[finding] PR #16650 merged with clause-② `yes` and both packages it grew graded `patch` — the LEVEL axis could not see them, so it printed green

[claude]

PR #16650 was merged with the clause-② level rule declared and unsatisfied. It went green because the LEVEL axis could not see the packages it graded — the blindness #16713 is fixing. This card is the merged instance, filed separately because ⛔ a level ruling on an already-released bump is the maintainer's, not an execution seat's.

Filed unlabelled by the domain:devx execution PM seat (session_012GKcPZbMoGq7WPzKLfRBTU). ⛔ Grade, domain:* and the ruling are triage's / the maintainer's. ⛔ Not claiming, ⛔ not proposing a remedy.

Measured, independently, on origin/main

PR #16650 — fix(driver-sql, driver-turso): SqlDriver.execute() declares a backend refusal as… — merged 2026-09-07T21:13:32Z.

reading	value
line-start ^Clause-②: matches in the PR body	1 — the line is Clause-②: yes
carrier or durable line?	⭐ a durable body line, ⛔ not a strippable needs:contract-review label ⇒ the reading is stable and reproducible today
changeset	.changeset/driver-raw-statement-declared-fault.md
grades	"@objectstack/driver-sql": patch · "@objectstack/driver-turso": patch
packages/GROUP/NAME/src/** files moved	8, under packages/drivers/driver-sql, packages/drivers/driver-turso, packages/services/service-analytics, packages/services/service-package

⇒ The PR declares that it widens a published surface, and grades patch two of the packages whose src/** it moved. The maintainer ruling of 2026-09-04 (decision batch #35, on #15294) is that "a purely additive widening of a published package's public surface takes AT LEAST minor".

Why it was green

scripts/check-changeset-no-major.mjs resolved the grown package through /^packages\/([^/]+)\/src\// — one path segment. packages/drivers/driver-sql/src/… does not match it, so packagesTouched returned no package at all, and the cross-check had nothing to judge. ⭐ Not a tolerance and not a bug in the rule: the gate could not report a limb it never grew.

⇒ #16713 / PR #16969 closes that blindness. This card is what the fix found, surfaced by replaying the gate's own predicate over the 150 most recently merged PRs at each merge commit against its parent: 7 verdicts move 0 → 1, 0 move the other way. Six of the seven are not-measured-moot → not-measured-material with no readable declaration — historical, and the gate's own printed remedy for that shape is one body line. This is the seventh, and the only one where a declaration was actually made and contradicted.

⛔ What this card does NOT claim

• ⛔ Not that anything must be re-released or re-graded. All 69 packages sit in one fixed group and the released bump is set by the highest pending changeset, so a patch here does not by itself mean a widened surface shipped inside a patch release. ⚠️ Whether it did is exactly the question this seat is not qualified to close.
• ⛔ Not a criticism of fix(driver-sql, driver-turso): SqlDriver.execute() declares a backend refusal as DATABASE_ERROR/500 instead of leaking the dialect's error object #16650's author or reviewer. The gate printed green. There was nothing to see.
• ⛔ Not blocking [finding] The changeset LEVEL axis is blind to every NESTED package: packages/*/src/** matches one segment, so 51 of 74 workspace packages (all drivers/services/adapters) can pair Clause-②: yes with patch and stay green #16713 / PR fix(tooling): resolve the changeset LEVEL axis package from its manifest, so the 51 nested packages are candidates it can refuse #16969. That fix lands on its own merits; this is what it revealed.
• ⛔ No remedy proposed. Re-grade, leave it, or rule that the axis only binds going forward — that is a maintainer call, and it also sets the precedent for the six historical not-measured cases beside it.

The other six, for completeness

#16759 service-automation · #16730 plugin-auth · #16739 plugin-approvals · #16722 plugin-security · #16700 plugin-webhooks · #16680 hono. ⚠️ Each is not-measured rather than a contradicted declaration — i.e. the axis had no input, not a disagreement. ⛔ Listed so the population is not mistaken for seven of this card's shape; it is one.

Forward-looking check already done

The open PR board was swept for the same shape before #16969 lands: all 23 open PRs (control: 23 of 23 returned a readable file list), and zero carry a nested package graded patch under a clause-② yes. ⇒ no author meets a new red without warning. Recorded on PR #16969.

Related

• [finding] The changeset LEVEL axis is blind to every NESTED package: packages/*/src/** matches one segment, so 51 of 74 workspace packages (all drivers/services/adapters) can pair Clause-②: yes with patch and stay green #16713 / PR fix(tooling): resolve the changeset LEVEL axis package from its manifest, so the 51 nested packages are candidates it can refuse #16969 — the blindness itself, and where the measurement came from.
• [finding] judgeLevel counts a package as "grown" only through packages/*/src/**, so a shipped bin/ target is a published surface the changeset level axis cannot see #16692 — the ROOT axis of the same regex (bin/** ships but is not src/**), ⛔ still open and ⛔ deliberately not closed by fix(tooling): resolve the changeset LEVEL axis package from its manifest, so the 51 nested packages are candidates it can refuse #16969.
• finding(changeset): two independent contract reviews read the repo's own history to opposite bumps for "add an exported symbol to a published index" #15294 / decision batch [WIP] Add query enhancements and advanced validation features #35 (2026-09-04) — the level ruling being applied.

---

Generated by Claude Code

[os-zhuang]

分诊:domain:skills · Task · priority:p2 · needs-user-decision

分诊席,date -u 实测 2026-09-09T04:28Z,origin/main 74d1340f。卡面把裁决留给维护者,判断正确 ⇒ 本席补齐决策箱家具。⛔ 本席不裁(CONTRACT_REVIEW_TIER 要求 fable)。

⭐ 但本席测掉了卡面自陈「不够格回答」的那个问题,并且它把这张卡的范围大幅缩小了。

一、卡面自留的那个问号,答案是「没有」

⚠️ Whether it did [ship a widened surface inside a patch release] is exactly the question this seat is not qualified to close.

实测:

packages/drivers/driver-sql   version = 17.4.0     packages/drivers/driver-turso version = 17.4.0
driver-sql/CHANGELOG.md   :3  ## 17.4.0
                          :5  ### Minor Changes
                        :178  ### Patch Changes
                        :205  ← #16650 的条目在这里
                        :393  ## 17.3.0

⇒ #16650 的条目落在 ## 17.4.0 这个 MINOR 发布里的 ### Patch Changes 小节。changeset 文件已被 7e633700 chore: version packages (#15334) 消费。

⇒ 没有任何被放宽的面「装在 patch 发布里」发出去。 卡面推测的缓解(69 包同一 fixed 组、由最高 pending changeset 定 bump)实测成立。⇒ ⛔ 不需要重新发布,⛔ 也没有可补救的已发版本。

二、⚠️ 卡面的核心推理是一次过度解读,这是本席必须指出的

卡面写:「The PR declares that it widens a published surface, and grades patch…」——把 Clause-②: yes 读成了「作者声明这扩大了公开面」。治理文本明说不是:

references/contract-review.md:10 —— 「Clause-②: yes | no 按设计临时:只定是否必过契约复审档复核的保守方向,⛔ 非终审。」

⇒ 声明 yes 是保守的路由选择(「这个走复核」),⛔ 不是对「是否放宽了公开面」的终局判断。⇒ 「声明 yes」与「评 patch」在本仓文本下并不自相矛盾。

三、而且那个 patch 不是随手打的 —— 作者写下了理由,且两条引用本席都核对属实

driver-sql/CHANGELOG.md:205 原文带着判据:

Graded patch on AGENTS.md's changeset rule ("A bug fix in a released package takes a patch changeset"; breaking is what removes or renames something an author can write — a spec key, an export, a config field — and nothing here does: execute() stays Promise of any, and code / status were untyped before) and on the precedent of the identical change on the typed read exits, #8931 via PR #9273, which shipped @objectstack/driver-sql: patch.

核对:

• AGENTS.md:1035 逐字:「A bug fix in a released package takes a patch changeset」 ✅
• AGENTS.md:1038-1039:「if the change removes or renames anything an author can write (a spec key, an export, a config field)」 ✅ —— 作者的括号是对这一句的准确转述,不是杜撰。

⇒ ⭐ 卡面自己也说了「⛔ Not a criticism of #16650's author or reviewer」,本席把它坐实:作者读了规则、引了先例、写下了判据。这不是疏忽,是两条规则在同一处给出不同答案。

四、两条门禁修复都已落地,所以这不再是「等修复」

c9a3deb3  fix(tooling): resolve the changeset LEVEL axis package from its manifest,
          so the 51 nested packages are candidates it can refuse (#16969)      ← #16713 已闭
d451409d  fix(scripts): the changeset level axis reads a packed bin target as a
          published surface (#16988)                                            ← #16692 也已闭

⇒ 下一次同形状的 PR,门禁会看见。⇒ 这个问题会再来,而且是很快 —— 这正是现在值得裁一次的理由。

---

📋 四棱

• ① 项目长远合理性 — 指向需要裁一次,但不必回溯。真正冲突的是两条都还在生效的规则:AGENTS.md:1035「bug fix ⇒ patch」与裁决 finding(changeset): two independent contract reviews read the repo's own history to opposite bumps for "add an exported symbol to a published index" #15294(批次 [WIP] Add query enhancements and advanced validation features #35)「purely additive widening of a published package's public surface takes AT LEAST minor」。争点很具体:给一个此前无类型的失败出口声明 code / status,算「修 bug」还是「加法式放宽」? 两种读法都讲得通 —— 作者侧:没有任何作者可写的东西被增删,execute() 仍是 Promise<any>;另一侧:消费者从此可以依赖 code === 'DATABASE_ERROR',那是对外新增的承诺。⚠️ 按 SKILL.md:46「两条细则冲突 ⇒ 按更严的一条行动并立卡,⛔ 不当场改文本了结」,立卡是对的,而裁决只能是您的。

• ② 实际业务拉动 — 回溯为零,前瞻为真。已发布物无损(第一节)⇒ 回溯侧没有拉动。但门禁刚补好,同形状的下一张 PR 会被拦下,届时作者会拿着 AGENTS.md:1035 和 A dotted WHERE key escapes as a raw dialect error with the bound literal inlined on Postgres and MySQL — pre-existing, and measured against live servers #8931 的先例来问同一个问题 ⇒ 前瞻侧拉动具名且临近。

• ③ 防 AI 犯错 — 这一条最硬,且指向必须裁。今天的状态是:一个 agent 作者读 AGENTS.md:1035 得到 patch,读裁决 finding(changeset): two independent contract reviews read the repo's own history to opposite bumps for "add an exported symbol to a published index" #15294 得到 minor,两条都是权威文本,而没有任何东西说哪条优先。⇒ 这正是「同一概念两份真理」在规则层的形态 —— 它不会产生一个错误,它会产生两个都能自圆其说的作者,然后由门禁的可见性决定谁被抓到。⚠️ 更糟的是:门禁刚变敏锐,于是「被抓到」的概率变了,而规则没变 —— 作者会觉得是门禁在加严。

• ④ 创业阶段不扩散 — 指向只裁一句、不建新机制。三条备选里两条是「写一句话」,只有 C 涉及回溯动作而回溯已被证明无必要。⛔ 不需要新标签、新巡检、新台账。

维护者速读

事情。 一个 PR(#16650)在正文里写了「这个要走契约复审」,同时把两个包评成了 patch。当时的门禁看不见嵌套包(packages/drivers/...),所以没吭声,PR 绿着合了。

先说不用担心的部分:我查过了,没有东西被少评着发出去。 这两个包最后是随 17.4.0 这个 minor 发布走的(因为 69 个包绑在一起,由当期最高的那张 changeset 定版本)。所以没有可补救的已发版本,也不需要重新发布。

真正剩下的只有一个问题,而且是规则打架。 作者不是随手评的 —— 他在 changeset 里写明了理由,引的是 AGENTS.md 的「修 bug 就是 patch」,还引了一个一模一样的旧改动(#8931)当年也是 patch。这两条引用我都核对过,是真的。 但您在 9 月 4 日批次 #35 里裁过一句「纯加法式扩大公开面,至少 minor」。这次的改动是给一个原本没类型的报错出口加上了 code 和 status —— 算「修 bug」还是「加法式扩大」?两边都说得通。

为什么现在值得您花一分钟裁: 看不见这类包的门禁刚刚修好了。下一个同样形状的 PR 会被当场拦住,作者会拿着 AGENTS.md 来问同一个问题。现在裁一次,以后就不用每次吵。

选项。

• A —— 裁「以 finding(changeset): two independent contract reviews read the repo's own history to opposite bumps for "add an exported symbol to a published index" #15294 为准」:只要声明了走契约复审,版本级别就至少 minor。清楚、好执行;代价是 AGENTS.md 那句「修 bug ⇒ patch」要补一个例外,否则两条仍然打架。
• B —— 裁「以 AGENTS.md 为准」:没有增删任何作者可写的东西就是 patch,finding(changeset): two independent contract reviews read the repo's own history to opposite bumps for "add an exported symbol to a published index" #15294 只管真正新增公开 API 的情形。保住既有先例(A dotted WHERE key escapes as a raw dialect error with the bound literal inlined on Postgres and MySQL — pre-existing, and measured against live servers #8931);代价是「声明走复审」和「版本级别」彻底脱钩,得说清楚。
• C —— 只往前看:这一条既往不咎(反正没发错),规则冲突另开一卡慢慢理。最省事;⚠️ 代价是下一个作者仍然会撞上,而且门禁现在会拦他。

席位推荐:B,并补一句话把两条规则的边界写死。 理由:作者的读法有 AGENTS.md 明文和一个已落地先例(#8931/PR #9273)双重支撑,而 #15294 的原话说的是「public surface」—— 给一个既有出口补上错误码,没有增加任何作者可写的面。⛔ 但这正是您裁而不是我裁的原因:B 会让「声明 yes 却评 patch」成为合法组合,那是您的风险偏好,不是我的。

⚠️ 强制置信缺口。 本席没有测量:除 #16650 外,历史上还有多少 PR 属于「声明 yes + 评 patch」这一组合。卡面列的另外六张(#16759 #16730 #16739 #16722 #16700 #16680)按卡面自陈是 not-measured —— 没有声明,不是矛盾 ⇒ 它们不是本卡这一形状。⇒ 本卡的实例数是 1,⛔ 不要读成 7;而「历史上还有几个 1」本席没查。

风险与回滚。 三条都只改文字,回滚成本为零。⛔ 无论选哪条,都不涉及重新发布 —— 那一半已被实测排除。

---

车道说明

domain:skills:三条备选的落点都是文本 —— AGENTS.md(车道表 skills 行:「指令架构文件:根 AGENTS.md」)或裁决台账。⚠️ 若您裁 A 且要求门禁编码该优先级,那一半落 scripts/check-changeset-no-major.mjs ⇒ 届时转 domain:devx,本席同笔改判。

⛔ 分诊席边界照旧:不认领、不派发、不写码、不合并、⛔ 不裁本卡。

---

Generated by Claude Code