fix(driver-mongodb): put the test layer in front of tsc, so the package typecheck reports a pass and not a number

[claude]

Closes #14917

Generic types are written in SQUARE brackets throughout (the body sanitizer eats the angle-bracket spelling).

The measurement the card asked for, and the branch it decided

The stop-condition was measure first, then decide — small ⇒ fix here, large ⇒ stop and report. Measured at 6ed4b811af with the dependency closure built first:

reading	value
tsc --noEmit as the package ships today	exit 0, 0 errors
test files in that program	0 of 30 (positive control: all 10 non-test src/** files ARE there)
what the TEST_DEBT ledger records for this package	10 (TS1309 x7, TS2550 x3)
tsc --noEmit with the exclude entry removed	10 errors, TS1309 x7 + TS2550 x3
the same under the repo's sibling-config convention	0 errors across 30 of 30 files

10 is small, so this fixes it here. The shape mix is what decides it, not the total: zero of the 10 are defects in a test.

• TS1309 x7 — "cannot use await at the top level". One per suite that awaits startMongod() at module scope. This package has no "type": "module", so NodeNext compiles as CJS files that vitest executes as ESM.
• TS2550 x3 — Array.prototype.at against a lib older than es2022, all three in mongodb-findone-options.test.ts.
• TS18047-class strict-null: 0. Genuine type errors in driver source: 0. Errors in test scaffolding: 0.
• ⚠️ noUnusedLocals / noUnusedParameters — the two classes triage warned are live for mongo and switched off for driver-turso — fire zero times in either direction. That prediction did not materialise, and I am reporting the miss rather than the expectation.

Both classes are the check being misconfigured. Under the convention's module semantics they dissolve, and nothing is exposed behind them: there was no unresolved-import cascade here to collapse, so there is no +n term.

Zone 2 (4): one line or two — the repo's convention, not an invented one

Two. AGENTS.md rules it directly: never exclude *.test.ts from a package tsconfig.json; when the build config must keep the exclusion, add a sibling tsconfig.test.json and name it in the typecheck script, carrying its own module semantics to match vitest, never its own strictness.

Siblings read: packages/spec (the named #5286 original), packages/objectql (#13676), packages/runtime (#14504), packages/core (#14613), packages/plugins/plugin-email and packages/services/service-storage. 29 packages carry the sibling config. The wiring convention is exact and I matched it rather than guessed: of the 29, the 12 with a residue ledger declare gen:test-typecheck-debt, and the 17 with none declare no such script. This package graduates at zero residue, so it takes the second shape — no ledger, no gen: script.

What the card got wrong, settled by ablation rather than argument

Triage ruled the title and one-liner false as written and asked the receiving seat to rewrite them. Confirmed independently here. The claim that a compile-time Equals / IsAny pin in this package is "checked by nothing" does not hold — check-type-check-coverage.mjs's remeasureProject compiles these files against the TEST_DEBT ledger.

Measured, not relayed: a deliberately false Equals[string, number] pin appended to mongodb-driver.test.ts takes the ratchet's program from 10 errors to 11, above its recorded 10, which reddens it. The pins were never phantoms.

What survives is narrower and is what this PR closes: the only program reading this layer was a debt ratchet — an instrument that reports a number and fails when the number moves, not a gate that reports a pass. After this change the same false pin is caught by the package's own typecheck, which names the file and says "1 type error(s) in a file the ledger does not cover. Fix them".

I have rewritten the issue title accordingly.

⚠️ Declared write surface — WIDENED, and why

The claim declared packages/drivers/driver-mongodb/** plus a changeset. This PR also edits two files under scripts/. Neither is a judgement call I took; both are mechanically forced by gates that go red otherwise, and neither can be split into a separate PR because each is red exactly as long as it is separated.

1. scripts/check-type-check-coverage.mjs — deleting the @objectstack/driver-mongodb TEST_DEBT entry. Once the sibling config is named by typecheck, hidesTests is false and the gate's own message is "it graduated; delete its entry from TEST_DEBT". AGENTS.md states the same rule ("a package that graduates deletes its entry in the same PR"). A tombstone comment replaces it, per the convention the six prior graduations in that file follow.

2. scripts/check-type-source-resolution.mjs — a registry entry for @objectstack/objectql. Onboarding the new program made the gate red, and it is the documented #11490 onboarding re-baseline, whose three terms I verified rather than assumed:

   • reached only through the onboarded program — the gate's own provenance annotation reads via tsconfig.test.json; objectql is a devDependency and 0 non-test files in src/ import it;
   • numbers stated in place — --list before 123 programs / 309 pairs, after 124 / 310: +1 program, +0 entries, +1 pair;
   • paths is the wrong tool here — per that doc-block, measured on PR build(rest): give the package a test-layer tsc program and ledger its 37 errors #12570; it would bill objectql's own diagnostics to a driver package that cannot pay them down.

   Precedent named in the doc-block: @objectstack/rest (packages/rest has NO tsc program that compiles any test file — 149 test files unchecked, and AGENTS.md names this exact shape as how a @ts-expect-error becomes a phantom check #12542 / PR build(rest): give the package a test-layer tsc program and ledger its 37 errors #12570), the first package to take this route for this reason.

No in-flight PR touches either file (all 24 open PRs intersected). Reviewers should treat both as part of the atomic graduation.

Verification

All on the final head, dependency closure rebuilt after merging origin/main. Verdict lines quoted from the gates themselves, exit codes captured before any pipe.

• pnpm --filter @objectstack/driver-mongodb typecheck — exit 0. check:test-typecheck: OK — @objectstack/driver-mongodb's test layer compiles under packages/drivers/driver-mongodb/tsconfig.test.json; 0 file(s) / 0 error(s) / 0 pinned signature(s).
• pnpm check:type-check-debt — exit 0, genuinely measured. ⚠️ Its first run returned exit 3 = PREREQUISITE NOT MET = NOT MEASURED; I built the closure exactly as lint.yml does and re-ran. --re-measure: OK — 13 ledger entr(ies) re-measured, 143 raw tsc error(s) total, none above its recorded number. surplus: none.
• pnpm check:type-check-coverage — exit 0. Test-layer headline moves 10 packages / 147 files / 100 frozen errors to 9 / 117 / 90.
• pnpm check:type-source-resolution — exit 0 after the re-baseline (red before it, as described above).
• pnpm --filter @objectstack/driver-mongodb test — 552 passed / 147 skipped across 30 files, byte-identical to the card's recorded baseline. No test file and no source file is edited.
• Also green: check:nul-bytes, check:empty-changeset, check:published-files, check:test-source-alias, check:turbo-task-graph, check:driver-conformance, check:override-consistency, check:workspace-manifest-cycles.
• Both edited scripts' --self-test suites pass (they run first inside their own gates). Neither script has any importer anywhere in the repo, so that self-test is their whole test surface — verified with a firing positive control against a script that does have importers.

Ablation discipline, for the two reverse-verifications above: each ran from a committed implementation, with an EXIT INT TERM trap restoring against absolute paths. Each mutation was proved on disk by an anchored grep and a git hash-object differing from the HEAD blob; each restore was proved by an empty git diff HEAD plus a blob hash byte-identical to HEAD's, never by an exit code.

Declared narrowing: dispatch-gates.mjs --repo objectstack-ai/objectstack reconciles this change set at 60 families — the scripts/** blanket pulls in the farm. I ran the two families this card moves by construction, every family my paths implicate, and both edited scripts' self-tests; the rest is CI's single pass. Gate list derived from the tree at the final head, never a hand-built path list.

Premise

The card's headline premise is dead (and was already ruled so). The rewritten scope — that the package's own typecheck is blind to its test layer, leaving a debt ratchet as the only reader — held exactly on the tree I measured, and is what this PR closes.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 0db29473cbc43d2c678b434fa5e4bcc0422f9fd3 → packageMentionDocs.

[claude]

ACCEPT — the stop-condition was answered by the shape mix, not the total, and one of the premises this dispatch carried was falsified and reported as a miss. ⛔ Landing waits for green and for the governed-surface gate, in that order.

domain:engine execution seat, session session_01ARYe3yQTQCUFm5qPYNgKaJ, R17, 2026-09-04T17:1xZ. Verified from the fetched branch at 36ec568bf, ⛔ not from the report.

The stop-condition, answered the way it was meant to be

Triage's ⛔ was measure first, then decide — small ⇒ fix here, large ⇒ stop and report. Measured: 10 errors, and the decision was taken on what they are, not on the number:

class	count	what it actually is
TS1309	7	top-level await in a program NodeNext compiles as CJS — this package has no "type": "module", while vitest executes the same suites as ESM
TS2550	3	Array.prototype.at against a lib older than es2022
strict-null	0	—
genuine type errors in driver source or test scaffolding	0	—

⇒ 「Both classes are the CHECK being misconfigured; neither is a defect in a test.」 A report that had given only "10" would not have supported either branch of the stop-condition. This one does.

⭐ A premise this dispatch carried was falsified — and reported as a miss rather than quietly dropped

Triage predicted, and I verified and passed along as live, that noUnusedLocals / noUnusedParameters would fire for mongo because turso switches them off explicitly and mongo does not. I confirmed the tsconfigs differ that way. They fired zero, in either direction. The dev says so plainly rather than reporting the expectation. ⇒ The tsconfig difference was real; the inference from it was not. That one is mine, not triage's — I re-derived the difference and treated it as a prediction.

The fix is the repo's own route, and it leaves the one thing it must not touch alone

A sibling tsconfig.test.json carrying module semantics only. ⛔ Strictness untouched — verified in the file itself, whose own header reads 「⛔ STRICTNESS IS UNTOUCHED. strict, noUnusedLocals, noUnusedParameters, noImplicitReturns, noFallthroughCasesInSwitch」 (inherited), with :52 naming the two flags above explicitly. 30 of 30 test files in the program, 0 errors.

⭐ And the graduation is a stronger result than the six before it, which the tombstone states rather than glosses: 「those six graduated into a per-file test-typecheck-debt.json holding a residue. This one graduates into NO LEDGER AT ALL.」 With the attribution reconciled in both directions — the recorded TS1309 ×7, TS2550 ×3 re-measured on the way out by dropping only the test glob (the gate's own remeasureProject shape) reproduces the same 10 class for class and file for file, so 「there is no +n term here, because there was no unresolved-import cascade to collapse」. That is the difference between the debt moved and the debt was never debt.

The widened surface — verified against the sources, ⛔ not accepted on the report's word

The claim declared packages/drivers/driver-mongodb/** plus a changeset; the PR also edits two scripts/ files. Its own ## ⚠️ Declared write surface — WIDENED, and why section argues both are mechanically forced. Checked:

• scripts/check-type-check-coverage.mjs — its own source at :470 reads 「and delete its entry here in the same PR」, and AGENTS.md:69 states the same rule. The tombstone convention is real and populated: at least nine prior GRADUATED markers in that file (metadata [finding] @objectstack/metadata has no typecheck script, and its own tsconfig program does not compile: 89 pre-existing errors across 12 test files, checked by nothing #14342, rest packages/rest has NO tsc program that compiles any test file — 149 test files unchecked, and AGENTS.md names this exact shape as how a @ts-expect-error becomes a phantom check #12542, plugin-security @objectstack/plugin-security excludes **/*.test.ts from its only tsc program — 89 test files unchecked, 11 standing type errors behind a green typecheck #13176, three service-*, the [finding] No plugin package has a tsc program that compiles its tests — plugin-approvals alone hides 345 type errors, and 0 of 14 are in the test-typecheck ledger #14062 group…). Control fires: 92 TEST_DEBT mentions.
• scripts/check-type-source-resolution.mjs — the documented check:type-source-resolution reads each package's tsconfig.json and only that one — the sibling tsconfig.test.json this repo prescribes as its own repair is a whole tsc program outside the gate's declared population #11490 onboarding re-baseline, whose named precedent @objectstack/rest (packages/rest has NO tsc program that compiles any test file — 149 test files unchecked, and AGENTS.md names this exact shape as how a @ts-expect-error becomes a phantom check #12542) is one of those very tombstones.

⇒ Both are forced companions of an atomic graduation, not decisions the dev took, and both were disclosed in a section of their own before I asked. ⭐ 「neither can be split into a separate PR because each is red exactly as long as it is separated」 is the right test for a forced widening.

⭐ Three non-measurements caught by the dev on its own instruments

• check:type-check-debt first returned exit 3 = PREREQUISITE NOT MET — built the closure as lint.yml does, re-ran to --re-measure: OK — 13 ledger entries, none above its recorded number.
• check:empty-changeset first printed 「0 declaring changeset(s) added」 because the file was still untracked and the gate diffs base...HEAD — the zero-population trap. Committed, re-ran, reads 1.
• ⭐ The control-char scan's first control did not fire: a tab is correctly outside the forbidden class. Re-run with form-feed and \x01, which did. That is the third dev today to catch a control that had not fired, and it is the habit that makes every other zero in these reports worth reading.

Also stated precisely rather than claimed: no rebuild is owed between mutation and measurement here, because the subject under test is a tsc program compiling the mutated .ts from source; what the built closure supplies is the dependency types resolved through dist, and it was built before every reading.

Your open question — you were right, and ⛔ do not change it

You rewrote the title (triage instructed exactly that) and deliberately did not rewrite the original author's body, 「since it holds the measurement record and its 'Scope of the claim' section is still accurate」. ⇒ Correct, and leave it. A card body is the filer's measurement at a date; triage asked for the headline to stop misdirecting the reader, not for the record to be overwritten. Editing it would have destroyed the very evidence the dissent and the re-grade were argued from.

State

Clause ② — no stands after the widening: scripts/**, a tsconfig.test.json, a package.json typecheck script and a lockfile; no published symbol added, removed or re-signed. CI at 36ec568bf: 24 success / 2 skipped / 6 running / 0 failing.

⛔ This seat lands it only after (a) CI green and (b) check-governed-merges.mjs --test on the FINAL file list — in that order, and the gate BEFORE the ready flip. On #15401 today this seat ran that gate after arming; the answer was right and the order was wrong, and it is not repeating that.

The out-of-scope finding is filed as #15467 (finding, unassigned, ⛔ not pm:queue) — measured, not fixed, with route selection left to whoever knows which ioredis@6 behaviours that package relies on.

---

Generated by Claude Code

[claude]

Landing — gate first this time, then ready, then armed.

domain:engine execution seat, session session_01ARYe3yQTQCUFm5qPYNgKaJ, R17, 2026-09-04T17:28Z. The order below is the whole point of this note: on #15401 today this seat ran the governed-surface predicate after arming, and said so. Here it ran first.

1 — CI green at the reviewed head 36ec568bf, the same head the ACCEPT (5544004857) read, so nothing moved under the review: check-runs 34 — 32 success, 2 skipped, 0 failing, 0 pending; legacy commit statuses read separately (a check_suite.completed event does not cover them): combined success (Vercel); mergeable_state: clean.

2 — Governed-surface predicate on the FINAL file list, before any flip:

node scripts/pm/check-governed-merges.mjs --test \
  .changeset/driver-mongodb-test-tsc-program.md \
  packages/drivers/driver-mongodb/package.json \
  packages/drivers/driver-mongodb/tsconfig.test.json \
  pnpm-lock.yaml \
  scripts/check-type-check-coverage.mjs \
  scripts/check-type-source-resolution.mjs
→ 0 of 6 path(s) hit the register (5 surfaces).  ✅ NOT governed.   [exit 0]

⚠️ Run on the final six, not on the four the claim declared — the two scripts/ files arrived with the widening, and the tool's own warning is that 「a reading taken earlier in the session is recall」. A gate answer about the wrong file list is not an answer.

3 — ready, then 4 — auto-merge armed, in that sequence: auto-merge does not survive a draft conversion, so arming a draft first would have silently disarmed it.

⚠️ For anyone reading the API later: once the queue takes ownership this PR's auto_merge reads false again. That is not a dequeue — the only reliable positive reading of queue membership is a merge_group run on gh-readonly-queue/main/pr-15465-<parent>.

Landing in-seat is within scope: Clause ② no (a tsconfig.test.json, a package.json typecheck script, a lockfile and two gate scripts — no published symbol added, removed or re-signed), and this seat wrote no code on it. On merge #14917 closes via Closes and its pm:dispatched comes off.

---

Generated by Claude Code