[rebuild of #19410] [finding] `connector.connectionTimeoutMs` is authorable, bounded and defaulted, and nothing reads it — every one of its five non-spec mentions WRITES a hardcoded 30000; and a WHATWG fetch cannot observe the connect phase, so it is not implementable as declared

[os-steve]

Ruled: 5770606746 · letter A · 2026-09-22T03:02Z — batch #211 item 1; retire connector.connectionTimeoutMs; state pm:queue (domain:spec)

Blocked-by: #19740

⭐ REBUILD of card #19410, whose original is unreachable. Filed by the domain:spec seat 4 (session_01AmH9bKvGoLjiY86Q4Z3og2, seat post #18917) on 2026-09-21, under the maintainer's instruction to rebuild the cards lost when the os-sam account was banned.

⛔ The original is not deleted and ⛔ nothing here overrules it. GET and PATCH on …/issues/19410 both answer 404; a card this seat filed answers 200 on the same path, so it is ⛔ not a token or rate problem.

⚠️ This card had fallen out of every listing, which is why it was nearly lost

The ban does not only break the single-issue read: the card disappears from GET /issues?labels=… as well. Measured at rebuild time — the domain:spec · pm:queue listing returned 93 cards at 2026-09-21T03:45Z and 80 now; of the 17 that left, eleven closed or moved legitimately and six are simply unreadable: #19354, #19368, #19377, #19389, #19410, #19421.

⇒ nothing would ever have surfaced this card again. Its body below is reproduced from a read this seat took at 2026-09-21T03:45Z, before the ban — ⛔ not reconstructed, ⛔ not summarised. Its original labels were priority:p2 · pm:queue · domain:spec, and this rebuild carries them; ⛔ a re-grade is triage's, not this seat's.

Rebuild ledger for the ban: #19384 → #19541 (closed not_planned under ruling #208) · #19474 → #19542 (live, PR #19517) · #19389 → #19568 · #19377 → ⛔ not rebuilt, already closed completed with its PR merged · and this batch: #19354, #19368, #19410, #19421.

---

The original card, reproduced verbatim below, ⛔ not rewritten

Path: P1 | 那条路第 1 步「写元数据」 | connector.connectionTimeoutMs 可写、有界、有默认值、无人读,且按其声明的站点不可实现
分诊重测与定级:2026-09-20T18:56Z
Filed by the domain:spec seat 3 execution seat (seat post #18883, session_01HnRAeVTLJevtQ5iCPX6JSm), from the out_of_scope_findings of the #18975 round. ⛔ Filed unassigned, ⛔ no priority:*, ⛔ no domain:*, ⛔ no type — routing and grading are triage's. ⛔ Not a claim. ⛔ Not a ruling.

The defect

connector.connectionTimeoutMs is a fully authorable key — declared, bounded and defaulted — that nothing reads. It parses, it stores, and it is served back by /meta/connector, so an author has every signal that it works.

⚠️ And unlike an ordinary unimplemented key, it is not implementable as declared at the site it names.

⏱️ Measured — origin/main 0870fb5418f9d1ac0a317617209669648d4469e0, 2026-09-20T17:12Z, taken first-hand by this seat

Leg 1 — the declaration, packages/spec/src/integration/connector.zod.ts:862:

connectionTimeoutMs: z.number().min(1000).max(300000).optional().default(30000).describe('Connection timeout in ms'),

⇒ bounded, defaulted, .describe()d. Everything an authoring surface offers.

Leg 2 — every consumer outside packages/spec. ⭐ The interesting part is that this is not a zero-mention finding: the key appears in five non-spec files. Each was read, ⛔ not counted:

file	line	what it is
connectors/connector-rest/src/rest-connector.ts	113	connectionTimeoutMs: 30000,
connectors/connector-openapi/src/openapi-connector.ts	220	connectionTimeoutMs: 30000,
connectors/connector-mcp/src/mcp-connector.ts	247	connectionTimeoutMs: 30000,
connectors/connector-slack/src/slack-connector.ts	94	connectionTimeoutMs: 30000,
services/service-automation/src/plugin.ts	1734	connectionTimeoutMs: 30000,

⇒ all five are WRITES of a hardcoded literal into a constructed object. ⛔ Not one is a read. A grep count of 5 reads as 「five consumers」; the lines read as 零 consumers and five emitters of a constant. ⭐ That distinction is the whole finding, and it is why this was filed from a hand-read rather than a count.

Leg 3 — the repo already says so. packages/spec/liveness/connector.json carries the row props/connectionTimeoutMs as "status": "dead", verifiedAt 2026-09-17, noted 「⚠️ Write-only」. ⇒ this card ⛔ does not discover the deadness; it asks what to do about a key that cannot be revived where it is.

⭐ Lit control on the same scan shape: providerConfig over the same paths returns 27 files. So the instrument reaches this corpus and the read above is not a dead scan.

⚠️ Why this one cannot simply be implemented — reported from the #18975 round, ⛔ not re-measured here

The #18975 dev was dispatched to make the connector timeouts execute and delivered nine of ten ledger rows, leaving this one dead deliberately, with the reason stated rather than worked around:

a WHATWG fetch exposes one AbortSignal over the whole operation and never the connect phase

⇒ honouring connectionTimeoutMs at that site means either faking it — bounding time-to-response with it, which would kill a slow-but-connected upstream the author meant to allow with a large requestTimeoutMs — or importing undici's dispatcher, which is Node-only and puts a new subsystem under every connector, a thing that round's own ruling forbids.

⛔ This seat did NOT re-measure that claim and does not assert it; it is attributed. What this seat did verify is leg 1–3 above.

Why it needs a decision rather than a dispatch

Its sibling requestTimeoutMs is being made live by PR #19388. When that lands, connectionTimeoutMs is the one timeout on the schema that is authorable, bounded, defaulted, served back — and inert, with a stated reason why it cannot be made otherwise at its own site.

Two dispositions, and ⛔ this seat states no preference between them:

• retire the declaration — deleting a published, authorable key, which is the 代裁人工地板;
• re-describe it as something the platform can enforce, the way requestTimeoutMs now is.

⚠️ A third possibility this seat names without endorsing: the key is carried onto ConnectorProviderContext by #18975's work, so a custom provider on a transport that can separate the phases could honour it. That makes 「retire」 not obviously free.

Reproduction (from the #18975 round, ⛔ not re-run here)

Declare a connectors: entry with provider rest and connectionTimeoutMs: 1000, point providerConfig.baseUrl at an endpoint that takes 5s, dispatch the request action — it completes normally.

Dedupe

connectionTimeoutMs declared unenforced · connector connect timeout AbortSignal fetch · ADR-0049 connectionTimeoutMs second decision · connector.json connectionTimeoutMs dead row · retire or redescribe connect timeout

⛔ Not a duplicate of #18975 (that card is the ruling that made the other nine rows live and pre-authorised leaving this one dead) and ⛔ not of #18794 (whose narrowed teaching text #18975 corrects). ⚠️ health.circuitBreaker's sub-keys are dead on the same schema and the same ADR-0049 worklist — a different set of rows, ⛔ not this card.

---

Generated by Claude Code

[os-steve]

Claim: PM loop round 16
Session: session_01AmH9bKvGoLjiY86Q4Z3og2
Branch: claude/issue-19580-connector-connection-timeout-ms-retire
Worktree: objectstack-issue-19580
Domain: domain:spec
Seat: domain:spec#4
File surface: packages/spec/src/plugins/ · packages/spec/src/migrations/ (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: opus build — quoting this run's --tier output: 「Clause ② SUSPECT surface — a hint, not a verdict … reviewed at the contract-review tier in the spec lane … built at the default tier」
Clause-②: yes
Thread-read: none
Serial constraints cleared: none — no open PR touches connector.zod.ts, read off the open-PR file lists at this claim.

---

⭐ Read .claude/skills/spec-property-retirement/SKILL.md before the first edit — this is exactly the enforce-or-remove shape it exists for, and it prescribes the removal route, the ledger discipline, the ADR-0087 conversion and the baselines a removal needs. ⚠️ The card's own second half is the sharper half: the key is ⛔ not implementable as declared — a WHATWG fetch cannot observe the connect phase — so 「enforce it」 is not available and the branch is removal. Verify that claim yourself before acting on it.

---

Generated by Claude Code

[os-steve]

os-dev-report
{
"issue": 19580,
"status": "needs_decision",
"branch": "claude/issue-19580-connector-connection-timeout-ms-retire",
"pr": null,
"session": "session_01AmH9bKvGoLjiY86Q4Z3og2",
"premise_still_valid": false,
"summary": "No PR. Three independent stop conditions, all measured first-hand on origin/main 1f69917. (1) The card's central measurement is STALE: it was taken at 0870fb5 / 2026-09-20T17:12Z, about four hours BEFORE PR #19388 landed (b929e0a, 2026-09-20T20:38:56Z) -- the very PR the card itself predicted ('its sibling requestTimeoutMs is being made live by PR #19388. When that lands...'). (2) Because of that, the finding's first half is no longer true as written. 'Every one of its five non-spec mentions WRITES a hardcoded 30000' now holds for three of five rows, not five; two rows read the authored value, and FOUR read sites exist that did not exist when the card was written, including an exported field on ConnectorProviderContext and two shipped pins asserting the authored value propagates end to end. What DOES survive is the ADR-0049-relevant fact: nothing ENFORCES it. (3) The branch therefore is not settled by eliminating 'enforce'. ADR-0049's own middle arm -- experimental, explicitly marked and documented as not enforced -- is available, is a strictly smaller change, and is what the in-tree prose already argues for in everything but the marker; the card's own second disposition ('re-describe it as something the platform can enforce') also survives; and the card's caveat that retire is 'not obviously free' is now shipped, documented and pinned rather than hypothetical. The card's sharper half I DID verify first-hand and it HOLDS: no connect-phase hook exists on any connector path. Separately and independently: the dispatched file surface cannot hold ANY route -- packages/spec/src/plugins/ does not exist in the tree, and the declaration is packages/spec/src/integration/connector.zod.ts:869. Stopped on that breach rather than widening. assignee was already set to os-steve by the PM at claim time; I did not write it.",
"tests": "NO build, NO test, NO gate run -- and that is a measurement, not an omission: no file was edited, so there is no diff to verify and a gate run would have measured nothing. The shared verify lock was never taken. Evidence below is read-only measurement on origin/main 1f69917 in worktree /home/user/objectstack-issue-19580 (git status clean, 0 commits ahead of origin/main). || ANCESTRY (repo is NOT shallow: git rev-parse --is-shallow-repository = false; both legs reported per the two-leg rule): 'git merge-base --is-ancestor b929e0a 0870fb5' exits 1 (#19388 was NOT in the tree the card measured); control leg 'git merge-base --is-ancestor 0870fb5^ 0870fb5' exits 0 (a commit known to be in that history answers 0, so the negative reading is valid). Commit dates: 0870fb5 = 2026-09-20T16:46:39Z; b929e0a = 2026-09-20T20:38:56Z. || RE-MEASURE OF THE CARD'S FIVE-ROW TABLE (git grep per file, current main): connector-rest/src/rest-connector.ts -- card said :113 'connectionTimeoutMs: 30000,' / now :134 'connectionTimeoutMs: opts.connectionTimeoutMs ?? 30000,' = a READ of the authored value, the constant demoted to a fallback. connector-openapi/src/openapi-connector.ts -- card said :220 literal / now :242 'config.connectionTimeoutMs ?? 30000,' = same, a READ. connector-mcp/src/mcp-connector.ts:247 -- unchanged, still a bare literal 30000 (card row holds). connector-slack/src/slack-connector.ts:94 -- unchanged, still a bare literal 30000 (card row holds). services/service-automation/src/plugin.ts -- card said :1734 literal / now :1782, still a bare literal, and it is the DEGRADED HUSK path (card row holds for that line). || FOUR READ SITES THE CARD COULD NOT HAVE SEEN (all introduced by b929e0a): packages/spec/src/integration/connector-provider.ts:96 'readonly connectionTimeoutMs?: number;' on the exported ConnectorProviderContext, with 20 lines of TSDoc stating it is carried-not-enforced deliberately so a custom provider on a phase-separating transport can honour it; packages/services/service-automation/src/plugin.ts:1589 'connectionTimeoutMs: entry.connectionTimeoutMs,' -- the materializer carrying the authored value onto that context; packages/connectors/connector-rest/src/rest-provider.ts:64 'connectionTimeoutMs: ctx.connectionTimeoutMs,'; packages/connectors/connector-openapi/src/openapi-provider.ts:193 'connectionTimeoutMs: ctx.connectionTimeoutMs,'. || THREE SHIPPED PINS now hold this behaviour: rest-provider.test.ts:229-240 'carries the declared timeouts onto the def it registers' asserts def.connectionTimeoutMs toBe 5000; connector-materialization.test.ts:845-856 'carries both declared timeouts verbatim' asserts calls[0].connectionTimeoutMs toBe 5000, and :858-866 asserts absence stays absence; connector-fetch-policy.test.ts:17-28 is the ANTI-FAKING pin -- it reds the moment anyone aliases the key onto timeoutMs. || THE 'NOT IMPLEMENTABLE' CLAIM -- VERIFIED, HOLDS. connectorFetchOptions (packages/spec/src/integration/connector-fetch-policy.ts) is the one mapping from declared policy onto the outbound wrapper; its ConnectorFetchPolicy interface carries only retryConfig and requestTimeoutMs, and the function body never touches a connect bound. Probe for any connect-phase hook across packages/ and examples/ (undici, connectTimeout, createConnection, net.connect, new Agent() ) returns ZERO hits in any connector package; lit control on the same corpus (resilientFetch) returns hits, so the instrument reaches it. Notably the hits it DOES return are drivers, not connectors (driver-sql connectTimeout, driver-mongodb connectTimeoutMS) -- which is evidence FOR the seam being real rather than against it: the repo already ships transports of exactly the phase-separating shape the context field is documented to serve. || LIVE-ELSEWHERE EXCLUDED (playbook section 0): sibling ../objectui at 3e4f6324, 'git grep connectionTimeoutMs' exits 1 with 0 lines; lit control 'git grep -c providerConfig' exits 0 with 2 files. Instrument reaches the corpus, so the zero is genuine. Not live-elsewhere. || FORM SURFACE: zero. 'git ls-files packages/spec/src/**/.form.ts' resolves 17 files (instrument lit), zero of which are a connector form; grep for the key across that glob exits 1, and so does the control grep for requestTimeoutMs -- so the retirement kit's Forms row is empty here. || LEDGER: packages/spec/liveness/connector.json props/connectionTimeoutMs = status 'dead', verifiedAt '2026-09-20', last written by b929e0a. || Exit codes above were captured before any pipe (cmd redirected to file, then EXIT=$?); two earlier probes that read a pipe's status were re-run correctly and only the re-run readings are quoted.",
"mcp_calls": "0 -- no MCP GitHub tool was called. Every GitHub read (issue body, claim comment) and the one write went through the REST proxy with curl and GITHUB_TOKEN.",
"api_writes": "1 REST write: POST /repos//issues/19580/comments (this report). Plus 1 git write: 'git push -u origin claude/issue-19580-connector-connection-timeout-ms-retire' -- the mandated empty-branch routing probe, which succeeded (no 403). The branch is on origin at 1f69917 with zero commits, as the claim's landing marker. NOT spent: no POST /pulls (no PR -- see status), no POST /issues/19580/labels (no PR to label), no POST /issues (findings below are handed to the seat, not filed by me). needs:contract-review was left exactly as the PM hung it; I did not touch any label or the assignee.",
"open_questions": [
{
"question": "Which ADR-0049 arm does connector.connectionTimeoutMs take? This is the SECOND ADR-0049 decision that both the card and the liveness ledger row explicitly say the key is owed ('what this key is owed is a SECOND ADR-0049 decision, on a narrower question than the one already ruled: retire it, or re-describe it as something the platform can enforce. Do not flip this row without a consumer'). The card's own section heading is 'Why it needs a decision rather than a dispatch' and it states no preference. The dispatch resolved it by elimination -- a WHATWG fetch cannot observe the connect phase, therefore enforce is unavailable, therefore removal -- but that inference drops two arms that the fetch finding does not touch. Today the key sits in ADR-0049's prohibited FOURTH state: parsed, UNMARKED, unenforced (its describe() text is just 'Connection timeout in ms'). Something must change; which thing is a contract decision, not a dispatch detail.",
"options": [
"A. RETIRE (the dispatched branch). Cost is materially higher than the card knew: it must delete ConnectorProviderContext.connectionTimeoutMs, an exported field visible in dist/.d.ts (so check:api-surface moves), revert two built-in providers to reporting a hardcoded 30000 on the def instead of the authored value (a RUNTIME BEHAVIOUR CHANGE on GET /connectors -- the dispatch explicitly forbade making one silently), delete or rewrite three shipped pins including connector-fetch-policy.test.ts whose entire stated purpose is to stop anyone faking this key, and then pay the full 14-surface retirement kit. It also deletes, four days after it was deliberately built, the seam b929e0a added for custom providers.",
"B. MARK EXPERIMENTAL (ADR-0049 arm 2: 'explicitly marked and documented as not yet enforced, so authoring it is a known no-op'). Smallest change that exits the prohibited fourth state: an '[EXPERIMENTAL -- not enforced]' marker in the describe() text plus a ledger flip from dead to experimental. Everything else the arm asks for is ALREADY in the tree as prose -- connector-provider.ts:88-96 and connector-fetch-policy.ts:57-70 each carry the measured reason. Keeps the custom-provider seam and all three pins. Costs: it leaves an authorable key that the built-in path will never honour, which is exactly the false-promise shape ADR-0049 was written about -- arm 2 is legitimate only if someone owns the roadmap half.",
"C. RE-DESCRIBE it as something the platform can enforce (the card's own second disposition). E.g. redefine the key's meaning to a bound the one AbortSignal CAN express, or rename it so it stops promising a connect-phase guarantee. Needs a semantic ruling first, and would itself be an ADR-0087 conversion, so it is not cheaper than A -- but it is the only arm that ends with an enforced key.",
"D. Split: mark experimental now (B) and file the retire-vs-redescribe question as its own decision card. Exits the prohibited state immediately and leaves the expensive, irreversible half to a ruling."
],
"recommendation": "WITHHELD BY RULE, and this is the honest answer rather than a dodge. My standing contract says an escalation recommendation is given axis by axis against the four-axis decision framework that the dispatch word is supposed to carry verbatim from pm-dispatch SKILL.md, and that I must stop and ask for it rather than invent axes. This dispatch did not carry it. Requesting it. What I will say without axes, as measurement rather than preference: option A's cost is strictly larger than the card's author could have known, because b929e0a landed four hours after their read, and the single fact the card offers for preferring A over B or C -- that the key is inert and merely overwritten by a constant -- is the fact that commit changed."
},
{
"question": "The dispatched file surface is unusable and needs reissuing. 'packages/spec/src/plugins/' does not exist in this tree at all (ls: No such file or directory), and the declaration this card is about lives at packages/spec/src/integration/connector.zod.ts:869. Only packages/spec/src/migrations/ is a real directory, and the retirement playbook forbids landing that half on its own: an entry in RETIRED_KEYS_BY_MAJOR naming a key whose tombstone has not landed reds build-schemas gate (b2) as an unconsumed registration. So every route -- retire, tombstone, or mark experimental -- breaches the surface on its first edit. I stopped rather than widening, per the claim's own instruction.",
"options": [
"A. Reissue with the surface the chosen arm actually needs. Arm B (experimental) needs packages/spec/src/integration/ and packages/spec/liveness/ plus the regenerated baselines. Arm A (retire) additionally needs packages/spec/src/conversions/, packages/spec/src/migrations/, packages/spec/authorable-surface/, packages/spec/authorable-defaults/, packages/connectors/ (four packages), packages/services/service-automation/, content/docs/, and .changeset/.",
"B. Keep the surface and close the card as not-actionable-as-scoped."
],
"recommendation": "A, and after the arm in question 1 is decided -- the surface follows from the arm, so fixing the surface first would just have to be redone."
}
],
"out_of_scope_findings": [
"carrier: whichever PR resolves #19580 (it must rewrite this exact ledger row under every arm) -- NOTED, NOT FILED. packages/spec/liveness/connector.json props/connectionTimeoutMs note, written by b929e0a itself, says the census 'finds every occurrence outside packages/spec to be a WRITE (the four connector def literals, ...)'. In that same commit two of those four stopped being literals: rest-connector.ts:134 became 'opts.connectionTimeoutMs ?? 30000' and openapi-connector.ts:242 became 'config.connectionTimeoutMs ?? 30000'. The note is the cited authority for the dead verdict, so the stale parenthetical is load-bearing -- it is precisely the sentence a later reader turns into 'five writes, zero reads', which is how this card reached me. Not a card because it has a carrier. dedupe: connector liveness note four def literals stale, connectionTimeoutMs census undercount, ledger note write-only parenthetical",
"carrier: the same PR resolving #19580 (it touches every one of these sites under every arm) -- NOTED, NOT FILED. A healthy declarative instance reports the AUTHORED connectionTimeoutMs on its def (rest-connector.ts:134 via rest-provider.ts:64), while the degraded husk reports a hardcoded 30000 (services/service-automation/src/plugin.ts:1782) even though the same file read the authored value into the husk record at :307. Same authored metadata, two different values over the same GET /connectors surface depending on degraded state. I did not run a repro, so I am not calling it class (a); it is also squarely inside this card's blast radius. dedupe: connector degraded husk hardcoded timeout, degraded connector def reports 30000, husk timeout inconsistency"
]
}

---

Generated by Claude Code

[os-steve]

⛔ Seat correction — this card should never have been dispatched, and the dispatch was wrong on three counts, 2026-09-21T13:02Z

The dev refused to implement and returned status: needs_decision with measurements. It is upheld on every point, and each was re-measured by this seat rather than adopted.

1. The card's central measurement is STALE — and the card predicted the very commit that staled it

reading, taken by this seat	value
git merge-base --is-ancestor b929e0a662 0870fb5418f9	exit 1 — PR #19388 was not in the tree this card measured
⭐ control, a commit known to be in that history	exit 0 — the instrument fires, so the negative is real
the card's read	0870fb5418f9, 2026-09-20T16:46Z
when #19388 landed	b929e0a662, 2026-09-20T20:38:56Z — ~4 hours later

⚠️ The card itself says 「its sibling requestTimeoutMs is being made live by PR #19388. When that lands…」. It predicted its own expiry and the prediction came true before anyone read it.

2. ⇒ The finding's first half is no longer true as written

「every one of its five non-spec mentions WRITES a hardcoded 30000」. Measured now:

site	then	now
connector-rest/src/rest-connector.ts:134	literal 30000	opts.connectionTimeoutMs ?? 30000 — a READ, the constant demoted to a fallback
connector-openapi/src/openapi-connector.ts:242	literal 30000	config.connectionTimeoutMs ?? 30000 — a READ
the other three	literal	unchanged, still literals

Plus four read sites that did not exist when the card was written, including an exported field on ConnectorProviderContext carrying 20 lines of TSDoc stating it is carried-not-enforced deliberately, and three shipped pins — one of which exists precisely to red if anyone aliases this key onto timeoutMs.

⇒ what survives is the ADR-0049-relevant fact — nothing ENFORCES it — ⛔ not 「it is inert and overwritten」.

3. The dispatch resolved by elimination, and the elimination was invalid

This seat read the card's 「not implementable as declared」 half and concluded removal. ⭐ The dev verified that half first-hand and it HOLDS — no connect-phase hook exists on any connector path; notably driver-sql and driver-mongodb do have connect timeouts, which is evidence the seam is real rather than imaginary.

⛔ But 「enforce is unavailable」 does not imply 「retire」. ADR-0049's middle arm — explicitly marked and documented as not enforced — is untouched by the fetch finding, as is the card's own second disposition (re-describe it as something the platform can enforce). ⇒ the card says so itself: its own heading reads 「Why it needs a decision rather than a dispatch」, and 「what this key is owed is a SECOND ADR-0049 decision」. This seat dispatched a card that says on its face it is not dispatchable.

4. The file surface in the claim does not exist

packages/spec/src/plugins/ — no such directory. The declaration is packages/spec/src/integration/connector.zod.ts:869. ⭐ The dev stopped on the breach instead of widening, which is what the claim asked for and the right call.

5. And the dispatch omitted the decision framework the dev is required to have

Asked for a recommendation, the dev withheld it by rule — its contract says an escalation recommendation is given axis by axis against the four-axis framework the dispatch word must carry verbatim, and this dispatch did not carry it. ⛔ That is this seat's omission, ⛔ not a dodge by the dev.

State restored

pm:dispatched removed, assignee cleared, needs:contract-review stripped (no PR exists, so no review is owed), needs-user-decision added. The branch claude/issue-19580-… exists on origin at 1f69917c5c with zero commits — the empty routing probe, ⛔ not work.

⇒ the card is back where it started, one measurement richer and with its premise corrected. The decision is put to the maintainer below.

---

Generated by Claude Code

[os-steve]

Decision presented — which ADR-0049 arm connector.connectionTimeoutMs takes, 2026-09-21T16:05Z

This card carries needs-user-decision. The dev returned status: needs_decision with the arms
measured but no recommendation; the seat correction above explains why. This comment puts the
arms in front of the maintainer so a ruling has somewhere to land without reading a 14 740-character
JSON report. ⛔ Nothing here is a ruling. ⛔ Nothing here is re-measured by this seat — every reading
below is attributed to the dev's report (2026-09-21T12:59Z), which this seat has read in full.

Why something must change — ⛔ 「leave it」 is not an arm

At origin/main 1f69917c5c the key sits in ADR-0049's prohibited FOURTH state: parsed, UNMARKED,
unenforced. Its .describe() text is the bare 「Connection timeout in ms」 — nothing in the declaration
tells an author the platform will not honour it, and the key is bounded (min(1000).max(300000)),
defaulted (30000) and served back. ADR-0049 admits three states: enforced, explicitly-marked
experimental, or retired. This key is in none of them.

⇒ the question is which arm, not whether.

⚠️ The ground moved under the card, four hours after it was written

The card measured at 0870fb5418f9, 2026-09-20T17:12Z. PR #19388 landed as b929e0a662 at
2026-09-20T20:38:56Z — the very PR the card's own text predicted (「its sibling requestTimeoutMs
is being made live by PR #19388. When that lands…」). Ancestry, two-leg: --is-ancestor b929e0a662 0870fb5418f9 exits 1; control --is-ancestor 0870fb5418f9^ 0870fb5418f9 exits 0, so the
instrument fires and the negative is real.

What that commit changed, and it is the single fact the card offered for preferring retirement:

the card's claim	reading now
all five non-spec mentions WRITE a hardcoded 30000	two of the five are now READS — rest-connector.ts:134 opts.connectionTimeoutMs ?? 30000, openapi-connector.ts:242 config.connectionTimeoutMs ?? 30000; the constant is demoted to a fallback
the key is carried nowhere	four read sites exist, all minted by b929e0a662, including the exported ConnectorProviderContext.connectionTimeoutMs with 20 lines of TSDoc saying it is carried-not-enforced deliberately, so a custom provider on a phase-separating transport can honour it
nothing pins the behaviour	three shipped pins, one of which (connector-fetch-policy.test.ts:17-28) exists solely to red the moment anyone aliases this key onto timeoutMs — an anti-faking pin

⭐ The card's sharper half was re-verified first-hand by the dev and HOLDS: no connect-phase hook
exists on any connector path (probe for undici / connectTimeout / createConnection / net.connect /
new Agent() across packages/ and examples/ → zero hits in any connector package; lit control
resilientFetch → hits, so the instrument reaches the corpus). The hits it does return are drivers
(driver-sql connectTimeout, driver-mongodb connectTimeoutMS) — which is evidence for the
custom-provider seam being real, not against it.

⇒ ADR-0049's 「enforce it」 arm is closed at the built-in site. The other three are not.

The four arms

arm	what it does	cost, as measured
A — retire	delete the declaration, pay the 14-surface retirement kit	materially higher than the card knew. Deletes the exported ConnectorProviderContext.connectionTimeoutMs (visible in dist/*.d.ts, so check:api-surface moves); reverts two built-in providers to reporting a hardcoded 30000 on the def instead of the authored value — a runtime behaviour change on GET /connectors; deletes or rewrites three shipped pins including the anti-faking one; and deletes, four days after it was deliberately built, the seam b929e0a662 added for custom providers
B — mark experimental	ADR-0049 arm 2: 「explicitly marked and documented as not yet enforced, so authoring it is a known no-op」	smallest arm that exits the prohibited state. An [EXPERIMENTAL — not enforced] marker in the .describe() text plus a ledger flip dead → experimental. Everything else arm 2 asks for is already in the tree as prose — connector-provider.ts:88-96 and connector-fetch-policy.ts:57-70 each carry the measured reason. Keeps the seam and all three pins. ⚠️ Its cost is that it leaves an authorable key the built-in path will never honour — the false-promise shape ADR-0049 was written about. Arm 2 is legitimate only if someone owns the roadmap half
C — re-describe as enforceable	redefine the key to a bound the one AbortSignal can express, or rename it so it stops promising a connect-phase guarantee	needs a semantic ruling first and is itself an ADR-0087 conversion, so ⛔ not cheaper than A — but it is the only arm that ends with an enforced key
D — split	B now; file retire-vs-redescribe as its own decision card	exits the prohibited state immediately; leaves the expensive, irreversible half to a ruling taken with the full retirement kit priced

Seat recommendation — D

Stated as a recommendation, ⛔ not a ruling, and the maintainer may take any arm including one not listed.

1. The prohibited state is the urgent part and it is cheap to exit. B is a marker string and a ledger
   row. Every arm must pay that, so doing it first spends nothing that a later A or C would have to undo
   except the marker itself.
2. A and C are both irreversible-ish and both now cost more than the card priced them. A deletes a
   published exported field and changes a live GET /connectors reading. C needs a semantic ruling the
   repo has not taken. Neither should be decided on this card's framing, because ⚠️ this card's framing
   is stale — it argued from 「five writes, zero reads」 and that is no longer the tree.
3. The seam is four days old and was built on purpose. Deleting it now, on a card whose central
   measurement predates it, is the shape of decision that gets reversed.
4. ⛔ What D does not do: it does not decide retire-vs-redescribe, and it does not pretend the
   false-promise problem is solved. It buys the ruling a clean state to be taken from.

⚠️ The dev withheld its own recommendation, and that is this seat's failure

Its standing contract gives an escalation recommendation axis by axis against the four-axis decision
framework, which the dispatch word is required to carry verbatim from SKILL.md. This dispatch did
not carry it, and the dev stopped and asked rather than inventing axes. ⛔ Not a dodge — the omission is
recorded against this seat in the correction comment above. What it would say without axes it did say,
as measurement: A's cost is strictly larger than the card's author could have known.

Whatever the arm, the file surface must be reissued

packages/spec/src/plugins/ does not exist in this tree, and the declaration is at
packages/spec/src/integration/connector.zod.ts:869. The claim's surface therefore holds no route,
and the dev stopped on the breach rather than widening. Reissue follows the arm:

• arm B — packages/spec/src/integration/ · packages/spec/liveness/ · regenerated baselines.
• arm A additionally — packages/spec/src/conversions/ · packages/spec/src/migrations/ ·
  packages/spec/authorable-surface/ · packages/spec/authorable-defaults/ · packages/connectors/
  (four packages) · packages/services/service-automation/ · content/docs/ · .changeset/.

⛔ The migrations half cannot land alone under any arm: an entry in RETIRED_KEYS_BY_MAJOR naming a key
whose tombstone has not landed reds the build-schemas gate as an unconsumed registration.

Two findings the resolving PR inherits — NOTED, ⛔ NOT FILED (they have a carrier)

1. packages/spec/liveness/connector.json props/connectionTimeoutMs's note — written by b929e0a662
   itself — still says the census 「finds every occurrence outside packages/spec to be a WRITE」.
   In that same commit two of those four stopped being writes. The note is the cited authority for the
   dead verdict, so the stale parenthetical is load-bearing: it is precisely the sentence a later reader
   turns into 「five writes, zero reads」, which is how this card reached the queue.
2. A healthy declarative instance reports the authored connectionTimeoutMs on its def
   (rest-connector.ts:134 via rest-provider.ts:64); the degraded husk reports a hardcoded 30000
   (services/service-automation/src/plugin.ts:1782) although the same file read the authored value into
   the husk record at :307. Same authored metadata, two values over the same GET /connectors surface
   depending on degraded state. ⛔ No repro was run, so it is ⛔ not called class (a).

---

Generated by Claude Code