docs-only: backlink #8323's measured cross-tenant oracle from R11's (`unique/unscoped-declared-index`) doc comment

[hotlong]

Follow-through from the #8379 closure (maintainer ruling A, 2026-08-13: closed as already-satisfied). Filed by the triage seat as the accepted optional half of that ruling.

What

Add a one-line backlink in the doc comment of lintUnscopedDeclaredIndexes (rule unique/unscoped-declared-index, R11, packages/lint/src/data-model-rules.ts) pointing at #8323's end-to-end measurement of the cross-tenant 409-vs-201 oracle — the concrete harm the rule's warning exists to prevent.

Why

#8379 existed because part 3 of the #8323 ruling was written without knowing R11 already delivered its substance — the connection between the rule and the measured oracle lived nowhere in the tree. A one-line backlink makes the next sweep/ruling find R11 instead of re-deriving (or re-mandating) it. The #8379 dev report's evidence index is the source map.

Scope

• One doc-comment line. No rule logic, no tier, no message text, no verdict change.
• skip-changeset (docs-only, not user-visible).

Size: S, mechanical. Related: #8379 (closed, the ruling) · #8323 (the measurement) · #5082 (the v18 endgame R11 backlinks already).

Filed unassigned by the triage seat Routine.

[qq9340100]

Claimed by the domain:devx execution PM seat (#6023).

• session: session_01Jqe56GnYFddggeAyfkZFVz
• branch: claude/issue-8584-r11-oracle-backlink
• worktree: ../objectstack-8584 (dedicated)
• domain: domain:devx · container/model: os-dev / sonnet — mechanical floor, one doc-comment line, no judgment call in it
• file surface: packages/lint/src/data-model-rules.ts (the lintUnscopedDeclaredIndexes doc comment only)
• serial constraints: ⚠️ declared, not cleared. packages/lint/** is a hot surface: another seat's PR feat(objectql,runtime,lint): tighten views: to the container-only contract; assembled manifests travel non-container view artifacts in viewItems: #8572 (domain:spec's [3 of #7891] Flip the registration: runtimeTypes gains object + permission/book — whole rule families cross the publish door #8310 lane) touches lint, and this lane's check-i18n-bundles merge mode never updates an EXISTING field description, so editing one leaves the en bundle silently stale (and the gate green) #8543 is in flight across packages/spec + packages/cli + regenerated bundles. Neither is known to touch data-model-rules.ts, but "known to" is doing real work in that sentence — the dev re-checks at branch time and says so if the file has moved.

⛔ Scope is one line of doc comment. No rule logic, no tier, no message text, no verdict change, skip-changeset.

---

Generated by Claude Code

[qq9340100]

os-dev-report

{
  "issue": 8584,
  "status": "done",
  "branch": "claude/issue-8584-r11-oracle-backlink",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/8598",
  "premise_still_valid": true,
  "summary": "Added one line to the doc comment of lintUnscopedDeclaredIndexes (rule unique/unscoped-declared-index, R11, ADR-0120 D5a, packages/lint/src/data-model-rules.ts): a backlink to #8323's end-to-end measurement of the cross-tenant 409-vs-201 oracle. No rule logic, tier, message text, or verdict changed. Draft PR #8598 opened against main, labeled skip-changeset (docs-only, not user-visible).",
  "tests": "Serial constraint checked at branch time: `git log --oneline -- packages/lint/src/data-model-rules.ts` on origin/main shows the file untouched since #8253 (unrelated lychee-retry fix); PR #8572's file list (fetched via pull_request_read) touches validate-view-containers.ts/engine.ts/packages/runtime, never data-model-rules.ts; the objectstack-8543 worktree's `git diff --stat origin/main` also does not touch this file. No collision. Gate derivation: `node scripts/pm/dispatch-gates.mjs packages/lint/src/data-model-rules.ts` named check:cross-package-test-inputs (lint.yml + ci.yml matches on packages/lint/src/**); both ran green (`pnpm check:cross-package-test-inputs`: 12/12 self-test cases + 9 packages OK). Also ran check:nul-bytes per the AGENTS.md 'any edit' rule (OK, 7740 files scanned) and the named-caution check:type-check-coverage (OK — 64/77 packages, non-event as expected for a comment-only change). Dependency closure built first: `pnpm --workspace-concurrency=2 --filter '@objectstack/lint^...' build` (spec+formula, green). Then `pnpm --filter '@objectstack/lint' test -- --maxWorkers=2`: 72 test files, 2013 passed, 4 skipped, 0 failed. `pnpm --filter '@objectstack/lint' typecheck`: clean, no output. All commands wrapped in `flock -w 7200 /tmp/os-heavy-verify.lock` with NODE_OPTIONS=--max-old-space-size=4096.",
  "open_questions": [],
  "out_of_scope_findings": []
}

The exact line added (between the "17.x: warning..." tier paragraph and the "Wiring:..." paragraph, as its own one-line JSDoc paragraph — a distinct sentence from the tier/wiring topics either side of it, not appended to either):

 * Concrete harm: #8323 measured the cross-tenant 409-vs-201 oracle end to end.

Verified against #8323's evidence (via the #8379 dev report's evidence index, plus re-reading #8323's own body directly rather than paraphrasing the title): #8323 §1 measured, end-to-end via the REST API with real cross-org sessions, that a POST colliding with another tenant's invisible row on sys_capability returns 409 UNIQUE_VIOLATION while a GET for the same value returns total 0 — the 409-vs-201 oracle. §2 shows the same shape on sys_user_preference. §Cause names uniqueIndexesFromFields producing a single-column global index for the bare/unique: true spelling — exactly the declared-index shape R11 (lintUnscopedDeclaredIndexes) warns on, per the #8379 dev report's evidence-index row "The advisory already ships, publish-time" → packages/lint/src/data-model-rules.ts / lintUnscopedDeclaredIndexes. So the line names the correct measurement and the correct issue.

Serial-constraint check result: cleared, no collision — details above under tests.

Gate families derived and run: check:cross-package-test-inputs (from node scripts/pm/dispatch-gates.mjs, matched via packages/lint/src/** in both lint.yml and ci.yml) — green. Plus check:nul-bytes (AGENTS.md's unconditional "any edit" clause) — green — and check:type-check-coverage (the prompt's named caution) — green, non-event as expected.

skip-changeset label read back: PR #8598 carried bot-applied size/xs at write time; applied the union ["size/xs", "skip-changeset"] via a whole-set write, then re-read the PR — confirmed labels are ["size/xs", "skip-changeset"].

Draft PR: #8598, head SHA cc9ae869b752b2397bb26cc5dcd51ec35a02c382, base main, draft: true.

---

Generated by Claude Code

---

Generated by Claude Code