management/analysis/findings/F-012-orphaned-sha-references.md

F-012: Six commit references in the docs resolve nowhere, and nothing would have caught it

category: doc-drift confidence: high

evidence:

• All SHA-shaped tokens in the 40 management documents were resolved against every ref of all six repos and against the rewrite mapping (analysis/scripts/inv_shas.py -> analysis/data/sha_refs.tsv): 22 resolve, 6 do not.
• The six, with their nature established individually:
  • hosts/cfgmon.md:54 dfe04c4a and verfahren/deploy-uebergabe.md:84 dfe04c4 — a commit pushed directly to Gitea and overwritten by the mirror. Unresolvable by design; the surrounding text documents the loss ("vom Mirror überschrieben").
  • verfahren/deploy-uebergabe.md:85 and verfahren/aar/2026-08-01-cve-pipeline-gitops47.md:13 2b715ca — same class, the second documented overwrite ("2b715ca→0bd77e2").
  • hosts/overmind.md:23 7645a2b — a commit in the vendor/windows repo, which the human placed out of scope; not resolvable here, not a defect.
  • hosts/overmind.md:87 5bc25447 — not a commit at all but a container image tag ("Tags 5bc25447 + stable"); a false positive of the extractor, recorded as such.
• So of six, four are intentional records of lost commits and two are out-of-scope or mis-typed as commits. No accidental orphan was found — and that is the finding worth keeping: the mapping list did its job (F-015).
• What no mechanism provides: none of this was checkable before this session wrote a script for it. analysis/data/links.tsv covers markdown link targets and reports 2 broken links in 11,390 (both malformed upstream Element changelog entries), but a SHA in prose is not a link and was never checked.

impact: Low today, structurally high. The repo cites commits as evidence throughout — it is the house style, and a good one (README.md:68-70, "woher stammt die Aussage?"). That style depends on citations staying resolvable across exactly the kind of history operation this project performed on 2026-08-07, and the only thing that kept it working was a document someone remembered to write by hand.

root-cause pattern: Evidence-by-citation without a checker. The convention is sound and followed; its integrity rests on human diligence at rewrite time.

neckbeard mechanism: Gap in neckbeard. scripts/validate.py checks link integrity in two places — check_links for frontmatter link fields and check_body_links for inline markdown links, erroring with "inline link target missing" — and schema.yaml:19-20 extends body-link checking to root-level prose via link_only: ["*.md"]. Commit SHAs cited in prose are outside both. Given AGENTS.md:101-103 ("Deterministic jobs … are done by scripts … If a deterministic job lacks a script, propose one"), resolving a cited SHA is a textbook deterministic job — git cat-file -e — and its absence is a real hole for any project whose docs cite commits. analysis/scripts/inv_shas.py is a working reference implementation.