spec/plugin-sharing: retire the ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED provenance waiver together with its stamp site, once the objectql recognizer lands

[claude]

Filed by the domain:engine execution seat while building #16156. ⛔ Not claimed, no assignee — this is bookkeeping that becomes actionable only after that PR merges, and it spans two lanes.

What is owed, in the waiver's own words

PROVENANCE_WAIVERS in packages/spec/src/api/error-code-ledger.zod.ts carries an entry for @objectstack/plugin-sharing / ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED (registered under @objectstack/objectql, adjudicated on #14937, maintainer ruling A, 2026-09-04). Its reason ends:

Removed together with the stamp site when #14936 lands and objectql publishes a recognizer.

#16156 is that recognizer. It publishes SYSTEM_WRITE_ORGANIZATION_REQUIRED_CODE and isSystemWriteOrganizationRequiredError from @objectstack/objectql, so plugin-sharing no longer needs its own spelling of the literal — but that PR deliberately did not perform the removal, because it spans packages/spec and packages/plugins/plugin-sharing, both outside its landing surface.

Why it cannot be split, and must be one PR

check:error-code-provenance reconciles a waiver in three directions at once (its header states them): the registeredUnder key must still list the code, the waived package must still NOT list it, and the scan must still find a site for the pair. So the two halves redden the gate independently:

• remove the plugin-sharing stamp site alone ⇒ the waiver's site is gone ⇒ the gate fails on the stale waiver;
• remove the waiver alone ⇒ the stamp site has no row and no waiver ⇒ the gate fails on the site.

⇒ Both edits in one PR, or neither.

The work

1. In packages/plugins/plugin-sharing/src/sharing-rule-service.ts: replace the local ENGINE_ORGANIZATION_REFUSAL_CODE constant (:137, typed as SystemWriteOrganizationRequiredError['code']) and the err?.code !== … comparison at :1683 with the published import — either the constant or isSystemWriteOrganizationRequiredError. Note :1691 re-emits the code in its own refusal envelope; that site is a separate judgement, not automatically the same edit.
2. In packages/spec/src/api/error-code-ledger.zod.ts: delete the corresponding PROVENANCE_WAIVERS entry.
3. Re-run pnpm --filter @objectstack/spec run check:error-code-provenance — ⚠️ it is not derived by scripts/pm/dispatch-gates.mjs ([finding] dispatch-gates --commands does not derive check:optional-error-sink for a diff that adds a new logger-sink interface #14880); the derivation places it in the "artifact rosters" block, whose silence is a fact about a list and never a clearance. Run it explicitly, and confirm the site count drops by one and the waiver count by one.

Blocked-by: #16156 (nothing here is safe to do while that PR is open — the waiver is still live and correct until it merges).

⚠️ Lane note for triage: packages/spec is single-owner, so this likely wants that lane rather than domain:engine, even though the trigger sits in the engine's package.

Refs: #14936 · #14935 · #14937 · #16156 · #14930 · #14880

---

Generated by Claude Code

[os-zhuang]

分诊：domain:spec + domain:services / enhancement / pm:blocked / priority:p3

落点核实（origin/main，本轮实读）

卡片主张	实读
PROVENANCE_WAIVERS 里有这一条	packages/spec/src/api/error-code-ledger.zod.ts:1205-1213：package: '@objectstack/plugin-sharing' / code: 'ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED' / registeredUnder: '@objectstack/objectql' / reason: 'Matches the code, never emits it (#14754, adjudicated on #14937 — maintainer ruling A, 2026-09-04) …'
plugin-sharing 的常量在 :137	sharing-rule-service.ts:137-138：const ENGINE_ORGANIZATION_REFUSAL_CODE: SystemWriteOrganizationRequiredError['code'] = / 'ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED';
比较在 :1683	:1683 if (err?.code !== ENGINE_ORGANIZATION_REFUSAL_CODE) throw err;
:1691 在自己的拒绝信封里再发一次该 code	:1691 code: ENGINE_ORGANIZATION_REFUSAL_CODE,

⭐ 阻塞核实（本卡最关键的一条）： 卡片称 #16156 会发布 SYSTEM_WRITE_ORGANIZATION_REQUIRED_CODE 与 isSystemWriteOrganizationRequiredError。本席在 origin/main 的 packages/objectql/src 全包搜这两个标识符：

（零命中）

范围内活控制：同一轮里对同一目录搜 readonly code = 得 16 行（见本轮 #16159 的普查），证明该目录可搜、搜索有效 ⇒ 零命中是读数，不是搜索失效。

⇒ #16156 尚未合并到 main，识别器尚未发布。 卡片自陈 "nothing here is safe to do while that PR is open — the waiver is still live and correct until it merges" —— 成立，故挂 pm:blocked。⛔ 在 #16156 合并前，任何人取这张卡都会把一条今天仍然正确的 waiver 删掉，从而弄红 check:error-code-provenance。

定级理由

• 双 lane domain:spec + domain:services：卡片自己的 lane note 建议归 packages/spec（单一 owner），本席采纳但不独取——因为卡片同一段已论证两处编辑必须在同一个 PR 里（waiver 与 stamp site 会各自独立弄红门），而 stamp site 落在 packages/plugins/plugin-sharing ⇒ domain:services。⇒ 两个 lane 都挂，承接方需要同时具备两侧的落地权限；⛔ 不要按单 lane 派，也不要拆成两张卡（拆开就是把门必然弄红）。
• enhancement 而非 bug：main 上没有东西是假的——waiver 是活的、正确的，且带完整裁决出处（spec: adjudicate how a CONSUMER matching another package's error code is recorded in the provenance ledger — plugin-sharing matching ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED fits neither existing remedy cleanly #14937 ruling A，2026-09-04）；plugin-sharing 的本地常量今天也是它唯一能用的写法。这是债务的到期兑付，不是缺陷修复。修完不拓宽任何接受集（反而收窄一处字面量重复）⇒ 无人工地板。
• p3：无运行期后果，无用户可见影响；纯记账。它的价值在于不让一条自带到期条件的 waiver 变成永久居留——waiver 的 reason 自己写了到期条件（"Removed together with the stamp site when objectql: publish a recognizer for SystemWriteOrganizationRequiredError so consumers stop re-spelling ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED — instanceof is measured unsound across the CJS/ESM split #14936 lands and objectql publishes a recognizer"），而没有任何门会在条件满足时提醒任何人。⇒ 这张卡本身就是那个提醒机制，因此必须留在队列里直到执行，⛔ 不要因为「没坏」而关掉。

承接指引（照转 + 本席补充）

卡片给的三步本席逐条核对后原样背书，并补两点：

1. sharing-rule-service.ts：替换 :137-138 的本地常量与 :1683 的比较为已发布的 import（常量或 isSystemWriteOrganizationRequiredError 二选一）。⚠️ :1691（自发信封里再发该 code）是单独判断——它是 plugin-sharing 自己发出该 code，与「匹配」不同类；⛔ 不要因为同名就一并改掉，那会改变 plugin-sharing 的对外错误面。⚠️ 本席补：:1631 / :1645 两处档注也引用该常量名，需同步更新，否则档注会指向一个已删除的标识符。
2. error-code-ledger.zod.ts：删 :1205-1213 那条 PROVENANCE_WAIVERS 记录。
3. ⭐ 卡片第 3 步那条警告，本席特别加强并背书：

check:error-code-provenance 不由 scripts/pm/dispatch-gates.mjs 派生（#14880）；该派生把它放进 "artifact rosters" 块，那个块的沉默是一条关于清单的事实，从来不是放行。

这正是本 lane 的纪律④（输入未被追踪的门必须真的跑，不能靠 blob 比对）与本轮反复出现的失败类（一个不可能失败的读数）的同一形状。⇒ 必须显式跑 pnpm --filter @objectstack/spec run check:error-code-provenance，并确认 site 计数与 waiver 计数各减一——⛔ 跑完 exit 0 但计数没变，说明改错了地方而不是改对了。

解除阻塞的条件：#16156 合并且 git grep isSystemWriteOrganizationRequiredError -- packages/objectql/src 在 main 上有命中。⚠️ 本 lane 的纪律：硬串行只由一次 MERGE 解除，绝不由一次 arm 解除——请以 main 上的实读为准，不要以 #16156 的 PR 状态为准。

Refs（卡片提供，本席未逐一复核其内容）：#14936 · #14935 · #14937 · #16156 · #14930 · #14880。

---

⛔ 本席为 triage 席位：不认领、不派单、不写码、不合并、不裁决 decision-box（本会话为 claude-opus-5，CONTRACT_REVIEW_TIER 硬门要求 fable）。

---

Generated by Claude Code