exit contract -- deliberately thin, because a
+ * second corpus joining this gate must be able to be exactly the same thing.
+ *
+ * ## Why this gate exists (the measured failure)
+ *
+ * ADRs cited positions in source files by LINE NUMBER. The #13556 census
+ * enumerated all of them -- 343 distinct anchors across 35 of the 134 ADRs,
+ * plus 52 continuation anchors, a 395-anchor surface -- and resolved each
+ * against `main`. Excluding 4 HISTORICAL and 2 EXTERNAL anchors, **243 of 337
+ * were broken: 72.1%**, with the four hottest target files 100% broken across
+ * 50 anchors.
+ *
+ * ⭐ **72.1% IS A ONE-WAY LOWER BOUND, and that declaration is part of the
+ * record** (maintainer ruling 2026-09-01, point 5: 「72.1% 是单向误差下界的申报
+ * 原样入册」). The census's mechanical RESOLVES test accepted a symbol appearing
+ * anywhere inside the cited range, including inside a COMMENT, so it passed
+ * anchors a stricter reading fails. True rot was higher than 72.1%, never
+ * lower. This migration confirmed the direction: `object.zod.ts` was credited
+ * with `stateMachines` by the census, but on today's tree the only occurrence
+ * is a comment saying that map no longer exists. The resolver in
+ * `symbol-anchors.mjs` strips comments before matching precisely so this gate
+ * does not inherit that permissiveness.
+ *
+ * ## The ruling (maintainer 2026-09-01, 总监批 #27)
+ *
+ * Option A: 「ADR 行号锚整体迁为符号锚 + resolver 门禁(缺符号变红)—— 与 #13788
+ * 已裁方向同构,共享同一个 resolver,⛔ 不造第二套」, with 「C 不作过渡」 -- one
+ * migration, no gradual phase. That is why a surviving line anchor is a hard
+ * finding here rather than a warning: a deprecation window is precisely the
+ * "两道工" the ruling refused, and it would let the 243 proven-rotted numbers
+ * outlive the migration that deleted them.
+ *
+ * ## What a red means, and how to clear it
+ *
+ * [line-anchor]        A `path:NNN` is back. Cite the symbol instead --
+ *                      `path#symbolName` -- or, if the sentence names no
+ *                      symbol that exists, drop to a file-level `path`. Both
+ *                      stay checked; a line number does not.
+ * [unresolved-symbol]  The file is there, the symbol is not. Either the symbol
+ *                      was renamed (update the anchor) or the mechanism moved
+ *                      out of that file (re-anchor it where it lives). ⚠️ If
+ *                      the SENTENCE has become untrue -- not just the pointer
+ *                      -- that is a separate defect and takes its own card;
+ *                      ADR-0113's inverted predicate is the worked example
+ *                      (#14193). Do not repair prose to clear this gate.
+ * [unresolved-path]    No tracked file at that path. The file moved or went.
+ * [bad-exemption]      An `anchor-exempt` marker naming no valid class. A typo
+ *                      must not be a way to switch the gate off.
+ *
+ * ⛔ MAINTAINER-ONLY: adding an `anchor-exempt` marker. It is the one remedy
+ * that makes this gate quieter instead of satisfying it -- the same shape as
+ * editing a shrink-only ledger -- and it exists for exactly two classes
+ * (HISTORICAL, EXTERNAL) that no in-repo resolver could ever check. An author
+ * whose anchor will not resolve fixes the ANCHOR, never the exemption list.
+ *
+ * ## Cross-repo anchors are REPORTED, never red (ruling point 3)
+ *
+ * 11 census anchors point into the sibling `objectui` repo. A gate living here
+ * cannot resolve them against a moving sibling without pinning a sha, so the
+ * ruled fallback applies: they are downgraded to file-level anchors that NAME
+ * the cross-repo target (`objectui:packages/...`), and the resolver verifies
+ * them only when a checkout is actually available ($OBJECTUI_CHECKOUT). With no
+ * checkout they are listed as skipped and the gate stays green -- a check that
+ * reddens on the healthy case is the permanently-red gate this repo retired.
+ */
+
+import { execFileSync } from 'node:child_process';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+
+import { isEntrypoint } from './invoked-as.mjs';
+import { ANCHOR_GRAMMAR, defineCorpus, sweepCorpus } from './symbol-anchors.mjs';
+
+/* ── The declared path population (#13519 / check-declared-population-live) ───
+ * These literals ARE the population this gate reads, and the self-test holds
+ * them against the corpus registration below, so a moved surface reddens here
+ * rather than turning this gate silently inert. */
+export const ADR_DIR = 'docs/adr';
+export const ROOT_DIR_WATCH_HINTS = ['docs/adr/**'];
+
+/* The census this gate was built from, kept as data so the report can state
+ * what the surface was when the migration ran. ⛔ SHRINK-ONLY in spirit: these
+ * are historical measurements, not a budget to spend. */
+export const CENSUS_13556 = {
+  measuredOn: '83be46012778c07b8de6b6d3a026217f26712302',
+  adrFilesTotal: 134,
+  adrFilesWithAnchors: 35,
+  distinctLineAnchors: 343,
+  continuationAnchors: 52,
+  totalSurface: 395,
+  brokenOfLive: [243, 337],
+  rotRate: '72.1%',
+  rotRateIsLowerBound: true,
+};
+
+export const CORPUS = defineCorpus({
+  id: 'adr',
+  label: 'docs/adr/** (architecture decision records)',
+  docRoots: [ADR_DIR],
+  docPattern: /\.md$/,
+  crossRepos: { objectui: { checkoutEnv: 'OBJECTUI_CHECKOUT' } },
+});
+
+export function runCheck(root = process.cwd()) {
+  const { findings, counts } = sweepCorpus(CORPUS, root);
+  const hard = findings.filter((f) => !f.soft);
+  const soft = findings.filter((f) => f.soft);
+
+  if (counts.anchors === 0) {
+    console.error('❌ check-adr-symbol-anchors: the sweep found ZERO anchors in docs/adr/** — the extractor is broken, not the corpus clean.');
+    process.exit(1);
+  }
+
+  for (const f of soft) console.log(`ℹ️  [${f.kind}] ${f.doc}:${f.line}  ${f.raw}\n      ${f.detail}`);
+
+  if (hard.length > 0) {
+    console.error(`❌ check-adr-symbol-anchors: ${hard.length} finding(s) across ${counts.docs} records.\n`);
+    for (const f of hard) console.error(`  [${f.kind}] ${f.doc}:${f.line}  ${f.raw}\n      ${f.detail}`);
+    console.error(`\nThe anchor grammar:\n  ${ANCHOR_GRAMMAR}`);
+    console.error('\n⛔ MAINTAINER-ONLY: an `anchor-exempt` marker is not the remedy — fix the anchor.');
+    process.exit(1);
+  }
+
+  console.log(
+    `✅ check-adr-symbol-anchors: ${counts.anchors} anchors across ${counts.docs} records resolve — ` +
+      `${counts.symbol} symbol (${counts.declaration} declaration, ${counts.literal} literal), ` +
+      `${counts.fileLevel} file-level, ${counts.crossRepo} cross-repo, ${counts.exempt} exempt, ` +
+      `${counts.continuation} continuation. 0 line anchors survive.`,
+  );
+}
+
+function list(root = process.cwd()) {
+  const { findings, counts } = sweepCorpus(CORPUS, root);
+  console.log(JSON.stringify({ counts, findings }, null, 2));
+}
+
+/* ─────────────────────────────── self-test ─────────────────────────────── */
+
+function assert(cond, msg) { if (!cond) { console.error(`❌ check-adr-symbol-anchors --self-test: ${msg}`); process.exit(1); } }
+
+export function selfTest() {
+  // 1. ⭐ The instrument this gate cannot hold about itself on a clean tree: a
+  //    synthetic corpus carrying one of EVERY finding class, plus the healthy
+  //    forms, so "no findings" is told apart from "the rule stopped matching".
+  const tmp = mkdtempSync(join(tmpdir(), 'check-adr-symbol-anchors-'));
+  try {
+    const write = (rel, body) => { mkdirSync(dirname(join(tmp, rel)), { recursive: true }); writeFileSync(join(tmp, rel), body); };
+    write('src/thing.ts', 'export function realSymbol() {}\nconst names = ["sys_thing"];\n// commentOnlySymbol is only named here\n');
+    write('docs/adr/0001-good.md', [
+      'A symbol anchor `src/thing.ts#realSymbol` resolves.',
+      'A data identifier `src/thing.ts#sys_thing` resolves as a literal.',
+      'A file-level anchor `src/thing.ts` resolves.',
+      'A continuation `src/thing.ts#realSymbol` then `#sys_thing`.',
+    ].join('\n'));
+    write('docs/adr/0002-bad.md', [
+      'A survived line anchor `src/thing.ts:42` must be found.',
+      'A range `src/thing.ts:10-20` must be found.',
+      'An en-dash range `src/thing.ts:30–40` must be found.',
+      'A missing symbol `src/thing.ts#noSuchSymbol` must be found.',
+      'A comment-only symbol `src/thing.ts#commentOnlySymbol` must be found.',
+      'A gone file `src/vanished.ts#whatever` must be found.',
+      'A bogus exemption `src/thing.ts:99` <!-- anchor-exempt: NOPE --> must be found.',
+    ].join('\n'));
+    write('docs/adr/0003-exempt.md', 'An excused anchor `src/gone.ts:7` <!-- anchor-exempt: HISTORICAL --> is silent.');
+    // the sweep reads `git ls-files`, so the fixture needs to be a repo
+    execFileSync('git', ['init', '-q'], { cwd: tmp });
+    execFileSync('git', ['add', '-A'], { cwd: tmp });
+
+    const { findings, counts } = sweepCorpus(CORPUS, tmp);
+    const kinds = findings.map((f) => f.kind);
+    const count = (k) => kinds.filter((x) => x === k).length;
+
+    assert(count('line-anchor') === 3, `3 line anchors (plain, hyphen range, EN DASH range) must be found, got ${count('line-anchor')}`);
+    // `noSuchSymbol` (absent) and `commentOnlySymbol` (named only in a
+    // comment — the census's permissiveness, refused here). The vanished FILE
+    // is a different class and is asserted separately below.
+    assert(count('unresolved-symbol') === 2, `2 unresolved symbols must be found, got ${count('unresolved-symbol')}`);
+    assert(count('bad-exemption') === 1, `an invalid exemption class must be a finding, got ${count('bad-exemption')}`);
+    assert(count('unresolved-path') === 1, `a vanished target must be a finding, got ${count('unresolved-path')}`);
+    assert(counts.exempt === 1, 'a valid exemption must be honoured exactly once');
+    // ...and the healthy record must contribute NOTHING. A rule that fires on
+    // good anchors is as broken as one that misses bad ones.
+    assert(!findings.some((f) => f.doc.includes('0001-good')), 'the healthy record must produce no findings');
+    assert(counts.declaration >= 1 && counts.literal >= 1, 'both resolution classes must be exercised by the fixture');
+  } finally {
+    rmSync(tmp, { recursive: true, force: true });
+  }
+
+  // 2. The population guard: the declaration is read by ANOTHER tool
+  //    (dispatch-gates / check-declared-population-live), so a wrong entry runs
+  //    perfectly green here and shows up only as a dev who was never told this
+  //    gate reads their surface.
+  assert(ROOT_DIR_WATCH_HINTS.every((h) => h.startsWith(ADR_DIR)), 'every watch hint must be under the declared ADR dir');
+  assert(existsSync(ADR_DIR), `the declared population must reach the tree: ${ADR_DIR}`);
+  assert(CORPUS.docRoots.includes(ADR_DIR), 'the corpus must sweep the population this gate declares');
+  assert(
+    ROOT_DIR_WATCH_HINTS.every((h) => CORPUS.docRoots.includes(h.replace(/\/\*+$/, ''))),
+    `the declared hints must name the roots the corpus sweeps: ${ROOT_DIR_WATCH_HINTS.join(', ')} vs ${CORPUS.docRoots.join(', ')}`,
+  );
+
+  // 3. ⭐ The live corpus is not empty. This is the ONLY thing separating a
+  //    clean tree from an extractor that silently matches nothing — the exact
+  //    failure mode that let 243 rotted anchors sit unnoticed.
+  const live = sweepCorpus(CORPUS);
+  assert(live.counts.anchors > 300, `the live ADR corpus must yield its anchors, got ${live.counts.anchors}`);
+  assert(live.counts.symbol > 0, 'the live corpus must contain resolved SYMBOL anchors');
+
+  // 4. The gate is wired to run. A gate nothing invokes is this repo's most
+  //    carded defect class, and renaming a step silently detaches it.
+  const workflow = readFileSync('.github/workflows/lint.yml', 'utf8');
+  assert(workflow.includes('node scripts/check-adr-symbol-anchors.mjs'), 'lint.yml must invoke this gate');
+  assert(workflow.includes('node scripts/check-adr-symbol-anchors.mjs --self-test'), 'lint.yml must invoke this gate\'s --self-test');
+
+  // 5. The census declaration is intact, INCLUDING the one-way error direction
+  //    the ruling ordered recorded (point 5).
+  assert(CENSUS_13556.rotRateIsLowerBound === true, 'the 72.1% figure is a LOWER bound and must be declared as one');
+  assert(CENSUS_13556.totalSurface === CENSUS_13556.distinctLineAnchors + CENSUS_13556.continuationAnchors, 'the declared surface must be the sum of its parts');
+
+  console.log(`✅ check-adr-symbol-anchors --self-test: every finding class provoked, healthy anchors silent, population live, wiring pinned (${live.counts.anchors} live anchors)`);
+}
+
+if (isEntrypoint(import.meta.url)) {
+  if (process.argv.includes('--self-test')) selfTest();
+  else if (process.argv.includes('--list')) list();
+  else runCheck();
+}
diff --git a/scripts/symbol-anchors.mjs b/scripts/symbol-anchors.mjs
new file mode 100644
index 0000000000..ecbcc454fc
--- /dev/null
+++ b/scripts/symbol-anchors.mjs
@@ -0,0 +1,707 @@
+#!/usr/bin/env node
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * symbol-anchors -- the SHARED core behind every "this document points at that
+ * code" gate in this repo.
+ *
+ *   node scripts/symbol-anchors.mjs --self-test
+ *
+ * This module holds the grammar, the extractor and the resolution rule. It
+ * sweeps nothing on its own and knows about no corpus: a corpus is a
+ * `defineCorpus({...})` registration handed to `sweepCorpus`. That split is the
+ * whole point of the file and it is a RULING, not a preference -- see "Why one
+ * resolver" below.
+ *
+ * ## The failure this exists for (#13556)
+ *
+ * `docs/adr/**` cited positions inside source files by LINE NUMBER. A census on
+ * that card enumerated every one of them -- 343 distinct anchors across 35 of
+ * the 134 ADRs, plus 52 continuation anchors, a 395-anchor surface -- and
+ * resolved each against `main`. Excluding 4 HISTORICAL and 2 EXTERNAL anchors,
+ * **243 of 337 were broken: 72.1%**, and that figure is a ONE-WAY LOWER BOUND
+ * (the census's mechanical RESOLVES test was permissive, so true rot is higher,
+ * never lower).
+ *
+ * A rotted line anchor is worse than a missing one. It does not fail -- it
+ * silently points a reader at unrelated code, inside the document whose entire
+ * purpose is to be the durable record of a decision. The census's sharpest
+ * reading is that rot tracks TARGET-FILE CHURN, not ADR age: anchors into files
+ * of 3,000+ lines were 86.4% broken against 62.1% for smaller targets, and the
+ * four hottest targets were 100% broken across 50 anchors. A line number into a
+ * 16,000-line file has an expected lifetime measured in days.
+ *
+ * ⭐ And the rot can hide a SEMANTIC INVERSION. ADR-0113 cited
+ * `sql-driver.ts:4901` for `if (field.required) col.notNullable()`; the
+ * mechanism moved and now keys off `storage.notNull` -- the opposite predicate.
+ * With the anchor rotted, the ADR's pre-decision Context row reads to a fresh
+ * reader as a description of today. That is carded separately as #14193 and is
+ * ⛔ NOT repaired by re-anchoring; re-anchoring only stops the pointer lying
+ * about WHERE the mechanism is.
+ *
+ * ## The ruling this implements (maintainer 2026-09-01, 总监批 #27, on #13556)
+ *
+ * Option **A**, verbatim: 「ADR 行号锚整体迁为**符号锚 + resolver 门禁**(缺符号
+ * 变红)—— 与 #13788 已裁方向同构,**共享同一个 resolver**,⛔ 不造第二套」and
+ * 「**C 不作过渡**(不考虑渐进):243 个已证烂行号在 A 的一次迁移中同笔消失」.
+ *
+ * Two consequences that are load-bearing here:
+ *
+ *   1. **No transition period.** There is no "line anchors are deprecated"
+ *      phase. A surviving `path:NNN` in a governed corpus is a FINDING, not a
+ *      warning -- otherwise the 243 proven-rotted numbers outlive the
+ *      migration that was supposed to delete them.
+ *   2. **One resolver.** #13788 (1,647 platform-checklist source citations) was
+ *      ruled the same shape and is serial behind #13556. It reuses THIS module
+ *      by registering a corpus. ⛔ Do not fork this file for a second corpus;
+ *      if a corpus needs behaviour this core lacks, widen the core.
+ *
+ * ## Why one resolver, mechanically
+ *
+ * The expensive, subtle part of an anchor gate is not the sweep -- it is the
+ * RESOLUTION RULE (below), which decides what counts as a symbol really being
+ * in a file. Two copies of that rule drift, and they drift SILENTLY: each gate
+ * stays green on its own corpus while meaning something different by
+ * "resolves". A second corpus is therefore a registration, and the resolution
+ * rule has exactly one implementation and one self-test.
+ *
+ * ─────────────────────────────────────────────────────────────────────────────
+ * ## THE ANCHOR GRAMMAR (authoritative -- `ANCHOR_GRAMMAR` below is this text)
+ *
+ * An anchor is written inside a markdown code span. Three forms, and no others:
+ *
+ *     `path/to/file.ts#symbolName`     SYMBOL anchor    -- the default
+ *     `path/to/file.ts`                FILE-LEVEL anchor
+ *     `repo:path/to/file.ts#symbol`    CROSS-REPO anchor (e.g. `objectui:...`)
+ *
+ * plus a continuation form, so a sentence naming several symbols in one file
+ * does not repeat the path -- it inherits the path from the anchor before it on
+ * the SAME line:
+ *
+ *     (`packages/objectql/src/engine.ts#registerApp`, `#installPackage`)
+ *
+ * Rules the forms exist to satisfy:
+ *
+ *   (a) MECHANICALLY VERIFIABLE. `#symbol` is checked against the target file's
+ *       declaration sites, so an absent symbol is a loud red.
+ *   (b) SURVIVES LINE CHURN. Nothing in an anchor encodes a position, so an
+ *       unrelated edit above the target cannot rot it. This is the property the
+ *       343-anchor census showed line numbers do not have.
+ *   (c) READS NATURALLY. `#symbol` is the fragment syntax a reader already
+ *       knows from URLs, and it survives copy-paste into a GitHub link.
+ *
+ * ⛔ A LINE NUMBER IS NOT AN ANCHOR FORM. `file.ts:4901`, `file.ts:341-400`,
+ * `file.ts:459–463` (en dash) and a bare continuation `:2933` are all findings.
+ *
+ * ### The one escape hatch, and who may use it
+ *
+ * An anchor that no in-repo resolver could ever check carries an inline marker
+ * immediately after it:
+ *
+ *     `turso-driver.ts:764-776` <!-- anchor-exempt: HISTORICAL -->
+ *
+ * Two classes only:
+ *
+ *   HISTORICAL -- a DATED RECORD, not a live claim: the document is quoting a
+ *                 position as it stood, often to annotate it as deleted or to
+ *                 refute it. Re-anchoring it would falsify the record.
+ *   EXTERNAL   -- the target is in a third-party repository that is not and
+ *                 will not be in this tree (e.g. the Builder.io SDK).
+ *
+ * ⛔ MAINTAINER-ONLY. Adding an exemption is how this gate goes quiet, and it is
+ * the same move as editing a shrink-only ledger: it removes a check rather than
+ * satisfying it. An author whose anchor will not resolve fixes the ANCHOR --
+ * name the real symbol, or drop to a file-level anchor, both of which stay
+ * checked. The exemption list is for the two classes above and nothing else,
+ * and growing it is a maintainer's call, never an author's route to green.
+ *
+ * ─────────────────────────────────────────────────────────────────────────────
+ * ## THE RESOLUTION RULE -- what "the symbol is in that file" means
+ *
+ * The census's caveat is binding and is the reason this is not `includes()`:
+ * **a symbol appearing in unrelated prose is NOT resolution.** The census's own
+ * permissive test is what makes 72.1% a lower bound; this gate does not repeat
+ * that mistake. Comments are stripped from the target before anything is
+ * matched, so a symbol named only in a comment does not resolve.
+ *
+ * A symbol resolves in exactly two ways, and the class is REPORTED, never
+ * silently merged -- callers that want the stricter rule can demand it:
+ *
+ *   `declaration`  A declaration site in the target's own language. For TS/JS:
+ *                  `function`/`class`/`interface`/`type`/`enum`/`namespace`
+ *                  declarations, `const`/`let`/`var` bindings, a member or
+ *                  object-literal key written at the start of a line (`name:`,
+ *                  `'name':`, `name(`, `get name(`, `name =`), and a named
+ *                  re-export (`export { name }`). For markdown, a heading whose
+ *                  text or GitHub slug matches. For JSON/YAML, a key.
+ *
+ *   `literal`      The symbol appears as a COMPLETE quoted string token
+ *                  (`'sys_metadata'`). This class exists because a large part
+ *                  of this platform's vocabulary is DATA identifiers -- object
+ *                  and field API names like `sys_metadata`, `crm_account`,
+ *                  `state_machine` -- which are declared as strings and have no
+ *                  binding site to point at. It is a whole-token match against
+ *                  a string literal, never a substring of running text.
+ *
+ * ⚠️ `literal` is deliberately WEAKER than `declaration` and the migration
+ * prefers `declaration` wherever one exists. What both classes share is the
+ * property the line numbers lacked: they are checked, and they do not move.
+ *
+ * ### What this gate does NOT claim
+ *
+ * It verifies that the anchor POINTS AT SOMETHING REAL. It cannot verify that
+ * the sentence around the anchor is TRUE about that code -- no static check
+ * can. A sentence that is semantically wrong about today's code is a separate
+ * finding and takes its own card (#14193 is the worked example).
+ */
+
+import { execFileSync } from 'node:child_process';
+import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
+import { join, relative, resolve } from 'node:path';
+
+import { isEntrypoint } from './invoked-as.mjs';
+
+/* The grammar, as a string, so a gate can print it in its own failure text
+ * instead of restating it and drifting from this file. */
+/* dispatch-gates: no-path-population -- this module is the shared resolution
+ * core and reads NO population of its own: a corpus supplies its own roots
+ * through `defineCorpus`, and each corpus gate declares them (see
+ * ROOT_DIR_WATCH_HINTS in check-adr-symbol-anchors.mjs). The placeholders in
+ * the grammar below are deliberately NOT path-shaped, so the derivation cannot
+ * read an example as a declaration and then report it as dead. */
+export const ANCHOR_GRAMMAR = [
+  '`<dir>/<file>.ts#<symbol>`    symbol anchor  — `<symbol>` must have a declaration site in that file',
+  '`<dir>/<file>.ts`             file-level anchor — the file must exist',
+  '`objectui:<dir>/<file>.ts`    cross-repo anchor — verified only when a checkout is available',
+  '`…#first`, `#second`          continuation — inherits the path from the anchor before it on the same line',
+  '⛔ `<dir>/<file>.ts:4901`     A LINE NUMBER IS NOT AN ANCHOR FORM.',
+].join('\n  ');
+
+/* Extensions an anchor may name. Deliberately the same list the #13556 census
+ * extracted with, so a token that census counted is a token this gate sees. */
+export const ANCHORABLE_EXTENSIONS = [
+  'ts', 'tsx', 'mts', 'cts', 'js', 'jsx', 'mjs', 'cjs',
+  'sh', 'yaml', 'yml', 'json', 'jsonc', 'md', 'mdx',
+  'sql', 'css', 'scss', 'py', 'rs', 'go', 'toml', 'prisma',
+];
+
+const EXT_ALT = ANCHORABLE_EXTENSIONS.join('|');
+const PATHISH = `[A-Za-z0-9_@.\\-]+(?:/[A-Za-z0-9_@.\\-]+)*\\.(?:${EXT_ALT})`;
+const SYMBOL = `[A-Za-z_$][A-Za-z0-9_$]*`;
+
+/* A code span carrying an anchor. `repo:` prefix is optional and only ever a
+ * bare word, so a Windows-style drive letter or a URL scheme cannot be read as
+ * one by accident. */
+const ANCHOR_SPAN = new RegExp(
+  '`(?:(?<repo>[a-z][a-z0-9-]*):)?(?<path>' + PATHISH + ')(?:#(?<symbol>' + SYMBOL + '))?`',
+  'g',
+);
+/* A continuation: a code span that is ONLY a fragment. */
+const CONTINUATION_SPAN = new RegExp('`#(?<symbol>' + SYMBOL + ')`', 'g');
+
+/* ⛔ The forms the migration deleted. Matched on the SAME text the anchor
+ * extractor sees, so a line number cannot hide behind a spelling the extractor
+ * normalises away. Both the full form and the bare continuation. */
+/* ⭐ A LINE SPEC is not just `:123`, and assuming it was is how a gate
+ * false-greens. The #13556 corpus spells one position NINE ways, and the
+ * census's own extractor missed the comma forms exactly as a naive rule here
+ * would:
+ *
+ *     :4901        :341-400      :459–463 (en dash)     :2214+
+ *     :610,1028    :13,346-389   :29-39,147-152         :2956/2991
+ *
+ * A trailing `+` ("from here on"), a comma list and a slash list are all line
+ * numbers wearing a hat; they rot identically.
+ *
+ * ⛔ And the scan runs over the WHOLE line, with NO code-span logic. An earlier
+ * version matched only a span that was EXACTLY an anchor, and it called a
+ * corpus still carrying rot clean — three ways at once: a bare anchor in
+ * running prose, an anchor sharing a span with other text
+ * (`` `Builder.io SDK: packages/sdks/src/types/builder-block.ts:42` ``), and
+ * that slash list. A line number is rot wherever it is written; the only thing
+ * excluded is a FENCED block, which is quoted material, not an anchor. */
+const LINE_SPEC = '\\d+(?:\\s*[-–—]\\s*\\d+)?(?:\\s*[,/]\\s*\\d+(?:\\s*[-–—]\\s*\\d+)?)*\\+?';
+const LINE_ANCHOR = new RegExp('(?<![\\w/.-])(' + PATHISH + '):(' + LINE_SPEC + ')(?![\\w-])', 'g');
+const LINE_CONTINUATION = new RegExp('`\\s*[:,]\\s*(' + LINE_SPEC + ')`', 'g');
+
+/* `// packages/foo/bar.ts:378` — a comment that is nothing but a path. */
+const FENCED_HEADER = new RegExp('^\\s*(?://|#|\\*|/\\*)\\s*' + PATHISH + ':\\d');
+
+/* ⭐ A ninth spelling, and the census counted none of them: a bare backticked
+ * number, tilde-prefixed — `` ~`326` `` for "about line 326". It carries no
+ * path, so it cannot be resolved to anything; ADR-0056 alone held 13.
+ *
+ * ⚠️ Only the TILDE form is judged. A bare `` `403` `` or `` `4096` `` is an
+ * HTTP status or a byte count far more often than a line, and a gate that
+ * cannot tell them apart would red on prose that is perfectly correct. The
+ * tilde is what makes the reading unambiguous. Residual gap, stated rather
+ * than papered over: an untilded bare number is migrated by hand but NOT
+ * gated. */
+const TILDE_LINE = /~\s*`(\d{2,5})`/g;
+
+const EXEMPT_MARKER = /<!--\s*anchor-exempt:\s*(HISTORICAL|EXTERNAL)\b[^>]*-->/;
+export const EXEMPT_CLASSES = ['HISTORICAL', 'EXTERNAL'];
+
+/* ───────────────────────── target-side: declaration sites ──────────────── */
+
+/* Comments are stripped before ANY match, so "we used to call this `foo`" in a
+ * doc comment never resolves an anchor. Strings are preserved -- the `literal`
+ * class needs them, and a `//` inside a string must not eat the rest of a real
+ * line, so the stripper tracks string state rather than regexing blindly. */
+export function stripCommentsPreservingStrings(source) {
+  let out = '';
+  let i = 0;
+  const n = source.length;
+  let quote = null;
+  while (i < n) {
+    const c = source[i];
+    const d = source[i + 1];
+    if (quote) {
+      out += c;
+      if (c === '\\') { out += d ?? ''; i += 2; continue; }
+      if (c === quote) quote = null;
+      i += 1;
+      continue;
+    }
+    if (c === "'" || c === '"' || c === '`') { quote = c; out += c; i += 1; continue; }
+    if (c === '/' && d === '/') { while (i < n && source[i] !== '\n') i += 1; continue; }
+    if (c === '/' && d === '*') {
+      i += 2;
+      while (i < n && !(source[i] === '*' && source[i + 1] === '/')) { if (source[i] === '\n') out += '\n'; i += 1; }
+      i += 2;
+      continue;
+    }
+    out += c;
+    i += 1;
+  }
+  return out;
+}
+
+const escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+
+/* GitHub's heading slug, matching the rule `check-doc-anchors` already uses on
+ * `content/docs`: lowercase, strip anything but word chars/space/hyphen, spaces
+ * to hyphens. Kept local rather than pulling in the slugger, because the only
+ * job here is a comparison and a dependency would make this core heavier for
+ * every corpus that anchors no markdown at all. */
+function slug(text) {
+  return text.trim().toLowerCase().replace(/[^\w\s-]/g, '').replace(/\s+/g, '-');
+}
+
+function markdownSymbolClass(source, symbol) {
+  const want = symbol.toLowerCase();
+  const wantSlug = slug(symbol);
+  for (const line of source.split('\n')) {
+    const m = /^\s{0,3}#{1,6}\s+(.*?)\s*#*\s*$/.exec(line);
+    if (!m) continue;
+    const text = m[1].replace(/`/g, '');
+    if (text.toLowerCase() === want || slug(text) === wantSlug) return 'declaration';
+  }
+  return null;
+}
+
+function keyedSymbolClass(source, symbol) {
+  const n = escapeRe(symbol);
+  /* A key may open a line (YAML, pretty JSON) or follow `{` / `,` / `[` on one
+   * (minified or single-line JSON), so both positions are admitted -- and
+   * nothing else is, which is what keeps a VALUE of the same spelling out. */
+  const key = new RegExp(`(?:^|[{,\\[])\\s*(?:-\\s*)?["']?${n}["']?\\s*:`, 'm');
+  return key.test(source) ? 'declaration' : null;
+}
+
+function scriptSymbolClass(source, symbol) {
+  const code = stripCommentsPreservingStrings(source);
+  const n = escapeRe(symbol);
+  const declarations = [
+    // function / class / interface / type / enum / namespace / module
+    new RegExp(`\\b(?:export\\s+)?(?:default\\s+)?(?:declare\\s+)?(?:abstract\\s+)?(?:async\\s+)?(?:function\\s*\\*?|class|interface|type|enum|namespace|module)\\s+${n}\\b`),
+    // value binding
+    new RegExp(`\\b(?:export\\s+)?(?:declare\\s+)?(?:const|let|var)\\s+${n}\\b`),
+    // a member or object-literal key written at the start of a line
+    new RegExp(`^[ \\t]*(?:readonly |static |public |private |protected |abstract |declare |async |\\* )*(?:get |set )?(?:${n}|'${n}'|"${n}"|\\[${n}\\]|\\['${n}'\\]|\\["${n}"\\])\\s*[?!]?\\s*[:(<=]`, 'm'),
+    // named re-export
+    new RegExp(`\\bexport\\s*\\{[^}]*\\b${n}\\b[^}]*\\}`),
+    // destructured binding
+    new RegExp(`\\b(?:const|let|var)\\s*\\{[^}]*\\b${n}\\b[^}]*\\}\\s*=`),
+  ];
+  if (declarations.some((re) => re.test(code))) return 'declaration';
+  // whole-token quoted string -- the DATA-identifier class
+  if (new RegExp(`(['"\`])${n}\\1`).test(code)) return 'literal';
+  return null;
+}
+
+/**
+ * How (and whether) `symbol` resolves inside `source`.
+ * Returns 'declaration' | 'literal' | null. The class is never merged away:
+ * `literal` is weaker and the caller is told so.
+ */
+export function symbolResolutionClass(source, filePath, symbol) {
+  const ext = (filePath.split('.').pop() || '').toLowerCase();
+  if (ext === 'md' || ext === 'mdx') return markdownSymbolClass(source, symbol);
+  if (ext === 'json' || ext === 'jsonc' || ext === 'yml' || ext === 'yaml' || ext === 'toml') {
+    return keyedSymbolClass(source, symbol);
+  }
+  return scriptSymbolClass(source, symbol);
+}
+
+/* ───────────────────────── document-side: extraction ───────────────────── */
+
+/**
+ * Every anchor and every surviving line anchor in one document.
+ * `line` is 1-based, so a finding can be clicked.
+ */
+export function extractAnchors(markdown) {
+  const anchors = [];
+  const lineAnchors = [];
+  const lines = markdown.split('\n');
+  let inFence = false;
+  lines.forEach((text, idx) => {
+    if (/^\s*(```|~~~)/.test(text)) { inFence = !inFence; return; }
+    const lineNo = idx + 1;
+    /* Inside a fence, only a COMMENT HEADER naming a repo path is an anchor.
+     * The corpus introduces a quoted snippet with `// packages/…/x.ts:378`,
+     * and the census counted those among its 343 — so skipping fences wholesale
+     * would leave five rotted anchors behind. Everything else in a fence is
+     * quoted material (sample code, CI output) and is NOT judged: an example
+     * that happens to contain `foo.ts:12` is not an anchor. */
+    if (inFence) {
+      if (!FENCED_HEADER.test(text)) return;
+      for (const m of text.matchAll(LINE_ANCHOR)) {
+        lineAnchors.push({ line: lineNo, index: m.index, raw: m[0], path: m[1], cited: parseInt(m[2], 10), exempt: null, fencedHeader: true });
+      }
+      return;
+    }
+    const exemptAt = [];
+    for (const m of text.matchAll(/<!--\s*anchor-exempt:[^>]*-->/g)) {
+      const cls = EXEMPT_MARKER.exec(m[0]);
+      exemptAt.push({ index: m.index, class: cls ? cls[1] : null, raw: m[0] });
+    }
+    /* An exemption governs the anchor it FOLLOWS -- the nearest one to its
+     * left on the same line. That keeps the marker adjacent to what it excuses
+     * and stops one marker from quietly covering a whole paragraph. */
+    /* Takes the END of the anchor match. Between the anchor and its marker
+     * there may be the closing backtick of the span the anchor sits in, and
+     * nothing more: one backtick is the span this anchor is inside, a second
+     * means another code span intervenes and the marker belongs to THAT one.
+     * This is what "immediately after" means, and it is why a marker cannot
+     * reach across a neighbouring anchor to excuse it too. */
+    const exemptionFor = (endIndex) => {
+      let best = null;
+      for (const e of exemptAt) {
+        if (e.index >= endIndex && (best === null || e.index < best.index)) {
+          const between = text.slice(endIndex, e.index);
+          if ((between.match(/`/g) ?? []).length <= 1) best = e;
+        }
+      }
+      return best;
+    };
+    let lastPath = null;
+    for (const m of text.matchAll(ANCHOR_SPAN)) {
+      const { repo, path, symbol } = m.groups;
+      lastPath = path;
+      anchors.push({ line: lineNo, index: m.index, raw: m[0], repo: repo ?? null, path, symbol: symbol ?? null, continuation: false });
+    }
+    for (const m of text.matchAll(CONTINUATION_SPAN)) {
+      const before = text.slice(0, m.index);
+      const prior = [...before.matchAll(ANCHOR_SPAN)].pop();
+      if (!prior) continue;
+      anchors.push({
+        line: lineNo, index: m.index, raw: m[0],
+        repo: prior.groups.repo ?? null, path: prior.groups.path,
+        symbol: m.groups.symbol, continuation: true,
+      });
+    }
+    for (const m of text.matchAll(LINE_ANCHOR)) {
+      const ex = exemptionFor(m.index + m[0].length);
+      lineAnchors.push({ line: lineNo, index: m.index, raw: m[0], path: m[1], cited: parseInt(m[2], 10), exempt: ex?.class ?? null, exemptRaw: ex?.raw ?? null });
+    }
+    for (const m of text.matchAll(TILDE_LINE)) {
+      const ex = exemptionFor(m.index + m[0].length);
+      lineAnchors.push({ line: lineNo, index: m.index, raw: m[0], path: lastPath, cited: parseInt(m[1], 10), exempt: ex?.class ?? null, exemptRaw: ex?.raw ?? null, tilde: true });
+    }
+    for (const m of text.matchAll(LINE_CONTINUATION)) {
+      const ex = exemptionFor(m.index + m[0].length);
+      lineAnchors.push({ line: lineNo, index: m.index, raw: m[0], path: lastPath, cited: parseInt(m[1], 10), exempt: ex?.class ?? null, exemptRaw: ex?.raw ?? null, continuation: true });
+    }
+  });
+  return { anchors, lineAnchors };
+}
+
+/* ───────────────────────── corpus registration ─────────────────────────── */
+
+/**
+ * Register a corpus. THIS is how a second body of documents joins the gate --
+ * #13788's platform-checklist citations are a `defineCorpus` call and no new
+ * resolver. Everything corpus-specific is data here; everything mechanical
+ * lives above and is shared.
+ */
+export function defineCorpus(spec) {
+  const { id, label, docRoots, docPattern = /\.mdx?$/, crossRepos = {}, checkBarePaths = false } = spec;
+  if (!id || !label) throw new Error('defineCorpus: `id` and `label` are required');
+  if (!Array.isArray(docRoots) || docRoots.length === 0) throw new Error('defineCorpus: `docRoots` must be a non-empty array');
+  return { id, label, docRoots, docPattern, crossRepos, checkBarePaths };
+}
+
+function walk(dir, pattern, out = []) {
+  if (!existsSync(dir)) return out;
+  for (const entry of readdirSync(dir)) {
+    const full = join(dir, entry);
+    if (statSync(full).isDirectory()) walk(full, pattern, out);
+    else if (pattern.test(entry)) out.push(full);
+  }
+  return out;
+}
+
+/* ⚠️ KEYED BY ROOT. An earlier version cached one global set, and the effect
+ * was not a slow gate but a WRONG one: a self-test that sweeps a synthetic
+ * fixture first poisoned the cache, so the following sweep of the real repo saw
+ * the fixture's four files and reported the entire live corpus unresolvable.
+ * Any caller sweeping two roots in one process hits the same thing. */
+const trackedCache = new Map();
+function trackedFiles(root) {
+  const key = resolve(root);
+  if (!trackedCache.has(key)) {
+    const out = execFileSync('git', ['ls-files'], { cwd: key, encoding: 'utf8', maxBuffer: 1 << 28 });
+    trackedCache.set(key, new Set(out.split('\n').filter(Boolean)));
+  }
+  return trackedCache.get(key);
+}
+
+/**
+ * Sweep one corpus. Returns findings and the counts a report needs.
+ *
+ * Finding kinds:
+ *   line-anchor        a `path:NNN` survived the migration                (RED)
+ *   unresolved-path    an anchor names a file that is not in the tree     (RED)
+ *   unresolved-symbol  the file is there, the symbol is not               (RED)
+ *   bad-exemption      an exemption marker names no valid class           (RED)
+ *   cross-repo-skipped no checkout for that repo -- reported, never red
+ */
+export function sweepCorpus(corpus, root = process.cwd()) {
+  const tracked = trackedFiles(root);
+  const findings = [];
+  const counts = { docs: 0, anchors: 0, symbol: 0, fileLevel: 0, declaration: 0, literal: 0, crossRepo: 0, exempt: 0, continuation: 0 };
+  const sourceCache = new Map();
+  const readTarget = (p) => {
+    if (!sourceCache.has(p)) sourceCache.set(p, readFileSync(join(root, p), 'utf8'));
+    return sourceCache.get(p);
+  };
+
+  const docs = corpus.docRoots.flatMap((r) => walk(join(root, r), corpus.docPattern)).sort();
+  for (const abs of docs) {
+    const rel = relative(root, abs);
+    counts.docs += 1;
+    const { anchors, lineAnchors } = extractAnchors(readFileSync(abs, 'utf8'));
+
+    for (const la of lineAnchors) {
+      if (la.exempt && EXEMPT_CLASSES.includes(la.exempt)) { counts.exempt += 1; continue; }
+      /* A marker whose CLASS is unrecognised is its own finding, never a
+       * silent pass and never an ordinary line anchor: a typo in the class
+       * must not be a quiet way to switch this gate off, and it must not be
+       * mistaken for someone who simply never excused the anchor. */
+      findings.push({
+        kind: la.exemptRaw ? 'bad-exemption' : 'line-anchor',
+        doc: rel, line: la.line, raw: la.raw,
+        detail: la.exemptRaw
+          ? `\`${la.exemptRaw}\` names no valid exemption class — expected one of ${EXEMPT_CLASSES.join(' / ')}`
+          : `a line number is not an anchor form — cite the symbol (\`${la.path ?? 'path'}#symbol\`) or drop to a file-level anchor`,
+      });
+    }
+
+    for (const a of anchors) {
+      counts.anchors += 1;
+      if (a.continuation) counts.continuation += 1;
+      if (a.repo) {
+        counts.crossRepo += 1;
+        const checkout = corpus.crossRepos[a.repo];
+        const base = checkout && process.env[checkout.checkoutEnv];
+        if (!base || !existsSync(join(base, a.path))) {
+          findings.push({
+            kind: 'cross-repo-skipped', doc: rel, line: a.line, raw: a.raw, soft: true,
+            detail: `cross-repo target in \`${a.repo}\` — no checkout available (set $${checkout?.checkoutEnv ?? 'CHECKOUT'}), so it is reported, not judged`,
+          });
+          continue;
+        }
+        const src = readFileSync(join(base, a.path), 'utf8');
+        if (a.symbol && !symbolResolutionClass(src, a.path, a.symbol)) {
+          findings.push({ kind: 'unresolved-symbol', doc: rel, line: a.line, raw: a.raw, detail: `\`${a.symbol}\` has no declaration site in ${a.repo}:${a.path}` });
+        }
+        continue;
+      }
+      if (!a.symbol) {
+        /* A BARE path code span. In a prose corpus this is indistinguishable
+         * from an ordinary mention of a file, so whether it is judged is the
+         * corpus's call, not this core's.
+         *
+         * ⚠️ `docs/adr/**` sets this OFF, and the reason is measured rather
+         * than assumed: judging every bare path there produces 1,056 findings
+         * across all 134 records — 616 distinct paths — of which only a
+         * handful are anchors. They are abbreviated spellings
+         * (`objectql/src/protocol.ts`), sibling-repo paths, and files that
+         * moved years ago: a real defect class, but NOT the line-anchor rot
+         * #13556 measured, and folding it in would bury this gate's signal
+         * under a corpus-wide cleanup nobody ruled on. It is recorded as a
+         * follow-up finding instead. A corpus whose citations are uniform
+         * (#13788's checklist rows) can switch this on and get the check. */
+        counts.fileLevel += 1;
+        if (corpus.checkBarePaths && !tracked.has(a.path)) {
+          findings.push({ kind: 'unresolved-path', doc: rel, line: a.line, raw: a.raw, detail: `no tracked file at \`${a.path}\`` });
+        }
+        continue;
+      }
+      if (!tracked.has(a.path)) {
+        findings.push({ kind: 'unresolved-path', doc: rel, line: a.line, raw: a.raw, detail: `no tracked file at \`${a.path}\` (named by anchor \`#${a.symbol}\`)` });
+        continue;
+      }
+      counts.symbol += 1;
+      const cls = symbolResolutionClass(readTarget(a.path), a.path, a.symbol);
+      if (!cls) {
+        findings.push({
+          kind: 'unresolved-symbol', doc: rel, line: a.line, raw: a.raw,
+          detail: `\`${a.symbol}\` has no declaration site or string-literal token in \`${a.path}\``,
+        });
+        continue;
+      }
+      counts[cls] += 1;
+    }
+  }
+  return { findings, counts };
+}
+
+export function formatFindings(findings) {
+  return findings.map((f) => `  [${f.kind}] ${f.doc}:${f.line}  ${f.raw}\n      ${f.detail}`).join('\n');
+}
+
+/* ───────────────────────────────── self-test ───────────────────────────── */
+
+function assert(cond, msg) { if (!cond) { console.error(`❌ symbol-anchors --self-test: ${msg}`); process.exit(1); } }
+
+export function selfTest() {
+  // 1. Declaration sites, one per supported spelling. Each is provoked in BOTH
+  //    directions -- a rule that only ever says "found" is not a rule.
+  const ts = [
+    'export function registerApp(m) {}',
+    'export class SqlDriver {}',
+    'interface Shape { width: number }',
+    'export type Verdict = "a" | "b";',
+    'enum Posture { Open }',
+    'const RESERVED_NAMESPACES = new Set();',
+    'export { helperName };',
+    'const { destructured } = thing;',
+    'const schema = {',
+    '  stateMachines: z.array(x),',
+    "  'quoted_key': 1,",
+    '  methodShorthand(a) { return a; },',
+    '  get accessorName() { return 1; },',
+    '};',
+    'const names = ["sys_metadata"];',
+  ].join('\n');
+  for (const name of ['registerApp', 'SqlDriver', 'Shape', 'Verdict', 'Posture', 'RESERVED_NAMESPACES',
+    'helperName', 'destructured', 'stateMachines', 'quoted_key', 'methodShorthand', 'accessorName']) {
+    assert(symbolResolutionClass(ts, 'x.ts', name) === 'declaration', `"${name}" should resolve as a declaration`);
+  }
+  assert(symbolResolutionClass(ts, 'x.ts', 'sys_metadata') === 'literal', 'a quoted data identifier resolves as `literal`, not `declaration`');
+  assert(symbolResolutionClass(ts, 'x.ts', 'notPresentAnywhere') === null, 'an absent symbol must NOT resolve');
+
+  // 2. ⭐ The census caveat, enforced: prose is not resolution. A symbol named
+  //    only in a comment is exactly the false green that made 72.1% a LOWER
+  //    bound, so it is provoked directly.
+  const commented = '// registerApp is described here but not defined\nconst other = 1;\n';
+  assert(symbolResolutionClass(commented, 'x.ts', 'registerApp') === null, 'a symbol named only in a comment must NOT resolve');
+  const blockCommented = '/* interface Shape { } */\nconst other = 1;\n';
+  assert(symbolResolutionClass(blockCommented, 'x.ts', 'Shape') === null, 'a declaration inside a block comment must NOT resolve');
+  // ...and the stripper must not be fooled by a `//` living inside a string.
+  const slashInString = 'const url = "https://example.com";\nexport function afterTheString() {}\n';
+  assert(symbolResolutionClass(slashInString, 'x.ts', 'afterTheString') === 'declaration', '`//` inside a string must not eat the rest of the file');
+
+  // 3. Substring is not resolution -- the other half of the same caveat.
+  assert(symbolResolutionClass('const registerApplication = 1;', 'x.ts', 'registerApp') === null, 'a symbol must not resolve as a substring of a longer identifier');
+  assert(symbolResolutionClass('const names = ["sys_metadata_extra"];', 'x.ts', 'sys_metadata') === null, 'the `literal` class is a WHOLE-token match');
+
+  // 4. Markdown headings and keyed formats.
+  assert(symbolResolutionClass('## Overlay whitelist\n', 'a.md', 'Overlay whitelist') === 'declaration', 'a markdown heading resolves by text');
+  assert(symbolResolutionClass('## Overlay whitelist\n', 'a.md', 'overlay-whitelist') === 'declaration', 'a markdown heading resolves by slug');
+  assert(symbolResolutionClass('## Something else\n', 'a.md', 'overlay-whitelist') === null, 'an absent heading must NOT resolve');
+  assert(symbolResolutionClass('{ "compilerOptions": { } }', 'a.json', 'compilerOptions') === 'declaration', 'a JSON key resolves');
+  assert(symbolResolutionClass('{ "other": 1 }', 'a.json', 'compilerOptions') === null, 'an absent JSON key must NOT resolve');
+
+  // 5. Extraction: every grammar form, and every ⛔ line-number spelling the
+  //    census found in the corpus (plain, hyphen range, EN DASH range, and a
+  //    bare continuation).
+  const doc = [
+    'Prose with `packages/objectql/src/engine.ts#registerApp` and `#installPackage`.',
+    'A file-level anchor `packages/spec/src/data/object.zod.ts` stands alone.',
+    'Cross-repo `objectui:packages/types/src/layout.ts#BaseSchema`.',
+    'Rotted `packages/drivers/driver-sql/src/sql-driver.ts:4901` here.',
+    'Range `packages/spec/src/kernel/manifest.zod.ts:28-76` and `docs/adr/0048-x.md:459–463`.',
+    'Continuation `packages/objectql/src/engine.ts:2920`, `:2933`.',
+    'Comma list `packages/objectql/src/registry.ts:13,346-389` and `packages/spec/src/api/errors.zod.ts:29-39,147-152`.',
+    'Open-ended `packages/drivers/driver-sql/src/sql-driver.ts:2214+` and its continuation `:595+`.',
+    'Bare in prose packages/plugins/plugin-audit/src/audit-plugin.ts:40 with no backticks at all.',
+    'Slash list `packages/objectql/src/engine.ts:2956/2991` and a shared span `Builder.io SDK: packages/sdks/src/types/builder-block.ts:42`.',
+    'Tilde form `packages/plugins/plugin-security/src/security-plugin.ts` ~`326` names a line with no path of its own.',
+    'Exempt `packages/drivers/driver-turso/src/turso-driver.ts:764-776` <!-- anchor-exempt: HISTORICAL -->.',
+    '```ts',
+    '// packages/objectql/src/validation/rule-validator.ts:378',
+    'a fenced `file.ts:12` must be invisible',
+    '```',
+  ].join('\n');
+  const { anchors, lineAnchors } = extractAnchors(doc);
+  const sym = anchors.filter((a) => a.symbol);
+  assert(sym.length === 3, `expected 3 symbol anchors, got ${sym.length}`);
+  assert(anchors.some((a) => a.continuation && a.symbol === 'installPackage' && a.path.endsWith('engine.ts')), 'a continuation must inherit the preceding path');
+  assert(anchors.some((a) => a.repo === 'objectui' && a.symbol === 'BaseSchema'), 'a cross-repo anchor keeps its repo');
+  assert(anchors.some((a) => !a.symbol && a.path.endsWith('object.zod.ts')), 'a file-level anchor is an anchor');
+  const live = lineAnchors.filter((l) => !l.exempt);
+  /* ⭐ EVERY spelling in the corpus, by name. The comma and `+` forms are here
+   * because the #13556 census's own extractor missed them, and a gate that
+   * inherits that blind spot reports a rotted corpus as clean. */
+  const rawOf = (needle) => live.filter((l) => l.raw.includes(needle));
+  assert(rawOf(':4901').length === 1, 'a plain line anchor must be found');
+  assert(rawOf(':28-76').length === 1, 'a hyphen range must be found');
+  assert(rawOf('459–463').length === 1, 'an EN DASH range must be found');
+  assert(rawOf(':2920').length === 1, 'a continuation parent must be found');
+  assert(rawOf(':2933').length === 1, 'a bare continuation must be found');
+  assert(rawOf(':13,346-389').length === 1, 'a COMMA list must be found');
+  assert(rawOf(':29-39,147-152').length === 1, 'a comma list of RANGES must be found');
+  assert(rawOf(':2214+').length === 1, 'an open-ended `+` anchor must be found');
+  assert(rawOf(':595+').length === 1, 'an open-ended `+` continuation must be found');
+  assert(rawOf('audit-plugin.ts:40').length === 1, 'a BARE, un-spanned line anchor in prose must be found');
+  assert(rawOf(':2956/2991').length === 1, 'a SLASH list must be found');
+  assert(rawOf('builder-block.ts:42').length === 1, 'an anchor SHARING a code span with other text must be found');
+  assert(rawOf('~`326`').length === 1, 'the TILDE bare-number form must be found');
+  assert(extractAnchors('a status `403` and a size `4096` on a `packages/x/y.ts#sym` line').lineAnchors.length === 0,
+    'an UNTILDED bare number must NOT be read as a line anchor — it is an HTTP status or a byte count far more often than a line');
+  assert(live.length === 14, `expected 14 live line anchors across every spelling, got ${live.length}: ${live.map((l) => l.raw).join(' ')}`);
+  assert(lineAnchors.some((l) => l.exempt === 'HISTORICAL'), 'the exemption marker must be read');
+  assert(!lineAnchors.some((l) => l.raw.includes('file.ts:12')), 'ordinary fenced content must stay invisible to the extractor');
+  assert(rawOf('rule-validator.ts:378').length === 1, 'a fenced COMMENT HEADER naming a path IS an anchor and must be found');
+
+  // 6. An exemption governs the anchor it FOLLOWS and does not spill leftwards
+  //    onto an earlier, unexcused one.
+  const spill = 'First `a/b.ts:10` then `c/d.ts:20` <!-- anchor-exempt: HISTORICAL -->';
+  const spilled = extractAnchors(spill).lineAnchors;
+  assert(spilled.find((l) => l.raw.includes('a/b.ts'))?.exempt === null, 'an exemption must not cover an earlier anchor');
+  assert(spilled.find((l) => l.raw.includes('c/d.ts'))?.exempt === 'HISTORICAL', 'an exemption must cover the anchor it follows');
+
+  // 7. An invalid exemption class is a finding, not a silent pass -- otherwise
+  //    a typo is a way to switch the gate off.
+  const bogus = extractAnchors('`a/b.ts:10` <!-- anchor-exempt: BECAUSE-I-SAID-SO -->').lineAnchors;
+  assert(bogus[0].exempt === null, 'an unrecognised exemption class must not be honoured');
+  assert(bogus[0].exemptRaw !== null, 'an unrecognised exemption must still be CARRIED, so it reports as a bad exemption rather than as a plain line anchor');
+
+  // 8. defineCorpus refuses a corpus that would sweep nothing.
+  let threw = false;
+  try { defineCorpus({ id: 'x', label: 'x', docRoots: [] }); } catch { threw = true; }
+  assert(threw, 'defineCorpus must refuse an empty docRoots');
+
+  console.log('✅ symbol-anchors --self-test: grammar, both resolution classes, comment/substring rejection, every ⛔ line-number spelling, exemption scoping and corpus registration verified');
+}
+
+if (isEntrypoint(import.meta.url)) {
+  if (process.argv.includes('--self-test')) selfTest();
+  else {
+    console.log('symbol-anchors is a library. Anchor grammar:\n  ' + ANCHOR_GRAMMAR);
+    console.log('\nRun a corpus gate (e.g. `node scripts/check-adr-symbol-anchors.mjs`) or `--self-test`.');
+  }
+}

From 1a6cb8e2e428a36581b4ee435ed8726541f76e6e Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Tue, 1 Sep 2026 20:59:44 +0000
Subject: [PATCH 2/2] ci(lint): keep the ADR symbol-anchor sweep out of its
 collector block
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`check-step-collectors --self-test` was red on this branch:

    • lint.yml "ADR symbol anchors resolve (no line numbers survive)":
      all green => every command runs (3/2)

The counts are (executed / collected), so three ran where two were collected —
not the reverse. That gate drives the real `run:` block under `bash -e` with a
STUB planted at each collected command's SCRIPT PATH, then holds "all green =>
every command runs" as an equality. The step ended with a bare
`node scripts/check-adr-symbol-anchors.mjs` after the collector's exit guard,
which re-invokes the very stub planted for that script's `--self-test` entry —
a third execution against two collected commands.

Split into two steps: the collector carries the two self-tests and nothing
else, and the production sweep is its own step. That is also the shape both
existing collectors in this file already have, and it restores the property
the split was for — the sweep now runs on its own footing instead of behind
the self-tests' `exit 1`.

⛔ No scope change: `docs/adr/**`, the resolver and its corpus registration are
untouched. Both invocations the gate's own `--self-test` pins in lint.yml are
still present, so the wiring assertion still holds.

Refs #13556

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Mszp61SetNhQfVGvWh9bNn
---
 .github/workflows/lint.yml | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index ba5645eb35..ba7a9d798a 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -2181,7 +2181,17 @@ jobs:
       # chained second self-test is neither green nor red — it never runs
       # (#10814). The collector runs both unconditionally and fails at the end
       # naming every one that broke.
-      - name: ADR symbol anchors resolve (no line numbers survive)
+      #
+      # ⛔ AND THE PRODUCTION SWEEP IS A SEPARATE STEP, which is not cosmetic.
+      # `check-step-collectors` drives this very block under a real `bash -e`
+      # with a STUB planted at each collected command's script path, and holds
+      # "all green => every command runs" as an equality. A trailing
+      # `node scripts/check-adr-symbol-anchors.mjs` in the same block re-invokes
+      # that same stub, so the harness counts 3 executions against 2 collected
+      # commands and the gate reds (3/2) — which is exactly what it did here.
+      # Both existing collectors in this file carry self-tests ONLY, for the
+      # same reason. Keep the sweep out of the collector block.
+      - name: ADR symbol-anchor gate self-tests
         run: |
           failed=""
           run_self_test() {
@@ -2202,7 +2212,9 @@ jobs:
             printf "%s" "$failed"
             exit 1
           fi
-          node scripts/check-adr-symbol-anchors.mjs
+
+      - name: ADR symbol anchors resolve (no line numbers survive)
+        run: node scripts/check-adr-symbol-anchors.mjs
 
       # NOTE: the standing platform test checklist (docs/qa/platform-checklist/)
       # is validated by `pnpm check:platform-checklist`, but by MAINTAINER