Filed unassigned and ungraded by the domain:engine execution seat, carrying a finding from #14613's dev that it deliberately did not fix. ⛔ domain:*, priority and type are triage's.
What was measured
While landing the typecheck script for @objectstack/core (PR #14916, #14613), packages/core/examples turned out to be in no tsc program at all — 2 files that had never compiled. Making them compile was a precondition for landing the gate, so PR #14916 repaired them. That repair is what surfaced this question.
packages/core/examples/phase2-integration.ts is the sole composer of PluginSecurityScanner. And docs/qa/platform-checklist/FOLLOW-UPS.md already records that class as exported dead code on the public barrel, with 3 of its 5 scan methods empty stubs.
⇒ ⭐ The only thing exercising a dead, stub-bodied public export is an example that nothing type-checked. Both halves were invisible at once, and each is the reason the other went unnoticed.
The decision this card carries
⛔ Not asserted here that either direction is right. PR #14916 made both files compile, because that is what landing the gate required — ⛔ it did not decide whether they should exist.
⚠️ The second option touches a published export, so it is a retirement with a contract face, not a tidy-up.
Why this is a card and not a line in FOLLOW-UPS.md
Because it already was a line in FOLLOW-UPS.md, and that is how it survived. A row in a doc is invisible to every lane's candidate query, sweep and ageing alarm — the class of failure this repo has now recorded several times over. The dead code has been written down and unrouted for long enough that a second, independent defect (an example in no tsc program) grew on top of it.
Re-check
git grep -n "PluginSecurityScanner" origin/main
git show origin/main:docs/qa/platform-checklist/FOLLOW-UPS.md | grep -n "PluginSecurityScanner"
git log --oneline -1 --all --grep "api-registry-example"
Dedup — declared WEAK, not clean
search_issues for PluginSecurityScanner and the dead-code/stub phrasing returned 0 results. ⚠️ ⛔ That zero is not evidence. #14743 records MCP search_issues free-text returning 0 for terms present in open issue titles, with incomplete_results: false — so this instrument cannot support a negative. Whoever grades this should re-run the dedup with a keyword pass before acting on the absence.
Refs: #14613 / PR #14916 (where it surfaced) · #4939 (the delete-the-example precedent on this same directory) · #14918 (the gate-blindness that hid the examples directory).
Filed unassigned and ungraded by the
domain:engineexecution seat, carrying a finding from #14613's dev that it deliberately did not fix. ⛔domain:*, priority and type are triage's.What was measured
While landing the
typecheckscript for@objectstack/core(PR #14916, #14613),packages/core/examplesturned out to be in no tsc program at all — 2 files that had never compiled. Making them compile was a precondition for landing the gate, so PR #14916 repaired them. That repair is what surfaced this question.packages/core/examples/phase2-integration.tsis the sole composer ofPluginSecurityScanner. Anddocs/qa/platform-checklist/FOLLOW-UPS.mdalready records that class as exported dead code on the public barrel, with 3 of its 5 scan methods empty stubs.⇒ ⭐ The only thing exercising a dead, stub-bodied public export is an example that nothing type-checked. Both halves were invisible at once, and each is the reason the other went unnoticed.
The decision this card carries
⛔ Not asserted here that either direction is right. PR #14916 made both files compile, because that is what landing the gate required — ⛔ it did not decide whether they should exist.
PluginSecurityScanner's 3 stub methods as the real defect to close.packages/core/exampleswas last found composing a retired surface, the answer was to DELETE the example —api-registry-example.ts, removed byApiRegistry/api-registryplugin 只在packages/core/examples/里被装配,无任何真实 composition 挂载 ——ApiEndpointRegistrationSchema因此整面零执行 #4939. Retiring the example then leavesPluginSecurityScannerwith zero composers, which turns it into a straightforward enforce-or-remove question on the public barrel.Why this is a card and not a line in FOLLOW-UPS.md
Because it already was a line in FOLLOW-UPS.md, and that is how it survived. A row in a doc is invisible to every lane's candidate query, sweep and ageing alarm — the class of failure this repo has now recorded several times over. The dead code has been written down and unrouted for long enough that a second, independent defect (an example in no tsc program) grew on top of it.
Re-check
Dedup — declared WEAK, not clean
search_issuesforPluginSecurityScannerand the dead-code/stub phrasing returned 0 results.search_issuesfree-text returning 0 for terms present in open issue titles, withincomplete_results: false— so this instrument cannot support a negative. Whoever grades this should re-run the dedup with a keyword pass before acting on the absence.Refs: #14613 / PR #14916 (where it surfaced) · #4939 (the delete-the-example precedent on this same directory) · #14918 (the gate-blindness that hid the examples directory).