fix(lint): teach describe() the live-elsewhere verdict instead of throwing

[os-musk]

Fixes#14057

describe() in packages/lint/src/lint-liveness-properties.ts maps ledger verdicts to author-facing findings, and throws — deliberately, per its own boundary comment — on a status it has not been taught. #13483 then shipped the ledger's fifth status, live-elsewhere (dead HERE by measurement, genuinely enforced in a sibling repo), and migrated manifest.runtime onto it. describe() was never taught it. The day any live-elsewhere row opts into authorWarn: true, os lint raises a shipped-ledger-integrity error instead of the advisory warning the author should have received.

It must never be the dead branch

This is the load-bearing constraint on the repair, and it is why the fix is a new branch rather than a widened one. Per the #11384 lesson, the verdicts imply opposite author actions, so telling an author to "Remove it" about a key whose enforcement is real and remote is exactly the wrong sentence: for manifest.runtime the enforcer is the cloud marketplace publish gate, where an unverified publisher requesting the node tier is hard-rejected, so deleting the key would tear out a live gate's input. live-elsewhere therefore gets its own rule id, its own message, and a default hint that keeps the property and points at the ledger row's evidence for the enforcer.

What changed

• A fourth branch in describe(), placed against the dead branch it must never be, with a comment saying why the adjacency is deliberate: the two verdicts are one measurement apart and opposite in what they ask of the author.
• LIVENESS_LIVE_ELSEWHERE_PROPERTY = 'liveness-live-elsewhere-property', exported beside its three siblings and re-exported from src/index.ts. Advisory-only, like them; nothing downstream keys off these ids today (measured: the only non-CHANGELOG consumers of any liveness rule id are src/index.ts, this package's tests, and one CLI test; there is no rule catalogue and no docs page listing them).
• The sentinel throw stays for genuinely unknown statuses, with its enumeration of the known ones updated — and a test pins the enumeration equal to the branches, since a stale list is how the next status gets misread.
• Two stale statements in the file's own comments corrected: it described the vocabulary as four members and quoted check-liveness.mts's header as Statuses: live | experimental | planned | dead. That header now reads live | experimental | planned | dead | live-elsewhere.

Reachability, measured

Still a fuse, not a fire. An entry reaches describe() only after shouldWarn() says yes (authorWarn: true, or status === 'experimental'), and the shipped manifest.runtime row carries no authorWarn. A negative control on the real ledger pins that, with an anti-vacuity guard: the coverage walk must SEE a live-elsewhere row (the one row carrying that status lives in manifest.json, so seeing the status proves the file was read) while authorWarnedProperties('manifest') must not contain runtime. If that row ever opts in, the pin goes red and the reviewer updates the pin — the new branch is what makes that flip safe.

Coverage, derived rather than hand-listed

The triage asked for a check that describe() covers every verdict, because patching one status leaves the next to repeat this card. Hand-listing the vocabulary in a test would go stale for exactly the reason describe() did — nobody edits the list they did not know existed — so the pin walks the shipped ledger rows (shippedLedgerStatuses(), a package-internal seam in the same posture as the existing #10262 seam: exported from the module only, re-exported by neither src/index.ts nor the package's exports map) and requires every distinct status it finds to be answered by describe() with a rule id of its own, plus asserts no two verdicts share a rule id. The vocabulary is prose in a comment, not an importable enum, so rows are the only machine-readable statement of it in this package's reach; a status with zero rows cannot reach describe() anyway, and the moment one appears, the pin names it.

live is the one member that deliberately gets no branch, and the source header already ruled it out in a sentence this PR keeps and now pins: an entry marked authorWarn: true on a live row "would be a ledger authoring mistake, not a user error". A mistake in our own shipped data is what the sentinel is for, so the pin asserts live stays loud rather than handled — matching the case the suite already carried.

Measured vocabulary: five members at packages/spec/scripts/liveness/check-liveness.mts:36 and in packages/spec/liveness/README.md. The inconclusive mentioned in triage is not a ledger status — zero hits across packages/spec/; it belongs to the skill-side vocabulary of the sibling card, which is out of scope here.

Changeset

'@objectstack/lint': minor, in .changeset/lint-liveness-live-elsewhere-rule-id.md. LIVENESS_LIVE_ELSEWHERE_PROPERTY is a new export on packages/lint/src/index.ts, the public entry, and a new public-entry export is minor under the precedent this lane applied today — #14606 took @objectstack/types: minor for three new exports. Nothing narrows, so no BREAKING banner and no ADR-0087 marker is owed; the behaviour change is an internal integrity error becoming the advisory finding it should always have been.

An earlier revision of this PR got two things wrong here and both are fixed. It declared patch, arguing from the planned verdict's own changeset; and it wrote its note to .changeset/liveness-live-elsewhere-verdict.md, a filename derived from the verdict — which is #13483's existing file on origin/main, declaring the pending @objectstack/spec: patch bump and describing the fifth verdict's gate-executable criteria and the 180-day re-attestation discipline. Writing there truncated it. That file is restored byte for byte (blob 5321f1b09, git diff origin/main on the path empty, and the re-derived three-dot change set no longer mentions it at all), and this package's note lives under its own non-colliding name.

Verification, at 168c1d7fa for the code, re-confirmed at 6d75c6462

The head moved only by the two changeset files above; the re-derived gate family is byte-identical between the two heads, so the union below carries over.

• pnpm --filter @objectstack/lint typecheck and the full package suite: 93 files, 2821 passed, 5 skipped. The new tests are genuinely in the typecheck population — tsconfig.test.json --listFiles lists lint-liveness-properties.test.ts.
• Reverse verification (ablation). Reverting only the new branch, tests untouched, turns three of the new cases red with the sentinel firing on live-elsewhere — the card's defect, reproduced: 3 failed | 65 passed. Restored: blob equality with HEAD, git diff HEAD empty, git status --porcelain empty, 68 passed. The mutation was confirmed on disk before the run (removed text 0 hits, injected marker 1 hit, blob hash changed), and the subject is a package-relative source import, so no dist indirection is in the path.
• Gate union re-derived on this tree with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (34 commands): 30 green. pnpm lint (whole repo), pnpm check:nul-bytes and pnpm check:error-status-conformance also green. On the new head, check-empty-changeset ("1 declaring changeset(s) added"), check-changeset-no-major and check-adr-0087-registration were re-run: all exit 0.
• Four gates answered exit 3 — NOT MEASURED in their own words, not green and not red: check-test-completeness, pm/check-half-states, check:dual-build-cjs-loads ("PREREQUISITE NOT MET ... this is NOT a pass: nothing was measured") and check:type-check-debt. The latter two read built output for every package; CI builds that closure before running them.
• check:doc-authoring caught a real defect in the first draft: the new tracker id sat inside the sentinel's runtime string, which reaches authors and generated surfaces that cannot resolve it. Moved to the adjacent // comment; the gate is green.

Scope

packages/spec/liveness/** and its scripts were read, never changed. The skills-lane sibling card is untouched.

🤖 Generated with Claude Code

https://claude.ai/code/session_0112hMx9hjJ9BgB28X97DS68

[github-actions]

📓 Docs Drift Check

2 anchor(s) derived from 1 changed package(s); no hand-written page names any of them. ⚠️1 changed file(s) yielded no anchor (packages/lint/src/index.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

What this run could not see

• 1 changed file(s) yielded no anchor (packages/lint/src/index.ts) — pages documenting those are invisible to this run
• 1 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 5 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 937ec142d5bb6e3f112dae2530842b1292be1cd4 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 913f571e75fbda67f34777d7051aeaa695dca7df — the merge of head 6d75c646275cbb88c980bbd3c4d06799fe68b17f into base 937ec142d5bb6e3f112dae2530842b1292be1cd4, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 913f571e75fbda67f34777d7051aeaa695dca7df && git checkout 913f571e75fbda67f34777d7051aeaa695dca7df
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 937ec142d5bb6e3f112dae2530842b1292be1cd4 6d75c646275cbb88c980bbd3c4d06799fe68b17f && git checkout -B drift-repro 937ec142d5bb6e3f112dae2530842b1292be1cd4 && git merge --no-ff 6d75c646275cbb88c980bbd3c4d06799fe68b17f
node scripts/docs-audit/affected-docs.mjs --json 937ec142d5bb6e3f112dae2530842b1292be1cd4

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

[os-musk]

Landing provenance (engine execution seat, session session_0112hMx9hjJ9BgB28X97DS68): flipped ready at 16:17Z and armed auto-merge (squash) on head 6d75c6462, the patch-round head.

• Review: ACCEPT on the card, comment 5512439181, after one patch round. Clause-② no — the new export is a semver fact, not a Clause-② fact.
• Governed-surface test on the four changed paths: 0 of 4 governed — ordinary queue landing.
• Changeset: @objectstack/lint: minor in .changeset/lint-liveness-live-elsewhere-rule-id.md, a file of its own. Liveness ledger has no verdict for keys enforced only in a sibling repo — dead misreads as deletable (manifest.runtime case) #13483's .changeset/liveness-live-elsewhere-verdict.md was restored byte-for-byte and verified empty against origin/main, so @objectstack/spec keeps its pending patch bump and the fifth verdict keeps its release note.
• Enqueue bar: every check run on 6d75c6462 completed green or skipped (36 runs read at 16:17Z, perPage: 50). Last standing was Lint & Repo Gates at 16:13:23Z, with Test Core (1/6) finishing 16:12:58Z — 17 minutes.
• Landing owed by the seat at MERGED: verify by content on origin/main that describe() carries the live-elsewhere branch with LIVENESS_LIVE_ELSEWHERE_PROPERTY and that the sentinel throw survives, strip pm:dispatched from lint-liveness-properties.ts describe() has not been taught the live-elsewhere verdict — throws by design the day such a row opts into authorWarn #14057, landing record on the card.

---

Generated by Claude Code

[os-musk]

Fixes#14057

describe() in packages/lint/src/lint-liveness-properties.ts maps ledger verdicts to author-facing findings, and throws — deliberately, per its own boundary comment — on a status it has not been taught. #13483 then shipped the ledger's fifth status, live-elsewhere (dead HERE by measurement, genuinely enforced in a sibling repo), and migrated manifest.runtime onto it. describe() was never taught it. The day any live-elsewhere row opts into authorWarn: true, os lint raises a shipped-ledger-integrity error instead of the advisory warning the author should have received.

It must never be the dead branch

This is the load-bearing constraint on the repair, and it is why the fix is a new branch rather than a widened one. Per the #11384 lesson, the verdicts imply opposite author actions, so telling an author to "Remove it" about a key whose enforcement is real and remote is exactly the wrong sentence: for manifest.runtime the enforcer is the cloud marketplace publish gate, where an unverified publisher requesting the node tier is hard-rejected, so deleting the key would tear out a live gate's input. live-elsewhere therefore gets its own rule id, its own message, and a default hint that keeps the property and points at the ledger row's evidence for the enforcer.

What changed

• A fourth branch in describe(), placed against the dead branch it must never be, with a comment saying why the adjacency is deliberate: the two verdicts are one measurement apart and opposite in what they ask of the author.
• LIVENESS_LIVE_ELSEWHERE_PROPERTY = 'liveness-live-elsewhere-property', exported beside its three siblings and re-exported from src/index.ts. Advisory-only, like them; nothing downstream keys off these ids today (measured: the only non-CHANGELOG consumers of any liveness rule id are src/index.ts, this package's tests, and one CLI test; there is no rule catalogue and no docs page listing them).
• The sentinel throw stays for genuinely unknown statuses, with its enumeration of the known ones updated — and a test pins the enumeration equal to the branches, since a stale list is how the next status gets misread.
• Two stale statements in the file's own comments corrected: it described the vocabulary as four members and quoted check-liveness.mts's header as Statuses: live | experimental | planned | dead. That header now reads live | experimental | planned | dead | live-elsewhere.

Reachability, measured

Still a fuse, not a fire. An entry reaches describe() only after shouldWarn() says yes (authorWarn: true, or status === 'experimental'), and the shipped manifest.runtime row carries no authorWarn. A negative control on the real ledger pins that, with an anti-vacuity guard: the coverage walk must SEE a live-elsewhere row (the one row carrying that status lives in manifest.json, so seeing the status proves the file was read) while authorWarnedProperties('manifest') must not contain runtime. If that row ever opts in, the pin goes red and the reviewer updates the pin — the new branch is what makes that flip safe.

Coverage, derived rather than hand-listed

The triage asked for a check that describe() covers every verdict, because patching one status leaves the next to repeat this card. Hand-listing the vocabulary in a test would go stale for exactly the reason describe() did — nobody edits the list they did not know existed — so the pin walks the shipped ledger rows (shippedLedgerStatuses(), a package-internal seam in the same posture as the existing #10262 seam: exported from the module only, re-exported by neither src/index.ts nor the package's exports map) and requires every distinct status it finds to be answered by describe() with a rule id of its own, plus asserts no two verdicts share a rule id. The vocabulary is prose in a comment, not an importable enum, so rows are the only machine-readable statement of it in this package's reach; a status with zero rows cannot reach describe() anyway, and the moment one appears, the pin names it.

live is the one member that deliberately gets no branch, and the source header already ruled it out in a sentence this PR keeps and now pins: an entry marked authorWarn: true on a live row "would be a ledger authoring mistake, not a user error". A mistake in our own shipped data is what the sentinel is for, so the pin asserts live stays loud rather than handled — matching the case the suite already carried.

Measured vocabulary: five members at packages/spec/scripts/liveness/check-liveness.mts:36 and in packages/spec/liveness/README.md. The inconclusive mentioned in triage is not a ledger status — zero hits across packages/spec/; it belongs to the skill-side vocabulary of the sibling card, which is out of scope here.

Changeset

'@objectstack/lint': minor, in .changeset/lint-liveness-live-elsewhere-rule-id.md. LIVENESS_LIVE_ELSEWHERE_PROPERTY is a new export on packages/lint/src/index.ts, the public entry, and a new public-entry export is minor under the precedent this lane applied today — #14606 took @objectstack/types: minor for three new exports. Nothing narrows, so no BREAKING banner and no ADR-0087 marker is owed; the behaviour change is an internal integrity error becoming the advisory finding it should always have been.

An earlier revision of this PR got two things wrong here and both are fixed. It declared patch, arguing from the planned verdict's own changeset; and it wrote its note to .changeset/liveness-live-elsewhere-verdict.md, a filename derived from the verdict — which is #13483's existing file on origin/main, declaring the pending @objectstack/spec: patch bump and describing the fifth verdict's gate-executable criteria and the 180-day re-attestation discipline. Writing there truncated it. That file is restored byte for byte (blob 5321f1b09, git diff origin/main on the path empty, and the re-derived three-dot change set no longer mentions it at all), and this package's note lives under its own non-colliding name.

Verification, at 168c1d7fa for the code, re-confirmed at 6d75c6462

The head moved only by the two changeset files above; the re-derived gate family is byte-identical between the two heads, so the union below carries over.

• pnpm --filter @objectstack/lint typecheck and the full package suite: 93 files, 2821 passed, 5 skipped. The new tests are genuinely in the typecheck population — tsconfig.test.json --listFiles lists lint-liveness-properties.test.ts.
• Reverse verification (ablation). Reverting only the new branch, tests untouched, turns three of the new cases red with the sentinel firing on live-elsewhere — the card's defect, reproduced: 3 failed | 65 passed. Restored: blob equality with HEAD, git diff HEAD empty, git status --porcelain empty, 68 passed. The mutation was confirmed on disk before the run (removed text 0 hits, injected marker 1 hit, blob hash changed), and the subject is a package-relative source import, so no dist indirection is in the path.
• Gate union re-derived on this tree with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (34 commands): 30 green. pnpm lint (whole repo), pnpm check:nul-bytes and pnpm check:error-status-conformance also green. On the new head, check-empty-changeset ("1 declaring changeset(s) added"), check-changeset-no-major and check-adr-0087-registration were re-run: all exit 0.
• Four gates answered exit 3 — NOT MEASURED in their own words, not green and not red: check-test-completeness, pm/check-half-states, check:dual-build-cjs-loads ("PREREQUISITE NOT MET ... this is NOT a pass: nothing was measured") and check:type-check-debt. The latter two read built output for every package; CI builds that closure before running them.
• check:doc-authoring caught a real defect in the first draft: the new tracker id sat inside the sentinel's runtime string, which reaches authors and generated surfaces that cannot resolve it. Moved to the adjacent // comment; the gate is green.

Scope

packages/spec/liveness/** and its scripts were read, never changed. The skills-lane sibling card is untouched.

🤖 Generated with Claude Code

https://claude.ai/code/session_0112hMx9hjJ9BgB28X97DS68

[github-actions]

📓 Docs Drift Check

2 anchor(s) derived from 1 changed package(s); no hand-written page names any of them. ⚠️1 changed file(s) yielded no anchor (packages/lint/src/index.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

What this run could not see

• 1 changed file(s) yielded no anchor (packages/lint/src/index.ts) — pages documenting those are invisible to this run
• 1 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 5 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 937ec142d5bb6e3f112dae2530842b1292be1cd4 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 913f571e75fbda67f34777d7051aeaa695dca7df — the merge of head 6d75c646275cbb88c980bbd3c4d06799fe68b17f into base 937ec142d5bb6e3f112dae2530842b1292be1cd4, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 913f571e75fbda67f34777d7051aeaa695dca7df && git checkout 913f571e75fbda67f34777d7051aeaa695dca7df
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 937ec142d5bb6e3f112dae2530842b1292be1cd4 6d75c646275cbb88c980bbd3c4d06799fe68b17f && git checkout -B drift-repro 937ec142d5bb6e3f112dae2530842b1292be1cd4 && git merge --no-ff 6d75c646275cbb88c980bbd3c4d06799fe68b17f
node scripts/docs-audit/affected-docs.mjs --json 937ec142d5bb6e3f112dae2530842b1292be1cd4

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

[os-musk]

Landing provenance (engine execution seat, session session_0112hMx9hjJ9BgB28X97DS68): flipped ready at 16:17Z and armed auto-merge (squash) on head 6d75c6462, the patch-round head.

• Review: ACCEPT on the card, comment 5512439181, after one patch round. Clause-② no — the new export is a semver fact, not a Clause-② fact.
• Governed-surface test on the four changed paths: 0 of 4 governed — ordinary queue landing.
• Changeset: @objectstack/lint: minor in .changeset/lint-liveness-live-elsewhere-rule-id.md, a file of its own. Liveness ledger has no verdict for keys enforced only in a sibling repo — dead misreads as deletable (manifest.runtime case) #13483's .changeset/liveness-live-elsewhere-verdict.md was restored byte-for-byte and verified empty against origin/main, so @objectstack/spec keeps its pending patch bump and the fifth verdict keeps its release note.
• Enqueue bar: every check run on 6d75c6462 completed green or skipped (36 runs read at 16:17Z, perPage: 50). Last standing was Lint & Repo Gates at 16:13:23Z, with Test Core (1/6) finishing 16:12:58Z — 17 minutes.
• Landing owed by the seat at MERGED: verify by content on origin/main that describe() carries the live-elsewhere branch with LIVENESS_LIVE_ELSEWHERE_PROPERTY and that the sentinel throw survives, strip pm:dispatched from lint-liveness-properties.ts describe() has not been taught the live-elsewhere verdict — throws by design the day such a row opts into authorWarn #14057, landing record on the card.

---

Generated by Claude Code

[os-musk]

Fixes#14057

describe() in packages/lint/src/lint-liveness-properties.ts maps ledger verdicts to author-facing findings, and throws — deliberately, per its own boundary comment — on a status it has not been taught. #13483 then shipped the ledger's fifth status, live-elsewhere (dead HERE by measurement, genuinely enforced in a sibling repo), and migrated manifest.runtime onto it. describe() was never taught it. The day any live-elsewhere row opts into authorWarn: true, os lint raises a shipped-ledger-integrity error instead of the advisory warning the author should have received.

It must never be the dead branch

This is the load-bearing constraint on the repair, and it is why the fix is a new branch rather than a widened one. Per the #11384 lesson, the verdicts imply opposite author actions, so telling an author to "Remove it" about a key whose enforcement is real and remote is exactly the wrong sentence: for manifest.runtime the enforcer is the cloud marketplace publish gate, where an unverified publisher requesting the node tier is hard-rejected, so deleting the key would tear out a live gate's input. live-elsewhere therefore gets its own rule id, its own message, and a default hint that keeps the property and points at the ledger row's evidence for the enforcer.

What changed

• A fourth branch in describe(), placed against the dead branch it must never be, with a comment saying why the adjacency is deliberate: the two verdicts are one measurement apart and opposite in what they ask of the author.
• LIVENESS_LIVE_ELSEWHERE_PROPERTY = 'liveness-live-elsewhere-property', exported beside its three siblings and re-exported from src/index.ts. Advisory-only, like them; nothing downstream keys off these ids today (measured: the only non-CHANGELOG consumers of any liveness rule id are src/index.ts, this package's tests, and one CLI test; there is no rule catalogue and no docs page listing them).
• The sentinel throw stays for genuinely unknown statuses, with its enumeration of the known ones updated — and a test pins the enumeration equal to the branches, since a stale list is how the next status gets misread.
• Two stale statements in the file's own comments corrected: it described the vocabulary as four members and quoted check-liveness.mts's header as Statuses: live | experimental | planned | dead. That header now reads live | experimental | planned | dead | live-elsewhere.

Reachability, measured

Still a fuse, not a fire. An entry reaches describe() only after shouldWarn() says yes (authorWarn: true, or status === 'experimental'), and the shipped manifest.runtime row carries no authorWarn. A negative control on the real ledger pins that, with an anti-vacuity guard: the coverage walk must SEE a live-elsewhere row (the one row carrying that status lives in manifest.json, so seeing the status proves the file was read) while authorWarnedProperties('manifest') must not contain runtime. If that row ever opts in, the pin goes red and the reviewer updates the pin — the new branch is what makes that flip safe.

Coverage, derived rather than hand-listed

The triage asked for a check that describe() covers every verdict, because patching one status leaves the next to repeat this card. Hand-listing the vocabulary in a test would go stale for exactly the reason describe() did — nobody edits the list they did not know existed — so the pin walks the shipped ledger rows (shippedLedgerStatuses(), a package-internal seam in the same posture as the existing #10262 seam: exported from the module only, re-exported by neither src/index.ts nor the package's exports map) and requires every distinct status it finds to be answered by describe() with a rule id of its own, plus asserts no two verdicts share a rule id. The vocabulary is prose in a comment, not an importable enum, so rows are the only machine-readable statement of it in this package's reach; a status with zero rows cannot reach describe() anyway, and the moment one appears, the pin names it.

live is the one member that deliberately gets no branch, and the source header already ruled it out in a sentence this PR keeps and now pins: an entry marked authorWarn: true on a live row "would be a ledger authoring mistake, not a user error". A mistake in our own shipped data is what the sentinel is for, so the pin asserts live stays loud rather than handled — matching the case the suite already carried.

Measured vocabulary: five members at packages/spec/scripts/liveness/check-liveness.mts:36 and in packages/spec/liveness/README.md. The inconclusive mentioned in triage is not a ledger status — zero hits across packages/spec/; it belongs to the skill-side vocabulary of the sibling card, which is out of scope here.

Changeset

'@objectstack/lint': minor, in .changeset/lint-liveness-live-elsewhere-rule-id.md. LIVENESS_LIVE_ELSEWHERE_PROPERTY is a new export on packages/lint/src/index.ts, the public entry, and a new public-entry export is minor under the precedent this lane applied today — #14606 took @objectstack/types: minor for three new exports. Nothing narrows, so no BREAKING banner and no ADR-0087 marker is owed; the behaviour change is an internal integrity error becoming the advisory finding it should always have been.

An earlier revision of this PR got two things wrong here and both are fixed. It declared patch, arguing from the planned verdict's own changeset; and it wrote its note to .changeset/liveness-live-elsewhere-verdict.md, a filename derived from the verdict — which is #13483's existing file on origin/main, declaring the pending @objectstack/spec: patch bump and describing the fifth verdict's gate-executable criteria and the 180-day re-attestation discipline. Writing there truncated it. That file is restored byte for byte (blob 5321f1b09, git diff origin/main on the path empty, and the re-derived three-dot change set no longer mentions it at all), and this package's note lives under its own non-colliding name.

Verification, at 168c1d7fa for the code, re-confirmed at 6d75c6462

The head moved only by the two changeset files above; the re-derived gate family is byte-identical between the two heads, so the union below carries over.

• pnpm --filter @objectstack/lint typecheck and the full package suite: 93 files, 2821 passed, 5 skipped. The new tests are genuinely in the typecheck population — tsconfig.test.json --listFiles lists lint-liveness-properties.test.ts.
• Reverse verification (ablation). Reverting only the new branch, tests untouched, turns three of the new cases red with the sentinel firing on live-elsewhere — the card's defect, reproduced: 3 failed | 65 passed. Restored: blob equality with HEAD, git diff HEAD empty, git status --porcelain empty, 68 passed. The mutation was confirmed on disk before the run (removed text 0 hits, injected marker 1 hit, blob hash changed), and the subject is a package-relative source import, so no dist indirection is in the path.
• Gate union re-derived on this tree with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (34 commands): 30 green. pnpm lint (whole repo), pnpm check:nul-bytes and pnpm check:error-status-conformance also green. On the new head, check-empty-changeset ("1 declaring changeset(s) added"), check-changeset-no-major and check-adr-0087-registration were re-run: all exit 0.
• Four gates answered exit 3 — NOT MEASURED in their own words, not green and not red: check-test-completeness, pm/check-half-states, check:dual-build-cjs-loads ("PREREQUISITE NOT MET ... this is NOT a pass: nothing was measured") and check:type-check-debt. The latter two read built output for every package; CI builds that closure before running them.
• check:doc-authoring caught a real defect in the first draft: the new tracker id sat inside the sentinel's runtime string, which reaches authors and generated surfaces that cannot resolve it. Moved to the adjacent // comment; the gate is green.

Scope

packages/spec/liveness/** and its scripts were read, never changed. The skills-lane sibling card is untouched.

🤖 Generated with Claude Code

https://claude.ai/code/session_0112hMx9hjJ9BgB28X97DS68

[github-actions]

📓 Docs Drift Check

2 anchor(s) derived from 1 changed package(s); no hand-written page names any of them. ⚠️1 changed file(s) yielded no anchor (packages/lint/src/index.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

What this run could not see

• 1 changed file(s) yielded no anchor (packages/lint/src/index.ts) — pages documenting those are invisible to this run
• 1 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 5 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 937ec142d5bb6e3f112dae2530842b1292be1cd4 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 913f571e75fbda67f34777d7051aeaa695dca7df — the merge of head 6d75c646275cbb88c980bbd3c4d06799fe68b17f into base 937ec142d5bb6e3f112dae2530842b1292be1cd4, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 913f571e75fbda67f34777d7051aeaa695dca7df && git checkout 913f571e75fbda67f34777d7051aeaa695dca7df
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 937ec142d5bb6e3f112dae2530842b1292be1cd4 6d75c646275cbb88c980bbd3c4d06799fe68b17f && git checkout -B drift-repro 937ec142d5bb6e3f112dae2530842b1292be1cd4 && git merge --no-ff 6d75c646275cbb88c980bbd3c4d06799fe68b17f
node scripts/docs-audit/affected-docs.mjs --json 937ec142d5bb6e3f112dae2530842b1292be1cd4

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

[os-musk]

Landing provenance (engine execution seat, session session_0112hMx9hjJ9BgB28X97DS68): flipped ready at 16:17Z and armed auto-merge (squash) on head 6d75c6462, the patch-round head.

• Review: ACCEPT on the card, comment 5512439181, after one patch round. Clause-② no — the new export is a semver fact, not a Clause-② fact.
• Governed-surface test on the four changed paths: 0 of 4 governed — ordinary queue landing.
• Changeset: @objectstack/lint: minor in .changeset/lint-liveness-live-elsewhere-rule-id.md, a file of its own. Liveness ledger has no verdict for keys enforced only in a sibling repo — dead misreads as deletable (manifest.runtime case) #13483's .changeset/liveness-live-elsewhere-verdict.md was restored byte-for-byte and verified empty against origin/main, so @objectstack/spec keeps its pending patch bump and the fifth verdict keeps its release note.
• Enqueue bar: every check run on 6d75c6462 completed green or skipped (36 runs read at 16:17Z, perPage: 50). Last standing was Lint & Repo Gates at 16:13:23Z, with Test Core (1/6) finishing 16:12:58Z — 17 minutes.
• Landing owed by the seat at MERGED: verify by content on origin/main that describe() carries the live-elsewhere branch with LIVENESS_LIVE_ELSEWHERE_PROPERTY and that the sentinel throw survives, strip pm:dispatched from lint-liveness-properties.ts describe() has not been taught the live-elsewhere verdict — throws by design the day such a row opts into authorWarn #14057, landing record on the card.

---

Generated by Claude Code

[os-musk]

Fixes#14057

describe() in packages/lint/src/lint-liveness-properties.ts maps ledger verdicts to author-facing findings, and throws — deliberately, per its own boundary comment — on a status it has not been taught. #13483 then shipped the ledger's fifth status, live-elsewhere (dead HERE by measurement, genuinely enforced in a sibling repo), and migrated manifest.runtime onto it. describe() was never taught it. The day any live-elsewhere row opts into authorWarn: true, os lint raises a shipped-ledger-integrity error instead of the advisory warning the author should have received.

It must never be the dead branch

This is the load-bearing constraint on the repair, and it is why the fix is a new branch rather than a widened one. Per the #11384 lesson, the verdicts imply opposite author actions, so telling an author to "Remove it" about a key whose enforcement is real and remote is exactly the wrong sentence: for manifest.runtime the enforcer is the cloud marketplace publish gate, where an unverified publisher requesting the node tier is hard-rejected, so deleting the key would tear out a live gate's input. live-elsewhere therefore gets its own rule id, its own message, and a default hint that keeps the property and points at the ledger row's evidence for the enforcer.

What changed

• A fourth branch in describe(), placed against the dead branch it must never be, with a comment saying why the adjacency is deliberate: the two verdicts are one measurement apart and opposite in what they ask of the author.
• LIVENESS_LIVE_ELSEWHERE_PROPERTY = 'liveness-live-elsewhere-property', exported beside its three siblings and re-exported from src/index.ts. Advisory-only, like them; nothing downstream keys off these ids today (measured: the only non-CHANGELOG consumers of any liveness rule id are src/index.ts, this package's tests, and one CLI test; there is no rule catalogue and no docs page listing them).
• The sentinel throw stays for genuinely unknown statuses, with its enumeration of the known ones updated — and a test pins the enumeration equal to the branches, since a stale list is how the next status gets misread.
• Two stale statements in the file's own comments corrected: it described the vocabulary as four members and quoted check-liveness.mts's header as Statuses: live | experimental | planned | dead. That header now reads live | experimental | planned | dead | live-elsewhere.

Reachability, measured

Still a fuse, not a fire. An entry reaches describe() only after shouldWarn() says yes (authorWarn: true, or status === 'experimental'), and the shipped manifest.runtime row carries no authorWarn. A negative control on the real ledger pins that, with an anti-vacuity guard: the coverage walk must SEE a live-elsewhere row (the one row carrying that status lives in manifest.json, so seeing the status proves the file was read) while authorWarnedProperties('manifest') must not contain runtime. If that row ever opts in, the pin goes red and the reviewer updates the pin — the new branch is what makes that flip safe.

Coverage, derived rather than hand-listed

The triage asked for a check that describe() covers every verdict, because patching one status leaves the next to repeat this card. Hand-listing the vocabulary in a test would go stale for exactly the reason describe() did — nobody edits the list they did not know existed — so the pin walks the shipped ledger rows (shippedLedgerStatuses(), a package-internal seam in the same posture as the existing #10262 seam: exported from the module only, re-exported by neither src/index.ts nor the package's exports map) and requires every distinct status it finds to be answered by describe() with a rule id of its own, plus asserts no two verdicts share a rule id. The vocabulary is prose in a comment, not an importable enum, so rows are the only machine-readable statement of it in this package's reach; a status with zero rows cannot reach describe() anyway, and the moment one appears, the pin names it.

live is the one member that deliberately gets no branch, and the source header already ruled it out in a sentence this PR keeps and now pins: an entry marked authorWarn: true on a live row "would be a ledger authoring mistake, not a user error". A mistake in our own shipped data is what the sentinel is for, so the pin asserts live stays loud rather than handled — matching the case the suite already carried.

Measured vocabulary: five members at packages/spec/scripts/liveness/check-liveness.mts:36 and in packages/spec/liveness/README.md. The inconclusive mentioned in triage is not a ledger status — zero hits across packages/spec/; it belongs to the skill-side vocabulary of the sibling card, which is out of scope here.

Changeset

'@objectstack/lint': minor, in .changeset/lint-liveness-live-elsewhere-rule-id.md. LIVENESS_LIVE_ELSEWHERE_PROPERTY is a new export on packages/lint/src/index.ts, the public entry, and a new public-entry export is minor under the precedent this lane applied today — #14606 took @objectstack/types: minor for three new exports. Nothing narrows, so no BREAKING banner and no ADR-0087 marker is owed; the behaviour change is an internal integrity error becoming the advisory finding it should always have been.

An earlier revision of this PR got two things wrong here and both are fixed. It declared patch, arguing from the planned verdict's own changeset; and it wrote its note to .changeset/liveness-live-elsewhere-verdict.md, a filename derived from the verdict — which is #13483's existing file on origin/main, declaring the pending @objectstack/spec: patch bump and describing the fifth verdict's gate-executable criteria and the 180-day re-attestation discipline. Writing there truncated it. That file is restored byte for byte (blob 5321f1b09, git diff origin/main on the path empty, and the re-derived three-dot change set no longer mentions it at all), and this package's note lives under its own non-colliding name.

Verification, at 168c1d7fa for the code, re-confirmed at 6d75c6462

The head moved only by the two changeset files above; the re-derived gate family is byte-identical between the two heads, so the union below carries over.

• pnpm --filter @objectstack/lint typecheck and the full package suite: 93 files, 2821 passed, 5 skipped. The new tests are genuinely in the typecheck population — tsconfig.test.json --listFiles lists lint-liveness-properties.test.ts.
• Reverse verification (ablation). Reverting only the new branch, tests untouched, turns three of the new cases red with the sentinel firing on live-elsewhere — the card's defect, reproduced: 3 failed | 65 passed. Restored: blob equality with HEAD, git diff HEAD empty, git status --porcelain empty, 68 passed. The mutation was confirmed on disk before the run (removed text 0 hits, injected marker 1 hit, blob hash changed), and the subject is a package-relative source import, so no dist indirection is in the path.
• Gate union re-derived on this tree with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (34 commands): 30 green. pnpm lint (whole repo), pnpm check:nul-bytes and pnpm check:error-status-conformance also green. On the new head, check-empty-changeset ("1 declaring changeset(s) added"), check-changeset-no-major and check-adr-0087-registration were re-run: all exit 0.
• Four gates answered exit 3 — NOT MEASURED in their own words, not green and not red: check-test-completeness, pm/check-half-states, check:dual-build-cjs-loads ("PREREQUISITE NOT MET ... this is NOT a pass: nothing was measured") and check:type-check-debt. The latter two read built output for every package; CI builds that closure before running them.
• check:doc-authoring caught a real defect in the first draft: the new tracker id sat inside the sentinel's runtime string, which reaches authors and generated surfaces that cannot resolve it. Moved to the adjacent // comment; the gate is green.

Scope

packages/spec/liveness/** and its scripts were read, never changed. The skills-lane sibling card is untouched.

🤖 Generated with Claude Code

https://claude.ai/code/session_0112hMx9hjJ9BgB28X97DS68

[github-actions]

📓 Docs Drift Check

2 anchor(s) derived from 1 changed package(s); no hand-written page names any of them. ⚠️1 changed file(s) yielded no anchor (packages/lint/src/index.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

What this run could not see

• 1 changed file(s) yielded no anchor (packages/lint/src/index.ts) — pages documenting those are invisible to this run
• 1 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 5 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 937ec142d5bb6e3f112dae2530842b1292be1cd4 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 913f571e75fbda67f34777d7051aeaa695dca7df — the merge of head 6d75c646275cbb88c980bbd3c4d06799fe68b17f into base 937ec142d5bb6e3f112dae2530842b1292be1cd4, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 913f571e75fbda67f34777d7051aeaa695dca7df && git checkout 913f571e75fbda67f34777d7051aeaa695dca7df
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 937ec142d5bb6e3f112dae2530842b1292be1cd4 6d75c646275cbb88c980bbd3c4d06799fe68b17f && git checkout -B drift-repro 937ec142d5bb6e3f112dae2530842b1292be1cd4 && git merge --no-ff 6d75c646275cbb88c980bbd3c4d06799fe68b17f
node scripts/docs-audit/affected-docs.mjs --json 937ec142d5bb6e3f112dae2530842b1292be1cd4

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

[os-musk]

Landing provenance (engine execution seat, session session_0112hMx9hjJ9BgB28X97DS68): flipped ready at 16:17Z and armed auto-merge (squash) on head 6d75c6462, the patch-round head.

• Review: ACCEPT on the card, comment 5512439181, after one patch round. Clause-② no — the new export is a semver fact, not a Clause-② fact.
• Governed-surface test on the four changed paths: 0 of 4 governed — ordinary queue landing.
• Changeset: @objectstack/lint: minor in .changeset/lint-liveness-live-elsewhere-rule-id.md, a file of its own. Liveness ledger has no verdict for keys enforced only in a sibling repo — dead misreads as deletable (manifest.runtime case) #13483's .changeset/liveness-live-elsewhere-verdict.md was restored byte-for-byte and verified empty against origin/main, so @objectstack/spec keeps its pending patch bump and the fifth verdict keeps its release note.
• Enqueue bar: every check run on 6d75c6462 completed green or skipped (36 runs read at 16:17Z, perPage: 50). Last standing was Lint & Repo Gates at 16:13:23Z, with Test Core (1/6) finishing 16:12:58Z — 17 minutes.
• Landing owed by the seat at MERGED: verify by content on origin/main that describe() carries the live-elsewhere branch with LIVENESS_LIVE_ELSEWHERE_PROPERTY and that the sentinel throw survives, strip pm:dispatched from lint-liveness-properties.ts describe() has not been taught the live-elsewhere verdict — throws by design the day such a row opts into authorWarn #14057, landing record on the card.

---

Generated by Claude Code

[os-musk]

Fixes#14057

describe() in packages/lint/src/lint-liveness-properties.ts maps ledger verdicts to author-facing findings, and throws — deliberately, per its own boundary comment — on a status it has not been taught. #13483 then shipped the ledger's fifth status, live-elsewhere (dead HERE by measurement, genuinely enforced in a sibling repo), and migrated manifest.runtime onto it. describe() was never taught it. The day any live-elsewhere row opts into authorWarn: true, os lint raises a shipped-ledger-integrity error instead of the advisory warning the author should have received.

It must never be the dead branch

This is the load-bearing constraint on the repair, and it is why the fix is a new branch rather than a widened one. Per the #11384 lesson, the verdicts imply opposite author actions, so telling an author to "Remove it" about a key whose enforcement is real and remote is exactly the wrong sentence: for manifest.runtime the enforcer is the cloud marketplace publish gate, where an unverified publisher requesting the node tier is hard-rejected, so deleting the key would tear out a live gate's input. live-elsewhere therefore gets its own rule id, its own message, and a default hint that keeps the property and points at the ledger row's evidence for the enforcer.

What changed

• A fourth branch in describe(), placed against the dead branch it must never be, with a comment saying why the adjacency is deliberate: the two verdicts are one measurement apart and opposite in what they ask of the author.
• LIVENESS_LIVE_ELSEWHERE_PROPERTY = 'liveness-live-elsewhere-property', exported beside its three siblings and re-exported from src/index.ts. Advisory-only, like them; nothing downstream keys off these ids today (measured: the only non-CHANGELOG consumers of any liveness rule id are src/index.ts, this package's tests, and one CLI test; there is no rule catalogue and no docs page listing them).
• The sentinel throw stays for genuinely unknown statuses, with its enumeration of the known ones updated — and a test pins the enumeration equal to the branches, since a stale list is how the next status gets misread.
• Two stale statements in the file's own comments corrected: it described the vocabulary as four members and quoted check-liveness.mts's header as Statuses: live | experimental | planned | dead. That header now reads live | experimental | planned | dead | live-elsewhere.

Reachability, measured

Still a fuse, not a fire. An entry reaches describe() only after shouldWarn() says yes (authorWarn: true, or status === 'experimental'), and the shipped manifest.runtime row carries no authorWarn. A negative control on the real ledger pins that, with an anti-vacuity guard: the coverage walk must SEE a live-elsewhere row (the one row carrying that status lives in manifest.json, so seeing the status proves the file was read) while authorWarnedProperties('manifest') must not contain runtime. If that row ever opts in, the pin goes red and the reviewer updates the pin — the new branch is what makes that flip safe.

Coverage, derived rather than hand-listed

The triage asked for a check that describe() covers every verdict, because patching one status leaves the next to repeat this card. Hand-listing the vocabulary in a test would go stale for exactly the reason describe() did — nobody edits the list they did not know existed — so the pin walks the shipped ledger rows (shippedLedgerStatuses(), a package-internal seam in the same posture as the existing #10262 seam: exported from the module only, re-exported by neither src/index.ts nor the package's exports map) and requires every distinct status it finds to be answered by describe() with a rule id of its own, plus asserts no two verdicts share a rule id. The vocabulary is prose in a comment, not an importable enum, so rows are the only machine-readable statement of it in this package's reach; a status with zero rows cannot reach describe() anyway, and the moment one appears, the pin names it.

live is the one member that deliberately gets no branch, and the source header already ruled it out in a sentence this PR keeps and now pins: an entry marked authorWarn: true on a live row "would be a ledger authoring mistake, not a user error". A mistake in our own shipped data is what the sentinel is for, so the pin asserts live stays loud rather than handled — matching the case the suite already carried.

Measured vocabulary: five members at packages/spec/scripts/liveness/check-liveness.mts:36 and in packages/spec/liveness/README.md. The inconclusive mentioned in triage is not a ledger status — zero hits across packages/spec/; it belongs to the skill-side vocabulary of the sibling card, which is out of scope here.

Changeset

'@objectstack/lint': minor, in .changeset/lint-liveness-live-elsewhere-rule-id.md. LIVENESS_LIVE_ELSEWHERE_PROPERTY is a new export on packages/lint/src/index.ts, the public entry, and a new public-entry export is minor under the precedent this lane applied today — #14606 took @objectstack/types: minor for three new exports. Nothing narrows, so no BREAKING banner and no ADR-0087 marker is owed; the behaviour change is an internal integrity error becoming the advisory finding it should always have been.

An earlier revision of this PR got two things wrong here and both are fixed. It declared patch, arguing from the planned verdict's own changeset; and it wrote its note to .changeset/liveness-live-elsewhere-verdict.md, a filename derived from the verdict — which is #13483's existing file on origin/main, declaring the pending @objectstack/spec: patch bump and describing the fifth verdict's gate-executable criteria and the 180-day re-attestation discipline. Writing there truncated it. That file is restored byte for byte (blob 5321f1b09, git diff origin/main on the path empty, and the re-derived three-dot change set no longer mentions it at all), and this package's note lives under its own non-colliding name.

Verification, at 168c1d7fa for the code, re-confirmed at 6d75c6462

The head moved only by the two changeset files above; the re-derived gate family is byte-identical between the two heads, so the union below carries over.

• pnpm --filter @objectstack/lint typecheck and the full package suite: 93 files, 2821 passed, 5 skipped. The new tests are genuinely in the typecheck population — tsconfig.test.json --listFiles lists lint-liveness-properties.test.ts.
• Reverse verification (ablation). Reverting only the new branch, tests untouched, turns three of the new cases red with the sentinel firing on live-elsewhere — the card's defect, reproduced: 3 failed | 65 passed. Restored: blob equality with HEAD, git diff HEAD empty, git status --porcelain empty, 68 passed. The mutation was confirmed on disk before the run (removed text 0 hits, injected marker 1 hit, blob hash changed), and the subject is a package-relative source import, so no dist indirection is in the path.
• Gate union re-derived on this tree with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (34 commands): 30 green. pnpm lint (whole repo), pnpm check:nul-bytes and pnpm check:error-status-conformance also green. On the new head, check-empty-changeset ("1 declaring changeset(s) added"), check-changeset-no-major and check-adr-0087-registration were re-run: all exit 0.
• Four gates answered exit 3 — NOT MEASURED in their own words, not green and not red: check-test-completeness, pm/check-half-states, check:dual-build-cjs-loads ("PREREQUISITE NOT MET ... this is NOT a pass: nothing was measured") and check:type-check-debt. The latter two read built output for every package; CI builds that closure before running them.
• check:doc-authoring caught a real defect in the first draft: the new tracker id sat inside the sentinel's runtime string, which reaches authors and generated surfaces that cannot resolve it. Moved to the adjacent // comment; the gate is green.

Scope

packages/spec/liveness/** and its scripts were read, never changed. The skills-lane sibling card is untouched.

🤖 Generated with Claude Code

https://claude.ai/code/session_0112hMx9hjJ9BgB28X97DS68

[github-actions]

📓 Docs Drift Check

2 anchor(s) derived from 1 changed package(s); no hand-written page names any of them. ⚠️1 changed file(s) yielded no anchor (packages/lint/src/index.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

What this run could not see

• 1 changed file(s) yielded no anchor (packages/lint/src/index.ts) — pages documenting those are invisible to this run
• 1 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 5 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 937ec142d5bb6e3f112dae2530842b1292be1cd4 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 913f571e75fbda67f34777d7051aeaa695dca7df — the merge of head 6d75c646275cbb88c980bbd3c4d06799fe68b17f into base 937ec142d5bb6e3f112dae2530842b1292be1cd4, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 913f571e75fbda67f34777d7051aeaa695dca7df && git checkout 913f571e75fbda67f34777d7051aeaa695dca7df
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 937ec142d5bb6e3f112dae2530842b1292be1cd4 6d75c646275cbb88c980bbd3c4d06799fe68b17f && git checkout -B drift-repro 937ec142d5bb6e3f112dae2530842b1292be1cd4 && git merge --no-ff 6d75c646275cbb88c980bbd3c4d06799fe68b17f
node scripts/docs-audit/affected-docs.mjs --json 937ec142d5bb6e3f112dae2530842b1292be1cd4

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

[os-musk]

Landing provenance (engine execution seat, session session_0112hMx9hjJ9BgB28X97DS68): flipped ready at 16:17Z and armed auto-merge (squash) on head 6d75c6462, the patch-round head.

• Review: ACCEPT on the card, comment 5512439181, after one patch round. Clause-② no — the new export is a semver fact, not a Clause-② fact.
• Governed-surface test on the four changed paths: 0 of 4 governed — ordinary queue landing.
• Changeset: @objectstack/lint: minor in .changeset/lint-liveness-live-elsewhere-rule-id.md, a file of its own. Liveness ledger has no verdict for keys enforced only in a sibling repo — dead misreads as deletable (manifest.runtime case) #13483's .changeset/liveness-live-elsewhere-verdict.md was restored byte-for-byte and verified empty against origin/main, so @objectstack/spec keeps its pending patch bump and the fifth verdict keeps its release note.
• Enqueue bar: every check run on 6d75c6462 completed green or skipped (36 runs read at 16:17Z, perPage: 50). Last standing was Lint & Repo Gates at 16:13:23Z, with Test Core (1/6) finishing 16:12:58Z — 17 minutes.
• Landing owed by the seat at MERGED: verify by content on origin/main that describe() carries the live-elsewhere branch with LIVENESS_LIVE_ELSEWHERE_PROPERTY and that the sentinel throw survives, strip pm:dispatched from lint-liveness-properties.ts describe() has not been taught the live-elsewhere verdict — throws by design the day such a row opts into authorWarn #14057, landing record on the card.

---

Generated by Claude Code

[os-musk]

Fixes#14057

describe() in packages/lint/src/lint-liveness-properties.ts maps ledger verdicts to author-facing findings, and throws — deliberately, per its own boundary comment — on a status it has not been taught. #13483 then shipped the ledger's fifth status, live-elsewhere (dead HERE by measurement, genuinely enforced in a sibling repo), and migrated manifest.runtime onto it. describe() was never taught it. The day any live-elsewhere row opts into authorWarn: true, os lint raises a shipped-ledger-integrity error instead of the advisory warning the author should have received.

It must never be the dead branch

This is the load-bearing constraint on the repair, and it is why the fix is a new branch rather than a widened one. Per the #11384 lesson, the verdicts imply opposite author actions, so telling an author to "Remove it" about a key whose enforcement is real and remote is exactly the wrong sentence: for manifest.runtime the enforcer is the cloud marketplace publish gate, where an unverified publisher requesting the node tier is hard-rejected, so deleting the key would tear out a live gate's input. live-elsewhere therefore gets its own rule id, its own message, and a default hint that keeps the property and points at the ledger row's evidence for the enforcer.

What changed

• A fourth branch in describe(), placed against the dead branch it must never be, with a comment saying why the adjacency is deliberate: the two verdicts are one measurement apart and opposite in what they ask of the author.
• LIVENESS_LIVE_ELSEWHERE_PROPERTY = 'liveness-live-elsewhere-property', exported beside its three siblings and re-exported from src/index.ts. Advisory-only, like them; nothing downstream keys off these ids today (measured: the only non-CHANGELOG consumers of any liveness rule id are src/index.ts, this package's tests, and one CLI test; there is no rule catalogue and no docs page listing them).
• The sentinel throw stays for genuinely unknown statuses, with its enumeration of the known ones updated — and a test pins the enumeration equal to the branches, since a stale list is how the next status gets misread.
• Two stale statements in the file's own comments corrected: it described the vocabulary as four members and quoted check-liveness.mts's header as Statuses: live | experimental | planned | dead. That header now reads live | experimental | planned | dead | live-elsewhere.

Reachability, measured

Still a fuse, not a fire. An entry reaches describe() only after shouldWarn() says yes (authorWarn: true, or status === 'experimental'), and the shipped manifest.runtime row carries no authorWarn. A negative control on the real ledger pins that, with an anti-vacuity guard: the coverage walk must SEE a live-elsewhere row (the one row carrying that status lives in manifest.json, so seeing the status proves the file was read) while authorWarnedProperties('manifest') must not contain runtime. If that row ever opts in, the pin goes red and the reviewer updates the pin — the new branch is what makes that flip safe.

Coverage, derived rather than hand-listed

The triage asked for a check that describe() covers every verdict, because patching one status leaves the next to repeat this card. Hand-listing the vocabulary in a test would go stale for exactly the reason describe() did — nobody edits the list they did not know existed — so the pin walks the shipped ledger rows (shippedLedgerStatuses(), a package-internal seam in the same posture as the existing #10262 seam: exported from the module only, re-exported by neither src/index.ts nor the package's exports map) and requires every distinct status it finds to be answered by describe() with a rule id of its own, plus asserts no two verdicts share a rule id. The vocabulary is prose in a comment, not an importable enum, so rows are the only machine-readable statement of it in this package's reach; a status with zero rows cannot reach describe() anyway, and the moment one appears, the pin names it.

live is the one member that deliberately gets no branch, and the source header already ruled it out in a sentence this PR keeps and now pins: an entry marked authorWarn: true on a live row "would be a ledger authoring mistake, not a user error". A mistake in our own shipped data is what the sentinel is for, so the pin asserts live stays loud rather than handled — matching the case the suite already carried.

Measured vocabulary: five members at packages/spec/scripts/liveness/check-liveness.mts:36 and in packages/spec/liveness/README.md. The inconclusive mentioned in triage is not a ledger status — zero hits across packages/spec/; it belongs to the skill-side vocabulary of the sibling card, which is out of scope here.

Changeset

'@objectstack/lint': minor, in .changeset/lint-liveness-live-elsewhere-rule-id.md. LIVENESS_LIVE_ELSEWHERE_PROPERTY is a new export on packages/lint/src/index.ts, the public entry, and a new public-entry export is minor under the precedent this lane applied today — #14606 took @objectstack/types: minor for three new exports. Nothing narrows, so no BREAKING banner and no ADR-0087 marker is owed; the behaviour change is an internal integrity error becoming the advisory finding it should always have been.

An earlier revision of this PR got two things wrong here and both are fixed. It declared patch, arguing from the planned verdict's own changeset; and it wrote its note to .changeset/liveness-live-elsewhere-verdict.md, a filename derived from the verdict — which is #13483's existing file on origin/main, declaring the pending @objectstack/spec: patch bump and describing the fifth verdict's gate-executable criteria and the 180-day re-attestation discipline. Writing there truncated it. That file is restored byte for byte (blob 5321f1b09, git diff origin/main on the path empty, and the re-derived three-dot change set no longer mentions it at all), and this package's note lives under its own non-colliding name.

Verification, at 168c1d7fa for the code, re-confirmed at 6d75c6462

The head moved only by the two changeset files above; the re-derived gate family is byte-identical between the two heads, so the union below carries over.

• pnpm --filter @objectstack/lint typecheck and the full package suite: 93 files, 2821 passed, 5 skipped. The new tests are genuinely in the typecheck population — tsconfig.test.json --listFiles lists lint-liveness-properties.test.ts.
• Reverse verification (ablation). Reverting only the new branch, tests untouched, turns three of the new cases red with the sentinel firing on live-elsewhere — the card's defect, reproduced: 3 failed | 65 passed. Restored: blob equality with HEAD, git diff HEAD empty, git status --porcelain empty, 68 passed. The mutation was confirmed on disk before the run (removed text 0 hits, injected marker 1 hit, blob hash changed), and the subject is a package-relative source import, so no dist indirection is in the path.
• Gate union re-derived on this tree with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (34 commands): 30 green. pnpm lint (whole repo), pnpm check:nul-bytes and pnpm check:error-status-conformance also green. On the new head, check-empty-changeset ("1 declaring changeset(s) added"), check-changeset-no-major and check-adr-0087-registration were re-run: all exit 0.
• Four gates answered exit 3 — NOT MEASURED in their own words, not green and not red: check-test-completeness, pm/check-half-states, check:dual-build-cjs-loads ("PREREQUISITE NOT MET ... this is NOT a pass: nothing was measured") and check:type-check-debt. The latter two read built output for every package; CI builds that closure before running them.
• check:doc-authoring caught a real defect in the first draft: the new tracker id sat inside the sentinel's runtime string, which reaches authors and generated surfaces that cannot resolve it. Moved to the adjacent // comment; the gate is green.

Scope

packages/spec/liveness/** and its scripts were read, never changed. The skills-lane sibling card is untouched.

🤖 Generated with Claude Code

https://claude.ai/code/session_0112hMx9hjJ9BgB28X97DS68

[github-actions]

📓 Docs Drift Check

2 anchor(s) derived from 1 changed package(s); no hand-written page names any of them. ⚠️1 changed file(s) yielded no anchor (packages/lint/src/index.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

What this run could not see

• 1 changed file(s) yielded no anchor (packages/lint/src/index.ts) — pages documenting those are invisible to this run
• 1 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 5 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 937ec142d5bb6e3f112dae2530842b1292be1cd4 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 913f571e75fbda67f34777d7051aeaa695dca7df — the merge of head 6d75c646275cbb88c980bbd3c4d06799fe68b17f into base 937ec142d5bb6e3f112dae2530842b1292be1cd4, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 913f571e75fbda67f34777d7051aeaa695dca7df && git checkout 913f571e75fbda67f34777d7051aeaa695dca7df
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 937ec142d5bb6e3f112dae2530842b1292be1cd4 6d75c646275cbb88c980bbd3c4d06799fe68b17f && git checkout -B drift-repro 937ec142d5bb6e3f112dae2530842b1292be1cd4 && git merge --no-ff 6d75c646275cbb88c980bbd3c4d06799fe68b17f
node scripts/docs-audit/affected-docs.mjs --json 937ec142d5bb6e3f112dae2530842b1292be1cd4

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

[os-musk]

Landing provenance (engine execution seat, session session_0112hMx9hjJ9BgB28X97DS68): flipped ready at 16:17Z and armed auto-merge (squash) on head 6d75c6462, the patch-round head.

• Review: ACCEPT on the card, comment 5512439181, after one patch round. Clause-② no — the new export is a semver fact, not a Clause-② fact.
• Governed-surface test on the four changed paths: 0 of 4 governed — ordinary queue landing.
• Changeset: @objectstack/lint: minor in .changeset/lint-liveness-live-elsewhere-rule-id.md, a file of its own. Liveness ledger has no verdict for keys enforced only in a sibling repo — dead misreads as deletable (manifest.runtime case) #13483's .changeset/liveness-live-elsewhere-verdict.md was restored byte-for-byte and verified empty against origin/main, so @objectstack/spec keeps its pending patch bump and the fifth verdict keeps its release note.
• Enqueue bar: every check run on 6d75c6462 completed green or skipped (36 runs read at 16:17Z, perPage: 50). Last standing was Lint & Repo Gates at 16:13:23Z, with Test Core (1/6) finishing 16:12:58Z — 17 minutes.
• Landing owed by the seat at MERGED: verify by content on origin/main that describe() carries the live-elsewhere branch with LIVENESS_LIVE_ELSEWHERE_PROPERTY and that the sentinel throw survives, strip pm:dispatched from lint-liveness-properties.ts describe() has not been taught the live-elsewhere verdict — throws by design the day such a row opts into authorWarn #14057, landing record on the card.

---

Generated by Claude Code

[os-musk]

Fixes#14057

describe() in packages/lint/src/lint-liveness-properties.ts maps ledger verdicts to author-facing findings, and throws — deliberately, per its own boundary comment — on a status it has not been taught. #13483 then shipped the ledger's fifth status, live-elsewhere (dead HERE by measurement, genuinely enforced in a sibling repo), and migrated manifest.runtime onto it. describe() was never taught it. The day any live-elsewhere row opts into authorWarn: true, os lint raises a shipped-ledger-integrity error instead of the advisory warning the author should have received.

It must never be the dead branch

This is the load-bearing constraint on the repair, and it is why the fix is a new branch rather than a widened one. Per the #11384 lesson, the verdicts imply opposite author actions, so telling an author to "Remove it" about a key whose enforcement is real and remote is exactly the wrong sentence: for manifest.runtime the enforcer is the cloud marketplace publish gate, where an unverified publisher requesting the node tier is hard-rejected, so deleting the key would tear out a live gate's input. live-elsewhere therefore gets its own rule id, its own message, and a default hint that keeps the property and points at the ledger row's evidence for the enforcer.

What changed

• A fourth branch in describe(), placed against the dead branch it must never be, with a comment saying why the adjacency is deliberate: the two verdicts are one measurement apart and opposite in what they ask of the author.
• LIVENESS_LIVE_ELSEWHERE_PROPERTY = 'liveness-live-elsewhere-property', exported beside its three siblings and re-exported from src/index.ts. Advisory-only, like them; nothing downstream keys off these ids today (measured: the only non-CHANGELOG consumers of any liveness rule id are src/index.ts, this package's tests, and one CLI test; there is no rule catalogue and no docs page listing them).
• The sentinel throw stays for genuinely unknown statuses, with its enumeration of the known ones updated — and a test pins the enumeration equal to the branches, since a stale list is how the next status gets misread.
• Two stale statements in the file's own comments corrected: it described the vocabulary as four members and quoted check-liveness.mts's header as Statuses: live | experimental | planned | dead. That header now reads live | experimental | planned | dead | live-elsewhere.

Reachability, measured

Still a fuse, not a fire. An entry reaches describe() only after shouldWarn() says yes (authorWarn: true, or status === 'experimental'), and the shipped manifest.runtime row carries no authorWarn. A negative control on the real ledger pins that, with an anti-vacuity guard: the coverage walk must SEE a live-elsewhere row (the one row carrying that status lives in manifest.json, so seeing the status proves the file was read) while authorWarnedProperties('manifest') must not contain runtime. If that row ever opts in, the pin goes red and the reviewer updates the pin — the new branch is what makes that flip safe.

Coverage, derived rather than hand-listed

The triage asked for a check that describe() covers every verdict, because patching one status leaves the next to repeat this card. Hand-listing the vocabulary in a test would go stale for exactly the reason describe() did — nobody edits the list they did not know existed — so the pin walks the shipped ledger rows (shippedLedgerStatuses(), a package-internal seam in the same posture as the existing #10262 seam: exported from the module only, re-exported by neither src/index.ts nor the package's exports map) and requires every distinct status it finds to be answered by describe() with a rule id of its own, plus asserts no two verdicts share a rule id. The vocabulary is prose in a comment, not an importable enum, so rows are the only machine-readable statement of it in this package's reach; a status with zero rows cannot reach describe() anyway, and the moment one appears, the pin names it.

live is the one member that deliberately gets no branch, and the source header already ruled it out in a sentence this PR keeps and now pins: an entry marked authorWarn: true on a live row "would be a ledger authoring mistake, not a user error". A mistake in our own shipped data is what the sentinel is for, so the pin asserts live stays loud rather than handled — matching the case the suite already carried.

Measured vocabulary: five members at packages/spec/scripts/liveness/check-liveness.mts:36 and in packages/spec/liveness/README.md. The inconclusive mentioned in triage is not a ledger status — zero hits across packages/spec/; it belongs to the skill-side vocabulary of the sibling card, which is out of scope here.

Changeset

'@objectstack/lint': minor, in .changeset/lint-liveness-live-elsewhere-rule-id.md. LIVENESS_LIVE_ELSEWHERE_PROPERTY is a new export on packages/lint/src/index.ts, the public entry, and a new public-entry export is minor under the precedent this lane applied today — #14606 took @objectstack/types: minor for three new exports. Nothing narrows, so no BREAKING banner and no ADR-0087 marker is owed; the behaviour change is an internal integrity error becoming the advisory finding it should always have been.

An earlier revision of this PR got two things wrong here and both are fixed. It declared patch, arguing from the planned verdict's own changeset; and it wrote its note to .changeset/liveness-live-elsewhere-verdict.md, a filename derived from the verdict — which is #13483's existing file on origin/main, declaring the pending @objectstack/spec: patch bump and describing the fifth verdict's gate-executable criteria and the 180-day re-attestation discipline. Writing there truncated it. That file is restored byte for byte (blob 5321f1b09, git diff origin/main on the path empty, and the re-derived three-dot change set no longer mentions it at all), and this package's note lives under its own non-colliding name.

Verification, at 168c1d7fa for the code, re-confirmed at 6d75c6462

The head moved only by the two changeset files above; the re-derived gate family is byte-identical between the two heads, so the union below carries over.

• pnpm --filter @objectstack/lint typecheck and the full package suite: 93 files, 2821 passed, 5 skipped. The new tests are genuinely in the typecheck population — tsconfig.test.json --listFiles lists lint-liveness-properties.test.ts.
• Reverse verification (ablation). Reverting only the new branch, tests untouched, turns three of the new cases red with the sentinel firing on live-elsewhere — the card's defect, reproduced: 3 failed | 65 passed. Restored: blob equality with HEAD, git diff HEAD empty, git status --porcelain empty, 68 passed. The mutation was confirmed on disk before the run (removed text 0 hits, injected marker 1 hit, blob hash changed), and the subject is a package-relative source import, so no dist indirection is in the path.
• Gate union re-derived on this tree with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (34 commands): 30 green. pnpm lint (whole repo), pnpm check:nul-bytes and pnpm check:error-status-conformance also green. On the new head, check-empty-changeset ("1 declaring changeset(s) added"), check-changeset-no-major and check-adr-0087-registration were re-run: all exit 0.
• Four gates answered exit 3 — NOT MEASURED in their own words, not green and not red: check-test-completeness, pm/check-half-states, check:dual-build-cjs-loads ("PREREQUISITE NOT MET ... this is NOT a pass: nothing was measured") and check:type-check-debt. The latter two read built output for every package; CI builds that closure before running them.
• check:doc-authoring caught a real defect in the first draft: the new tracker id sat inside the sentinel's runtime string, which reaches authors and generated surfaces that cannot resolve it. Moved to the adjacent // comment; the gate is green.

Scope

packages/spec/liveness/** and its scripts were read, never changed. The skills-lane sibling card is untouched.

🤖 Generated with Claude Code

https://claude.ai/code/session_0112hMx9hjJ9BgB28X97DS68

[github-actions]

📓 Docs Drift Check

2 anchor(s) derived from 1 changed package(s); no hand-written page names any of them. ⚠️1 changed file(s) yielded no anchor (packages/lint/src/index.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

What this run could not see

• 1 changed file(s) yielded no anchor (packages/lint/src/index.ts) — pages documenting those are invisible to this run
• 1 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 5 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 937ec142d5bb6e3f112dae2530842b1292be1cd4 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 913f571e75fbda67f34777d7051aeaa695dca7df — the merge of head 6d75c646275cbb88c980bbd3c4d06799fe68b17f into base 937ec142d5bb6e3f112dae2530842b1292be1cd4, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 913f571e75fbda67f34777d7051aeaa695dca7df && git checkout 913f571e75fbda67f34777d7051aeaa695dca7df
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 937ec142d5bb6e3f112dae2530842b1292be1cd4 6d75c646275cbb88c980bbd3c4d06799fe68b17f && git checkout -B drift-repro 937ec142d5bb6e3f112dae2530842b1292be1cd4 && git merge --no-ff 6d75c646275cbb88c980bbd3c4d06799fe68b17f
node scripts/docs-audit/affected-docs.mjs --json 937ec142d5bb6e3f112dae2530842b1292be1cd4

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

[os-musk]

Landing provenance (engine execution seat, session session_0112hMx9hjJ9BgB28X97DS68): flipped ready at 16:17Z and armed auto-merge (squash) on head 6d75c6462, the patch-round head.

• Review: ACCEPT on the card, comment 5512439181, after one patch round. Clause-② no — the new export is a semver fact, not a Clause-② fact.
• Governed-surface test on the four changed paths: 0 of 4 governed — ordinary queue landing.
• Changeset: @objectstack/lint: minor in .changeset/lint-liveness-live-elsewhere-rule-id.md, a file of its own. Liveness ledger has no verdict for keys enforced only in a sibling repo — dead misreads as deletable (manifest.runtime case) #13483's .changeset/liveness-live-elsewhere-verdict.md was restored byte-for-byte and verified empty against origin/main, so @objectstack/spec keeps its pending patch bump and the fifth verdict keeps its release note.
• Enqueue bar: every check run on 6d75c6462 completed green or skipped (36 runs read at 16:17Z, perPage: 50). Last standing was Lint & Repo Gates at 16:13:23Z, with Test Core (1/6) finishing 16:12:58Z — 17 minutes.
• Landing owed by the seat at MERGED: verify by content on origin/main that describe() carries the live-elsewhere branch with LIVENESS_LIVE_ELSEWHERE_PROPERTY and that the sentinel throw survives, strip pm:dispatched from lint-liveness-properties.ts describe() has not been taught the live-elsewhere verdict — throws by design the day such a row opts into authorWarn #14057, landing record on the card.

---

Generated by Claude Code

[os-musk]

Fixes#14057

describe() in packages/lint/src/lint-liveness-properties.ts maps ledger verdicts to author-facing findings, and throws — deliberately, per its own boundary comment — on a status it has not been taught. #13483 then shipped the ledger's fifth status, live-elsewhere (dead HERE by measurement, genuinely enforced in a sibling repo), and migrated manifest.runtime onto it. describe() was never taught it. The day any live-elsewhere row opts into authorWarn: true, os lint raises a shipped-ledger-integrity error instead of the advisory warning the author should have received.

It must never be the dead branch

This is the load-bearing constraint on the repair, and it is why the fix is a new branch rather than a widened one. Per the #11384 lesson, the verdicts imply opposite author actions, so telling an author to "Remove it" about a key whose enforcement is real and remote is exactly the wrong sentence: for manifest.runtime the enforcer is the cloud marketplace publish gate, where an unverified publisher requesting the node tier is hard-rejected, so deleting the key would tear out a live gate's input. live-elsewhere therefore gets its own rule id, its own message, and a default hint that keeps the property and points at the ledger row's evidence for the enforcer.

What changed

• A fourth branch in describe(), placed against the dead branch it must never be, with a comment saying why the adjacency is deliberate: the two verdicts are one measurement apart and opposite in what they ask of the author.
• LIVENESS_LIVE_ELSEWHERE_PROPERTY = 'liveness-live-elsewhere-property', exported beside its three siblings and re-exported from src/index.ts. Advisory-only, like them; nothing downstream keys off these ids today (measured: the only non-CHANGELOG consumers of any liveness rule id are src/index.ts, this package's tests, and one CLI test; there is no rule catalogue and no docs page listing them).
• The sentinel throw stays for genuinely unknown statuses, with its enumeration of the known ones updated — and a test pins the enumeration equal to the branches, since a stale list is how the next status gets misread.
• Two stale statements in the file's own comments corrected: it described the vocabulary as four members and quoted check-liveness.mts's header as Statuses: live | experimental | planned | dead. That header now reads live | experimental | planned | dead | live-elsewhere.

Reachability, measured

Still a fuse, not a fire. An entry reaches describe() only after shouldWarn() says yes (authorWarn: true, or status === 'experimental'), and the shipped manifest.runtime row carries no authorWarn. A negative control on the real ledger pins that, with an anti-vacuity guard: the coverage walk must SEE a live-elsewhere row (the one row carrying that status lives in manifest.json, so seeing the status proves the file was read) while authorWarnedProperties('manifest') must not contain runtime. If that row ever opts in, the pin goes red and the reviewer updates the pin — the new branch is what makes that flip safe.

Coverage, derived rather than hand-listed

The triage asked for a check that describe() covers every verdict, because patching one status leaves the next to repeat this card. Hand-listing the vocabulary in a test would go stale for exactly the reason describe() did — nobody edits the list they did not know existed — so the pin walks the shipped ledger rows (shippedLedgerStatuses(), a package-internal seam in the same posture as the existing #10262 seam: exported from the module only, re-exported by neither src/index.ts nor the package's exports map) and requires every distinct status it finds to be answered by describe() with a rule id of its own, plus asserts no two verdicts share a rule id. The vocabulary is prose in a comment, not an importable enum, so rows are the only machine-readable statement of it in this package's reach; a status with zero rows cannot reach describe() anyway, and the moment one appears, the pin names it.

live is the one member that deliberately gets no branch, and the source header already ruled it out in a sentence this PR keeps and now pins: an entry marked authorWarn: true on a live row "would be a ledger authoring mistake, not a user error". A mistake in our own shipped data is what the sentinel is for, so the pin asserts live stays loud rather than handled — matching the case the suite already carried.

Measured vocabulary: five members at packages/spec/scripts/liveness/check-liveness.mts:36 and in packages/spec/liveness/README.md. The inconclusive mentioned in triage is not a ledger status — zero hits across packages/spec/; it belongs to the skill-side vocabulary of the sibling card, which is out of scope here.

Changeset

'@objectstack/lint': minor, in .changeset/lint-liveness-live-elsewhere-rule-id.md. LIVENESS_LIVE_ELSEWHERE_PROPERTY is a new export on packages/lint/src/index.ts, the public entry, and a new public-entry export is minor under the precedent this lane applied today — #14606 took @objectstack/types: minor for three new exports. Nothing narrows, so no BREAKING banner and no ADR-0087 marker is owed; the behaviour change is an internal integrity error becoming the advisory finding it should always have been.

An earlier revision of this PR got two things wrong here and both are fixed. It declared patch, arguing from the planned verdict's own changeset; and it wrote its note to .changeset/liveness-live-elsewhere-verdict.md, a filename derived from the verdict — which is #13483's existing file on origin/main, declaring the pending @objectstack/spec: patch bump and describing the fifth verdict's gate-executable criteria and the 180-day re-attestation discipline. Writing there truncated it. That file is restored byte for byte (blob 5321f1b09, git diff origin/main on the path empty, and the re-derived three-dot change set no longer mentions it at all), and this package's note lives under its own non-colliding name.

Verification, at 168c1d7fa for the code, re-confirmed at 6d75c6462

The head moved only by the two changeset files above; the re-derived gate family is byte-identical between the two heads, so the union below carries over.

• pnpm --filter @objectstack/lint typecheck and the full package suite: 93 files, 2821 passed, 5 skipped. The new tests are genuinely in the typecheck population — tsconfig.test.json --listFiles lists lint-liveness-properties.test.ts.
• Reverse verification (ablation). Reverting only the new branch, tests untouched, turns three of the new cases red with the sentinel firing on live-elsewhere — the card's defect, reproduced: 3 failed | 65 passed. Restored: blob equality with HEAD, git diff HEAD empty, git status --porcelain empty, 68 passed. The mutation was confirmed on disk before the run (removed text 0 hits, injected marker 1 hit, blob hash changed), and the subject is a package-relative source import, so no dist indirection is in the path.
• Gate union re-derived on this tree with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (34 commands): 30 green. pnpm lint (whole repo), pnpm check:nul-bytes and pnpm check:error-status-conformance also green. On the new head, check-empty-changeset ("1 declaring changeset(s) added"), check-changeset-no-major and check-adr-0087-registration were re-run: all exit 0.
• Four gates answered exit 3 — NOT MEASURED in their own words, not green and not red: check-test-completeness, pm/check-half-states, check:dual-build-cjs-loads ("PREREQUISITE NOT MET ... this is NOT a pass: nothing was measured") and check:type-check-debt. The latter two read built output for every package; CI builds that closure before running them.
• check:doc-authoring caught a real defect in the first draft: the new tracker id sat inside the sentinel's runtime string, which reaches authors and generated surfaces that cannot resolve it. Moved to the adjacent // comment; the gate is green.

Scope

packages/spec/liveness/** and its scripts were read, never changed. The skills-lane sibling card is untouched.

🤖 Generated with Claude Code

https://claude.ai/code/session_0112hMx9hjJ9BgB28X97DS68

[github-actions]

📓 Docs Drift Check

2 anchor(s) derived from 1 changed package(s); no hand-written page names any of them. ⚠️1 changed file(s) yielded no anchor (packages/lint/src/index.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

What this run could not see

• 1 changed file(s) yielded no anchor (packages/lint/src/index.ts) — pages documenting those are invisible to this run
• 1 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 5 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 937ec142d5bb6e3f112dae2530842b1292be1cd4 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 913f571e75fbda67f34777d7051aeaa695dca7df — the merge of head 6d75c646275cbb88c980bbd3c4d06799fe68b17f into base 937ec142d5bb6e3f112dae2530842b1292be1cd4, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 913f571e75fbda67f34777d7051aeaa695dca7df && git checkout 913f571e75fbda67f34777d7051aeaa695dca7df
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 937ec142d5bb6e3f112dae2530842b1292be1cd4 6d75c646275cbb88c980bbd3c4d06799fe68b17f && git checkout -B drift-repro 937ec142d5bb6e3f112dae2530842b1292be1cd4 && git merge --no-ff 6d75c646275cbb88c980bbd3c4d06799fe68b17f
node scripts/docs-audit/affected-docs.mjs --json 937ec142d5bb6e3f112dae2530842b1292be1cd4

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

[os-musk]

Landing provenance (engine execution seat, session session_0112hMx9hjJ9BgB28X97DS68): flipped ready at 16:17Z and armed auto-merge (squash) on head 6d75c6462, the patch-round head.

• Review: ACCEPT on the card, comment 5512439181, after one patch round. Clause-② no — the new export is a semver fact, not a Clause-② fact.
• Governed-surface test on the four changed paths: 0 of 4 governed — ordinary queue landing.
• Changeset: @objectstack/lint: minor in .changeset/lint-liveness-live-elsewhere-rule-id.md, a file of its own. Liveness ledger has no verdict for keys enforced only in a sibling repo — dead misreads as deletable (manifest.runtime case) #13483's .changeset/liveness-live-elsewhere-verdict.md was restored byte-for-byte and verified empty against origin/main, so @objectstack/spec keeps its pending patch bump and the fifth verdict keeps its release note.
• Enqueue bar: every check run on 6d75c6462 completed green or skipped (36 runs read at 16:17Z, perPage: 50). Last standing was Lint & Repo Gates at 16:13:23Z, with Test Core (1/6) finishing 16:12:58Z — 17 minutes.
• Landing owed by the seat at MERGED: verify by content on origin/main that describe() carries the live-elsewhere branch with LIVENESS_LIVE_ELSEWHERE_PROPERTY and that the sentinel throw survives, strip pm:dispatched from lint-liveness-properties.ts describe() has not been taught the live-elsewhere verdict — throws by design the day such a row opts into authorWarn #14057, landing record on the card.

---

Generated by Claude Code