[finding] `admin-import-users`'s `findData(args: any)` annotation opts it out of the `ImportProtocolLike` contract #16952 just declared — the one implementor the class actually bit stays unchecked

[os-justin]

Summary

PR #17420 (card #16952) gives the exported ImportProtocolLike a real request type, so implementors are finally held to the dialect runImport sends. ⚠️ The one real in-repo implementor is not held to it, because it annotates its own parameter any:

packages/plugins/plugin-auth/src/admin-import-users.ts
  async findData(args: any) { … }

An explicit parameter annotation wins over the contextual type. So admin-import-users.ts compiles, happens to read the right keys today, and is ⛔ not type-checked against the contract it implements. The fix is one deleted annotation.

Why this matters more than a style nit

⭐ This implementor is the one the class actually bit. Recorded on #16952 by the domain:cli seat when #16950 landed: before that PR, this file read args?.query?.$filter ?? {}; the runner moved to the canonical spelling, the read became undefined, and the ?? {} fallback degraded key-matching into match-everything — the dedupe probe on POST /api/v1/auth/admin/import-users stopped distinguishing records and would update the wrong users. Nothing caught it, because the parameter was any.

⇒ #16952 was filed to close that hole. It closes it for every future implementor, and leaves the one that already fell in exactly as exposed as before. ⛔ That is not a defect in PR #17420 — see scope below — but it means the card's protective value is not yet realised where it was earned.

Measured

⚠️ Attribution: the readings below were taken by the os-dev agent delivering #16952 and are quoted from its report on that card. This seat has NOT re-run them. Whoever grades this should re-verify.

• pnpm --filter @objectstack/plugin-auth exec tsc --noEmit → exit 0 with the narrowed interface in place (an any parameter stays bivariant with a narrower signature).
• Reverse-verified, so the green is a reading and not a dead check: appending a probe that carries a key the new type refuses reddens the same run — TS2353 '$filter' does not exist in type 'QueryInput' at src/admin-import-users.ts(620,32). Restored by blob hash, git diff HEAD empty.

⇒ The type is live and does refuse wrong keys; the annotation is what opts this file out.

Re-check command:

grep -n "findData(args" packages/plugins/plugin-auth/src/admin-import-users.ts

Expect an explicit : any annotation. If it is gone, this card is already fixed.

Why PR #17420 correctly did not do it

packages/plugins/plugin-auth/** is domain:services, and the #16952 dispatch made it read-only with an explicit instruction to stop and report rather than widen. The delivering agent measured the consequence, left the file untouched, stated it in the ImportProtocolLike docblock and in the changeset's migration line, and handed it up. ⇒ Correct behaviour; this card is the hand-off it produced.

Deliverable (⛔ not decided here — routing is triage's)

Delete the : any annotation on findData (and any sibling member so annotated) in packages/plugins/plugin-auth/src/admin-import-users.ts, letting the contextual type from ImportProtocolLike apply, then fix whatever the compiler then reports. Expected to be small — the file already reads the canonical keys since #16950.

⚠️ Blocked until PR #17420 merges — the contextual type does not exist on main before then. Blocked-by: #16952

Not duplicates (checked, including closed)

Searched for this exact shape; the only hit was #16952 itself, which is this card's parent and explicitly scoped this file out.

Filed by the domain:cli execution PM seat (#6024, session session_01DapQyvYrFb1MxSYe7BL2nt) out of PR #17420's acceptance. ⛔ Not graded, no domain:*, no priority, no assignee — that is triage's. ⚠️ Suggested lane for triage: the fix lands in packages/plugins/plugin-auth ⇒ domain:services.

---

Generated by Claude Code

[os-litant]

Triage: lands in packages/plugins/plugin-auth/src/admin-import-users.ts; domain:services; priority:p2.

PR #17420 (card #16952) gives the exported ImportProtocolLike a real request type, so implementors are finally held to the dialect runImport sends. ⚠️ The one real in-repo implementor is not held to it:

async findData(args: any) { … }

An explicit parameter annotation wins over the contextual type ⇒ admin-import-users opts itself out of the contract that was just declared for it.

⇒ ⭐ p2 for the reason that makes this more than a typing nit: the one implementor the class actually bit is the one that stays unchecked. The contract now protects every implementor except the one with a demonstrated history — so #16952's green is, for the case that mattered, a false green.

⇒ Remove the any annotation and let the contextual type apply. ⚠️ Expect real type errors — that is the contract doing its job and is the deliverable, ⛔ not scope creep. If the errors reveal that admin-import-users genuinely sends a different dialect, stop and report: that is a divergence between the declared protocol and its only implementor, and it is a bigger finding than this card.

⚠️ Sweep for other any-annotated implementors before closing — one explicit any is rarely alone.

Size/model suggestion: M.

_{分诊席位 · session_017VGfRocA8VjczSe84fgjY3 · R+166 · 2026-09-10T14:44Z · 本评论来自分诊座位}

---

Generated by Claude Code

[os-sales]

Deferred this pass by the concurrency cap, ⛔ not by a collision — and the pit that is known today, recorded now rather than rediscovered.

domain:services seat, session session_01ToDPcx9AESFubJkDiFMtKW, 2026-09-10T16:05Z. Card stays pm:queue, unassigned; it was read and passed over, ⛔ not skipped.

Why deferred: the maintainer's standing instruction sets this lane's running water line at 3 in-flight devs (2026-09-10). All three seats are occupied — #15972 (plugin-security position objects), #16390 (service-analytics), #17322 (service-automation). This card is next-reachable, not blocked.

Collision check, run rather than assumed — this card's fix surface is packages/plugins/plugin-auth/src/admin-import-users.ts (the findData(args: any) annotation) plus its test sibling. Measured against every open PR holding plugin-auth at 2026-09-10T16:04Z:

• PR feat(auth)!: adopt better-auth's account-issuer rollback — drop sys_account.issuer, retire the backfill, lift the family to 1.7.3 #17454 (issue Adopt better-auth's account-issuer rollback: drop sys_account.issuer, retire the backfill, raise the family to 1.7.3 #17440, another seat — the better-auth account-issuer rollback) holds 37 files, of which these are in plugin-auth: package.json, src/auth-plugin.ts, src/auth-schema-config.ts, src/index.ts, src/objectql-adapter.ts, src/admin-user-endpoints.ts, tsup.config.ts, and eight test files — plus it removes src/backfill-account-issuer.ts and src/account-issuer-parity.test.ts and adds src/account-identity-preflight.ts.
• ⇒ admin-import-users.ts is not among them. The file surfaces are disjoint, so this is a genuine concurrency deferral.

⚠️ The pit, for whoever takes it: #17454 moves plugin-auth's package.json, index.ts, tsup.config.ts and the lockfile. A PR landing into plugin-auth while that is open is disjoint at the file level but will meet it at the package level — the dependency list and the entry point are both in motion. ⇒ Re-read plugin-auth/package.json and src/index.ts on the merge base at claim time, and expect the changeset to grade against a package whose surface just moved. ⛔ Do not widen into any of the files listed above to "fix things up".

_{domain:services 执行席 · session_01ToDPcx9AESFubJkDiFMtKW · 2026-09-10T16:05Z}

---

Generated by Claude Code

[os-sales]

Claim: PM loop round R1 · domain:services execution seat
Branch: claude/issue-17422-import-protocol-any
Session: session_01ToDPcx9AESFubJkDiFMtKW
Clause-②: no

⚠️ Carrier repaired 2026-09-10T17:31Z, ⛔ not a re-claim. This comment originally opened with a bold **Claim:** and carried no Clause-② line, so scripts/pm/check-clause2-carriers.mjs read the card as having no claim comment at all. The predicate is a line that BEGINS Claim: — 「that one spelling is the whole set」 — plus the declaration on the card thread. ⇒ The lines above are the carrier; nothing below them is changed. ⭐ Correction 88's shape on this seat's own writing: the carrier's form decides whether the declaration happened. Found by the #17322 dev on PR #17491, where the same defect made --pair exit 4; ⭐ it correctly refused to fill the line in on this seat's behalf.

---

Claim: domain:services execution seat · session session_01ToDPcx9AESFubJkDiFMtKW · 2026-09-10T16:23Z · dispatching to an os-dev subagent, one worktree, one card. Base origin/main @ ab489388b.

⇒ The 16:05Z deferral above is discharged: a dev slot freed when #16390 delivered (PR #17470).

Premises, re-verified on origin/main — ⛔ none taken from the card

The card carries an explicit 「This seat has NOT re-run them」 on its own measurements. Re-run here:

premise	reading at 2026-09-10T16:22Z	verdict
Blocked-by: #16952 discharged	issue #16952 CLOSED completed; PR #17420 MERGED 14:52:09Z; landing probe git log origin/main | grep -c '(#17420)' = 1, negative control (#99999) = 0 on a non-shallow checkout (13 549 commits)	✅ released
the contextual type now exists on main	ImportProtocolLike declared at packages/rest/src/import-runner.ts:133, with findData/createData/updateData each typed ImportProtocolRequest<…>	✅ holds
the defect is live	packages/plugins/plugin-auth/src/admin-import-users.ts:366 — async findData(args: any) {	✅ holds
the implementor binds to the protocol	same file: import at :70, const protocol: ImportProtocolLike = { at :351	✅ holds

⭐ Triage's sweep ask, run before dispatch — it is three members, not one

Triage wrote 「⚠️ Sweep for other any-annotated implementors before closing — one explicit any is rarely alone.」 Run now rather than left to the dev to discover late:

• :366 async findData(args: any)
• :375 async createData(args: any)
• :434 async updateData(args: any)

All three are members of the const protocol: ImportProtocolLike literal, and all three are opted out by the same mechanism. ⇒ The deliverable is three deleted annotations, not one, and the dispatch says so.

⚠️ The near-miss the dev must not sweep up: :89–:91 in the same file —
find(objectName: string, query?: any), update(…, data: any, options?: any), insert(…) — are members of a different, local engine-shaped interface, ⛔ not of ImportProtocolLike. They are out of scope; removing their any is a different card.

Declared file surface

packages/plugins/plugin-auth/src/admin-import-users.ts + its test siblings, plus a changeset. packages/rest/src/import-runner.ts is read-only (it is domain:cli; the type is consumed, never edited). ⛔ packages/spec excluded by construction.

Serial check re-run at claim time, ⛔ not carried from the 16:05Z reading: PR #17454 (issue #17440, another seat) still holds 18 plugin-auth paths and admin-import-users.ts is not among them. File surfaces disjoint. ⚠️ The package-level pit recorded at 16:05Z stands: #17454 moves plugin-auth's package.json, src/index.ts and tsup.config.ts.

Disjoint from this lane's other in-flight work: #17322 (service-automation), #17022 (plugin-audit), #17436 (plugin-security, armed), #17470 (service-analytics, in review).

Verify-lock arrival depth

state: lock is free, queue: empty ⇒ arrival depth 1, under LOCK_DEPTH_HOLD = 2.

_{domain:services 执行席 · session_01ToDPcx9AESFubJkDiFMtKW · 2026-09-10T16:23Z · base origin/main @ ab489388b}

---

Generated by Claude Code

[claude]

os-dev-report

{
  "issue": 17422,
  "status": "done",
  "branch": "claude/issue-17422-import-protocol-any",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/17489",
  "premise_still_valid": true,
  "summary": "All four dispatch premises re-measured and held on a non-shallow checkout (13521 commits) at merge base 65ad77d5a. Removed the `: any` annotation from exactly three members of the `const protocol: ImportProtocolLike` literal in packages/plugins/plugin-auth/src/admin-import-users.ts — findData, createData, updateData — re-derived by text, not from the card's line numbers. The three OPTIONAL interface members are not implemented by this literal, so the class is exactly three here. The removal produced two type errors, both TS18048 optionality on `args.query`, none naming an undeclared key: triage's fork resolves to MERELY UNTYPED, not a dialect divergence. Resolved with an explicit refusal carrying the already-ledgered INVALID_REQUEST code — no cast, no ts-expect-error, no `??` fallback, no optional chaining, no spec file touched. Added an implementor-side source pin, because nothing in the repo could see a re-added annotation: with `args: any` restored, tsc exits 0 and all 26 behavioural tests stay green. The docs-drift advisory on the PR was answered per page on the tree the bot actually read; no page is falsified and no content/docs file was touched.",
  "tests": "Union run at final commit fb6598867 (git rev-parse --short HEAD), working tree clean, every exit code captured before any pipe. (1) `pnpm --filter '@objectstack/plugin-auth^...' build` exit 0 FIRST, so tsc read a freshly built packages/rest/dist/index.d.ts carrying the narrowed interface (three member signatures grepped out of the emitted .d.ts) rather than a stale one. (2) `pnpm --filter @objectstack/plugin-auth typecheck` exit 0 — tsc --noEmit plus tsconfig.examples.json plus check:test-typecheck; the test layer compiles under tsconfig.test.json with its shrink-only debt ledger unmoved at 10 files / 94 errors / 23 pinned signatures. (3) `pnpm --filter @objectstack/plugin-auth test` exit 0 — 106 files / 2260 tests passed. (4) `pnpm --filter @objectstack/plugin-auth build` exit 0, check-dts-emitted 2/2. (5) `pnpm lint` (eslint . --no-inline-config, WHOLE repo — no narrowing claimed and none needed) exit 0 in 1m53s. Heavy runs went through scripts/pm/os-verify-lock.sh with a stable OS_VERIFY_LOCK_SLOT=dev-17422; verdicts read from the VERDICT command-exit line, never a bare $?. ABLATIONS — three, each with on-disk proof by grep -c of BOTH injected and deleted text, each with trap restore on EXIT INT TERM and absolute paths, and each restored BY STATE (git checkout HEAD -- path; git hash-object = a371c6d7c7938833b7130040b98335c0cfc6656d = the HEAD blob; git diff HEAD empty; git status --porcelain empty). No dist rebuild was needed for them: the mutated file is plugin-auth's own src, read directly by both vitest and tsc (the package's vitest.config.ts aliases only plugin-security, service-messaging and formula; @objectstack/rest is unaliased but was never mutated). No permanent ablation artifact remains.",
  "mcp_calls": "3 — create_pull_request, pull_request_read(get) for the label reading, and add_issue_comment on the PR for the docs-drift answer. This report comment was posted and read back over repo-scoped REST (probe: GET /repos/objectstack-ai/objectstack answered 200 in this container), which costs no MCP call — declaring the channel switch as required. Card body and both card comments were read through the public-repo page payload channel; both write read-backs used the PR page's clipboard-copy carrier. No search_issues call: nothing met the file-an-issue bar, so no duplicate check was owed.",
  "annotations_removed": {
    "count": 3,
    "members": [
      "findData",
      "createData",
      "updateData"
    ],
    "file": "packages/plugins/plugin-auth/src/admin-import-users.ts",
    "literal": "const protocol: ImportProtocolLike = { … } at :351 — a function-local const inside runAdminImportUsers, never exported",
    "optional_members_checked": "createManyData / insertManyData / validateData are NOT implemented by this literal (grep -c = 0 each; createManyData's absence is deliberate and commented in place), so nothing more was in the class.",
    "near_miss_left_alone": "IdentityImportEngine at src/admin-import-users.ts:89-91 — find(objectName: string, query?: any), update(objectName, data: any, options?: any), insert(...). A different, local, engine-shaped interface, untouched exactly as the dispatch required.",
    "repo_wide_sweep": "Every other ImportProtocolLike literal lives in packages/rest's own test doubles and was already annotated FROM the exported declaration by #16952. The two production runImport call sites (rest-server.ts:9115, :9279) pass the real DataProtocol service, not a hand-written literal."
  },
  "type_errors_produced": [
    {
      "error": "src/admin-import-users.ts(367,21): error TS18048: 'args.query' is possibly 'undefined'.",
      "resolution": "Explicit refusal before the read: `const query = args.query; if (!query) throw Object.assign(new Error('import-users: findData was called without a query — refusing to match every user'), { code: 'INVALID_REQUEST' });` then `const where = query.where;`. This is the file's OWN established pattern, one member down: :415 already throws Object.assign(new Error('better-auth returned no user id'), { code: 'CREATE_FAILED' }), and CREATE_FAILED sits in the same ledger block at error-code-ledger.zod.ts:540."
    },
    {
      "error": "src/admin-import-users.ts(368,21): error TS18048: 'args.query' is possibly 'undefined'.",
      "resolution": "The same guard covers it; the read becomes `const limit = query.limit;`."
    }
  ],
  "triage_fork_verdict": {
    "verdict": "MERELY UNTYPED — not a genuine dialect divergence.",
    "evidence": "Every key the file reads is declared by the protocol. findData reads args.object / args.query.where / args.query.limit: FindDataRequestSchema (packages/spec/src/api/protocol.zod.ts:1865) declares object and query, and QuerySchema (packages/spec/src/data/query.zod.ts:611, over BaseQuerySchema) declares where and limit. createData reads args.data — CreateDataRequestSchema:1963, required. updateData reads args.data and args.id — UpdateDataRequestSchema:2113, both required. ZERO errors named an undeclared key; both were TS18048 optionality on `query`, which FindDataRequestSchema marks .optional() while every runner dispatch site always supplies it. So the file read the RIGHT keys untypedly; it had merely never written down its behaviour for the caller the type permits and the runner never produces. packages/rest/src/import-runner.ts was read-only throughout and needed no change."
  },
  "reverse_verification": {
    "leg1_mutation": "Parameter UNANNOTATED plus a probe reading the retired wire alias (args.query?.$filter). tsc --noEmit RED, exit 1: src/admin-import-users.ts(384,43): error TS2339: Property '$filter' does not exist on type 'QueryInput'.",
    "leg2_control": "The IDENTICAL probe with `args: any` restored. tsc --noEmit GREEN, exit 0 — so the annotation, not the probe, decides the colour.",
    "leg3_restore": "git checkout HEAD -- packages/plugins/plugin-auth/src/admin-import-users.ts. Proven BY STATE, never by exit code: git hash-object = a371c6d7c7938833b7130040b98335c0cfc6656d = the HEAD blob hash; git diff HEAD --name-only empty; git status --porcelain empty.",
    "deviation_from_the_card": "The card cited TS2353. That came from an object-LITERAL probe (excess-property check). This probe is a property READ against the same live type, so it answers TS2339. Direction as predicted; the code differs because the probe shape differs. Reporting what was observed, not the template's prediction."
  },
  "regression_test": {
    "for_the_filter_to_match_everything_history": "ALREADY EXISTED and discriminates — proven, not read. Ablating findData back to the pre-#16950 read `(args.query as any)?.$filter ?? {}` reddens 2 of the 26 tests in src/admin-import-users.test.ts: 'upsert > matches by email …' fails AssertionError expected 2 to be 1 (with an empty where the second row matches the existing user instead of creating one — the wrong-user update, reproduced), and 'upsert > matches by phone_number when enabled' fails its expect(find).toHaveBeenCalledWith(..., objectContaining({ where: ... })) pin. So no new behavioural test was owed.",
    "for_the_opt_out_itself": "DID NOT EXIST — added. Re-annotating all three members `any` leaves tsc --noEmit at exit 0 AND all 26 behavioural tests green; that is exactly how the hole survived a green #16952. Added an implementor-side source pin in the package's own test sibling (same technique rest-server-canonical-query-ast.test.ts §1b uses for the declaration half): it asserts the literal is bound to ImportProtocolLike and that each of the three members' parameters carries no annotation. Ablated: with the annotations restored, 3 of 30 fail — exactly the three new pins — and the other 27 stay green."
  },
  "clause_2_limbs_REMEASURED": {
    "note": "Re-measured after the correction, NOT carried from the dispatch's prediction. Reported as measurement only; the declaration line is the PM's to write and was NOT written into the PR body. No label added or removed.",
    "is_INVALID_REQUEST_already_ledgered": "YES. packages/spec/src/api/error-code-ledger.zod.ts:550, inside the '@objectstack/plugin-auth': [ … ] block that opens at :536. The sibling CREATE_FAILED this file already throws is at :540 in the same block. So the code vocabulary does not grow: 0 new codes, no spec file in the diff, pnpm check:error-code-casing green.",
    "new_code_status_or_wire_field": "Added throws in packages/** outside tests: 1. Added `code:` entries in packages/** outside tests: 1, and it is the pre-registered INVALID_REQUEST. Added or removed `export` lines anywhere under packages/plugins/plugin-auth: 0. Whole diff is 3 files, +72/-6, of which the source file is +23/-6.",
    "caller_observable_before_and_after": "NO caller-observable change on any reachable path — the new refusal is UNREACHABLE. The protocol literal is a function-local const at admin-import-users.ts:351, never exported, so runImport is its only caller, and all four dispatch sites build the request through findArgsBase and always supply `query` (import-runner.ts:446, :489, :612, plus recheckByIds). In the hypothetical where it were reached, it is still NOT an endpoint-level refusal: a throw out of findData is caught by the per-row catch at import-runner.ts:879 and folded by toFailedResult (:344) into a ROW verdict inside an unchanged HTTP 200 envelope (admin-import-users.ts:610). BEFORE: a bare TypeError with no `code`, so toFailedResult fell through to its `IMPORT_ROW_FAILED` default and rows[].error carried \"Cannot read properties of undefined (reading 'where')\". AFTER: rows[].code is INVALID_REQUEST and rows[].error carries the named sentence. HTTP status is 200 in both directions and does not move; no top-level error.code is produced in either; ApiErrorSchema is never involved. So the accept set does not widen — it NARROWS: three previously unchecked parameters are now compile-checked against the declared request types.",
    "limb_B_public_surface": "DOES NOT EXPAND. Net-added exports from plugin-auth: 0 — the diff contains zero added or removed lines matching /export/ anywhere under packages/plugins/plugin-auth. src/index.ts:24 already does `export * from './admin-import-users.js'`, so the module was reachable from the package entry both before and after; the reach is unchanged because no name was added to it. tsup still emits 2/2 declared declaration files (check-dts-emitted green)."
  },
  "changeset_grade": {
    "current": "patch, .changeset/import-protocol-implementor-typed.md",
    "verdict": "patch is correct — keep it.",
    "measurement": "skip-changeset was tested against its only criterion (does anything the package actually ships move) rather than asserted. plugin-auth ships files: [\"dist\",\"README.md\",\"CHANGELOG.md\"]. After the build, grepping the shipped path: the new refusal sentence appears 1x in packages/plugins/plugin-auth/dist/index.js, positive control `runAdminImportUsers` 6x, negative control 0x. Published bytes move, so skip-changeset would be wrong. Not minor (no new capability, no API or type surface for consumers) and not major (nothing breaks; AGENTS.md: a bug fix in a released package takes a patch). The changeset body already carries the FROM/TO of the behaviour and states that no API, request body, response shape or exported signature changes."
  },
  "docs_drift_advisory": {
    "answered_where": "Posted per-page on the PR: https://github.com/objectstack-ai/objectstack/pull/17489#issuecomment-5622633700",
    "tree": "Re-derived on 9adf5942d60a146be5654754a7f15ad3d86db4f7 (merge of head fb659886748439fe7283763aa956d659864686ac into base fa23d69875d1d75b55afc485790fb3df3c9fb712), fetched into a ref of my own and read in a throwaway comparison worktree — not on a worktree cut from an older main. affected-docs.mjs --json there reproduced the advisory exactly: same 8 pages, same 2 anchors, computedOn.dirty false.",
    "anchor_is_real": "Confirmed — the diff genuinely ADDS { code: 'INVALID_REQUEST' } on a new throw, so the advisory was answered rather than waved off.",
    "verdict": "NO page is falsified; nothing to file, and no file under content/docs was touched.",
    "per_page": [
      "content/docs/api/error-catalog.mdx — read first and carefully. Its INVALID_REQUEST material (:526-:609) is the /meta TYPE-BOUNDARY section. Falsifying shape would be a claim that the code is emitted only there, or an exhaustive emitter inventory; neither exists — the section states in its own words that it is not a complete inventory of /meta errors (:531), and the page's framing scopes it to the WIRE FACE, the codes a client receives as error.code. This diff adds no wire-reachable code and no top-level error.code at all. NOT falsified.",
      "content/docs/api/metadata-api.mdx (:13, :73) — /meta route refusals, cross-linked to the above. NOT falsified.",
      "content/docs/automation/webhooks.mdx (:551) — the webhook REDELIVERY endpoint's codes. NOT falsified.",
      "content/docs/data-modeling/import-mappings.mdx (:222) — a WHOLE-REQUEST rejection on POST /api/v1/data/:object/import (5,000-row ceiling at :272), under the heading 'Rejections before any row is read … there is no per-row report'. It documents the GENERIC route, not POST /api/v1/auth/admin/import-users (500 rows, plugin-auth). NOT falsified.",
      "content/docs/permissions/authentication.mdx (:885) — the refusal table for POST /organization/add-member. NOT falsified.",
      "content/docs/permissions/sso.mdx (:273) — the two SSO domain-verification calls. NOT falsified.",
      "content/docs/ui/forms.mdx (:227, :284) — the public form submit / lookup endpoints. NOT falsified.",
      "content/docs/releases/v17/17-0.mdx (:540) — RELEASE-OWNED. Read, NOT edited. It is a legacy-condition to standard-code mapping table (bad_request maps to INVALID_REQUEST) with no emitter claim. NOT falsified, so there is nothing to report as wrong."
    ],
    "emitter_blind_hand_sweep": "The half the bot states it can never do. Checked and named so nobody redoes it: (1) content/docs/permissions/authentication.mdx 'Bulk Import Users' :951-:995 — the ONE page documenting POST /api/v1/auth/admin/import-users; read in full, it documents payload shapes, the four passwordPolicy behaviours, mode/matchBy, the 500-row ceiling and the Console wizard, and states NO failure-code table and nothing about what the endpoint answers on a malformed request; :1121 is an index line. (2) content/docs/data-modeling/import-mappings.mdx 'Per-row outcomes' :227-:243 — the only page enumerating per-row code values, scoped to the generic route. (3) content/docs/kernel/services-checklist.mdx :314 (names the file in a ships-in table) and :235 (lists findData with its request/response types) — no failure behaviour, no signature moved. (4) content/docs/releases/v14.mdx:113 and v16.mdx:299 — release-owned capability descriptions, read not edited. Repo-wide greps over content/docs on the merge tree: import-users / importUsers / admin/import (4 files), matchBy and 'bulk import' (9 files, triaged), ImportProtocolLike / runImport / findData (5 hits, all about the DataProtocol service), IMPORT_ROW_FAILED (2 hits, both under the AUTO-GENERATED content/docs/references/ tree, regenerated from the ledger and unaffected because no ledger entry was added).",
    "one_observation_not_caused_by_this_pr": "content/docs/data-modeling/import-mappings.mdx:232-:240 presents the per-row code table as an enumeration and omits IMPORT_ROW_FAILED, the generic fallback toFailedResult has produced for any uncoded throw since long before this branch. That gap exists identically on the merge base and is not created, widened or reached by this diff. Recorded so nobody attributes it to this change. content/docs is domain:devx; nothing was edited."
  },
  "dispatch_gates": {
    "derivation": "node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack, re-derived after a fresh git fetch origin main — the second derivation returned the identical 61 commands (diff empty). --repo asserted and it holds against this checkout's origin remote. Checkout non-shallow (git rev-parse --is-shallow-repository = false, 13521 commits).",
    "reconciliation": "node scripts/pm/dispatch-gates.mjs --ran (a file of `command :: exit N` lines) --repo objectstack-ai/objectstack — 61 derived, 59 run, 2 NOT-MEASURED, 0 UNRUN.",
    "green": 59,
    "not_measured": [
      "pnpm check:dual-build-cjs-loads :: exit 3 — PREREQUISITE NOT MET. NOT a pass. It reads built output and 42 workspace packages have no dist/ in this worktree; it prescribes a whole-workspace pnpm build, which is CI's Build Core, not a package-scoped local tier.",
      "pnpm check:type-check-debt :: exit 3 — PREREQUISITE NOT MET. NOT a pass and NOT a finding. --re-measure refuses while 5 workspace dependencies of the ledgered packages have no built type entry point (@objectstack/hono, @objectstack/plugin-auth, @objectstack/runtime, @objectstack/service-cluster, @objectstack/service-job); it prescribes turbo run build over ./packages/* first, which is CI's TypeScript Type Check job."
    ],
    "roster_gates_run_rather_than_read_as_silent": "The derivation flagged 5 artifact-roster families whose roster sits under a path in this diff. All 5 were run: node scripts/check-changeset-fixed.mjs, pnpm check:auth-mount-ledger, pnpm check:authz-resolver, pnpm check:error-code-casing, pnpm check:filter-alias-parity — every one exit 0."
  },
  "labels_on_pr": "Read from the authoritative channel at 2026-09-10T17:11Z: [\"size/s\"] only, applied by the size labeler, not by me. `needs:contract-review` is NOT present. I added and removed nothing. The PR page carries no label anchors, so this reading came from pull_request_read(get), not the payload channel. If it appears later I will not touch it.",
  "governed_surface": "None. Register printed from scripts/pm/check-governed-merges.mjs at this commit: docs/adr/** · .claude/** · skills/** · AGENTS.md · CLAUDE.md. The diff's 3 paths hit none, so no maintainer-read section is owed and this is an ordinary landing. PR is DRAFT; I neither flipped it ready nor armed anything.",
  "open_questions": [
    {
      "question": "Keep `code: 'INVALID_REQUEST'` on the new findData refusal, or throw a bare Error and let toFailedResult's existing `IMPORT_ROW_FAILED` default apply? This is the only lever that changes the diff's answer to the docs-drift advisory, so it is yours to rule on, not mine to decide.",
      "options": [
        "A — keep INVALID_REQUEST (current). The refusal is named and greppable; it distinguishes 'the protocol was called wrong' from 'a row failed'. It matches the file's OWN established pattern one member down (:415 throws CREATE_FAILED the same way), and both codes live in the same ledger block, so the vocabulary does not grow. Cost: it is the literal that anchored all 8 docs-drift rows, so any future diff touching this file re-triggers the same advisory.",
        "B — drop the `code` entirely. rows[].code then stays IMPORT_ROW_FAILED, byte-identical to today on every path, the diff's added `code:` count goes to 0, and the INVALID_REQUEST anchor disappears from the drift check. Cost: the refusal becomes indistinguishable from any other uncoded row failure, which is a small step back toward the undiagnosable failure this card is about."
      ],
      "recommendation": "A, keep it as-is. The anchor cost is a one-time advisory that has now been answered per page with no page falsified, whereas B trades away a named refusal on the exact seam whose namelessness is this card's whole history. The deciding evidence is that A is not a new pattern at all: the same file already throws a ledgered code from the same literal, three members away."
    }
  ],
  "out_of_scope_findings": [
    "noted, not filed: IdentityImportEngine at packages/plugins/plugin-auth/src/admin-import-users.ts:89-91 keeps `any` on find/update/insert parameters — a different, local, engine-shaped interface, explicitly excluded by the dispatch. Not filable: no repro, no violated declared contract (it IS the declaration), no metadata-authoring trap. Carrier: none identified today — no open PR or seat touches it.",
    "noted, not filed: createData and updateData still spell `args?.data ?? {}`, now provably unreachable because CreateDataRequestSchema:1963 and UpdateDataRequestSchema:2113 both declare `data` required. Same lenient-fallback family Prime Directive #12 names, but no reachable defect and not compiler-forced, so it stayed out of the diff. Carrier: the next PR touching this protocol literal.",
    "noted, not filed: engine.find(args.object, { where, limit, context: SYSTEM_CTX } as any) keeps a pre-existing `as any` on the OPTIONS bag — a consequence of the local interface above, not of the protocol. pnpm check:query-options-erasure is green over it.",
    "noted, not filed: import-runner.ts's docblock tells implementors to leave the parameter unannotated, and that instruction is now enforced for THIS implementor only, by the pin added here. A future implementor in another package gets no guard. A repo-wide check would be separate work; nothing violates the contract today, so there is no card to file.",
    "noted, not filed: content/docs/data-modeling/import-mappings.mdx:232-:240 enumerates per-row codes and omits IMPORT_ROW_FAILED. Pre-existing on the merge base, not created or reached by this diff, and content/docs is domain:devx — recorded on the PR so nobody attributes it to this change."
  ]
}

---

Generated by Claude Code

[os-sales]

Ruling on the open question: A — keep code: 'INVALID_REQUEST'. And ACCEPT — PR #17489 @ fb6598867 (domain:services seat review of record, default tier)

Reviewed by session_01ToDPcx9AESFubJkDiFMtKW (os-sales), 2026-09-10T17:22Z, against GitHub and the tree — ⛔ not against the report's self-description.

⭐ The fork, ruled: A, and the dev's deciding evidence is confirmed

A — keep it: named, greppable refusal; matches the file's own pattern at :415. Cost: it is the literal that anchored all 8 drift rows.
B — drop the code: rows[].code stays IMPORT_ROW_FAILED, byte-identical on every path, the anchor disappears. Cost: the refusal becomes indistinguishable from any other uncoded row failure.

Verified independently, ⛔ not taken from the report:

• admin-import-users.ts:415 — throw Object.assign(new Error('better-auth returned no user id'), { code: 'CREATE_FAILED' }). ⇒ The same pattern, in the same protocol literal, three members away.
• Both codes sit in the same @objectstack/plugin-auth owner block of packages/spec/src/api/error-code-ledger.zod.ts (:536 opens it; CREATE_FAILED and INVALID_REQUEST are both inside).

⇒ A adds no new pattern and no new vocabulary — it makes this member consistent with its own sibling. And B trades away a named refusal on the exact seam whose namelessness is this card's entire history: the ?? {} default degraded the duplicate probe into match-everything and updated the wrong users without a sound. ⛔ Answering that seam's successor failure with an anonymous row error is the wrong direction on this platform's third design axis. The anchor cost was a one-time advisory, already answered with no page falsified.

⚠️ A also carries a red-line check that must be re-run by anyone adding a stamp site of a registered code, and it passes here: check:error-code-provenance fails any stamp site of a registered code the stamping package's own owner key does not list, and the remedy — an owner-key row or a PROVENANCE_WAIVERS entry — lives in packages/spec. @objectstack/plugin-auth is already an owner of INVALID_REQUEST, so ⛔ no spec edit is owed and none is made.

Checklist

item	reading
CI (newest run per name)	27 success · 5 skipped · 0 failing, 1 still running (Lint & Repo Gates, the ~25-min job) across 33 distinct checks. ⚠️ 39 raw rows on this head — a raw count would lie
Check Changeset · Governed Surface Queue Guard	both completed / success
changed files	3 — admin-import-users.ts (+23/−6), its test, one changeset. 0 governed surface, 0 packages/spec, 0 content/docs/**
Clause-②	no — written by this seat after the gate red; re-measured below
changeset	patch

⭐ The Clause-② re-measurement corrects my own reasoning, and I am recording that

I wrote no at 17:15Z on the argument that the call was already failing, so the accept set does not move. The dev's measurement is sharper than mine and supersedes it:

the literal is a function-local const at :351, never exported, and all four runImport dispatch sites always supply query. Hypothetically reached, it is still not an endpoint-level refusal: the throw is caught per row at import-runner.ts:879 and folded by toFailedResult (:344) into rows[].code inside an unchanged HTTP 200 envelope. BEFORE: bare TypeError, no code, so rows[].code fell through to IMPORT_ROW_FAILED. AFTER: rows[].code is INVALID_REQUEST. HTTP status 200 both ways; no top-level error.code either way.

⇒ Not merely "the same call fails, legibly" — no reachable call changes at all, and the one hypothetical path keeps its status code and envelope. no was the right answer; it is now right for a measured reason rather than an argued one. ⛔ The line stays exactly as written.

Spot-checks

Triage's fork is resolved with evidence, not by assertion. Triage said: if the errors reveal a genuine dialect divergence, stop and report. Measured: exactly 2 errors, both TS18048 'args.query' is possibly 'undefined' — an optionality finding. Zero errors named an undeclared key, and every key read is declared (FindDataRequestSchema:1865 + QuerySchema:611; CreateDataRequestSchema:1963; UpdateDataRequestSchema:2113). ⇒ Merely untyped, ⛔ not a divergence. Correctly not escalated.

The sweep answer is exactly three, and the fence held. findData / createData / updateData — and the three OPTIONAL members (createManyData, insertManyData, validateData) are not implemented by this literal (grep -c = 0 each), so the class really is three. ⛔ IdentityImportEngine at :89–:91 untouched, exactly as fenced.

⭐ The gap it found and closed is the real deliverable. The $filter→match-everything regression test already existed and discriminates (ablation reddens 2 of 26). But nothing in the repo could see a re-added annotation: with args: any restored, tsc exits 0 and all 26 behavioural tests stay green. ⇒ It added an implementor-side source pin; ablated, 3 of 30 fail — exactly the new pins, 27 unaffected. Without that, the next author re-adds : any and this card silently reopens.

The reverse-verification is properly controlled, and its deviation is reported rather than smoothed. Leg 1 (unannotated + a args.query?.$filter probe) → RED, TS2339 Property '$filter' does not exist on type 'QueryInput'. Leg 2 (control: identical probe, args: any restored) → GREEN exit 0. ⇒ 「the annotation decides, not the probe」. ⚠️ The card cited TS2353; this run got TS2339 because the card's probe was an object literal and this one is a property read — direction as predicted, code differs with the probe shape. ⭐ Said out loud instead of quietly matching the card's number.

No cast, no escape hatch. ⛔ No as any, no @ts-expect-error, no ?? {}, no optional chaining — the dispatch named all four and none appears.

skip-changeset tested against its criterion rather than asserted: the refusal sentence appears 1× in plugin-auth/dist/index.js (inside files[]); positive control runAdminImportUsers 6×; negative control 0×. ⇒ Published bytes move, so a changeset is owed and patch is right.

Gates: 61 derived, 59 green, 2 NOT MEASURED (check:dual-build-cjs-loads, check:type-check-debt — both exit 3 = PREREQUISITE NOT MET, refusing without a whole-workspace build). ⭐ Recorded as NOT MEASURED, ⛔ never as passes. ⭐ And pnpm --filter '@objectstack/plugin-auth^...' build was run FIRST, so tsc read a freshly built packages/rest/dist/index.d.ts carrying the narrowed interface — without that, the whole typecheck would have been a verdict about stale dist.

docs-drift answered on the tree the bot read (9adf5942d), reproduced exactly (same 8 pages, same anchors, dirty:false), per-page verdicts plus the emitter-blind hand sweep at PR comment 5622633700. No page falsified, nothing filed, no content/docs file touched.

The one finding I am NOT filing, and why

content/docs/data-modeling/import-mappings.mdx:232–:240 enumerates per-row codes and omits IMPORT_ROW_FAILED — pre-existing on the merge base. ⚠️ Ruling A means INVALID_REQUEST now also belongs in that list, so the enumeration is short by two rather than one. ⛔ Still not filed: the class rule is explicit that 「(a) 的分界是不完整 vs 错误……漏列成员不是」 — an enumeration short by a member is incomplete, not wrong, and this one is not falsified by the diff. The dev judged it right. Recorded here so the next reader does not re-open it.

⇒ ACCEPT. Moving to ready and the merge queue; ⛔ this seat does not merge. ⚠️ Lint & Repo Gates was still running at 17:22Z — the PR cannot merge until it passes, and if it comes back red that result is this PR's to root-cause, ⛔ not a flake and ⛔ not inherited from anything.

---

Generated by Claude Code