check:adr-anchors is red on every PR: the namespace tombstone cites ADR-0006 D4, which no revision of ADR-0006 records

[hotlong]

Since PR #12736 merged (2026-08-28), check:adr-anchors exits 1 on EVERY PR: the namespace tombstone message in packages/spec/src/data/object.zod.ts cites "ADR-0006 D4", and ADR-0006 — which declared no decision letters when the citation was written — now declares a real letter index (D1, D1.1–D1.3, D2, D3) with no D4, flipping the soft cannot-verify into a hard failing assertion. Discovered during #12867 (its dev proved the red pre-exists that branch byte-identically; escalation recorded on #12786, comment 5450025028).

Measured facts (2026-08-28, origin/main):

• The failing citation is the namespace tombstone string: "namespace was retired in ADR-0006 D4 — the object name IS the canonical id everywhere…" (also cites 未知键静默剥离仍是全仓默认:把 #3405 的 strict 收紧从一个 schema 推广到整个可授权面(ADR-0078 完整性闸门) #4001 for closing the parse path).
• No revision of ADR-0006 (v1–v4) records retiring the object-schema namespace key at all: every namespace hit in the v4 file is about code-identity tables or the SDK method namespace. So this is not a simple D4→v4 respell — the cited provenance appears to be wrong, not just misindexed.
• Impact: the gate is advisory (not in the six required contexts) but red on every PR, so every lane's every-check-green enqueue discipline now needs a manual disposition per PR until fixed. Three draft PRs parked for the ADR-0006 D2 coordinated window (ADR-0006 D2 (SDK half): rename client.projects.* to client.environments.*, unwrap keys follow the wire, JSDoc names the endpoint (#12866) #12885, docs(adr): retire ADR-0006 D1 by execution — the three retained-project surfaces are renamed (#12867) #12908, cloud#1692) hit it at enqueue time — tracked as a window blocker on epic ADR-0006 D2 execution carrier (SDK half): rename client.projects.* → client.environments.* + wire unwrap shapes + JSDoc — parked until the next SDK/protocol breaking major #12865's checklist.

Fix shape (for the spec seat — this file is packages/spec territory): locate the true provenance of the namespace-key retirement (an ADR that actually records it, or the retirement PR/issue) and respell the citation; if no record exists, drop the ADR reference from the tombstone and keep the concrete #4001 pointer. ⛔ Do NOT mint an ADR-0006 D4 to green the gate — manufacturing a decision letter to satisfy a checker is the defect class the gate exists to catch (#12867's dev declined exactly this).

Refs: #12786 (the broad letters audit finding this regression escalates), PR #12736 (the merge that armed the assertion), epic #12865 (consumer of the fix at its landing window).

[hotlong]

Claim: PM loop round 4 (maintainer direct-dispatch channel; epic #12865's landing is the named consumer)
Authorization, verbatim from the maintainer's batched ruling in live PM chat, 2026-08-28: 「1 同意 2 不挂 major 3 可以 4 推」 — item 1 approves dispatching this card and #12881 from this seat (cross-lane, recorded rationale: mechanical fixes with written specs, unblocking every PR's gate reads).
Session: session_65d2faee-1ff4-4be8-be28-72b972c539d9
Branch: claude/issue-12910-namespace-tombstone-provenance
Worktree: objectstack-issue-12910
Domain: domain:spec territory (guidance prose in packages/spec) — dispatched via the direct channel above; triage may still label
File surface: packages/spec/src/data/object.zod.ts (the namespace tombstone string only), plus whatever spec test pins that string, plus a scripts/adr-anchors baseline for that file if the gate keeps one (stop on breach; explain in the report)
Container & model: S-mechanical-plus-provenance, mode:subagent, model: fable (packages/spec/src path limb — dispatched AT the contract-review tier so the clause-② enqueue gate is satisfied by tier)
Clause-②: no
(Error-message prose only; accept/reject behavior and the public surface are unchanged. The fable tier is for the path limb's enqueue discipline, not because the content limb fires.)
Serial constraints cleared: PR #12946 touches only scripts/adr-anchors/packages__types__src__thrown-http-error.ts.json — a different file's baseline, region-disjoint. No open PR touches object.zod.ts or the tombstone (re-derived this dispatch across all open PRs).

[hotlong]

os-dev-report

Session session_65d2faee-1ff4-4be8-be28-72b972c539d9 · branch claude/issue-12910-namespace-tombstone-provenance (local worktree only — never pushed; see deviations).

{
  "issue": 12910,
  "status": "done",
  "branch": "claude/issue-12910-namespace-tombstone-provenance",
  "pr": null,
  "premise_still_valid": false,
  "summary": "Premise dead on arrival: the exact prescribed fix already landed as PR #12917 (commit 750fff559, merged 2026-08-28T09:18:16Z — about 3.5h before this 12:57Z dispatch claim). That one-line respell dropped the phantom ADR-0006 D4 citation from the namespace tombstone in packages/spec/src/data/object.zod.ts while keeping the #4001 pointer and the upgrade prescription (embed the prefix: sys_user), plus a patch changeset — exactly the fix shape this card prescribed, including declining to mint a D4. Issue #12910 itself was closed by os-zhuang at 10:30:53Z, before this dispatch; the PM claim at 12:57Z landed on an already-closed card (reporting the anomaly, not re-adjudicating it). Verified on fresh origin/main @ 15d55fb24: both check:adr-anchors legs exit 0. Two residual phantom ADR-0006 D4 spellings DO remain on main — packages/spec/src/system/translation.zod.ts line 362 (tombstone message, a different file, outside my declared surface) and the packages/spec/src/data/object.test.ts line 1573 pin-test title (inside my declared surface) — but both are off the gate's anchored letter-validation surface (the letter check runs only on files with scripts/adr-anchors baselines, which is why the original red named exactly 1 file), and both are already recorded verbatim on open finding #12918 item 2 as deliberately left by #12917, with the recorded plan: write the actual retirement decision into an ADR first, then restore/respell those citations. Editing them now would contradict that recorded disposition, so I made zero edits.",
  "tests": "On fresh origin/main @ 15d55fb24, exits captured before any pipe (cmd redirected to file, then EXIT read from dollar-question, then tail): (1) node scripts/check-adr-anchors.mjs --self-test — EXIT=0, gate's own verdict line: 'check-adr-anchors --self-test: 106 assertions over the real auditAdrDirectory() / auditCitedNumbers() / assembleAnchors() paths.' (2) node scripts/check-adr-anchors.mjs (live) — EXIT=0, verdict line: 'check-adr-anchors: OK (52 anchored file(s), every governing ADR still referenced; 126 decision number(s), each naming one decision or an allowlisted pair; 29855 citation(s) across 3783 file(s) resolve; 880 decision-letter citation(s) on the anchored surface name a decision the record makes).' Cross-checks: git grep of the phantom citation shows zero hits in object.zod.ts (only the two known residual spellings plus CHANGELOG history and the #12917 changeset prose); scripts/adr-anchors/packages__spec__src__data__object.zod.ts.json records only ADR-0120 (no ADR-0006 entry), consistent with #12917 needing no baseline regeneration. Zero files changed, so dispatch-gates.mjs derivation is vacuous and no spec test/typecheck is owed.",
  "mcp_calls": "0 — every GitHub read and this write went via local gh REST (repo-scoped REST probe succeeded on this seat); no MCP GitHub calls at all",
  "gates": {
    "check:adr-anchors --self-test": "EXIT=0 (106/106) on origin/main @ 15d55fb24",
    "check:adr-anchors (live scan)": "EXIT=0 (OK line quoted in tests) on origin/main @ 15d55fb24",
    "dispatch-gates.mjs derivation": "vacuous — zero changed files",
    "spec tests/typecheck": "not owed — zero changed files"
  },
  "files_changed": [],
  "deviations": [
    "No PR and no branch push: the premise was falsified before the first edit (already fixed on main via PR #12917), and a premise_still_valid=false report with no PR is the prescribed first-class deliverable; pushing an orphan empty branch for a closed, already-fixed card would only leave clutter. The empty-branch write probe was therefore skipped as moot — the write path is proven by this very comment instead.",
    "The card was already CLOSED (10:30:53Z, by os-zhuang) when the 12:57Z dispatch claim landed on it — another actor's state, reported here rather than corrected.",
    "The in-surface residual (object.test.ts:1573 test title still naming the phantom letter) was deliberately NOT edited: open finding #12918 item 2 records it as intentionally left pending the ADR being written, and overriding a recorded live disposition is not this seat's call.",
    "pnpm install was never run in the worktree — check-adr-anchors.mjs is dependency-free node, so both legs ran without it; worktree removed cleanly after this report."
  ],
  "open_questions": [],
  "out_of_scope_findings": [
    "none newly filed — the two residual phantom ADR-0006 D4 spellings (translation.zod.ts:362 and the object.test.ts:1573 title) were dedup-checked this dispatch and are already recorded on open finding #12918 item 2, together with the write-the-ADR-first plan; filing again would duplicate a live card"
  ]
}

Generated by Claude Code

[hotlong]

PM correction (public, same card): this seat claimed and dispatched this card at 12:57Z without re-reading its state — it had been FIXED (PR #12917, merged 09:18Z) and CLOSED (10:30Z) hours earlier. The claim-time state re-read that the dispatch protocol requires was skipped in a batch-execution rush; the dispatched dev correctly falsified the premise with zero edits (see the os-dev-report above). Retracting the claim artifacts now: assignee and pm:dispatched label removed. The residual phantom spellings are already tracked on #12918 with a recorded write-the-ADR-first plan — no new work needed.