fix(client): delete the stale packages.update exported-any-returns entry reddening main

[os-trump]

Fixes#12184

main was red on packages/client's check:exported-any-returns, inside the
Type Check · consumer gates job — so every branch cut from it inherited the
failure, with an error message about a client-SDK ledger unrelated to their diff.

What this changes

One line, one file: the stale ObjectStackClient.packages.update entry is deleted
from packages/client/exported-any-returns.json (65 entries to 64).

The gap that entry described is closed. packages/client/src/index.ts now reads
update: async (id, patch): Promise< InstalledPackage > and returns
this.unwrapResponse< InstalledPackage >(res). The ledger is shrink-only and judged
EXACTLY in both directions, so an entry whose gap has closed is red until it is deleted.

⛔ The gate is not touched, not loosened, and no exemption is added — the ledger was
wrong, not the gate. Nothing from the commit that closed the gap is reverted; only the
bookkeeping it left behind is completed.

(Angle brackets are spaced above because GitHub's body sanitizer eats short bracketed
fragments — it truncated this same annotation to Promise => in the issue body.)

Verification

Union re-run at adf0cb2b, the final commit on this branch.

Before — pristine origin/main (22c42c9b, 0 dirty files), reproducing the red:

✅ self-test: flags awaited-`any` returns through nested namespaces, and NOT
caller-supplied generics, `any`-containing types, or named data properties.
Ledger is exact in both directions.
❌ 1 stale exported-any-returns.json entr(y/ies) — the gap is closed, delete the entry:
• ObjectStackClient.packages.update — no longer resolves to `any`

After — this branch:

✅ self-test: … Ledger is exact in both directions.
✅ no NEW exported callable of @objectstack/client resolves to `any`: 317 callables
reached (51 caller-supplied generics, not counted as erasure), 64 ledgered site(s) still open.

The self-test is the positive control: it asserts the ledger is judged exactly in both
directions, so the green verdict is a measurement rather than a gate that read nothing.
The reported 64 ledgered site(s) still open matches the post-deletion entry count
independently, and no entry is added.

The whole ledger was re-judged, not just the reported entry

"One reported" is not "one exists", so this was checked rather than assumed — and the
answer is structural, not merely empirical. judge() collects stale entries with a full
filter over every ledger key and prints ${stale.length}, so it does not stop at
the first:

const stale = Object.keys(ledger.entries).filter((key) => !found.has(key));

The post-fix run reports zero stale and zero unledgered across all 64 remaining entries.
Consistent with the cause: the commit that closed the gap bound three methods —
packages.list, packages.update, packages.get — and only packages.update was
ledgered; the other two were any-containing, which this ledger's stated scope
deliberately excludes.

No changeset — measured, not assumed

packages/client/package.json declares files: ["dist", "README.md", "CHANGELOG.md"],
and npm pack --dry-run lists 10 files with exported-any-returns.jsonabsent. This
deletion therefore changes zero published bytes and no observable behaviour: it is
repo-side ratchet bookkeeping. The type change itself already shipped its own changeset in
the commit that closed the gap, so a changeset here would announce that same change twice.
Labelled skip-changeset.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

⚠️1 changed file(s) yielded no anchor (packages/client/exported-any-returns.json), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files. Nothing else in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)).

What this run could not see

• 1 changed file(s) yielded no anchor (packages/client/exported-any-returns.json) — pages documenting those are invisible to this run
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 15 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 22c42c9b21a479b502583ae74ac588232564a6a8 → packageMentionDocs.

[os-trump]

⚠️This PR is a duplicate of #12186 and should probably be closed unmerged. Do not land both.

Flagged by the implementing seat (domain:cli dev, session session_01HbG3rGVLjZStHQxHDtzJdJ, R37) on discovering the collision after the work was already pushed.

The defect was filed twice and dispatched twice: #12180 (12:02:06Z, domain:services) and #12184 (12:15:00Z, domain:cli, this PR's card) describe the same stale row from the same cause. PR #12186 against #12180 makes the identical change — the same single line deleted from the same file, 65 rows to 64 — and it was reported, reviewed and ACCEPTED at 12:21:33Z, with Type Check · consumer gates confirmed green on it by name. It is ready and mergeable_state: clean.

⇒ #12186 is the earlier, already-cleared fix. This PR adds nothing to it. Two identical deletions racing into an already-blocked merge queue is the failure the duplicate-alert on #12184 warned about, so this one should be closed in favour of #12186 unless a reviewer prefers the reverse.

⛔ Nothing is being changed here on that basis: this PR is left as-is (draft, not ready, no auto-merge) and #12186 / #12180 are untouched. Which card and which PR survive is the PM's call, not this seat's.

For the record, since the two runs were independent and agree: this branch measured the same red-before on a pristine origin/main (22c42c9b, 0 dirty files) and the same green-after, 64 ledgered site(s) still open reconciling with the file's 64 remaining rows, plus a full-repo pnpm lint and the seven path-derived gate families all green at adf0cb2b. Two independent seats reaching the same one-line answer is corroboration of the diagnosis — it is just not a reason to merge it twice.

---

Generated by Claude Code

---

Generated by Claude Code