chore(devx): lower nine type-check DEBT ledger entries to their measurement (#7888)

[hotlong]

Fixes#7888

pnpm check:type-check-debt --lower on the DEBT / TEST_DEBT ledger in
scripts/check-type-check-coverage.mjs. Nine entries recorded more raw tsc errors than
the tree has; each is rewritten to what the compiler reports. 271 raw errors of
regression headroom closed. No package source changes — this PR records where the
numbers already are, it does not move them.

What moved

Measured on b5e09b21 (this PR's base) with the full closure built first:
pnpm exec turbo run build --filter='./packages/*' --filter='./packages/*/*' — 70/70
tasks successful, exit 0.

ledger	package	recorded	measured	delta
TEST_DEBT	@objectstack/plugin-approvals	547	348	−199
TEST_DEBT	@objectstack/plugin-auth	131	108	−23
TEST_DEBT	@objectstack/lint	42	20	−22
TEST_DEBT	@objectstack/mcp	63	53	−10
TEST_DEBT	@objectstack/plugin-security	21	11	−10
DEBT	@objectstack/metadata	92	89	−3
DEBT	@objectstack/service-automation	5	3	−2
DEBT	@objectstack/service-storage	52	51	−1
TEST_DEBT	@objectstack/http-conformance	4	3	−1
	total			−271

Ledger totals: DEBT 442 → 436, TEST_DEBT 1795 → 1530.

Nothing was raised. Three independent guarantees, not one: the run prints
none above its recorded number before it writes; plannedLowerings skips every entry
whose measurement is at or above its ceiling (if (m.actual >= m.recorded) continue, with
a self-test case named a grown entry is never lowered); and lowerLedgerEntries refuses
any entry whose on-disk number is not the one the measurement was taken against.

Where this differs from the issue's table

The card measured at b313fde (2026-08-12 02:17Z) and reported 273 across the same
nine entries. Two entries have each gained one error since, so the surplus is smaller:

package	card	this PR
@objectstack/plugin-auth	measured 107, −24	measured 108, −23
@objectstack/lint	measured 19, −23	measured 20, −22

The other seven are identical to the card. 273 → 271. (The card's plugin-auth
measured cell reads 106; the reopen comment already corrected it to 107, and 107 is what
the −24 assumed. That correction stands.)

The card's set of nine entries is otherwise exactly reproduced — six PRs landing in the
lane since, including the one that changed a package's tsc program membership, moved two
counts by one each and nothing else.

plugin-approvals −199: a genuine floor, not a shrunken surface

The card asks for this one before its ceiling is written in, and the question is the right
one: a gap that size is either a wholesale fix (the new number is a real floor) or files
leaving the measured set (writing it in ratchets the gate against a smaller surface than it
thinks it is guarding). It is the first. Three readings, any one of which would have
falsified the other answer:

1. The composition moved in exactly one class.

code	at the recorded 547	measured now
TS2339	296	296
TS2550	20	20
TS18048	10	10
TS2345	213	16
singletons	—	6

Three of the four recorded classes are unchanged to the unit; only TS2345 (argument not
assignable) collapsed. This is also what rules out the dangerous reading — a program that
had degraded, with an unresolved import turning a type into any, would have wiped the
296 property errors first, because property access on any is legal. 296 surviving is proof
the program still resolves the same real types.

2. Nothing left the measured set; the set grew. All 21 *.test.ts files in the package
are on disk and all 21 are in the program (counted from tsc --listFiles). No test file has
been deleted. Over the window the package's other test files gained 406 lines and lost 204.

3. The file carrying the debt is byte-identical.src/approval-service.test.ts holds
273 of the measured 348, as it held 443 of the recorded 547 — and its blob hash is the same
3fc272f at 5ab08428, where the 547 was measured, and at this PR's base. Same 3335 lines,
same bytes, 170 fewer errors. The repair landed in a producer's types; no assertion was
deleted to get it.

The 16 TS2345 that survive in that file are still reported against a fully-resolved
approver-config union, so the parameter type is still strict — the 197 that went away were
repaired, not loosened away.

That attribution is written into the entry's note, which is what --lower asks for on the
entries you can attribute. The other eight notes are left exactly as they were — they
describe a larger pile than exists, which misleads in the safe direction, and inventing a
composition for errors that are gone is the one thing this ledger's own rules forbid.

Verification

• Build closure complete, and provable. 70/70 turbo tasks successful, exit 0. The
  script's unbuiltClosure guard is the structural half: it refuses to measure at all if any
  workspace dependency of a ledgered package has no built type entry on disk, so a partial or
  skipped closure cannot quietly yield low numbers — it yields a thrown error naming the
  packages. (Its own docstring measures the stakes: packages/lint reports 19 built and 147
  unbuilt, same tree, same commit.)
• The measurement is stable.--re-measure run twice in two separate clean invocations
  on the same tree: identical entry for entry, 1966 raw errors total, surplus 271 both times.
  A third run, on the previous base fa48973, gave the same nine entries and the same 271 —
  so the reading is a property of the tree, not of the run.
• After lowering:pnpm check:type-check-debt green, and --re-measure reports no
  surplus line at all. Both readings, not one.
• pnpm check:type-check-coverage green (47 structural + 15 re-measure + 12 built-closure +
  9 auto-lowering self-test cases hold). check:nul-bytes green.

Notes for the reviewer

• The diff is nine errors: numbers plus one rewritten note. Everything else in the file
  is untouched.
• No changeset: this releases nothing (scripts/ only), so the PR carries skip-changeset.
• A ledger number is a number about a moment. This one was taken at b5e09b21; the base was
  refreshed to the tip once, mid-task, precisely to shrink that window, and the numbers were
  identical at both bases. If the merge queue kicks this on a package that took a new error
  in between, the repair is a re-measure on the new head — not a raise.
• out of scope: [finding] check-type-check-coverage.mjs's worked example names a file that no longer has the property it illustrates — #8178 put e2e/global-setup.ts in the program with zero errors #8189 (the stale worked example in this file's prose). As a by-product of
  reading the file: that card's ~1410 line number is accurate — the passage sits at lines
  1409-1412 on this base, inside measureTestDebt's docblock. There is a second copy of
  the same e2e/global-setup.ts claim at line 500, in the TEST_DEBT preamble, which the
  card does not name; whoever takes it should fix both or neither.

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
objectstack	Ignored		Aug 12, 2026 10:11pm

[hotlong]

Queue kick diagnosed and fixed in b9677487. It was this PR, not a batch-mate, and not a flake.

The merge queue built this onto b16dcb45 and check:type-check-debt failed on exactly one line:

@objectstack/plugin-auth: TEST_DEBT records 108 raw tsc error(s),
`tsc --noEmit` now reports 111 (+3).

That is the ratchet working. The 108 was measured at b5e09b21; plugin-auth took +3 inside the hour, and an exactly-recorded ceiling carries no margin to absorb it. It is the same moving-base race this file's own notes record as kicking #5278 three times, and it is the case this PR's body named in advance: "the repair is a re-measure on the new head — not a raise."

This is still a lowering.main records 131; this PR now records 111. The 108 was an intermediate that never existed on main, so nothing about the ratchet is bent — the entry shrinks by 20 instead of by 23.

Why 111 is not hand-typed. It is the merge-queue run's own --re-measure, produced by the same command with the full build closure, on the exact ref this PR lands on (run 31645032836). Re-deriving it locally would measure a different, already-moved base — CI's reading is the stricter provenance here, and I would rather say plainly where the number came from than dress up a second one.

The other eight need no change, and that is a measured claim rather than an assumption. The same queue run printed no ℹ ... can be lowered note for any entry. A surplus is always reported; silence means every other entry sat exactly at its new ceiling on the queue base. Only one entry moved.

Ran locally on the fix: --self-test green (23 + 24 + 15 + 12 + 9 cases), the structural gate green, check:nul-bytes green. The --re-measure verification is CI's, deliberately — see above.

One judgement call worth a second pair of eyes, flagged rather than buried.plugin-auth has now moved twice in this card's lifetime (107 → 108 → 111). If the queue kicks it again on that same entry, the right answer is probably not a third re-measure lap but dropping plugin-auth from this PR — restore it to 131 and land the other eight, closing 248 of the 271 today and leaving the hot entry for a quiet window. I have not done that pre-emptively, because the current diff is the one the card actually asks for and it is green on everything measured so far.

---

Generated by Claude Code

---

Generated by Claude Code