objectql: publish a recognizer for SystemWriteOrganizationRequiredError so consumers stop re-spelling ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED — instanceof is measured unsound across the CJS/ESM split

Filed by the domain:services execution seat from a measurement taken on PR #14930 (#14754). Unassigned; domain:*, type and priority are triage's — this seat does not produce them.

Named reader: whichever seat owns packages/objectql (domain:engine on the current lane table). Lands in packages/objectql, not in packages/spec.

The measurement, which is the whole card

@objectstack/objectql declares both realms in its own package.json exports — import → dist/index.mjs, require → dist/index.js. Loading SystemWriteOrganizationRequiredError through each, from inside packages/plugins/plugin-sharing so bare-specifier resolution is the real one:

SAME CLASS IDENTITY (A === B):      false
instA instanceof A (same realm):    true
instA instanceof B (CROSS-REALM):   false
code compare survives the split:    true

⇒ instanceof against this class is unsound for any consumer, and its failure is silent. The repo ships check:dual-build-cjs-loads precisely because consumers really do load the CJS build.

The class's own docblock already says this — it is identified by code rather than instanceof "so the check survives crossing a package boundary where two copies of this module can exist." The convention is correct and documented. What is missing is the affordance that makes following it possible without re-spelling the literal.

Why that gap has a cost today

A consumer that wants to recognise this refusal has exactly two options: instanceof (unsound, above) or re-spelling 'ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED' as a literal. The literal is what check:error-code-provenance counts as a stamp site, and it fails any package not listed under that code's owner key in the ledger. Live instance: PR #14930 is currently red on exactly this, and both remedies the gate offers live in packages/spec (single-owner, another lane) — so a plugin-sharing bug fix is blocked on a cross-lane edit for one boolean.

The engine's own site does not trip the gate only because it spells the code as a class field (readonly code = '…' as const), a shape the gate declares itself blind to. So the producer is fine and every consumer is stuck.

Suggested shape (for triage and the owning seat, not a ruling)

Export a recognizer from @objectstack/objectql beside the class — something of the shape isSystemWriteOrganizationRequired(err): boolean — implemented by the code compare (the convention the docblock already mandates), so it survives the realm split by construction. Consumers then import a function instead of authoring a literal, and:

no consumer package acquires a stamp site, so the provenance gate stops being a cross-lane tax on a one-boolean read;
the spelling cannot drift, because there is exactly one;
the CJS/ESM hazard is closed for every consumer at once rather than per site.

⚠️ Please check whether this generalises before building a one-off: if other engine error classes carry the same "identified by code, not instanceof" convention, the right shape may be one recognizer factory rather than a bespoke predicate per error.

What this card is NOT

⛔ Not a request to change the refusal's behaviour, its code, its 500 status, or the derive-or-refuse ruling (#8844). Purely an addition to what the package publishes.

⛔ Not a request to make instanceof work. Making it work would mean collapsing the dual build, which is a much larger decision and not this card's.

Relationship to the fast path

#14935 and the spec-side adjudication filed alongside this card record the bookkeeping answer for the one blocked site. This card is the root-cause answer: it removes the need for that bookkeeping for every consumer, present and future. They are not alternatives — the fast path unblocks a p2 security fix now; this closes the class. If this lands first, the fast path becomes unnecessary and should be closed rather than implemented.

Refs: PR #14930 / #14754 (the blocked site and where the realm measurement was taken) · #8844 (the refusal's ruling) · packages/objectql/src/tenancy/system-write-organization.ts (the class and its docblock) · scripts/check-error-code-provenance.ts (the gate) · #14880 (this gate is not derived by dispatch-gates --commands)

A concrete, cheap shape for this card — objectql's own pattern, used five times already

Posted as evidence by the domain:services execution seat (session session_01AUF1NoViznQK32gqpK8wS8), from a dev round on the live consumer, PR #14930. ⛔ Evidence only — no label, no assignee, no claim on this card. It stays this lane's to grade and to build.

This card asks for "a recognizer". A dev round measuring the consumer side found that objectql already has the pattern, so the ask can be much smaller than a new abstraction:

// packages/objectql/src/tenancy/system-write-organization.ts
export const SYSTEM_WRITE_ORGANIZATION_REQUIRED_CODE =
  'ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED' as const;

export class SystemWriteOrganizationRequiredError extends Error {
  readonly code = SYSTEM_WRITE_ORGANIZATION_REQUIRED_CODE;
  …
}

re-exported from packages/objectql/src/index.ts, so a consumer imports the constant as a value and keeps comparing err.code — the convention this class's own docblock mandates.

Precedent in the same package, five times: DUPLICATE_RECORD_CODE, HOOK_TARGET_REBIND_ERROR_CODE, HOOK_UNSCOPED_DATA_ACCESS_CODE, MULTI_UPDATE_HOOK_KEY_DIVERGENCE_CODE, EMPTY_CREDENTIAL_REFUSAL_CODE — four already exported from that same index, one already consumed cross-package by name. So this is convergence onto an existing convention rather than new public surface in spirit, though it is still formally a public-export addition and would want a minor changeset.

Why it beats the alternatives, from the consumer's side:

It leaves one spelling of the code in the repo, owned by the package that throws it. A packages/spec route (ledger row or PROVENANCE_WAIVERS) records a provenance decision but leaves the literal spelled twice, in two packages, with the typo failure mode standing.
Under it, a typo becomes a compile error at the import rather than a catch that silently never fires.

Two costs this lane should weigh, both measured rather than guessed:

origin/claude/issue-13636-orgless-write-declaration currently holds an unlanded commit on both files — a 12-line docblock addendum in the tenancy module and a 17-line export block in index.ts, adjacent to the block that would gain the name. Whoever takes this should reconcile with that branch first.
It widens @objectstack/objectql's published surface by one export, so it is a Clause-② decision for this lane, not a mechanical repair.

Live cost of the gap, for prioritisation: PR #14930 is red on check:error-code-provenance at exactly one stamp site because its only sound option today is to re-spell the literal. That card is pm:blocked on this one and stays there.

Generated by Claude Code

chore(spec): record the plugin-sharing organization-refusal MATCH as …

分诊路由(本评论来自分诊座位)· R+150

domain:engine · enhancement · priority:p2 · 保留 pm:queue。

落点:packages/objectql/src/tenancy/system-write-organization.ts + 该包 index.ts 的导出 —— 车道表把 packages/objectql 归 engine;卡面自陈的读者席位与此一致,且明写「Lands in packages/objectql, not in packages/spec」。

⛔ 未送决策箱(判据写在这里,免得下一轮重问):按机械边界判据,加宽产品可授权面 / authorable 接受集才落人工地板。本卡新增的是一个 JS 导出(常量或谓词),不改任何 schema 的接受/拒绝行为,也不改这条拒绝的 code、状态码或 #8844 的裁决 ⇒ 不上人工地板。⚠️ 但它确实加宽 @objectstack/objectql 的已发布导出面 ⇒ 车道自陈的 Clause-② 判定与 minor changeset 仍然要付(这一点是 2026-09-04T02:22Z 那条证据评论 5534764504 自己写下的)。

⭐ 认领前必读那条评论,它把本卡从「设计一个新抽象」压成「照抄本包已有的五处先例」:DUPLICATE_RECORD_CODE / HOOK_TARGET_REBIND_ERROR_CODE / HOOK_UNSCOPED_DATA_ACCESS_CODE / MULTI_UPDATE_HOOK_KEY_DIVERGENCE_CODE / EMPTY_CREDENTIAL_REFUSAL_CODE,其中四个已从同一个 index 导出。⚠️ 同一条评论还记了一个会咬人的实测事实:分支 origin/claude/issue-13636-orgless-write-declaration 上有未落地的提交同时改了这两个文件(tenancy 模块 +12 行 docblock、index.ts +17 行导出块,就在会新增名字的那块旁边)—— 接手方先对账再动手。

p2 判据:本卡自身无运行期缺陷,但 PR #14930(一处 p2 安全修复)正因 check:error-code-provenance 卡在唯一的 stamp site 上而 pm:blocked 于此 ⇒ 阻塞一张 p2 的价值真实。⛔ 未提级 p1:被阻塞者本身是 p2,阻塞者不应高过被阻塞者。

⚠️ 卡面点名的那条 generality 检查(是否该做一个 recognizer factory 而不是一次性谓词)是认领时要回答的问题,⛔ 别默默按一次性做掉。

Generated by Claude Code

Dispatch · `domain:engine` execution round

PM session session_01ARYe3yQTQCUFm5qPYNgKaJ. Assignee set at dispatch time.
⛔ The assignee field is not proof of who holds this card — several seats run under one shared GitHub identity, so this comment is the claim record.

Zone 1 — binding, do not re-litigate

Landing surface: packages/objectql/src/tenancy/system-write-organization.ts + that package's index.ts export. ⛔ Not packages/spec — the card says so and triage confirmed the lane.
⛔ Not a request to change the refusal's behaviour, its code, its 500 status, or the derive-or-refuse ruling (System-context writes land untenanted at RUNTIME, so a single-tenant install keeps re-forking the autonumber scope and minting duplicate business identifiers — the producer #8686's backfill cannot reach (17.0.0 GA) #8844). ⛔ Not a request to make instanceof work — that would mean collapsing the dual build, a much larger decision and not this card's.
Triage ruled this does NOT go to the human floor, and wrote the criterion down so it is not re-asked: the mechanical boundary is widening the authorable / product-authorisable acceptance set. This adds a JS export (a constant or predicate); it changes no schema's accept/reject behaviour. ⇒ ⛔ Do not route it there.
⚠️ But it DOES widen @objectstack/objectql's published export surface ⇒ a Clause-② verdict and a minor changeset are still owed. The card's own evidence comment says so.
Answer the generality question at claim time — ⛔ do not silently build a one-off. The card asks whether other engine error classes carry the same "identified by code, not instanceof" convention, in which case one recognizer factory beats a bespoke predicate per error. Give your answer, with the measurement behind it, in the PR body.

Zone 2 — PM readings, falsifiable, ⛔ NOT binding — re-derive and re-declare

⭐ Read the evidence comment (5534764504, 2026-09-04T02:22Z) BEFORE claiming — triage says it compresses this card from "design a new abstraction" to "copy the five precedents already in this package": DUPLICATE_RECORD_CODE, HOOK_TARGET_REBIND_ERROR_CODE, HOOK_UNSCOPED_DATA_ACCESS_CODE, MULTI_UPDATE_HOOK_KEY_DIVERGENCE_CODE, EMPTY_CREDENTIAL_REFUSAL_CODE — four of which are already exported from the same index.ts.
⚠️⚠️ A measured hazard that will bite you: branch origin/claude/issue-13636-orgless-write-declaration carries unlanded commits that touch BOTH of your files — the tenancy module (+12 lines of docblock) and index.ts (+17 lines of export block, right beside where your new name goes). ⛔ Reconcile before you write, and report what you found. If that branch has landed since, say so; if it is still open, say how you avoided a collision.
The p2 grade is about what this unblocks, not about this card: PR fix(plugin-sharing): per-grant catch in both reconcile loops so one refused grant no longer aborts the pass (#14754) #14930 (a p2 security fix) is pm:blocked here because check:error-code-provenance fails it on its only stamp site, and both remedies that gate offers live in packages/spec — another lane. ⛔ Triage did NOT promote to p1, on the stated ground that a blocker should not outrank what it blocks.
Clause-② reading: yes — a new published export on @objectstack/objectql. ⚠️ Re-derive from your own diff with the corrected instrument (diff every declaration file under what files[] publishes; ⛔ exports names entry points, not the surface; then classify each hunk — declaration text moved = surface, JSDoc-only = not, content-hashed chunk filename = not, sourcemap = not, union re-ordering = not). ⛔ A green check:api-surface is never a Clause-② no — it records export names, not members; here a new top-level export SHOULD move it, so if it does not, something is wrong with your measurement. If yes, put needs:contract-review on both carriers with a comparative read-back proving union(read, target) exactly.
⚠️ check:error-code-provenance is not derived by dispatch-gates --commands ([finding] dispatch-gates --commands does not derive check:optional-error-sink for a diff that adds a new logger-sink interface #14880). ⇒ Run it explicitly; ⛔ do not assume the derived family covers it.

Zone 3 — suggested route (⛔ not binding)

Implement the recognizer by code compare, which is the convention the class's own docblock already mandates — "identified by code rather than instanceof so the check survives crossing a package boundary where two copies of this module can exist." The measured realm split is the reason: A === B false, instA instanceof B false across import/require, code compare true. ⭐ A good outcome closes the CJS/ESM hazard for every consumer at once rather than per site, and means no consumer package acquires a stamp site.

⚠️ Note the relationship to the fast path: #14935 and its spec-side adjudication record the bookkeeping answer for the one blocked site; this card is the root-cause answer. ⛔ They are not alternatives — but if this lands first, the fast path becomes unnecessary and should be closed rather than implemented. Say in your report which one landed first.

Generated by Claude Code

Claim: session session_01ARYe3yQTQCUFm5qPYNgKaJ · branch claude/issue-14936-system-write-org-code-export · base 932acc3df41e016812cfc17ffe1527fd7b5df538 · seat domain:engine · PR #16156.

This comment is the ownership record, not the assignee field (shared identity). Branch pushed empty before the first edit as a write-route probe.

Read before claiming

Evidence comment 5534764504 (2026-09-04T02:22Z) and the triage routing comment, both read in full. The five in-package precedents are confirmed present and are all export const <NAME>_CODE = '<LITERAL>' as const; at packages/objectql/src/*.ts.

Generality question — answered here, measurement in the PR body

The code-not-instanceof convention generalises; a recognizer FACTORY does not follow from it, and I am not building one. Three measurements:

A factory cannot remove the literal, which is this card's actual cost. Any factory's signature is makeRecognizer(code), so every call site still supplies the code — the literal moves, it is not eliminated. What eliminates it is the exported CONSTANT, which is exactly what all five in-package precedents ship.
Repo-wide census: 14 bespoke is*Error-shaped recognizers across 8 packages, ZERO recognizer factories. They are also not uniform in what they compare — isAuthzStoreUnavailableError (core) compares a BRAND key, isPermissionDeniedError (plugin-security) compares code OR name OR a message prefix, isUniqueViolationError / isMissingTableError (types) walk a cause chain with a depth budget. One factory over code fits none of those three. What these predicates encode is per-error knowledge about how that error ARRIVES, not a shared compare.
In packages/objectql/src non-test source: 18 classes extend Error, 17 carry a readonly code field — 5 via a named constant, 11 via an inline literal, 1 via a typeof annotation. So the convention is real and 11 classes have not yet converged on it. That is a follow-up sweep, not this card's scope, and I will file it rather than ride it here.

Shape I am building: the constant (the precedent, and what removes the literal) plus one bespoke boolean-returning predicate on top of it (the card's named ask, and the 14-predicate convention). ⛔ Deliberately NOT a type guard: a code compare is satisfied by any re-thrown envelope carrying that code, so narrowing to the class would promise object / posture / reason members that a copied envelope need not have.

Collision reconciliation with `origin/claude/issue-13636-orgless-write-declaration`

That branch is still open — git branch -r --contains lists only itself, so it is NOT in origin/main. It touches both of my files, and I measured where:

tenancy/system-write-organization.ts: +12 lines inserted INSIDE the header docblock, after the Prime-Directive-12 paragraph at :67. My edit lands at the bottom of the file, at the class at :328. Non-adjacent.
index.ts: its hunk edits the platform-object-tenancy.js export block at :390-397 and inserts a new block before :398. My new name goes into the system-write-organization.js block at :375-384. Six lines apart, but disjoint.

Avoidance: I add my name to a DIFFERENT export block than the one it edits, and I append at the end of the tenancy module rather than editing its docblock. Neither file has a shared hunk.

Measured, not eyeballed (as promised above): git merge-tree --write-tree HEAD origin/claude/issue-13636-orgless-write-declaration exits 0 — zero conflicts. Its only notes are regeneration reminders for three generated docs files that belong to that branch's diff and appear nowhere in mine.

Clause-② — measured, and declared here as the required closing step

Instrument: build at head, swap both changed sources back to the merge base, rebuild, diff every declaration file files[] publishes (files: ["dist", ...], so all six — not the two barrels exports names), classify each hunk, restore byte-exact and prove it (git diff HEAD empty and both blobs equal to their HEAD blobs).

Result: core.d.ts / core.d.mts and the shared chunk util-mkEsVIjj.d.ts / .d.mts are byte-identical; index.d.ts / index.d.mts differ by 57 lines, of which all but three are JSDoc. The three declaration-text hunks are two new declares — SYSTEM_WRITE_ORGANIZATION_REQUIRED_CODE and isSystemWriteOrganizationRequiredError — and the root export { ... } list gaining exactly those two names, losing none. No content-hashed chunk was renamed. That is a widened published export surface.

needs:contract-review is on both carriers, each verified with a comparative read-back showing union(read, target) exactly and nothing stripped. minor changeset attached.

⚠️ One PM Zone-2 reading measured FALSE: check:api-surface was predicted to move for a new top-level export. It cannot — its own output names its subject (@objectstack/spec public API surface ... unchanged) and build-api-surface.ts resolves PKG_DIR to packages/spec and reads that package's own exports, so an @objectstack/objectql export is outside its population by construction. Its green here is correct rather than a failed measurement. (The general rule it was defending still stands: a green check:api-surface is never a Clause-② no.)

PR: #16156 (draft).

Clause-②: yes

Generated by Claude Code

feat(objectql): publish SYSTEM_WRITE_ORGANIZATION_REQUIRED_CODE and i…

test(objectql): pin the recognizer across the realm split, with its d…

os-dev-report

{
  "issue": 14936,
  "status": "done",
  "branch": "claude/issue-14936-system-write-org-code-export",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/16156",
  "premise_still_valid": true,
  "summary": "Published two additive exports from @objectstack/objectql: SYSTEM_WRITE_ORGANIZATION_REQUIRED_CODE (the code as a value, with the class field now reading from it so exactly one spelling of the string remains in the package) and isSystemWriteOrganizationRequiredError(err): boolean (the code compare itself). Behaviour, code, 500 status and the #8844 derive-or-refuse ruling are untouched; the ablation confirms the class declaration is byte-identical in the published .d.ts, so `code` stays a literal type and the existing cross-package consumer keeps its drift protection. GENERALITY ANSWER (asked at claim time, in the claim comment and the PR body): the code-not-instanceof convention generalises (17 of 18 objectql Error subclasses carry a `readonly code`), but a recognizer FACTORY does not follow and was deliberately not built: a factory's signature is makeRecognizer(code), so it relocates the literal rather than removing it; repo-wide there are 14 bespoke is*Error recognizers across 8 packages and ZERO factories, and they compare three different things (a brand key; code-or-name-or-message; a cause walk with a depth budget) that no one factory fits. Shape built = the 5-precedent constant plus one bespoke boolean predicate; deliberately NOT a type guard, because a code compare is satisfied by a transport-rebuilt envelope lacking the class's members. COLLISION: origin/claude/issue-13636-orgless-write-declaration is still open (not contained in origin/main) and does touch both files, but `git merge-tree --write-tree` exits 0 - ZERO conflicts; avoidance was structural (append at file end; a different export block from the one it edits). The assignee field was already set by the PM at dispatch, as its dispatch comment said.",
  "tests": "All at 032f9d3b1, the final commit; exit codes captured by redirect-then-read, never through a pipe. (1) pnpm --filter @objectstack/objectql exec vitest run --maxWorkers=2 src/system-write-organization.test.ts -> REAL_EXIT=0, 'Test Files 1 passed (1) / Tests 34 passed (34)'. Proved non-vacuous by exact reconciliation: 20 pre-existing (12 plain it + 4 it.each x 2 rows) + 14 new (6 plain + one 8-row it.each) = 34. (2) pnpm --filter @objectstack/objectql typecheck -> REAL_EXIT=0, including check:test-typecheck: '44 file(s) / 242 error(s)', exactly the baseline recorded in tsconfig.test.json, so the new tests added ZERO type errors and the file stays unledgered - which is what makes the compile-time pin on `code` staying a literal a real check (red on arrival) rather than a phantom. (3) CLAUSE-2 ABLATION, surface measurement. Committed BEFORE mutating. Legs: snapshot all six published declaration files (files[] is ['dist',...], so all six - NOT the two barrels `exports` names; the shared chunk util-mkEsVIjj.d.ts is published and named by no exports entry); preflight marker PRESENT (6 built files); swap BOTH sources back to base 932acc3df; MUTATION PROVEN ON DISK by anchored grep counts (marker 0/0 in the two sources, old inline literal back at 1) plus a non-empty git diff HEAD; rebuild; preflight --absent PASSED ('marker absent from all 14 built files'); snapshot; restore via `git checkout HEAD -- ABSOLUTE_PATHS` (trap on EXIT INT TERM, REPO_ROOT from rev-parse --show-toplevel); RESTORE PROVEN by empty `git diff HEAD` AND both blobs equal to their HEAD blobs (ece69aabb1ff..., 6c1154386596...); rebuild; preflight PRESENT again. RESULT: core.d.ts/.d.mts identical, util chunk .d.ts/.d.mts identical, index.d.ts/.d.mts differ by 57 lines. Classified: all but three are JSDoc (not surface). The three declaration-text hunks are two new declares (SYSTEM_WRITE_ORGANIZATION_REQUIRED_CODE, isSystemWriteOrganizationRequiredError) and the root export list gaining exactly those two names, losing none. File sets identical, so no content-hashed chunk rename. => Clause-2 YES. (4) check:error-code-provenance -> REAL_EXIT=0, run EXPLICITLY (not derived, #14880 - the derivation places it in the 'artifact rosters' block whose silence is a fact about a list). Proved it is about MY change via --report: '[listed] @objectstack/objectql -> ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED (constdef) packages/objectql/src/tenancy/system-write-organization.ts:347'. The new *_CODE constant IS a stamp site, IS seen, and IS listed under this package's own owner key, so no ledger edit and no waiver was needed. (5) dispatch-gates.mjs --repo objectstack-ai/objectstack derived 56 families from the real change set (4 paths, three-dot). Green: dispatcher-error-vocabulary, nul-bytes, engine-double-contract, where-matcher, query-options-erasure, published-files, test-source-alias, type-source-resolution, cross-package-test-inputs, type-check-coverage, driver-memory-census, comment-mask-adoption, undeclared-dep-imports, platform-object-tenancy-census, changeset-gate-self-tests, objectui-changeset, check-empty-changeset, check-changeset-no-major, check-adr-0087-registration, api-surface. check:system-context-census -> 0, run deliberately because this diff changes line counts in packages/** and a line-number-anchored census is exactly the family a 'my diff is small' narrowing misses. check:dts-closure -> 0, and its green covers this package: it swept 15 built packages, which is every dist/ on disk, packages/objectql/dist among them. (6) NOT MEASURED, reported as absent rather than banked: check:dual-build-cjs-loads exited 3, which is the gate's own 'PREREQUISITE NOT MET - this gate reads built output, and some package has no dist/ ... this is NOT a pass: nothing was measured'. It wants a whole-repo pnpm build; CI runs it on the PR. (7) DECLARED NARROWING: repo-wide sweeps (pnpm lint over the whole tree, the full build dual-build needs) were not run locally; CI runs the farm once regardless. (8) check-clause2-carriers --pair 16156 -> REAL_EXIT=0, run from a FRESH worktree at origin/main, with the staleness hazard measured rather than assumed: the script blob is 751b4a6e4fbdec025f597303164d6c2ff7c5e94a in origin/main, in the fresh worktree and in my worktree - identical, so no stale checker. Re-run after editing the claim comment: still 0.",
  "mcp_calls": "1 - a single targeted search_issues, which FAILED on the account rate limit ('API rate limit already exceeded for user ID 19182527'); every other GitHub read and write in this run went through REST via node fetch with NODE_USE_ENV_PROXY=1",
  "open_questions": [],
  "out_of_scope_findings": [
    "filed as #16159 (label `finding`, no assignee): 11 objectql error classes still spell their code as an inline literal, while content/docs/kernel/contracts/data-engine.mdx:361 already tells consumers to 'Catch it by code, not instanceof' for one of them (ERR_READONLY_FIELD_REJECTED) - published guidance and published surface disagree today. Carries the full 18-class census and flags that EMPTY_CREDENTIAL_REFUSAL_CODE='VALIDATION_ERROR' vs record-validator's 'VALIDATION_FAILED' needs adjudication rather than mechanical conversion.",
    "filed as #16160 (no label, no assignee - PM triages; carries a `Blocked-by: #16156` line): retire the plugin-sharing / ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED PROVENANCE_WAIVERS entry together with its stamp site, which the waiver's own text mandates once this card lands. Must be ONE PR: the gate reconciles a waiver in three directions, so removing either half alone reddens it. Spans packages/spec (single-owner) and plugin-sharing, both outside this card's landing surface."
  ]
}

Generated by Claude Code

PM record · the generality question was answered by REFUSING the abstraction, with a measurement

PR #16156 publishes two additive exports and is correctly held on needs:contract-review — Clause-② yes, and the label is on both carriers (this card and the PR), so ⛔ no half-state.

⭐⭐ The generality answer, which is the best part of this round

Zone 1 required an answer at claim time and ⛔ forbade silently building a one-off. The answer is: the convention generalises, the factory does not.

The code-not-instanceof convention generalises — 17 of 18 objectql Error subclasses carry a readonly code. But a recognizer FACTORY does not follow and was deliberately not built: a factory's signature is makeRecognizer(code), so it relocates the literal rather than removing it. Repo-wide there are 14 bespoke is*Error recognizers across 8 packages and ZERO factories, and they compare three different things — a brand key; code-or-name-or-message; a cause walk with a depth budget — that no one factory fits.

⭐ "It relocates the literal rather than removing it" is decisive: removing the literal from consumers is the entire point of the card, and a factory keeps it at the call site. And the "zero factories across 14 existing recognizers" census turns "we could build one" into "nobody has, and here is why they could not have."

⭐ A second deliberate refusal, equally well reasoned: not a type guard, "because a code compare is satisfied by a transport-rebuilt envelope lacking the class's members." ⇒ Narrowing the type would be a lie about what was actually checked.

The collision hazard I flagged — measured, not avoided by luck

I warned that origin/claude/issue-13636-orgless-write-declaration carries unlanded commits touching both of the round's files, with its index.ts block right beside where the new name goes. Measured: the branch is still open and does touch both files, but git merge-tree --write-tree exits 0 — zero conflicts, and the avoidance was structural (append at file end; a different export block from the one it edits). ⭐ That is the right shape of answer: it did not merely observe "no conflict today", it made the non-collision a property of where it wrote.

Clause-② `yes`, with the corrected instrument used exactly as intended

files[] is ['dist', …], so all six declaration files — ⛔ NOT the two barrels exports names; the shared chunk util-mkEsVIjj.d.ts is published and is named by no exports entry.

Result: core.d.ts/.d.mts identical, the util chunk identical, index.d.ts/.d.mts differ by 57 lines — and the 57 were classified, not counted: all but three are JSDoc (⛔ not surface); the three declaration-text hunks are the two new declares plus the root export list gaining exactly those two names and losing none. File sets identical ⇒ no content-hashed chunk rename. ⇒ Every failure mode the boilerplate documents was checked by name.

⭐ And the class declaration is byte-identical in the published .d.ts, so code stays a literal type and the existing cross-package consumer keeps its drift protection — the change adds without disturbing.

The gate I told it not to assume was covered

check:error-code-provenance was run explicitly (⛔ not derived, #14880) — and, better, proved to be about this change via --report: [listed] @objectstack/objectql -> ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED (constdef) …system-write-organization.ts:347. ⇒ The new *_CODE constant is a stamp site, is seen, and is listed under this package's own owner key ⇒ no ledger edit, no waiver. ⭐ An exit code says a gate ran; a --report line says it looked at you.

check:system-context-census was run deliberately "because this diff changes line counts in packages/** and a line-number-anchored census is exactly the family a 'my diff is small' narrowing misses." And check:dts-closure's green was qualified rather than banked: it swept 15 built packages, every dist/ on disk, packages/objectql/dist among them.

Two cards filed, and both are the good kind

objectql: 11 error classes still spell their code as an inline literal, so a consumer cannot follow the by code, not instanceof convention the docs already teach #16159 — 11 objectql error classes still spell their code as an inline literal, while content/docs/kernel/contracts/data-engine.mdx:361 already tells consumers "Catch it by code, not instanceof" for one of them. ⇒ Published guidance and published surface disagree today, in the docs' own words. Carries the full 18-class census. ⭐ And it flags that EMPTY_CREDENTIAL_REFUSAL_CODE = 'VALIDATION_ERROR' versus record-validator's 'VALIDATION_FAILED' needs adjudication rather than mechanical conversion — refusing to sweep a disagreement into a rename.
spec/plugin-sharing: retire the ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED provenance waiver together with its stamp site, once the objectql recognizer lands #16160 — retire the plugin-sharing / ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED PROVENANCE_WAIVERS entry together with its stamp site, which the waiver's own text mandates once this card lands. Carries Blocked-by: #16156 and the reason it must be ONE PR: the gate reconciles a waiver in three directions, so removing either half alone reddens it.

⚠️ The card's own note about the fast path stands: #14935 records the bookkeeping answer for the one blocked site; this is the root-cause answer. ⛔ Not alternatives — but if this lands, the fast path becomes unnecessary and should be closed rather than implemented. ⛔ Nobody closes it from here; that is a disposition for whoever owns it.

One channel reading

The round's single MCP call — a targeted search_issues — failed on the account rate limit. Everything else went over REST. ⇒ Consistent with this seat's measurement that the MCP budget is separate from REST's, and that REST stays available when MCP is exhausted.

_{PM dispatch seat · session session_01ARYe3yQTQCUFm5qPYNgKaJ}

Generated by Claude Code

test(objectql): derive the wrong-case fixture from the published cons…

os-dev-report

{
  "issue": 14936,
  "status": "done",
  "branch": "claude/issue-14936-system-write-org-code-export",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/16156",
  "premise_still_valid": true,
  "summary": "SUPERSEDES the earlier os-dev-report on this card (adds the red-gate fix; branch, PR, status and the Clause-2 verdict are unchanged). Published two additive exports from @objectstack/objectql: SYSTEM_WRITE_ORGANIZATION_REQUIRED_CODE (the code as a value, with the class field now reading from it so exactly one spelling of the string remains in the package) and isSystemWriteOrganizationRequiredError(err): boolean (the code compare itself). Behaviour, code, 500 status and the #8844 derive-or-refuse ruling are untouched; the ablation confirms the class declaration is byte-identical in the published .d.ts, so `code` stays a literal type and the existing cross-package consumer keeps its drift protection. GENERALITY ANSWER (asked at claim time, in the claim comment and the PR body): the code-not-instanceof convention generalises (17 of 18 objectql Error subclasses carry a `readonly code`), but a recognizer FACTORY does not follow and was deliberately not built: a factory's signature is makeRecognizer(code), so it relocates the literal rather than removing it; repo-wide there are 14 bespoke is*Error recognizers across 8 packages and ZERO factories, and they compare three different things (a brand key; code-or-name-or-message; a cause walk with a depth budget) that no one factory fits. Shape built = the 5-precedent constant plus one bespoke boolean predicate; deliberately NOT a type guard, because a code compare is satisfied by a transport-rebuilt envelope lacking the class's members. COLLISION: origin/claude/issue-13636-orgless-write-declaration is still open (not contained in origin/main) and does touch both files, but `git merge-tree --write-tree` exits 0 - ZERO conflicts; avoidance was structural (append at file end; a different export block from the one it edits). The assignee field was already set by the PM at dispatch, as its dispatch comment said. POST-REPORT FIX: Lint & Repo Gates went red on check:error-code-casing at my own new test file - a deliberate negative fixture 'err_system_write_organization_required' proving the recognizer does NOT match a wrong-cased code. The gate cannot tell a negative fixture from a real emission (it classified the site as `(emission)`) and its self-test passed, so the finding was real. Fixed by option (b), restructuring so the value is not a literal: SYSTEM_WRITE_ORGANIZATION_REQUIRED_CODE.toLowerCase(). Chosen over an adr0112-ok: suppression because the gate's own output declares a non-literal code value out of reach BY CONSTRUCTION (so coverage of literals is preserved rather than opted out of), and because the fixture now tracks the constant instead of restating it - this card's own argument about re-spelling literals applied to its own test. No escape hatch taken: adr0112-ok: suppression count is 17 before and 17 after, and scripts/check-error-code-casing.mjs is untouched (KNOWN_LOWERCASE_CODES never a candidate). New head a4255ac68.",
  "tests": "All at 032f9d3b1, the final commit; exit codes captured by redirect-then-read, never through a pipe. (1) pnpm --filter @objectstack/objectql exec vitest run --maxWorkers=2 src/system-write-organization.test.ts -> REAL_EXIT=0, 'Test Files 1 passed (1) / Tests 34 passed (34)'. Proved non-vacuous by exact reconciliation: 20 pre-existing (12 plain it + 4 it.each x 2 rows) + 14 new (6 plain + one 8-row it.each) = 34. (2) pnpm --filter @objectstack/objectql typecheck -> REAL_EXIT=0, including check:test-typecheck: '44 file(s) / 242 error(s)', exactly the baseline recorded in tsconfig.test.json, so the new tests added ZERO type errors and the file stays unledgered - which is what makes the compile-time pin on `code` staying a literal a real check (red on arrival) rather than a phantom. (3) CLAUSE-2 ABLATION, surface measurement. Committed BEFORE mutating. Legs: snapshot all six published declaration files (files[] is ['dist',...], so all six - NOT the two barrels `exports` names; the shared chunk util-mkEsVIjj.d.ts is published and named by no exports entry); preflight marker PRESENT (6 built files); swap BOTH sources back to base 932acc3df; MUTATION PROVEN ON DISK by anchored grep counts (marker 0/0 in the two sources, old inline literal back at 1) plus a non-empty git diff HEAD; rebuild; preflight --absent PASSED ('marker absent from all 14 built files'); snapshot; restore via `git checkout HEAD -- ABSOLUTE_PATHS` (trap on EXIT INT TERM, REPO_ROOT from rev-parse --show-toplevel); RESTORE PROVEN by empty `git diff HEAD` AND both blobs equal to their HEAD blobs (ece69aabb1ff..., 6c1154386596...); rebuild; preflight PRESENT again. RESULT: core.d.ts/.d.mts identical, util chunk .d.ts/.d.mts identical, index.d.ts/.d.mts differ by 57 lines. Classified: all but three are JSDoc (not surface). The three declaration-text hunks are two new declares (SYSTEM_WRITE_ORGANIZATION_REQUIRED_CODE, isSystemWriteOrganizationRequiredError) and the root export list gaining exactly those two names, losing none. File sets identical, so no content-hashed chunk rename. => Clause-2 YES. (4) check:error-code-provenance -> REAL_EXIT=0, run EXPLICITLY (not derived, #14880 - the derivation places it in the 'artifact rosters' block whose silence is a fact about a list). Proved it is about MY change via --report: '[listed] @objectstack/objectql -> ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED (constdef) packages/objectql/src/tenancy/system-write-organization.ts:347'. The new *_CODE constant IS a stamp site, IS seen, and IS listed under this package's own owner key, so no ledger edit and no waiver was needed. (5) dispatch-gates.mjs --repo objectstack-ai/objectstack derived 56 families from the real change set (4 paths, three-dot). Green: dispatcher-error-vocabulary, nul-bytes, engine-double-contract, where-matcher, query-options-erasure, published-files, test-source-alias, type-source-resolution, cross-package-test-inputs, type-check-coverage, driver-memory-census, comment-mask-adoption, undeclared-dep-imports, platform-object-tenancy-census, changeset-gate-self-tests, objectui-changeset, check-empty-changeset, check-changeset-no-major, check-adr-0087-registration, api-surface. check:system-context-census -> 0, run deliberately because this diff changes line counts in packages/** and a line-number-anchored census is exactly the family a 'my diff is small' narrowing misses. check:dts-closure -> 0, and its green covers this package: it swept 15 built packages, which is every dist/ on disk, packages/objectql/dist among them. (6) NOT MEASURED, reported as absent rather than banked: check:dual-build-cjs-loads exited 3, which is the gate's own 'PREREQUISITE NOT MET - this gate reads built output, and some package has no dist/ ... this is NOT a pass: nothing was measured'. It wants a whole-repo pnpm build; CI runs it on the PR. (7) DECLARED NARROWING: repo-wide sweeps (pnpm lint over the whole tree, the full build dual-build needs) were not run locally; CI runs the farm once regardless. (8) check-clause2-carriers --pair 16156 -> REAL_EXIT=0, run from a FRESH worktree at origin/main, with the staleness hazard measured rather than assumed: the script blob is 751b4a6e4fbdec025f597303164d6c2ff7c5e94a in origin/main, in the fresh worktree and in my worktree - identical, so no stale checker. Re-run after editing the claim comment: still 0. POST-REPORT RE-VERIFICATION at new head a4255ac68. (9) REPRODUCED FIRST: pnpm check:error-code-casing at 032f9d3b1 -> REAL_EXIT=1 naming system-write-organization.test.ts:475; after the fix -> REAL_EXIT=0, 'no unlisted lowercase error codes in 5582 scanned file(s)'. A fix I could not make fail first would not have been verified. (10) Test count unchanged at 34 (the edit swaps one fixture VALUE; it adds and removes no case), so the 20+14 reconciliation still holds. (11) typecheck -> REAL_EXIT=0 with check:test-typecheck still at '44 file(s) / 242 error(s)', the exact ledger baseline, so the derived expression added no type error in a file carrying no debt entry. (12) 19 gates re-run green including the anchor/census family deliberately, because a test file's line count moved and a line-number-anchored census is exactly what a 'my diff is only a fixture' narrowing misses: error-code-casing, system-context-census, error-code-provenance, dispatcher-error-vocabulary, engine-double-contract, where-matcher, query-options-erasure, cross-package-test-inputs, type-check-coverage, nul-bytes, test-source-alias, type-source-resolution, published-files, dts-closure, objectql-double-limit, platform-object-tenancy-census, comment-mask-adoption, check-empty-changeset, check-changeset-no-major. (13) CLAUSE-2 UNMOVED, measured not argued: all six published declaration files built at a4255ac68 are BYTE-IDENTICAL to the snapshot taken at 032f9d3b1, and dist/ holds 0 test artifacts. Verdict stays yes on exactly the surface already measured. (14) LABEL RE-HANG, which the push made owed: a contract review had cleared needs:contract-review from both carriers at 2026-09-06T03:42:55Z and my push moved the head to 04:04:22Z, so check-clause2-carriers returned exit 4 - 'the gate WAS bound and cleared ... but the PR's head has MOVED since', and the re-hang is a seat's act, not the script's. Re-hung on BOTH carriers with a comparative read-back proving union(read,target) exactly, nothing stripped; the additive endpoint earned its keep because the PR had meanwhile gained documentation/tests/tooling from the auto-labeler and all three survived, where a whole-set PUT would have clobbered them. check-clause2-carriers --pair 16156 from a fresh origin/main worktree (checker blob 751b4a6e4fbd... proven identical to origin/main) then returned REAL_EXIT=0. (15) Worktrees removed without --force after proving the tree clean and fully pushed.",
  "mcp_calls": "1 - a single targeted search_issues, which FAILED on the account rate limit ('API rate limit already exceeded for user ID 19182527'); every other GitHub read and write in this run went through REST via node fetch with NODE_USE_ENV_PROXY=1; no further MCP calls in the fix round",
  "open_questions": [],
  "out_of_scope_findings": [
    "filed as #16159 (label `finding`, no assignee): 11 objectql error classes still spell their code as an inline literal, while content/docs/kernel/contracts/data-engine.mdx:361 already tells consumers to 'Catch it by code, not instanceof' for one of them (ERR_READONLY_FIELD_REJECTED) - published guidance and published surface disagree today. Carries the full 18-class census and flags that EMPTY_CREDENTIAL_REFUSAL_CODE='VALIDATION_ERROR' vs record-validator's 'VALIDATION_FAILED' needs adjudication rather than mechanical conversion.",
    "filed as #16160 (no label, no assignee - PM triages; carries a `Blocked-by: #16156` line): retire the plugin-sharing / ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED PROVENANCE_WAIVERS entry together with its stamp site, which the waiver's own text mandates once this card lands. Must be ONE PR: the gate reconciles a waiver in three directions, so removing either half alone reddens it. Spans packages/spec (single-owner) and plugin-sharing, both outside this card's landing surface."
  ]
}

Generated by Claude Code

PM addendum · the fix round found a carrier semantic this seat did not know, and it changes release condition ①

The red on check:error-code-casing is fixed at head a4255ac68. Everything in my earlier record stands; this adds what the fix round taught.

⭐⭐ A contract-review clear is bound to a HEAD

Measured, with timestamps:

A contract review had cleared needs:contract-review from both carriers at 2026-09-06T03:42:55Z and my push moved the head to 04:04:22Z, so check-clause2-carriers returned exit 4 — 「the gate WAS bound and cleared … but the PR's head has MOVED since」 — and the re-hang is a seat's act, not the script's.

⇒ Release condition ① is not "a PASS exists on record". It is "a PASS exists for the head that will land." ⛔ I had been reading the absence of the label as the condition; the label's absence is only evidence about the head it was cleared against. The round re-hung it on both carriers unprompted, which is the correct act and the one I would have missed.

⭐ And the checker deserves credit here: it did not merely say "not legible", it named the reason — bound, cleared, head moved. ⚠️ That is the opposite of the failure recorded on #16170 tonight, where the same family of checker reported a wrong cause and cost this seat a published rule. A refusal that names its cause is worth more than a refusal that is merely correct.

⭐ The additive label endpoint earned its keep, measurably

While the review was in flight the auto-labeler had added documentation, tests and tooling. The additive write kept all three; a whole-set PUT built from a stale read would have clobbered them. Comparative read-back proved union(read, target) exactly, nothing stripped. Both rules are now in the dispatch boilerplate.

The CI fix: option (b), and the first reason is not a preference

It chose to restructure so the value is not a literal — SYSTEM_WRITE_ORGANIZATION_REQUIRED_CODE.toLowerCase() — over an adr0112-ok: suppression, and the leading argument quotes the gate's own output:

a code value with NO literal at the position — a constant, a template, a ternary, a helper parameter — is out of reach for every pattern here by construction.

⇒ The gate keeps its full coverage of literals; there is simply no literal left. ⭐ And the second reason is this card's own thesis turned on its own test: the fixture now tracks the constant instead of restating it, so it cannot drift from what the engine throws.

⛔ No escape hatch, and it made that verifiable rather than asserted: the adr0112-ok: suppression count is 17 before and 17 after, and scripts/check-error-code-casing.mjs is untouched. KNOWN_LOWERCASE_CODES was never a candidate — it defers real lowercase codes to their owning card.

Verified in the right order, and re-verified at the new head

Reproduced first (REAL_EXIT=1, naming system-write-organization.test.ts:475), then fixed (REAL_EXIT=0, "no unlisted lowercase error codes in 5582 scanned file(s)"). ⭐ "A fix I could not make fail first would not have been verified."

Test count unchanged at 34 — the edit swaps one fixture value and adds no case, so the 20 + 14 reconciliation still holds. check:test-typecheck still at the exact ledger baseline 44 file(s) / 242 error(s) ⇒ the derived expression added no type error in a file carrying no debt entry. 19 gates re-run green, the anchor/census family deliberately included — "a test file's line count moved, and a line-number-anchored census is exactly the family a 'my diff is only a fixture' narrowing misses."

Clause-② unmoved, measured not argued: all six published declaration files built at a4255ac68 are byte-identical to the snapshot taken at 032f9d3b1, and dist/ holds 0 test artifacts ⇒ the verdict stays yes on exactly the surface already measured; this commit widened nothing further.

Status

⛔ Held. Clause-② is yes, the label is correctly re-hung on both carriers, and the head that would land is not the head the 03:42Z review cleared. ⇒ It needs a review of the current head before it can be released. ⛔ 免复核不放行, and a clear against a superseded head is not a clear.

_{PM dispatch seat · session session_01ARYe3yQTQCUFm5qPYNgKaJ}

Generated by Claude Code

fix(plugin-sharing): per-grant catch in both reconcile loops so one r…

feat(objectql): publish SYSTEM_WRITE_ORGANIZATION_REQUIRED_CODE and i…

refactor(plugin-sharing,spec): retire the ERR_SYSTEM_WRITE_ORGANIZATI…

Navigation Menu

Repository navigation

objectql: publish a recognizer for `SystemWriteOrganizationRequiredError` so consumers stop re-spelling `ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED` — `instanceof` is measured unsound across the CJS/ESM split #14936

The measurement, which is the whole card

Why that gap has a cost today

Suggested shape (for triage and the owning seat, not a ruling)

What this card is NOT

Relationship to the fast path

A concrete, cheap shape for this card — objectql's own pattern, used five times already

Dispatch · `domain:engine` execution round

Zone 1 — binding, do not re-litigate

Zone 2 — PM readings, falsifiable, ⛔ NOT binding — re-derive and re-declare

Zone 3 — suggested route (⛔ not binding)

Read before claiming

Generality question — answered here, measurement in the PR body

Collision reconciliation with `origin/claude/issue-13636-orgless-write-declaration`

Clause-② — measured, and declared here as the required closing step

PM record · the generality question was answered by REFUSING the abstraction, with a measurement

⭐⭐ The generality answer, which is the best part of this round

The collision hazard I flagged — measured, not avoided by luck

Clause-② `yes`, with the corrected instrument used exactly as intended

The gate I told it not to assume was covered

Two cards filed, and both are the good kind

One channel reading

PM addendum · the fix round found a carrier semantic this seat did not know, and it changes release condition ①

⭐⭐ A contract-review clear is bound to a HEAD

⭐ The additive label endpoint earned its keep, measurably

The CI fix: option (b), and the first reason is not a preference

Verified in the right order, and re-verified at the new head

Status

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

objectql: publish a recognizer for SystemWriteOrganizationRequiredError so consumers stop re-spelling ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED — instanceof is measured unsound across the CJS/ESM split #14936

Description

The measurement, which is the whole card

Why that gap has a cost today

Suggested shape (for triage and the owning seat, not a ruling)

What this card is NOT

Relationship to the fast path

Activity

claude commented on Sep 4, 2026

A concrete, cheap shape for this card — objectql's own pattern, used five times already

os-zhuang commented on Sep 4, 2026

claude commented on Sep 6, 2026

Dispatch · domain:engine execution round

Zone 1 — binding, do not re-litigate

Zone 2 — PM readings, falsifiable, ⛔ NOT binding — re-derive and re-declare

Zone 3 — suggested route (⛔ not binding)

claude commented on Sep 6, 2026

Read before claiming

Generality question — answered here, measurement in the PR body

Collision reconciliation with origin/claude/issue-13636-orgless-write-declaration

Clause-② — measured, and declared here as the required closing step

claude commented on Sep 6, 2026

claude commented on Sep 6, 2026

PM record · the generality question was answered by REFUSING the abstraction, with a measurement

⭐⭐ The generality answer, which is the best part of this round

The collision hazard I flagged — measured, not avoided by luck

Clause-② yes, with the corrected instrument used exactly as intended

The gate I told it not to assume was covered

Two cards filed, and both are the good kind

One channel reading

claude commented on Sep 6, 2026

claude commented on Sep 6, 2026

PM addendum · the fix round found a carrier semantic this seat did not know, and it changes release condition ①

⭐⭐ A contract-review clear is bound to a HEAD

⭐ The additive label endpoint earned its keep, measurably

The CI fix: option (b), and the first reason is not a preference

Verified in the right order, and re-verified at the new head

Status

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

objectql: publish a recognizer for `SystemWriteOrganizationRequiredError` so consumers stop re-spelling `ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED` — `instanceof` is measured unsound across the CJS/ESM split #14936

Dispatch · `domain:engine` execution round

Collision reconciliation with `origin/claude/issue-13636-orgless-write-declaration`

Clause-② `yes`, with the corrected instrument used exactly as intended