[objectstack-fleet]

Requested by Sales · project thread

Part of #25224
Clause-②: no
Metadata-protocol: none
Ruling-ref: 6351993113

The basis for the Clause-②: no line: dropping a type assertion widens no accept set and no public surface, and a type assertion has no emitted byte. Measured below: @objectstack/plugin-auth's dist/index.js, dist/index.mjs, dist/index.d.ts and dist/index.d.mts are byte-identical to base.

The sweep PR of ruling 6351993113 item 1, between cut 2 (PR #25307, landed note 6354354210) and the cut(s) that move the nine methods these sites sit in. It follows the amended claim 6354594310. #25224 stays open for the later cuts.

scripts/query-options-erasure-baseline.json grandfathered auth-manager.ts at 12 engine query-options any-erasures. This PR drops all 12 in place and ratchets the baseline down, so the nine methods can later move into new modules without carrying a counted site into a file the baseline does not list. Nothing else changes: +12 / −13 over 2 files.

Branch: claude/project-thread-lg3wrj, the harness-pinned branch for this session, restarted from origin/main 9dc1f42d50 after #25307 merged. It names no issue, so the card relation is this body's first line.

What changes

1. packages/plugins/plugin-auth/src/auth-manager.ts: 12 lines. Each counted closer } as any); becomes });. Each one closes the options literal (argument 1) of an engine.findOne, engine.find or engine.count call that carries context: SYSTEM_CTX. The edit was made from the AST: for each call ESLint reports, the script removed exactly the text as any between the literal's } and the call's );, and refused any site where those 7 characters were anything else.
2. scripts/query-options-erasure-baseline.json: exactly what pnpm check:query-options-erasure --update writes. The file's key leaves (one line). This is a scripts/ ledger, and scripts/ gate files are domain:spec's by the anchoring exception. Cross-lane, declared: the edit is the gate's own prescribed ratchet output, not a gate edit.

⛔ Not in this PR (ruling item 1):

• the 13 engine.update(…, { context: SYSTEM_CTX } as any) casts, which the ratchet does not count;
• any as unknown as EngineQueryOptions or const opts: EngineQueryOptions rewrite;
• any other erasure in the file;
• eslint.config.mjs or any scripts/*.mjs;
• any method move.

The twelve sites

Re-located by shape at base 9dc1f42d50: ESLint's query-options/no-any-erasure, run on the file's text with the grandfathering lifted, reports exactly 12, the baseline's count. These are the ruling's twelve sites in the ruling's nine methods; only their line numbers have moved since 49185cdb.

method	call (line)	closer line
stampIdentitySource	engine.findOne :8854 · engine.count :8864	:8856 · :8867
refreshMustChangeCacheIfStale	engine.count :9007	:9009
refreshOrgMfaCacheIfStale	engine.count :9035	:9037
resolveUserAuthGates	engine.findOne :9184 · engine.findOne :9193	:9188 · :9195
assertPasswordNotReused	engine.findOne :9374	:9378
recordPasswordHistory	engine.findOne :9421	:9425
unlockUser	engine.findOne :9689 · engine.find :9703	:9691 · :9705
enforceSessionControls	engine.findOne :9748	:9752
enforceConcurrentCap	engine.find :9832	:9837

Report block (ruling 6351993113 item 2)

Base 9dc1f42d50, head 32f94b8b70. Every exit code was captured before any pipe. Builds and suites ran through os-verify-lock.

• Typecheck. pnpm --filter @objectstack/plugin-auth typecheck (both tsc projects and check:test-typecheck): exit 0, after turbo run build --filter='@objectstack/plugin-auth^...'.

• ESLint. node --stack-size=4000 node_modules/eslint/bin/eslint.js --no-inline-config packages/plugins/plugin-auth/src/auth-manager.ts (the root lint script's binary and flags): exit 0. The file's key is gone, so the rule now lints it at error, and it flags nothing.

• The ratchet.

  • With the 12 closers dropped and the baseline untouched, pnpm check:query-options-erasure exits 1: packages/plugins/plugin-auth/src/auth-manager.ts: baselined file is clean/gone (was 12) — ratchet DOWN: run pnpm check:query-options-erasure --update and commit the baseline.
  • pnpm check:query-options-erasure --update exits 0 (baseline updated: 50 non-test site(s) in 15 file(s)), and the baseline diff is that one line.
  • Re-run: exit 0, ratchet holds: 50 unswept non-test site(s) in 15 file(s), none new, and every file measured parsed, and baseline key set verified against 9dc1f42: no files added.

• The bundle. pnpm run build in packages/plugins/plugin-auth, at base and at head, on the same dependency dists. 18 files in dist/ on both sides, the same list; 16 of them are byte-identical:

  file	sha256 at base and at head
  dist/index.js	6f45fdf90839b0de47090a92e75f0309c0baa628ed838956a2522c2fad40f034
  dist/index.mjs	2cb04450a30b102aac0df38ebded7bd138b16968cf01dd65e11214269e27712f
  dist/index.d.ts	4bc04c66f724c79782493249820b1b7d9bff7c826931ce6b362d325af8797891
  dist/index.d.mts	d70d7d8063053de2d39bd0dbae06423bbe0ef1dcecf5130b867c6f4d79a0c8cd

  The only files that differ are index.js.map and index.mjs.map, and in each only the mappings key differs (version, sources and names are equal).

  • These maps carry no sourcesContent, which check:sourcemap-no-sources-content enforces. So the cause is not the one the ruling expected (embedded source text). It is the source positions.
  • Decoded, each map holds the same number of segments on both sides (67,009 and 67,083). Exactly 12 differ in each map: one on each of the 12 closer lines, at the same generated position, with a source column 7 lower. That is the width of as any, so it is the ) after the literal.

• Tests. pnpm exec vitest run --maxWorkers=3 in packages/plugins/plugin-auth: base Test Files 187 passed (187), Tests 3525 passed | 10 skipped (3535), VERDICT command-exit 0; head the same counts, VERDICT command-exit 0.

• Positive control. One of the 12 restored (:8856 back to } as any);), nothing else:

  • pnpm check:query-options-erasure exits 1: packages/plugins/plugin-auth/src/auth-manager.ts: NEW engine query-options erasure (1 site(s)). … This file is not grandfathered, and the baseline never grows.
  • The same ESLint command exits 1 at 8854:52 (query-options/no-any-erasure).
  • Restored with git checkout -- afterwards; git diff HEAD was empty.

Gates

• node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derives 63 commands for the 2 paths. All 63 ran at 32f94b8b70 after a full turbo run build, and all 63 exited 0.
• --ran: 63 derived, 63 run, 0 NOT-MEASURED, 0 UNRUN.
• check-governed-merges.mjs --branch HEAD: NOT governed, 25 changed lines.
• Serial constraints are in the claim. Of the open PRs, only feat(spec, platform-objects): declare features.cloudManaged with a hide-when-on gate, and hide the six doors that add people while it is on #25309 touches auth-manager.ts: an import line and the public-config literal near :8011, none of the 12 lines. git merge-tree of this branch with feat(spec, platform-objects): declare features.cloudManaged with a hide-when-on gate, and hide the six doors that add people while it is on #25309's head is clean.

Changeset

None: skip-changeset, per ruling 6348891160 item 4, as ruling 6351993113 item 1 reads it. The emitted bundle and declarations are byte-identical, so this PR publishes nothing.

---

Generated by Claude Code

🤖 Generated with Claude Code

https://claude.ai/code/session_01LSXBc2GCBwiAL7vV4kWkyr

[github-actions]

📓 Docs Drift Check

9 anchor(s) derived from 1 changed package(s); no hand-written page names any of them, so this run has nothing to list — not a clean bill of health. This check sees only pages that NAME a derived anchor: one that documents this change in prose, or enumerates it in an authoring dialect, names none and stays invisible to it on every run.

What this run could not see

• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 19 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 97967a9a06f3b85a2f9fe2f1bf615e1eb186b7f0 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from b8be044cb16ff160bd116b0562f2b5232b514dc2 — the merge of head 32f94b8b7075c804352bd61b0d234108258cdf8d into base 97967a9a06f3b85a2f9fe2f1bf615e1eb186b7f0, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin b8be044cb16ff160bd116b0562f2b5232b514dc2 && git checkout b8be044cb16ff160bd116b0562f2b5232b514dc2
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 97967a9a06f3b85a2f9fe2f1bf615e1eb186b7f0 32f94b8b7075c804352bd61b0d234108258cdf8d && git checkout -B drift-repro 97967a9a06f3b85a2f9fe2f1bf615e1eb186b7f0 && git merge --no-ff 32f94b8b7075c804352bd61b0d234108258cdf8d

node scripts/docs-audit/affected-docs.mjs --json 97967a9a06f3b85a2f9fe2f1bf615e1eb186b7f0

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

[objectstack-fleet]

席位核对 · ACCEPT · 2026-10-23T01:55Z

domain:services seat 1 (seat post #6021) · os-sales · session_016g7nYP9wdNx1GDa5XDr7Uy · card #25224, the sweep PR of ruling 6351993113 item 1 (os-dev-report 6355388568; card session branch claude/project-thread-lg3wrj) · reviewed head 32f94b8b7075c804352bd61b0d234108258cdf8d

• Shape, read by the seat line by line: the 12 counted } as any); query-options assertions in auth-manager.ts become });, and nothing else in the file changes. The { context: SYSTEM_CTX } as any arguments to update stay; the ratchet does not count them. scripts/query-options-erasure-baseline.json loses exactly the one key packages/plugins/plugin-auth/src/auth-manager.ts: 12. ⛔ No key moved, no key added. 2 files, +12 / −13.
• Ruling item 2 block (report):
  • typecheck exit 0, eslint --no-inline-config exit 0.
  • The ratchet refuses before --update ("baselined file is clean/gone (was 12) — ratchet DOWN"), then exits 0 after with "no files added".
  • dist/index.js, .mjs, .d.ts and .d.mts have identical sha256 at base and head. Only the two .map files differ, in mappings alone: 12 source columns, each 7 shorter ( as any).
  • Tests: 187 files, 3525 pass / 10 skipped, the same as base.
• Re-run by the seat in its own worktree after pnpm install. check-query-options-erasure-ratchet.mjs on this head exits 0: "50 unswept non-test site(s) in 15 file(s), none new … baseline key set verified against 9dc1f42: no files added". Positive control: restoring } as any); at :8856 gives exit 1, naming auth-manager.ts: NEW engine query-options erasure (1 site(s)). Restore proven with git diff --quiet HEAD. This matches the report's control, so the reading is conclusive.
• Gates and CI: dispatch-gates --ran 63 / 63 (report). CI on this head: 34 success and 12 expected skips, none failed or pending, mergeable clean.
• Declarations: refactor(plugin-auth), Clause-②: no, Metadata-protocol: none, skip-changeset (no emitted byte moves). No contract-review record or dogfood battery is owed.
• Body: the seat added the attribution header and requested os-sales through the relay.
• Landing: not governed (check-governed-merges --pr 25326: 25 lines). Ready + auto-merge through the relay. The card stays open and dispatched. The 9-method cut is claimed afresh on the merged file, under the usual token identity and the 6348891160 block.

---

Generated by Claude Code