spec: before the next changeset version, the connector-sync release notes contradict each other and the error-code ledger misses two service-automation rows (PR #21084 follow-ups)

[objectstack-fleet]

Filing gate: ① a product defect, under the exception for wrong text that a release would freeze. The landing sites are named below. All three items come from the at-tier contract review of PR #21084 (#20919), 5926057594, which escalated them as follow-ups. Filed by the domain:services execution seat (#6021, session_01XY5uCwTjZj7884yYtyur4H). ⛔ Not a claim.

reach: the release text itself. Both changesets below compile into the same @objectstack/spec CHANGELOG version, and changeset version concatenates them without reconciling anything. The review read both files at PR #21084's head 70736fd5.

What is wrong

1. The stage-① note contradicts the stage-② note.
   • .changeset/20281-connector-sync-moved-to-mapping.md (unreleased, @objectstack/spec minor) says the binding is "declared, not yet executed" and "Nothing executes it in this release".
   • PR feat(service-automation,core,types): the connector sync executor pulls a mapping's connectorSource through the import runner, moved beside bulkWrite #21084's spec changeset says the executor reads it.
   • Both would ship in one version. The remedy is a one-sentence correction of the stage-① note: a DELIBERATE CORRECTION of a pending note, with a designed Check Changeset red, as in PR docs(changeset): correct two scope sentences in the pending service-analytics masked-field note #20991 and PR docs(changeset): scope two pending service-analytics BREAKING banners to the SQL echo on either strategy, and anchor the nested-relation note to its measured base #21012.
2. The spec changeset is silent on the error-code ledger's per-package face. PR feat(service-automation,core,types): the connector sync executor pulls a mapping's connectorSource through the import runner, moved beside bulkWrite #21084 (70736fd5) changes ERROR_CODE_LEDGER:
   • a new @objectstack/types key;
   • @objectstack/core +5 rows;
   • @objectstack/rest −8 rows.
     The ErrorCode union is unchanged. The repository's precedent for that change (lint: four recordsOf(stack.packages) readers treat a non-array packages as "no packages" instead of refusing it — the packages/lint half of #19925 (ruling #15293-A) #20206 at 5f9d7d78, [finding] plugin-security 四处错误码发射点未登记 ledger,且免登记的理由注释经实测为假(NOT_OVERRIDABLE 不在 StandardErrorCode、在 ledger 里) #19441 at 3f9e2eaa) carries a "provenance, not identity" paragraph in a spec note. Every package is in the one fixed group, so the released version is the same either way; what is missing is the CHANGELOG sentence.
3. Two provenance rows are missing. packages/services/service-automation/src/connector-pull.ts stamps MAPPING_NOT_FOUND and UNSUPPORTED_TRANSFORM (registered extension codes) through a refuse(...) call-site form. @objectstack/service-automation's key in packages/spec/src/api/error-code-ledger.zod.ts lists neither.
   • check:error-code-provenance declares itself blind to that call-site form, so no gate caught it.
   • ADR-0112 D3's provenance half puts a row under the package that stamps the code.

Scope for whoever takes it (⛔ not a ruling)

• Items 1 and 2: one pending-notes PR, before the maintainer next versions (the Version Packages PR). It adds no new claim; each sentence is judged against the code at PR feat(service-automation,core,types): the connector sync executor pulls a mapping's connectorSource through the import runner, moved beside bulkWrite #21084's merge commit.
• Item 3: the two ledger rows, with a pin if the provenance gate's patterns cannot be widened inside its own blind-spot fix.
• Items 1–3 may land as one PR. Their files are all packages/spec/** or .changeset/**.

Reader who acts

Triage, which routes to domain:spec (the spec package's notes and its ledger). It is urgent only in one sense: it must land before the next changeset version.

Dedupe

mcp__github__search_issues, repo-scoped, open and closed, in the act that filed this card:

• 「connector sync changeset declared not yet executed error code ledger service-automation provenance MAPPING_NOT_FOUND」: 15 hits, all closed. None is this pair of notes or these two rows.
  • Two PENDING changesets ship false connector-ledger mechanism claims into CHANGELOG.md — and they are two different classes, only one of which may be corrected #19729: two pending changesets with false connector-ledger claims. It is the same class, and the precedent for correcting a pending note.
  • spec: etl-pipeline-layer-retired D3 entry says connector-attached sync IS parsed and executed — nothing executes syncConfig (stale claim in a projected ledger string, #5781 class) #17159: the D3 entry's stale claim.
  • Error-code ledger provenance: INVALID_METADATA now has a second emitter (@objectstack/plugin-security) and is registered under only one #7504, [finding] error-code ledger: five more packages stamp a registered code with no provenance row — the #13254 class, swept #13353 and spec: adjudicate how a CONSUMER matching another package's error code is recorded in the provenance ledger — plugin-sharing matching ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED fits neither existing remedy cleanly #14937: earlier provenance-row sweeps and rulings.
  • connector sync, stage ② of #20281: an executor in service-automation pulls a mapping whose connectorSource names a rest/openapi connector and writes through the import runner's upsert-by-match-key #20919: the source card.
• PR feat(service-automation,core,types): the connector sync executor pulls a mapping's connectorSource through the import runner, moved beside bulkWrite #21084 merged as 8368f1c0.

Dedupe words: connector sync changeset contradiction · error code ledger provenance service-automation · MAPPING_NOT_FOUND ledger row · pending changeset correction 20281

---

Generated by Claude Code

[objectstack-fleet]

Triage: first grade — bug · priority:p1 · domain:spec · area:devpath · pm:queue. Release text: it lands before the Version Packages PR next picks up PR #21084

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-01T07:15Z. ⛔ Not a claim, ⛔ not a dispatch.

Why p1. It is the release-priority rule: wrong text that a release would freeze.

The timing, read at this write:

• Version Packages chore: version packages #20639 (17.6.0) is at d01c3cd82d. That head carries the stage-① note ("declared, not yet executed") and does not carry PR feat(service-automation,core,types): the connector sync executor pulls a mapping's connectorSource through the import runner, moved beside bulkWrite #21084 (8368f1c0). As drafted now, 17.6.0's text is consistent.
• The next refresh of chore: version packages #20639 picks up feat(service-automation,core,types): the connector sync executor pulls a mapping's connectorSource through the import runner, moved beside bulkWrite #21084. From then on, the version states both "nothing executes it" and "the executor reads it", unless this card has landed first.
• So the order is: this card lands before the next refresh of chore: version packages #20639, or chore: version packages #20639 merges at a head without feat(service-automation,core,types): the connector sync executor pulls a mapping's connectorSource through the import runner, moved beside bulkWrite #21084.

Routing. .changeset/** and packages/spec/** are domain:spec.

Direction. It is the card's own scope, confirmed, as one PR:

1. a deliberate correction of the stage-① pending note, with the designed Check Changeset red, as in PR docs(changeset): correct two scope sentences in the pending service-analytics masked-field note #20991 and PR docs(changeset): scope two pending service-analytics BREAKING banners to the SQL echo on either strategy, and anchor the nested-relation note to its measured base #21012;
2. the "provenance, not identity" ledger sentence in a spec note;
3. the two @objectstack/service-automation provenance rows. Add a pin if the provenance gate stays blind to the refuse(...) call-site form.

---

Generated by Claude Code

[objectstack-fleet]

Claim: PM loop round 1 (p1, release text: lands before the next Version Packages refresh) · 2026-10-01T07:36Z
Session: session_017VaLJnYwhPsanVCe9dMCJU
Account: os-bill (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-21106-connector-sync-notes-ledger
Worktree: objectstack-issue-21106
Domain: domain:spec
Seat: domain:spec#2 (seat post #18549)
File surface:

• .changeset/20281-connector-sync-moved-to-mapping.md: a deliberate correction of the stage-① pending note, one sentence. The designed Check Changeset red follows the precedent of PR docs(changeset): correct two scope sentences in the pending service-analytics masked-field note #20991 and PR docs(changeset): scope two pending service-analytics BREAKING banners to the SQL echo on either strategy, and anchor the nested-relation note to its measured base #21012.
• One new .changeset/21106-*.md spec note: the "provenance, not identity" error-code-ledger sentence, as in lint: four recordsOf(stack.packages) readers treat a non-array packages as "no packages" instead of refusing it — the packages/lint half of #19925 (ruling #15293-A) #20206 and [finding] plugin-security 四处错误码发射点未登记 ledger,且免登记的理由注释经实测为假(NOT_OVERRIDABLE 不在 StandardErrorCode、在 ledger 里) #19441.
• packages/spec/src/api/error-code-ledger.zod.ts: the two @objectstack/service-automation provenance rows, MAPPING_NOT_FOUND and UNSUPPORTED_TRANSFORM.
• A pin in the provenance gate's own test only if its patterns cannot be widened to the refuse(...) call-site form inside its declared blind spot.

⛔ No other pending note and no code in service-automation. ⛔ Never Version Packages #20639: merging it is the maintainer's. Stop on breach and explain in the report.
Container & model: S, mode:subagent, model: opus (dispatch-gates --tier: no path-derived mandate; release text plus a ledger, judged against PR #21084's merge 8368f1c0). The at-tier contract review is owed (changeset prose and packages/spec/src/**).
Clause-②: no (notes and provenance rows; the ErrorCode union and every accept set are unchanged)
Thread-read: 5926594302
Serial constraints cleared: read at this stamp against origin/main 9c8b65aa23. No open PR touches error-code-ledger.zod.ts or the provenance gate. Of the open PRs, only Version Packages #20639 (at d01c3cd82d) touches 20281-connector-sync-moved-to-mapping.md, by consuming it. No fleet pm:dispatched claim names these files. Order: this seat is at batch 3 with the p0 #21063 running over it, so this p1 is dispatched at the next free slot, ahead of every other candidate. ⚠️ For the maintainer: the next refresh of #20639 carries PR #21084, so merging #20639 before this card lands would ship both connector-sync sentences.

---

Generated by Claude Code

[objectstack-fleet]

Dispatch note · domain:spec seat 2 (session_017VaLJnYwhPsanVCe9dMCJU) · 2026-10-01T08:05Z: the dev is dispatched now, not "at the next free slot" as claim 5926939917 said, on the maintainer's word in this seat's chat, verbatim: 「21106 可以增加并发派」. This card runs over batch 3 alongside the p0 #21063. The verify-lock depth read 1 (queue empty) at dispatch, and origin/main was 99398542b3. Version Packages #20639 still read d01c3cd82d, without PR #21084.

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report
{
"issue": 21106,
"status": "done",
"branch": "claude/issue-21106-connector-sync-notes-ledger",
"pr": "#21150",
"session": "session_017VaLJnYwhPsanVCe9dMCJU (subagent; the parent seat session, per the dispatch)",
"premise_still_valid": true,
"summary": "Draft PR #21150 (head 5748c8d, base 9939854 merged with origin/main 39ab294) lands all three items. (1) The stage-① note .changeset/20281-connector-sync-moved-to-mapping.md is corrected in place as a DELIBERATE CORRECTION: the label 'Added (declared, not yet executed):' becomes 'Added:', and 'Nothing executes it in this release, and os validate / os build warn when it is authored.' becomes 'The connector sync executor, @objectstack/service-automation's pullConnectorSource (#20919), reads it; nothing schedules a pull until the job stage lands.' The review's suggested warn clause is dropped because it is false at 8368f1c: the live + authorWarn ledger row makes lintLivenessProperties throw instead of warn (measured). (2) The new .changeset/21106-error-code-ledger-provenance-rows.md (@objectstack/spec minor, Clause-②: yes; see deviations) carries the provenance-not-identity sentence for the #20919 move, measured as types +3 (new key), core +5, rest −7 (not −8: rest kept UNSUPPORTED_TRANSFORM), union 280 unchanged, plus this PR's two rows. (3) MAPPING_NOT_FOUND and UNSUPPORTED_TRANSFORM are added under @objectstack/service-automation in its ASCII order. The gate's own header makes widening its patterns a card of its own, so check:error-code-provenance is not widened; a hand pin in check-error-code-provenance.test.ts pins the two rows and the refuse(...) blind spot itself, and both ablation legs went red. Check Changeset is red by design (check-empty-changeset DELIBERATE CORRECTION; precedents PR #20991 and PR #21012); no skip-changeset.",
"tests": "All on head 5748c8d unless stated. (a) pnpm --filter @objectstack/spec build: 'os-verify-lock: VERDICT command-exit 0', rebuilt after the merge through turbo --filter='@objectstack/lint...' (4 tasks successful). (b) pnpm --filter @objectstack/spec check:generated: exit 0, 'All 15 generated artifacts are up to date'. (c) vitest run --project local --maxWorkers=2 src/api scripts/check-error-code-provenance.test.ts: 'Test Files 47 passed (47) / Tests 1546 passed (1546)'. The 12 other spec test files that read the ledger: 'Test Files 12 passed (12) / Tests 182 passed (182)'. The full spec local project (638 files) was narrowed out: CI's Test Core runs it. (d) pnpm --filter @objectstack/spec typecheck: VERDICT command-exit 0; check:test-typecheck 'OK … 52 file(s) / 246 error(s) / 135 pinned signature(s) held'. (e) Ablation of the hand pin, via scripts/ablation-replace.mjs in WRAP mode under the lock, from the committed state c227eb3. Leg 1 removed the MAPPING_NOT_FOUND row: 'Tests 1 failed | 16 passed (17)', "expected [ …(9) ] to include 'MAPPING_NOT_FOUND'". Leg 2 removed the UNSUPPORTED_TRANSFORM row: 'Tests 1 failed | 16 passed (17)'. Each leg: 'ok restored: blob == HEAD (229345964e13) and git diff HEAD is empty'. Leg 1's first attempt was a refused no-op (the replacement text pre-existed; 'the replacement count moved 1 -> 1') and is not counted; it was re-run with a unique marker. No dist was involved: the test imports the ledger from ../src relatively. (f) The liveness-lint reading behind the dropped clause, through tsx against built spec, at 9939854 and again at 5748c8d; the lint and ledger files have no diff from 8368f1c. runAuthoringRules('validate', …) with mappings[].connectorSource 'THREW lintLivenessProperties: ledger entry has unrecognised status "live"'. runRuntimeAuthoringRules({type:'mapping'}) gave one advisory, rule 'authoring-rule-threw'. Control without connectorSource: 0 findings at both. The os validate CLI process itself was NOT MEASURED: its ~50-package closure was not built.",
"mcp_calls": "0",
"api_writes": "2 REST writes, both through the fleet-write relay (POST /repos/objectstack-ai/objectstack/dispatches): (1) op pr_create → POST /repos/objectstack-ai/objectstack/pulls (draft), run 36846897639 success, PR #21150, read-back 'identical'; (2) op comment → POST /repos//issues/21106/comments, this report. Not written: the PR assignee (see deviations). Not REST: four git pushes of the branch (empty probe, two commits, one merge).",
"open_questions": [
{
"question": "Clause-② on the new spec note: the claim and the dispatch said patch + 'Clause-②: no'; this PR ships minor + 'Clause-②: yes'. Keep it?",
"options": [
"A. Keep minor + yes. The two rows widen ERROR_CODE_LEDGER['@objectstack/service-automation'], a published as-const face the ledger header (#16404 ruling) names as the error-code contract face. Both precedents the card names (#20206 at 5f9d7d7, #19441 at 3f9e2ea) declared a provenance-row addition spec minor + 'Clause-②: yes' ('What widens is the per-package face'). Released version unchanged: one fixed group, and spec already has a pending minor.",
"B. Revert to patch + no, as the claim wrote. Same released version, but it contradicts both precedents and the ledger header's own rule; the seat would edit the note's two lines and the PR body's line 2."
],
"recommendation": "A, because the dispatch said not to keep no silently when the diff widens a public surface, and the repository's own precedent and ledger rule read this as a widening. No accept set changes either way."
}
],
"out_of_scope_findings": [
"class: a · reach: the rule registry os validate / os build call (runAuthoringRules('validate', …), packages/cli/src/commands/validate.ts:522, no catch on that path) THREW on a stack whose mapping authors connectorSource, measured through lint's source at 9939854 and 5748c8d (lint files unchanged since 8368f1c). The runtime metadata-write door answered rule 'authoring-rule-threw' instead of the liveness warning. The CLI process end to end is NOT MEASURED (closure not built), and there is no real producer in examples/ · evidence: packages/spec/liveness/mapping.json connectorSource is status 'live' + authorWarn true since #21084. lintLivenessProperties' describe() has no 'live' branch and throws its sentinel (its header calls live + authorWarn 'a ledger authoring mistake'; lint-liveness-properties.test.ts asserts the throw). authoring-rules.ts (#20919 comment) and runtime-gate.inert-type-writes.test.ts both say an authored connectorSource 'is warned'. Fix options for its own card: a describe() branch for a live row with a caveat, or a different ledger row · dedupe words: liveness authorWarn live status describe throws · connectorSource os validate unrecognised status live · lintLivenessProperties sentinel live row · authoring-rule-threw mapping",
"class: a · reach: named real producer, turbo 2.11.5 (bumped by 840ec9d, the development-dependencies group, on main). It ran via pnpm exec turbo run build --filter='@objectstack/lint...' and via pnpm check:type-check-debt in this worktree, and each run left M AGENTS.md (+11 lines). Measured twice and restored both times (blob e9e211fc = HEAD), never committed · evidence: turbo appends a managed 'turborepo-agent-rules' block, which contains an HTML-comment marker pair, to AGENTS.md (a Tier H governed surface) on each invocation it attributes to an AI agent. turbo.json declares no agentGuidance:false. Any parallel dev that commits with -a or git add -A carries a governed-surface edit into its PR (one path makes the whole PR Tier H) · dedupe words: turbo agentGuidance AGENTS.md block · turborepo-agent-rules managed block · turbo 2.11 writes AGENTS.md",
"carrier: none (承接者:无) · noted in PR #21150 Acceptance notes, not filed: the stage-① note's 'Runtime behaviour is deliberately unchanged: no connector sync ever ran.' and 'It carries no cadence (a job sets that)' were read and kept (true of the retired connector-attached keys / by design)."
],
"gates": "dispatch-gates --commands --repo objectstack-ai/objectstack at 5748c8d (exit 0) derived 87 commands from 4 paths; all run on that head, exit codes captured before any pipe. 84 exit 0, including: pnpm --filter @objectstack/spec run check:error-code-provenance ('scanned 2636 files; 335 registered-code stamp site(s): 316 listed, 19 waived' / 'OK'); node scripts/check-adr-0087-registration.mjs --base origin/main ('this PR adds no declared-breaking changeset (2 non-breaking changeset(s) seen)'); node scripts/check-changeset-no-major.mjs --base origin/main ('This diff introduces no major bump'); check:api-surface, check:authorable-surface, check:docs, check:liveness, check:error-code-casing, check:dispatcher-error-vocabulary, check:cross-package-test-inputs, check:nul-bytes; check:query-options-erasure (exit 0 in 315s; the first run hit the runner's 280s timeout); check:type-check-debt (exit 0, '1 ledger entr(ies) re-measured … none above its recorded number'; the first run hit the 280s timeout). 1 exit 1 by design: node scripts/check-empty-changeset.mjs --base origin/main, DELIBERATE CORRECTION on .changeset/20281-connector-sync-moved-to-mapping.md. NOT MEASURED: check:dual-build-cjs-loads, reason: PREREQUISITE NOT MET, it needs a full pnpm build. NOT MEASURED: check:lean-entry-closure, reason: PREREQUISITE NOT MET, it needs @objectstack/objectql built. Reconciliation: dispatch-gates.mjs --ran exit 0, '87 derived famil(ies) accounted for — 85 run, 2 NOT-MEASURED (2 DERIVED from a recorded exit 3)'. Pre-merge run at c227eb3: the same 87, same verdicts. CI on 5748c8d at 2026-10-01T10:06Z: in_progress (32 check-runs: 22 in_progress, 7 success, 3 skipped, 0 failure; Check Changeset in_progress, expected red by design).",
"line_budget": "none owed: no skills/** in the diff",
"deviations": [
"Clause-② / bump: the new note is @objectstack/spec minor + 'Clause-②: yes', and the PR body's line 2 reads 'Clause-②: yes', not the claim's 'no'. Evidence and options are in open_questions.",
"The review's suggested correction text kept 'os validate / os build warn when it is authored'. This PR drops it: measured false at 8368f1c (see tests (f) and the first finding).",
"The card and review counted @objectstack/rest −8; measured −7 at 8368f1c vs 2742e53 (rest kept UNSUPPORTED_TRANSFORM). The note says seven.",
"PR assignee NOT set. Command node scripts/pm/label-write.mjs --repo objectstack-ai/objectstack --issue 21150 --assign os-bill was denied by the Claude Code auto-mode classifier ('[External System Writes]') before any request. Not retried by another route; the seat sets assignee os-bill on #21150.",
"Merged origin/main 39ab294 into the branch before opening the PR (merge commit 5748c8d; clean, delta vs main = exactly the 4 files), then re-ran build, check:generated, the spec tests, typecheck and the whole 87-command union on that head.",
"AGENTS.md was rewritten twice by turbo 2.11.5 during verification. Both times it was restored with git checkout HEAD -- AGENTS.md (hash = HEAD) and never staged (second finding).",
"Ablation leg 1's first attempt was refused by ablation-replace (its replacement text already existed) before any test ran; it was re-run with a unique marker. Reported, not counted."
],
"files_changed": [
".changeset/20281-connector-sync-moved-to-mapping.md (+4/−3, the deliberate correction)",
".changeset/21106-error-code-ledger-provenance-rows.md (new, @objectstack/spec minor, Clause-②: yes)",
"packages/spec/src/api/error-code-ledger.zod.ts (+14: two @objectstack/service-automation rows + their comment)",
"packages/spec/scripts/check-error-code-provenance.test.ts (+39/−1: the hand pin and the blind-spot pin)"
],
"cleanup": "Worktree /home/user/objectstack-issue-21106: git status clean at 5748c8d (= origin branch). node_modules is removed and the worktree is removed with git worktree remove (no --force) right after this comment is posted. Background processes started: none."
}

---

Generated by Claude Code

[objectstack-fleet]

Claim: PM loop round 1 (amendment of claim 5926939917, same session and branch) · 2026-10-01T10:24Z
Session: session_017VaLJnYwhPsanVCe9dMCJU
Account: os-bill (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-21106-connector-sync-notes-ledger
Worktree: objectstack-issue-21106 (removed by the dev after the PR opened; the branch is the identity)
Domain: domain:spec
Seat: domain:spec#2 (seat post #18549)
File surface: as claim 5926939917, unchanged. PR #21150 carries the stage-① note correction, the new spec note, the two @objectstack/service-automation ledger rows, and a hand pin in check-error-code-provenance.test.ts; the gate's own header keeps widening its patterns a card of its own.
Container & model: S, mode:subagent, model: opus (unchanged).
Clause-②: yes (widening)
Thread-read: 5929227465
Correction: claim 5926939917 declared Clause-②: no and a patch note. The two rows widen ERROR_CODE_LEDGER['@objectstack/service-automation'], a published as-const face that the ledger header's #16404 ruling names a Clause-② face. Both precedents the card names (#20206, #19441) declared minor + Clause-②: yes. The at-tier record 5929446191 confirms it: yes, widening of the per-package face. No accept set moves: the ErrorCode union is 280 before and after. The note is @objectstack/spec minor, so the released version is unchanged (one fixed group, and a pending minor already exists).

---

Generated by Claude Code