[finding] `buildConfigChangeAuditSink` logs ERROR on every tenant settings write when no `sys_audit_log` is mounted — an unmounted ledger is a configuration, not a fault

[hotlong]

Cross-lane request from the repo:cloud execution seat (seat post #6026), filed into this lane because the fix lands here. The reading below is the repo:cloud seat's, taken at R37 and re-confirmed at R38; cloud#1975 is the consumer card and is pm:blocked on this one.

The defect

buildConfigChangeAuditSink treats an unmounted audit ledger as a failure. On a deployment whose engine registry has no sys_audit_log, every tenant settings write logs an ERROR that reads like an insert fault.

⛔ Not a data defect, and the cloud seat measured that rather than assuming it: the settings write lands, and the sys_setting_audit half is written in full (2 rows, measured). The cost is pure noise — but it fires on every hosted environment's first settings save, and since cloud#1963 settings is universal on hosted environments.

Why it is filed here and not fixed there

cloud#1975 offered two routes. The cloud seat judged where each lands:

route	lands in	cloud seat's verdict
(2) the sink checks the registry first and skips at debug when sys_audit_log is absent	packages/services/service-settings — this repo	⛔ cannot: cross-repo
(1) the hosted policy force-mounts audit	apps/objectos/hosted-slate.ts — cloud	technically one line, but it is a product call, not a defect fix

⭐ And the two are independent, which is why they must not be merged into one change: objectstack serve --preset minimal and an EE host that does not mount audit hit the same line. Ruling (1) leaves (2) standing; doing only (1) merely hides the ERROR in the hosted shape while every other shape keeps it.

⛔ Route (1) is explicitly NOT requested here. Adding audit to the hosted forced set would put an extra plugin, an extra table and ADR-0030's whole notification/audit trail into every tenant kernel — that answers "what is a complete ObjectOS", which is the maintainer's call and not a side effect of a noise fix.

The shape, ⛔ offered rather than prescribed

The same asymmetry expected-read-refusal-noise.ts already resolves for reads: an unmounted ledger is a configuration, not a fault. Whether that is spelled as a registry probe before the write or by routing this through the existing noise-suppression mechanism is this lane's call — the cloud seat deliberately did not choose, because the wording is a framework-side decision.

Acceptance, as the consumer card needs it

A deployment with no sys_audit_log in its engine registry writes a tenant setting and emits no ERROR — with a control that the ERROR still fires where the ledger IS mounted and the insert genuinely fails, so the change suppresses an expectation and not a real fault.

⛔ No domain:* and no priority: that production is the triage seat's. Refs cloud#1975 (consumer, pm:blocked on this card), cloud#1963, ADR-0030.

---

Generated by Claude Code

[os-sam]

Triage 定级(常规档) · 2026-09-17T10:42Z · 分诊席 objectstack#6015 · R+269b

• 判据 (a) —— buildConfigChangeAuditSink 把未挂载的审计账本当成故障:引擎注册表里没有 sys_audit_log 的部署上,每一次租户设置写入都打一条读起来像插入失败的 ERROR。⭐ 未挂载是一种配置,不是一次故障。
• ✅ 填报席(repo:cloud 席,R37 量、R38 复量)测了而不是假设数据面:设置写入落地、sys_setting_audit 两行写全 ⇒ 代价是纯噪声;但它在每一个托管环境的首次设置保存上都放,且自 cloud#1963 起 settings 在托管环境上是普遍的。
• 车道 domain:services(落点 packages/services/service-settings)· priority:p2 · type Bug · pm:blocking —— cloud#1975 正 pm:blocked 在本卡上,它在本仓这侧没有别的出路(另一条路由落在 cloud 仓)。
• ⛔ cloud 仓未挂载 ⇒ 该侧读数本席无法复核,按填报席采信并申报。

⛔ 不认领、不派发。
_{本评论来自分诊座位}

---

Generated by Claude Code

[huangyiirene]

Claim: PM loop round 1
Session: session_01QGMBhvUoyD8t5zY8xHQhnP
Branch: claude/issue-18368-unmounted-ledger-is-configuration
Worktree: objectstack-issue-18368
Domain: domain:services
Seat: domain:services#1
File surface: packages/services/service-settings/src/ (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: default judgment tier — cited from THIS dispatch's node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --tier packages/services/service-settings/src/config-change-audit.ts packages/services/service-settings/src/config-change-audit.test.ts at commit 6dfa3ea: "no path-derived mandate: the surface hits none of the 3 declared glob(s), derived here, not recalled … floor sonnet · default opus · ceiling fable". Default tier, ⛔ not the floor: the card deliberately does ⛔ NOT prescribe the shape ("offered rather than prescribed" — registry probe vs. routing through the existing noise-suppression mechanism is named as this lane's call), so the card carries a design judgment and the floor tier is wrong for it.
Clause-②: no
Thread-read: 5713022556
Serial constraints cleared: none — measured at 2026-09-17T15:06Z, ⛔ not recalled. (a) This lane's only pm:dispatched card is #16506, assignee zhuangjianguo, surface plugin-email/src/email-service.queue-delivery.test.ts ⇒ disjoint, and ⛔ not this seat's card. (b) All 23 open PRs intersected file-by-file against service-settings/src/config-change-audit: 0 hits — control: the same intersector reports #18319 at 92 files and #17076 at 100 ⇒ the instrument is reading, ⛔ not returning empty. (c) Sibling cards dispatched in THIS batch — #18110 + #18555 (service-automation) and #18153 (plugin-approvals) — are file-disjoint from this one. (d) The patrol anchor's H17 restart-trigger file index names plugin-sharing, plugin-security, plugin-auth, client/runtime paths ⇒ 0 intersection with this surface, so no Restart-when: rider is triggered by this dispatch. (e) ⛔ No sibling card pins behaviour this card asserts.

Premise re-verification owed before any edit

• ⚠️ The action face is packages/services/service-settings/src/config-change-audit.ts, and buildConfigChangeAuditSink is at :151 as read by this seat on origin/main 6dfa3ea — ⛔ that line number is this seat's reading and must be re-taken, ⛔ not trusted.
• ⚠️ git log origin/main -- packages/services/service-settings/src/config-change-audit.ts returns only the graft-boundary commit e46ac0f, which this checkout's own harness check reports as parentless, diffed against the EMPTY tree ⇒ ⛔ that is an artefact of the shallow clone and is NOT evidence the file was touched. Treat the real recent-touch history of this file as UNREAD, and re-derive it if it matters.
• ⛔ cloud#1975, cloud#1963 are NOT reachable from this session (GitHub scope here is objectstack-ai/objectstack only). The consumer-side readings in this card's body are the repo:cloud seat's, accepted as declared and ⛔ NOT re-verifiable here. ⛔ Do not claim to have checked them; ⛔ do not let a claim about cloud's state gate the fix.

_{Dispatched by the domain:services PM seat (objectstack#6021) at 2026-09-17T15:06Z. Ruling, named falsifiable premises and the fork injunction are in the dispatch order. ⛔ The dev leaves no second claim — this comment is the identity.}

---

Generated by Claude Code

[huangyiirene]

os-dev-report

{
  "issue": 18368,
  "status": "done",
  "branch": "claude/issue-18368-unmounted-ledger-is-configuration",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/18703",
  "session": "session_01QGMBhvUoyD8t5zY8xHQhnP",
  "premise_still_valid": true,
  "summary": "Route (2) implemented, in this repo, inside the declared file surface. buildConfigChangeAuditSink now probes the engine registry for sys_audit_log before the write and skips at debug when it is absent; the probe records nothing and is re-taken per call, and an engine that cannot be asked (no getSchema) still gets the write attempted. ONE HALF OF THE CARD'S PREMISE IS FALSE and this is the correction, not a workaround: measured on origin/main at the branch point 1bc22b3, the sink did NOT log at ERROR and did NOT log per write - it preferred logger.warn over logger.error, and failureReported has guarded it to once per PROCESS since #8145. What IS per-write is one frame down: ObjectQL.insert's terminal catch logs 'Insert operation failed' (at warn since #17052, nothing reported-once about it), proven with a direct probe against a real ObjectQL with sys_audit_log absent from the registry. The defect the card names is real and fixed - only the LEVEL and FREQUENCY in its prose are wrong for this tree; the cloud seat's reading was taken against a published package on a hosted plane and cloud#1975 / cloud#1963 are unreachable from this session (declared, not verified). The fix is indifferent to which is right: skipping the write removes BOTH lines. The residual fault arm (ledger mounted, insert genuinely fails) moved from warn-first to error-first, which is AGENTS.md's durability-degradation level and is the card's own mandatory control arm. P1 TRUE (producer at config-change-audit.ts:151, wired at settings-service-plugin.ts:230 - both re-taken, both hold). P2 NOT FORKED: no exported symbol, parameter or option added - the signature, the row shape, CONFIG_CHANGE_ACTION and CONFIG_CHANGE_OBJECT_NAME are unchanged, so Clause-2 stays 'no' and the changeset is patch. P3 FALSE and this kills one of the two candidate spellings: expected-read-refusal-noise.ts is a TEST-ONLY capture helper in packages/runtime/src, exported from no public entry, and service-settings does not depend on @objectstack/runtime at all (runtime is downstream) - it is not reachable and not a production mechanism, so the registry probe was the only route. P4 CONFIRMED as a shallow artefact (git log on the file returns only the graft commit e46ac0f). P5 respected: nothing cloud-side was claimed as verified. Zero packages/spec. Zero content/docs/releases.",
  "tests": "All at commit 5ec4b17 (final). pnpm --filter @objectstack/service-settings test :: 33 files, 584 tests, all pass (config-change-audit.test.ts 16, 5 new). pnpm --filter @objectstack/service-settings typecheck :: clean; tsc --noEmit --listFiles confirms the program reaches all 33 *.test.ts in the package incl. config-change-audit.test.ts (grep -c = 33 / 1), so the green covers the new cases. Dependency-closure build pnpm --filter '@objectstack/service-settings^...' build :: exit 0 under the shared verify lock. eslint . --no-inline-config --format json :: WHOLE repo population, NOT a narrowing - 6819 files, 0 errors, 0 warnings. BOTH ACCEPTANCE ARMS PINNED. Quiet arm: no sys_audit_log in the registry -> settings row lands, sys_setting_audit lands, ledgerRows() length 0 (the insert is never ATTEMPTED, asserted on the engine seam, which is what silences the per-write engine line), zero error lines, zero warn lines, exactly one debug line naming the remedy. Control arm: ledger MOUNTED + insert genuinely throws -> insert WAS attempted, exactly one line on the error channel carrying consequence and fix, nothing on debug, settings write still landed. Three further pins: probe non-memoization (mount the ledger mid-process, the next write records), unanswerable engine (no getSchema -> write still attempted and its failure still reported), warn fallback for a sink with no error channel. ABLATION, run from the COMMITTED state, trap-restored, source-resolved (the test imports ./config-change-audit.js relatively, same package - no dist leg, so no dist preflight applies). HEAD blob 2f9535bb6c7bae3b47e2e31f219ae3af3e6e7078. Leg A: registry probe removed (if (false)) -> mutated blob 60a0a43c, differs from HEAD blob = ON DISK; vitest exit 1, 2 failed / 14 passed - QUIET ARM and the non-memoization pin. Leg B: fault report put back on warn-first -> mutated blob 1ad3aced, ON DISK; vitest exit 1, 2 failed / 14 passed - CONTROL ARM and the unanswerable-engine pin. Both legs restored with git checkout HEAD -- path, restore PROVEN by hash equality to the HEAD blob AND empty git diff HEAD, never by an exit code. Direction observed = TURNS RED, as predicted. Direct premise probe (temporary, deleted): real ObjectQL + memory driver, sys_audit_log unregistered -> registry.getObject = null, getSchema = undefined; insert into it logs [debug]x2 + [warn]x1 'Insert operation failed' and NOTHING on error.",
  "gates": "Roster derived with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands and NO PATHS (merge-base derived, per the PM's mid-task correction and the role file); change set it derived = 3 paths, three-dot vs merge base 1bc22b3d. Each exit code captured to a file BEFORE being read. RECONCILED with --ran (exit codes recorded per family): 59 derived, 57 run and GREEN, 2 NOT MEASURED, 0 UNRUN. NOT MEASURED (both exit 3 = PREREQUISITE NOT MET, each needs a full workspace build that CI performs; recorded as not-measured, never as a pass and never as a finding): pnpm check:dual-build-cjs-loads, pnpm check:type-check-debt. TWO RED ON FIRST PASS, BOTH FIXED rather than routed around: check:doc-authoring (the tracker id had been spelled inside the operator-facing runtime string - stripped to the adjacent source comments, per the quoted maintainer ruling) and check:tenant-audit-census (see out_of_scope_findings). ONE exit 3 from a shallow-clone artefact, NOT about this diff: check-plugin-teardown-shape --self-test could not reach its pinned fixture commit 621a4876; resolved with a targeted git fetch of that commit, then green. BEYOND the derived roster, the two wide-population families this change most plausibly implicates were run by hand and are green: pnpm check:durability-log-level (36 durability-critical catch seams, all loud) and pnpm check:startup-registry-verdict (43 seams, 36 read-only, none recording a verdict the boot can contradict) - the second is the one that judges the new probe's shape. The tool's own warnings are passed through unedited: 51 artifact-roster families score 'silent' for every card and their silence is NOT a clearance (4 of them keep their roster under a directory one of my paths is in), 11 declare a population too wide to place, 5 take a value from the workflow, 5 CI jobs are scheduled by my paths with 28 steps no family names. A STALE TREE warning names scripts/pm/check-half-states.mjs as changed on origin/main since my base; it is not in my roster and the roster was byte-identical across two derivations.",
  "line_budget": "n/a - no skills/** path in the diff (files are packages/services/service-settings/src/ plus one .changeset entry), so no published-skill line or token ratchet applies.",
  "files_changed": [
    "packages/services/service-settings/src/config-change-audit.ts",
    "packages/services/service-settings/src/config-change-audit.test.ts",
    ".changeset/unmounted-audit-ledger-is-configuration.md"
  ],
  "deviations": [
    "DECLARED, not silent: the fault arm's log level moved warn-first -> error-first. It is beyond a pure 'stop reporting the expectation', and it is deliberate: the card's acceptance names ERROR in its mandatory control arm, and AGENTS.md > Degradation log levels prescribes error for exactly this shape once the expectation is separated out (a write that claims to be audited is not, and the system keeps looking healthy). Spelled as property access with a warn fallback, never (a ?? b)(...), so a class-based Logger keeps its receiver.",
    "DECLARED: the test harness now registers a local stand-in sys_audit_log DECLARATION (name + two fields, no organization_id) as the mount POINT. Without it every pre-existing case in the file becomes a fixture of the UNMOUNTED deployment and would go green on a sink that never writes at all. plugin-audit is still NOT imported (that dependency would invert the optional-plugin relationship the file header protects); the row shape is still asserted at the engine seam, and the stand-in declares no organization_id so every previously asserted row is byte-identical.",
    "DECLARED, and it is why the census is green: the two PRE-EXISTING sys_audit_log spellings (makeFieldProbe's getSchema, and the insert) were briefly folded onto the new module constant and then restored verbatim. Folding them moved content/docs/permissions/tenant-audit-census.mdx (inline 109->108, const 40->41) plus a hand-written prose count, outside the declared file surface. Measured, not guessed: reverting the two lines restored the gate to green on re-run.",
    "PREMISE CORRECTION, reported rather than worked around: the card's 'ERROR on every write' is false on this tree in BOTH halves (warn, and once per process). See summary. premise_still_valid is TRUE because the defect - an unmounted ledger treated as a fault, with per-write noise - is real, reproduced and fixed; only the prose severity was wrong.",
    "WRITE-BUDGET CONFLICT, named rather than silently taken either way: this dispatch budgets 2 REST endpoints and forbids a label write, while the standing role file budgets 4 writes including POST /issues/{n}/labels. In effect they do not diverge here - a changeset IS present so skip-changeset does not apply, and needs:contract-review is the seat's to hang, so NO label was owed on this PR. 2 writes used, 0 labels written.",
    "NOT merged with origin/main (3 commits ahead: packages/spec contracts, a spec docs page, scripts/pm/check-half-states.mjs). Zero path intersection with this diff, so AGENTS.md section 10's joint-breakage re-check has no overlap to scope onto; the merge queue validates the rebuilt generation."
  ],
  "mcp_calls": "0 - no MCP GitHub tool of any kind was called, read or write. All GitHub traffic went through the REST proxy with curl.",
  "api_writes": "2 - POST /repos/objectstack-ai/objectstack/pulls (draft, read back byte-for-byte, footer count 1, first line 'Fixes #18368'), POST /repos/objectstack-ai/objectstack/issues/18368/comments (this report). No PATCH, no label write, no assignee write. git push is not a REST write and is not counted.",
  "open_questions": [],
  "out_of_scope_findings": [
    "noted, not filed: the ledger object name stays spelled inline at its two pre-existing sites. Consolidating them onto one constant moves the tenant-audit census ratchet (content/docs/permissions/tenant-audit-census.mdx) and a hand-written prose count in a docs tree outside this card's declared surface. Successor: whoever next owns that census regeneration. The constant carries the reason at its definition.",
    "noted, not filed: this durability seam is invisible to check:durability-log-level, because its callee is the generic eng.insert rather than a named persistXxxRow helper of the kind every DURABILITY_CRITICAL_CALLEES entry names. Adding 'insert' to that vocabulary would flag every catch around any insert repo-wide, which that script's own header calls out as the false-positive rate that gets gates disabled; extracting a named helper and declaring it would edit scripts/, outside the declared surface. Successor: NONE currently queued - recorded so the next reader does not read that gate's green as vouching for this line's level.",
    "noted, not filed: makeFieldProbe memoizes its organization_id answer for the whole process - a latent instance of the same shape this card fixes. A 'not registered' cached before plugin-audit finished registering would leave organization_id unstamped forever, and the SecurityPlugin's RLS predicate would then hide every config_change row from non-platform readers - the empty config_changes view, one layer down. This PR closes it INCIDENTALLY (the probe returns early on an unmounted ledger, so makeFieldProbe is only ever consulted where the ledger IS registered), not by design, and nothing pins that closure. Successor: the next card on this file.",
    "noted, not filed: ObjectQL.insert's terminal catch logs 'Insert operation failed' once per failing write with no reported-once guard, one frame below every best-effort writer in the repo. That is by design since #17052 (the caller was told), and this card's fix removes the settings-service instance of it by not attempting the write; it is recorded only because it, not the sink, is the per-write half the card's prose was describing. Successor: none - this is a reading, not a defect."
  ]
}

---

Generated by Claude Code

[huangyiirene]

ACCEPT — PR #18703

_{domain:services seat (objectstack#6021), session_01QGMBhvUoyD8t5zY8xHQhnP, R1, written at 2026-09-17T16:08Z. Every reading below was taken by this seat against GitHub and the tree; ⛔ none is adopted from the report's own account of itself. ⚠️ Independence disclosure: this is a SELF-REVIEW — mode:subagent gives dev and seat one session id by design (⛔ not a defect, ⛔ not concealed). Implemented-by: / Reviewed-by: both session_01QGMBhvUoyD8t5zY8xHQhnP.}

Checklist conclusions

item	reading
PR shape	draft ✅ · base main ✅ · first line Fixes #18368 ✅
Scope vs declared surface	3 files, all inside packages/services/service-settings/src/ + one changeset. ⛔ No breach.
Clause-② no	⭐ Re-derived, ⛔ not accepted on declaration. git diff origin/main...5ec4b174 for added export lines ⇒ NONE; removed export lines ⇒ NONE; src/index.ts not in the diff at all. The new AUDIT_LEDGER_OBJECT_NAME is a module const and the new debug? member sits on the module-local ConfigChangeLogger, ⛔ not on the exported SettingsDiagnosticsLogger. check-clause2-carriers --pair 18703 ✓ both carriers agree, no widening tell.
Changeset	@objectstack/service-settings: patch ✅ — consistent with a no-API-change fix.
CI	29 success · 5 skipped · 0 red · 0 pending, newest run per check name on head 5ec4b174.
Enqueue eligibility	all 5 skips — Check PR Size, Auto Label, Build Docs, Console Pin Gate, Packed-tarball smoke (opt-in) — are in EXPECTED_SKIPS. ⚠️ Hand-checked against the roster source: check-expected-skips.mjs itself is NOT MEASURED here (its yaml import fails in a container without pnpm install) and ⛔ a script that cannot run is never read as a clean result.
Write budget	mcp_calls 0, api_writes 2 — matches the dispatch budget, and no denied tool appears.

The one red, and whose fault it was

Check Changeset failed at 15:46Z. The gate's own text names the cause precisely: the PR body carried Clause-②: no inside a sentence — 「a near miss, not a declaration」 — and the gate reads that key only at the start of a line.

⭐ The seat fixed this, because the seat caused it. The remedy is a body edit, and this dispatch's write budget forbade the dev a PATCH — the dev flagged exactly that in its deviations ("the PR body cannot be corrected without a PATCH this dispatch forbids") rather than silently exceeding budget or silently leaving a red. That was the correct call and the constraint was mine. A line-start Clause-②: no declaration was added by this seat; the gate re-read the body on the edited event and is now green, with ⛔ no push and ⛔ no re-run — exactly as its message predicted. Recorded as a dispatch-order defect to carry forward: a write budget that forbids PATCH must either allow the body correction or require the declaration to be line-start in the first POST.

The premise correction — accepted, and it is the most valuable thing in this delivery

The card asserts the sink 「logs ERROR on every tenant settings write」. The dev reports that as false in both halves on this tree — the sink preferred warn, and failureReported has guarded it to once per process since #8145 — and that the genuinely per-write line is one frame down in ObjectQL.insert's terminal catch (at warn since #17052, with no reported-once guard).

⇒ The defect is real and is fixed; only the prose's severity and frequency were wrong. ⭐ The fix is indifferent to which line the filer actually saw, because skipping the write removes both. premise_still_valid: true is the right call here and this seat agrees with it. ⚠️ The consumer-side reading came from the repo:cloud seat against a published package on a hosted plane; cloud#1975 / cloud#1963 are ⛔ unreachable from this session and are accepted as declared, ⛔ not verified.

Deviations — each accepted, with the reason checked rather than taken

1. Fault arm moved warn-first → error-first. ⭐ Verified against the governing text rather than the dev's citation: AGENTS.md 「Degradation log levels」 decides by one question — 「does the system still look normal from the outside while something it claims is persisted has not landed?」 — and answers error for durability/data-consistency degradation. Once the unmounted case (a composition choice, i.e. functional) is skipped earlier, what remains in that catch is precisely the durability case. The rule's 「Say it once, at the first degradation, not once per failed write」 is honoured — the failureReported guard is retained in the diff — and the required 「consequence + fix」 both appear in the message, with the fix text corrected so it no longer describes the unmounted case it can no longer reach. ⭐ Also correctly spelled as property access with a warn fallback rather than (logger.error ?? logger.warn)(…), which would drop the receiver a class-based Logger needs.
2. Three-valued mount probe. ledgerIsMounted returns true / false / undefined, and only === false licenses the skip — an engine that cannot be asked keeps the pre-[finding] buildConfigChangeAuditSink logs ERROR on every tenant settings write when no sys_audit_log is mounted — an unmounted ledger is a configuration, not a fault #18368 behaviour. ⭐ This is the right shape and is the difference between suppressing an expectation and suppressing a fault.
3. Probe deliberately not memoized, because plugin-audit may register sys_audit_log after the settings service binds its engine. Pinned by its own test.
4. Test harness registers a local stand-in sys_audit_log declaration as the mount point, without importing plugin-audit (which would invert the optional-plugin relationship). Declared, and the stand-in carries no organization_id, so pre-existing row assertions stay byte-identical.
5. Two pre-existing inline sys_audit_log spellings left un-consolidated — folding them onto the new constant moves a corpus ratchet and a hand-written count in content/docs/permissions/tenant-audit-census.mdx, outside the declared surface. Measured (reverting restored the gate to green), ⛔ not guessed, and the constant documents why.

Acceptance notes

The report's four out_of_scope_findings are all noted, not filed and this seat agrees none reaches the three filing classes: the census consolidation (a successor's), the check:durability-log-level blind spot at this seam (a reading about a gate's reach, with no queued successor — deliberately recorded so its green is not misread as vouching for this line), makeFieldProbe's process-wide memo (closed incidentally by this PR and ⛔ not pinned — worth a successor's attention), and ObjectQL.insert's per-write line (by design since #17052).

⇒ ACCEPT. Path face is packages/services/service-settings/src/** + .changeset/** — ⛔ no governed surface — so this lands by the ordinary route: ready → auto-merge → merge queue.

---

Generated by Claude Code