docs(changeset): correct two false mechanism claims in a pending connector-ledger note - #19746

Route 0 confirmation — DELIBERATE CORRECTION, awaiting a countersignature

pr-automation.yml route 0 asks for this in writing on the PR, so it is here as a thread entry as well as in the body.

The note. .changeset/18582-connector-analytics-cube-liveness-ledgers.md — "@objectstack/spec": patch, pending, added by 559041d39d, present on this PR's merge base and not added by this PR.

What changed under it. Exactly two sentences on line 9, both established false when written against instruments read at 559041d39d^:

1. authentication was called "refused outright by ADR-0097 §3, never ignored". The schema accepts and defaults the key (.optional().default({ type: 'none' })); only a non-none value is refused; ADR-0097 §3 rejects inline secrets, not the key. The ledger row seeded by the same commit already said the correct thing.
2. The key-reach enumeration double-counted name (itself a ConnectorProviderContext field), over-included the host-injected loadPackageFile, and omitted provider (read on the authoring door, absent from the context).

Old and new text quoted verbatim in the PR body, with the per-claim measurements.

What did not change. The dated measurements on the same line — the property counts and the dead-subsystem list — and the other three carriers. Those were accurate when made; overwriting them would falsify history rather than correct a record.

The red is intended. Check Changeset stays red, skip-changeset is deliberately not applied, and the base copy must not be restored. ⛔ Please do not turn that check green — every other check should be green.

Asked of a reviewer: confirm in this thread that correcting this pending release note is agreed, and merge over the red.

Generated by Claude Code

Seat note — the red is expected, and TWO different things are outstanding

From the domain:spec execution seat 1 (session session_013RDBh5DqXd2xnLwvHLgLFr) at 2026-09-22T20:03Z. ⛔ Not repeating the route-0 confirmation above — it is complete and its measurements stand. This names who can supply what, because the comment above asks 「a reviewer」 and that word covers two acts this seat must keep apart.

The failing check is ⛔ not a defect, and was declared before the work started

Check Changeset → failure (run 106913822367). That is pr-automation.yml route 0 behaving as designed for a DELIBERATE CORRECTION. This seat declared it in the dispatching claim (5782920710) before the dev began, precisely so nobody would later read it as a broken PR.

⇒ ⛔ This is not the 「red CI is work now」 case. ⛔ Do not restore the false sentence to turn it green, and ⛔ do not apply skip-changeset. Every other check is clean.

Two outstanding items, ⛔ different acts, ⛔ different signatories

1. The at-tier contract review — the seat's to arrange, ⛔ NOT a countersignature.
check-clause2-carriers --pair 19746 row C6: no review of record exists on head 752992dd28. ⚠️ Note its basis is the lane rule — the spec lane owes a review on every round it delivers — ⛔ not the path limb, which does not fire on a .changeset-only diff. This seat arranges it through an isolated at-tier subagent and posts the record. ⛔ No human is owed anything for this one.

2. The route-0 countersignature — a HUMAN act, and ⛔ this seat cannot supply it.
Route 0 asks for agreement that correcting a pending release note is wanted. ⛔ This seat opened this PR, so signing off on it would be self-approval; ⛔ the red lines forbid approving or merging a managed-surface PR on this seat's own authority. ⇒ this one genuinely waits on a person, and it is being raised to the maintainer rather than left implied in a thread.

⚠️ A PASS on item 1 does ⛔ NOT discharge item 2. A contract review judges whether the correction is right; the countersignature is agreement that rewriting a pending release note is wanted at all. Landing on the review alone would be this seat deciding the second question by omission.

The clock, restated because it is the reason this card jumped the queue

Both fragments are pending. changeset version deletes the fragment and publishes its text into CHANGELOG.md, and PR #17076 (chore: version packages) is open. ⇒ if that lands first, the false sentence ships as a released changelog entry and the correction becomes history-rewriting rather than a record fix.

⛔ That is a reason to answer, ⛔ never a reason to merge without the answer.

Generated by Claude Code

Served-tier: 91/91 CONTRACT_REVIEW_TIER (seat-measured, 2026-09-22T20:21Z)
Head-sha: 752992d

Subject: objectstack-ai/objectstack PR #19746 (claude/issue-19729-connector-ledger-changeset-claims, Part of #19729). Base main @ 16d090ede01e8e940313364603a254a659a2355b — re-derived as the merge-base at 2026-09-22T2007Z. Diff re-derived at head: exactly one row, M .changeset/18582-connector-analytics-cube-liveness-ledgers.md, +1/−1, line 9 only. Reviewer: isolated at-tier subagent for seat domain:spec#1. ⛔ No GitHub write of any kind was made. Every tree reading below was taken from origin/main, refs/pull/19746/head, refs/pull/19657/head or 559041d39d^ fetched into owned refs, never from the shared working tree; the probe script and its output are at scratchpad/pr-19746/probes.sh / probes.log.

Tier control: origin/main:scripts/pm/dispatch-gates.mjs:12282 reads export const CONTRACT_REVIEW_TIER = 'claude-fable-5-1'; (read 2026-09-22T2008Z). The served-tier count is the seat's to take from the transcript's per-request harness model stamps; this reviewer's self-report is not admissible and is not offered. No fallback, overload or quota notice was observed at any point in this run.

① Derived judgments

Trees: S = 559041d39d^ = 684146bb480bead0cea1882758f9d03b7cad9c23, the parent of seeding commit 559041d39da63b67… (2026-09-17, "govern connector + analytics_cube in the liveness ledger", an ancestor of origin/main); M = origin/main = 16d090ede0; H = PR head 752992dd28; N = PR #19657 head 9e2843a4d31da6cb185c5c33631691650373add4. The fragment is byte-identical at 559041d39d, at base and at M (empty git diff, 2026-09-22T2007Z), so H's − line is the seeding-time text and "judge against the tree it was written on" means S.

(a) old — «authentication is planned: refused outright by ADR-0097 §3, never ignored.» — FALSE at S (re-derived 2026-09-22T2008Z)

• The key is accepted and defaulted: packages/spec/src/integration/connector.zod.ts:753 @s — authentication: ConnectorAuthConfigSchema.optional().default({ type: 'none' }). Dark control on the same file: authentification → 0.
• Only a VALUE is refused: connector.zod.ts:970 @s — if (entry.authentication && entry.authentication.type !== 'none') adds the custom issue; the descriptor-branch message at :976 prescribes "drop authentication (or set { type: 'none' })", which is sayable only if the key is accepted.
• ADR-0097 §3 @s (docs/adr/0097-declarative-connector-instances.md:69-71) is headed "3. Credentials are references" and says "Inline secrets in stack metadata are rejected at authoring/publish (lint + schema)." — inline secrets, not the key. Its body is byte-identical at M.
• "never ignored" is contradicted by the ledger row the SAME commit seeded: 559041d39d:packages/spec/liveness/connector.json → props.authentication.note = "the only value an author may write is { type: 'none' } … Not live: the accepted value does nothing". The file does not exist at S (git cat-file -e → exit 128), so no later tree is involved: the seeding commit contradicts its own changeset.
  ⇒ Both halves were false when written. Class 1 confirmed at source, independently of the card's table.

(a) new — TRUE at S and at M (read 2026-09-22T2008–2012Z)

• "the key is accepted and inert rather than refused: the schema declares authentication: ConnectorAuthConfigSchema.optional().default({ type: 'none' })" — verbatim at S :753 and at M :776.
• "so it parses and the accepted value reaches no consumer" — census \.authentication\b over the whole tree minus packages/spec, CHANGELOGs, tests, docs/, content/: 0 hits at S and 0 at M. Firing control (same instrument, the sibling key the factories DO read): ctx.auth / entry.auth → 5 hits at S and 5 at M (mcp-provider.ts, openapi-provider.ts, rest-provider.ts, plugin.ts×2). Dark control: \.authentification\b → 0. Token sweep \bauthentication\b over runtime src (non-test, non-comment): the only connector-related hit at either tree is a WRITE — authentication: { type: 'none' } in buildDegradedHuskDef (plugin.ts:1733 @s, :1781 @m). Who executes/prints it: nobody — which is the claim.
• "while the [security] sys_metadata.metadata is a general cleartext sink: any authored artefact whose schema permits an inline credential lands it there (datasource config.password, connector authentication) #7990 cross-field rule loudly rejects every non-none value and names auth: { type, credentialRef } as the mechanism to use instead" — :970-976 @s, :993-999 @m; both branch messages name auth: { type, credentialRef }; #7990 occurs 4× in connector.zod.ts at each tree, on this rule's docblock ("One rule applies to EVERY authored entry ([security] sys_metadata.metadata is a general cleartext sink: any authored artefact whose schema permits an inline credential lands it there (datasource config.password, connector authentication) #7990, maintainer-ruled 2026-08-12)") and its inline comment. Who executes it — both authoring doors: packages/spec/src/stack.zod.ts:703 @s / :707 @m connectors: z.array(DeclarativeConnectorEntrySchema) (the defineStack door), and packages/spec/src/kernel/metadata-type-schemas.ts:254 (both trees) connector: DeclarativeConnectorEntrySchema in UNREGISTERED_KIND_SCHEMAS, reached through getMetadataTypeSchema's fallback at :299 (the PUT /meta/connector/:name door). Dark control: DeclarativeConnectorEntrySchemas (plural) → 0 at both trees.
• "ADR-0097 §3 ("Credentials are references") backs that refusal of inline secrets — it does not refuse the key." — heading and body as above at S; identical at M.
  ⇒ The date-neutrality claim holds: the sentence names no count and no enumeration, and every instrument it names reads the same at S and M (only line numbers drift, :753→:776, :970→:993). Read additionally at N (:893, :1168): still true there, even though N rewires the entry schema from superRefine to a z.preprocess pipe — relevant because feat(spec)!: retire connector.connectionTimeoutMs — carried everywhere, applied nowhere #19657 may land before chore: version packages #17076.

(b) old — «The keys an authored entry can actually reach are the ConnectorProviderContext fields plus name and enabled;» — FALSE at S (re-derived 2026-09-22T2008Z)

• name double-counted: packages/spec/src/integration/connector-provider.ts:58 @s — readonly name: string is the first field of ConnectorProviderContext (:57-78).
• loadPackageFile over-included: on the interface at :77, whose own docblock (:65-76) opens "Host-injected package file reader"; the materializer sets it from the host, packages/services/service-automation/src/plugin.ts:1546 @s — loadPackageFile: createPackageFileLoader(this.options.packageRoot). No authored key reaches it.
• provider omitted: plugin.ts:1451 @s — if (typeof entry.provider !== 'string' || entry.provider.length === 0) continue; gates the desired set; :1494 — const provider = entry.provider; then engine.getConnectorProvider(provider) selects the factory. provider is on no field of the interface and absent from the providerCtx literal (:1535-1547).
  ⇒ Three counts, each false when written.

(b) new — TRUE at S and at M (read 2026-09-22T2012–2013Z)

Completeness control first: every distinct entry.X / bound.X / c.X property read in plugin.ts was enumerated with grep -o (20 distinct accesses at S, 23 at M — the instrument fires; dark control entry\.providerr → 0).

• Reads on the connector authoring paths at S: name, provider, enabled, label, description, icon, type, providerConfig, auth; at M additionally retryConfig, connectionTimeoutMs, requestTimeoutMs. Every other hit (shadowing, definition, flowName, triggerType, effect, reason) sits in the flow loops (:819, :943-952, :1133) — not connector reads (control: the instrument sees them and they are attributable).
• Attribution: label/description/icon/type/providerConfig/auth → providerCtx fields (:1535-1547 @s); at M the three [Decision] ADR-0049 欠 ConnectorSchema.retryConfig(8 个子键)与 connectionTimeoutMs / requestTimeoutMs 一次裁定 —— 账本已记 dead 并自陈「欠的是裁定不是清扫」,而退休会拿掉文档对 429 的唯一建议(#18794 的另一半) #18975 keys are threaded onto the context in the same literal (which now ends at :1594) and the interface carries them (connector-provider.ts:83, :96, :101 @m). They therefore fall under "author-supplied ConnectorProviderContext fields" without the sentence naming them — which is precisely why this replacement is date-neutral where the fixed enumeration in .changeset/18983 was not.
• name is author-supplied: providerCtx.name is the desired-map key taken from entry.name (:1450-1458 @s).
• provider "never reaches the context yet decides on the authoring door whether the entry is materialized at all and which factory does it": no interface field at S or M; read at :1451/:1494 @s and :1470/:1513 @m — the continue gate and getConnectorProvider(provider) are exactly those two decisions.
• enabled: if (bound.enabled === false) continue; (:1453 @s, same at M) plus c.enabled !== false in findInertDeclaredConnectors (:407 @s, :426 @m).
• loadPackageFile host-injected: :1546 @s, :1594 @m.
• One read outside the set, judged rather than skipped: findInertDeclaredConnectors reads a descriptor's (c.actions?.length ?? 0) > 0 (:406 @s, :425 @m) solely to emit the Declarative connectors: stack entries are inert — bridge them to the automation connector registry or document as descriptor-only #2612 boot warning that the descriptor is inert. The ledger's own actions.key row seeded by 559041d39d classifies this: "Live on the PLUGIN/provider door, inert-and-audited on the authoring door … That warning is the Declarative connectors: stack entries are inert — bridge them to the automation connector registry or document as descriptor-only #2612 contract made audible; it is not dispatch." A diagnostic that fires because the key reaches nothing is not the key reaching a consumer; the sentence's set is consistent with the ledger it summarises. Observation, not a finding.
  ⇒ True at both trees; the three moves (provider in, name folded into the context fields, loadPackageFile out as host-injected) each verified at source, with a positive control per instrument.

What deliberately did not change — leaving it is right

• "74 properties: 20 live, 1 planned, 53 dead" is the generated row in packages/spec/liveness/state-counts.md at 559041d39d (:67 — | \connector` | 20 | 0 | 0 | 53 | 1 | 74 |). Independent leaf walk of connector.json(nesting viachildren, 8 container rows) at 559041d: 67 leaves = 13 live + 1 planned + 53 dead — the deadandplannedaddends reproduce exactly; the generatedliveof 20 additionally counts container rows by the generator's own rule, which was not re-derived here. At M the generated row reads29 | 0 | 0 | 44 | 1 | 74 (:68) and the walk gives 22 live + 1 planned + 44 dead: deadandplanned` reproduce exactly again, and the live delta (+9 leaves, +9 generated) matches. True when written, overtaken now — the class-2 description exactly.
• retryConfig in the "four declared subsystems with no engine" list: its 8 sub-keys are all dead at 559041d39d and all live at M ([Decision] ADR-0049 欠 ConnectorSchema.retryConfig(8 个子键)与 connectionTimeoutMs / requestTimeoutMs 一次裁定 —— 账本已记 dead 并自陈「欠的是裁定不是清扫」,而退休会拿掉文档对 429 的唯一建议(#18794 的另一半) #18975). True when written, overtaken.
• Judgment: a dated release note that recorded a correct measurement must not be re-measured under the old date; that would put a 2026-09-22 count under a 2026-09-17 record. Leaving the counts beside the corrected sentences does not make line 9 inconsistent: new (a) says planned, matching "1 planned"; new (b) is a rule, not a count; the retained "type and icon reach that context and are dropped by all three shipped provider factories" still reads correctly against new (b). The card left a dated "as of [Decision] ADR-0049 欠 ConnectorSchema.retryConfig(8 个子键)与 connectionTimeoutMs / requestTimeoutMs 一次裁定 —— 账本已记 dead 并自陈「欠的是裁定不是清扫」,而退休会拿掉文档对 429 的唯一建议(#18794 的另一半) #18975" note to the taker's judgement; the dev's NO is sound (such a note would ship into CHANGELOG.md beside counts it does not correct).
• Untouched carriers .changeset/18614…, .changeset/18983…, packages/spec/src/conversions/registry.ts: confirmed absent from the diff (one M row total).

强制条款② (clause-②) reading

• Path limb (packages/spec/src/**, SKILL.md :648 @m): the diff's only path is under .changeset/ — the limb does not fire.
• Declaration limb (SKILL.md :649): the card's dispatching claim 5782920710 declares Clause-②: no; the fragment itself carries a pre-existing Clause-②: no trailer (:15, present at base and untouched — 70 of 602 fragments at M carry such a trailer; check-changeset-no-major.mjs's level axis reads it). No yes on any carrier, and none is owed: verified at H that nothing moves an accept set, a published key or a default and no refusal is deleted — the diff touches no .ts, no .json, no schema, no ledger.
• This review exists by the lane rule, ⛔ not by the path limb: scripts/pm/check-clause2-carriers.mjs:331-370 @m (C6, lane-keyed by charter conflict: does a Clause-②: no PR that touches no contract surface still owe an in-seat review before it can land? #18536) owes a CONTRACT_REVIEW_TIER record on every delivered round of a card in the spec or skills lane, Clause-②: yes or no; the card carries domain:spec.

Checks on head 752992dd28 — GitHub check-runs, newest per name, read 2026-09-22T2007Z and re-read 2026-09-22T2010Z; nothing re-run locally

• Check Changeset — failure, job 106913822367 (run 35777351995). Log read: the Require a changeset step counted ADDED=0 against merge base 16d090ede0… and exited 1 after printing route 0 verbatim ("If every row is M or D and none is A … the DELIBERATE CORRECTION class … LEAVE THIS CHECK RED"; "not one of the required contexts"). The discriminator re-derived here: git diff --name-status 16d090ede0 refs/pull/19746/head -- '.changeset/*.md' → exactly one row, M. Expected red; not a finding.
• Lint & Repo Gates — in_progress at the 2007Z read (NOT MEASURED then); success at the 2010Z re-read (completed 20:09:36Z).
• The other 24 runs: success, or skipped by the path filter job (Test Core shards, Dogfood, Console Pin Gate, Build Core/Docs, Temporal, Packed-tarball opt-in). No check is red for a reason other than route 0.

② Semver level

Frontmatter "@objectstack/spec": patch, unchanged by this PR. The fragment records two data files (liveness/connector.json, liveness/analytics_cube.json) added inside the package and states "No schema changed and no verdict moved"; correcting its prose does not change the act it records, and ① shows no accept set, export, key or default moving at H. The fragment declares Clause-②: no, so the level axis in check-changeset-no-major reads not-declared. @objectstack/spec is in .changeset/config.json's single fixed group (spec present: true), so the group's bump for this fragment stays patch either way. patch is right for what the fragment now says.

③ Boundary flags

1. Route-0 red is expected (Check Changeset, job 106913822367) and is the mechanism that puts the decision in front of a person: ⛔ do not turn it green, ⛔ no skip-changeset, ⛔ do not restore the base copy. The written confirmation is on the PR (body + comment 5783188219), and the seat declared the red in claim 5782920710 at 19:46Z, before the PR existed (19:59Z).
2. The route-0 countersignature is a human act and is ⛔ not discharged by this record (the seat's comment 5783245759 already separates the two). PR state at read: draft: true, mergeable_state: blocked.
3. The clock is real: PR chore: version packages #17076 chore: version packages is OPEN (head 1457473dbf, base 16d090ede0, updated 2026-09-22T18:20Z). Per Prime Directive Add missing Field.phone() helper and factory methods for Action/Dashboard/Report #15 no AI seat merges, queues or arms it; the reason to answer quickly is not a reason to land without the answer.
4. Acceptance-note 1 verified. At M, packages/spec/liveness/README.md:942 (the connector row) and packages/spec/liveness/connector.json:3 (_note) still carry the old wording — refused outright|plus \name` and `enabled` fires on both. At N (9e2843a, fetched into an owned ref): connector.json→ 0 hits for either pattern and its_notereads "exactly the AUTHOR-SUPPLIEDConnectorProviderContextfields plusproviderandenabled"; README.md:942 still matches the naive regex, but only inside a negated quotation (⛔ NOT "refused outright" — the former tail here said exactly that), while the firing control finds the new wording on the same line ("author-supplied … plus providerandenabled", "host-injected rather than authored"). So both carriers ARE corrected on #19657's unmerged head; there the zero is sentence-level, not byte-level. N does not touch .changeset/18582…(empty diff) and is not on top of M (merge-base5ce3705`) — no collision with this PR.
5. Acceptance-note 2 verified. The card's "can be lifted verbatim from packages/spec/liveness/README.md:942" is false at M — that line carries the OLD wording (hit above); the corrected text exists only on N. The dev derived the wording at source instead; it agrees with N's in substance. The card's cited head 657788103c was not fetched here.
6. Observation, no carrier owed: the descriptor-path actions.length read in findInertDeclaredConnectors (①(b)) is consistent with the ledger's actions.key note.
7. Observation: .changeset/** is on no GOVERNED_SURFACES row (scripts/pm/check-governed-merges.mjs:1056-1061 @m: docs/adr/**, .claude/**, skills/**, AGENTS.md, CLAUDE.md, docs/NORTH-STAR.md), so this is not a governed-surface PR; the landing bar is route 0's countersignature plus this record.

Implemented-by: claude/issue-19729-connector-ledger-changeset-claims
Reviewed-by: session_013RDBh5DqXd2xnLwvHLgLFr
VERDICT: PASS — both replacement sentences are true at 559041d39d^ and at origin/main against source, the two sentences they replace were false when written, nothing else in the fragment or the repository moves, and the only red check is the route-0 red the workflow prescribes.

Tier control — measured by the SEAT from the reviewer's transcript, ⛔ not reported by the reviewer

The reviewer declined to count itself and said so in the record, which is right: a self-description is not a reading, and self-counts on this seat have run 4–6× low every time they have been tried. get_session is ⛔ not admissible as corroboration either — it measures the dispatching session, ⛔ not the subagent. So the seat counted the harness's own per-request stamps in the subagent's transcript, ⛔ without loading the file.

• 91 assistant requests, 91 stamped claude-fable-5-1 — every per-request "message":{"model":…}, no exceptions.
• 197/197 on the superset: 106 "model" plus 91 "advisorModel", all the same value.
• Dark control: empty. Filtering every "model" / "advisorModel" occurrence for anything other than claude-fable-5-1 returns nothing at all.
• Fallback / overload sweep: 40 keyword hits, ⛔ none of them a notice. Read in context, every one is prose: tool-schema descriptions that happen to use the word, the dispatching order's own sentence instructing the reviewer to report a notice if it saw one, the reviewer's own sentence saying it saw none, and repo text about ?? fallbacks and getMetadataTypeSchema's unregistered-kind fallback. ⛔ No platform notice fired, so nothing voids the verdict.
• CONTRACT_REVIEW_TIER re-read at source: origin/main:scripts/pm/dispatch-gates.mjs — export const CONTRACT_REVIEW_TIER = 'claude-fable-5-1';

What this record does ⛔ NOT discharge

⚠️ The route-0 countersignature is a human act, and a PASS on this review is ⛔ not it. The two are separate and were separated on this PR before the review was arranged (seat note 5783245759). pr-automation.yml's route 0 asks for the confirmation to be 「get it confirmed there in writing」 and says plainly that 「the approver merges over it」 — the red is the mechanism that puts the decision in front of a person, so this seat arming auto-merge would route around the very thing the gate exists to do.

⇒ This PR stays draft with Check Changeset deliberately red. ⛔ Not because anything is wrong with it, and ⛔ not because CI is unhappy: 25 of 26 checks on this head are success or path-filtered skipped, and the 26th is the red the workflow prescribes.

Generated by Claude Code

Maintainer instruction — skip-changeset applied and this PR sent to the merge queue, overriding ruling D for this PR

domain:spec execution seat 1 (session_013RDBh5DqXd2xnLwvHLgLFr, seat post #6017), 2026-09-23T07:06Z. The seat acts on the maintainer's instruction, with provenance:

• Who: the maintainer, in this seat's own session.
• Words, verbatim: 「立卡更新我的决裁,这两个你直接打标签跟进合并。」
• Where: the chat of session_013RDBh5DqXd2xnLwvHLgLFr, replying to this seat's report that docs(changeset): correct two false mechanism claims in a pending connector-ledger note #19746 and docs(changeset): correct four statements in the pending enableOnInstall one-authority note #19747 were red only on Check Changeset (route 0, ruling D on [finding] the skip-changeset label suppresses the DELIBERATE-CORRECTION refusal whose own text says 「no label and no diff shape makes that safe」 — declared contract against enforced behaviour #18375).

⇒ The two PRs are #19746 and #19747. This PR gets skip-changeset despite ruling D (batch #158 item 1, which says the label is never applied to a PR that edits an existing changeset), and the seat takes it through the merge queue. The ruling itself is being updated on its own card, filed in the same act.

The at-tier review at this head is a PASS (5783531345).

Nothing else changes: the head stays as reviewed, the queue runs every required check, and the seat verifies the landing by content on origin/main after merge.

Generated by Claude Code

Confirmation of record (ruling D ② B) — replaces the label route

domain:spec execution seat 1 (session_013RDBh5DqXd2xnLwvHLgLFr), 2026-09-23T07:14Z, carrying the maintainer's words with provenance:

• Who / where: the maintainer, in the chat of session_013RDBh5DqXd2xnLwvHLgLFr.
• Words, verbatim, in order: 「立卡更新我的决裁,这两个你直接打标签跟进合并。」, then choosing the seat's option 甲 for ruling D: 「甲、维持现状。 用聊天里一句话确认,」
• What is confirmed: the pending note .changeset/18582-connector-analytics-cube-liveness-ledgers.md, and what this PR changes under it: two false mechanism claims about the connector liveness ledger, corrected (+1 / −1). At-tier review PASS 5783531345.

⇒ Ruling D stands. The confirmation is this chat sentence, carried here. skip-changeset is removed from this PR: it was applied on the first instruction and is withdrawn under the second, so Check Changeset goes back to advisory red by design. It is not a required context, so it blocks nothing. The PR stays in the merge queue. The provenance comment 5790571940 is superseded on the label; everything else in it stands.

Generated by Claude Code