test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle

[claude]

Fixes#14555

Resumption of a previous agent's branch. That agent pushed two commits and died before opening a PR or reporting, so nothing on the branch had been verified by anyone. This PR verifies the existing work item-by-item against the triage ruling, adds the one gate repair the work had broken, and lands it.

All measurements below were taken at f63bc0d22.

1. The previous agent's work, checked against the ruling

The ruling (issuecomment-5514107240) scoped five items. The branch carries all five, and each matches.

#	Ruling asked for	What the diff actually does	Match
1	Pin the SCIM DELETE of the last administrator; add a DELETE face to the existing suite	Adds one it(...) at scim-deactivation-reconcile-user.test.ts:487, inside the existing deactivating the last administrator is refused through SCIM describe. Asserts 403, the SCIM error schema, status: "403", a detail naming last administrator and ADR-0024 D5.2; then that the row survives, is unbanned, still signs in, and that the vendor tombstone rolled back	yes
1b	Do not restructure face (c) or the PATCH path	The whole test diff removes exactly five lines: three header-comment lines and the two timing constants of item 3. Face (c) at :430, its positive control at :468, and every PATCH face are byte-identical	yes
1c	Register through the harness list, not a hand-written object list	Untouched. The file still has import { authIdentityObjects } from './manifest.js' (line 71), const AUTH_OBJECTS = authIdentityObjects (line 102), consumed at line 174. The diff adds no object list	yes
2	Rewrite the stale last-admin-guard.ts header to describe 1.7.2	Bullets 1 and 2 rewritten (quoted below)	yes
3	Widen expiry to 5 s, wait expiry + 500 ms	TIMED_BAN_MS = 5_000, TIMED_BAN_WAIT_MS = TIMED_BAN_MS + 500. Both faces carry 60_000 timeouts; the whole face measured 25.84 s wall for the entire 13-test file, so 5.5 s of sleep sits far inside it	yes
3b	The positive control — "the most valuable single line in this card"	Present at :640. Identical setup, same timed ban, same wait, no SCIM deactivation, sign-in accepted, row unbanned	yes
4	One stale word in the auth-manager.ts docblock	admin-ban-endpoints.ts becomes user-ban-write.ts	yes
5	One clause: DELETE over a timed administrator ban also makes it permanent	Added to the same docblock (quoted below)	yes

Item 4 — proof that user-ban-write.ts is the live module, and that both modules exist. Both files are present on disk. The live import in auth-manager.ts is:

import{applyUserBan,applyUserUnban,SCIM_DEACTIVATION_BAN_REASON,}from'./user-ban-write.js';

admin-ban-endpoints.ts still exists and still exports runAdminBanUser / runAdminUnbanUser, so the old spelling was a stale attribution, not a dangling reference — the docblock credited the wrong module for the write this path performs.

2. Prose changed — before and after

Item 2, last-admin-guard.ts bullet 1. Before:

the better-auth admin plugin's ban endpoint writes it, and @better-auth/scim maps a SCIM active: false onto that same admin ban (which is why SCIM forces the admin plugin on — ADR-0071).

After: it now says 1.6.x mapped active: false onto the admin ban itself, that 1.7.0 removed that write in favour of an optional host callback, and that since #14360 the ban is landed by plugin-auth's own identity.reconcileUser — "the same column and the same hook, a different author". The installed dependency is @better-auth/scim1.7.2, so the version claim is current.

Item 2, bullet 2. Before:

deleting the sys_user row (#5941) — how every remove lands: SCIM DELETE /Users/{id}, better-auth's /admin/remove-user and /delete-user, an import, a script.

After, SCIM DELETE is removed from that list and called out as explicitly not a row delete on 1.7.2, arriving instead as bullet 1's ban write, "refused by guardBan on beforeUpdate and never reaches guardDelete". The rest of the row-delete half is unchanged.

Item 5, auth-manager.ts. Before:

account. Re-provisioning through the tombstone re-links the same user, the state turns active, and the SCIM ban is lifted by the second bullet.

After:

account — by the SAME branch as active: false, including over an administrator's timed ban, whose banExpires a DELETE therefore clears too: a deprovision cannot be outlived by an expiry the administrator set. For the same reason a DELETE is judged by the beforeUpdate guard below and never by any beforeDelete — deleting the last administrator through SCIM is refused exactly as deactivating them is. Re-provisioning through the tombstone re-links the same user, the state turns active, and the SCIM ban is lifted by the second bullet.

3. Ablations — both pins proved able to fail

Every leg: mutate, prove the mutation reached disk by blob hash and by literal-text counts on both the removed and injected text, run, restore against HEAD (never a bare git checkout -- path, which restores from a possibly-poisoned index), then prove restoration by blob equality and an empty git diff HEAD. Each ran under a trap ... EXIT INT TERM. No mutation was proved by a comment — esbuild strips those.

Ablation A — the positive control can fail. Inverted its sign-in expectation (expectSignInAccepted becomes expectSignInBanned).

HEAD blob = c27ebf78aec1fcdf64d3a2be894f076f61eb1be5
post blob = 8c90af927452afb782bfb322ecebb0174a8963f0 (differs: mutation on disk)
before: FROM-count=1 TO-count=0 after: FROM-count=0 TO-count=1

Mutated: Tests 1 failed | 12 skipped (13), failing precisely on the mechanism the control exists to observe:

AssertionError: expected BANNED_USER, got 200 {... "banned":true,
"banReason":"Policy violation","banExpires":"2026-09-03T02:56:41.983Z" ...}
expected 200 to be 403

That is the vendor's session.create auto-lift admitting a principal whose banExpires has passed — exactly the alternative explanation the ruling wanted excluded. Restored: blob back to c27ebf78, empty git diff HEAD, Tests 1 passed | 12 skipped (13).

Ablation B — the DELETE face exercises the guard. The ruling's own prose claims this face is refused through beforeUpdate and never reaches beforeDelete, so both legs were run. Predicted directions were fixed before running, and both held.

Leg	Mutation	Predicted	Measured
B1	registerHook('beforeUpdate', guardBan, ...) replaced by a no-op	red	red — Tests 1 failed | 12 skipped (13)
B2	registerHook('beforeDelete', guardDelete, ...) replaced by a no-op	green	green — Tests 1 passed | 12 skipped (13)

B1: HEAD blob = 40daa74e67a583fab91f31ee7eabe93dcebd2631
post blob = c9de082ca878d49388fe6d7252b54bfcb2d11263
B2: post blob = 8ea396623d8f680b8d01750dac79c8fda87177cd
both restored to 40daa74e..., empty `git diff HEAD`

B1's failure is the DELETE succeeding and returning an empty body where the 403 SCIM error JSON was expected (SyntaxError: Unexpected end of JSON input at the res.json() on line 503). B2 is green because the SCIM DELETE never reaches guardDelete at all.

Together these confirm the measured claim the branch ships in the guard header — "removing the beforeDelete registration leaves the SCIM DELETE face green, removing the beforeUpdate one reddens it" — is accurate as written, and that the new face is genuinely pinned to the guard rather than to an incidental 403.

4. One gate the branch had broken, repaired here

check-system-context-census was red on the branch as pushed, and would have reddened CI:

::error::[anchor-is-not-a-read-site] the page anchors .../last-admin-guard.ts:286 ...
::error::[ledger-row-unused] NON_READ_ANCHORS excuses .../last-admin-guard.ts:299 ...

Cause: the item-2 header rewrite added 13 net lines above the census's read site, moving the needle line applies to EVERY context, isSystem included from 286 to 299 (verified against the merge base: 286 there, 299 here). The gate's ledger row finds that line by needle, so it followed the code; content/docs/permissions/system-context.mdx hard-codes the number, so it did not — reddening both directions at once. Repaired with the gate's own --fix, which is the authority on the form:

re-anchored content/docs/permissions/system-context.mdx:201 `last-admin-guard.ts:286` -> `:299`
check-system-context-census: OK — 109 elevation read sites in 20 packages across 45 files,
all anchored; 145 anchors resolve, 27 declared non-read.

5. Verification

All at f63bc0d22.

• Target file:Test Files 1 passed (1) / Tests 13 passed (13)
• Whole affected package (@objectstack/plugin-auth, run because better-auth-schema-parity.test.ts reads auth-manager.ts as source text and a comment-only edit is not self-evidently inert to it): Test Files 91 passed (91) / Tests 1866 passed (1866)
• pnpm --filter @objectstack/plugin-auth typecheck: exit 0, including check:test-typecheck over tsconfig.test.json. This matters here: the build tsconfig.json excludes **/*.test.ts, so tsc --noEmit alone says nothing about the new test code; the test-layer program is what covers it, and this file carries no test-typecheck-debt.json entry, so it must be at zero errors.
• Gate family, re-derived in-worktree with node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack. The first derivation over the three original paths gave 28 commands; the census repair added content/docs/..., which pulled the count to 52. Re-deriving after that edit was load-bearing — 24 doc gates would otherwise have gone unrun. Union at f63bc0d22: 49 pass, 3 PREREQUISITE NOT MET.

The three unmeasured, each of which self-declares that it is neither a pass nor a finding:

Gate	Exit	Why
check-test-completeness.mjs	3	Needs a saved turbo run test log, which only CI tees. Its own text names the dispatch-gates family as this branch and says to record NOT MEASURED
check:dual-build-cjs-loads	3	Reads built output; 40 packages have no dist/. Needs a full pnpm build
check:type-check-debt	3	Needs the whole workspace closure built, or it "would silently measure a DIFFERENT WORLD"

check:skill-examples initially exited 1 on an unmet prerequisite (client-react unbuilt). Rather than record it unmeasured I built the closure and re-ran it: pass, 256 prose examples type-check across 3 surfaces.

6. Changeset

None owed. The diff is comment-only in two source files, one test file, and one docs anchor — no exported symbol, no payload key, no behaviour change. Both edited docblocks are off the published surface: the auth-manager.ts block documents private async reconcileScimUserLifecycle, and the last-admin-guard.ts block is a file-level header before the first import. This is pr-automation.yml's route 2 verbatim ("It releases nothing (.github/, .claude/, skills/, docs/, content/, examples/, tests-only, and the like) -- apply the skip-changeset label"), so the label is applied rather than an empty changeset.

7. Co-occupancy

• auth-manager.ts is co-occupied by open PR feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775 (claude/issue-13881-sys-user-locale), whose hunks sit at base lines 3029-4714 (the email/SMS locale docblocks). This branch's edits are at 5138 and 5164-5174, inside the SCIM reconcile docblock only. Disjoint. Nothing in 3029-4714 was touched, and the edits were anchored by content rather than by line number.
• [finding] plugin-auth SCIM harnesses register no OAuth objects, so every sign-in logs a Better Auth ERROR (back-channel logout planning failed … no such table: sys_oauth_access_token) #14615 / PR test(plugin-auth): register the production object set in the two SCIM harnesses #14751 is merged and already in the test file; its authIdentityObjects harness registration is untouched here.
• Per the ruling, SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522 (SCIM transaction residual) and [finding] SCIM forces the better-auth admin plugin on (pluginConfig.admin ?? scimEffective) and a deployment has no declared way to decline it — split from #13439 by the 2026-08-31 ruling #13816 (admin forcing) are not folded in, and the five stale assertion sites fenced on [finding] SCIM active:false no longer disables the account — the vendor ban coupling was removed upstream in @better-auth/scim 1.7.0 and nothing in this repo replaced it #14360 are not touched.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-auth, touching 2 documentable anchor(s).

3 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/kernel/contracts/auth-service.mdx(via AuthManager (symbol, a top-level class))
• content/docs/kernel/services-checklist.mdx(via AuthManager (symbol, a top-level class))
• content/docs/permissions/authentication.mdx(via AuthManager (symbol, a top-level class))

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 11 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 5a5336b399db2ef18dd4700f97d579a328197dda → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 35da8cc60775679ebda2af1255c4cf1972ecdaaa — the merge of head f63bc0d22ab6fbfdf63fd6569d0e94d13eb9df79 into base 5a5336b399db2ef18dd4700f97d579a328197dda, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 35da8cc60775679ebda2af1255c4cf1972ecdaaa && git checkout 35da8cc60775679ebda2af1255c4cf1972ecdaaa
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 5a5336b399db2ef18dd4700f97d579a328197dda f63bc0d22ab6fbfdf63fd6569d0e94d13eb9df79 && git checkout -B drift-repro 5a5336b399db2ef18dd4700f97d579a328197dda && git merge --no-ff f63bc0d22ab6fbfdf63fd6569d0e94d13eb9df79
node scripts/docs-audit/affected-docs.mjs --json 5a5336b399db2ef18dd4700f97d579a328197dda

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 5a5336b399db2ef18dd4700f97d579a328197dda → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33716744075 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1801
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 25 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(cli): make the unread-reader ceiling a load-independent constant at RUN_TIMEOUT_MS #14715、test(cli): derive the vitest tier population instead of freezing it in a list #14717、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(devx): partition os-regen-merge.sh's step-1 conflict message by class #14733、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、fix(deps): take the fix for the four OSV advisories blocking every manifest PR #14736、fix(tooling): a template-literal mode for the vocabulary gate's four shared textual scanners #14739、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815），分属 6 条投机栈 ⇒ 6 次独立命中。⚠️ 同签名的汇总 issue Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822 已作为重复关闭，且没有仍然打开的同签名汇总 issue ⇒ 本次不新建（新建只会再被判重）。请到它指向的那张 issue 上谈，或重开 Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822。
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 64 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33716557375 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1800
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 26 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(cli): make the unread-reader ceiling a load-independent constant at RUN_TIMEOUT_MS #14715、test(cli): derive the vitest tier population instead of freezing it in a list #14717、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(devx): partition os-regen-merge.sh's step-1 conflict message by class #14733、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、fix(deps): take the fix for the four OSV advisories blocking every manifest PR #14736、fix(tooling): a template-literal mode for the vocabulary gate's four shared textual scanners #14739、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、fix(service-automation): a try_catch whose catch region itself fails keeps both regions' step record #14813、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815），分属 5 条投机栈 ⇒ 5 次独立命中。⚠️ 同签名的汇总 issue Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822 已作为重复关闭，且没有仍然打开的同签名汇总 issue ⇒ 本次不新建（新建只会再被判重）。请到它指向的那张 issue 上谈，或重开 Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822。
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• ⚠️本 PR 过去 24h 已在队列失败 1 次（不含本次）。 内容未变而反复失败 ⇒ 高度怀疑 flaky 测试或与同组 PR 的语义冲突，重排不解决。
• 过去 24h 队列共有 69 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[claude]

Fixes#14555

Resumption of a previous agent's branch. That agent pushed two commits and died before opening a PR or reporting, so nothing on the branch had been verified by anyone. This PR verifies the existing work item-by-item against the triage ruling, adds the one gate repair the work had broken, and lands it.

All measurements below were taken at f63bc0d22.

1. The previous agent's work, checked against the ruling

The ruling (issuecomment-5514107240) scoped five items. The branch carries all five, and each matches.

#	Ruling asked for	What the diff actually does	Match
1	Pin the SCIM DELETE of the last administrator; add a DELETE face to the existing suite	Adds one it(...) at scim-deactivation-reconcile-user.test.ts:487, inside the existing deactivating the last administrator is refused through SCIM describe. Asserts 403, the SCIM error schema, status: "403", a detail naming last administrator and ADR-0024 D5.2; then that the row survives, is unbanned, still signs in, and that the vendor tombstone rolled back	yes
1b	Do not restructure face (c) or the PATCH path	The whole test diff removes exactly five lines: three header-comment lines and the two timing constants of item 3. Face (c) at :430, its positive control at :468, and every PATCH face are byte-identical	yes
1c	Register through the harness list, not a hand-written object list	Untouched. The file still has import { authIdentityObjects } from './manifest.js' (line 71), const AUTH_OBJECTS = authIdentityObjects (line 102), consumed at line 174. The diff adds no object list	yes
2	Rewrite the stale last-admin-guard.ts header to describe 1.7.2	Bullets 1 and 2 rewritten (quoted below)	yes
3	Widen expiry to 5 s, wait expiry + 500 ms	TIMED_BAN_MS = 5_000, TIMED_BAN_WAIT_MS = TIMED_BAN_MS + 500. Both faces carry 60_000 timeouts; the whole face measured 25.84 s wall for the entire 13-test file, so 5.5 s of sleep sits far inside it	yes
3b	The positive control — "the most valuable single line in this card"	Present at :640. Identical setup, same timed ban, same wait, no SCIM deactivation, sign-in accepted, row unbanned	yes
4	One stale word in the auth-manager.ts docblock	admin-ban-endpoints.ts becomes user-ban-write.ts	yes
5	One clause: DELETE over a timed administrator ban also makes it permanent	Added to the same docblock (quoted below)	yes

Item 4 — proof that user-ban-write.ts is the live module, and that both modules exist. Both files are present on disk. The live import in auth-manager.ts is:

import{applyUserBan,applyUserUnban,SCIM_DEACTIVATION_BAN_REASON,}from'./user-ban-write.js';

admin-ban-endpoints.ts still exists and still exports runAdminBanUser / runAdminUnbanUser, so the old spelling was a stale attribution, not a dangling reference — the docblock credited the wrong module for the write this path performs.

2. Prose changed — before and after

Item 2, last-admin-guard.ts bullet 1. Before:

the better-auth admin plugin's ban endpoint writes it, and @better-auth/scim maps a SCIM active: false onto that same admin ban (which is why SCIM forces the admin plugin on — ADR-0071).

After: it now says 1.6.x mapped active: false onto the admin ban itself, that 1.7.0 removed that write in favour of an optional host callback, and that since #14360 the ban is landed by plugin-auth's own identity.reconcileUser — "the same column and the same hook, a different author". The installed dependency is @better-auth/scim1.7.2, so the version claim is current.

Item 2, bullet 2. Before:

deleting the sys_user row (#5941) — how every remove lands: SCIM DELETE /Users/{id}, better-auth's /admin/remove-user and /delete-user, an import, a script.

After, SCIM DELETE is removed from that list and called out as explicitly not a row delete on 1.7.2, arriving instead as bullet 1's ban write, "refused by guardBan on beforeUpdate and never reaches guardDelete". The rest of the row-delete half is unchanged.

Item 5, auth-manager.ts. Before:

account. Re-provisioning through the tombstone re-links the same user, the state turns active, and the SCIM ban is lifted by the second bullet.

After:

account — by the SAME branch as active: false, including over an administrator's timed ban, whose banExpires a DELETE therefore clears too: a deprovision cannot be outlived by an expiry the administrator set. For the same reason a DELETE is judged by the beforeUpdate guard below and never by any beforeDelete — deleting the last administrator through SCIM is refused exactly as deactivating them is. Re-provisioning through the tombstone re-links the same user, the state turns active, and the SCIM ban is lifted by the second bullet.

3. Ablations — both pins proved able to fail

Every leg: mutate, prove the mutation reached disk by blob hash and by literal-text counts on both the removed and injected text, run, restore against HEAD (never a bare git checkout -- path, which restores from a possibly-poisoned index), then prove restoration by blob equality and an empty git diff HEAD. Each ran under a trap ... EXIT INT TERM. No mutation was proved by a comment — esbuild strips those.

Ablation A — the positive control can fail. Inverted its sign-in expectation (expectSignInAccepted becomes expectSignInBanned).

HEAD blob = c27ebf78aec1fcdf64d3a2be894f076f61eb1be5
post blob = 8c90af927452afb782bfb322ecebb0174a8963f0 (differs: mutation on disk)
before: FROM-count=1 TO-count=0 after: FROM-count=0 TO-count=1

Mutated: Tests 1 failed | 12 skipped (13), failing precisely on the mechanism the control exists to observe:

AssertionError: expected BANNED_USER, got 200 {... "banned":true,
"banReason":"Policy violation","banExpires":"2026-09-03T02:56:41.983Z" ...}
expected 200 to be 403

That is the vendor's session.create auto-lift admitting a principal whose banExpires has passed — exactly the alternative explanation the ruling wanted excluded. Restored: blob back to c27ebf78, empty git diff HEAD, Tests 1 passed | 12 skipped (13).

Ablation B — the DELETE face exercises the guard. The ruling's own prose claims this face is refused through beforeUpdate and never reaches beforeDelete, so both legs were run. Predicted directions were fixed before running, and both held.

Leg	Mutation	Predicted	Measured
B1	registerHook('beforeUpdate', guardBan, ...) replaced by a no-op	red	red — Tests 1 failed | 12 skipped (13)
B2	registerHook('beforeDelete', guardDelete, ...) replaced by a no-op	green	green — Tests 1 passed | 12 skipped (13)

B1: HEAD blob = 40daa74e67a583fab91f31ee7eabe93dcebd2631
post blob = c9de082ca878d49388fe6d7252b54bfcb2d11263
B2: post blob = 8ea396623d8f680b8d01750dac79c8fda87177cd
both restored to 40daa74e..., empty `git diff HEAD`

B1's failure is the DELETE succeeding and returning an empty body where the 403 SCIM error JSON was expected (SyntaxError: Unexpected end of JSON input at the res.json() on line 503). B2 is green because the SCIM DELETE never reaches guardDelete at all.

Together these confirm the measured claim the branch ships in the guard header — "removing the beforeDelete registration leaves the SCIM DELETE face green, removing the beforeUpdate one reddens it" — is accurate as written, and that the new face is genuinely pinned to the guard rather than to an incidental 403.

4. One gate the branch had broken, repaired here

check-system-context-census was red on the branch as pushed, and would have reddened CI:

::error::[anchor-is-not-a-read-site] the page anchors .../last-admin-guard.ts:286 ...
::error::[ledger-row-unused] NON_READ_ANCHORS excuses .../last-admin-guard.ts:299 ...

Cause: the item-2 header rewrite added 13 net lines above the census's read site, moving the needle line applies to EVERY context, isSystem included from 286 to 299 (verified against the merge base: 286 there, 299 here). The gate's ledger row finds that line by needle, so it followed the code; content/docs/permissions/system-context.mdx hard-codes the number, so it did not — reddening both directions at once. Repaired with the gate's own --fix, which is the authority on the form:

re-anchored content/docs/permissions/system-context.mdx:201 `last-admin-guard.ts:286` -> `:299`
check-system-context-census: OK — 109 elevation read sites in 20 packages across 45 files,
all anchored; 145 anchors resolve, 27 declared non-read.

5. Verification

All at f63bc0d22.

• Target file:Test Files 1 passed (1) / Tests 13 passed (13)
• Whole affected package (@objectstack/plugin-auth, run because better-auth-schema-parity.test.ts reads auth-manager.ts as source text and a comment-only edit is not self-evidently inert to it): Test Files 91 passed (91) / Tests 1866 passed (1866)
• pnpm --filter @objectstack/plugin-auth typecheck: exit 0, including check:test-typecheck over tsconfig.test.json. This matters here: the build tsconfig.json excludes **/*.test.ts, so tsc --noEmit alone says nothing about the new test code; the test-layer program is what covers it, and this file carries no test-typecheck-debt.json entry, so it must be at zero errors.
• Gate family, re-derived in-worktree with node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack. The first derivation over the three original paths gave 28 commands; the census repair added content/docs/..., which pulled the count to 52. Re-deriving after that edit was load-bearing — 24 doc gates would otherwise have gone unrun. Union at f63bc0d22: 49 pass, 3 PREREQUISITE NOT MET.

The three unmeasured, each of which self-declares that it is neither a pass nor a finding:

Gate	Exit	Why
check-test-completeness.mjs	3	Needs a saved turbo run test log, which only CI tees. Its own text names the dispatch-gates family as this branch and says to record NOT MEASURED
check:dual-build-cjs-loads	3	Reads built output; 40 packages have no dist/. Needs a full pnpm build
check:type-check-debt	3	Needs the whole workspace closure built, or it "would silently measure a DIFFERENT WORLD"

check:skill-examples initially exited 1 on an unmet prerequisite (client-react unbuilt). Rather than record it unmeasured I built the closure and re-ran it: pass, 256 prose examples type-check across 3 surfaces.

6. Changeset

None owed. The diff is comment-only in two source files, one test file, and one docs anchor — no exported symbol, no payload key, no behaviour change. Both edited docblocks are off the published surface: the auth-manager.ts block documents private async reconcileScimUserLifecycle, and the last-admin-guard.ts block is a file-level header before the first import. This is pr-automation.yml's route 2 verbatim ("It releases nothing (.github/, .claude/, skills/, docs/, content/, examples/, tests-only, and the like) -- apply the skip-changeset label"), so the label is applied rather than an empty changeset.

7. Co-occupancy

• auth-manager.ts is co-occupied by open PR feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775 (claude/issue-13881-sys-user-locale), whose hunks sit at base lines 3029-4714 (the email/SMS locale docblocks). This branch's edits are at 5138 and 5164-5174, inside the SCIM reconcile docblock only. Disjoint. Nothing in 3029-4714 was touched, and the edits were anchored by content rather than by line number.
• [finding] plugin-auth SCIM harnesses register no OAuth objects, so every sign-in logs a Better Auth ERROR (back-channel logout planning failed … no such table: sys_oauth_access_token) #14615 / PR test(plugin-auth): register the production object set in the two SCIM harnesses #14751 is merged and already in the test file; its authIdentityObjects harness registration is untouched here.
• Per the ruling, SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522 (SCIM transaction residual) and [finding] SCIM forces the better-auth admin plugin on (pluginConfig.admin ?? scimEffective) and a deployment has no declared way to decline it — split from #13439 by the 2026-08-31 ruling #13816 (admin forcing) are not folded in, and the five stale assertion sites fenced on [finding] SCIM active:false no longer disables the account — the vendor ban coupling was removed upstream in @better-auth/scim 1.7.0 and nothing in this repo replaced it #14360 are not touched.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-auth, touching 2 documentable anchor(s).

3 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/kernel/contracts/auth-service.mdx(via AuthManager (symbol, a top-level class))
• content/docs/kernel/services-checklist.mdx(via AuthManager (symbol, a top-level class))
• content/docs/permissions/authentication.mdx(via AuthManager (symbol, a top-level class))

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 11 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 5a5336b399db2ef18dd4700f97d579a328197dda → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 35da8cc60775679ebda2af1255c4cf1972ecdaaa — the merge of head f63bc0d22ab6fbfdf63fd6569d0e94d13eb9df79 into base 5a5336b399db2ef18dd4700f97d579a328197dda, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 35da8cc60775679ebda2af1255c4cf1972ecdaaa && git checkout 35da8cc60775679ebda2af1255c4cf1972ecdaaa
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 5a5336b399db2ef18dd4700f97d579a328197dda f63bc0d22ab6fbfdf63fd6569d0e94d13eb9df79 && git checkout -B drift-repro 5a5336b399db2ef18dd4700f97d579a328197dda && git merge --no-ff f63bc0d22ab6fbfdf63fd6569d0e94d13eb9df79
node scripts/docs-audit/affected-docs.mjs --json 5a5336b399db2ef18dd4700f97d579a328197dda

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 5a5336b399db2ef18dd4700f97d579a328197dda → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33716744075 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1801
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 25 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(cli): make the unread-reader ceiling a load-independent constant at RUN_TIMEOUT_MS #14715、test(cli): derive the vitest tier population instead of freezing it in a list #14717、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(devx): partition os-regen-merge.sh's step-1 conflict message by class #14733、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、fix(deps): take the fix for the four OSV advisories blocking every manifest PR #14736、fix(tooling): a template-literal mode for the vocabulary gate's four shared textual scanners #14739、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815），分属 6 条投机栈 ⇒ 6 次独立命中。⚠️ 同签名的汇总 issue Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822 已作为重复关闭，且没有仍然打开的同签名汇总 issue ⇒ 本次不新建（新建只会再被判重）。请到它指向的那张 issue 上谈，或重开 Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822。
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 64 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33716557375 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1800
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 26 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(cli): make the unread-reader ceiling a load-independent constant at RUN_TIMEOUT_MS #14715、test(cli): derive the vitest tier population instead of freezing it in a list #14717、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(devx): partition os-regen-merge.sh's step-1 conflict message by class #14733、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、fix(deps): take the fix for the four OSV advisories blocking every manifest PR #14736、fix(tooling): a template-literal mode for the vocabulary gate's four shared textual scanners #14739、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、fix(service-automation): a try_catch whose catch region itself fails keeps both regions' step record #14813、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815），分属 5 条投机栈 ⇒ 5 次独立命中。⚠️ 同签名的汇总 issue Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822 已作为重复关闭，且没有仍然打开的同签名汇总 issue ⇒ 本次不新建（新建只会再被判重）。请到它指向的那张 issue 上谈，或重开 Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822。
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• ⚠️本 PR 过去 24h 已在队列失败 1 次（不含本次）。 内容未变而反复失败 ⇒ 高度怀疑 flaky 测试或与同组 PR 的语义冲突，重排不解决。
• 过去 24h 队列共有 69 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[claude]

Fixes#14555

Resumption of a previous agent's branch. That agent pushed two commits and died before opening a PR or reporting, so nothing on the branch had been verified by anyone. This PR verifies the existing work item-by-item against the triage ruling, adds the one gate repair the work had broken, and lands it.

All measurements below were taken at f63bc0d22.

1. The previous agent's work, checked against the ruling

The ruling (issuecomment-5514107240) scoped five items. The branch carries all five, and each matches.

#	Ruling asked for	What the diff actually does	Match
1	Pin the SCIM DELETE of the last administrator; add a DELETE face to the existing suite	Adds one it(...) at scim-deactivation-reconcile-user.test.ts:487, inside the existing deactivating the last administrator is refused through SCIM describe. Asserts 403, the SCIM error schema, status: "403", a detail naming last administrator and ADR-0024 D5.2; then that the row survives, is unbanned, still signs in, and that the vendor tombstone rolled back	yes
1b	Do not restructure face (c) or the PATCH path	The whole test diff removes exactly five lines: three header-comment lines and the two timing constants of item 3. Face (c) at :430, its positive control at :468, and every PATCH face are byte-identical	yes
1c	Register through the harness list, not a hand-written object list	Untouched. The file still has import { authIdentityObjects } from './manifest.js' (line 71), const AUTH_OBJECTS = authIdentityObjects (line 102), consumed at line 174. The diff adds no object list	yes
2	Rewrite the stale last-admin-guard.ts header to describe 1.7.2	Bullets 1 and 2 rewritten (quoted below)	yes
3	Widen expiry to 5 s, wait expiry + 500 ms	TIMED_BAN_MS = 5_000, TIMED_BAN_WAIT_MS = TIMED_BAN_MS + 500. Both faces carry 60_000 timeouts; the whole face measured 25.84 s wall for the entire 13-test file, so 5.5 s of sleep sits far inside it	yes
3b	The positive control — "the most valuable single line in this card"	Present at :640. Identical setup, same timed ban, same wait, no SCIM deactivation, sign-in accepted, row unbanned	yes
4	One stale word in the auth-manager.ts docblock	admin-ban-endpoints.ts becomes user-ban-write.ts	yes
5	One clause: DELETE over a timed administrator ban also makes it permanent	Added to the same docblock (quoted below)	yes

Item 4 — proof that user-ban-write.ts is the live module, and that both modules exist. Both files are present on disk. The live import in auth-manager.ts is:

import{applyUserBan,applyUserUnban,SCIM_DEACTIVATION_BAN_REASON,}from'./user-ban-write.js';

admin-ban-endpoints.ts still exists and still exports runAdminBanUser / runAdminUnbanUser, so the old spelling was a stale attribution, not a dangling reference — the docblock credited the wrong module for the write this path performs.

2. Prose changed — before and after

Item 2, last-admin-guard.ts bullet 1. Before:

the better-auth admin plugin's ban endpoint writes it, and @better-auth/scim maps a SCIM active: false onto that same admin ban (which is why SCIM forces the admin plugin on — ADR-0071).

After: it now says 1.6.x mapped active: false onto the admin ban itself, that 1.7.0 removed that write in favour of an optional host callback, and that since #14360 the ban is landed by plugin-auth's own identity.reconcileUser — "the same column and the same hook, a different author". The installed dependency is @better-auth/scim1.7.2, so the version claim is current.

Item 2, bullet 2. Before:

deleting the sys_user row (#5941) — how every remove lands: SCIM DELETE /Users/{id}, better-auth's /admin/remove-user and /delete-user, an import, a script.

After, SCIM DELETE is removed from that list and called out as explicitly not a row delete on 1.7.2, arriving instead as bullet 1's ban write, "refused by guardBan on beforeUpdate and never reaches guardDelete". The rest of the row-delete half is unchanged.

Item 5, auth-manager.ts. Before:

account. Re-provisioning through the tombstone re-links the same user, the state turns active, and the SCIM ban is lifted by the second bullet.

After:

account — by the SAME branch as active: false, including over an administrator's timed ban, whose banExpires a DELETE therefore clears too: a deprovision cannot be outlived by an expiry the administrator set. For the same reason a DELETE is judged by the beforeUpdate guard below and never by any beforeDelete — deleting the last administrator through SCIM is refused exactly as deactivating them is. Re-provisioning through the tombstone re-links the same user, the state turns active, and the SCIM ban is lifted by the second bullet.

3. Ablations — both pins proved able to fail

Every leg: mutate, prove the mutation reached disk by blob hash and by literal-text counts on both the removed and injected text, run, restore against HEAD (never a bare git checkout -- path, which restores from a possibly-poisoned index), then prove restoration by blob equality and an empty git diff HEAD. Each ran under a trap ... EXIT INT TERM. No mutation was proved by a comment — esbuild strips those.

Ablation A — the positive control can fail. Inverted its sign-in expectation (expectSignInAccepted becomes expectSignInBanned).

HEAD blob = c27ebf78aec1fcdf64d3a2be894f076f61eb1be5
post blob = 8c90af927452afb782bfb322ecebb0174a8963f0 (differs: mutation on disk)
before: FROM-count=1 TO-count=0 after: FROM-count=0 TO-count=1

Mutated: Tests 1 failed | 12 skipped (13), failing precisely on the mechanism the control exists to observe:

AssertionError: expected BANNED_USER, got 200 {... "banned":true,
"banReason":"Policy violation","banExpires":"2026-09-03T02:56:41.983Z" ...}
expected 200 to be 403

That is the vendor's session.create auto-lift admitting a principal whose banExpires has passed — exactly the alternative explanation the ruling wanted excluded. Restored: blob back to c27ebf78, empty git diff HEAD, Tests 1 passed | 12 skipped (13).

Ablation B — the DELETE face exercises the guard. The ruling's own prose claims this face is refused through beforeUpdate and never reaches beforeDelete, so both legs were run. Predicted directions were fixed before running, and both held.

Leg	Mutation	Predicted	Measured
B1	registerHook('beforeUpdate', guardBan, ...) replaced by a no-op	red	red — Tests 1 failed | 12 skipped (13)
B2	registerHook('beforeDelete', guardDelete, ...) replaced by a no-op	green	green — Tests 1 passed | 12 skipped (13)

B1: HEAD blob = 40daa74e67a583fab91f31ee7eabe93dcebd2631
post blob = c9de082ca878d49388fe6d7252b54bfcb2d11263
B2: post blob = 8ea396623d8f680b8d01750dac79c8fda87177cd
both restored to 40daa74e..., empty `git diff HEAD`

B1's failure is the DELETE succeeding and returning an empty body where the 403 SCIM error JSON was expected (SyntaxError: Unexpected end of JSON input at the res.json() on line 503). B2 is green because the SCIM DELETE never reaches guardDelete at all.

Together these confirm the measured claim the branch ships in the guard header — "removing the beforeDelete registration leaves the SCIM DELETE face green, removing the beforeUpdate one reddens it" — is accurate as written, and that the new face is genuinely pinned to the guard rather than to an incidental 403.

4. One gate the branch had broken, repaired here

check-system-context-census was red on the branch as pushed, and would have reddened CI:

::error::[anchor-is-not-a-read-site] the page anchors .../last-admin-guard.ts:286 ...
::error::[ledger-row-unused] NON_READ_ANCHORS excuses .../last-admin-guard.ts:299 ...

Cause: the item-2 header rewrite added 13 net lines above the census's read site, moving the needle line applies to EVERY context, isSystem included from 286 to 299 (verified against the merge base: 286 there, 299 here). The gate's ledger row finds that line by needle, so it followed the code; content/docs/permissions/system-context.mdx hard-codes the number, so it did not — reddening both directions at once. Repaired with the gate's own --fix, which is the authority on the form:

re-anchored content/docs/permissions/system-context.mdx:201 `last-admin-guard.ts:286` -> `:299`
check-system-context-census: OK — 109 elevation read sites in 20 packages across 45 files,
all anchored; 145 anchors resolve, 27 declared non-read.

5. Verification

All at f63bc0d22.

• Target file:Test Files 1 passed (1) / Tests 13 passed (13)
• Whole affected package (@objectstack/plugin-auth, run because better-auth-schema-parity.test.ts reads auth-manager.ts as source text and a comment-only edit is not self-evidently inert to it): Test Files 91 passed (91) / Tests 1866 passed (1866)
• pnpm --filter @objectstack/plugin-auth typecheck: exit 0, including check:test-typecheck over tsconfig.test.json. This matters here: the build tsconfig.json excludes **/*.test.ts, so tsc --noEmit alone says nothing about the new test code; the test-layer program is what covers it, and this file carries no test-typecheck-debt.json entry, so it must be at zero errors.
• Gate family, re-derived in-worktree with node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack. The first derivation over the three original paths gave 28 commands; the census repair added content/docs/..., which pulled the count to 52. Re-deriving after that edit was load-bearing — 24 doc gates would otherwise have gone unrun. Union at f63bc0d22: 49 pass, 3 PREREQUISITE NOT MET.

The three unmeasured, each of which self-declares that it is neither a pass nor a finding:

Gate	Exit	Why
check-test-completeness.mjs	3	Needs a saved turbo run test log, which only CI tees. Its own text names the dispatch-gates family as this branch and says to record NOT MEASURED
check:dual-build-cjs-loads	3	Reads built output; 40 packages have no dist/. Needs a full pnpm build
check:type-check-debt	3	Needs the whole workspace closure built, or it "would silently measure a DIFFERENT WORLD"

check:skill-examples initially exited 1 on an unmet prerequisite (client-react unbuilt). Rather than record it unmeasured I built the closure and re-ran it: pass, 256 prose examples type-check across 3 surfaces.

6. Changeset

None owed. The diff is comment-only in two source files, one test file, and one docs anchor — no exported symbol, no payload key, no behaviour change. Both edited docblocks are off the published surface: the auth-manager.ts block documents private async reconcileScimUserLifecycle, and the last-admin-guard.ts block is a file-level header before the first import. This is pr-automation.yml's route 2 verbatim ("It releases nothing (.github/, .claude/, skills/, docs/, content/, examples/, tests-only, and the like) -- apply the skip-changeset label"), so the label is applied rather than an empty changeset.

7. Co-occupancy

• auth-manager.ts is co-occupied by open PR feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775 (claude/issue-13881-sys-user-locale), whose hunks sit at base lines 3029-4714 (the email/SMS locale docblocks). This branch's edits are at 5138 and 5164-5174, inside the SCIM reconcile docblock only. Disjoint. Nothing in 3029-4714 was touched, and the edits were anchored by content rather than by line number.
• [finding] plugin-auth SCIM harnesses register no OAuth objects, so every sign-in logs a Better Auth ERROR (back-channel logout planning failed … no such table: sys_oauth_access_token) #14615 / PR test(plugin-auth): register the production object set in the two SCIM harnesses #14751 is merged and already in the test file; its authIdentityObjects harness registration is untouched here.
• Per the ruling, SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522 (SCIM transaction residual) and [finding] SCIM forces the better-auth admin plugin on (pluginConfig.admin ?? scimEffective) and a deployment has no declared way to decline it — split from #13439 by the 2026-08-31 ruling #13816 (admin forcing) are not folded in, and the five stale assertion sites fenced on [finding] SCIM active:false no longer disables the account — the vendor ban coupling was removed upstream in @better-auth/scim 1.7.0 and nothing in this repo replaced it #14360 are not touched.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-auth, touching 2 documentable anchor(s).

3 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/kernel/contracts/auth-service.mdx(via AuthManager (symbol, a top-level class))
• content/docs/kernel/services-checklist.mdx(via AuthManager (symbol, a top-level class))
• content/docs/permissions/authentication.mdx(via AuthManager (symbol, a top-level class))

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 11 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 5a5336b399db2ef18dd4700f97d579a328197dda → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 35da8cc60775679ebda2af1255c4cf1972ecdaaa — the merge of head f63bc0d22ab6fbfdf63fd6569d0e94d13eb9df79 into base 5a5336b399db2ef18dd4700f97d579a328197dda, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 35da8cc60775679ebda2af1255c4cf1972ecdaaa && git checkout 35da8cc60775679ebda2af1255c4cf1972ecdaaa
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 5a5336b399db2ef18dd4700f97d579a328197dda f63bc0d22ab6fbfdf63fd6569d0e94d13eb9df79 && git checkout -B drift-repro 5a5336b399db2ef18dd4700f97d579a328197dda && git merge --no-ff f63bc0d22ab6fbfdf63fd6569d0e94d13eb9df79
node scripts/docs-audit/affected-docs.mjs --json 5a5336b399db2ef18dd4700f97d579a328197dda

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 5a5336b399db2ef18dd4700f97d579a328197dda → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33716744075 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1801
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 25 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(cli): make the unread-reader ceiling a load-independent constant at RUN_TIMEOUT_MS #14715、test(cli): derive the vitest tier population instead of freezing it in a list #14717、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(devx): partition os-regen-merge.sh's step-1 conflict message by class #14733、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、fix(deps): take the fix for the four OSV advisories blocking every manifest PR #14736、fix(tooling): a template-literal mode for the vocabulary gate's four shared textual scanners #14739、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815），分属 6 条投机栈 ⇒ 6 次独立命中。⚠️ 同签名的汇总 issue Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822 已作为重复关闭，且没有仍然打开的同签名汇总 issue ⇒ 本次不新建（新建只会再被判重）。请到它指向的那张 issue 上谈，或重开 Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822。
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 64 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33716557375 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1800
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 26 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(cli): make the unread-reader ceiling a load-independent constant at RUN_TIMEOUT_MS #14715、test(cli): derive the vitest tier population instead of freezing it in a list #14717、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(devx): partition os-regen-merge.sh's step-1 conflict message by class #14733、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、fix(deps): take the fix for the four OSV advisories blocking every manifest PR #14736、fix(tooling): a template-literal mode for the vocabulary gate's four shared textual scanners #14739、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、fix(service-automation): a try_catch whose catch region itself fails keeps both regions' step record #14813、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815），分属 5 条投机栈 ⇒ 5 次独立命中。⚠️ 同签名的汇总 issue Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822 已作为重复关闭，且没有仍然打开的同签名汇总 issue ⇒ 本次不新建（新建只会再被判重）。请到它指向的那张 issue 上谈，或重开 Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822。
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• ⚠️本 PR 过去 24h 已在队列失败 1 次（不含本次）。 内容未变而反复失败 ⇒ 高度怀疑 flaky 测试或与同组 PR 的语义冲突，重排不解决。
• 过去 24h 队列共有 69 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[claude]

Fixes#14555

Resumption of a previous agent's branch. That agent pushed two commits and died before opening a PR or reporting, so nothing on the branch had been verified by anyone. This PR verifies the existing work item-by-item against the triage ruling, adds the one gate repair the work had broken, and lands it.

All measurements below were taken at f63bc0d22.

1. The previous agent's work, checked against the ruling

The ruling (issuecomment-5514107240) scoped five items. The branch carries all five, and each matches.

#	Ruling asked for	What the diff actually does	Match
1	Pin the SCIM DELETE of the last administrator; add a DELETE face to the existing suite	Adds one it(...) at scim-deactivation-reconcile-user.test.ts:487, inside the existing deactivating the last administrator is refused through SCIM describe. Asserts 403, the SCIM error schema, status: "403", a detail naming last administrator and ADR-0024 D5.2; then that the row survives, is unbanned, still signs in, and that the vendor tombstone rolled back	yes
1b	Do not restructure face (c) or the PATCH path	The whole test diff removes exactly five lines: three header-comment lines and the two timing constants of item 3. Face (c) at :430, its positive control at :468, and every PATCH face are byte-identical	yes
1c	Register through the harness list, not a hand-written object list	Untouched. The file still has import { authIdentityObjects } from './manifest.js' (line 71), const AUTH_OBJECTS = authIdentityObjects (line 102), consumed at line 174. The diff adds no object list	yes
2	Rewrite the stale last-admin-guard.ts header to describe 1.7.2	Bullets 1 and 2 rewritten (quoted below)	yes
3	Widen expiry to 5 s, wait expiry + 500 ms	TIMED_BAN_MS = 5_000, TIMED_BAN_WAIT_MS = TIMED_BAN_MS + 500. Both faces carry 60_000 timeouts; the whole face measured 25.84 s wall for the entire 13-test file, so 5.5 s of sleep sits far inside it	yes
3b	The positive control — "the most valuable single line in this card"	Present at :640. Identical setup, same timed ban, same wait, no SCIM deactivation, sign-in accepted, row unbanned	yes
4	One stale word in the auth-manager.ts docblock	admin-ban-endpoints.ts becomes user-ban-write.ts	yes
5	One clause: DELETE over a timed administrator ban also makes it permanent	Added to the same docblock (quoted below)	yes

Item 4 — proof that user-ban-write.ts is the live module, and that both modules exist. Both files are present on disk. The live import in auth-manager.ts is:

import{applyUserBan,applyUserUnban,SCIM_DEACTIVATION_BAN_REASON,}from'./user-ban-write.js';

admin-ban-endpoints.ts still exists and still exports runAdminBanUser / runAdminUnbanUser, so the old spelling was a stale attribution, not a dangling reference — the docblock credited the wrong module for the write this path performs.

2. Prose changed — before and after

Item 2, last-admin-guard.ts bullet 1. Before:

the better-auth admin plugin's ban endpoint writes it, and @better-auth/scim maps a SCIM active: false onto that same admin ban (which is why SCIM forces the admin plugin on — ADR-0071).

After: it now says 1.6.x mapped active: false onto the admin ban itself, that 1.7.0 removed that write in favour of an optional host callback, and that since #14360 the ban is landed by plugin-auth's own identity.reconcileUser — "the same column and the same hook, a different author". The installed dependency is @better-auth/scim1.7.2, so the version claim is current.

Item 2, bullet 2. Before:

deleting the sys_user row (#5941) — how every remove lands: SCIM DELETE /Users/{id}, better-auth's /admin/remove-user and /delete-user, an import, a script.

After, SCIM DELETE is removed from that list and called out as explicitly not a row delete on 1.7.2, arriving instead as bullet 1's ban write, "refused by guardBan on beforeUpdate and never reaches guardDelete". The rest of the row-delete half is unchanged.

Item 5, auth-manager.ts. Before:

account. Re-provisioning through the tombstone re-links the same user, the state turns active, and the SCIM ban is lifted by the second bullet.

After:

account — by the SAME branch as active: false, including over an administrator's timed ban, whose banExpires a DELETE therefore clears too: a deprovision cannot be outlived by an expiry the administrator set. For the same reason a DELETE is judged by the beforeUpdate guard below and never by any beforeDelete — deleting the last administrator through SCIM is refused exactly as deactivating them is. Re-provisioning through the tombstone re-links the same user, the state turns active, and the SCIM ban is lifted by the second bullet.

3. Ablations — both pins proved able to fail

Every leg: mutate, prove the mutation reached disk by blob hash and by literal-text counts on both the removed and injected text, run, restore against HEAD (never a bare git checkout -- path, which restores from a possibly-poisoned index), then prove restoration by blob equality and an empty git diff HEAD. Each ran under a trap ... EXIT INT TERM. No mutation was proved by a comment — esbuild strips those.

Ablation A — the positive control can fail. Inverted its sign-in expectation (expectSignInAccepted becomes expectSignInBanned).

HEAD blob = c27ebf78aec1fcdf64d3a2be894f076f61eb1be5
post blob = 8c90af927452afb782bfb322ecebb0174a8963f0 (differs: mutation on disk)
before: FROM-count=1 TO-count=0 after: FROM-count=0 TO-count=1

Mutated: Tests 1 failed | 12 skipped (13), failing precisely on the mechanism the control exists to observe:

AssertionError: expected BANNED_USER, got 200 {... "banned":true,
"banReason":"Policy violation","banExpires":"2026-09-03T02:56:41.983Z" ...}
expected 200 to be 403

That is the vendor's session.create auto-lift admitting a principal whose banExpires has passed — exactly the alternative explanation the ruling wanted excluded. Restored: blob back to c27ebf78, empty git diff HEAD, Tests 1 passed | 12 skipped (13).

Ablation B — the DELETE face exercises the guard. The ruling's own prose claims this face is refused through beforeUpdate and never reaches beforeDelete, so both legs were run. Predicted directions were fixed before running, and both held.

Leg	Mutation	Predicted	Measured
B1	registerHook('beforeUpdate', guardBan, ...) replaced by a no-op	red	red — Tests 1 failed | 12 skipped (13)
B2	registerHook('beforeDelete', guardDelete, ...) replaced by a no-op	green	green — Tests 1 passed | 12 skipped (13)

B1: HEAD blob = 40daa74e67a583fab91f31ee7eabe93dcebd2631
post blob = c9de082ca878d49388fe6d7252b54bfcb2d11263
B2: post blob = 8ea396623d8f680b8d01750dac79c8fda87177cd
both restored to 40daa74e..., empty `git diff HEAD`

B1's failure is the DELETE succeeding and returning an empty body where the 403 SCIM error JSON was expected (SyntaxError: Unexpected end of JSON input at the res.json() on line 503). B2 is green because the SCIM DELETE never reaches guardDelete at all.

Together these confirm the measured claim the branch ships in the guard header — "removing the beforeDelete registration leaves the SCIM DELETE face green, removing the beforeUpdate one reddens it" — is accurate as written, and that the new face is genuinely pinned to the guard rather than to an incidental 403.

4. One gate the branch had broken, repaired here

check-system-context-census was red on the branch as pushed, and would have reddened CI:

::error::[anchor-is-not-a-read-site] the page anchors .../last-admin-guard.ts:286 ...
::error::[ledger-row-unused] NON_READ_ANCHORS excuses .../last-admin-guard.ts:299 ...

Cause: the item-2 header rewrite added 13 net lines above the census's read site, moving the needle line applies to EVERY context, isSystem included from 286 to 299 (verified against the merge base: 286 there, 299 here). The gate's ledger row finds that line by needle, so it followed the code; content/docs/permissions/system-context.mdx hard-codes the number, so it did not — reddening both directions at once. Repaired with the gate's own --fix, which is the authority on the form:

re-anchored content/docs/permissions/system-context.mdx:201 `last-admin-guard.ts:286` -> `:299`
check-system-context-census: OK — 109 elevation read sites in 20 packages across 45 files,
all anchored; 145 anchors resolve, 27 declared non-read.

5. Verification

All at f63bc0d22.

• Target file:Test Files 1 passed (1) / Tests 13 passed (13)
• Whole affected package (@objectstack/plugin-auth, run because better-auth-schema-parity.test.ts reads auth-manager.ts as source text and a comment-only edit is not self-evidently inert to it): Test Files 91 passed (91) / Tests 1866 passed (1866)
• pnpm --filter @objectstack/plugin-auth typecheck: exit 0, including check:test-typecheck over tsconfig.test.json. This matters here: the build tsconfig.json excludes **/*.test.ts, so tsc --noEmit alone says nothing about the new test code; the test-layer program is what covers it, and this file carries no test-typecheck-debt.json entry, so it must be at zero errors.
• Gate family, re-derived in-worktree with node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack. The first derivation over the three original paths gave 28 commands; the census repair added content/docs/..., which pulled the count to 52. Re-deriving after that edit was load-bearing — 24 doc gates would otherwise have gone unrun. Union at f63bc0d22: 49 pass, 3 PREREQUISITE NOT MET.

The three unmeasured, each of which self-declares that it is neither a pass nor a finding:

Gate	Exit	Why
check-test-completeness.mjs	3	Needs a saved turbo run test log, which only CI tees. Its own text names the dispatch-gates family as this branch and says to record NOT MEASURED
check:dual-build-cjs-loads	3	Reads built output; 40 packages have no dist/. Needs a full pnpm build
check:type-check-debt	3	Needs the whole workspace closure built, or it "would silently measure a DIFFERENT WORLD"

check:skill-examples initially exited 1 on an unmet prerequisite (client-react unbuilt). Rather than record it unmeasured I built the closure and re-ran it: pass, 256 prose examples type-check across 3 surfaces.

6. Changeset

None owed. The diff is comment-only in two source files, one test file, and one docs anchor — no exported symbol, no payload key, no behaviour change. Both edited docblocks are off the published surface: the auth-manager.ts block documents private async reconcileScimUserLifecycle, and the last-admin-guard.ts block is a file-level header before the first import. This is pr-automation.yml's route 2 verbatim ("It releases nothing (.github/, .claude/, skills/, docs/, content/, examples/, tests-only, and the like) -- apply the skip-changeset label"), so the label is applied rather than an empty changeset.

7. Co-occupancy

• auth-manager.ts is co-occupied by open PR feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775 (claude/issue-13881-sys-user-locale), whose hunks sit at base lines 3029-4714 (the email/SMS locale docblocks). This branch's edits are at 5138 and 5164-5174, inside the SCIM reconcile docblock only. Disjoint. Nothing in 3029-4714 was touched, and the edits were anchored by content rather than by line number.
• [finding] plugin-auth SCIM harnesses register no OAuth objects, so every sign-in logs a Better Auth ERROR (back-channel logout planning failed … no such table: sys_oauth_access_token) #14615 / PR test(plugin-auth): register the production object set in the two SCIM harnesses #14751 is merged and already in the test file; its authIdentityObjects harness registration is untouched here.
• Per the ruling, SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522 (SCIM transaction residual) and [finding] SCIM forces the better-auth admin plugin on (pluginConfig.admin ?? scimEffective) and a deployment has no declared way to decline it — split from #13439 by the 2026-08-31 ruling #13816 (admin forcing) are not folded in, and the five stale assertion sites fenced on [finding] SCIM active:false no longer disables the account — the vendor ban coupling was removed upstream in @better-auth/scim 1.7.0 and nothing in this repo replaced it #14360 are not touched.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-auth, touching 2 documentable anchor(s).

3 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/kernel/contracts/auth-service.mdx(via AuthManager (symbol, a top-level class))
• content/docs/kernel/services-checklist.mdx(via AuthManager (symbol, a top-level class))
• content/docs/permissions/authentication.mdx(via AuthManager (symbol, a top-level class))

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 11 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 5a5336b399db2ef18dd4700f97d579a328197dda → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 35da8cc60775679ebda2af1255c4cf1972ecdaaa — the merge of head f63bc0d22ab6fbfdf63fd6569d0e94d13eb9df79 into base 5a5336b399db2ef18dd4700f97d579a328197dda, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 35da8cc60775679ebda2af1255c4cf1972ecdaaa && git checkout 35da8cc60775679ebda2af1255c4cf1972ecdaaa
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 5a5336b399db2ef18dd4700f97d579a328197dda f63bc0d22ab6fbfdf63fd6569d0e94d13eb9df79 && git checkout -B drift-repro 5a5336b399db2ef18dd4700f97d579a328197dda && git merge --no-ff f63bc0d22ab6fbfdf63fd6569d0e94d13eb9df79
node scripts/docs-audit/affected-docs.mjs --json 5a5336b399db2ef18dd4700f97d579a328197dda

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 5a5336b399db2ef18dd4700f97d579a328197dda → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33716744075 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1801
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 25 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(cli): make the unread-reader ceiling a load-independent constant at RUN_TIMEOUT_MS #14715、test(cli): derive the vitest tier population instead of freezing it in a list #14717、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(devx): partition os-regen-merge.sh's step-1 conflict message by class #14733、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、fix(deps): take the fix for the four OSV advisories blocking every manifest PR #14736、fix(tooling): a template-literal mode for the vocabulary gate's four shared textual scanners #14739、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815），分属 6 条投机栈 ⇒ 6 次独立命中。⚠️ 同签名的汇总 issue Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822 已作为重复关闭，且没有仍然打开的同签名汇总 issue ⇒ 本次不新建（新建只会再被判重）。请到它指向的那张 issue 上谈，或重开 Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822。
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 64 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33716557375 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1800
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 26 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(cli): make the unread-reader ceiling a load-independent constant at RUN_TIMEOUT_MS #14715、test(cli): derive the vitest tier population instead of freezing it in a list #14717、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(devx): partition os-regen-merge.sh's step-1 conflict message by class #14733、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、fix(deps): take the fix for the four OSV advisories blocking every manifest PR #14736、fix(tooling): a template-literal mode for the vocabulary gate's four shared textual scanners #14739、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、fix(service-automation): a try_catch whose catch region itself fails keeps both regions' step record #14813、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815），分属 5 条投机栈 ⇒ 5 次独立命中。⚠️ 同签名的汇总 issue Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822 已作为重复关闭，且没有仍然打开的同签名汇总 issue ⇒ 本次不新建（新建只会再被判重）。请到它指向的那张 issue 上谈，或重开 Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822。
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• ⚠️本 PR 过去 24h 已在队列失败 1 次（不含本次）。 内容未变而反复失败 ⇒ 高度怀疑 flaky 测试或与同组 PR 的语义冲突，重排不解决。
• 过去 24h 队列共有 69 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[claude]

Fixes#14555

Resumption of a previous agent's branch. That agent pushed two commits and died before opening a PR or reporting, so nothing on the branch had been verified by anyone. This PR verifies the existing work item-by-item against the triage ruling, adds the one gate repair the work had broken, and lands it.

All measurements below were taken at f63bc0d22.

1. The previous agent's work, checked against the ruling

The ruling (issuecomment-5514107240) scoped five items. The branch carries all five, and each matches.

#	Ruling asked for	What the diff actually does	Match
1	Pin the SCIM DELETE of the last administrator; add a DELETE face to the existing suite	Adds one it(...) at scim-deactivation-reconcile-user.test.ts:487, inside the existing deactivating the last administrator is refused through SCIM describe. Asserts 403, the SCIM error schema, status: "403", a detail naming last administrator and ADR-0024 D5.2; then that the row survives, is unbanned, still signs in, and that the vendor tombstone rolled back	yes
1b	Do not restructure face (c) or the PATCH path	The whole test diff removes exactly five lines: three header-comment lines and the two timing constants of item 3. Face (c) at :430, its positive control at :468, and every PATCH face are byte-identical	yes
1c	Register through the harness list, not a hand-written object list	Untouched. The file still has import { authIdentityObjects } from './manifest.js' (line 71), const AUTH_OBJECTS = authIdentityObjects (line 102), consumed at line 174. The diff adds no object list	yes
2	Rewrite the stale last-admin-guard.ts header to describe 1.7.2	Bullets 1 and 2 rewritten (quoted below)	yes
3	Widen expiry to 5 s, wait expiry + 500 ms	TIMED_BAN_MS = 5_000, TIMED_BAN_WAIT_MS = TIMED_BAN_MS + 500. Both faces carry 60_000 timeouts; the whole face measured 25.84 s wall for the entire 13-test file, so 5.5 s of sleep sits far inside it	yes
3b	The positive control — "the most valuable single line in this card"	Present at :640. Identical setup, same timed ban, same wait, no SCIM deactivation, sign-in accepted, row unbanned	yes
4	One stale word in the auth-manager.ts docblock	admin-ban-endpoints.ts becomes user-ban-write.ts	yes
5	One clause: DELETE over a timed administrator ban also makes it permanent	Added to the same docblock (quoted below)	yes

Item 4 — proof that user-ban-write.ts is the live module, and that both modules exist. Both files are present on disk. The live import in auth-manager.ts is:

import{applyUserBan,applyUserUnban,SCIM_DEACTIVATION_BAN_REASON,}from'./user-ban-write.js';

admin-ban-endpoints.ts still exists and still exports runAdminBanUser / runAdminUnbanUser, so the old spelling was a stale attribution, not a dangling reference — the docblock credited the wrong module for the write this path performs.

2. Prose changed — before and after

Item 2, last-admin-guard.ts bullet 1. Before:

the better-auth admin plugin's ban endpoint writes it, and @better-auth/scim maps a SCIM active: false onto that same admin ban (which is why SCIM forces the admin plugin on — ADR-0071).

After: it now says 1.6.x mapped active: false onto the admin ban itself, that 1.7.0 removed that write in favour of an optional host callback, and that since #14360 the ban is landed by plugin-auth's own identity.reconcileUser — "the same column and the same hook, a different author". The installed dependency is @better-auth/scim1.7.2, so the version claim is current.

Item 2, bullet 2. Before:

deleting the sys_user row (#5941) — how every remove lands: SCIM DELETE /Users/{id}, better-auth's /admin/remove-user and /delete-user, an import, a script.

After, SCIM DELETE is removed from that list and called out as explicitly not a row delete on 1.7.2, arriving instead as bullet 1's ban write, "refused by guardBan on beforeUpdate and never reaches guardDelete". The rest of the row-delete half is unchanged.

Item 5, auth-manager.ts. Before:

account. Re-provisioning through the tombstone re-links the same user, the state turns active, and the SCIM ban is lifted by the second bullet.

After:

account — by the SAME branch as active: false, including over an administrator's timed ban, whose banExpires a DELETE therefore clears too: a deprovision cannot be outlived by an expiry the administrator set. For the same reason a DELETE is judged by the beforeUpdate guard below and never by any beforeDelete — deleting the last administrator through SCIM is refused exactly as deactivating them is. Re-provisioning through the tombstone re-links the same user, the state turns active, and the SCIM ban is lifted by the second bullet.

3. Ablations — both pins proved able to fail

Every leg: mutate, prove the mutation reached disk by blob hash and by literal-text counts on both the removed and injected text, run, restore against HEAD (never a bare git checkout -- path, which restores from a possibly-poisoned index), then prove restoration by blob equality and an empty git diff HEAD. Each ran under a trap ... EXIT INT TERM. No mutation was proved by a comment — esbuild strips those.

Ablation A — the positive control can fail. Inverted its sign-in expectation (expectSignInAccepted becomes expectSignInBanned).

HEAD blob = c27ebf78aec1fcdf64d3a2be894f076f61eb1be5
post blob = 8c90af927452afb782bfb322ecebb0174a8963f0 (differs: mutation on disk)
before: FROM-count=1 TO-count=0 after: FROM-count=0 TO-count=1

Mutated: Tests 1 failed | 12 skipped (13), failing precisely on the mechanism the control exists to observe:

AssertionError: expected BANNED_USER, got 200 {... "banned":true,
"banReason":"Policy violation","banExpires":"2026-09-03T02:56:41.983Z" ...}
expected 200 to be 403

That is the vendor's session.create auto-lift admitting a principal whose banExpires has passed — exactly the alternative explanation the ruling wanted excluded. Restored: blob back to c27ebf78, empty git diff HEAD, Tests 1 passed | 12 skipped (13).

Ablation B — the DELETE face exercises the guard. The ruling's own prose claims this face is refused through beforeUpdate and never reaches beforeDelete, so both legs were run. Predicted directions were fixed before running, and both held.

Leg	Mutation	Predicted	Measured
B1	registerHook('beforeUpdate', guardBan, ...) replaced by a no-op	red	red — Tests 1 failed | 12 skipped (13)
B2	registerHook('beforeDelete', guardDelete, ...) replaced by a no-op	green	green — Tests 1 passed | 12 skipped (13)

B1: HEAD blob = 40daa74e67a583fab91f31ee7eabe93dcebd2631
post blob = c9de082ca878d49388fe6d7252b54bfcb2d11263
B2: post blob = 8ea396623d8f680b8d01750dac79c8fda87177cd
both restored to 40daa74e..., empty `git diff HEAD`

B1's failure is the DELETE succeeding and returning an empty body where the 403 SCIM error JSON was expected (SyntaxError: Unexpected end of JSON input at the res.json() on line 503). B2 is green because the SCIM DELETE never reaches guardDelete at all.

Together these confirm the measured claim the branch ships in the guard header — "removing the beforeDelete registration leaves the SCIM DELETE face green, removing the beforeUpdate one reddens it" — is accurate as written, and that the new face is genuinely pinned to the guard rather than to an incidental 403.

4. One gate the branch had broken, repaired here

check-system-context-census was red on the branch as pushed, and would have reddened CI:

::error::[anchor-is-not-a-read-site] the page anchors .../last-admin-guard.ts:286 ...
::error::[ledger-row-unused] NON_READ_ANCHORS excuses .../last-admin-guard.ts:299 ...

Cause: the item-2 header rewrite added 13 net lines above the census's read site, moving the needle line applies to EVERY context, isSystem included from 286 to 299 (verified against the merge base: 286 there, 299 here). The gate's ledger row finds that line by needle, so it followed the code; content/docs/permissions/system-context.mdx hard-codes the number, so it did not — reddening both directions at once. Repaired with the gate's own --fix, which is the authority on the form:

re-anchored content/docs/permissions/system-context.mdx:201 `last-admin-guard.ts:286` -> `:299`
check-system-context-census: OK — 109 elevation read sites in 20 packages across 45 files,
all anchored; 145 anchors resolve, 27 declared non-read.

5. Verification

All at f63bc0d22.

• Target file:Test Files 1 passed (1) / Tests 13 passed (13)
• Whole affected package (@objectstack/plugin-auth, run because better-auth-schema-parity.test.ts reads auth-manager.ts as source text and a comment-only edit is not self-evidently inert to it): Test Files 91 passed (91) / Tests 1866 passed (1866)
• pnpm --filter @objectstack/plugin-auth typecheck: exit 0, including check:test-typecheck over tsconfig.test.json. This matters here: the build tsconfig.json excludes **/*.test.ts, so tsc --noEmit alone says nothing about the new test code; the test-layer program is what covers it, and this file carries no test-typecheck-debt.json entry, so it must be at zero errors.
• Gate family, re-derived in-worktree with node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack. The first derivation over the three original paths gave 28 commands; the census repair added content/docs/..., which pulled the count to 52. Re-deriving after that edit was load-bearing — 24 doc gates would otherwise have gone unrun. Union at f63bc0d22: 49 pass, 3 PREREQUISITE NOT MET.

The three unmeasured, each of which self-declares that it is neither a pass nor a finding:

Gate	Exit	Why
check-test-completeness.mjs	3	Needs a saved turbo run test log, which only CI tees. Its own text names the dispatch-gates family as this branch and says to record NOT MEASURED
check:dual-build-cjs-loads	3	Reads built output; 40 packages have no dist/. Needs a full pnpm build
check:type-check-debt	3	Needs the whole workspace closure built, or it "would silently measure a DIFFERENT WORLD"

check:skill-examples initially exited 1 on an unmet prerequisite (client-react unbuilt). Rather than record it unmeasured I built the closure and re-ran it: pass, 256 prose examples type-check across 3 surfaces.

6. Changeset

None owed. The diff is comment-only in two source files, one test file, and one docs anchor — no exported symbol, no payload key, no behaviour change. Both edited docblocks are off the published surface: the auth-manager.ts block documents private async reconcileScimUserLifecycle, and the last-admin-guard.ts block is a file-level header before the first import. This is pr-automation.yml's route 2 verbatim ("It releases nothing (.github/, .claude/, skills/, docs/, content/, examples/, tests-only, and the like) -- apply the skip-changeset label"), so the label is applied rather than an empty changeset.

7. Co-occupancy

• auth-manager.ts is co-occupied by open PR feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775 (claude/issue-13881-sys-user-locale), whose hunks sit at base lines 3029-4714 (the email/SMS locale docblocks). This branch's edits are at 5138 and 5164-5174, inside the SCIM reconcile docblock only. Disjoint. Nothing in 3029-4714 was touched, and the edits were anchored by content rather than by line number.
• [finding] plugin-auth SCIM harnesses register no OAuth objects, so every sign-in logs a Better Auth ERROR (back-channel logout planning failed … no such table: sys_oauth_access_token) #14615 / PR test(plugin-auth): register the production object set in the two SCIM harnesses #14751 is merged and already in the test file; its authIdentityObjects harness registration is untouched here.
• Per the ruling, SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522 (SCIM transaction residual) and [finding] SCIM forces the better-auth admin plugin on (pluginConfig.admin ?? scimEffective) and a deployment has no declared way to decline it — split from #13439 by the 2026-08-31 ruling #13816 (admin forcing) are not folded in, and the five stale assertion sites fenced on [finding] SCIM active:false no longer disables the account — the vendor ban coupling was removed upstream in @better-auth/scim 1.7.0 and nothing in this repo replaced it #14360 are not touched.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-auth, touching 2 documentable anchor(s).

3 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/kernel/contracts/auth-service.mdx(via AuthManager (symbol, a top-level class))
• content/docs/kernel/services-checklist.mdx(via AuthManager (symbol, a top-level class))
• content/docs/permissions/authentication.mdx(via AuthManager (symbol, a top-level class))

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 11 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 5a5336b399db2ef18dd4700f97d579a328197dda → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 35da8cc60775679ebda2af1255c4cf1972ecdaaa — the merge of head f63bc0d22ab6fbfdf63fd6569d0e94d13eb9df79 into base 5a5336b399db2ef18dd4700f97d579a328197dda, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 35da8cc60775679ebda2af1255c4cf1972ecdaaa && git checkout 35da8cc60775679ebda2af1255c4cf1972ecdaaa
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 5a5336b399db2ef18dd4700f97d579a328197dda f63bc0d22ab6fbfdf63fd6569d0e94d13eb9df79 && git checkout -B drift-repro 5a5336b399db2ef18dd4700f97d579a328197dda && git merge --no-ff f63bc0d22ab6fbfdf63fd6569d0e94d13eb9df79
node scripts/docs-audit/affected-docs.mjs --json 5a5336b399db2ef18dd4700f97d579a328197dda

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 5a5336b399db2ef18dd4700f97d579a328197dda → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33716744075 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1801
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 25 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(cli): make the unread-reader ceiling a load-independent constant at RUN_TIMEOUT_MS #14715、test(cli): derive the vitest tier population instead of freezing it in a list #14717、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(devx): partition os-regen-merge.sh's step-1 conflict message by class #14733、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、fix(deps): take the fix for the four OSV advisories blocking every manifest PR #14736、fix(tooling): a template-literal mode for the vocabulary gate's four shared textual scanners #14739、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815），分属 6 条投机栈 ⇒ 6 次独立命中。⚠️ 同签名的汇总 issue Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822 已作为重复关闭，且没有仍然打开的同签名汇总 issue ⇒ 本次不新建（新建只会再被判重）。请到它指向的那张 issue 上谈，或重开 Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822。
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 64 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33716557375 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1800
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 26 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(cli): make the unread-reader ceiling a load-independent constant at RUN_TIMEOUT_MS #14715、test(cli): derive the vitest tier population instead of freezing it in a list #14717、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(devx): partition os-regen-merge.sh's step-1 conflict message by class #14733、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、fix(deps): take the fix for the four OSV advisories blocking every manifest PR #14736、fix(tooling): a template-literal mode for the vocabulary gate's four shared textual scanners #14739、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、fix(service-automation): a try_catch whose catch region itself fails keeps both regions' step record #14813、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815），分属 5 条投机栈 ⇒ 5 次独立命中。⚠️ 同签名的汇总 issue Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822 已作为重复关闭，且没有仍然打开的同签名汇总 issue ⇒ 本次不新建（新建只会再被判重）。请到它指向的那张 issue 上谈，或重开 Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822。
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• ⚠️本 PR 过去 24h 已在队列失败 1 次（不含本次）。 内容未变而反复失败 ⇒ 高度怀疑 flaky 测试或与同组 PR 的语义冲突，重排不解决。
• 过去 24h 队列共有 69 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[claude]

Fixes#14555

Resumption of a previous agent's branch. That agent pushed two commits and died before opening a PR or reporting, so nothing on the branch had been verified by anyone. This PR verifies the existing work item-by-item against the triage ruling, adds the one gate repair the work had broken, and lands it.

All measurements below were taken at f63bc0d22.

1. The previous agent's work, checked against the ruling

The ruling (issuecomment-5514107240) scoped five items. The branch carries all five, and each matches.

#	Ruling asked for	What the diff actually does	Match
1	Pin the SCIM DELETE of the last administrator; add a DELETE face to the existing suite	Adds one it(...) at scim-deactivation-reconcile-user.test.ts:487, inside the existing deactivating the last administrator is refused through SCIM describe. Asserts 403, the SCIM error schema, status: "403", a detail naming last administrator and ADR-0024 D5.2; then that the row survives, is unbanned, still signs in, and that the vendor tombstone rolled back	yes
1b	Do not restructure face (c) or the PATCH path	The whole test diff removes exactly five lines: three header-comment lines and the two timing constants of item 3. Face (c) at :430, its positive control at :468, and every PATCH face are byte-identical	yes
1c	Register through the harness list, not a hand-written object list	Untouched. The file still has import { authIdentityObjects } from './manifest.js' (line 71), const AUTH_OBJECTS = authIdentityObjects (line 102), consumed at line 174. The diff adds no object list	yes
2	Rewrite the stale last-admin-guard.ts header to describe 1.7.2	Bullets 1 and 2 rewritten (quoted below)	yes
3	Widen expiry to 5 s, wait expiry + 500 ms	TIMED_BAN_MS = 5_000, TIMED_BAN_WAIT_MS = TIMED_BAN_MS + 500. Both faces carry 60_000 timeouts; the whole face measured 25.84 s wall for the entire 13-test file, so 5.5 s of sleep sits far inside it	yes
3b	The positive control — "the most valuable single line in this card"	Present at :640. Identical setup, same timed ban, same wait, no SCIM deactivation, sign-in accepted, row unbanned	yes
4	One stale word in the auth-manager.ts docblock	admin-ban-endpoints.ts becomes user-ban-write.ts	yes
5	One clause: DELETE over a timed administrator ban also makes it permanent	Added to the same docblock (quoted below)	yes

Item 4 — proof that user-ban-write.ts is the live module, and that both modules exist. Both files are present on disk. The live import in auth-manager.ts is:

import{applyUserBan,applyUserUnban,SCIM_DEACTIVATION_BAN_REASON,}from'./user-ban-write.js';

admin-ban-endpoints.ts still exists and still exports runAdminBanUser / runAdminUnbanUser, so the old spelling was a stale attribution, not a dangling reference — the docblock credited the wrong module for the write this path performs.

2. Prose changed — before and after

Item 2, last-admin-guard.ts bullet 1. Before:

the better-auth admin plugin's ban endpoint writes it, and @better-auth/scim maps a SCIM active: false onto that same admin ban (which is why SCIM forces the admin plugin on — ADR-0071).

After: it now says 1.6.x mapped active: false onto the admin ban itself, that 1.7.0 removed that write in favour of an optional host callback, and that since #14360 the ban is landed by plugin-auth's own identity.reconcileUser — "the same column and the same hook, a different author". The installed dependency is @better-auth/scim1.7.2, so the version claim is current.

Item 2, bullet 2. Before:

deleting the sys_user row (#5941) — how every remove lands: SCIM DELETE /Users/{id}, better-auth's /admin/remove-user and /delete-user, an import, a script.

After, SCIM DELETE is removed from that list and called out as explicitly not a row delete on 1.7.2, arriving instead as bullet 1's ban write, "refused by guardBan on beforeUpdate and never reaches guardDelete". The rest of the row-delete half is unchanged.

Item 5, auth-manager.ts. Before:

account. Re-provisioning through the tombstone re-links the same user, the state turns active, and the SCIM ban is lifted by the second bullet.

After:

account — by the SAME branch as active: false, including over an administrator's timed ban, whose banExpires a DELETE therefore clears too: a deprovision cannot be outlived by an expiry the administrator set. For the same reason a DELETE is judged by the beforeUpdate guard below and never by any beforeDelete — deleting the last administrator through SCIM is refused exactly as deactivating them is. Re-provisioning through the tombstone re-links the same user, the state turns active, and the SCIM ban is lifted by the second bullet.

3. Ablations — both pins proved able to fail

Every leg: mutate, prove the mutation reached disk by blob hash and by literal-text counts on both the removed and injected text, run, restore against HEAD (never a bare git checkout -- path, which restores from a possibly-poisoned index), then prove restoration by blob equality and an empty git diff HEAD. Each ran under a trap ... EXIT INT TERM. No mutation was proved by a comment — esbuild strips those.

Ablation A — the positive control can fail. Inverted its sign-in expectation (expectSignInAccepted becomes expectSignInBanned).

HEAD blob = c27ebf78aec1fcdf64d3a2be894f076f61eb1be5
post blob = 8c90af927452afb782bfb322ecebb0174a8963f0 (differs: mutation on disk)
before: FROM-count=1 TO-count=0 after: FROM-count=0 TO-count=1

Mutated: Tests 1 failed | 12 skipped (13), failing precisely on the mechanism the control exists to observe:

AssertionError: expected BANNED_USER, got 200 {... "banned":true,
"banReason":"Policy violation","banExpires":"2026-09-03T02:56:41.983Z" ...}
expected 200 to be 403

That is the vendor's session.create auto-lift admitting a principal whose banExpires has passed — exactly the alternative explanation the ruling wanted excluded. Restored: blob back to c27ebf78, empty git diff HEAD, Tests 1 passed | 12 skipped (13).

Ablation B — the DELETE face exercises the guard. The ruling's own prose claims this face is refused through beforeUpdate and never reaches beforeDelete, so both legs were run. Predicted directions were fixed before running, and both held.

Leg	Mutation	Predicted	Measured
B1	registerHook('beforeUpdate', guardBan, ...) replaced by a no-op	red	red — Tests 1 failed | 12 skipped (13)
B2	registerHook('beforeDelete', guardDelete, ...) replaced by a no-op	green	green — Tests 1 passed | 12 skipped (13)

B1: HEAD blob = 40daa74e67a583fab91f31ee7eabe93dcebd2631
post blob = c9de082ca878d49388fe6d7252b54bfcb2d11263
B2: post blob = 8ea396623d8f680b8d01750dac79c8fda87177cd
both restored to 40daa74e..., empty `git diff HEAD`

B1's failure is the DELETE succeeding and returning an empty body where the 403 SCIM error JSON was expected (SyntaxError: Unexpected end of JSON input at the res.json() on line 503). B2 is green because the SCIM DELETE never reaches guardDelete at all.

Together these confirm the measured claim the branch ships in the guard header — "removing the beforeDelete registration leaves the SCIM DELETE face green, removing the beforeUpdate one reddens it" — is accurate as written, and that the new face is genuinely pinned to the guard rather than to an incidental 403.

4. One gate the branch had broken, repaired here

check-system-context-census was red on the branch as pushed, and would have reddened CI:

::error::[anchor-is-not-a-read-site] the page anchors .../last-admin-guard.ts:286 ...
::error::[ledger-row-unused] NON_READ_ANCHORS excuses .../last-admin-guard.ts:299 ...

Cause: the item-2 header rewrite added 13 net lines above the census's read site, moving the needle line applies to EVERY context, isSystem included from 286 to 299 (verified against the merge base: 286 there, 299 here). The gate's ledger row finds that line by needle, so it followed the code; content/docs/permissions/system-context.mdx hard-codes the number, so it did not — reddening both directions at once. Repaired with the gate's own --fix, which is the authority on the form:

re-anchored content/docs/permissions/system-context.mdx:201 `last-admin-guard.ts:286` -> `:299`
check-system-context-census: OK — 109 elevation read sites in 20 packages across 45 files,
all anchored; 145 anchors resolve, 27 declared non-read.

5. Verification

All at f63bc0d22.

• Target file:Test Files 1 passed (1) / Tests 13 passed (13)
• Whole affected package (@objectstack/plugin-auth, run because better-auth-schema-parity.test.ts reads auth-manager.ts as source text and a comment-only edit is not self-evidently inert to it): Test Files 91 passed (91) / Tests 1866 passed (1866)
• pnpm --filter @objectstack/plugin-auth typecheck: exit 0, including check:test-typecheck over tsconfig.test.json. This matters here: the build tsconfig.json excludes **/*.test.ts, so tsc --noEmit alone says nothing about the new test code; the test-layer program is what covers it, and this file carries no test-typecheck-debt.json entry, so it must be at zero errors.
• Gate family, re-derived in-worktree with node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack. The first derivation over the three original paths gave 28 commands; the census repair added content/docs/..., which pulled the count to 52. Re-deriving after that edit was load-bearing — 24 doc gates would otherwise have gone unrun. Union at f63bc0d22: 49 pass, 3 PREREQUISITE NOT MET.

The three unmeasured, each of which self-declares that it is neither a pass nor a finding:

Gate	Exit	Why
check-test-completeness.mjs	3	Needs a saved turbo run test log, which only CI tees. Its own text names the dispatch-gates family as this branch and says to record NOT MEASURED
check:dual-build-cjs-loads	3	Reads built output; 40 packages have no dist/. Needs a full pnpm build
check:type-check-debt	3	Needs the whole workspace closure built, or it "would silently measure a DIFFERENT WORLD"

check:skill-examples initially exited 1 on an unmet prerequisite (client-react unbuilt). Rather than record it unmeasured I built the closure and re-ran it: pass, 256 prose examples type-check across 3 surfaces.

6. Changeset

None owed. The diff is comment-only in two source files, one test file, and one docs anchor — no exported symbol, no payload key, no behaviour change. Both edited docblocks are off the published surface: the auth-manager.ts block documents private async reconcileScimUserLifecycle, and the last-admin-guard.ts block is a file-level header before the first import. This is pr-automation.yml's route 2 verbatim ("It releases nothing (.github/, .claude/, skills/, docs/, content/, examples/, tests-only, and the like) -- apply the skip-changeset label"), so the label is applied rather than an empty changeset.

7. Co-occupancy

• auth-manager.ts is co-occupied by open PR feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775 (claude/issue-13881-sys-user-locale), whose hunks sit at base lines 3029-4714 (the email/SMS locale docblocks). This branch's edits are at 5138 and 5164-5174, inside the SCIM reconcile docblock only. Disjoint. Nothing in 3029-4714 was touched, and the edits were anchored by content rather than by line number.
• [finding] plugin-auth SCIM harnesses register no OAuth objects, so every sign-in logs a Better Auth ERROR (back-channel logout planning failed … no such table: sys_oauth_access_token) #14615 / PR test(plugin-auth): register the production object set in the two SCIM harnesses #14751 is merged and already in the test file; its authIdentityObjects harness registration is untouched here.
• Per the ruling, SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522 (SCIM transaction residual) and [finding] SCIM forces the better-auth admin plugin on (pluginConfig.admin ?? scimEffective) and a deployment has no declared way to decline it — split from #13439 by the 2026-08-31 ruling #13816 (admin forcing) are not folded in, and the five stale assertion sites fenced on [finding] SCIM active:false no longer disables the account — the vendor ban coupling was removed upstream in @better-auth/scim 1.7.0 and nothing in this repo replaced it #14360 are not touched.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-auth, touching 2 documentable anchor(s).

3 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/kernel/contracts/auth-service.mdx(via AuthManager (symbol, a top-level class))
• content/docs/kernel/services-checklist.mdx(via AuthManager (symbol, a top-level class))
• content/docs/permissions/authentication.mdx(via AuthManager (symbol, a top-level class))

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 11 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 5a5336b399db2ef18dd4700f97d579a328197dda → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 35da8cc60775679ebda2af1255c4cf1972ecdaaa — the merge of head f63bc0d22ab6fbfdf63fd6569d0e94d13eb9df79 into base 5a5336b399db2ef18dd4700f97d579a328197dda, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 35da8cc60775679ebda2af1255c4cf1972ecdaaa && git checkout 35da8cc60775679ebda2af1255c4cf1972ecdaaa
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 5a5336b399db2ef18dd4700f97d579a328197dda f63bc0d22ab6fbfdf63fd6569d0e94d13eb9df79 && git checkout -B drift-repro 5a5336b399db2ef18dd4700f97d579a328197dda && git merge --no-ff f63bc0d22ab6fbfdf63fd6569d0e94d13eb9df79
node scripts/docs-audit/affected-docs.mjs --json 5a5336b399db2ef18dd4700f97d579a328197dda

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 5a5336b399db2ef18dd4700f97d579a328197dda → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33716744075 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1801
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 25 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(cli): make the unread-reader ceiling a load-independent constant at RUN_TIMEOUT_MS #14715、test(cli): derive the vitest tier population instead of freezing it in a list #14717、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(devx): partition os-regen-merge.sh's step-1 conflict message by class #14733、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、fix(deps): take the fix for the four OSV advisories blocking every manifest PR #14736、fix(tooling): a template-literal mode for the vocabulary gate's four shared textual scanners #14739、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815），分属 6 条投机栈 ⇒ 6 次独立命中。⚠️ 同签名的汇总 issue Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822 已作为重复关闭，且没有仍然打开的同签名汇总 issue ⇒ 本次不新建（新建只会再被判重）。请到它指向的那张 issue 上谈，或重开 Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822。
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 64 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33716557375 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1800
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 26 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(cli): make the unread-reader ceiling a load-independent constant at RUN_TIMEOUT_MS #14715、test(cli): derive the vitest tier population instead of freezing it in a list #14717、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(devx): partition os-regen-merge.sh's step-1 conflict message by class #14733、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、fix(deps): take the fix for the four OSV advisories blocking every manifest PR #14736、fix(tooling): a template-literal mode for the vocabulary gate's four shared textual scanners #14739、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、fix(service-automation): a try_catch whose catch region itself fails keeps both regions' step record #14813、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815），分属 5 条投机栈 ⇒ 5 次独立命中。⚠️ 同签名的汇总 issue Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822 已作为重复关闭，且没有仍然打开的同签名汇总 issue ⇒ 本次不新建（新建只会再被判重）。请到它指向的那张 issue 上谈，或重开 Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822。
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• ⚠️本 PR 过去 24h 已在队列失败 1 次（不含本次）。 内容未变而反复失败 ⇒ 高度怀疑 flaky 测试或与同组 PR 的语义冲突，重排不解决。
• 过去 24h 队列共有 69 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[claude]

Fixes#14555

Resumption of a previous agent's branch. That agent pushed two commits and died before opening a PR or reporting, so nothing on the branch had been verified by anyone. This PR verifies the existing work item-by-item against the triage ruling, adds the one gate repair the work had broken, and lands it.

All measurements below were taken at f63bc0d22.

1. The previous agent's work, checked against the ruling

The ruling (issuecomment-5514107240) scoped five items. The branch carries all five, and each matches.

#	Ruling asked for	What the diff actually does	Match
1	Pin the SCIM DELETE of the last administrator; add a DELETE face to the existing suite	Adds one it(...) at scim-deactivation-reconcile-user.test.ts:487, inside the existing deactivating the last administrator is refused through SCIM describe. Asserts 403, the SCIM error schema, status: "403", a detail naming last administrator and ADR-0024 D5.2; then that the row survives, is unbanned, still signs in, and that the vendor tombstone rolled back	yes
1b	Do not restructure face (c) or the PATCH path	The whole test diff removes exactly five lines: three header-comment lines and the two timing constants of item 3. Face (c) at :430, its positive control at :468, and every PATCH face are byte-identical	yes
1c	Register through the harness list, not a hand-written object list	Untouched. The file still has import { authIdentityObjects } from './manifest.js' (line 71), const AUTH_OBJECTS = authIdentityObjects (line 102), consumed at line 174. The diff adds no object list	yes
2	Rewrite the stale last-admin-guard.ts header to describe 1.7.2	Bullets 1 and 2 rewritten (quoted below)	yes
3	Widen expiry to 5 s, wait expiry + 500 ms	TIMED_BAN_MS = 5_000, TIMED_BAN_WAIT_MS = TIMED_BAN_MS + 500. Both faces carry 60_000 timeouts; the whole face measured 25.84 s wall for the entire 13-test file, so 5.5 s of sleep sits far inside it	yes
3b	The positive control — "the most valuable single line in this card"	Present at :640. Identical setup, same timed ban, same wait, no SCIM deactivation, sign-in accepted, row unbanned	yes
4	One stale word in the auth-manager.ts docblock	admin-ban-endpoints.ts becomes user-ban-write.ts	yes
5	One clause: DELETE over a timed administrator ban also makes it permanent	Added to the same docblock (quoted below)	yes

Item 4 — proof that user-ban-write.ts is the live module, and that both modules exist. Both files are present on disk. The live import in auth-manager.ts is:

import{applyUserBan,applyUserUnban,SCIM_DEACTIVATION_BAN_REASON,}from'./user-ban-write.js';

admin-ban-endpoints.ts still exists and still exports runAdminBanUser / runAdminUnbanUser, so the old spelling was a stale attribution, not a dangling reference — the docblock credited the wrong module for the write this path performs.

2. Prose changed — before and after

Item 2, last-admin-guard.ts bullet 1. Before:

the better-auth admin plugin's ban endpoint writes it, and @better-auth/scim maps a SCIM active: false onto that same admin ban (which is why SCIM forces the admin plugin on — ADR-0071).

After: it now says 1.6.x mapped active: false onto the admin ban itself, that 1.7.0 removed that write in favour of an optional host callback, and that since #14360 the ban is landed by plugin-auth's own identity.reconcileUser — "the same column and the same hook, a different author". The installed dependency is @better-auth/scim1.7.2, so the version claim is current.

Item 2, bullet 2. Before:

deleting the sys_user row (#5941) — how every remove lands: SCIM DELETE /Users/{id}, better-auth's /admin/remove-user and /delete-user, an import, a script.

After, SCIM DELETE is removed from that list and called out as explicitly not a row delete on 1.7.2, arriving instead as bullet 1's ban write, "refused by guardBan on beforeUpdate and never reaches guardDelete". The rest of the row-delete half is unchanged.

Item 5, auth-manager.ts. Before:

account. Re-provisioning through the tombstone re-links the same user, the state turns active, and the SCIM ban is lifted by the second bullet.

After:

account — by the SAME branch as active: false, including over an administrator's timed ban, whose banExpires a DELETE therefore clears too: a deprovision cannot be outlived by an expiry the administrator set. For the same reason a DELETE is judged by the beforeUpdate guard below and never by any beforeDelete — deleting the last administrator through SCIM is refused exactly as deactivating them is. Re-provisioning through the tombstone re-links the same user, the state turns active, and the SCIM ban is lifted by the second bullet.

3. Ablations — both pins proved able to fail

Every leg: mutate, prove the mutation reached disk by blob hash and by literal-text counts on both the removed and injected text, run, restore against HEAD (never a bare git checkout -- path, which restores from a possibly-poisoned index), then prove restoration by blob equality and an empty git diff HEAD. Each ran under a trap ... EXIT INT TERM. No mutation was proved by a comment — esbuild strips those.

Ablation A — the positive control can fail. Inverted its sign-in expectation (expectSignInAccepted becomes expectSignInBanned).

HEAD blob = c27ebf78aec1fcdf64d3a2be894f076f61eb1be5
post blob = 8c90af927452afb782bfb322ecebb0174a8963f0 (differs: mutation on disk)
before: FROM-count=1 TO-count=0 after: FROM-count=0 TO-count=1

Mutated: Tests 1 failed | 12 skipped (13), failing precisely on the mechanism the control exists to observe:

AssertionError: expected BANNED_USER, got 200 {... "banned":true,
"banReason":"Policy violation","banExpires":"2026-09-03T02:56:41.983Z" ...}
expected 200 to be 403

That is the vendor's session.create auto-lift admitting a principal whose banExpires has passed — exactly the alternative explanation the ruling wanted excluded. Restored: blob back to c27ebf78, empty git diff HEAD, Tests 1 passed | 12 skipped (13).

Ablation B — the DELETE face exercises the guard. The ruling's own prose claims this face is refused through beforeUpdate and never reaches beforeDelete, so both legs were run. Predicted directions were fixed before running, and both held.

Leg	Mutation	Predicted	Measured
B1	registerHook('beforeUpdate', guardBan, ...) replaced by a no-op	red	red — Tests 1 failed | 12 skipped (13)
B2	registerHook('beforeDelete', guardDelete, ...) replaced by a no-op	green	green — Tests 1 passed | 12 skipped (13)

B1: HEAD blob = 40daa74e67a583fab91f31ee7eabe93dcebd2631
post blob = c9de082ca878d49388fe6d7252b54bfcb2d11263
B2: post blob = 8ea396623d8f680b8d01750dac79c8fda87177cd
both restored to 40daa74e..., empty `git diff HEAD`

B1's failure is the DELETE succeeding and returning an empty body where the 403 SCIM error JSON was expected (SyntaxError: Unexpected end of JSON input at the res.json() on line 503). B2 is green because the SCIM DELETE never reaches guardDelete at all.

Together these confirm the measured claim the branch ships in the guard header — "removing the beforeDelete registration leaves the SCIM DELETE face green, removing the beforeUpdate one reddens it" — is accurate as written, and that the new face is genuinely pinned to the guard rather than to an incidental 403.

4. One gate the branch had broken, repaired here

check-system-context-census was red on the branch as pushed, and would have reddened CI:

::error::[anchor-is-not-a-read-site] the page anchors .../last-admin-guard.ts:286 ...
::error::[ledger-row-unused] NON_READ_ANCHORS excuses .../last-admin-guard.ts:299 ...

Cause: the item-2 header rewrite added 13 net lines above the census's read site, moving the needle line applies to EVERY context, isSystem included from 286 to 299 (verified against the merge base: 286 there, 299 here). The gate's ledger row finds that line by needle, so it followed the code; content/docs/permissions/system-context.mdx hard-codes the number, so it did not — reddening both directions at once. Repaired with the gate's own --fix, which is the authority on the form:

re-anchored content/docs/permissions/system-context.mdx:201 `last-admin-guard.ts:286` -> `:299`
check-system-context-census: OK — 109 elevation read sites in 20 packages across 45 files,
all anchored; 145 anchors resolve, 27 declared non-read.

5. Verification

All at f63bc0d22.

• Target file:Test Files 1 passed (1) / Tests 13 passed (13)
• Whole affected package (@objectstack/plugin-auth, run because better-auth-schema-parity.test.ts reads auth-manager.ts as source text and a comment-only edit is not self-evidently inert to it): Test Files 91 passed (91) / Tests 1866 passed (1866)
• pnpm --filter @objectstack/plugin-auth typecheck: exit 0, including check:test-typecheck over tsconfig.test.json. This matters here: the build tsconfig.json excludes **/*.test.ts, so tsc --noEmit alone says nothing about the new test code; the test-layer program is what covers it, and this file carries no test-typecheck-debt.json entry, so it must be at zero errors.
• Gate family, re-derived in-worktree with node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack. The first derivation over the three original paths gave 28 commands; the census repair added content/docs/..., which pulled the count to 52. Re-deriving after that edit was load-bearing — 24 doc gates would otherwise have gone unrun. Union at f63bc0d22: 49 pass, 3 PREREQUISITE NOT MET.

The three unmeasured, each of which self-declares that it is neither a pass nor a finding:

Gate	Exit	Why
check-test-completeness.mjs	3	Needs a saved turbo run test log, which only CI tees. Its own text names the dispatch-gates family as this branch and says to record NOT MEASURED
check:dual-build-cjs-loads	3	Reads built output; 40 packages have no dist/. Needs a full pnpm build
check:type-check-debt	3	Needs the whole workspace closure built, or it "would silently measure a DIFFERENT WORLD"

check:skill-examples initially exited 1 on an unmet prerequisite (client-react unbuilt). Rather than record it unmeasured I built the closure and re-ran it: pass, 256 prose examples type-check across 3 surfaces.

6. Changeset

None owed. The diff is comment-only in two source files, one test file, and one docs anchor — no exported symbol, no payload key, no behaviour change. Both edited docblocks are off the published surface: the auth-manager.ts block documents private async reconcileScimUserLifecycle, and the last-admin-guard.ts block is a file-level header before the first import. This is pr-automation.yml's route 2 verbatim ("It releases nothing (.github/, .claude/, skills/, docs/, content/, examples/, tests-only, and the like) -- apply the skip-changeset label"), so the label is applied rather than an empty changeset.

7. Co-occupancy

• auth-manager.ts is co-occupied by open PR feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775 (claude/issue-13881-sys-user-locale), whose hunks sit at base lines 3029-4714 (the email/SMS locale docblocks). This branch's edits are at 5138 and 5164-5174, inside the SCIM reconcile docblock only. Disjoint. Nothing in 3029-4714 was touched, and the edits were anchored by content rather than by line number.
• [finding] plugin-auth SCIM harnesses register no OAuth objects, so every sign-in logs a Better Auth ERROR (back-channel logout planning failed … no such table: sys_oauth_access_token) #14615 / PR test(plugin-auth): register the production object set in the two SCIM harnesses #14751 is merged and already in the test file; its authIdentityObjects harness registration is untouched here.
• Per the ruling, SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522 (SCIM transaction residual) and [finding] SCIM forces the better-auth admin plugin on (pluginConfig.admin ?? scimEffective) and a deployment has no declared way to decline it — split from #13439 by the 2026-08-31 ruling #13816 (admin forcing) are not folded in, and the five stale assertion sites fenced on [finding] SCIM active:false no longer disables the account — the vendor ban coupling was removed upstream in @better-auth/scim 1.7.0 and nothing in this repo replaced it #14360 are not touched.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-auth, touching 2 documentable anchor(s).

3 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/kernel/contracts/auth-service.mdx(via AuthManager (symbol, a top-level class))
• content/docs/kernel/services-checklist.mdx(via AuthManager (symbol, a top-level class))
• content/docs/permissions/authentication.mdx(via AuthManager (symbol, a top-level class))

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 11 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 5a5336b399db2ef18dd4700f97d579a328197dda → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 35da8cc60775679ebda2af1255c4cf1972ecdaaa — the merge of head f63bc0d22ab6fbfdf63fd6569d0e94d13eb9df79 into base 5a5336b399db2ef18dd4700f97d579a328197dda, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 35da8cc60775679ebda2af1255c4cf1972ecdaaa && git checkout 35da8cc60775679ebda2af1255c4cf1972ecdaaa
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 5a5336b399db2ef18dd4700f97d579a328197dda f63bc0d22ab6fbfdf63fd6569d0e94d13eb9df79 && git checkout -B drift-repro 5a5336b399db2ef18dd4700f97d579a328197dda && git merge --no-ff f63bc0d22ab6fbfdf63fd6569d0e94d13eb9df79
node scripts/docs-audit/affected-docs.mjs --json 5a5336b399db2ef18dd4700f97d579a328197dda

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 5a5336b399db2ef18dd4700f97d579a328197dda → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33716744075 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1801
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 25 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(cli): make the unread-reader ceiling a load-independent constant at RUN_TIMEOUT_MS #14715、test(cli): derive the vitest tier population instead of freezing it in a list #14717、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(devx): partition os-regen-merge.sh's step-1 conflict message by class #14733、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、fix(deps): take the fix for the four OSV advisories blocking every manifest PR #14736、fix(tooling): a template-literal mode for the vocabulary gate's four shared textual scanners #14739、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815），分属 6 条投机栈 ⇒ 6 次独立命中。⚠️ 同签名的汇总 issue Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822 已作为重复关闭，且没有仍然打开的同签名汇总 issue ⇒ 本次不新建（新建只会再被判重）。请到它指向的那张 issue 上谈，或重开 Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822。
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 64 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33716557375 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1800
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 26 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(cli): make the unread-reader ceiling a load-independent constant at RUN_TIMEOUT_MS #14715、test(cli): derive the vitest tier population instead of freezing it in a list #14717、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(devx): partition os-regen-merge.sh's step-1 conflict message by class #14733、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、fix(deps): take the fix for the four OSV advisories blocking every manifest PR #14736、fix(tooling): a template-literal mode for the vocabulary gate's four shared textual scanners #14739、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、fix(service-automation): a try_catch whose catch region itself fails keeps both regions' step record #14813、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815），分属 5 条投机栈 ⇒ 5 次独立命中。⚠️ 同签名的汇总 issue Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822 已作为重复关闭，且没有仍然打开的同签名汇总 issue ⇒ 本次不新建（新建只会再被判重）。请到它指向的那张 issue 上谈，或重开 Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822。
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• ⚠️本 PR 过去 24h 已在队列失败 1 次（不含本次）。 内容未变而反复失败 ⇒ 高度怀疑 flaky 测试或与同组 PR 的语义冲突，重排不解决。
• 过去 24h 队列共有 69 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[claude]

Fixes#14555

Resumption of a previous agent's branch. That agent pushed two commits and died before opening a PR or reporting, so nothing on the branch had been verified by anyone. This PR verifies the existing work item-by-item against the triage ruling, adds the one gate repair the work had broken, and lands it.

All measurements below were taken at f63bc0d22.

1. The previous agent's work, checked against the ruling

The ruling (issuecomment-5514107240) scoped five items. The branch carries all five, and each matches.

#	Ruling asked for	What the diff actually does	Match
1	Pin the SCIM DELETE of the last administrator; add a DELETE face to the existing suite	Adds one it(...) at scim-deactivation-reconcile-user.test.ts:487, inside the existing deactivating the last administrator is refused through SCIM describe. Asserts 403, the SCIM error schema, status: "403", a detail naming last administrator and ADR-0024 D5.2; then that the row survives, is unbanned, still signs in, and that the vendor tombstone rolled back	yes
1b	Do not restructure face (c) or the PATCH path	The whole test diff removes exactly five lines: three header-comment lines and the two timing constants of item 3. Face (c) at :430, its positive control at :468, and every PATCH face are byte-identical	yes
1c	Register through the harness list, not a hand-written object list	Untouched. The file still has import { authIdentityObjects } from './manifest.js' (line 71), const AUTH_OBJECTS = authIdentityObjects (line 102), consumed at line 174. The diff adds no object list	yes
2	Rewrite the stale last-admin-guard.ts header to describe 1.7.2	Bullets 1 and 2 rewritten (quoted below)	yes
3	Widen expiry to 5 s, wait expiry + 500 ms	TIMED_BAN_MS = 5_000, TIMED_BAN_WAIT_MS = TIMED_BAN_MS + 500. Both faces carry 60_000 timeouts; the whole face measured 25.84 s wall for the entire 13-test file, so 5.5 s of sleep sits far inside it	yes
3b	The positive control — "the most valuable single line in this card"	Present at :640. Identical setup, same timed ban, same wait, no SCIM deactivation, sign-in accepted, row unbanned	yes
4	One stale word in the auth-manager.ts docblock	admin-ban-endpoints.ts becomes user-ban-write.ts	yes
5	One clause: DELETE over a timed administrator ban also makes it permanent	Added to the same docblock (quoted below)	yes

Item 4 — proof that user-ban-write.ts is the live module, and that both modules exist. Both files are present on disk. The live import in auth-manager.ts is:

import{applyUserBan,applyUserUnban,SCIM_DEACTIVATION_BAN_REASON,}from'./user-ban-write.js';

admin-ban-endpoints.ts still exists and still exports runAdminBanUser / runAdminUnbanUser, so the old spelling was a stale attribution, not a dangling reference — the docblock credited the wrong module for the write this path performs.

2. Prose changed — before and after

Item 2, last-admin-guard.ts bullet 1. Before:

the better-auth admin plugin's ban endpoint writes it, and @better-auth/scim maps a SCIM active: false onto that same admin ban (which is why SCIM forces the admin plugin on — ADR-0071).

After: it now says 1.6.x mapped active: false onto the admin ban itself, that 1.7.0 removed that write in favour of an optional host callback, and that since #14360 the ban is landed by plugin-auth's own identity.reconcileUser — "the same column and the same hook, a different author". The installed dependency is @better-auth/scim1.7.2, so the version claim is current.

Item 2, bullet 2. Before:

deleting the sys_user row (#5941) — how every remove lands: SCIM DELETE /Users/{id}, better-auth's /admin/remove-user and /delete-user, an import, a script.

After, SCIM DELETE is removed from that list and called out as explicitly not a row delete on 1.7.2, arriving instead as bullet 1's ban write, "refused by guardBan on beforeUpdate and never reaches guardDelete". The rest of the row-delete half is unchanged.

Item 5, auth-manager.ts. Before:

account. Re-provisioning through the tombstone re-links the same user, the state turns active, and the SCIM ban is lifted by the second bullet.

After:

account — by the SAME branch as active: false, including over an administrator's timed ban, whose banExpires a DELETE therefore clears too: a deprovision cannot be outlived by an expiry the administrator set. For the same reason a DELETE is judged by the beforeUpdate guard below and never by any beforeDelete — deleting the last administrator through SCIM is refused exactly as deactivating them is. Re-provisioning through the tombstone re-links the same user, the state turns active, and the SCIM ban is lifted by the second bullet.

3. Ablations — both pins proved able to fail

Every leg: mutate, prove the mutation reached disk by blob hash and by literal-text counts on both the removed and injected text, run, restore against HEAD (never a bare git checkout -- path, which restores from a possibly-poisoned index), then prove restoration by blob equality and an empty git diff HEAD. Each ran under a trap ... EXIT INT TERM. No mutation was proved by a comment — esbuild strips those.

Ablation A — the positive control can fail. Inverted its sign-in expectation (expectSignInAccepted becomes expectSignInBanned).

HEAD blob = c27ebf78aec1fcdf64d3a2be894f076f61eb1be5
post blob = 8c90af927452afb782bfb322ecebb0174a8963f0 (differs: mutation on disk)
before: FROM-count=1 TO-count=0 after: FROM-count=0 TO-count=1

Mutated: Tests 1 failed | 12 skipped (13), failing precisely on the mechanism the control exists to observe:

AssertionError: expected BANNED_USER, got 200 {... "banned":true,
"banReason":"Policy violation","banExpires":"2026-09-03T02:56:41.983Z" ...}
expected 200 to be 403

That is the vendor's session.create auto-lift admitting a principal whose banExpires has passed — exactly the alternative explanation the ruling wanted excluded. Restored: blob back to c27ebf78, empty git diff HEAD, Tests 1 passed | 12 skipped (13).

Ablation B — the DELETE face exercises the guard. The ruling's own prose claims this face is refused through beforeUpdate and never reaches beforeDelete, so both legs were run. Predicted directions were fixed before running, and both held.

Leg	Mutation	Predicted	Measured
B1	registerHook('beforeUpdate', guardBan, ...) replaced by a no-op	red	red — Tests 1 failed | 12 skipped (13)
B2	registerHook('beforeDelete', guardDelete, ...) replaced by a no-op	green	green — Tests 1 passed | 12 skipped (13)

B1: HEAD blob = 40daa74e67a583fab91f31ee7eabe93dcebd2631
post blob = c9de082ca878d49388fe6d7252b54bfcb2d11263
B2: post blob = 8ea396623d8f680b8d01750dac79c8fda87177cd
both restored to 40daa74e..., empty `git diff HEAD`

B1's failure is the DELETE succeeding and returning an empty body where the 403 SCIM error JSON was expected (SyntaxError: Unexpected end of JSON input at the res.json() on line 503). B2 is green because the SCIM DELETE never reaches guardDelete at all.

Together these confirm the measured claim the branch ships in the guard header — "removing the beforeDelete registration leaves the SCIM DELETE face green, removing the beforeUpdate one reddens it" — is accurate as written, and that the new face is genuinely pinned to the guard rather than to an incidental 403.

4. One gate the branch had broken, repaired here

check-system-context-census was red on the branch as pushed, and would have reddened CI:

::error::[anchor-is-not-a-read-site] the page anchors .../last-admin-guard.ts:286 ...
::error::[ledger-row-unused] NON_READ_ANCHORS excuses .../last-admin-guard.ts:299 ...

Cause: the item-2 header rewrite added 13 net lines above the census's read site, moving the needle line applies to EVERY context, isSystem included from 286 to 299 (verified against the merge base: 286 there, 299 here). The gate's ledger row finds that line by needle, so it followed the code; content/docs/permissions/system-context.mdx hard-codes the number, so it did not — reddening both directions at once. Repaired with the gate's own --fix, which is the authority on the form:

re-anchored content/docs/permissions/system-context.mdx:201 `last-admin-guard.ts:286` -> `:299`
check-system-context-census: OK — 109 elevation read sites in 20 packages across 45 files,
all anchored; 145 anchors resolve, 27 declared non-read.

5. Verification

All at f63bc0d22.

• Target file:Test Files 1 passed (1) / Tests 13 passed (13)
• Whole affected package (@objectstack/plugin-auth, run because better-auth-schema-parity.test.ts reads auth-manager.ts as source text and a comment-only edit is not self-evidently inert to it): Test Files 91 passed (91) / Tests 1866 passed (1866)
• pnpm --filter @objectstack/plugin-auth typecheck: exit 0, including check:test-typecheck over tsconfig.test.json. This matters here: the build tsconfig.json excludes **/*.test.ts, so tsc --noEmit alone says nothing about the new test code; the test-layer program is what covers it, and this file carries no test-typecheck-debt.json entry, so it must be at zero errors.
• Gate family, re-derived in-worktree with node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack. The first derivation over the three original paths gave 28 commands; the census repair added content/docs/..., which pulled the count to 52. Re-deriving after that edit was load-bearing — 24 doc gates would otherwise have gone unrun. Union at f63bc0d22: 49 pass, 3 PREREQUISITE NOT MET.

The three unmeasured, each of which self-declares that it is neither a pass nor a finding:

Gate	Exit	Why
check-test-completeness.mjs	3	Needs a saved turbo run test log, which only CI tees. Its own text names the dispatch-gates family as this branch and says to record NOT MEASURED
check:dual-build-cjs-loads	3	Reads built output; 40 packages have no dist/. Needs a full pnpm build
check:type-check-debt	3	Needs the whole workspace closure built, or it "would silently measure a DIFFERENT WORLD"

check:skill-examples initially exited 1 on an unmet prerequisite (client-react unbuilt). Rather than record it unmeasured I built the closure and re-ran it: pass, 256 prose examples type-check across 3 surfaces.

6. Changeset

None owed. The diff is comment-only in two source files, one test file, and one docs anchor — no exported symbol, no payload key, no behaviour change. Both edited docblocks are off the published surface: the auth-manager.ts block documents private async reconcileScimUserLifecycle, and the last-admin-guard.ts block is a file-level header before the first import. This is pr-automation.yml's route 2 verbatim ("It releases nothing (.github/, .claude/, skills/, docs/, content/, examples/, tests-only, and the like) -- apply the skip-changeset label"), so the label is applied rather than an empty changeset.

7. Co-occupancy

• auth-manager.ts is co-occupied by open PR feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775 (claude/issue-13881-sys-user-locale), whose hunks sit at base lines 3029-4714 (the email/SMS locale docblocks). This branch's edits are at 5138 and 5164-5174, inside the SCIM reconcile docblock only. Disjoint. Nothing in 3029-4714 was touched, and the edits were anchored by content rather than by line number.
• [finding] plugin-auth SCIM harnesses register no OAuth objects, so every sign-in logs a Better Auth ERROR (back-channel logout planning failed … no such table: sys_oauth_access_token) #14615 / PR test(plugin-auth): register the production object set in the two SCIM harnesses #14751 is merged and already in the test file; its authIdentityObjects harness registration is untouched here.
• Per the ruling, SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522 (SCIM transaction residual) and [finding] SCIM forces the better-auth admin plugin on (pluginConfig.admin ?? scimEffective) and a deployment has no declared way to decline it — split from #13439 by the 2026-08-31 ruling #13816 (admin forcing) are not folded in, and the five stale assertion sites fenced on [finding] SCIM active:false no longer disables the account — the vendor ban coupling was removed upstream in @better-auth/scim 1.7.0 and nothing in this repo replaced it #14360 are not touched.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-auth, touching 2 documentable anchor(s).

3 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/kernel/contracts/auth-service.mdx(via AuthManager (symbol, a top-level class))
• content/docs/kernel/services-checklist.mdx(via AuthManager (symbol, a top-level class))
• content/docs/permissions/authentication.mdx(via AuthManager (symbol, a top-level class))

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 11 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 5a5336b399db2ef18dd4700f97d579a328197dda → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 35da8cc60775679ebda2af1255c4cf1972ecdaaa — the merge of head f63bc0d22ab6fbfdf63fd6569d0e94d13eb9df79 into base 5a5336b399db2ef18dd4700f97d579a328197dda, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 35da8cc60775679ebda2af1255c4cf1972ecdaaa && git checkout 35da8cc60775679ebda2af1255c4cf1972ecdaaa
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 5a5336b399db2ef18dd4700f97d579a328197dda f63bc0d22ab6fbfdf63fd6569d0e94d13eb9df79 && git checkout -B drift-repro 5a5336b399db2ef18dd4700f97d579a328197dda && git merge --no-ff f63bc0d22ab6fbfdf63fd6569d0e94d13eb9df79
node scripts/docs-audit/affected-docs.mjs --json 5a5336b399db2ef18dd4700f97d579a328197dda

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 5a5336b399db2ef18dd4700f97d579a328197dda → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33716744075 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1801
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 25 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(cli): make the unread-reader ceiling a load-independent constant at RUN_TIMEOUT_MS #14715、test(cli): derive the vitest tier population instead of freezing it in a list #14717、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(devx): partition os-regen-merge.sh's step-1 conflict message by class #14733、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、fix(deps): take the fix for the four OSV advisories blocking every manifest PR #14736、fix(tooling): a template-literal mode for the vocabulary gate's four shared textual scanners #14739、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815），分属 6 条投机栈 ⇒ 6 次独立命中。⚠️ 同签名的汇总 issue Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822 已作为重复关闭，且没有仍然打开的同签名汇总 issue ⇒ 本次不新建（新建只会再被判重）。请到它指向的那张 issue 上谈，或重开 Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822。
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 64 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 33716557375 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

• Test Core (1/6) — 失败步骤: Run this shard's tests

  @objectstack/cli:test: FAIL integration test/run-dev-unbuilt-workspace.e2e.test.ts > the mirror direction: a reader that is never coming back > gives up and exits instead of waiting forever
  ↳ 失败原因: @objectstack/cli:test: AssertionError: the harness SIGKILLed the child — it was still alive at the ceiling. cap 180000 ms (RUN_TIMEOUT_MS, constant and load-independent by design); this child ran 1800
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/run-dev-unbuilt-workspace.e2e.test.ts — 24h 内已弹出 26 个 PR（fix(plugin-sharing): let system writes materialize sharing rules — drop the isSystem skips in bindRuleHooks (#13533) #14528、test(cli): make the unread-reader ceiling a load-independent constant at RUN_TIMEOUT_MS #14715、test(cli): derive the vitest tier population instead of freezing it in a list #14717、fix(sharing): stamp organization_id on every sys_record_share write, backfill the stranded rows, admit the object to the tenancy ledger (#14484) #14726、fix(devx): partition os-regen-merge.sh's step-1 conflict message by class #14733、fix(spec): send a top-level flow trigger to the START node config, not to a type rename #14735、fix(deps): take the fix for the four OSV advisories blocking every manifest PR #14736、fix(tooling): a template-literal mode for the vocabulary gate's four shared textual scanners #14739、test(runtime): pin the measured loadMany vs by-name divergence for #14423 (a) #14741、test(plugin-approvals): pin the lock release in the tenant-admin reverse check #14750、fix(lint): consolidate five more private "Did you mean?" copies onto suggestName #14757、fix(metadata-protocol): apply the allowOrgOverride read gate inside getMetaItems, so multi-type sweeps are scoped per type #14767、feat(dispatch-gates): a checkable whole-tree-population channel, so a repo-wide gate is placed by declaration instead of landing near undetermined #14774、feat(spec,platform-objects,service-messaging,plugin-auth): sys_user.locale + per-recipient notification locale (#13881) #14775、skills(data): drop the two bare ADR-0010 citations from the objectstack-data skill #14777、docs(skills): repair five semantic minors in the axis-weighting and batch-presentation encoding #14779、fix(skills): teach {current_user_id}, not $currentUser, in the objectstack-ui Filtering example #14781、fix(deps): take the fix for four fast-uri OSV advisories (3.1.5 -> 3.1.6) #14783、docs(pm-dispatch): timestamped readings are the first construct-shaped fix; record the remediation-shape ranking beside it #14784、docs(ci): correct lint.yml corpus-claim-drift comment for #13745's shipped rows #14790、docs(skills): settle two false claims in skills/README.md and add three cross-skill routing bullets #14795、docs(i18n): name the measurement-widening race in check-i18n-coverage's header #14799、fix(examples): app-multi-package's module is served WITH scope: 'project' — drop the "no scope key" claim #14804、fix(plugin-auth): register the auth service-composition bindings independently of registerRoutes #14810、fix(service-automation): a try_catch whose catch region itself fails keeps both regions' step record #14813、test(plugin-auth): pin the SCIM DELETE of the last administrator, de-flake the timed-ban face, and describe the 1.7.2 lifecycle #14815），分属 5 条投机栈 ⇒ 5 次独立命中。⚠️ 同签名的汇总 issue Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822 已作为重复关闭，且没有仍然打开的同签名汇总 issue ⇒ 本次不新建（新建只会再被判重）。请到它指向的那张 issue 上谈，或重开 Queue-flake anchor: test/run-dev-unbuilt-workspace.e2e.test.ts #14822。
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• ⚠️本 PR 过去 24h 已在队列失败 1 次（不含本次）。 内容未变而反复失败 ⇒ 高度怀疑 flaky 测试或与同组 PR 的语义冲突，重排不解决。
• 过去 24h 队列共有 69 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)