[objectstack-fleet]

Fixes #19217
Clause-②: no

What changed

Two QA-checklist carriers still required or cited sys_account.issuer, a column that retired with better-auth 1.7.3 (durable record: packages/spec/src/migrations/entries/semantic/18.sys-account-issuer-retired.ts). Docs/QA only; no code, no published package source.

1. docs/qa/platform-checklist/areas/identity-auth.json, item identity-auth.linked-accounts-social: the ORACLE. The step 「issuer stamped」 and the first acceptance clause's verify 「issuer is stamped」 are both withdrawn. The same shape PR docs(qa): re-anchor three approvals knownGaps on the sys_account.issuer retirement #19213 used for approvals.json: the reason is kept (the step now says (provider_id, account_id) is the whole account identity and names the retirement's migration entry), and the verify says an issuer-less row is the healthy shape, never a FAIL. revision 1 -> 2 with an appended history entry; revision 1's history entry is untouched.
2. docs/qa/platform-checklist/FOLLOW-UPS.md section 6, the "second signed-up (non-admin) user in seeds" row: the closing-evidence clause "issuer derived from the dev admin's own row" is withdrawn. The file's own rule is append-never-rewrite, so the correction is made visibly in place (the pattern section 10's E2 row already uses): the row says what the seed does today (ensureCredentialAccount -> better-auth internalAdapter.createAccount, keyed on (provider_id, account_id), read at examples/app-showcase/src/security/seed-approval-demo.ts ensureCredentialAccount and the comment above its call site), and records that it used to claim an issuer derivation, withdrawn with this card.

Premise, re-measured on c1185240 (branch base)

• identity-auth.json step at :1119 and verify at :1128 carried the dead requirement (card said :1118 / :1127).
• FOLLOW-UPS.md:151 carried the falsified clause.
• The corroboration still holds: packages/qa/dogfood/test/showcase-demo-personas-loginable.dogfood.test.ts:133-138 asserts the admin's account row has NO issuer own-property ("sys_account.issuer retired with better-auth 1.7.3 — nothing should still be writing it"); only its header comment changed.
• Left untouched on purpose, each read: the other issuer hits in identity-auth.json are the OIDC discovery-document issuer (:178, :233, :235, :250, :275) and the TOTP otpauth label issuer + account (:1287, :1302) — different concepts, correct. areas/approvals.json's hits are all in history entries or closed-by-fixture knownGaps text — the correct steady state, not in scope. areas/ai.json:697/719 is the OAuth issuer URL in a boot-log warning — unrelated.

Verification (at f7fb5a98)

Gate list derived with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (13 commands), every one run, reconciled with --ran carrying exit codes: "13 derived famil(ies) accounted for — 13 run, 0 NOT-MEASURED (a DERIVED zero)".

• pnpm check:platform-checklist exit 0: "OK — 15 areas, 265 items ... symbol anchors: 619/637 resolved ... 17 file floors held".
• Anchor census unchanged by this diff: areas/identity-auth.json 83 against floor 82, FOLLOW-UPS.md 4 against floor 2. No floor or ledger moved. (identity-auth.json has one anchor of headroom — the new migration citations are bare paths, which add and remove no anchor.)
• pnpm check:doc-authoring, check:nul-bytes, check:cross-package-test-inputs, check:driver-memory-census, check:gitlink-declared, check:refd-timer-probe, check:watch-hint-literal, check-ci-filter-parity, check-closing-keyword-parity (+ --self-test), check-comment-mask-corpus: all exit 0.
• @objectstack/lint check:doc-formula-expressions: first run exit 3 (PREREQUISITE NOT MET — @objectstack/formula / @objectstack/lint unbuilt, nothing measured); after turbo run build of those two, exit 0.

Changeset

None. The diff is docs/qa/** only and publishes nothing from any released package, so this is skip-changeset territory; the label is left to the PM seat.

Acceptance notes

• No out-of-scope findings filed or proposed.

---

Generated by Claude Code

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: f7fb5a98636d1a6cc823aae80a107eda571353b9

① Derived judgments

• "(provider_id, account_id) is the whole account identity; sys_account.issuer retired with better-auth 1.7.3": packages/spec/src/migrations/entries/semantic/18.sys-account-issuer-retired.ts (replacement: "account identity is (provider_id, account_id)…", reason: "better-auth 1.7.3 removed the issuer-scoped account identity"). Cited path exists on origin/main. True.
• "a row with no issuer is the healthy shape, never a FAIL — the column is retired": corroborated by packages/qa/dogfood/test/showcase-demo-personas-loginable.dogfood.test.ts:133-138 asserting issuer ABSENT. True.
• FOLLOW-UPS row: "ensureCredentialAccount, keyed on (provider_id, account_id) through better-auth's internalAdapter.createAccount": examples/app-showcase/src/security/seed-approval-demo.ts:196-214 (provider_id: 'credential', authCtx.internalAdapter.createAccount), :364-370 ("(provider_id, account_id) is the key, and internalAdapter.createAccount supplies both"). True.
• "The three items this row unblocked withdrew the same clause with docs(qa): three approvals-checklist knownGap texts cite the retired backfill-account-issuer.ts #17453": docs/qa/platform-checklist/areas/approvals.json:92, :314, :731 history entries all "ref": "#17453". True.
• identity-auth.json history: revision-1 entry byte-unchanged (only the array separator comma appended); revision-2 entry appended; revision 1→2. Append-only holds.
• No accept set or public surface touched; Clause-②: no is right. No generated/release/governed path. Other issuer hits in the file (OIDC discovery, TOTP label) are different concepts and correctly untouched.

② Semver level

docs/qa/** only; ships in no package files[]; no .changeset/*.md. No changeset is correct; skip-changeset is the route.

③ Boundary flags

• FOLLOW-UPS.md:3-4 declares "append, never rewrite — a resolved row stays with its resolution". The §6 row is corrected in place rather than by an appended resolution line. Mitigation: the old clause is kept visibly ("This row used to add … withdrawn 2026-09-23 with docs(qa): two checklist carriers still require the retired sys_account.issuer — identity-auth.json's link_social VERIFY is an oracle that now fails a healthy system #19217"), the identical in-place pattern already exists in the file (§10 E2 row at :601, "This row used to name … Corrected 2026-09-08 with [finding] No shipped boot path authors RestServerConfig at all — os serve fixes it and the dev plugin passes none, so every live crud / metadata / batch key is embedder-only #15543"), and the dev declared it as a deviation. The card did not prescribe the ledger repair shape. Not a breach of the card's fence; PM may still prefer an appended line.
• areas/approvals.json history entries (fenced by card) untouched. Confirmed.

Implemented-by: claude/issue-19217-issuer-carriers
Reviewed-by: session_01VDtqoecgES7ScQYGbFVDRv

VERDICT: PASS

Isolated at-tier reviewer, adopted by the domain:devx#1 seat. Reviewed with the seat's own ACCEPT excluded from its inputs.

---

Generated by Claude Code