[objectstack-fleet]

Requested by Steve · project thread
Fixes #29049

Clause-②: no (narrowing)
Metadata-protocol: none

维护者速读

• 改了什么：流程区域形状检查（ADR-0031，loop / parallel / try_catch 区域须单入口单出口、无环，parallel 至少两个分支）从 CLI 专用关卡搬进 @objectstack/lint 的作者期规则表，新规则 flow-region-shape-invalid，直接调用 spec 的 validateControlFlow；os lint 从此也拒收这类流程。
• 为什么改：此前只有 os validate / os build 拒收，os lint 照样放行；作者跑 lint 看到绿灯，部署后引擎注册时拒收该流程，触发器永不触发。
• 风险与回滚：os lint 收窄（BREAKING 横幅）；validate / build 的通过与拒收结论不变，只是错误改由规则表报出、--json 行的形状随之变化（该形状尚未发布）。回滚即还原本 PR。
• 先看：packages/lint/src/validate-flow-region-shape.ts（规则本体）、packages/lint/src/authoring-rules.ts 新条目、packages/cli/test/validate-flow-region-shape.test.ts（三命令同一夹具）。
• 两分钟验证：pnpm --filter @objectstack/cli exec vitest run --project unit test/validate-flow-region-shape.test.ts，预期 5/5 通过，其中三条用例对 validate、build、lint 同一夹具均退出 1 并给出同一规则 id。
• 需要你做的：无，席位落地（新规则 id 由席位在 ACCEPT 中裁定；两条待发 changeset 的句子被本 PR 改正，Check Changeset 按设计变红，由席位复核确认）。

What changes

• New authoring rule flow-region-shape-invalid (packages/lint/src/validate-flow-region-shape.ts; validateFlowRegionShape and FLOW_REGION_SHAPE_INVALID exported from the root barrel). Each flows[] record goes through the two calls the engine's registerFlow makes: FlowSchema, then validateControlFlow from @objectstack/spec/automation. No copy of the region logic. Message: Flow 'NAME' would be refused at registration: plus the engine's sentence, verbatim. Gating, input: 'parsed', all three commands.
• Fail-closed kept (fix(cli): the flow-region gate never passes a flow it could not judge, and the boot banner counts refused flows #29243). A flow record FlowSchema refuses is a finding ("could not be judged", with the schema's issues), never a skip. A non-record entry (null, a string) is skipped like every registry reader skips it (non-record-object-entry.test.ts reds otherwise); the flows after it keep their own index.
• Runtime publish gate: not wired (surfaces: CLI_ONLY, with a surfaceReason). Whether a metadata publish refuses a malformed region is sibling card metadata: a flow whose loop / parallel / try_catch region is malformed or cyclic reads valid as a draft and publishes, then the engine refuses to register it #29233 (domain:server); this PR does not decide it.
• CLI-only gate retired. packages/cli/src/utils/flow-region-shape.ts and its unit test are deleted; validate.ts step 3a-vi and compile.ts step 3b-iii-ter are reduced to a pointer comment. validate and build now get the check from the registry, so the defect is reported once (measured below).
• os explain flow-region-shape-invalid: new entry in rule-explanations.ts.
• Docs: the four CLI transcripts now print Running author-time rules (61) (recounted from the merged registry: validate 61, build 61).
• Changesets: new .changeset/29049-flow-region-shape-lint-rule.md (@objectstack/lint + @objectstack/cli patch, BREAKING banner, adr-0087: not-required (no-migration-prescription)).

Forced test edits

• packages/cli/test/authoring-rule-command-parity.test.ts: the flow region shape (#28893) row left OUTSIDE_THE_TABLE and is now a CASES row (rule: 'flow-region-shape-invalid', blindTo: ['lint']), as that table's docblock prescribed. OUTSIDE_THE_TABLE held only that row, so the table, its docblock and its it.each are removed (an empty it.each would register no test).
• packages/cli/test/validate-build-gate-parity.test.ts: the findFlowRegionRefusals row is removed from SHARED_NON_REGISTRY_GATES; neither command calls it now, and the ledger's own stale-row check requires that.
• packages/cli/test/validate-flow-region-shape.test.ts: still green, with three edits. (1) A refusal is now a rule finding (rule, where, path, message, hint), under errors for os validate --json and under issues for os build --json (the rule table's envelope), not the old gate's VALIDATION_ERROR row with flow. (2) The cli: harden the os validate/build flow-region gate (silent parse skip, vacuous blindness pin, untested packages[] subject) and count refused flows at boot #29059 assembled-artifact case located the row at packages[1].manifest.flows[0]; the rule table judges the artifact's folded union first (as it does every collection), so the finding is at flows[1] with where: flow 'rgn_ops_lead_time'. Still exactly one row, from the second package. (3) Each case now also runs os lint in process on the same fixture.
• packages/cli/src/utils/flow-region-shape.test.ts (deleted with its subject): its three cli: harden the os validate/build flow-region gate (silent parse skip, vacuous blindness pin, untested packages[] subject) and count refused flows at boot #29059 refused-parse cases moved to packages/lint/src/validate-flow-region-shape.test.ts. The packages[] location case has no rule-level counterpart (the rule reads the stack it is handed); its door-level half is the assembled case above.

Tests

One test per command on the same fixture: packages/cli/test/validate-flow-region-shape.test.ts runs os validate --json, os build --json and os lint --json in process on each of duly, nested, singleBranch and assembled; all three exit 1 with rule: flow-region-shape-invalid and the engine's sentence, build writes no dist/, and the joined control passes validate and build with no finding of the rule under lint. The validate leg also asserts the refusal appears exactly once (no echo from a second gate).

Readings on head 52b05b8e (after merging origin/main at 7b1ae338, closure rebuilt):

Consumer suites

• pnpm --filter @objectstack/lint test: Test Files 190 passed (190), Tests 7843 passed (7843); typecheck clean.
• pnpm --filter @objectstack/cli exec vitest run --project unit: Test Files 373 passed (373), Tests 5263 passed (5263) (includes validate-flow-region-shape, validate-build-gate-parity, explain-rule-id, the published-subpath-* pins after pnpm --filter @objectstack/cli build); typecheck clean.
• pnpm --filter @objectstack/cli exec vitest run --project integration test/authoring-rule-command-parity.test.ts: Tests 12 passed (12), including flow-region-shape-invalid gates on all three commands.
• pnpm --filter @objectstack/spec exec vitest run src/automation: Test Files 45 passed (45), Tests 1745 passed (1745).
• Rule count recounted from the merged registry's dist: validate 61, build 61 (lint 59), matching the four transcripts.

Ablation (one, on the line the tests pin)

Mutation: validateControlFlow(result.data); in packages/lint/src/validate-flow-region-shape.ts guarded behind an always-false globalThis.ABLATION_29049_MARKER read, via scripts/ablation-replace.mjs (anchor 1 -> 0, blob 46bdaf4b -> changed), lint rebuilt, ablation-dist-preflight found the marker in 4 dist files.

• lint validate-flow-region-shape.test.ts: 4 failed, 3 passed (red as expected; the 3 green are the refused-parse and control cases, which do not reach the call).
• cli validate-flow-region-shape.test.ts: 4 failed, 1 passed: validate, build and lint all PASS the malformed flow with the rule disabled, which also proves no second gate refuses it any more (the retired walk is gone).
• cli authoring-rule-command-parity.test.ts: flow-region-shape-invalid gates on all three commands failed, 11 passed.
• Restore: blob back to 46bdaf4b == HEAD, git diff HEAD empty, lint rebuilt, preflight --absent clean on 20 files and a clean tree; both CLI files green again (5/5, 12/12).

A first attempt replaced the call with a bare expression; that build failed, so the marker never reached dist/ and its readings are discarded (not counted).

Measured out of scope

A flow whose top-level graph cycles (start -> a -> b -> a, b -> end) draws no finding; the same cycle inside a loop body draws loop 'L' body: ... region contains a cycle. So this rule does not cover #29051.

Acceptance notes

• os lint now also reports a flow record the flow schema refuses (the fail-closed finding). os validate and os build already refuse such a flow at their schema step, so no command accepts what it refused before beyond the region case; os lint reaches it because it never parses.
• Top-level graph cycles stay out of scope (automation: a flow with a top-level cycle passes os validate and build; detectCycles runs only at registration and has no author-time home #29051): the engine's detectCycles is not exported, and validateControlFlow checks cycles inside regions only. Measured: this rule does not cover the top-level cycle.
• The lane line in lanes/server.md reported in triage 6579387723 is not touched.

Verification

Gates on head 52b05b8e: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 92 commands; all 92 run and reconciled with --ran (92 derived famil(ies) accounted for — 88 run, 4 NOT-MEASURED).

Non-zero exits

• node scripts/check-empty-changeset.mjs --base origin/main exit 1, by design: this PR corrects two PENDING changesets whose sentences it makes false (DELIBERATE CORRECTION class). .changeset/28893-flow-region-shape-at-validate-build.md no longer says the doors call findFlowRegionRefusals and print a VALIDATION_ERROR row; it now names the rule flow-region-shape-invalid and that os lint reports it too. .changeset/29059-flow-region-gate-hardening.md now says the unjudgeable flow is refused with a flow-region-shape-invalid finding instead of a VALIDATION_ERROR row. Restoring them would republish false sentences; this needs confirming on the PR. Check Changeset is not a required context.
• NOT MEASURED (exit 3, prerequisite): check:dual-build-cjs-loads and check:skill-examples (packages outside this closure have no dist/, e.g. client-react), check:i18n-coverage (the showcase example needs an unbuilt connector dist/), check-plugin-teardown-shape --self-test (shallow clone cannot reach its pinned fixture commit). None reads a file this PR changes for its verdict; CI runs them on a full build.
• Offline: check-changeset-no-major --event exit 0 (LEVEL AXIS: no (narrowing) + none, patch); check-adr-0087-registration exit 0 (not-required (no-migration-prescription)).

Dogfood (required by the (narrowing) arm) on head 52b05b8e, pnpm --filter @objectstack/dogfood test under the lock after building @objectstack/dogfood^...: VERDICT command-exit 1 · Test Files 2 failed | 393 passed | 3 skipped (398) · Tests 4 failed | 3255 passed | 28 skipped (3287).

The 4 failures are not this PR's (control measured)

• test/flow-runas.dogfood.test.ts: runAs:'system' ELEVATES (trigger answers 404 RECORD_NOT_FOUND on runas_note), runAs:'user' DE-ELEVATES, runAs:'system' READS.
• test/declarative-endpoint-anonymous-guest.dogfood.test.ts: carries the guest position … (flowContexts length 0, expected 1).
• Re-run alone on this head: same 4 failed, 8 passed. Control: packages/lint/src, packages/cli/src and packages/cli/test restored to origin/main 7b1ae338 (this PR's diff removed from both packages), lint and cli rebuilt, the same two files: the same 4 failed, 8 passed. So they fail on main's code without this diff; reported to the seat as a main-red candidate. Tree restored to HEAD and rebuilt (clean git status).

---

Generated by Claude Code

[objectstack-fleet]

domain:spec#4 · os-steve · session_01ADHkmQNap7ryQcyQXocWct

Contract-review-claim: session_01ADHkmQNap7ryQcyQXocWct · head 52b05b8 · 2026-11-02T17:10Z

The lane seat reviews this head itself at CONTRACT_REVIEW_TIER (triage ruling 6575141496 on #28741 returned contract review to the lane): a new @objectstack/lint authoring rule narrows os lint to refuse a flow region the engine refuses to register, and the CLI-only gate it replaces is retired.

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/cli, @objectstack/lint, touching 17 documentable anchor(s). ⚠️ 1 changed file(s) yielded no anchor (packages/lint/src/index.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

36 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json c88467d4adc417e668474e1b6198a5a7c503ac3f.

⛔ 8 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 1 changed file(s) yielded no anchor (packages/lint/src/index.ts) — pages documenting those are invisible to this run
• 1 anchor(s) matched too much of the corpus to be a work list: os validate (command, 83 pages)
• 12 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 60 of 216 client-bound route-ledger rows — the other 156 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 156: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 101 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 37 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json c88467d4adc417e668474e1b6198a5a7c503ac3f → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 216998fb6103f6c60808cf72f64363545a06f2e2 — the merge of head b3d46b7b436a2572979af7115d3fa082505a63ca into base c88467d4adc417e668474e1b6198a5a7c503ac3f, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 216998fb6103f6c60808cf72f64363545a06f2e2 && git checkout 216998fb6103f6c60808cf72f64363545a06f2e2
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin c88467d4adc417e668474e1b6198a5a7c503ac3f b3d46b7b436a2572979af7115d3fa082505a63ca && git checkout -B drift-repro c88467d4adc417e668474e1b6198a5a7c503ac3f && git merge --no-ff b3d46b7b436a2572979af7115d3fa082505a63ca

node scripts/docs-audit/affected-docs.mjs --json c88467d4adc417e668474e1b6198a5a7c503ac3f

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs c88467d4adc417e668474e1b6198a5a7c503ac3f → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

domain:spec#4 · os-steve · session_01ADHkmQNap7ryQcyQXocWct

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 52b05b8e3211a28c0dc157553d9b8df9c2fe4388
Local-runs: none
Scope: packages/lint/src/validate-flow-region-shape.ts, packages/lint/src/validate-flow-region-shape.test.ts, packages/lint/src/authoring-rules.ts, packages/lint/src/index.ts, packages/lint/src/rule-explanations.ts, packages/cli/src/commands/validate.ts, packages/cli/src/commands/compile.ts, packages/cli/src/utils/flow-region-shape.ts (deleted), packages/cli/src/utils/flow-region-shape.test.ts (deleted), packages/cli/test/authoring-rule-command-parity.test.ts, packages/cli/test/validate-build-gate-parity.test.ts, packages/cli/test/validate-flow-region-shape.test.ts + packages/spec/src/automation/control-flow.zod.ts (validateControlFlow), packages/spec/src/stack.zod.ts (flows: z.array(FlowSchema)), packages/services/service-automation/src/flow-definitions.ts (registerFlow), packages/cli/src/commands/lint.ts, packages/cli/src/utils/artifact-packages.ts (runPerPackageAuthoringRules, findingKey), packages/cli/src/utils/stack-collections.ts (authoringRuleUnionStack), packages/lint/src/non-record-object-entry.test.ts, packages/lint/src/authoring-rule-wiring.test.ts, docs/adr/0031-advanced-flow-node-executors-and-dag.md. Not reviewed: the four content/docs/**/*.mdx count bumps and the three .changeset/*.md files (read for ②).

① Derived judgments

Read on the net diff origin/main...52b05b8e and the cited code in the live tree.

• Accept-set narrowing at os lint — right. A new gating rule flow-region-shape-invalid (tier: 'gating', input: 'parsed', commands: ALL) runs FlowSchema.safeParse then the spec's validateControlFlow on every record of stack.flows. That is the same two calls registerFlow makes (flow-definitions.ts lines 213-220: FlowSchema.parse(converted), detectCycles, validateControlFlow(parsed)); no copy of the region logic exists in the rule. A flow this rule refuses is one the engine refuses to register today, and one os validate / os build already refused on main through the CLI walk. os lint goes to the bar the other two commands and the engine already hold; nothing green on main under all three commands turns red.
• Accept set at os validate / os build — unchanged, right. The CLI walk (findFlowRegionRefusals) walked packages[] entries' flows when packages were present, else the stack's own flows. The rule reads stack.flows only, but the two doors run it over the union stack (authoringRuleUnionStack folds packages[].flows into an absent top-level flows) AND once per package (runPerPackageAuthoringRules, where packageBodyAsStack puts the package's flows at flows), de-duplicated by findingKey, which neutralises the top-level index. Coverage is therefore a superset of the walk's: a stack that carries BOTH top-level flows and packages[] is now judged on both, where the walk judged only the packages. The case the union fold does not reach (top-level flows: [] beside packages) is reached by the per-package pass. os lint runs the same union + per-package pair (lint.ts lines 402, 698, 757), so the assembled-artifact fixture draws one finding at flows[1] on all three doors.
• --json row shape for this refusal at os validate / os build — changed, right, and unreleased. The old VALIDATION_ERROR row with flow came from .changeset/28893-* and .changeset/29059-*, both still pending on main (the files exist; a consumed changeset is deleted by Version Packages), so no published consumer reads that shape. The refusal is now an AuthoringFinding (rule, where, path, message, hint) under errors (validate) / issues (build), the envelope every other gating rule already uses; exit codes and verdicts are unchanged, and the refusal is reported once (the test asserts the count).
• Public surface of @objectstack/lint — widened, right: validateFlowRegionShape, FLOW_REGION_SHAPE_INVALID, type FlowRegionShapeFinding from the root barrel; RULE_EXPLANATIONS['flow-region-shape-invalid'] (covers 48 chars, no period, three-plus paragraphs: within rule-explanations.test.ts' pins). commands: ALL satisfies the wiring guard ("every gating rule runs on all three commands"); surfaces: CLI_ONLY with a surfaceReason over 40 chars satisfies the off-runtime ratchet.
• Deleted module packages/cli/src/utils/flow-region-shape.ts — right. Internal to @objectstack/cli (not a published subpath); no reference to it survives on the branch outside the two pointer comments and the test headers. The validate-build-gate-parity.test.ts ledger row is removed as that ledger's stale-row check requires; the parity table's OUTSIDE_THE_TABLE row moves into CASES as its own docblock prescribed, and the empty table goes with it.
• Fail-closed on a schema-refused flow record — right, and under os lint it is reachable. lint.ts hands the parsed tier lowerCallables(authoringRuleUnionStack(normalizeStackInput(config))), i.e. the same ADR-0087 D2 conversion layer the other two doors run before their stack parse, so FlowSchema.safeParse under lint refuses exactly the flows stack.zod.ts (flows: z.array(FlowSchema)) would refuse at the os validate schema step. A non-record entry (null, string, number, array) is skipped with its index kept, which is what non-record-object-entry.test.ts sweeps stack.flows with (its junk shapes are null, undefined, string, number, array; {} is swept only under objects), so the sweep's zero-invented-finding assertion holds for this rule.
• Rule count 60 to 61 in the four transcripts — right by construction: exactly one commands: ALL entry is added, none scoped.
• Top-level cycles stay unjudged — right and declared (rule header, explanation, changeset); detectCycles is engine-private and automation: a flow with a top-level cycle passes os validate and build; detectCycles runs only at registration and has no author-time home #29051 is open for it.
• Check-runs on the head: NONE. GET commits/52b05b8e/check-runs returns total_count: 0; the five app check-suites (vercel, fly-io, claude, cloudflare, objectstack-fleet) sit queued with no conclusion and no GitHub Actions suite is listed (the PR is a draft). So no derived gate family carries a CI verdict on this head yet. The dev's report quotes local readings (lint 7843/7843, cli unit 5263/5263, parity 12/12, spec automation 1745/1745, one ablation that reds the pinned tests and restores clean); those are the dev's claims, consistent with the tree as read, not gate verdicts. The landing conjunct "every check is green" is therefore unmet at the time of this record, independent of its verdict.
• Dogfood (owed by the narrowing arm): the dev reports 4 failures (flow-runas.dogfood.test.ts x3, declarative-endpoint-anonymous-guest.dogfood.test.ts x1) that reproduce identically with lint/cli restored to origin/main 7b1ae338; filed as an out-of-scope class-a finding. Not this PR's; read as such.

② Semver level

Clause-②: no (narrowing) and Metadata-protocol: none on the PR body and on .changeset/29049-flow-region-shape-lint-rule.md (@objectstack/lint: patch, @objectstack/cli: patch, BREAKING banner, adr-0087: not-required (no-migration-prescription)). Right under ruling A (check-changeset-no-major.mjs, 2026-10-21): the level follows the Metadata-protocol: line, and none is correct here because no schema, key, default or published symbol of the protocol moves; the spec's own refusal (validateControlFlow) is unchanged and merely reaches a third door. A non-protocol narrowing ships patch and keeps its BREAKING banner, which this changeset does. The (narrowing) arm is declared, as the ADR-0087 gate and the queue guard read it. The ADR-0087 class matches the 28893 changeset's accepted class for the identical change at the other two doors; the body's remedy sentence ("add one node every exit of the region leads to") is the engine's fix for the author's flow, not a consumer code-rewrite prescription.

The two pending changesets 28893-* and 29059-* are edited (DELIBERATE CORRECTION class): their sentences about findFlowRegionRefusals and a VALIDATION_ERROR row would publish false after this PR. The corrected sentences match the tree; restoring them would be wrong. check-empty-changeset red on this head is by design and is not a required context; the seat confirms it on the PR.

③ Boundary flags

• open_questions 1 — rule id. Option A, flow-region-shape-invalid, is right: subject then verdict, in the registry's existing -invalid spelling (approval-expression-invalid, expression-invalid); B (-malformed) says less and C (-unregisterable) names the consequence rather than the defect. A name alone is the seat's call; no needs-user-decision is owed. The PR body's 维护者速读 line still says the id goes to the maintainer for approval; the dev's deviation names the corrected body r2 for the seat to send. Should-fix on the PR record, not the tree.
• open_questions 2 — keep fail-closed under os lint. Option A (keep) is right. The engine refuses a flow FlowSchema refuses before it ever reaches the region check, so "could not be judged" is a true refusal, not a phantom; os lint's input is the same normalized stack the other doors parse, so the finding fires on exactly the flows os validate refuses at its schema step (no false refusal of a flow the engine registers); and option B would reopen the silent-pass branch cli: harden the os validate/build flow-region gate (silent parse skip, vacuous blindness pin, untested packages[] subject) and count refused flows at boot #29059 closed at validate/build, since the rule cannot tell which command runs it. The finding names the cause ("the flow schema refused it", with the schema's issues) and the hint points at os validate, so the rule id's region shape wording does not mislead. No change.
• Deviation: runtime publish surface left CLI_ONLY. In contract: surfaceReason names metadata: a flow whose loop / parallel / try_catch region is malformed or cyclic reads valid as a draft and publishes, then the engine refuses to register it #29233 (open, p2, domain:server, dispatched), which will put validateControlFlow into runtime-authoring-gate.ts at the publish door. Should-fix carried to metadata: a flow whose loop / parallel / try_catch region is malformed or cyclic reads valid as a draft and publishes, then the engine refuses to register it #29233, not here: when that lands, this entry's reason goes stale, and the cheaper shape is to wire THIS rule (surfaces: CLI_AND_RUNTIME, runtimeTypes: ['flow'], as lintFlowPatterns and validateFlowTriggerReadiness are) rather than a second call at the gate, so one registry row answers both doors.
• Deviation: MCP assignee/reviewer skipped — right; the standard order forbids it.
• Deviation: --json row shape — judged in ①: unreleased shape, no consumer.
• Out-of-scope findings: dogfood 4 red on main (class a, main-red candidate, not bisected) and the top-level cycle (automation: a flow with a top-level cycle passes os validate and build; detectCycles runs only at registration and has no author-time home #29051) — both correctly left to their carriers; the first needs a card if none exists.
• Nothing escalates to the maintainer from this record.

④ Design judgment

The narrowing read against the published spec on main: packages/spec/src/automation/control-flow.zod.ts validateControlFlow throws on a region that is not single-entry/single-exit, on a cyclic region body, and on a parallel with fewer than two branches, and parseFlowNodeRegions deliberately leaves a malformed region raw "for validateControlFlow to name" — the spec's own stated refusal, which ADR-0031 declares (lines 75, 122, 174). registerFlow runs it on every flow. So the capability the author holds under the spec is "a flow whose regions are single-entry/single-exit, acyclic, with two-plus parallel branches"; a flow outside that was never registered and never ran. This PR takes no declared capability away at the consumer: it makes the spec's own refusal real at the one authoring door that was still blind to it, with the spec's own function and sentence. That is the #4409 contract (three commands, one verdict) applied to a rule that #28893 had wired to two.

Attempts to break it, each read in the tree:

• Does the rule refuse under os lint what the engine registers? No: registerFlow applies conversions with includeRetired: true only for the stored-row rehydration seam; an AUTHORED stack reaches FlowSchema through normalizeStackInput on every door, and the rule reads that same normalized body under lint. The retired-alias case is refused by the schema on every door alike.
• Does moving from the walk to the rule table lose a flow? No: union fold plus per-package pass is a superset of the walk's subject set (①), and the de-dup key collapses the echo so the assembled case draws one row, as the test pins on all three doors.
• Does the rule throw on junk? No: isRec skips non-records and FlowSchema.safeParse never throws; the family sweep's shapes for flows are all non-records.
• Does the schema-refused branch invent a finding? Only for a record FlowSchema refuses, which os validate refuses at its schema step and the engine refuses at registration; both directions hold.
• Does the input: 'parsed' tier starve the rule under lint? No: runAuthoringRules hands run.parsed ?? run.normalized, and lint.ts passes parsed: lowered.
• Is the deleted walk cited anywhere that now dangles? No: no flow-region-shape.ts / findFlowRegionRefusals reference survives in content/, skills/, docs/, .claude/ or packages/ outside the two pointer comments and the test headers that record the move.

Must-fix: none.

Should-fix (none blocks):

1. PR body 维护者速读 still routes the rule id to the maintainer as needs-user-decision; send the r2 body (seat; not the tree).
2. Carried to metadata: a flow whose loop / parallel / try_catch region is malformed or cyclic reads valid as a draft and publishes, then the engine refuses to register it #29233: wire the publish door through this registry row (CLI_AND_RUNTIME, runtimeTypes: ['flow']) rather than a parallel validateControlFlow call at the gate, and retire this entry's surfaceReason in the same stroke.

Nothing in the tree is judged on the PR body's account of it; the readings above are from the diff and the cited code. The head carries no check-run yet (①): this PASS is a verdict on the contract and the design, and the queue's own "every check green" conjunct still has to be met on 52b05b8e before the seat lands it.

Implemented-by: claude/project-thread-f473q9
Reviewed-by: session_01ADHkmQNap7ryQcyQXocWct

VERDICT: PASS

[objectstack-fleet]

domain:spec#4 · os-steve · session_01ADHkmQNap7ryQcyQXocWct

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: b3d46b7b436a2572979af7115d3fa082505a63ca
Local-runs: none
Scope: packages/lint/src/validate-flow-region-shape.ts, packages/lint/src/validate-flow-region-shape.test.ts, packages/lint/src/authoring-rules.ts, packages/lint/src/index.ts, packages/lint/src/rule-explanations.ts, packages/cli/src/commands/validate.ts, packages/cli/src/commands/compile.ts, packages/cli/src/utils/flow-region-shape.ts (deleted), packages/cli/src/utils/flow-region-shape.test.ts (deleted), packages/cli/test/authoring-rule-command-parity.test.ts, packages/cli/test/validate-build-gate-parity.test.ts, packages/cli/test/validate-flow-region-shape.test.ts + the cited code named in record 6583593915, and for this delta packages/lint/src/lint-connector-credential-literals.ts (main's new registry entry, read to judge the merge). Not reviewed: the four content/docs/**/*.mdx count bumps and the three .changeset/*.md files (read for ②).

Delta review. Head b3d46b7b is one merge commit (52b05b8e + origin/main c88467d4), made to clear a conflict in packages/lint/src/authoring-rules.ts. The net diff against main is still 19 files, +371/-270. Diffing the old net diff (7b1ae338...52b05b8e) against the new one (c88467d4...b3d46b7b) changes only hunk offsets, blob ids, and the four transcript counts, which now read 61 to 62 over main's 61. Every judgment of record 6583593915 on 52b05b8e stands unchanged on this head; the sections below cover the delta only.

① Derived judgments

• Merge resolution in authoring-rules.ts — right. git diff c88467d4 b3d46b7b on the file is exactly the PR's own hunk: one import of validateFlowRegionShape (placed after lintFlowCredentialLiterals, before main's new lintConnectorCredentialLiterals import, the file's import order) and the one validateFlowRegionShape entry, placed after the lintFlowCredentialLiterals entry and before main's new lintConnectorCredentialLiterals entry, whose leading comment ("The same predicate over a declarative connector's four header/env maps") now follows the new entry intact. git diff 52b05b8e b3d46b7b on the file brings in exactly main's one addition (lintConnectorCredentialLiterals, tier: 'advisory', commands: ALL). Nothing dropped, nothing duplicated, entry fields unchanged from the reviewed head.
• Counts — right. Main (7b1ae338..c88467d4) registered one commands: ALL rule and moved the four transcripts 60 to 61; this PR adds one more commands: ALL rule, so 62 is the merged registry's validate/build count. No commit on origin/main past c88467d4 (now 399df5bb) touches the registry or the transcripts.
• Test pins and parity rows — none stale. Main's changes in the window touch packages/lint/src (connector credential literals, null guards, searchable fields, validate-expressions) and add one cli e2e test; none edits authoring-rule-command-parity.test.ts, validate-build-gate-parity.test.ts, validate-flow-region-shape.test.ts, the wiring guard, the explain pins or the non-record sweep. index.ts and rule-explanations.ts merged cleanly with both sides present (the explanations map gains both CONNECTOR_CREDENTIAL_LITERAL from main and FLOW_REGION_SHAPE_INVALID from this PR).
• Check-runs on b3d46b7b — present now (69 runs), and they answer the gates: Build Core, Test Core (8/8 shards), TypeScript Type Check, Lint & Repo Gates, Lint · PM dispatch-gates, Lint · docs & code guards, Lint · repo & tooling gates, Lint · ESLint, the three scoped lint jobs, Type Check · workspace / source gates / consumer gates / debt ledger, Spec property liveness, Dogfood Regression Gate, Build Docs, Check Documentation Links, Flag docs affected, Check PR Size, Governed Surface Queue Guard, Auto Label, PR-body guards, Test UI (16/16), Build & E2E UI, Live E2E UI, Type Check UI: all success. Skipped: Lint UI, UI Published Artifacts, Temporal Conformance, Dogfood Verify CLI, the matrix placeholder, Packed-tarball smoke, 18.x harness, Schedule gate (opt-in or not-applicable jobs). One PR-body guards run is cancelled (job 125427862209, 17:14:54Z), superseded by the success run 32 seconds later on the same head. Check Changeset is failure twice (the two workflow runs on the head), and the job log names the cause exactly: check-empty-changeset.mjs --base MERGE_BASE refuses .changeset/28893-flow-region-shape-at-validate-build.md and .changeset/29059-flow-region-gate-hardening.md as pending release notes this PR rewrote, and prints the DELIBERATE CORRECTION remedy ("do NOT restore it; say so on the PR and get it confirmed"). That is the case ② of record 6583593915 already judged: the two sentences would publish false without the edit. Not a required context; it needs the seat's confirmation on the PR, not a change to the tree.
• The dogfood reading of the first record (4 red on main, not this PR's) is unchanged; main's 6af3d295 test(dogfood): re-point the runAs and anonymous-guest flow pins is in this merge, which is the likely repair, and the Dogfood Regression Gate on this head is success.

② Semver level

Unchanged from record 6583593915: Clause-②: no (narrowing), Metadata-protocol: none, @objectstack/lint and @objectstack/cli patch with BREAKING banner, adr-0087: not-required (no-migration-prescription) — right under ruling A. The merge adds no changeset and edits none beyond the three already judged.

③ Boundary flags

Unchanged from record 6583593915: rule id option A flow-region-shape-invalid (seat's call, no escalation); fail-closed under os lint kept (option A). The merge raises no new flag. The Check Changeset red is the DELIBERATE CORRECTION class and is answered by the seat's confirmation on the PR.

④ Design judgment

Unchanged from record 6583593915: the narrowing makes the spec's own refusal (validateControlFlow, ADR-0031, run by registerFlow) real at os lint, takes no declared capability away, and holds against the union-plus-per-package pass, the non-record sweep and the input-tier handoff. The merge brings in one advisory rule beside it and no change to any code the rule cites.

Must-fix: none.

Should-fix (carried over, neither blocks): (1) send the r2 PR body so 维护者速读 no longer routes the rule id to the maintainer; (2) on #29233, wire the publish door through this registry row and retire the entry's surfaceReason.

Implemented-by: claude/project-thread-f473q9
Reviewed-by: session_01ADHkmQNap7ryQcyQXocWct

VERDICT: PASS

[objectstack-fleet]

domain:spec#4 · os-steve · session_01ADHkmQNap7ryQcyQXocWct

Head-sha: b3d46b7b436a2572979af7115d3fa082505a63ca · read 2026-11-02T17:50Z

维护者速读

• 改了什么：@objectstack/lint 新增门禁规则 flow-region-shape-invalid。它对每个 flow 先跑 FlowSchema，再跑 spec 的 validateControlFlow，所以 os lint 也会拒绝引擎不肯注册的 loop / parallel / try_catch 区域。CLI 里只给 validate 和 build 用的那段旧校验（flow-region-shape.ts）删了，改由规则表统一判，同一处错误只报一次。
• 为什么改：在 main 上，这类坏 flow 已经会被 os validate、os build 和引擎注册拒绝，唯独 os lint 看不见（lint: os lint stays blind to a flow region the engine refuses to register; validate and build refuse it since #28893 through a CLI-only gate #29049）。
• 风险与回滚：只收紧 os lint（BREAKING 窄化，patch 级，带 ADR-0087 豁免说明）。os validate / os build 的判定和退出码不变，--json 里这条拒绝改成通用的规则行，而旧行形状从未发布。回滚就是 revert 本 PR。
• 先看：packages/lint/src/validate-flow-region-shape.ts，以及 authoring-rules.ts 里的新条目。
• 两分钟验证：pnpm --filter @objectstack/lint exec vitest run src/validate-flow-region-shape.test.ts，预期全部通过。
• 需要你做的：无，席位落地。

席位意见：可落地。契约复审在 52b05b8 判 PASS（6583593915），合 main 后的 head 由同一复审者 delta 复审 PASS（6584199633）。CI 除按设计变红的 Check Changeset 外全绿。

席位核对 — ACCEPT · domain:spec#4 · head b3d46b7b

1. Shape: draft, base main, Fixes #29049; Clause-②: no (narrowing) and Metadata-protocol: none sit at line start in the body. The new changeset .changeset/29049-flow-region-shape-lint-rule.md (@objectstack/lint + @objectstack/cli patch) carries both lines, the BREAKING banner, and an ADR-0087 no-migration-prescription disposition (check-adr-0087-registration and check-changeset-no-major pass in CI). The diff is 19 files, +371/−270, all inside claim 6580500987's surface. No governed path. Author objectstack-fleet[bot] (relay).
2. Premise measured: on main, the parity table carried the flow-region row in OUTSIDE_THE_TABLE with blindTo: ['lint'], and no packages/lint/src file called validateControlFlow. The rule now calls that same spec function registerFlow calls, without copying it. The parity row moved into CASES and holds on all three commands. In the dev's ablation, guarding the validateControlFlow call turned the rule test, the cli test and the parity test red; restoring it turned all three green again.
3. Gates: check-runs on b3d46b7b: Test Core 8/8, Test UI 16/16, Dogfood Regression Gate, the type checks and the governance jobs are all success. Skipped runs are path-gated or opt-in. The one cancelled PR-body guards run was superseded by a success on the same head. Check Changeset is red by design, and the seat confirms it: the PR rewrote the pending .changeset/28893-* and .changeset/29059-*, whose sentences it makes false (DELIBERATE CORRECTION; restoring them would put the false sentences back). The dev's 92 derived gates ran on 52b05b8e: 88 exit 0, 4 NOT MEASURED on exit-3 prerequisites (dual-build-cjs, skill-examples, i18n-coverage, plugin-teardown self-test), plus the by-design changeset red.
4. Rulings on the open questions: (a) the rule id is flow-region-shape-invalid, along with the exports validateFlowRegionShape and FLOW_REGION_SHAPE_INVALID. It uses the registry's existing -invalid spelling. Naming is the seat's call, so no needs-user-decision. (b) Fail-closed stays on every command. os lint hands the rule the same normalized body the other commands parse, and the engine refuses a schema-refused flow too; skipping it would reopen cli: harden the os validate/build flow-region gate (silent parse skip, vacuous blindness pin, untested packages[] subject) and count refused flows at boot #29059's false-clean branch. Accepted deviations: the --json row shape for this refusal changes at validate/build (the old shape is unreleased); and no MCP assignee or reviewer writes, because the order forbids them.
5. Out of scope: the 4 dogfood failures on 52b05b8e are anchor main red: Dogfood Regression Gate fails on main since #29365 (dfbe34d8) — flow-runas and declarative-endpoint-anonymous-guest dogfood files #29426: fix(runtime): every flow start door judges a start input against the object the flow's definition reads it from #29365 caused them and test(dogfood): re-point the runAs and anonymous-guest flow pins to flow start admission's record rule #29451 fixed them. The dev's first merge of main predated that fix, and Dogfood is green on b3d46b7b, so no finding is needed. Should-fix 2 of the review was carried to metadata: a flow whose loop / parallel / try_catch region is malformed or cyclic reads valid as a draft and publishes, then the engine refuses to register it #29233 (6583607752): wire the publish door through this registry row and retire surfaceReason. A top-level graph cycle stays with automation: a flow with a top-level cycle passes os validate and build; detectCycles runs only at registration and has no author-time home #29051.
6. Landing: not Tier H, under 3000 lines, so the seat lands it with pr_ready and auto-merge. After merge the seat writes a landing note on lint: os lint stays blind to a flow region the engine refuses to register; validate and build refuse it since #28893 through a CLI-only gate #29049 and removes pm:dispatched.

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 41495260722 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

分类：failure —— 按下面的日志分诊。

失败的 job（日志抽取，best effort）：

• Test Core (2/8) — 失败步骤: Run this shard's tests

  @objectstack/spec:test:  FAIL   local  scripts/dropped-refinements.test.ts > the committed ledger > names at least one site per entry, and its header totals match its body
    ↳ 失败原因: @objectstack/spec:test: AssertionError: expected 993 to be 998 // Object.is equality
  @objectstack/spec:test:repo:  FAIL   repo  scripts/strictness-ledger-doc.test.ts > the ledger and the generated counts agree > is checked in current — every shard on disk equals a fresh render, and no
    ↳ 失败原因: @objectstack/spec:test:repo: AssertionError: expected Map{ …(14) } to deeply equal Map{ …(14) }
  @objectstack/spec:test:repo:  FAIL   repo  scripts/strictness-ledger-doc.test.ts > the ledger and the generated counts agree > the read-time totals equal the sums of the shards' own rows
    ↳ 失败原因: @objectstack/spec:test:repo: AssertionError: expected 'untriaged: 1297 object site(s) across…' to be 'untriaged: 1296 object site(s) across…' // Object.is equality
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️ 断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• scripts/strictness-ledger-doc.test.ts — 24h 内已弹出 14 个 PR（feat(spec): declare the whole-deployment export, every installed package as installable packages in one read (PackageExportBundleSchema) #29100、feat(spec): push channel protocol face — device registration widening, stored device shape, device contract members, push route, APNs/FCM config by credentialRef #29218、fix(spec)!: refuse a dashboard globalFilters entry keyed dateRange beside a declared dateRange #29370、fix(spec)!: a datasource named drivers is refused at every door that parses a datasource #29423、feat(spec): a record page can name the apps whose routes open it (PageSchema.apps) #29437、docs(spec): tenancy-posture prose says which side of the open/commercial split gates activation #29454、feat(spec): declare features.sso on the auth config response #29455、feat(lint)!: os lint refuses a flow region the engine refuses to register (flow-region-shape-invalid) #29495、build(turbo): hash the Service Worker generator into the Console's build and type-check only #29504、fix(pm): the relay reads no runner 403 as the egress proxy's, and a refused advisory row names its cause #29505、fix(cli): os migrate organization-ownership --apply carries a public-form withdrawal onto a read-only package view into its .custom pair, declared #29508、docs(spec): the disabledActions description names Setup › Packaged Actions, not the retired Packaged automation page #29511、docs(spec): TOP_LEVEL_COLLECTIONS_NEVER_RESIDUAL names the readers of top-level datasets the tree has #29514、feat(pm): a ruled decision card still in the box is a patrol row, and the director's ruling lands with its knock #29515），但它们同属 1 条投机栈 ⇒ 1 次独立命中。汇总 issue：Queue-flake anchor: scripts/strictness-ledger-doc.test.ts #29524（已刷新）
• scripts/dropped-refinements.test.ts — 24h 内已弹出 7 个 PR（feat(spec): a record page can name the apps whose routes open it (PageSchema.apps) #29437、docs(spec): tenancy-posture prose says which side of the open/commercial split gates activation #29454、feat(lint)!: os lint refuses a flow region the engine refuses to register (flow-region-shape-invalid) #29495、fix(pm): the relay reads no runner 403 as the egress proxy's, and a refused advisory row names its cause #29505、docs(spec): the disabledActions description names Setup › Packaged Actions, not the retired Packaged automation page #29511、docs(spec): TOP_LEVEL_COLLECTIONS_NEVER_RESIDUAL names the readers of top-level datasets the tree has #29514、feat(pm): a ruled decision card still in the box is a patrol row, and the director's ruling lands with its knock #29515），但它们同属 1 条投机栈 ⇒ 1 次独立命中。汇总 issue：Queue-flake anchor: scripts/dropped-refinements.test.ts #29530（已刷新）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• 本 PR 过去 24h 无队列失败记录（首次）。
• 过去 24h 队列共有 22 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)

[github-actions]

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 41498375728 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

分类：failure —— 按下面的日志分诊。

失败的 job（日志抽取，best effort）：

• Test Core (2/8) — 失败步骤: Run this shard's tests

  @objectstack/spec:test:  FAIL   local  scripts/dropped-refinements.test.ts > the committed ledger > names at least one site per entry, and its header totals match its body
    ↳ 失败原因: @objectstack/spec:test: AssertionError: expected 993 to be 998 // Object.is equality
  

• Test UI (15/16) — 失败步骤: Run the ui tests (shard 15/16)

  × a refused report save makes a reload and the pillar link ask; a save that lands clears it 1962ms
  FAIL   dom  packages/app-shell/src/views/studio-design/StudioDesignSurface.refusedLeafUnsaved-29113.test.tsx > a leaf edit whose save was refused guards every departure (objectstack#29113) > a refused
    ↳ 失败原因: AssertionError: expected false to be true // Object.is equality
  

↳ 失败原因 是判读的关键：超时（Test timed out in … / Hook timed out in …）多半是负载/时序，不是本 PR 的回归；
断言（AssertionError: …）才指向真实的行为改变。两者的 FAIL 行长得一模一样，只有这一行能区分。

⚠️ 断言这一侧有一类例外，判据是断言在测什么，不是它是不是 AssertionError。 断言的对象是产品行为（一个值、一个形状、一次拒收）⇒ 照上面读：真实的行为改变，去查，⛔ 不要重排掉；
断言的对象是这次实验自身的有效性前提（跑完的耗时、负载下的先后、任何只在时间预算内才成立的条件）⇒ 它跟超时是同一类，同样对负载敏感，重排一次是合法的判别手段。
识别是机械的：断言的消息或它比较的值本身点名了一段时长、一个时间戳、一个耗时计数。实测过的一对 —— AssertionError: SecurityPlugin.init() ran: expected false to be true 测的是产品行为（真回归）；
AssertionError: this run took over a second, so second-precision stamps could have differed too: expected 1006 to be less than 1000 测的是实验前提：它守护的那条不变式当时是绿的，同一个 head 原样重排一次即成功。
穿着 AssertionError 外衣的时间测量，仍然是时间测量。（⛔ 这只改「怎么读一次红」，不改「哪些测试可以重排」——后者由别处管。）

跨 PR 相同签名（24h，按失败测试文件聚合）：

• scripts/dropped-refinements.test.ts — 24h 内已弹出 7 个 PR（feat(spec): a record page can name the apps whose routes open it (PageSchema.apps) #29437、docs(spec): tenancy-posture prose says which side of the open/commercial split gates activation #29454、feat(lint)!: os lint refuses a flow region the engine refuses to register (flow-region-shape-invalid) #29495、fix(pm): the relay reads no runner 403 as the egress proxy's, and a refused advisory row names its cause #29505、docs(spec): the disabledActions description names Setup › Packaged Actions, not the retired Packaged automation page #29511、docs(spec): TOP_LEVEL_COLLECTIONS_NEVER_RESIDUAL names the readers of top-level datasets the tree has #29514、feat(pm): a ruled decision card still in the box is a patrol row, and the director's ruling lands with its knock #29515），但它们同属 1 条投机栈 ⇒ 1 次独立命中。汇总 issue：Queue-flake anchor: scripts/dropped-refinements.test.ts #29530（已刷新）
• packages/app-shell/src/views/studio-design/StudioDesignSurface.refusedLeafUnsaved-29113.test.tsx — 24h 内已弹出 2 个互相独立的 PR（feat(spec): declare features.sso on the auth config response #29455、feat(lint)!: os lint refuses a flow region the engine refuses to register (flow-region-shape-invalid) #29495）。汇总 issue：Queue-flake anchor: packages/app-shell/src/views/studio-design/StudioDesignSurface.refusedLeafUnsaved-29113.test.tsx #29555（新建）
• ⚠️ 24h 评论账本没读完（超过 5 页仍未读到窗口尽头），所以上面的「不同 PR 数」是下界，不是全量。

历史信号：

• ⚠️ 本 PR 过去 24h 已在队列失败 1 次（不含本次）。 内容未变而反复失败 ⇒ 高度怀疑 flaky 测试或与同组 PR 的语义冲突，重排不解决。
• 过去 24h 队列共有 28 个失败构建（不含本次）。

分诊清单：

1. 失败测试在本 PR 改动的包里 → 真回归，修 PR。
2. 失败测试与本 PR 无关 → 看上面的「跨 PR 相同签名」；已有汇总 issue ⇒ flaky/环境问题实锤，去那张 issue 上谈，修好前重排只会再烧一轮全队列。
3. 两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

---

Generated by Claude Code · merge-queue-triage workflow (#4859)