Repair the ten plugin-auth durability swallows — batch 5 of the #12981 worklist (#13488)

* fix(plugin-auth): report the refused identity writes ten `catch {}` sites swallowed

Ten tier-1 DARK durability swallows in `plugin-auth`: a refused write that was
neither logged, rethrown, nor delivered to the caller. Control flow is unchanged
at every site — a bookkeeping write must never turn a valid sign-in into a 500 —
but the failure is no longer silent.

Eight in auth-manager.ts (stampIdentitySource, stampPasswordChangedAt,
recordPasswordHistory, recordSignInOutcome, stampLastLogin, unlockUser,
enforceSessionControls, enforceConcurrentCap) report through a new in-file
`logDurabilityDegradation` on the guaranteed `warn` channel. Two in
auth-plugin.ts report at `error` through the kernel Logger, whose `error` is
required.

Three inline `.catch(() => undefined)` swallows inside the two session controls
are repaired in the same change: they sit between the refused write and the
enclosing catch, so repairing only the outer handler would have produced a
reporter that could never fire.

What was hiding in the silence was mostly security controls that had quietly
stopped enforcing — lockout accounting, the password-reuse ring, session
revocation, the concurrent-session cap, and the managed-identity provenance
stamp that gates local-password self-service.

Every seam is pinned by a test that fails if the site goes silent again, plus
two absence-asserting cases so a seam that warns unconditionally cannot pass.

The `AuthManager` sink is re-exported from the package index.ts and declares no
`error`, so the LEVEL stays `warn` and is recorded on the programme card rather
than changed here.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012WkdHQwHr2KQmaX7P1BHzi

* docs(permissions): re-anchor the census row this batch's line shift rotted

PURE LINE ROT, established before fixing: the page carries exactly one anchor
for auth-plugin.ts and this file's `isSystem` occurrence list is byte-identical
to the merge base's — same 11 occurrences, same text, same order — so no
elevation read was added or removed. `--fix` rewrote the one anchor, 1254 ->
1288. Row 10 keeps the value that landed on main meanwhile.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012WkdHQwHr2KQmaX7P1BHzi

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: Elon Musk

.changeset/auth-swallow-family-batch-5.md

@@ -0,0 +1,73 @@
+---
+"@objectstack/plugin-auth": patch
+---
+
+fix(plugin-auth): report the refused identity writes ten `catch {}` sites swallowed (#12981)
+
+Batch 5 of the ruled `catch { return null; }` worklist, scoped to `plugin-auth`.
+A re-run of the census instrument
+(`scripts/measure-durability-swallow-family.mjs`) moves tier-1 DARK from
+**21 sites in 11 files to 11 in 10**, with `LOUD` rising **32 → 34** and the
+adjacent `QUIET` bucket **85 → 93** — the ten, moved, nothing else touched.
+
+Every site swallowed a refused write into a bare `catch` whose comment said
+"best-effort". That was true about **control flow** — a bookkeeping write must
+never turn a valid sign-in into a 500 — and it was being read as permission to
+say nothing, which is a different decision. The request answered 200, the
+session was issued, and nothing downstream looked wrong; the write simply did
+not happen. In `plugin-auth` that silence was hiding **security controls that
+had quietly stopped enforcing**.
+
+**What an operator now sees that they did not before** — one line per seam,
+each naming the object that did not land, the control that is consequently not
+enforced, and the remedy:
+
+- **`recordSignInOutcome`** — a refused `failed_login_count` / `locked_until`
+  write means consecutive failures never accumulate and the account is never
+  locked: `lockoutThreshold` (ADR-0069 D2) is configured and not enforced, so a
+  brute-force run against that account meets no limit.
+- **`recordPasswordHistory`** — a refused ring write means the password just
+  replaced was never recorded, so `passwordHistoryCount` (ADR-0069 D1) will not
+  refuse it next time. "You cannot reuse your last N passwords" is advertised
+  and, for that identity, not enforced.
+- **`enforceSessionControls`** — a refused revocation leaves a session that IS
+  past its idle / absolute limit fully live (ADR-0069 D4). A refused activity
+  heartbeat is reported separately, because it fails the other way: the idle
+  clock keeps measuring from an older instant, so an active user is signed out
+  **earlier** than the configured window.
+- **`enforceConcurrentCap`** — a refused revocation leaves the account holding
+  more simultaneous sessions than `maxConcurrentSessions` allows.
+- **`stampIdentitySource`** (and its SCIM twin in `auth-plugin.ts`) — a refused
+  provenance stamp leaves a federated identity still reading `env_native`, so it
+  is offered the local-password actions that are supposed to hide for a managed
+  identity (cloud ADR-0024 D4) — the path by which a managed user self-mints a
+  password that bypasses enforced SSO. The SCIM hook is the sharper of the two:
+  it is the **only** stamp on the adapter-level path and nothing retries it.
+- **`unlockUser`** — the password stage is cleared and the method still answers
+  `true`, so the admin is told the unlock worked while a user locked at the
+  second factor stays locked with no escape hatch at all. That `true` is
+  exactly why the silence had to go.
+- **`stampPasswordChangedAt`** — a refused write leaves any admin-issued
+  force-change flag SET (so the user is told to change a password they just
+  changed) and leaves the password-age policy reading a timestamp for a password
+  that no longer exists.
+- **`stampLastLogin`** — this write is what plugin-audit turns into the
+  change-trail row, so a refusal leaves the sign-in with **no** trace in the
+  compliance ledger at all.
+
+Three inline `.catch(() => undefined)` swallows inside the two session controls
+are repaired in the same change. They are not optional to it: they sit between
+the refused write and the enclosing `catch`, so repairing only the outer handler
+would have produced a reporter that could never fire — a green-looking fix over
+an unchanged silence.
+
+Level: the eight `AuthManager` seams report at `warn`, not `error`.
+`AuthManagerOptions.logger` declares `{ info?; warn }` with no `error` and is
+re-exported from the package `index.ts`, so adding one is a published-shape
+change; #12981 routes that question to #13398 and scopes this batch to the
+**silence**, exactly as batches 1 and 2 did for `plugin-security`. The two
+`AuthPlugin` seams log through the kernel `Logger`, whose `error` is required,
+and use it.
+
+No entry was added to `scripts/durability-degradation.baseline.json`, and the
+gate vocabulary is untouched in either direction.

content/docs/permissions/system-context.mdx

@@ -97,7 +97,7 @@ that silently does not happen.
 | 8 | `explain()` may target a principal other than the caller | plugin-security | Get: no `manage_users` / delegated-admin check | `security-plugin.ts:3808` |
 | 9 | Anonymous-deny treats the caller as authenticated | core | Get: passes the 401 seam with no `userId` | `anonymous-deny.ts:154` |
 | 10 | Permission-set projection middleware skipped | plugin-security | Lose: projection of permission-set-derived columns | `permission-set-projection.ts:1015` |
-| 11 | Session-resolution middleware skipped | plugin-auth | Get: no session lookup attempted | `auth-plugin.ts:1254` |
+| 11 | Session-resolution middleware skipped | plugin-auth | Get: no session lookup attempted | `auth-plugin.ts:1288` |
 | 12 | Per-request performance timings disclosed | observability | Get: timing headers a normal caller cannot pull | `perf-timing.ts:474` |
 | 13 | Permission-set **overlay discard** skips the tenant-admin assertion | plugin-security | Get: an overlay can be discarded with no authenticated tenant administrator | `permission-set-overlay-discard.ts:142` |
 | 14 | MCP stdio bridge skips the object API-exposure gate | mcp | Get: the bridge reaches objects whose `apiEnabled` / `apiMethods` would refuse an external caller | `stdio-data-bridge.ts:246` |