test(plugin-auth): register the production object set in the two SCIM harnesses

[os-sales]

Fixes#14615

Both SCIM harnesses re-spelled plugin-auth's object set by hand and omitted every
OAuth object. They now import authIdentityObjects from the plugin's own manifest
instead — the same array auth-plugin.ts registers at runtime and
objectstack.config.ts declares at compile time — so a harness cannot drift from a
real deployment by construction. Test-only diff; two files.

What actually emits the line, measured

The card attributes the ERROR to POST /sign-in/email. That is not the trigger.
The vendor's own source is unambiguous — @better-auth/oauth-provider 1.7.2,
dist/authorize-BmTe2VYG.mjs, prepareBackchannelLogoutPlan is installed as a
databaseHooks.session.delete.before hook (line 4419), not a sign-in hook. It
reads exactly two models, both keyed on sessionId:

const[accessTokens,refreshTokens]=awaitPromise.all([adapter.findMany({model: "oauthAccessToken", where }),adapter.findMany({model: "oauthRefreshToken", where }),]);constaffectedClientIds=newSet();
...
if(affectedClientIds.size===0)returnnull;// returns BEFORE reading oauthClient

So the reads that demanded a registration are sys_oauth_access_token and
sys_oauth_refresh_token, and they are demanded by session revocation, not by
sign-in. oauthClient (sys_oauth_application) is reached only when a token row was
found, which never happens in a harness whose tables are empty, and oauthConsent
(sys_oauth_consent) is not read by this seam at all. That is why the fix is not
"the four OAuth objects from the posture test": two of those four are not demanded by
any read here, and importing the production set is both narrower in intent and wider
in coverage than hand-picking either number.

Before / after — same command, quoted

pnpm --filter @objectstack/plugin-auth exec vitest run --maxWorkers=2 src/SUITE.test.ts

suite	phase	back-channel logout planning failed	no such table: sys_oauth*	ERROR lines	result
scim-deactivation-reconcile-user	before	2	6	10	Tests 11 passed (11)
scim-deactivation-reconcile-user	after	0	0	0	Tests 11 passed (11)
scim-transaction-scope	before	0	0	2	Tests 5 passed (5)
scim-transaction-scope	after	0	0	2	Tests 5 passed (5)
credential-at-rest-posture (control, untouched)	before	0	0	0	Tests 5 passed (5)
credential-at-rest-posture (control, untouched)	after	0	0	0	Tests 5 passed (5)

The 2 ERROR lines that remain in scim-transaction-scope are that suite's own
deliberately injected failure ([#14522 test] injected failure on insert sys_scim_user),
unchanged in both phases. A diff of the ERROR lines before vs after found no line
present only in the after phase in either suite: registering the production set
introduced no new noise.

Whole package, on the merged tree: Test Files 91 passed (91) / Tests 1862 passed (1862),
and 0 occurrences of the line package-wide.

Two of the card's premises did not survive measurement

Reported here rather than quietly worked around.

1. scim-transaction-scope.test.ts never emitted the line. Its before count is 0,
   not because its object list differs — it was byte-identical to the other suite's —
   but because it never deletes a session. Its sign-in in case (c) is not a trigger.
   Its gap was latent, and the change to it is prophylactic with a measured delta
   of 0 to 0. It is in this PR because it is the same harness shape in the card's
   declared surface, and it is now un-driftable rather than accidentally quiet.
2. The control is not evidence. The card's whole basis for the remedy was that
   credential-at-rest-posture.test.ts registers the OAuth objects and does not emit
   the line. It does not emit the line, but it drives no auth request at all — no
   sign-in, no sign-out, no revocation — so its 0 is not attributable to its
   registration list. The causal evidence for this fix is the vendor source above plus
   the direct 2 to 0 measurement, not the control.

Registering from the manifest rather than from AUTH_OBJECTS

The card named the posture test's AUTH_OBJECTS as the reference. This PR follows the
triage's direction on the card instead (#14615 comment of 2026-09-02): that list is
itself a hand-copied second spelling of authIdentityObjects, and adding four names to
two more hand-lists would give the repo four copies of one truth — while the card's own
strongest observation is that this gap "already was [copied], twice". Importing the
production array is the only version that stops the next copy. AUTH_OBJECTS in the
posture test is deliberately not touched here.

Scope

• No changeset: test-only, publishes nothing (plugin-auth's files is
  ["dist","README.md","CHANGELOG.md"]). This is pr-automation.yml's route 2,
  "tests-only ... apply the skip-changeset label", which is the label's own preferred
  case. Label applied.
• No product source touched. auth-manager.ts is held by PR fix(plugin-auth): bind the dev-admin seed's operator-provisioning ticket to more than the seed address (#14373) #14730 and is not in this
  diff; the back-channel planner is the vendor's and was not modified. The card's second
  remedy direction — discriminating an absent table as a benign read — is not
  addressed here and remains a product decision, exactly as the triage ruled.
• Export surface unchanged: git diff -U0 origin/main...HEAD | grep -E '^[+-].*export'
  returns nothing.

Left alone deliberately

Four more AuthManager harnesses in plugin-auth still hand-write the object list
without the OAuth objects, and are ⛔ not touched here (the population, counted:
7 harnesses construct an AuthManager and register objects — 2 now import the
manifest, 1 hand-list carries the OAuth objects, 4 hand-lists do not):

• audience-bootstrap-seam.test.ts
• dev-admin-seed-credential-gate.test.ts
• sso-register-platform-admin-gate.test.ts
• walled-owner-operator-stamp.test.ts

None of them emits the line today — the package-wide count above is 0 — because none
deletes a session. They are latent copies of the same shape, for a separate card.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 7a17f3bf1e48e1e88f8e833a794e37bd40230f17 → packageMentionDocs.

[os-sales]

Fixes#14615

Both SCIM harnesses re-spelled plugin-auth's object set by hand and omitted every
OAuth object. They now import authIdentityObjects from the plugin's own manifest
instead — the same array auth-plugin.ts registers at runtime and
objectstack.config.ts declares at compile time — so a harness cannot drift from a
real deployment by construction. Test-only diff; two files.

What actually emits the line, measured

The card attributes the ERROR to POST /sign-in/email. That is not the trigger.
The vendor's own source is unambiguous — @better-auth/oauth-provider 1.7.2,
dist/authorize-BmTe2VYG.mjs, prepareBackchannelLogoutPlan is installed as a
databaseHooks.session.delete.before hook (line 4419), not a sign-in hook. It
reads exactly two models, both keyed on sessionId:

const[accessTokens,refreshTokens]=awaitPromise.all([adapter.findMany({model: "oauthAccessToken", where }),adapter.findMany({model: "oauthRefreshToken", where }),]);constaffectedClientIds=newSet();
...
if(affectedClientIds.size===0)returnnull;// returns BEFORE reading oauthClient

So the reads that demanded a registration are sys_oauth_access_token and
sys_oauth_refresh_token, and they are demanded by session revocation, not by
sign-in. oauthClient (sys_oauth_application) is reached only when a token row was
found, which never happens in a harness whose tables are empty, and oauthConsent
(sys_oauth_consent) is not read by this seam at all. That is why the fix is not
"the four OAuth objects from the posture test": two of those four are not demanded by
any read here, and importing the production set is both narrower in intent and wider
in coverage than hand-picking either number.

Before / after — same command, quoted

pnpm --filter @objectstack/plugin-auth exec vitest run --maxWorkers=2 src/SUITE.test.ts

suite	phase	back-channel logout planning failed	no such table: sys_oauth*	ERROR lines	result
scim-deactivation-reconcile-user	before	2	6	10	Tests 11 passed (11)
scim-deactivation-reconcile-user	after	0	0	0	Tests 11 passed (11)
scim-transaction-scope	before	0	0	2	Tests 5 passed (5)
scim-transaction-scope	after	0	0	2	Tests 5 passed (5)
credential-at-rest-posture (control, untouched)	before	0	0	0	Tests 5 passed (5)
credential-at-rest-posture (control, untouched)	after	0	0	0	Tests 5 passed (5)

The 2 ERROR lines that remain in scim-transaction-scope are that suite's own
deliberately injected failure ([#14522 test] injected failure on insert sys_scim_user),
unchanged in both phases. A diff of the ERROR lines before vs after found no line
present only in the after phase in either suite: registering the production set
introduced no new noise.

Whole package, on the merged tree: Test Files 91 passed (91) / Tests 1862 passed (1862),
and 0 occurrences of the line package-wide.

Two of the card's premises did not survive measurement

Reported here rather than quietly worked around.

1. scim-transaction-scope.test.ts never emitted the line. Its before count is 0,
   not because its object list differs — it was byte-identical to the other suite's —
   but because it never deletes a session. Its sign-in in case (c) is not a trigger.
   Its gap was latent, and the change to it is prophylactic with a measured delta
   of 0 to 0. It is in this PR because it is the same harness shape in the card's
   declared surface, and it is now un-driftable rather than accidentally quiet.
2. The control is not evidence. The card's whole basis for the remedy was that
   credential-at-rest-posture.test.ts registers the OAuth objects and does not emit
   the line. It does not emit the line, but it drives no auth request at all — no
   sign-in, no sign-out, no revocation — so its 0 is not attributable to its
   registration list. The causal evidence for this fix is the vendor source above plus
   the direct 2 to 0 measurement, not the control.

Registering from the manifest rather than from AUTH_OBJECTS

The card named the posture test's AUTH_OBJECTS as the reference. This PR follows the
triage's direction on the card instead (#14615 comment of 2026-09-02): that list is
itself a hand-copied second spelling of authIdentityObjects, and adding four names to
two more hand-lists would give the repo four copies of one truth — while the card's own
strongest observation is that this gap "already was [copied], twice". Importing the
production array is the only version that stops the next copy. AUTH_OBJECTS in the
posture test is deliberately not touched here.

Scope

• No changeset: test-only, publishes nothing (plugin-auth's files is
  ["dist","README.md","CHANGELOG.md"]). This is pr-automation.yml's route 2,
  "tests-only ... apply the skip-changeset label", which is the label's own preferred
  case. Label applied.
• No product source touched. auth-manager.ts is held by PR fix(plugin-auth): bind the dev-admin seed's operator-provisioning ticket to more than the seed address (#14373) #14730 and is not in this
  diff; the back-channel planner is the vendor's and was not modified. The card's second
  remedy direction — discriminating an absent table as a benign read — is not
  addressed here and remains a product decision, exactly as the triage ruled.
• Export surface unchanged: git diff -U0 origin/main...HEAD | grep -E '^[+-].*export'
  returns nothing.

Left alone deliberately

Four more AuthManager harnesses in plugin-auth still hand-write the object list
without the OAuth objects, and are ⛔ not touched here (the population, counted:
7 harnesses construct an AuthManager and register objects — 2 now import the
manifest, 1 hand-list carries the OAuth objects, 4 hand-lists do not):

• audience-bootstrap-seam.test.ts
• dev-admin-seed-credential-gate.test.ts
• sso-register-platform-admin-gate.test.ts
• walled-owner-operator-stamp.test.ts

None of them emits the line today — the package-wide count above is 0 — because none
deletes a session. They are latent copies of the same shape, for a separate card.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 7a17f3bf1e48e1e88f8e833a794e37bd40230f17 → packageMentionDocs.

[os-sales]

Fixes#14615

Both SCIM harnesses re-spelled plugin-auth's object set by hand and omitted every
OAuth object. They now import authIdentityObjects from the plugin's own manifest
instead — the same array auth-plugin.ts registers at runtime and
objectstack.config.ts declares at compile time — so a harness cannot drift from a
real deployment by construction. Test-only diff; two files.

What actually emits the line, measured

The card attributes the ERROR to POST /sign-in/email. That is not the trigger.
The vendor's own source is unambiguous — @better-auth/oauth-provider 1.7.2,
dist/authorize-BmTe2VYG.mjs, prepareBackchannelLogoutPlan is installed as a
databaseHooks.session.delete.before hook (line 4419), not a sign-in hook. It
reads exactly two models, both keyed on sessionId:

const[accessTokens,refreshTokens]=awaitPromise.all([adapter.findMany({model: "oauthAccessToken", where }),adapter.findMany({model: "oauthRefreshToken", where }),]);constaffectedClientIds=newSet();
...
if(affectedClientIds.size===0)returnnull;// returns BEFORE reading oauthClient

So the reads that demanded a registration are sys_oauth_access_token and
sys_oauth_refresh_token, and they are demanded by session revocation, not by
sign-in. oauthClient (sys_oauth_application) is reached only when a token row was
found, which never happens in a harness whose tables are empty, and oauthConsent
(sys_oauth_consent) is not read by this seam at all. That is why the fix is not
"the four OAuth objects from the posture test": two of those four are not demanded by
any read here, and importing the production set is both narrower in intent and wider
in coverage than hand-picking either number.

Before / after — same command, quoted

pnpm --filter @objectstack/plugin-auth exec vitest run --maxWorkers=2 src/SUITE.test.ts

suite	phase	back-channel logout planning failed	no such table: sys_oauth*	ERROR lines	result
scim-deactivation-reconcile-user	before	2	6	10	Tests 11 passed (11)
scim-deactivation-reconcile-user	after	0	0	0	Tests 11 passed (11)
scim-transaction-scope	before	0	0	2	Tests 5 passed (5)
scim-transaction-scope	after	0	0	2	Tests 5 passed (5)
credential-at-rest-posture (control, untouched)	before	0	0	0	Tests 5 passed (5)
credential-at-rest-posture (control, untouched)	after	0	0	0	Tests 5 passed (5)

The 2 ERROR lines that remain in scim-transaction-scope are that suite's own
deliberately injected failure ([#14522 test] injected failure on insert sys_scim_user),
unchanged in both phases. A diff of the ERROR lines before vs after found no line
present only in the after phase in either suite: registering the production set
introduced no new noise.

Whole package, on the merged tree: Test Files 91 passed (91) / Tests 1862 passed (1862),
and 0 occurrences of the line package-wide.

Two of the card's premises did not survive measurement

Reported here rather than quietly worked around.

1. scim-transaction-scope.test.ts never emitted the line. Its before count is 0,
   not because its object list differs — it was byte-identical to the other suite's —
   but because it never deletes a session. Its sign-in in case (c) is not a trigger.
   Its gap was latent, and the change to it is prophylactic with a measured delta
   of 0 to 0. It is in this PR because it is the same harness shape in the card's
   declared surface, and it is now un-driftable rather than accidentally quiet.
2. The control is not evidence. The card's whole basis for the remedy was that
   credential-at-rest-posture.test.ts registers the OAuth objects and does not emit
   the line. It does not emit the line, but it drives no auth request at all — no
   sign-in, no sign-out, no revocation — so its 0 is not attributable to its
   registration list. The causal evidence for this fix is the vendor source above plus
   the direct 2 to 0 measurement, not the control.

Registering from the manifest rather than from AUTH_OBJECTS

The card named the posture test's AUTH_OBJECTS as the reference. This PR follows the
triage's direction on the card instead (#14615 comment of 2026-09-02): that list is
itself a hand-copied second spelling of authIdentityObjects, and adding four names to
two more hand-lists would give the repo four copies of one truth — while the card's own
strongest observation is that this gap "already was [copied], twice". Importing the
production array is the only version that stops the next copy. AUTH_OBJECTS in the
posture test is deliberately not touched here.

Scope

• No changeset: test-only, publishes nothing (plugin-auth's files is
  ["dist","README.md","CHANGELOG.md"]). This is pr-automation.yml's route 2,
  "tests-only ... apply the skip-changeset label", which is the label's own preferred
  case. Label applied.
• No product source touched. auth-manager.ts is held by PR fix(plugin-auth): bind the dev-admin seed's operator-provisioning ticket to more than the seed address (#14373) #14730 and is not in this
  diff; the back-channel planner is the vendor's and was not modified. The card's second
  remedy direction — discriminating an absent table as a benign read — is not
  addressed here and remains a product decision, exactly as the triage ruled.
• Export surface unchanged: git diff -U0 origin/main...HEAD | grep -E '^[+-].*export'
  returns nothing.

Left alone deliberately

Four more AuthManager harnesses in plugin-auth still hand-write the object list
without the OAuth objects, and are ⛔ not touched here (the population, counted:
7 harnesses construct an AuthManager and register objects — 2 now import the
manifest, 1 hand-list carries the OAuth objects, 4 hand-lists do not):

• audience-bootstrap-seam.test.ts
• dev-admin-seed-credential-gate.test.ts
• sso-register-platform-admin-gate.test.ts
• walled-owner-operator-stamp.test.ts

None of them emits the line today — the package-wide count above is 0 — because none
deletes a session. They are latent copies of the same shape, for a separate card.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 7a17f3bf1e48e1e88f8e833a794e37bd40230f17 → packageMentionDocs.

[os-sales]

Fixes#14615

Both SCIM harnesses re-spelled plugin-auth's object set by hand and omitted every
OAuth object. They now import authIdentityObjects from the plugin's own manifest
instead — the same array auth-plugin.ts registers at runtime and
objectstack.config.ts declares at compile time — so a harness cannot drift from a
real deployment by construction. Test-only diff; two files.

What actually emits the line, measured

The card attributes the ERROR to POST /sign-in/email. That is not the trigger.
The vendor's own source is unambiguous — @better-auth/oauth-provider 1.7.2,
dist/authorize-BmTe2VYG.mjs, prepareBackchannelLogoutPlan is installed as a
databaseHooks.session.delete.before hook (line 4419), not a sign-in hook. It
reads exactly two models, both keyed on sessionId:

const[accessTokens,refreshTokens]=awaitPromise.all([adapter.findMany({model: "oauthAccessToken", where }),adapter.findMany({model: "oauthRefreshToken", where }),]);constaffectedClientIds=newSet();
...
if(affectedClientIds.size===0)returnnull;// returns BEFORE reading oauthClient

So the reads that demanded a registration are sys_oauth_access_token and
sys_oauth_refresh_token, and they are demanded by session revocation, not by
sign-in. oauthClient (sys_oauth_application) is reached only when a token row was
found, which never happens in a harness whose tables are empty, and oauthConsent
(sys_oauth_consent) is not read by this seam at all. That is why the fix is not
"the four OAuth objects from the posture test": two of those four are not demanded by
any read here, and importing the production set is both narrower in intent and wider
in coverage than hand-picking either number.

Before / after — same command, quoted

pnpm --filter @objectstack/plugin-auth exec vitest run --maxWorkers=2 src/SUITE.test.ts

suite	phase	back-channel logout planning failed	no such table: sys_oauth*	ERROR lines	result
scim-deactivation-reconcile-user	before	2	6	10	Tests 11 passed (11)
scim-deactivation-reconcile-user	after	0	0	0	Tests 11 passed (11)
scim-transaction-scope	before	0	0	2	Tests 5 passed (5)
scim-transaction-scope	after	0	0	2	Tests 5 passed (5)
credential-at-rest-posture (control, untouched)	before	0	0	0	Tests 5 passed (5)
credential-at-rest-posture (control, untouched)	after	0	0	0	Tests 5 passed (5)

The 2 ERROR lines that remain in scim-transaction-scope are that suite's own
deliberately injected failure ([#14522 test] injected failure on insert sys_scim_user),
unchanged in both phases. A diff of the ERROR lines before vs after found no line
present only in the after phase in either suite: registering the production set
introduced no new noise.

Whole package, on the merged tree: Test Files 91 passed (91) / Tests 1862 passed (1862),
and 0 occurrences of the line package-wide.

Two of the card's premises did not survive measurement

Reported here rather than quietly worked around.

1. scim-transaction-scope.test.ts never emitted the line. Its before count is 0,
   not because its object list differs — it was byte-identical to the other suite's —
   but because it never deletes a session. Its sign-in in case (c) is not a trigger.
   Its gap was latent, and the change to it is prophylactic with a measured delta
   of 0 to 0. It is in this PR because it is the same harness shape in the card's
   declared surface, and it is now un-driftable rather than accidentally quiet.
2. The control is not evidence. The card's whole basis for the remedy was that
   credential-at-rest-posture.test.ts registers the OAuth objects and does not emit
   the line. It does not emit the line, but it drives no auth request at all — no
   sign-in, no sign-out, no revocation — so its 0 is not attributable to its
   registration list. The causal evidence for this fix is the vendor source above plus
   the direct 2 to 0 measurement, not the control.

Registering from the manifest rather than from AUTH_OBJECTS

The card named the posture test's AUTH_OBJECTS as the reference. This PR follows the
triage's direction on the card instead (#14615 comment of 2026-09-02): that list is
itself a hand-copied second spelling of authIdentityObjects, and adding four names to
two more hand-lists would give the repo four copies of one truth — while the card's own
strongest observation is that this gap "already was [copied], twice". Importing the
production array is the only version that stops the next copy. AUTH_OBJECTS in the
posture test is deliberately not touched here.

Scope

• No changeset: test-only, publishes nothing (plugin-auth's files is
  ["dist","README.md","CHANGELOG.md"]). This is pr-automation.yml's route 2,
  "tests-only ... apply the skip-changeset label", which is the label's own preferred
  case. Label applied.
• No product source touched. auth-manager.ts is held by PR fix(plugin-auth): bind the dev-admin seed's operator-provisioning ticket to more than the seed address (#14373) #14730 and is not in this
  diff; the back-channel planner is the vendor's and was not modified. The card's second
  remedy direction — discriminating an absent table as a benign read — is not
  addressed here and remains a product decision, exactly as the triage ruled.
• Export surface unchanged: git diff -U0 origin/main...HEAD | grep -E '^[+-].*export'
  returns nothing.

Left alone deliberately

Four more AuthManager harnesses in plugin-auth still hand-write the object list
without the OAuth objects, and are ⛔ not touched here (the population, counted:
7 harnesses construct an AuthManager and register objects — 2 now import the
manifest, 1 hand-list carries the OAuth objects, 4 hand-lists do not):

• audience-bootstrap-seam.test.ts
• dev-admin-seed-credential-gate.test.ts
• sso-register-platform-admin-gate.test.ts
• walled-owner-operator-stamp.test.ts

None of them emits the line today — the package-wide count above is 0 — because none
deletes a session. They are latent copies of the same shape, for a separate card.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 7a17f3bf1e48e1e88f8e833a794e37bd40230f17 → packageMentionDocs.

[os-sales]

Fixes#14615

Both SCIM harnesses re-spelled plugin-auth's object set by hand and omitted every
OAuth object. They now import authIdentityObjects from the plugin's own manifest
instead — the same array auth-plugin.ts registers at runtime and
objectstack.config.ts declares at compile time — so a harness cannot drift from a
real deployment by construction. Test-only diff; two files.

What actually emits the line, measured

The card attributes the ERROR to POST /sign-in/email. That is not the trigger.
The vendor's own source is unambiguous — @better-auth/oauth-provider 1.7.2,
dist/authorize-BmTe2VYG.mjs, prepareBackchannelLogoutPlan is installed as a
databaseHooks.session.delete.before hook (line 4419), not a sign-in hook. It
reads exactly two models, both keyed on sessionId:

const[accessTokens,refreshTokens]=awaitPromise.all([adapter.findMany({model: "oauthAccessToken", where }),adapter.findMany({model: "oauthRefreshToken", where }),]);constaffectedClientIds=newSet();
...
if(affectedClientIds.size===0)returnnull;// returns BEFORE reading oauthClient

So the reads that demanded a registration are sys_oauth_access_token and
sys_oauth_refresh_token, and they are demanded by session revocation, not by
sign-in. oauthClient (sys_oauth_application) is reached only when a token row was
found, which never happens in a harness whose tables are empty, and oauthConsent
(sys_oauth_consent) is not read by this seam at all. That is why the fix is not
"the four OAuth objects from the posture test": two of those four are not demanded by
any read here, and importing the production set is both narrower in intent and wider
in coverage than hand-picking either number.

Before / after — same command, quoted

pnpm --filter @objectstack/plugin-auth exec vitest run --maxWorkers=2 src/SUITE.test.ts

suite	phase	back-channel logout planning failed	no such table: sys_oauth*	ERROR lines	result
scim-deactivation-reconcile-user	before	2	6	10	Tests 11 passed (11)
scim-deactivation-reconcile-user	after	0	0	0	Tests 11 passed (11)
scim-transaction-scope	before	0	0	2	Tests 5 passed (5)
scim-transaction-scope	after	0	0	2	Tests 5 passed (5)
credential-at-rest-posture (control, untouched)	before	0	0	0	Tests 5 passed (5)
credential-at-rest-posture (control, untouched)	after	0	0	0	Tests 5 passed (5)

The 2 ERROR lines that remain in scim-transaction-scope are that suite's own
deliberately injected failure ([#14522 test] injected failure on insert sys_scim_user),
unchanged in both phases. A diff of the ERROR lines before vs after found no line
present only in the after phase in either suite: registering the production set
introduced no new noise.

Whole package, on the merged tree: Test Files 91 passed (91) / Tests 1862 passed (1862),
and 0 occurrences of the line package-wide.

Two of the card's premises did not survive measurement

Reported here rather than quietly worked around.

1. scim-transaction-scope.test.ts never emitted the line. Its before count is 0,
   not because its object list differs — it was byte-identical to the other suite's —
   but because it never deletes a session. Its sign-in in case (c) is not a trigger.
   Its gap was latent, and the change to it is prophylactic with a measured delta
   of 0 to 0. It is in this PR because it is the same harness shape in the card's
   declared surface, and it is now un-driftable rather than accidentally quiet.
2. The control is not evidence. The card's whole basis for the remedy was that
   credential-at-rest-posture.test.ts registers the OAuth objects and does not emit
   the line. It does not emit the line, but it drives no auth request at all — no
   sign-in, no sign-out, no revocation — so its 0 is not attributable to its
   registration list. The causal evidence for this fix is the vendor source above plus
   the direct 2 to 0 measurement, not the control.

Registering from the manifest rather than from AUTH_OBJECTS

The card named the posture test's AUTH_OBJECTS as the reference. This PR follows the
triage's direction on the card instead (#14615 comment of 2026-09-02): that list is
itself a hand-copied second spelling of authIdentityObjects, and adding four names to
two more hand-lists would give the repo four copies of one truth — while the card's own
strongest observation is that this gap "already was [copied], twice". Importing the
production array is the only version that stops the next copy. AUTH_OBJECTS in the
posture test is deliberately not touched here.

Scope

• No changeset: test-only, publishes nothing (plugin-auth's files is
  ["dist","README.md","CHANGELOG.md"]). This is pr-automation.yml's route 2,
  "tests-only ... apply the skip-changeset label", which is the label's own preferred
  case. Label applied.
• No product source touched. auth-manager.ts is held by PR fix(plugin-auth): bind the dev-admin seed's operator-provisioning ticket to more than the seed address (#14373) #14730 and is not in this
  diff; the back-channel planner is the vendor's and was not modified. The card's second
  remedy direction — discriminating an absent table as a benign read — is not
  addressed here and remains a product decision, exactly as the triage ruled.
• Export surface unchanged: git diff -U0 origin/main...HEAD | grep -E '^[+-].*export'
  returns nothing.

Left alone deliberately

Four more AuthManager harnesses in plugin-auth still hand-write the object list
without the OAuth objects, and are ⛔ not touched here (the population, counted:
7 harnesses construct an AuthManager and register objects — 2 now import the
manifest, 1 hand-list carries the OAuth objects, 4 hand-lists do not):

• audience-bootstrap-seam.test.ts
• dev-admin-seed-credential-gate.test.ts
• sso-register-platform-admin-gate.test.ts
• walled-owner-operator-stamp.test.ts

None of them emits the line today — the package-wide count above is 0 — because none
deletes a session. They are latent copies of the same shape, for a separate card.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 7a17f3bf1e48e1e88f8e833a794e37bd40230f17 → packageMentionDocs.

[os-sales]

Fixes#14615

Both SCIM harnesses re-spelled plugin-auth's object set by hand and omitted every
OAuth object. They now import authIdentityObjects from the plugin's own manifest
instead — the same array auth-plugin.ts registers at runtime and
objectstack.config.ts declares at compile time — so a harness cannot drift from a
real deployment by construction. Test-only diff; two files.

What actually emits the line, measured

The card attributes the ERROR to POST /sign-in/email. That is not the trigger.
The vendor's own source is unambiguous — @better-auth/oauth-provider 1.7.2,
dist/authorize-BmTe2VYG.mjs, prepareBackchannelLogoutPlan is installed as a
databaseHooks.session.delete.before hook (line 4419), not a sign-in hook. It
reads exactly two models, both keyed on sessionId:

const[accessTokens,refreshTokens]=awaitPromise.all([adapter.findMany({model: "oauthAccessToken", where }),adapter.findMany({model: "oauthRefreshToken", where }),]);constaffectedClientIds=newSet();
...
if(affectedClientIds.size===0)returnnull;// returns BEFORE reading oauthClient

So the reads that demanded a registration are sys_oauth_access_token and
sys_oauth_refresh_token, and they are demanded by session revocation, not by
sign-in. oauthClient (sys_oauth_application) is reached only when a token row was
found, which never happens in a harness whose tables are empty, and oauthConsent
(sys_oauth_consent) is not read by this seam at all. That is why the fix is not
"the four OAuth objects from the posture test": two of those four are not demanded by
any read here, and importing the production set is both narrower in intent and wider
in coverage than hand-picking either number.

Before / after — same command, quoted

pnpm --filter @objectstack/plugin-auth exec vitest run --maxWorkers=2 src/SUITE.test.ts

suite	phase	back-channel logout planning failed	no such table: sys_oauth*	ERROR lines	result
scim-deactivation-reconcile-user	before	2	6	10	Tests 11 passed (11)
scim-deactivation-reconcile-user	after	0	0	0	Tests 11 passed (11)
scim-transaction-scope	before	0	0	2	Tests 5 passed (5)
scim-transaction-scope	after	0	0	2	Tests 5 passed (5)
credential-at-rest-posture (control, untouched)	before	0	0	0	Tests 5 passed (5)
credential-at-rest-posture (control, untouched)	after	0	0	0	Tests 5 passed (5)

The 2 ERROR lines that remain in scim-transaction-scope are that suite's own
deliberately injected failure ([#14522 test] injected failure on insert sys_scim_user),
unchanged in both phases. A diff of the ERROR lines before vs after found no line
present only in the after phase in either suite: registering the production set
introduced no new noise.

Whole package, on the merged tree: Test Files 91 passed (91) / Tests 1862 passed (1862),
and 0 occurrences of the line package-wide.

Two of the card's premises did not survive measurement

Reported here rather than quietly worked around.

1. scim-transaction-scope.test.ts never emitted the line. Its before count is 0,
   not because its object list differs — it was byte-identical to the other suite's —
   but because it never deletes a session. Its sign-in in case (c) is not a trigger.
   Its gap was latent, and the change to it is prophylactic with a measured delta
   of 0 to 0. It is in this PR because it is the same harness shape in the card's
   declared surface, and it is now un-driftable rather than accidentally quiet.
2. The control is not evidence. The card's whole basis for the remedy was that
   credential-at-rest-posture.test.ts registers the OAuth objects and does not emit
   the line. It does not emit the line, but it drives no auth request at all — no
   sign-in, no sign-out, no revocation — so its 0 is not attributable to its
   registration list. The causal evidence for this fix is the vendor source above plus
   the direct 2 to 0 measurement, not the control.

Registering from the manifest rather than from AUTH_OBJECTS

The card named the posture test's AUTH_OBJECTS as the reference. This PR follows the
triage's direction on the card instead (#14615 comment of 2026-09-02): that list is
itself a hand-copied second spelling of authIdentityObjects, and adding four names to
two more hand-lists would give the repo four copies of one truth — while the card's own
strongest observation is that this gap "already was [copied], twice". Importing the
production array is the only version that stops the next copy. AUTH_OBJECTS in the
posture test is deliberately not touched here.

Scope

• No changeset: test-only, publishes nothing (plugin-auth's files is
  ["dist","README.md","CHANGELOG.md"]). This is pr-automation.yml's route 2,
  "tests-only ... apply the skip-changeset label", which is the label's own preferred
  case. Label applied.
• No product source touched. auth-manager.ts is held by PR fix(plugin-auth): bind the dev-admin seed's operator-provisioning ticket to more than the seed address (#14373) #14730 and is not in this
  diff; the back-channel planner is the vendor's and was not modified. The card's second
  remedy direction — discriminating an absent table as a benign read — is not
  addressed here and remains a product decision, exactly as the triage ruled.
• Export surface unchanged: git diff -U0 origin/main...HEAD | grep -E '^[+-].*export'
  returns nothing.

Left alone deliberately

Four more AuthManager harnesses in plugin-auth still hand-write the object list
without the OAuth objects, and are ⛔ not touched here (the population, counted:
7 harnesses construct an AuthManager and register objects — 2 now import the
manifest, 1 hand-list carries the OAuth objects, 4 hand-lists do not):

• audience-bootstrap-seam.test.ts
• dev-admin-seed-credential-gate.test.ts
• sso-register-platform-admin-gate.test.ts
• walled-owner-operator-stamp.test.ts

None of them emits the line today — the package-wide count above is 0 — because none
deletes a session. They are latent copies of the same shape, for a separate card.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 7a17f3bf1e48e1e88f8e833a794e37bd40230f17 → packageMentionDocs.

[os-sales]

Fixes#14615

Both SCIM harnesses re-spelled plugin-auth's object set by hand and omitted every
OAuth object. They now import authIdentityObjects from the plugin's own manifest
instead — the same array auth-plugin.ts registers at runtime and
objectstack.config.ts declares at compile time — so a harness cannot drift from a
real deployment by construction. Test-only diff; two files.

What actually emits the line, measured

The card attributes the ERROR to POST /sign-in/email. That is not the trigger.
The vendor's own source is unambiguous — @better-auth/oauth-provider 1.7.2,
dist/authorize-BmTe2VYG.mjs, prepareBackchannelLogoutPlan is installed as a
databaseHooks.session.delete.before hook (line 4419), not a sign-in hook. It
reads exactly two models, both keyed on sessionId:

const[accessTokens,refreshTokens]=awaitPromise.all([adapter.findMany({model: "oauthAccessToken", where }),adapter.findMany({model: "oauthRefreshToken", where }),]);constaffectedClientIds=newSet();
...
if(affectedClientIds.size===0)returnnull;// returns BEFORE reading oauthClient

So the reads that demanded a registration are sys_oauth_access_token and
sys_oauth_refresh_token, and they are demanded by session revocation, not by
sign-in. oauthClient (sys_oauth_application) is reached only when a token row was
found, which never happens in a harness whose tables are empty, and oauthConsent
(sys_oauth_consent) is not read by this seam at all. That is why the fix is not
"the four OAuth objects from the posture test": two of those four are not demanded by
any read here, and importing the production set is both narrower in intent and wider
in coverage than hand-picking either number.

Before / after — same command, quoted

pnpm --filter @objectstack/plugin-auth exec vitest run --maxWorkers=2 src/SUITE.test.ts

suite	phase	back-channel logout planning failed	no such table: sys_oauth*	ERROR lines	result
scim-deactivation-reconcile-user	before	2	6	10	Tests 11 passed (11)
scim-deactivation-reconcile-user	after	0	0	0	Tests 11 passed (11)
scim-transaction-scope	before	0	0	2	Tests 5 passed (5)
scim-transaction-scope	after	0	0	2	Tests 5 passed (5)
credential-at-rest-posture (control, untouched)	before	0	0	0	Tests 5 passed (5)
credential-at-rest-posture (control, untouched)	after	0	0	0	Tests 5 passed (5)

The 2 ERROR lines that remain in scim-transaction-scope are that suite's own
deliberately injected failure ([#14522 test] injected failure on insert sys_scim_user),
unchanged in both phases. A diff of the ERROR lines before vs after found no line
present only in the after phase in either suite: registering the production set
introduced no new noise.

Whole package, on the merged tree: Test Files 91 passed (91) / Tests 1862 passed (1862),
and 0 occurrences of the line package-wide.

Two of the card's premises did not survive measurement

Reported here rather than quietly worked around.

1. scim-transaction-scope.test.ts never emitted the line. Its before count is 0,
   not because its object list differs — it was byte-identical to the other suite's —
   but because it never deletes a session. Its sign-in in case (c) is not a trigger.
   Its gap was latent, and the change to it is prophylactic with a measured delta
   of 0 to 0. It is in this PR because it is the same harness shape in the card's
   declared surface, and it is now un-driftable rather than accidentally quiet.
2. The control is not evidence. The card's whole basis for the remedy was that
   credential-at-rest-posture.test.ts registers the OAuth objects and does not emit
   the line. It does not emit the line, but it drives no auth request at all — no
   sign-in, no sign-out, no revocation — so its 0 is not attributable to its
   registration list. The causal evidence for this fix is the vendor source above plus
   the direct 2 to 0 measurement, not the control.

Registering from the manifest rather than from AUTH_OBJECTS

The card named the posture test's AUTH_OBJECTS as the reference. This PR follows the
triage's direction on the card instead (#14615 comment of 2026-09-02): that list is
itself a hand-copied second spelling of authIdentityObjects, and adding four names to
two more hand-lists would give the repo four copies of one truth — while the card's own
strongest observation is that this gap "already was [copied], twice". Importing the
production array is the only version that stops the next copy. AUTH_OBJECTS in the
posture test is deliberately not touched here.

Scope

• No changeset: test-only, publishes nothing (plugin-auth's files is
  ["dist","README.md","CHANGELOG.md"]). This is pr-automation.yml's route 2,
  "tests-only ... apply the skip-changeset label", which is the label's own preferred
  case. Label applied.
• No product source touched. auth-manager.ts is held by PR fix(plugin-auth): bind the dev-admin seed's operator-provisioning ticket to more than the seed address (#14373) #14730 and is not in this
  diff; the back-channel planner is the vendor's and was not modified. The card's second
  remedy direction — discriminating an absent table as a benign read — is not
  addressed here and remains a product decision, exactly as the triage ruled.
• Export surface unchanged: git diff -U0 origin/main...HEAD | grep -E '^[+-].*export'
  returns nothing.

Left alone deliberately

Four more AuthManager harnesses in plugin-auth still hand-write the object list
without the OAuth objects, and are ⛔ not touched here (the population, counted:
7 harnesses construct an AuthManager and register objects — 2 now import the
manifest, 1 hand-list carries the OAuth objects, 4 hand-lists do not):

• audience-bootstrap-seam.test.ts
• dev-admin-seed-credential-gate.test.ts
• sso-register-platform-admin-gate.test.ts
• walled-owner-operator-stamp.test.ts

None of them emits the line today — the package-wide count above is 0 — because none
deletes a session. They are latent copies of the same shape, for a separate card.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 7a17f3bf1e48e1e88f8e833a794e37bd40230f17 → packageMentionDocs.

[os-sales]

Fixes#14615

Both SCIM harnesses re-spelled plugin-auth's object set by hand and omitted every
OAuth object. They now import authIdentityObjects from the plugin's own manifest
instead — the same array auth-plugin.ts registers at runtime and
objectstack.config.ts declares at compile time — so a harness cannot drift from a
real deployment by construction. Test-only diff; two files.

What actually emits the line, measured

The card attributes the ERROR to POST /sign-in/email. That is not the trigger.
The vendor's own source is unambiguous — @better-auth/oauth-provider 1.7.2,
dist/authorize-BmTe2VYG.mjs, prepareBackchannelLogoutPlan is installed as a
databaseHooks.session.delete.before hook (line 4419), not a sign-in hook. It
reads exactly two models, both keyed on sessionId:

const[accessTokens,refreshTokens]=awaitPromise.all([adapter.findMany({model: "oauthAccessToken", where }),adapter.findMany({model: "oauthRefreshToken", where }),]);constaffectedClientIds=newSet();
...
if(affectedClientIds.size===0)returnnull;// returns BEFORE reading oauthClient

So the reads that demanded a registration are sys_oauth_access_token and
sys_oauth_refresh_token, and they are demanded by session revocation, not by
sign-in. oauthClient (sys_oauth_application) is reached only when a token row was
found, which never happens in a harness whose tables are empty, and oauthConsent
(sys_oauth_consent) is not read by this seam at all. That is why the fix is not
"the four OAuth objects from the posture test": two of those four are not demanded by
any read here, and importing the production set is both narrower in intent and wider
in coverage than hand-picking either number.

Before / after — same command, quoted

pnpm --filter @objectstack/plugin-auth exec vitest run --maxWorkers=2 src/SUITE.test.ts

suite	phase	back-channel logout planning failed	no such table: sys_oauth*	ERROR lines	result
scim-deactivation-reconcile-user	before	2	6	10	Tests 11 passed (11)
scim-deactivation-reconcile-user	after	0	0	0	Tests 11 passed (11)
scim-transaction-scope	before	0	0	2	Tests 5 passed (5)
scim-transaction-scope	after	0	0	2	Tests 5 passed (5)
credential-at-rest-posture (control, untouched)	before	0	0	0	Tests 5 passed (5)
credential-at-rest-posture (control, untouched)	after	0	0	0	Tests 5 passed (5)

The 2 ERROR lines that remain in scim-transaction-scope are that suite's own
deliberately injected failure ([#14522 test] injected failure on insert sys_scim_user),
unchanged in both phases. A diff of the ERROR lines before vs after found no line
present only in the after phase in either suite: registering the production set
introduced no new noise.

Whole package, on the merged tree: Test Files 91 passed (91) / Tests 1862 passed (1862),
and 0 occurrences of the line package-wide.

Two of the card's premises did not survive measurement

Reported here rather than quietly worked around.

1. scim-transaction-scope.test.ts never emitted the line. Its before count is 0,
   not because its object list differs — it was byte-identical to the other suite's —
   but because it never deletes a session. Its sign-in in case (c) is not a trigger.
   Its gap was latent, and the change to it is prophylactic with a measured delta
   of 0 to 0. It is in this PR because it is the same harness shape in the card's
   declared surface, and it is now un-driftable rather than accidentally quiet.
2. The control is not evidence. The card's whole basis for the remedy was that
   credential-at-rest-posture.test.ts registers the OAuth objects and does not emit
   the line. It does not emit the line, but it drives no auth request at all — no
   sign-in, no sign-out, no revocation — so its 0 is not attributable to its
   registration list. The causal evidence for this fix is the vendor source above plus
   the direct 2 to 0 measurement, not the control.

Registering from the manifest rather than from AUTH_OBJECTS

The card named the posture test's AUTH_OBJECTS as the reference. This PR follows the
triage's direction on the card instead (#14615 comment of 2026-09-02): that list is
itself a hand-copied second spelling of authIdentityObjects, and adding four names to
two more hand-lists would give the repo four copies of one truth — while the card's own
strongest observation is that this gap "already was [copied], twice". Importing the
production array is the only version that stops the next copy. AUTH_OBJECTS in the
posture test is deliberately not touched here.

Scope

• No changeset: test-only, publishes nothing (plugin-auth's files is
  ["dist","README.md","CHANGELOG.md"]). This is pr-automation.yml's route 2,
  "tests-only ... apply the skip-changeset label", which is the label's own preferred
  case. Label applied.
• No product source touched. auth-manager.ts is held by PR fix(plugin-auth): bind the dev-admin seed's operator-provisioning ticket to more than the seed address (#14373) #14730 and is not in this
  diff; the back-channel planner is the vendor's and was not modified. The card's second
  remedy direction — discriminating an absent table as a benign read — is not
  addressed here and remains a product decision, exactly as the triage ruled.
• Export surface unchanged: git diff -U0 origin/main...HEAD | grep -E '^[+-].*export'
  returns nothing.

Left alone deliberately

Four more AuthManager harnesses in plugin-auth still hand-write the object list
without the OAuth objects, and are ⛔ not touched here (the population, counted:
7 harnesses construct an AuthManager and register objects — 2 now import the
manifest, 1 hand-list carries the OAuth objects, 4 hand-lists do not):

• audience-bootstrap-seam.test.ts
• dev-admin-seed-credential-gate.test.ts
• sso-register-platform-admin-gate.test.ts
• walled-owner-operator-stamp.test.ts

None of them emits the line today — the package-wide count above is 0 — because none
deletes a session. They are latent copies of the same shape, for a separate card.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 7a17f3bf1e48e1e88f8e833a794e37bd40230f17 → packageMentionDocs.