feat(spec)!: retire connector.connectionTimeoutMs — carried everywhere, applied nowhere - #19657

📓 Docs Drift Check

This PR changes 6 package(s): @objectstack/connector-mcp, @objectstack/connector-openapi, @objectstack/connector-rest, @objectstack/connector-slack, @objectstack/service-automation, @objectstack/spec, touching 31 documentable anchor(s). ⚠️ 10 changed file(s) yielded no anchor (packages/spec/authorable-defaults/integration.json, packages/spec/authorable-surface/integration.json, packages/spec/docs/SYNC_ARCHITECTURE.md, …), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

⛔ 2 release-owned page(s) name something this change touched. These are read-only:

• content/docs/releases/v15.mdx (via ConnectorSchema (symbol, a top-level const))
• content/docs/releases/v17/17-0.mdx (via ConnectorSchema (symbol, a top-level const), DeclarativeConnectorEntrySchema (symbol, a top-level const))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 2b92990ed2f80d167a6def02a1968e5ef0e86ffd && git checkout 2b92990ed2f80d167a6def02a1968e5ef0e86ffd
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 6eaa0f4a81a0146250f083df2b9d000b75dbec61 1e5a44ab640141319360551b9207e711fee8fb47 && git checkout -B drift-repro 6eaa0f4a81a0146250f083df2b9d000b75dbec61 && git merge --no-ff 1e5a44ab640141319360551b9207e711fee8fb47

node scripts/docs-audit/affected-docs.mjs --json 6eaa0f4a81a0146250f083df2b9d000b75dbec61

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 6eaa0f4a81a0146250f083df2b9d000b75dbec61 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 1e5a44ab640141319360551b9207e711fee8fb47

_{Reviewed and posted 2026-09-23T11:03Z by the at-tier review subagent the domain:spec#5 seat spawned — read: card #19580 (all 38 comments; reports treated as claims), the PR body/commits/check-runs, the 31-file diff against merge-base 6eaa0f4a81, AGENTS.md, contract-review.md, the spec-property-retirement skill; ran, in a sibling worktree at the head: safeParse / conversion / registry probes on the head tree and on the pre-retirement base tree, the retirement pin under --project repo (15/15), the migrate-sentence pin (14/14), the connector + conversions + migrations suites (516/516), and the sweeps below; NOT MEASURED: the objectui SPA build against this head (no Console Pin Gate run exists at this head) and the derived gate family (read from CI, never re-run).}

① Derived judgments

• Applied nowhere — confirmed first-hand. At merge-base 6eaa0f4a81, git grep connectionTimeoutMs over non-spec, non-test code files: 13 occurrences / 7 files / 5 packages — 6 reads (plugin.ts:307 fingerprint, :1589 context build, rest-provider.ts:64 + openapi-provider.ts:193 ctx. pass-throughs, rest-connector.ts:134 + openapi-connector.ts:242 ?? 30000 onto the def), 4 type declarations, 3 literal writes. Every read terminates on the echoed def or the fingerprint; connectorFetchOptions() reads { retryConfig, requestTimeoutMs } only (control: requestTimeoutMs resolves to opts.timeoutMs, 22 non-spec code lines). At the card's 0870fb5418: exactly the five literal writes. objectui at .objectui-sha 87af769e9a3e…: 0 hits (exit 1); control DeclarativeConnectorEntrySchema 12 hits; no .extend/.omit/.pick/.partial/.merge/.strict/.keyof/.safeExtend/.superRefine/.shape call on either connector schema there. At head, no authoring survives outside the kit (tree-scoped pin green in my worktree; hand grep agrees — remaining hits are comments, prose and the pins).
• What an author gets (ran, head). ConnectorSchema, DeclarativeConnectorEntrySchema, getMetadataTypeSchema('connector') and ObjectStackSchema each refuse 15000, 1000 and "30000" with code: invalid_type, path: ['connectionTimeoutMs'] (stack: connectors.0.connectionTimeoutMs) and the full prescription — fully-qualified key, removed in @objectstack/spec 17 (ADR-0049 …), names requestTimeoutMs, ends with the os migrate meta --from 17 sentence. 30000 is accepted and stripped on both carriers. Negative controls: the same objects without the key parse; an unknown key is stripped silently (non-strict, unchanged); requestTimeoutMs: 'x' fails at its own path. Base-tree control: the pre-retirement schema emits connectionTimeoutMs: 30000 for an entry authoring only name/label/type, and the write door retained 4321 — so the residue stage and the D2 are both owed, as the PR says. tsc channel: z.input is never (pin with @ts-expect-error green).
• Registration. RETIRED_KEYS_BY_MAJOR[18] holds integration/Connector:connectionTimeoutMs and integration/DeclarativeConnectorEntry:connectionTimeoutMs once each, no other major. D2 connector-connection-timeout-ms-removed: toMajor: 18, retiredFromLoadPath: true, fixture disjoint, one attributed notice at connectors[0].connectionTimeoutMs, replay idempotent (0 notices, same reference), silent on the default load path, and applyConversionsToStoredItem('connector', …) strips the key with requestTimeoutMs intact. D3 connector-provider-context-connection-timeout-ms-retired present in step 18 with non-empty reason / acceptanceCriteria naming requestTimeoutMs. RETIRED_DEFS_BY_MAJOR[18] untouched (only the pre-existing integration/ConnectorErrorCategory).
• ⭐ step18.rationale after two conflict resolutions — whole and once. All 86 of main's rationale lines appear in head byte-exact and exactly once, except main's last line whose closing quote-comma becomes a trailing space inside the string (the same edit fix(spec): retire tenancy.organizationField from the authorable surface (#19054) #19618 made to feat(spec)!: split the translation bundle type — settings is a platform group, not a per-app one (#15178) #19600's line); the feat(spec)!: split the translation bundle type — settings is a platform group, not a per-app one (#15178) #19600, fix(spec): retire tenancy.organizationField from the authorable surface (#19054) #19618 and this PR's paragraph heads each occur exactly once; exactly one quote-comma terminator; conversionIds = main's 33 in main's order plus connector-connection-timeout-ms-removed, no duplicates. The semantic[] and RETIRED_KEYS_BY_MAJOR regions differ from main only by this PR's entries.
• Liveness ledger. Row stays dead, verifiedAt 2026-09-22, REMOVED note — correct for the tombstone route. README connector row: the 44-dead partition re-summed from connector.json (syncConfig 8, fieldMappings 7, health 15, triggers 6, webhooks 1, status 1, metadata 1, actions 2, three top-level tombstones 3 = 44); six tombstone rows by name; state-counts.md row 29/1/44 (unchanged, consistent). _note claims re-derived at head: fingerprint hashes exactly nine keys (has provider, no enabled); authentication declared .optional().default({ type: 'none' }) at :893, non-none value refused at :1168; the connector-rate-limit-config-removed fixture comment (:4503) and the field-mapping-transform-removed "Execution: none" line (:4544) are quoted as they read; ConnectorTrigger docblock verbatim; retryConfig at 14fdebd766 = 67 lines / 77 occurrences / 15 files; syncConfig outside spec = two comment lines in the dogfood ledger; objectui dda8f3815 previews = 22 distinct types / 20 components, connector absent; both carriers expose 30 identical keys. One overtaken count — non-blocking (iv).
• Baselines and docs. authorable-surface/integration.json +2 [RETIRED]; authorable-defaults/integration.json −2 = 30000; api-surface/ and json-schema.manifest/ untouched — correct for a key-only tombstone (api-surface records ConnectorSchema (const) by name only); dropped-refinements.baseline.json moves exactly the 5 connector sites onto .out. content/docs/references/integration/connector.mdx is AUTO-GEN and mirrors the docblock; its currency rests on check:docs inside the green required TypeScript Type Check job (not re-run here). No hand-written content/docs, skills/, examples/, *.form.ts or i18n surface carries the key; packages/lint and packages/qa/dogfood have no row to move.
• Console Pin Gate. Not affected by reading: objectui imports the two schemas only to safeParse. The SPA build against this head is NOT MEASURED (the gate was skipped, see CI). The sibling break is a structural test assertion, optOuts.test.ts:468 checks(DeclarativeConnectorEntrySchema): 1 on the base tree, 0 at head (both measured); objectui#10211 open, AGENTS.md §4 promises the pinned sibling is protected, but Console Pin Gate only BUILDS it — a break that reds objectui's tests is invisible to every gate in both repos #19692 closed not_planned.
• Shipping-sentence sweep (normalised: */// stripped, backticks dropped, ' + ' seams joined). Verified: the thirteen/seven/five census and the five-writes census with their trees; the nine siblings (8 retryConfig + requestTimeoutMs); allowPurge carries D2 (:8595) and the residue stage (permission.zod.ts:563, the EffectiveObjectPermissionSchema route at :595); the two non-residue siblings are registered keys; combinators: eight gone on both carriers, superRefine survives and returns a schema with no shape (all measured against a plain-object control that keeps all nine); Clause-②: yes (narrowing) (the ruling wrote no; the claim corrected it to yes, which is what AGENTS.md's closed pair requires for a removal). Flagged — all non-blocking: (i) changeset: "a published interface member leaves ConnectorProviderContext" — the member entered with b929e0a662 (2026-09-20), after the last tag @objectstack/*@17.4.0 (2026-09-09; npm latest 17.4.0), so no release ever carried it; same for RestConnectorOptions.connectionTimeoutMs / OpenApiConnectorConfig.connectionTimeoutMs. (ii) "five sites … READ" (schema docblock, conversion docblock, pin header, rationale) vs "six reads" (changeset, entry, ledger row, PR body) — same set, the two ?? 30000 fallbacks counted as one site or two. (iii) changeset + entry: "the tombstoned build refuses that exact object at connectors.0.connectionTimeoutMs" — head accepts-and-strips it (residue stage); true only of the tombstone without the stage. (iv) ledger _note: "fieldMappings occurring on 14 lines over 6 files outside packages/spec" cites no tree; 14/6 at 9e2843a4d3, 15/7 at head after main's b22e3f7646 added skills/objectstack-upgrade/evals/protocol-major-upgrade.json (the gloss "prose, no read" still holds). (v) PR body: "objectui resolves @objectstack/spec from the registry at ^17.0.0, so main does not go red on merge" — the gate injects the local spec dist (OBJECTSTACK_SPEC_DIST); the real reasons are that the gate only builds (tsc && vite build) and its path filter does not fire on this diff. Not re-measured (historical censuses): the 19-open-PR / 283-row file census and the local gate tallies. Model identifiers: swept for every model-identifier spelling over the diff, the changeset, the PR body and all 19 commit messages — zero hits; control file 2 hits; commit trailers are the model-free pair.
• CI at the head (35 check-runs, 35 distinct names, de-dup needed none; latest started_at 2026-09-23T08:38Z): 33 success, 2 skipped, 0 failure. Skips: Console Pin Gate — needs.filter.outputs.console == 'false' (its paths are .objectui-sha, the five console scripts and ci.yml; none in the diff); Packed-tarball smoke (opt-in) — opt-in label needs:pack-smoke absent. Check Changeset (runs check-changeset-no-major and check-adr-0087-registration), Spec property liveness, Lint & Repo Gates and TypeScript Type Check all green. mergeable_state: clean.

② Semver level

Correct. @objectstack/spec: minor (the launch-window gate refuses major; Check Changeset green) carrying the BREAKING banner, the FROM → TO table and the one-line fix, Clause-②: yes (narrowing), and exactly one ADR-0087 marker <!-- adr-0087: registered connector-connection-timeout-ms-removed, connector-provider-context-connection-timeout-ms-retired --> — both ids exist in the registries. patch on connector-rest, connector-openapi, connector-mcp, connector-slack, service-automation is defensible: nothing those packages published is removed (the option fields are post-17.4.0), and the one observable change — the def GET /connectors echoes no longer carries connectionTimeoutMs — is declared in the changeset.

③ Boundary flags

Dev flags, each answered on the card: content/docs/references/…/connector.mdx regenerated outside the fence (AUTO-GEN per the Documentation Guardrails; releases/ untouched) — accepted; the five consumer packages forced by tsc — accepted; the vitest.repo-tests.json line demanded by check:cross-package-test-inputs — accepted, and the pin's radius is declared (turbo @objectstack/spec#test:repo inputs carry packages/** by extension, examples/** non-code, content/**, skills/**, scripts/** — exactly the pin's roots and extension sets); dropped-refinements.baseline.json — accepted; README widening — accepted; PR-body edits deferred to the seat — present at head. Round-6 open question (two pending fragments) → option A, #19729 — closed via #19746, which is in this head. open_questions: [] on the merge-round report; the two merges verified above.

Blocking: none.
Non-blocking:

1. ⚠️ Escalate before changeset version — unnamed by any round: .changeset/18975-connector-retry-config-and-request-timeout.md (pending, @objectstack/spec: minor) will publish into the same 17.5.0 CHANGELOG entry as this changeset the sentences "ConnectorProviderContext gains retryConfig, connectionTimeoutMs and requestTimeoutMs" and "connectionTimeoutMs … is carried onto ConnectorProviderContext (a custom provider … may honour it)". Unlike Two PENDING changesets ship false connector-ledger mechanism claims into CHANGELOG.md — and they are two different classes, only one of which may be corrected #19729's class 2, that state is never released, so the entry would describe a member 17.5.0 does not have while this entry says it was removed. Outside this diff by the seat's own Two PENDING changesets ship false connector-ledger mechanism claims into CHANGELOG.md — and they are two different classes, only one of which may be corrected #19729 rule; needs the docs(changeset): correct two false mechanism claims in a pending connector-ledger note #19746 route (docs-only correction, maintainer countersign) or an explicit seat authorisation to absorb those two clauses here. Seat's call.
2. Changeset wording (i): say the ConnectorProviderContext member and the two options fields were added after 17.4.0 and never published; the Clause-② sentence should rest on the authorable key alone. Wording (iii): "the tombstone without the stage refuses …". Count (ii): pick "six reads" or "five sites" once, tree-wide.
3. Ledger _note (iv): add the tree (9e2843a4d3) or re-cite 15 lines / 7 files at head — the row's own lesson.
4. The merge-round report's "to file (a)" finding (check:type-check-debt --re-measure spawns an unlocked whole-repo turbo build that clobbers dist under os-verify-lock) has no card — only check:type-check-debt --re-measure trusts stale dist/: phantom upward drift for ledgered packages whose deps resolve to build artifacts, unless the caller builds the closure first #8271 (closed, a different defect). Seat to file.
5. objectui#10211 (open) is the pin-bump-time break; no bump rides here, per the standing rule.

Implemented-by: claude/issue-19580-retire-connector-connection-timeout
Reviewed-by: session_01Sfe5YjBLwB9J3y8fvm2xq1 — at-tier review subagent spawned by the domain:spec#5 seat

VERDICT: PASS