fix(tooling): re-tally @objectstack/plugin-auth's TEST_DEBT from tsc (#11583)

`errors: 109` recorded a pile tsc no longer finds. Re-measured against a
built workspace closure: 97, with the composition and the per-file split
taken from that same run rather than rescaled.

  TS2493 x36, TS18048 x24, TS2322 x11, TS2532 x9, TS2345 x4, TS2339 x3,
  TS2554 x3, TS2741 x3, TS7006 x2, TS2769 x1, TS6133 x1  =  97

The -12 is measured, not subtracted. 109 - 11 = 98 is the arithmetic that
looks right and is wrong twice over: the surplus was 11 when filed, 12 when
last swept, and cross-tabbing the two runs by file AND code attributes all
12 -- 11 in src/admin-import-users.test.ts alone (TS2339 5 -> 0, TS2493
13 -> 7, the typed engine doubles) and one TS2345 out of
src/auth-manager.test.ts afterwards, left unattributed rather than guessed.

The per-file split is re-derived whole, and doing so falsified the predicted
one: src/admin-user-endpoints.test.ts holds 18 at both ends and never moved.
It is now complete -- 11 files summing to 97, not a top-four.

Anchor re-established first: d5e7b9f still measures 109 today, matching
the recorded note class for class and file for file, so the measuring stick
did not drift under the entry and 97 is comparable to 109. Worth checking --
the re-measure path did move over that window (TS6059 now dropped, include
roots extracted), but neither change reaches this package.

Not a graduation: 97 is not 0, so the entry stays and the package's
typecheck script is unchanged. No `compositionAt` is written: the note's
opening tally is per-code, which COMPOSITION deliberately does not sum, and
declaring the field over an unreadable itemisation is itself a failure.


Claude-Session: https://claude.ai/code/session_015ahemw8RcTgqtxrj15PEZx

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-steve

scripts/check-type-check-coverage.mjs

@@ -900,35 +900,62 @@ const TEST_DEBT = {
       + '(#5278 option A).',
   },
   '@objectstack/plugin-auth': {
-    errors: 109,
-    note: 'RE-TALLIED from tsc at the 109 below (measured on this branch over base e717ba111), so the '
-      + 'composition, the per-file split and the total are one measurement rather than a rescale: '
-      + 'TS2493 x42 (tuple index out of range), TS18048 x24, TS2322 x11, TS2532 x9, TS2339 x8, '
-      + 'TS2345 x5, TS2554 x3, TS2741 x3, TS7006 x2, TS2769 x1, TS6133 x1. 44 of the 109 sit in '
-      + 'src/auth-manager.test.ts, 22 in src/admin-import-users.test.ts, 18 in '
-      + 'src/admin-user-endpoints.test.ts and 12 in src/auth-plugin.test.ts. What this replaces is '
-      + 'worth one sentence, because it is the #7038 shape and not an arithmetic slip: the old tally '
-      + 'was taken at 131, said so, and named TS2740 x19 and TS2741 x8 -- TS2740 has since gone to '
-      + 'zero outright and TS2741 stands at 3, so no rescale of it could have been right. '
+    errors: 97,
+    note: 'RE-TALLIED from tsc at the 97 below (#10615), measured at cea8c7d867 with the workspace closure '
+      + 'built by the same command lint.yml runs before this gate, so the composition, the per-file split '
+      + 'and the total are ONE measurement rather than a rescale: TS2493 x36 (tuple index out of range), '
+      + 'TS18048 x24, TS2322 x11, TS2532 x9, TS2345 x4, TS2339 x3, TS2554 x3, TS2741 x3, TS7006 x2, '
+      + 'TS2769 x1, TS6133 x1 = 97, the recorded number EXACTLY -- no margin, so the next new error here '
+      + 'goes red immediately. The per-file split is COMPLETE at this measurement rather than a top-four: '
+      + '43 in src/auth-manager.test.ts, 18 in src/admin-user-endpoints.test.ts, 12 in '
+      + 'src/auth-plugin.test.ts, 11 in src/admin-import-users.test.ts, 3 each in '
+      + 'src/objectql-adapter.test.ts and src/sso-client-secret-at-rest.test.ts, 2 each in '
+      + 'src/auth-manager.jwt-eddsa-fallback.test.ts and src/reconcile-membership.test.ts, 1 each in '
+      + 'src/better-auth-schema-parity.test.ts, src/last-admin-guard.test.ts and '
+      + 'src/oauth-provider-schema-parity.test.ts -- 11 files, summing to 97. '
+      + 'LOWERED 109 -> 97 here, and the -12 was MEASURED rather than subtracted, which is the whole point '
+      + 'of the card: it was filed naming a surplus of 11 (a 98) off PR #10614\'s head, a later sweep at '
+      + '3c6028f1b2 reported the surplus as 12, and 109 - 11 = 98 was the cheap wrong answer that looks '
+      + 'right. Cross-tabbing the recorded measurement against this one by file AND code attributes all 12: '
+      + '11 sit in ONE file, src/admin-import-users.test.ts (TS2339 5 -> 0, TS2493 13 -> 7), which is '
+      + '#10614 giving two engine doubles real typed parameters -- a zero-parameter mock has a zero-length '
+      + 'parameter tuple, so every call site reading `.mock.calls[0][1]` was a TS2493 and every '
+      + '`options?.where` off it a TS2339. The 12th is one TS2345 that left '
+      + 'src/auth-manager.test.ts(4086,46) after that PR (a vi.fn callback whose parameter tuple did not '
+      + 'match its consumer), over three commits that rewrote 204 lines of that file, and it is NOT '
+      + 'attributed further rather than guessed. '
+      + 'CORRECTION, recorded because re-deriving the whole split is what caught it: the card predicted '
+      + 'src/admin-import-users.test.ts AND src/admin-user-endpoints.test.ts as "exactly the two files '
+      + 'that moved". admin-user-endpoints holds 18 at BOTH ends and did not move at all. Patching the two '
+      + 'numbers a reader believes changed would have written a plausible and wrong split over a correct '
+      + 'total -- the one failure this ledger cannot see, since nothing but prose records a split. '
+      + 'ANCHOR, re-established BEFORE re-tallying rather than assumed: d5e7b9f5a1, the ref the 109 was '
+      + 'measured on, still measures 109 today -- and not only in total, which is what makes it an anchor '
+      + 'rather than a coincidence: the composition reproduces class for class (TS2493 x42, TS18048 x24, '
+      + 'TS2322 x11, TS2532 x9, TS2339 x8, TS2345 x5, TS2554 x3, TS2741 x3, TS7006 x2, TS2769 x1, '
+      + 'TS6133 x1) and the per-file split reproduces the 44/22/18/12 this note used to record. So the '
+      + 'measuring stick did not drift under the entry and 97 is comparable to 109. Worth the check: this '
+      + 'gate grew +1752/-81 over the same window and the re-measure path itself DID move -- '
+      + '`measureTestDebt` now asks `tscErrorCount` to drop TS6059 (#10779) and the `include` roots moved '
+      + 'into `includeRoot` (#10876) -- but neither reaches this package, whose output carries no TS6059 '
+      + 'and whose `include` root reads the same under an expression that is the old inline one verbatim. '
+      + 'NOT a graduation: 97 is not 0, so this entry stays and the package typecheck script is unchanged. '
       + 'History, still true: measured 124 -> 129 (5ab08428, composition unchanged in shape) -> 131 '
       + '(e8db1a230). Lowered 131 -> 111 at b16dcb45 (#7888); the intermediate 108 in that PR\'s first '
       + 'commit was measured at b5e09b21 and was already stale when the merge queue built it -- the '
-      + 'package took +3 inside the hour, the same "a ledger number is a number about a moment" race '
-      + 'that kicked #5278 three times, so 111 was the merge-queue run\'s own re-measure on the ref '
-      + 'that PR actually landed on. Of the +2 that had made 131, half is a TS2554 in '
-      + 'src/last-admin-guard.test.ts, a file added by #5941 / PR #5993 (the break-glass delete '
-      + 'guard); the other 1 landed in a file that already existed and is not attributed further. '
-      + 'Then 111 -> 110 in PR #10013 -- the number moved and this note did not, which is how a '
-      + 'composition written at 131 was still sitting over an entry reading 110. '
-      + '110 -> 109 here (#9694): src/managed-extension-fields.test.ts held the package\'s only '
-      + 'TS1470 -- an `import.meta.url` seed in a package that is CJS-typed and therefore forbids '
-      + 'the meta-property under module: NodeNext -- and now seeds from `__dirname`, which '
-      + 'type-checks here AND is a seed spelling check:cross-package-test-inputs resolves -- the '
-      + 'current set is that gate\'s published RECOGNISED_PATH_SPELLINGS, printed verbatim in its '
-      + 'failure text, and is deliberately not restated as a count here because a count drifts '
-      + 'silently (it has been widened twice, #8995 and #9763) -- so '
-      + 'that file\'s repo-wide *.object.ts walk stays visible to the gate holding plugin-auth\'s '
-      + 'declared input radius. It contributes nothing to this pile any more.',
+      + 'package took +3 inside the hour, the same "a ledger number is a number about a moment" race that '
+      + 'kicked #5278 three times, so 111 was the merge-queue run\'s own re-measure on the ref that PR '
+      + 'actually landed on. Of the +2 that had made 131, half is a TS2554 in src/last-admin-guard.test.ts, '
+      + 'a file added by #5941 / PR #5993 (the break-glass delete guard); the other 1 landed in a file that '
+      + 'already existed and is not attributed further. Then 111 -> 110 in PR #10013 -- the number moved '
+      + 'and the note did not, which is how a composition written at 131 was still sitting over an entry '
+      + 'reading 110 -- and 110 -> 109 (#9694), where src/managed-extension-fields.test.ts stopped seeding '
+      + 'from `import.meta.url` (a meta-property module: NodeNext forbids in this CJS-typed package) and '
+      + 'now seeds from `__dirname`, which type-checks here AND is a spelling '
+      + 'check:cross-package-test-inputs resolves -- that gate publishes the current set verbatim in its '
+      + 'failure text, deliberately not restated as a count here because a count drifts silently (widened '
+      + 'twice, #8995 and #9763) -- so that file\'s repo-wide *.object.ts walk stays visible to the gate '
+      + 'holding plugin-auth\'s declared input radius. It contributes nothing to this pile any more.',
   },
   '@objectstack/mcp': {
     errors: 53,