feat(devx): a symbol-anchor corpus over scripts/** refuses line citations in gate headers, and the free ones are migrated (#15765) (#15806)

* feat(devx): symbol-anchors gains a comment-prose doc projection and a tracked-target line-citation scope

The extractor already reads comment prose exactly as it reads an ADR
paragraph; what it also reads is the CODE around it, so a raw `.mjs`
corpus judges a gate's own self-test fixtures. `commentProse` projects a
JavaScript-shaped source down to its comment characters through the
shared `js-comment-mask` scanner, blanking rather than deleting so line
numbers survive.

`defineCorpus` grows two options, both defaulting to today's behaviour:
`docProjection` (refused loudly when present but not callable) and
`judgeUntrackedLineAnchors`, the same scope call `checkBarePaths` makes.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012zGPuVVX3deAx9LdjK8jCk

* feat(devx): register a scripts/** symbol-anchor corpus and migrate the free citations

Second `defineCorpus` registration over `scripts/**` `.mjs` comment prose,
so a cross-file `path:NNN` naming a tracked file is REFUSED under the
existing ANCHOR_GRAMMAR and symbol/file-level anchors resolve. 31 of the
32 judged citations are migrated; two files another lane's live PR holds
carry a dated allowance row that the self-test forces to be deleted the
day the citation goes.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012zGPuVVX3deAx9LdjK8jCk

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: claude[bot]

.github/workflows/lint.yml

@@ -2284,7 +2284,7 @@ jobs:
       # commands and the gate reds (3/2) — which is exactly what it did here.
       # Both existing collectors in this file carry self-tests ONLY, for the
       # same reason. Keep the sweep out of the collector block.
-      - name: ADR symbol-anchor gate self-tests
+      - name: Symbol-anchor gate self-tests
         run: |
           failed=""
           run_self_test() {
@@ -2299,16 +2299,25 @@ jobs:
           }
           run_self_test node scripts/symbol-anchors.mjs --self-test
           run_self_test node scripts/check-adr-symbol-anchors.mjs --self-test
+          run_self_test node scripts/check-scripts-symbol-anchors.mjs --self-test
           if [ -n "$failed" ]; then
             echo ""
-            echo "ADR symbol-anchor self-tests — the following FAILED:"
+            echo "Symbol-anchor self-tests — the following FAILED:"
             printf "%s" "$failed"
             exit 1
           fi
 
       - name: ADR symbol anchors resolve (no line numbers survive)
         run: node scripts/check-adr-symbol-anchors.mjs
 
+      # The SECOND corpus (#15765), and it is a `defineCorpus` registration over
+      # `scripts/**` comment prose — ⛔ not a second resolver. Its own sweep is a
+      # separate step for the same `check-step-collectors` reason stated above:
+      # a production sweep inside the collector block re-invokes the stub the
+      # harness plants and the count comes out 4/3.
+      - name: scripts/** symbol anchors resolve (no line citations on tracked targets survive)
+        run: node scripts/check-scripts-symbol-anchors.mjs
+
       # NOTE: the standing platform test checklist (docs/qa/platform-checklist/)
       # is validated by `pnpm check:platform-checklist`, but by MAINTAINER
       # DECISION it is NOT wired into CI — it runs on a periodic manual cadence

package.json

@@ -86,6 +86,7 @@
     "check:adr-anchors": "node scripts/check-adr-anchors.mjs --self-test && node scripts/check-adr-anchors.mjs",
     "check:adr-links": "node scripts/check-adr-links.mjs --self-test && node scripts/check-adr-links.mjs",
     "check:adr-symbol-anchors": "node scripts/symbol-anchors.mjs --self-test && node scripts/check-adr-symbol-anchors.mjs --self-test && node scripts/check-adr-symbol-anchors.mjs",
+    "check:scripts-symbol-anchors": "node scripts/symbol-anchors.mjs --self-test && node scripts/check-scripts-symbol-anchors.mjs --self-test && node scripts/check-scripts-symbol-anchors.mjs",
     "check:platform-checklist": "node scripts/checklist-select.mjs --self-test && node scripts/check-platform-checklist.mjs",
     "check:org-identifier": "node scripts/check-org-identifier.mjs --self-test && node scripts/check-org-identifier.mjs",
     "check:runner-env-posture": "node scripts/check-runner-env-posture.mjs --self-test && node scripts/check-runner-env-posture.mjs",

scripts/audits/14423-databaseloader-cost-probe.mjs

@@ -2,9 +2,9 @@
 // Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
 //
 // #14423 step 1 (census) — empirical confirmation that `DatabaseLoader.loadManyKeyed()`
-// costs NOTHING extra over `loadMany()` (same query, same cache — `readTypeRows()`,
-// `packages/metadata/src/loaders/database-loader.ts:936`), while a `listNames()` +
-// per-name `load()` read costs a SEPARATE query (`list()`, `:1062`) plus one query
+// costs NOTHING extra over `loadMany()` (same query, same cache —
+// `packages/metadata/src/loaders/database-loader.ts#readTypeRows`, `#list`), while
+// a `listNames()` + per-name `load()` read costs a SEPARATE query plus one query
 // PER NAME (`load()`'s `_findOne`, via `baseFilter(type,name)`) — a real N+1 against
 // `loadMany`'s single query. MEASUREMENT ONLY — ships nothing.
 

scripts/audits/14423-unbound-declarations-before-count.mjs

@@ -9,7 +9,7 @@
  * (`runActionGovernanceInventory`, `collectEngineActionDeclarations`,
  * `reconcileActionRegistrations` — all exported from its public entry) and
  * drives it exactly as `ObjectQLPlugin.runGovernanceInventory`
- * (`packages/objectql/src/plugin.ts:2475`) does, over a controlled standalone
+ * (`packages/objectql/src/plugin.ts#runGovernanceInventory`) does, over a controlled standalone
  * source that isolates the ONE population the identity fix can move:
  * standalone `action` declarations whose BODY carries no `name` (the C2/C6
  * shape) and are otherwise `type: 'script'` with no `body` and no bound

scripts/check-agent-test-spelling.mjs

@@ -80,11 +80,16 @@
  * printing. FIVE of the six are forms a naive bare-`--` selector would have RED,
  * and every one of them is correct as written:
  *
- *   .github/workflows/ci.yml:1122   pnpm turbo run test --filter=@objectstack/dogfood -- --shard=N/3
- *   .github/workflows/lint.yml:2443 pnpm dev -- --fresh   (quoted in this gate's own wiring comment)
- *   AGENTS.md:126                   pnpm dev -- --fresh -p <random>
- *   AGENTS.md:133                   pnpm dev:crm -- --fresh -p 38421
- *   AGENTS.md:388                   pnpm dev -- --fresh -p <random>
+ * ⚠️ The rows name the FILE, never a line in it. The line each sat on when this
+ * was measured is kept beside it as data, because that is a dated reading and
+ * not a pointer -- and a pointer written `file:NNN` rots silently, which is the
+ * whole finding of #15765. `--list` re-derives the live position on every run.
+ *
+ *   `.github/workflows/ci.yml`    (was line 1122)  pnpm turbo run test --filter=@objectstack/dogfood -- --shard=N/3
+ *   `.github/workflows/lint.yml`  (was line 2443)  pnpm dev -- --fresh   (quoted in this gate's own wiring comment)
+ *   `AGENTS.md`                   (was line 126)   pnpm dev -- --fresh -p <random>
+ *   `AGENTS.md`                   (was line 133)   pnpm dev:crm -- --fresh -p 38421
+ *   `AGENTS.md`                   (was line 388)   pnpm dev -- --fresh -p <random>
  *
  * The sixth is prose inside `scripts/check-examples-live-imports.mjs`, cleared
  * because its command word is a `check:` script.

scripts/check-doc-anchors.mjs

@@ -81,10 +81,14 @@
 // 200 internal fragment links across `content/**`, of which 4 pointed at
 // headings that do not exist:
 //
-//   content/docs/automation/flows.mdx:240              #notify
-//   content/docs/concepts/metadata-lifecycle.mdx:77    #overlay-whitelist
-//   content/docs/permissions/authentication.mdx:75     /docs/deployment/cli#os-login--json-is-ndjson--the-one-exception
-//   content/docs/protocol/kernel/http-protocol.mdx:764 /docs/api/client-sdk#clientdata--crud-operations
+// The FRAGMENT is the durable identifier of each row, so the file is named as a
+// file-level anchor and the line it sat on at measurement time is data beside
+// it — a dated reading, not a pointer (#15765).
+//
+//   `content/docs/automation/flows.mdx`               (was line 240)  #notify
+//   `content/docs/concepts/metadata-lifecycle.mdx`    (was line 77)   #overlay-whitelist
+//   `content/docs/permissions/authentication.mdx`     (was line 75)   /docs/deployment/cli#os-login--json-is-ndjson--the-one-exception
+//   `content/docs/protocol/kernel/http-protocol.mdx`  (was line 764)  /docs/api/client-sdk#clientdata--crud-operations
 //
 // Three of the four are the exact shape the card predicted — an anchor written
 // from the heading a reader SEES, one dash off from the heading the slugger

scripts/check-init-service-contract.mjs

@@ -788,7 +788,8 @@ function selfTest() {
     }
   `;
 
-  // 13. #4772 VERBATIM, pre-fix (`f2eb85007^`, packages/plugins/plugin-auth/src/auth-plugin.ts:346):
+  // 13. #4772 VERBATIM, pre-fix — `packages/plugins/plugin-auth/src/auth-plugin.ts`
+  //     as it stood at `f2eb85007^` (line 346 there, a dated reading, not a pointer):
   //     init() resolves the workspace-provided `cache` through `getServiceAsync`,
   //     via an optional call on a cast `ctx`, inside a best-effort try/catch, and
   //     the plugin's declarations cover `data`/`manifest`/objectql — never `cache`.

scripts/check-org-identifier.mjs

@@ -203,10 +203,13 @@
 //   ... of them wrong today ............................................ 0
 //   the same literal in the SCANNED (non-test) population ............... 0
 //
-//     packages/spec/src/data/hook.test.ts:619                   #3290 absence pin
-//     packages/plugins/plugin-audit/src/audit-writers.test.ts:1666  absence pin
-//     packages/plugins/plugin-audit/src/comment-access-hooks.test.ts:529  #9691
-//     packages/services/service-storage/src/attachment-access-hooks.test.ts:750
+//   (the file, never a line in it — the recipe above re-derives the position on
+//   every run, and a `file:NNN` pointer written here would rot silently, #15765)
+//
+//     `packages/spec/src/data/hook.test.ts`                                  #3290 absence pin
+//     `packages/plugins/plugin-audit/src/audit-writers.test.ts`              absence pin
+//     `packages/plugins/plugin-audit/src/comment-access-hooks.test.ts`       #9691
+//     `packages/services/service-storage/src/attachment-access-hooks.test.ts`
 //
 // (The recipe reports 5 matches across those 4 files: `hook.test.ts` carries a
 // second one whose `tenantId` sits inside a COMMENT in the literal's body.)

scripts/check-overlay-whitelist-table.mjs

@@ -162,9 +162,9 @@
  * ## Scope: this table only, deliberately
  *
  * Sibling pages state the same facts correctly in PROSE, not in a machine-shaped
- * type→flag table: `content/docs/permissions/authorization.mdx:236`
+ * type→flag table: `content/docs/permissions/authorization.mdx`
  * ("`permission` declares `allowOrgOverride: false`"),
- * `content/docs/automation/jobs.mdx:42` (a job-vs-flow comparison table whose
+ * `content/docs/automation/jobs.mdx` (a job-vs-flow comparison table whose
  * flag mention sits inside an English cell), `content/docs/ai/agents.mdx`,
  * `content/docs/permissions/capabilities.mdx`,
  * `content/docs/references/system/email-template.mdx`.

scripts/check-platform-checklist.mjs

@@ -46,7 +46,8 @@
 //     `use`. A recipe nobody opts into is dead text a runner may still replay.
 //     Both directions together are what the trap vocabulary beside them has
 //     always had — used implies documented, documented implies used.
-//   - every SYMBOL ANCHOR (`path/to/file.ts#symbolName`) resolves: the cited
+//   - every SYMBOL ANCHOR (`<dir>/<file>.ts#<symbol>`, the spelling
+//     `scripts/symbol-anchors.mjs#ANCHOR_GRAMMAR` defines) resolves: the cited
 //     file is in the tree and the cited symbol is still in it, comments masked
 //     — a symbol surviving only in a docblock is ABSENT. A shrink-never floor
 //     per family file keeps the population from being emptied one deleted