docs(qa): re-point the eight stale platform-checklist anchors at what the files declare now (#23651)

Fixes #23593
Clause-②: no

## What

`pnpm check:platform-checklist` was red on `main` (`42718df38`) with
exactly the 8 problems the watchdog card lists, in three area files.
Each cited symbol was removed by a refactor. For each one this PR read
the item's steps against `main`, then moved the citation to the code
that holds the behaviour now. Where the behaviour itself had moved, the
item was re-authored. Nothing under `packages/**`,
`scripts/symbol-anchors.mjs` or
`scripts/checklist-symbol-anchor-baseline.json` changes, and no floor is
lowered.

| Problem line | Where the symbol went | Disposition |
|:--|:--|:--|
| `access-security.json`:
`protocol.ts#anonymousFormIntakeOrgScopeRefusal` (x1) | deleted by
`b389e4355` (PR #22515, ADR-0131 D6 stage S4) | item
`access-security.public-form-withdrawal-layers` **re-authored**,
revision 1 to 2 |
| `access-security.json`: `protocol.ts#anonymousFormIntakeReopenRefusal`
(x2) | deleted by `b389e4355`: every organization-scoped write is now
refused by `organizationScopedWriteRefusal` | same item; the write-door
citation now names `organizationScopedWriteRefusal` |
| `access-security.json`: `protocol.ts#envWideRawViewRows` (x2) |
deleted by `b389e4355` | same item; the list the doors read now names
`getMetaItems`, and the package-less stand-in names
`servedViewExpansion` |
| `attachments-storage.json`: `attachment-access-hooks.ts#canEdit` |
removed by `ce3d0ad41` (PR #22513): the gate reads the tri-state
`checkEdit` through one composition | **re-pointed** to
`#mayEditParent`, revision 5 to 6 |
| `attachments-storage.json`: floor 27 of 28 | the lost anchor above |
**28 of 28** again |
| `search.json`: `protocol.ts#countable` | deleted by `55382dc02` (PR
#22857): a paged search now counts its total | clause 2 of
`search.rls-both-personas` **re-authored**, anchor `#findData`, revision
6 to 7 |

## Why the public-form item is re-authored, not re-pointed

Every clause of revision 1 composed a withdrawal against an
**organization overlay**. ADR-0131 retired that layer:

- the `/meta` doors hand the protocol no organization (PR #22447);
- the protocol refuses every organization-scoped write, and `b389e4355`
deleted the three symbols the item anchored;
- the `sys_metadata` family declares no organization column (PR #23469);
- the anonymous doors read the environment alone (C7).

So revision 1's steps 4 to 10 PUT saves that now land environment-wide.
Its clauses 0, 1 and 3 describe a layer that can no longer be written. A
re-point by name alone would have kept those clauses reading as live.

Revision 2 keeps the capability the id names: a withdrawal that no other
layer re-opens. It states that capability on the layers `main` has.

- **Stock, end to end (oracle `api`).** It follows the dogfood pin,
which the ADR-0131 PRs had already re-authored. An organization-active
administrator's save is environment-wide, and its withdrawal closes both
doors. The open control lands in the organization.
- **Package layers (oracle `test`, no stock fixture).** These are one
item per package of a view name in the environment's list, a package's
shipped `false`, and the package-less copy as the switch. They are
scored from the `rest`, `metadata-protocol` and `metadata-core` pins
that replaced the deleted cases.
- The clause "a withdrawal in any package's body closes the form in
every package" is new as a clause. Revision 1 deliberately left two
packages of one name unscored while #21934 was open, and #21934 has
since landed.
- **The ruled known limit** of revision 1 (an overlay stored before the
withdrawal) has no stage left to occur on. It is recorded in `knownGaps`
as retired, not as a gap.

The alternative, retiring the item, was weighed and not taken (see the
report on the card). It would drop checklist coverage of rules that are
live and pinned on `main`.

## Verification (head `b7774745e`, which merges `origin/main`
`c5dd7fce3`)

- `pnpm check:platform-checklist` **exit 0**. The verdict line, trimmed:
`check-platform-checklist: OK — 16 areas, 279 items (274 active, 1
planned); … symbol anchors: 732/742 resolved by symbol-anchors.mjs … 10
on the named #16898 residual, 18 file floors held`. On the base it
exited 1 with the 8 problems.
- Anchor census (`--anchor-census`), base to head:
`access-security.json` 62 to 69 (floor 44), `attachments-storage.json`
27 to 28 (floor 28), `search.json` 17 to 18 (floor 14).
- Derived gates (`dispatch-gates --commands --repo
objectstack-ai/objectstack`, change set from the merge base): 13
derived, and each was run with its exit captured before any pipe. All 13
exit 0. `--ran` reports 13 run, 0 NOT-MEASURED, 0 UNRUN.
- The first run of `check:doc-formula-expressions` exited 3
(PREREQUISITE NOT MET: the `formula` and `lint` dist were not built). It
was rebuilt under the verify lock and re-run: exit 0.
- **The pins the re-authored clauses cite were run at this head**, each
case name confirmed in the verbose output:
  - `metadata-core` `anonymous-form-intake.test.ts`: 46 passed;
- `metadata-protocol` `protocol.org-scoped-write-refused.test.ts`: 297
passed;
- `rest` `public-form-withdrawal.test.ts` with
`list-search-total-door.test.ts`: 33 passed.
- NOT MEASURED:
`showcase-public-form-withdrawal-layers.dogfood.test.ts`. Reason: its
closure is the full showcase boot, and `main`'s full battery runs it.
Its three cases were read at this head, and the item's end-to-end
clauses follow them.
- No package is touched, so there is no build closure or package suite
to run for this diff. `docs/qa/**` ships in no package's `files[]`, so
there is no changeset, and this PR takes `skip-changeset`.

## Acceptance notes

- `content/docs/ui/public-data-collection.mdx` section 4 still describes
the anonymous doors as reading the Default Organization's legacy copy,
including its "Known limit: legacy copies". `rest-server.ts`
`registerFormEndpoints` and the pin `[ADR-0131 C7] no view read names an
organization, whatever the tenancy answers: one environment read per
door` say that read was deleted. This is docs drift and is not filed: no
public door returns a wrong answer from it. The re-authored item's
`source` entry says so. Carrier: none.
- `attachments-storage.attach-requires-parent-edit` has no clause for
the limb PR #22513 added: an abstaining parent is judged by its master's
write check (`controlled_by_parent`). This is a coverage observation for
a later `checklist-author` sweep, not a defect. Carrier: none.
- Why this kept recurring, and a proposal for a pre-merge signal that is
not a new CI gate: in the report on the card.

---
_Generated by [Claude
Code](https://claude.ai/code/session_01ESFcvW3staenyBCGq7kcDH)_

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]