test(qa): assertArmed — a fixture proves the control under test is engaged before it measures anything (#8074)

[os-zhuang]

Fixes #8074

What this is

packages/qa/dogfood/test/armed.ts — assertArmed: a fixture names the control it is about to measure and the default that would silence it, and the harness reads that declaration off the live booted stack before the fixture is allowed to measure anything.

The card's common factor is not a missing fixture helper — it is a platform default that disarms the thing under test, while the harness keeps reporting success. So the guard is built around the precondition, not around any one of the three defaults.

Scope — stated plainly, because two of three is the honest answer

instance	disarming mechanism	covered here
#8023	org-less boot ⇒ no org_member ⇒ the write floor never applies	yes — principalArmed
#8049	passwordHistoryCount: 0 ⇒ nothing to reject against	yes — authSettingArmed
#7809	tsconfig excludes the test layer ⇒ a type-level pin is never evaluated	no, deliberately

Instance 3 is out of reach of a runtime probe by construction: its assertion was evaluated by tsc, not by vitest, and what disarmed it lived in tsconfig.json. Three measured reasons not to build a package-local imitation of it:

• scripts/check-type-check-coverage.mjs already owns the coverage half repo-wide (its TEST_DEBT ledger lifts a package's test-layer exclusion, compiles it, ratchets the count);
• the remaining signal hole — PINS_CHECKED recognising only @ts-expect-error — is [finding] PINS_CHECKED detects only @ts-expect-error, so other compile-time pin idioms in a hidden test layer are invisible to it — measured on a live example #8113 and is explicitly not this card's;
• measured rather than assumed: @objectstack/dogfood is in neither ledger, its tsconfig include is ["src/**/*", "test/**/*"], and a deliberate type error in a dogfood test file makes pnpm --filter @objectstack/dogfood typecheck go red (TS2322, ablation G below). Instance 3's mechanism is absent from this surface.

The module's header carries this reasoning, so the mechanism cannot read as though it covers all three.

Three design decisions, each load-bearing

1. Called from beforeAll, not from an it(). A disarmed fixture must produce zero green cells. The hand-rolled [integrity] idiom this generalises is an ordinary case, so a disarm reddens one cell and every sibling still prints green — and A public_read_write object is only writable by the row's creator — showcase_contributor gets 403 editing a showcase_project it can read, where the access matrix declares edit:true #8023's harm was exactly a green cell in a 124-cell matrix re-drive. Measured, on A public_read_write object is only writable by the row's creator — showcase_contributor gets 403 editing a showcase_project it can read, where the access matrix declares edit:true #8023's own fixture: ablating orgContext: true used to leave 9 green cells; it now yields 10 skipped, 0 green.
2. An unreadable probe counts as disarmed. A guard that passes when it cannot see is a guard that passes.
3. The vacuous spellings are unavailable, not discouraged. assertArmed([]) throws; principalArmed with nothing required and seededArmed with an empty where throw at construction.

Consumers — five fixtures that patch-and-trust today

owd-public-read-write-write-floor (#8023), bearer-lane-password-change (#8049), two-factor-lockout, oidc-authorize-env-gate. All four state their vacuity risk in prose and then trust the arming; none reads it back. They now do.

Every guard is shown to fire

This card is about assertions that cannot fail, so the guard is held to its own standard. Direction predicted before each run:

ablation	predicted	observed
A — assertArmed neutered	5 red (the rejection cases)	5 red, 15 green
B — armedWhen accepts a truthy non-boolean	exactly 1 red	1 red, 19 green
C — principalArmed always armed	4 red	4 red, 16 green
D — the guard's own org-bound stack loses orgContext	4 red	4 red, both positive controls fell
E — #8023's fixture loses orgContext: true	whole file dies, 0 green	10 skipped, 0 green
F(i) — #8049's fixture loses its arming line	whole file dies, 0 green	12 skipped, 0 green
F(ii) — same disarm, gate also removed (pre-#8074 shape)	some red, green cells alongside	3 red + 9 GREEN
G — type error in a dogfood test file	red	red, TS2322

F(ii) is the one worth reading twice: the pre-#8074 fixture records nine passing cells for a control that was never armed. That is the harm, reproduced.

Two positive controls in the guard's own suite assert that a fully armed declaration resolves — without them, an assertArmed that simply always threw would satisfy every rejection case above.

No dependency package was mutated in any ablation: all six files live in packages/qa/dogfood/test/ and vitest transforms them from source, so no dist/ rebuild sits between mutate and run.

Verification

• vitest run over the five affected fixtures: 55 passed.
• pnpm --filter @objectstack/dogfood typecheck: clean.
• Gate families re-derived from the actual changed paths via scripts/pm/dispatch-gates.mjs: check:nul-bytes, check:test-source-alias, check:type-source-resolution, check:query-options-erasure, check:type-check-coverage — all green.
• eslint --no-inline-config on all six files: clean.

Tests-only (packages/qa/dogfood/test/**; @objectstack/dogfood is private: true), so no changeset — skip-changeset applied.

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
objectstack	Ignored		Aug 13, 2026 11:25am

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/dogfood.

2 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:

• content/docs/permissions/authorization.mdx (via packages/qa/dogfood)
• content/docs/permissions/delegated-administration.mdx (via packages/qa/dogfood)

Advisory only. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs origin/main → pass the list as args.docs.