feat(tooling): @objectstack/core declares a typecheck script; test and examples layers enter the ratchet

[os-musk]

Fixes#14613

@objectstack/core declared exactly build, test, test:watch. turbo run typecheck selects only packages that declare the task, so the lint workflow's typecheck job could not reach this package, and pnpm --filter @objectstack/core typecheck failed with ERR_PNPM_RECURSIVE_RUN_NO_SCRIPT for anyone who tried it — which is how a dispatched task came to assume it existed.

The card asked for the count before any repair. Here it is.

Measured at 84b8190ae, dependency closure built first

program	files	errors
tsc --noEmit -p tsconfig.json (undivided — exactly as the DEBT entry measured it)	12 with errors	98
the same program over only the non-test sources	63	0
the 48 test files under vitest's own module semantics	48	4

98 reproduces the ledger to the unit, and the class breakdown matches it line for line: TS7006 x71, TS2835 x22, and one each of TS6133, TS2739, TS2352, TS2347, TS18046. All 12 files are .test.ts.

So the build layer graduated as it stood, and 94 of the 98 were the CHECK, not the code.

What landed

The split this repo already runs for spec, rest, objectql and client:

• tsconfig.json stays the BUILD config and now excludes the test layer.
• tsconfig.test.json (new) compiles that layer under module: esnext / moduleResolution: bundler — the semantics vitest actually executes it with. That retires 22 x TS2835, the TS2347 beside them, and the share of TS7006 they cascade into: an import that does not resolve makes every symbol it names any. Strictness is inherited and untouched, and no test file is edited.
• test-typecheck-debt.json (new) holds the residue of 4, per file and per signature, EXACT and shrink-only.
• scripts/check-type-check-coverage.mjs — the @objectstack/core DEBT entry is deleted, because RECONCILED makes a DEBT entry for a package that declares typecheck an error.

The 4 ledgered are left deliberately, and the ledger's authored _note says why. Two are one defect twice over (src/plugin-loader.test.ts, src/security/plugin-permission-enforcer.test.ts: a mock PluginContext missing registerServiceFactory / replaceService / getServiceScoped) — the same shape the @objectstack/metadata DEBT entry records, whose repair is in flight on its own card, so the shared fixture they want should be authored once by whoever closes that rather than twice in parallel.

The examples/ half — found by the new script, not by the card

Declaring typecheck flips the package from COVERED-BY-LEDGER to COVERED-BY-SCRIPT, and check:type-check-coverage's SOURCES_COVERED invariant then reported packages/core/examples: 2 non-test source files in no tsc program at all. Neither had ever compiled — kernel-features-example.ts imported ../index.js (above the package root, never existed) and phase2-integration.ts imported @objectstack/core, i.e. this package self-referencing by a name it declares in no dependency block.

Collapsing that cascade exposed errors rather than removing them, 12 to 29 — all real, none new:

• 20 reads of ObjectKernel's privatelogger;
• 4 members of the security-scan result that do not exist (passed, score, summary.critical, summary.high, where KernelSecurityScanResult carries status and per-severity counts);
• 2 config literals passing the unparsed shapes where PluginHealthMonitor.registerPlugin and HotReloadManager.registerPlugin are declared over the Parsed ones. That pair is retirement drift: this file was edited by two retirements (the PluginHealthCheck restart keys, and watchPatterns) while no tsc program could check the result.

Every correction is pinned to this package's own signatures — PluginPermissionSet off src/security/permission-manager.ts, the Parsed variants off src/health-monitor.ts / src/hot-reload.ts, the scan shape off the type tsc printed. packages/spec was not touched, and needed no change: the three types the example wanted are exported from @objectstack/spec/kernel, never from .../system, and this package's own source already imports them from kernel.

@objectstack/core therefore leaves the DEBT ledger: check:type-check-coverage now reads 70/79 type-checked with 9 ledgered, where it read 68/78 with 10.

Out of scope, reported not fixed

packages/core/examples/phase2-integration.ts is the sole composer of PluginSecurityScanner, which docs/qa/platform-checklist/FOLLOW-UPS.md already records as exported dead code on the public barrel with 3 of 5 scan methods empty stubs. When this directory was last found composing a retired surface, the repo deleted the example (api-registry-example.ts, #4939). Whether these two files should exist at all is a retirement decision for that seat; this PR only makes them compile, so the question is now visible to tsc instead of hidden from it.

Gates

Derived with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands and no path arguments, so the change set comes from the merge base rather than a hand-written list; harvested via --commands, not by grepping the prose. 49 families, all run at 27ecaa29e:

• 45 green in the light batch, plus check:dual-build-cjs-loads and check:type-check-debt green.
• pnpm --filter @objectstack/core typecheck — exit 0 (the script this card is about).
• check:type-check-debt — 20 ledger entr(ies) re-measured in 299.8s, 451 raw tsc error(s) total, none above its recorded number. surplus: none.
• node scripts/pm/check-governed-merges.mjs --test on the final 9-file list — NOT governed.
• 2 recorded NOT MEASURED, not red: check-test-completeness and check-half-states both exit 3 = PREREQUISITE NOT MET (a saved turbo run test log; GitHub API access). Neither is a finding, and both are unrelated to this diff.

⚠️ One local-only wrinkle worth naming: check:dual-build-cjs-loads first reported 2 findings against @objectstack/client and @objectstack/client-react. Both were artifacts of a cut-off local build (dist present, declarations not emitted); after building those two properly the gate is green over 102 entry points. Neither names @objectstack/core and this diff changes no exports map, no files, and no runtime source.

🤖 Generated with Claude Code

https://claude.ai/code/session_0112hMx9hjJ9BgB28X97DS68

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/core, touching 4 documentable anchor(s). ⚠️3 changed file(s) yielded no anchor (packages/core/test-typecheck-debt.json, packages/core/tsconfig.examples.json, packages/core/tsconfig.json), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/protocol/kernel/lifecycle.mdx(via installPlugin (symbol, a method of class EnterprisePluginPlatform))

What this run could not see

• 3 changed file(s) yielded no anchor (packages/core/test-typecheck-debt.json, packages/core/tsconfig.examples.json, packages/core/tsconfig.json) — pages documenting those are invisible to this run
• 4 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 24 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 09cc6be43414214b9abfc7791b8497ea4f9dd2fc → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 000a8b2396d77613e3506148fbad7b8072257e01 — the merge of head 86d7cc58b2615bf4cd0fe2de6a0c0856102f0336 into base 09cc6be43414214b9abfc7791b8497ea4f9dd2fc, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 000a8b2396d77613e3506148fbad7b8072257e01 && git checkout 000a8b2396d77613e3506148fbad7b8072257e01
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 09cc6be43414214b9abfc7791b8497ea4f9dd2fc 86d7cc58b2615bf4cd0fe2de6a0c0856102f0336 && git checkout -B drift-repro 09cc6be43414214b9abfc7791b8497ea4f9dd2fc && git merge --no-ff 86d7cc58b2615bf4cd0fe2de6a0c0856102f0336
node scripts/docs-audit/affected-docs.mjs --json 09cc6be43414214b9abfc7791b8497ea4f9dd2fc

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 09cc6be43414214b9abfc7791b8497ea4f9dd2fc → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-musk]

Fixes#14613

@objectstack/core declared exactly build, test, test:watch. turbo run typecheck selects only packages that declare the task, so the lint workflow's typecheck job could not reach this package, and pnpm --filter @objectstack/core typecheck failed with ERR_PNPM_RECURSIVE_RUN_NO_SCRIPT for anyone who tried it — which is how a dispatched task came to assume it existed.

The card asked for the count before any repair. Here it is.

Measured at 84b8190ae, dependency closure built first

program	files	errors
tsc --noEmit -p tsconfig.json (undivided — exactly as the DEBT entry measured it)	12 with errors	98
the same program over only the non-test sources	63	0
the 48 test files under vitest's own module semantics	48	4

98 reproduces the ledger to the unit, and the class breakdown matches it line for line: TS7006 x71, TS2835 x22, and one each of TS6133, TS2739, TS2352, TS2347, TS18046. All 12 files are .test.ts.

So the build layer graduated as it stood, and 94 of the 98 were the CHECK, not the code.

What landed

The split this repo already runs for spec, rest, objectql and client:

• tsconfig.json stays the BUILD config and now excludes the test layer.
• tsconfig.test.json (new) compiles that layer under module: esnext / moduleResolution: bundler — the semantics vitest actually executes it with. That retires 22 x TS2835, the TS2347 beside them, and the share of TS7006 they cascade into: an import that does not resolve makes every symbol it names any. Strictness is inherited and untouched, and no test file is edited.
• test-typecheck-debt.json (new) holds the residue of 4, per file and per signature, EXACT and shrink-only.
• scripts/check-type-check-coverage.mjs — the @objectstack/core DEBT entry is deleted, because RECONCILED makes a DEBT entry for a package that declares typecheck an error.

The 4 ledgered are left deliberately, and the ledger's authored _note says why. Two are one defect twice over (src/plugin-loader.test.ts, src/security/plugin-permission-enforcer.test.ts: a mock PluginContext missing registerServiceFactory / replaceService / getServiceScoped) — the same shape the @objectstack/metadata DEBT entry records, whose repair is in flight on its own card, so the shared fixture they want should be authored once by whoever closes that rather than twice in parallel.

The examples/ half — found by the new script, not by the card

Declaring typecheck flips the package from COVERED-BY-LEDGER to COVERED-BY-SCRIPT, and check:type-check-coverage's SOURCES_COVERED invariant then reported packages/core/examples: 2 non-test source files in no tsc program at all. Neither had ever compiled — kernel-features-example.ts imported ../index.js (above the package root, never existed) and phase2-integration.ts imported @objectstack/core, i.e. this package self-referencing by a name it declares in no dependency block.

Collapsing that cascade exposed errors rather than removing them, 12 to 29 — all real, none new:

• 20 reads of ObjectKernel's privatelogger;
• 4 members of the security-scan result that do not exist (passed, score, summary.critical, summary.high, where KernelSecurityScanResult carries status and per-severity counts);
• 2 config literals passing the unparsed shapes where PluginHealthMonitor.registerPlugin and HotReloadManager.registerPlugin are declared over the Parsed ones. That pair is retirement drift: this file was edited by two retirements (the PluginHealthCheck restart keys, and watchPatterns) while no tsc program could check the result.

Every correction is pinned to this package's own signatures — PluginPermissionSet off src/security/permission-manager.ts, the Parsed variants off src/health-monitor.ts / src/hot-reload.ts, the scan shape off the type tsc printed. packages/spec was not touched, and needed no change: the three types the example wanted are exported from @objectstack/spec/kernel, never from .../system, and this package's own source already imports them from kernel.

@objectstack/core therefore leaves the DEBT ledger: check:type-check-coverage now reads 70/79 type-checked with 9 ledgered, where it read 68/78 with 10.

Out of scope, reported not fixed

packages/core/examples/phase2-integration.ts is the sole composer of PluginSecurityScanner, which docs/qa/platform-checklist/FOLLOW-UPS.md already records as exported dead code on the public barrel with 3 of 5 scan methods empty stubs. When this directory was last found composing a retired surface, the repo deleted the example (api-registry-example.ts, #4939). Whether these two files should exist at all is a retirement decision for that seat; this PR only makes them compile, so the question is now visible to tsc instead of hidden from it.

Gates

Derived with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands and no path arguments, so the change set comes from the merge base rather than a hand-written list; harvested via --commands, not by grepping the prose. 49 families, all run at 27ecaa29e:

• 45 green in the light batch, plus check:dual-build-cjs-loads and check:type-check-debt green.
• pnpm --filter @objectstack/core typecheck — exit 0 (the script this card is about).
• check:type-check-debt — 20 ledger entr(ies) re-measured in 299.8s, 451 raw tsc error(s) total, none above its recorded number. surplus: none.
• node scripts/pm/check-governed-merges.mjs --test on the final 9-file list — NOT governed.
• 2 recorded NOT MEASURED, not red: check-test-completeness and check-half-states both exit 3 = PREREQUISITE NOT MET (a saved turbo run test log; GitHub API access). Neither is a finding, and both are unrelated to this diff.

⚠️ One local-only wrinkle worth naming: check:dual-build-cjs-loads first reported 2 findings against @objectstack/client and @objectstack/client-react. Both were artifacts of a cut-off local build (dist present, declarations not emitted); after building those two properly the gate is green over 102 entry points. Neither names @objectstack/core and this diff changes no exports map, no files, and no runtime source.

🤖 Generated with Claude Code

https://claude.ai/code/session_0112hMx9hjJ9BgB28X97DS68

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/core, touching 4 documentable anchor(s). ⚠️3 changed file(s) yielded no anchor (packages/core/test-typecheck-debt.json, packages/core/tsconfig.examples.json, packages/core/tsconfig.json), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/protocol/kernel/lifecycle.mdx(via installPlugin (symbol, a method of class EnterprisePluginPlatform))

What this run could not see

• 3 changed file(s) yielded no anchor (packages/core/test-typecheck-debt.json, packages/core/tsconfig.examples.json, packages/core/tsconfig.json) — pages documenting those are invisible to this run
• 4 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 24 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 09cc6be43414214b9abfc7791b8497ea4f9dd2fc → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 000a8b2396d77613e3506148fbad7b8072257e01 — the merge of head 86d7cc58b2615bf4cd0fe2de6a0c0856102f0336 into base 09cc6be43414214b9abfc7791b8497ea4f9dd2fc, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 000a8b2396d77613e3506148fbad7b8072257e01 && git checkout 000a8b2396d77613e3506148fbad7b8072257e01
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 09cc6be43414214b9abfc7791b8497ea4f9dd2fc 86d7cc58b2615bf4cd0fe2de6a0c0856102f0336 && git checkout -B drift-repro 09cc6be43414214b9abfc7791b8497ea4f9dd2fc && git merge --no-ff 86d7cc58b2615bf4cd0fe2de6a0c0856102f0336
node scripts/docs-audit/affected-docs.mjs --json 09cc6be43414214b9abfc7791b8497ea4f9dd2fc

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 09cc6be43414214b9abfc7791b8497ea4f9dd2fc → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-musk]

Fixes#14613

@objectstack/core declared exactly build, test, test:watch. turbo run typecheck selects only packages that declare the task, so the lint workflow's typecheck job could not reach this package, and pnpm --filter @objectstack/core typecheck failed with ERR_PNPM_RECURSIVE_RUN_NO_SCRIPT for anyone who tried it — which is how a dispatched task came to assume it existed.

The card asked for the count before any repair. Here it is.

Measured at 84b8190ae, dependency closure built first

program	files	errors
tsc --noEmit -p tsconfig.json (undivided — exactly as the DEBT entry measured it)	12 with errors	98
the same program over only the non-test sources	63	0
the 48 test files under vitest's own module semantics	48	4

98 reproduces the ledger to the unit, and the class breakdown matches it line for line: TS7006 x71, TS2835 x22, and one each of TS6133, TS2739, TS2352, TS2347, TS18046. All 12 files are .test.ts.

So the build layer graduated as it stood, and 94 of the 98 were the CHECK, not the code.

What landed

The split this repo already runs for spec, rest, objectql and client:

• tsconfig.json stays the BUILD config and now excludes the test layer.
• tsconfig.test.json (new) compiles that layer under module: esnext / moduleResolution: bundler — the semantics vitest actually executes it with. That retires 22 x TS2835, the TS2347 beside them, and the share of TS7006 they cascade into: an import that does not resolve makes every symbol it names any. Strictness is inherited and untouched, and no test file is edited.
• test-typecheck-debt.json (new) holds the residue of 4, per file and per signature, EXACT and shrink-only.
• scripts/check-type-check-coverage.mjs — the @objectstack/core DEBT entry is deleted, because RECONCILED makes a DEBT entry for a package that declares typecheck an error.

The 4 ledgered are left deliberately, and the ledger's authored _note says why. Two are one defect twice over (src/plugin-loader.test.ts, src/security/plugin-permission-enforcer.test.ts: a mock PluginContext missing registerServiceFactory / replaceService / getServiceScoped) — the same shape the @objectstack/metadata DEBT entry records, whose repair is in flight on its own card, so the shared fixture they want should be authored once by whoever closes that rather than twice in parallel.

The examples/ half — found by the new script, not by the card

Declaring typecheck flips the package from COVERED-BY-LEDGER to COVERED-BY-SCRIPT, and check:type-check-coverage's SOURCES_COVERED invariant then reported packages/core/examples: 2 non-test source files in no tsc program at all. Neither had ever compiled — kernel-features-example.ts imported ../index.js (above the package root, never existed) and phase2-integration.ts imported @objectstack/core, i.e. this package self-referencing by a name it declares in no dependency block.

Collapsing that cascade exposed errors rather than removing them, 12 to 29 — all real, none new:

• 20 reads of ObjectKernel's privatelogger;
• 4 members of the security-scan result that do not exist (passed, score, summary.critical, summary.high, where KernelSecurityScanResult carries status and per-severity counts);
• 2 config literals passing the unparsed shapes where PluginHealthMonitor.registerPlugin and HotReloadManager.registerPlugin are declared over the Parsed ones. That pair is retirement drift: this file was edited by two retirements (the PluginHealthCheck restart keys, and watchPatterns) while no tsc program could check the result.

Every correction is pinned to this package's own signatures — PluginPermissionSet off src/security/permission-manager.ts, the Parsed variants off src/health-monitor.ts / src/hot-reload.ts, the scan shape off the type tsc printed. packages/spec was not touched, and needed no change: the three types the example wanted are exported from @objectstack/spec/kernel, never from .../system, and this package's own source already imports them from kernel.

@objectstack/core therefore leaves the DEBT ledger: check:type-check-coverage now reads 70/79 type-checked with 9 ledgered, where it read 68/78 with 10.

Out of scope, reported not fixed

packages/core/examples/phase2-integration.ts is the sole composer of PluginSecurityScanner, which docs/qa/platform-checklist/FOLLOW-UPS.md already records as exported dead code on the public barrel with 3 of 5 scan methods empty stubs. When this directory was last found composing a retired surface, the repo deleted the example (api-registry-example.ts, #4939). Whether these two files should exist at all is a retirement decision for that seat; this PR only makes them compile, so the question is now visible to tsc instead of hidden from it.

Gates

Derived with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands and no path arguments, so the change set comes from the merge base rather than a hand-written list; harvested via --commands, not by grepping the prose. 49 families, all run at 27ecaa29e:

• 45 green in the light batch, plus check:dual-build-cjs-loads and check:type-check-debt green.
• pnpm --filter @objectstack/core typecheck — exit 0 (the script this card is about).
• check:type-check-debt — 20 ledger entr(ies) re-measured in 299.8s, 451 raw tsc error(s) total, none above its recorded number. surplus: none.
• node scripts/pm/check-governed-merges.mjs --test on the final 9-file list — NOT governed.
• 2 recorded NOT MEASURED, not red: check-test-completeness and check-half-states both exit 3 = PREREQUISITE NOT MET (a saved turbo run test log; GitHub API access). Neither is a finding, and both are unrelated to this diff.

⚠️ One local-only wrinkle worth naming: check:dual-build-cjs-loads first reported 2 findings against @objectstack/client and @objectstack/client-react. Both were artifacts of a cut-off local build (dist present, declarations not emitted); after building those two properly the gate is green over 102 entry points. Neither names @objectstack/core and this diff changes no exports map, no files, and no runtime source.

🤖 Generated with Claude Code

https://claude.ai/code/session_0112hMx9hjJ9BgB28X97DS68

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/core, touching 4 documentable anchor(s). ⚠️3 changed file(s) yielded no anchor (packages/core/test-typecheck-debt.json, packages/core/tsconfig.examples.json, packages/core/tsconfig.json), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/protocol/kernel/lifecycle.mdx(via installPlugin (symbol, a method of class EnterprisePluginPlatform))

What this run could not see

• 3 changed file(s) yielded no anchor (packages/core/test-typecheck-debt.json, packages/core/tsconfig.examples.json, packages/core/tsconfig.json) — pages documenting those are invisible to this run
• 4 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 24 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 09cc6be43414214b9abfc7791b8497ea4f9dd2fc → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 000a8b2396d77613e3506148fbad7b8072257e01 — the merge of head 86d7cc58b2615bf4cd0fe2de6a0c0856102f0336 into base 09cc6be43414214b9abfc7791b8497ea4f9dd2fc, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 000a8b2396d77613e3506148fbad7b8072257e01 && git checkout 000a8b2396d77613e3506148fbad7b8072257e01
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 09cc6be43414214b9abfc7791b8497ea4f9dd2fc 86d7cc58b2615bf4cd0fe2de6a0c0856102f0336 && git checkout -B drift-repro 09cc6be43414214b9abfc7791b8497ea4f9dd2fc && git merge --no-ff 86d7cc58b2615bf4cd0fe2de6a0c0856102f0336
node scripts/docs-audit/affected-docs.mjs --json 09cc6be43414214b9abfc7791b8497ea4f9dd2fc

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 09cc6be43414214b9abfc7791b8497ea4f9dd2fc → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-musk]

Fixes#14613

@objectstack/core declared exactly build, test, test:watch. turbo run typecheck selects only packages that declare the task, so the lint workflow's typecheck job could not reach this package, and pnpm --filter @objectstack/core typecheck failed with ERR_PNPM_RECURSIVE_RUN_NO_SCRIPT for anyone who tried it — which is how a dispatched task came to assume it existed.

The card asked for the count before any repair. Here it is.

Measured at 84b8190ae, dependency closure built first

program	files	errors
tsc --noEmit -p tsconfig.json (undivided — exactly as the DEBT entry measured it)	12 with errors	98
the same program over only the non-test sources	63	0
the 48 test files under vitest's own module semantics	48	4

98 reproduces the ledger to the unit, and the class breakdown matches it line for line: TS7006 x71, TS2835 x22, and one each of TS6133, TS2739, TS2352, TS2347, TS18046. All 12 files are .test.ts.

So the build layer graduated as it stood, and 94 of the 98 were the CHECK, not the code.

What landed

The split this repo already runs for spec, rest, objectql and client:

• tsconfig.json stays the BUILD config and now excludes the test layer.
• tsconfig.test.json (new) compiles that layer under module: esnext / moduleResolution: bundler — the semantics vitest actually executes it with. That retires 22 x TS2835, the TS2347 beside them, and the share of TS7006 they cascade into: an import that does not resolve makes every symbol it names any. Strictness is inherited and untouched, and no test file is edited.
• test-typecheck-debt.json (new) holds the residue of 4, per file and per signature, EXACT and shrink-only.
• scripts/check-type-check-coverage.mjs — the @objectstack/core DEBT entry is deleted, because RECONCILED makes a DEBT entry for a package that declares typecheck an error.

The 4 ledgered are left deliberately, and the ledger's authored _note says why. Two are one defect twice over (src/plugin-loader.test.ts, src/security/plugin-permission-enforcer.test.ts: a mock PluginContext missing registerServiceFactory / replaceService / getServiceScoped) — the same shape the @objectstack/metadata DEBT entry records, whose repair is in flight on its own card, so the shared fixture they want should be authored once by whoever closes that rather than twice in parallel.

The examples/ half — found by the new script, not by the card

Declaring typecheck flips the package from COVERED-BY-LEDGER to COVERED-BY-SCRIPT, and check:type-check-coverage's SOURCES_COVERED invariant then reported packages/core/examples: 2 non-test source files in no tsc program at all. Neither had ever compiled — kernel-features-example.ts imported ../index.js (above the package root, never existed) and phase2-integration.ts imported @objectstack/core, i.e. this package self-referencing by a name it declares in no dependency block.

Collapsing that cascade exposed errors rather than removing them, 12 to 29 — all real, none new:

• 20 reads of ObjectKernel's privatelogger;
• 4 members of the security-scan result that do not exist (passed, score, summary.critical, summary.high, where KernelSecurityScanResult carries status and per-severity counts);
• 2 config literals passing the unparsed shapes where PluginHealthMonitor.registerPlugin and HotReloadManager.registerPlugin are declared over the Parsed ones. That pair is retirement drift: this file was edited by two retirements (the PluginHealthCheck restart keys, and watchPatterns) while no tsc program could check the result.

Every correction is pinned to this package's own signatures — PluginPermissionSet off src/security/permission-manager.ts, the Parsed variants off src/health-monitor.ts / src/hot-reload.ts, the scan shape off the type tsc printed. packages/spec was not touched, and needed no change: the three types the example wanted are exported from @objectstack/spec/kernel, never from .../system, and this package's own source already imports them from kernel.

@objectstack/core therefore leaves the DEBT ledger: check:type-check-coverage now reads 70/79 type-checked with 9 ledgered, where it read 68/78 with 10.

Out of scope, reported not fixed

packages/core/examples/phase2-integration.ts is the sole composer of PluginSecurityScanner, which docs/qa/platform-checklist/FOLLOW-UPS.md already records as exported dead code on the public barrel with 3 of 5 scan methods empty stubs. When this directory was last found composing a retired surface, the repo deleted the example (api-registry-example.ts, #4939). Whether these two files should exist at all is a retirement decision for that seat; this PR only makes them compile, so the question is now visible to tsc instead of hidden from it.

Gates

Derived with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands and no path arguments, so the change set comes from the merge base rather than a hand-written list; harvested via --commands, not by grepping the prose. 49 families, all run at 27ecaa29e:

• 45 green in the light batch, plus check:dual-build-cjs-loads and check:type-check-debt green.
• pnpm --filter @objectstack/core typecheck — exit 0 (the script this card is about).
• check:type-check-debt — 20 ledger entr(ies) re-measured in 299.8s, 451 raw tsc error(s) total, none above its recorded number. surplus: none.
• node scripts/pm/check-governed-merges.mjs --test on the final 9-file list — NOT governed.
• 2 recorded NOT MEASURED, not red: check-test-completeness and check-half-states both exit 3 = PREREQUISITE NOT MET (a saved turbo run test log; GitHub API access). Neither is a finding, and both are unrelated to this diff.

⚠️ One local-only wrinkle worth naming: check:dual-build-cjs-loads first reported 2 findings against @objectstack/client and @objectstack/client-react. Both were artifacts of a cut-off local build (dist present, declarations not emitted); after building those two properly the gate is green over 102 entry points. Neither names @objectstack/core and this diff changes no exports map, no files, and no runtime source.

🤖 Generated with Claude Code

https://claude.ai/code/session_0112hMx9hjJ9BgB28X97DS68

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/core, touching 4 documentable anchor(s). ⚠️3 changed file(s) yielded no anchor (packages/core/test-typecheck-debt.json, packages/core/tsconfig.examples.json, packages/core/tsconfig.json), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/protocol/kernel/lifecycle.mdx(via installPlugin (symbol, a method of class EnterprisePluginPlatform))

What this run could not see

• 3 changed file(s) yielded no anchor (packages/core/test-typecheck-debt.json, packages/core/tsconfig.examples.json, packages/core/tsconfig.json) — pages documenting those are invisible to this run
• 4 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 24 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 09cc6be43414214b9abfc7791b8497ea4f9dd2fc → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 000a8b2396d77613e3506148fbad7b8072257e01 — the merge of head 86d7cc58b2615bf4cd0fe2de6a0c0856102f0336 into base 09cc6be43414214b9abfc7791b8497ea4f9dd2fc, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 000a8b2396d77613e3506148fbad7b8072257e01 && git checkout 000a8b2396d77613e3506148fbad7b8072257e01
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 09cc6be43414214b9abfc7791b8497ea4f9dd2fc 86d7cc58b2615bf4cd0fe2de6a0c0856102f0336 && git checkout -B drift-repro 09cc6be43414214b9abfc7791b8497ea4f9dd2fc && git merge --no-ff 86d7cc58b2615bf4cd0fe2de6a0c0856102f0336
node scripts/docs-audit/affected-docs.mjs --json 09cc6be43414214b9abfc7791b8497ea4f9dd2fc

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 09cc6be43414214b9abfc7791b8497ea4f9dd2fc → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-musk]

Fixes#14613

@objectstack/core declared exactly build, test, test:watch. turbo run typecheck selects only packages that declare the task, so the lint workflow's typecheck job could not reach this package, and pnpm --filter @objectstack/core typecheck failed with ERR_PNPM_RECURSIVE_RUN_NO_SCRIPT for anyone who tried it — which is how a dispatched task came to assume it existed.

The card asked for the count before any repair. Here it is.

Measured at 84b8190ae, dependency closure built first

program	files	errors
tsc --noEmit -p tsconfig.json (undivided — exactly as the DEBT entry measured it)	12 with errors	98
the same program over only the non-test sources	63	0
the 48 test files under vitest's own module semantics	48	4

98 reproduces the ledger to the unit, and the class breakdown matches it line for line: TS7006 x71, TS2835 x22, and one each of TS6133, TS2739, TS2352, TS2347, TS18046. All 12 files are .test.ts.

So the build layer graduated as it stood, and 94 of the 98 were the CHECK, not the code.

What landed

The split this repo already runs for spec, rest, objectql and client:

• tsconfig.json stays the BUILD config and now excludes the test layer.
• tsconfig.test.json (new) compiles that layer under module: esnext / moduleResolution: bundler — the semantics vitest actually executes it with. That retires 22 x TS2835, the TS2347 beside them, and the share of TS7006 they cascade into: an import that does not resolve makes every symbol it names any. Strictness is inherited and untouched, and no test file is edited.
• test-typecheck-debt.json (new) holds the residue of 4, per file and per signature, EXACT and shrink-only.
• scripts/check-type-check-coverage.mjs — the @objectstack/core DEBT entry is deleted, because RECONCILED makes a DEBT entry for a package that declares typecheck an error.

The 4 ledgered are left deliberately, and the ledger's authored _note says why. Two are one defect twice over (src/plugin-loader.test.ts, src/security/plugin-permission-enforcer.test.ts: a mock PluginContext missing registerServiceFactory / replaceService / getServiceScoped) — the same shape the @objectstack/metadata DEBT entry records, whose repair is in flight on its own card, so the shared fixture they want should be authored once by whoever closes that rather than twice in parallel.

The examples/ half — found by the new script, not by the card

Declaring typecheck flips the package from COVERED-BY-LEDGER to COVERED-BY-SCRIPT, and check:type-check-coverage's SOURCES_COVERED invariant then reported packages/core/examples: 2 non-test source files in no tsc program at all. Neither had ever compiled — kernel-features-example.ts imported ../index.js (above the package root, never existed) and phase2-integration.ts imported @objectstack/core, i.e. this package self-referencing by a name it declares in no dependency block.

Collapsing that cascade exposed errors rather than removing them, 12 to 29 — all real, none new:

• 20 reads of ObjectKernel's privatelogger;
• 4 members of the security-scan result that do not exist (passed, score, summary.critical, summary.high, where KernelSecurityScanResult carries status and per-severity counts);
• 2 config literals passing the unparsed shapes where PluginHealthMonitor.registerPlugin and HotReloadManager.registerPlugin are declared over the Parsed ones. That pair is retirement drift: this file was edited by two retirements (the PluginHealthCheck restart keys, and watchPatterns) while no tsc program could check the result.

Every correction is pinned to this package's own signatures — PluginPermissionSet off src/security/permission-manager.ts, the Parsed variants off src/health-monitor.ts / src/hot-reload.ts, the scan shape off the type tsc printed. packages/spec was not touched, and needed no change: the three types the example wanted are exported from @objectstack/spec/kernel, never from .../system, and this package's own source already imports them from kernel.

@objectstack/core therefore leaves the DEBT ledger: check:type-check-coverage now reads 70/79 type-checked with 9 ledgered, where it read 68/78 with 10.

Out of scope, reported not fixed

packages/core/examples/phase2-integration.ts is the sole composer of PluginSecurityScanner, which docs/qa/platform-checklist/FOLLOW-UPS.md already records as exported dead code on the public barrel with 3 of 5 scan methods empty stubs. When this directory was last found composing a retired surface, the repo deleted the example (api-registry-example.ts, #4939). Whether these two files should exist at all is a retirement decision for that seat; this PR only makes them compile, so the question is now visible to tsc instead of hidden from it.

Gates

Derived with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands and no path arguments, so the change set comes from the merge base rather than a hand-written list; harvested via --commands, not by grepping the prose. 49 families, all run at 27ecaa29e:

• 45 green in the light batch, plus check:dual-build-cjs-loads and check:type-check-debt green.
• pnpm --filter @objectstack/core typecheck — exit 0 (the script this card is about).
• check:type-check-debt — 20 ledger entr(ies) re-measured in 299.8s, 451 raw tsc error(s) total, none above its recorded number. surplus: none.
• node scripts/pm/check-governed-merges.mjs --test on the final 9-file list — NOT governed.
• 2 recorded NOT MEASURED, not red: check-test-completeness and check-half-states both exit 3 = PREREQUISITE NOT MET (a saved turbo run test log; GitHub API access). Neither is a finding, and both are unrelated to this diff.

⚠️ One local-only wrinkle worth naming: check:dual-build-cjs-loads first reported 2 findings against @objectstack/client and @objectstack/client-react. Both were artifacts of a cut-off local build (dist present, declarations not emitted); after building those two properly the gate is green over 102 entry points. Neither names @objectstack/core and this diff changes no exports map, no files, and no runtime source.

🤖 Generated with Claude Code

https://claude.ai/code/session_0112hMx9hjJ9BgB28X97DS68

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/core, touching 4 documentable anchor(s). ⚠️3 changed file(s) yielded no anchor (packages/core/test-typecheck-debt.json, packages/core/tsconfig.examples.json, packages/core/tsconfig.json), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/protocol/kernel/lifecycle.mdx(via installPlugin (symbol, a method of class EnterprisePluginPlatform))

What this run could not see

• 3 changed file(s) yielded no anchor (packages/core/test-typecheck-debt.json, packages/core/tsconfig.examples.json, packages/core/tsconfig.json) — pages documenting those are invisible to this run
• 4 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 24 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 09cc6be43414214b9abfc7791b8497ea4f9dd2fc → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 000a8b2396d77613e3506148fbad7b8072257e01 — the merge of head 86d7cc58b2615bf4cd0fe2de6a0c0856102f0336 into base 09cc6be43414214b9abfc7791b8497ea4f9dd2fc, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 000a8b2396d77613e3506148fbad7b8072257e01 && git checkout 000a8b2396d77613e3506148fbad7b8072257e01
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 09cc6be43414214b9abfc7791b8497ea4f9dd2fc 86d7cc58b2615bf4cd0fe2de6a0c0856102f0336 && git checkout -B drift-repro 09cc6be43414214b9abfc7791b8497ea4f9dd2fc && git merge --no-ff 86d7cc58b2615bf4cd0fe2de6a0c0856102f0336
node scripts/docs-audit/affected-docs.mjs --json 09cc6be43414214b9abfc7791b8497ea4f9dd2fc

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 09cc6be43414214b9abfc7791b8497ea4f9dd2fc → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-musk]

Fixes#14613

@objectstack/core declared exactly build, test, test:watch. turbo run typecheck selects only packages that declare the task, so the lint workflow's typecheck job could not reach this package, and pnpm --filter @objectstack/core typecheck failed with ERR_PNPM_RECURSIVE_RUN_NO_SCRIPT for anyone who tried it — which is how a dispatched task came to assume it existed.

The card asked for the count before any repair. Here it is.

Measured at 84b8190ae, dependency closure built first

program	files	errors
tsc --noEmit -p tsconfig.json (undivided — exactly as the DEBT entry measured it)	12 with errors	98
the same program over only the non-test sources	63	0
the 48 test files under vitest's own module semantics	48	4

98 reproduces the ledger to the unit, and the class breakdown matches it line for line: TS7006 x71, TS2835 x22, and one each of TS6133, TS2739, TS2352, TS2347, TS18046. All 12 files are .test.ts.

So the build layer graduated as it stood, and 94 of the 98 were the CHECK, not the code.

What landed

The split this repo already runs for spec, rest, objectql and client:

• tsconfig.json stays the BUILD config and now excludes the test layer.
• tsconfig.test.json (new) compiles that layer under module: esnext / moduleResolution: bundler — the semantics vitest actually executes it with. That retires 22 x TS2835, the TS2347 beside them, and the share of TS7006 they cascade into: an import that does not resolve makes every symbol it names any. Strictness is inherited and untouched, and no test file is edited.
• test-typecheck-debt.json (new) holds the residue of 4, per file and per signature, EXACT and shrink-only.
• scripts/check-type-check-coverage.mjs — the @objectstack/core DEBT entry is deleted, because RECONCILED makes a DEBT entry for a package that declares typecheck an error.

The 4 ledgered are left deliberately, and the ledger's authored _note says why. Two are one defect twice over (src/plugin-loader.test.ts, src/security/plugin-permission-enforcer.test.ts: a mock PluginContext missing registerServiceFactory / replaceService / getServiceScoped) — the same shape the @objectstack/metadata DEBT entry records, whose repair is in flight on its own card, so the shared fixture they want should be authored once by whoever closes that rather than twice in parallel.

The examples/ half — found by the new script, not by the card

Declaring typecheck flips the package from COVERED-BY-LEDGER to COVERED-BY-SCRIPT, and check:type-check-coverage's SOURCES_COVERED invariant then reported packages/core/examples: 2 non-test source files in no tsc program at all. Neither had ever compiled — kernel-features-example.ts imported ../index.js (above the package root, never existed) and phase2-integration.ts imported @objectstack/core, i.e. this package self-referencing by a name it declares in no dependency block.

Collapsing that cascade exposed errors rather than removing them, 12 to 29 — all real, none new:

• 20 reads of ObjectKernel's privatelogger;
• 4 members of the security-scan result that do not exist (passed, score, summary.critical, summary.high, where KernelSecurityScanResult carries status and per-severity counts);
• 2 config literals passing the unparsed shapes where PluginHealthMonitor.registerPlugin and HotReloadManager.registerPlugin are declared over the Parsed ones. That pair is retirement drift: this file was edited by two retirements (the PluginHealthCheck restart keys, and watchPatterns) while no tsc program could check the result.

Every correction is pinned to this package's own signatures — PluginPermissionSet off src/security/permission-manager.ts, the Parsed variants off src/health-monitor.ts / src/hot-reload.ts, the scan shape off the type tsc printed. packages/spec was not touched, and needed no change: the three types the example wanted are exported from @objectstack/spec/kernel, never from .../system, and this package's own source already imports them from kernel.

@objectstack/core therefore leaves the DEBT ledger: check:type-check-coverage now reads 70/79 type-checked with 9 ledgered, where it read 68/78 with 10.

Out of scope, reported not fixed

packages/core/examples/phase2-integration.ts is the sole composer of PluginSecurityScanner, which docs/qa/platform-checklist/FOLLOW-UPS.md already records as exported dead code on the public barrel with 3 of 5 scan methods empty stubs. When this directory was last found composing a retired surface, the repo deleted the example (api-registry-example.ts, #4939). Whether these two files should exist at all is a retirement decision for that seat; this PR only makes them compile, so the question is now visible to tsc instead of hidden from it.

Gates

Derived with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands and no path arguments, so the change set comes from the merge base rather than a hand-written list; harvested via --commands, not by grepping the prose. 49 families, all run at 27ecaa29e:

• 45 green in the light batch, plus check:dual-build-cjs-loads and check:type-check-debt green.
• pnpm --filter @objectstack/core typecheck — exit 0 (the script this card is about).
• check:type-check-debt — 20 ledger entr(ies) re-measured in 299.8s, 451 raw tsc error(s) total, none above its recorded number. surplus: none.
• node scripts/pm/check-governed-merges.mjs --test on the final 9-file list — NOT governed.
• 2 recorded NOT MEASURED, not red: check-test-completeness and check-half-states both exit 3 = PREREQUISITE NOT MET (a saved turbo run test log; GitHub API access). Neither is a finding, and both are unrelated to this diff.

⚠️ One local-only wrinkle worth naming: check:dual-build-cjs-loads first reported 2 findings against @objectstack/client and @objectstack/client-react. Both were artifacts of a cut-off local build (dist present, declarations not emitted); after building those two properly the gate is green over 102 entry points. Neither names @objectstack/core and this diff changes no exports map, no files, and no runtime source.

🤖 Generated with Claude Code

https://claude.ai/code/session_0112hMx9hjJ9BgB28X97DS68

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/core, touching 4 documentable anchor(s). ⚠️3 changed file(s) yielded no anchor (packages/core/test-typecheck-debt.json, packages/core/tsconfig.examples.json, packages/core/tsconfig.json), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/protocol/kernel/lifecycle.mdx(via installPlugin (symbol, a method of class EnterprisePluginPlatform))

What this run could not see

• 3 changed file(s) yielded no anchor (packages/core/test-typecheck-debt.json, packages/core/tsconfig.examples.json, packages/core/tsconfig.json) — pages documenting those are invisible to this run
• 4 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 24 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 09cc6be43414214b9abfc7791b8497ea4f9dd2fc → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 000a8b2396d77613e3506148fbad7b8072257e01 — the merge of head 86d7cc58b2615bf4cd0fe2de6a0c0856102f0336 into base 09cc6be43414214b9abfc7791b8497ea4f9dd2fc, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 000a8b2396d77613e3506148fbad7b8072257e01 && git checkout 000a8b2396d77613e3506148fbad7b8072257e01
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 09cc6be43414214b9abfc7791b8497ea4f9dd2fc 86d7cc58b2615bf4cd0fe2de6a0c0856102f0336 && git checkout -B drift-repro 09cc6be43414214b9abfc7791b8497ea4f9dd2fc && git merge --no-ff 86d7cc58b2615bf4cd0fe2de6a0c0856102f0336
node scripts/docs-audit/affected-docs.mjs --json 09cc6be43414214b9abfc7791b8497ea4f9dd2fc

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 09cc6be43414214b9abfc7791b8497ea4f9dd2fc → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-musk]

Fixes#14613

@objectstack/core declared exactly build, test, test:watch. turbo run typecheck selects only packages that declare the task, so the lint workflow's typecheck job could not reach this package, and pnpm --filter @objectstack/core typecheck failed with ERR_PNPM_RECURSIVE_RUN_NO_SCRIPT for anyone who tried it — which is how a dispatched task came to assume it existed.

The card asked for the count before any repair. Here it is.

Measured at 84b8190ae, dependency closure built first

program	files	errors
tsc --noEmit -p tsconfig.json (undivided — exactly as the DEBT entry measured it)	12 with errors	98
the same program over only the non-test sources	63	0
the 48 test files under vitest's own module semantics	48	4

98 reproduces the ledger to the unit, and the class breakdown matches it line for line: TS7006 x71, TS2835 x22, and one each of TS6133, TS2739, TS2352, TS2347, TS18046. All 12 files are .test.ts.

So the build layer graduated as it stood, and 94 of the 98 were the CHECK, not the code.

What landed

The split this repo already runs for spec, rest, objectql and client:

• tsconfig.json stays the BUILD config and now excludes the test layer.
• tsconfig.test.json (new) compiles that layer under module: esnext / moduleResolution: bundler — the semantics vitest actually executes it with. That retires 22 x TS2835, the TS2347 beside them, and the share of TS7006 they cascade into: an import that does not resolve makes every symbol it names any. Strictness is inherited and untouched, and no test file is edited.
• test-typecheck-debt.json (new) holds the residue of 4, per file and per signature, EXACT and shrink-only.
• scripts/check-type-check-coverage.mjs — the @objectstack/core DEBT entry is deleted, because RECONCILED makes a DEBT entry for a package that declares typecheck an error.

The 4 ledgered are left deliberately, and the ledger's authored _note says why. Two are one defect twice over (src/plugin-loader.test.ts, src/security/plugin-permission-enforcer.test.ts: a mock PluginContext missing registerServiceFactory / replaceService / getServiceScoped) — the same shape the @objectstack/metadata DEBT entry records, whose repair is in flight on its own card, so the shared fixture they want should be authored once by whoever closes that rather than twice in parallel.

The examples/ half — found by the new script, not by the card

Declaring typecheck flips the package from COVERED-BY-LEDGER to COVERED-BY-SCRIPT, and check:type-check-coverage's SOURCES_COVERED invariant then reported packages/core/examples: 2 non-test source files in no tsc program at all. Neither had ever compiled — kernel-features-example.ts imported ../index.js (above the package root, never existed) and phase2-integration.ts imported @objectstack/core, i.e. this package self-referencing by a name it declares in no dependency block.

Collapsing that cascade exposed errors rather than removing them, 12 to 29 — all real, none new:

• 20 reads of ObjectKernel's privatelogger;
• 4 members of the security-scan result that do not exist (passed, score, summary.critical, summary.high, where KernelSecurityScanResult carries status and per-severity counts);
• 2 config literals passing the unparsed shapes where PluginHealthMonitor.registerPlugin and HotReloadManager.registerPlugin are declared over the Parsed ones. That pair is retirement drift: this file was edited by two retirements (the PluginHealthCheck restart keys, and watchPatterns) while no tsc program could check the result.

Every correction is pinned to this package's own signatures — PluginPermissionSet off src/security/permission-manager.ts, the Parsed variants off src/health-monitor.ts / src/hot-reload.ts, the scan shape off the type tsc printed. packages/spec was not touched, and needed no change: the three types the example wanted are exported from @objectstack/spec/kernel, never from .../system, and this package's own source already imports them from kernel.

@objectstack/core therefore leaves the DEBT ledger: check:type-check-coverage now reads 70/79 type-checked with 9 ledgered, where it read 68/78 with 10.

Out of scope, reported not fixed

packages/core/examples/phase2-integration.ts is the sole composer of PluginSecurityScanner, which docs/qa/platform-checklist/FOLLOW-UPS.md already records as exported dead code on the public barrel with 3 of 5 scan methods empty stubs. When this directory was last found composing a retired surface, the repo deleted the example (api-registry-example.ts, #4939). Whether these two files should exist at all is a retirement decision for that seat; this PR only makes them compile, so the question is now visible to tsc instead of hidden from it.

Gates

Derived with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands and no path arguments, so the change set comes from the merge base rather than a hand-written list; harvested via --commands, not by grepping the prose. 49 families, all run at 27ecaa29e:

• 45 green in the light batch, plus check:dual-build-cjs-loads and check:type-check-debt green.
• pnpm --filter @objectstack/core typecheck — exit 0 (the script this card is about).
• check:type-check-debt — 20 ledger entr(ies) re-measured in 299.8s, 451 raw tsc error(s) total, none above its recorded number. surplus: none.
• node scripts/pm/check-governed-merges.mjs --test on the final 9-file list — NOT governed.
• 2 recorded NOT MEASURED, not red: check-test-completeness and check-half-states both exit 3 = PREREQUISITE NOT MET (a saved turbo run test log; GitHub API access). Neither is a finding, and both are unrelated to this diff.

⚠️ One local-only wrinkle worth naming: check:dual-build-cjs-loads first reported 2 findings against @objectstack/client and @objectstack/client-react. Both were artifacts of a cut-off local build (dist present, declarations not emitted); after building those two properly the gate is green over 102 entry points. Neither names @objectstack/core and this diff changes no exports map, no files, and no runtime source.

🤖 Generated with Claude Code

https://claude.ai/code/session_0112hMx9hjJ9BgB28X97DS68

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/core, touching 4 documentable anchor(s). ⚠️3 changed file(s) yielded no anchor (packages/core/test-typecheck-debt.json, packages/core/tsconfig.examples.json, packages/core/tsconfig.json), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/protocol/kernel/lifecycle.mdx(via installPlugin (symbol, a method of class EnterprisePluginPlatform))

What this run could not see

• 3 changed file(s) yielded no anchor (packages/core/test-typecheck-debt.json, packages/core/tsconfig.examples.json, packages/core/tsconfig.json) — pages documenting those are invisible to this run
• 4 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 24 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 09cc6be43414214b9abfc7791b8497ea4f9dd2fc → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 000a8b2396d77613e3506148fbad7b8072257e01 — the merge of head 86d7cc58b2615bf4cd0fe2de6a0c0856102f0336 into base 09cc6be43414214b9abfc7791b8497ea4f9dd2fc, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 000a8b2396d77613e3506148fbad7b8072257e01 && git checkout 000a8b2396d77613e3506148fbad7b8072257e01
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 09cc6be43414214b9abfc7791b8497ea4f9dd2fc 86d7cc58b2615bf4cd0fe2de6a0c0856102f0336 && git checkout -B drift-repro 09cc6be43414214b9abfc7791b8497ea4f9dd2fc && git merge --no-ff 86d7cc58b2615bf4cd0fe2de6a0c0856102f0336
node scripts/docs-audit/affected-docs.mjs --json 09cc6be43414214b9abfc7791b8497ea4f9dd2fc

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 09cc6be43414214b9abfc7791b8497ea4f9dd2fc → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-musk]

Fixes#14613

@objectstack/core declared exactly build, test, test:watch. turbo run typecheck selects only packages that declare the task, so the lint workflow's typecheck job could not reach this package, and pnpm --filter @objectstack/core typecheck failed with ERR_PNPM_RECURSIVE_RUN_NO_SCRIPT for anyone who tried it — which is how a dispatched task came to assume it existed.

The card asked for the count before any repair. Here it is.

Measured at 84b8190ae, dependency closure built first

program	files	errors
tsc --noEmit -p tsconfig.json (undivided — exactly as the DEBT entry measured it)	12 with errors	98
the same program over only the non-test sources	63	0
the 48 test files under vitest's own module semantics	48	4

98 reproduces the ledger to the unit, and the class breakdown matches it line for line: TS7006 x71, TS2835 x22, and one each of TS6133, TS2739, TS2352, TS2347, TS18046. All 12 files are .test.ts.

So the build layer graduated as it stood, and 94 of the 98 were the CHECK, not the code.

What landed

The split this repo already runs for spec, rest, objectql and client:

• tsconfig.json stays the BUILD config and now excludes the test layer.
• tsconfig.test.json (new) compiles that layer under module: esnext / moduleResolution: bundler — the semantics vitest actually executes it with. That retires 22 x TS2835, the TS2347 beside them, and the share of TS7006 they cascade into: an import that does not resolve makes every symbol it names any. Strictness is inherited and untouched, and no test file is edited.
• test-typecheck-debt.json (new) holds the residue of 4, per file and per signature, EXACT and shrink-only.
• scripts/check-type-check-coverage.mjs — the @objectstack/core DEBT entry is deleted, because RECONCILED makes a DEBT entry for a package that declares typecheck an error.

The 4 ledgered are left deliberately, and the ledger's authored _note says why. Two are one defect twice over (src/plugin-loader.test.ts, src/security/plugin-permission-enforcer.test.ts: a mock PluginContext missing registerServiceFactory / replaceService / getServiceScoped) — the same shape the @objectstack/metadata DEBT entry records, whose repair is in flight on its own card, so the shared fixture they want should be authored once by whoever closes that rather than twice in parallel.

The examples/ half — found by the new script, not by the card

Declaring typecheck flips the package from COVERED-BY-LEDGER to COVERED-BY-SCRIPT, and check:type-check-coverage's SOURCES_COVERED invariant then reported packages/core/examples: 2 non-test source files in no tsc program at all. Neither had ever compiled — kernel-features-example.ts imported ../index.js (above the package root, never existed) and phase2-integration.ts imported @objectstack/core, i.e. this package self-referencing by a name it declares in no dependency block.

Collapsing that cascade exposed errors rather than removing them, 12 to 29 — all real, none new:

• 20 reads of ObjectKernel's privatelogger;
• 4 members of the security-scan result that do not exist (passed, score, summary.critical, summary.high, where KernelSecurityScanResult carries status and per-severity counts);
• 2 config literals passing the unparsed shapes where PluginHealthMonitor.registerPlugin and HotReloadManager.registerPlugin are declared over the Parsed ones. That pair is retirement drift: this file was edited by two retirements (the PluginHealthCheck restart keys, and watchPatterns) while no tsc program could check the result.

Every correction is pinned to this package's own signatures — PluginPermissionSet off src/security/permission-manager.ts, the Parsed variants off src/health-monitor.ts / src/hot-reload.ts, the scan shape off the type tsc printed. packages/spec was not touched, and needed no change: the three types the example wanted are exported from @objectstack/spec/kernel, never from .../system, and this package's own source already imports them from kernel.

@objectstack/core therefore leaves the DEBT ledger: check:type-check-coverage now reads 70/79 type-checked with 9 ledgered, where it read 68/78 with 10.

Out of scope, reported not fixed

packages/core/examples/phase2-integration.ts is the sole composer of PluginSecurityScanner, which docs/qa/platform-checklist/FOLLOW-UPS.md already records as exported dead code on the public barrel with 3 of 5 scan methods empty stubs. When this directory was last found composing a retired surface, the repo deleted the example (api-registry-example.ts, #4939). Whether these two files should exist at all is a retirement decision for that seat; this PR only makes them compile, so the question is now visible to tsc instead of hidden from it.

Gates

Derived with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands and no path arguments, so the change set comes from the merge base rather than a hand-written list; harvested via --commands, not by grepping the prose. 49 families, all run at 27ecaa29e:

• 45 green in the light batch, plus check:dual-build-cjs-loads and check:type-check-debt green.
• pnpm --filter @objectstack/core typecheck — exit 0 (the script this card is about).
• check:type-check-debt — 20 ledger entr(ies) re-measured in 299.8s, 451 raw tsc error(s) total, none above its recorded number. surplus: none.
• node scripts/pm/check-governed-merges.mjs --test on the final 9-file list — NOT governed.
• 2 recorded NOT MEASURED, not red: check-test-completeness and check-half-states both exit 3 = PREREQUISITE NOT MET (a saved turbo run test log; GitHub API access). Neither is a finding, and both are unrelated to this diff.

⚠️ One local-only wrinkle worth naming: check:dual-build-cjs-loads first reported 2 findings against @objectstack/client and @objectstack/client-react. Both were artifacts of a cut-off local build (dist present, declarations not emitted); after building those two properly the gate is green over 102 entry points. Neither names @objectstack/core and this diff changes no exports map, no files, and no runtime source.

🤖 Generated with Claude Code

https://claude.ai/code/session_0112hMx9hjJ9BgB28X97DS68

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/core, touching 4 documentable anchor(s). ⚠️3 changed file(s) yielded no anchor (packages/core/test-typecheck-debt.json, packages/core/tsconfig.examples.json, packages/core/tsconfig.json), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/protocol/kernel/lifecycle.mdx(via installPlugin (symbol, a method of class EnterprisePluginPlatform))

What this run could not see

• 3 changed file(s) yielded no anchor (packages/core/test-typecheck-debt.json, packages/core/tsconfig.examples.json, packages/core/tsconfig.json) — pages documenting those are invisible to this run
• 4 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 24 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 09cc6be43414214b9abfc7791b8497ea4f9dd2fc → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 000a8b2396d77613e3506148fbad7b8072257e01 — the merge of head 86d7cc58b2615bf4cd0fe2de6a0c0856102f0336 into base 09cc6be43414214b9abfc7791b8497ea4f9dd2fc, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 000a8b2396d77613e3506148fbad7b8072257e01 && git checkout 000a8b2396d77613e3506148fbad7b8072257e01
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 09cc6be43414214b9abfc7791b8497ea4f9dd2fc 86d7cc58b2615bf4cd0fe2de6a0c0856102f0336 && git checkout -B drift-repro 09cc6be43414214b9abfc7791b8497ea4f9dd2fc && git merge --no-ff 86d7cc58b2615bf4cd0fe2de6a0c0856102f0336
node scripts/docs-audit/affected-docs.mjs --json 09cc6be43414214b9abfc7791b8497ea4f9dd2fc

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 09cc6be43414214b9abfc7791b8497ea4f9dd2fc → pass the list as
args.docs, on the commit named under Which tree this was computed on.