Merge remote-tracking branch 'origin/main' into claude/issue-21464-s-kanban-cf

Author: claude

.changeset/spec-test-surface-dead-citation-anchors.md

@@ -0,0 +1,16 @@
+---
+'@objectstack/spec': patch
+---
+
+Two provenance comments that tests read literally were re-anchored
+
+Clause-②: no
+
+The removal note on `DATA_ACTION_TO_API_OPERATION` in `src/data/api-derivation.ts` and the
+explanatory block about `ApiKeySchema` in `src/identity/identity.zod.ts` cited tracker numbers
+that no longer resolve on GitHub. Each now opens with the commit in this repository's history
+that decided the matter: 6968885ef removed the producer-less `batch: 'bulk'` alias row, and
+2c86fe3ea deleted `ApiKeySchema` on the maintainer's ruling. The unit tests that read those two
+comments moved with them, and the same re-anchoring was applied to the comments in the
+package's test files, which do not ship. Comments only: no type, schema, export or runtime
+behaviour changes.

packages/spec/src/api/export-job-family-retirement.test.ts

@@ -21,8 +21,8 @@ import { MIGRATIONS_BY_MAJOR, RETIRED_DEFS_BY_MAJOR } from '../migrations/regist
 // (`contracts/export-service.ts`) and `ScheduleExportInput` leave the public
 // surface, and `ScheduleState` (`automation/execution.zod.ts`) goes with them
 // unless a live consumer is measured. Landing route A (decision batch #221
-// item 2): objectui retired its side first (objectui#10247, merged as objectui
-// PR #10264), and the pinned `.objectui-sha` already descends from that merge.
+// item 2): objectui retired its side first (objectui#10247, merged as
+// objectui PR #10264), and the pinned `.objectui-sha` already descends from that merge.
 // Scope note: the export-job LIST pair (`ListExportJobsRequestSchema` with its
 // `limit` / `cursor`, and its response) is in, absorbing #19543 door ②; the
 // import-job family in the same module is served and is NOT in.

packages/spec/src/api/protocol.test.ts

@@ -1805,7 +1805,7 @@ describe('PublishMetaItemRequestSchema mirrors the implementation parameter type
   // `@objectstack/metadata-protocol` — `{ type, name, organizationId?,
   // actor?, message?, packageId? }` — and the REST door's actual reads;
   // nothing else is declared because nothing else is enforced.
-  // As in the #9726/#9741 blocks above, accept-pins assert the parsed VALUE:
+  // As in the #9726 / commit 2a29caa53 blocks above, accept-pins assert the parsed VALUE:
   // this is a non-strict object, so `success` alone is exactly the
   // silent-strip state this family of cards closes.
 
@@ -1935,9 +1935,9 @@ describe('AuditMetaItemRequestSchema mirrors the implementation parameter type (
   // implementation's parameter type in `@objectstack/metadata-protocol` —
   // `{ type, name, organizationId?: string | null, limit?: number }` — and the
   // REST door's actual sends; nothing else is declared because nothing else is
-  // enforced. As in the #9726/#9741/#11006 blocks above, accept-pins assert
-  // the parsed VALUE: this is a non-strict object, so `success` alone is
-  // exactly the silent-strip state this family of cards closes.
+  // enforced. As in the #9726 / commit 2a29caa53 / commit cccbe51bf blocks above,
+  // accept-pins assert the parsed VALUE: this is a non-strict object, so
+  // `success` alone is exactly the silent-strip state this family of cards closes.
 
   const base = { type: 'view', name: 'account_list' } as const;
 

packages/spec/src/api/rest-api-config-dead-keys-retirement.test.ts

@@ -249,8 +249,8 @@ describe('rest_api retirement — ADR-0087 registration', () => {
     expect(entry!.surface).toBe('restServer.api.responseFormat / restServer.api.documentation.enabled');
     expect(entry!.replacement).toContain('`api.enableOpenApi`');
     // Plugin TS configuration has no stored or stack source for a conversion to
-    // rewrite — the #14691 / `openApi31` shape. A conversion id naming either
-    // key would be a strip with nothing to strip.
+    // rewrite — the `RestServerConfig` retirement (commit b3a63d32c) / `openApi31`
+    // shape. A conversion id naming either key would be a strip with nothing to strip.
     expect(step.conversionIds.filter((id) => /response-format|documentation-enabled/.test(id))).toEqual([]);
   });
 

packages/spec/src/automation/control-flow.test.ts

@@ -412,7 +412,7 @@ describe('TryCatchErrorValueSchema', () => {
     expect(TryCatchErrorValueSchema.safeParse({ nodeId: 'guard', message: 'x', iteration: 1.5 }).success).toBe(false);
   });
 
-  // #14954 — `code` (#14419): the engine binds the failing node's
+  // #14954 — `code` (commit c5a7448d5): the engine binds the failing node's
   // platform-classified error code beside `nodeId` / `message`, so a catch
   // region can DISCRIMINATE ("the row is already there" vs "the store is
   // down") by branching on `$error.code` instead of parsing `message`. This

packages/spec/src/automation/schedule-organization.test.ts

@@ -8,7 +8,7 @@ import {
   resolveScheduleOrganization,
 } from './schedule-organization.zod';
 
-// [#16659] The declaration side of the acting-organization ruling. Two
+// [commit ecdfc9411] The declaration side of the acting-organization ruling. Two
 // consumers read this module and they must not be able to disagree about what
 // counts as DECLARED: the automation engine lifts the value onto the trigger
 // binding (`resolveTriggerBinding`), and both time triggers refuse a binding

packages/spec/src/automation/sync-retirement.test.ts

@@ -217,7 +217,7 @@ describe('[#4738] sync/conflict dual-source retirement', () => {
     }
     // Anti-vacuity: the ui namespace we just probed is real and non-trivial —
     // otherwise a broken import would satisfy the three absences above.
-    // (`ThemeSchema` was the probe until #10485 retired it — ADR-0049.)
+    // (`ThemeSchema` was the probe until commit 35ad101bc retired it — ADR-0049.)
     expect('PageSchema' in ui).toBe(true);
   });
 

packages/spec/src/automation/webhook.test.ts

@@ -276,10 +276,10 @@ describe('unknown keys are rejected, not stripped (#4001 batch 11)', () => {
   });
 
   /**
-   * [#6362] The measurement that card asked for, kept as a pin.
+   * [commit b5404f496] The measurement that commit took in the same pass, kept as a pin.
    *
-   * #6362 fixed `connector`, which TOLERATED the stamped envelope and then
-   * stripped it — success with silent data loss — and asked whether `webhook`
+   * Commit b5404f496 fixed `connector`, which TOLERATED the stamped envelope and then
+   * stripped it — success with silent data loss — and measured whether `webhook`
    * had the same drop. It does not: `WebhookSchema` has carried
    * `...MetadataProtectionFields` since #4001 batch 11, and all SEVEN keys
    * survive the round-trip. No spread was added here; this pin is what makes

packages/spec/src/compose-stacks-action-echo.test.ts

@@ -17,7 +17,7 @@
  * three stacks binding b1/b2/b3 to one object, override / merge
  *                                        : shared.actions=["emb3/EMB","b3/BOUND","b1/BOUND","b2/BOUND","b3/BOUND"]
  * defineStack(composeStacks([a, b]))     : REFUSED  'a_item:dup_x' is declared 3 times
- * defineStack(a)   (a lone built input)  : REFUSED  'a_item:dup_x' is declared twice   ← #14686's landed pin
+ * defineStack(a)   (a lone built input)  : REFUSED  'a_item:dup_x' is declared twice   ← commit 279431e7a's landed pin
  * ```
  *
  * The three-stack `merge` row above is a refusal since #14848: `'merge'` no
@@ -31,7 +31,7 @@
  * the very same object as an entry of `object.actions` is that a previous merge
  * put it there. A strict parse produces fresh objects, so a hand-written twin —
  * the same action authored in both positions — never shares identity, and
- * #14686's same-key refusal, which runs before the merge, still refuses it. A
+ * commit 279431e7a's same-key refusal, which runs before the merge, still refuses it. A
  * marker key cannot do this job: `ActionSchema` is a strict object, so the key
  * is refused before it could travel (measured below).
  *
@@ -197,7 +197,7 @@ describe('composeStacks - what the identity skip does NOT fold', () => {
 
   it('under strict: false, ONE action object placed in both positions is one declaration — carried once (before: twice)', () => {
     // No parse clones it, so it shares identity exactly as a build's echo does.
-    // #14686's walk does not run in this mode by the author's choice, and the
+    // Commit 279431e7a's walk does not run in this mode by the author's choice, and the
     // runtime dedupes a standalone against an embedded entry by key anyway.
     const shared = act('sh', { objectName: 'n_item' });
     const out = defineStack({ manifest: mf('com.example.n'), objects: [obj('n_item', [shared])], actions: [shared] }, { strict: false });

packages/spec/src/compose-stacks-action-key-collision.test.ts

@@ -1,6 +1,6 @@
 /**
  * `composeStacks` refuses two INPUT STACKS whose action declarations resolve
- * to one scope-qualified runtime key — and only those (#14662).
+ * to one scope-qualified runtime key — and only those (commit 35dffeace).
  *
  * `defineStack` refuses the same collision within one stack
  * (`stack-duplicate-action-key.test.ts`); the runtime keys a composed artifact