docs(platform-objects): re-measure the two better-auth 1.6.11 stamps outside #10188's plugin-auth carrier

[os-sam]

Fixes#11362

Two better-auth 1.6.11 stamps in platform-objects carried the same upstream-gap claim
as #10188's plugin-auth site 1 (the stock /admin/oauth2/update-client endpoint's Zod body
schema does not accept disabled), but sat outside that card's carrier and were recorded
separately per its own triage note. Nothing was broken: both claims are still true at
the version installed now; only the stamps and (for site 1) the anchor were stale.

What each site now says, and how it was measured

Re-measured in this worktree, against node_modules as installed on the current base,
independently of the card body's own re-measurement — 2026-08-23, against installed
@better-auth/oauth-provider@1.7.1 (confirmed by reading package.json at the resolved
pnpm store path, not carried forward from #10188 or #11446):
adminUpdateOAuthClient (dist/authorize-Crqw4_bR.mjs:2860) declares its body schema at
:2862-2889, and disabled occurs zero times in that block — while matching 35 other
lines of the same file (grep -c; 38 whole-word, 42 substring), so the search reaches the
text. This agrees with #11446's independent re-measurement of the same file/version, and
with the card's own 2026-08-23 reading — but was read fresh here, not inherited.

1. sys-oauth-application.object.ts:49 (comment on SysOauthApplication's actions)

Load-bearing, same as #11446's site 1: this comment already carried its own
retirement trigger ("When upstream ships disabled support, retarget the enable/disable
actions and delete the bridge route") — and that retarget/delete is this file's own
disable_oauth_application / enable_oauth_application actions, a few lines below the
comment. If the claim had gone false, this PR would be retargeting those two actions to
the stock endpoint and deleting the plugin-auth bridge route, not re-stamping a comment.

Verified past the one block, for the same reason #11446 did:

• the non-admin sibling /oauth2/update-client handler (updateClientEndpoint,
  :2379-2444) destructures its update payload from ctx.body.update, which is bound
  by the same Zod schema shape (no disabled key) — so it can't accept the flag either;
• resourceBodySchema (:3361), the one disabled: z.boolean().optional() elsewhere in
  the file, belongs to OAuth resources — a different, unrelated model — confirmed a
  false friend;
• the DCR re-registration path sources disabled from the stored record
  (disabled: existingClient.disabled, :1972), never from client input.

Updated the comment to record the 2026-08-23 measurement, name grep -c as the
instrument, and correct the anchor to :2862-2889 (not :2896, which is the closing
}); of the whole createAuthEndpoint(...) call — includes metadata and the handler,
not the schema).

2. platform-objects.test.ts:185 (comment inside a test)

No assertion in this test pins the better-auth 1.6.11 string — it explains why the
test expects disable?.target / enable?.target to be the bridge route rather than the
stock endpoint. Not independently load-bearing: if the claim ever goes false, the
decision is made at site 1 (retarget the actions), and that change is what would force
this test's assertions — and this comment — to move together with it. Updated to record
the 2026-08-23 re-measurement and the anchor, dropping the version-number framing that
made it a fourth stamp.

Not touched, and why

• packages/plugins/plugin-auth — its three sites were already swept and merged in
  docs(plugin-auth): re-measure the three version-stamped vendor attestations outside #10073's two-string scope #11446; re-touching it here would be exactly the widening the triage note forbids.
• The generalizable "dependency name adjacent to a version literal" gate [finding] Three more stale version-stamped attestations in plugin-auth sit outside #10073's two-string scope — a better-auth@-only comment-vs-pin gate would still miss two of them #10188 sketches —
  that is its own card, not built here.

Changeset: skip-changeset, judgement stated

platform-objects is a published package, so this is a judgement call, not an automatic
skip — same call #11446 made for plugin-auth. Both sites are comment text only:

• sys-oauth-application.object.ts:49 — a // comment block inside the actions
  configuration passed to ObjectSchema.create(...), not a JSDoc attached to an exported
  type or symbol. tsup's dts generation reads type declarations, not comments sitting
  inside a runtime object-literal expression, so nothing here reaches dist/*.d.ts.
• platform-objects.test.ts:185 — a test file, not published at all.

No exported symbol's documentation changes, no behaviour changes, no accept/reject
behaviour, no public surface moves. skip-changeset applied on that basis (label added
via the additive endpoint per AGENTS.md and read back — see report).

Verification

Gate union derived with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack
and no path arguments (2 paths vs merge base 8542bd457), on the final commit
05bfc3eb34, clean tree, exit codes captured before any pipe.

Path-matched and convention-triggered families, all green:

gate	verdict
check:published-files	69 publishable packages, all covered
check:slot-lookup	ratchet holds, 107 unswept sites, none new
check:test-source-alias	OK — 72 packages scanned
check:type-source-resolution	OK — 77 packages scanned
check-ci-filter-parity.mjs	OK — 89 declared globs covered
check-plugin-teardown-shape.mjs	63 Plugin implementations, baseline fully burned down
docs-audit/check-affected-docs.mjs	self-test 339 cases pass
check:query-options-erasure	ratchet holds, none new (via the shared lock)
check:type-check-coverage (structural)	OK — 65/78 packages type-checked
check:engine-double-contract	OK — 390 pinned
check:cross-package-test-inputs	OK — 14 packages, all declared
check:where-matcher	288 matchers, 0 silently-wrong

Package verification (foreground, filtered):

• pnpm --filter @objectstack/platform-objects test -- --maxWorkers=2 — 27 test files,
  432 tests passed.
• pnpm --filter @objectstack/platform-objects typecheck — exit 0, clean.

Two gates are NOT MEASURED, reported as such rather than folded into the pass count:

• check:type-check-debt --re-measurerefused: PREREQUISITE NOT MET — 50 workspace dependencies have no built type entry point on disk. It needs the full workspace closure
  built exactly as lint.yml does (turbo run build --filter='./packages/*' --filter='./packages/*/*') — a shared-lock verify contention lane ([finding] 共享 verify 锁在多席位并发下已成吞吐瓶颈,并出现两种非吞吐后果:容器上限杀掉持锁 gate、以及 agent 在排队中结束回合 —— 一个班次内三次实测 #11363) queued 5+ deep
  behind this attempt; abandoned rather than parking the session on it (its structural
  half, check:type-check-coverage without --re-measure, is measured above and green).
• check:i18nrefused: PREREQUISITE NOT MET — the workspace CLI is not built
  (packages/cli/dist/commands/i18n/extract.js missing). Same shared-lock contention.

Repo-wide pnpm lint — declared narrowing, not a gap, for the same contention reason
(#11363 is live; a full-farm pnpm lint and the closure build above were both queued 5-6
deep behind other agents' work in the same window). In its place, the same three facts
#11446 used to make a narrowed run a measurement rather than an omission:

1. Population from ESLint's own config: pnpm lint is eslint . --no-inline-config
   over the single root eslint.config.mjs; both changed files return real result objects.
2. Count read from --format json: 2 files linted, 0 errors, 0 warnings.
3. Invariance for untouched files: this repo's one eslint.config.mjs never enables
   type-aware linting for any file (no parserOptions.project, no typed
   @typescript-eslint rules), so a comment-only edit inside two files cannot move any
   verdict on a file it does not touch.

CI runs the full farm regardless and its conclusion is authoritative over every narrowing
above.

Scope

Comment text only, in exactly the two files this card names. No assertion, pin, schema,
route, or gate input is touched.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/platform-objects, touching 2 documentable anchor(s).

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/protocol/objectui/actions.mdx(via /api/v1/auth/admin/oauth2/toggle-disabled (route))

What this run could not see

Coarse fallback — 2 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 8542bd457765444626023db6ffeb6f8105f7f83e → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 6af5ecc58b02b0f4a3c74ec892ef3fbd67a8bf3a — the merge of head 05bfc3eb34cb9e208d3f886e0ee17910a9c30154 into base 8542bd457765444626023db6ffeb6f8105f7f83e, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 6af5ecc58b02b0f4a3c74ec892ef3fbd67a8bf3a && git checkout 6af5ecc58b02b0f4a3c74ec892ef3fbd67a8bf3a
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 8542bd457765444626023db6ffeb6f8105f7f83e 05bfc3eb34cb9e208d3f886e0ee17910a9c30154 && git checkout -B drift-repro 8542bd457765444626023db6ffeb6f8105f7f83e && git merge --no-ff 05bfc3eb34cb9e208d3f886e0ee17910a9c30154
node scripts/docs-audit/affected-docs.mjs --json 8542bd457765444626023db6ffeb6f8105f7f83e

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 8542bd457765444626023db6ffeb6f8105f7f83e → pass the list as
args.docs, on the commit named under Which tree this was computed on.