fix(service-storage): put the test layer in front of tsc, and repair what it was hiding

[os-sales]

Fixes#15050

packages/services/service-storage had no typecheck script at all (its scripts were build and test), so no tsc program anywhere read this package's test layer. Turbo/CI typecheck lanes skipped it silently, because a zero-matching filter run exits 0. tsup transpiles with esbuild and vitest runs through esbuild type-stripping; neither type-checks.

Clause-②: no — this is the checked-test-zone mechanism (#14062/#14181) applied one package over; it touches no spec/API contract surface, only this package's own test files, tsc configs and the two shared ledger scripts the ratchet already routes graduations through.

The route, and which exemplar it was copied from

Copied from plugin-webhooks / service-cluster (#14181, PR #15032 — read before starting), not from plugin-auth / plugin-sharing / core, because it is the structural match. The deciding property is what the BUILD config does with tests:

package	tsconfig.json excludes tests?	fits here
plugin-auth, plugin-sharing, core	yes	no
plugin-webhooks, service-cluster, service-storage	no	yes

service-storage's tsconfig.json includes the tests and always did, so the program that would have read them already existed and was simply never invoked. tsconfig.json is therefore untouched; the sibling tsconfig.test.json is the family's uniform instrument over the same files (module semantics only — esnext/bundler/lib: ES2022; strictness inherited, no paths).

A ninth file also needed the same treatment: scripts/i18n-extract.config.ts is the ninth instance #11351 onboarded for the other 8 packages that carry one — deliberately left out of that ledger before now, because SOURCES_COVERED only asks its question of a package that declares typecheck, and this one didn't. Giving it a typecheck script makes that question start firing here, so tsconfig.scripts.json (copied from packages/objectql's minimal shape) completes the family in the same PR rather than leaving a new gap the moment typecheck exists.

Measured error count, both ways, before and after

Dependency closure built first (pnpm --filter '@objectstack/service-storage^...' build; @objectstack/objectql's DTS worker had been truncated by an unrelated 10-minute foreground kill on the first attempt — see Findings — and was rebuilt before measuring):

program	before	after
BUILD semantics (tsc --noEmit -p tsconfig.json, already includes tests)	51 (matches the DEBT ledger's recorded 51 exactly)	0
test layer (tsc --noEmit -p tsconfig.test.json)	10	0

1102 files in the BUILD program / 1068 in the test program, covering all 35 of the package's src/**/*.test.ts. (Re-measured after the merge below with --listFiles: still 1102 / 1068 / 35, both programs still exit 0.)

Both readings agree at 0/0 — the same headline result service-cluster reported, reached by a longer road. Unlike that package, this one's BUILD reading was not already clean, so the 51→0 needed real repair on both legs, not just the test-only split:

• code-tier 8 (TS2339 × 4, TS2347 × 4) — genuine test-file defects, fixed in the tests (below).
• config-tier 26 (TS2835 × 23 relative-import extensions, TS2550 × 3 Array.prototype.at) — repaired, not routed around.
• noise 17 (TS7006 × 15, TS6196 × 1, TS6133 × 1).

The composition matches the DEBT entry's own note (code-tier 8 (TS2339 x4, TS2347 x4); config-tier 26 (TS2835 x23, TS2550 x3); noise 17 (TS7006 x15, TS6196, TS6133)) exactly — a positive control that the 51-measurement is reading the same thing the ledger already recorded.

The config-tier repair, and why it's a repair rather than a workaround

The 23 TS2835 are relative imports missing their .js extension, required under BUILD's NodeNext resolution but optional under the split's bundler resolution. The fix is to add the extension (./local-storage-adapter → ./local-storage-adapter.js), across 12 test files — this resolves correctly under both module modes, so it isn't a config-only accommodation, it's a real fix. Doing so also cleared all 15 TS7006 as a downstream cascade — the same shape @objectstack/core reported at 98 → 4 (#14916): an unresolved relative import makes every symbol it names any, and once the import resolves, the "implicitly any" errors disappear with it. Measured directly: 41 BUILD errors before the extension fix, 3 after (all TS2550).

The remaining 3 TS2550 (Array.prototype.at needing lib es2022) are rewritten to indexed access (arr[arr.length - 1]) in storage-adapter-list.conformance.test.ts rather than widening the shared BUILD tsconfig.json's lib — the narrower fix, and it leaves the BUILD config untouched.

The 8 code-tier errors, and why each fix is correct rather than convenient

• TS2339 × 4, file-reference-lifecycle.test.ts — the driveInsert test helper builds row by spreading a value typed Record of string keys to unknown values, plus id. TypeScript's object-spread inference drops the source's index signature when it has no known properties, so an un-annotated row infers as bare { id: string } and every per-key read off row is an error — even though the runtime shape genuinely carries the caller's fields. Reproduced in isolation (a 5-line repro) before touching the file. Fixed with an explicit annotation on row — the same Record shape intersected with { id: string } — which states the true type rather than widening anything.
• TS2347 × 4, storage-service-plugin.test.ts — a fake ctx: any's getService method (declared generic, one type parameter) becomes any-typed through the outer annotation, so calling it WITH an explicit type argument — ctx.getService('storage') spelled with the type argument inline, IStorageService — is invalid (TS can't verify a generic call through any). One call site in this same file had already hit this and left a comment documenting the fix: "Plain calls with casts, not the type-argument form — the fake ctx's getService is untyped, and each type-argument call adds a frozen-debt TS2347..." — the other three call sites just hadn't been converted yet. Converted all four to the cast form, ctx.getService('storage') as the target type, the pattern the file itself had already established.
• TS6196 × 1 — a genuinely dead StorageFileInfo import, invisible until a tsc program finally read the file. Removed.
• TS6133 × 1 — an unused destructured param in a .map() callback. Renamed to _r (the underscore-ignore convention already used elsewhere in this package's tests).

Ledger consequences

• DEBT['@objectstack/service-storage'] deleted, not lowered — errors: 51 is gone; the graduation note is recorded in check-type-check-coverage.mjs's own prose, per its convention. Post-merge figures: the gate now reads 53 raw errors across 4 packages, where main at 460134af8 reads 104 across 5. (The pre-merge body said 66/6 from 117/7; both siblings of this family have since landed and taken their own entries out, so those two pairs are stale and are replaced here.)
• No test-typecheck-debt.json created — residue is 0, so none is owed; opening one is maintainer-only (@ts-expect-error 退役 pin 在 packages/spec 里是幽灵检查:tsconfig 把 **/*.test.ts 排除出唯一的 tsc --noEmit #5286).
• UNCHECKED_SOURCE_DEBT's "ninth config" paragraph updated to record that scripts/i18n-extract.config.ts joined the other eight, measuring 0 errors under its new tsconfig.scripts.json, same as all eight siblings.

⚠️check:type-source-resolution — an onboarding re-baseline, please review it as one

This gate went red on my diff. Onboarding tsconfig.test.json + tsconfig.scripts.json moves the package's tsc PROGRAM SET, which the gate judges per program — its own doc-block opens an explicit onboarding limb for exactly this, on the same three terms #14181/PR #15032 used for service-cluster.

Term 1 — provenance, measured four ways on one checkout by varying only what typecheck names (--list). Re-measured on the post-merge tree (the two landed siblings moved every absolute here and none of the deltas), restoring package.json from HEAD between rows and proving the restore byte-identical:

typecheck names	entry	totals
nothing / tsconfig.json only	absent	121 programs / 302 pairs
tsconfig.test.json only	PRESENT	122 programs / 309 pairs
all three (this PR)	PRESENT	123 programs / 309 pairs

Rows 1–2 match origin/main @ 460134af8 measured on its own in a detached worktree (60 of 78 packages, 121 programs, 302 pairs, 18 clean).

Row 2 is load-bearing: BUILD carries zero dist-resolved workspace type imports, so the exposure is only reachable through the onboarded programs, not merely first seen there.

Term 2 — numbers: +1 package (60→61 of 78), +2 programs, +7 pairs — this entry and nothing else. The deltas are unchanged from the reviewed reading; only the absolutes moved (the pre-merge body said 58→59).

Term 3 — why the registry entry and not paths, measured both ways on the pre-merge checkout (temporary paths block added to tsconfig.test.json, tsc --noEmit -p run, then removed — never committed): redirecting all 7 deps to source takes this package's test layer from 0 errors to 306 (305 × TS6059 "not under rootDir" + 1 × TS6133), every TS6059 in another package's source (packages/types/src/**, packages/spec/src/**, packages/objectql/src/**, packages/observability/src/**, packages/drivers/driver-sql/src/**) — billed to a package that cannot pay it down. Same shape as #12570 (+5 for rest) and #8021 (247 TS6059), reproduced at larger scale on a package whose whole point here is reaching zero. This 306 was NOT re-measured after the merge — and it is not being claimed as unchangeable: main moved packages/spec/src/** and other trees the TS6059 land in, so the exact number could differ today. What the merge cannot flip is the direction the term rests on (a paths redirect bills hundreds of other packages' TS6059 to this one), and the committed tree contains no paths either way.

Gates

All figures in this section are the post-merge re-run, on head 2e8cbeed5 over merge base 460134af8 — not carried over from the pre-merge round. origin/main was merged into this branch (merge commit a58676160), never rebased; the conflict was in check-type-check-coverage.mjs only, and it resolved as "keep every entry" — all three graduation paragraphs kept, all three DEBT entries gone.

Derived with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands against the post-merge diff (20 paths vs merge base 460134af8).

66 command(s) — 36 pnpm, 30 direct node. All run, all 66 green.

The three that read exit 3 (PREREQUISITE NOT MET) in the pre-merge round — check:dual-build-cjs-loads, check:i18n, check:type-check-debt — plus the artifact-roster gate check:published-readme-exports that read exit 1 for the same missing-dist/ reason, were all re-run after building the whole workspace (turbo run build --filter './packages/*' --filter './packages/*/*', 71/71 successful) and all four are exit 0. check:type-check-debt re-measured 14 ledger entries in 147.9s, 153 raw tsc errors total, none above its recorded number.

check:type-check-coverage verdict on the merged tree: OK — 75/79 workspace packages type-checked (plus the root), 4 in the DEBT ledger (53 frozen raw errors), 1 exempt.check:type-source-resolution verdict: OK — 123 tsc program(s) across 78 packages scanned; 61 registered as still resolving a workspace dep's types through dist/.

Package-level, on the merged head: pnpm --filter @objectstack/service-storage typecheck — exit 0, all three legs (tsc --noEmit, tsc --noEmit -p tsconfig.scripts.json, check:test-typecheck) clean, 0 file(s) / 0 error(s) / 0 pinned signature(s). pnpm --filter @objectstack/service-storage exec vitest run — exit 0, 35 files / 536 tests passed, the same counts the pre-merge round recorded.

Both edited gate scripts (check-type-check-coverage.mjs, check-type-source-resolution.mjs) ran their own --self-test green on the merged tree.

pnpm-lock.yaml was not hand-merged: pnpm install over the merged manifest set leaves the auto-merged file byte-identical (git hash-object = 000bb7dfbcebaca6c6b92a26d9d970d464c3f6fd before and after), and pnpm install --frozen-lockfile exits 0.

Figures NOT re-measured after the merge, stated as such rather than implied: the before columns of the error table (51 BUILD / 10 test layer), their tier decomposition (8 / 26 / 17), the intermediate 41 → 3 extension-fix reading, and the 306-error paths measurement in Term 3. All four are readings of the pre-fix tree; the after column (0 / 0) is the live claim and it is re-measured above.

Findings (out of scope, reported)

• @objectstack/objectql's DTS worker was truncated by the ~10-minute foreground kill on the first pnpm --filter '@objectstack/service-storage^...' build attempt in a fresh worktree: dist/ had .js/.mjs but zero .d.ts files, check-dts-emitted.mjs never ran (the whole pnpm build recursive run was SIGTERM'd mid-flight), yet the dist/*.js files were already on disk. This produced 16 spurious TS7016 ("Could not find a declaration file for module '@objectstack/objectql'") errors in the first undivided measurement (73, not 51) — a false read that would have been invisible without the ledger's 51 as a positive control to notice the mismatch against. Not filed as a separate issue: it's a restatement of the platform-fact AGENTS.md already documents (front-of-process ~10-minute SIGTERM cap can land mid-build), not a new defect — rebuilding the one truncated package (pnpm --filter '@objectstack/objectql' build, ~17s for its DTS step alone) fixed it.

Declined, with reasons

• No paths rules added — measured at +306 TS6059 in other packages' source (above).
• No test skipped, disabled or quarantined; no program narrowed; no @ts-expect-error/@ts-ignore added; strict untouched; BUILD tsconfig.json's lib untouched (the 3 TS2550 sites were rewritten instead).
• packages/spec not touched (single-owner lane) — only read, to confirm PubSubHandler/IStorageService contracts were not implicated.
• No content/docs/releases edit.
• Nothing outside this card touched in the merge round — no edit to service-automation or service-knowledge, whose PRs have landed; the diff against main is the same 20 files it was when reviewed.

Changeset

.changeset/service-storage-test-tsc-program.md, patch on @objectstack/service-storage. No runtime code changed — src/** excluding tests is byte-identical — so no shipped behaviour moves; the level reflects the published package.json gaining typecheck/check:test-typecheck scripts and a tsx devDependency.

The merge-conflict round was carried out by a second Claude Code session, https://claude.ai/code/session_01XpTx2tbq3pZRYAdoGt6E6Y; the implementation round's session is named in the footer below.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

⚠️1 changed file(s) yielded no anchor (packages/services/service-storage/tsconfig.scripts.json), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files. Nothing else in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)).

What this run could not see

• 1 changed file(s) yielded no anchor (packages/services/service-storage/tsconfig.scripts.json) — pages documenting those are invisible to this run
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 6 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 460134af85f7ab2cf68abc62f1bbb9783b8899dd → packageMentionDocs.

[os-sales]

Fixes#15050

packages/services/service-storage had no typecheck script at all (its scripts were build and test), so no tsc program anywhere read this package's test layer. Turbo/CI typecheck lanes skipped it silently, because a zero-matching filter run exits 0. tsup transpiles with esbuild and vitest runs through esbuild type-stripping; neither type-checks.

Clause-②: no — this is the checked-test-zone mechanism (#14062/#14181) applied one package over; it touches no spec/API contract surface, only this package's own test files, tsc configs and the two shared ledger scripts the ratchet already routes graduations through.

The route, and which exemplar it was copied from

Copied from plugin-webhooks / service-cluster (#14181, PR #15032 — read before starting), not from plugin-auth / plugin-sharing / core, because it is the structural match. The deciding property is what the BUILD config does with tests:

package	tsconfig.json excludes tests?	fits here
plugin-auth, plugin-sharing, core	yes	no
plugin-webhooks, service-cluster, service-storage	no	yes

service-storage's tsconfig.json includes the tests and always did, so the program that would have read them already existed and was simply never invoked. tsconfig.json is therefore untouched; the sibling tsconfig.test.json is the family's uniform instrument over the same files (module semantics only — esnext/bundler/lib: ES2022; strictness inherited, no paths).

A ninth file also needed the same treatment: scripts/i18n-extract.config.ts is the ninth instance #11351 onboarded for the other 8 packages that carry one — deliberately left out of that ledger before now, because SOURCES_COVERED only asks its question of a package that declares typecheck, and this one didn't. Giving it a typecheck script makes that question start firing here, so tsconfig.scripts.json (copied from packages/objectql's minimal shape) completes the family in the same PR rather than leaving a new gap the moment typecheck exists.

Measured error count, both ways, before and after

Dependency closure built first (pnpm --filter '@objectstack/service-storage^...' build; @objectstack/objectql's DTS worker had been truncated by an unrelated 10-minute foreground kill on the first attempt — see Findings — and was rebuilt before measuring):

program	before	after
BUILD semantics (tsc --noEmit -p tsconfig.json, already includes tests)	51 (matches the DEBT ledger's recorded 51 exactly)	0
test layer (tsc --noEmit -p tsconfig.test.json)	10	0

1102 files in the BUILD program / 1068 in the test program, covering all 35 of the package's src/**/*.test.ts. (Re-measured after the merge below with --listFiles: still 1102 / 1068 / 35, both programs still exit 0.)

Both readings agree at 0/0 — the same headline result service-cluster reported, reached by a longer road. Unlike that package, this one's BUILD reading was not already clean, so the 51→0 needed real repair on both legs, not just the test-only split:

• code-tier 8 (TS2339 × 4, TS2347 × 4) — genuine test-file defects, fixed in the tests (below).
• config-tier 26 (TS2835 × 23 relative-import extensions, TS2550 × 3 Array.prototype.at) — repaired, not routed around.
• noise 17 (TS7006 × 15, TS6196 × 1, TS6133 × 1).

The composition matches the DEBT entry's own note (code-tier 8 (TS2339 x4, TS2347 x4); config-tier 26 (TS2835 x23, TS2550 x3); noise 17 (TS7006 x15, TS6196, TS6133)) exactly — a positive control that the 51-measurement is reading the same thing the ledger already recorded.

The config-tier repair, and why it's a repair rather than a workaround

The 23 TS2835 are relative imports missing their .js extension, required under BUILD's NodeNext resolution but optional under the split's bundler resolution. The fix is to add the extension (./local-storage-adapter → ./local-storage-adapter.js), across 12 test files — this resolves correctly under both module modes, so it isn't a config-only accommodation, it's a real fix. Doing so also cleared all 15 TS7006 as a downstream cascade — the same shape @objectstack/core reported at 98 → 4 (#14916): an unresolved relative import makes every symbol it names any, and once the import resolves, the "implicitly any" errors disappear with it. Measured directly: 41 BUILD errors before the extension fix, 3 after (all TS2550).

The remaining 3 TS2550 (Array.prototype.at needing lib es2022) are rewritten to indexed access (arr[arr.length - 1]) in storage-adapter-list.conformance.test.ts rather than widening the shared BUILD tsconfig.json's lib — the narrower fix, and it leaves the BUILD config untouched.

The 8 code-tier errors, and why each fix is correct rather than convenient

• TS2339 × 4, file-reference-lifecycle.test.ts — the driveInsert test helper builds row by spreading a value typed Record of string keys to unknown values, plus id. TypeScript's object-spread inference drops the source's index signature when it has no known properties, so an un-annotated row infers as bare { id: string } and every per-key read off row is an error — even though the runtime shape genuinely carries the caller's fields. Reproduced in isolation (a 5-line repro) before touching the file. Fixed with an explicit annotation on row — the same Record shape intersected with { id: string } — which states the true type rather than widening anything.
• TS2347 × 4, storage-service-plugin.test.ts — a fake ctx: any's getService method (declared generic, one type parameter) becomes any-typed through the outer annotation, so calling it WITH an explicit type argument — ctx.getService('storage') spelled with the type argument inline, IStorageService — is invalid (TS can't verify a generic call through any). One call site in this same file had already hit this and left a comment documenting the fix: "Plain calls with casts, not the type-argument form — the fake ctx's getService is untyped, and each type-argument call adds a frozen-debt TS2347..." — the other three call sites just hadn't been converted yet. Converted all four to the cast form, ctx.getService('storage') as the target type, the pattern the file itself had already established.
• TS6196 × 1 — a genuinely dead StorageFileInfo import, invisible until a tsc program finally read the file. Removed.
• TS6133 × 1 — an unused destructured param in a .map() callback. Renamed to _r (the underscore-ignore convention already used elsewhere in this package's tests).

Ledger consequences

• DEBT['@objectstack/service-storage'] deleted, not lowered — errors: 51 is gone; the graduation note is recorded in check-type-check-coverage.mjs's own prose, per its convention. Post-merge figures: the gate now reads 53 raw errors across 4 packages, where main at 460134af8 reads 104 across 5. (The pre-merge body said 66/6 from 117/7; both siblings of this family have since landed and taken their own entries out, so those two pairs are stale and are replaced here.)
• No test-typecheck-debt.json created — residue is 0, so none is owed; opening one is maintainer-only (@ts-expect-error 退役 pin 在 packages/spec 里是幽灵检查:tsconfig 把 **/*.test.ts 排除出唯一的 tsc --noEmit #5286).
• UNCHECKED_SOURCE_DEBT's "ninth config" paragraph updated to record that scripts/i18n-extract.config.ts joined the other eight, measuring 0 errors under its new tsconfig.scripts.json, same as all eight siblings.

⚠️check:type-source-resolution — an onboarding re-baseline, please review it as one

This gate went red on my diff. Onboarding tsconfig.test.json + tsconfig.scripts.json moves the package's tsc PROGRAM SET, which the gate judges per program — its own doc-block opens an explicit onboarding limb for exactly this, on the same three terms #14181/PR #15032 used for service-cluster.

Term 1 — provenance, measured four ways on one checkout by varying only what typecheck names (--list). Re-measured on the post-merge tree (the two landed siblings moved every absolute here and none of the deltas), restoring package.json from HEAD between rows and proving the restore byte-identical:

typecheck names	entry	totals
nothing / tsconfig.json only	absent	121 programs / 302 pairs
tsconfig.test.json only	PRESENT	122 programs / 309 pairs
all three (this PR)	PRESENT	123 programs / 309 pairs

Rows 1–2 match origin/main @ 460134af8 measured on its own in a detached worktree (60 of 78 packages, 121 programs, 302 pairs, 18 clean).

Row 2 is load-bearing: BUILD carries zero dist-resolved workspace type imports, so the exposure is only reachable through the onboarded programs, not merely first seen there.

Term 2 — numbers: +1 package (60→61 of 78), +2 programs, +7 pairs — this entry and nothing else. The deltas are unchanged from the reviewed reading; only the absolutes moved (the pre-merge body said 58→59).

Term 3 — why the registry entry and not paths, measured both ways on the pre-merge checkout (temporary paths block added to tsconfig.test.json, tsc --noEmit -p run, then removed — never committed): redirecting all 7 deps to source takes this package's test layer from 0 errors to 306 (305 × TS6059 "not under rootDir" + 1 × TS6133), every TS6059 in another package's source (packages/types/src/**, packages/spec/src/**, packages/objectql/src/**, packages/observability/src/**, packages/drivers/driver-sql/src/**) — billed to a package that cannot pay it down. Same shape as #12570 (+5 for rest) and #8021 (247 TS6059), reproduced at larger scale on a package whose whole point here is reaching zero. This 306 was NOT re-measured after the merge — and it is not being claimed as unchangeable: main moved packages/spec/src/** and other trees the TS6059 land in, so the exact number could differ today. What the merge cannot flip is the direction the term rests on (a paths redirect bills hundreds of other packages' TS6059 to this one), and the committed tree contains no paths either way.

Gates

All figures in this section are the post-merge re-run, on head 2e8cbeed5 over merge base 460134af8 — not carried over from the pre-merge round. origin/main was merged into this branch (merge commit a58676160), never rebased; the conflict was in check-type-check-coverage.mjs only, and it resolved as "keep every entry" — all three graduation paragraphs kept, all three DEBT entries gone.

Derived with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands against the post-merge diff (20 paths vs merge base 460134af8).

66 command(s) — 36 pnpm, 30 direct node. All run, all 66 green.

The three that read exit 3 (PREREQUISITE NOT MET) in the pre-merge round — check:dual-build-cjs-loads, check:i18n, check:type-check-debt — plus the artifact-roster gate check:published-readme-exports that read exit 1 for the same missing-dist/ reason, were all re-run after building the whole workspace (turbo run build --filter './packages/*' --filter './packages/*/*', 71/71 successful) and all four are exit 0. check:type-check-debt re-measured 14 ledger entries in 147.9s, 153 raw tsc errors total, none above its recorded number.

check:type-check-coverage verdict on the merged tree: OK — 75/79 workspace packages type-checked (plus the root), 4 in the DEBT ledger (53 frozen raw errors), 1 exempt.check:type-source-resolution verdict: OK — 123 tsc program(s) across 78 packages scanned; 61 registered as still resolving a workspace dep's types through dist/.

Package-level, on the merged head: pnpm --filter @objectstack/service-storage typecheck — exit 0, all three legs (tsc --noEmit, tsc --noEmit -p tsconfig.scripts.json, check:test-typecheck) clean, 0 file(s) / 0 error(s) / 0 pinned signature(s). pnpm --filter @objectstack/service-storage exec vitest run — exit 0, 35 files / 536 tests passed, the same counts the pre-merge round recorded.

Both edited gate scripts (check-type-check-coverage.mjs, check-type-source-resolution.mjs) ran their own --self-test green on the merged tree.

pnpm-lock.yaml was not hand-merged: pnpm install over the merged manifest set leaves the auto-merged file byte-identical (git hash-object = 000bb7dfbcebaca6c6b92a26d9d970d464c3f6fd before and after), and pnpm install --frozen-lockfile exits 0.

Figures NOT re-measured after the merge, stated as such rather than implied: the before columns of the error table (51 BUILD / 10 test layer), their tier decomposition (8 / 26 / 17), the intermediate 41 → 3 extension-fix reading, and the 306-error paths measurement in Term 3. All four are readings of the pre-fix tree; the after column (0 / 0) is the live claim and it is re-measured above.

Findings (out of scope, reported)

• @objectstack/objectql's DTS worker was truncated by the ~10-minute foreground kill on the first pnpm --filter '@objectstack/service-storage^...' build attempt in a fresh worktree: dist/ had .js/.mjs but zero .d.ts files, check-dts-emitted.mjs never ran (the whole pnpm build recursive run was SIGTERM'd mid-flight), yet the dist/*.js files were already on disk. This produced 16 spurious TS7016 ("Could not find a declaration file for module '@objectstack/objectql'") errors in the first undivided measurement (73, not 51) — a false read that would have been invisible without the ledger's 51 as a positive control to notice the mismatch against. Not filed as a separate issue: it's a restatement of the platform-fact AGENTS.md already documents (front-of-process ~10-minute SIGTERM cap can land mid-build), not a new defect — rebuilding the one truncated package (pnpm --filter '@objectstack/objectql' build, ~17s for its DTS step alone) fixed it.

Declined, with reasons

• No paths rules added — measured at +306 TS6059 in other packages' source (above).
• No test skipped, disabled or quarantined; no program narrowed; no @ts-expect-error/@ts-ignore added; strict untouched; BUILD tsconfig.json's lib untouched (the 3 TS2550 sites were rewritten instead).
• packages/spec not touched (single-owner lane) — only read, to confirm PubSubHandler/IStorageService contracts were not implicated.
• No content/docs/releases edit.
• Nothing outside this card touched in the merge round — no edit to service-automation or service-knowledge, whose PRs have landed; the diff against main is the same 20 files it was when reviewed.

Changeset

.changeset/service-storage-test-tsc-program.md, patch on @objectstack/service-storage. No runtime code changed — src/** excluding tests is byte-identical — so no shipped behaviour moves; the level reflects the published package.json gaining typecheck/check:test-typecheck scripts and a tsx devDependency.

The merge-conflict round was carried out by a second Claude Code session, https://claude.ai/code/session_01XpTx2tbq3pZRYAdoGt6E6Y; the implementation round's session is named in the footer below.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

⚠️1 changed file(s) yielded no anchor (packages/services/service-storage/tsconfig.scripts.json), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files. Nothing else in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)).

What this run could not see

• 1 changed file(s) yielded no anchor (packages/services/service-storage/tsconfig.scripts.json) — pages documenting those are invisible to this run
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 6 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 460134af85f7ab2cf68abc62f1bbb9783b8899dd → packageMentionDocs.

[os-sales]

Fixes#15050

packages/services/service-storage had no typecheck script at all (its scripts were build and test), so no tsc program anywhere read this package's test layer. Turbo/CI typecheck lanes skipped it silently, because a zero-matching filter run exits 0. tsup transpiles with esbuild and vitest runs through esbuild type-stripping; neither type-checks.

Clause-②: no — this is the checked-test-zone mechanism (#14062/#14181) applied one package over; it touches no spec/API contract surface, only this package's own test files, tsc configs and the two shared ledger scripts the ratchet already routes graduations through.

The route, and which exemplar it was copied from

Copied from plugin-webhooks / service-cluster (#14181, PR #15032 — read before starting), not from plugin-auth / plugin-sharing / core, because it is the structural match. The deciding property is what the BUILD config does with tests:

package	tsconfig.json excludes tests?	fits here
plugin-auth, plugin-sharing, core	yes	no
plugin-webhooks, service-cluster, service-storage	no	yes

service-storage's tsconfig.json includes the tests and always did, so the program that would have read them already existed and was simply never invoked. tsconfig.json is therefore untouched; the sibling tsconfig.test.json is the family's uniform instrument over the same files (module semantics only — esnext/bundler/lib: ES2022; strictness inherited, no paths).

A ninth file also needed the same treatment: scripts/i18n-extract.config.ts is the ninth instance #11351 onboarded for the other 8 packages that carry one — deliberately left out of that ledger before now, because SOURCES_COVERED only asks its question of a package that declares typecheck, and this one didn't. Giving it a typecheck script makes that question start firing here, so tsconfig.scripts.json (copied from packages/objectql's minimal shape) completes the family in the same PR rather than leaving a new gap the moment typecheck exists.

Measured error count, both ways, before and after

Dependency closure built first (pnpm --filter '@objectstack/service-storage^...' build; @objectstack/objectql's DTS worker had been truncated by an unrelated 10-minute foreground kill on the first attempt — see Findings — and was rebuilt before measuring):

program	before	after
BUILD semantics (tsc --noEmit -p tsconfig.json, already includes tests)	51 (matches the DEBT ledger's recorded 51 exactly)	0
test layer (tsc --noEmit -p tsconfig.test.json)	10	0

1102 files in the BUILD program / 1068 in the test program, covering all 35 of the package's src/**/*.test.ts. (Re-measured after the merge below with --listFiles: still 1102 / 1068 / 35, both programs still exit 0.)

Both readings agree at 0/0 — the same headline result service-cluster reported, reached by a longer road. Unlike that package, this one's BUILD reading was not already clean, so the 51→0 needed real repair on both legs, not just the test-only split:

• code-tier 8 (TS2339 × 4, TS2347 × 4) — genuine test-file defects, fixed in the tests (below).
• config-tier 26 (TS2835 × 23 relative-import extensions, TS2550 × 3 Array.prototype.at) — repaired, not routed around.
• noise 17 (TS7006 × 15, TS6196 × 1, TS6133 × 1).

The composition matches the DEBT entry's own note (code-tier 8 (TS2339 x4, TS2347 x4); config-tier 26 (TS2835 x23, TS2550 x3); noise 17 (TS7006 x15, TS6196, TS6133)) exactly — a positive control that the 51-measurement is reading the same thing the ledger already recorded.

The config-tier repair, and why it's a repair rather than a workaround

The 23 TS2835 are relative imports missing their .js extension, required under BUILD's NodeNext resolution but optional under the split's bundler resolution. The fix is to add the extension (./local-storage-adapter → ./local-storage-adapter.js), across 12 test files — this resolves correctly under both module modes, so it isn't a config-only accommodation, it's a real fix. Doing so also cleared all 15 TS7006 as a downstream cascade — the same shape @objectstack/core reported at 98 → 4 (#14916): an unresolved relative import makes every symbol it names any, and once the import resolves, the "implicitly any" errors disappear with it. Measured directly: 41 BUILD errors before the extension fix, 3 after (all TS2550).

The remaining 3 TS2550 (Array.prototype.at needing lib es2022) are rewritten to indexed access (arr[arr.length - 1]) in storage-adapter-list.conformance.test.ts rather than widening the shared BUILD tsconfig.json's lib — the narrower fix, and it leaves the BUILD config untouched.

The 8 code-tier errors, and why each fix is correct rather than convenient

• TS2339 × 4, file-reference-lifecycle.test.ts — the driveInsert test helper builds row by spreading a value typed Record of string keys to unknown values, plus id. TypeScript's object-spread inference drops the source's index signature when it has no known properties, so an un-annotated row infers as bare { id: string } and every per-key read off row is an error — even though the runtime shape genuinely carries the caller's fields. Reproduced in isolation (a 5-line repro) before touching the file. Fixed with an explicit annotation on row — the same Record shape intersected with { id: string } — which states the true type rather than widening anything.
• TS2347 × 4, storage-service-plugin.test.ts — a fake ctx: any's getService method (declared generic, one type parameter) becomes any-typed through the outer annotation, so calling it WITH an explicit type argument — ctx.getService('storage') spelled with the type argument inline, IStorageService — is invalid (TS can't verify a generic call through any). One call site in this same file had already hit this and left a comment documenting the fix: "Plain calls with casts, not the type-argument form — the fake ctx's getService is untyped, and each type-argument call adds a frozen-debt TS2347..." — the other three call sites just hadn't been converted yet. Converted all four to the cast form, ctx.getService('storage') as the target type, the pattern the file itself had already established.
• TS6196 × 1 — a genuinely dead StorageFileInfo import, invisible until a tsc program finally read the file. Removed.
• TS6133 × 1 — an unused destructured param in a .map() callback. Renamed to _r (the underscore-ignore convention already used elsewhere in this package's tests).

Ledger consequences

• DEBT['@objectstack/service-storage'] deleted, not lowered — errors: 51 is gone; the graduation note is recorded in check-type-check-coverage.mjs's own prose, per its convention. Post-merge figures: the gate now reads 53 raw errors across 4 packages, where main at 460134af8 reads 104 across 5. (The pre-merge body said 66/6 from 117/7; both siblings of this family have since landed and taken their own entries out, so those two pairs are stale and are replaced here.)
• No test-typecheck-debt.json created — residue is 0, so none is owed; opening one is maintainer-only (@ts-expect-error 退役 pin 在 packages/spec 里是幽灵检查:tsconfig 把 **/*.test.ts 排除出唯一的 tsc --noEmit #5286).
• UNCHECKED_SOURCE_DEBT's "ninth config" paragraph updated to record that scripts/i18n-extract.config.ts joined the other eight, measuring 0 errors under its new tsconfig.scripts.json, same as all eight siblings.

⚠️check:type-source-resolution — an onboarding re-baseline, please review it as one

This gate went red on my diff. Onboarding tsconfig.test.json + tsconfig.scripts.json moves the package's tsc PROGRAM SET, which the gate judges per program — its own doc-block opens an explicit onboarding limb for exactly this, on the same three terms #14181/PR #15032 used for service-cluster.

Term 1 — provenance, measured four ways on one checkout by varying only what typecheck names (--list). Re-measured on the post-merge tree (the two landed siblings moved every absolute here and none of the deltas), restoring package.json from HEAD between rows and proving the restore byte-identical:

typecheck names	entry	totals
nothing / tsconfig.json only	absent	121 programs / 302 pairs
tsconfig.test.json only	PRESENT	122 programs / 309 pairs
all three (this PR)	PRESENT	123 programs / 309 pairs

Rows 1–2 match origin/main @ 460134af8 measured on its own in a detached worktree (60 of 78 packages, 121 programs, 302 pairs, 18 clean).

Row 2 is load-bearing: BUILD carries zero dist-resolved workspace type imports, so the exposure is only reachable through the onboarded programs, not merely first seen there.

Term 2 — numbers: +1 package (60→61 of 78), +2 programs, +7 pairs — this entry and nothing else. The deltas are unchanged from the reviewed reading; only the absolutes moved (the pre-merge body said 58→59).

Term 3 — why the registry entry and not paths, measured both ways on the pre-merge checkout (temporary paths block added to tsconfig.test.json, tsc --noEmit -p run, then removed — never committed): redirecting all 7 deps to source takes this package's test layer from 0 errors to 306 (305 × TS6059 "not under rootDir" + 1 × TS6133), every TS6059 in another package's source (packages/types/src/**, packages/spec/src/**, packages/objectql/src/**, packages/observability/src/**, packages/drivers/driver-sql/src/**) — billed to a package that cannot pay it down. Same shape as #12570 (+5 for rest) and #8021 (247 TS6059), reproduced at larger scale on a package whose whole point here is reaching zero. This 306 was NOT re-measured after the merge — and it is not being claimed as unchangeable: main moved packages/spec/src/** and other trees the TS6059 land in, so the exact number could differ today. What the merge cannot flip is the direction the term rests on (a paths redirect bills hundreds of other packages' TS6059 to this one), and the committed tree contains no paths either way.

Gates

All figures in this section are the post-merge re-run, on head 2e8cbeed5 over merge base 460134af8 — not carried over from the pre-merge round. origin/main was merged into this branch (merge commit a58676160), never rebased; the conflict was in check-type-check-coverage.mjs only, and it resolved as "keep every entry" — all three graduation paragraphs kept, all three DEBT entries gone.

Derived with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands against the post-merge diff (20 paths vs merge base 460134af8).

66 command(s) — 36 pnpm, 30 direct node. All run, all 66 green.

The three that read exit 3 (PREREQUISITE NOT MET) in the pre-merge round — check:dual-build-cjs-loads, check:i18n, check:type-check-debt — plus the artifact-roster gate check:published-readme-exports that read exit 1 for the same missing-dist/ reason, were all re-run after building the whole workspace (turbo run build --filter './packages/*' --filter './packages/*/*', 71/71 successful) and all four are exit 0. check:type-check-debt re-measured 14 ledger entries in 147.9s, 153 raw tsc errors total, none above its recorded number.

check:type-check-coverage verdict on the merged tree: OK — 75/79 workspace packages type-checked (plus the root), 4 in the DEBT ledger (53 frozen raw errors), 1 exempt.check:type-source-resolution verdict: OK — 123 tsc program(s) across 78 packages scanned; 61 registered as still resolving a workspace dep's types through dist/.

Package-level, on the merged head: pnpm --filter @objectstack/service-storage typecheck — exit 0, all three legs (tsc --noEmit, tsc --noEmit -p tsconfig.scripts.json, check:test-typecheck) clean, 0 file(s) / 0 error(s) / 0 pinned signature(s). pnpm --filter @objectstack/service-storage exec vitest run — exit 0, 35 files / 536 tests passed, the same counts the pre-merge round recorded.

Both edited gate scripts (check-type-check-coverage.mjs, check-type-source-resolution.mjs) ran their own --self-test green on the merged tree.

pnpm-lock.yaml was not hand-merged: pnpm install over the merged manifest set leaves the auto-merged file byte-identical (git hash-object = 000bb7dfbcebaca6c6b92a26d9d970d464c3f6fd before and after), and pnpm install --frozen-lockfile exits 0.

Figures NOT re-measured after the merge, stated as such rather than implied: the before columns of the error table (51 BUILD / 10 test layer), their tier decomposition (8 / 26 / 17), the intermediate 41 → 3 extension-fix reading, and the 306-error paths measurement in Term 3. All four are readings of the pre-fix tree; the after column (0 / 0) is the live claim and it is re-measured above.

Findings (out of scope, reported)

• @objectstack/objectql's DTS worker was truncated by the ~10-minute foreground kill on the first pnpm --filter '@objectstack/service-storage^...' build attempt in a fresh worktree: dist/ had .js/.mjs but zero .d.ts files, check-dts-emitted.mjs never ran (the whole pnpm build recursive run was SIGTERM'd mid-flight), yet the dist/*.js files were already on disk. This produced 16 spurious TS7016 ("Could not find a declaration file for module '@objectstack/objectql'") errors in the first undivided measurement (73, not 51) — a false read that would have been invisible without the ledger's 51 as a positive control to notice the mismatch against. Not filed as a separate issue: it's a restatement of the platform-fact AGENTS.md already documents (front-of-process ~10-minute SIGTERM cap can land mid-build), not a new defect — rebuilding the one truncated package (pnpm --filter '@objectstack/objectql' build, ~17s for its DTS step alone) fixed it.

Declined, with reasons

• No paths rules added — measured at +306 TS6059 in other packages' source (above).
• No test skipped, disabled or quarantined; no program narrowed; no @ts-expect-error/@ts-ignore added; strict untouched; BUILD tsconfig.json's lib untouched (the 3 TS2550 sites were rewritten instead).
• packages/spec not touched (single-owner lane) — only read, to confirm PubSubHandler/IStorageService contracts were not implicated.
• No content/docs/releases edit.
• Nothing outside this card touched in the merge round — no edit to service-automation or service-knowledge, whose PRs have landed; the diff against main is the same 20 files it was when reviewed.

Changeset

.changeset/service-storage-test-tsc-program.md, patch on @objectstack/service-storage. No runtime code changed — src/** excluding tests is byte-identical — so no shipped behaviour moves; the level reflects the published package.json gaining typecheck/check:test-typecheck scripts and a tsx devDependency.

The merge-conflict round was carried out by a second Claude Code session, https://claude.ai/code/session_01XpTx2tbq3pZRYAdoGt6E6Y; the implementation round's session is named in the footer below.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

⚠️1 changed file(s) yielded no anchor (packages/services/service-storage/tsconfig.scripts.json), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files. Nothing else in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)).

What this run could not see

• 1 changed file(s) yielded no anchor (packages/services/service-storage/tsconfig.scripts.json) — pages documenting those are invisible to this run
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 6 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 460134af85f7ab2cf68abc62f1bbb9783b8899dd → packageMentionDocs.

[os-sales]

Fixes#15050

packages/services/service-storage had no typecheck script at all (its scripts were build and test), so no tsc program anywhere read this package's test layer. Turbo/CI typecheck lanes skipped it silently, because a zero-matching filter run exits 0. tsup transpiles with esbuild and vitest runs through esbuild type-stripping; neither type-checks.

Clause-②: no — this is the checked-test-zone mechanism (#14062/#14181) applied one package over; it touches no spec/API contract surface, only this package's own test files, tsc configs and the two shared ledger scripts the ratchet already routes graduations through.

The route, and which exemplar it was copied from

Copied from plugin-webhooks / service-cluster (#14181, PR #15032 — read before starting), not from plugin-auth / plugin-sharing / core, because it is the structural match. The deciding property is what the BUILD config does with tests:

package	tsconfig.json excludes tests?	fits here
plugin-auth, plugin-sharing, core	yes	no
plugin-webhooks, service-cluster, service-storage	no	yes

service-storage's tsconfig.json includes the tests and always did, so the program that would have read them already existed and was simply never invoked. tsconfig.json is therefore untouched; the sibling tsconfig.test.json is the family's uniform instrument over the same files (module semantics only — esnext/bundler/lib: ES2022; strictness inherited, no paths).

A ninth file also needed the same treatment: scripts/i18n-extract.config.ts is the ninth instance #11351 onboarded for the other 8 packages that carry one — deliberately left out of that ledger before now, because SOURCES_COVERED only asks its question of a package that declares typecheck, and this one didn't. Giving it a typecheck script makes that question start firing here, so tsconfig.scripts.json (copied from packages/objectql's minimal shape) completes the family in the same PR rather than leaving a new gap the moment typecheck exists.

Measured error count, both ways, before and after

Dependency closure built first (pnpm --filter '@objectstack/service-storage^...' build; @objectstack/objectql's DTS worker had been truncated by an unrelated 10-minute foreground kill on the first attempt — see Findings — and was rebuilt before measuring):

program	before	after
BUILD semantics (tsc --noEmit -p tsconfig.json, already includes tests)	51 (matches the DEBT ledger's recorded 51 exactly)	0
test layer (tsc --noEmit -p tsconfig.test.json)	10	0

1102 files in the BUILD program / 1068 in the test program, covering all 35 of the package's src/**/*.test.ts. (Re-measured after the merge below with --listFiles: still 1102 / 1068 / 35, both programs still exit 0.)

Both readings agree at 0/0 — the same headline result service-cluster reported, reached by a longer road. Unlike that package, this one's BUILD reading was not already clean, so the 51→0 needed real repair on both legs, not just the test-only split:

• code-tier 8 (TS2339 × 4, TS2347 × 4) — genuine test-file defects, fixed in the tests (below).
• config-tier 26 (TS2835 × 23 relative-import extensions, TS2550 × 3 Array.prototype.at) — repaired, not routed around.
• noise 17 (TS7006 × 15, TS6196 × 1, TS6133 × 1).

The composition matches the DEBT entry's own note (code-tier 8 (TS2339 x4, TS2347 x4); config-tier 26 (TS2835 x23, TS2550 x3); noise 17 (TS7006 x15, TS6196, TS6133)) exactly — a positive control that the 51-measurement is reading the same thing the ledger already recorded.

The config-tier repair, and why it's a repair rather than a workaround

The 23 TS2835 are relative imports missing their .js extension, required under BUILD's NodeNext resolution but optional under the split's bundler resolution. The fix is to add the extension (./local-storage-adapter → ./local-storage-adapter.js), across 12 test files — this resolves correctly under both module modes, so it isn't a config-only accommodation, it's a real fix. Doing so also cleared all 15 TS7006 as a downstream cascade — the same shape @objectstack/core reported at 98 → 4 (#14916): an unresolved relative import makes every symbol it names any, and once the import resolves, the "implicitly any" errors disappear with it. Measured directly: 41 BUILD errors before the extension fix, 3 after (all TS2550).

The remaining 3 TS2550 (Array.prototype.at needing lib es2022) are rewritten to indexed access (arr[arr.length - 1]) in storage-adapter-list.conformance.test.ts rather than widening the shared BUILD tsconfig.json's lib — the narrower fix, and it leaves the BUILD config untouched.

The 8 code-tier errors, and why each fix is correct rather than convenient

• TS2339 × 4, file-reference-lifecycle.test.ts — the driveInsert test helper builds row by spreading a value typed Record of string keys to unknown values, plus id. TypeScript's object-spread inference drops the source's index signature when it has no known properties, so an un-annotated row infers as bare { id: string } and every per-key read off row is an error — even though the runtime shape genuinely carries the caller's fields. Reproduced in isolation (a 5-line repro) before touching the file. Fixed with an explicit annotation on row — the same Record shape intersected with { id: string } — which states the true type rather than widening anything.
• TS2347 × 4, storage-service-plugin.test.ts — a fake ctx: any's getService method (declared generic, one type parameter) becomes any-typed through the outer annotation, so calling it WITH an explicit type argument — ctx.getService('storage') spelled with the type argument inline, IStorageService — is invalid (TS can't verify a generic call through any). One call site in this same file had already hit this and left a comment documenting the fix: "Plain calls with casts, not the type-argument form — the fake ctx's getService is untyped, and each type-argument call adds a frozen-debt TS2347..." — the other three call sites just hadn't been converted yet. Converted all four to the cast form, ctx.getService('storage') as the target type, the pattern the file itself had already established.
• TS6196 × 1 — a genuinely dead StorageFileInfo import, invisible until a tsc program finally read the file. Removed.
• TS6133 × 1 — an unused destructured param in a .map() callback. Renamed to _r (the underscore-ignore convention already used elsewhere in this package's tests).

Ledger consequences

• DEBT['@objectstack/service-storage'] deleted, not lowered — errors: 51 is gone; the graduation note is recorded in check-type-check-coverage.mjs's own prose, per its convention. Post-merge figures: the gate now reads 53 raw errors across 4 packages, where main at 460134af8 reads 104 across 5. (The pre-merge body said 66/6 from 117/7; both siblings of this family have since landed and taken their own entries out, so those two pairs are stale and are replaced here.)
• No test-typecheck-debt.json created — residue is 0, so none is owed; opening one is maintainer-only (@ts-expect-error 退役 pin 在 packages/spec 里是幽灵检查:tsconfig 把 **/*.test.ts 排除出唯一的 tsc --noEmit #5286).
• UNCHECKED_SOURCE_DEBT's "ninth config" paragraph updated to record that scripts/i18n-extract.config.ts joined the other eight, measuring 0 errors under its new tsconfig.scripts.json, same as all eight siblings.

⚠️check:type-source-resolution — an onboarding re-baseline, please review it as one

This gate went red on my diff. Onboarding tsconfig.test.json + tsconfig.scripts.json moves the package's tsc PROGRAM SET, which the gate judges per program — its own doc-block opens an explicit onboarding limb for exactly this, on the same three terms #14181/PR #15032 used for service-cluster.

Term 1 — provenance, measured four ways on one checkout by varying only what typecheck names (--list). Re-measured on the post-merge tree (the two landed siblings moved every absolute here and none of the deltas), restoring package.json from HEAD between rows and proving the restore byte-identical:

typecheck names	entry	totals
nothing / tsconfig.json only	absent	121 programs / 302 pairs
tsconfig.test.json only	PRESENT	122 programs / 309 pairs
all three (this PR)	PRESENT	123 programs / 309 pairs

Rows 1–2 match origin/main @ 460134af8 measured on its own in a detached worktree (60 of 78 packages, 121 programs, 302 pairs, 18 clean).

Row 2 is load-bearing: BUILD carries zero dist-resolved workspace type imports, so the exposure is only reachable through the onboarded programs, not merely first seen there.

Term 2 — numbers: +1 package (60→61 of 78), +2 programs, +7 pairs — this entry and nothing else. The deltas are unchanged from the reviewed reading; only the absolutes moved (the pre-merge body said 58→59).

Term 3 — why the registry entry and not paths, measured both ways on the pre-merge checkout (temporary paths block added to tsconfig.test.json, tsc --noEmit -p run, then removed — never committed): redirecting all 7 deps to source takes this package's test layer from 0 errors to 306 (305 × TS6059 "not under rootDir" + 1 × TS6133), every TS6059 in another package's source (packages/types/src/**, packages/spec/src/**, packages/objectql/src/**, packages/observability/src/**, packages/drivers/driver-sql/src/**) — billed to a package that cannot pay it down. Same shape as #12570 (+5 for rest) and #8021 (247 TS6059), reproduced at larger scale on a package whose whole point here is reaching zero. This 306 was NOT re-measured after the merge — and it is not being claimed as unchangeable: main moved packages/spec/src/** and other trees the TS6059 land in, so the exact number could differ today. What the merge cannot flip is the direction the term rests on (a paths redirect bills hundreds of other packages' TS6059 to this one), and the committed tree contains no paths either way.

Gates

All figures in this section are the post-merge re-run, on head 2e8cbeed5 over merge base 460134af8 — not carried over from the pre-merge round. origin/main was merged into this branch (merge commit a58676160), never rebased; the conflict was in check-type-check-coverage.mjs only, and it resolved as "keep every entry" — all three graduation paragraphs kept, all three DEBT entries gone.

Derived with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands against the post-merge diff (20 paths vs merge base 460134af8).

66 command(s) — 36 pnpm, 30 direct node. All run, all 66 green.

The three that read exit 3 (PREREQUISITE NOT MET) in the pre-merge round — check:dual-build-cjs-loads, check:i18n, check:type-check-debt — plus the artifact-roster gate check:published-readme-exports that read exit 1 for the same missing-dist/ reason, were all re-run after building the whole workspace (turbo run build --filter './packages/*' --filter './packages/*/*', 71/71 successful) and all four are exit 0. check:type-check-debt re-measured 14 ledger entries in 147.9s, 153 raw tsc errors total, none above its recorded number.

check:type-check-coverage verdict on the merged tree: OK — 75/79 workspace packages type-checked (plus the root), 4 in the DEBT ledger (53 frozen raw errors), 1 exempt.check:type-source-resolution verdict: OK — 123 tsc program(s) across 78 packages scanned; 61 registered as still resolving a workspace dep's types through dist/.

Package-level, on the merged head: pnpm --filter @objectstack/service-storage typecheck — exit 0, all three legs (tsc --noEmit, tsc --noEmit -p tsconfig.scripts.json, check:test-typecheck) clean, 0 file(s) / 0 error(s) / 0 pinned signature(s). pnpm --filter @objectstack/service-storage exec vitest run — exit 0, 35 files / 536 tests passed, the same counts the pre-merge round recorded.

Both edited gate scripts (check-type-check-coverage.mjs, check-type-source-resolution.mjs) ran their own --self-test green on the merged tree.

pnpm-lock.yaml was not hand-merged: pnpm install over the merged manifest set leaves the auto-merged file byte-identical (git hash-object = 000bb7dfbcebaca6c6b92a26d9d970d464c3f6fd before and after), and pnpm install --frozen-lockfile exits 0.

Figures NOT re-measured after the merge, stated as such rather than implied: the before columns of the error table (51 BUILD / 10 test layer), their tier decomposition (8 / 26 / 17), the intermediate 41 → 3 extension-fix reading, and the 306-error paths measurement in Term 3. All four are readings of the pre-fix tree; the after column (0 / 0) is the live claim and it is re-measured above.

Findings (out of scope, reported)

• @objectstack/objectql's DTS worker was truncated by the ~10-minute foreground kill on the first pnpm --filter '@objectstack/service-storage^...' build attempt in a fresh worktree: dist/ had .js/.mjs but zero .d.ts files, check-dts-emitted.mjs never ran (the whole pnpm build recursive run was SIGTERM'd mid-flight), yet the dist/*.js files were already on disk. This produced 16 spurious TS7016 ("Could not find a declaration file for module '@objectstack/objectql'") errors in the first undivided measurement (73, not 51) — a false read that would have been invisible without the ledger's 51 as a positive control to notice the mismatch against. Not filed as a separate issue: it's a restatement of the platform-fact AGENTS.md already documents (front-of-process ~10-minute SIGTERM cap can land mid-build), not a new defect — rebuilding the one truncated package (pnpm --filter '@objectstack/objectql' build, ~17s for its DTS step alone) fixed it.

Declined, with reasons

• No paths rules added — measured at +306 TS6059 in other packages' source (above).
• No test skipped, disabled or quarantined; no program narrowed; no @ts-expect-error/@ts-ignore added; strict untouched; BUILD tsconfig.json's lib untouched (the 3 TS2550 sites were rewritten instead).
• packages/spec not touched (single-owner lane) — only read, to confirm PubSubHandler/IStorageService contracts were not implicated.
• No content/docs/releases edit.
• Nothing outside this card touched in the merge round — no edit to service-automation or service-knowledge, whose PRs have landed; the diff against main is the same 20 files it was when reviewed.

Changeset

.changeset/service-storage-test-tsc-program.md, patch on @objectstack/service-storage. No runtime code changed — src/** excluding tests is byte-identical — so no shipped behaviour moves; the level reflects the published package.json gaining typecheck/check:test-typecheck scripts and a tsx devDependency.

The merge-conflict round was carried out by a second Claude Code session, https://claude.ai/code/session_01XpTx2tbq3pZRYAdoGt6E6Y; the implementation round's session is named in the footer below.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

⚠️1 changed file(s) yielded no anchor (packages/services/service-storage/tsconfig.scripts.json), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files. Nothing else in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)).

What this run could not see

• 1 changed file(s) yielded no anchor (packages/services/service-storage/tsconfig.scripts.json) — pages documenting those are invisible to this run
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 6 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 460134af85f7ab2cf68abc62f1bbb9783b8899dd → packageMentionDocs.

[os-sales]

Fixes#15050

packages/services/service-storage had no typecheck script at all (its scripts were build and test), so no tsc program anywhere read this package's test layer. Turbo/CI typecheck lanes skipped it silently, because a zero-matching filter run exits 0. tsup transpiles with esbuild and vitest runs through esbuild type-stripping; neither type-checks.

Clause-②: no — this is the checked-test-zone mechanism (#14062/#14181) applied one package over; it touches no spec/API contract surface, only this package's own test files, tsc configs and the two shared ledger scripts the ratchet already routes graduations through.

The route, and which exemplar it was copied from

Copied from plugin-webhooks / service-cluster (#14181, PR #15032 — read before starting), not from plugin-auth / plugin-sharing / core, because it is the structural match. The deciding property is what the BUILD config does with tests:

package	tsconfig.json excludes tests?	fits here
plugin-auth, plugin-sharing, core	yes	no
plugin-webhooks, service-cluster, service-storage	no	yes

service-storage's tsconfig.json includes the tests and always did, so the program that would have read them already existed and was simply never invoked. tsconfig.json is therefore untouched; the sibling tsconfig.test.json is the family's uniform instrument over the same files (module semantics only — esnext/bundler/lib: ES2022; strictness inherited, no paths).

A ninth file also needed the same treatment: scripts/i18n-extract.config.ts is the ninth instance #11351 onboarded for the other 8 packages that carry one — deliberately left out of that ledger before now, because SOURCES_COVERED only asks its question of a package that declares typecheck, and this one didn't. Giving it a typecheck script makes that question start firing here, so tsconfig.scripts.json (copied from packages/objectql's minimal shape) completes the family in the same PR rather than leaving a new gap the moment typecheck exists.

Measured error count, both ways, before and after

Dependency closure built first (pnpm --filter '@objectstack/service-storage^...' build; @objectstack/objectql's DTS worker had been truncated by an unrelated 10-minute foreground kill on the first attempt — see Findings — and was rebuilt before measuring):

program	before	after
BUILD semantics (tsc --noEmit -p tsconfig.json, already includes tests)	51 (matches the DEBT ledger's recorded 51 exactly)	0
test layer (tsc --noEmit -p tsconfig.test.json)	10	0

1102 files in the BUILD program / 1068 in the test program, covering all 35 of the package's src/**/*.test.ts. (Re-measured after the merge below with --listFiles: still 1102 / 1068 / 35, both programs still exit 0.)

Both readings agree at 0/0 — the same headline result service-cluster reported, reached by a longer road. Unlike that package, this one's BUILD reading was not already clean, so the 51→0 needed real repair on both legs, not just the test-only split:

• code-tier 8 (TS2339 × 4, TS2347 × 4) — genuine test-file defects, fixed in the tests (below).
• config-tier 26 (TS2835 × 23 relative-import extensions, TS2550 × 3 Array.prototype.at) — repaired, not routed around.
• noise 17 (TS7006 × 15, TS6196 × 1, TS6133 × 1).

The composition matches the DEBT entry's own note (code-tier 8 (TS2339 x4, TS2347 x4); config-tier 26 (TS2835 x23, TS2550 x3); noise 17 (TS7006 x15, TS6196, TS6133)) exactly — a positive control that the 51-measurement is reading the same thing the ledger already recorded.

The config-tier repair, and why it's a repair rather than a workaround

The 23 TS2835 are relative imports missing their .js extension, required under BUILD's NodeNext resolution but optional under the split's bundler resolution. The fix is to add the extension (./local-storage-adapter → ./local-storage-adapter.js), across 12 test files — this resolves correctly under both module modes, so it isn't a config-only accommodation, it's a real fix. Doing so also cleared all 15 TS7006 as a downstream cascade — the same shape @objectstack/core reported at 98 → 4 (#14916): an unresolved relative import makes every symbol it names any, and once the import resolves, the "implicitly any" errors disappear with it. Measured directly: 41 BUILD errors before the extension fix, 3 after (all TS2550).

The remaining 3 TS2550 (Array.prototype.at needing lib es2022) are rewritten to indexed access (arr[arr.length - 1]) in storage-adapter-list.conformance.test.ts rather than widening the shared BUILD tsconfig.json's lib — the narrower fix, and it leaves the BUILD config untouched.

The 8 code-tier errors, and why each fix is correct rather than convenient

• TS2339 × 4, file-reference-lifecycle.test.ts — the driveInsert test helper builds row by spreading a value typed Record of string keys to unknown values, plus id. TypeScript's object-spread inference drops the source's index signature when it has no known properties, so an un-annotated row infers as bare { id: string } and every per-key read off row is an error — even though the runtime shape genuinely carries the caller's fields. Reproduced in isolation (a 5-line repro) before touching the file. Fixed with an explicit annotation on row — the same Record shape intersected with { id: string } — which states the true type rather than widening anything.
• TS2347 × 4, storage-service-plugin.test.ts — a fake ctx: any's getService method (declared generic, one type parameter) becomes any-typed through the outer annotation, so calling it WITH an explicit type argument — ctx.getService('storage') spelled with the type argument inline, IStorageService — is invalid (TS can't verify a generic call through any). One call site in this same file had already hit this and left a comment documenting the fix: "Plain calls with casts, not the type-argument form — the fake ctx's getService is untyped, and each type-argument call adds a frozen-debt TS2347..." — the other three call sites just hadn't been converted yet. Converted all four to the cast form, ctx.getService('storage') as the target type, the pattern the file itself had already established.
• TS6196 × 1 — a genuinely dead StorageFileInfo import, invisible until a tsc program finally read the file. Removed.
• TS6133 × 1 — an unused destructured param in a .map() callback. Renamed to _r (the underscore-ignore convention already used elsewhere in this package's tests).

Ledger consequences

• DEBT['@objectstack/service-storage'] deleted, not lowered — errors: 51 is gone; the graduation note is recorded in check-type-check-coverage.mjs's own prose, per its convention. Post-merge figures: the gate now reads 53 raw errors across 4 packages, where main at 460134af8 reads 104 across 5. (The pre-merge body said 66/6 from 117/7; both siblings of this family have since landed and taken their own entries out, so those two pairs are stale and are replaced here.)
• No test-typecheck-debt.json created — residue is 0, so none is owed; opening one is maintainer-only (@ts-expect-error 退役 pin 在 packages/spec 里是幽灵检查:tsconfig 把 **/*.test.ts 排除出唯一的 tsc --noEmit #5286).
• UNCHECKED_SOURCE_DEBT's "ninth config" paragraph updated to record that scripts/i18n-extract.config.ts joined the other eight, measuring 0 errors under its new tsconfig.scripts.json, same as all eight siblings.

⚠️check:type-source-resolution — an onboarding re-baseline, please review it as one

This gate went red on my diff. Onboarding tsconfig.test.json + tsconfig.scripts.json moves the package's tsc PROGRAM SET, which the gate judges per program — its own doc-block opens an explicit onboarding limb for exactly this, on the same three terms #14181/PR #15032 used for service-cluster.

Term 1 — provenance, measured four ways on one checkout by varying only what typecheck names (--list). Re-measured on the post-merge tree (the two landed siblings moved every absolute here and none of the deltas), restoring package.json from HEAD between rows and proving the restore byte-identical:

typecheck names	entry	totals
nothing / tsconfig.json only	absent	121 programs / 302 pairs
tsconfig.test.json only	PRESENT	122 programs / 309 pairs
all three (this PR)	PRESENT	123 programs / 309 pairs

Rows 1–2 match origin/main @ 460134af8 measured on its own in a detached worktree (60 of 78 packages, 121 programs, 302 pairs, 18 clean).

Row 2 is load-bearing: BUILD carries zero dist-resolved workspace type imports, so the exposure is only reachable through the onboarded programs, not merely first seen there.

Term 2 — numbers: +1 package (60→61 of 78), +2 programs, +7 pairs — this entry and nothing else. The deltas are unchanged from the reviewed reading; only the absolutes moved (the pre-merge body said 58→59).

Term 3 — why the registry entry and not paths, measured both ways on the pre-merge checkout (temporary paths block added to tsconfig.test.json, tsc --noEmit -p run, then removed — never committed): redirecting all 7 deps to source takes this package's test layer from 0 errors to 306 (305 × TS6059 "not under rootDir" + 1 × TS6133), every TS6059 in another package's source (packages/types/src/**, packages/spec/src/**, packages/objectql/src/**, packages/observability/src/**, packages/drivers/driver-sql/src/**) — billed to a package that cannot pay it down. Same shape as #12570 (+5 for rest) and #8021 (247 TS6059), reproduced at larger scale on a package whose whole point here is reaching zero. This 306 was NOT re-measured after the merge — and it is not being claimed as unchangeable: main moved packages/spec/src/** and other trees the TS6059 land in, so the exact number could differ today. What the merge cannot flip is the direction the term rests on (a paths redirect bills hundreds of other packages' TS6059 to this one), and the committed tree contains no paths either way.

Gates

All figures in this section are the post-merge re-run, on head 2e8cbeed5 over merge base 460134af8 — not carried over from the pre-merge round. origin/main was merged into this branch (merge commit a58676160), never rebased; the conflict was in check-type-check-coverage.mjs only, and it resolved as "keep every entry" — all three graduation paragraphs kept, all three DEBT entries gone.

Derived with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands against the post-merge diff (20 paths vs merge base 460134af8).

66 command(s) — 36 pnpm, 30 direct node. All run, all 66 green.

The three that read exit 3 (PREREQUISITE NOT MET) in the pre-merge round — check:dual-build-cjs-loads, check:i18n, check:type-check-debt — plus the artifact-roster gate check:published-readme-exports that read exit 1 for the same missing-dist/ reason, were all re-run after building the whole workspace (turbo run build --filter './packages/*' --filter './packages/*/*', 71/71 successful) and all four are exit 0. check:type-check-debt re-measured 14 ledger entries in 147.9s, 153 raw tsc errors total, none above its recorded number.

check:type-check-coverage verdict on the merged tree: OK — 75/79 workspace packages type-checked (plus the root), 4 in the DEBT ledger (53 frozen raw errors), 1 exempt.check:type-source-resolution verdict: OK — 123 tsc program(s) across 78 packages scanned; 61 registered as still resolving a workspace dep's types through dist/.

Package-level, on the merged head: pnpm --filter @objectstack/service-storage typecheck — exit 0, all three legs (tsc --noEmit, tsc --noEmit -p tsconfig.scripts.json, check:test-typecheck) clean, 0 file(s) / 0 error(s) / 0 pinned signature(s). pnpm --filter @objectstack/service-storage exec vitest run — exit 0, 35 files / 536 tests passed, the same counts the pre-merge round recorded.

Both edited gate scripts (check-type-check-coverage.mjs, check-type-source-resolution.mjs) ran their own --self-test green on the merged tree.

pnpm-lock.yaml was not hand-merged: pnpm install over the merged manifest set leaves the auto-merged file byte-identical (git hash-object = 000bb7dfbcebaca6c6b92a26d9d970d464c3f6fd before and after), and pnpm install --frozen-lockfile exits 0.

Figures NOT re-measured after the merge, stated as such rather than implied: the before columns of the error table (51 BUILD / 10 test layer), their tier decomposition (8 / 26 / 17), the intermediate 41 → 3 extension-fix reading, and the 306-error paths measurement in Term 3. All four are readings of the pre-fix tree; the after column (0 / 0) is the live claim and it is re-measured above.

Findings (out of scope, reported)

• @objectstack/objectql's DTS worker was truncated by the ~10-minute foreground kill on the first pnpm --filter '@objectstack/service-storage^...' build attempt in a fresh worktree: dist/ had .js/.mjs but zero .d.ts files, check-dts-emitted.mjs never ran (the whole pnpm build recursive run was SIGTERM'd mid-flight), yet the dist/*.js files were already on disk. This produced 16 spurious TS7016 ("Could not find a declaration file for module '@objectstack/objectql'") errors in the first undivided measurement (73, not 51) — a false read that would have been invisible without the ledger's 51 as a positive control to notice the mismatch against. Not filed as a separate issue: it's a restatement of the platform-fact AGENTS.md already documents (front-of-process ~10-minute SIGTERM cap can land mid-build), not a new defect — rebuilding the one truncated package (pnpm --filter '@objectstack/objectql' build, ~17s for its DTS step alone) fixed it.

Declined, with reasons

• No paths rules added — measured at +306 TS6059 in other packages' source (above).
• No test skipped, disabled or quarantined; no program narrowed; no @ts-expect-error/@ts-ignore added; strict untouched; BUILD tsconfig.json's lib untouched (the 3 TS2550 sites were rewritten instead).
• packages/spec not touched (single-owner lane) — only read, to confirm PubSubHandler/IStorageService contracts were not implicated.
• No content/docs/releases edit.
• Nothing outside this card touched in the merge round — no edit to service-automation or service-knowledge, whose PRs have landed; the diff against main is the same 20 files it was when reviewed.

Changeset

.changeset/service-storage-test-tsc-program.md, patch on @objectstack/service-storage. No runtime code changed — src/** excluding tests is byte-identical — so no shipped behaviour moves; the level reflects the published package.json gaining typecheck/check:test-typecheck scripts and a tsx devDependency.

The merge-conflict round was carried out by a second Claude Code session, https://claude.ai/code/session_01XpTx2tbq3pZRYAdoGt6E6Y; the implementation round's session is named in the footer below.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

⚠️1 changed file(s) yielded no anchor (packages/services/service-storage/tsconfig.scripts.json), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files. Nothing else in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)).

What this run could not see

• 1 changed file(s) yielded no anchor (packages/services/service-storage/tsconfig.scripts.json) — pages documenting those are invisible to this run
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 6 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 460134af85f7ab2cf68abc62f1bbb9783b8899dd → packageMentionDocs.

[os-sales]

Fixes#15050

packages/services/service-storage had no typecheck script at all (its scripts were build and test), so no tsc program anywhere read this package's test layer. Turbo/CI typecheck lanes skipped it silently, because a zero-matching filter run exits 0. tsup transpiles with esbuild and vitest runs through esbuild type-stripping; neither type-checks.

Clause-②: no — this is the checked-test-zone mechanism (#14062/#14181) applied one package over; it touches no spec/API contract surface, only this package's own test files, tsc configs and the two shared ledger scripts the ratchet already routes graduations through.

The route, and which exemplar it was copied from

Copied from plugin-webhooks / service-cluster (#14181, PR #15032 — read before starting), not from plugin-auth / plugin-sharing / core, because it is the structural match. The deciding property is what the BUILD config does with tests:

package	tsconfig.json excludes tests?	fits here
plugin-auth, plugin-sharing, core	yes	no
plugin-webhooks, service-cluster, service-storage	no	yes

service-storage's tsconfig.json includes the tests and always did, so the program that would have read them already existed and was simply never invoked. tsconfig.json is therefore untouched; the sibling tsconfig.test.json is the family's uniform instrument over the same files (module semantics only — esnext/bundler/lib: ES2022; strictness inherited, no paths).

A ninth file also needed the same treatment: scripts/i18n-extract.config.ts is the ninth instance #11351 onboarded for the other 8 packages that carry one — deliberately left out of that ledger before now, because SOURCES_COVERED only asks its question of a package that declares typecheck, and this one didn't. Giving it a typecheck script makes that question start firing here, so tsconfig.scripts.json (copied from packages/objectql's minimal shape) completes the family in the same PR rather than leaving a new gap the moment typecheck exists.

Measured error count, both ways, before and after

Dependency closure built first (pnpm --filter '@objectstack/service-storage^...' build; @objectstack/objectql's DTS worker had been truncated by an unrelated 10-minute foreground kill on the first attempt — see Findings — and was rebuilt before measuring):

program	before	after
BUILD semantics (tsc --noEmit -p tsconfig.json, already includes tests)	51 (matches the DEBT ledger's recorded 51 exactly)	0
test layer (tsc --noEmit -p tsconfig.test.json)	10	0

1102 files in the BUILD program / 1068 in the test program, covering all 35 of the package's src/**/*.test.ts. (Re-measured after the merge below with --listFiles: still 1102 / 1068 / 35, both programs still exit 0.)

Both readings agree at 0/0 — the same headline result service-cluster reported, reached by a longer road. Unlike that package, this one's BUILD reading was not already clean, so the 51→0 needed real repair on both legs, not just the test-only split:

• code-tier 8 (TS2339 × 4, TS2347 × 4) — genuine test-file defects, fixed in the tests (below).
• config-tier 26 (TS2835 × 23 relative-import extensions, TS2550 × 3 Array.prototype.at) — repaired, not routed around.
• noise 17 (TS7006 × 15, TS6196 × 1, TS6133 × 1).

The composition matches the DEBT entry's own note (code-tier 8 (TS2339 x4, TS2347 x4); config-tier 26 (TS2835 x23, TS2550 x3); noise 17 (TS7006 x15, TS6196, TS6133)) exactly — a positive control that the 51-measurement is reading the same thing the ledger already recorded.

The config-tier repair, and why it's a repair rather than a workaround

The 23 TS2835 are relative imports missing their .js extension, required under BUILD's NodeNext resolution but optional under the split's bundler resolution. The fix is to add the extension (./local-storage-adapter → ./local-storage-adapter.js), across 12 test files — this resolves correctly under both module modes, so it isn't a config-only accommodation, it's a real fix. Doing so also cleared all 15 TS7006 as a downstream cascade — the same shape @objectstack/core reported at 98 → 4 (#14916): an unresolved relative import makes every symbol it names any, and once the import resolves, the "implicitly any" errors disappear with it. Measured directly: 41 BUILD errors before the extension fix, 3 after (all TS2550).

The remaining 3 TS2550 (Array.prototype.at needing lib es2022) are rewritten to indexed access (arr[arr.length - 1]) in storage-adapter-list.conformance.test.ts rather than widening the shared BUILD tsconfig.json's lib — the narrower fix, and it leaves the BUILD config untouched.

The 8 code-tier errors, and why each fix is correct rather than convenient

• TS2339 × 4, file-reference-lifecycle.test.ts — the driveInsert test helper builds row by spreading a value typed Record of string keys to unknown values, plus id. TypeScript's object-spread inference drops the source's index signature when it has no known properties, so an un-annotated row infers as bare { id: string } and every per-key read off row is an error — even though the runtime shape genuinely carries the caller's fields. Reproduced in isolation (a 5-line repro) before touching the file. Fixed with an explicit annotation on row — the same Record shape intersected with { id: string } — which states the true type rather than widening anything.
• TS2347 × 4, storage-service-plugin.test.ts — a fake ctx: any's getService method (declared generic, one type parameter) becomes any-typed through the outer annotation, so calling it WITH an explicit type argument — ctx.getService('storage') spelled with the type argument inline, IStorageService — is invalid (TS can't verify a generic call through any). One call site in this same file had already hit this and left a comment documenting the fix: "Plain calls with casts, not the type-argument form — the fake ctx's getService is untyped, and each type-argument call adds a frozen-debt TS2347..." — the other three call sites just hadn't been converted yet. Converted all four to the cast form, ctx.getService('storage') as the target type, the pattern the file itself had already established.
• TS6196 × 1 — a genuinely dead StorageFileInfo import, invisible until a tsc program finally read the file. Removed.
• TS6133 × 1 — an unused destructured param in a .map() callback. Renamed to _r (the underscore-ignore convention already used elsewhere in this package's tests).

Ledger consequences

• DEBT['@objectstack/service-storage'] deleted, not lowered — errors: 51 is gone; the graduation note is recorded in check-type-check-coverage.mjs's own prose, per its convention. Post-merge figures: the gate now reads 53 raw errors across 4 packages, where main at 460134af8 reads 104 across 5. (The pre-merge body said 66/6 from 117/7; both siblings of this family have since landed and taken their own entries out, so those two pairs are stale and are replaced here.)
• No test-typecheck-debt.json created — residue is 0, so none is owed; opening one is maintainer-only (@ts-expect-error 退役 pin 在 packages/spec 里是幽灵检查:tsconfig 把 **/*.test.ts 排除出唯一的 tsc --noEmit #5286).
• UNCHECKED_SOURCE_DEBT's "ninth config" paragraph updated to record that scripts/i18n-extract.config.ts joined the other eight, measuring 0 errors under its new tsconfig.scripts.json, same as all eight siblings.

⚠️check:type-source-resolution — an onboarding re-baseline, please review it as one

This gate went red on my diff. Onboarding tsconfig.test.json + tsconfig.scripts.json moves the package's tsc PROGRAM SET, which the gate judges per program — its own doc-block opens an explicit onboarding limb for exactly this, on the same three terms #14181/PR #15032 used for service-cluster.

Term 1 — provenance, measured four ways on one checkout by varying only what typecheck names (--list). Re-measured on the post-merge tree (the two landed siblings moved every absolute here and none of the deltas), restoring package.json from HEAD between rows and proving the restore byte-identical:

typecheck names	entry	totals
nothing / tsconfig.json only	absent	121 programs / 302 pairs
tsconfig.test.json only	PRESENT	122 programs / 309 pairs
all three (this PR)	PRESENT	123 programs / 309 pairs

Rows 1–2 match origin/main @ 460134af8 measured on its own in a detached worktree (60 of 78 packages, 121 programs, 302 pairs, 18 clean).

Row 2 is load-bearing: BUILD carries zero dist-resolved workspace type imports, so the exposure is only reachable through the onboarded programs, not merely first seen there.

Term 2 — numbers: +1 package (60→61 of 78), +2 programs, +7 pairs — this entry and nothing else. The deltas are unchanged from the reviewed reading; only the absolutes moved (the pre-merge body said 58→59).

Term 3 — why the registry entry and not paths, measured both ways on the pre-merge checkout (temporary paths block added to tsconfig.test.json, tsc --noEmit -p run, then removed — never committed): redirecting all 7 deps to source takes this package's test layer from 0 errors to 306 (305 × TS6059 "not under rootDir" + 1 × TS6133), every TS6059 in another package's source (packages/types/src/**, packages/spec/src/**, packages/objectql/src/**, packages/observability/src/**, packages/drivers/driver-sql/src/**) — billed to a package that cannot pay it down. Same shape as #12570 (+5 for rest) and #8021 (247 TS6059), reproduced at larger scale on a package whose whole point here is reaching zero. This 306 was NOT re-measured after the merge — and it is not being claimed as unchangeable: main moved packages/spec/src/** and other trees the TS6059 land in, so the exact number could differ today. What the merge cannot flip is the direction the term rests on (a paths redirect bills hundreds of other packages' TS6059 to this one), and the committed tree contains no paths either way.

Gates

All figures in this section are the post-merge re-run, on head 2e8cbeed5 over merge base 460134af8 — not carried over from the pre-merge round. origin/main was merged into this branch (merge commit a58676160), never rebased; the conflict was in check-type-check-coverage.mjs only, and it resolved as "keep every entry" — all three graduation paragraphs kept, all three DEBT entries gone.

Derived with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands against the post-merge diff (20 paths vs merge base 460134af8).

66 command(s) — 36 pnpm, 30 direct node. All run, all 66 green.

The three that read exit 3 (PREREQUISITE NOT MET) in the pre-merge round — check:dual-build-cjs-loads, check:i18n, check:type-check-debt — plus the artifact-roster gate check:published-readme-exports that read exit 1 for the same missing-dist/ reason, were all re-run after building the whole workspace (turbo run build --filter './packages/*' --filter './packages/*/*', 71/71 successful) and all four are exit 0. check:type-check-debt re-measured 14 ledger entries in 147.9s, 153 raw tsc errors total, none above its recorded number.

check:type-check-coverage verdict on the merged tree: OK — 75/79 workspace packages type-checked (plus the root), 4 in the DEBT ledger (53 frozen raw errors), 1 exempt.check:type-source-resolution verdict: OK — 123 tsc program(s) across 78 packages scanned; 61 registered as still resolving a workspace dep's types through dist/.

Package-level, on the merged head: pnpm --filter @objectstack/service-storage typecheck — exit 0, all three legs (tsc --noEmit, tsc --noEmit -p tsconfig.scripts.json, check:test-typecheck) clean, 0 file(s) / 0 error(s) / 0 pinned signature(s). pnpm --filter @objectstack/service-storage exec vitest run — exit 0, 35 files / 536 tests passed, the same counts the pre-merge round recorded.

Both edited gate scripts (check-type-check-coverage.mjs, check-type-source-resolution.mjs) ran their own --self-test green on the merged tree.

pnpm-lock.yaml was not hand-merged: pnpm install over the merged manifest set leaves the auto-merged file byte-identical (git hash-object = 000bb7dfbcebaca6c6b92a26d9d970d464c3f6fd before and after), and pnpm install --frozen-lockfile exits 0.

Figures NOT re-measured after the merge, stated as such rather than implied: the before columns of the error table (51 BUILD / 10 test layer), their tier decomposition (8 / 26 / 17), the intermediate 41 → 3 extension-fix reading, and the 306-error paths measurement in Term 3. All four are readings of the pre-fix tree; the after column (0 / 0) is the live claim and it is re-measured above.

Findings (out of scope, reported)

• @objectstack/objectql's DTS worker was truncated by the ~10-minute foreground kill on the first pnpm --filter '@objectstack/service-storage^...' build attempt in a fresh worktree: dist/ had .js/.mjs but zero .d.ts files, check-dts-emitted.mjs never ran (the whole pnpm build recursive run was SIGTERM'd mid-flight), yet the dist/*.js files were already on disk. This produced 16 spurious TS7016 ("Could not find a declaration file for module '@objectstack/objectql'") errors in the first undivided measurement (73, not 51) — a false read that would have been invisible without the ledger's 51 as a positive control to notice the mismatch against. Not filed as a separate issue: it's a restatement of the platform-fact AGENTS.md already documents (front-of-process ~10-minute SIGTERM cap can land mid-build), not a new defect — rebuilding the one truncated package (pnpm --filter '@objectstack/objectql' build, ~17s for its DTS step alone) fixed it.

Declined, with reasons

• No paths rules added — measured at +306 TS6059 in other packages' source (above).
• No test skipped, disabled or quarantined; no program narrowed; no @ts-expect-error/@ts-ignore added; strict untouched; BUILD tsconfig.json's lib untouched (the 3 TS2550 sites were rewritten instead).
• packages/spec not touched (single-owner lane) — only read, to confirm PubSubHandler/IStorageService contracts were not implicated.
• No content/docs/releases edit.
• Nothing outside this card touched in the merge round — no edit to service-automation or service-knowledge, whose PRs have landed; the diff against main is the same 20 files it was when reviewed.

Changeset

.changeset/service-storage-test-tsc-program.md, patch on @objectstack/service-storage. No runtime code changed — src/** excluding tests is byte-identical — so no shipped behaviour moves; the level reflects the published package.json gaining typecheck/check:test-typecheck scripts and a tsx devDependency.

The merge-conflict round was carried out by a second Claude Code session, https://claude.ai/code/session_01XpTx2tbq3pZRYAdoGt6E6Y; the implementation round's session is named in the footer below.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

⚠️1 changed file(s) yielded no anchor (packages/services/service-storage/tsconfig.scripts.json), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files. Nothing else in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)).

What this run could not see

• 1 changed file(s) yielded no anchor (packages/services/service-storage/tsconfig.scripts.json) — pages documenting those are invisible to this run
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 6 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 460134af85f7ab2cf68abc62f1bbb9783b8899dd → packageMentionDocs.

[os-sales]

Fixes#15050

packages/services/service-storage had no typecheck script at all (its scripts were build and test), so no tsc program anywhere read this package's test layer. Turbo/CI typecheck lanes skipped it silently, because a zero-matching filter run exits 0. tsup transpiles with esbuild and vitest runs through esbuild type-stripping; neither type-checks.

Clause-②: no — this is the checked-test-zone mechanism (#14062/#14181) applied one package over; it touches no spec/API contract surface, only this package's own test files, tsc configs and the two shared ledger scripts the ratchet already routes graduations through.

The route, and which exemplar it was copied from

Copied from plugin-webhooks / service-cluster (#14181, PR #15032 — read before starting), not from plugin-auth / plugin-sharing / core, because it is the structural match. The deciding property is what the BUILD config does with tests:

package	tsconfig.json excludes tests?	fits here
plugin-auth, plugin-sharing, core	yes	no
plugin-webhooks, service-cluster, service-storage	no	yes

service-storage's tsconfig.json includes the tests and always did, so the program that would have read them already existed and was simply never invoked. tsconfig.json is therefore untouched; the sibling tsconfig.test.json is the family's uniform instrument over the same files (module semantics only — esnext/bundler/lib: ES2022; strictness inherited, no paths).

A ninth file also needed the same treatment: scripts/i18n-extract.config.ts is the ninth instance #11351 onboarded for the other 8 packages that carry one — deliberately left out of that ledger before now, because SOURCES_COVERED only asks its question of a package that declares typecheck, and this one didn't. Giving it a typecheck script makes that question start firing here, so tsconfig.scripts.json (copied from packages/objectql's minimal shape) completes the family in the same PR rather than leaving a new gap the moment typecheck exists.

Measured error count, both ways, before and after

Dependency closure built first (pnpm --filter '@objectstack/service-storage^...' build; @objectstack/objectql's DTS worker had been truncated by an unrelated 10-minute foreground kill on the first attempt — see Findings — and was rebuilt before measuring):

program	before	after
BUILD semantics (tsc --noEmit -p tsconfig.json, already includes tests)	51 (matches the DEBT ledger's recorded 51 exactly)	0
test layer (tsc --noEmit -p tsconfig.test.json)	10	0

1102 files in the BUILD program / 1068 in the test program, covering all 35 of the package's src/**/*.test.ts. (Re-measured after the merge below with --listFiles: still 1102 / 1068 / 35, both programs still exit 0.)

Both readings agree at 0/0 — the same headline result service-cluster reported, reached by a longer road. Unlike that package, this one's BUILD reading was not already clean, so the 51→0 needed real repair on both legs, not just the test-only split:

• code-tier 8 (TS2339 × 4, TS2347 × 4) — genuine test-file defects, fixed in the tests (below).
• config-tier 26 (TS2835 × 23 relative-import extensions, TS2550 × 3 Array.prototype.at) — repaired, not routed around.
• noise 17 (TS7006 × 15, TS6196 × 1, TS6133 × 1).

The composition matches the DEBT entry's own note (code-tier 8 (TS2339 x4, TS2347 x4); config-tier 26 (TS2835 x23, TS2550 x3); noise 17 (TS7006 x15, TS6196, TS6133)) exactly — a positive control that the 51-measurement is reading the same thing the ledger already recorded.

The config-tier repair, and why it's a repair rather than a workaround

The 23 TS2835 are relative imports missing their .js extension, required under BUILD's NodeNext resolution but optional under the split's bundler resolution. The fix is to add the extension (./local-storage-adapter → ./local-storage-adapter.js), across 12 test files — this resolves correctly under both module modes, so it isn't a config-only accommodation, it's a real fix. Doing so also cleared all 15 TS7006 as a downstream cascade — the same shape @objectstack/core reported at 98 → 4 (#14916): an unresolved relative import makes every symbol it names any, and once the import resolves, the "implicitly any" errors disappear with it. Measured directly: 41 BUILD errors before the extension fix, 3 after (all TS2550).

The remaining 3 TS2550 (Array.prototype.at needing lib es2022) are rewritten to indexed access (arr[arr.length - 1]) in storage-adapter-list.conformance.test.ts rather than widening the shared BUILD tsconfig.json's lib — the narrower fix, and it leaves the BUILD config untouched.

The 8 code-tier errors, and why each fix is correct rather than convenient

• TS2339 × 4, file-reference-lifecycle.test.ts — the driveInsert test helper builds row by spreading a value typed Record of string keys to unknown values, plus id. TypeScript's object-spread inference drops the source's index signature when it has no known properties, so an un-annotated row infers as bare { id: string } and every per-key read off row is an error — even though the runtime shape genuinely carries the caller's fields. Reproduced in isolation (a 5-line repro) before touching the file. Fixed with an explicit annotation on row — the same Record shape intersected with { id: string } — which states the true type rather than widening anything.
• TS2347 × 4, storage-service-plugin.test.ts — a fake ctx: any's getService method (declared generic, one type parameter) becomes any-typed through the outer annotation, so calling it WITH an explicit type argument — ctx.getService('storage') spelled with the type argument inline, IStorageService — is invalid (TS can't verify a generic call through any). One call site in this same file had already hit this and left a comment documenting the fix: "Plain calls with casts, not the type-argument form — the fake ctx's getService is untyped, and each type-argument call adds a frozen-debt TS2347..." — the other three call sites just hadn't been converted yet. Converted all four to the cast form, ctx.getService('storage') as the target type, the pattern the file itself had already established.
• TS6196 × 1 — a genuinely dead StorageFileInfo import, invisible until a tsc program finally read the file. Removed.
• TS6133 × 1 — an unused destructured param in a .map() callback. Renamed to _r (the underscore-ignore convention already used elsewhere in this package's tests).

Ledger consequences

• DEBT['@objectstack/service-storage'] deleted, not lowered — errors: 51 is gone; the graduation note is recorded in check-type-check-coverage.mjs's own prose, per its convention. Post-merge figures: the gate now reads 53 raw errors across 4 packages, where main at 460134af8 reads 104 across 5. (The pre-merge body said 66/6 from 117/7; both siblings of this family have since landed and taken their own entries out, so those two pairs are stale and are replaced here.)
• No test-typecheck-debt.json created — residue is 0, so none is owed; opening one is maintainer-only (@ts-expect-error 退役 pin 在 packages/spec 里是幽灵检查:tsconfig 把 **/*.test.ts 排除出唯一的 tsc --noEmit #5286).
• UNCHECKED_SOURCE_DEBT's "ninth config" paragraph updated to record that scripts/i18n-extract.config.ts joined the other eight, measuring 0 errors under its new tsconfig.scripts.json, same as all eight siblings.

⚠️check:type-source-resolution — an onboarding re-baseline, please review it as one

This gate went red on my diff. Onboarding tsconfig.test.json + tsconfig.scripts.json moves the package's tsc PROGRAM SET, which the gate judges per program — its own doc-block opens an explicit onboarding limb for exactly this, on the same three terms #14181/PR #15032 used for service-cluster.

Term 1 — provenance, measured four ways on one checkout by varying only what typecheck names (--list). Re-measured on the post-merge tree (the two landed siblings moved every absolute here and none of the deltas), restoring package.json from HEAD between rows and proving the restore byte-identical:

typecheck names	entry	totals
nothing / tsconfig.json only	absent	121 programs / 302 pairs
tsconfig.test.json only	PRESENT	122 programs / 309 pairs
all three (this PR)	PRESENT	123 programs / 309 pairs

Rows 1–2 match origin/main @ 460134af8 measured on its own in a detached worktree (60 of 78 packages, 121 programs, 302 pairs, 18 clean).

Row 2 is load-bearing: BUILD carries zero dist-resolved workspace type imports, so the exposure is only reachable through the onboarded programs, not merely first seen there.

Term 2 — numbers: +1 package (60→61 of 78), +2 programs, +7 pairs — this entry and nothing else. The deltas are unchanged from the reviewed reading; only the absolutes moved (the pre-merge body said 58→59).

Term 3 — why the registry entry and not paths, measured both ways on the pre-merge checkout (temporary paths block added to tsconfig.test.json, tsc --noEmit -p run, then removed — never committed): redirecting all 7 deps to source takes this package's test layer from 0 errors to 306 (305 × TS6059 "not under rootDir" + 1 × TS6133), every TS6059 in another package's source (packages/types/src/**, packages/spec/src/**, packages/objectql/src/**, packages/observability/src/**, packages/drivers/driver-sql/src/**) — billed to a package that cannot pay it down. Same shape as #12570 (+5 for rest) and #8021 (247 TS6059), reproduced at larger scale on a package whose whole point here is reaching zero. This 306 was NOT re-measured after the merge — and it is not being claimed as unchangeable: main moved packages/spec/src/** and other trees the TS6059 land in, so the exact number could differ today. What the merge cannot flip is the direction the term rests on (a paths redirect bills hundreds of other packages' TS6059 to this one), and the committed tree contains no paths either way.

Gates

All figures in this section are the post-merge re-run, on head 2e8cbeed5 over merge base 460134af8 — not carried over from the pre-merge round. origin/main was merged into this branch (merge commit a58676160), never rebased; the conflict was in check-type-check-coverage.mjs only, and it resolved as "keep every entry" — all three graduation paragraphs kept, all three DEBT entries gone.

Derived with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands against the post-merge diff (20 paths vs merge base 460134af8).

66 command(s) — 36 pnpm, 30 direct node. All run, all 66 green.

The three that read exit 3 (PREREQUISITE NOT MET) in the pre-merge round — check:dual-build-cjs-loads, check:i18n, check:type-check-debt — plus the artifact-roster gate check:published-readme-exports that read exit 1 for the same missing-dist/ reason, were all re-run after building the whole workspace (turbo run build --filter './packages/*' --filter './packages/*/*', 71/71 successful) and all four are exit 0. check:type-check-debt re-measured 14 ledger entries in 147.9s, 153 raw tsc errors total, none above its recorded number.

check:type-check-coverage verdict on the merged tree: OK — 75/79 workspace packages type-checked (plus the root), 4 in the DEBT ledger (53 frozen raw errors), 1 exempt.check:type-source-resolution verdict: OK — 123 tsc program(s) across 78 packages scanned; 61 registered as still resolving a workspace dep's types through dist/.

Package-level, on the merged head: pnpm --filter @objectstack/service-storage typecheck — exit 0, all three legs (tsc --noEmit, tsc --noEmit -p tsconfig.scripts.json, check:test-typecheck) clean, 0 file(s) / 0 error(s) / 0 pinned signature(s). pnpm --filter @objectstack/service-storage exec vitest run — exit 0, 35 files / 536 tests passed, the same counts the pre-merge round recorded.

Both edited gate scripts (check-type-check-coverage.mjs, check-type-source-resolution.mjs) ran their own --self-test green on the merged tree.

pnpm-lock.yaml was not hand-merged: pnpm install over the merged manifest set leaves the auto-merged file byte-identical (git hash-object = 000bb7dfbcebaca6c6b92a26d9d970d464c3f6fd before and after), and pnpm install --frozen-lockfile exits 0.

Figures NOT re-measured after the merge, stated as such rather than implied: the before columns of the error table (51 BUILD / 10 test layer), their tier decomposition (8 / 26 / 17), the intermediate 41 → 3 extension-fix reading, and the 306-error paths measurement in Term 3. All four are readings of the pre-fix tree; the after column (0 / 0) is the live claim and it is re-measured above.

Findings (out of scope, reported)

• @objectstack/objectql's DTS worker was truncated by the ~10-minute foreground kill on the first pnpm --filter '@objectstack/service-storage^...' build attempt in a fresh worktree: dist/ had .js/.mjs but zero .d.ts files, check-dts-emitted.mjs never ran (the whole pnpm build recursive run was SIGTERM'd mid-flight), yet the dist/*.js files were already on disk. This produced 16 spurious TS7016 ("Could not find a declaration file for module '@objectstack/objectql'") errors in the first undivided measurement (73, not 51) — a false read that would have been invisible without the ledger's 51 as a positive control to notice the mismatch against. Not filed as a separate issue: it's a restatement of the platform-fact AGENTS.md already documents (front-of-process ~10-minute SIGTERM cap can land mid-build), not a new defect — rebuilding the one truncated package (pnpm --filter '@objectstack/objectql' build, ~17s for its DTS step alone) fixed it.

Declined, with reasons

• No paths rules added — measured at +306 TS6059 in other packages' source (above).
• No test skipped, disabled or quarantined; no program narrowed; no @ts-expect-error/@ts-ignore added; strict untouched; BUILD tsconfig.json's lib untouched (the 3 TS2550 sites were rewritten instead).
• packages/spec not touched (single-owner lane) — only read, to confirm PubSubHandler/IStorageService contracts were not implicated.
• No content/docs/releases edit.
• Nothing outside this card touched in the merge round — no edit to service-automation or service-knowledge, whose PRs have landed; the diff against main is the same 20 files it was when reviewed.

Changeset

.changeset/service-storage-test-tsc-program.md, patch on @objectstack/service-storage. No runtime code changed — src/** excluding tests is byte-identical — so no shipped behaviour moves; the level reflects the published package.json gaining typecheck/check:test-typecheck scripts and a tsx devDependency.

The merge-conflict round was carried out by a second Claude Code session, https://claude.ai/code/session_01XpTx2tbq3pZRYAdoGt6E6Y; the implementation round's session is named in the footer below.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

⚠️1 changed file(s) yielded no anchor (packages/services/service-storage/tsconfig.scripts.json), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files. Nothing else in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)).

What this run could not see

• 1 changed file(s) yielded no anchor (packages/services/service-storage/tsconfig.scripts.json) — pages documenting those are invisible to this run
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 6 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 460134af85f7ab2cf68abc62f1bbb9783b8899dd → packageMentionDocs.

[os-sales]

Fixes#15050

packages/services/service-storage had no typecheck script at all (its scripts were build and test), so no tsc program anywhere read this package's test layer. Turbo/CI typecheck lanes skipped it silently, because a zero-matching filter run exits 0. tsup transpiles with esbuild and vitest runs through esbuild type-stripping; neither type-checks.

Clause-②: no — this is the checked-test-zone mechanism (#14062/#14181) applied one package over; it touches no spec/API contract surface, only this package's own test files, tsc configs and the two shared ledger scripts the ratchet already routes graduations through.

The route, and which exemplar it was copied from

Copied from plugin-webhooks / service-cluster (#14181, PR #15032 — read before starting), not from plugin-auth / plugin-sharing / core, because it is the structural match. The deciding property is what the BUILD config does with tests:

package	tsconfig.json excludes tests?	fits here
plugin-auth, plugin-sharing, core	yes	no
plugin-webhooks, service-cluster, service-storage	no	yes

service-storage's tsconfig.json includes the tests and always did, so the program that would have read them already existed and was simply never invoked. tsconfig.json is therefore untouched; the sibling tsconfig.test.json is the family's uniform instrument over the same files (module semantics only — esnext/bundler/lib: ES2022; strictness inherited, no paths).

A ninth file also needed the same treatment: scripts/i18n-extract.config.ts is the ninth instance #11351 onboarded for the other 8 packages that carry one — deliberately left out of that ledger before now, because SOURCES_COVERED only asks its question of a package that declares typecheck, and this one didn't. Giving it a typecheck script makes that question start firing here, so tsconfig.scripts.json (copied from packages/objectql's minimal shape) completes the family in the same PR rather than leaving a new gap the moment typecheck exists.

Measured error count, both ways, before and after

Dependency closure built first (pnpm --filter '@objectstack/service-storage^...' build; @objectstack/objectql's DTS worker had been truncated by an unrelated 10-minute foreground kill on the first attempt — see Findings — and was rebuilt before measuring):

program	before	after
BUILD semantics (tsc --noEmit -p tsconfig.json, already includes tests)	51 (matches the DEBT ledger's recorded 51 exactly)	0
test layer (tsc --noEmit -p tsconfig.test.json)	10	0

1102 files in the BUILD program / 1068 in the test program, covering all 35 of the package's src/**/*.test.ts. (Re-measured after the merge below with --listFiles: still 1102 / 1068 / 35, both programs still exit 0.)

Both readings agree at 0/0 — the same headline result service-cluster reported, reached by a longer road. Unlike that package, this one's BUILD reading was not already clean, so the 51→0 needed real repair on both legs, not just the test-only split:

• code-tier 8 (TS2339 × 4, TS2347 × 4) — genuine test-file defects, fixed in the tests (below).
• config-tier 26 (TS2835 × 23 relative-import extensions, TS2550 × 3 Array.prototype.at) — repaired, not routed around.
• noise 17 (TS7006 × 15, TS6196 × 1, TS6133 × 1).

The composition matches the DEBT entry's own note (code-tier 8 (TS2339 x4, TS2347 x4); config-tier 26 (TS2835 x23, TS2550 x3); noise 17 (TS7006 x15, TS6196, TS6133)) exactly — a positive control that the 51-measurement is reading the same thing the ledger already recorded.

The config-tier repair, and why it's a repair rather than a workaround

The 23 TS2835 are relative imports missing their .js extension, required under BUILD's NodeNext resolution but optional under the split's bundler resolution. The fix is to add the extension (./local-storage-adapter → ./local-storage-adapter.js), across 12 test files — this resolves correctly under both module modes, so it isn't a config-only accommodation, it's a real fix. Doing so also cleared all 15 TS7006 as a downstream cascade — the same shape @objectstack/core reported at 98 → 4 (#14916): an unresolved relative import makes every symbol it names any, and once the import resolves, the "implicitly any" errors disappear with it. Measured directly: 41 BUILD errors before the extension fix, 3 after (all TS2550).

The remaining 3 TS2550 (Array.prototype.at needing lib es2022) are rewritten to indexed access (arr[arr.length - 1]) in storage-adapter-list.conformance.test.ts rather than widening the shared BUILD tsconfig.json's lib — the narrower fix, and it leaves the BUILD config untouched.

The 8 code-tier errors, and why each fix is correct rather than convenient

• TS2339 × 4, file-reference-lifecycle.test.ts — the driveInsert test helper builds row by spreading a value typed Record of string keys to unknown values, plus id. TypeScript's object-spread inference drops the source's index signature when it has no known properties, so an un-annotated row infers as bare { id: string } and every per-key read off row is an error — even though the runtime shape genuinely carries the caller's fields. Reproduced in isolation (a 5-line repro) before touching the file. Fixed with an explicit annotation on row — the same Record shape intersected with { id: string } — which states the true type rather than widening anything.
• TS2347 × 4, storage-service-plugin.test.ts — a fake ctx: any's getService method (declared generic, one type parameter) becomes any-typed through the outer annotation, so calling it WITH an explicit type argument — ctx.getService('storage') spelled with the type argument inline, IStorageService — is invalid (TS can't verify a generic call through any). One call site in this same file had already hit this and left a comment documenting the fix: "Plain calls with casts, not the type-argument form — the fake ctx's getService is untyped, and each type-argument call adds a frozen-debt TS2347..." — the other three call sites just hadn't been converted yet. Converted all four to the cast form, ctx.getService('storage') as the target type, the pattern the file itself had already established.
• TS6196 × 1 — a genuinely dead StorageFileInfo import, invisible until a tsc program finally read the file. Removed.
• TS6133 × 1 — an unused destructured param in a .map() callback. Renamed to _r (the underscore-ignore convention already used elsewhere in this package's tests).

Ledger consequences

• DEBT['@objectstack/service-storage'] deleted, not lowered — errors: 51 is gone; the graduation note is recorded in check-type-check-coverage.mjs's own prose, per its convention. Post-merge figures: the gate now reads 53 raw errors across 4 packages, where main at 460134af8 reads 104 across 5. (The pre-merge body said 66/6 from 117/7; both siblings of this family have since landed and taken their own entries out, so those two pairs are stale and are replaced here.)
• No test-typecheck-debt.json created — residue is 0, so none is owed; opening one is maintainer-only (@ts-expect-error 退役 pin 在 packages/spec 里是幽灵检查:tsconfig 把 **/*.test.ts 排除出唯一的 tsc --noEmit #5286).
• UNCHECKED_SOURCE_DEBT's "ninth config" paragraph updated to record that scripts/i18n-extract.config.ts joined the other eight, measuring 0 errors under its new tsconfig.scripts.json, same as all eight siblings.

⚠️check:type-source-resolution — an onboarding re-baseline, please review it as one

This gate went red on my diff. Onboarding tsconfig.test.json + tsconfig.scripts.json moves the package's tsc PROGRAM SET, which the gate judges per program — its own doc-block opens an explicit onboarding limb for exactly this, on the same three terms #14181/PR #15032 used for service-cluster.

Term 1 — provenance, measured four ways on one checkout by varying only what typecheck names (--list). Re-measured on the post-merge tree (the two landed siblings moved every absolute here and none of the deltas), restoring package.json from HEAD between rows and proving the restore byte-identical:

typecheck names	entry	totals
nothing / tsconfig.json only	absent	121 programs / 302 pairs
tsconfig.test.json only	PRESENT	122 programs / 309 pairs
all three (this PR)	PRESENT	123 programs / 309 pairs

Rows 1–2 match origin/main @ 460134af8 measured on its own in a detached worktree (60 of 78 packages, 121 programs, 302 pairs, 18 clean).

Row 2 is load-bearing: BUILD carries zero dist-resolved workspace type imports, so the exposure is only reachable through the onboarded programs, not merely first seen there.

Term 2 — numbers: +1 package (60→61 of 78), +2 programs, +7 pairs — this entry and nothing else. The deltas are unchanged from the reviewed reading; only the absolutes moved (the pre-merge body said 58→59).

Term 3 — why the registry entry and not paths, measured both ways on the pre-merge checkout (temporary paths block added to tsconfig.test.json, tsc --noEmit -p run, then removed — never committed): redirecting all 7 deps to source takes this package's test layer from 0 errors to 306 (305 × TS6059 "not under rootDir" + 1 × TS6133), every TS6059 in another package's source (packages/types/src/**, packages/spec/src/**, packages/objectql/src/**, packages/observability/src/**, packages/drivers/driver-sql/src/**) — billed to a package that cannot pay it down. Same shape as #12570 (+5 for rest) and #8021 (247 TS6059), reproduced at larger scale on a package whose whole point here is reaching zero. This 306 was NOT re-measured after the merge — and it is not being claimed as unchangeable: main moved packages/spec/src/** and other trees the TS6059 land in, so the exact number could differ today. What the merge cannot flip is the direction the term rests on (a paths redirect bills hundreds of other packages' TS6059 to this one), and the committed tree contains no paths either way.

Gates

All figures in this section are the post-merge re-run, on head 2e8cbeed5 over merge base 460134af8 — not carried over from the pre-merge round. origin/main was merged into this branch (merge commit a58676160), never rebased; the conflict was in check-type-check-coverage.mjs only, and it resolved as "keep every entry" — all three graduation paragraphs kept, all three DEBT entries gone.

Derived with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands against the post-merge diff (20 paths vs merge base 460134af8).

66 command(s) — 36 pnpm, 30 direct node. All run, all 66 green.

The three that read exit 3 (PREREQUISITE NOT MET) in the pre-merge round — check:dual-build-cjs-loads, check:i18n, check:type-check-debt — plus the artifact-roster gate check:published-readme-exports that read exit 1 for the same missing-dist/ reason, were all re-run after building the whole workspace (turbo run build --filter './packages/*' --filter './packages/*/*', 71/71 successful) and all four are exit 0. check:type-check-debt re-measured 14 ledger entries in 147.9s, 153 raw tsc errors total, none above its recorded number.

check:type-check-coverage verdict on the merged tree: OK — 75/79 workspace packages type-checked (plus the root), 4 in the DEBT ledger (53 frozen raw errors), 1 exempt.check:type-source-resolution verdict: OK — 123 tsc program(s) across 78 packages scanned; 61 registered as still resolving a workspace dep's types through dist/.

Package-level, on the merged head: pnpm --filter @objectstack/service-storage typecheck — exit 0, all three legs (tsc --noEmit, tsc --noEmit -p tsconfig.scripts.json, check:test-typecheck) clean, 0 file(s) / 0 error(s) / 0 pinned signature(s). pnpm --filter @objectstack/service-storage exec vitest run — exit 0, 35 files / 536 tests passed, the same counts the pre-merge round recorded.

Both edited gate scripts (check-type-check-coverage.mjs, check-type-source-resolution.mjs) ran their own --self-test green on the merged tree.

pnpm-lock.yaml was not hand-merged: pnpm install over the merged manifest set leaves the auto-merged file byte-identical (git hash-object = 000bb7dfbcebaca6c6b92a26d9d970d464c3f6fd before and after), and pnpm install --frozen-lockfile exits 0.

Figures NOT re-measured after the merge, stated as such rather than implied: the before columns of the error table (51 BUILD / 10 test layer), their tier decomposition (8 / 26 / 17), the intermediate 41 → 3 extension-fix reading, and the 306-error paths measurement in Term 3. All four are readings of the pre-fix tree; the after column (0 / 0) is the live claim and it is re-measured above.

Findings (out of scope, reported)

• @objectstack/objectql's DTS worker was truncated by the ~10-minute foreground kill on the first pnpm --filter '@objectstack/service-storage^...' build attempt in a fresh worktree: dist/ had .js/.mjs but zero .d.ts files, check-dts-emitted.mjs never ran (the whole pnpm build recursive run was SIGTERM'd mid-flight), yet the dist/*.js files were already on disk. This produced 16 spurious TS7016 ("Could not find a declaration file for module '@objectstack/objectql'") errors in the first undivided measurement (73, not 51) — a false read that would have been invisible without the ledger's 51 as a positive control to notice the mismatch against. Not filed as a separate issue: it's a restatement of the platform-fact AGENTS.md already documents (front-of-process ~10-minute SIGTERM cap can land mid-build), not a new defect — rebuilding the one truncated package (pnpm --filter '@objectstack/objectql' build, ~17s for its DTS step alone) fixed it.

Declined, with reasons

• No paths rules added — measured at +306 TS6059 in other packages' source (above).
• No test skipped, disabled or quarantined; no program narrowed; no @ts-expect-error/@ts-ignore added; strict untouched; BUILD tsconfig.json's lib untouched (the 3 TS2550 sites were rewritten instead).
• packages/spec not touched (single-owner lane) — only read, to confirm PubSubHandler/IStorageService contracts were not implicated.
• No content/docs/releases edit.
• Nothing outside this card touched in the merge round — no edit to service-automation or service-knowledge, whose PRs have landed; the diff against main is the same 20 files it was when reviewed.

Changeset

.changeset/service-storage-test-tsc-program.md, patch on @objectstack/service-storage. No runtime code changed — src/** excluding tests is byte-identical — so no shipped behaviour moves; the level reflects the published package.json gaining typecheck/check:test-typecheck scripts and a tsx devDependency.

The merge-conflict round was carried out by a second Claude Code session, https://claude.ai/code/session_01XpTx2tbq3pZRYAdoGt6E6Y; the implementation round's session is named in the footer below.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

⚠️1 changed file(s) yielded no anchor (packages/services/service-storage/tsconfig.scripts.json), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files. Nothing else in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)).

What this run could not see

• 1 changed file(s) yielded no anchor (packages/services/service-storage/tsconfig.scripts.json) — pages documenting those are invisible to this run
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 6 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 460134af85f7ab2cf68abc62f1bbb9783b8899dd → packageMentionDocs.