Maintainer ruling (2026-08-21, delivered live in the PM session — verbatim, untranslated)
A：新增 vendor 状态 — surface 3 增设第四状态「vendor wire format」——surface 2 已裁 kind 3 的对应物。仍被计数（封闭在 N 条）、note 强制点名 vendor/读者/契约伙伴、增改 MAINTAINER-ONLY，并把 const 提升规避具名写进门禁散文。
Chosen over (B) widening the exempt grammar with a second adjudicated class, and over (C) probing a relay/delegation route first. The full escalation that produced this fork is on PR #10352 (comment 5364581437): the success body { session, user } at admin-impersonate-endpoint.ts:254 is better-auth's own wire format — the endpoint passes through the vendor's published OpenAPI schema, authClient.admin.impersonateUser reads that shape, and the contract partner /admin/stop-impersonating (entirely vendor-side) returns the same bare shape. Surface 2 already names this class kind 3 ("a foreign wire format a client library requires") and treats relayed instances as by-design invisible; this body became visible only because the handler was reimplemented in-repo, turning a relay into a built literal. All three existing declarations were measured dishonest for it: {} stays red, ratchet asserts a conversion that can never happen, exempt is #9389's closed pre-auth class — the opposite population.
Scope (all in scripts/check-route-envelope.mjs)
- New surface-3 state (name is the implementer's design choice, e.g.
vendorWire): a RULED classification for a body this repo builds but whose shape is a vendor's wire format.
- Record the evasion by name in the gate's prose: hoisting a body literal to a
const and passing the identifier makes the gate go green with zero wire change — write it down as a forbidden move so the next agent hitting this class of red does not rediscover it as a fix.
- Self-test coverage (
--self-test) for the new state: accepted with note, rejected without note, rejected alongside ratchet/exempt, MAINTAINER-ONLY diagnostic on widening.
Mechanism assumption (measure, do not assume)
Whether the table entry for packages/plugins/plugin-auth/src/admin-impersonate-endpoint.ts can land HERE is undetermined: that file exists only on PR #10352's branch, and a table entry for an undiscovered file may itself be an error. Default expectation: this card ships the machinery + prose + self-test only on main; PR #10352's own branch then merges main and adds its entry under the new state. If measurement shows a dormant entry is tolerated (or trivially tolerable), say so in the report — the maintainer ruling covers the classification either way.
Unblocks
Maintainer ruling (2026-08-21, delivered live in the PM session — verbatim, untranslated)
Chosen over (B) widening the
exemptgrammar with a second adjudicated class, and over (C) probing a relay/delegation route first. The full escalation that produced this fork is on PR #10352 (comment5364581437): the success body{ session, user }atadmin-impersonate-endpoint.ts:254is better-auth's own wire format — the endpoint passes through the vendor's published OpenAPI schema,authClient.admin.impersonateUserreads that shape, and the contract partner/admin/stop-impersonating(entirely vendor-side) returns the same bare shape. Surface 2 already names this class kind 3 ("a foreign wire format a client library requires") and treats relayed instances as by-design invisible; this body became visible only because the handler was reimplemented in-repo, turning a relay into a built literal. All three existing declarations were measured dishonest for it:{}stays red,ratchetasserts a conversion that can never happen,exemptis #9389's closed pre-auth class — the opposite population.Scope (all in
scripts/check-route-envelope.mjs)vendorWire): a RULED classification for a body this repo builds but whose shape is a vendor's wire format.exempt: the boundary is closed at exactly N bodies in exactly these files; a new vendor-shaped body fails the gate until declared.notenaming (a) the vendor, (b) the vendor client reader that requires the shape, (c) the contract-partner endpoint(s).ratchetandexempt, same as those two are with each other.check:engine-double-contractfires at CI time, not authoring time — four independent PRs tripped it on brand-new test files in one shift, and a pre-warning in the brief did not prevent it #8435 rule).constand passing the identifier makes the gate go green with zero wire change — write it down as a forbidden move so the next agent hitting this class of red does not rediscover it as a fix.--self-test) for the new state: accepted with note, rejected without note, rejected alongsideratchet/exempt, MAINTAINER-ONLY diagnostic on widening.Mechanism assumption (measure, do not assume)
Whether the table entry for
packages/plugins/plugin-auth/src/admin-impersonate-endpoint.tscan land HERE is undetermined: that file exists only on PR #10352's branch, and a table entry for an undiscovered file may itself be an error. Default expectation: this card ships the machinery + prose + self-test only onmain; PR #10352's own branch then mergesmainand adds its entry under the new state. If measurement shows a dormant entry is tolerated (or trivially tolerable), say so in the report — the maintainer ruling covers the classification either way.Unblocks
check:route-envelopeis its only red) — Part ofimpersonate_userandset_user_rolestill 403 every platform admin — neither route is safely raw-mountable, and each blocks for a different reason #9968