chore(lint): delete inert eslint-disable family comments in package sources

content/docs/permissions/system-context.mdx

@@ -158,7 +158,7 @@ The largest single consumer — **20 of the 109 sites**.
 |:--|:---|:---|:---|:---|
 | 48 | Object API-exposure gate bypassed (`apiEnabled` / `apiMethods`) | runtime | Get: internal self-writes ignore exposure declarations — these govern **external** exposure, not engine self-writes | `action-execution.ts:138` |
 | 49 | Action `requiredPermissions` bypassed | runtime | Get: engine self-invocation runs any action | `action-execution.ts:401` |
-| 50 | `manage_metadata` bypassed on metadata writes | runtime, rest | Get: schema writes without the capability | `domains/meta.ts:471`, `:874`, `rest-server.ts:4716`, `:6079`, `:6327`, `:6758`, `:6951` |
+| 50 | `manage_metadata` bypassed on metadata writes | runtime, rest | Get: schema writes without the capability | `domains/meta.ts:471`, `:874`, `rest-server.ts:4715`, `:6078`, `:6326`, `:6757`, `:6950` |
 | 51 | The shared metadata-write verdict itself returns `allowed` | metadata-core | Get: the one function all of row 50's doors consult answers yes before any capability is examined | `meta-write-capability.ts:134` |
 | 52 | Anonymous-deny seam satisfied on the domain dispatchers and the package/federation routes | runtime, rest | Get: passes with no `userId` | `domains/actions.ts:411`, `domains/ai.ts:60`, `domains/automation.ts:989`, `domains/meta.ts:232`, `domains/security.ts:78`, `domains/packages.ts:326`, `external-datasource-routes.ts:302`, `package-routes.ts:97` |
 | 53 | MCP principal check satisfied | runtime | Get: MCP surface reachable with no user | `domains/mcp.ts:61` |

packages/adapters/hono/src/index.ts

@@ -30,15 +30,13 @@ export type { Hono } from 'hono';
  * Minimal structural interface matching KernelManager from @objectstack/service-cloud.
  * Declared locally to avoid a circular build dependency.
  */
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
 export type KernelManager = any;
 
 /**
  * Opaque reference to an EnvironmentDriverRegistry from @objectstack/service-cloud.
  * Declared locally to avoid a circular build dependency. Pass an instance
  * of DefaultEnvironmentDriverRegistry from @objectstack/service-cloud at runtime.
  */
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
 export type EnvironmentDriverRegistry = any;
 import {
   createOriginMatcher,

packages/cli/src/utils/schema-migration-plugins.ts

@@ -640,7 +640,6 @@ export function createDeclarationBootWriteGuard(): DeclarationBootWriteGuard {
       else refusals.set(key, { driver: driverName, method, object, count: 1 });
       if (!warned.has(key)) {
         warned.add(key);
-        // eslint-disable-next-line no-console
         console.warn(
           `[migrate] ⚠ Refused ${method}() on ${object} via ${driverName}: a declaration `
           + 'boot refuses row writes. The plugin that issued it registers a writing hook '
@@ -667,7 +666,6 @@ export function createDeclarationBootWriteGuard(): DeclarationBootWriteGuard {
       else rawExecutions.set(driverName, { driver: driverName, count: 1 });
       if (!warnedExec.has(driverName)) {
         warnedExec.add(driverName);
-        // eslint-disable-next-line no-console
         console.warn(
           `[migrate] ⚠ Raw execute() called via ${driverName} during the declaration boot. `
           + 'A raw command cannot be classified as read or write, so it was FORWARDED, not '
@@ -699,7 +697,6 @@ export function createDeclarationBootWriteGuard(): DeclarationBootWriteGuard {
       else immediateDdl.set(key, { driver: driverName, method, object, count: 1 });
       if (!warnedDdl.has(driverName)) {
         warnedDdl.add(driverName);
-        // eslint-disable-next-line no-console
         console.warn(
           `[migrate] ⚠ ${method}() on ${object} called via ${driverName} during the declaration boot. `
           + 'Immediate DDL is not held back by the schema deferral, so it was FORWARDED, not '
@@ -1137,7 +1134,6 @@ export async function buildSchemaMigrationPlugins(opts: {
         + 'The plan below covers ONLY the objects the data stack registered — it does NOT '
         + "cover this deployment's own objects, so an empty plan here is UNMEASURED, not "
         + '"in sync". Fix the config (or its environment) and re-run.';
-      // eslint-disable-next-line no-console
       console.warn(`[migrate] ⚠ ${line}`);
       notes.push(line);
       hostConfigError = message;
@@ -1280,7 +1276,6 @@ export function refuseWhenHostConfigUnloadable(
 ): boolean {
   const line = describeUnloadableHostConfig(composition, options);
   if (line === null) return false;
-  // eslint-disable-next-line no-console
   console.error(`[migrate] ✗ ${line}`);
   process.exitCode = 1;
   return true;

packages/core/src/utils/metadata-activation-store.ts

@@ -124,11 +124,8 @@ export interface MetadataActivationStore {
  * what is used keeps every test double honest about that.
  */
 export interface MetadataActivationStoreEngine {
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
     find(object: string, options?: any): Promise<any[]>;
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
     insert(object: string, data: any, options?: any): Promise<any>;
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
     update(object: string, data: any, options?: any): Promise<any>;
 }
 
@@ -224,7 +221,6 @@ export class ObjectStoreMetadataActivationStore implements MetadataActivationSto
             context: SYSTEM_CTX,
         });
         const current = Array.isArray(existing)
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any
             ? existing.find((r: any) => r?.organization_id == null)
             : undefined;
 

packages/drivers/driver-sqlite-wasm/src/knex-wasm-dialect.ts

@@ -37,7 +37,6 @@ import {
 // re-bundling. We defer the actual `createRequire(...)` call so that the
 // CJS build (where `import.meta.url` is empty) doesn't blow up at module
 // init; the CJS path uses `globalThis.require` directly anyway.
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
 let cachedEsmRequire: any = null;
 function getEsmRequire(): any {
   if (cachedEsmRequire) return cachedEsmRequire;
@@ -168,7 +167,6 @@ export function statementMutatesDatabase(sql: string, method?: string): boolean
  * Wrapped in a function so the bundler cannot execute it at module init.
  */
 function resolveKnexSqlite3Dialect(): any {
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
   const g = globalThis as any;
   if (typeof g.require === 'function') {
     try {
@@ -184,7 +182,6 @@ function resolveKnexSqlite3Dialect(): any {
   return getEsmRequire()('knex/lib/dialects/sqlite3');
 }
 
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
 let cachedDialect: any = null;
 
 /**
@@ -193,7 +190,6 @@ let cachedDialect: any = null;
  * code so downstream re-bundlers (e.g. `packages/runtime`) cannot collapse
  * it into a Dynamic-require stub.
  */
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
 export function getClient_WasmSqlite(): any {
   if (cachedDialect) return cachedDialect;
   const Client_SQLite3 = resolveKnexSqlite3Dialect();
@@ -317,7 +313,6 @@ export function getClient_WasmSqlite(): any {
  * in some bundlers, which defeats the lazy pattern. New code should call
  * `getClient_WasmSqlite()` directly.
  */
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
 export const Client_WasmSqlite: any = new Proxy(function () {} as any, {
   get(_t, prop) {
     return (getClient_WasmSqlite() as any)[prop];

packages/metadata-protocol/src/sys-metadata-repository.ts

@@ -1034,7 +1034,6 @@ export class SysMetadataRepository implements MetadataRepository {
         row,
       );
       // Strip body for the header projection.
-      // eslint-disable-next-line @typescript-eslint/no-unused-vars
       const { body, ...header } = item;
       yield header;
     }

packages/metadata/src/plugin.ts

@@ -633,33 +633,28 @@ export class MetadataPlugin implements Plugin {
                         w.on('change', () => { void reload(); });
                         w.on('add', () => { void reload(); });
                         this.artifactWatcher = { close: () => w.close() };
-                        // eslint-disable-next-line no-console
                         console.log('[MetadataPlugin] artifact file watcher attached', src.path);
                     } catch (e: any) {
                         ctx.logger.warn('[MetadataPlugin] artifact watcher failed to start', { error: e?.message });
                     }
                 }
                 if (hub) {
-                    // eslint-disable-next-line no-console
                     console.log('[MetadataPlugin] HMR endpoint registered at /api/v1/dev/metadata-events');
                 } else {
                     // Printed on every non-development boot, deliberately: a
                     // closed door that says nothing is indistinguishable from a
                     // door that was never asked about, and this line is what an
                     // operator greps when the Studio preview stops
                     // auto-reloading.
-                    // eslint-disable-next-line no-console
                     console.log(
                         '[MetadataPlugin] dev metadata-HMR endpoints NOT mounted — they require '
                         + `NODE_ENV=development (this process: ${process.env.NODE_ENV ? `NODE_ENV=${process.env.NODE_ENV}` : 'NODE_ENV unset, treated as production'})`,
                     );
                 }
             } else {
-                // eslint-disable-next-line no-console
                 console.log('[MetadataPlugin] HTTP server with getRawApp() not available — skipping HMR endpoint');
             }
         } catch (e: any) {
-            // eslint-disable-next-line no-console
             console.warn('[MetadataPlugin] Failed to register HMR endpoint', e?.message);
         }
     }

packages/objectql/src/having-filter.ts

@@ -361,7 +361,6 @@ function checkCondition(
     || condition instanceof Date
     || Array.isArray(condition)
   ) {
-    // eslint-disable-next-line eqeqeq
     return value == condition;
   }
 
@@ -391,9 +390,7 @@ function checkCondition(
     }
     if (value === undefined && !NO_VALUE_ANSWERED_BY_OPERATOR.has(op)) return false;
     switch (op) {
-      // eslint-disable-next-line eqeqeq
       case '$eq': if (value != target) return false; break;
-      // eslint-disable-next-line eqeqeq
       case '$ne': if (value == target) return false; break;
       case '$gt': if (!(value > target)) return false; break;
       case '$gte': if (!(value >= target)) return false; break;

packages/objectql/src/validation/rule-validator.ts

@@ -2417,7 +2417,6 @@ function matchesNamedFormat(format: FormatRule['format'], str: string): boolean
       return PHONE_RE.test(str);
     case 'url':
       try {
-        // eslint-disable-next-line no-new
         new URL(str);
         return true;
       } catch {

packages/plugins/plugin-auth/src/auth-manager.ts

@@ -236,7 +236,6 @@ function installWebContainerRequestStatePolyfill(): void {
   if (!g[sym].context) g[sym].context = {};
   if (!g[sym].context.requestStateAsyncStorage) {
     g[sym].context.requestStateAsyncStorage = new WebContainerRequestStateAsyncLocalStorage();
-    // eslint-disable-next-line no-console
     console.warn(
       '[AuthManager] WebContainer detected: installed synchronous request-state polyfill ' +
         '(node:async_hooks AsyncLocalStorage does not propagate context across await in WebContainer).',

packages/rest/src/export-format.ts

@@ -102,7 +102,6 @@ export function exportContentDisposition(
       `-${pad(now.getHours())}${pad(now.getMinutes())}${pad(now.getSeconds())}`;
   const asciiBase = objectName.replace(/[^A-Za-z0-9_.-]/g, '_') || 'export';
   // Keep unicode letters (CJK labels) but drop filesystem-hostile characters.
-  // eslint-disable-next-line no-control-regex
   const utf8Base = String(label ?? '')
     .replace(/[\\/:*?"<>|\u0000-\u001f]+/g, '_')
     .replace(/^[\s._-]+|[\s._-]+$/g, '')

packages/rest/src/rest-server.ts

@@ -4328,7 +4328,6 @@ export class RestServer {
     private async loadOpenApiSpec(): Promise<any | null> {
         if (this._openApiSpecCache !== undefined) return this._openApiSpecCache;
         try {
-            // eslint-disable-next-line @typescript-eslint/ban-ts-comment
             // @ts-ignore — node built-in, no @types/node in this package
             const mod: any = await import('module');
             const requireFn = mod.createRequire((import.meta as any).url);

packages/runtime/src/load-artifact-bundle.ts

@@ -96,14 +96,12 @@ export async function loadArtifactBundle(
         // artifact (malformed JSON, bad permissions, HTTP error) is a real
         // fault and keeps the loud warning.
         if (err?.code === 'ENOENT') {
-            // eslint-disable-next-line no-console
             console.log(
                 `${tag} no compiled artifact at '${absArtifactPath}' — booting without one ` +
                 `(run 'os compile' to build it)`,
             );
             return null;
         }
-        // eslint-disable-next-line no-console
         console.warn(`${tag} artifact read FAILED: path='${absArtifactPath}' error=${err?.message ?? err}`);
         return null;
     }
@@ -114,7 +112,6 @@ export async function loadArtifactBundle(
         // want to execute remote code by default). Hooks/flow handlers must
         // be carried in the JSON itself (declarative bodies, sandbox-eval).
         if (typeof bundle?.runtimeModule === 'string' && bundle.runtimeModule.length > 0) {
-            // eslint-disable-next-line no-console
             console.warn(
                 `${tag} ignoring runtimeModule='${bundle.runtimeModule}' for remote artifact ${absArtifactPath} ` +
                 `(remote ESM imports are not supported; embed handlers in the JSON instead)`,
@@ -138,7 +135,6 @@ export async function mergeRuntimeModule(bundle: any, artifactAbsPath: string, t
         const mod: any = await import(pathToFileURL(moduleAbsPath).href);
         const fns = (mod && (mod.functions ?? mod.default?.functions)) ?? null;
         if (!fns || typeof fns !== 'object') {
-            // eslint-disable-next-line no-console
             console.warn(`${tag} runtime module '${moduleAbsPath}' exported no \`functions\` map`);
             return;
         }
@@ -191,7 +187,6 @@ export async function mergeRuntimeModule(bundle: any, artifactAbsPath: string, t
         }
         bundle.functions = merged;
     } catch (err: any) {
-        // eslint-disable-next-line no-console
         console.warn(`${tag} runtime module load FAILED: path='${moduleAbsPath}' error=${err?.message ?? err}`);
     }
 }

packages/runtime/src/sandbox/script-runner.ts

@@ -482,11 +482,9 @@ export interface ScriptRunner {
  * and be unit-tested ahead of the engine landing.
  */
 export class UnimplementedScriptRunner implements ScriptRunner {
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
   evalExpression(_body: ExpressionBody, _ctx: ScriptContext, _opts: ScriptRunOptions): Promise<ScriptResult> {
     return Promise.reject(new Error('ScriptRunner not configured: install a quickjs engine first.'));
   }
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars
   runScript(_body: ScriptBody, _ctx: ScriptContext, _opts: ScriptRunOptions): Promise<ScriptResult> {
     return Promise.reject(new Error('ScriptRunner not configured: install a quickjs engine first.'));
   }

packages/runtime/src/standalone-stack.ts

@@ -575,7 +575,6 @@ export async function createStandaloneStack(config?: StandaloneStackConfig): Pro
     if (dbNotice) {
         // Legacy-file compat-read (#6469): loud, once per boot, on stderr so a
         // `--json` command's reserved stdout stays a single parseable document.
-        // eslint-disable-next-line no-console
         console.warn(`[StandaloneStack] ⚠ ${dbNotice}`);
     }
 

packages/sdui-parser/src/codegen.ts

@@ -37,7 +37,6 @@ export function generateDts(manifest: Manifest, options: CodegenOptions = {}): s
 
   return `// AUTO-GENERATED by @object-ui/sdui-parser — DO NOT EDIT.
 // Source of truth: ComponentRegistry inputs (ADR-0080 §3). Regenerate via codegen.
-/* eslint-disable */
 
 export interface SduiBaseProps {
   id?: string;

packages/services/service-automation/src/builtin/template.ts

@@ -281,7 +281,6 @@ function resolveToken(token: string, variables: VariableMap, context: Automation
         return JSON.stringify(String(val));
     });
     try {
-        // eslint-disable-next-line @typescript-eslint/no-implied-eval, no-new-func
         const fn = new Function(...KNOWN_EXPRESSION_FUNCTION_NAMES, `"use strict"; return (${safe});`);
         return fn(...KNOWN_EXPRESSION_FUNCTION_NAMES.map((n) => KNOWN_EXPRESSION_FUNCTIONS[n]));
     } catch (err) {

packages/services/service-cluster-redis/src/kv.ts

@@ -83,7 +83,6 @@ export class RedisKV implements IKV {
 
         // Optimistic-concurrency loop — Redis WATCH aborts the MULTI on
         // any intervening write.
-        // eslint-disable-next-line no-constant-condition
         while (true) {
             await this.client.watch(physical);
             const raw = await this.client.get(physical);
@@ -127,7 +126,6 @@ export class RedisKV implements IKV {
             return removed > 0;
         }
 
-        // eslint-disable-next-line no-constant-condition
         while (true) {
             await this.client.watch(physical);
             const raw = await this.client.get(physical);

packages/services/service-cluster-redis/src/pubsub.ts

@@ -66,7 +66,6 @@ export class RedisPubSub implements IPubSub {
         this.onError =
             opts.onError ??
             ((err, channel) => {
-                // eslint-disable-next-line no-console
                 console.error(`[RedisPubSub] handler error on "${channel}":`, err);
             });
 

packages/services/service-cluster/src/cluster.ts

@@ -36,7 +36,6 @@ export class ComposedClusterService implements IClusterService {
             try {
                 await c.close();
             } catch (err) {
-                // eslint-disable-next-line no-console
                 console.error('[ClusterService] close error:', err);
             }
         }

packages/services/service-cluster/src/memory/pubsub.ts

@@ -47,7 +47,6 @@ export class MemoryPubSub implements IPubSub {
         this.onError =
             opts.onError ??
             ((err, channel) => {
-                // eslint-disable-next-line no-console
                 console.error(`[MemoryPubSub] handler error on channel "${channel}":`, err);
             });
         this.nodeId = opts.nodeId;

packages/services/service-datasource/src/sqlite-driver-fallback.ts

@@ -115,7 +115,6 @@ export async function resolveSqliteDriver(
     opts.warn ??
     ((message: string) => {
       try {
-        // eslint-disable-next-line no-console
         console.warn(message);
       } catch {
         /* ignore */

packages/types/src/node.ts

@@ -120,7 +120,6 @@ import { isModuleNotFoundError } from './module-not-found.js';
  * reads an export off it dynamically, exactly as the bare `import()` it replaces
  * did.
  */
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
 export type HostImporter = (pkg: string) => Promise<any>;
 
 /**
@@ -132,7 +131,6 @@ export type HostImporter = (pkg: string) => Promise<any>;
  * `any` for the same reason {@link HostImporter} uses it: the module namespace
  * belongs to a package this repo does not compile against.
  */
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
 export type FallbackImport = (specifier: string) => Promise<any>;
 
 /** Options for {@link createHostImporter}. */

packages/verify/src/derive.ts

@@ -18,7 +18,6 @@
 // What it still can't satisfy (required-reference cycles, external/missing targets)
 // is reported `blocked` with a precise reason — the gate stays honest.
 
-/* eslint-disable @typescript-eslint/no-explicit-any */
 
 const COMPUTED = new Set(['formula', 'summary', 'autonumber', 'rollup', 'vector']);
 const RELATIONAL = new Set(['lookup', 'master_detail', 'master-detail', 'masterdetail', 'tree']);