chore(lint): delete inert eslint-disable family comments in package sources (#14801)

package.json's lint script runs eslint with --no-inline-config, so every
inline eslint-disable / eslint-disable-next-line / eslint-enable comment
is ignored by the repo's only lint invocation. This deletes the 58 such
comments across 26 non-test source files under packages/** that carry
them at this branch's base (89a156a) -- comment removal only, no code
change. Per-comment measurement against eslint.config.mjs (see PR body)
confirms none of the named rules are configured there either, so the
deletion cannot expose a live finding.

Also re-anchors 5 line-number references in
content/docs/permissions/system-context.mdx that check:system-context-census
pins to exact lines in packages/rest/src/rest-server.ts -- one of this PR's
comment deletions shifted those lines by one, and the gate's own --fix
brought the anchors back in sync (verified green before and after).

Fixes #14529


Claude-Session: https://claude.ai/code/session_01WLJQhde67SeTccsmnBVarV

Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>

Author: claude[bot]

content/docs/permissions/system-context.mdx

@@ -158,7 +158,7 @@ The largest single consumer — **20 of the 109 sites**.
 |:--|:---|:---|:---|:---|
 | 48 | Object API-exposure gate bypassed (`apiEnabled` / `apiMethods`) | runtime | Get: internal self-writes ignore exposure declarations — these govern **external** exposure, not engine self-writes | `action-execution.ts:138` |
 | 49 | Action `requiredPermissions` bypassed | runtime | Get: engine self-invocation runs any action | `action-execution.ts:401` |
-| 50 | `manage_metadata` bypassed on metadata writes | runtime, rest | Get: schema writes without the capability | `domains/meta.ts:471`, `:874`, `rest-server.ts:4716`, `:6079`, `:6327`, `:6758`, `:6951` |
+| 50 | `manage_metadata` bypassed on metadata writes | runtime, rest | Get: schema writes without the capability | `domains/meta.ts:471`, `:874`, `rest-server.ts:4715`, `:6078`, `:6326`, `:6757`, `:6950` |
 | 51 | The shared metadata-write verdict itself returns `allowed` | metadata-core | Get: the one function all of row 50's doors consult answers yes before any capability is examined | `meta-write-capability.ts:134` |
 | 52 | Anonymous-deny seam satisfied on the domain dispatchers and the package/federation routes | runtime, rest | Get: passes with no `userId` | `domains/actions.ts:411`, `domains/ai.ts:60`, `domains/automation.ts:989`, `domains/meta.ts:232`, `domains/security.ts:78`, `domains/packages.ts:326`, `external-datasource-routes.ts:302`, `package-routes.ts:97` |
 | 53 | MCP principal check satisfied | runtime | Get: MCP surface reachable with no user | `domains/mcp.ts:61` |

packages/adapters/hono/src/index.ts

@@ -30,15 +30,13 @@ export type { Hono } from 'hono';
  * Minimal structural interface matching KernelManager from @objectstack/service-cloud.
  * Declared locally to avoid a circular build dependency.
  */
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
 export type KernelManager = any;
 
 /**
  * Opaque reference to an EnvironmentDriverRegistry from @objectstack/service-cloud.
  * Declared locally to avoid a circular build dependency. Pass an instance
  * of DefaultEnvironmentDriverRegistry from @objectstack/service-cloud at runtime.
  */
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
 export type EnvironmentDriverRegistry = any;
 import {
   createOriginMatcher,

packages/cli/src/utils/schema-migration-plugins.ts

@@ -640,7 +640,6 @@ export function createDeclarationBootWriteGuard(): DeclarationBootWriteGuard {
       else refusals.set(key, { driver: driverName, method, object, count: 1 });
       if (!warned.has(key)) {
         warned.add(key);
-        // eslint-disable-next-line no-console
         console.warn(
           `[migrate] ⚠ Refused ${method}() on ${object} via ${driverName}: a declaration `
           + 'boot refuses row writes. The plugin that issued it registers a writing hook '
@@ -667,7 +666,6 @@ export function createDeclarationBootWriteGuard(): DeclarationBootWriteGuard {
       else rawExecutions.set(driverName, { driver: driverName, count: 1 });
       if (!warnedExec.has(driverName)) {
         warnedExec.add(driverName);
-        // eslint-disable-next-line no-console
         console.warn(
           `[migrate] ⚠ Raw execute() called via ${driverName} during the declaration boot. `
           + 'A raw command cannot be classified as read or write, so it was FORWARDED, not '
@@ -699,7 +697,6 @@ export function createDeclarationBootWriteGuard(): DeclarationBootWriteGuard {
       else immediateDdl.set(key, { driver: driverName, method, object, count: 1 });
       if (!warnedDdl.has(driverName)) {
         warnedDdl.add(driverName);
-        // eslint-disable-next-line no-console
         console.warn(
           `[migrate] ⚠ ${method}() on ${object} called via ${driverName} during the declaration boot. `
           + 'Immediate DDL is not held back by the schema deferral, so it was FORWARDED, not '
@@ -1137,7 +1134,6 @@ export async function buildSchemaMigrationPlugins(opts: {
         + 'The plan below covers ONLY the objects the data stack registered — it does NOT '
         + "cover this deployment's own objects, so an empty plan here is UNMEASURED, not "
         + '"in sync". Fix the config (or its environment) and re-run.';
-      // eslint-disable-next-line no-console
       console.warn(`[migrate] ⚠ ${line}`);
       notes.push(line);
       hostConfigError = message;
@@ -1280,7 +1276,6 @@ export function refuseWhenHostConfigUnloadable(
 ): boolean {
   const line = describeUnloadableHostConfig(composition, options);
   if (line === null) return false;
-  // eslint-disable-next-line no-console
   console.error(`[migrate] ✗ ${line}`);
   process.exitCode = 1;
   return true;

packages/core/src/utils/metadata-activation-store.ts

@@ -124,11 +124,8 @@ export interface MetadataActivationStore {
  * what is used keeps every test double honest about that.
  */
 export interface MetadataActivationStoreEngine {
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
     find(object: string, options?: any): Promise<any[]>;
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
     insert(object: string, data: any, options?: any): Promise<any>;
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
     update(object: string, data: any, options?: any): Promise<any>;
 }
 
@@ -224,7 +221,6 @@ export class ObjectStoreMetadataActivationStore implements MetadataActivationSto
             context: SYSTEM_CTX,
         });
         const current = Array.isArray(existing)
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any
             ? existing.find((r: any) => r?.organization_id == null)
             : undefined;
 

packages/drivers/driver-sqlite-wasm/src/knex-wasm-dialect.ts

@@ -37,7 +37,6 @@ import {
 // re-bundling. We defer the actual `createRequire(...)` call so that the
 // CJS build (where `import.meta.url` is empty) doesn't blow up at module
 // init; the CJS path uses `globalThis.require` directly anyway.
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
 let cachedEsmRequire: any = null;
 function getEsmRequire(): any {
   if (cachedEsmRequire) return cachedEsmRequire;
@@ -168,7 +167,6 @@ export function statementMutatesDatabase(sql: string, method?: string): boolean
  * Wrapped in a function so the bundler cannot execute it at module init.
  */
 function resolveKnexSqlite3Dialect(): any {
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
   const g = globalThis as any;
   if (typeof g.require === 'function') {
     try {
@@ -184,7 +182,6 @@ function resolveKnexSqlite3Dialect(): any {
   return getEsmRequire()('knex/lib/dialects/sqlite3');
 }
 
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
 let cachedDialect: any = null;
 
 /**
@@ -193,7 +190,6 @@ let cachedDialect: any = null;
  * code so downstream re-bundlers (e.g. `packages/runtime`) cannot collapse
  * it into a Dynamic-require stub.
  */
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
 export function getClient_WasmSqlite(): any {
   if (cachedDialect) return cachedDialect;
   const Client_SQLite3 = resolveKnexSqlite3Dialect();
@@ -317,7 +313,6 @@ export function getClient_WasmSqlite(): any {
  * in some bundlers, which defeats the lazy pattern. New code should call
  * `getClient_WasmSqlite()` directly.
  */
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
 export const Client_WasmSqlite: any = new Proxy(function () {} as any, {
   get(_t, prop) {
     return (getClient_WasmSqlite() as any)[prop];

packages/metadata-protocol/src/sys-metadata-repository.ts

@@ -1034,7 +1034,6 @@ export class SysMetadataRepository implements MetadataRepository {
         row,
       );
       // Strip body for the header projection.
-      // eslint-disable-next-line @typescript-eslint/no-unused-vars
       const { body, ...header } = item;
       yield header;
     }

packages/metadata/src/plugin.ts

@@ -633,33 +633,28 @@ export class MetadataPlugin implements Plugin {
                         w.on('change', () => { void reload(); });
                         w.on('add', () => { void reload(); });
                         this.artifactWatcher = { close: () => w.close() };
-                        // eslint-disable-next-line no-console
                         console.log('[MetadataPlugin] artifact file watcher attached', src.path);
                     } catch (e: any) {
                         ctx.logger.warn('[MetadataPlugin] artifact watcher failed to start', { error: e?.message });
                     }
                 }
                 if (hub) {
-                    // eslint-disable-next-line no-console
                     console.log('[MetadataPlugin] HMR endpoint registered at /api/v1/dev/metadata-events');
                 } else {
                     // Printed on every non-development boot, deliberately: a
                     // closed door that says nothing is indistinguishable from a
                     // door that was never asked about, and this line is what an
                     // operator greps when the Studio preview stops
                     // auto-reloading.
-                    // eslint-disable-next-line no-console
                     console.log(
                         '[MetadataPlugin] dev metadata-HMR endpoints NOT mounted — they require '
                         + `NODE_ENV=development (this process: ${process.env.NODE_ENV ? `NODE_ENV=${process.env.NODE_ENV}` : 'NODE_ENV unset, treated as production'})`,
                     );
                 }
             } else {
-                // eslint-disable-next-line no-console
                 console.log('[MetadataPlugin] HTTP server with getRawApp() not available — skipping HMR endpoint');
             }
         } catch (e: any) {
-            // eslint-disable-next-line no-console
             console.warn('[MetadataPlugin] Failed to register HMR endpoint', e?.message);
         }
     }

packages/objectql/src/having-filter.ts

@@ -361,7 +361,6 @@ function checkCondition(
     || condition instanceof Date
     || Array.isArray(condition)
   ) {
-    // eslint-disable-next-line eqeqeq
     return value == condition;
   }
 
@@ -391,9 +390,7 @@ function checkCondition(
     }
     if (value === undefined && !NO_VALUE_ANSWERED_BY_OPERATOR.has(op)) return false;
     switch (op) {
-      // eslint-disable-next-line eqeqeq
       case '$eq': if (value != target) return false; break;
-      // eslint-disable-next-line eqeqeq
       case '$ne': if (value == target) return false; break;
       case '$gt': if (!(value > target)) return false; break;
       case '$gte': if (!(value >= target)) return false; break;

packages/objectql/src/validation/rule-validator.ts

@@ -2417,7 +2417,6 @@ function matchesNamedFormat(format: FormatRule['format'], str: string): boolean
       return PHONE_RE.test(str);
     case 'url':
       try {
-        // eslint-disable-next-line no-new
         new URL(str);
         return true;
       } catch {

packages/plugins/plugin-auth/src/auth-manager.ts

@@ -236,7 +236,6 @@ function installWebContainerRequestStatePolyfill(): void {
   if (!g[sym].context) g[sym].context = {};
   if (!g[sym].context.requestStateAsyncStorage) {
     g[sym].context.requestStateAsyncStorage = new WebContainerRequestStateAsyncLocalStorage();
-    // eslint-disable-next-line no-console
     console.warn(
       '[AuthManager] WebContainer detected: installed synchronous request-state polyfill ' +
         '(node:async_hooks AsyncLocalStorage does not propagate context across await in WebContainer).',