chore(typecheck): seven ledgered packages type-check their own tests through a sibling test program (#12511) - #16295

Part of #12511.

Seven of the card's eight residual packages now type-check their own tests through a sibling
test program named by their own typecheck script, so an error in a test file surfaces in
seconds instead of only after a full-closure build. @objectstack/http-conformance is
deliberately left out — its hole needs a config-policy judgement that is the card's to make,
stated at the bottom.

Config only: tsconfig.test.json (new, 7), package.json scripts (7), test-typecheck-debt.json
(new, 7, measured), the TEST_DEBT rows in scripts/check-type-check-coverage.mjs, the merge
dispositions in scripts/regen-artifacts.mjs, and a declared re-baseline in
scripts/check-type-source-resolution.mjs. No src/** and no test file is edited anywhere.

The census — measured, with positive controls in the same run

Limb 2 is decided by RUNNING every config each package's typecheck script NAMES under
tsc --noEmit --listFiles and counting that package's own test files in the resulting program —
never by looking for a tsconfig.test.json on disk. Taken at 6a1e38244 with the dependency
closure built, and re-confirmed on the merged tree at bb4ccec4e.

Positive controls, same binary, same run, same worktree — without them every zero above is
unfalsifiable: packages/rest tsconfig.test.json 186 test files in program;
packages/metadata-core tsconfig.test.json 15; packages/drivers/driver-memory
tsconfig.json (no test exclusion) 44. Every program in the table also holds a non-zero
count of the package's own src files, so no zero is an empty-program artifact.

The coverage gate's own summary line, before and after:

before  test layer: 8 package(s) still hide their own tests from tsc
        (111 files hidden as counted by this run, 87 frozen raw errors in TEST_DEBT).
after   test layer: 1 package(s) still hide their own tests from tsc
        (5 files hidden as counted by this run, 2 frozen raw errors in TEST_DEBT).

pnpm check:type-check-coverage exits 0 before and after; --self-test exits 0 (55 semantic +
97 observation + 45 re-measure + 28 built-closure + 19 auto-lowering + 18 exit-code cases hold).

Not a blanket edit — where the per-package judgement actually diverged

Each config states its own reading in its own header. The two axes that mattered:

rootDir is inherited untouched in all seven — every test file lives under src, and the two
imports that escape the package (scripts/js-comment-mask.mjs, from mcp and platform-objects)
land on a checked-in js-comment-mask.d.mts, so the raw programs carry no TS6059. Measured, not
reasoned. Strictness is untouched everywhere, and no config declares paths (a child's paths
replaces the parent map rather than merging into it).

lib: ["ES2022"] has a measured effect of zero on today's tree in all seven — no TS2550
either way. It is stated that way rather than claimed as a subtraction; it is fidelity to the Node
vitest actually runs on, and it is the exact trap the card was filed about (Object.hasOwn is
TS2550 against a pre-ES2022 lib while the package's advertised typecheck says nothing).

TEST_DEBT attribution — both directions, no remainder

RAW is re-measured on the way out through the coverage gate's own remeasureProject shape
(extends the package's tsconfig.json, drops ONLY the test glob) at 6a1e38244 with the closure
built. RECORDED equalled RAW for all seven, class for class and file for file.

The single dissolution is formula's TS1470 x2 under module: esnext. Nothing was exposed
behind it — there was no unresolved-import cascade to collapse in any of the seven, so there is
no +n term anywhere. Not one of the 83 is repaired here; this change edits no test file, and each
would have been reported on origin/main had these programs always existed.

One composition correction the deleted formula entry earned: it attributed its TS2591 x6 to
process. Measured, all six are node builtins named as bare specifiers (node:fs x2,
node:path x2, node:url x2) and the TS2339 x2 beside them read
Property 'url' does not exist on type 'ImportMeta' — one cause, this package declaring no
@types/node and naming no types. Real debt, now ledgered per file and per signature, and
deliberately not repaired here.

Two mechanical consequences, both recorded in place:

• scripts/regen-artifacts.mjs gains seven NOT_DRIVER_MANAGED rows, one per new ledger.
  reconcileGenerators keys on (owner, script), so one row standing for the family would be a
  disposition nobody made for any of these files. pnpm check:merge-driver exits 0.
• scripts/check-type-source-resolution.mjs takes the re-baseline its own doc-block opens for
  exactly this case, with the provenance the doc-block requires: every admitted dep is annotated
  via tsconfig.test.json by the gate itself, i.e. reached only through the program this change
  onboarded. 125 -> 132 programs, 61 -> 61 entries, 310 -> 319 package-dep pairs
  (mcp +2, platform-objects +3, the three connectors +1 each, service-sms +1).
  formula onboarded a program and admitted nothing, which is the control saying the other six
  report a real widening rather than an artifact of the population growing. paths is measured to
  be the wrong tool for the onboarding case (PR build(rest): give the package a test-layer tsc program and ledger its 37 errors #12570: 37 -> 42, billing other packages' source
  diagnostics into the onboarding package's ledger), so the two places where a vitest alias and the
  type program now disagree about which artifact they read are declared there rather than
  papered over.

Positive control — the card's own claim, reproduced

One deliberate type error planted in an unledgered test file of a wired package, on the
committed tree, restored by blob hash. Nothing from this step is committed.

HEAD blob:                 284876511f134709f854edec7bed238b1878d30c
on-disk before:            284876511f134709f854edec7bed238b1878d30c
anchor occurrences before: 1        (unique — otherwise the control did not run)
injected occurrences:      1        (proof it reached disk; an editor's exit code is not proof)
on-disk after mutation:    557714f45394567d5e6787c53c84d5df2c1a9090

--- pnpm --filter @objectstack/connector-rest typecheck (mutated tree)
elapsed: 8s   typecheck exit: 1
check:test-typecheck: 1 problem(s)
  - src/connector-rest-plugin.test.ts: 1 type error(s) in a file the ledger does not cover.

on-disk after restore:     284876511f134709f854edec7bed238b1878d30c   (== HEAD blob)
git diff HEAD  -> empty
git status --porcelain -> empty

8 seconds on a shared box, naming the file. Before this change the same error was invisible to
that package's advertised typecheck and reachable only through a full-closure build — the ~9
minutes the card measured. Restore is git checkout HEAD -- <path> (never a bare checkout, which
reads the index the mutation polluted), under a trap with absolute paths.

Verification, pinned to bb4ccec4e

• Each wired package's own typecheck, both legs, on the merged tree with the closure built: 7 of
  7 exit 0, each printing check:test-typecheck: OK with its ledger held exactly
  (53 / 15 / 3 / 5 / 5 / 1 / 1 errors; 8 / 12 / 2 / 1 / 1 / 1 / 1 pinned signatures).
• Gate union derived with node scripts/pm/dispatch-gates.mjs --changed --commands --repo objectstack-ai/objectstack
  on the final tree: 70 commands, 70 run. Exit codes captured before any pipe.
  67 exit 0 on the first pass. Three returned exit 3 — PREREQUISITE NOT MET, which is NOT
  MEASURED and not a finding, never a red (check:dual-build-cjs-loads and check:i18n need a
  full workspace build; check:type-check-debt OOM'd under a 4096 MB ceiling the runner imposed,
  below the 6144 MB the CI job uses). Re-run with pnpm build done (exit 0) and at CI's ceiling,
  all three exit 0 — so 70 of 70 exit 0. check:type-check-debt's own verdict line:
  check-type-check-coverage --re-measure: OK — 5 ledger entr(ies) re-measured in 95.9s, 55 raw tsc error(s) total, none above its recorded number.
• Not run locally, by design: the repo-wide pnpm lint sweep and the full test farm are CI's.

skip-changeset applied: config-only, nothing is published from any package by this diff.

What did NOT graduate, and why it is the card's call

@objectstack/http-conformance keeps its entry. Its 2 recorded errors reproduce exactly
(TS2307 x1, TS2304 x1) and its own ledger note already says what they are — both inside
node_modules .d.ts files (@better-auth/core's bun:sqlite import, @better-fetch/fetch's
Timer), so the entry moves with the lockfile rather than with this package's code.

The reason it cannot take the sibling route unchanged is a fact this repo had not recorded:
packages/qa/http-conformance/tsconfig.json is one of six package configs that do not extend
the repo root config, and it is the only one of those that also declares no skipLibCheck — which
is the sole reason those two third-party declarations are checked at all. Both available repairs
depart from precedent:

• Ledger them per file. That keys a shrink-only, EXACT ratchet on .pnpm content-hash paths
  that move on any unrelated dependency bump — a ledger nobody can pay down, and red for reasons
  that are about no test.
• Turn skipLibCheck on. None of the 31 sibling test configs declares it, and the alternative
  — putting it in the build config, or making that config extend the root like every other package —
  changes what the build program reports for src too, which every one of the 31 precedents
  explicitly refuses to do.

That is a judgement about this repo's config policy rather than about this package, so it is left
to the card rather than taken here.

Generated by Claude Code