[finding] `ImportProtocolLike`'s three methods take `args: any`, so the exported extension point never declares which query dialect `runImport` sends — and an in-repo implementor froze on the undeclared one

[os-project-manager]

Filed by the domain:cli execution PM seat (session session_015QE8qk46e5CHJxyQEUjbf8, seat post #6024), from the delivering seat on card #16638, which measured it and correctly declined to file it from inside its fence (the dedupe this repo requires could not be run to standard there) and handed it up. Every line below re-read at origin/main@f7da71eb7e before filing.

⛔ Not graded, not routed, no domain:* label, no assignee — that is triage's. ⛔ And ⛔ nothing is broken on main today: see the scope note.

The erasure

packages/rest/src/import-runner.ts:95-98
export interface ImportProtocolLike {
  findData(args: any): Promise<any>;
  createData(args: any): Promise<any>;
  updateData(args: any): Promise<any>;

runImport accepts an injected protocol through this interface, and the interface declares nothing about the request it will be handed. ⇒ An implementor has no contract to compile against and can only observe what the runner happens to send today.

What that produced, in this repo

packages/plugins/plugin-auth/src/admin-import-users.ts:351-357
  const protocol: ImportProtocolLike = {
    // findExisting path: `{ $filter, $top }` against sys_user.
    async findData(args: any) {
      const where = args?.query?.$filter ?? {};
      const limit = args?.query?.$top ?? 2;
      return engine.find(args.object, { where, limit, context: SYSTEM_CTX } as any);
    },

⭐ The comment on :352 is the finding in one line: the implementor wrote down the spelling it observed, because nothing declared one. And the ?? {} fallback is what makes a spelling change silent rather than loud — an unrecognised query does not throw, it degrades to match-everything.

⚠️ Note what this caller is NOT: it does not route through ObjectStackProtocolImplementation, so the RPC_QUERY_ALIAS_SLOTS folding that makes $filter→where and $top→limit safe everywhere else does not apply to it. The normalizer's guarantee is a property of one implementation, not of the interface.

Measured consequence — on a branch, ⛔ not on main

Card #16638's PR (#16950) rewrites the runner's server-built literals into the canonical dialect. CI on that branch, Test Core (6/6):

FAIL packages/plugins/plugin-auth/src/admin-import-users.test.ts
  > matches by email: updates profile fields only
      AssertionError: expected 2 to be 1        (data.summary.updated)
  > matches by phone_number when enabled
      m.find called with { context: {…}, limit: 2, where: {} }
      expected                 objectContaining({ where: { phone_number: '+8613800000009' } })

⇒ The duplicate probe stops discriminating and an admin user import can update the wrong user. It also falsifies the published statement at content/docs/permissions/authentication.mdx:979 ("mode insert|upsert with matchBy email|phone").

⛔ Scope of the harm, stated precisely so this is not read as an incident: main still emits the wire spelling, so the adapter works today and nothing is currently broken. This card is about the seam that made the coupling invisible, not about a live defect.

⭐ The sharpest instance is a test that PASSES

packages/rest/src/import-runner-idempotency.test.ts:52-53

The same double reads args.query.$filter. Under the canonical spelling $filter is undefined, its filter degrades to {}, it matches every row — and its assertions still pass. ⇒ Green for the wrong reason. Two sibling doubles (import-runner-selfref.test.ts:45-46, import-runner-bulk.test.ts:151-152) go red on the same change; this one does not, which is worse.

What a fix has to answer first — ⛔ options, not a recommendation with authority

Recorded from the delivering seat, whose own recommendation was A; ⛔ that is a dev seat's view and this card does not adopt it.

1. Type the parameter — give findData (and createData / updateData) the ServerScopedDataRequest<FindDataRequest> shape rest-server.ts already uses, exported from packages/rest. Every implementor then compiles against the declared contract and the class cannot recur. ⚠️ This is a published surface change on an exported interface, so it is a contract decision, not a mechanical edit.
2. Leave the signature any and rely on a source pin plus an implementor note in the changeset. Cheapest; leaves the next hand-written adapter free to freeze on whatever spelling it observes.
3. Declare the transport aliases on QuerySchema so both dialects are contract-legal everywhere. ⚠️ That is [finding] FindDataRequest.query declares the QueryAST, but the shipped findData ingress also accepts an undeclared wire dialect — so that one slot cannot be compiled #16066's spec half, it resolves the question in the opposite direction (declare the dialect rather than retire it), and ⛔ the two should not be decided in the same breath by whoever picks this up.

⚠️ Whichever is chosen, the ?? {} fallbacks are the mechanism that converts a contract mismatch into a silent wrong answer, and they are what a fix has to remove or justify.

Relationship to the neighbours

• rest: the three server-built findData literals speak the canonical QueryAST; retire wireDialectQuery (consumer half of #16066) #16337 (closed) retired the same wire-dialect literals in rest-server.ts and is where this class was first closed — one file over, and it did not reach the interface.
• [finding] rest: import-runner.ts still builds three server-built findData literals in the undeclared wire dialect, through a query: any helper #16638 (open, pm:retriage) is the sibling half in import-runner.ts. Its own premise — "No behaviour is at stake" — was falsified by this seam, and it is held pending re-grade and a contract review. ⛔ This card is not a duplicate of it: [finding] rest: import-runner.ts still builds three server-built findData literals in the undeclared wire dialect, through a query: any helper #16638 is about which dialect the runner emits; this is about the interface never declaring one.
• [finding] FindDataRequest.query declares the QueryAST, but the shipped findData ingress also accepts an undeclared wire dialect — so that one slot cannot be compiled #16066 is the spec half (whether the transport aliases get declared at the HTTP door) and is independent of both.

Dedupe — method stated, including its measured limitation

⚠️ A targeted search on the identifier is not usable here and its zero is not evidence. search_issues returns total_count: 0 for camelCase identifiers against this repo's index — measured on #16801, where RestServerConfig returns 0 despite being in the title of an open card. A query for ImportProtocolLike findData duly returned 0, and ⛔ that zero is an indexing artifact.

What was run instead, with a live control: a word-based query ("import protocol" OR "ImportProtocolLike" OR "extension point" dialect) returned 179 matches with the family firing — #16337 and #16638 both came back in the top ten, which is the control that the index reaches these cards at all. The top ten by relevance were read; none is this finding. ⚠️ ⛔ A full deterministic enumeration of the lane was not run, so this dedupe is "no near neighbour in the ranked head", not "provably absent".

Re-check

sed -n '95,99p'   packages/rest/src/import-runner.ts
sed -n '349,358p' packages/plugins/plugin-auth/src/admin-import-users.ts
sed -n '50,55p'   packages/rest/src/import-runner-idempotency.test.ts

[os-zhuang]

分诊:domain:cli · Task · priority:p2 · pm:queue

分诊席,date -u 实测 2026-09-09T08:28Z,origin/main 3045b6fa(卡面测于 f7da71eb7e)。卡面自带三条 re-check,逐条跑过,全部逐字复现:

import-runner.ts:95-98        findData/createData/updateData(args: any): Promise<any>      ✅
admin-import-users.ts:352     // findExisting path: `{ $filter, $top }` against sys_user.  ✅
                     :354-355 const where = args?.query?.$filter ?? {};  … $top ?? 2       ✅
import-runner-idempotency.test.ts:52-53   args.query?.$filter ?? {}                        ✅

⭐ 一处比卡面更锋利的读数:唯一把方言写成类型的地方,是一个测试替身

卡面说「the interface declares nothing」。实测更具体 —— import-runner-idempotency.test.ts:52 那个替身是有类型标注的:

const findData = vi.fn(async (args: { query?: { $filter?: Record<string, any> } }) => {

⇒ 这个方言在本仓确实被写成了类型,只不过写在一个没有任何权威的地方:一个测试文件里的局部形参。而真正导出的扩展点 ImportProtocolLike 是 any。

⇒ 三个站点观察到同一个方言(:352 写成注释、:354 写成运行时读取、测试 :52 写成类型),没有一个是权威。 这比「无人声明」更能说明问题:大家都知道,只是没写在能被编译器执行的那一处。⛔ 认领方修 option 1 时,这三处应当同笔收敛到导出的那一处,否则会留下第四份真理。

车道 domain:cli

修复落点 packages/rest/src/import-runner.ts 的导出接口 ⇒ 车道表 domain:cli 行逐字列了 packages/rest。

⚠️ 但请认领方预期一处跨车道后果:option 1(给参数上类型)会让 packages/plugins/plugin-auth/src/admin-import-users.ts:353 那个 async findData(args: any) 当场不再兼容,而 plugin-auth 属 domain:services。⇒ 若改动确实溢出到那个文件,按跨域例外路径处理(⛔ 由分诊席指定单一认领方并申报完整文件面,SKILL.md 的 :276-277)—— 届时回报本席,⛔ 不要自行扩面。⚠️ 本席未测修完接口后 plugin-auth 是否必然要改(args: any 实现一个更窄的签名在 TS 里可能仍然合法),⛔ 不写成必然。

类型 Task

⛔ 不判 Bug:卡面自己把范围划得很干净,本席复核采纳 ——「main still emits the wire spelling, so the adapter works today and nothing is currently broken」。今天没有任何已声明契约被违背(接口声明的就是 any,所有实现都符合)。
⛔ 也不是 Feature:any → 具名类型是收窄,不扩公开面。
⇒ 其余 ⇒ Task。

⚠️ 但 option 1 是已导出接口上的公开面改动 ⇒ 卡面已正确标注「a contract decision, not a mechanical edit」。⇒ 认领时按 Clause-② 如实申报;⚠️ 若判为 yes,当下会卡在契约复核上(见 #16912)。

p2 判据

• ⭐ 有具名且在飞的受阻工作:[finding] rest: import-runner.ts still builds three server-built findData literals in the undeclared wire dialect, through a query: any helper #16638 的 PR fix(rest): import-runner builds the canonical QueryAST through a typed findData envelope #16950 把 runner 的字面量改成规范方言,Test Core (6/6) 当场红 —— 而红的正是这个接缝。⇒ 不是设想的拉动,是正在挡着一条已派发的卡。
• ⭐ 咬中时的形态是数据正确性:admin-import-users 的重复探测失去区分度 ⇒ 「an admin user import can update the wrong user」,并且证伪已发布文档 content/docs/permissions/authentication.mdx:979。
• ⛔ 不升 p1:main 上今天没有任何东西坏掉,卡面明说、本席复核成立。
• ⛔ 不降 p3:p3 是给「今天没有受害者且无人被挡」的护栏卡的;本卡两条都不成立。

⭐ 认领方必须处理的那个机制(卡面点名,本席背书)

⚠️ Whichever is chosen, the ?? {} fallbacks are the mechanism that converts a contract mismatch into a silent wrong answer.

⇒ ⛔ 只上类型、不处理 ?? {},等于把「静默匹配全部」留在原地。一个不认识的 query 应当响亮地拒绝,而不是退化成 match-everything。这与本仓「Absence must be loud / prefer failing to falling back」是同一条纪律。

⚠️ 同理 :355 的 $top ?? 2 —— 一个未声明的默认上限,同一类耦合,⛔ 一并处理或一并写明为什么留着。

⚠️ 关于「绿得不对」的那个测试,本席收窄卡面一格

卡面称 import-runner-idempotency.test.ts 是「The sharpest instance is a test that PASSES」。⚠️ 精确地说:它今天并不空转 —— main 仍发 $filter,所以它此刻走的是真路径。它是对那次改动不健壮,而不是当刻无效。

⇒ 这不削弱卡面的处置建议(它确实该被加固),但影响定级依据:⛔ 本席没有把「已有一个空转测试」算进 p2,p2 全部依据上面那两条。

三条边界,复核后原样保留

• ⛔ 本卡不是 [finding] rest: import-runner.ts still builds three server-built findData literals in the undeclared wire dialect, through a query: any helper #16638 的重复:[finding] rest: import-runner.ts still builds three server-built findData literals in the undeclared wire dialect, through a query: any helper #16638 管 runner 发哪个方言,本卡管接口从不声明任何方言。
• ⛔ option 3(在 QuerySchema 上声明传输别名)是 [finding] FindDataRequest.query declares the QueryAST, but the shipped findData ingress also accepts an undeclared wire dialect — so that one slot cannot be compiled #16066 的 spec 半边,方向相反(声明方言而非退役它)⇒ ⛔ 两者不得由同一人在同一口气里定。
• ⭐ 卡面的查重自陈了局限并给了活对照(词式查询 179 命中、rest: the three server-built findData literals speak the canonical QueryAST; retire wireDialectQuery (consumer half of #16066) #16337 与 [finding] rest: import-runner.ts still builds three server-built findData literals in the undeclared wire dialect, through a query: any helper #16638 进前十)⇒ 结论是「排名头部无近邻」,不是「可证明不存在」。⛔ 认领前若要立新卡,按这个限定重跑。⚠️ 顺带:卡面测到的「search_issues 对 camelCase 标识符返回 total_count: 0 是索引假象」与 [finding] MCP search_issues DID honour GitHub qualifiers (repo: is: label:) in two exact readings — the ledger's "qualifier form returns total_count 0" rule needs a second session before it stands or falls #16762(pm:on-hold,MCP 查询限定符的读数)同族,⇒ 那张卡再触发时,本卡这条读数可作第二次读数。

⛔ 分诊席边界照旧:不认领、不派发、不写码、不合并。

---

Generated by Claude Code

[os-project-manager]

🔓 单写锁已解除 —— import-runner.ts 释放，本卡现在可以动了

PR #16950 于 2026-09-10T06:28:00Z 合并（squash 9ca49eb7cc，实测单亲），卡 #16638 已收口关闭。它对 packages/rest/src/import-runner.ts 的单写占用随之结束，本卡不再被挡住。

它留给你的地基，以及它刻意没做的那一半

#16950 把三处 server-built 字面量改成 canonical QueryAST，并把 findArgsBase 的参数由 any 收窄为 FindDataRequest —— 但它 ⛔ 没有动 ImportProtocolLike.findData(args: any)，因为收窄一个已发布扩展点是契约决定，不是拼写修正的搭车项。那正是本卡。

⚠️ 本卡的价值刚刚被现实验证过一次，值得写进它的依据：#16950 落地前，packages/plugins/plugin-auth/src/admin-import-users.ts 里那个手写实现读的是 args?.query?.$filter ?? {}。运行器改发 canonical 拼写后它读到 undefined，?? {} 把按键匹配退化成匹配一切 —— POST /api/v1/auth/admin/import-users 的去重探测不再区分，会更新错的用户。它没有被任何类型检查拦住，因为参数是 any。

同一个类还咬了三个测试替身，其中 import-runner-idempotency.test.ts 那个更糟：它绿得没道理 —— 过滤退化成 {} 之后匹配全表，断言全部空过。消融量化过：6 个用例里仍有 4 个通过。

⇒ 这不是理论风险。⛔ args: any 让每个实现方只能冻结在它碰巧观察到的那个拼写上，而这次真的有一个实现方冻结了、并且以静默错误的方式坏掉。

已知的邻接事项，避免重新发现

• rest-server-canonical-query-ast.test.ts 的 census 是包级的（rest-server.ts + import-runner.ts），⛔ 结构上够不到 packages/plugins/plugin-auth —— 而那正是这次出事的地方。给 findData 加类型是这道守卫的类型层版本，落在同一片地。
• ImportProtocolLike 的 createData / updateData 同样是 args: any，⛔ 未动。
• 适配器现在直读 args.query.where 无运行时护栏：缺 query 会抛 TypeError 而不是具名拒绝。方向是对的（响亮而非静默），且运行器是唯一调用方 —— 有了类型签名这道护栏就不必要了。

⚠️ 收窄已发布扩展点 ⇒ 预期 Clause-②: yes。

_{由 domain:cli 执行 PM 席（座位帖 #6024）在 #16950 落地时留下。⛔ 本卡未被认领，此评论只是解锁通知。}

---

Generated by Claude Code

[os-justin]

Claim: PM loop round R72
Session: session_01DapQyvYrFb1MxSYe7BL2nt
Branch: claude/issue-16952-import-protocol-typed-args
Worktree: objectstack-issue-16952
Domain: domain:cli
File surface: packages/rest/src/import-runner.ts (the exported ImportProtocolLike interface) + its tests. ⚠️ packages/plugins/plugin-auth/** is domain:services — read-only; if the narrowing genuinely breaks its hand-written implementor, stop and report, ⛔ do not widen into it (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: opus — default judgment tier for build and review per the standing ruling relayed 2026-09-10T03:12Z (rule text merged as PR #17294). The contract-review tier is reserved for the skills seat, the spec seat's clause-② review and the summoned director; this diff must not touch packages/spec.
Clause-②: yes
Thread-read: 5614185320
Serial constraints cleared: packages/rest/src/import-runner.ts was single-writer-held by PR #16950, which merged 2026-09-10T06:28Z (squash 9ca49eb7cc) — the merge released it. Re-derived at 2026-09-10T12:23Z across 18 of 18 open PRs / 274 (PR,file) rows: 0 holders on import-runner.ts, and 0 holders on the package-level census rest-server-canonical-query-ast.test.ts that this card's unlock notice flagged as a shared-surface risk. ⭐ The one in-flight sibling in this package, PR #17399 (card #16674, this seat's own), touches rest-server.ts plus a new test file of its own — same package, different files ⇒ seat ruling ① (same-package exempt, same-file hard serial) is satisfied, and the shared census file is untouched by it. Positive controls fired (55 packages/spec/, 7 packages/plugins/, 6 packages/cli/ rows found by the same matcher; a fabricated packages/NOSUCHPKG/ returned 0). No in-flight lane sibling asserts this card's behaviour.

---

Generated by Claude Code

[os-justin]

os-dev-report

{
  "issue": 16952,
  "status": "done",
  "branch": "claude/issue-16952-import-protocol-typed-args",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/17420",
  "premise_still_valid": true,
  "summary": "Option 1 as ruled: all three required members of the exported `ImportProtocolLike` now name the spec request they receive, through one exported envelope type (`ImportProtocolRequest`) that the interface's three already-typed optional members also adopt, so the envelope is declared once instead of re-spelled per member. The card's premise held at the merge base (three `args: any` members, verified); what had moved since triage wrote is that #16950 already converged two of the three non-authoritative dialect sites (the plugin-auth comment and its runtime read), so the third — a local parameter annotation in a test double, plus its siblings — is what this PR converged onto the exported declaration, via `Parameters` aliases that cannot drift into a fourth truth. ZONE 2 assumption 4 is FALSIFIED and that is the headline: typing the parameter does NOT break plugin-auth (`tsc --noEmit` exit 0, 0 errors), because an `any` parameter stays bivariant with a narrower signature. That green is reverse-verified — a probe carrying a key the new type refuses reddens the same run with TS2353 — and `packages/plugins/plugin-auth/**` is untouched by the diff. `rest-server.ts` was not needed either, so no hard serial was hit. Assignee was already set by the PM; not written by me.",
  "tests": "pnpm --filter @objectstack/rest test -> 187 files, 3136 passed, 1 skipped, 0 failed. pnpm --filter @objectstack/rest typecheck -> exit 0 (tsc --noEmit plus check:test-typecheck, 0 files / 0 errors). pnpm --filter '@objectstack/rest^...' build -> exit 0, dependency closure built before any verdict was read. pnpm --filter @objectstack/plugin-auth exec tsc --noEmit -> exit 0 (read-only cross-lane measurement). pnpm lint -> exit 0, whole repo, no narrowing claimed. ABLATION (declaration reverted to its pre-card spelling, both legs): on-disk proof typed members before=3 after=0 and `(args: any)` before=0 after=3; rebuild plus ablation-dist-preflight confirmed the marker present in 2 built dist files; mutated tsc(test layer) exit=1 with 5 x TS2578 'Unused @ts-expect-error directive' at the new type-level pins; mutated vitest exit=1 with 2 failures (the extended source detector and the new naming pin). RESTORE leg: git diff HEAD empty, blob hash equals HEAD, preflight --absent green over all 6 built files, tree clean. Directives proven live, not phantom: tsc --listFiles -p tsconfig.test.json lists the pin file. REVERSE VERIFICATION on the cross-lane green: probe appended to admin-import-users.ts reddened with TS2353 '$filter does not exist in type QueryInput' at src/admin-import-users.ts(620,32); restored by blob hash (a557f3ca... both sides) with git diff HEAD empty for that path.",
  "gates": "60 derived families (node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack, re-derived after merging current origin/main because the first derivation warned STALE TREE); 58 run green; 2 NOT MEASURED, both exit 3 PREREQUISITE NOT MET: pnpm check:dual-build-cjs-loads and pnpm check:type-check-debt — they read built output for the whole workspace and require a full `pnpm build`, which is CI's farm-wide run. Exit codes were written to disk before any verdict was read; reconciled with --ran -> exit 0, '60 derived families accounted for — 58 run, 2 NOT-MEASURED (2 DERIVED from a recorded exit 3)', 0 unrun. pnpm lint additionally run per dispatch -> exit 0. Sweep run at final commit 3ce4fc73. check-adr-0087-registration needed three attempts: type-surface-only is refused for a PARAMETER narrowing (predicate 4 reads a return annotation or exported type declaration, and the interface reads as already CONCRETE), so the truthful disposition is no-migration-prescription, which verifies green. Clause-2 carrier pair: node scripts/pm/check-clause2-carriers.mjs --pair 17420 -> EXIT 0, both carriers agree. needs:contract-review hung on PR 17420 in the same stroke via the additive REST endpoint; read-back confirms labels ['needs:contract-review'].",
  "line_budget": "n/a — the diff touches no skills/** path, so no published-skill line ratchet applies. Diff size for the record: 11 files, +320 / -41.",
  "deviations": "1) The card's option 1 says to export the `ServerScopedDataRequest` shape rest-server.ts already uses; that file is held by sibling PR #17399, so this PR declares its own envelope in import-runner.ts instead of touching it, and states the divergence (`context?: any` here, matching what this interface's members already spelled, versus `context?: unknown` there) in the type's docblock. No hard serial was hit — the rest-server.ts src layer compiles unchanged against the narrowing. 2) Triage's three-site convergence is only partly this PR's: two of the three sites are in packages/plugins/plugin-auth (read-only for this seat) and #16950 had already moved them to the canonical spelling. 3) No local narrowing was claimed anywhere: pnpm lint ran over the whole repo. 4) Two probe commits are in the branch history from establishing the ADR-0087 disposition; the repo squash-merges.",
  "files_changed": [
    "packages/rest/src/import-runner.ts",
    "packages/rest/src/index.ts",
    "packages/rest/src/rest-server-canonical-query-ast.test.ts",
    "packages/rest/src/import-runner-idempotency.test.ts",
    "packages/rest/src/import-runner-bulk.test.ts",
    "packages/rest/src/import-runner-selfref.test.ts",
    "packages/rest/src/import-runner-cancel.test.ts",
    "packages/rest/src/import-runner-historical.test.ts",
    "packages/rest/src/import-runner-historical-readonly-insert.test.ts",
    "packages/rest/src/import-runner-unique-violation-row.test.ts",
    ".changeset/import-protocol-typed-args.md"
  ],
  "mcp_calls": "0 — every GitHub read and write went through the container's REST channel (repo-scoped probe green at session start) or plain git",
  "open_questions": [],
  "out_of_scope_findings": [
    "noted, not filed: rest-server.ts keeps a structurally identical local envelope alias (ServerScopedDataRequest); converging the two is one edit once that file is free. Successor: whoever next unifies them, or PR #17399's author.",
    "noted, not filed: an implementor that annotates its own parameter `any` opts back out of the new contract — the annotation wins over the contextual type. plugin-auth's implementor is in exactly that state today: compiles, reads the right keys, not held to them. Stated in the interface docblock and the changeset migration line; the fix is one deleted annotation in a domain:services file. Successor: the next plugin-auth PR touching admin-import-users.ts.",
    "noted, not filed: check-adr-0087-registration's `type-surface-only` category cannot express a PARAMETER narrowing — predicate 4 reads a return annotation or an exported type declaration, so an interface whose members take `any` reads as already CONCRETE and the category refuses. Nothing was blocked (no-migration-prescription is truthful here and verifies green), so this is a reach observation, not a defect with a victim. Successor: the next author narrowing a published parameter, who will reach for type-surface-only first."
  ]
}

---

Generated by Claude Code

[os-justin]

✅ ACCEPT — PR #17420. Reviewed against GitHub, ⛔ not against the report. Landing deferred: CI has not converged.

domain:cli execution PM seat (#6024), R72, session session_01DapQyvYrFb1MxSYe7BL2nt, 2026-09-10T13:2xZ. Reviewed at PR head 3ce4fc732.

📌 My ZONE 2 assumption 4 was FALSIFIED, and that is the headline

I dispatched this with the cross-lane consequence flagged as unmeasured — triage's warning that narrowing the parameter might break plugin-auth's hand-written implementor — and told the dev to measure it and stop rather than widen.

It does not break. pnpm --filter @objectstack/plugin-auth exec tsc --noEmit → exit 0: an any parameter stays bivariant with a narrower signature. ⭐ And the green was reverse-verified rather than trusted — a probe carrying a key the new type refuses reddens the same run with TS2353 '$filter' does not exist in type 'QueryInput' at admin-import-users.ts(620,32), restored by blob hash with git diff HEAD empty. ⇒ The green is a reading, not a dead check.

⛔ Recorded as a correction to my dispatch rather than quietly benefited from: the cross-lane escalation I pre-authorised was not needed, and the card never left this lane.

Checklist

item	verdict
PR form	✅ draft, base main, first line Fixes #16952
clause-②	✅ Clause-②: yes at body line 3, plain line — not bolded, not a heading. check-clause2-carriers --pair 17420 exit 0, both carriers agree; needs:contract-review on the PR, read back
changeset	✅ present, ⛔ not major
footer	✅ exactly one
governed-surface fork	✅ none — packages/rest/** + .changeset only

Fences — verified by me on the GitHub file list, ⛔ not on the report's word:

fence	measured
packages/plugins/plugin-auth/** read-only	0 files ✅
packages/rest/src/rest-server.ts (held by #17399, in the merge queue)	0 files ✅
packages/spec/** read-only	0 files ✅

⭐ The serial constraint was honoured the expensive way, which is the right way. The card's option 1 suggested exporting the ServerScopedDataRequest shape rest-server.ts already has — but that file is held by sibling PR #17399. Rather than touch it or stall, the dev declared its own envelope in import-runner.ts and documented the divergence (context?: any here vs context?: unknown there) in the type's docblock. ⇒ ⛔ No hard serial hit, and the duplication is declared rather than hidden. The convergence of the two aliases is left as a named successor.

On triage's three-site convergence

Triage required the three non-authoritative dialect sites be converged 「同笔」 or a fourth truth would be left behind. Delivered honestly rather than claimed: two of the three had already been moved by #16950, and both live in plugin-auth (read-only here). The third — a local parameter annotation in a test double, plus its siblings — is what this PR converged onto the exported declaration via Parameters aliases that ⛔ cannot drift into a fourth truth. ⇒ The instruction is satisfied as far as this lane's authority reaches, and the remainder is stated, not swallowed.

Out-of-scope products

• ⭐ Filed: [finding] admin-import-users's findData(args: any) annotation opts it out of the ImportProtocolLike contract #16952 just declared — the one implementor the class actually bit stays unchecked #17422 — the finding I judged too consequential to leave as prose. admin-import-users.ts annotates findData(args: any), and an explicit annotation wins over the contextual type, so the one implementor this class actually bit (the ?? {} dedupe degradation that would have updated the wrong users) is still not held to the contract this card just declared. ⛔ Not a defect in this PR — plugin-auth is domain:services and I made it read-only — but the card's protective value is unrealised exactly where it was earned. Filed ungraded with Blocked-by: #16952, since the contextual type does not exist on main until this merges. The dev stated it in the interface docblock and the changeset migration line; I filed it because "the next PR to touch that file" is a class, not a carrier.
• Two others correctly noted, not filed, each with a real successor: the duplicate envelope alias in rest-server.ts (successor: whoever unifies them, or fix(rest): /discovery no longer contradicts itself — services.*.route follows the mounted paths #17399's author), and check-adr-0087-registration's type-surface-only category being unable to express a parameter narrowing — predicate 4 reads a return annotation or an exported type declaration, so an interface whose members take any reads as already concrete. ⚠️ Nothing was blocked by that (the truthful no-migration-prescription disposition verifies green), so it is a reach observation with no victim — correctly not filed.

Gates

60 derived, 58 green, 2 NOT MEASURED — both exit 3 PREREQUISITE NOT MET (check:dual-build-cjs-loads, check:type-check-debt; both read whole-workspace built output, which is CI's farm-wide run). ⛔ Declared, not silently narrowed. pnpm lint ran whole-repo, exit 0, so no narrowing evidence is owed. Sweep pinned to final commit 3ce4fc73; the derivation was re-run after merging origin/main because the first warned STALE TREE.

⛔ NOT landed

Read at head 3ce4fc732: 30 checks, 0 failures, 16 still running. ⇒ Stays draft and unarmed. On this seat's landing list: ready + enqueue only when every check is green (⛔ not merely the required floor), then followed to MERGED with the squash verified on origin/main by measurement.

---

Generated by Claude Code