test(automation): pin the control-flow trio's designer forms (#4045)

[os-zhuang]

Step A of #4045, after #4050 (step 1) and #4059 (step 3a). Tests only, no production code.

The gap

config-schemas.test.ts covered the CRUD quartet, assignment and screen. loop / parallel / try_catch had no descriptor assertions at all — the designer's input for the entire control-flow trio was unguarded, so a change to those configSchema literals could not be noticed by anything.

…and a premise this plan had wrong

#4045 — and my own analysis on it — treated these three as the easy part: redundant copies of Zod that already exists in control-flow.zod.ts, so step 4 would be "pure deletion, put it last". Reading them side by side to write these assertions shows that is wrong, and it would have been an expensive thing to discover mid-refactor.

The literals are deliberately shallower and looser than the Zod:

	form literal publishes	Zod says	naive generation would
loop.body, parallel.branches[].nodes/edges, try_catch.try/catch	{ type: 'array' }, no items	FlowRegionSchema = z.array(FlowNodeSchema)	nest the whole FlowNode/FlowEdge definition
collection	type: 'string'	z.string().min(1)	add minLength: 1
iteratorVariable	type: 'string'	.default('item')	add default: 'item'

The region case is the load-bearing one. A loop body is edited on the canvas; publishing its element schema would invite the designer to render a property form for every node inside the sub-graph. The absence of items is the contract, not an oversight.

So these are not duplicate sources pending merge — they are a second artifact with a different job (drive a form vs. validate a value), and the gaps are intentional. That reopens the option-1-vs-option-3 question for these nodes specifically: where two artifacts legitimately differ, what you want is the difference declared and enforced, not the difference erased.

What this PR does

Pins the intent, so the next person (or the next refactor) has an oracle:

• expectOpaqueRegion() asserts each region key is an object whose nodes/edges are arrays with items undefined — a named, explained assertion rather than a bare deep-equal.
• Pins loop.collection.xExpression === 'template', the maxIterations bounds against LOOP_MAX_ITERATIONS_CEILING, parallel.branches.minItems === 2, try_catch's errorVariable and the retry policy bounds.
• Asserts the absence of minLength / default on loop's string keys, so publishing the Zod-only constraints becomes a decision rather than a side effect.

Verified to bite, not merely to pass

An assertion that never fails is decoration. I simulated what a naive z.toJSONSchema swap would emit — deep items under body.nodes, plus minLength/default on the string keys — and both new loop tests went red with the intended message:

× loop: template collection, bounded iterations, opaque body
× loop: the form does NOT carry the Zod-only string constraints
AssertionError: loop.body.nodes must stay opaque (no items):
  expected { type: 'object', …(1) } to be undefined

Test plan

Check	Result
@objectstack/service-automation	✅ 452 passed (4 new)
ESLint on the changed file	✅ clean

Empty changeset — tests only, nothing releases.

What this changes about the next step

Step B is now worth doing before any swap: run z.toJSONSchema(LoopConfigSchema) for real and diff it against these pinned shapes, so the size of the gap is measured rather than inferred from reading. My table above is read from source, not from generated output. Depending on that result, the honest answer for region-bearing nodes may be a reconciliation ratchet (option 1) while the flat nodes — screen, CRUD, http, notify — go the single-Zod-source route (option 3), rather than one approach forced on all thirteen.

🤖 Generated with Claude Code

https://claude.ai/code/session_01QoA8AV99Ss1RRkLLAYmDzq

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
objectstack	Ignored		Jul 30, 2026 7:45am

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): packages/services.

6 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:

• content/docs/automation/webhooks.mdx (via packages/services)
• content/docs/kernel/runtime-services/audit-service.mdx (via packages/services)
• content/docs/kernel/runtime-services/index.mdx (via packages/services)
• content/docs/kernel/runtime-services/settings-service.mdx (via packages/services)
• content/docs/plugins/packages.mdx (via packages/services)
• content/docs/protocol/kernel/i18n-standard.mdx (via packages/services)

Advisory only. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs origin/main → pass the list as args.docs.