feat(automation)!: edge-branched decision is exclusive; mode: 'inclusive' takes every branch (#15429)

[objectstack-fleet]

Fixes #15429
Clause-②: yes

Carries the maintainer's ruling 5793803317 (「跟主流对齐」, 2026-09-23) as ONE change, routed to domain:spec by 5860007474 and dispatched by the domain:spec seat 4 PM (session_01CiCTczDo7tGhafXjf61dUJ, claim 5860277199). Branch base 10ea9eb2e; origin/main (a78f731ad) merged through os-regen-merge.sh; every reading below is at head e92edee5b unless it says otherwise; the patch commit 27a1a4598 (the seat's answer A in 5861311629) and the ruling C round (5863827385, claim 5864486967, head 18cbf4e2) carry their own readings where stated. (Body revised by the seat at 2026-09-28T01:34Z from the patch-round report 5861745226.)

Coordination card: objectstack-ai/objectui#10750 (the designer offers mode). Nothing is written in objectui here.

What changes

1. Exclusive by default (ruling item 1). AutomationEngine.traverseNext: on a decision node the conditioned out-edges are evaluated in the order the flow's edges array declares them and the FIRST one whose condition holds is the branch; its later siblings are not evaluated and record the same skipped step a closed gate does (skippedBy names the gate and the edge). isDefault is unchanged: it runs when no conditioned sibling did. Scoped to decision: conditioned out-edges of any other node type keep the every-true-edge traversal (the census below found none).
2. Explicit inclusive (item 2). config.mode: 'inclusive' takes every out-edge whose condition holds, one successor at a time (never Promise.all; the pin's positive control proves the instrument can see interleaving).
3. Registration door (acceptance 5857171841). registerFlow parses every decision's config through the spec's DecisionConfigSchema and refuses the flow on any issue rooted at mode — the refinement (mode beside a non-empty conditions list, either member) and the value refusal — with the schema's own sentence at node 'x' (decision) at config.mode, inside ADR-0031 regions too. Judged on mode alone, deliberately: the same parse also refuses an undeclared key, but that strictness binds at authoring by the standing decision in the module header of schemaless-node-config.zod.ts, and refusing an inert extra key at boot would be a second behaviour change riding a ruling that ordered one. Measured reach of the alternative: zero decision nodes in either corpus carry a key other than conditions, so promoting it later is cheap.
4. os validate door. @objectstack/lint gains flow-decision-mode-invalid (gating; the finding IS the schema's issue message, so both doors say one sentence) and flow-decision-inclusive-overlap (advisory, ruling item 4: mode: 'inclusive' with two or more conditioned out-edges; beside flow-decision-unconditional-branch, which is about an out-edge nothing gates).
5. Migration (item 3). ADR-0087 D2 conversion flow-decision-mode-inclusive-explicit (protocol 18): a decision with no conditions list, no mode, and two or more conditioned out-edges (a fault edge is error routing; a blank condition is none; regions walked through the shared slot table) gets mode: 'inclusive' written, with a notice naming the count. One conditioned edge plus a default is left alone; an authored mode is left alone (idempotent by construction). No inference over the conditions, per the ruling. Paired D3 entry flow-decision-edge-branching-first-match names the D2 id as a whole word and carries the three-way judgment the diff asks for. MIGRATIONS_BY_MAJOR[18] wires the id and its rationale grows a sentence.
6. Rewrites (item 5). decision-overlapping-edge-conditions.pin.test.ts is the contract pin now, per its own header. flows.mdx, the DecisionConfigSchema docblock and mode describe, the module header (the declared-ahead sites of 5852576993 item 2), logic-nodes.ts, and engine.ts's traversal comment all describe both modes; the reference mdx is regenerated.

Ruling C (5863827385): stored rows take the new meaning — listed, not rewritten

The ruling, verbatim:

Ruled: C. Ruling 5793803317 item 3 (「保证已上线的流程行为不变」) is narrowed to the surfaces that can carry it: authored sources (os migrate meta --from 17) and built artifacts. Stored rows (sys_metadata) take the new meaning on upgrade — a decision node with no config.conditions, no mode and two or more conditioned out-edges evaluates first-match — and the changeset and the upgrade guide state that as BREAKING, naming the shape and the one-line fix (mode: 'inclusive') for a node that meant every branch. No stored-row rewrite, no cutoff, no read-path completion. A (write-explicit on save plus read-path completion of a missing mode to inclusive) and B (an operator-supplied cutoff) are not taken.

Execution parameters (ruled in the same stroke):

• PR feat(automation)!: edge-branched decision is exclusive; mode: 'inclusive' takes every branch (#15429) #20344 (draft, 6bc84ba59, CI green) lands after the at-tier contract review (Clause-② yes), with these edits in its next round: the D3 entry's and the changeset's 「judgment owed」 sentence replaced by this ruling; a BREAKING paragraph naming the stored-row shape and the mode: 'inclusive' fix; os migrate meta --stored lists — report only, no --apply effect — every stored decision node with two or more conditioned out-edges and no mode, so an operator can review candidates before and after the upgrade. ADR-0087 needs no addendum: the artifact-door section's premise holds for sources and artifacts, and the stored seam is stated in the changeset.
• objectui#10750 (the designer writes mode explicitly on save) proceeds on its own card; it is the same question's other end and is wanted under this letter too.
• Pins: a stored decision node lacking mode with overlapping conditions evaluates first-match after upgrade; the --stored report lists it and changes nothing; a source flow migrated with --from 17 carries explicit mode: 'inclusive' and still takes every branch.

What this round did: (a) prose — the D3 entry flow-decision-edge-branching-first-match (reason tail and acceptance sentence), the D2 docblock, step18's rationale and the changeset now state BREAKING for a stored decision with no config.conditions, no mode and two or more conditioned out-edges, the one-line fix mode: 'inclusive', and the listing; the upgrade guide renders the D3 entry (reason = Why not automatic, acceptanceCriteria = Done when) when protocol 18 is cut; DecisionConfigSchema.mode's describe/docblock and the traversal comment say 'authored sources'; flows.mdx gains a stored-flow callout and cli.mdx a --stored paragraph; (b) listing — StoredMigrationReport.decisionModeReview (StoredDecisionModeReview: row id, flow, org, package, state, node id, label, path) in @objectstack/metadata-protocol, filled for every flow row on preview and apply alike by collectDecisionModeReview, which runs the D2 entry's own apply over the stored body and discards the result (one predicate; no engine needed; throws if the entry leaves the registry); it moves no outcome, count, exit code or write; formatStoredMigrationReport prints it with the fix, and the CLI and POST /meta/_migrate-stored carry it unchanged, so meta.ts is not edited; (c) the ruling's three pins, named below.

PM mechanism assumptions, measured

1. Where the traversal lives — held. Both sites relocated by content: the conditional loop under the old 「evaluate sequentially (mutually exclusive)」 comment in engine.ts (traverseNext), and the config.conditions first-match in builtin/logic-nodes.ts (untouched, still label-narrowing). Declaration order is flow.edges array order: traverseNext filters that array in place; FlowSchema.parse (region transform included) and every conversion walker are copy-on-write maps that never reorder; normalizeStackInput normalizes map-form collections at the stack level and never touches a flow's edges; canonicalizeStoredFlow runs those same two. Grep for any edge re-sort across packages/*/src and packages/*/*/src (edges.sort, sortEdges, .edges.slice().sort, localeCompare on edges): 0 hits. NOT MEASURED: the Studio designer's own serialization order at save time — objectui is not checked out in this container; server side, saveMetaItem canonicalizes without reordering.

2. The migration predicate — census. Corpus: this repository's examples at 10ea9eb2e and objectstack-ai/hotcrm at 2f7b2326 (read-only), every flow module loaded and every graph walked including regions; platform packages ship no decision node (grep over packages/platform-objects, plugins, services: only the executor and the README).

corpus	flows	decisions	rewritten (no list, ≥ 2 conditioned, no mode)	left alone	non-decision nodes with a conditioned out-edge
examples (app-crm, app-todo, app-showcase)	35	5	4	1 (crm_convert_lead_wizard.check_converted: 1 conditioned + isDefault)	0
hotcrm	13	25	13 (incl. lead_conversion.decision_duplicate, the #1555 node, now three conditioned edges)	12 (single-conditioned guards, no default)	0

Every one of the 17 positives is a hand-written partition by inspection (a predicate beside its negation, > beside <=, has() beside !has(), hotcrm's CASE_HAS_OWNER beside its exact complement, memberSource != "contacts" beside == "contacts"), so first-match changes none of their runs; the conversion still writes the key onto all 17, as ruled, and the D3 entry tells the author to delete it there. No decision in either corpus carries a config key other than conditions. examples/** is outside this claim's surface and is not edited: the four in-tree positives partition, so nothing changes at boot.

3. Stored flows — FAILED, and adapted. The assumption was that the conversion replays at rehydration like the other step-18 entries. It cannot: this is a DEFAULT FLIP (the old shape still parses and now means exclusive), and the flow rehydration seam serves post-flip authored bodies too — canonicalizeStoredFlow is reached by the boot pull for code-shipped flows, by POST /automation, by saveMetaItem (every Studio save) and by duplicatePackage, all through one two-argument signature, none dated. Replaying there would rewrite every NEW exclusive decision into an inclusive one at registration and persist it at save, and the ruled default would be unobservable. The registry's own doctrine for this class (excludeConversionIds, the artifact door's DEFAULT_FLIPS_NOT_REPLAYED_HERE for app-hidden-to-unpublished on #17885, the WITHDRAWN field-required-notnull-explicit note) says a seam that cannot state 「this body predates the flip」 refuses the entry by id. So:

• the entry is retiredFromLoadPath: true (no authoring window — 「不留过渡窗口」) and replays where the operator asserts the source's age: os migrate meta --from 17 (the D3 chain), pinned both ways;
• canonicalizeStoredFlow refuses it by id (CONVERSIONS_NOT_REPLAYED_AT_REHYDRATION, reason at the call site), pinned on parsed, storable and notices, with the chain as the firing control;
• Stored sys_metadata flows take the new meaning — ruled C (5863827385). A decision saved before this release with two or more conditioned out-edges and no mode runs first-match after the upgrade; no pass rewrites it (no stored-row migration, no cutoff, no read-path completion). BREAKING, stated in the changeset and the D3 entry with the one-line fix mode: 'inclusive'; os migrate meta --stored lists every such node, report only.
• The artifact-ingestion door refuses it too (patch commit 27a1a4598, the seat's answer A in 5861311629). packages/metadata-core/src/artifact-forward-conversion.ts lists flow-decision-mode-inclusive-explicit in DEFAULT_FLIPS_NOT_REPLAYED_HERE beside the app-hidden-to-unpublished precedent, with its reason: the door's trigger is the artifact's declared engines.protocol floor, ^17.0.0 is what create-objectstack stamps, so an app scaffolded today against the exclusive contract lands inside the window and would otherwise be handed an inclusive gateway it never asked for. The door pin has four legs (subject, the strict parse the door feeds, negative, firing control), and the engine seam's and the entry's docblocks now cite the door precisely.

4. Serial state — moved, merged. origin/main gained #20286 (view-overlay-owner-hidden-removed) on the same registry lines; os-regen-merge.sh merged it (both entries kept in landing order in conversions/registry.ts and in MIGRATIONS_BY_MAJOR[18], rationale concatenated), gen:migration-registry regenerated to an identical file, check:generated found every artifact current, and every sibling symbol was asserted present on both sides by exact-name grep (viewOverlayOwnerHiddenRemoved 3/3, view-overlay-owner-hidden-removed 9/9, view.zod.ts retiredKey 21/21).

5. Ruling C round (dispatch assumptions). (1) The report type is metadata-protocol's, not a spec contract type (api/protocol.zod.ts, ruling 2C note), so the widening is StoredMigrationReport + StoredDecisionModeReview there, covered by Clause-②: yes; the renderer is also metadata-protocol's, so meta.ts needed no edit. (2) The listing reads the stored body directly, with no engine, through the D2 entry's apply by id; a flow row skipped for want of an engine still lists. (3) origin/main 15bf186f5 (32 commits) merged through os-regen-merge.sh as df3f6a00: two hand-written conflicts (both registries; main's form-layout-inline-grid-to-vertical, currency-config-precision-removed, permission-rls-tags-removed kept ahead of ours), the reference mdx regenerated (62771d8e), gen:migration-registry a no-op on the merged entries, sibling ids and symbols asserted present 2/2 and 2/2. (4) #20316: branch claude/issue-20316-flow-node-config-build-doors exists, no PR; overlap with this PR is conversions.test.ts and migrations/registry.ts only; nothing here touches registerFlow.

Surface

22 files, +2157 / −205 (2362 changed lines against merge base 15bf186f5, under the 5000 human-merge threshold). Two files entered by the claim's surface amendment (5861311629): packages/metadata-core/src/artifact-forward-conversion.ts (only the DEFAULT_FLIPS_NOT_REPLAYED_HERE array and its reason docblock) and packages/metadata-core/src/artifact-forward-conversion.test.ts (the door pin). Two files the claim did not spell are recorded there as covered: packages/spec/src/conversions/registry.ts (where every D2 conversion lives) and packages/lint/src/index.ts (the two rule-id exports, required by rule-id-barrel-exports.test.ts). ⛔ Not touched: flow-node-expression-paths.ts, examples/**, packages/cli/**, packages/runtime/**, packages/rest/**, packages/spec/src/contracts/**, objectui. The ruling C round adds packages/metadata-protocol/src/{stored-migration,protocol,index}.ts, protocol.stored-migration.test.ts and content/docs/deployment/cli.mdx. ⛔ Still not touched: packages/cli/**, packages/runtime/**, packages/rest/**, packages/spec/src/contracts/**, examples/**, docs/adr/**, objectui.

Pins that carry weight, and the ablations

decision-overlapping-edge-conditions.pin.test.ts (21 tests): two overlapping true edges → exactly one runs, the first declared, the sibling records skipped; declaration order decides (the same predicates reversed take the other branch); mode: 'inclusive' → both run nested, no skipped step; none true → isDefault runs in both modes; a true edge beside a default passes the default over in both modes; a conditions list still narrows by label; registration refuses the pair (either member) and a bad value with the spec sentence, inside a loop body too, and the flow is never armed; the four controls register; the rehydration seam leaves the two-branch shape unrewritten while applyMetaMigrations(stack, 17, 18) rewrites it; a non-decision node keeps every-true-edge. conversions.test.ts: the fixture pair (2 notices) plus the predicate's edges, region reach, idempotence, the authoring funnel's silence, and the seam refusal with its firing control. lint-flow-patterns.test.ts: both rules, gating vs advisory, controls, regions, no double report through rule (2). migrations.test.ts's census pin sees the D3 entry naming the D2 id. artifact-forward-conversion.test.ts (27a1a4598): a ^17.0.0-floor artifact carrying a two-branch decision passes the door with no mode written, no notice for the id and the same reference back; the strict parse the door feeds receives no mode; ^99.0.0 shuts the window; and the same fixture through applyConversions with includeRetired: true and no refusal comes back { mode: inclusive } with the entry's notice (firing control). Ruling C (5863827385): decision-overlapping-edge-conditions.pin.test.ts — a decision as a pre-18 row stores it (JSON text, no mode, the hotcrm#1555 pair) passes canonicalizeStoredFlow with no mode written, registers and runs FIRST-MATCH (second branch skipped on its edge); the same body through applyMetaMigrations(stack, 17, 18) carries mode: inclusive and runs EVERY branch, nested, no skipped step (22 tests). protocol.stored-migration.test.ts — the stored node is listed with row, flow, node, label and path while the row stays canonical and clean; --apply changes no byte and writes no history; a row rewritten for another conversion persists no mode; no engine still lists; region path; controls (either mode, one edge plus default, conditions list, fault edge); the list equals the --from 17 chain's write paths; the renderer prints it beside the on-protocol verdict.

Both ablations ran from committed state through scripts/ablation-replace.mjs (anchor hit 1→0, marker 0→1, blob hashes printed), the reading was taken, and restore was git checkout HEAD -- ABS_PATH under a trap, proven by git diff HEAD clean and git hash-object equal to the HEAD blob. No dist leg was owed: both suites resolve their subject through src (../engine.js inside service-automation; ./registry.js inside spec).

• traversal: if (exclusive && anyConditionMet) → if (false && …). Blob a60861d3985717a743cb32c16d9e3ba925dee3c7 → f0e25d39262ae22b38ef67b5affbba494c0023bf. Ablated run: 6 failed (exactly the exclusivity, skipped-step, declaration-order, written-exclusive, default-passed-over and seam-runs-exclusive pins), 15 passed (the controls, inclusive, default and registration pins). Restored: a60861d3… on disk and at HEAD.
• predicate: MIN_CONDITIONED_EDGES = 2 → 3. Blob fd1a7902d480b791e7f53116eb38c97ad268fb78 → a03f5cbdf9f742aabf42e8400a1fc5df50b50d1b. Ablated run: 5 failed (the fixture pair, the wiring pin, the two-edge rewrite, the left-alone pin, the seam-refusal firing control), 216 passed. Restored: fd1a7902… on disk and at HEAD.
• artifact door (27a1a4598): the id removed from DEFAULT_FLIPS_NOT_REPLAYED_HERE (anchor 1→0, marker 0→1). Blob 16742f49e72eaa98214eca097b9b14cef03e8809 → 26220cf59c92d7b4daf75a74b17e5a076156503c. Ablated run: 2 failed (the subject leg — mode written — and the strict-parse leg), 27 passed (the firing control and the negative stayed green). Restored: 16742f49… on disk and at HEAD.
• stored listing (18cbf4e2): protocol.ts for (const node of collectDecisionModeReview(body)) { emptied (.slice(0, 0)), blob 711fded5ddea7d37b4f6d2a52f7b7a6a80db8081 → ce0c296d5134527c0634c1932ec88b59c6285dbc; ablated run 5 failed | 34 passed (the five listing pins; region, controls, parity and the nothing-to-review control green); restored 711fded5… on disk and at HEAD.
• stored-row seam (18cbf4e2): engine.ts excludeConversionIds: CONVERSIONS_NOT_REPLAYED_AT_REHYDRATION, removed (a read-path completion), blob daac6de07304ae4051f1681ab4311c447a8ad3a9 → a3555237ccca29ff4ad888bd009cc97be4007ae8; ablated run 7 failed | 15 passed (the ruling C stored-row pin, both seam pins, four exclusive-traversal pins; the --from 17 source pin, inclusive, default, registration and boundary green); restored daac6de0… on disk and at HEAD.

Tests, at e92edee5b, every exit captured after a redirect

• pnpm --filter @objectstack/spec test → exit 0: Test Files 554 passed (554) · Tests 16366 passed | 1 todo.
• pnpm --filter @objectstack/service-automation exec vitest run --maxWorkers=2 → exit 0: Test Files 147 passed (147) · Tests 1782 passed (1782).
• pnpm --filter @objectstack/lint exec vitest run --maxWorkers=2 → exit 0: Test Files 111 passed (111) · Tests 4313 passed (4313).
• typecheck for the same three packages → exit 0 each (check:test-typecheck OK on each test layer).
• Importers of DecisionConfigSchema outside these packages: metadata-protocol's JSON-projection walk (a refinement projects byte-identically) and config-expression-ledger.test.ts (in the service-automation run above); no other importer of the traversal exists (registerFlow callers in runtime and plugin.ts are unchanged call sites).
• Gates: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 114 commands on this branch; all 114 ran on e92edee5b with exit 0 (check:dual-build-cjs-loads and check:type-check-debt first answered exit 3, PREREQUISITE NOT MET, until the whole packages/* closure was built — 71/71 — then 0); --ran reconciliation: 114 derived, 114 run, 0 NOT-MEASURED, 0 UNRUN. check:generated on the merged tree: every artifact current after gen:docs. spec-changes.json and the upgrade guide render no protocol-18 id yet (control: report-joined-chart-removed 0 hits too), so their green is genuine, not a missed regeneration.
• Patch commit 27a1a4598, readings at that head: pnpm --filter @objectstack/metadata-core exec vitest run --maxWorkers=2 → exit 0: Test Files 16 passed (16) · Tests 289 passed (289); metadata-core typecheck → exit 0. Re-run because the diff reaches them (docblock edits in engine.ts and conversions/registry.ts): service-automation Test Files 147 passed (147) · Tests 1782 passed (1782), spec Test Files 554 passed (554) · Tests 16366 passed | 1 todo, both typechecks exit 0; lint is not reached and was not re-run. Gates: the same 114 derived commands (0 added, 0 dropped), all exit 0 on 27a1a4598; --ran: 114 derived, 114 run, 0 NOT-MEASURED, 0 UNRUN. check:type-check-debt first refused (exit 3) because metadata-core's cache-restored dist/ was older than its source after the ablation's restore rewrote the file; a direct pnpm --filter @objectstack/metadata-core build, as the gate prescribes, and a re-run gave 0.
• Ruling C round, at 18cbf4e2: spec test 557 passed (557) · 16508 passed | 1 todo; spec test:repo 35 passed (35) · 634 passed (634); metadata-protocol 189 passed | 3 skipped (192) · 2745 passed | 19 skipped (2764); service-automation 147 passed (147) · 1783 passed (1783); metadata-core 16 passed (16) · 289 passed (289); lint 113 passed (113) · 4713 passed (4713); cli unit 230 passed plus the two published-subpath pins 2 passed (2) · 29 passed (29) after a post-merge pnpm install (prerequisite, not a red); typecheck exit 0 for all six. Gates: 117 derived, 117 run, --ran: 117 derived, 117 run, 0 NOT-MEASURED, 0 UNRUN (three first answered exit 3 PREREQUISITE NOT MET until the full ./packages/* closure and client-react / metadata-protocol were built). Narrowed eslint over the PR's 18 changed .ts files: 0 errors, 0 warnings (no type-aware linting in eslint.config.mjs). CI on 18cbf4e2: 33 success, 2 skipped, all seven required contexts success.

Changeset grade, measured at landing

npm latest @objectstack/spec is 17.4.0 (npm view, re-measured 2026-09-28), whose published DecisionConfig.json declares conditions only; .changeset/19867-decision-config-mode.md and .changeset/20168-…md are still unconsumed, so mode is unreleased and reaches its first release with the traversal that reads it and the conversion that writes it. Clause-②: yes per the ruling's item 2 (the D2/D3 entries and the two lint rules widen the published surface; nothing published narrows). minor for @objectstack/spec, @objectstack/service-automation and @objectstack/lint, with the BREAKING banner, the FROM → TO block and the disposition marker registered flow-decision-mode-inclusive-explicit (the changeset file carries it in the gate's own form). @objectstack/metadata-protocol minor (the report widens) and @objectstack/metadata-core patch (the artifact door's refusal) join the bump list; the changeset carries the ruling C BREAKING section.

Acceptance notes

• Landed on this PR (27a1a4598): the artifact door's refusal of flow-decision-mode-inclusive-explicit, per the seat's answer A (5861311629).
• The stored-row half is ruled C (5863827385) and landed in this round: stored rows take the first-match meaning (BREAKING, stated with the fix), os migrate meta --stored lists them report-only, and the three pins hold it. objectui#10750 (the designer writes mode on save) proceeds on its own card and is not this PR.
• origin/main moved two commits after this round's merge (0d7ed5a3 regenerates packages/spec/src/migrations/registry.ts); the landing lap merges it through os-regen-merge.sh.
• skills/objectstack-automation/SKILL.md line 65 (「routed by edge condition predicates」) stays true and does not mention mode; governed surface, not touched.
• The REST door answers a registration refusal as VALIDATION_ERROR 400 through flowDefinitionRefusal (unchanged code path); not pinned here, the runtime package is outside this surface.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 5 package(s): @objectstack/lint, @objectstack/metadata-core, @objectstack/metadata-protocol, @objectstack/service-automation, @objectstack/spec, touching 47 documentable anchor(s). ⚠️ 2 changed file(s) yielded no anchor (packages/lint/src/index.ts, packages/metadata-protocol/src/index.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

26 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json 40b315b03345e334069dd454aecaf7016adbea4f.

⛔ 7 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 2 changed file(s) yielded no anchor (packages/lint/src/index.ts, packages/metadata-protocol/src/index.ts) — pages documenting those are invisible to this run
• 1 cross-cutting symbol(s) contributed no route anchor: organizationId (6 routes)
• 8 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 137 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 40b315b03345e334069dd454aecaf7016adbea4f → packageMentionDocs.

Which tree this was computed on

This run read content/docs from e82b32af5b2ece5e03fe7be92c4ab5cc2caac653 — the merge of head b30325bb385e5b4da8e31538ea7931550ec1cd56 into base 40b315b03345e334069dd454aecaf7016adbea4f, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin e82b32af5b2ece5e03fe7be92c4ab5cc2caac653 && git checkout e82b32af5b2ece5e03fe7be92c4ab5cc2caac653
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 40b315b03345e334069dd454aecaf7016adbea4f b30325bb385e5b4da8e31538ea7931550ec1cd56 && git checkout -B drift-repro 40b315b03345e334069dd454aecaf7016adbea4f && git merge --no-ff b30325bb385e5b4da8e31538ea7931550ec1cd56

node scripts/docs-audit/affected-docs.mjs --json 40b315b03345e334069dd454aecaf7016adbea4f

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 40b315b03345e334069dd454aecaf7016adbea4f → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 18cbf4e2b923dd530304235a39924fdf6043c395
Local-runs: none

① Derived judgments

Inputs read in full: card #15429 (body + all 24 comments, rulings 5793803317 and 5863827385 included), PR #20344 body and 22-file list, the net diff against merge base 15bf186f5 (+2157/−205, 13 branch commits), and the check-runs on the head. Check-runs: 42 on the head; at first read ONE was in progress — Check Changeset (re-run started 07:51:24Z; its earlier run on the same head concluded success at 06:58:49Z); on a re-poll before this record was rendered it concluded success at 07:52:25Z, leaving 38 success · 4 skipped (Console Pin Gate, Packed-tarball smoke opt-in, and Auto Label / Check PR Size on the re-run) · 0 failure · 0 in progress. Every accept-set and public-surface change the diff implies, judged:

1. Traversal (engine.ts traverseNext) — RIGHT. exclusive = node.type === 'decision' && config.mode !== 'inclusive'; once a conditioned out-edge holds, every later sibling is passed over unevaluated and records the same skipped step a closed gate does (skippedBy names gate + edge, via the hoisted recordSkipped); anyConditionMet still gates isDefault; the unconditional bucket's Promise.all and non-decision nodes are untouched. Declaration order is flow.edges array order (filtered in place; parse and conversions are copy-on-write). Ruling item 1 verbatim. One scope note, not a defect: the flag keys on node type, not on "no config.conditions", so a conditions-list decision whose label-narrowed edges hold two or more conditioned edges under one label also goes first-match now — the D3 text says "nothing else about conditions-list decisions changes"; the corpus has zero such nodes and the direction matches the ruling.
2. mode: 'inclusive' — RIGHT. Every true edge, sequential (await inside the loop), never Promise.all; pinned nested-not-interleaved with the unconditional fan-out as the positive control. Ruling item 2.
3. Registration door (validateDecisionModes) — RIGHT. Every decision in every graph (regions via collectFlowGraphs) is parsed through DecisionConfigSchema.safeParse; the flow is refused on issues rooted at mode only, with the schema's own sentence at node 'x' (decision) at config.mode, region-prefixed; hard-fail, never armed (getFlow null pinned). Acceptance 5857171841 (refinement + value prescription, both doors). Judging mode alone and leaving unknown-key strictness at authoring is a declared, reasoned scope (module header's standing decision; measured reach zero).
4. os validate — RIGHT. flow-decision-mode-invalid (severity error; finding IS the schema issue message; hint names registerFlow) and flow-decision-inclusive-overlap (advisory; two or more conditioned non-fault out-edges; one edge plus default excluded), both barrel-exported, region-reaching, no double report with flow-decision-unconditional-branch. Ruling item 4.
5. D2 conversion flow-decision-mode-inclusive-explicit — RIGHT. toMajor: 18, retiredFromLoadPath: true, predicate = decision with no non-empty conditions, no mode key, two or more conditioned non-fault out-edges (string or {dialect, source} envelope; blank = none), regions through FLOW_REGION_SLOTS_BY_TYPE with a depth ceiling, copy-on-write, one notice per write, fixture pair with 2 notices; wired into CONVERSIONS_BY_MAJOR[18] and MIGRATIONS_BY_MAJOR[18].conversionIds. No alias, no transition window, no inference over CEL — the ruling's count predicate. Idempotent by construction. Ruling item 3, landed in the SAME PR as the semantics ("never apart" held).
6. D3 entry 18.flow-decision-edge-branching-first-match.ts + regenerated migrations/registry.ts — RIGHT. Names the D2 id as a whole word; reason and acceptanceCriteria carry ruling C in substance (BREAKING for stored rows, no rewrite / cutoff / read-path completion, the one-line fix, the --stored listing); step18 rationale gains the sentence.
7. Replay sites of the flip id, each judged:
   • authored sources, os migrate meta --from 17 = applyMetaMigrations(stack, 17, 18): REPLAYS — pinned (conversions.test.ts chain wiring; the ruling-C source pin: migrated flow carries { mode: 'inclusive' } and takes every branch). Right.
   • authoring funnel normalizeStackInput: refused by retiredFromLoadPath — pinned. Right.
   • engine rehydration seam canonicalizeStoredFlow: applyConversionsToFlow(…, { includeRetired: true, excludeConversionIds: CONVERSIONS_NOT_REPLAYED_AT_REHYDRATION }); spec/conversions/apply.ts:115,130-132 honours the option; pinned on parsed, storable and notices with the chain as firing control; the dev's ablation (exclusion removed = a read-path completion) turned 7/22 red. Refused — right.
   • artifact door applyArtifactForwardConversions: DEFAULT_FLIPS_NOT_REPLAYED_HERE (fed to excludeConversionIds at line 361) gains the id beside app-hidden-to-unpublished with its reason; four-leg pin (subject at ^17.0.0, the strict parse the door feeds, ^99.0.0 negative, firing control through applyConversions with the window open). Refused — right; the seat's answer A 5861311629 executed on this PR in 27a1a4598.
   • stored pass migrateStoredMetadata: flow rows never reach applyConversionsToStoredItem (protocol.ts:4780 returns flow bodies untouched); they go through the caller's canonicalizer (the engine seam above) or are skipped; collectDecisionModeReview runs the D2 entry's own apply over { flows: [body] }, keeps only the emitted paths and discards the stack (throws if the entry leaves the registry or emits an unknown path shape). Listing only — pinned: row/flow/node/label/path listed with the row canonical and stored bytes identical; --apply writes nothing and no history row; a row rewritten for another conversion persists no mode; no engine still lists; region path; five controls; ONE-PREDICATE parity with the chain's write paths; renderer beside the on-protocol verdict; storedMigrationClean unmoved. Right.
   • enumeration closed: includeRetired: true outside tests occurs at exactly three sites at the head (artifact door, engine seam, spec/conversions/stored.ts:104 item primitive); the item primitive's only non-spec callers are core/fallbacks/authored-translation-sync.ts (translation type) and protocol.ts:4783 behind the flow short-circuit. No fourth seam.
8. Report widening (@objectstack/metadata-protocol) — RIGHT. StoredMigrationReport.decisionModeReview (required array) + exported type StoredDecisionModeReview; formatStoredMigrationReport prints the section only when non-empty, with the fix sentence; describeScope widened to a Pick. CLI migrate/meta.ts:708-732 formats through that renderer and spreads the report into --json; REST rest-server.ts:5854-5866 answers res.json(report); the SDK's meta.migrateStored is deliberately unbound (spec/api/protocol.zod.ts:1651, ruling 2C) — so no spec contract type exists to widen and meta.ts needed no edit; the dev's reading holds. No other constructor of the report type at the head, so the required field breaks no consumer (workspace type-check green).
9. Prose — RIGHT, with one residue. Module header, the former "Declared ahead of its enforcement" paragraph (now "Where mode is honoured"), the mode describe and docblock, flows.mdx ("BPMN gateway — the default choice", the exclusive/inclusive paragraphs, the upgrade and stored-flow callouts), cli.mdx --stored paragraph, logic-nodes.ts and the engine.ts traversal comment (the "mutually exclusive" comment is now true — item 5), regenerated reference mdx (describe text byte-identical; check:generated green). Residue: schemaless-node-config.zod.ts:451, the DecisionConfigSchema docblock's opening line, still reads "the branch mode declared ahead of the engine change that will read it" — source-only (it reaches neither the generated reference nor flows.mdx) and contradicted by the head's own next section. Flagged in ③, non-blocking.
10. Pin rewrite — RIGHT. decision-overlapping-edge-conditions.pin.test.ts is the contract pin per its own header (22 tests, the ruling-C pair included). Item 5.
11. examples/** not rewritten — RIGHT. Chain-only conversion; the 4 in-tree positives all partition, so first-match changes no run at boot.

② Semver level

Changeset .changeset/15429-decision-edge-branching-first-match.md: @objectstack/spec minor · @objectstack/service-automation minor · @objectstack/lint minor · @objectstack/metadata-protocol minor · @objectstack/metadata-core patch; feat(automation)!: title; the adr-0087 "registered" disposition marker naming flow-decision-mode-inclusive-explicit; Clause-②: yes; BREAKING banner, FROM → TO block, and a second BREAKING section for stored rows (ruling C). Check Changeset success twice on the head.

• spec minor — right. Publishes the D2 conversion and D3 entry into the protocol-18 chain (ALL_CONVERSIONS, MIGRATIONS_BY_MAJOR[18]) and the describe/docblock text; no published accept set narrows: npm latest @objectstack/spec 17.4.0 declares conditions only, mode and its refinement (spec(automation): add an optional mode: 'inclusive' to DecisionConfigSchema — the contract half of #15429's ruling (edge-branched decisions become exclusive / first-match; "take every true edge" must be declared) #19867, fix(spec): refuse decision mode beside a non-empty conditions list (#20168) #20279) are unconsumed, so mode reaches its first release with the traversal that reads it and the conversion that writes it.
• service-automation minor with BREAKING banner — right. A run-time semantics flip on a shipped node type plus a new registration refusal; under the launch-window rule in scripts/check-changeset-no-major.mjs (lockstep group; breaking ships as minor with the banner) this is the house form.
• lint minor — right. Two new exported rule ids; the gating one can only refuse a mode that has never shipped.
• metadata-protocol minor — right. A published report type gains a field and a new type is exported; widening, no external constructor.
• metadata-core patch — right. One array entry refusing an id that is new in the same release; unobservable against the previous release.
• Clause-②: yes — right. The D2/D3 entries, the two rule ids and decisionModeReview are new keys/entries on published payloads; nothing narrows; the level axis is satisfied by spec minor.
• Note only: .changeset/19867-decision-config-mode.md (unconsumed, from spec(automation): add an optional mode: 'inclusive' to DecisionConfigSchema — the contract half of #15429's ruling (edge-branched decisions become exclusive / first-match; "take every true edge" must be declared) #19867) still says "until that second step ships, nothing reads mode"; both notes ship in one release and read as a sequence. Not this PR's file, no action.

③ Boundary flags

Dev flags — newest os-dev-report 5865679628, deviations, each answered:

1. origin/main merged first (df3f6a00), no force-push — fine; every reading on the merged tree.
2. Mechanism assumption 1 partly falsified (renderer and report type live in metadata-protocol; meta.ts untouched) — verified at the head (①.8). Right.
3. Mechanism assumption 2 (listing reads the stored body with no engine, through the entry's apply) — verified; guarded against a silently empty list. Right.
4. Surface additions (cli.mdx paragraph, metadata-protocol/src/index.ts type export, mode describe/docblock narrowed to "authored sources", engine.ts comment-only) — verified: between 62771d8e and the head engine.ts moves no non-comment line and nothing enters registerFlow. Within claim 5864486967; accepted.
5. Changeset gains @objectstack/metadata-core: patch — right (②).
6. CLI unit prerequisite refusals (no dist, then post-merge workspace deps) — prerequisite, not a red; CI Test Core shards green on the head.
7. origin/main moved after the merge — now FIVE commits past the merge base (0d7ed5a3 regenerates migrations/registry.ts and rewords driver-/kernel-/system-* entries; ab6fb027 docs cli; 2f122b6e objectql; 681868ca spec ui; df3ba164 plugin-email). Nothing in this head depends on any of them: the diff references none of their content, its tests and gates ran on the merged tree at 15bf186f5, and the only file both sides touch is the generated packages/spec/src/migrations/registry.ts in non-overlapping regions (PR hunks at step18 lines 5414 / 5457 / 10414; main's at step17 2376–2506 and step18 8215–8406, 11052–11467). GitHub reports mergeable: true against the current tip (df3ba164, 06:39Z, before this read), and a git trial merge of origin/main into the head (tree objects only, no worktree) is conflict-free. The landing lap is a merge plus a confirming gen:migration-registry / check:generated, expected no-op since the new semantic entry sorts into its own position.

open_questions: none in the ruling-C report. The earlier round's one question (which route lands the artifact door's refusal) was answered A by 5861311629 and landed in 27a1a4598; verified (①.7).

Ruling coverage:

• 5793803317 items 1–5 all landed in this one PR (traversal; explicit inclusive; D2 + D3 with the semantics, no alias, no window; lint hint; the rewrites).
• 5863827385 (letter C), execution parameters: the "judgment owed" / "rewritten by nothing" / "half no command reaches" sentences are gone from the head (zero hits across packages, content, .changeset, docs); the BREAKING paragraph naming the stored-row shape and mode: 'inclusive' is in the changeset, the D3 entry, step18's rationale, the flows.mdx callout and cli.mdx; os migrate meta --stored lists report-only with no --apply effect (bytes-identical pinned); no stored-row rewrite, no cutoff flag, no read-path completion; no ADR edit (docs/adr/** untouched, as ruled); the three named pins are present (stored no-mode overlapping decision runs first-match; the --stored report lists it and changes nothing; a --from 17 source carries explicit mode: 'inclusive' and still takes every branch). The generated docs/protocol-upgrade-guide.md renders no protocol-18 step while PROTOCOL_VERSION is 17.0.0; the BREAKING text is carried by the D3 entry's reason / acceptanceCriteria, which is what the guide renders at the cut — satisfied by construction, visible at the cut.
• objectui#10750 proceeds on its own card, as ruled; nothing here reaches objectui.

Escalations: none. Flagged for the landing lap, non-blocking: the one-line docblock residue at packages/spec/src/automation/schemaless-node-config.zod.ts:451 ("declared ahead of the engine change that will read it"), which no generated artifact carries.

Implemented-by: claude/issue-15429-decision-first-match
Reviewed-by: session_01ARcDurZ5j34RdqsGgc4jgH

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 0c4dad2a60b3f6aa189ebe3856afb44a7458f9ba
Local-runs: none

① Derived judgments

Inputs read in full: card #15429 (body + all 27 comments — rulings 5793803317 and 5863827385, resolution B 5865957805, claim 5864486967, reports 5865679628 / 5865931103 / 5866729342 included), PR #20344 body and 22-file list, the net diff against main at dcd3bcea (dcd3bcea IS the merge base, so two-dot equals three-dot: 22 files, +2157 / −205, path-for-path and count-for-count equal to the PR's file list), and the check-runs on this head: 35 — 33 success · 2 skipped (Console Pin Gate, Packed-tarball smoke opt-in) · 0 failure · 0 in progress; Check Changeset, Lint & Repo Gates, Spec property liveness, Governed Surface Queue Guard, every Type Check and Test Core shard, both Dogfood gates and Temporal Conformance all success.

The merge resolution, judged first (head = merge commit, parents 18cbf4e2 and dcd3bcea; no regeneration commit followed):

• (a) main's side — RIGHT. git diff 15bf186f5 dcd3bcea versus git diff 18cbf4e2 0c4dad2a on the two registries, compared as +/− line multisets: 508 versus 506 lines, and the only lines not common are the one string join — main's closing literal '`action-aria-retired`.', is '`action-aria-retired`. ' at the head so the concatenation continues. No line of main's dropped, reordered or reworded otherwise (main's own permission-rls-tags-retired join, which main had already opened for action-aria, is on both sides). This PR's side — RIGHT. git diff 15bf186f5 18cbf4e2 versus git diff dcd3bcea 0c4dad2a on the same two paths: 374 versus 374 lines, identical except that the join this PR opens is now action-aria-retired's instead of permission-rls-tags-retired's; every one of its 294 + 79 added lines is present. Order at the head: CONVERSIONS_BY_MAJOR[18] ends permissionRlsTagsRemoved, actionAriaRemoved, flowDecisionModeInclusiveExplicit (conversions/registry.ts:12206-12208); step 18 conversionIds ends 'permission-rls-tags-removed', 'action-aria-removed', 'flow-decision-mode-inclusive-explicit' (migrations/registry.ts:5500-5502) — resolution B's landing order, and nowhere else was hand-edited.
• (b) the resolved step-18 rationale — true, with one cosmetic seam. At migrations/registry.ts:5433-5458 main's sentence ("Finally, it removes aria from the action … its D3 record is the semantic entry action-aria-retired. ") is followed by this PR's sentence verbatim ("Finally it makes edge-branched decision nodes EXCLUSIVE … mode: 'inclusive' is the one-line fix where a node meant every branch."). Every sentence in the sequence is true on this head; build-upgrade-guide.ts:89 prints step.rationale as one paragraph, so the reader at the protocol-18 cut will see two consecutive "Finally" openers. That is the cost resolution B priced in ("carried to the next PR that touches step 18's rationale"), and rewording main's opener would have breached B's own rule. Non-blocking; restated in ③.
• (c) no other file moved — RIGHT. git diff --numstat 15bf186f5...18cbf4e2 and git diff --numstat dcd3bcea...0c4dad2a are identical for all 22 files (diff of the two lists empty; +2157 / −205 both). Stronger than the numstat: of the 22 files, main moved only the two registries between 15bf186f5 and dcd3bcea; the 20 non-registry files have byte-identical blobs at 18cbf4e2 and at this head (git diff --name-only 18cbf4e2 0c4dad2a over those 20 paths is empty); and git diff --name-only dcd3bcea 0c4dad2a is exactly the 22. The regeneration chain was a no-op on the resolved tree, so the head is the merge commit itself; Lint & Repo Gates (which carries check:generated) is success on this head.

Every accept-set and public-surface change, re-rendered on this head. Because the 20 non-registry files are byte-identical to 18cbf4e2 and the registry additions are line-identical, each judgment below is carried from 5865889450 on confirmed-unchanged bytes and re-anchored to the head's lines:

1. Traversal (engine.ts traverseNext) — RIGHT. :10382 exclusive = node.type === 'decision' && !decisionTakesEveryBranch(node), where :239-242 returns config?.mode === 'inclusive'; once a conditioned out-edge holds, every later sibling is passed over unevaluated and recordSkipped (:10331) writes the closed-gate skipped step; anyConditionMet still gates isDefault (:10408-10420); the unconditional bucket and non-decision nodes untouched; declaration order = flow.edges order. Ruling item 1. Scope note unchanged: the flag keys on node type, corpus has zero conditions-list decisions with two conditioned edges under one label, direction matches the ruling.
2. mode: 'inclusive' — RIGHT. Sequential await inside the loop, never Promise.all; nested-not-interleaved pinned. Ruling item 2.
3. Registration door (validateDecisionModes) — RIGHT. Every decision in every graph parsed through DecisionConfigSchema.safeParse; refusal on mode-rooted issues only, schema sentence at node 'x' (decision) at config.mode; never armed. Acceptance 5857171841.
4. os validate — RIGHT. flow-decision-mode-invalid (gating) and flow-decision-inclusive-overlap (advisory) at lint-flow-patterns.ts:242,250, emitted at :927,955, barrel-exported at lint/src/index.ts:844-845. Ruling item 4.
5. D2 conversion flow-decision-mode-inclusive-explicit — RIGHT. conversions/registry.ts:11869-11873: toMajor: 18, retiredFromLoadPath: true; DECISION_MODE_INCLUSIVE_MIN_CONDITIONED_EDGES = 2 (:12006); wired at :12208 and in step 18's conversionIds. No alias, no window, no inference over CEL; same PR as the semantics. Ruling item 3.
6. D3 entry 18.flow-decision-edge-branching-first-match.ts + generated block (migrations/registry.ts:10500) — RIGHT. Names the D2 id as a whole word; reason and acceptanceCriteria carry ruling C (BREAKING for stored rows, no rewrite / cutoff / read-path completion, the one-line fix, the --stored listing under decisionModeReview, the house --from 17 sentence). The ruling-retired phrasing ("judgment owed", "rewritten by nothing", "half no command reaches") has 0 hits at the head across packages, content, .changeset, docs.
7. Replay sites of the flip id — each RIGHT. Authored sources via applyMetaMigrations(stack, 17, 18): replays, pinned both ways. Authoring funnel: refused by retiredFromLoadPath. Engine rehydration seam: CONVERSIONS_NOT_REPLAYED_AT_REHYDRATION = ['flow-decision-mode-inclusive-explicit'] (engine.ts:2153-2155) fed as excludeConversionIds beside includeRetired: true (:4123-4124). Artifact door: DEFAULT_FLIPS_NOT_REPLAYED_HERE lists it beside app-hidden-to-unpublished with its reason (artifact-forward-conversion.ts:290,310-312), fed at :361. Stored pass: listing only, through the entry's own apply by id (protocol.ts:16944, stored-migration.ts:288). Enumeration still closed: includeRetired: true outside tests occurs at exactly the three known sites (artifact door :360, engine seam :4123, spec/conversions/stored.ts:104).
8. Report widening (@objectstack/metadata-protocol) — RIGHT. StoredDecisionModeReview (stored-migration.ts:168, exported at index.ts:162), required decisionModeReview (:211), initialised [] at protocol.ts:16826, filled at :16944; renderer prints the section with the fix; CLI and REST carry the object unchanged, meta.ts untouched (the SDK's meta.migrateStored is deliberately unbound, ruling 2C).
9. Prose — RIGHT, with the one residue. Module header, mode describe/docblock, flows.mdx, cli.mdx, logic-nodes.ts, the engine.ts traversal comment (now true), regenerated reference mdx — all byte-identical to the reviewed head. Residue at schemaless-node-config.zod.ts:451 unchanged (③).
10. Pin rewrite — RIGHT. decision-overlapping-edge-conditions.pin.test.ts is the contract pin per its own header, ruling-C pair included; byte-identical. Ruling item 5.
11. examples/** not rewritten — RIGHT. Chain-only conversion; the four in-tree positives partition.

② Semver level

.changeset/15429-decision-edge-branching-first-match.md is among the 20 byte-identical files, re-read at the head: @objectstack/spec minor · @objectstack/service-automation minor · @objectstack/lint minor · @objectstack/metadata-protocol minor · @objectstack/metadata-core patch; feat(automation)!: title; the adr-0087 registered flow-decision-mode-inclusive-explicit disposition marker in the gate's comment form; Clause-②: yes (the PR body carries the same line); BREAKING banner with the before/after table, the FROM → TO block, and the stored-row BREAKING section naming the shape, the one-line fix and the --stored listing. Check Changeset success on this head (08:15:14Z).

• spec minor — right. The D2 conversion and D3 entry enter the protocol-18 chain and the describe/docblock text; nothing published narrows (npm latest 17.4.0 declares conditions only; mode and its refinement are unconsumed, so mode ships with the traversal that reads it and the conversion that writes it).
• service-automation minor with BREAKING banner — right. Run-time semantics flip on a shipped node type plus a new registration refusal, in the house launch-window form (check-changeset-no-major, green on the head).
• lint minor — right. Two new exported rule ids; the gating one refuses only a mode that never shipped.
• metadata-protocol minor — right. A published report type gains a required field and a type is exported; no external constructor.
• metadata-core patch — right. One array entry refusing an id new in the same release.
• Clause-②: yes — right. New keys/entries on published payloads (D2/D3 entries, the two rule ids, decisionModeReview); nothing narrows; the level axis is met by spec minor.
• The merge added nothing this PR publishes: main's action-aria-removed / action-aria-retired entries are feat(spec)!: retire action.aria — no action renderer ever applied it (ADR-0049) #20398's, carried by its own already-merged changeset. The two newer main changesets ([finding] An RLS predicate comparing two fields of different comparison classes (text vs number, text vs image) passes os validate; on driver-sql the using read answers 400 while the check insert is admitted and stored #20347, metadata forms: one row each for object.access, object.highlightFields, object.requiredPermissions, object.searchableFields and permission.adminScope (#19332 flight G1a) #20349) are independent files.

③ Boundary flags

Dev flags, each answered:

• Landing-lap report 5866729342 — deviations: (1) "No regeneration commit: the chain was a no-op, the head is the merge commit" — verified: 0c4dad2a has parents 18cbf4e2 and dcd3bcea, nothing follows it on the branch, and check:generated is green in CI on this head. One consequence: the merge commit message's closing line ("generated regions are regenerated in the next commit") is stale — commit-message prose, nothing published, non-blocking. open_questions: none.
• Blocked report 5865931103 — one deviation (the conflicted merge aborted and the worktree removed; no pushed history changed — 18cbf4e2 is this head's first parent, no force-push) and one open_questions entry (resolution A / B / C) — answered B by the seat in 5865957805; ① shows the head executes B exactly and nowhere else.
• Ruling-C round report 5865679628 — seven deviations, each answered in 5865889450; every file those answers rest on is byte-identical at this head, so they carry. Deviation 7 (origin/main moved after the merge) is overtaken: 0d7ed5a3, ab6fb027, 2f122b6e, 681868ca, df3ba164 and dcd3bcea are all ancestors of this head.
• Carried note 1 — non-blocking, footing unchanged. packages/spec/src/automation/schemaless-node-config.zod.ts:451 still opens the DecisionConfigSchema docblock with "declared ahead of the engine change that will read it"; the file's blob is identical to 18cbf4e2, the line reaches no generated artifact, and the head's own next section contradicts it. Source-only residue for a later prose pass.
• Carried note 2 — non-blocking, footing unchanged. The D3 text "nothing else about conditions-list decisions changes" while the traversal flag keys on node type: engine.ts and the D3 entry are byte-identical to the reviewed head; the corpus has zero such nodes; the direction matches the ruling.
• New note from this round — non-blocking. The doubled "Finally" in step 18's rationale (①(b)): seat-accepted under resolution B, carried to the next PR that touches that string.

origin/main at 7db1332f, two commits past dcd3bcea: 2c310705 (#20403 — refuse a cross-class RLS / sharing-rule field comparison at authoring: packages/lint/src/validate-rls-predicate-enforceability.ts, validate-sharing-rule-enforceability.ts, packages/spec/src/data/filter-cross-field-comparison-class.ts, data/index.ts, api-surface/data.json, export-origins/data.json, cli / driver-sql tests, its changeset) and 7db1332f (#20405 — metadata-form rows: spec/src/data/object.form.ts, security/permission.form.ts, platform-objects generated translations and tests, its changeset). Path intersection with this PR's 22 files: empty. Neither touches flows, decision config, either registry, service-automation, metadata-protocol or metadata-core; this head imports nothing from them and they read nothing this head adds. In meaning they are orthogonal (an authoring-time comparison-class refusal; form rows) to decision traversal. git merge-tree --write-tree origin/main 0c4dad2a → clean tree 4745098a, exit 0, no conflict entries. Nothing in this head depends on those two commits, and nothing conflicts with them in meaning; the next landing lap is a pure merge.

Ruling coverage: 5793803317 items 1–5 and 5863827385's execution parameters and three pins — carried from 5865889450 on unchanged bytes; the retired sentences have 0 hits at the head; docs/adr/** untouched; objectui#10750 proceeds on its own card and nothing in the 22 paths reaches objectui. No governed surface among the 22 paths (Governed Surface Queue Guard success); the claim 5864486967 names this branch (The card this PR closes must claim this branch success).

Escalations: none.

Implemented-by: claude/issue-15429-decision-first-match
Reviewed-by: session_01ARcDurZ5j34RdqsGgc4jgH

VERDICT: PASS

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: b30325bb385e5b4da8e31538ea7931550ec1cd56
Local-runs: none

① Derived judgments

Inputs read in full: card #15429 (body + all 30 comments — rulings 5793803317 and 5863827385, resolution B 5865957805, its re-application 5867190364, the ACCEPT 5866992766, reports 5865679628 / 5865931103 / 5866729342 / 5867993849, the two earlier records 5865889450 / 5866970574), PR #20344 body (Fixes #15429, Clause-②: yes, no longer draft, mergeable: true, mergeable_state: clean, base sha 40b315b0) and its 22-file list, the net diff against main at 40b315b0 (the PR's base and the head's second parent, so two-dot equals three-dot: 22 files, +2157 / −205, path-for-path and count-for-count equal to the file list), and the check-runs on this head: 35 — 33 success · 2 skipped (Console Pin Gate, Packed-tarball smoke (opt-in), both named on scripts/pm/check-expected-skips.mjs's roster) · 0 failure · 0 in progress; latest completion 09:57:02Z. Check Changeset, Lint & Repo Gates, Spec property liveness, Governed Surface Queue Guard, Flag docs affected by code changes, every Type Check and Test Core shard, both Dogfood gates, Temporal Conformance, and the four PR-shape guards (part-of, claim, single-writer path, same-issue) all success.

The merge resolution, judged first (head = merge commit, parents 0c4dad2a and 40b315b0; no regeneration commit followed — origin/claude/issue-15429-decision-first-match IS b30325bb):

• (a) main's side — RIGHT. git diff 40b315b0 b30325bb -- packages/spec/src/migrations/registry.ts packages/spec/src/conversions/registry.ts (424 lines) contains only this PR's additions: in conversions/registry.ts one import (FLOW_REGION_SLOTS_BY_TYPE), the D2 block with its helpers, and flowDecisionModeInclusiveExplicit, at :12286 after main's actionAriaRemoved, (:12285); in migrations/registry.ts the conversionIds entry at :5523 after 'action-aria-removed' (:5522), the D3 block at :10580, and ONE touched main line — the closing literal '`intervalSeconds`.', became '`intervalSeconds`. ' at :5463 so the concatenation continues. Nothing of main's is dropped, reordered or reworded. Stronger than the two-file diff: git's own merge, git merge-tree --write-tree 0c4dad2a 40b315b0, conflicts on exactly one region (the step-18 rationale), and git diff of that conflict tree against b30325bb shows only that region resolved — main's text kept whole, this PR's sentence placed after it, the separator. No other byte differs between the mechanical merge and the hand-resolved head.
• (b) this PR's side — RIGHT. Every one of its 294 + 79 added lines is present (numstat identical, below), the appended rationale sentence is verbatim (the conflict-tree diff moves the identical 12-line block, no word changes), and feat(spec)!: retire the connector resilience family — health (probe + breaker), status and nested webhooks, sixteen keys nothing read (#20273) #20350's entries sit exactly as on main because (a) found no difference from main in those regions: connectorResilienceKeysRemoved defined at conversions/registry.ts:9559 and listed at :12268; 'connector-resilience-keys-removed' at migrations/registry.ts:5505; the D3 connector-resilience-keys-retired at :7348. Order at the head: CONVERSIONS_BY_MAJOR[18] ends permissionRlsTagsRemoved, actionAriaRemoved, flowDecisionModeInclusiveExplicit; step 18 conversionIds ends 'permission-rls-tags-removed', 'action-aria-removed', 'flow-decision-mode-inclusive-explicit' — resolution B's landing order, main first.
• (c) the resolved step-18 rationale — one true sentence sequence. At migrations/registry.ts:5433-5475: main's "Finally, it removes aria from the action … action-aria-retired. " → feat(spec)!: retire the connector resilience family — health (probe + breaker), status and nested webhooks, sixteen keys nothing read (#20273) #20350's "It also retires the connector resilience family … intervalSeconds. " → this PR's "Finally it makes edge-branched decision nodes EXCLUSIVE … the one-line fix where a node meant every branch." Each sentence is true on this head. The two "Finally" openers are no longer consecutive — feat(spec)!: retire the connector resilience family — health (probe + breaker), status and nested webhooks, sixteen keys nothing read (#20273) #20350's sentence now sits between them — so the cosmetic seam 5866970574 noted is softer, not gone (the paragraph carries 18 "Finally" openers in all; this PR's is the last). Non-blocking; restated in ③.
• (d) no other file moved — RIGHT. The 20 non-registry files have byte-identical blobs at 0c4dad2a and b30325bb (blob ids compared one by one, 20/20 equal). git diff --numstat dcd3bcea...0c4dad2a and git diff --numstat 40b315b0...b30325bb are identical for all 22 files (diff of the two lists empty; +2157 / −205 both). git diff --name-only 40b315b0 b30325bb is exactly the 22; the other 86 paths main moved between dcd3bcea and 40b315b0 (feat(spec)!: retire the connector resilience family — health (probe + breaker), status and nested webhooks, sixteen keys nothing read (#20273) #20350, [finding] An RLS predicate comparing two fields of different comparison classes (text vs number, text vs image) passes os validate; on driver-sql the using read answers 400 while the check insert is admitted and stored #20347, metadata forms: one row each for object.access, object.highlightFields, object.requiredPermissions, object.searchableFields and permission.adminScope (#19332 flight G1a) #20349, plugin-auth: under the open audience posture, honour an explicit requireEmailVerification: false (email_domain stays forced) #20389, docs(skills): platform skill describes the blank starter as shipped — requires automation+triggers, seven barrels via exportsOf #20410 …) intersect this PR's 22 nowhere but the two registries. check:generated rides in Lint & Repo Gates, success on this head, so the regeneration chain's no-op is CI-confirmed, not only reported.

Every accept-set and public-surface change, re-rendered on this head. The 20 non-registry files are byte-identical to 0c4dad2a and the registry additions are line-identical, so each judgment below is carried from 5866970574 on confirmed-unchanged bytes, re-read against the diff at this head and re-anchored to this head's lines:

1. Traversal (engine.ts traverseNext) — RIGHT. :239 decisionTakesEveryBranch returns config?.mode === 'inclusive'; :10382 exclusive = node.type === 'decision' && !decisionTakesEveryBranch(node); once a conditioned out-edge holds, every later sibling is passed over unevaluated and recordSkipped (:10331, called at :10388) writes the closed-gate skipped step with skippedBy naming gate and edge; anyConditionMet still gates isDefault; the unconditional Promise.all bucket and non-decision nodes untouched; declaration order = flow.edges order (filtered in place; parse and conversions copy-on-write). Ruling item 1. Scope note unchanged: the flag keys on node type, the corpus holds zero conditions-list decisions with two conditioned edges under one label, direction matches the ruling.
2. mode: 'inclusive' — RIGHT. Sequential await inside the loop, never Promise.all; nested-not-interleaved pinned with the fan-out as positive control. Ruling item 2.
3. Registration door (validateDecisionModes, engine.ts:9298-9355, called at :4185) — RIGHT. Every decision in every graph (collectFlowGraphs, regions prefixed) parsed through DecisionConfigSchema.safeParse; refusal on mode-rooted issues only, with the schema's own sentence at node 'x' (decision) at config.mode; hard-fail, never armed (getFlow null pinned). Acceptance 5857171841. Judging mode alone is a declared, reasoned scope.
4. os validate — RIGHT. flow-decision-mode-invalid (lint-flow-patterns.ts:242, severity error, finding IS the schema issue message, hint names registerFlow) and flow-decision-inclusive-overlap (:250, advisory; two or more conditioned non-fault out-edges; one edge plus default excluded), barrel-exported at lint/src/index.ts:844-845, region-reaching, no double report with flow-decision-unconditional-branch. Ruling item 4.
5. D2 conversion flow-decision-mode-inclusive-explicit — RIGHT. conversions/registry.ts:11944-11945: toMajor: 18, retiredFromLoadPath: true; predicate = decision with no non-empty conditions, no mode key, at least DECISION_MODE_INCLUSIVE_MIN_CONDITIONED_EDGES = 2 (:12081) conditioned non-fault out-edges (string or {dialect, source} envelope; blank = none); regions via FLOW_REGION_SLOTS_BY_TYPE with a depth ceiling; copy-on-write; one notice per write; fixture pair with 2 notices; wired at :12286 and migrations/registry.ts:5523. No alias, no window, no inference over CEL; same PR as the semantics. Ruling item 3.
6. D3 entry 18.flow-decision-edge-branching-first-match.ts + generated block (migrations/registry.ts:10580) — RIGHT. Names the D2 id as a whole word; reason and acceptanceCriteria carry ruling C (BREAKING for stored rows, no rewrite / cutoff / read-path completion, the one-line fix, the --stored listing under decisionModeReview, the house --from 17 sentence); step 18's rationale carries the sentence (①(c)). The ruling-retired phrasing ("judgment owed", "judgment still owed", "rewritten by nothing", "half no command reaches") has 0 hits at the head across packages, content, .changeset, docs.
7. Replay sites of the flip id — each RIGHT, enumeration re-closed on the merged tree. Authored sources via applyMetaMigrations(stack, 17, 18): replays, pinned both ways. Authoring funnel normalizeStackInput: refused by retiredFromLoadPath, pinned. Engine rehydration seam: CONVERSIONS_NOT_REPLAYED_AT_REHYDRATION = ['flow-decision-mode-inclusive-explicit'] (engine.ts:2153) fed as excludeConversionIds (:4124) beside includeRetired: true (:4123). Artifact door: DEFAULT_FLIPS_NOT_REPLAYED_HERE (artifact-forward-conversion.ts:310-312) lists it beside app-hidden-to-unpublished, fed at :361 beside includeRetired: true (:360); four-leg pin. Stored pass: listing only, through the entry's own apply by id (stored-migration.ts:288, protocol.ts:16944). includeRetired: true outside tests at this head occurs in exactly three source sites — the artifact door :360, the engine seam :4123, and spec/conversions/stored.ts:104 (the item primitive, which flow rows never reach) — the remaining hits are CHANGELOG prose and a types.ts docblock. feat(spec)!: retire the connector resilience family — health (probe + breaker), status and nested webhooks, sixteen keys nothing read (#20273) #20350's merge (connector zod, liveness ledgers, plugin-auth, connector packages) opened no fourth seam.
8. Report widening (@objectstack/metadata-protocol) — RIGHT. StoredDecisionModeReview (stored-migration.ts:168, exported index.ts:162), required decisionModeReview (:211), initialised [] at protocol.ts:16826, filled at :16944-16945 read off the stored body before the canonicalizer and with no engine; formatStoredMigrationReport prints the section with the fix only when non-empty; describeScope widened to a Pick; storedMigrationClean unmoved; CLI and REST carry the object unchanged, meta.ts untouched (SDK meta.migrateStored deliberately unbound, ruling 2C).
9. Prose — RIGHT, with the one residue. Module header, mode describe/docblock ("Where mode is honoured"), flows.mdx (exclusive/inclusive paragraphs, the upgrade callout, the stored-flow BREAKING callout), cli.mdx --stored paragraph, logic-nodes.ts, the engine.ts traversal comment (now true), regenerated reference mdx — all byte-identical to the reviewed head. Residue at schemaless-node-config.zod.ts:451 ("declared ahead of the engine change that will read it") confirmed present at this head, source-only (③).
10. Pin rewrite — RIGHT. decision-overlapping-edge-conditions.pin.test.ts is the contract pin per its own header (22 tests, ruling-C pair included); byte-identical. Ruling item 5.
11. examples/** not rewritten — RIGHT. Chain-only conversion; the four in-tree positives partition.
12. What the merge brought and does not publish here. feat(spec)!: retire the connector resilience family — health (probe + breaker), status and nested webhooks, sixteen keys nothing read (#20273) #20350's retirement of connector.health / status / nested webhooks is orthogonal to flows and decisions; nothing in this PR's 22 files reads those keys, and its own added lines reference none of feat(spec)!: retire the connector resilience family — health (probe + breaker), status and nested webhooks, sixteen keys nothing read (#20273) #20350's symbols. Judged: no new accept-set change enters through the merge.

② Semver level

.changeset/15429-decision-edge-branching-first-match.md is among the 20 byte-identical files, re-read at the head: @objectstack/spec minor · @objectstack/service-automation minor · @objectstack/lint minor · @objectstack/metadata-protocol minor · @objectstack/metadata-core patch; feat(automation)!: title; the adr-0087 registered flow-decision-mode-inclusive-explicit disposition marker in the gate's comment form; Clause-②: yes (the PR body carries the same line, alone); BREAKING banner with the before/after table, the FROM → TO block, and the stored-row BREAKING section naming the shape, the one-line fix and the --stored listing. Check Changeset success on this head.

• spec minor — right. The D2 conversion and D3 entry enter the protocol-18 chain and the describe/docblock text; nothing published narrows. Premise re-checked at this head: PROTOCOL_VERSION is still 17.0.0, and .changeset/19867-decision-config-mode.md and .changeset/20168-decision-mode-beside-conditions-refused.md are still unconsumed in the tree, so mode ships with the traversal that reads it and the conversion that writes it.
• service-automation minor with BREAKING banner — right. Run-time semantics flip on a shipped node type plus a new registration refusal, in the house launch-window form (check-changeset-no-major, green on the head).
• lint minor — right. Two new exported rule ids; the gating one refuses only a mode that never shipped.
• metadata-protocol minor — right. A published report type gains a required field and a type is exported; no external constructor (workspace type-check green).
• metadata-core patch — right. One array entry refusing an id new in the same release.
• Clause-②: yes — right. New keys/entries on published payloads (D2/D3 entries, the two rule ids, decisionModeReview); nothing narrows; the level axis is met by spec minor.
• The merge added nothing this PR publishes: feat(spec)!: retire the connector resilience family — health (probe + breaker), status and nested webhooks, sixteen keys nothing read (#20273) #20350's .changeset/20273-connector-resilience-keys-retired.md and the other three new main changesets are independent files already on main.

③ Boundary flags

Dev flags, each answered:

• Landing-lap 2 report 5867993849 — deviations: (1) "No regeneration commit: the chain was a no-op, the head is the merge commit" — verified: b30325bb has parents 0c4dad2a and 40b315b0, nothing follows it on the branch, check:generated is green in CI on this head. Its numstat (identical before/after), id_presence (each of the three ids once per registry; main's whole registries present) and resolved_hunks claims each re-derived above (①(a)–(d)) and hold. open_questions: none.
• Seat note 5867190364 and resolution B 5865957805 — the head executes B exactly: main's text kept whole (the action-aria sentence, then feat(spec)!: retire the connector resilience family — health (probe + breaker), status and nested webhooks, sixteen keys nothing read (#20273) #20350's connector-resilience sentence), this PR's sentence appended verbatim, one separator at the seam, nowhere else hand-edited. The merge commit's own message describes this lap accurately.
• Earlier laps' flags (5866729342's one deviation, 5865931103's aborted-merge deviation and its A/B/C question answered B, 5865679628's seven deviations) — carried from 5866970574; every file those answers rest on is byte-identical at this head. One footnote moves: the stale line "generated regions are regenerated in the next commit" lives in 0c4dad2a's commit message, now this head's first parent; commit prose only, nothing published, non-blocking.
• Carried note 1 — non-blocking, footing unchanged. packages/spec/src/automation/schemaless-node-config.zod.ts:451 still opens the DecisionConfigSchema docblock with "declared ahead of the engine change that will read it"; the blob is identical to 18cbf4e2 / 0c4dad2a, the line reaches no generated artifact, and the head's own next section contradicts it. Source-only residue for a later prose pass.
• Carried note 2 — non-blocking, footing unchanged. The D3 text "nothing else about conditions-list decisions changes" while the traversal flag keys on node type: engine.ts and the D3 entry are byte-identical; the corpus has zero such nodes; the direction matches the ruling.
• Carried note 3 — non-blocking, footing eased. The doubled "Finally" in step 18's rationale: after this merge the two openers are separated by feat(spec)!: retire the connector resilience family — health (probe + breaker), status and nested webhooks, sixteen keys nothing read (#20273) #20350's "It also retires…" sentence, so they no longer read consecutively; two "Finally" sentences remain in one paragraph, seat-accepted under resolution B, carried to the next PR that touches that string. Rewording main's opener would have breached B.
• Carried note 4 — non-blocking. Stale merge-commit prose: see the earlier-laps bullet; b30325bb's message is accurate.
• New notes from this round: none.

origin/main at 50e273fd (#20407, service-analytics), one commit past 40b315b0: it touches .changeset/20381-adhoc-cube-request-scope.md, packages/services/service-analytics/src/analytics-service.ts, its __tests__/adhoc-query-request-scope.test.ts and packages/qa/dogfood/test/analytics-adhoc-query-isolation.dogfood.test.ts — the ad-hoc query and sql doors' cube scope and inferred-cube publication. Path intersection with this PR's 22 files: empty. This PR's added lines mention none of its symbols (0 hits for service-analytics, AnalyticsService, requestScope, CubeScope, ensureCube, publishInferredCube in the diff's + lines; the "analytics" tokens present in the big registries and protocol.ts are pre-existing text with identical counts on 40b315b0). In meaning it is orthogonal (analytics request scoping) to decision traversal, migrations, lint and the stored-migration report; neither side imports or reads the other. git merge-tree --write-tree origin/main b30325bb → clean tree 033f0920, exit 0, no conflict entries; GitHub reports mergeable_state: clean. Nothing in this head depends on 50e273fd, and nothing conflicts with it in meaning; the queue can take this head as it stands.

Ruling coverage: 5793803317 items 1–5 and 5863827385's execution parameters and three pins — carried from 5866970574 on unchanged bytes and re-read at this head (stored no-mode overlapping decision runs first-match; --stored lists it and changes nothing; a --from 17 source carries explicit mode: 'inclusive' and takes every branch); the retired sentences have 0 hits; docs/adr/** untouched; objectui#10750 proceeds on its own card and nothing in the 22 paths reaches objectui. No governed surface among the 22 paths (Governed Surface Queue Guard success); claim 5864486967 names this branch (The card this PR closes must claim this branch success); no other open PR claims the issue or a single-writer path (both guards success).

Escalations: none.

Implemented-by: claude/issue-15429-decision-first-match
Reviewed-by: session_01ARcDurZ5j34RdqsGgc4jgH

VERDICT: PASS