fix(scripts): assert an ADR number names one decision + repair a broken ADR link (#5992)

.github/workflows/lint.yml

@@ -182,7 +182,15 @@ jobs:
       # and the mechanism was simply that the edited file never mentioned them —
       # so the author could not have known. Presence check only; the invariant
       # travels in the failure message (scripts/adr-anchors.json).
-      - name: ADR anchors (governed code names its decision)
+      #
+      # Since #5992 the same script also audits the premise the anchors rest on:
+      # an ADR number names exactly ONE decision. Three numbers were each claimed
+      # by two unrelated records (0010/0019/0057) — grandfathered on an explicit
+      # shrink-only allowlist in the script, so a FOURTH collision goes red here.
+      # The `--self-test` in the pnpm script provokes that red path on synthetic
+      # directories every run, because a collision is rare enough that nobody
+      # would otherwise see the gate fail before it mattered.
+      - name: ADR anchors + number uniqueness (governed code names its decision)
         run: pnpm check:adr-anchors
 
       # #3280/#3290 org-identifier guard: `organizationId` is the blessed

docs/adr/0057-erp-authorization-core-business-units-and-scope-depth.md

@@ -2,7 +2,7 @@
 
 **Status**: Accepted in part (2026-06-21) — D1–D3/D8 implemented (scope-depth enum + evaluator, `sys_business_unit` tree, hierarchy-resolver seam, conformance rows); **D4–D7 superseded by ADR-0090 D3 / ADR-0095**: the `sys_role`/`sys_user_role`/`role_and_subordinates` vocabulary never shipped — the code realizes them as flat `sys_position`/`sys_user_position` with rollup on the BU tree. This ADR's own implementation-status table predates that supersession; read it with the rename applied.
 **Deciders**: ObjectStack Protocol Architects
-**Builds on**: [ADR-0010](./0010-metadata-protection.md) (metadata protection / object ownership),
+**Builds on**: [ADR-0010](./0010-metadata-protection-model.md) (metadata protection / object ownership),
 [ADR-0049](./0049-no-unenforced-security-properties.md) (enforce-or-remove),
 [ADR-0054](./0054-runtime-proof-for-authorable-surface.md) (runtime proof),
 [ADR-0055](./0055-master-detail-controlled-by-parent.md) (RLS reuses pre-resolved membership IN-form; **no compiler subquery**),

package.json

@@ -40,7 +40,7 @@
     "check:skill-frame-sync": "node scripts/check-skill-frame-sync.mjs --self-test && node scripts/check-skill-frame-sync.mjs",
     "check:skill-frame-freshness": "node scripts/check-skill-frame-freshness.mjs --self-test && node scripts/check-skill-frame-freshness.mjs",
     "check:skill-compatibility": "node scripts/check-skill-compatibility-version.mjs --self-test && node scripts/check-skill-compatibility-version.mjs",
-    "check:adr-anchors": "node scripts/check-adr-anchors.mjs",
+    "check:adr-anchors": "node scripts/check-adr-anchors.mjs --self-test && node scripts/check-adr-anchors.mjs",
     "check:org-identifier": "node scripts/check-org-identifier.mjs",
     "check:authz-resolver": "node scripts/check-single-authz-resolver.mjs --self-test && node scripts/check-single-authz-resolver.mjs",
     "check:slot-lookup": "node scripts/check-slot-lookup-ratchet.mjs",