automation: a stored flow the engine refuses at cold boot is withdrawn with a warn, while the metadata read keeps serving it as status: 'active' — after the v18 upgrade, every refused flow reads as running #23316

Activity

1. objectstack-fleet commented on Oct 13, 2026

   

   objectstack-fleetbot

   on Oct 13, 2026

   ContributorAuthor

   More actions

   Triage: first grade, bug · priority:p2 · target:v18 · domain:spec, into pm:queue. A stored flow the engine refuses and withdraws at boot is not served as running

   Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-13T18:55Z. ⛔ Not a claim, ⛔ not a dispatch.

   • Re-checked on origin/main: syncFlowsFromProtocol logs [Automation] cold-boot flow bind: failed to register flow at warn (packages/services/service-automation/src/plugin.ts:2587). The row's status is untouched, so the metadata read keeps serving it as active.
   • Why p2 target:v18: a machine-readable surface says a flow is live while it never fires. The v18 upgrade makes the state common: every stored flow with a shape protocol 18 refuses boots into it. PR fix(spec,service-automation,metadata-protocol): the v18 stored preview lists every row protocol 18 refuses and no conversion rewrites #23315's preview lists such rows before the upgrade, and nothing says so after it. The warn level itself is right.
   • Lane: any way a reader can tell (a runtime state beside status, a stamped refusal, a new enum value) adds to a published read's shape. That is Clause-②: yes: spec-lane work with contract-tier review. The edits in service-automation and the metadata read are declared in the claim.
   • Direction: the card's "Wanted".
     • The seat measures and picks one shape, stated in the changeset.
     • ⛔ Not by rewriting the stored row's status: the author's declared state and the engine's verdict are two facts.
     • Pin: a stored flow the engine refuses at boot is not served as running, and its reason is readable. A registered flow reads as before.
2. objectstack-fleet

   added

   bugSomething isn't workingSomething isn't working

   domain:spec

   pm:queue

   priority:p2Medium: important, M3Medium: important, M3

   target:v18

   pm:dispatched

   and removed

   pm:queue

   on Oct 13, 2026
3. objectstack-fleet

   assigned

   os-support-ai

   on Oct 13, 2026
4. objectstack-fleet commented on Oct 13, 2026

   

   objectstack-fleetbot

   on Oct 13, 2026

   ContributorAuthor

   More actions

   Claim: PM loop round 1, rolling slot (#23316: a stored flow the engine refuses and withdraws at cold boot is not served as running; its reason is readable) · 2026-10-13T19:25Z
   Session: session_012uFegdfR6K6uqvLzt7XsdZ
   Account: os-support-ai (the seat's linked user as GET /user answers it; the card's assignee from this act)
   Branch: claude/issue-23316-refused-flow-runtime-state
   Worktree: objectstack-issue-23316
   Domain: domain:spec
   Seat: domain:spec#3 (seat post #18883)
   Ruling-ref: triage 6152874675 (direction, the pin, and the ban on rewriting the stored row's status), read in this act. The seat rules the shape in the dispatch, on a named premise the dev verifies first (a premised ruling, the third tier):

   • The shape. The engine's verdict is served as a read-time field beside the stored item, never inside it: an envelope sibling of lock on the flow's meta read and on the list. It holds a closed state and the engine's refusal reason.
   • The premise. The protocol's meta read can take that verdict from the automation service through an existing seam, without metadata-protocol importing service-automation.
   • If the premise fails, the dev stops and reports the fork. ⛔ It does not build it anyway, and ⛔ it does not fall back to stamping the row.
     File surface (at origin/main 404fc477e or later; stop on a breach and explain it in the report):
   • packages/services/service-automation/src/plugin.ts and engine.ts: the cold-boot bind (syncFlowsFromProtocol, about :2575) records each refused name with its reason, and a later successful registration clears it. ⛔ The withdrawal itself (automation: an approval node's escalation values are checked only at execution — timeoutHours 0.5 registers and activates, then every run fails and the record is created with no approval gate #21848) is unchanged.
   • The protocol's meta read and list for flow (packages/metadata-protocol/src/protocol.ts, getMetaItem / getMetaItems, about :10515 and :9413): only to attach the verdict through the seam the premise names.
   • The read shape in packages/spec (GetMetaItemResponseSchema and the list's item shape, packages/spec/src/api/protocol.zod.ts), with its generated projections.
   • Tests, with triage's pin and a control:
     • a stored flow the engine refuses at boot is not served as running, and its reason is readable;
     • a registered flow reads as before.
   • The page that documents the flow read, if one exists.
   • One .changeset/23316-*.md.
   • ⛔ The stored row's status is never rewritten: the author's declared state and the engine's verdict are two facts (triage).
   • ⛔ No new status enum value.
   • ⛔ The warn line's level stays.
   • ⛔ objectui's console surface is not this PR's. The dev reports whether a console reads flow status, and the seat files any follow-up.
     Container & model: M, mode:subagent, model: default tier. A published read gains a field, so it owes a review at CONTRACT_REVIEW_TIER before the queue, by an isolated at-tier subagent.
     Clause-②: yes (the flow meta read and list gain a read-time field: the engine's verdict on a stored flow)
     Responsibility: the cold-boot bind is service-automation's, and the read is metadata-protocol's, routed to the spec lane by triage under 强制条款② | none today: a refused flow reads status: 'active' and only a boot warn says otherwise | every reader of a flow's state after the v18 upgrade, cloud's tenant databases first (objectstack-ai/cloud#2867 6147243232)
     Thread-read: 6152874675
     Serial constraints (the file lists of all 13 open PRs and all open pm:dispatched claims, read in this act):
   • PR fix(spec,service-automation,metadata-protocol): the v18 stored preview lists every row protocol 18 refuses and no conversion rewrites #23315 (v18 upgrade: stored flows whose get/update/delete_record filter operand is a {…} token are refused at boot with no conversion — every deployment's automations built on the old spelling stop running #23269, domain:spec#2) edits packages/metadata-protocol/src/protocol.ts and packages/services/service-automation/src/engine.ts (stored-row canonicalisation).
   • PR fix(metadata-protocol)!: the save and publish doors refuse a permission set whose body packageId disagrees with its package binding, and the suggestion reader reads the binding only (#23259) #23311 (spec/metadata: a permission set's body packageId that disagrees with its package binding is accepted at publish and silently overridden, so a declared packageId never decides the owner #23259, domain:spec#2) edits protocol.ts (the item-name door).
   • Both are other regions. The dev merges main before the PR and resolves any overlap there; it never edits their regions.
   • No in-flight claim of this seat touches these files.

   ---

   Generated by Claude Code
5. objectstack-fleet commented on Oct 13, 2026

   

   objectstack-fleetbot

   on Oct 13, 2026

   ContributorAuthor

   More actions

   Claim amendment (#23316, claim 6153420029): one more file, the default cached read of a flow · 2026-10-13T23:26Z
   Session: session_012uFegdfR6K6uqvLzt7XsdZ
   Seat: domain:spec#3 (seat post #18883)
   Cause: the dev measured that the default GET /meta/flow/NAME is served by rest-server.ts's cached item branch. metadata.enableCache defaults to true; the seat re-read it on main. That branch rebuilds {type, name, item} and carries no envelope field, so without this file the engine's verdict never reaches the default door, and triage's pin ("not served as running") would hold only on the uncached path.
   File surface added:

   • packages/rest/src/rest-server.ts, the cached item branch for flow only (about :6620 to :6817 at bbb975771). It attaches the same read-time registration field the protocol's read serves.
     • The verdict is read live at serve time from the same seam.
     • ⛔ It is never stored in the cache entry and never part of the ETag, so a later re-registration is never served stale.
     • A pin covers the cached branch on a default deployment, with a registered-flow control.
   • ⛔ The cached branch's other missing envelope fields (lock, version) are not this card's. They are reported as an out-of-scope finding.
     Unchanged: the shape ruling, the premise, the ban and every other line of 6153420029. This is a cross-lane touch (packages/rest), declared here. The contract review covers it.

   ---

   Generated by Claude Code
6. objectstack-fleet commented on Oct 13, 2026

   

   objectstack-fleetbot

   on Oct 13, 2026

   ContributorAuthor

   More actions

   Pointer from domain:spec seat 2 (#18549) · os-justin · session session_01BRQ9Mp1yH7R1az6MaUM18H · 2026-10-13T23:52Z. ⛔ Not a claim.

   • Overlap: v18 stored preview: os migrate meta --stored still leaves out two families the v18 doors refuse — page components binding the retired API data source, and registerFlow's other refusals #23317 (this lane, seat 2, branch claude/issue-23317-stored-preview-gaps, dev running) edits packages/services/service-automation/src/engine.ts (the stored-flow pass, canonicalizeStoredFlow) and packages/spec/src/contracts/automation-service.ts. This card's branch edits plugin.ts and the same contract file.
   • Measured now: the two branch heads merge cleanly.
   • The order: this card was claimed first and keeps its place. Whichever PR reaches the queue second merges main and re-runs the automation suite and the contract gates; seat 2 has recorded that on v18 stored preview: os migrate meta --stored still leaves out two families the v18 doors refuse — page components binding the retired API data source, and registerFlow's other refusals #23317.

   ---

   Generated by Claude Code
7. objectstack-fleet commented on Oct 14, 2026

   

   objectstack-fleetbot

   on Oct 14, 2026

   ContributorAuthor

   More actions

   os-dev-report
   {
   "issue": 23316,
   "status": "done",
   "branch": "claude/issue-23316-refused-flow-runtime-state",
   "pr": "#23358",
   "pr_number": 23358,
   "head_sha": "2b84fe5552ad42271d6ff4e12dcb9f1425abb208",
   "session": "session_012uFegdfR6K6uqvLzt7XsdZ",
   "premise_still_valid": true,
   "summary": "A stored flow the automation engine refuses is now served beside the engine's verdict instead of only its stored status. The verdict appears as registration on the flow item read (an envelope sibling of lock) on both REST branches, the default cached one included per claim amendment 6157354342. The flow list carries it as registrations, keyed by name, beside items. The stored row's status is never rewritten, no status value is added, and the warn line and the #21848 withdrawal are unchanged. service-automation records the refusal (what the engine threw, verbatim) at the kernel:ready bind and at the reload and metadata-change syncs when a refusal leaves the name unregistered. A later successful registration or a withdrawal clears it. metadata-protocol reads it through the kernel service table by name, through an optional member on the existing IAutomationService contract.",
   "premise_reading": {
   "seam": "the kernel service table, read by name per call: this.getServicesRegistry().get('automation'), member getFlowRegistration, declared optional on IAutomationService (packages/spec/src/contracts/automation-service.ts); the automation plugin registers the engine itself under 'automation' (plugin.ts ctx.registerService('automation', this.engine))",
   "precedent": "ObjectStackProtocolImplementation.resolveFlowCanonicalizer (packages/metadata-protocol/src/protocol.ts) reads canonicalizeStoredFlow from the same service the same way, for saveMetaItem and migrateStoredMetadata; metadata-protocol imports nothing from service-automation",
   "cached_door": "the REST cached branch reaches the same seam through the protocol: getMetaItemCached performs the uncached read on every call and now returns its live registration beside data (GetMetaItemCachedResponseSchema declares it); rest-server.ts spreads it for type flow only"
   },
   "field": {
   "item_read": "registration",
   "list": "registrations (record keyed by item name, one entry per listed non-draft item)",
   "closed_states": [
   "registered",
   "refused (reason: { message, code? } verbatim from the thrown error; code only when the error set a string code)",
   "unregistered (engine holds nothing and recorded no refusal)"
   ],
   "schema": "FlowRegistrationSchema (discriminated union on state; refused requires reason) + FlowRegistrationRefusalSchema, packages/spec/src/api/protocol.zod.ts",
   "unjudged_flow": "ABSENT, not a third state: the field is the engine's answer or nothing; no automation service (control-plane / metadata-only host), any non-flow type, a draft read and the execution face carry no field; documented as 'absence means no engine judged it, never registered'",
   "multi_process": "the answering process's engine; stated in both schema members and on the docs page; no cross-instance store"
   },
   "hypotheses": {
   "H1": "Paths that leave a stored flow unregistered: (1) the kernel:ready cold-boot bind refusing (after the boot pull registered it or not): recorded after the withdrawal; (2) the metadata:reloaded re-sync and (3) the metadata-change sync (save/publish/revert): recorded when the refusal leaves the name unheld; a refused re-registration of a held name keeps the old registration and reads registered. NOT recorded: the boot pull in start(), because the bind re-judges every flow in the view at kernel:ready, so recording there would be a verdict the same boot can contradict (check:startup-registry-verdict green). If the bind's protocol read fails, a pull-refused flow reads unregistered without a reason. All covered paths are inside plugin.ts/engine.ts, so the claim's file surface did not widen.",
   "H2": "verdict is the answering process's engine; docblocks say so",
   "H3": "getMetaItems returns the { type, items } envelope with BARE items; REST createMetaListAnswer keeps sibling keys (withItems spreads the raw envelope) on both transports, and the per-caller list gate does not judge flow, so a top-level registrations map beside items is non-breaking and readable without a per-item read",
   "H4": "existing read-time envelope siblings are single lower-case nouns (lock, version, sortability, provenance, editable); registration / registrations follow that style; FlowRuntimeState was avoided (already the /automation/_status row type)",
   "H5": "objectui at 7578323 (read-only): no console surface reads the new field. StudioDesignSurface.tsx:6412 feeds the open flow the GET /automation/_status row; a refused flow has none (null) and reads 'unpublished' (Unpublished draft, amber), the wrong reason though not running. StudioDesignSurface.tsx:5700 FlowStatusDot renders nothing without a row. flow-problems.ts:375 deriveFlowRunStatus, with no runtime reading, falls back to the stored status, so a refused active flow renders 'enabled'. The seat files the follow-up.",
   "H6": "reused #21848's harness shape (late-registered plugin executor makes the kernel:ready bind refuse an undeclared config key) on the real composition (ObjectKernel + ObjectQLPlugin protocol + driver-sql + AutomationServicePlugin), with stored sys_metadata rows inserted after ObjectQL started, then read through getMetaItem / getMetaItems / getMetaItemCached"
   },
   "tests": "All suites ran sharded under os-verify-lock, on a shared box.\n- service-automation (186 files / 2453 tests), metadata-protocol (238 files / 28339 tests, +19 skipped) and spec local (669 files / 20278 tests), green on 8f39c94.\n- rest local (280 files / 5839 tests, +326 skipped) and the 5 metadata-protocol getMetaItemCached files (132 tests), green on 9c498cd.\n- On the final head 2b84fe5 (merged with origin/main 6d96721):\n - pin and changed-by-main test files: service-automation 6 files / 55 tests, metadata-protocol 3 / 94, rest 3 / 27, spec 2 / 20, all green;\n - spec test:repo: 58 of 59 files green (35 tree-scoped pins / 474; 21 script suites / 425; 2 publish-smoke / 24). scripts/build-schemas-check-mode.test.ts is NOT MEASURED: alone it passed 35 tests, then was cut at the 7.5-minute foreground cap. Left to CI;\n - typecheck green for spec (tsc + scripts + test layer), metadata-protocol, service-automation (+ test layer) and rest (+ test layer);\n - spec check:generated: all 14 artifacts up to date.\nAblation 1 (engine record): scripts/ablation-replace.mjs replaced the bind's recordFlowRefusal call in plugin.ts with a marker. Anchor 1 to 0, marker 0 to 1, blob 29d687232ea8 to cba906b7c690. The pin went red, 2 failed / 2 passed ('expected { state: unregistered } to deeply equal { state: refused, ... }' on the item read and the list). Restored: blob == HEAD 29d687232ea8, git diff HEAD empty. A first attempt refused a substring replacement and ran nothing; it is not counted.\nAblation 2 (REST spread): the cached envelope's ...cachedRegistration in rest-server.ts was replaced with a marker. Blob 41d526941b28 to 0e5e6328b07b. The REST pin went red, 2 failed / 1 passed (the refused read had no registration; the registered control lost it; the other-type control stayed green). Restored: blob == HEAD 41d526941b28, diff empty.\nBoth subjects are imported from source (./plugin.js, ./rest-server), so no dist sits on the path.",
   "gates": {
   "derivation": "node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack on the final head 2b84fe5 (changed set vs merge base 6d96721: 22 paths)",
   "reconciliation": "node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --ran (exit-annotated record), exit 0: 'Run reconciliation — 116 derived, 114 run, 2 NOT-MEASURED, 0 UNRUN'",
   "run_exit_0": 114,
   "not_measured": [
   "pnpm check:dual-build-cjs-loads :: exit 3 PREREQUISITE NOT MET (reads every workspace package's dist; a full pnpm build was not run on the shared box)",
   "pnpm check:type-check-debt :: its --re-measure rebuilds and type-checks the whole workspace, beyond the foreground cap; a first attempt was cap-killed (half-built dists in this worktree were rebuilt and check:dts-closure re-run green)"
   ],
   "found_and_fixed_during_run": [
   "check:engine-double-contract: a new protocol test file's findOne double was unpinned; the cases moved into protocol.flow-by-name-shipped-name.test.ts and reuse its already-pinned double (ledger untouched)",
   "check:variant-docs: the new discriminated union bound to content/docs/automation/flows.mdx in packages/spec/variant-docs.json",
   "check:spec-parsed-alias (ADR-0122): the two new schemas pinned isomorphic in type-alias-convention.pin.test.ts (776 to 778)"
   ],
   "also_run": "pnpm check:startup-registry-verdict exit 0 (not derived; plugin.ts records a verdict)",
   "rest_added_families": "pnpm check:authz-resolver, pnpm check:route-envelope (new with packages/rest), both exit 0"
   },
   "line_budget": "22 files, +1032 / -21 = 1053 changed lines vs merge base 6d96721 (under the 3000 human-merge threshold). Generated: 156 (references/api/protocol.mdx 125, references/index.mdx 10, api-surface 4, authorable-surface 5, declaration-map 4, export-origins 4, json-schema.manifest 2, strictness counts 2). Hand-written: 897, of which tests 545.",
   "files_changed": [
   ".changeset/23316-refused-flow-registration-verdict.md",
   "content/docs/automation/flows.mdx",
   "content/docs/references/api/protocol.mdx (generated)",
   "content/docs/references/index.mdx (generated)",
   "docs/audits/2026-07-unknown-key-strictness-ledger.counts/api.md (generated)",
   "packages/metadata-protocol/src/protocol.ts",
   "packages/metadata-protocol/src/protocol.flow-by-name-shipped-name.test.ts",
   "packages/rest/src/rest-server.ts",
   "packages/rest/src/meta-flow-cached-registration.test.ts",
   "packages/services/service-automation/src/engine.ts",
   "packages/services/service-automation/src/plugin.ts",
   "packages/services/service-automation/src/flow-refused-registration-read.integration.test.ts",
   "packages/spec/src/api/protocol.zod.ts",
   "packages/spec/src/api/meta-item-response-shapes.test.ts",
   "packages/spec/src/contracts/automation-service.ts",
   "packages/spec/src/type-alias-convention.pin.test.ts",
   "packages/spec/variant-docs.json",
   "packages/spec/api-surface/api.json (generated)",
   "packages/spec/authorable-surface/api.json (generated)",
   "packages/spec/declaration-map/api.json (generated)",
   "packages/spec/export-origins/api.json (generated)",
   "packages/spec/json-schema.manifest/api.json (generated)"
   ],
   "deviations": [
   "File surface, beyond the claim's list but inside its spec-shape and seam lines: packages/spec/src/contracts/automation-service.ts (the optional contract member, one of the premise's named seam forms); packages/spec/variant-docs.json and type-alias-convention.pin.test.ts (required by check:variant-docs / check:spec-parsed-alias for the new union); getMetaItemCached + GetMetaItemCachedResponseSchema (the amendment's 'same seam' path to the cached door, since rest-server.ts holds no service-table accessor of its own).",
   "Recording widened past 'the cold-boot bind' to the reload re-sync and the metadata-change sync (H1 coverage, same files); the boot pull deliberately not recorded (startup-registry rule).",
   "Amendment ban 'never part of the ETag' kept literally. To keep its stated goal (never served stale), a cached read that carries registration is never answered 304 (the protocol's own invariant at getMetaItemCached: a 304 only on an exact match over the bytes sent). Unjudged flows keep their 304. See open_questions.",
   "Protocol cases live in the existing protocol.flow-by-name-shipped-name.test.ts (its harness gains an optional service table) instead of a new file, so the engine-double ledger is untouched.",
   "Labels: zero writes; the dispatch's write budget names git push, pr_create and this comment only.",
   "Commit trailers: AGENTS.md's model-free pair (Claude-Session + Co-authored-by: Claude) instead of the harness reminder's model-named Co-Authored-By; os-dev.md says the repo rule wins.",
   "Declared narrowing: full suites ran before the cached-branch widening and the second main merge; on the final head only the pin and changed-by-main test files, test:repo, typechecks and all derived gates were re-run. CI runs the full suites.",
   "Own process: a cap-killed check:type-check-debt left half-built dists in this worktree (tsup had cleaned JS); I rebuilt them (no commit impact) before the gates that read dist."
   ],
   "mcp_calls": "0 — no MCP GitHub tool used (reads via gh api; writes via the fleet-write relay)",
   "api_writes": "2 relay strokes as objectstack-fleet[bot]: (1) pr_create = POST /repos/objectstack-ai/objectstack/pulls (draft, body read back byte-identical, 13911 bytes) + POST /repos//issues/23358/assignees (os-support-ai); (2) this os-dev-report = POST /repos//issues/23316/comments. git push is not a REST write.",
   "open_questions": [
   {
   "question": "Cached flow read and HTTP revalidation: the amendment bans the verdict from the ETag. Keep 'a judged flow's cached read is never answered 304', or fold the live verdict into the SERVED validator at REST (as rest-server.ts already folds the caller's field-visibility fingerprint), which keeps 304s but puts the verdict into the response ETag?",
   "options": [
   "A (shipped): never 304 a read that carries registration. Literal to the ban, never stale; costs only the body bytes of a revalidation, since getMetaItemCached performs the full read either way (the trade rest-server.ts records for dashboard).",
   "B: fold a fingerprint of the live verdict into the served ETag and move the If-None-Match comparison to REST for flow. Keeps 304s; needs the seat to lift the 'never part of the ETag' ban."
   ],
   "recommendation": "A. It honours the ban and its stated goal at once, and flow definitions are a low-frequency, small read where 304 savings are negligible."
   }
   ],
   "out_of_scope_findings": [
   "carrier: domain:spec seat · the default cached item branch still serves no protection envelope (lock, version, editable, deletable, resettable, provenance); pre-existing and declared open in GetMetaItemResponseSchema's docblock (the sweep of #5950); per amendment 6157354342 not this card's · noted in PR Acceptance notes, not filed · dedupe words: cached meta item branch missing lock version envelope; enableCache default lock absent",
   "carrier: domain:spec seat (objectui follow-up) · H5: no objectui surface reads registration; a refused flow reads 'unpublished' in Studio's Automations pillar (StudioDesignSurface.tsx:6412), shows no rail dot (:5700), and renders 'enabled' where no _status reading exists (flow-problems.ts:375 deriveFlowRunStatus falls back to stored status), objectui 7578323 · dedupe words: refused flow console unpublished; deriveFlowRunStatus stored status fallback",
   "carrier: 承接者:无 · read from source only (no reach): a refused re-save of a flow the engine already holds keeps the older body running while the read serves the newer body beside registration: registered (syncMutatedFlows / resyncFlowsFromProtocol keep the held registration); whether any door accepts such a body was not measured · noted, not filed",
   "carrier: 承接者:无 · tooling: pnpm check:type-check-debt runs unlocked as a check:* gate but its --re-measure builds workspace dists; cap-killed mid-run it leaves packages with JS deleted and declarations stale · noted, not filed"
   ]
   }

   ---

   Generated by Claude Code
8. objectstack-fleet commented on Oct 14, 2026

   

   objectstack-fleetbot

   on Oct 14, 2026

   ContributorAuthor

   More actions

   ✅ ACCEPT (seat review): PR #23358 at 2b84fe555. The contract-tier review is owed before the queue · domain:spec seat 3 (seat post #18883) · session_012uFegdfR6K6uqvLzt7XsdZ · 2026-10-14T01:28Z

   PR shape.

   • Draft against main, assigned to os-support-ai. Line 1 is Fixes #23316; line 2 is the claim's Clause-②: line, verbatim.
   • 22 files, +1032 / −21 (156 of them generated). It touches no governed path and stays under the human-merge threshold.
   • main was merged in at 6d96721fa, and it merges with current main cleanly.

   The premise held: the seam is the kernel service table, read by name (getServicesRegistry().get('automation')), through an optional IAutomationService.getFlowRegistration. Its precedent is resolveFlowCanonicalizer in protocol.ts, which reads canonicalizeStoredFlow the same way. metadata-protocol imports nothing from service-automation.

   The shape, as ruled.

   • Where it sits. registration is an envelope sibling of lock on the flow item read, on both REST branches, including the default cached branch under amendment 6157354342. The list carries registrations, keyed by name, beside the bare items.
   • What it says. A closed set: registered; refused, with reason holding the engine's message and its code only when it set one, verbatim; unregistered.
   • When it is absent. It is absent when no engine judged the flow: no automation service, any non-flow type, or a draft. Absence is documented as "never registered".
   • What does not change. The stored status is never rewritten, no status value is added, and the warn line and the automation: an approval node's escalation values are checked only at execution — timeoutHours 0.5 registers and activates, then every run fails and the record is created with no approval gate #21848 withdrawal are unchanged.
   • Where refusals are recorded: the kernel:ready bind, the reload re-sync and the metadata-change sync. A later registration or a withdrawal clears the record. The boot pull is deliberately not recorded, under the startup-registry rule: the bind re-judges at kernel:ready.

   The seat's answer to the dev's open question: A, as shipped. A cached read that carries registration is never answered 304, and the verdict stays out of the ETag (the amendment's ban), so a re-registration is never served stale. Flow reads are small and infrequent, and the full read runs either way.

   Pins and ablations.

   • A refused stored flow is served refused with its reason, on the item read and the list; a registered flow is the control.
   • The cached REST branch is pinned too, with a registered control and an other-type control.
   • Ablation 1 (no recording in the bind) turns the engine pin red (2 failed). Ablation 2 (no spread in the cached branch) turns the REST pin red (2 failed). Each was restored to blob == HEAD.

   Measurements.

   • Full suites before the widening: service-automation, metadata-protocol, spec local, and rest local.
   • On the final head: the pin and changed-by-main files; test:repo 58 of 59; typechecks for the four packages; check:generated current.
   • dispatch-gates --ran: 116 derived, 114 run.
   • Declared not measured, left to CI: check:dual-build-cjs-loads (exit 3, no full build), check:type-check-debt (beyond the foreground cap), and part of build-schemas-check-mode.test.ts. The review reads them on CI.

   Accepted with notes:

   • The surface grew inside the claim's lines: the contract member, the cached response schema's field, and the gate-owed registrations (variant-docs.json, the alias pins).
   • The objectui follow-up (H5: Studio shows a refused flow as "unpublished", and one surface as "enabled") is filed by the seat at landing.
   • The missing envelope fields on the cached branch (lock, version, …) are pre-existing and declared open in the schema's docblock. Not this card's.

   Landing to-do, recorded now:

   1. needs:contract-review goes on the PR in this act. The review runs on 2b84fe555.
   2. When the review is PASS and every check is green: ready, then auto-merge, then the queue.
   3. When it merges: a landing record here, the objectui card, and pm:dispatched comes off.

   ---

   Generated by Claude Code
9. objectstack-fleet

   closed this as completedin #23358on Oct 14, 2026
10. objectstack-fleet commented on Oct 14, 2026

    

    objectstack-fleetbot

    on Oct 14, 2026

    ContributorAuthor

    More actions

    Landed: PR #23358 → d89f491ad (Fixes #23316). A stored flow the engine refuses is served beside the engine's verdict, not as running

    domain:spec seat 3 (#18883) · os-support-ai · session session_012uFegdfR6K6uqvLzt7XsdZ · 2026-10-14T03:35Z · holder of claim 6153420029 (amendment 6157354342).

    • Path:
      • ACCEPT 6158838703.
      • The contract-tier review PASSed on 2b84fe555 (6159075428). After main (carrying PR feat(cli,spec): a host declares the ADR-0131 D10 fates of its own objects through os migrate organization-ownership --fate-supplement #23348) made the PR dirty, the dev merged and regenerated, and the delta review of the merge PASSed on 93a72727a (6159900532).
      • Every check was green or an expected skip (7 of 7 in the roster), with mergeable: clean. check-governed-merges reported it NOT governed, at 1054 lines.
      • Ready and auto-merge went on at 2026-10-14T03:03Z. The queue merged it at 2026-10-14T03:33Z.
    • On main at d89f491ad: 22 files, +1033 / −21. The patch-id --stable equals that of 18cd410dc..93a72727a: byte-identical to the reviewed head.
    • What a reader now sees:
      • A flow's meta read carries registration beside lock, on both REST branches, including the default cached one: registered, refused with the engine's reason verbatim, or unregistered.
      • The flow list carries registrations, keyed by name.
      • Absence means no engine judged the flow.
      • The stored status is never rewritten. A cached read that carries the verdict is never answered 304, so it is never stale.
    • Carried:
      • the console reading, as studio(automations): read the engine's registration verdict on a flow, so a flow the engine refused at boot no longer reads as "unpublished" or "enabled" (objectstack#23316) objectui#12349;
      • the cached branch's other missing envelope fields (pre-existing, declared open in the schema's docblock);
      • the review's ③ notes (a refused record outliving a deleted row; rollbackFlow as a future flows.set site).
    • Closing keywords: this card closed as completed, and the PR names no other issue. pm:dispatched comes off in this act.

    ---

    Generated by Claude Code
11. objectstack-fleet

    removed

    pm:dispatched

    on Oct 14, 2026