spec: before the next changeset version, the connector-sync release notes contradict each other and the error-code ledger misses two service-automation rows (PR #21084 follow-ups) #21106

Triage: first grade — bug · priority:p1 · domain:spec · area:devpath · pm:queue. Release text: it lands before the Version Packages PR next picks up PR #21084

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-01T07:15Z. ⛔ Not a claim, ⛔ not a dispatch.

Why p1. It is the release-priority rule: wrong text that a release would freeze.

The timing, read at this write:

• Version Packages chore: version packages #20639 (17.6.0) is at d01c3cd82d. That head carries the stage-① note ("declared, not yet executed") and does not carry PR feat(service-automation,core,types): the connector sync executor pulls a mapping's connectorSource through the import runner, moved beside bulkWrite #21084 (8368f1c0). As drafted now, 17.6.0's text is consistent.
• The next refresh of chore: version packages #20639 picks up feat(service-automation,core,types): the connector sync executor pulls a mapping's connectorSource through the import runner, moved beside bulkWrite #21084. From then on, the version states both "nothing executes it" and "the executor reads it", unless this card has landed first.
• So the order is: this card lands before the next refresh of chore: version packages #20639, or chore: version packages #20639 merges at a head without feat(service-automation,core,types): the connector sync executor pulls a mapping's connectorSource through the import runner, moved beside bulkWrite #21084.

Routing. .changeset/** and packages/spec/** are domain:spec.

Direction. It is the card's own scope, confirmed, as one PR:

1. a deliberate correction of the stage-① pending note, with the designed Check Changeset red, as in PR docs(changeset): correct two scope sentences in the pending service-analytics masked-field note #20991 and PR docs(changeset): scope two pending service-analytics BREAKING banners to the SQL echo on either strategy, and anchor the nested-relation note to its measured base #21012;
2. the "provenance, not identity" ledger sentence in a spec note;
3. the two @objectstack/service-automation provenance rows. Add a pin if the provenance gate stays blind to the refuse(...) call-site form.

Generated by Claude Code

Claim: PM loop round 1 (p1, release text: lands before the next Version Packages refresh) · 2026-10-01T07:36Z
Session: session_017VaLJnYwhPsanVCe9dMCJU
Account: os-bill (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-21106-connector-sync-notes-ledger
Worktree: objectstack-issue-21106
Domain: domain:spec
Seat: domain:spec#2 (seat post #18549)
File surface:

• .changeset/20281-connector-sync-moved-to-mapping.md: a deliberate correction of the stage-① pending note, one sentence. The designed Check Changeset red follows the precedent of PR docs(changeset): correct two scope sentences in the pending service-analytics masked-field note #20991 and PR docs(changeset): scope two pending service-analytics BREAKING banners to the SQL echo on either strategy, and anchor the nested-relation note to its measured base #21012.
• One new .changeset/21106-*.md spec note: the "provenance, not identity" error-code-ledger sentence, as in lint: four recordsOf(stack.packages) readers treat a non-array packages as "no packages" instead of refusing it — the packages/lint half of #19925 (ruling #15293-A) #20206 and [finding] plugin-security 四处错误码发射点未登记 ledger,且免登记的理由注释经实测为假(NOT_OVERRIDABLE 不在 StandardErrorCode、在 ledger 里) #19441.
• packages/spec/src/api/error-code-ledger.zod.ts: the two @objectstack/service-automation provenance rows, MAPPING_NOT_FOUND and UNSUPPORTED_TRANSFORM.
• A pin in the provenance gate's own test only if its patterns cannot be widened to the refuse(...) call-site form inside its declared blind spot.

⛔ No other pending note and no code in service-automation. ⛔ Never Version Packages #20639: merging it is the maintainer's. Stop on breach and explain in the report.
Container & model: S, mode:subagent, model: opus (dispatch-gates --tier: no path-derived mandate; release text plus a ledger, judged against PR #21084's merge 8368f1c0). The at-tier contract review is owed (changeset prose and packages/spec/src/**).
Clause-②: no (notes and provenance rows; the ErrorCode union and every accept set are unchanged)
Thread-read: 5926594302
Serial constraints cleared: read at this stamp against origin/main 9c8b65aa23. No open PR touches error-code-ledger.zod.ts or the provenance gate. Of the open PRs, only Version Packages #20639 (at d01c3cd82d) touches 20281-connector-sync-moved-to-mapping.md, by consuming it. No fleet pm:dispatched claim names these files. Order: this seat is at batch 3 with the p0 #21063 running over it, so this p1 is dispatched at the next free slot, ahead of every other candidate. ⚠️ For the maintainer: the next refresh of #20639 carries PR #21084, so merging #20639 before this card lands would ship both connector-sync sentences.

Generated by Claude Code

Dispatch note · domain:spec seat 2 (session_017VaLJnYwhPsanVCe9dMCJU) · 2026-10-01T08:05Z: the dev is dispatched now, not "at the next free slot" as claim 5926939917 said, on the maintainer's word in this seat's chat, verbatim: 「21106 可以增加并发派」. This card runs over batch 3 alongside the p0 #21063. The verify-lock depth read 1 (queue empty) at dispatch, and origin/main was 99398542b3. Version Packages #20639 still read d01c3cd82d, without PR #21084.

Generated by Claude Code

os-dev-report
{
"issue": 21106,
"status": "done",
"branch": "claude/issue-21106-connector-sync-notes-ledger",
"pr": "#21150",
"session": "session_017VaLJnYwhPsanVCe9dMCJU (subagent; the parent seat session, per the dispatch)",
"premise_still_valid": true,
"summary": "Draft PR #21150 (head 5748c8d, base 9939854 merged with origin/main 39ab294) lands all three items. (1) The stage-① note .changeset/20281-connector-sync-moved-to-mapping.md is corrected in place as a DELIBERATE CORRECTION: the label 'Added (declared, not yet executed):' becomes 'Added:', and 'Nothing executes it in this release, and os validate / os build warn when it is authored.' becomes 'The connector sync executor, @objectstack/service-automation's pullConnectorSource (#20919), reads it; nothing schedules a pull until the job stage lands.' The review's suggested warn clause is dropped because it is false at 8368f1c: the live + authorWarn ledger row makes lintLivenessProperties throw instead of warn (measured). (2) The new .changeset/21106-error-code-ledger-provenance-rows.md (@objectstack/spec minor, Clause-②: yes; see deviations) carries the provenance-not-identity sentence for the #20919 move, measured as types +3 (new key), core +5, rest −7 (not −8: rest kept UNSUPPORTED_TRANSFORM), union 280 unchanged, plus this PR's two rows. (3) MAPPING_NOT_FOUND and UNSUPPORTED_TRANSFORM are added under @objectstack/service-automation in its ASCII order. The gate's own header makes widening its patterns a card of its own, so check:error-code-provenance is not widened; a hand pin in check-error-code-provenance.test.ts pins the two rows and the refuse(...) blind spot itself, and both ablation legs went red. Check Changeset is red by design (check-empty-changeset DELIBERATE CORRECTION; precedents PR #20991 and PR #21012); no skip-changeset.",
"tests": "All on head 5748c8d unless stated. (a) pnpm --filter @objectstack/spec build: 'os-verify-lock: VERDICT command-exit 0', rebuilt after the merge through turbo --filter='@objectstack/lint...' (4 tasks successful). (b) pnpm --filter @objectstack/spec check:generated: exit 0, 'All 15 generated artifacts are up to date'. (c) vitest run --project local --maxWorkers=2 src/api scripts/check-error-code-provenance.test.ts: 'Test Files 47 passed (47) / Tests 1546 passed (1546)'. The 12 other spec test files that read the ledger: 'Test Files 12 passed (12) / Tests 182 passed (182)'. The full spec local project (638 files) was narrowed out: CI's Test Core runs it. (d) pnpm --filter @objectstack/spec typecheck: VERDICT command-exit 0; check:test-typecheck 'OK … 52 file(s) / 246 error(s) / 135 pinned signature(s) held'. (e) Ablation of the hand pin, via scripts/ablation-replace.mjs in WRAP mode under the lock, from the committed state c227eb3. Leg 1 removed the MAPPING_NOT_FOUND row: 'Tests 1 failed | 16 passed (17)', "expected [ …(9) ] to include 'MAPPING_NOT_FOUND'". Leg 2 removed the UNSUPPORTED_TRANSFORM row: 'Tests 1 failed | 16 passed (17)'. Each leg: 'ok restored: blob == HEAD (229345964e13) and git diff HEAD is empty'. Leg 1's first attempt was a refused no-op (the replacement text pre-existed; 'the replacement count moved 1 -> 1') and is not counted; it was re-run with a unique marker. No dist was involved: the test imports the ledger from ../src relatively. (f) The liveness-lint reading behind the dropped clause, through tsx against built spec, at 9939854 and again at 5748c8d; the lint and ledger files have no diff from 8368f1c. runAuthoringRules('validate', …) with mappings[].connectorSource 'THREW lintLivenessProperties: ledger entry has unrecognised status "live"'. runRuntimeAuthoringRules({type:'mapping'}) gave one advisory, rule 'authoring-rule-threw'. Control without connectorSource: 0 findings at both. The os validate CLI process itself was NOT MEASURED: its ~50-package closure was not built.",
"mcp_calls": "0",
"api_writes": "2 REST writes, both through the fleet-write relay (POST /repos/objectstack-ai/objectstack/dispatches): (1) op pr_create → POST /repos/objectstack-ai/objectstack/pulls (draft), run 36846897639 success, PR #21150, read-back 'identical'; (2) op comment → POST /repos//issues/21106/comments, this report. Not written: the PR assignee (see deviations). Not REST: four git pushes of the branch (empty probe, two commits, one merge).",
"open_questions": [
{
"question": "Clause-② on the new spec note: the claim and the dispatch said patch + 'Clause-②: no'; this PR ships minor + 'Clause-②: yes'. Keep it?",
"options": [
"A. Keep minor + yes. The two rows widen ERROR_CODE_LEDGER['@objectstack/service-automation'], a published as-const face the ledger header (#16404 ruling) names as the error-code contract face. Both precedents the card names (#20206 at 5f9d7d7, #19441 at 3f9e2ea) declared a provenance-row addition spec minor + 'Clause-②: yes' ('What widens is the per-package face'). Released version unchanged: one fixed group, and spec already has a pending minor.",
"B. Revert to patch + no, as the claim wrote. Same released version, but it contradicts both precedents and the ledger header's own rule; the seat would edit the note's two lines and the PR body's line 2."
],
"recommendation": "A, because the dispatch said not to keep no silently when the diff widens a public surface, and the repository's own precedent and ledger rule read this as a widening. No accept set changes either way."
}
],
"out_of_scope_findings": [
"class: a · reach: the rule registry os validate / os build call (runAuthoringRules('validate', …), packages/cli/src/commands/validate.ts:522, no catch on that path) THREW on a stack whose mapping authors connectorSource, measured through lint's source at 9939854 and 5748c8d (lint files unchanged since 8368f1c). The runtime metadata-write door answered rule 'authoring-rule-threw' instead of the liveness warning. The CLI process end to end is NOT MEASURED (closure not built), and there is no real producer in examples/ · evidence: packages/spec/liveness/mapping.json connectorSource is status 'live' + authorWarn true since #21084. lintLivenessProperties' describe() has no 'live' branch and throws its sentinel (its header calls live + authorWarn 'a ledger authoring mistake'; lint-liveness-properties.test.ts asserts the throw). authoring-rules.ts (#20919 comment) and runtime-gate.inert-type-writes.test.ts both say an authored connectorSource 'is warned'. Fix options for its own card: a describe() branch for a live row with a caveat, or a different ledger row · dedupe words: liveness authorWarn live status describe throws · connectorSource os validate unrecognised status live · lintLivenessProperties sentinel live row · authoring-rule-threw mapping",
"class: a · reach: named real producer, turbo 2.11.5 (bumped by 840ec9d, the development-dependencies group, on main). It ran via pnpm exec turbo run build --filter='@objectstack/lint...' and via pnpm check:type-check-debt in this worktree, and each run left M AGENTS.md (+11 lines). Measured twice and restored both times (blob e9e211fc = HEAD), never committed · evidence: turbo appends a managed 'turborepo-agent-rules' block, which contains an HTML-comment marker pair, to AGENTS.md (a Tier H governed surface) on each invocation it attributes to an AI agent. turbo.json declares no agentGuidance:false. Any parallel dev that commits with -a or git add -A carries a governed-surface edit into its PR (one path makes the whole PR Tier H) · dedupe words: turbo agentGuidance AGENTS.md block · turborepo-agent-rules managed block · turbo 2.11 writes AGENTS.md",
"carrier: none (承接者:无) · noted in PR #21150 Acceptance notes, not filed: the stage-① note's 'Runtime behaviour is deliberately unchanged: no connector sync ever ran.' and 'It carries no cadence (a job sets that)' were read and kept (true of the retired connector-attached keys / by design)."
],
"gates": "dispatch-gates --commands --repo objectstack-ai/objectstack at 5748c8d (exit 0) derived 87 commands from 4 paths; all run on that head, exit codes captured before any pipe. 84 exit 0, including: pnpm --filter @objectstack/spec run check:error-code-provenance ('scanned 2636 files; 335 registered-code stamp site(s): 316 listed, 19 waived' / 'OK'); node scripts/check-adr-0087-registration.mjs --base origin/main ('this PR adds no declared-breaking changeset (2 non-breaking changeset(s) seen)'); node scripts/check-changeset-no-major.mjs --base origin/main ('This diff introduces no major bump'); check:api-surface, check:authorable-surface, check:docs, check:liveness, check:error-code-casing, check:dispatcher-error-vocabulary, check:cross-package-test-inputs, check:nul-bytes; check:query-options-erasure (exit 0 in 315s; the first run hit the runner's 280s timeout); check:type-check-debt (exit 0, '1 ledger entr(ies) re-measured … none above its recorded number'; the first run hit the 280s timeout). 1 exit 1 by design: node scripts/check-empty-changeset.mjs --base origin/main, DELIBERATE CORRECTION on .changeset/20281-connector-sync-moved-to-mapping.md. NOT MEASURED: check:dual-build-cjs-loads, reason: PREREQUISITE NOT MET, it needs a full pnpm build. NOT MEASURED: check:lean-entry-closure, reason: PREREQUISITE NOT MET, it needs @objectstack/objectql built. Reconciliation: dispatch-gates.mjs --ran exit 0, '87 derived famil(ies) accounted for — 85 run, 2 NOT-MEASURED (2 DERIVED from a recorded exit 3)'. Pre-merge run at c227eb3: the same 87, same verdicts. CI on 5748c8d at 2026-10-01T10:06Z: in_progress (32 check-runs: 22 in_progress, 7 success, 3 skipped, 0 failure; Check Changeset in_progress, expected red by design).",
"line_budget": "none owed: no skills/** in the diff",
"deviations": [
"Clause-② / bump: the new note is @objectstack/spec minor + 'Clause-②: yes', and the PR body's line 2 reads 'Clause-②: yes', not the claim's 'no'. Evidence and options are in open_questions.",
"The review's suggested correction text kept 'os validate / os build warn when it is authored'. This PR drops it: measured false at 8368f1c (see tests (f) and the first finding).",
"The card and review counted @objectstack/rest −8; measured −7 at 8368f1c vs 2742e53 (rest kept UNSUPPORTED_TRANSFORM). The note says seven.",
"PR assignee NOT set. Command node scripts/pm/label-write.mjs --repo objectstack-ai/objectstack --issue 21150 --assign os-bill was denied by the Claude Code auto-mode classifier ('[External System Writes]') before any request. Not retried by another route; the seat sets assignee os-bill on #21150.",
"Merged origin/main 39ab294 into the branch before opening the PR (merge commit 5748c8d; clean, delta vs main = exactly the 4 files), then re-ran build, check:generated, the spec tests, typecheck and the whole 87-command union on that head.",
"AGENTS.md was rewritten twice by turbo 2.11.5 during verification. Both times it was restored with git checkout HEAD -- AGENTS.md (hash = HEAD) and never staged (second finding).",
"Ablation leg 1's first attempt was refused by ablation-replace (its replacement text already existed) before any test ran; it was re-run with a unique marker. Reported, not counted."
],
"files_changed": [
".changeset/20281-connector-sync-moved-to-mapping.md (+4/−3, the deliberate correction)",
".changeset/21106-error-code-ledger-provenance-rows.md (new, @objectstack/spec minor, Clause-②: yes)",
"packages/spec/src/api/error-code-ledger.zod.ts (+14: two @objectstack/service-automation rows + their comment)",
"packages/spec/scripts/check-error-code-provenance.test.ts (+39/−1: the hand pin and the blind-spot pin)"
],
"cleanup": "Worktree /home/user/objectstack-issue-21106: git status clean at 5748c8d (= origin branch). node_modules is removed and the worktree is removed with git worktree remove (no --force) right after this comment is posted. Background processes started: none."
}

Generated by Claude Code

Claim: PM loop round 1 (amendment of claim 5926939917, same session and branch) · 2026-10-01T10:24Z
Session: session_017VaLJnYwhPsanVCe9dMCJU
Account: os-bill (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-21106-connector-sync-notes-ledger
Worktree: objectstack-issue-21106 (removed by the dev after the PR opened; the branch is the identity)
Domain: domain:spec
Seat: domain:spec#2 (seat post #18549)
File surface: as claim 5926939917, unchanged. PR #21150 carries the stage-① note correction, the new spec note, the two @objectstack/service-automation ledger rows, and a hand pin in check-error-code-provenance.test.ts; the gate's own header keeps widening its patterns a card of its own.
Container & model: S, mode:subagent, model: opus (unchanged).
Clause-②: yes (widening)
Thread-read: 5929227465
Correction: claim 5926939917 declared Clause-②: no and a patch note. The two rows widen ERROR_CODE_LEDGER['@objectstack/service-automation'], a published as-const face that the ledger header's #16404 ruling names a Clause-② face. Both precedents the card names (#20206, #19441) declared minor + Clause-②: yes. The at-tier record 5929446191 confirms it: yes, widening of the per-package face. No accept set moves: the ErrorCode union is 280 before and after. The note is @objectstack/spec minor, so the released version is unchanged (one fixed group, and a pending minor already exists).

Generated by Claude Code

ACCEPT — PR #21150 at head 5748c8ddd1 · domain:spec seat 2 (session_017VaLJnYwhPsanVCe9dMCJU) · 2026-10-01T10:25Z

Reviewed against GitHub (the PR object, its file list, its diff and the head's check-runs), not against report 5929227465.

• Shape: draft, base main, first line Fixes #21106 and no other closing keyword, Clause-②: yes at line start. That matches the amended claim. The new note is @objectstack/spec minor.
• Scope: 4 files, inside the claim: the corrected stage-① note, the new spec note, the two ledger rows, and the hand pin. check-governed-merges.mjs --pr 21150 says NOT governed.
• Contract review: the at-tier record 5929446191 on the PR is a PASS at 5748c8ddd10f, the head this lands. It judges each point the seat asked about.
  • The arm: minor + Clause-②: yes, a widening of the per-package face, is right ([Decision] Clause ② on an UNREGISTERED error code carried by a thrown value: #14552 landed no, #15963 lands yes, and they are the same class #16404's ruling and both precedents).
  • The corrected sentences are true at 8368f1c0. "reads it" holds at connector-pull.ts, and nothing calls pullConnectorSource outside its package. Dropping the suggested "os validate / os build warn" clause is right: the live + authorWarn row throws instead of warning, which is [finding] os lint / os validate crash on any stack whose mapping authors connectorSource: the ledger row is live with authorWarn: true, and the liveness rule throws its integrity sentinel #21127's, in flight.
  • The counts were verified against 2742e537 and 8368f1c0: types +3 on a new key, core +5, rest −7 (the card's −8 was wrong), union 280 unchanged.
  • The hand pin in place of widening the gate is right; the gate's header makes widening a card of its own.
• Designed red: Check Changeset is red by design on the DELIBERATE CORRECTION. It is recorded before enqueue at the seat's PR comment, and confirmed by the same-head PASS above.
• Evidence read:
  • Ablation: two legs, each red and each restored to blob equality.
  • Suites: spec src/api plus the provenance test (1,546 tests), the 12 other ledger readers, and spec typecheck.
  • Gates: 87 derived, 84 exit 0, 1 red by design, and 2 NOT MEASURED that read built output (CI's).
• CI at 5748c8ddd1, read at this stamp: 28 success, 3 roster skips, Check Changeset red by design, and Lint & Repo Gates and Test Core (5/6) in progress. Landing waits for those two.
• The PR assignee is not set. The dev's label-write was refused by the auto-mode classifier and was not retried; the seat has put it to the maintainer.
• Findings:
  • The live + authorWarn crash: carried by [finding] os lint / os validate crash on any stack whose mapping authors connectorSource: the ledger row is live with authorWarn: true, and the liveness rule throws its integrity sentinel #21127 (p1, in flight).
  • turbo 2.11.5 writing a managed block into AGENTS.md: carried by tooling: turbo 2.11.5 writes a managed block into AGENTS.md in every agent worktree; opt out with "agentGuidance": false in turbo.json #21146 / PR chore(turbo): opt out of the agent-guidance block in the root turbo.json #21151 (domain:devx).
  • Two kept sentences of the stage-① note: Acceptance notes, not filed (true as written).

Generated by Claude Code

Landed · PR #21150 MERGED through the merge queue as df1feaed70 (single parent 2488b98b4) · domain:spec seat 2 (session_017VaLJnYwhPsanVCe9dMCJU) · 2026-10-01T11:04Z

• Verified by content, not by the merged flag. All 4 files have the same blob in the merge commit as at the ACCEPTed head 5748c8ddd1, the head the at-tier PASS 5929446191 covers. The merge commit is an ancestor of origin/main.
• The deadline held: Version Packages chore: version packages #20639 still reads d01c3cd82d, which does not carry PR feat(service-automation,core,types): the connector sync executor pulls a mapping's connectorSource through the import runner, moved beside bulkWrite #21084, at this stamp. Its next refresh therefore picks up PR feat(service-automation,core,types): the connector sync executor pulls a mapping's connectorSource through the import runner, moved beside bulkWrite #21084 and this correction together, and the stage-① note no longer says the binding is "declared, not yet executed".
• The designed red: Check Changeset was red by design on the DELIBERATE CORRECTION, recorded at 5929476499 and confirmed by the same-head PASS. The queue merged it as it did PR docs(changeset): scope two pending service-analytics BREAKING banners to the SQL echo on either strategy, and anchor the nested-relation note to its measured base #21012.
• Closing keywords: the body carried Fixes #21106 only. This card closed completed, and no other card was named.
• State: pm:dispatched comes off in this act. The PR assignee is still unset, pending the maintainer's word.

Generated by Claude Code