docs(changeset): make the two pending connectionTimeoutMs notes true when read as one release

[objectstack-fleet]

Fixes #19851

Clause-②: no

What this changes

Changeset text only: two PENDING notes on origin/main, .changeset/18975-connector-retry-config-and-request-timeout.md and .changeset/19580-retire-connector-connection-timeout-ms.md, +47 / -29. No code, no other file, and no frontmatter line: packages and levels are byte-identical to the merge base.

Both notes go into the same next release. The last tag is @objectstack/*@17.4.0. On npm, latest for @objectstack/spec, connector-rest, connector-openapi, connector-mcp, connector-slack and service-automation is 17.4.0, published 2026-09-09, with no version after it. Read together as that one release, the base text said that ConnectorProviderContext gains connectionTimeoutMs, and also that the same member, called "a published interface member", is removed. It also misstated what the residue stage does with the default value, and it anchored its read census to a moving ref. After this PR, every sentence the two notes publish is true of what that release ships.

DELIBERATE CORRECTION: this PR awaits the maintainer's written confirmation, and Check Changeset is red on purpose

This PR adds no changeset of its own. It changes two pending changesets it did not add. Route 0's discriminator against the merge base:

$ git diff --name-status 8490127962 HEAD -- '.changeset/*.md'
M	.changeset/18975-connector-retry-config-and-request-timeout.md
M	.changeset/19580-retire-connector-connection-timeout-ms.md

Every row is M and none is A, so this is the DELIBERATE CORRECTION class that scripts/check-empty-changeset.mjs names. It is not a COLLISION: nothing of this PR's own was overwritten, and restoring the base copies would republish the false sentences.

• ⛔ No skip-changeset label, and ⛔ no new changeset file (ruling D on [finding] the skip-changeset label suppresses the DELIBERATE-CORRECTION refusal whose own text says 「no label and no diff shape makes that safe」 — declared contract against enforced behaviour #18375).
• Check Changeset stays advisory red. It is not one of the seven required contexts. Every other check should be green.
• This PR awaits the maintainer's one-sentence confirmation of the correction. The owning seat carries it to this PR with its provenance (who, the words, where). The PR is not to be armed before that confirmation is on it.

Measurements (taken before editing a word)

The worktree was cut at merge base 8490127962. The checkout is a full clone (git rev-parse --is-shallow-repository answers false).

M1: the three members entered after 17.4.0, and no release carried them

Question	Instrument	Reading
When did each member enter and leave?	git log -G 'connectionTimeoutMs\?:' origin/main on connector-provider.ts, rest-connector.ts and openapi-connector.ts	For all three files, it entered with b929e0a662 (2026-09-20, #19388) and left with fc29c74400 (2026-09-23, #19657).
Is b929e0a662 in any release?	git tag --contains b929e0a662	0 tags.
Same question, by ancestry	git merge-base --is-ancestor b929e0a662 '@objectstack/spec@17.4.0'	exit 1. The control leg is @objectstack/spec@17.3.0 (8a1bad8b8e), in the same checkout, against the same target, an older commit: exit 0.
Is 17.4.0 the newest release?	git ls-remote --tags origin 'refs/tags/@objectstack/spec@*' and npm view @objectstack/spec dist-tags time	The newest tag is 17.4.0, which peels to 7e6337007f. The connector-rest, connector-openapi and service-automation 17.4.0 tags point at the same commit. npm has latest 17.4.0 and rc 17.0.0-rc.6, and nothing was published after 2026-09-09T03:57Z.
What did 17.4.0 ship?	npm install @objectstack/spec@17.4.0, then read dist/integration/index.d.ts	interface ConnectorProviderContext has name, label, description, icon, type, providerConfig, auth and loadPackageFile. It has no connectionTimeoutMs, and no retryConfig or requestTimeoutMs either.
same	npm pack @objectstack/connector-rest@17.4.0 and @objectstack/connector-openapi@17.4.0, then read every .d.ts	interface RestConnectorOptions and interface OpenApiConnectorConfig are present (the control), with 0 connectionTimeoutMs occurrences in any .d.ts.
What does the next release ship?	packages/spec/src/integration/connector-provider.ts:67 at the merge base	ConnectorProviderContext declares retryConfig and requestTimeoutMs. connectionTimeoutMs appears only in a "REMOVED" comment. rest-connector.ts:42 and openapi-connector.ts:130 have comments only.

The authorable key was published. In the 17.4.0 source, connector.zod.ts:839 reads connectionTimeoutMs: z.number().min(1000).max(300000).optional().default(30000), and DeclarativeConnectorEntrySchema (:955) is built on ConnectorSchema. The M2 probe of the released 17.4.0 package shows ConnectorSchema accepting and keeping an authored 15000. So "a published authorable key is removed on two carriers" stays true, and it is now the only thing the Clause-② sentence rests on.

M2: parse probes, with the path each refusal is reported at

For today's tree, tsx ran against packages/spec/src at the merge base, for four carriers. The entry is { name: 'ledger_api', label: 'Ledger API', type: 'api' } plus the key:

connectionTimeoutMs	ConnectorSchema	DeclarativeConnectorEntrySchema	getMetadataTypeSchema('connector')	ObjectStackSchema (connectors: [entry])
absent (control)	accept, key absent	accept, key absent	accept, key absent	accept, key absent
30000	accept, key stripped	accept, key stripped	accept, key stripped	accept, key stripped
15000	refuse invalid_type @ connectionTimeoutMs	same	same	refuse invalid_type @ connectors.0.connectionTimeoutMs
1000	same as 15000	same	same	same
"30000" (string)	same as 15000	same	same	same

Every refusal message names requestTimeoutMs. In every accepted case requestTimeoutMs still reads 30000, the control that shows the stage leaves the live sibling alone. ConnectorSchema is a pipe whose input stage is a transform. The tombstone without the stage is the pipe's inner object. It refuses 30000 at connectionTimeoutMs, and it accepts the same entry with the key absent (the control).

Released side: @objectstack/spec@17.4.0 from npm emits connectionTimeoutMs: 30000 for that entry on ConnectorSchema, on DeclarativeConnectorEntrySchema and on ObjectStackSchema, and it accepts and keeps an authored 15000. npm pack of connector-mcp, connector-openapi, connector-rest and connector-slack at 17.4.0 each ship one literal connectionTimeoutMs: 3e4 in their JS.

M3: which sites READ the key (one number: six)

The instrument is git grep -n connectionTimeoutMs SHA -- . ':!packages/spec', keeping non-test code files. It was run at e07843b5a6, the parent of the landing commit fc29c74400, and gives an identical result at 6eaa0f4a81, the review's merge base. The result is 13 occurrences, 7 files, 5 packages:

• 6 reads: openapi-connector.ts:242, openapi-provider.ts:193, rest-connector.ts:134, rest-provider.ts:64, plugin.ts:307, plugin.ts:1589
• 4 type declarations: openapi-connector.ts:135, rest-connector.ts:47, plugin.ts:291, plugin.ts:339
• 3 literal 30000 writes: mcp-connector.ts:247, slack-connector.ts:94, plugin.ts:1782

Six read expressions sit at six file:line locations. The "five sites" phrasing elsewhere counts the two ?? 30000 fallbacks as one site: it is the same set in a different unit (see the acceptance notes). Within the changesets, the one count used is six reads, and the tree it was taken on is now named. 0870fb5418, which the note cites for the earlier census, re-measures at exactly five hits, all connectionTimeoutMs: 30000,, as the note says.

Old and new, per file

.changeset/18975-connector-retry-config-and-request-timeout.md

(a) This release does not add a member that the same release removes (M1).

old: ConnectorProviderContext gains retryConfig, connectionTimeoutMs and requestTimeoutMs, read-only and resolved from the entry …

new: ConnectorProviderContext gains retryConfig and requestTimeoutMs, read-only and resolved from the entry …

(b) The key is no longer described as "carried onto ConnectorProviderContext" and "owed a decision". The same release retires it, and no release carries it on the context (M1). The mapping and the ledger still record the reason: connector-fetch-policy.ts:57 and liveness/connector.json props.connectionTimeoutMs.status: dead, both at the merge base.

old: ⚠️ connectionTimeoutMs is NOT enforced, deliberately, … … So it is carried onto ConnectorProviderContext (a custom provider on a transport that can separate the phases may honour it) and left unenforced by the platform, with the reason recorded at the mapping and in packages/spec/liveness/connector.json, which keeps that one row dead. It is owed a second, narrower ADR-0049 decision: retire it, or re-describe it as something the platform can enforce.

new: ⚠️ connectionTimeoutMs is NOT made live, deliberately, … … So this change leaves it unenforced, with the reason recorded at the mapping and in packages/spec/liveness/connector.json, whose row for it stays dead. That left it owed a second, narrower ADR-0049 decision, and this same release takes it: connector.connectionTimeoutMs is retired, and its own entry in this release says what to write instead. The key never reaches ConnectorProviderContext in any release.

(c) The claim that the schema "keeps every key" is scoped to the change it describes. Read as a claim about the release, it is false twice. connectionTimeoutMs is retired by fc29c74400. syncConfig.schedule is deleted by 929d9e3f20: present at 17.4.0, absent at the merge base, and git merge-base --is-ancestor 929d9e3f20 '@objectstack/spec@17.4.0' gives exit 1. As a claim about b929e0a662 itself it holds: that commit changes 0 non-comment lines of connector.zod.ts, the file that also holds RetryConfigSchema.

old: Nine of the ten ledger rows flip dead → live with the consumer site named. No declaration moves: the connector schema keeps every key, every bound and every default it had.

new: Nine of the ten ledger rows flip dead → live with the consumer site named; the tenth is connectionTimeoutMs, above. This change itself moves no declaration: it leaves every key, every bound and every default on the connector schema as it found them.

.changeset/19580-retire-connector-connection-timeout-ms.md

(d) The never-released member is no longer called published. The Clause-② sentence now rests on the authorable key alone (M1). The line's leading token is unchanged, and readClause2Line reads it identically at base and head.

old: Clause-②: yes (narrowing) — a published authorable key is removed on two carriers and a published interface member leaves ConnectorProviderContext, so the accept set a consumer writes against narrows.

new: Clause-②: yes (narrowing) — a published authorable key is removed on two carriers, so the accept set a consumer writes against narrows.

(e) The migration no longer tells a released-version factory to stop reading something it never had (M1). One paragraph says which members were never released and who could have read them.

old: The one-line fix: delete the key — and, for a custom provider factory, stop reading ctx.connectionTimeoutMs.

new: The one-line fix: delete the key. … The three interface members withdrawn with it were never in a release: ConnectorProviderContext.connectionTimeoutMs, RestConnectorOptions.connectionTimeoutMs and OpenApiConnectorConfig.connectionTimeoutMs all entered with b929e0a662, after the @objectstack/*@17.4.0 tag, and leave in this same release. A factory or caller built against a released version never saw them; only code written against an unreleased main in between can read them, and it stops.

Two sentences follow from the same reading. The FROM → TO row for ConnectorProviderContext.connectionTimeoutMs gains "added after @objectstack/spec@17.4.0 and never in a release, see below". The D3 bullet now says the removal reaches "a factory author who read it — possible only against an unreleased main —" rather than any factory author.

(f) The residue stage is stated as measured (M2).

old: … measured across two builds: the base build emits it for an entry that authored only name/label/type, and the tombstoned build refuses that exact object at connectors.0.connectionTimeoutMs.

new: … measured on both sides of the retirement: the released @objectstack/spec@17.4.0 emits connectionTimeoutMs: 30000 for an entry that authored only name/label/type, and the tombstone without the stage refuses that exact object at connectionTimeoutMs. With the stage, as it ships, that object is accepted and the key stripped before the tombstone reads it — on ConnectorSchema, DeclarativeConnectorEntrySchema, the /meta/connector schema and stack.connectors[] alike.

old: … and all four shipped connector packages put the materialized value straight into that def literal. So the emitted 30000 is accepted-and-stripped while 15000 keeps the tombstone's refusal, …

new: … and in 17.4.0 all four shipped connector packages put that 30000 straight into the def literal. So the emitted 30000 is accepted-and-stripped, while every other value (15000, 1000, the string "30000") keeps the tombstone's refusal — at connectionTimeoutMs, or at connectors.0.connectionTimeoutMs inside a stack — …

The tombstone bullet's "stack.connectors[] and the /meta/connector door refuse it too" gains "every value but the retired default 30000, which the residue stage below strips first". Without that clause, the bullet contradicted the residue bullet.

(g) The read census names its tree (M3).

old: Measured with git grep -n connectionTimeoutMs SHA -- . ':!packages/spec' at origin/main: thirteen …

new: Measured with git grep -n connectionTimeoutMs SHA -- . ':!packages/spec' at e07843b5a6, the tree this retirement landed on: thirteen …

What deliberately did not change

• Frontmatter, both files. No level is wrong after the correction:
  • 18975's minors cover real widenings: ConnectorProviderContext gains retryConfig and requestTimeoutMs, and the provider options and resilientFetch gain knobs.
  • 19580 stays @objectstack/spec: minor with the BREAKING banner, because the launch window refuses major.
  • 19580's patch for the connector and service packages is now better supported: the correction states outright that the option fields those packages withdraw were never released.
• The ADR-0087 marker and the remaining sentences. The marker line is unchanged, and so is every sentence not quoted above.
• What the changeset gates read. Base and head get the same reading from check-adr-0087-registration and readClause2Line:
  • 19580: breaking true ["BREAKING","bang"], disposition registered with the same two ids, migration prescription found.
  • 18975: non-breaking, no migration prescription, Clause-②: yes (widening) declared.
  • An intermediate wording (654adaba14) mentioned the retirement entry's migration table by its house label. The detector's label branch read that as a migration prescription on 18975. It was reworded in baf93b20fd, and the parity above was re-measured on f4fbb2203e.

Local gates, on f4fbb2203e

The gate list is derived by node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands: 19 commands. Reconciled with --ran and exit codes recorded: 19 derived, 19 run, 0 NOT-MEASURED, 0 UNRUN. Every exit code was captured before any pipe.

Command	Exit
node scripts/check-empty-changeset.mjs --base origin/main	1, as intended: ✓ No empty-frontmatter changeset introduced, then "This PR changes a changeset it did not add" naming both files, with the DELIBERATE CORRECTION remedy
node scripts/check-adr-0087-registration.mjs --base origin/main	0 (✓ … this PR adds no declared-breaking changeset (2 non-breaking changeset(s) seen))
node scripts/check-changeset-no-major.mjs --base origin/main	0 (✓ This diff introduces no major bump.; the LEVEL axis is not applicable without a pull_request payload)
node scripts/check-changeset-fixed.mjs (not derived, run as a check-changeset* gate)	0 (✓ … "fixed" group is in sync with 70 public workspace packages.)
pnpm check:changeset-gate-self-tests	0 (159, 441 and 339 assertions)
pnpm check:nul-bytes	0 (OK … no raw ASCII control bytes)
the --self-test of check-adr-0087-registration, check-changeset-no-major and check-empty-changeset, plus check-closing-keyword-parity (both), check-comment-mask-corpus, pm/release-rehearsal-clone --self-test, check:driver-memory-census, check:gitlink-declared, check:objectui-changeset, check:pm-changeset-deadline-census, check:published-files, check:refd-timer-probe, check:watch-hint-literal	0 each

NOT MEASURED: the four type-check programs the derivation lists outside the derived total, which are CI's whole-workspace lanes. Reason: the diff touches no TypeScript, and no workspace build was bought for a text-only diff. Also scanned for control bytes (none, with a lit positive control) and for model identifiers in the diff (0 hits).

Acceptance notes

• "five sites … READ" is still the wording in four code docblocks. packages/spec/src/integration/connector.zod.ts:565, packages/spec/src/conversions/registry.ts:9078, packages/spec/src/integration/connector-connection-timeout-retirement.test.ts:15 and packages/spec/src/migrations/registry.ts:5255 say that. The retired-key entry (18.integration__Connector__connectionTimeoutMs.ts:14, migrations/registry.ts:14678), the liveness row and the 19580 changeset say "six reads". It is the same set, with the two ?? 30000 fallbacks counted as one site or two. Not touched here, because this PR is changeset text only. Carrier: none.
• The retired-key entry and the liveness _note still anchor the read census "at origin/main" without a sha. This is the moving-ref reading corrected in the changeset by (g). Code and data, not changeset text, so not touched here. Carrier: none.
• The 19580 note's Clause-② sentence reads as near-miss (reason describing) in readClause2Line. That is so at base and at head, because the token sits in backticks with prose after it. check-adr-0087-registration therefore classifies the note as breaking through the banner and the !, not through signal (4). It is left as it was: changing the line would change what the gate reads, which is outside a correction of false sentences.

---

Generated by Claude Code

[objectstack-fleet]

Maintainer confirmation — the DELIBERATE CORRECTION of the two pending changesets, 2026-09-24T15:16Z

domain:spec seat 4 (session_019c3Hi6ZMU1p6m6aA6Bz45d) carries the maintainer's sentences to the PR. This seat has held card #19851 since takeover 5816722457.

Provenance.

• Who: the maintainer.
• Words, verbatim, in this order:
  • 「同意 docs(changeset): make the two pending connectionTimeoutMs notes true when read as one release #19918 更正两条 changeset」
  • 「changeset 你看着更新就行」
• Where: the chat of session session_019c3Hi6ZMU1p6m6aA6Bz45d.

What the confirmation covers. The text corrections this PR makes to two pending notes:

• .changeset/18975-connector-retry-config-and-request-timeout.md;
• .changeset/19580-retire-connector-connection-timeout-ms.md.

The frontmatter of both is unchanged: packages and levels are byte-identical to the merge base. The second sentence hands the wording to this seat. If the at-tier review asks for a changed sentence, this seat corrects it in a patch round on this branch and does not come back for a new confirmation. The review record on the final head is the basis (execution-duties.md:175: an at-tier PASS on the same head, or the maintainer's words).

The red it answers. Recorded here as the red-by-design route requires:

• The gate is Check Changeset. Step 11, "Require a changeset (or the skip-changeset label)", fails with its own route-0 text: 「if its only .changeset rows are CHANGED, not added, this PR corrects somebody else's pending release note -- do NOT apply 'skip-changeset'; write the confirmation on the PR … and leave this check red ([finding] the skip-changeset label suppresses the DELIBERATE-CORRECTION refusal whose own text says 「no label and no diff shape makes that safe」 — declared contract against enforced behaviour #18375)」. This comment is that confirmation.
• The gate does not run in the merge group: .github/workflows/pr-automation.yml triggers on pull_request only, with 0 merge_group hits at origin/main. Check Changeset is not a required context of the queue, so the red stays advisory and blocks nothing.
• ⛔ No skip-changeset label (ruling D, [finding] the skip-changeset label suppresses the DELIBERATE-CORRECTION refusal whose own text says 「no label and no diff shape makes that safe」 — declared contract against enforced behaviour #18375).

Landing. Not armed yet, as the takeover comment says. First, an at-tier contract review of head f4fbb2203e must read PASS; it is running now. Then ready + auto-merge follows, provided the head is unchanged and every other check-run is success or skipped by design. If the review FAILs, a patch round comes first, then a fresh review of the new head.

---

Generated by Claude Code

[objectstack-fleet]

Contract review

Served-tier: 89/89 CONTRACT_REVIEW_TIER
Head-sha: f4fbb2203e32689e6110c1b5599dfae3ecd6197e

Isolated at-tier reviewer subagent, run by the domain:spec seat-4 session; every one of its 89 transcript turns served at the tier the constant names. It read the PR before the maintainer's confirmation 5816903363 was posted, so ③'s line saying the confirmation is not yet on the PR is now answered. Adopted by the seat 2026-09-24T15:40Z. The record below is the reviewer's, unedited except the two header lines.

Refs used: merge base 8490127962834a125239ae85d9e6a88c0386896c (git merge-base origin/main refs/review/pr-19918), origin/main at c8399867b891c158267430cce75588f51fb75258, PR ref refs/review/pr-19918 = head. Clone is shallow with root bbdecaa652 (2026-06-19), which predates the 17.4.0 tag commit 7e6337007f (2026-09-09), so every ancestry read below is complete.

① Derived judgments

Main drift since the merge base. git diff --stat 8490127962 origin/main -- .changeset/18975-… .changeset/19580-… is empty: main did not touch either note. Of the notes' subjects, main moved only packages/spec/src/stack.zod.ts (the connectors: field still reads z.array(DeclarativeConnectorEntrySchema) at stack.zod.ts:712 on main), service-automation/src/engine.ts (a comment block; registerConnector still parses ConnectorSchema at engine.ts:3694 and :3773), and packages/spec/src/shared/lazy-schema.ts (JSON-Schema metadata aliasing, #19101; parse/.shape behaviour untouched). packages/spec/src/integration/, packages/connectors/, and packages/spec/liveness/connector.json are byte-identical between the merge base and main. Every sentence below is therefore judged on origin/main today.

M1, the three members were never in a tagged release. git log -G 'connectionTimeoutMs\?:' origin/main -- FILE on packages/spec/src/integration/connector-provider.ts, packages/connectors/connector-rest/src/rest-connector.ts, packages/connectors/connector-openapi/src/openapi-connector.ts returns exactly two commits each: b929e0a662 (2026-09-20, #19388) and fc29c74400 (2026-09-23, #19657). git tag --contains b929e0a662 is empty. git merge-base --is-ancestor b929e0a662 '@objectstack/spec@17.4.0' exit 1; the reverse --is-ancestor '@objectstack/spec@17.4.0' b929e0a662 exit 0; control 17.3.0 ancestor of 17.4.0 exit 0. Newest spec tag is @objectstack/spec@17.4.0 (git tag -l '@objectstack/spec@*' | sort -V | tail -1); no 17.5*/18* tag on any package; the five connector-rest/openapi/mcp/slack and service-automation 17.4.0 tags all peel to 7e6337007f. At the tag, connector-provider.ts has 0 connectionTimeoutMs hits, and rest-connector.ts:113 / openapi-connector.ts:220 carry only the literal connectionTimeoutMs: 30000, def write, not an interface member. At b929e0a662 the members are declared at rest-connector.ts:47 (RestConnectorOptions), openapi-connector.ts:135 (OpenApiConnectorConfig), connector-provider.ts:96 (ConnectorProviderContext). At origin/main only REMOVED comments remain (connector-provider.ts:63,87,91, rest-connector.ts:42, openapi-connector.ts:130), and ConnectorProviderContext declares retryConfig (:86) and requestTimeoutMs (:104). So 18975:30-31 ("gains retryConfig and requestTimeoutMs"), 18975:69-70 ("never reaches ConnectorProviderContext in any release"), 19580:28, 19580:34-40, 19580:97-101 and 19580:146-148 are all true of the next release.

M2, the residue stage, judged from the implementation at origin/main (no probe run). packages/spec/src/shared/retired-key.ts:113-114 makes retiredKey() a z.never with the guidance as message; :189-218 acceptRetiredDefaultResidue strips a key only when body[key] === residue[key] (strict equality, :198-201) and then wraps in z.preprocess(strip, schema) (:208) with a read-through shape (:213-215). connector.zod.ts:992 puts connectionTimeoutMs: retiredKey(CONNECTION_TIMEOUT_MS_RETIRED) on the private ConnectorBaseSchema (:855); :651 sets the residue to connectionTimeoutMs: 30000; :1094-1095 ConnectorSchema and :1152-1161 DeclarativeConnectorEntrySchema both wrap that base with the stage; kernel/metadata-type-schemas.ts:254 maps connector to DeclarativeConnectorEntrySchema; stack.zod.ts:712 uses it for connectors[]. Hence on all four carriers the number 30000 is stripped before the tombstone sees it, while 15000, 1000 and the string "30000" fail === and reach z.never, refused at connectionTimeoutMs, or at connectors.0.connectionTimeoutMs inside a stack; the bare inner object (tombstone without the stage) refuses 30000. The prescription at connector.zod.ts:606-615 names requestTimeoutMs. Released side: connector.zod.ts:839 at the 17.4.0 tag reads connectionTimeoutMs: z.number().min(1000).max(300000).optional().default(30000), so a 17.4.0 parse emits 30000; and at the tag all four connector packages write the literal (mcp-connector.ts:247, openapi-connector.ts:220, rest-connector.ts:113, slack-connector.ts:94). 19580:84-85, 19580:115-124 and 19580:131-136 are true.

M3, the census. e07843b5a6 is fc29c74400^ (git rev-parse fc29c74400^ = e07843b5a63e6e8bddb8f0d1b1d94efe88ae8dc4). git grep -n connectionTimeoutMs e07843b5a6 -- . ':!packages/spec', non-test code files: 13 occurrences, 7 files, 5 packages; the six reads are exactly openapi-connector.ts:242, openapi-provider.ts:193, rest-connector.ts:134, rest-provider.ts:64, plugin.ts:307, plugin.ts:1589; four type declarations (openapi-connector.ts:135, rest-connector.ts:47, plugin.ts:291, plugin.ts:339); three literal writes (mcp-connector.ts:247, slack-connector.ts:94, plugin.ts:1782). Identical at 6eaa0f4a81. At 0870fb5418: exactly 5 hits, all connectionTimeoutMs: 30000,. At origin/main: 7 hits, all comments. 19580:50-56 and 19580:111-112 are true; the note uses one count, six reads (:53, :57), and "five" only for the dated 0870fb5418 reading (:111).

Ledger and the "ten rows". Walking props and children of packages/spec/liveness/connector.json at b929e0a662^ vs b929e0a662: exactly nine rows flip dead to live (retryConfig.strategy, .maxAttempts, .initialDelayMs, .maxDelayMs, .backoffMultiplier, .retryableStatusCodes, .retryOnNetworkError, .jitter, and requestTimeoutMs); connectionTimeoutMs stays dead. At origin/main the row is still present with status: dead (ledger unchanged since the merge base). 18975:65-67 and 18975:72-73 are true. git show b929e0a662 -- packages/spec/src/integration/connector.zod.ts changes 28+/21- lines, every one a comment line, so 18975:73-75 ("This change itself moves no declaration") is true as scoped.

Retirement kit at main. Both ADR-0087 ids resolve: conversions/registry.ts:9157 (connector-connection-timeout-ms-removed), migrations/registry.ts:6670 and migrations/entries/semantic/18.connector-provider-context-connection-timeout-ms-retired.ts:6. authorable-surface/integration.json:22 and :91 carry the two [RETIRED] rows; authorable-defaults/integration.json has 0 connectionTimeoutMs rows; retired-defs 0. plugin.ts:1580 parses RetryConfigSchema.safeParse(entry.retryConfig) and hands retryConfig/requestTimeoutMs to the context (:1604-1605), supporting 18975:32-33; connectorFetchOptions is exported (integration/index.ts:35 re-exports connector-fetch-policy.ts:97); resilient-fetch.ts declares all five knobs named at 18975:23-24.

Card coverage. Item 1 (18975 "gains … connectionTimeoutMs", "carried onto") fixed at 18975:30-31 and 59-70. Item 2(i) ("published interface member") fixed at 19580:146-148 with the new paragraph 34-40. Item 2(iii) ("refuses that exact object at connectors.0.connectionTimeoutMs") fixed at 19580:115-124 and 84-85. Item 2(ii) (five/six): within the two notes the count is one, six reads; the four code docblocks (e.g. connector.zod.ts:565 at main) are outside the card's file surface. Nothing the card requires is missing. The additional edits (b, c, e, g, the tombstone bullet clause) are each measured true above and stay inside the two notes.

Left as-is, imprecise but not false of what ships (non-blocking, both pre-existing and untouched by this PR): 19580:108 says the liveness row stays dead "with a REMOVED note", while the row note at fc29c74400 and at origin/main opens RETIRED (ADR-0049 … and contains no REMOVED token; 19580:113-114 says the row "carries both readings with their trees", while the row's second reading is anchored "At origin/main" rather than a sha (the PR's acceptance notes already flag that anchor, carrier none).

② Semver level

Frontmatter: extracting lines 1 through the closing --- at merge base, head and origin/main and diffing pairwise gives no output for either file; od -c of the head frontmatter shows the same bytes. Byte-identical, verified.

18975: '@objectstack/spec': minor, service-automation: minor, connector-rest: minor, connector-openapi: minor; Clause-②: yes (widening) at line 10 (readClause2Line from the origin/main script, run in scratch: declared / yes / widening, same at base and head); no **BREAKING, no !: summary, no major, no marker. Non-breaking; yes takes at least minor (AGENTS.md:1085), so minor is right for a release that adds retryConfig/requestTimeoutMs to ConnectorProviderContext and the option knobs.

19580: '@objectstack/spec': minor with **BREAKING** at line 12 and feat(spec)!: at line 10; exactly one ADR-0087 marker at line 150, spelled adr-0087: registered id, id inside an HTML comment, matching the gate regex at scripts/check-adr-0087-registration.mjs:1924 (adr-0087 colon, body up to the comment close); both ids resolve at main (above). Under the launch-window convention stated at scripts/check-changeset-no-major.mjs header ("we ship breaking changes as minor"), minor plus the BREAKING banner plus one registered marker is the correct shape. The patch levels on connector-rest/openapi/mcp/slack and service-automation are consistent with the corrected text: the option fields they withdraw were never released (M1), and at main those packages carry comments only. The 19580 Clause-② line is read by readClause2Line as near-miss / describing at base and head alike (backticked token with prose after it); breaking-ness is still read from the banner and the bang, so no gate reading changes. Pre-existing, non-blocking.

③ Boundary flags

• Files: git diff --name-status 8490127962 refs/review/pr-19918 = M .changeset/18975-connector-retry-config-and-request-timeout.md, M .changeset/19580-retire-connector-connection-timeout-ms.md; pulls/19918/files lists the same two, +12/-11 and +35/-18 (= +47/-29). No file outside the claim.
• Route 0: no A row, no added changeset; PR labels are documentation, size/s, tooling, no skip-changeset. pr-automation.yml:714-748 at main names this class and says LEAVE THIS CHECK RED; check-empty-changeset.mjs:563 (main) carries the DELIBERATE CORRECTION remedy. Check Changeset is failure on the head by design.
• Required contexts: rules/branches/main lists 7 required checks (TypeScript Type Check, Test Core, Dogfood Regression Gate, Build Core, Temporal Conformance, Lint & Repo Gates, Governed Surface Queue Guard); Check Changeset is not among them. On the head, 26 check-runs: the 7 required are success or skipped (Build Core, Temporal Conformance skipped by path filter on a text-only diff); the four Type Check · lanes are success.
• Merge from main: git merge-tree --write-tree origin/main refs/review/pr-19918 exit 0, tree 979b2126…, no conflict output. Lands cleanly on today's main without a merge commit.
• State: draft, 0 issue comments, 0 review comments, 0 reviews. The maintainer's one-sentence confirmation of the correction is not yet on the PR; per the card's claim 5816722457 and route 0 the PR is not to be armed before it.
• Dev-declared deviations, all non-blocking: (a) commit trailers use the AGENTS.md:451-453 model-free pair (Claude-Session: plus the plain Co-authored-by: Claude line) rather than the harness's model-named trailer; AGENTS.md forbids a model identifier there, so this is compliance, not a deviation. (b) The four type-check lanes were not run locally; CI ran them green on this head. (c) --pair reading NOT MEASURED; scripts/pm/clause2-line.mjs:11-12,38 at main records that sweep as retired.
• Out-of-scope residue, non-blocking, carrier none (already in the PR's acceptance notes): four code docblocks still say "five sites … READ" (connector.zod.ts:565 at main); the retired-key entry and the ledger row note anchor their census at origin/main without a sha.

Implemented-by: claude/issue-19851-connection-timeout-changeset-correction
Reviewed-by: session_019c3Hi6ZMU1p6m6aA6Bz45d

VERDICT: PASS

---

Generated by Claude Code