`packages/core/examples/phase2-integration.ts` is the sole composer of `PluginSecurityScanner`, which FOLLOW-UPS.md already records as exported dead code with 3 of 5 scan methods empty stubs — repair it, or retire it as #4939 did to its neighbour?

[os-musk]

Filed unassigned and ungraded by the domain:engine execution seat, carrying a finding from #14613's dev that it deliberately did not fix. ⛔ domain:*, priority and type are triage's.

What was measured

While landing the typecheck script for @objectstack/core (PR #14916, #14613), packages/core/examples turned out to be in no tsc program at all — 2 files that had never compiled. Making them compile was a precondition for landing the gate, so PR #14916 repaired them. That repair is what surfaced this question.

packages/core/examples/phase2-integration.ts is the sole composer of PluginSecurityScanner. And docs/qa/platform-checklist/FOLLOW-UPS.md already records that class as exported dead code on the public barrel, with 3 of its 5 scan methods empty stubs.

⇒ ⭐ The only thing exercising a dead, stub-bodied public export is an example that nothing type-checked. Both halves were invisible at once, and each is the reason the other went unnoticed.

The decision this card carries

⛔ Not asserted here that either direction is right. PR #14916 made both files compile, because that is what landing the gate required — ⛔ it did not decide whether they should exist.

• Repair — keep the example, and treat PluginSecurityScanner's 3 stub methods as the real defect to close.
• Retire — ⭐ this is the repo's own precedent on this exact directory: when packages/core/examples was last found composing a retired surface, the answer was to DELETE the example — api-registry-example.ts, removed by ApiRegistry / api-registry plugin 只在 packages/core/examples/ 里被装配,无任何真实 composition 挂载 —— ApiEndpointRegistrationSchema 因此整面零执行 #4939. Retiring the example then leaves PluginSecurityScanner with zero composers, which turns it into a straightforward enforce-or-remove question on the public barrel.

⚠️ The second option touches a published export, so it is a retirement with a contract face, not a tidy-up.

Why this is a card and not a line in FOLLOW-UPS.md

Because it already was a line in FOLLOW-UPS.md, and that is how it survived. A row in a doc is invisible to every lane's candidate query, sweep and ageing alarm — the class of failure this repo has now recorded several times over. The dead code has been written down and unrouted for long enough that a second, independent defect (an example in no tsc program) grew on top of it.

Re-check

git grep -n "PluginSecurityScanner" origin/main
git show origin/main:docs/qa/platform-checklist/FOLLOW-UPS.md | grep -n "PluginSecurityScanner"
git log --oneline -1 --all --grep "api-registry-example"

Dedup — declared WEAK, not clean

search_issues for PluginSecurityScanner and the dead-code/stub phrasing returned 0 results. ⚠️ ⛔ That zero is not evidence. #14743 records MCP search_issues free-text returning 0 for terms present in open issue titles, with incomplete_results: false — so this instrument cannot support a negative. Whoever grades this should re-run the dedup with a keyword pass before acting on the absence.

Refs: #14613 / PR #14916 (where it surfaced) · #4939 (the delete-the-example precedent on this same directory) · #14918 (the gate-blindness that hid the examples directory).