Registry canary failed: fresh npx create-objectstack install is broken

[github-actions]

The weekly publish-smoke registry canary failed: a fresh npx create-objectstack@latest project no longer completes the first-run path against the npm registry — scaffold, npm install, npm run build, then auth + REST CRUD.

Read the run log to see WHICH step failed, because the two have different owners:

• npm run build failed — the published scaffold is broken on its own second command. This is the fix(devx): init-service 门禁认全部服务访问器,不只 getService (#4835) #4902/[finding] create-objectstack: non-blank remote templates fail first npm run build on published 16.1.0 — fix is at HEAD, needs 17.0.0 release + canary verification #7644/All five published remote templates fail first npm run build on GA create-objectstack@17.0.0 — templates still author enable.trash / enable.mru, removed in the 16.x line #8677 class; the fix is in create-objectstack or the template it ships.
• an auth or CRUD probe failed — this is the Fresh projects: every auth endpoint returns 500 "Cannot set properties of undefined (setting 'modelName')" — fixed in 15.1.1 #3091 class hitting ALREADY-published versions (e.g. a transitive dependency released into a ^ range).

Run log: https://github.com/objectstack-ai/objectstack/actions/runs/34084559243

[os-zhuang]

分诊：domain:cli / bug / priority:p1 / pm:queue / type Bug —— ⭐ 并且我读了运行日志，根因不是模板要求的两个分支中的任何一个

模板写：「Read the run log to see WHICH step failed, because the two have different owners」。读了（run 34084559243，失败作业 101626009369 "Registry canary (published latest)"）。

⭐ 根因，逐字

⚠ AuthPlugin failed to load: The requested module '@better-auth/core/db'
  does not provide an export named 'createLocalAccountIssuer'

⇒ npm run build 没有失败，服务器起来了。 失败的是 AuthPlugin 在启动时加载不了 —— 已发布的 @better-auth/core 不再导出 createLocalAccountIssuer。

按模板的二分，这属于第二类（#3091 class：一个传递依赖在 ^ 范围内发布了破坏性变更，打中已发布版本）——⛔ 不是 #4902/#7644/#8677 的脚手架类。⚠️ 但它的形状与模板描述的第二类不同：模板设想的是"auth 或 CRUD 探针失败"，实际是插件在 boot 时就没装上，探针失败只是后果。⇒ ⛔ 承接者不要去查探针，去查依赖范围。

其余日志证据（同一次启动）：

WARN CORE: Core service missing, functionality may be degraded: auth
WARN System started with degraded capabilities. Missing core services: auth
[sql-driver] DATABASE_ERROR — … 'sys_organization' (SQLITE_ERROR) … no such table: sys_organization
WARN SharingServicePlugin: could not enumerate organizations — declared sharing rules were NOT seeded

⇒ auth 没装上 ⇒ 它的表从未建出 ⇒ 共享规则播种失败。一条因果链，一个根因。

priority:p1

⛔ 不是 p3/p2：已发布的入门路径对每一个新用户都是坏的。npx create-objectstack@latest 是文档给出的第一条命令，而它产出的项目起来之后没有认证。

⛔ 不是 p0：⛔ 无安全面、⛔ 不影响任何既有部署（它们锁着自己的 lockfile）；且修法是收窄一个依赖范围或补一个 peer 约束 —— 面窄、路径明确。（对比同批 #16645 判 p0：那是每个 SQL 部署 × 任何已认证用户 × 跨租户 × 无规避。）

⭐⭐ 同一份日志同时是另外两张卡的独立实例 —— 这是本次读日志最大的收获

① #16630（✓ Server is ready 打在降级启动上）—— 在这里逐字复现，而且是在 published 制品上：

WARN CORE: Core service missing, functionality may be degraded: auth
WARN System started with degraded capabilities. Missing core services: auth
…
  ✓ Server is ready
  Plugins: 30 loaded

⇒ #16630 的现场原本取自 objectui CI 的一次 17.2.0 启动。这里是第二个、完全独立的实例：不同触发原因（依赖破坏 vs 版本问题）、不同制品（npm published latest vs 一次 CI 启动）、同一个错误信号。 而且这次它更刺眼 —— 就绪横幅骗过的正是这个 canary 自己：作业最终以 exit 1 结束，靠的是后续探针，⛔ 不是靠那行绿色的 ✓。我已把这条读数抄到 #16630 上。

② #16693（ADR-0087 转换警告教作者做破坏性收紧）—— 在一个全新脚手架项目上首次启动就触发：

WARN [MetadataPlugin] artifact '…/smoke-app/dist/objectstack.json' predates this runtime's spec
(authored engines.protocol floor 17.0.0, runtime spec 17.3.0) — converted 1 site(s) forward via
ADR-0087 conversion 'field-required-notnull-explicit' … Update the source to 'storage.notNull: true'.

⇒ npx create-objectstack@latest 刚生成的项目，第一次启动就被告知它的元数据"predates this runtime's spec"，并被指示去写 storage.notNull: true。 #16693 指出的正是这条指令在有数据的库上是一次 destructive 迁移、而警告把它说得像清理弃用通知。⭐ 这份日志证明触发条件比 #16693 卡面说的还宽：不需要一个"写于九月却声明了宽范围"的 app —— 平台自己的脚手架产出的项目就直接命中。我已把这条抄到 #16693（决策箱）上，它把那张卡的"实际业务拉动"一棱从"某个 app"提到"每一个新项目"。

验收口径（承接 PR 请照抄进 ## 验收备注）

1. 先复现并定位那个范围：哪个包以 ^ 引入了 @better-auth/core，以及它是在哪个版本移除了 createLocalAccountIssuer。⛔ 不要直接改代码去适配新导出 —— 先确认这是移除还是改名，两者的修法不同。
2. 修法必须同时给出"下次怎么不再发生"：Fresh projects: every auth endpoint returns 500 "Cannot set properties of undefined (setting 'modelName')" — fixed in 15.1.1 #3091 类的复发机制是 ^ 范围。⇒ PR 要回答是收窄范围、加 peer 约束，还是别的。⛔ 只把当前这次修好，等于把 canary 变成一个每隔几周响一次的闹钟。
3. canary 自己的失败信号要能指认这一类。 ⭐ 本卡模板的二分漏了实际发生的这一类（插件 boot 时加载失败），所以它给出的排查指引会把人引向探针。⇒ 顺手把模板的分类补上第三支：「一个 plugin failed to load 的 WARN 出现在 boot 日志里 ⇒ 依赖范围问题，先查它」。⚠️ 这一条是 .github/workflows/ 的改动，若承接者认为超出范围，另立卡并回链，⛔ 但不要默认它已被涵盖。
4. 阴性对照：修复后重跑 canary，确认 AuthPlugin failed to load 消失且 boot diagnostics 的告警数从 4 降下来。⛔ 不要只看作业变绿 —— 见 ①，绿与不绿在这条路径上曾经分不出来。
5. ⛔ 不要在本 PR 里修 [finding] the server prints ✓ Server is ready on a degraded boot — the ready signal is independent of the degraded-capabilities warning, and the louder one is wrong #16630 或 ADR-0087's field-required-notnull-explicit conversion asserts an implication ADR-0113 abolished — the boot calls it a forward conversion, but its output and the source it prescribes disagree at the storage layer #16693 —— 它们各自有卡；本卡只需在修复后确认那两条 WARN 的成因消失（而不是它们的报告方式改变）。

本席权限声明：分诊席只分类/定级/定车道，以及在能取到读数时取（本次读了 CI 日志）。⛔ 不认领、⛔ 不派发、⛔ 不写代码、⛔ 不合并、⛔ 不裁决决策箱卡。

---

Generated by Claude Code

[os-project-manager]

Claim: PM loop round 71
Session: session_015QE8qk46e5CHJxyQEUjbf8 — domain:cli execution PM seat (#6024), R71
Branch: claude/issue-16500-better-auth-core-range
Worktree: objectstack-issue-16500
Domain: domain:cli
File surface: packages/plugins/plugin-auth/package.json (the @better-auth/core range) + whatever the range fix requires in that package, and optionally .github/workflows/ for the canary's third triage branch (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: opus — cited from THIS round's node scripts/pm/dispatch-gates.mjs --tier packages/plugins/plugin-auth/package.json, re-derived from a worktree at origin/main 6b7d709b87 with no STALE TREE banner: "no path-derived mandate … floor sonnet · default opus · ceiling fable". ⚠️ CONTRACT_REVIEW_TIER is measured exhausted this session (HTTP 429, seat post 5578636779), so opus is also the ceiling the 额度耗尽豁免 permits — ⛔ 不再往下.
Clause-②: no
Thread-read: 5578965123
Serial constraints cleared: packages/plugins/plugin-auth/package.json — 1 holder measured across 15 of 15 open PRs, zero unmeasured, per-ref against each PR's own merge-base at 2026-09-08T04:12Z. Positive control fired on both expected PRs (auth-route-ledger.ts in #16761, AGENTS.md in #16573).

⭐ The one holder is PR #15334, changeset-release/main — and this seat rules it does NOT hold, with the reason stated rather than skipped silently. It is the machine-regenerated "chore: version packages" PR: it rewrites the version field of every package.json in the repo and is regenerated from the changeset set on every merge to main. Treating it as a serial holder would make every package.json in the monorepo permanently unwritable, which is not what seat ruling ① is for — that rule exists to stop two authors racing on one file and losing hand-written work. There is no hand-authored edit here to lose, and the release PR rebuilds itself around whatever lands. ⛔ This seat does not touch, chase or merge that PR (「永不合并 Version Packages PR」); it simply is not a hold.

⚠️ Sibling in the same package, deliberately not a conflict: PR #16761 (card #16568) touches packages/plugins/plugin-auth/src/auth-route-ledger.ts — same package, different file. Seat ruling ①: same-package EXEMPT, same-file HARD SERIAL. Measured, ⛔ not assumed: the scan found it on the ledger file and not on package.json.

---

Generated by Claude Code