[objectstack-fleet]

Requested by Leehom · project thread

Refs #31224

Clause-②: yes (narrowing)
Metadata-protocol: narrowed
Skills-docs: none — skills/** and content/docs/** teach only wired top-level flows; the edgeless examples in content/docs/automation/flows.mdx are region bodies, which this rule does not judge. The reasoning ships as the os explain flow-node-unreachable entry.

维护者速读

• 改了什么：@objectstack/lint 的 lintFlowPatterns 新增一个 error 级发现 flow-node-unreachable：流程顶层某个节点从 start 节点出发沿任何边都走不到，就报出该节点、它为何永远不会执行、以及修法（从会执行的节点连一条边进来，或删掉它）。另加 os explain 条目、测试和一个 lint minor changeset。
• 为什么改：Enforce-or-remove: four metadata shapes cloud's authoring rules warn about still parse clean (boolean required, open flow start config, orphan action nodes, roll-up filter keys) #31224 第 C 项。引擎从 start 节点开始沿边执行，走不到的节点永远不跑，但流程照样解析、注册、显示为已配置，作者得不到任何提示。
• 为什么不放在 parse：保存门 protocol-save.ts:1429 对每次保存（含草稿）都跑 FlowSchema，而 Studio 设计器删除节点时 edgesAfterNodeRemoval 会让后继节点断开。放在 parse 会让这类草稿直接存不了；放在 lint，草稿照存（发现写进 _diagnostics），发布被拒。
• 风险与回滚：收窄：os lint/validate/build 和流程发布门会拒绝此前接受的流程。普查为零：objectstack 54 个流程 238 个节点、hotcrm 35 个流程 256 个节点，不可达均为 0（对照：分别有 184、221 个非 start 节点可达）。回滚即 revert。
• 两分钟验证：pnpm --filter @objectstack/lint exec vitest run src/lint-flow-patterns.test.ts，预期 255 个全部通过，其中新 describe 的 10 条为本卡新增。
• 需要你做的：无，席位做契约复审后落地。

What changes

1. packages/lint/src/lint-flow-patterns.ts: FLOW_NODE_UNREACHABLE = 'flow-node-unreachable' and scanUnreachableNodes, called from lintFlowPatterns once per flow over the top-level graph. A breadth-first walk from the first start node over every top-level edge; one finding per node it does not reach, severity: 'error', at flow 'NAME' · node 'ID' (TYPE). The message names the start node and says why the node never runs; the hint is "Add an edge into it from a node that runs, or delete the node." A second start node (unreached by construction: a run starts at the first one) gets its own hint: delete the extra start, and wire what follows it from a node that runs.
   • Every edge type is a path: default, conditional, fault and back.
   • Exempt: a boundary_event node and the nodes reached only from one (attached to its host by boundaryConfig.attachedToNodeId, not entered by an edge; its own contract owns its refusal).
   • Not judged: region bodies (a region is a single-entry acyclic graph, which analyzeRegion / validateControlFlow already hold, so every node in one is reached); a flow with no start node; a flow with an edge whose endpoint names no node (the flow parse refuses that edge first, and reporting its target here would prescribe the wrong cure).
2. packages/lint/src/index.ts: exports FLOW_NODE_UNREACHABLE beside the other flow rule ids. This new export is why Clause-② reads yes (narrowing) rather than the claim's no (narrowing), following report publish gate: a report whose runtimeFilter names a field the dataset's object lacks publishes 200 and renders "Dataset query failed", where the same key on a dashboard widget filter is refused 422 #29900's changeset (new rule id exports under a narrowing).
3. packages/lint/src/rule-explanations.ts: the os explain flow-node-unreachable entry (what reaches a node, what is not judged, why lint and not parse, the gate reach).
4. .changeset/31224-flow-node-unreachable.md: '@objectstack/lint': minor, BREAKING banner, ADR-0087 not-required (no-migration-prescription): no key moves, and an unreached node never ran, so no rewrite keeps what the author meant.

Why lint, not the flow parse. A first build put the rule in FlowSchema.superRefine. It was taken back out (the revert commit on this branch leaves packages/spec byte-identical to main) for this reason. The metadata save door safeParses FlowSchema on every save, drafts included (packages/metadata-protocol/src/protocol-save.ts:1429, 422 INVALID_METADATA). The Studio designer's node delete (edgesAfterNodeRemoval, ui/packages/app-shell/src/views/metadata-admin/previews/flow-problems.ts:729) bridges the gap only when the deleted node had exactly one in-edge and one out-edge, and otherwise leaves the successor unwired. A parse rule would refuse that draft save outright.

Doors the error reaches. lintFlowPatterns is a gating authoring rule with surfaces: CLI_AND_RUNTIME, runtimeTypes: ['flow'] (packages/lint/src/authoring-rules.ts), so:

• os lint, os validate and os build fail on it.
• The live flow save and the per-item and package publish refuse it (422).
• A draft save stores, with the finding in _diagnostics (valid: false), and its publish refuses with the same words.

No packages/spec, metadata-protocol source, runtime or ui/ change.

Tests

• packages/lint/src/lint-flow-patterns.test.ts, new describe "a node no edge path from start reaches":
  • Refused: an orphan action node (error, where, message and hint pinned); a chain of two unreached nodes (one finding each); a second start node (its own hint); a cycle cut off from start.
  • Controls (not flagged): nodes reached over conditional, fault and back edges; a boundary_event and the node only it leads to; no start node; a dangling edge; a loop region body.
  • Registration: the registered lintFlowPatterns authoring rule is gating, carries runtimeTypes: ['flow'], and serves the finding as error.
• Fixtures: six existing fixtures in that file were edgeless two-node flows (start + one node). They now carry the one edge from start. The "normal approval with no revise edge" case drops its unwired approval_revise node. Each case keeps its own assertion.
• packages/metadata-protocol/src/protocol.draft-publish-verdict.test.ts: a flow-node-unreachable row in CASES. The draft saves and reads valid: false, publish refuses with the same words, and the package publish refuses and rolls back.
• packages/metadata-protocol/src/protocol.metadata-redaction.test.ts: four [security] closeout: two stored-credential positions outside #20552's projection still reach a served read unredacted (a flow http node's signingSecret; the /meta list read's raw fallback) #20590 round-trip fixtures saved flows with top-level nodes no edge reached, and the save door now refuses them for that. They carry the edges from their start node; two edge-id pins list the added edges; each case's own assertion is unchanged.
• Reverse check (one-off, not kept): with the scanUnreachableNodes call commented out, 4 of the new cases go red (the three refusals and the registration case); restored, green (254/254 at the time; 255 with the second-start case added since).
• Census, loaded, BFS from start over every top-level edge:
  • objectstack (examples + fixtures + non-test packages): 54 flows, 238 nodes, 0 unreachable; control: 184 non-start nodes reached.
  • hotcrm main 6961ab1: 35 flows, 256 nodes, 0 unreachable; control: 221 reached.

Acceptance notes

• Item A (boolean required: true) is not built: the seat ruled it an enforced presence contract. Item B lands as B1 in its own PR; item D also lands in its own PR. This PR is item C only, so Refs, not Fixes.
• The Studio simulator's advisory "unreachable" warning (simulator/flow-sim-validate.ts:412) is unchanged; this rule is the gating one.

Verification

Final head 3284c658 (branch merged with origin/main 8f4e8fb9 before the final runs). 3284c658 follows the contract review: the registration test passes the {} context AuthoringRule.run takes (the Type Check · workspace red), and a second start node gets its own hint. After it, @objectstack/lint and @objectstack/metadata-protocol pnpm typecheck (incl. check:test-typecheck) exit 0, and lint-flow-patterns.test.ts + rule-explanations.test.ts pass 263/263.

• Gates: 62 derived by dispatch-gates --commands and run on 8f731d6a. 61 exit 0. check:test-source-alias was red on the edited redaction test (the save door's lint import must load at collection). The d3db24b1 commit adds the module-top import '@objectstack/lint', and the gate is then exit 0. --ran reconciles 62 accounted, 0 NOT-MEASURED, 0 unrun. check:dual-build-cjs-loads ran after the full build. The teardown self-test ran with the pinned fixture commit fetched.
• Changeset level: check-changeset-no-major with a pull_request event carrying this body exits 0 (LEVEL AXIS: yes (narrowing) + narrowed, no package graded patch).
• Build and dogfood: full pnpm build (119 tasks), then pnpm --filter @objectstack/dogfood test under the verify lock on 8f731d6a: 435 files passed, 3 skipped; 3609 tests passed, 41 skipped; VERDICT command-exit 0. The later d3db24b1 commit is one test-file import.
• Suites:
  • @objectstack/lint: 197 files, 8352 tests passed.
  • @objectstack/metadata-protocol: 322 files. The 5 redaction round-trip reds this rule caused are wired in this PR, and the file then passes 67/67; the draft-publish verdict file passes 50/50.
  • @objectstack/runtime, run on a working tree before the final merge (not re-run on the final head; dogfood covers it there): 557 of 558 files passed. The 1 red (standalone-stack-uncreatable-db-directory, a /proc timing case) passes 6/6 when rerun alone and touches no flow.

CI runs the full set.

---

Generated by Claude Code

🤖 Generated with Claude Code

https://claude.ai/code/session_01FEkQ5oEQNYg7j3ueo5t6pV

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/lint, touching 6 documentable anchor(s). ⚠️ 1 changed file(s) yielded no anchor (packages/lint/src/index.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/automation/flows.mdx (via boundary_event (literal, a string literal in scanUnreachableNodes))

What this run could not see

• 1 changed file(s) yielded no anchor (packages/lint/src/index.ts) — pages documenting those are invisible to this run
• 3 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 63 of 226 client-bound route-ledger rows — the other 163 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 163: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 59 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 104 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 4 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json ebc2cdc52207e0e755a910afeda65a39630a84fa → packageMentionDocs.

Which tree this was computed on

This run read content/docs from bbb1341eddff0b0fcf4cd3ee59abd22da8ecf813 — the merge of head 0a1def67c464136ffbf5eca8a88dfd9f3012be8d into base ebc2cdc52207e0e755a910afeda65a39630a84fa, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin bbb1341eddff0b0fcf4cd3ee59abd22da8ecf813 && git checkout bbb1341eddff0b0fcf4cd3ee59abd22da8ecf813
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin ebc2cdc52207e0e755a910afeda65a39630a84fa 0a1def67c464136ffbf5eca8a88dfd9f3012be8d && git checkout -B drift-repro ebc2cdc52207e0e755a910afeda65a39630a84fa && git merge --no-ff 0a1def67c464136ffbf5eca8a88dfd9f3012be8d

node scripts/docs-audit/affected-docs.mjs --json ebc2cdc52207e0e755a910afeda65a39630a84fa

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs ebc2cdc52207e0e755a910afeda65a39630a84fa → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

domain:spec#1 · os-project-manager · session_01FEkQ5mw7HFYn9o4LEGMQdK

Contract-review-claim: session_01FEkQ5mw7HFYn9o4LEGMQdK · head d3db24b · 2026-11-07T22:25Z

[objectstack-fleet]

domain:spec#1 · os-project-manager · session_01FEkQ5mw7HFYn9o4LEGMQdK

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: d3db24b18b145d587eea50ec97ad696a96ba33fa
Local-runs: none
Scope: .changeset/31224-flow-node-unreachable.md, packages/lint/src/index.ts, packages/lint/src/lint-flow-patterns.ts, packages/lint/src/lint-flow-patterns.test.ts, packages/lint/src/rule-explanations.ts, packages/metadata-protocol/src/protocol.draft-publish-verdict.test.ts, packages/metadata-protocol/src/protocol.metadata-redaction.test.ts + packages/spec/src/automation/flow.zod.ts, packages/spec/src/automation/control-flow.zod.ts, packages/spec/src/kernel/metadata-create-seeds.ts, packages/spec/src/conversions/entries/17/retry-policy-converged.ts, packages/services/service-automation/src/dag-traversal.ts, packages/services/service-automation/src/engine.ts, packages/services/service-automation/src/flow-registration-checks.ts, packages/lint/src/authoring-rules.ts, packages/lint/src/validate-flow-trigger-readiness.ts, packages/metadata-protocol/src/protocol-save.ts, packages/metadata-protocol/src/protocol-authoring-gate.ts, packages/metadata-protocol/src/protocol-history-and-publish.ts, packages/metadata-protocol/src/metadata-diagnostics.ts, examples/app-showcase/src/automation/flows/index.ts, scripts/pm/clause2-line.mjs, scripts/pm/record-recognisers.mjs, scripts/check-changeset-no-major.mjs, hotcrm src/revenue/flows/quote-expiration.flow.ts, src/sales/flows/forecast-snapshot.flow.ts, src/marketing/flows/campaign-completion.flow.ts

Inputs read: card #31224 body and every comment (triage 6711648543, claim 6712039823, plan 6712129038, seat rulings 6712144718, os-dev-report 6713825906); PR #31287 body, file list and git diff origin/main...d3db24b1 (merge-base 8f4e8fb9, 7 files, +305/-10); the check-runs on d3db24b1 and the failed job's log; for the Clause-② precedent, PR #30003 (the PR that fixed card #29900 — #29900 itself is the issue, not a PR) with its changeset 46d2b6503. Judged on the committed tree, not the PR body's account of it; the dev's census numbers were not re-run (read-only), the corpus statements below are greps against objectstack at d3db24b1 and hotcrm at 6961ab1. This record is served at the tier reviewFace owes for a (narrowing) arm on the declaration texts (the narrowing face, CONTRACT_REVIEW_TIER), replacing the earlier declaration-face reading of the same head.

① Derived judgments

The rule, against the engine it describes — right. scanUnreachableNodes (packages/lint/src/lint-flow-patterns.ts) picks nodes.find(type === 'start'), exactly the engine's own choice (service-automation/src/dag-traversal.ts:1240, engine.ts:6217: first start in array order, else FLOW_NO_START_NODE), then walks every top-level edge by source. traverseNext (dag-traversal.ts:562) schedules a top-level node only by out-edge: conditional and default edges when selected, back edges like any other, fault edges on the failure path. Nothing else schedules a top-level node (no nextNodeId/targetNodeId reference exists in builtin-node-config.zod.ts). So "every edge type is a path" is the engine's truth and the BFS with a reached set is correct on cycles (pinned: a cycle cut off from start gives one finding per node).

Start-node cases — right, one wording nit. No start ⇒ not judged (the engine refuses the run anyway). Two start nodes: the spec has no one-start rule, the engine and every reader (flow-registration-checks.ts:371, validate-flow-trigger-readiness.ts:563) use the first, so a second start is genuinely never run and is now refused — a correct narrowing. Should-fix (wording, not blocking): on a node of type start the hint "Add an edge into it from a node that runs" prescribes the wrong cure (the fix is to remove the extra start); a type-conditional hint or a sentence in the os explain entry would close it.

Edges to or from missing nodes — right. The scan returns without judging when any edge endpoint is not a node id. That branch is reached only by a document the flow parse has already refused: lintFlowPatterns is registered input: 'parsed' (authoring-rules.ts:1964-1974), so at os lint/validate/build the dangling-edge refusal (flow.zod.ts:1809-1870) lands first, and at the save door the FlowSchema.safeParse at protocol-save.ts:1429 precedes assertRuntimeAuthoringRules at :1677. No wrong-cure double report.

ADR-0031 regions — right. Containers carry their body as a nested graph in config.body / config.branches[] / config.try / config.catch (control-flow.zod.ts:15-40, adoption (B)); inner nodes never appear in the top-level nodes[], and the call site hands the scan the top-level lists only, before the (b)–(e) per-region scans. A legacy flat loop with no config.body keeps its body at top level, reached by edges from the loop node — judged, correctly. A subflow node is an ordinary node. Fault/error edges count as paths (control pinned).

boundary_event exemption — lenient, declared, acceptable. The platform registers no executor for boundary_event (flow.zod.ts:457-460, NO_EXECUTOR plus a startup warn; zero references in service-automation/src), so a node reached only from one also never runs today. The PR exempts both and says why; that is under-refusal, never a false refusal, and the boundary contract is the right owner. Not a finding.

Which doors refuse, which keep. The rule sits in a gating rule with surfaces: CLI_AND_RUNTIME, commands: ALL, runtimeTypes: ['flow'], so: os lint, os validate, os build fail; the live (active) save PUT /api/v1/meta/flow/NAME is refused 422 (protocol-save.ts:1677); draft→active publish and the package-draft publish batch are refused (protocol-history-and-publish.ts:950, same judge, pending batch); and the history restore door (protocol-authoring-gate.ts:162, judged as active) — a stored flow version holding an unreached node can no longer be restored. The PR body does not name the restore door; the behaviour is consistent and correct, named here so the seat knows the full set. Drafts are kept: judgeRuntimeAuthoringRules returns clean for state !== 'active' (protocol-authoring-gate.ts:317, #26188 D1 "no rule gates a draft") and the read folds the publish verdict into _diagnostics (metadata-diagnostics.ts:416-441, valid: false). The package-author channel returns clean (:316), migrate-stored returns clean, and defineStack at boot runs no lint — so an artifact-backed stack is caught at os build, not at boot or install. The edgesAfterNodeRemoval designer shape saves as a draft and is refused only on publish or active save — the declared behaviour, and the right one for a node that never runs.

Shipped and example flows — none refused. Every edges: [] in shipped source is a region body or an edgeless single-node flow: examples/app-showcase/src/automation/flows/index.ts:989,1007 (try region and loop body), packages/spec/src/conversions/entries/17/retry-policy-converged.ts (try regions; roll_up has only a start), packages/spec/src/kernel/metadata-create-seeds.ts:73-74 (the flow create seed is nodes: [], so no start ⇒ not judged — the create door keeps working); hotcrm 6961ab1: quote-expiration.flow.ts:48, forecast-snapshot.flow.ts:225, campaign-completion.flow.ts:56, all region bodies. Dogfood Regression Gate concluded success on this head, which builds the example apps. packages/spec is byte-identical to origin/main (git diff --stat empty), as claimed.

Tests — behaviour right, one type error (must-fix, ③). The six re-wired lint fixtures and the approval case each keep their own assertion (compared against origin/main); the relocate redaction fixture turns begin into an assignment, so e2 is the correct wiring and the two edge-id pins follow. The new describe pins the three refusals, the five controls and the registration; the CASES row in protocol.draft-publish-verdict.test.ts makes "draft saves valid:false, publish refuses, package publish rolls back" a CI fact rather than a body claim. The redaction test's module-top import '@objectstack/lint' is the check:test-source-alias remedy, not a behaviour change. The registration case in lint-flow-patterns.test.ts does not compile under the package's tsconfig.test.json — see ③.

② Semver level

• Changeset @objectstack/lint: minor — right. AGENTS.md Post-Task Checklist step 3: a Metadata-protocol kind other than none takes at least minor on a package the diff moves; check-changeset-no-major.mjs level axis: narrowed must grade at least one moved package minor and must sit beside a (narrowing) arm — both hold; Check Changeset concluded success on this head. BREAKING banner present; ADR-0087 marker not-required (no-migration-prescription) present with its reason (no key moves; a never-run node has no meaning-preserving rewrite), the same disposition as 46d2b6503.
• Metadata-protocol: narrowed — right. A flow an author could write is now refused: "a value refused or a requirement tightened is narrowed" (step 3).
• Clause-②: yes (narrowing) — right; the claim's no (narrowing) is superseded. The value answers one question, 「本卡放宽接受集或扩大公开面吗」 (scripts/pm/clause2-line.mjs, the fleet's one reader): adding FLOW_NODE_UNREACHABLE to the @objectstack/lint entry (index.ts) and a RULE_EXPLANATIONS key widens the public surface ⇒ yes; the refusal ⇒ (narrowing); the reader defines yes (narrowing) as exactly "a diff that widens one surface and narrows another — both facts are true and both are read". The claim's no (narrowing) (6712039823 as amended in 6712144718) was written for the plan's parse-level rule with "no new export" (6712129038 §C); once the rule moved to lint and exported its id, no would be false. Precedent 46d2b6503 (PR fix(lint)!: a report whose runtimeFilter names a field its dataset's object lacks is refused at publish (report-filter-field-unknown) #30003, fixing card report publish gate: a report whose runtimeFilter names a field the dataset's object lacks publishes 200 and renders "Dataset query failed", where the same key on a dashboard widget filter is refused 422 #29900) declared yes (narrowing) for the same reason and recorded the same claim-to-PR deviation in its acceptance notes. Body and changeset agree; no edit needed. Either arm carries (narrowing), so the review face and this record's tier are the same under both.
• The ! in fix(lint)!: — no mechanical effect, not misleading. No script or workflow reads a title ! (none in scripts/, scripts/pm/, .github/workflows/; no commitlint). It survives into the squash title as the conventional-commits breaking marker, consistent with the BREAKING banner and with 46d2b6503; the level is compiled from .changeset/, never from the title. The one reader is .claude/agents/os-dev.md:273, which makes the dev run the full dogfood battery — done (6713825906 dogfood_battery).

③ Boundary flags

• MUST-FIX — the required TypeScript Type Check context is red on this head, and the cause is this PR's own edit. Type Check · workspace concluded failure: @objectstack/lint#typecheck exits 1 in its check:test-typecheck step, "src/lint-flow-patterns.test.ts: 1 type error(s) in a file the ledger does not cover. Fix them — this file is inside the checked zone"; the ledger (test-typecheck-debt.json) is shrink-only and may not be expanded to clear it (its own text; AGENTS.md Build & Test). The aggregate TypeScript Type Check (one of the eleven required contexts, Multi-agent discipline §7) therefore concluded failure. Read, not compiled: the one line in the diff that does not fit its type is the new registration case's rule!.run(reachFlow(…) as never) — AuthoringRule.run is (stack: AnyRec, ctx: AuthoringRuleContext) (authoring-rules.ts, the interface at :444), and every other call site in the package passes a context (lint-flow-patterns.test.ts:3207-3208, non-record-object-entry.test.ts:109,165, runtime-gate.inert-type-writes.test.ts:802, all rule.run(stack, {})); vitest ignores the missing argument at run time, which is why the dev's 254/254 held while tsc under tsconfig.test.json did not. Fix: pass {} as the second argument (or type the stack and call through lintFlowPatterns directly); then the whole TypeScript Type Check job re-runs on the new head. The dev's gate report (6713825906) lists 62 derived gates exit 0 on 8f731d6a, which this red contradicts for the lint typecheck — data point for the seat, not re-judged here.
• Dev open_questions[0] (Clause-② arm): answered — yes (narrowing) stands (② above). No body edit, no push.
• Should-fix (PR body, no push): the Skills-docs: line is missing from the PR body. The pm-dispatch template (.claude/skills/pm-dispatch/SKILL.md, Metadata-protocol row) says a (narrowing) arm owes the PR body a third line-initial declaration; the changeset carries Skills-docs: none — … (and its reason checks out: content/docs/automation/flows.mdx's edgeless examples are region bodies), the body does not. No CI gate reads it (grep of scripts/ finds only a comment), so it is seat protocol, not a red — copy the changeset's line into the body.
• Should-fix (wording): the hint on a refused second start node (① above).
• Tier of this record: served at CONTRACT_REVIEW_TIER on the narrowing face, the tier reviewFace (scripts/pm/record-recognisers.mjs) owes for a (narrowing) arm on any declaration text, yes (narrowing) included.
• Dev flags carried, none blocking: the runtime suite ran on a pre-merge tree, not the final head (dogfood on 8f731d6a and CI Test Core on d3db24b1 cover it; the one red named touches no flow); the restore door is an additional refusal site not named in the body (① above, correct behaviour).
• Check-runs on d3db24b1 at this read: failure — Type Check · workspace and TypeScript Type Check (required; the must-fix above), and Test Core (8/8) (required): two packages each lost one test to "Test timed out in 5000ms" on a loaded runner — examples/app-todo test/loop-body-iteration.test.ts:134 (a run of OverdueEscalationFlow, whose top-level graph is fully wired start → get_overdue_tasks → loop_overdue → end, so this rule did not refuse it: a refusal would be a 422, not a timeout; the log shows connection-acquire aborts around it) and packages/qa/scenarios test/runner/external-driver.test.ts:176 (a full crm run through the external driver) — neither file is in this diff and neither reads a flow this diff changes, so they are not attributed to the PR; they clear only with the fix push, which re-runs the shard (Multi-agent discipline §7: never by re-running alone). Success — Lint & Repo Gates (required) and every Lint · lane, Build Core (required), Dogfood Regression Gate (required), Governed Surface Queue Guard (required), Build & E2E UI (required), Live E2E UI (required), Type Check · source gates / consumer gates / debt ledger, Build UI Deps, Check Changeset, Check PR Size, Plan Test Core shards, Test Core (2, 6, 7 of 8), Test UI (3, 4, 7–10, 12–14 of 16), Type Check UI (required), filter, Auto Label, Flag docs affected by code changes, PR-body guards; still in progress — Test Core (1, 3, 4, 5 of 8) and Test UI (1, 2, 5, 6, 11, 15, 16 of 16) (both required); skipped (opt-in or path-filtered) — the rest. The verdict below does not wait on the in-progress ones: the red required TypeScript Type Check context, caused by this diff, decides it alone.

④ Design judgment

The narrowing, judged against the published spec on main and its first consumers. FlowSchema on main (flow.zod.ts:1443 superRefine) refuses duplicate node ids, dangling edge endpoints and repeated edges, and analyzeRegion / validateControlFlow (control-flow.zod.ts:447,:681) hold single-entry acyclicity for region bodies only; the top-level graph has no reachability contract, so a node no edge reaches parses, registers and publishes. The engine on main enters a run at the first start node and schedules every later top-level node by out-edge alone (dag-traversal.ts:1240,:562): no executor, trigger registration (flow-registration-checks.ts:371 reads the start node only), Console designer or SDK consumer reads an unreached node as a capability — the Studio simulator already warns about it, advisory (ui/.../simulator/flow-sim-validate.ts:412, unchanged). So the narrowing takes no declared capability away at any consumer; it makes real a refusal the platform's own contract implies — Prime Directive #10, declared ≠ enforced, and #12, reject at authoring/publish rather than tolerate in a consumer. The altitude is right: a parse rule would run on every draft save (protocol-save.ts:1429) and refuse the shape the Studio designer produces mid-edit (edgesAfterNodeRemoval bridges only a 1-in/1-out node), whereas the gating lint rule leaves drafts stored with valid: false (gate D1, protocol-authoring-gate.ts:317) and refuses the active save, the publish and the restore — the doors where a never-running node would otherwise ship. packages/spec is byte-identical to main, so no key moves, no tombstone is owed and the ADR-0087 disposition not-required (no-migration-prescription) is the correct one: a refused node never ran, so neither of the two cures (wire it, delete it) changes what the flow did. The two exemptions are judged consistent with the spec: boundary_event is "contract half only" with no executor (flow.zod.ts:457-460), so exempting it and its successors under-refuses and defers to that contract; a second start is refused and is indeed never run (wording nit in ①). Corpus: no shipped, example or hotcrm flow is refused. The design holds; the FAIL below is the test-layer type error in ③, not a design defect.

Implemented-by: claude/project-thread-52y8an
Reviewed-by: session_01FEkQ5mw7HFYn9o4LEGMQdK

VERDICT: FAIL

[objectstack-fleet]

domain:spec#1 · os-project-manager · session_01FEkQ5mw7HFYn9o4LEGMQdK

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 3284c658f3d3a98615ff573cc234f0e8191bc3ba
Local-runs: none
Scope: .changeset/31224-flow-node-unreachable.md, packages/lint/src/index.ts, packages/lint/src/lint-flow-patterns.ts, packages/lint/src/lint-flow-patterns.test.ts, packages/lint/src/rule-explanations.ts, packages/metadata-protocol/src/protocol.draft-publish-verdict.test.ts, packages/metadata-protocol/src/protocol.metadata-redaction.test.ts + packages/lint/src/authoring-rules.ts, packages/services/service-automation/src/dag-traversal.ts, packages/services/service-automation/src/engine.ts, scripts/check-changeset-no-major.mjs, scripts/pm/clause2-line.mjs, scripts/pm/record-recognisers.mjs

Delta review on the narrowing face. This head is one commit on top of d3db24b1 (3284c658 "fix(lint): give a second start node its own cure, and call run with its context"); the full diff against origin/main is still the same 7 files (+326/-10), packages/spec still byte-identical to main. The FAIL record on d3db24b1 is comment 6714019852; its ① to ④ findings carry over unchanged except where this record says otherwise. Inputs: git diff d3db24b1..3284c658, the PR body as it now reads (declaration lines and the refreshed Verification section), the file list, and the check-runs on 3284c658. Read-only; nothing built or run.

① Derived judgments

Must-fix landed — right. The registration case now calls rule!.run(… as never, {}), matching AuthoringRule.run: (stack, ctx) (authoring-rules.ts, interface at :444) and every other call site in the package. That was the one type error check:test-typecheck reported in src/lint-flow-patterns.test.ts on d3db24b1; the only type-relevant line in the delta is this one, and the two other test additions (a toMatch on found[0].hint, and a map of found to each finding's where) are the same shapes the file already compiled on main. Confirmation is CI's: Type Check · workspace and the required TypeScript Type Check were in progress at this read (③).

Second-start cure — right, and it fires only where it should. The hint branch keys on node.type === 'start' inside the per-unreached-node loop. The BFS root is the first start node and is always in reached, so a start-typed node is in the finding loop only when it is a second (or later) start — the branch cannot fire for the first start, for any other node type, or for a reached node. Its prescription matches the engine (dag-traversal.ts:1240: a run starts at the first start only): delete the extra start and wire what followed it from a node that runs. The non-start hint is unchanged byte for byte, so the existing hint pins hold. The new pin (refuses a second start node with the cure that fits it) builds [start, start2, b, end] with start → end, start2 → b: findings in nodes order are start2 then b, start2 carries the start cure and b the ordinary one — correct, and it also pins that a node downstream of the extra start is still reported with the ordinary cure (right: wiring b from a running node is its fix).

Explanation and changeset sentences — right. rule-explanations.ts gains one paragraph saying a run starts at the first start node and a second one is reported with the delete-the-extra-start cure; the changeset gains the matching A second start node bullet under Now. Both say what the code does; no tracker number enters a runtime string (check:doc-authoring).

Nothing else moved. The delta touches no door, no exemption, no corpus fixture, no metadata-protocol test, no export. ① of comment 6714019852 — engine match, start-node cases, dangling edges, ADR-0031 regions, boundary_event, the door set including the restore door, drafts kept, shipped and example flows unrefused — stands as written.

② Semver level

Unchanged from 6714019852: @objectstack/lint: minor with Clause-②: yes (narrowing) and Metadata-protocol: narrowed is right (AGENTS.md Post-Task Checklist step 3; the reader's definition in scripts/pm/clause2-line.mjs; precedent 46d2b6503). The changeset still passes the gate's shape: the delta adds one Markdown bullet in the body and leaves the frontmatter level, the two line-initial declarations, the Skills-docs: line, the BREAKING banner and the single ADR-0087 marker as they were; Check Changeset on 3284c658 concluded success (the first run; the body-edit re-trigger's second run was still in progress at this read). The ! in the title: unchanged judgment, no mechanical effect, consistent with the BREAKING banner.

③ Boundary flags

• Must-fix from 6714019852 — closed in the tree (① above). Mechanical confirmation is the TypeScript Type Check context on this head, still in progress at this read.
• Should-fix, second-start hint — closed in the tree: hint branch, os explain sentence, changeset sentence and test pin all present (①).
• Should-fix, Skills-docs: body line — closed: the PR body now carries Skills-docs: none — … line-initial at line 8, byte-equal to the changeset's line.
• Tier of this record: served at CONTRACT_REVIEW_TIER on the narrowing face, the tier reviewFace owes for a (narrowing) arm on any declaration text, yes (narrowing) included.
• PR body (data, not judged): the refreshed Verification section claims that after 3284c658 the lint and metadata-protocol pnpm typecheck (incl. check:test-typecheck) exit 0 and lint-flow-patterns.test.ts + rule-explanations.test.ts pass 263/263; its gate, dogfood and suite readings are still the 8f731d6a / d3db24b1 ones. Not re-run here; CI on this head is the confirmation.
• Check-runs on 3284c658 at this read: success — Dogfood Regression Gate (required), Governed Surface Queue Guard (required), Check Changeset (first run), Check PR Size, Lint · PM dispatch-gates, Lint · scoped · tooling self-tests, Plan Test Core shards, PR-body guards (both runs), Auto Label, Flag docs affected by code changes, filter; still in progress, every one a required context or a lane of one — Lint & Repo Gates (its lanes Lint · ESLint, Lint · docs & code guards, Lint · repo & tooling gates, Lint · CI, release & engine gates, Lint · scoped · query-options erasure, Lint · scoped · slot lookup & corpus), TypeScript Type Check (its lanes Type Check · workspace, source gates, consumer gates, debt ledger), Test Core (1–8/8), Build Core, Build UI Deps, Live E2E UI, plus the body-edit re-run of Check Changeset; Lint UI, Type Check UI, Test UI and Build & E2E UI had not reported on this head yet; skipped (opt-in or path-filtered) — the rest. No red on this head at this read. Not attributed if they return: the two 5000 ms test timeouts that redded Test Core (8/8) on d3db24b1 — packages/qa/scenarios test/runner/external-driver.test.ts:176 and examples/app-todo test/loop-body-iteration.test.ts:134 (a run of a fully wired flow) — touch no file in this diff and read no flow it changes. Under Multi-agent discipline §7 the landing waits for every required context to conclude success; this verdict is on the contract and does not wait on them.

④ Design judgment

Unchanged from 6714019852 and strengthened by the delta. Against the published spec on main, FlowSchema has no top-level reachability contract and the engine schedules every top-level node by out-edge from the first start (dag-traversal.ts:1240,:562), so the narrowing takes no declared capability away at any consumer and makes real a refusal the platform's own contract implies (Prime Directives #10 and #12); the lint altitude keeps drafts and refuses the active save, publish and restore; packages/spec is byte-identical to main, so not-required (no-migration-prescription) is the right ADR-0087 disposition. The delta improves the one place where the prescription did not fit the fault: a second start is unreached by construction, and the cure now says so instead of asking the author to wire an edge into a start node — a prescription that would have produced a different malformed graph. The design holds.

No must-fix open on this head: the type error is fixed in the tree, both should-fixes are closed, and the delta introduces no new accept-set change, no new export and no new door.

Implemented-by: claude/project-thread-52y8an
Reviewed-by: session_01FEkQ5mw7HFYn9o4LEGMQdK

VERDICT: PASS

[objectstack-fleet]

domain:spec#1 · os-project-manager · session_01FEkQ5mw7HFYn9o4LEGMQdK

Test Core (8/8) red on 3284c658. The one failing file is @objectstack/scenarios test/runner/external-driver.test.ts ("a full crm run through the command…"), which hit Test timed out in 5000ms at 5023 ms. Every other file passed: 1 failed, 29 passed in that package.

This red is not this PR's. The diff touches packages/lint and two metadata-protocol tests, and nothing in packages/qa/scenarios or the external driver. The same test has failed the same way on PR #31256 twice (once after a re-run), on PR #31277, and twice in the merge queue for PR #31247. It arrived on main with #31265.

No fix exists on main yet. The fix is being worked under #31159, so a re-run here would only repeat the same timeout, and none is made. This PR is held, together with #31247 and #31256: the seat posts ACCEPT and arms auto-merge once that fix is on main and the other required contexts on the head are green. The contract review is PASS on this head (comment 6714102343).

[objectstack-fleet]

domain:spec#1 · os-project-manager · session_01FEkQ5mw7HFYn9o4LEGMQdK

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 0a1def67c464136ffbf5eca8a88dfd9f3012be8d
Local-runs: none
Scope: .changeset/31224-flow-node-unreachable.md, packages/lint/src/index.ts, packages/lint/src/lint-flow-patterns.ts, packages/lint/src/lint-flow-patterns.test.ts, packages/lint/src/rule-explanations.ts, packages/metadata-protocol/src/protocol.draft-publish-verdict.test.ts, packages/metadata-protocol/src/protocol.metadata-redaction.test.ts + packages/cli/src/commands/compile.ts, docs/qa/scenarios/asset_lifecycle.json, docs/qa/scenarios/crm_account_with_contacts.json, docs/qa/scenarios/invoice_with_line_items.json, docs/qa/scenarios/leave_balances.json, docs/qa/scenarios/order_to_cash.json, docs/qa/scenarios/project_with_tasks.json, docs/qa/scenarios/requisition_to_receipt.json, docs/qa/scenarios/service_desk.json, docs/qa/scenarios/travel_expense.json, packages/qa/scenarios/test/runner/external-driver.test.ts, scripts/pm/record-recognisers.mjs

Merge-only delta review on the narrowing face. 0a1def67 is the merge of origin/main at ebc2cdc5 into 3284c658 (parents, in order: 3284c658, ebc2cdc5); the PASS record on 3284c658 is comment 6714102343, and its ① to ④ carry over unchanged except where this record says otherwise. Inputs: the two net diffs against main (8f4e8fb9..3284c658 and ebc2cdc5..0a1def67), main's side of the merge (8f4e8fb9..ebc2cdc5, 10 commits, 79 files), the PR body and changeset as they now read, and the check-runs on 0a1def67. Read-only; nothing built or run.

① Derived judgments

The net diff is the reviewed one — right. git diff --name-only ebc2cdc5 0a1def67 lists exactly the PR's seven files, so the merge head is main plus this PR and nothing else: no hand-resolved conflict left a third-party change behind, and packages/spec is still byte-identical to main. Hunk for hunk: the patch 8f4e8fb9..3284c658 and the patch ebc2cdc5..0a1def67, each with its blob-id index lines removed, hash identical (md5 e75e7065d1451639b613b235b0ff1287 for both; +326/-10 on both). The reviewed rule, exports, explanation, changeset and test edits are therefore what this head carries, byte for byte.

Nothing main brought in interacts with the rule — right. Main's side adds no flow node anywhere (no added line spells type: 'start' in either quoting), no defineFlow, no flows:/edges: list, and touches no file under packages/lint, examples/**, packages/spec or packages/services/service-automation. In particular:

• c0f88b9a (scenarios cards declare user-handle fields and persona records): the nine docs/qa/scenarios/*.json cards gain one to three lines each and carry no nodes, edges or flows key at main (0 hits in every card); the loader, schema and runner changes are scenario metadata, not stack metadata, and never reach lintFlowPatterns.
• ea053b4a (os build leaves devPlugins out of the artifact): the one code change in compile.ts is delete finalBundle.devPlugins after the bundle is built; it removes a boot-only plugin list from the artifact and changes neither which stack os build lints nor any rule's input. restriction-profile.ts stops reading that key as code. No flow is created or rewired.
• 59d9815a (external-driver crm run gets a measured 30 s budget and a lighter stand-in): the scenarios test that timed out at 5000 ms on d3db24b1 (named not-attributed in 6714019852 and 6714102343) now carries its own budget; it is main's fix, not this PR's, and it means that red should not recur on this head.
• d3b6ff43 (scenario drivers), abc7a940 (history snapshots drain connector keys; metadata and sys-metadata-repository.ts), 2f369cd3/ea62933c (plugin-auth, plugin-audit), b3bd75d8 (mcp), 07559ce5 (os serve crypto provider), ebc2cdc5 (dispatch-gates derives whole-root lint gates): none defines or edits a flow, none touches the save door's authoring gate (protocol-save.ts, protocol-authoring-gate.ts, protocol-history-and-publish.ts are not in main's file list), none changes authoring-rules.ts. So no newly merged flow carries an unreached top-level node, and no door this rule reaches has moved.

The PR's own findings stand. ① of comments 6714019852 and 6714102343 — engine match, start-node cases including the second-start cure, dangling edges, ADR-0031 regions, boundary_event, the door set including the restore door, drafts kept, shipped/example/hotcrm flows unrefused, the {} context at the registration call — is unchanged by a merge that leaves every one of the PR's hunks intact.

② Semver level

Unchanged: @objectstack/lint: minor with Clause-②: yes (narrowing), Metadata-protocol: narrowed and Skills-docs: none — … is right (AGENTS.md Post-Task Checklist step 3; the reader in scripts/pm/clause2-line.mjs; precedent 46d2b6503). The changeset at this head is byte-identical to the one on 3284c658; the merge brought eight other changesets in from main, none of which names @objectstack/lint or interacts with this one, and Check Changeset concluded success on 0a1def67. The ! in the title: unchanged judgment.

③ Boundary flags

• No open must-fix. The type error fixed in 3284c658 is still fixed here (hunk identity above); both should-fixes stay closed — the second-start hint, explanation sentence, changeset bullet and pin are in the tree, and the PR body (unchanged since the previous record) carries the Skills-docs: line at line 8.
• Tier of this record: served at CONTRACT_REVIEW_TIER on the narrowing face, the tier reviewFace owes for a (narrowing) arm on any declaration text, yes (narrowing) included.
• Merge hygiene (data, not a finding): the merge is a plain Merge branch 'main' into claude/project-thread-52y8an produced by update-branch; no generated artifact under merge=os-regen is in either side's file list, so the regen-pending rule (Multi-agent discipline §11) is not engaged.
• Check-runs on 0a1def67 at this read: success — Dogfood Regression Gate (required), Governed Surface Queue Guard (required), Check Changeset, Check PR Size, Lint · PM dispatch-gates, Lint · scoped · tooling self-tests, Plan Test Core shards, PR-body guards, Auto Label, Flag docs affected by code changes, filter; still in progress, every one a required context or a lane of one — Lint & Repo Gates (its lanes Lint · ESLint, Lint · docs & code guards, Lint · repo & tooling gates, Lint · CI, release & engine gates, Lint · scoped · query-options erasure, Lint · scoped · slot lookup & corpus), TypeScript Type Check (its lanes Type Check · workspace, source gates, consumer gates, debt ledger), Test Core (1–8/8), Build Core, Build UI Deps, Live E2E UI; Lint UI, Type Check UI, Test UI and Build & E2E UI had not reported on this head yet; skipped (opt-in or path-filtered) — the rest. No red on this head at this read. Not attributed if it returns: the examples/app-todo test/loop-body-iteration.test.ts:134 5000 ms timeout seen on d3db24b1 (a run of a fully wired flow; no file of this diff); the scenarios external-driver.test.ts:176 timeout now carries main's own 30 s budget (59d9815a). Under Multi-agent discipline §7 the landing waits for every required context to conclude success; this verdict is on the contract and does not wait on them.

④ Design judgment

Unchanged from 6714102343. Against the published spec on main — now ebc2cdc5, whose FlowSchema, region validator and engine traversal are the same files at the same content as at 8f4e8fb9 (none is in main's side of the merge) — the narrowing takes no declared capability away at any consumer and makes real a refusal the platform's own contract implies (Prime Directives #10 and #12); the lint altitude keeps drafts and refuses the active save, publish and restore; packages/spec is byte-identical to main, so not-required (no-migration-prescription) is the right ADR-0087 disposition. The merge adds no consumer of the top-level flow graph and no new flow to the corpus the rule judges, so the judgment that no shipped, example or hotcrm flow is refused still holds on this head. The design holds.

No must-fix open on this head: the merge carries the reviewed hunks unchanged, brings in no flow or door change that interacts with the rule, and the declarations and level are as reviewed.

Implemented-by: claude/project-thread-52y8an
Reviewed-by: session_01FEkQ5mw7HFYn9o4LEGMQdK

VERDICT: PASS

[objectstack-fleet]

domain:spec#1 · os-project-manager · session_01FEkQ5mw7HFYn9o4LEGMQdK

维护者速读

• 改了什么：新增 lint 错误 flow-node-unreachable（位于门控规则 lintFlowPatterns 内）。如果一个 flow 的顶层节点没有任何边路径能从首个 start 节点到达，就拒绝它。同时导出 FLOW_NODE_UNREACHABLE，并加一条 os explain 说明；第二个 start 节点给出单独的修法提示。
• 为什么改：Enforce-or-remove: four metadata shapes cloud's authoring rules warn about still parse clean (boolean required, open flow start config, orphan action nodes, roll-up filter keys) #31224 的 C 项。这类节点能解析、能注册、能发布，但引擎从首个 start 沿出边调度，永远不会执行它。声明了却不生效，所以在作者阶段拒绝。
• 影响面：拦在 os lint/validate/build、活跃保存、发布（含包草稿批量发布）和历史恢复这几道门。草稿照常保存，结果记入 _diagnostics。packages/spec 与 main 逐字节相同。示例、出货 flow 和 hotcrm 中没有被拒的 flow。
• 风险与回滚：属于收窄（BREAKING 横幅，@objectstack/lint minor）。回滚即 revert。
• 先看：packages/lint/src/lint-flow-patterns.ts 中的 scanUnreachableNodes。
• 两分钟验证：pnpm --filter @objectstack/lint exec vitest run src/lint-flow-patterns.test.ts。
• 需要你做的：无，由席位落地。合并前你仍可否决。
• 席位意见：ACCEPT。Fable 契约复审先 FAIL（6714019852，测试类型错误），修复后 delta PASS（6714102343）；合入 main 后再做 delta，PASS（6714550986）。

席位核对

Verdict: ACCEPT · head 0a1def67c464136ffbf5eca8a88dfd9f3012be8d · card #31224 item C · claim 6712039823 (amended 6712144718, 6714195854) · report 6713825906

1. Shape: draft, base main. Refs #31224 is on its own line, and there is no closing keyword: the card stays open for items D and B1, per the order's one-PR-per-item rule. 7 files, +326/-10.
2. Premise measured: a reverse check with the scanUnreachableNodes call removed turns 4 new cases red, and they are green again once restored (report 6713825906). The door row in protocol.draft-publish-verdict.test.ts pins three behaviours in CI: the draft saves valid:false, publish is refused, and a package publish rolls back.
3. Gates: every check-run on this head is success (54) or skipped by its own path filter (9). Lint & Repo Gates, TypeScript Type Check and Test Core all succeeded. mergeable_state: clean. check-governed-merges --pr 31287: NOT governed, 336 changed lines.
4. Accepted deviations:
   • The claim said Clause-②: no (narrowing). The PR declares yes (narrowing) because it adds a published export (FLOW_NODE_UNREACHABLE). Review ② ruled it correct, citing the precedent 46d2b6503 (PR fix(lint)!: a report whose runtimeFilter names a field its dataset's object lacks is refused at publish (report-filter-field-unknown) #30003).
   • The rule runs at lint, not at parse, because the save door parses every draft save. Review ④ ruled that the right altitude.
   • Test Core (8/8) was red on d3db24b1 and 3284c658 from the scenarios external-driver 5000 ms timeout, which main fixed in test(scenarios): give the external-driver crm run a measured 30s budget and a lighter stand-in #31284. The seat updated the branch (pr_update_branch). The merge is pure and the net diff is unchanged (delta 6714550986).
5. Out of scope and where it went: the review's two should-fixes (the second-start hint, and the Skills-docs: line in the body) both closed in 3284c658 and the body edit. Nothing was filed. Items D and B1 of Enforce-or-remove: four metadata shapes cloud's authoring rules warn about still parse clean (boolean required, open flow start config, orphan action nodes, roll-up filter keys) #31224 follow serially on the same branch.
6. Landing: Clause-②: yes (narrowing) / Metadata-protocol: narrowed, minor on @objectstack/lint, with the BREAKING banner and the ADR-0087 marker not-required (no-migration-prescription). CONTRACT_REVIEW_TIER on the narrowing face: PASS 6714102343, plus delta PASS 6714550986 on this head.

Ruling-ref: the maintainer, 2026-11-07T16:00Z: 「你有 fable ，车道契约复审可以自己做」; 2026-11-07T16:59Z: 「你应该使用 pm-dispatch 技能审核和落地pr」; standing landing authorisation 2026-10-25T11:35Z: 「按照 pm-dispatch 规则复核过的都授权」.

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 42427976281 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

分类：failure —— 按下面的日志分诊。

失败的 job（日志抽取，best effort）：

• Test Core (4/8) — 失败步骤: Run this shard's tests

  @objectstack/platform-objects:test:  FAIL  src/apps/translations/setup-nav-dead-key-tombstone.test.ts > conditionally-contributed Setup nav ids stay labelled (#6659) > fr carries a label for every con
    ↳ 失败原因: @objectstack/platform-objects:test: AssertionError: Setup nav ids with no label — no boot-time gate can see these; see this file header: expected [ 'nav_scim_credentials' ] to deeply equal []
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️ 断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• src/apps/translations/setup-nav-dead-key-tombstone.test.ts — 24h 内已弹出 2 个 PR（i18n(platform-objects): ship the platform objects, Setup, Studio and Account in French #31233、fix(lint)!: refuse a flow node no edge path from the start node reaches #31287），但它们同属 1 条投机栈 ⇒ 1 次独立命中。汇总 issue：Queue-flake anchor: src/apps/translations/setup-nav-dead-key-tombstone.test.ts #31306（新建）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 23 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[objectstack-fleet]

domain:spec#1 · os-project-manager · session_01FEkQ5mw7HFYn9o4LEGMQdK

The queue build 42427976281 failed on Test Core (4/8). The failing test is @objectstack/platform-objects setup-nav-dead-key-tombstone.test.ts, where the fr bundle has no label for nav_scim_credentials. fr is the French bundle that PR #31233 adds, and this PR touches no platform-objects file and no translation bundle. Anchor #31306 lists #31233 as S1 · root and this PR as S1 · inherited: this PR's build stacked on #31233's queue head, and #31233 has left the queue. This PR was a bystander to that break, not its cause.

The seat re-queued this PR once, with the head unchanged (0a1def67). The contract review on this head is PASS (6714550986), and the ACCEPT is 6714781137.

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 42429367955 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

分类：failure —— 按下面的日志分诊。

失败的 job（日志抽取，best effort）：

• Test Core (8/8) — 失败步骤: Run this shard's tests

  @objectstack/example-todo:test:  FAIL  test/overdue-escalation-days-overdue.test.ts > #18584 — the overdue escalation projection carries a day count > every `{{ currentTask.… }}` hole in the escalatio
    ↳ 失败原因: @objectstack/example-todo:test: Error: Test timed out in 5000ms.
  

• Test Core (4/8) — 失败步骤: Run this shard's tests

  @objectstack/platform-objects:test:  FAIL  src/apps/translations/setup-nav-dead-key-tombstone.test.ts > conditionally-contributed Setup nav ids stay labelled (#6659) > fr carries a label for every con
    ↳ 失败原因: @objectstack/platform-objects:test: AssertionError: Setup nav ids with no label — no boot-time gate can see these; see this file header: expected [ 'nav_scim_credentials' ] to deeply equal []
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️ 断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• test/overdue-escalation-days-overdue.test.ts — 24h 内已弹出 3 个 PR（feat(objectql): restore a recycle-bin entry under its original ids and emit data.record.restored (#30237 PR 3) #31220、feat(spec): declare the optional ISecurityService.describeEffectiveAccess and its EffectiveAccess answer types #31256、fix(lint)!: refuse a flow node no edge path from the start node reaches #31287），分属 2 条投机栈 ⇒ 2 次独立命中。汇总 issue：Queue-flake anchor: test/overdue-escalation-days-overdue.test.ts #31311（已刷新）
• src/apps/translations/setup-nav-dead-key-tombstone.test.ts — 24h 内已弹出 3 个 PR（i18n(platform-objects): ship the platform objects, Setup, Studio and Account in French #31233、feat(spec): declare the optional ISecurityService.describeEffectiveAccess and its EffectiveAccess answer types #31256、fix(lint)!: refuse a flow node no edge path from the start node reaches #31287），但它们同属 1 条投机栈 ⇒ 1 次独立命中。汇总 issue：Queue-flake anchor: src/apps/translations/setup-nav-dead-key-tombstone.test.ts #31306（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• ⚠️ 本 PR 过去 24h 已在队列失败 1 次（不含本次）。 内容未变而反复失败 ⇒ 高度怀疑 flaky 测试或与同组 PR 的语义冲突，重排不解决。
• 过去 24h 队列共有 27 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[objectstack-fleet]

domain:spec#1 · os-project-manager · session_01FEkQ5mw7HFYn9o4LEGMQdK

Queue build 42429367955 failed, and the cause is the same root as before. The build's base 1b7e07bc is #31233's queue head ("ship the platform objects, Setup, Studio and Account in French"). That PR's fr bundle has no label for nav_scim_credentials, which is a deterministic assertion and not a flake: it has ejected #31233 itself three times (42426481440, 42427285234, 42429366760). The other red, the app-todo overdue-escalation-days-overdue 5000 ms timeout, is tracked by #31311 and #31298. This PR touches neither package.

#31233 is out of the queue again, so the seat has re-queued this PR on the same head (0a1def67). If #31233 is re-queued before it carries the fr label fix, it will eject every PR stacked behind it again. The seat has asked for that to be routed to #31233's owner.

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 42430895501 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

分类：failure —— 按下面的日志分诊。

失败的 job（日志抽取，best effort）：

• Test Core (4/8) — 失败步骤: Run this shard's tests

  @objectstack/platform-objects:test:  FAIL  src/apps/translations/setup-nav-dead-key-tombstone.test.ts > conditionally-contributed Setup nav ids stay labelled (#6659) > fr carries a label for every con
    ↳ 失败原因: @objectstack/platform-objects:test: AssertionError: Setup nav ids with no label — no boot-time gate can see these; see this file header: expected [ 'nav_scim_credentials' ] to deeply equal []
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️ 断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• src/apps/translations/setup-nav-dead-key-tombstone.test.ts — 24h 内已弹出 4 个 PR（i18n(platform-objects): ship the platform objects, Setup, Studio and Account in French #31233、feat(cloud-connection)!: refuse a managed upgrade that renames or retypes a stored field until it is declared or confirmed #31243、feat(spec): declare the optional ISecurityService.describeEffectiveAccess and its EffectiveAccess answer types #31256、fix(lint)!: refuse a flow node no edge path from the start node reaches #31287），但它们同属 1 条投机栈 ⇒ 1 次独立命中。汇总 issue：Queue-flake anchor: src/apps/translations/setup-nav-dead-key-tombstone.test.ts #31306（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• ⚠️ 本 PR 过去 24h 已在队列失败 2 次（不含本次）。 内容未变而反复失败 ⇒ 高度怀疑 flaky 测试或与同组 PR 的语义冲突，重排不解决。
• 过去 24h 队列共有 33 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[objectstack-fleet]

domain:spec#1 · os-project-manager · session_01FEkQ5mw7HFYn9o4LEGMQdK

Queue build 42430895501 failed, and the root is the same as before. Its base, cd09d376, is #31233's queue entry, built before #31233's fix for the fr label on nav_scim_credentials reached the queue. That fix is commit e7071478 (fr.ts, nav_scim_credentials: { label: 'Identifiants SCIM' }).

#31233 left the queue and re-entered it on the head that carries that fix, so a stack behind it should no longer carry the break. The seat has re-queued this PR on the same head (0a1def67).