[objectstack-fleet]

Requested by Elon · project thread

domain:server#4 · os-elon-musk · session_016WV4cyizCEEdpjyVi8Kmw1

Fixes #27966

Clause-②: no
Metadata-protocol: none
Skills-docs: none — no authorable metadata changes; only the text of an existing refusal moves

维护者速读

• 改了什么:管理员在「设置 › 打包自动化」里关掉的打包流程,被调用时仍以 FLOW_DISABLED 拒绝,但提示改成一句给人看的话:「This flow is turned off for this deployment. An administrator can turn it on again under Setup › Packaged automation, or copy it there under a new name.」
• 为什么改:旧提示把系统表 sys_metadata_activation 和 ADR-0126 §7.2 写给终端用户看。分诊裁定复用 feat(spec,metadata-protocol,rest,objectql,runtime): GET /meta/object serves switched-off packaged actions beside the item, and the disabled-action refusal reads as a plain sentence #27964 给动作定下的那一句,而不是再写一份。feat(spec,metadata-protocol,rest,objectql,runtime): GET /meta/object serves switched-off packaged actions beside the item, and the disabled-action refusal reads as a plain sentence #27964 的句子是写死在 objectql 里的字符串,service-automation 运行时又不依赖 objectql,所以把这句抽成 @objectstack/types 里的一个构建器,动作和流程共用(席位已改认领扩面)。
• 风险与回滚:错误码、状态码、拒绝的范围都没变;动作那句逐字不变。按状态停用的流程仍是「Flow '…' is disabled」,两种原因照旧可区分。表名和 ADR 改记到一条 info 日志。回滚即还原这个 commit。
• 先看:packages/types/src/packaged-item-turned-off.ts、packages/services/service-automation/src/engine.ts(describeDisabledFlow)、src/flow-activation-ledger.test.ts。
• 两分钟验证:pnpm --filter @objectstack/service-automation exec vitest run src/flow-activation-ledger.test.ts,预期 49 个测试全绿。
• 需要你做的:无,席位落地。

Measured before the change (origin/main 2e955dd, scratch test, not committed)

door	code	error
direct run (engine.execute, the run the REST trigger route calls)	FLOW_DISABLED	Flow 'lone' is disabled — it is switched off for this installation in the packaged-metadata activation ledger (sys_metadata_activation, ADR-0126 §7.2). Re-enable the packaged flow to arm it again, or run a clone of it under a new name.
subflow (a parent calling a switched-off child)	—	Node 'call' failed: subflow 'child' failed: Flow 'child' is disabled — it is switched off … (sys_metadata_activation, ADR-0126 §7.2). …
status-disabled flow (control, out of scope)	FLOW_DISABLED	Flow 'obs' is disabled

The REST trigger door forwards result.error verbatim as error.message (pinned at packages/runtime/src/domains/automation-trigger-route-status.test.ts:285), so it reads whatever the engine says. The retry exit in dag-traversal.ts asks the same describeDisabledFlow and is unreachable through execute() today (its own comment).

Why a new builder in @objectstack/types

Triage ruled that the flow sentence reuse "the one builder PR #27964 settles, not a second copy". Measured: #27964's sentence is a string literal inside ActionActivationProjection.describeDisabled() (packages/objectql/src/action-activation.ts), and @objectstack/objectql is only a devDependency of @objectstack/service-automation, so the flow engine cannot call it at runtime. Both packages already depend on @objectstack/types, so the sentence moved there as describeTurnedOffPackagedItem('action' | 'flow'). objectql's describeDisabled() now returns its action form, byte-identical to #27964's. The seat amended the claim's file surface for this.

What changes

• @objectstack/types: new packaged-item-turned-off.ts with describeTurnedOffPackagedItem, exported from the package entry. The two kinds share one shape and differ only in the last clause: flow clone is chartered (ADR-0126 §7.2, POST /automation/:name/clone, offered on the Setup page), so the flow sentence offers a copy; action-clone is not (§8 item 2), so the action sentence keeps "or you can use another action".
• @objectstack/service-automation: the ledger branch of describeDisabledFlow (subflow-guards.ts) returns the flow sentence. The engine's describeDisabledFlow writes an info line naming the code, the flow, sys_metadata_activation and ADR-0126 §7.2 whenever it refuses a ledger-disabled flow (the feat(spec,metadata-protocol,rest,objectql,runtime): GET /meta/object serves switched-off packaged actions beside the item, and the disabled-action refusal reads as a plain sentence #27964 log-line pattern). The status-dimension sentence is unchanged.
• @objectstack/objectql: describeDisabled() delegates to the builder; its existing meta: GET /meta/object serves which packaged actions are switched off beside the item, and the disabled-action refusal reads as a plain sentence #27842 pin is untouched and still green.
• QA checklist: automation.packaged-flow-disable-durable (revision 8) — acceptance[1] and negative[3] now key on the new sentence; the verdict is unchanged (the message still separates the ledger dimension from the status one, the code is still FLOW_DISABLED).
• Changeset: patch for @objectstack/service-automation, @objectstack/types, @objectstack/objectql.

Tests

• flow-activation-ledger.test.ts: the four entry-path cases now pin the exact sentence; new cases pin the plain sentence (no table, no ADR) plus exactly one FLOW_DISABLED: info line naming the flow, the table and the ADR, and the subflow door (Node 'call' failed: subflow 'child' failed: followed by the sentence, so the child is still named). The status-disabled case now asserts it never mentions Packaged automation.
• engine.test.ts: two toggle cases follow the new wording.
• packages/types/src/packaged-item-turned-off.test.ts (new, 4): both sentences byte for byte, neither names a table, an ADR or a tracker number.
• packages/objectql/src/action-activation.test.ts: new pin that describeDisabled() IS the builder's action sentence.

Ablations through scripts/ablation-replace.mjs (fix committed first)

ABLATE-1 subflow-guards.ts: ledger branch back to the old sentence
  × the four entry-path cases, × plain-sentence + log case, × subflow-door case,
  × engine.test "should disable a flow", × "leaves a run that never dispatched WITHOUT a status"
  Tests  8 failed | 205 passed (213)    ok restored: blob == HEAD
ABLATE-2 engine.ts: log line guard -> if (false)
  × [#27966] the ledger refusal reads as plain words for the caller, and the log line keeps the ledger and the ADR
  Tests  1 failed | 48 passed (49)      ok restored: blob == HEAD
ABLATE-3 objectql action-activation.ts: describeDisabled returns its own literal
  × [#27842] the refusal sentence is plain words …, × [#27966] … not a second copy of it
  Tests  2 failed | 20 passed (22)      ok restored: blob == HEAD

Verification (head 4ffb37d, main merged after #27951 landed)

• vitest: @objectstack/service-automation 226 files / 2864 tests, @objectstack/objectql 494 / 9601, @objectstack/types 34 / 836 — all green.
• pnpm --filter PKG typecheck (includes check:test-typecheck) exit 0 with PKG each of the three packages.
• dispatch-gates.mjs --commands: 67 derived, 67 run, all exit 0 (check:dual-build-cjs-loads after building the 7 packages it named); --ran reconcile: 0 NOT-MEASURED, 0 UNRUN.
• pnpm lint exit 0.

🤖 Generated with Claude Code

https://claude.ai/code/session_016WV4cyizCEEdpjyVi8Kmw1

[github-actions]

📓 Docs Drift Check

This PR changes 3 package(s): @objectstack/objectql, @objectstack/service-automation, @objectstack/types, touching 9 documentable anchor(s). ⚠️ 1 changed file(s) yielded no anchor (packages/types/src/index.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

7 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/client-sdk.mdx (via FLOW_DISABLED (literal, a string literal in describeDisabledFlow))
• content/docs/api/declarative-endpoints.mdx (via FLOW_DISABLED (literal, a string literal in describeDisabledFlow))
• content/docs/api/plugin-endpoints.mdx (via FLOW_DISABLED (literal, a string literal in describeDisabledFlow))
• content/docs/automation/flows.mdx (via FLOW_DISABLED (literal, a string literal in describeDisabledFlow))
• content/docs/concepts/metadata-lifecycle.mdx (via /automation/:name/clone (route, a path literal in a comment on a changed line))
• content/docs/protocol/kernel/http-protocol.mdx (via FLOW_DISABLED (literal, a string literal in describeDisabledFlow))
• content/docs/ui/actions.mdx (via FLOW_DISABLED (literal, a string literal in describeDisabledFlow))

⛔ 5 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v16.mdx (via AutomationEngine (symbol, a top-level class))
• content/docs/releases/v17/17-0.mdx (via AutomationEngine (symbol, a top-level class))
• content/docs/releases/v17/17-1.mdx (via FLOW_DISABLED (literal, a string literal in describeDisabledFlow))
• content/docs/releases/v17/17-6.mdx (via AutomationEngine (symbol, a top-level class), FLOW_DISABLED (literal, a string literal in describeDisabledFlow), /automation/:name/clone (route, a path literal in a comment on a changed line))
• content/docs/releases/v17/17-7.mdx (via /automation/:name/clone (route, a path literal in a comment on a changed line))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 1 changed file(s) yielded no anchor (packages/types/src/index.ts) — pages documenting those are invisible to this run
• 2 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 58 of 210 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 32 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 8cb8c7f461eb5302aa0bea7205a3fc5ef7bd443a → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 912c97b41b4ea9dbb03ce977467029c8a7b232ee — the merge of head 4ffb37d9fbdcb460f081dfe0c66d710361750d55 into base 8cb8c7f461eb5302aa0bea7205a3fc5ef7bd443a, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 912c97b41b4ea9dbb03ce977467029c8a7b232ee && git checkout 912c97b41b4ea9dbb03ce977467029c8a7b232ee
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 8cb8c7f461eb5302aa0bea7205a3fc5ef7bd443a 4ffb37d9fbdcb460f081dfe0c66d710361750d55 && git checkout -B drift-repro 8cb8c7f461eb5302aa0bea7205a3fc5ef7bd443a && git merge --no-ff 4ffb37d9fbdcb460f081dfe0c66d710361750d55

node scripts/docs-audit/affected-docs.mjs --json 8cb8c7f461eb5302aa0bea7205a3fc5ef7bd443a

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 8cb8c7f461eb5302aa0bea7205a3fc5ef7bd443a → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

domain:server#4 · os-elon-musk · session_016WV4d1Np3hU7RQnA13YZcL

维护者速读

• 改了什么：管理员在「设置 › 打包自动化」里关掉的打包流程被调用时，仍以 FLOW_DISABLED 拒绝，但提示换成一句给人看的话，和 feat(spec,metadata-protocol,rest,objectql,runtime): GET /meta/object serves switched-off packaged actions beside the item, and the disabled-action refusal reads as a plain sentence #27964 给动作定的那句共用一个构建器（@objectstack/types）。
• 为什么改：旧提示把系统表 sys_metadata_activation 和 ADR-0126 §7.2 写给终端用户看（automation: a switched-off packaged flow is refused FLOW_DISABLED with a sentence naming sys_metadata_activation and ADR-0126 §7.2, the flow twin of the action sentence #27842 rewrites #27966）。
• 风险与回滚：Clause-②: no；错误码、状态码、拒绝范围都不变，动作那句逐字不变；按状态停用的流程仍是 "Flow '…' is disabled"。表名和 ADR 改记到一条 info 日志。回滚即还原本 PR。
• 先看：packages/types/src/packaged-item-turned-off.ts、service-automation/src/engine.ts 的 describeDisabledFlow、flow-activation-ledger.test.ts。
• 两分钟验证：pnpm --filter @objectstack/service-automation exec vitest run src/flow-activation-ledger.test.ts，49 个测试全绿。
• 需要你做的：无（非受管；不欠契约复审；席位按本任落地授权落地）。

席位意见：ACCEPT。

席位核对

Head-sha: 4ffb37d9fbdcb460f081dfe0c66d710361750d55

• Shape: 11 files, +209 / −24: a shared sentence builder in @objectstack/types (one new export, describeTurnedOffPackagedItem + PackagedItemKind), objectql's action refusal now calls it (byte-identical sentence, pinned), the automation engine's ledger refusal and the subflow guard use it, the QA checklist row, pins, and a changeset. Nothing under packages/spec. check-governed-merges --pr 28097: NOT governed.
• Premise measured: on main the direct run and the subflow door both showed the ledger table name and ADR number in the user-facing error; the REST trigger door forwards result.error verbatim, so the engine sentence is what the caller reads.
• Ablations (dev, each restored to HEAD): old sentence → 8 red; log guard removed → 1 red; objectql's own literal → 2 red. dispatch-gates 67/67 exit 0, pnpm lint 0, three-package typecheck and full suites green (os-dev report 6523152119).
• Gate check-runs on the head: 49 runs, 39 success, 10 skipped, 0 failure/pending; mergeable_state clean.
• Contract review: not owed (reviewFace decides no face on this file list and the changeset says Clause-②: no). The new @objectstack/types export is internal plumbing that two runtime packages share; no authorable surface moves.
• Docs drift advisory: the 7 pages naming FLOW_DISABLED were read; none quotes the old ledger sentence, and the flows.mdx 409 example shows the status sentence, which is unchanged.
• Accepted deviation: the surface took @objectstack/types and objectql's action-activation.ts by claim amendment, so the action and flow sentences come from one builder instead of a second copy.
• Landing: under the maintainer's landing grant for this seat term (seat 4 thread, 2026-10-29 22:04Z): pr_ready + automerge_enable through the relay.