[objectstack-fleet]

Requested by Sales · project thread

Part of #25224
Clause-②: no
Metadata-protocol: none
Ruling-ref: 6348891160, 6364006498

The basis for the Clause-②: no line: this is a move. No accept set, route, refusal, code or answer changes, and the published surface is measured unchanged:

• @objectstack/plugin-auth's dist/index.d.ts and dist/index.d.mts are raw byte-identical to base at head (0 diff lines, so the union-order normalisation has nothing to do). The positive control is the one ruling 6348891160 asks for.
• Its ESM and CJS entries export the same 159 names at base and at head.

The .d.ts bar is ruling 6348891160 item 1 (on #25222, covering this card). Ruling 6364006498 is Sales's ruling A on this card, for bodies that read shared unexported helpers. This is the second cut it applies to.

Cut 10 of the auth-manager.ts split: request routing. Three AuthManager method bodies (226 lines) move unedited, re-indented one level, into one new module, packages/plugins/plugin-auth/src/auth-manager-request-routing.ts. #25224 stays open for the later cuts.

This follows the amended claim 6369962162, which amends 6367866058 on the file cut 9 left (#25461, landed note 6369059246). The shape is cuts 1 to 9's, which is #23050's.

Branch: claude/project-thread-lg3wrj, the harness-pinned branch for this session, restarted from origin/main 05cc3ee953 after #25461 merged. It names no issue, so the card relation is this body's first line.

auth-manager.ts goes from 8,711 to 8,521 lines. The cut is +361 / −233 over 2 files: 594 changed lines, under the 3,000-line line. It is not a governed surface (check-governed-merges.mjs --branch HEAD: 0 of the 2 paths hit the register). One commit, 27f04eaa1c.

The move

moved	base line	lines	members it reads
handleRequest (public)	:6369	200	betterAuthEndpointPath, getOrCreateAuth, resolveClientAddress, runSubjectErasureAtomically
ownsRoute (public)	:6739	14	betterAuthEndpointPath, getOrCreateAuth, and routeOwnership, routeOwnershipFor (read and written)
betterAuthEndpointPath (private)	:6766	12	getBasePath

Lines are base 05cc3ee953. The members come from a walk of every this.X in each body with the TypeScript compiler API. No body has a bare this, this[...], arguments or super, or a this inside a function or a nested class. The members a body assigns are routeOwnership and routeOwnershipFor (ownsRoute).

• handleRequest is the one seam every better-auth request passes through on its way to the vendor handler and back. The client address is established once, then come the vendor header, the dev-only Origin, the admin-session recovery out of impersonation, the request-state and actor-attribution scopes, the SCIM scope, the atomic erasure, the two refusal envelopes and the server-error log. It reassigns its own request parameter, as before. Its two await import(…) calls (@better-auth/core/context, ./scim-connection-service.js) and its two console.error('[AuthManager] better-auth returned error:', …) lines move with it, text unchanged.
• ownsRoute answers whether better-auth routes a request at all, from a memoized ownership table keyed on the live instance.
• betterAuthEndpointPath is the endpoint path both key on.

isScimProtocolPath is exported in place (ruling 6364006498, parameter 2):

• :1240 becomes export function isScimProtocolPath(…). That is the only edit to text that stays.
• It does not move. docs/adr/0134-env-side-scim-provisioning.md:122 anchors it as auth-manager.ts#isScimProtocolPath, beside #SCIM_PROTOCOL_PATH_PREFIX (:121), which it reads and which stays too.
• The new module imports it by value from ./auth-manager.js, beside type AuthManager. The one read is inside handleRequest's body, when a request is handled. The module's top level is imports, the host interface and three function declarations, so nothing reads the binding while the two modules are first evaluated.
• index.ts lists auth-manager.ts's published names one by one (cut 9) and does not list it, so it is not published. The head's ESM and CJS entries do not export it, and dist/index.d.ts does not name it.

Imports.

• Ten imported names leave auth-manager.ts, because their only readers were the moved bodies: runWithAuthActorScope, SESSION_ERASURE_PATHS, envelopeVendorAdminRefusal, refuseAnonymousSession, buildBetterAuthRouteOwnership, ADMIN_SESSION_COOKIE_KEY, STOP_IMPERSONATING_PATH, withBearerAdminSessionRecovery, withVendorClientAddress and clientAddressStateEntries. The lines that also carry a name that stays keep it (setAuthActorResolver, type BetterAuthRouteOwnership, rotateCallerBearerOnImpersonation, vendorClientAddressOptions, readRequestClientAddress). The three single-name lines go.
• type BetterAuthRouteOwnership stays for the routeOwnership field.
• ORGANIZATION_DELETE_PATH is imported by both files, because the global before-hook in auth-manager.ts (:2379) reads it too.

Evaluation order.

• session-tombstone.js is still first reached earlier, through objectql-adapter.js (:70).
• vendor-admin-refusal-envelope.js and anonymous-session-refusal.js have no other importer, so they are now first reached through the new module, whose import line is auth-manager.ts's last. Each one's top level is literal constants, one new Set([401, 403]), function declarations and two value imports:
  • ./platform-admin-gate.js, which an earlier import line of auth-manager.ts already reaches (admin-impersonate-endpoint.js, :95, imports it by value);
  • @objectstack/spec/api, which nothing else in plugin-auth imports by value. So its first load moves later too: in the CJS bundle its first require goes from line 4,372 to 7,535, and ESM hoists it either way.
• @objectstack/spec declares "sideEffects": false, and neither module does anything outside itself, so the later order cannot be observed.

The shape

• The class keeps all three methods at their places, with their names, signatures and docblocks: the published .d.ts lists each one. Each body is now a host literal of exactly the members that body reads, typed as a Pick of RequestRoutingHost, plus .call.
• RequestRoutingHost lives in the new module. It names the 7 members the bodies read, each typed as the class member (AuthManager['getBasePath'], …).
• Every method goes as a late-bound closure ((...a) => this.m(...a)), so a double or spy set on the manager is still the one a body reaches. handleRequest and ownsRoute ask betterAuthEndpointPath through the manager rather than calling the function directly.
• routeOwnership and routeOwnershipFor go as get/set pairs. ownsRoute stores the table it builds, and the instance it built it from, on the manager. So the memo stays the manager's, and it is rebuilt when that instance is replaced, as before. The two private fields stay on the class.
• handleRequest and ownsRoute are no longer async. Each returns the moved async function's own promise, so a caller awaits the same promise the body settles. Building the host cannot throw, so neither now throws synchronously where it used to reject. betterAuthEndpointPath was not async and stays so.
• The cost: small host objects on every better-auth request. handleRequest builds one, and each of its two betterAuthEndpointPath calls through the manager builds one more, so three per request; ownsRoute builds two.
• Nothing re-exports the new module, so the published surface does not move.

The decision-letter layer drops by one, as agreed with the seat

handleRequest's first comment cites ADR-0069 D7. auth-manager.ts is an anchored file and the new module is not. So check-adr-anchors' decision-letter layer reads 1,978 at base 05cc3ee953 and 1,977 at head, and the gate exits 0 at both. That is the one letter citation in the moved text. Its other ADR citation is ADR-0112, with no letter.

No anchor entry is added for the new module. The auth-manager.ts entry has two paragraphs (ADR-0093 D2, the membership reconciler; ADR-0108, the organization roles), and neither describes a moved method. The new module's header cites no ADR-NNNN. So the number layer reads 52,223 citations at both, across 6,651 files at base and 6,652 at head (the new module).

Path readers

No path reader needs migrating: none reads a moved line.

• The tenant-audit census. No census site moves: the moved text has no engine write, no this.X.delete() and no elevation read. check-tenant-audit-census exits 0 at head with no --write. There are 238 sites at base and at head, compared per site with line numbers ignored: 0 differences, 2 in auth-manager.ts at both, and 0 in the new module. So neither census document is edited.
• check-dispatcher-error-vocabulary.mjs and api-error-code.pin.test.ts's authManagerFiles floor: no new APIError( sits in the moved text. The gate reads 56 sites found and 56 classified at base and at head.
• The plugin-factory scans in better-auth-schema-parity.test.ts and managed-extension-fields.test.ts match await import('better-auth/plugins…') and await import('@better-auth/…') plugin factories. The moved await import('@better-auth/core/context') is not a plugin factory, and both suites pass at head.
• check-auth-mount-ledger.mjs and auth-manager-base-path.test.ts: no base-path literal or declaration sits in the moved text. getBasePath, configuredBasePath and rootedBasePath stay on the class.
• The system-context census reads 148 elevation read sites at base and at head.
• Prose that names the moved methods (better-auth-route-ownership.ts:103, anonymous-session-refusal.ts:89, vendor-admin-refusal-envelope.ts:83, comments in auth-manager.ts) names AuthManager.betterAuthEndpointPath or handleRequest, which stay on the class.
• Callers through the manager. These suites drive the three methods through the class methods, and all pass at head:
  • auth-catchall-fallthrough.test.ts and auth-catchall-yield.test.ts (route ownership and the plugin-auth 的终结式 catch-all 吞掉 /api/v1/auth/* 下别人的路由 —— console 权限层目前靠 kernel.use() 顺序才活着 #4088 yield);
  • auth-manager-base-path.test.ts (the endpoint path under every configured spelling);
  • oidc-discovery-sync-mount.test.ts;
  • scim-transaction-scope.test.ts (the SCIM scope around the request).
• Every symbol anchor into the file. Before the cut, every auth-manager.ts#symbol anchor in the tracked tree outside changelogs was mapped with symbolSegmentResolution from scripts/symbol-anchors.mjs. There are 29, and all 29 are declaration-class at base, with the moved bodies blanked, and at head. None names a moved method. Two name a token the moved text carries, and each resolves on the declaration that stays:
  • #isScimProtocolPath (ADR-0134 :122; the moved handleRequest calls it);
  • #AuthManager (ADR-0135 :104; the moved log text spells [AuthManager]).

Proof

Builds and suites ran through os-verify-lock, and every exit code was captured before any pipe. Base 05cc3ee953, head 27f04eaa1c. A full turbo run build ran first. Then plugin-auth was built and its suite run at base, and again at head, on the same dependency dists.

1. The moved text.

• For each of the 3 methods, the base class body and the new module's function body are the same TypeScript token sequence (scanner tokens, kind and text, trivia skipped, each template literal re-scanned at its substitutions as the parser does).
• Every line is the base line minus exactly two leading spaces, and the parameters and return type are the same text.
• Each class method keeps its docblock and signature, with async dropped from handleRequest and ownsRoute.
• Result: 3 of 3 pass, 226 body lines.

moved	lines	tokens
handleRequest	200	465
ownsRoute	14	90
betterAuthEndpointPath	12	86

• Negative control: one token changed in the module ('production' → 'productio' in handleRequest) makes that method fail (tokens and lines DIFFER), and the run exits 1. The module was restored afterwards, and cmp against the saved copy was clean.
• An independent reading: git diff --color-moved=plain --color-moved-ws=allow-indentation-change 05cc3ee953 27f04eaa1c over the two source files marks 226 of the 233 deleted lines and 236 of the 361 added lines as moved.
  • The other 7 deleted lines are the two async signature lines, function isScimProtocolPath( (now export function), three one-line imports that keep a name that stays, and the buildBetterAuthRouteOwnership, line of a fourth.
  • The other added lines are the stubs' host literals, RequestRoutingHost, the module header, the per-function pointer docblocks and the import blocks.

2. .d.ts and exports (ruling 6348891160 items 1 and 2).

file	base	head	raw diff lines
dist/index.d.ts raw	b85cb81c24e981304d02184a9ef1294be702aa7aa9df1d327f51e66be9dcfd33	same	0
dist/index.d.ts normalised	c86ed39db60c3929cf287b59d6cc9aa1a2505ccbfbaa23a624af35a3fcd11abb	same
dist/index.d.mts raw	3561220e444c82fbf102db534ec2a274041db507ed9e38785c0993ca92b84f70	same	0
dist/index.d.mts normalised	6165644e3dfd1d779991e9bd63ceac3b9ab3dc47d910776ac5a88b4293ef6de5	same

• The normaliser, verbatim (the ruling's one-liner): node -e 'const s=require("fs").readFileSync(process.argv[1],"utf8");process.stdout.write(s.replace(/"[^"\n]*"(?:\s*\|\s*"[^"\n]*")+/g,r=>r.split(/\s*\|\s*/).sort().join(" | ")))' dist/index.d.ts | sha256sum.
• The raw files are already byte-identical, so no union-order swap occurs in this cut: items 1(b) and 1(d) hold with nothing to account for.
• Positive control: the head dist/index.d.ts with one private member made public (private betterAuthEndpointPath; → betterAuthEndpointPath;, line 2999, a one-line change) hashes raw b2c8e7ab8a562e54b2698e5eedf0fa8493704a880dd7e2f54ceac8c6963e1190 and normalised 67551d11baf0aa0d506ae5934c99f6148ab638c4cc856ab2e8ad918b28c38b56. Both differ from the readings above.
• Export lists: ESM dist/index.mjs and CJS dist/index.js each have 159 names at base and at head, the same list (the sha256 of the sorted names is 3abb126f5babb701… on all four). isScimProtocolPath, handleRequest, ownsRoute and betterAuthEndpointPath are not among them, and dist/index.d.ts names isScimProtocolPath and RequestRoutingHost nowhere.
• The bundle: 18 files in dist/ at both, the same list. Only index.js, index.mjs and their two .map files differ, as a move of code inside the bundle must.

3. Tests and lint.

• pnpm exec vitest run --maxWorkers=3 in packages/plugins/plugin-auth: base Test Files 189 passed (189), Tests 3580 passed | 10 skipped (3590), exit 0. Head: the same counts, exit 0.
• pnpm --filter @objectstack/plugin-auth typecheck (both tsc projects and check:test-typecheck): exit 0. pnpm --filter @objectstack/runtime typecheck: exit 0.
• eslint --no-inline-config (the root lint script's binary and flags) over the 2 source files: exit 0.

4. The censuses, the measurement and the anchors, at base and at head.

• The tenant-audit census, as above: 238 sites at both, 0 per-site differences, 0 unresolved and 0 unledgered at both, and every total the same. Only scannedSources (730 → 731, the new module) and measuredAt differ.
• scripts/measure-durability-swallow-family.mjs (a measurement, not a gate): 74 members and 88 quiet rows at both, the same with line numbers ignored. Two statistics move:
  • the scanned file count, 3,454 → 3,455 (the new module);
  • the droppedNotAwaited diagnostic, 245 → 242 (delete 158 → 156, update 25 → 24). Measured with an instrumented scratch copy, never committed: at base, ownsRoute's try (:6742) followed this.getOrCreateAuth() into its same-file body and met three un-awaited write-shaped calls there (:5544, :5742, :6961). In the new module that try cannot follow the call into another file, so it no longer meets them. They were dropped at base too, so no member moves. The other try that reaches the same three calls (:5097 at base) still does.
• These checkers were run by hand at base and at head, because dispatch-gates does not derive the ADR one. All six exit 0 at both:
  • check-adr-symbol-anchors: 2,384 anchors across 142 records, 466 symbol (440 declaration, 26 literal), at both;
  • check-adr-anchors: 81 anchored files; the decision-letter layer reads 1,978 and 1,977, as above;
  • check-scripts-symbol-anchors: 4,070 anchors at both;
  • check-spec-docblock-symbol-anchors: 5,075 anchors at both (both of these read in the same built tree);
  • check-system-context-census: 148 elevation read sites at both;
  • check-platform-checklist: 16 areas, 329 items at both.

5. Gates.

• node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derives 53 commands for the 2 paths. All 53 ran at 27f04eaa1c after the full build, and all 53 exited 0.
• --ran over the record with each exit code: 53 derived, 53 run, 0 NOT-MEASURED, a derived zero.
• check-governed-merges.mjs --branch HEAD: NOT governed, 594 changed lines.
• Docs drift (node scripts/docs-audit/affected-docs.mjs --json 05cc3ee953, exit 0): 2 pages, content/docs/kernel/contracts/auth-service.mdx and content/docs/permissions/authentication.mdx. Both name handleRequest as the IAuthService contract member, which the class method still is, with the same signature. So no doc edit is owed. 0 release-owned pages.
• Serial constraints (in the claim): 19 PRs are open, and none touches this cut's files, the ten modules the new one imports, or a reader above. origin/main moved to d44c8936b1 (chore(console): move the objectui pin 1d178e06ac5e → 6fb31dcc9954, past objectui#13370, so the console builds against the spec again #25455, the console pin) before the push, and git merge-tree of this branch onto it is clean.

Changeset

None: skip-changeset, per ruling 6348891160 item 4. The published declarations and export lists are unchanged, and the bundle's bytes move only because code moved inside it.

---

Generated by Claude Code

🤖 Generated with Claude Code

https://claude.ai/code/session_01LSXBc2GCBwiAL7vV4kWkyr

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-auth, touching 20 documentable anchor(s).

2 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/kernel/contracts/auth-service.mdx (via handleRequest (symbol, a method of class AuthManager; a top-level function))
• content/docs/permissions/authentication.mdx (via handleRequest (symbol, a method of class AuthManager; a top-level function))

What this run could not see

• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 21 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json d44c8936b1a217155c09603a7c3ecec556abda00 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 502ad4fcefc11d949917b1afe535a21c22da1483 — the merge of head 27f04eaa1cff935c90569fbc90ae591deb44ffbe into base d44c8936b1a217155c09603a7c3ecec556abda00, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 502ad4fcefc11d949917b1afe535a21c22da1483 && git checkout 502ad4fcefc11d949917b1afe535a21c22da1483
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin d44c8936b1a217155c09603a7c3ecec556abda00 27f04eaa1cff935c90569fbc90ae591deb44ffbe && git checkout -B drift-repro d44c8936b1a217155c09603a7c3ecec556abda00 && git merge --no-ff 27f04eaa1cff935c90569fbc90ae591deb44ffbe

node scripts/docs-audit/affected-docs.mjs --json d44c8936b1a217155c09603a7c3ecec556abda00

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs d44c8936b1a217155c09603a7c3ecec556abda00 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

席位核对 · ACCEPT · 2026-10-23T17:28Z

domain:services seat 1 (seat post #6021) · os-sales · session_016g7nYP9wdNx1GDa5XDr7Uy · card #25224 cut 10, request routing (claim 6369962162; os-dev-report 6370581239) · reviewed head 27f04eaa1c · merge base 05cc3ee953

• Shape: handleRequest, ownsRoute and betterAuthEndpointPath move unedited into auth-manager-request-routing.ts. This is shape B, using the same host pattern as cuts 1 to 9.
  • routeOwnership and routeOwnershipFor go as get/set pairs, because ownsRoute writes them.
  • Five host members go as late-bound closures.
  • isScimProtocolPath is an ADR-0134 symbol anchor. It stays in place, gains export, and is imported by value. This is the second application of ruling 6364006498 A on this card.
  • 2 files, +361 / −233.
• .d.ts, ruling 6348891160 item 1, re-run by the seat in its own worktree:
  • turbo run build --filter=@objectstack/plugin-auth at 05cc3ee953 and at this head.
  • At both: dist/index.d.ts raw b85cb81c24e98130… / normalised c86ed39db60c3929…, and dist/index.d.mts raw 3561220e444c82fb… / normalised 6165644e3dfd1d77…. The raw diff is 0 lines.
  • The seat's positive control makes head line 347, private options;, public. That moves both hashes, to raw b5bfafb8a790524d… and normalised a1fdbdc5e388918c….
  • Export lists: 159 on ESM and on CJS, base = head (report). index.ts does not list isScimProtocolPath.
• Gates re-run by the seat, all exit 0 at base and at head:
  • check-adr-symbol-anchors: 2384 … 466 symbol at both. The ADR-0134 anchor on isScimProtocolPath still resolves.
  • check-tenant-audit-census: 238 sites.
  • check-adr-anchors
  • check-dispatcher-error-vocabulary
• Decision-letter count, read by the seat: 1978 at base and 1977 at head, with anchored files 81 at both.
  • ADR-0069 D7 leaves with handleRequest's body for an unanchored module. No paragraph of the auth-manager.ts entry describes the moved bodies, so no entry is owed.
  • Accepted as disclosed, the same shape as cut 5's ADR-0131 D7.
• Readings:
  • Census, vocabulary and floors: no migration (report: 238 sites, 0 per-site diffs; vocabulary 56/56).
  • measure-durability-swallow-family's droppedNotAwaited diagnostic goes 245 → 242, because ownsRoute's try no longer helper-walks into getOrCreateAuth across files. Members (74) and quiet rows (88) are unchanged. This is a diagnostic, not a gate, and it is accepted as disclosed.
• Tests and gates (report): 3/3 bodies are token-identical, and a negative control exits 1. The suite gives 3,580 passed / 10 skipped at both ends. 53 derived gates exit 0. CI on this head: 34 success and 12 expected skips, none failed or pending (46 runs).
• Mergeable: git merge-tree onto today's main (5188e7f18f) is clean.
• Body: the seat adds the attribution header and requests the os-sales reviewer in this stroke. The footers are present.
• Declarations: refactor(plugin-auth), Clause-②: no, Metadata-protocol: none, skip-changeset, Ruling-ref: 6348891160, 6364006498. No contract-review record or dogfood battery is owed.
• Out of scope: the auth-manager.ts entry's ADR-0093 D2 paragraph names settleMembership, whose body moved in cut 8. The seat rules that this is a cut 8 miss. Cut 11 carries it as a declared reader fix: an anchor entry on the cut 8 module plus a one-paragraph header citation, in its own commit.
• Landing: not governed (check-governed-merges --pr 25508: 594 lines). Ready + auto-merge through the relay. The card stays open and dispatched. Cut 11 (resolvePasswordHasher, with isWebContainerRuntime exported in place) is claimed afresh on the merged main.

---

Generated by Claude Code