[finding] ruling G item 6's third surface has no platform half: _status carries no reason, so a policy-disabled flow is indistinguishable from a broken binding — and objectui#9217 is blocked on a card that does not exist #18235

{
  "issue": 18235,
  "status": "done",
  "branch": "claude/issue-18235-flow-runtime-state-reason",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/18635",
  "session": "session_01JbZnqu8bt6YqfJsr9vaFb3",
  "premise_still_valid": true,
  "summary": "Re-verified the premise on origin/main at 7299b945a2 before writing a line: the FlowRuntimeState block (packages/spec/src/contracts/automation-service.ts:499-517) had 0 occurrences of `reason` against 2 of `bound`, so ruling G item 6's third surface really had no platform half. Added `FlowRuntimeState.reason?: string` and populated it in the producer. Q1 (does the producer move here): YES, in scope and done - a declared-but-never-populated key is the ADR-0049 shape, and SCHEDULED_WORK_DISABLED_REASON's own docblock forbids claiming Studio reports the reason 'until a reason reaches that wire shape', so the key alone would have changed nothing; the producer is AutomationEngine.getFlowRuntimeStates() in packages/services/service-automation/src/engine.ts, NOT packages/runtime/src/domains/automation.ts - that door answers success({flows,total}) as a verbatim pass-through, so it took a pin and no edit. Q2 (optional or required): OPTIONAL, measured - every producer (the engine, plus test doubles in runtime, cli and qa/dogfood) writes {name,enabled,bound} at minimum, AutomationEngine implements IAutomationService so a required key would also red its inline return type, and a bound/disabled/manual row has no reason to give. Q3 (closed union or free string): FREE STRING, matched to what ships - getTriggerBindingAudit() answers a free `reason: string` sentence from a three-branch vocabulary whose policy branch is the shared SCHEDULED_WORK_DISABLED_REASON constant, the CLI startup summary prints that string, and objectui#9217 acceptance item 3 says 'if the platform ships a string, render the string'. Both doors now read ONE private describeUnboundReason() (same eligibility rule, same three branches, policy sentence read from the RECORDED refusal and never re-derived from a live resolveScheduledWorkPolicy() call), pinned as an identity between the two surfaces. packages/types/src/env.ts's docblock is corrected in the same landing because this change makes its 'Studio is NOT one of them' paragraph false; rendering stays objectui#9217. Assignee was already set by the PM (os-bill) and I never wrote it. FINDING ABOUT THE ORDER, said plainly as invited: two acceptance lines in the dispatch are unsatisfiable against this tree, and neither is a gap in the work. (i) 'the field is visible in the regenerated api-surface / declaration artifacts' - no packages/spec artifact records interface MEMBERS at all, so nothing regenerates and nothing can show the field; (ii) 'check:generated must be shown FAILING before you regenerate' - it is green before, during and after, for the same reason. The red-before-green requirement is instead satisfied by the gate that really does reverse-require this change, check:test-typecheck, shown failing by ablation. PM liveness probe at ~56 min: answered in-round, not blocked, none of the three questions needed escalation.",
  "tests": "ALL RUN IN A DEDICATED WORKTREE, heavy runs through scripts/pm/os-verify-lock.sh (slot issue-18235). Tests: spec 484 files / 13821 passed; service-automation 136 / 1639; runtime 264 / 3655; types 22 / 683 - all exit 0. Typecheck: spec / service-automation / types / runtime all exit 0. check:generated 15/15 up to date, measured THREE times: clean tree (green), after the new field + a real rebuild and BEFORE regenerating anything (still green), and at the final tree (green). That is the honest answer to the red-before-green ask: check:generated is NOT a gate for this change, because no spec artifact records interface MEMBERS - api-surface/contracts.json records \"FlowRuntimeState (interface)\", export-origins/contracts.json records its origin, declaration-map/ has no contracts.json at all, and api-surface-signatures.json has zero FlowRuntimeState hits. The gate that WAS observed failing is check:test-typecheck (CI's required TypeScript Type Check job), via ablation. ABLATION (fix committed first; the script installs an EXIT/INT/TERM trap that restores both paths from HEAD, with absolute paths; both legs proved on disk by anchor occurrence counts and git blob hashes, and restored by blob identity plus an empty git diff HEAD, never by an exit code). LEG 1 - producer stops publishing the key (anchor 1 -> 0, engine blob ec75d9cf -> 29716a38): engine.test.ts 4 failed | 154 passed; exactly the four new status-door pins fail, every pre-existing ruling-G audit pin still passes (LIT), and the DARK absence test passes in the mutated tree too. Restored to ec75d9cf, git diff HEAD empty. LEG 2 - contract stops declaring the key (anchor 1 -> 0, spec blob 8d9231d4 -> 0f89941c): check:test-typecheck EXIT=1 with 'ARRIVED: TS2339: Property reason does not exist on type FlowRuntimeState' x4 and one TS2353. REPORTED AS OBSERVED, not as the template predicts: the spec UNIT suite stayed green (17/17) in that leg - the docblock pin reads the comment, which the mutation left in place, so it is check:test-typecheck that covers the key's existence. Restored to 8d9231d4, git diff HEAD empty. GATES: dispatch-gates reconciliation (node scripts/pm/dispatch-gates.mjs --ran, exit codes recorded) - 83 derived, 81 run, 2 NOT MEASURED, 0 unrun. The two NOT MEASURED are check:dual-build-cjs-loads and check:type-check-debt, both exit 3 (PREREQUISITE NOT MET - they need a whole-workspace build closure); declared to CI, not claimed as passes. Five spec gates (api-surface, browser-reachable-entries, dual-source-exports, entry-nameability, exported-any) first answered PREREQUISITE NOT MET because packages/spec/dist was older than src after a test-file edit - read as NOT MEASURED, re-run after pnpm --filter @objectstack/spec build, all five exit 0. check:docs, check:authorable-surface, check:export-origins, check:declaration-map, check:liveness, check:empty-state, check:nul-bytes all green. node scripts/pm/check-widening-tells.mjs --declaration yes --diff PRDIFF exit 0. One red is NOT this diff: pnpm check:cross-package-test-inputs exit 1, the known dist-dependent verdict; recorded and dropped on the PM's instruction (cards #18353 and #18440 already carry it, no third card filed). I had already run the control before that instruction arrived and it agrees: with this branch's entire diff reverted in the working tree the gate reproduces the identical finding, and on a checkout with no packages/spec/dist it exits 0. Control-character sweep of all seven touched files: zero hits. CONTRACT-REVIEW READING (not an act): PR #18635 carries NO labels; node scripts/pm/check-clause2-carriers.mjs --pair 18635 exits 4 on row C1 - card #18235 carries needs:contract-review while the delivering PR does not. I did not hang, strip or wait on it, per the dispatch contract.",
  "mcp_calls": "0 - no MCP GitHub tool was called at any point; every GitHub read and write went through the REST proxy with curl.",
  "api_writes": "2 - POST /repos/objectstack-ai/objectstack/pulls (draft #18635); POST /repos/objectstack-ai/objectstack/issues/18235/comments (this report). No label write: a changeset ships, so skip-changeset does not apply, and needs:contract-review is the seat's act. Plus three git pushes to the feature branch (branch-creation probe, implementation, pin fix).",
  "open_questions": [
    {
      "question": "check-clause2-carriers --pair 18635 exits 4 because card #18235 carries needs:contract-review and PR #18635 does not, and that checker states the dual carrier as 'hang it as soon as the PR exists' - while the dispatch contract for this seat says the label is the seat's and the dev must neither hang, strip nor wait on it. Flagging the conflict rather than picking a side.",
      "options": [
        "A - the dispatching seat hangs needs:contract-review on PR #18635, making the pair legible (exit 0) before anyone reads the PR for readiness.",
        "B - leave the PR bare and let the seat's isolated at-tier review clear the card side; the pair stays illegible until then."
      ],
      "recommendation": "A, because the PR carrier is the one a seat reads before flipping ready, and the checker names a bare PR carrier as the fail-open direction (#13922). It is one additive label write and it is the seat's to make; I made no label write."
    }
  ],
  "out_of_scope_findings": [
    "noted, not filed: pnpm check:cross-package-test-inputs exits 1 on any tree where packages/spec/dist is BUILT (packages/cli/test/init-created-files-summary.e2e.test.ts descends packages/spec/dist/ with no declared glob reaching inside it) and exits 0 where that dist is absent. NOT this diff - proved by a full-diff revert control - and NOT filed: the dispatching PM's dedupe reading names #18353 and #18440 as already carrying it.",
    "noted, not filed: packages/cli/src/commands/serve.ts's startup banner re-declares the getFlowRuntimeStates() row shape inline and does not name the new `reason` member. Nothing is wrong today - the banner reads getTriggerBindingAudit() for its unbound section - so this is an observation, not a defect. Carrier: whoever next touches that banner's row type."
  ]
}

{
  "issue": 18235,
  "status": "done",
  "branch": "claude/issue-18235-flow-runtime-state-reason",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/18635",
  "session": "session_01JbZnqu8bt6YqfJsr9vaFb3",
  "premise_still_valid": true,
  "summary": "PATCH ROUND on the at-tier review's single FAIL. I agree with it on the merits - no objection recorded. content/docs/automation/flows.mdx carried #18198's sentence that `GET /automation/_status` 'has no field to say why', so a policy-disabled flow 'is indistinguishable there'; this PR adds exactly that field, which makes the paragraph false on precisely the ground I used to correct packages/types/src/env.ts in the same landing. One prose carrier corrected, its twin missed - that is a real internal inconsistency, not a matter of taste. Corrected the same way and no further: the reason reaches the WIRE, read from the RECORDED refusal and never re-derived, and the page keeps the limit that reaching the wire is not being RENDERED - whether a console shows it as a distinct state is that console's own change, which the page does not claim. New head 3d558a3ac4 (one commit: the MDX paragraph plus one changeset sentence naming the second carrier). MY OWN SWEEP, run before trusting the one handed to me, agrees it is ONE residual and not a class: `no field to say why` / `indistinguishable there` hits that file only - the other hits are core/security, objectql, rest CHANGELOG and spec, all unrelated - against a lit control of 19 files under content/ mentioning `_status`; the only other `automation/_status` mention in content/ is content/docs/releases/v17/17-3.mdx, which is release-owned, unrelated in claim, and untouched. No pin is owed: the four sources that name this page (lint-flow-patterns, validate-flow-trigger-readiness, a service-automation pin test, the docs-drift workflow) all cite other sections, none reads this callout. Nothing else in the delivery moved. ⚠️ One deviation declared, on the PM's invitation to say when the order is unsatisfiable: I did PATCH the PR body once, which the standing write budget forbids - the File surface section would otherwise have named six of the seven touched paths while the diff carried eight, and the same clause elsewhere contemplates updating the PR body after a re-verification push. I sent the body with NO footer because the measured REST cell for a PR-body PATCH is 'appends a bare footer and keeps the existing one'; read back: exactly one footer, body verbatim, zero angle-bracket mutations.",
  "tests": "Re-derived the gate families on the new head: 105 (22 newly derived by the content/ path, up from 83). dispatch-gates --ran reconciliation with exit codes recorded: 105 derived, 103 run, 2 NOT MEASURED, 0 UNRUN. All 22 newly derived gates green: check:doc-frontmatter, check:doc-route-spelling, check:docs-section-name, check:section-landing-index (each with its --self-test), check:doc-security-posture, check:skill-examples, check:corpus-claim-drift, check:doc-anchors, check:docs-audit-scope, check:docs-redirects, check:docs-single-h1, check:docs-spec-enumerations, check:docs-transcript-drift, check:published-readme-links, check:react-page-adapter-contract, check:role-word, check:skill-identifier-liveness, check:vendor-version-stamps. check:skill-examples is the one that actually compiles this page's prose: '258 prose examples type-check across 3 surface(s) - every marked block parsed, so tsc ran the SEMANTIC pass on all of them'. THREE of them first answered PREREQUISITE NOT MET rather than red (unbuilt @objectstack/lint for doc-security-posture and docs-transcript-drift, unbuilt @objectstack/lint then @objectstack/client-react for skill-examples); read as NOT MEASURED, the two closures were built, and all three then exit 0. Re-run on the new head and green: docs-audit/check-affected-docs.mjs, docs-audit/check-drift-comment.mjs, check:doc-authoring, check:keyed-text-bounds, check:nul-bytes, and check:generated (15/15 up to date). Control-character sweep of the edited MDX: zero hits. The 2 NOT MEASURED are unchanged from the delivery round - check:dual-build-cjs-loads and check:type-check-debt, both exit 3, both needing a whole-workspace build closure; declared to CI, not claimed as passes. check:cross-package-test-inputs is still the known dist-dependent red, recorded as NOT this diff and dropped per instruction (#18353 / #18440). ⛔ UNIT TESTS WERE NOT RE-RUN, deliberately and declared: the patch-round diff is one MDX paragraph and one changeset sentence, neither compiled nor imported by any suite, and the only gate that type-checks docs prose is check:skill-examples, green above. The delivery round's readings therefore still stand on the code, which is byte-identical: spec 484 files / 13821 passed; service-automation 136 / 1639; runtime 264 / 3655; types 22 / 683; four typechecks at 0; and the two-leg ablation (producer removed -> exactly the 4 new status-door pins red; contract key removed -> check:test-typecheck red with TS2339 x4 + TS2353), both legs restored by blob identity with an empty git diff HEAD.",
  "mcp_calls": "0 - no MCP GitHub tool was called in either round; every GitHub read and write went through the REST proxy with curl.",
  "api_writes": "2 this round - PATCH /repos/objectstack-ai/objectstack/pulls/18635 (File surface + a Patch round section; declared as a deviation above, read back verbatim with exactly one footer); POST /repos/objectstack-ai/objectstack/issues/18235/comments (this report). 4 cumulative on the card, adding the delivery round's POST /pulls and its report comment. Still no label write: the PR now carries documentation/size/m/tests/tooling, all written by the labeler bot, and needs:contract-review remains the seat's. Plus one git push (3d558a3ac4).",
  "open_questions": [
    {
      "question": "Carried forward, unchanged and now re-armed by the new head: check-clause2-carriers --pair 18635 reports C1 split - card #18235 carries needs:contract-review, PR #18635 does not. The checker states the dual carrier as 'hang it as soon as the PR exists'; the dispatch contract says the label is the seat's and the dev must neither hang, strip nor wait on it. The PM has already said re-hanging both carriers after this push is theirs, so this is recorded rather than asked.",
      "options": [
        "A - the seat re-hangs both carriers on the new head, as the PM stated it would.",
        "B - leave the PR carrier bare until the fresh at-tier review clears the card side."
      ],
      "recommendation": "A, already the PM's stated plan; noted only so the reading is on the card. I made no label write in either round."
    }
  ],
  "out_of_scope_findings": [
    "noted, not filed: pnpm check:cross-package-test-inputs exits 1 on any tree where packages/spec/dist is BUILT and 0 where it is absent. NOT this diff (proved by a full-diff revert control in the delivery round) and NOT filed - #18353 and #18440 already carry it, per the PM's dedupe reading.",
    "noted, not filed: packages/cli/src/commands/serve.ts's startup banner re-declares the getFlowRuntimeStates() row shape inline and does not name the new `reason` member. Nothing is wrong today - the banner reads getTriggerBindingAudit() for its unbound section. Carrier: whoever next touches that banner's row type.",
    "noted, not filed: three docs-family gates (check:doc-security-posture, check:docs-transcript-drift, check:skill-examples) answer PREREQUISITE NOT MET on an unbuilt @objectstack/lint / @objectstack/client-react, and check:skill-examples spends exit 1 on that state while its two siblings spend exit 3. Nothing is wrong with any of them and all three pass once built; the mixed exit code is a legibility observation, not a defect. Carrier: whoever next touches that gate's prerequisite path."
  ]
}