docs(adr): repair stale full-path citations across the ADR corpus, and date ADR-0113's pre-P0 Context (#15160)

* docs(adr): rewrite 27 moved/mis-spelled path citations to their current paths

Citation hygiene only -- no decision text is touched. Each rewritten path was
verified against full git history (the shared clone was shallow; deepened first,
because a shallow clone reports every pre-cutoff deletion as "never existed").

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012zGPuVVX3deAx9LdjK8jCk

* docs(adr): date the remaining stale path citations, and name the sibling repo

Annotates every full-path citation in docs/adr/** that does not resolve and was
not already annotated: deleted / renamed / never-shipped paths keep their
historical spelling and gain a dated Path note carrying the evidence commit;
paths that live in the sibling objectui repo take the corpus's cross-repo
`objectui:` anchor form. No decision text is changed.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012zGPuVVX3deAx9LdjK8jCk

* docs(adr): annotate the two ADR-0025 References paths the record-level note did not reach

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012zGPuVVX3deAx9LdjK8jCk

* docs(adr): date ADR-0113's two Context sites as the pre-P0 state, re-anchored by symbol

Both sites now say they describe the state at decision time (2026-07-30) and name
the storage.notNull site that superseded them, and the citation is a symbol anchor
(sql-driver.ts#createColumn) rather than a line number. No decision text changed.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012zGPuVVX3deAx9LdjK8jCk

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: claude[bot]

docs/adr/0002-environment-database-isolation.md

@@ -123,6 +123,10 @@ The migration is **non-destructive** and **idempotent**: each legacy org's datab
 
 ## References
 
+> **Path note (2026-09):** the three `packages/services/service-tenant/…` paths below are historical
+> and deliberately unlinked — the `packages/services/service-tenant/` package left this repository with the control-plane split to `objectstack-ai/cloud` (`473fce590`, 2026-05-21).
+> They are kept as written because they record where this decision landed at the time.
+
 - `packages/spec/src/cloud/environment.zod.ts` — protocol schemas
 - `packages/services/service-tenant/src/objects/sys-environment.object.ts` — merged control-plane environment object (includes DB addressing)
 - `packages/services/service-tenant/src/environment-provisioning.ts` — provisioning service

docs/adr/0003-package-as-first-class-citizen.md

@@ -191,6 +191,7 @@ The migration is non-destructive and idempotent. Steps 1–4 ship in v4.x as an
 
 - `packages/spec/src/cloud/environment-package.zod.ts` — current installation schema (to be updated)
 - `packages/services/service-tenant/src/objects/sys-package-installation.object.ts` — DB object (to be updated)
+  *(Path note, 2026-09: historical and deliberately unlinked — the `packages/services/service-tenant/` package left this repository with the control-plane split to `objectstack-ai/cloud` (`473fce590`, 2026-05-21).)*
 - ADR-0002: `docs/adr/0002-environment-database-isolation.md` — Control Plane / Data Plane split
 - Salesforce Unlocked Packages: <https://developer.salesforce.com/docs/atlas.en-us.pkg2_dev.meta/pkg2_dev/>
 - Power Platform Solution Layers: <https://learn.microsoft.com/power-platform/alm/solution-layers-alm>

docs/adr/0004-cloud-multi-kernel.md

@@ -134,4 +134,8 @@ Custom domains and multi-hostname binding (ACME certificates, `sys_domain` table
 
 - Plan: `apps-server-sleepy-newell` (the plan this ADR crystallizes).
 - Code: `packages/runtime/src/kernel-manager.ts`, `packages/runtime/src/project-kernel-factory.ts`, `packages/runtime/src/http-dispatcher.ts`, `apps/objectos/server/bootstrap.ts`, `apps/cloud/objectstack.config.ts`.
+  *(Path note, 2026-09: four of these five are historical and deliberately unlinked — the two runtime
+  paths for the reason the Path note in §2 gives (`packages/runtime/src/cloud/` was removed by #1600,
+  `60fc50186`), and `apps/objectos/` and `apps/cloud/` because both split out to `objectstack-ai/cloud`
+  on 2026-05-21 (`617016428` / `2a1fc869a`). `http-dispatcher.ts` is the only one still in this repository.)*
 - Related guide: [Cloud vs Self-Hosted deployment](../../content/docs/deployment/index.mdx).

docs/adr/0005-metadata-customization-overlay.md

@@ -25,7 +25,7 @@ Project concept entirely. As a consequence:
   `branch`. The column physically named `project_id` on `sys_metadata`
   is treated as a legacy alias and will be renamed/dropped in the
   ADR-0008 PR-10 migration.
-- All references to `this.projectId` in `packages/objectql/src/protocol.ts`
+- All references to `this.projectId` in `packages/metadata-protocol/src/protocol.ts`
   are deprecated. New code must consult `organization_id` (and, in M1,
   the branch ref) only.
 - The `(type, name, project_id)` UNIQUE index is superseded by
@@ -143,7 +143,7 @@ Three different things were tangled into one place:
 
 ### Storage shape
 
-`sys_metadata` schema (`packages/platform-objects/src/metadata/sys-metadata.object.ts`) is the storage substrate. No schema changes needed in Phase 1:
+`sys_metadata` schema (`packages/metadata-core/src/objects/sys-metadata.object.ts`) is the storage substrate. No schema changes needed in Phase 1:
 
 | column | role |
 |---|---|
@@ -194,7 +194,9 @@ Five files in `packages/platform-objects/src/metadata/` duplicate a Zod schema t
 
 `sys-metadata.object.ts` and `sys-metadata-history.object.ts` are retained — they are the storage substrate, not duplicates of any metadata type.
 
-`MetadataProjector` (`packages/metadata/src/projection/metadata-projector.ts`) becomes dead code under this ADR. It is left in place for one release as a no-op safety net, and removed in the next major along with the deprecated objects.
+`MetadataProjector` (`packages/metadata/src/projection/metadata-projector.ts` — *Path note, 2026-09:
+the module was deleted in `516f48ca9`, the same change that implemented this ADR; the name survives
+only in `packages/metadata/src/migrations/drop-projection-tables.ts`*) becomes dead code under this ADR. It is left in place for one release as a no-op safety net, and removed in the next major along with the deprecated objects.
 
 ## Consequences
 
@@ -231,7 +233,7 @@ Five files in `packages/platform-objects/src/metadata/` duplicate a Zod schema t
 
 ## References
 
-- `packages/objectql/src/protocol.ts` — `getMetaItem`, `saveMetaItem`, `deleteMetaItem`, `loadMetaFromDb` (this ADR's primary site)
+- `packages/metadata-protocol/src/protocol.ts` — `getMetaItem`, `saveMetaItem`, `deleteMetaItem`, `loadMetaFromDb` (this ADR's primary site)
 - `packages/rest/src/rest-server.ts` — `PUT/GET/DELETE /api/v1/meta/:type/:name` routes
 - `packages/spec/src/api/protocol.zod.ts` — `ObjectStackProtocol` interface (`deleteMetaItem` added)
 - `packages/spec/src/kernel/metadata-plugin.zod.ts` — `MetadataTypeRegistryEntrySchema.supportsOverlay` (future hook for the whitelist)
@@ -247,7 +249,7 @@ Two implementation issues were discovered during browser E2E verification with t
 
 ### 1. List endpoint did not include overlay rows in project kernels
 
-`getMetaItems(type)` in `packages/objectql/src/protocol.ts` was gated by
+`getMetaItems(type)` in `packages/metadata-protocol/src/protocol.ts` was gated by
 `if (this.projectId === undefined)` before consulting `sys_metadata`. Project
 kernels — which are precisely where overlays live — therefore returned only
 artifact entries. `GET /api/v1/meta/view` listed 16 artifact items and zero
@@ -315,7 +317,7 @@ change, any JSON shape was accepted and stored verbatim, surfacing as
 runtime errors only at read time when the merged effective metadata was
 fed into the UI engine.
 
-Implementation (`packages/objectql/src/protocol.ts`):
+Implementation (`packages/metadata-protocol/src/protocol.ts`):
 
 - `resolveOverlaySchema(type, item)` dispatches by metadata type:
   - `view` → `ListViewSchema` or `FormViewSchema` (picked by the `type`
@@ -359,7 +361,7 @@ types fall through, plural type strings normalize correctly.
 
 ### Registry-driven opt-in (was: hard-coded whitelist)
 
-`packages/objectql/src/protocol.ts` previously gated `PUT/DELETE
+`packages/metadata-protocol/src/protocol.ts` previously gated `PUT/DELETE
 /api/v1/meta/:type/:name` against a **hard-coded** `Set` of allowed types
 (`OVERLAY_ALLOWED_TYPES = new Set(['view', 'dashboard'])`). Any new metadata
 type that wanted to participate in the overlay system had to find and edit
@@ -453,7 +455,7 @@ idempotent migration is provided and run automatically by
 >    place: the `allowOrgOverride` boolean on its
 >    `DEFAULT_METADATA_TYPE_REGISTRY` entry.
 > 3. The **overlay validator** lives in exactly one place:
->    `resolveOverlaySchema()` in `packages/objectql/src/protocol.ts`.
+>    `resolveOverlaySchema()` in `packages/metadata-protocol/src/protocol.ts`.
 >
 > Do **not** re-declare the same shape as a `*.object.ts` (the
 > projection-table pattern is removed; see Addendum 2026-05-16 (b)).
@@ -652,7 +654,7 @@ coverage:
 
 ### Admin UX: field-level Code-vs-Effective diff
 
-The Layers tab in the metadata editor (`packages/app-shell/.../LayeredDiff.tsx`
+The Layers tab in the metadata editor (`objectui:packages/app-shell/src/views/metadata-admin/LayeredDiff.tsx`
 in `objectui`) now defaults to a **Diff** view that compares
 `layered.code` (artifact baseline) against `layered.effective` (merged)
 field-by-field. Each top-level key renders as a row with a colour-coded
@@ -680,7 +682,7 @@ the present), so this section is where the present tense lives.
 
 | Addendum (d) says | Today | Superseded by |
 |:---|:---|:---|
-| "`addSysMetadataOverlayIndex(driver)` — exported from `@objectstack/metadata/migrations`" | **Deleted.** The export and its module are gone; `packages/metadata/src/migrations/index.ts` carries a tombstone in their place that records the measurement and forbids re-introducing a producer for `idx_sys_metadata_overlay_active` in that package. | #6771 (PR #6824, merged 2026-08-08); `.changeset/overlay-index-single-producer.md` |
+| "`addSysMetadataOverlayIndex(driver)` — exported from `@objectstack/metadata/migrations`" | **Deleted.** The export and its module are gone; `packages/metadata/src/migrations/index.ts` carries a tombstone in their place that records the measurement and forbids re-introducing a producer for `idx_sys_metadata_overlay_active` in that package. | #6771 (PR #6824, merged 2026-08-08); `.changeset/overlay-index-single-producer.md` (since consumed by the release, `24c1b91e4`) |
 | "a new idempotent migration is provided and run automatically by `DatabaseLoader.ensureSchema()`" | **No overlay-index DDL is issued from that method at all**, on either of its two paths — both call sites went with the export. What `ensureSchema()` still runs is the `project_id` → `environment_id` forward migration, which is a different concern. | #6771 (PR #6824) |
 | "Drivers ignore `indexes` declarations on synced tables today" | **False** — and this one is *not* a consequence of #6771. `SqlDriver.syncDeclaredIndexes` materializes every declared index, through knex's `table.unique(fields, { indexName })` / `table.index(fields, name)`, skipping by name for idempotence. | The driver itself. The spec records the same fact where the `IDataDriver` capability bit `indexes` was retired for having no reader: "Declared indexes are materialised by the driver itself during schema sync (`SqlDriver.syncDeclaredIndexes`)". |
 
@@ -745,7 +747,7 @@ form from being re-imposed over it.
 
 ### Anchors
 
-Both files above are registered in `scripts/adr-anchors.json` against ADR-0005, so
+Both files above are registered in `scripts/adr-anchors/` against ADR-0005, so
 the next author to edit either one is told which decision they are standing on.
 That is the recurrence guard Prime Directive #13 names and the one thing this
 amendment adds beyond prose: the producer that was deleted had no anchor, and

docs/adr/0006-project-environment-split.md

@@ -177,6 +177,8 @@ The toggle is sticky per user; once on, it stays on across sessions.
    later (different semantics) when Builder UX ships. SDK consumers
    (none in production yet) must rename calls.
 3. **`apps/cloud/server/index.ts` and `worker.ts` change** their hostname
+   *(Path note, 2026-09: historical and deliberately unlinked — `apps/cloud/` split out to
+   `objectstack-ai/cloud` on 2026-05-21, `2a1fc869a`.)*
    resolution from `sys_project` to `sys_environment`.
 
 ### Neutral

docs/adr/0006-project-environment-split.v2.md

@@ -219,5 +219,7 @@ Each phase is independently shippable behind a feature flag
   §12.3 — original three-layer-model recommendation
 - `packages/services/service-tenant/src/objects/sys-project.object.ts`
   — current single-table model; relabelled in Phase 0
+  *(Path note, 2026-09: historical and deliberately unlinked — the object was renamed to
+  `sys-environment.object.ts` by `0ee839c53`, and then the `packages/services/service-tenant/` package left this repository with the control-plane split to `objectstack-ai/cloud` (`473fce590`, 2026-05-21).)*
 
 

docs/adr/0006-project-environment-split.v4.md

@@ -189,7 +189,9 @@ installed where" goes through Packages → version history → installations.
 1. `sys_package_version.published_from_project_id` (introduced in v3) is
    removed as a field — provenance lives in `sys_package_version.metadata`
    if needed.
-2. `ProjectArtifactSchema` (`packages/spec/src/cloud/project-artifact.zod.ts`)
+2. `ProjectArtifactSchema` (`packages/spec/src/cloud/project-artifact.zod.ts` — *Path note, 2026-09:
+   the follow-up rename this paragraph anticipates happened; the file is
+   `packages/spec/src/cloud/environment-artifact.zod.ts` today, renamed by `944f18758`, 2026-05-24*)
    is the envelope returned by `GET /cloud/projects/:id/artifact`. The
    route name is kept for BC; the response shape continues to wrap the
    compiled `ObjectStackDefinitionSchema`. The "Project" in the schema
@@ -202,7 +204,7 @@ installed where" goes through Packages → version history → installations.
 
 | Phase | Scope | Status |
 |:---|:---|:---|
-| **A — Drop Project from the protocol** | Remove `packages/spec/src/cloud/project.zod.ts`; update `index.ts`; trim Project tests from `environment.test.ts`; mark `sys_environment_revision` as `@deprecated transitional` | ✅ This commit |
+| **A — Drop Project from the protocol** | Remove `packages/spec/src/cloud/project.zod.ts` (since removed, as this phase prescribes — `d4eed33ab`); update `index.ts`; trim Project tests from `environment.test.ts`; mark `sys_environment_revision` as `@deprecated transitional` | ✅ This commit |
 | **B — Rewire CLI publish onto Package** | `objectstack publish` resolves implicit `sys_package`; calls `POST /cloud/packages/:id/versions`; upserts `sys_package_installation`. Old `/cloud/projects/:envId/metadata` becomes a thin BC shim that internally walks the new path. | Next |
 | **C — Split CLI commands** | `objectstack push` (version only) + `objectstack deploy` (installation upsert) + `objectstack promote` + `objectstack rollback`. `publish` stays as a `push && deploy` alias. | Next+1 |
 | **D — Remove transitional revision table** | After Phase B is shipping and verified: drop `sys_environment_revision` schema, delete `_DEPRECATED` route handlers, wipe table from any seeded control planes. | After C |

docs/adr/0007-settings-manifest-and-kv-store.md

@@ -446,6 +446,7 @@ Review existing `sys_oauth_application`, `sys_webhook`, `sys_two_factor` — kee
 
 - `packages/platform-objects/src/identity/sys-user-preference.object.ts` — original config-resolution comment
 - `packages/services/service-tenant/src/objects/sys-environment-credential.object.ts` — encrypted-creds reference impl
+  *(Path note, 2026-09: historical and deliberately unlinked — the `packages/services/service-tenant/` package left this repository with the control-plane split to `objectstack-ai/cloud` (`473fce590`, 2026-05-21).)*
 - `packages/spec/src/data/field.zod.ts` — existing field type catalogue
 - `packages/platform-objects/src/apps/setup.app.ts` — Setup app shell
 - Apple "Implementing an iOS Settings Bundle" — https://developer.apple.com/documentation/foundation/userdefaults/implementing_an_ios_settings_bundle

docs/adr/0008-metadata-repository-and-change-log.md

@@ -482,7 +482,7 @@ The plan is intentionally staged so each milestone is **independently shippable*
 - [ ] All existing tests pass; new contract suite passes for both `InMemoryRepository` and `FileSystemRepository`
 - [ ] Cold start of the [HotCRM reference app](https://github.com/objectstack-ai/hotcrm) is ≤ current baseline (no eager full-load)
 - [ ] `MetadataEvent` stream visible in `apps/studio/Logs` panel
-- [ ] No code in `packages/objectql/src/protocol.ts` reads files or imports from `@objectstack/metadata-fs`
+- [ ] No code in `packages/metadata-protocol/src/protocol.ts` reads files or imports from `@objectstack/metadata-fs`
 
 **Out of scope for M0**
 

docs/adr/0010-nl-to-flow-authoring.md

@@ -139,6 +139,8 @@ HotCRM has a placeholder `live_data` skill that grounds Copilot answers in the l
 1. Add `'flow_author'` to `sales_copilot.skills[]`.
 2. Drop the explicit cut we made when removing the in-CRM `flow_designer` draft (commit retained in branch `feat/wow-2-flow-designer-draft`).
 3. Update `content/docs/ai-copilot/live-schema.mdx` with a Wow #2 sibling page.
+   *(Path note, 2026-09: this is a HotCRM path, not a path in this repository — no file has ever
+   existed at `content/docs/ai-copilot/` here. It is kept as the record of the planned edit.)*
 
 No CRM data model changes.
 
@@ -154,3 +156,5 @@ Pending platform review. HotCRM v1 launch (W9) will ship without Wow #2 unless t
 * ADR-0003 — package-as-first-class-citizen (target for `register_flow`).
 * ADR-0008 — metadata repository + change log (provides idempotency + audit).
 * HotCRM `content/docs/ai-copilot/live-schema.mdx` — Wow #1 marketing copy that sets up Wow #2.
+  *(Path note, 2026-09: a HotCRM path, not a path in this repository — no file has ever existed at
+  `content/docs/ai-copilot/` here.)*