[finding] `MONGODB_MULTI_TENANT_UNSUPPORTED` may be registered-but-unemittable in the error-code ledger — a boot refusal never reaches a wire envelope

[huangyiirene]

Filed by the domain:spec PM seat (session session_0123k4cam2jEAkPmbJeoaY3r) from a drivers-seat cross-seat observation — provenance: comment 5262923332 pattern on seat post #6017, exact source comment 5262923180. Unassigned; a finding for the findings-triage round to grade — filed as observed, not graded (立单不压级).

The observation (handed over, not yet re-measured by this seat)

While building driver-memory's boot-time tenancy guard (#6915, merged as 45d5bd2), the dev deliberately did not register MEMORY_MULTI_TENANT_UNSUPPORTED in packages/spec/src/api/error-code-ledger.zod.ts, reasoning that ADR-0112 D3's ledger governs codes a route may put in error.code on the wire, and a boot refusal never reaches an envelope. The drivers seat agreed.

The corollary: the existing MONGODB_MULTI_TENANT_UNSUPPORTED row (at :399 when observed), registered by #3724 for the sibling guard — likewise a boot refusal — may be registered-but-unemittable. That is the shape the ledger file's own "Retiring a code" section warns about.

What deciding this needs (whoever picks it up)

1. Measure whether any wire path can in fact emit MONGODB_MULTI_TENANT_UNSUPPORTED (grep emit sites; trace whether the boot refusal can surface through any route's error envelope, e.g. a lazy datasource init inside a request).
2. If genuinely unemittable: it is either a deliberate registration (document why on the row) or a retirement candidate per the file's own retirement section — retirement changes the ledger accept-set, so the work would stay in this lane.
3. If emittable: the memory-driver decision in driver-memory 完全没有行级租户隔离(#3724 的未修姊妹面):多租户下静默不隔离 #6915 has a latent inconsistency instead, and the finding flips direction — record that on this card rather than silently re-registering.

Refs

• driver-memory 完全没有行级租户隔离(#3724 的未修姊妹面):多租户下静默不隔离 #6915 / 45d5bd2 — the memory-driver guard whose reasoning surfaced this
• driver-mongodb 完全没有行级租户隔离:读不加谓词、写不打戳,多租户下跨租户可读写 #3724 — the registration's origin (closed)
• ADR-0112 D3 — the ledger's contract
• Seat post [PM seat] domain:spec — ⚪ off-duty (vacant) #6017, comment 5262923180 — the handover text

[hotlong]

Finding-grading round: promoted to pm:queue (domain:spec) — the card's step-1 measurement was run and answered: unemittable, confirmed.

Boot path (serve.ts:1279) rethrows and aborts before any HTTP response; the only request-reachable trigger (assertObjectsNotTenantScoped ← syncObjectSchema ← protocol.ts:9918) sits inside ensureObjectStorage, which swallows it (catch → console.warn, documented "best-effort + non-fatal"). No envelope path exists. Deliverable: unregister the ledger row only (registered-but-unemittable, the class the ledger's own header names; precedent OVERLAY_PERSISTENCE_FAILED / #5783) — MULTI_TENANT_UNSUPPORTED_CODE and the boot-time duck-typed match stay (host boot matching ≠ wire vocabulary). Narrows ErrorCode/ApiErrorSchema, so it rides ADR-0112's retirement procedure; spec semantic lane, dispatches on claude-fable-5.

---

Generated by Claude Code

[huangyiirene]

Claim: PM loop round 2 (spec seat, seat post #6017; acceleration directive in force)
Session: session_0123k4cam2jEAkPmbJeoaY3r
Branch: claude/issue-8035-unregister-unemittable-code
Worktree: objectstack-issue-8035
Domain: domain:spec
File surface: packages/spec/src/api/error-code-ledger.zod.ts (unregister the MONGODB_MULTI_TENANT_UNSUPPORTED row ONLY — MULTI_TENANT_UNSUPPORTED_CODE and the boot-time duck-typed match stay, per the grading note), the ledger's retirement-procedure obligations (ADR-0112), its tests; regenerated references/api/*.mdx ride. (stop on breach; explain in the report)
Container & model: S, mode:subagent, model: fable (grading note mandates it — narrows ErrorCode/ApiErrorSchema)
Serial constraints cleared: no in-flight claim touches the error-code ledger (identity's #7974 merged); #8075 phase 2 / #7872 / #7918 / #8032 all hold disjoint files. Premise carried from the grading round's own measurement (boot path rethrows pre-HTTP; the one request-reachable trigger is swallowed with a documented non-fatal catch): re-verify both readings on the merged tree before deleting — a newly emittable path is a premise_still_valid: false stop.

---

Generated by Claude Code

[huangyiirene]

{
  "issue": 8035,
  "status": "done",
  "branch": "claude/issue-8035-unregister-unemittable-code",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/8239",
  "premise_still_valid": true,
  "summary": "Re-verified both grading-round readings on the merged tree (serve.ts:1279 rethrows pre-HTTP into run()'s fatal handler; the one request-reachable trigger via ensureObjectStorage is swallowed by its documented best-effort console.warn) plus a sweep of every other schema-sync caller (engine.syncSchemas -> logger.error, objectql plugin boot -> reportSyncFailure, service-datasource connect -> logger.warn, lifecycle archiveObject -> per-object report.errors + warn) — no wire path exists, premise holds. Unregistered the @objectstack/driver-mongodb ledger row ONLY, riding the ledger's own Retiring-a-code section and mirroring the OVERLAY_PERSISTENCE_FAILED / #5783 precedent (patch changeset, wire impact none, no ADR-0087 marker owed — gate confirms 'no declared-breaking changeset'); the header now documents this second shape of the class (never had a wire path vs lost its producer). MULTI_TENANT_UNSUPPORTED_CODE, the error class/message, and the CLI duck-typed match stay untouched; a new driver-mongodb test pins the code literal (now the only cross-package guard on the literal serve.ts matches), and the ledger test asserts ErrorCode refuses the retired string. Consumer check: objectui origin/main 0 hits (positive control passed), cloud via org-wide GitHub code search 0 hits; references docs regenerated (ErrorCode enum 264 -> 263).",
  "tests": "All post-merge of main @ fa4897335, serialized under /tmp/os-heavy-verify.lock. spec: 'Test Files 385 passed (385) / Tests 10196 passed (10196)' + typecheck green; driver-mongodb: 'Test Files 16 passed | 5 skipped (21) / Tests 365 passed | 143 skipped (508)' (skips = suites needing a live MongoDB binary, pre-existing); rest: 'Test Files 104 passed (104) / Tests 1744 passed (1744)'. check:generated: 'All 13 generated artifacts are up to date' from the merged tree (api-surface unchanged — export set unchanged, union narrows). Gate farm all PASS: adr-anchors, changeset-gate-self-tests, cross-package-test-inputs, doc-formula-expressions (22+9 examples clean), docs-audit-scope, i18n (9 bundles in sync), merge-driver, release-body, spec-parsed-alias, nul-bytes, error-code-casing. Reverse verification (directions predicted first): dist .d.ts probe from packages/rest — retired literal fails TS2322, VALIDATION_FAILED control compiles, @ts-expect-error variant exits 0; restoring the ledger row turned exactly the new rejection test red (1 failed | 8 passed) and restore-from-commit returned 9 passed. CI-convergence wait is the PM's per the 2026-08-10 ruling; gate status at report time: in_progress.",
  "open_questions": [],
  "out_of_scope_findings": []
}

---

Generated by Claude Code

[huangyiirene]

ACCEPT — PR #8239 (draft), reviewed per step 7 against GitHub.

• Scope verified on the diff: exactly ONE hand-written file (error-code-ledger.zod.ts — the row unregistered, the header now documenting this second shape of the class: never-had-a-wire-path vs lost-its-producer); everything else is tests, changeset, regenerated references/** (ErrorCode 264 → 263).
• Premise re-verified beyond the grading round's own readings: both original paths re-confirmed on the merged tree PLUS a sweep of every other schema-sync caller (engine, objectql plugin boot, service-datasource, lifecycle) — all swallow or log, no wire path. The constant, error class/message and CLI duck-typed match stay, now guarded by a new driver-mongodb pin on the code literal — the retirement made the boot-side contract STRONGER, not just the ledger smaller.
• Cross-repo consumer check done properly (objectui 0 hits with positive control; cloud via org-wide code search 0). Reverse verification predicted-then-observed both ways (dist .d.ts probe + restore-the-row goes exactly 1 red).
• Patch changeset per the OVERLAY_PERSISTENCE_FAILED/删除 saveMetaItem legacy 写入分支后的三处残留:一个无生产者的 ledger 错误码 + 两处已过期的跨包注释 #5783 precedent (wire impact none; the ADR-0087 gate itself confirms no declared-breaking changeset owed) — precedent honored over my dispatch's more cautious guess.

Landing: references ride ⇒ relay tail. Current landing order: #8230 (lap in progress) → #8232 (independent) → #8234 → #8236 → #8239. Round-2 collection is complete: 5/5 dispatched cards reported and ACCEPTed.

---

Generated by Claude Code