[Decision] plugin-sharing's refused-backfill report lands at `warn` where AGENTS.md puts it at `error` — and the card that was supposed to carry the level is CLOSED

[os-elon]

Filed by the domain:services PM seat (session session_012WkdHQwHr2KQmaX7P1BHzi) out of #12981's dispatch, PR #13397. Unassigned. Recording a decision, not claiming it.

Why this is a card and not a line in that PR

PR #13397 repairs backfillPrimaryBu in plugin-sharing: a per-row catch {} counted nothing and the report was gated on updated > 0, so a pass in which every write was refused printed byte-identical output to a pass with nothing to do — while every affected user kept a stale or absent primary_business_unit_id and every sharing rule keyed on it evaluated against the wrong value. Refusals are now counted and reported once, and the branch is updated > 0 || refused > 0.

⭐ The SILENCE is fixed. The LEVEL is not, and the level is what this card is about. AGENTS.md → Degradation log levels puts "something the system CLAIMS to persist did not persist, while the system keeps looking healthy" at error. This report lands at warn.

⛔ The routing the dev proposed does not exist — measured, and it is why this card had to be filed

The dev's recommendation was "leave it at warn; the LEVEL is added by #10556 when that family next moves." Measured:

#10556  state: closed / completed, 2026-08-24 22:42Z, closed_by os-sam

⇒ A closed card cannot track new work. Had this been accepted as written, the level question would have been routed to a card that can never carry it — a half-state of exactly the kind this lane keeps paying to find by hand. The dev's reading of the ruling was accurate; its reading of the card's liveness was not, and nothing in the baseline file it read says the card is closed.

What was actually ruled on 2026-08-24, verified in the ledger rather than recalled

scripts/optional-error-sink-contract.baseline.json records #10556's ruled shape, and the relevant limbs are:

-4 — #10556's RULED SHAPE (maintainer, 2026-08-24, three answers on one card) … (c) the three PUBLICLY EXPORTED plugin-sharing options types tightened

and, on why the publicly exported ones are a contract call at all:

PUBLICLY EXPORTED from plugin-sharing's index.ts, so requiring warn breaks any host passing { info, error }. That is #10556's contract call.

⇒ The 2026-08-24 ruling tightened three publicly exported plugin-sharing options types and shipped that as a minor naming the break. OptionalSharingLogger — the sink backfillPrimaryBu reports through — was not among them, and its own header forbids growing an error member. That ledger now holds exactly 1 entry (control: a nonsense key returns 0), the service-settings deliberate exception, so this is not unpaid debt sitting in a queue; it is a question nobody has been asked.

The options, with their real costs

	Do what	Operator-visible	Cost
A ⭐	Leave the level at warn. The silence is fixed; the census keeps naming the site so it cannot be forgotten.	A refused backfill is now visible, on the warn channel	0
B	Grow OptionalSharingLogger with error?.	Same	⛔ Refused by that type's own header: it makes an optional error reachable beside an optional warn for every module on the type, enrolling them all into check:optional-error-sink-contract's population at once — and that ledger is shrink-only. This is the shape the gate exists to refuse.
C	Give backfillPrimaryBu a stricter sink ({info?, warn, error?} — the bulk-recompute.ts shape).	error, per AGENTS.md	Mechanically clean, but requires warn on a publicly exported shape ⇒ breaks any host passing { info, error }. That is the same break the 2026-08-24 ruling shipped as a minor for three sibling types — so there is precedent for how to do it, on a card that is closed.

This seat's recommendation: A now, C as the end state, on a live card

The operator-visible loss was that a fully refused backfill printed nothing at all, and that is repaired. The level changes who notices first, not whether anyone can. ⛔ B is the actively harmful option. C is right, has a shipped precedent for its break, and is a published-contract change ⇒ above this seat (clause ②, CONTRACT_REVIEW_TIER), which is the other reason it is a card rather than a line in a census PR.

⛔ Re-deciding another card's published-contract call inside a census PR is exactly the workaround-by-adjacency this repo keeps paying to remove.

⚠️ Confidence gaps

1. I did not read logger-shapes.ts:72 in full — I confirmed OptionalSharingLogger is declared there and is consumed by bu-tree-recompute.ts and primary-bu-projection.ts, but the exact member list and the precise wording of the header prohibition are the dev's reading, not mine. ⇒ Whoever takes C reads that header first.
2. I did not verify which three types the 2026-08-24 ruling tightened. The ledger says "the three PUBLICLY EXPORTED plugin-sharing options types"; I did not enumerate them, so "OptionalSharingLogger was not among them" rests on the dev's report plus the fact that it still has no error.
3. Whether C's break is actually breaking for any real host is unmeasured. The 2026-08-24 precedent shipped a minor naming it, which suggests the answer was "possibly, announce it" rather than "no".

Refs: #12981 (the worklist this came out of) · PR #13397 (where the silence was fixed) · #10556 (CLOSED — the 2026-08-24 ruling and its precedent) · #12970 / #12923 (the repair shape) · AGENTS.md → Degradation log levels

Generated by Claude Code

[os-elon]

This card now covers TWO packages — plugin-security hit the identical wall, and the argument is word-for-word the same

domain:services PM seat, session session_012WkdHQwHr2KQmaX7P1BHzi. Recorded here rather than as a second card, on the #12981 batch-2 dev's own suggestion: "may be worth one card covering BOTH sinks at once: the same argument, the same package, the same gate."

The second instance

PR #13414 (#12981 batch 2) repaired seven tier-1 DARK sites in plugin-security. ⭐ They split into two shapes, and the dev reported that rather than making the batch look uniform:

file	sink	level shipped
bootstrap-system-capabilities.ts	SeedLogger, package-private	error — fully repaired, level and all
cleanup-package-permissions.ts	rides a sink exported from index.ts	warn
suggested-audience-bindings.ts	rides a sink exported from index.ts	warn

⇒ The first one reaches the durability error channel because nothing outside the package can be broken by changing it. The other two cannot, for exactly the reason this card records for OptionalSharingLogger: adding error? to a sink enrols it in check:optional-error-sink-contract's population, which requires a non-optional warn — and requiring warn on a publicly exported shape breaks any host passing a reduced sink.

⛔ Both fix the SILENCE (which needed no contract change) and leave the LEVEL here.

Why one card and not two

• Same argument (published sink shape vs AGENTS.md's error), same gate (check:optional-error-sink-contract), same shrink-only ledger, same precedent (the 2026-08-24 Pay down the optional-error sink ledger — 13 paid, 2 remain and both are DESIGN CALLS (was: "15 sink types") #10556 ruling that tightened three publicly exported plugin-sharing options types and shipped the break as a minor).
• ⛔ Only the package differs. Two cards would mean the same ruling made twice, and the second one made by whoever happens to read it first.

⇒ The ask is now: rule the level for OptionalSharingLogger (plugin-sharing, backfillPrimaryBu) and for the two exported plugin-security sinks, as one decision. The option table in this card's body applies unchanged to both; ⛔ option B is refused by each type's own header for the same reason, and option C carries the same published break with the same shipped precedent for how to announce it.

⚠️ Unchanged and still true

The silence is repaired in every case — a fully-refused pass is now distinguishable from a nothing-to-do pass at all four sites across both packages. ⇒ Nothing here is urgent; the level changes who notices first, not whether anyone can. And ⛔ nobody should take the contract change inside a repair batch, which is what both batches correctly declined to do.

⚠️ What I did not measure

I did not read the two plugin-security sink declarations myself — that they declare warn optional and are exported from index.ts is the batch-2 dev's reading, taken with the gate's verdict (check:optional-error-sink stayed at "1 baselined, shrink-only", and the dev notes the number would have risen had it taken option B). ⇒ Whoever rules should confirm the two declarations first; it is one grep and it is the fact the whole ask rests on.

Refs: #12981 (the worklist) · PR #13397 (batch 1, plugin-sharing) · PR #13414 (batch 2, plugin-security) · #10556 (CLOSED — the 2026-08-24 ruling and its minor break precedent)

---

Generated by Claude Code

[zhuangjianguo]

⚖️ RULED — 维护者,2026-08-30,第 5 场总监席决裁批 #3,verbatim「同意」

裁定:A 是现状定论(级别留 warn),C 是已裁的终态、本卡收窄为 C 的活载体。

• A(现状):backfillPrimaryBu 的静默已由 PR Census the catch { return null; } durability swallow family, and repair the first two members (#12981) #13397 修好(拒绝现在计数并报告)。级别暂留 warn——operator 可见损失(全被拒的回填印空白)已消除,级别只改「谁先注意到」不改「能否注意到」。census 继续点名该站点不让它被忘。
• ⛔ B 排除:给 OptionalSharingLogger 长 error? 会把该类型上每个模块一次性登记进 shrink-only 的 check:optional-error-sink-contract 人口——正是那道门存在要拒绝的形状,主动有害。
• C(终态,本卡承载):给 backfillPrimaryBu 更严的 sink({info?, warn, error?},bulk-recompute.ts 形状),报 error 合 AGENTS.md《Degradation log levels》。⚠️ 它要求在已发布形状上要 warn ⇒ 破坏传 { info, error } 的 host——这正是 2026-08-24 裁决对三个兄弟类型作为 minor 发布的同款破坏,有先例知道怎么做。⇒ 派发按 minor + 命名破坏的升级说明;条款②按内容命中(已发布 sink 形状)走复审链、档位 CONTRACT_REVIEW_TIER。
• ⛔ 本卡即 C 的活卡,不复用已 CLOSED 的 Pay down the optional-error sink ledger — 13 paid, 2 remain and both are DESIGN CALLS (was: "15 sink types") #10556(dev 原路由指向的关闭卡无法承载)。

派发前必验(dev 首验):读 logger-shapes.ts:72 头注全文与 OptionalSharingLogger 成员列表;枚举 2026-08-24 裁紧的三个类型确认 OptionalSharingLogger 不在其中;C 的破坏对真实 host 是否真破坏(先例发 minor 命名它,倾向「可能,announce」)。

席位边界(裁不派):录裁 + 转 pm:queue。同笔摘 needs-user-decision。裁决入本场追认摘要表。

---

Generated by Claude Code