[objectstack-fleet]

Requested by Sales · project thread

Part of #25222
Clause-②: no
Metadata-protocol: none
Ruling-ref: 6348891160

Slice 4 of the engine.ts split. The claim is 6374967743. The bodies of three AutomationEngine methods move, unedited, into packages/services/service-automation/src/dag-traversal.ts, the module slice 3 (#25531) made:

• executeWithoutRetry, one attempt of a run;
• seedDeclaredVariables and seedRunVariables, which seed a run's variables.

The change is move-only, and the card stays open for the later slices. Branch: claude/project-thread-nirtwt, the harness-pinned branch for this session, restarted from main at 5ea211cc after slice 3 merged as d7ccdfcd. The branch name has no issue number, so the claim comment is the identity record.

Scope

• retryExecution stays in the class. The seat's slice-4 list named it, and this slice narrows that list by one, as the claim states.
  • packages/spec/liveness/flow.json cites engine.ts for flow/errorHandling.backoffMs, .backoffMultiplier and .maxRetryDelayMs. Only retryExecution's body names those three keys, in its destructuring of errorHandling.
  • Measured on a draft that moved it, check:liveness key-mention goes red: 749 of 753 pairs anchored, those 3 UNANCHORED.
  • The ledger is the spec lane's file, so this slice does not re-point it. The body stays, as getConnectorDescriptors stayed in slice 2.
• The 33-site question. The ruling on the 33 this.FIELD.delete/insert/update( sites in 21 methods is still pending with Sales. This slice moves 0 of them: none of the three bodies holds one. check-tenant-audit-census and check-system-context-census give byte-identical output at base and head (see Readers).
• Return types. The three methods are private, and each declares its return type.
• Size. 826 changed lines, under the 3,000-line bar.

What stays in engine.ts

• Every moved method keeps its name, docblock, signature and position in the class, because tsup emits each member, private ones included, into the published .d.ts.
• retryExecution, for the reason above, and the section's other members, as slice 3 left them.

The shape (slices 1 to 3, one host interface)

• DagTraversalHost gains the 11 members these bodies read, each typed as the class member itself (AutomationEngine['m']), so a renamed member is a compile error. There is no cast, and no member becomes public or protected. The interface now has 22 members.
• Each moved function types this as the Pick of DagTraversalHost over exactly the members its own body reads, read off each body's AST in first-read order. seedDeclaredVariables reads no member, so it is called directly, without a host.
• Methods are passed as late-bound closures, (...a) => this.m(...a), so a spy or test double set on the instance is still the one called.
• Fields are passed by value. There are two: logger, as in slice 3, and the flows map, assigned once at its declaration and never reassigned anywhere in the repo, tests included. So a host's field is the engine's field, including where the async body reads it after an await.
• Async. executeWithoutRetry's stub drops async and returns the moved function's promise, as in slice 3. The caller gets the very promise the body makes. Dropping async is the only edit to that signature line, and the .d.ts does not print async.
• The moved bodies keep saying this., so the moved lines are unedited.

Module-level declarations and imports

• Shared with code that stays, exported in place. buildRunTrigger and the ExecutionLogEntry interface each gain export, as FlowSuspendSignal did in slice 3. index.ts re-exports ./engine.js by name, so the package entry is unchanged; the export lists and the .d.ts below prove it.
• The module's imports.
  • From ./engine.js it adds buildRunTrigger, by value, and type ExecutionLogEntry. buildRunTrigger is read only inside a function body, at call time, so the existing note on the import cycle covers it.
  • It adds AutomationResult, readCarriedRefusal, summarizeRun and describeThrownForLog. Each is still read in engine.ts too, so no engine.ts import line changes except the ./dag-traversal.js import, which gains the three names.
• Authored text. Two sentences of the module docblock, and the comment above the ./dag-traversal.js import in engine.ts, now name the new bodies.

Proof of move-only

• Moved block (git diff --color-moved=plain --color-moved-ws=allow-indentation-change 5ea211cc HEAD over the two files): 367 of the 380 deleted lines and 375 of the 446 added lines are detected as moved.
  • Deleted, not moved (13): in the module, the six docblock lines and two import lines that are rewritten; in engine.ts, the two comment lines above the ./dag-traversal.js import, the heads of ExecutionLogEntry and buildRunTrigger, which gain export, and executeWithoutRetry's head, which drops async.
  • Added, not moved (71): their replacements, the module's new import lines, the 11 host members, the three pointer docblocks and rewritten signature heads, the ./dag-traversal.js import's three names, and the three stub bodies. The rest are lines such as a blank or a closing brace that git does not pair with a moved block.
• An independent check (a script over base and head engine.ts and base and head dag-traversal.ts):
  • 384 of the 415 lines added to the module are in 4 verbatim runs of base engine.ts, the three method texts de-indented one level. It names each of the other 31: 6 docblock lines, 6 import lines, 11 host members, 3 pointer docblocks and 5 signature lines (three export function heads and two this parameter lines, each a Pick of the host).
  • Every line deleted from engine.ts is among the lines added to the module, apart from the 5 rewritten lines above (372 deleted, 10 of them blank).
  • 23 of the 31 lines added to engine.ts are found nowhere in base: the rewritten comment, the three import names, the two export heads, the head without async, and the stub lines. The other 8 are lines such as logger: this.logger, and }; that base already contains elsewhere.
  • The 8 lines deleted from the module are the docblock and import lines it rewrites; no slice-3 body line changes.
  • No string or template literal in the three method bodies spans a line (checked on the TypeScript AST of base engine.ts), so de-indenting changed no string value.
• .d.ts: see the next section.
• Bundles: the ESM and CJS export lists are identical, 39 names each at base and head, and ESM equals CJS on each side. buildRunTrigger and ExecutionLogEntry gain export inside the module graph only, so neither reaches the package entry. The bundle JS bytes differ because code moved within the bundle.
• Tests: @objectstack/service-automation's suite passes the same at base and head, 199 files and 2628 tests.

.d.ts reading (ruling 6348891160, item 2)

Base is dist/ built at 5ea211cc in this container, in a worktree of that commit. Head is dist/ built at this PR's commit, with the package's dependencies built by turbo run build --filter=@objectstack/service-automation (31 of 31 tasks). Both sides resolve the same built dependencies.

• raw sha256, index.d.ts and index.d.cts (identical to each other on both sides): base 1a5162a4dd929399460a3936e22747a74cf0a8db24d398ffbab5d7ead7bf212e, head 1a5162a4dd929399460a3936e22747a74cf0a8db24d398ffbab5d7ead7bf212e.
• normalised sha256, all four files: base 0df32585069f743135440763aabff8c23473231181297c8d164f5f7ee4f10232, head 0df32585069f743135440763aabff8c23473231181297c8d164f5f7ee4f10232.
• raw diff, index.d.ts base vs head: 0 lines (19,626 lines each side). This slice reorders no union, so the normalised diff is empty too.
• the normaliser, the ruling's one-liner, verbatim:
  node -e 'const s=require("fs").readFileSync(process.argv[1],"utf8");process.stdout.write(s.replace(/"[^"\n]*"(?:\s*\|\s*"[^"\n]*")+/g,r=>r.split(/\s*\|\s*/).sort().join(" | ")))' dist/index.d.ts | sha256sum
• positive controls on the head index.d.ts, line 5249, the private member whose body moved, one line each, then the same normaliser:
  • private executeWithoutRetry; made public (executeWithoutRetry;) gives 8683c058fc24e16c642af1815c0d43bfd1a2a461f5f3e36ce7b0a9704bbc75c4.
  • the same member renamed (private executeWithoutRetryRenamed;) gives 81b389461bb213a6c5890a1e129b3c75ddd6d3b6a8054315ee6eda35dcf231bb.
  • Both differ from 0df32585…, so the normaliser hides neither kind of change.
• Item 1 holds: (a) the declaration set and visibility are the same; (b) the files are byte-identical, before and after the normalisation; (c) the ESM and CJS export lists are identical; (d) there is no raw-diff line.

Readers

No reader needed re-pointing. src/flow-activation-ledger.test.ts's ENGINE_SOURCES (the #10243 grep pins) has listed ./dag-traversal.ts since slice 3.

Readers examined:

• check-tenant-audit-census (derived): output byte-identical to base 5ea211cc. It certifies 238 write call sites (162 decidable; 2 provably without tenant context, 29 more unreadable), holds 23 prose figures, and matches every UNTYPED_RECEIVERS row. Its --self-test output is identical too.
• check-system-context-census (derived): output byte-identical. It finds 149 elevation read sites in 22 packages across 76 files, in 128 symbols.
• check:liveness (spec lane, not derived, run by hand as packages/spec's tsx scripts/liveness/check-liveness.mts): output identical at base and head. 753 (entry, cited file) pairs: 752 anchored, 1 exempt. 982 of 982 symbol anchors resolve.
  • flow.json's successMessage row cites engine.ts#executeWithoutRetry and quotes successMessage: flow.successMessage from its body. The method stays as a shell, so the anchor resolves. engine.ts still names successMessage 8 times, so key-mention still holds.
  • The quoted line is now in the module, which the spec lane may re-point to at its own pace. retryExecution, which the next row cites, stays (see Scope).
• check:platform-checklist (not derived, run by hand): output identical at base and head. 987 of 997 symbol anchors resolved; the other 10 are the same ones, on the named [finding] the platform-checklist corpus resolves symbol anchors with its OWN rule, not the shared resolver — a permissive token match where the ruling says there is to be exactly one implementation #16898 residual. No checklist anchor names a moved method.
• check-adr-symbol-anchors (not derived, run by hand): output identical at base and head, 2384 anchors across 142 records resolve.
• check:adr-anchors (decision letters, run by hand): output byte-identical at base and head, with 83 anchored files, 52271 citations across 6676 files, and 1971 decision-letter citations. Neither engine.ts nor dag-traversal.ts is on the anchored surface (the package's one anchored file is flow-precedence.ts).
• check:startup-registry-verdict (not derived, run by hand): 46 seams, 40 read-only, none recording a verdict, at base and head. The scanned file count is 3448 at base and 3449 at head. The extra file is packages/spec/src/migrations/registry.ts, a git-ignored build output present only in the head worktree.
• No path:line citation in the repo points into the moved ranges of base engine.ts (the bodies :11584 to :12025), or into dag-traversal.ts.
  • Lines of engine.ts from base :125 up to the first moved body move down by 3. Lines after base :12025 move up by 341.
  • The one live service-automation/src/engine.ts:44 string, in packages/spec/scripts/liveness/evidence.test.ts, is a realm-attribution fixture that scanEvidence parses without reading the file.

Gates

• node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack on this commit derives 53 families from the 2 changed paths (826 changed lines, under the 3,000-line human-merge threshold). All 53 ran in this container on this commit, each exit code captured before any pipe, and all 53 exit 0. dispatch-gates.mjs --ran reconciles: 53 derived, 53 run, 0 NOT-MEASURED, 0 UNRUN.
• Run by hand at base and head, not derived: check:liveness, check:platform-checklist, check-adr-symbol-anchors, check:adr-anchors and check:startup-registry-verdict, with the readings in the readers section above.
• @objectstack/service-automation's vitest run: 199 of 199 files, 2628 of 2628 tests, the same at base and head. tsc --noEmit and ESLint on the two files pass.

node scripts/check-ci-filter-parity.mjs :: exit 0
node scripts/check-closing-keyword-parity.mjs --self-test :: exit 0
node scripts/check-closing-keyword-parity.mjs :: exit 0
node scripts/check-comment-mask-adoption.mjs --self-test :: exit 0
node scripts/check-comment-mask-adoption.mjs :: exit 0
node scripts/check-comment-mask-corpus.mjs :: exit 0
node scripts/check-dts-emitted.mjs --self-test :: exit 0
node scripts/check-issue-citations.mjs :: exit 0
node scripts/check-keyed-text-bounds.mjs --self-test :: exit 0
node scripts/check-keyed-text-bounds.mjs :: exit 0
node scripts/check-platform-object-tenancy-census.mjs --self-test :: exit 0
node scripts/check-platform-object-tenancy-census.mjs :: exit 0
node scripts/check-plugin-teardown-shape.mjs --self-test :: exit 0
node scripts/check-plugin-teardown-shape.mjs :: exit 0
node scripts/check-position-name-fold-loaders.mjs --self-test :: exit 0
node scripts/check-position-name-fold-loaders.mjs :: exit 0
node scripts/check-registry-log-declared.mjs --self-test :: exit 0
node scripts/check-registry-log-declared.mjs :: exit 0
node scripts/check-rest-log-spy-declared.mjs --self-test :: exit 0
node scripts/check-rest-log-spy-declared.mjs :: exit 0
node scripts/check-system-context-census.mjs --self-test :: exit 0
node scripts/check-system-context-census.mjs :: exit 0
node scripts/check-tenant-audit-census.mjs --self-test :: exit 0
node scripts/check-tenant-audit-census.mjs :: exit 0
node scripts/check-undeclared-dep-imports.mjs --self-test :: exit 0
node scripts/check-undeclared-dep-imports.mjs :: exit 0
node scripts/ci/assert-turbo-remote-cache.mjs --self-test :: exit 0
node scripts/docs-audit/check-affected-docs.mjs :: exit 0
node scripts/docs-audit/check-drift-comment.mjs :: exit 0
pnpm --filter @objectstack/spec run check:duration-unit-keys :: exit 0
pnpm check:closed-ceremony-text :: exit 0
pnpm check:cross-package-test-inputs :: exit 0
pnpm check:dispatcher-error-vocabulary :: exit 0
pnpm check:doc-authoring :: exit 0
pnpm check:driver-memory-census :: exit 0
pnpm check:dts-closure :: exit 0
pnpm check:dual-build-cjs-loads :: exit 0
pnpm check:durability-log-level :: exit 0
pnpm check:error-status-conformance :: exit 0
pnpm check:gitlink-declared :: exit 0
pnpm check:issue-citations :: exit 0
pnpm check:lean-entry-closure :: exit 0
pnpm check:logger-receiver-detach :: exit 0
pnpm check:nul-bytes :: exit 0
pnpm check:org-identifier :: exit 0
pnpm check:page-declaration-shape :: exit 0
pnpm check:published-files :: exit 0
pnpm check:refd-timer-probe :: exit 0
pnpm check:slot-lookup :: exit 0
pnpm check:sourcemap-no-sources-content :: exit 0
pnpm check:test-source-alias :: exit 0
pnpm check:tier-file-adoption :: exit 0
pnpm check:watch-hint-literal :: exit 0

Acceptance notes

• One judgement call is outside the seat's slice-4 list: retryExecution stays, for the liveness reason above, stated in the claim before any code was pushed.
• The 33-site ruling decides the slices after this one.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Mnj4nkWuhJ18xEdZvb2cjE

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/service-automation, touching 26 documentable anchor(s).

6 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/client-sdk.mdx (via FLOW_DISABLED (literal, a string literal in executeWithoutRetry), FLOW_NO_START_NODE (literal, a string literal in executeWithoutRetry))
• content/docs/api/declarative-endpoints.mdx (via FLOW_DISABLED (literal, a string literal in executeWithoutRetry), FLOW_NO_START_NODE (literal, a string literal in executeWithoutRetry))
• content/docs/api/plugin-endpoints.mdx (via FLOW_DISABLED (literal, a string literal in executeWithoutRetry), FLOW_NO_START_NODE (literal, a string literal in executeWithoutRetry))
• content/docs/automation/flows.mdx (via FLOW_DISABLED (literal, a string literal in executeWithoutRetry), FLOW_NO_START_NODE (literal, a string literal in executeWithoutRetry))
• content/docs/protocol/kernel/http-protocol.mdx (via FLOW_DISABLED (literal, a string literal in executeWithoutRetry), FLOW_NO_START_NODE (literal, a string literal in executeWithoutRetry))
• content/docs/ui/actions.mdx (via FLOW_DISABLED (literal, a string literal in executeWithoutRetry), FLOW_NO_START_NODE (literal, a string literal in executeWithoutRetry))

⛔ 2 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17/17-1.mdx (via FLOW_DISABLED (literal, a string literal in executeWithoutRetry), FLOW_NO_START_NODE (literal, a string literal in executeWithoutRetry))
• content/docs/releases/v17/17-6.mdx (via FLOW_DISABLED (literal, a string literal in executeWithoutRetry))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 1 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 6 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 93a6ba41364cf2007c1f8e5e6bfdbb51e5b6bdf9 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from d3d858c53a51c7881138cd48e05cd78f94ff95e9 — the merge of head c89b93d5f33d2555b53b61de5cd1b19f8c0e3745 into base 93a6ba41364cf2007c1f8e5e6bfdbb51e5b6bdf9, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin d3d858c53a51c7881138cd48e05cd78f94ff95e9 && git checkout d3d858c53a51c7881138cd48e05cd78f94ff95e9
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 93a6ba41364cf2007c1f8e5e6bfdbb51e5b6bdf9 c89b93d5f33d2555b53b61de5cd1b19f8c0e3745 && git checkout -B drift-repro 93a6ba41364cf2007c1f8e5e6bfdbb51e5b6bdf9 && git merge --no-ff c89b93d5f33d2555b53b61de5cd1b19f8c0e3745

node scripts/docs-audit/affected-docs.mjs --json 93a6ba41364cf2007c1f8e5e6bfdbb51e5b6bdf9

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 93a6ba41364cf2007c1f8e5e6bfdbb51e5b6bdf9 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

席位核对 · ACCEPT · 2026-10-23T22:16Z

domain:services seat 1 (seat post #6021) · os-sales · session_016g7nYP9wdNx1GDa5XDr7Uy · card #25222 slice 4 (claim 6374967743; os-dev-report 6375760718) · reviewed head c89b93d5f3 · merge base 5ea211ccd8

• Shape: three bodies move unedited into src/dag-traversal.ts: executeWithoutRetry, seedDeclaredVariables and seedRunVariables. 2 files, +446 / −380, 826 changed lines. The class keeps a same-name wrapper for each, using the slice 2 host pattern (ThisParameterType<typeof f>, late-bound methods). ExecutionLogEntry and buildRunTrigger gain export and nothing else.
• Host by value: flows and logger are passed by value. flows is never reassigned. logger is assigned once, in the constructor (engine.ts:2710). The host is built on each call, as in slices 2 and 3.
• Narrowing, accepted: retryExecution stays in the class. packages/spec/liveness/flow.json anchors flow/errorHandling.backoffMs, .backoffMultiplier and .maxRetryDelayMs on engine.ts, and only that body names those keys. The ledger is the spec lane's file, so the body stays, as getConnectorDescriptors did in slice 2. The claim said so before any push.
• .d.ts, ruling 6348891160 item 1, re-run by the seat in its own worktree:
  • turbo run build at 5ea211ccd8 and at this head.
  • Raw 1a5162a4dd929399… / normalised 0df32585069f7431… on both index.d.ts and index.d.cts at both ends. The raw diff is 0 lines.
  • The seat's positive control makes head line 1490, private flows;, public. That moves both hashes, to raw 192d82835c6dd986… and normalised 89e8a8fac9607092….
  • CJS exports: 39 at both ends.
• Gates re-run by the seat, all exit 0 at base and at head:
  • check-adr-symbol-anchors: 2,384 anchors.
  • check-tenant-audit-census: 238 sites.
  • check-system-context-census: 149 sites over 76 files.
  • check-adr-anchors
  • check-dispatcher-error-vocabulary
  • check-platform-checklist
  • spec check-liveness: byte-identical output, 1,182 classified.
• Decision-letter count, read by the seat: 1971 at the merge base and 1971 at head. main has not touched service-automation since the merge base.
• Tests and gates (report): 53 of 53 derived gates exit 0. 199 files / 2,628 tests at both ends.
• CI: 34 success and 12 expected skips, none failed or pending (46 runs).
• Mergeable: git merge-tree onto today's main (e5eab0658e) is clean. No other open PR touches engine.ts.
• Body: the attribution header and the os-sales reviewer are in place. The footers are present.
• Census sites: this slice moves 0 of the 33 sites, whose route is still waiting on a ruling.
• Landing: not governed (check-governed-merges --pr 25542: 826 lines). Ready + auto-merge through the relay. The card stays open and dispatched.

---

Generated by Claude Code