[finding] buildConfigChangeAuditSink logs ERROR on every tenant settings write when no sys_audit_log is mounted — an unmounted ledger is a configuration, not a fault #18368

Activity

1. hotlong

   added

   finding

   on Sep 16, 2026
2. huangyiirene

   added

   pm:dispatched

   and removed

   pm:queue

   on Sep 17, 2026
3. huangyiirene

   self-assigned this

   on Sep 17, 2026
4. huangyiirene commented on Sep 17, 2026

   

   huangyiirene

   on Sep 17, 2026 – with Claude

   Last edited by huangyiirene

   Collaborator

   More actions

   Claim: PM loop round 1
   Session: session_01QGMBhvUoyD8t5zY8xHQhnP
   Branch: claude/issue-18368-unmounted-ledger-is-configuration
   Worktree: objectstack-issue-18368
   Domain: domain:services
   Seat: domain:services#1
   File surface: packages/services/service-settings/src/ (stop on breach; explain in the report)
   Container & model: M, mode:subagent, model: default judgment tier — cited from THIS dispatch's node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --tier packages/services/service-settings/src/config-change-audit.ts packages/services/service-settings/src/config-change-audit.test.ts at commit 6dfa3ea: "no path-derived mandate: the surface hits none of the 3 declared glob(s), derived here, not recalled … floor sonnet · default opus · ceiling fable". Default tier, ⛔ not the floor: the card deliberately does ⛔ NOT prescribe the shape ("offered rather than prescribed" — registry probe vs. routing through the existing noise-suppression mechanism is named as this lane's call), so the card carries a design judgment and the floor tier is wrong for it.
   Clause-②: no
   Thread-read: 5713022556
   Serial constraints cleared: none — measured at 2026-09-17T15:06Z, ⛔ not recalled. (a) This lane's only pm:dispatched card is #16506, assignee zhuangjianguo, surface plugin-email/src/email-service.queue-delivery.test.ts ⇒ disjoint, and ⛔ not this seat's card. (b) All 23 open PRs intersected file-by-file against service-settings/src/config-change-audit: 0 hits — control: the same intersector reports #18319 at 92 files and #17076 at 100 ⇒ the instrument is reading, ⛔ not returning empty. (c) Sibling cards dispatched in THIS batch — #18110 + #18555 (service-automation) and #18153 (plugin-approvals) — are file-disjoint from this one. (d) The patrol anchor's H17 restart-trigger file index names plugin-sharing, plugin-security, plugin-auth, client/runtime paths ⇒ 0 intersection with this surface, so no Restart-when: rider is triggered by this dispatch. (e) ⛔ No sibling card pins behaviour this card asserts.

   Premise re-verification owed before any edit

   • ⚠️ The action face is packages/services/service-settings/src/config-change-audit.ts, and buildConfigChangeAuditSink is at :151 as read by this seat on origin/main 6dfa3ea — ⛔ that line number is this seat's reading and must be re-taken, ⛔ not trusted.
   • ⚠️ git log origin/main -- packages/services/service-settings/src/config-change-audit.ts returns only the graft-boundary commit e46ac0f, which this checkout's own harness check reports as parentless, diffed against the EMPTY tree ⇒ ⛔ that is an artefact of the shallow clone and is NOT evidence the file was touched. Treat the real recent-touch history of this file as UNREAD, and re-derive it if it matters.
   • ⛔ cloud#1975, cloud#1963 are NOT reachable from this session (GitHub scope here is objectstack-ai/objectstack only). The consumer-side readings in this card's body are the repo:cloud seat's, accepted as declared and ⛔ NOT re-verifiable here. ⛔ Do not claim to have checked them; ⛔ do not let a claim about cloud's state gate the fix.

   _{Dispatched by the domain:services PM seat (objectstack#6021) at 2026-09-17T15:06Z. Ruling, named falsifiable premises and the fork injunction are in the dispatch order. ⛔ The dev leaves no second claim — this comment is the identity.}

   ---

   Generated by Claude Code
5. huangyiirene commented on Sep 17, 2026

   

   huangyiirene

   on Sep 17, 2026 – with Claude

   Collaborator

   More actions

   os-dev-report

   {
     "issue": 18368,
     "status": "done",
     "branch": "claude/issue-18368-unmounted-ledger-is-configuration",
     "pr": "https://github.com/objectstack-ai/objectstack/pull/18703",
     "session": "session_01QGMBhvUoyD8t5zY8xHQhnP",
     "premise_still_valid": true,
     "summary": "Route (2) implemented, in this repo, inside the declared file surface. buildConfigChangeAuditSink now probes the engine registry for sys_audit_log before the write and skips at debug when it is absent; the probe records nothing and is re-taken per call, and an engine that cannot be asked (no getSchema) still gets the write attempted. ONE HALF OF THE CARD'S PREMISE IS FALSE and this is the correction, not a workaround: measured on origin/main at the branch point 1bc22b3, the sink did NOT log at ERROR and did NOT log per write - it preferred logger.warn over logger.error, and failureReported has guarded it to once per PROCESS since #8145. What IS per-write is one frame down: ObjectQL.insert's terminal catch logs 'Insert operation failed' (at warn since #17052, nothing reported-once about it), proven with a direct probe against a real ObjectQL with sys_audit_log absent from the registry. The defect the card names is real and fixed - only the LEVEL and FREQUENCY in its prose are wrong for this tree; the cloud seat's reading was taken against a published package on a hosted plane and cloud#1975 / cloud#1963 are unreachable from this session (declared, not verified). The fix is indifferent to which is right: skipping the write removes BOTH lines. The residual fault arm (ledger mounted, insert genuinely fails) moved from warn-first to error-first, which is AGENTS.md's durability-degradation level and is the card's own mandatory control arm. P1 TRUE (producer at config-change-audit.ts:151, wired at settings-service-plugin.ts:230 - both re-taken, both hold). P2 NOT FORKED: no exported symbol, parameter or option added - the signature, the row shape, CONFIG_CHANGE_ACTION and CONFIG_CHANGE_OBJECT_NAME are unchanged, so Clause-2 stays 'no' and the changeset is patch. P3 FALSE and this kills one of the two candidate spellings: expected-read-refusal-noise.ts is a TEST-ONLY capture helper in packages/runtime/src, exported from no public entry, and service-settings does not depend on @objectstack/runtime at all (runtime is downstream) - it is not reachable and not a production mechanism, so the registry probe was the only route. P4 CONFIRMED as a shallow artefact (git log on the file returns only the graft commit e46ac0f). P5 respected: nothing cloud-side was claimed as verified. Zero packages/spec. Zero content/docs/releases.",
     "tests": "All at commit 5ec4b17 (final). pnpm --filter @objectstack/service-settings test :: 33 files, 584 tests, all pass (config-change-audit.test.ts 16, 5 new). pnpm --filter @objectstack/service-settings typecheck :: clean; tsc --noEmit --listFiles confirms the program reaches all 33 *.test.ts in the package incl. config-change-audit.test.ts (grep -c = 33 / 1), so the green covers the new cases. Dependency-closure build pnpm --filter '@objectstack/service-settings^...' build :: exit 0 under the shared verify lock. eslint . --no-inline-config --format json :: WHOLE repo population, NOT a narrowing - 6819 files, 0 errors, 0 warnings. BOTH ACCEPTANCE ARMS PINNED. Quiet arm: no sys_audit_log in the registry -> settings row lands, sys_setting_audit lands, ledgerRows() length 0 (the insert is never ATTEMPTED, asserted on the engine seam, which is what silences the per-write engine line), zero error lines, zero warn lines, exactly one debug line naming the remedy. Control arm: ledger MOUNTED + insert genuinely throws -> insert WAS attempted, exactly one line on the error channel carrying consequence and fix, nothing on debug, settings write still landed. Three further pins: probe non-memoization (mount the ledger mid-process, the next write records), unanswerable engine (no getSchema -> write still attempted and its failure still reported), warn fallback for a sink with no error channel. ABLATION, run from the COMMITTED state, trap-restored, source-resolved (the test imports ./config-change-audit.js relatively, same package - no dist leg, so no dist preflight applies). HEAD blob 2f9535bb6c7bae3b47e2e31f219ae3af3e6e7078. Leg A: registry probe removed (if (false)) -> mutated blob 60a0a43c, differs from HEAD blob = ON DISK; vitest exit 1, 2 failed / 14 passed - QUIET ARM and the non-memoization pin. Leg B: fault report put back on warn-first -> mutated blob 1ad3aced, ON DISK; vitest exit 1, 2 failed / 14 passed - CONTROL ARM and the unanswerable-engine pin. Both legs restored with git checkout HEAD -- path, restore PROVEN by hash equality to the HEAD blob AND empty git diff HEAD, never by an exit code. Direction observed = TURNS RED, as predicted. Direct premise probe (temporary, deleted): real ObjectQL + memory driver, sys_audit_log unregistered -> registry.getObject = null, getSchema = undefined; insert into it logs [debug]x2 + [warn]x1 'Insert operation failed' and NOTHING on error.",
     "gates": "Roster derived with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands and NO PATHS (merge-base derived, per the PM's mid-task correction and the role file); change set it derived = 3 paths, three-dot vs merge base 1bc22b3d. Each exit code captured to a file BEFORE being read. RECONCILED with --ran (exit codes recorded per family): 59 derived, 57 run and GREEN, 2 NOT MEASURED, 0 UNRUN. NOT MEASURED (both exit 3 = PREREQUISITE NOT MET, each needs a full workspace build that CI performs; recorded as not-measured, never as a pass and never as a finding): pnpm check:dual-build-cjs-loads, pnpm check:type-check-debt. TWO RED ON FIRST PASS, BOTH FIXED rather than routed around: check:doc-authoring (the tracker id had been spelled inside the operator-facing runtime string - stripped to the adjacent source comments, per the quoted maintainer ruling) and check:tenant-audit-census (see out_of_scope_findings). ONE exit 3 from a shallow-clone artefact, NOT about this diff: check-plugin-teardown-shape --self-test could not reach its pinned fixture commit 621a4876; resolved with a targeted git fetch of that commit, then green. BEYOND the derived roster, the two wide-population families this change most plausibly implicates were run by hand and are green: pnpm check:durability-log-level (36 durability-critical catch seams, all loud) and pnpm check:startup-registry-verdict (43 seams, 36 read-only, none recording a verdict the boot can contradict) - the second is the one that judges the new probe's shape. The tool's own warnings are passed through unedited: 51 artifact-roster families score 'silent' for every card and their silence is NOT a clearance (4 of them keep their roster under a directory one of my paths is in), 11 declare a population too wide to place, 5 take a value from the workflow, 5 CI jobs are scheduled by my paths with 28 steps no family names. A STALE TREE warning names scripts/pm/check-half-states.mjs as changed on origin/main since my base; it is not in my roster and the roster was byte-identical across two derivations.",
     "line_budget": "n/a - no skills/** path in the diff (files are packages/services/service-settings/src/ plus one .changeset entry), so no published-skill line or token ratchet applies.",
     "files_changed": [
       "packages/services/service-settings/src/config-change-audit.ts",
       "packages/services/service-settings/src/config-change-audit.test.ts",
       ".changeset/unmounted-audit-ledger-is-configuration.md"
     ],
     "deviations": [
       "DECLARED, not silent: the fault arm's log level moved warn-first -> error-first. It is beyond a pure 'stop reporting the expectation', and it is deliberate: the card's acceptance names ERROR in its mandatory control arm, and AGENTS.md > Degradation log levels prescribes error for exactly this shape once the expectation is separated out (a write that claims to be audited is not, and the system keeps looking healthy). Spelled as property access with a warn fallback, never (a ?? b)(...), so a class-based Logger keeps its receiver.",
       "DECLARED: the test harness now registers a local stand-in sys_audit_log DECLARATION (name + two fields, no organization_id) as the mount POINT. Without it every pre-existing case in the file becomes a fixture of the UNMOUNTED deployment and would go green on a sink that never writes at all. plugin-audit is still NOT imported (that dependency would invert the optional-plugin relationship the file header protects); the row shape is still asserted at the engine seam, and the stand-in declares no organization_id so every previously asserted row is byte-identical.",
       "DECLARED, and it is why the census is green: the two PRE-EXISTING sys_audit_log spellings (makeFieldProbe's getSchema, and the insert) were briefly folded onto the new module constant and then restored verbatim. Folding them moved content/docs/permissions/tenant-audit-census.mdx (inline 109->108, const 40->41) plus a hand-written prose count, outside the declared file surface. Measured, not guessed: reverting the two lines restored the gate to green on re-run.",
       "PREMISE CORRECTION, reported rather than worked around: the card's 'ERROR on every write' is false on this tree in BOTH halves (warn, and once per process). See summary. premise_still_valid is TRUE because the defect - an unmounted ledger treated as a fault, with per-write noise - is real, reproduced and fixed; only the prose severity was wrong.",
       "WRITE-BUDGET CONFLICT, named rather than silently taken either way: this dispatch budgets 2 REST endpoints and forbids a label write, while the standing role file budgets 4 writes including POST /issues/{n}/labels. In effect they do not diverge here - a changeset IS present so skip-changeset does not apply, and needs:contract-review is the seat's to hang, so NO label was owed on this PR. 2 writes used, 0 labels written.",
       "NOT merged with origin/main (3 commits ahead: packages/spec contracts, a spec docs page, scripts/pm/check-half-states.mjs). Zero path intersection with this diff, so AGENTS.md section 10's joint-breakage re-check has no overlap to scope onto; the merge queue validates the rebuilt generation."
     ],
     "mcp_calls": "0 - no MCP GitHub tool of any kind was called, read or write. All GitHub traffic went through the REST proxy with curl.",
     "api_writes": "2 - POST /repos/objectstack-ai/objectstack/pulls (draft, read back byte-for-byte, footer count 1, first line 'Fixes #18368'), POST /repos/objectstack-ai/objectstack/issues/18368/comments (this report). No PATCH, no label write, no assignee write. git push is not a REST write and is not counted.",
     "open_questions": [],
     "out_of_scope_findings": [
       "noted, not filed: the ledger object name stays spelled inline at its two pre-existing sites. Consolidating them onto one constant moves the tenant-audit census ratchet (content/docs/permissions/tenant-audit-census.mdx) and a hand-written prose count in a docs tree outside this card's declared surface. Successor: whoever next owns that census regeneration. The constant carries the reason at its definition.",
       "noted, not filed: this durability seam is invisible to check:durability-log-level, because its callee is the generic eng.insert rather than a named persistXxxRow helper of the kind every DURABILITY_CRITICAL_CALLEES entry names. Adding 'insert' to that vocabulary would flag every catch around any insert repo-wide, which that script's own header calls out as the false-positive rate that gets gates disabled; extracting a named helper and declaring it would edit scripts/, outside the declared surface. Successor: NONE currently queued - recorded so the next reader does not read that gate's green as vouching for this line's level.",
       "noted, not filed: makeFieldProbe memoizes its organization_id answer for the whole process - a latent instance of the same shape this card fixes. A 'not registered' cached before plugin-audit finished registering would leave organization_id unstamped forever, and the SecurityPlugin's RLS predicate would then hide every config_change row from non-platform readers - the empty config_changes view, one layer down. This PR closes it INCIDENTALLY (the probe returns early on an unmounted ledger, so makeFieldProbe is only ever consulted where the ledger IS registered), not by design, and nothing pins that closure. Successor: the next card on this file.",
       "noted, not filed: ObjectQL.insert's terminal catch logs 'Insert operation failed' once per failing write with no reported-once guard, one frame below every best-effort writer in the repo. That is by design since #17052 (the caller was told), and this card's fix removes the settings-service instance of it by not attempting the write; it is recorded only because it, not the sink, is the per-write half the card's prose was describing. Successor: none - this is a reading, not a defect."
     ]
   }

   ---

   Generated by Claude Code
6. huangyiirene commented on Sep 17, 2026

   

   huangyiirene

   on Sep 17, 2026 – with Claude

   Collaborator

   More actions

   ACCEPT — PR #18703

   _{domain:services seat (objectstack#6021), session_01QGMBhvUoyD8t5zY8xHQhnP, R1, written at 2026-09-17T16:08Z. Every reading below was taken by this seat against GitHub and the tree; ⛔ none is adopted from the report's own account of itself. ⚠️ Independence disclosure: this is a SELF-REVIEW — mode:subagent gives dev and seat one session id by design (⛔ not a defect, ⛔ not concealed). Implemented-by: / Reviewed-by: both session_01QGMBhvUoyD8t5zY8xHQhnP.}

   Checklist conclusions

   item	reading
   PR shape	draft ✅ · base main ✅ · first line Fixes #18368 ✅
   Scope vs declared surface	3 files, all inside packages/services/service-settings/src/ + one changeset. ⛔ No breach.
   Clause-② no	⭐ Re-derived, ⛔ not accepted on declaration. git diff origin/main...5ec4b174 for added export lines ⇒ NONE; removed export lines ⇒ NONE; src/index.ts not in the diff at all. The new AUDIT_LEDGER_OBJECT_NAME is a module const and the new debug? member sits on the module-local ConfigChangeLogger, ⛔ not on the exported SettingsDiagnosticsLogger. check-clause2-carriers --pair 18703 ✓ both carriers agree, no widening tell.
   Changeset	@objectstack/service-settings: patch ✅ — consistent with a no-API-change fix.
   CI	29 success · 5 skipped · 0 red · 0 pending, newest run per check name on head 5ec4b174.
   Enqueue eligibility	all 5 skips — Check PR Size, Auto Label, Build Docs, Console Pin Gate, Packed-tarball smoke (opt-in) — are in EXPECTED_SKIPS. ⚠️ Hand-checked against the roster source: check-expected-skips.mjs itself is NOT MEASURED here (its yaml import fails in a container without pnpm install) and ⛔ a script that cannot run is never read as a clean result.
   Write budget	mcp_calls 0, api_writes 2 — matches the dispatch budget, and no denied tool appears.

   The one red, and whose fault it was

   Check Changeset failed at 15:46Z. The gate's own text names the cause precisely: the PR body carried Clause-②: no inside a sentence — 「a near miss, not a declaration」 — and the gate reads that key only at the start of a line.

   ⭐ The seat fixed this, because the seat caused it. The remedy is a body edit, and this dispatch's write budget forbade the dev a PATCH — the dev flagged exactly that in its deviations ("the PR body cannot be corrected without a PATCH this dispatch forbids") rather than silently exceeding budget or silently leaving a red. That was the correct call and the constraint was mine. A line-start Clause-②: no declaration was added by this seat; the gate re-read the body on the edited event and is now green, with ⛔ no push and ⛔ no re-run — exactly as its message predicted. Recorded as a dispatch-order defect to carry forward: a write budget that forbids PATCH must either allow the body correction or require the declaration to be line-start in the first POST.

   The premise correction — accepted, and it is the most valuable thing in this delivery

   The card asserts the sink 「logs ERROR on every tenant settings write」. The dev reports that as false in both halves on this tree — the sink preferred warn, and failureReported has guarded it to once per process since #8145 — and that the genuinely per-write line is one frame down in ObjectQL.insert's terminal catch (at warn since #17052, with no reported-once guard).

   ⇒ The defect is real and is fixed; only the prose's severity and frequency were wrong. ⭐ The fix is indifferent to which line the filer actually saw, because skipping the write removes both. premise_still_valid: true is the right call here and this seat agrees with it. ⚠️ The consumer-side reading came from the repo:cloud seat against a published package on a hosted plane; cloud#1975 / cloud#1963 are ⛔ unreachable from this session and are accepted as declared, ⛔ not verified.

   Deviations — each accepted, with the reason checked rather than taken

   1. Fault arm moved warn-first → error-first. ⭐ Verified against the governing text rather than the dev's citation: AGENTS.md 「Degradation log levels」 decides by one question — 「does the system still look normal from the outside while something it claims is persisted has not landed?」 — and answers error for durability/data-consistency degradation. Once the unmounted case (a composition choice, i.e. functional) is skipped earlier, what remains in that catch is precisely the durability case. The rule's 「Say it once, at the first degradation, not once per failed write」 is honoured — the failureReported guard is retained in the diff — and the required 「consequence + fix」 both appear in the message, with the fix text corrected so it no longer describes the unmounted case it can no longer reach. ⭐ Also correctly spelled as property access with a warn fallback rather than (logger.error ?? logger.warn)(…), which would drop the receiver a class-based Logger needs.
   2. Three-valued mount probe. ledgerIsMounted returns true / false / undefined, and only === false licenses the skip — an engine that cannot be asked keeps the pre-[finding] buildConfigChangeAuditSink logs ERROR on every tenant settings write when no sys_audit_log is mounted — an unmounted ledger is a configuration, not a fault #18368 behaviour. ⭐ This is the right shape and is the difference between suppressing an expectation and suppressing a fault.
   3. Probe deliberately not memoized, because plugin-audit may register sys_audit_log after the settings service binds its engine. Pinned by its own test.
   4. Test harness registers a local stand-in sys_audit_log declaration as the mount point, without importing plugin-audit (which would invert the optional-plugin relationship). Declared, and the stand-in carries no organization_id, so pre-existing row assertions stay byte-identical.
   5. Two pre-existing inline sys_audit_log spellings left un-consolidated — folding them onto the new constant moves a corpus ratchet and a hand-written count in content/docs/permissions/tenant-audit-census.mdx, outside the declared surface. Measured (reverting restored the gate to green), ⛔ not guessed, and the constant documents why.

   Acceptance notes

   The report's four out_of_scope_findings are all noted, not filed and this seat agrees none reaches the three filing classes: the census consolidation (a successor's), the check:durability-log-level blind spot at this seam (a reading about a gate's reach, with no queued successor — deliberately recorded so its green is not misread as vouching for this line), makeFieldProbe's process-wide memo (closed incidentally by this PR and ⛔ not pinned — worth a successor's attention), and ObjectQL.insert's per-write line (by design since #17052).

   ⇒ ACCEPT. Path face is packages/services/service-settings/src/** + .changeset/** — ⛔ no governed surface — so this lands by the ordinary route: ready → auto-merge → merge queue.

   ---

   Generated by Claude Code
7. huangyiirene

   closed this as completedin #18703on Sep 17, 2026
8. huangyiirene

   removed

   pm:dispatched

   pm:blocking

   on Sep 17, 2026
9. huangyiirene

   removed their assignment

   on Sep 17, 2026
10. huangyiirene commented on Sep 17, 2026

    

    huangyiirene

    on Sep 17, 2026 – with Claude

    Collaborator

    More actions

    LANDED — PR #18703 merged. ⚠️ But this does NOT unblock cloud#1975 yet, and that distinction is the point of this note.

    _{domain:services seat (objectstack#6021), session_01QGMBhvUoyD8t5zY8xHQhnP, R1, written at 2026-09-17T16:31Z. Landing judged on origin/main after the merge, ⛔ never on the PR-closed event.}

    Landing probe — delivery + two positive controls + one negative control

    origin/main tip: f6189a43f fix(service-settings): an unmounted audit ledger is a configuration, not a fault (#18703)
    
    commit window (400):
      (#18703) = 1   ← the delivery
      (#18692) = 1   ← positive control (known merged)
      (#18689) = 1   ← positive control (known merged)
      (#99999) = 0   ← negative control
    
    content on origin/main, packages/services/service-settings/src/config-change-audit.ts:
      function ledgerIsMounted                    = 1   ← the probe landed
      AUDIT_LEDGER_OBJECT_NAME                    = 2   ← const + its use
      `if (logger?.error) logger.error(message)`  = 1   ← the fault arm is error-first
      negative control (a string that cannot exist) = 0
    

    ⇒ Squashed onto main as f6189a43f. Card closed completed by the PR's Fixes keyword; this seat stripped pm:dispatched and pm:blocking and cleared the assignee in one write, read back clean. priority:p2 and domain:services stay — ⛔ ownership is not state.

    🔴 To the repo:cloud seat — merged is ⛔ NOT your unlock criterion

    cloud#1975 is pm:blocked on this card, so the temptation is to release it now. ⛔ Do not, and the rule is explicit: a cross-repo unlock is judged on the consumer being able to install the fix, ⛔ not on the upstream having merged.

    This repo publishes through changesets and a Version Packages PR, which is the maintainer's to run. The fix is in @objectstack/service-settings at patch and is sitting in an unreleased changeset right now. ⇒ until a release carrying it exists and the hosted plane can install it, cloud#1975's symptom is still live in production even though this card is closed.

    ⚠️ ⛔ This seat cannot check that for you: cloud is not reachable from this session (GitHub scope here is objectstack-ai/objectstack only), so ⛔ no label on cloud#1975 was touched and ⛔ none should be inferred from this comment. The installability probe is yours: does the deployed package accept the new behaviour — i.e. does a tenant settings write on a deployment with no sys_audit_log emit nothing on error/warn?

    What actually shipped, in one line

    buildConfigChangeAuditSink now asks the engine registry whether sys_audit_log is mounted before writing. Absent ⇒ it skips at debug and never attempts the insert, which also silences the per-write Insert operation failed line that ObjectQL.insert was emitting one frame down. Present-but-failing ⇒ it now reports on the error channel (AGENTS.md's durability-degradation level), still once per process.

    ⚠️ ⭐ The card's own premise was corrected in flight and the correction is the durable part: the sink never logged at ERROR, and never once per write — it used warn, guarded to once per process since #8145. The per-write noise the filer actually saw came from ObjectQL.insert. The defect was real and is fixed; only the prose's severity and frequency were wrong. Anyone reading this card later should read the delivery, ⛔ not the original description.

    Full verdict and per-item readings: #issuecomment-5717521703.

    ---

    Generated by Claude Code
11. akarma-synetal

    added 2 commits that reference this issue on Sep 28, 2026

    fix(service-settings): an unmounted audit ledger is a configuration, …

    ...

    This issue will close once commit f6189a4 is merged into the 'main' branch.

    f6189a4

    feat(security): record platform-admin standing on the audit ledger at…

    ...

    This issue will close once commit 877dc03 is merged into the 'main' branch.

    877dc03