feat(platform-objects)!: retire the sys_scim_provider platform object (consumer sweep first, no data migration)

[os-trump]

Fixes #11757
Part of #11632 — the epic stays open; this is leg 1a.

What this does

Retires the sys_scim_provider platform object — the rc.1-era @better-auth/scim connection row — and removes its one registry line in packages/spec/src/system/constants/platform-object-names.ts in the SAME PR. That pairing is the 2026-08-28 maintainer ruling (C: one seat carries both halves, recorded on the card); PR #12726 landed the same shape in the same file in the opposite direction (addition) and is the worked precedent. The disposition itself was ruled on #11693 (2026-08-24, maintainer, verbatim on the card): A — retire, and NO data migration is owed. Accordingly this PR ships no backfill, no reaper, no migrate command; existing sys_scim_provider tables in deployed databases are left untouched. After PR #12726 (the stable-1.7.1 migration that discharged #3653) the installed library derives no scimProvider model, so the object backed nothing — nothing could write a row to it.

Out of scope, untouched by this PR: sys_scim_connection_credential (fenced by the card), docs/adr/0066 (governed surface — its 2026-07 narrative is historical record), content/docs/releases/ (release-owned), package CHANGELOGs and other PRs' changesets (historical record), and the pnpm-workspace.yaml pin narrative (its "retires separately under #11757" sentence stays true). #11632 remains open; #3653 stays discharged — neither is addressed here beyond what the lines above state.

Step 1 — consumer sweep, positive control first

Instrument: git grep -F against the dedicated worktree's pinned HEAD (BASE 8beb3deaf), never the shared checkout. Positive controls BEFORE any zero was read: sys_user matched 702 files, sys_scim_connection matched 19 — the instrument finds known readers of other platform objects through the same channel. Every identity from the 2026-08-24 measurement report was re-verified on the current ref rather than inherited (PR #12726 had moved several).

Readers repaired or deleted, per identity:

reader	disposition
packages/platform-objects/src/identity/sys-scim-provider.object.ts	DELETED (the declaration)
packages/platform-objects/src/identity/index.ts	export line removed
packages/platform-objects/scripts/i18n-extract.config.ts	import + roster entry removed (both occurrences)
packages/platform-objects/src/apps/translations/*.generated.ts (4 locales + 3 source-hash files)	regenerated via pnpm i18n:extract — the sys_scim_provider blocks drop out (0 residual hits)
packages/platform-objects/src/apps/translations/bundle-ownership.test.ts	OWNED_OBJECTS entry removed
packages/platform-objects/src/identity/action-predicate-sparse-face.test.ts	import + table row removed
packages/platform-objects/src/platform-objects.test.ts	ADR-0066 D3 capability-gate pin RETARGETED to the surviving sibling SysSsoProvider (same manage_platform_settings gate, declared at sys-sso-provider.object.ts:60) — deleting the case outright would have left the D3 sso/scim gate with zero test pins
packages/plugins/plugin-auth/src/manifest.ts	import + authIdentityObjects entry removed — the runtime provisioning list
packages/plugins/plugin-auth/src/objectql-adapter.ts	AUTH_MODEL_TO_PROTOCOL.scimProvider entry removed (stable 1.7.1 derives no such model; the entry bridged nothing)
packages/plugins/plugin-auth/src/better-auth-schema-parity.test.ts	import + PLATFORM_OBJECTS entry removed (its own comment said it stays only until this lands)
packages/plugins/plugin-auth/src/credential-at-rest-posture.test.ts	import + AUTH_OBJECTS entry removed
packages/plugins/plugin-auth/src/managed-extension-fields.test.ts	UNMAPPED_MANAGED_OBJECTS exemption removed — the suite's own stale-entry assertion forces this once the object stops declaring managedBy better-auth
packages/plugins/plugin-security/src/objects/default-permission-sets.ts	BETTER_AUTH_MANAGED_OBJECTS entry removed — pinned bidirectionally against live managedBy declarations by default-permission-sets.test.ts
packages/spec/src/system/constants/platform-object-names.ts	the −1 registry line (ruling C — this seat's half)
packages/objectql/src/registry.ts + registry-tenant-index-follows-wall.test.ts	comment example lists corrected (prose only)
packages/qa/dogfood/test/authz-conformance.matrix.ts	secure-by-default-posture enforcement prose retargeted to the surviving sys_sso_provider carrier
content/docs/permissions/authorization.mdx	secure-by-default paragraph corrected (hand-written docs tree)

objectui / cloud: the sweep surfaced no cross-repo reader candidates from this repo's side (no exported symbol other than SysScimProvider names it, and that export had no in-repo importers outside the list above); per the card, cross-repo verification is out of this repo's reach and was not guessed at.

Reverse verification — the absence pin

The registry conformance test (packages/spec/src/system/constants/platform-object-names.test.ts) scans every *.object.ts and asserts exact per-package set equality with the registry, both directions — so it IS the absence pin, and no redundant twin test was written. Measured on this branch (mutation and restore both proven on disk, script carried an EXIT/INT/TERM restore trap, no build involved — the test reads source via readFileSync and a relative import):

• Prediction written first: re-adding ONLY the object file (registry line still gone) reds registry group "platform-objects" is out of date.
• Observed: PRE file absent, POST file present with anchor name: 'sys_scim_provider' at exactly 1 hit, registry hits 0 — vitest exit 1, the test's own verdict line: AssertionError: registry group "platform-objects" is out of date: expected 46-name set to deeply equal 47. 1 failed, 6 passed.
• Restore proven: file absent again, git status --porcelain 0 lines, git diff HEAD 0 bytes.
• The prior 2026-08-24 measurement on this card proved the same red in the opposite one-sided direction (file deleted, registry line kept).

Verification (final head 736390e57, after merging origin/main churn — 5 commits, overlap re-run)

• Suites, all green: spec platform-object-names + migrations (114), platform-objects (523), plugin-auth (1695 — includes the SCIM parity gate with KNOWN_UNMAPPED_MODELS as the empty exact set, untouched), plugin-security (1578, re-run on the merged head), objectql tenant-index (11), qa authz-conformance matrix (27).
• Typecheck green: spec, platform-objects, plugin-auth, plugin-security, objectql, qa/dogfood.
• Gate batch derived by node scripts/pm/dispatch-gates.mjs (no path args, --repo asserted): 56 families run locally, all green after full closure build — including check:authorable-surface, check:docs, check:liveness, check:strictness-ledger, check:empty-state, check:api-surface (via spec check:generated: all 14 artifacts current), check:i18n, check:i18n-stale-fill, check:engine-double-contract, check:where-matcher, check:cross-package-test-inputs, check:type-check-coverage, check:type-check-debt, check:migration-registry, check:nul-bytes, changeset family incl. check-adr-0087-registration and check-changeset-no-major.
• Post-merge re-runs on 736390e57: plugin-security tests, cross-package-test-inputs, engine-double-contract, comment-mask-adoption, spec conformance + migrations, adr-0087, changeset-no-major, check:i18n — all green.

ADR-0087 and changeset

The gate's own verdict: 1 declared-breaking changeset, carrying disposition registered scim-provider-object-retired (new entry). The ledger entry is packages/spec/src/migrations/entries/semantic/18.scim-provider-object-retired.ts (registry regions regenerated; major-18 entries project into spec-changes.json and the upgrade guide only when that major ships, matching the existing 18.x stock). The changeset (.changeset/retire-sys-scim-provider-object.md) declares BREAKING with per-surface FROM → TO mappings and ships as minor per the launch-window convention and the #12726 precedent. The IdP token-reissue note stays a scheduled human operational action, per the card.

Review posture

Clause-② YES (public registry narrowing — ruled): this PR stays DRAFT; the contract-review chain owns enqueue. No labels were set by this seat. (Authored in session session_01LpRNHxWZgSUgVnFT9mQQo4.)

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 6 package(s): @objectstack/objectql, @objectstack/platform-objects, @objectstack/plugin-auth, @objectstack/plugin-security, @objectstack/dogfood, @objectstack/spec, touching 32 documentable anchor(s). ⚠️ 2 changed file(s) yielded no anchor (packages/objectql/src/registry.ts, packages/platform-objects/src/identity/index.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

65 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json b1a987e4a853132b0a76245c8c49f062be1d664d.

⛔ 6 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 2 changed file(s) yielded no anchor (packages/objectql/src/registry.ts, packages/platform-objects/src/identity/index.ts) — pages documenting those are invisible to this run
• 1 cross-cutting symbol(s) contributed no route anchor: isSystem (5 routes)
• 2 anchor(s) matched too much of the corpus to be a work list: created_at (literal, 34 pages), sys_user (literal, 29 pages)
• 11 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 134 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json b1a987e4a853132b0a76245c8c49f062be1d664d → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 3410a2d2926e851a7a3a0822dc16faa41678ad87 — the merge of head 736390e57bfe4f240627bb9b310c59c7f9dca7ce into base b1a987e4a853132b0a76245c8c49f062be1d664d, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 3410a2d2926e851a7a3a0822dc16faa41678ad87 && git checkout 3410a2d2926e851a7a3a0822dc16faa41678ad87
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin b1a987e4a853132b0a76245c8c49f062be1d664d 736390e57bfe4f240627bb9b310c59c7f9dca7ce && git checkout -B drift-repro b1a987e4a853132b0a76245c8c49f062be1d664d && git merge --no-ff 736390e57bfe4f240627bb9b310c59c7f9dca7ce

node scripts/docs-audit/affected-docs.mjs --json b1a987e4a853132b0a76245c8c49f062be1d664d

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs b1a987e4a853132b0a76245c8c49f062be1d664d → pass the list as
args.docs, on the commit named under Which tree this was computed on.