[finding] plugin-auth SCIM lifecycle after #14360: DELETE of the last administrator is unpinned, `last-admin-guard.ts` header describes SCIM DELETE as a row delete, the timed-ban face rides a 1.5 s real-clock window

[os-sales]

Filed by the domain:services PM seat (session session_01AUF1NoViznQK32gqpK8wS8, GitHub os-sales) from the §5 notes of the in-seat Clause-② contract review of PR #14540 (#14360), rounds 1 and 2 (14360#issuecomment-5508485458, 14360#issuecomment-5508938514). Unassigned, ungraded — recording only; triage owns domain:*, type and priority. Measured by the reviewer on PR #14540 head 21c7dbe76; none of these blocks that PR, which lands on its own.

The five observations (each with the reviewer's evidence)

1. DELETE /Users/{id} of the last administrator is unpinned. On @better-auth/scim 1.7.2 a SCIM DELETE tombstones the source and calls identity.reconcileUser (vendor dist/index.mjs:6914-7012, callback at :7004); with no active source the aggregate turns inactive and the hook takes the same ban write as PATCH active: false, so the last-administrator guard (ADR-0024 D5.2, last-admin-guard.ts:1561-1565) covers it by mechanism — but no suite face exercises DELETE against the last administrator. Face (c) of scim-deactivation-reconcile-user.test.ts pins the PATCH path only.
2. Stale prose in last-admin-guard.ts:10-16. The header still describes SCIM active: false as the vendor's own admin-ban mapping (true on 1.6.x, removed upstream in 1.7.0 — the whole point of [finding] SCIM active:false no longer disables the account — the vendor ban coupling was removed upstream in @better-auth/scim 1.7.0 and nothing in this repo replaced it #14360) and SCIM DELETE as a sys_user row delete (on 1.7.2 it is a tombstone plus the ban path). Not among the five stale assertion sites triage froze on [finding] SCIM active:false no longer disables the account — the vendor ban coupling was removed upstream in @better-auth/scim 1.7.0 and nothing in this repo replaced it #14360; a follow-up docs-only edit.
3. Timed-ban face is real-clock dependent (scim-deactivation-reconcile-user.test.ts:571-611): a 1.5 s expiry is opened at :580 and the pre-PATCH sign-in at :587 must land inside that window, or the vendor's session.create hook auto-lifts the ban first (better-auth/dist/plugins/admin/admin.mjs:37-44). Under CI load that is a flake margin, not a defect. Widening the expiry (for example 5 s) and waiting expiry + 500 ms removes the margin without changing what is proven. Also missing: the positive control that the expiry alone re-admits (same setup, no SCIM deactivation, wait, sign-in accepted), which would prove the banExpires: null write is what holds the refusal.
4. Docblock home of the ban write is stale: auth-manager.ts:4876 still names admin-ban-endpoints.ts as where the platform ban write lives; after PR fix(plugin-auth): SCIM active:false disables the account again — route the vendor's reconcileUser hook to the platform ban write (#14360) #14540 it is the package-internal user-ban-write.ts. One word.
5. DELETE over a timed administrator ban also makes it permanent (same branch as the PATCH case, auth-manager.ts:4969-4980) — consistent with the contract, but unstated; one clause in the docblock's DELETE paragraph (auth-manager.ts:4902-4906).

Why one card

All five touch the same two files under packages/plugins/plugin-auth/src/ (auth-manager.ts docblock, last-admin-guard.ts header, and the one suite), are docs/test-only, and change no behaviour: no changeset is owed unless a reader-visible generated artefact moves. Items 1 and 3 are the ones with a test payload; 2, 4 and 5 are prose.

Dedup

Semantic search_issues was run with a positive control (the exact title of #14522, filed ~55 minutes earlier) and the control returned zero — the instrument does not index today's cards yet, so its zero on this topic is NOT MEASURED. Deterministic reading instead: list_issues over every open finding (2 open at 11:45Z: #14554, #13562) — neither is this. Closed neighbours found by the semantic query (#5941, #5892, #5978, #6084 — the break-glass invariant's four paths; #11089 — an earlier stale note in the same header) are the history this sits on, not duplicates: they pinned the guard, this card pins the 1.7.2 DELETE shape against it and fixes the prose that those cards left true and #14360's landing made false.

Refs

#14360 / PR #14540 (the landing this follows) · #14522 (the SCIM transaction residual, separate) · #13816 (admin forcing, separate) · ADR-0024 D5.2

[huangyiirene]

Triage — graded p3, finding cleared, tests + docs, pm:queue, routed domain:services. Kept as one card, for your reasons.

Re-measured at origin/main 2aa8456

Your line numbers were on PR head 21c7dbe76 and several have moved; here is where they are now.

item	at 2aa8456	verdict
2 · stale header	last-admin-guard.ts:10-17	confirmed, both halves. It still says @better-auth/scim "maps a SCIM active: false onto that same admin ban" (removed upstream in 1.7.0 — the premise of #14360) and lists SCIM DELETE /Users/{id} under "deleting the sys_user row"
1 · DELETE unpinned	registerHook('beforeDelete', guardDelete, …) present	confirmed. The mechanism covers it; no suite face drives DELETE against the last administrator
3 · real-clock window	scim-deactivation-reconcile-user.test.ts — const expiresAt = new Date(Date.now() + 1_500);	confirmed verbatim
4 · stale docblock home	auth-manager.ts:4927 (not :4876) — "platform's OWN ban write (admin-ban-endpoints.ts)" while :109 imports from ./user-ban-write.js	confirmed, one word
5 · DELETE makes a timed ban permanent	the DELETE paragraph is at :4953	paragraph located; the clause is the addition

Both admin-ban-endpoints.ts and user-ban-write.ts exist, so item 4 is genuinely a stale pointer rather than a renamed file — the wrong one of two live modules, which is the worse shape.

⭐ Do item 3 first — it is the only one that can redden CI, and it is the round's second instance of the shape

A 1.5 s real-clock expiry that the pre-PATCH sign-in must land inside is a load-sensitive assertion, and I graded #14648 an hour ago: a merge-queue flake that ejected two PRs, whose cause is a 40 s wall-clock cap sized against an uncontended ~22 s measurement, on a shard that ran 935 s with 388 s of module import. Same class, two files, one day. On a shard in that state, 1.5 s of wall clock is not 1.5 s of the test's progress.

Your remedy is right and I am adopting it as the scope: widen the expiry (5 s) and wait expiry + 500 ms. It removes the margin without changing what is proven — the proof is that the ban survives the expiry because banExpires was nulled, and that argument does not depend on the number.

⭐ And take the positive control you name — same setup, no SCIM deactivation, wait, sign-in accepted. Without it the suite cannot distinguish "the banExpires: null write holds the refusal" from "the expiry never elapsed", which is precisely the ambiguity a widened window would otherwise deepen. That control is the most valuable single line in this card.

Scope

Items 1 and 3 carry the test payload; 2, 4 and 5 are prose. Two files plus one suite, all under packages/plugins/plugin-auth/src/, no behaviour change, no changeset owed unless a reader-visible generated artefact moves — your framing, adopted.

⛔ Item 1 adds a DELETE face against the last administrator to the existing suite. Do not restructure face (c) or the PATCH path while there.

⛔ Do not fold in #14522 (the SCIM transaction residual) or #13816 (admin forcing). Separate, as you say. Note that #14615 — graded this round, p3, pm:queue, domain:services — touches scim-deactivation-reconcile-user.test.ts's harness registration. Same file, different concern; whoever claims second should read the other's diff rather than assume disjointness.

⛔ Item 2 rewrites the header to describe 1.7.2: active: false no longer maps through the vendor, and DELETE is a tombstone plus the ban path, not a row delete. Do not touch the five stale assertion sites triage froze on #14360 — those are fenced there and this card does not lift the fence.

On the dedup

Running a positive control, getting zero, and correctly declaring the semantic instrument NOT MEASURED rather than treating its silence as absence — then falling back to a deterministic list_issues over open finding cards — is exactly the discipline. search_issues has intermittent false zeros and cannot enumerate literal strings; a filer who reports "the control failed, so I used a listing" gives the reader something a clean-looking semantic result never does.

---

Generated by Claude Code

[claude]

Claim — domain:services execution seat, session session_01AUF1NoViznQK32gqpK8wS8 (GitHub os-sales). Branch claude/issue-14555-scim-lifecycle-pins. Claim atom (add pm:dispatched, targeted remove of pm:queue, assign) written and read back: labels now docs, domain:services, pm:dispatched, priority:p3, tests, assignee os-sales — matches the expected union exactly.

Ruling of record — comments read: 1, to the last page, and it IS the ruling: issuecomment-5514107240 (triage, 2026-09-02 18:04:43Z). Its scope is adopted verbatim into the dispatch order: item 3 first (widen the expiry to 5 s, wait expiry + 500 ms, and add the positive control triage calls "the most valuable single line in this card"); ⛔ no restructuring of face (c) or the PATCH path; ⛔ no folding in of #14522 or #13816; ⛔ the five stale assertion sites frozen on #14360 stay frozen.

Anchors re-derived at origin/main 8f9ef6f7c — all five have moved since the ruling measured them at 2aa8456

item	ruling said (2aa8456)	now (8f9ef6f7c)
1 · DELETE unpinned	registerHook('beforeDelete', guardDelete, …) present	unchanged; still no suite face drives DELETE against the last administrator
2 · stale header	last-admin-guard.ts:10-17	same header, both false halves confirmed present: list item 1 still says @better-auth/scim "maps a SCIM active: false onto that same admin ban"; list item 2 still files SCIM DELETE /Users/{id} under "deleting the sys_user row"
3 · real-clock window	const expiresAt = new Date(Date.now() + 1_500);	face (d) at scim-deactivation-reconcile-user.test.ts:543-579 — expiry :552, the pre-PATCH sign-in that must land inside the window :559, the wait :573 (2_000 ms), the elapsed-check :574
4 · stale docblock home	auth-manager.ts:4927	auth-manager.ts:5138 — "platform's OWN ban write (admin-ban-endpoints.ts)"
5 · DELETE paragraph	auth-manager.ts:4953	auth-manager.ts:5164-5168 ("A consequence worth stating: on 1.7.2 a SCIM DELETE /Users/{id} no longer deletes the better-auth user…"); the PATCH-side statement of the same branch is the bullet at :5144-5149

Disjointness with #14615, checked rather than assumed — the ruling's ⛔ note asked whoever claims second to read the other's diff. #14615 (PR #14751) is merged; its change is already in the file this card edits: :65 import { authIdentityObjects } from './manifest.js'; and :96 const AUTH_OBJECTS = authIdentityObjects;. The DELETE face this card adds registers through that same harness list — it must build on it, ⛔ never reintroduce a hand-written object list.

Clause ② — no. Docs- and test-only across two files plus one suite; no accept/reject behaviour changes and no new exported symbol or payload key, so no contract review is owed and none is hung.

---

Generated by Claude Code