docs(vscode-extension): remove SUMMARY.md, which claimed a CodeQL scan this repo never ran

.changeset/5965-vscode-summary-codeql-claim.md

@@ -0,0 +1,25 @@
+---
+---
+
+Doc-only removal in the (private, unpublished) `object-ui` VSCode extension package:
+`packages/vscode-extension/SUMMARY.md` is deleted. The file asserted a security-scan
+outcome that nothing ever produced — "CodeQL扫描通过 / 无安全漏洞 / 无已知问题"
+("CodeQL scan passed / no security vulnerabilities / no known issues") — while this
+repository has never had a CodeQL workflow, default-setup or otherwise. `CONTRIBUTING.md`
+already states the opposite as the repo's canonical fact: it "does **not** run
+static-analysis security scanning of its own source code (CodeQL or equivalent)".
+
+The claim was not one line. It recurred as a release-checklist tick (`- [x] 安全扫描通过`)
+and twice in the conclusion, alongside a matching `- [x] 单元测试通过` in a package that
+carries zero test files — the document was a frozen one-off session status report
+("代码完成度: 100%", "扩展已准备好发布到VSCode Marketplace"), not living documentation.
+Nothing in the repository referenced it and it never shipped: the package is
+`private: true`, and `.vscodeignore` excludes `*.md` except `README.md`, so it was absent
+from the VSIX. Its durable reference content (commands, snippets, configuration, project
+structure) is already carried by `README.md`, `DESIGN.md`, and `PUBLISHING.md`.
+
+Also lowers two `objectui#4938` population floors in `scripts/__tests__/check-doc-links.test.ts`
+by exactly this one deletion (packages/* 12→11, combined 15→14), so they keep failing if
+the link scanner stops walking the tree.
+
+No published source, behaviour, or shipped artifact changes.

scripts/__tests__/check-doc-links.test.ts

@@ -443,7 +443,12 @@ describe('the repo it guards', () => {
  // apps/*) the day the row landed; a floor rather than an exact count for
  // the same reason as every wildcard row above — the surface is meant to
  // pick up the next file someone adds, not stay pinned to today's.
- expect(scanned['packages/*']).toBeGreaterThanOrEqual(12);
+ // objectui#5965 removed `packages/vscode-extension/SUMMARY.md` (a one-off
+ // session artifact asserting a CodeQL scan this repo never ran), taking
+ // the packages/* population from 12 to 11. The floor moves down by exactly
+ // that one deliberate deletion — it still fails if the scanner itself
+ // stops walking the tree, which is what this row guards.
+ expect(scanned['packages/*']).toBeGreaterThanOrEqual(11);
  expect(scanned['apps/*']).toBeGreaterThanOrEqual(3);
  for (const rootFile of ['AGENTS.md', 'CHANGELOG.md', 'CLAUDE.md', 'LICENSE-THIRD-PARTY.md', 'QUICK_REFERENCE.md']) {
  expect(scanned[rootFile], `${rootFile} is a SCAN_ROOTS row that opened no file`).toBe(1);
@@ -1603,7 +1608,10 @@ describe('objectui#4938 — the rest of each package/app directory', () => {
  ...(collectFiles(path.join(repoRoot, packagesRoot!.path), new Set(packagesRoot!.exclude)) as string[]),
  ...(collectFiles(path.join(repoRoot, appsRoot!.path), new Set(appsRoot!.exclude)) as string[]),
  ];
- expect(files.length).toBeGreaterThanOrEqual(15);
+ // objectui#5965 removed `packages/vscode-extension/SUMMARY.md`, so the
+ // combined population is 14 (11 + 3) rather than the 15 measured when the
+ // row landed. Still a floor, for the reasoning above.
+ expect(files.length).toBeGreaterThanOrEqual(14);
 
  let decidable = 0;
  for (const file of files) {