docs(adr): delete the six stale line pointers left outside the #13556 fence (#19022)

Fixes #18932

Clause-②: no

Deletes the six stale line pointers that ADR-0021, ADR-0034 and ADR-0077
still carried after the #13556 class removal — six pointers across five
lines in three records. The prescription is **deletion**, not
renumbering: the ruling retired this *class* of pointer, and all six
were sampled as naming code that has nothing to do with the prose citing
them.

Note on spelling in this body: this repository's body sanitizer eats
angle-bracket-shaped fragments, so every such fragment below is written
in placeholder words. One substitution is load-bearing and is flagged
inline. The byte-exact text is the diff.

## The five sites, each judged on its own

Each pointer was removed so that the surrounding prose keeps every other
fact it was carrying — in particular the referent (a path or a symbol
name) survives at every site, so nothing needed a replacement referent.

**1. ADR-0021 line 372** — removed `, L806 + L961`; `(**two** lists)`
deliberately kept.

```
- **Registration touches 4 surfaces**, not 1: `kernel/metadata-type-schemas.ts`, `kernel/metadata-plugin.zod.ts` (enum + `DEFAULT_METADATA_TYPE_REGISTRY`, `loadOrder` LESS-THAN report/dashboard), `shared/metadata-collection.zod.ts` (`MAP_SUPPORTED_FIELDS` + `PLURAL_TO_SINGULAR`), `objectql/engine.ts` `metadataArrayKeys` (**two** lists).
```

⚠️ `LESS-THAN` above stands for a single less-than character that is
pre-existing, untouched prose. It is spelled out only to survive this
body; the file itself is unchanged there.

**2. ADR-0034 lines 42-43** — removed ` around L1811`.

```
`engine.transaction()` threads the open transaction into the driver options of
the *top-level* write via `buildDriverOptions` (`engine.ts`, which even warns
about this deadlock). But internal reads/writes performed **during**
```

**3. ADR-0034 line 57** — removed ` L561-563`.

```
  savepoint on the parent transaction (`sql-driver.ts`). The gap is
```

**4. ADR-0034 lines 59-61** — removed `L548-600` and the comma that
introduced it; the bullet keeps all four of its symbol referents.

```
- `driver-sql` already implements a **persistent, atomic sequence**
  (`SEQUENCES_TABLE` + `getNextSequenceValue` with `forUpdate` + seed-from-max).
  See "Autonumber (#1603)" below — this is mostly already solved at
  the driver level.
```

**5. ADR-0077 line 51** — removed `, ~L3217`.

```
2. **The flow path does not thread the transaction explicitly**, and ALS is fragile here: it does **not** survive `setImmediate`/deferred-promise boundaries (the documented sandbox-runner limitation in `engine.ts`). Any atomicity would be *accidental* (inline before-path only) and *untested* — not a guarantee an author may rely on.
```

## Evidence

Base for every reading below: `origin/main` = `64de4c5764` (the merge of
#18925), merged into this branch. The dispatch order was written against
`43f4766889` and predicted "4 files before, 1 after (ADR-0020
remaining)"; #18925 landed at 11:53:36Z and cleared ADR-0020, so the
correct expectation is **3 files before, 0 after**. Both the corrected
expectation and the reading below were taken first-hand on this tree.

The probe is the shared grammar's own `PATHLESS_L_CITATION` regular
expression, copied verbatim from `scripts/symbol-anchors.mjs` — the
path-less L-pin spelling (optional tilde, the letter L, two or more
digits, optional dash-range, word-boundary on both sides). It is not
re-invented here.

| leg | reading |
|---|---|
| **BEFORE** — base tree, whole `docs/adr/**` | **3 files / 6 matches**:
ADR-0021 ×2, ADR-0034 ×3, ADR-0077 ×1 |
| **AFTER** — this tree, whole `docs/adr/**` | **0 files / 0 matches** |
| **LIGHT-ON** (same probe, same run, corpora this diff never touches) |
`docs/audits/2026-08-partial-retirement-annotation-signal.md` = **6**,
`docs/launch-readiness.md` = **3** |
| **FORGED NEEDLE** | a fabricated pin reads **0** across `docs/adr/**`,
and **1** in a scratch file where it was planted with the same probe |
| **DARK** — `docs/adr/0047-object-ui-run-modes.md` | blob `b50b52863d`
on `origin/main` and `b50b52863d` in this worktree — byte-identical, not
in the diff |

The two light-on corpora and the planted needle are what make the zero a
reading rather than a non-measurement: the same probe, in the same run,
read non-zero in three named places.

### Instrument reach radius, and a known target outside it

The AFTER reading is a **zero**, so the radius is stated by form and a
known target outside it is named — both measured, not asserted.

**Inside the radius.** Content layer: the raw line text of every file
under `docs/adr/`, read line by line. Form: an optional tilde, the
letter `L`, two or more digits, an optional dash-range, with a non-word
character required on both sides. Measured, this radius is *wider* than
the gate's in two ways worth naming: an L-pin written inside a markdown
link target (the hash-L-digits form that #18925 dealt with) **is** read
— measured, 1 match on a planted sample — and so is one written inside a
code fence, which the gate deliberately skips as quoted material. So
neither of those is a valid out-of-radius target here.

**Outside the radius, by form.** The path-anchored colon spelling (a
filename, a colon, digits), the path-less colon continuation (a bare
colon and digits continuing a filename named earlier), and any
single-digit L pin. Also outside, by population: every corpus that is
not under `docs/adr/`.

**The known target.** `docs/adr/0065-sdui-styling-model.md` line 96
carries a live path-anchored colon anchor into
`packages/sdks/src/types/builder-block.ts` at line 42, tagged with the
maintainer-only exemption marker. It is in the same corpus, the same
file type and the same content layer as everything this PR measured — it
differs from the deleted pointers **only in form**. Measured on that
exact line: the L-probe reads **0**, the colon probe reads **1**. Across
`scripts/*.mjs` the same asymmetry holds at scale — 127 colon-form
targets present, the L-probe reads 0 on all 127.

⇒ The zero above is therefore a reading about the L-pin form in
`docs/adr/**`, and ⛔ not a claim that no line pointer of any spelling
remains anywhere. The colon form is judged by
`check-adr-symbol-anchors`, which is green.

**What the gate says, and why this diff is invisible to it.** The ADR
corpus declares `pathlessLineCitations: false`, so
`check-adr-symbol-anchors` never judged this spelling — before or after.
Measured: the gate-visible colon form reads **0 before and 0 after** in
all three records, and the gate is green on both trees. #18925 (already
landed) is what stopped its verdict line from *claiming* a census it had
not taken; this PR removes the pointers that claim was measured false
against. No gate script, corpus vocabulary or `pathlessLineCitations`
switch is touched here.

**Gates.** `node scripts/pm/dispatch-gates.mjs --commands --repo
objectstack-ai/objectstack` derived 18 families on the merged tree; all
18 run, all exit 0, exit codes captured before any pipe and reconciled
with `--ran`: *18 derived, 18 run, 0 NOT-MEASURED, 0 UNRUN*. One family
(`check:doc-formula-expressions`) first exited **3 — PREREQUISITE NOT
MET**, which is a refusal to measure and not a finding; after building
`@objectstack/formula` and `@objectstack/lint` as its own output
instructs, it exits 0.

**Changeset — `skip-changeset`.** Per-path reading over the 70
non-private packages that declare a `files[]`: all three diff paths are
`docs/adr/**`, none sits inside a published package directory, and none
matches any `files[]` entry. Nothing this PR changes is shipped by any
package.

## Acceptance notes

Observed while working, deliberately **not** filed and **not** fixed
here:

- The blocker the card records is confirmed present and untouched:
`docs/adr/0047-object-ui-run-modes.md` lines 48-49 carry two dev-server
ports that the shared `pathlessLineCitations` grammar would read as line
citations. That file is byte-identical here. Anyone widening the ADR
corpus vocabulary still has to settle those two first. Successor: that
future vocabulary-widening PR — it cannot avoid this file.
- `docs/audits/2026-08-partial-retirement-annotation-signal.md` (6) and
`docs/launch-readiness.md` (3) carry the same path-less L-pin shape
outside `docs/adr/**`. Whether other corpora should be swept is a
scoping question no one has asked; they are used here only as light-on
controls. Successor: none today.

## Governance

`docs/adr/**` is a governed surface. This PR stays **draft**; it is not
merged, not queued, and auto-merge is not armed. Landing waits for the
maintainer's approval.

## 维护者速读(草稿)

**改了什么** —— 三份 ADR(0021 / 0034 / 0077)的散文里删掉 6 个指向源码行号的指针,分布在 5
行上。只删数字,每句话的路径名或符号名都留着,句子读起来完整。

**为什么改** —— #13556 已经裁定「ADR 行锚点」这一类整体删除、无过渡期。#18925 清掉了 ADR-0020 与
ADR-0096 里的,这 6 个当时在那张卡申报的文件面之外,所以留了下来。这 6 个都被抽样核过,指向的是今天完全无关的代码 ——
留着它们会把读 ADR 的人(和 AI)引到错的位置。

**风险与代价(含回滚)** —— 风险很低:纯散文删字,不动任何代码、门禁脚本或开关,任何包的发布内容都没有变(所以
`skip-changeset`)。回滚就是 revert 这一个 PR,没有数据迁移、没有生成物、没有下游依赖。唯一的信息代价是读者不再能从
ADR 直接跳到某一行 —— 而那正是本次要消除的东西,因为那些行号早就指错了。

**席位意见** ——

**你要做的** —— `docs/adr/**` 是受管面,需要你本人的 approval
才能落地。请看一眼上面五处改后的整句,确认散文没有丢信息(尤其 ADR-0021 那句要保住「**two**
lists」这个事实),然后决定是否 approve。

---
_Generated by [Claude
Code](https://claude.ai/code/session_01JbZnqu8bt6YqfJsr9vaFb3)_

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-bill

docs/adr/0021-analytics-dataset-semantic-layer.md

@@ -369,7 +369,7 @@ The ADR's `DatasetSchema` / `DimensionSchema` / `MeasureSchema` are all taken: `
 
 - **Rendering is in the sibling repo `objectui`**, not here — Dashboard/Report renderers, `useReportData`, builders, the `data-objectstack` adapter. Any field change is a **two-repo change** + a `.objectui-sha` bump.
 - **`ReportSchema` (pivot) has no runtime executor** — `plugin-reports` is a separate saved-query/CSV emailer; pivoting happens entirely client-side in `useReportData.ts`.
-- **Registration touches 4 surfaces**, not 1: `kernel/metadata-type-schemas.ts`, `kernel/metadata-plugin.zod.ts` (enum + `DEFAULT_METADATA_TYPE_REGISTRY`, `loadOrder` < report/dashboard), `shared/metadata-collection.zod.ts` (`MAP_SUPPORTED_FIELDS` + `PLURAL_TO_SINGULAR`), `objectql/engine.ts` `metadataArrayKeys` (**two** lists, L806 + L961).
+- **Registration touches 4 surfaces**, not 1: `kernel/metadata-type-schemas.ts`, `kernel/metadata-plugin.zod.ts` (enum + `DEFAULT_METADATA_TYPE_REGISTRY`, `loadOrder` < report/dashboard), `shared/metadata-collection.zod.ts` (`MAP_SUPPORTED_FIELDS` + `PLURAL_TO_SINGULAR`), `objectql/engine.ts` `metadataArrayKeys` (**two** lists).
 - **Migration scope:** 7 reports (2 files) + 64 widgets (4 files; heaviest `chart-gallery.dashboard.ts` = 38) + 2 chart-views (2 files) = **8 source files, two inline shapes**. Tests to rewrite: `view.test.ts` (214) + `dashboard.test.ts` (146) + `report.test.ts` (51) + `report-service.test.ts` + `view-expand.test.ts` + 3 example integration tests. No JSON/seed instance data. JSON-schema regenerates via `pnpm gen:schema`.
 
 ### Resolved decisions (gate everything) — decided 2026-05-31 on the AI-author / human-review criterion

docs/adr/0034-transactional-writes-and-ambient-transaction.md

@@ -40,7 +40,7 @@ better-sqlite3** with a **single-connection pool** (SQLite is single-writer).
 
 `engine.transaction()` threads the open transaction into the driver options of
 the *top-level* write via `buildDriverOptions` (`engine.ts`, which even warns
-about this deadlock around L1811). But internal reads/writes performed **during**
+about this deadlock). But internal reads/writes performed **during**
 a write — FK / reference checks, hook `api` calls, any helper query — do **not**
 all reuse the transaction's connection. Such a query asks the pool for a
 connection, the pool is exhausted (the transaction holds the only one), and it
@@ -54,11 +54,11 @@ that transaction's connection.
 
 - `driver-sql` already has the right *local* pattern for nested work:
   `getNextSequenceValue` uses `runner = parentTrx ?? this.knex` and opens a
-  savepoint on the parent transaction (`sql-driver.ts` L561-563). The gap is
+  savepoint on the parent transaction (`sql-driver.ts`). The gap is
   that this discipline isn't applied *globally* to every engine→driver call.
 - `driver-sql` already implements a **persistent, atomic sequence**
-  (`SEQUENCES_TABLE` + `getNextSequenceValue` with `forUpdate` + seed-from-max,
-  L548-600). See "Autonumber (#1603)" below — this is mostly already solved at
+  (`SEQUENCES_TABLE` + `getNextSequenceValue` with `forUpdate` + seed-from-max).
+  See "Autonumber (#1603)" below — this is mostly already solved at
   the driver level.
 
 ---

docs/adr/0077-authoring-surface-boundary-hook-flow-validation.md

@@ -48,7 +48,7 @@ Sources: `packages/triggers/trigger-record-change/src/record-change-trigger.ts`
 ObjectQL has an ambient-transaction store (ADR-0034, `AsyncLocalStorage` in `objectql/src/engine.ts`). Within an unbroken async chain on the same engine, internal data ops *inherit* the open transaction. One might therefore hope a before-flow's CRUD nodes join the triggering write's transaction. They do not, for two compounding reasons:
 
 1. **Errors are swallowed before they can roll anything back.** The trigger's `try/catch` is the outermost frame around the flow; a failing flow write never propagates to the transaction boundary, so rollback is structurally impossible — independent of ALS.
-2. **The flow path does not thread the transaction explicitly**, and ALS is fragile here: it does **not** survive `setImmediate`/deferred-promise boundaries (the documented sandbox-runner limitation in `engine.ts`, ~L3217). Any atomicity would be *accidental* (inline before-path only) and *untested* — not a guarantee an author may rely on.
+2. **The flow path does not thread the transaction explicitly**, and ALS is fragile here: it does **not** survive `setImmediate`/deferred-promise boundaries (the documented sandbox-runner limitation in `engine.ts`). Any atomicity would be *accidental* (inline before-path only) and *untested* — not a guarantee an author may rely on.
 
 The net is a **silent** contract violation: an author who writes a before-flow to normalize a field or block a save gets a flow that runs, changes nothing on the triggering record, cannot stop the write, and reports success. Nothing fails; the wrong thing just quietly happens.