fix(plugin-auth): seed managed-extension-fields' source scan from __dirname, retiring the package's only TS1470 (TEST_DEBT 110 -> 109)

[os-warren]

Fixes#9694

packages/plugins/plugin-auth/src/managed-extension-fields.test.ts seeded its
repo-wide *.object.ts scan from dirname(fileURLToPath(import.meta.url)).
plugin-auth is CJS-typed (no "type": "module"; it publishes dist/index.js as
CommonJS), so under module: NodeNext that line is a TS1470 — the package's only
one, frozen in a shrink-only TEST_DEBT ledger entry.

All numbers below were measured on this branch; none were copied from the card.

The seed: __dirname, not the card's findUp idiom — and why

The card and its triage both prescribe the package's findUp idiom
(member-role-canonical.test.ts:65-80). That would have broken
check:cross-package-test-inputs, and this PR does not do it. The evidence,
measured rather than argued:

check:cross-package-test-inputs finds escaping tests by scanning source text,
and recognises exactly two directory seeds: dirname(fileURLToPath(import.meta.url))
and __dirname. A findUp walk from process.cwd() is not one of them, so a
file seeded that way has no statically-visible radius at all. Enumerated on the
base ref, managed-extension-fields.test.ts is the ONLY test in plugin-auth
the gate can see escaping — it alone holds the package's declared radius
(packages/** object files + packages/core/src/security/**) and the matching
turbo.json#test inputs.

Counterfactual, run with the card's prescribed findUp idiom in place:

FAIL: cross-package test inputs are not declared consistently.
- @objectstack/plugin-auth declares a cross-package input radius, but no test in it reads outside
the package any more. Delete the entry (and its turbo.json inputs) — a stale
declaration invalidates that package's test cache for nothing.

Deleting that entry is exactly the wrong repair: the file really does walk every
*.object.ts in the monorepo, so dropping the turbo inputs would put the sweep
back in #7802's blind spot — turbo replaying a cached green for a diff that
changed another package's object file.

__dirname satisfies both constraints at once: it is TS1470-free under this
package's own CJS config, it is defined at runtime by vitest's transform, and it
is one of the two seeds the gate recognises. This is not a new invention — it is
the choice packages/platform-objects/src/managed-api-method-affordance-sweep.test.ts:95-113
already made for the sibling repo-wide object walk, for these same two reasons,
written out there in full. The comment added here points at it.

After the change the gate still sees the file, and stays green:

OK: 12 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob.

with findEscapingPackages() still reporting
packages/plugins/plugin-auth/src/managed-extension-fields.test.ts for
@objectstack/plugin-auth — the same single entry as before the change.

The now-unused fileURLToPath and dirname imports are removed (noUnusedLocals
is on, so leaving them would have traded one error for another).

The ledger: 110 → 109, measured twice on this branch

The card prescribes 111 → 110. That was already stale: PR #10013 lowered
this entry to 110 before this branch was cut. The recorded value at base
e717ba111 reads errors: 110, and the pre-fix measurement on this branch
returns exactly 110 — so the recorded number was correct, and the card's target
was the number that had already been consumed.

The measurement reproduces check-type-check-coverage.mjs's own
measureTestDebt(): the same generated project (the package's tsconfig.json
with the **/*.test.ts exclusion lifted, paths absolutised, typeRoots
reconstructed), the same tsc --noEmit --pretty false, the same
TSC_ERROR_LINE counter, against a built dependency closure.

	measured	TS1470
before (base e717ba111, recorded 110)	110	1 — managed-extension-fields.test.ts(281,36)
after	109	none

The delta is exactly the one error, and no other diagnostic moved: every other
code and per-file count is identical across the two runs.

The adjudicating gate agrees, at 1252262be:

check-type-check-coverage --re-measure: OK — 33 ledger entr(ies) re-measured in 354.3s, 1924 raw tsc error(s) total, none above its recorded number.
surplus: none — every entry sits exactly at its measurement, so any new error is red.

surplus: none is the load-bearing half: had 110 been left in place, the entry
would have printed its own can be lowered line instead.

The note: re-tallied, not rescaled

The entry's composition note was written at 131, said so openly, and had since
survived two number changes (131 → 111 → 110) without being touched — the #7038
shape. It is re-tallied from the same run that produced 109:

• old, at 131: TS2493 x42, TS18048 x24, TS2740 x19, TS2322 x11, TS2532 x9, TS2339 x8, TS2741 x8
• new, at 109: TS2493 x42, TS18048 x24, TS2322 x11, TS2532 x9, TS2339 x8, TS2345 x5, TS2554 x3, TS2741 x3, TS7006 x2, TS2769 x1, TS6133 x1

A rescale could not have produced this: TS2740 has gone to zero outright and
TS2741 is 3, not 8. The per-file split is re-measured too (44/22/18/12, was
64/22/18). The historical provenance sentences that are still true are kept, and
the 111 → 110 move that this note had missed is now recorded in it.

check-type-check-coverage.mjs:2766 — { ledger: 'TEST_DEBT', name: 'plugin-auth', recorded: 111, actual: 112 } — is the #8435 ratchet-offer detector's self-test
fixture, not the ledger, and is deliberately untouched.

Ablations

Both predicted first, then run, then restored byte-identically
(git hash-object = 9c57a17d7b005fbb4536ccf30bc8fb9038db96ae before and after
each). Neither ablation resolves through a dependency's dist/: one is a pure
source scan of the repo, the other mutates the test file vitest loads from
source, so no rebuild is interposed in either leg.

1. findUp counterfactual — predicted: the cross-package gate reports the
   declaration stale. Observed: exactly that, quoted above.

2. Vacuous-seed guard — predicted: a seed pointing at a wrong directory makes
   the scan find nothing and the file goes red. Observed, with
   const HERE = join(__dirname, 'no-such-dir'):

   AssertionError: expected 0 to be greater than 15
   Error: ENOENT: no such file or directory, open '…/plugin-auth/src/no-such-dir/auth-manager.ts'
   Test Files 1 failed (1)
   Tests 3 failed | 22 passed (25)
   

   So HERE is load-bearing in both of its uses, and the seed cannot silently
   resolve elsewhere: the file's own guards a silently empty sweep floor
   (> 15, and sys_api_key present) refuses a vacuous scan.

Gates run locally, at 1252262be

Families re-derived from the real diff with node scripts/pm/dispatch-gates.mjs
(no path list passed), then run to completion. Verdict lines as each gate printed
them:

• check:type-check-debt — check-type-check-coverage --re-measure: OK — 33 ledger entr(ies) re-measured in 354.3s, 1924 raw tsc error(s) total, none above its recorded number. / surplus: none — every entry sits exactly at its measurement, so any new error is red.
• check:type-check-coverage — check-type-check-coverage: OK — 64/77 workspace packages type-checked (plus the root), 13 in the DEBT ledger (436 frozen raw errors, …), 1 exempt.
• check:cross-package-test-inputs — OK: 12 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob. (+ All 52 self-test cases passed.)
• check:nul-bytes — check-nul-bytes: OK (scanned 6349 text file(s) …; no raw ASCII control bytes).
• check:slot-lookup — ✓ slot-lookup ratchet holds: 107 unswept site(s) in 25 file(s), none new.
• check:test-source-alias — check-test-source-alias OK — 72 packages with tests scanned; …
• check:type-source-resolution — check-type-source-resolution OK — 76 packages with a tsconfig.json scanned; …
• check:query-options-erasure — ✓ query-options-erasure ratchet holds: 67 unswept non-test site(s) in 17 file(s), none new.
• check:engine-double-contract — check-engine-double-contract: OK — 321 pinned, 133 in the DEBT ledger, 2 exempt.
• check:where-matcher — ✓ where-matcher conformance holds: 260 matcher(s) discovered, 260 answer the combinator battery correctly or refuse it loudly (155 refuse).
• scripts/docs-audit/check-affected-docs.mjs — exit 0.
• pnpm --filter @objectstack/plugin-auth typecheck — tsc --noEmit, exit 0.
• pnpm --filter @objectstack/plugin-auth test — Test Files 57 passed (57) · Tests 1301 passed (1301).

Changeset

skip-changeset. The diff is one test file and one CI-internal gate script; the
package's published artifact is unchanged (tsconfig.json and the build both
exclude *.test.ts), so this PR releases nothing — the case lint.yml names in
its own words as "the textbook skip-changeset case".

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.