@@ -0,0 +1,10 @@
+---
+'@objectstack/service-automation': patch
+---
+
+fix(service-automation): the region refusal cancels the child run it leaves behind even when the suspension store cannot be read
+
+Clause-②: no
+Metadata-protocol: none
+
+When a `subflow` or `map` call inside a `loop` body, a `parallel` branch or a `try_catch` slot starts a child flow that suspends, the run fails at the region boundary and the child run it parked is cancelled. That cancel walked the child's suspension chain through a best-effort read, so a suspended-run store it could not read handed back an empty chain: nothing was cancelled, only a `warn` was logged, and the child run could stay parked, to be resumed later for a caller that had already failed. Now an empty chain still cancels the child run once through `cancelRun`. If the store answers by then, the child is cancelled; if it is still unreadable, `cancelRun` logs the skipped cancellation at `error`, naming the run to cancel by hand. The refusal itself, its text and its un-routability are unchanged.
@@ -860,6 +860,18 @@ export async function runRegion(
                 try {
                     const chain = await this.resolveSuspensionChain(childRunId);
                     const reason = `the run that started it failed at a region boundary: ${refusal.message}`;
+                    if (chain.length === 0) {
+                        // [#29166] The chain is read through the DEGRADING
+                        // loader, so a store it cannot read reads as "nothing
+                        // suspended" and walking it cancelled nothing, with
+                        // only that loader's `warn` said, while the child run
+                        // stayed parked. The child id is known here, so it is
+                        // cancelled once anyway: `cancelRun` reads through the
+                        // STRICT loader and owns the `error` record when the
+                        // store is still unreadable, and it is a no-op when
+                        // there really is no suspension under that id.
+                        await this.cancelRun(childRunId, reason);
+                    }
                     for (const run of [...chain].reverse()) await this.cancelRun(run.runId, reason);
                 } catch (cancelErr) {
                     // #4632 verdict: DURABILITY, `error`, as `cancelRun`'s own
 
@@ -37,6 +37,12 @@ import { markGuardRefusal } from './guard-refusal.js';
  * `subflow` / `map`, `runRegion` also cancels the child run that node parked,
  * so nothing is left parked under a run that failed.
  *
+ * The un-routability below holds inside the run that met the refusal. One call
+ * level up it does not, on purpose ([#29166], seat ruling record 6576815635,
+ * option B): when this refusal fails a CHILD run, its caller's `subflow` /
+ * `map` node meets an ordinary child failure, routable like any other, and
+ * the arming gate does not decline that caller. See `subflow-region-guard.ts`.
+ *
  * ## Why a dedicated error and not the plain `Error` this replaces
  *
  * `runRegion` already converted a region-contained suspension — into a plain
 
@@ -21,6 +21,18 @@
  * child's whose own child can suspend, transitively. A child's region-nested
  * call is not read as a way for the CHILD to suspend: it fails the run at the
  * child's own region instead, so it never parks the caller.
+ *
+ * [#29166, seat ruling record 6576815635, option B] So the decline is one
+ * level deep BY DESIGN, not by omission. A caller whose call (top-level or
+ * not) reaches a child that itself makes a region call to a suspending flow is
+ * armed: that child's region refusal fails the CHILD run, and the caller meets
+ * it as an ordinary child failure, which the `subflow` / `map` contract makes
+ * routable. Measured: with no `fault` edge on the caller's call node, the
+ * caller's run fails loudly naming the child's region; with one, the caller's
+ * run completes. Declining such a caller would refuse a flow whose author
+ * routed that failure. The defect is the child's, and this gate names it on
+ * the child the moment the child has a trigger of its own. Keeping the
+ * refusal un-routable one level up would be a separate narrowing decision.
  */
 
 import { collectFlowGraphs } from '@objectstack/spec/automation';
 
@@ -21,13 +21,22 @@
 //     caller. The refusal now cancels the child run, and any run that child is
 //     parked on, through the engine's own `cancelRun`.
 //
+// [#29166] The chain that cancel walks is read through the DEGRADING loader
+// (`loadSuspendedRun`), so a store it cannot read hands back an empty chain.
+// Measured before that card: zero `cancelRun` calls, a `warn` from the
+// degrading read, and the child left parked with nothing at `error`. An empty
+// chain now still cancels the child run once, through `cancelRun`, whose
+// strict read owns the `error` record when the store stays unreadable.
+//
 // Neither half changes the refusal itself (code, text, un-routability) or
 // `FLOW_PAUSE_CAPABLE_NODE_TYPES`.
 
 import { describe, it, expect, vi } from 'vitest';
 import { AutomationEngine } from './engine.js';
 import type { FlowTrigger, FlowTriggerBinding } from './engine.js';
 import { InMemoryFlowActivationStore } from './flow-activation-store.js';
+import { InMemorySuspendedRunStore } from './suspended-run-store.js';
+import type { SuspendedRun } from './engine.js';
 import {
     registerSubflowNode,
     registerMapNode,
@@ -283,3 +292,72 @@ describe('the region refusal cancels the child run it leaves behind (#28897)', (
         expect(parked).toEqual(['deal_review', 'deal_submit']);
     });
 });
+
+/**
+ * [#29166] A store whose `load` fails for the child flow's runs: always
+ * (`'always'`), or only the first time each run id is read (`'once'`, a store
+ * that answers again by the time the cancel reads it).
+ */
+class ChildLoadFailingStore extends InMemorySuspendedRunStore {
+    private readonly failedOnce = new Set<string>();
+    constructor(private readonly childFlow: string, private readonly mode: 'always' | 'once') {
+        super();
+    }
+    override async load(runId: string): Promise<SuspendedRun | null> {
+        const row = await super.load(runId);
+        if (row?.flowName === this.childFlow && (this.mode === 'always' || !this.failedOnce.has(runId))) {
+            this.failedOnce.add(runId);
+            throw new Error('store connection reset');
+        }
+        return row;
+    }
+}
+
+describe('the region refusal still cancels the child run when its suspension chain cannot be read (#29166)', () => {
+    function storeRig(mode: 'always' | 'once') {
+        const r = rig();
+        const store = new ChildLoadFailingStore('deal_review', mode);
+        r.engine.setSuspendedRunStore(store);
+        r.engine.registerFlow('deal_review', pausingChild('deal_review'));
+        r.engine.registerFlow('deal_submit', regionCaller('deal_submit', 'deal_review', 'loop', 'subflow', false));
+        const cancel = vi.spyOn(r.engine, 'cancelRun');
+        return { ...r, store, cancel };
+    }
+
+    it('an unreadable store: the refusal is thrown as before, the child run gets exactly one cancelRun, and the skipped cancellation is recorded at `error`', async () => {
+        const { engine, logger, store, cancel } = storeRig('always');
+
+        const result: any = await engine.execute('deal_submit', {} as any);
+        // The refusal itself is unchanged.
+        expect(result.success).toBe(false);
+        expect(String(result.error)).toContain(
+            `durable pause inside a structured region: node 'step' (sub-flow 'deal_review') suspended`,
+        );
+
+        const parked = await store.list();
+        expect(parked.map((r) => r.flowName), 'the store could not be read, so the child is still parked').toEqual(['deal_review']);
+        const childRunId = parked[0].runId;
+
+        expect(cancel).toHaveBeenCalledTimes(1);
+        expect(cancel.mock.calls[0][0]).toBe(childRunId);
+        expect(String(cancel.mock.calls[0][1])).toContain('durable pause inside a structured region');
+
+        const errors = logger.error.mock.calls.map((c: unknown[]) => String(c[0]));
+        expect(
+            errors.filter((m: string) => m.includes(`cancelRun('${childRunId}') could not read the durable suspended-run store`)),
+            "cancelRun's strict read owns the error record",
+        ).toHaveLength(1);
+    });
+
+    it('a store that answers again by the cancel: the child run the empty chain hid is cancelled, not left parked', async () => {
+        const { engine, store, cancel } = storeRig('once');
+
+        const result: any = await engine.execute('deal_submit', {} as any);
+        expect(result.success).toBe(false);
+
+        expect(cancel).toHaveBeenCalledTimes(1);
+        expect(await store.list(), 'no run is left parked').toEqual([]);
+        const runs = await engine.listRuns('deal_review');
+        expect(runs.map((r: any) => r.status)).toEqual(['cancelled']);
+    });
+});
Original file line number	Diff line number	Diff line change
`@@ -37,6 +37,12 @@ import { markGuardRefusal } from './guard-refusal.js';`
`37`	`37`	* `subflow` / `map`, `runRegion` also cancels the child run that node parked,
`38`	`38`	`* so nothing is left parked under a run that failed.`
`39`	`39`	`*`
	`40`	`+ * The un-routability below holds inside the run that met the refusal. One call`
	`41`	`+ * level up it does not, on purpose ([#29166], seat ruling record 6576815635,`
	`42`	+ * option B): when this refusal fails a CHILD run, its caller's `subflow` /
	`43`	+ * `map` node meets an ordinary child failure, routable like any other, and
	`44`	+ * the arming gate does not decline that caller. See `subflow-region-guard.ts`.
	`45`	`+ *`
`40`	`46`	* ## Why a dedicated error and not the plain `Error` this replaces
`41`	`47`	`*`
`42`	`48`	* `runRegion` already converted a region-contained suspension — into a plain