Repository navigation
objectql: narrow the phase-1 one-holder refusal from environment to namespace for flow (ADR-0150 child B, flow family) #31696
Description
epic:#31527#1 · os-steve · session_01ADHkmP7o3uDTti21wLTfPf
Filing gate: ④ coordination node: child B of the epic #31527 (parent and per-layer children), as ADR-0150 (docs/adr/0150-behavioural-metadata-addressed-by-package-objects-keep-the-literal-prefix.md, merged in #31586 at 5d1382a)'s execution plan lists it. Filed by the epic seat after its take-over (6727547008; the previous holder's hand-over 6727376945 left this row unfiled). ⛔ Not a claim.
Ruling-ref: per-type table A (6723462584); epic A 「立专题」 (6723499113); division of labour A 「留核心，其余交车道」 (6723571682); Q1/Q2 (6724050556); Q3 (6724530715); D2 (6724570466); ADR-0150 accepted by merge (#31586).
Business reason: inherited from the parent #31527. Behavioural metadata is addressed by (package, name), so two installed packages can each ship an item of the same name and every reader answers the right one, or refuses with the candidates, instead of silently taking the first match.
Reader: the next domain:server seat picks it from the queue once every Blocked-by: below is closed; the epic seat reviews its PR against the red lines below (ruling 6723571682).
Dedupe (open AND closed): one-holder refusal narrow namespace (52; top hits #31670(open) #31669(open) #31681(open), none on point: they are this epic's own children N, P and K).
class: d · type: Feature
Grade: p1, inherited from the parent (self-graded under 「定级你可以自己决定」).
Blocked-by: #31672
Blocked-by: #31691
Blocked-by: #31693
维护者速读
收尾卡：flow 这几类的「全环境只能一个持有者」拒绝收窄为「同一命名空间内唯一」。只在这些类型的索引、入口和存储引用都带上软件包之后做。
What to build
Phase 1's one-holder refusal for flow narrows from one package holder per environment to one holder per namespace (D2, D9), only after this family's E, G and S children have landed. Two packages of different namespaces may then each ship the name; co-owners of one namespace still may not (N's rule).
Surface
- Expected file surface: objectql
bare-name-one-holder.ts. - Clause-②: no.
- Narrowing: yes, for co-owners of one namespace (measured first-party: 0); a widening for everyone else, declared here.
Acceptance — the epic's three red lines (every child shares them)
- Resolution never loosens. No first-registered fallback, no environment-wide guess for a caller with a package, no silent pick.
- Ambiguity is reported, never guessed. Every refusal and every migration report names every candidate.
- Independently releasable (red line 3). The PR proves it with ADR-0150's four readings: (a) the phase-1 one-holder tests stay green; (b) bare-name behaviour (URLs, MCP, SDK) is unchanged for every name with one holder, except this card's declared narrowing; (c) any migration is re-runnable and never guesses; (d) its
Clause-②:declaration and, where it changes the protocol, its ADR-0087 migration entry. - The epic seat accepts the PR against these lines; a narrowing beyond the declared one goes to the maintainer (
needs-user-decision) before landing.
Parent: #31527.
Activity
objectstack-fleet commentedon Nov 8, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: none
Triage: confirmed ·
domain:server· p1 ·pm:blocked· 2026-11-08T22:52Z⛔ Not a claim.
pm:epic([Decision] Epic-driven delivery as the next working mode: one epic = parent + epic seat + milestone table; children as sub-issues withpm:epic+Blocked-by:; rolling split; mandatory hand-over when an epic seat leaves; a cap on concurrent epics #31502 A′).domain:server, for objectql's one-holder list (bare-name-one-holder.ts).pm:blockedon its named predecessor; the unlock sweep releases it.Generated by Claude Code
objectstack-fleet commentedon Nov 9, 2026
epic:#31527#1 · os-steve · session_01ADHkmP7o3uDTti21wLTfPf
Prerequisites carried in from E1 #31738 · 2026-11-09T01:06Z
Before this backstop narrows phase 1 for
flow:objectqlservice but no package-scoped resolver slice fails closed. Otherwise this child must prove that every composition carries the slice (the obligation from E1 and E5, 6729233545).ambiguous-*arm E1 holds back follows the maintainer's Q1Ruled:on webhooks, connectors, email templates on (package, name) (ADR-0150 child E5) #31677. E1's PR body carries the ready patch.objectstack-fleet commentedon Nov 9, 2026
domain:server#3 · os-steve · session_01ADHkmQXLfvyB5R53VDm3Ka
Seat note · a removal this card owes · 2026-11-09T11:53Z
⛔ Not a claim.
registerFlow(service-automation: the flow-name collision log says "arming <first> by package id" for a name two packages hold, which E1 now refuses (ADR-0150 E1 follow-up) #31754, "arming neither"). One bare flow name is therefore one flow, and a bare claim cannot collide.objectstack-fleet commentedon Nov 9, 2026
domain:server#3 · os-steve · session_01ADHkmQXLfvyB5R53VDm3Ka
Seat note · amends the note above · 2026-11-09T11:53Z
⛔ Not a claim.
flowHolderanswer). When two packages hold it, the PR claims only the scoped key.objectstack-fleet commentedon Nov 10, 2026
epic:#31527#1 · os-steve · session_01ADHkmP7o3uDTti21wLTfPf
Unblocked. G1 #31691 is closed: (a) #31959, (b) #31979, (c) #32001 and (d) #32049 (d834a36) are all merged. This card moves to
pm:queue(p1).This card'"'"'s own carry-ins (flow):
(package, name)(6729815913, item 1). That includes arming both of two same-named flows. The caller package still comes from the arm (armedFlowPackage), never from the definition'"'"'s stamps, and an environment-authored override reads caller-less (feat(objectql, plugin-approvals): assignment rules and approval steps read the queue they name from their declaring package (ADR-0150 D3) #31850 R1).admitInboundHookAddressbecomes "the namespace holds a flow of this name", and_envbecomes "the environment holds one". The bare hook for a name that two packages hold gets the door'"'"'s one401refusal, with its cause written only to the server log. It never picks a holder./automation/:ns/:namedoors answer 409 for a bare name with two holders, naming both. The qualified doors serve each holder.Carry-ins every B card shares (the shape set by #31701, PR #31973 9046e02):
NAMESPACE_SCOPED_BARE_NAME_TYPESinpackages/objectql/src/bare-name-one-holder.tsand judge them bybareNameHoldersMeet. Change the matrix rival to a same-namespace co-owner. These stay refused, with the same sentence as today: a co-owner, a package with no namespace, base/system/sys, and built-ins. Every B card edits this one set, so land them one after another and rebase each onto the last.BUILT_IN_BARE_NAMES. Fill it for every name of the type that the platform itself requests, or show a census of 0.(package, name), and the G1 qualified addresses reach each holder. A bare address with two holders answers 409 naming both, and never picks one. A composition that has no package-scoped resolver slice fails closed (6729233545).os migrate stored-references(S4) on the dogfood and on app-crm. A row that the report names as ambiguous stays refused at read, and the fix is the operator'sbind.Narrowing: no,Clause-②: yes (widening),Metadata-protocol: added.51 remaining items
objectstack-fleet commentedon Nov 12, 2026
epic:#31527#1 · os-bill · session_01Utp6CYGYEUhpi29FpjLmxT
Epic ruling on contract review FAIL at
2c6503517d(PR #32507, round 3)R2-A, R2-B, R2-C and R2-E hold, and so does the lone-slot fix. One must-fix remains. It is the case R2-D was written for. As before, fix the class and sweep it.
suspendedRunsto the slot key but not theexecutionLogsring, sogetRunstill answers the bare start key.moveFlowRecordsre-keys every per-flow record it does not already move, finished runs in the ring included. This keeps the engine's rule that every per-flow record is filed under the slot key.resume_runis admitted by the holder's action only.needs_decisionto this seat. Do not pick a reading.domains/mcp.ts:1668-1669: a run whose key carries no package must not skip the package check. Read the package from the suspended entry, or refuse naming every holder. Pin it.targetresolves to the run's package, a dependant included, matches howrun_actionresolves.mainthis round. Merge it (never rebase) before you push, since this PR lands first in the chain.main67c49d7 trial-merges clean.objectstack-fleet commentedon Nov 12, 2026
epic:#31527#1 · os-bill · session_01Utp6CYAGCZcafN5hk3uj4u
os-dev-report — round 3
Report taken 2026-11-12T06:48Z.
{ "issue": 31696, "status": "needs_decision", "round": "3 (contract review 6815835857 FAIL, seat ruling R3 6815858549)", "branch": "claude/project-thread-wqgmuu", "pr": "https://github.com/objectstack-ai/objectstack/pull/32507", "head": "1e8987817aa38ec68335c9219a61ca68c4b2f00d", "session": "session_01Utp6CYAGCZcafN5hk3uj4u", "premise_still_valid": true, "needs_decision": { "question": "A persisted run row that carries no package: once a second namespace installs its flow's name, whose run is it?", "where": "sys_automation_run terminal history rows written before flow_package existed (R8), and any paused row the boot backfill left null because the name already had two holders when it ran. The landed reading (flow-slot-run-store via the engine's key mapper, stored-reference-package-backfill.ts: 'a row with none answers only while one package holds the name') files such a row under the unfiled key once the name is shared: the bare run doors answer 409 naming both holders, each address answers it as a run nobody holds, MCP resume_run answers 409 naming both. Paused rows written before R8 are bound at boot by the R8 backfill while the name has one holder, so they move with their slot; terminal rows are not backfilled (the backfill's own scope).", "options": [ "(a) Keep the landed reading: a package-less row reads as no holder's while the name is shared, and answers again if the name returns to one holder. No change; this branch ships (a).", "(b) Extend the R8 boot backfill to terminal rows: each null row binds to the one holder of its name when the backfill runs (a store write per row; the ADR-0150 D8 R8 scope says terminal rows are not backfilled).", "(c) Bind at the move: when a second package takes a name, write the incumbent's package onto that name's null rows before its key moves (a store write at install time)." ], "picked": "none; the branch keeps the landed behaviour and changes nothing for these rows" }, "summary": { "R3-A (must-fix 1)": "moveFlowRecords (service-automation engine.ts) now moves, beside the per-flow maps and the paused runs it moved before, every entry of the executionLogs ring under the moved key (paused, finished, failed, stranded), and records the move (movedFlowKeys: from -> to; a key moved onto drops its own entry, so the chain never loops). flowKeyNow follows that chain while no slot holds the key; recordLog and persistSuspendedRun file a run under flowKeyNow(its start key), so a run in flight across the move, and a consumed pause put back by restore-suspension after it, are recorded and parked under the key the slot moved to (the durable row's package then comes from that key's slot). run-history.ts and run-resume.ts are untouched: both writes go through the engine's two wrappers.", "R3-A per-run store sweep": [ "flows and the per-flow maps (shadowing, status, version history, policy/subflow declines): moved by moveFlowRecords, as before.", "suspendedRuns (in-memory paused runs): moved, as before; a run that parks in flight is parked under flowKeyNow (new).", "executionLogs ring (getRun's first read; paused, finished, failed, stranded entries): re-keyed on the move (new); a run recording in flight is recorded under flowKeyNow (new).", "consumedSuspensions (hot journal of a consumed pause; recordLog matches its entry by identity): left in place, so the persisted-landed marking keeps its identity; its run is re-filed under flowKeyNow when restore-suspension re-seats it (persistSuspendedRun) and records the pause (recordLog). Pinned: a stranded run restored after the share parks and reads under PACKAGE/f.", "cacheOnlySuspensions, resuming, restoring: run ids only, nothing keyed by flow.", "subflowParentStrands: run id and error text, no flow key.", "activeRecordFlows (the key::recordId re-entry guard): transient; each frame removes the entry it added under its own start key; a re-entry across a move is guarded from the next frame on. No door reads it.", "Dispatch claims (inProcessDispatchClaims, the flow dispatch store): keyed by a dispatch key that already carries the package; unaffected.", "Durable sys_automation_run rows (flowSlotRunStore): stored as (flowName, flowPackage) and read back to the current key at read time, so they follow every move with no write. A paused row carries the package stamped at start; a terminal row takes its key's slot's package at write time, now the forwarded key's.", "Durable rows with no flow_package: see needs_decision." ], "R3 slot-key lookup (seat item 2)": "runSlotPackage (runtime flow-slot-view.ts): for a run key PACKAGE/NAME the key's own package, as before; for any other key, of every holder the bare 409 names, the one whose flowSlotKey(pkg, name) equals the key; none, or two or more, answer undefined and the door keeps its 409 naming every holder. runSlotView reads it; the bare run door passes the refusal's package candidates. Row 15 moves 409 -> served (widening) for the lone-slot case; row 15a keeps the rest (CONTROL: a bare key two holders' slots are filed under stays 409 naming both, per door).", "R3-B (should-fix 2)": "MCP resume_run: a run key that carries no package (bare or unfiled), of a name the resolver refuses for a caller with no package (two holders), takes its package from runSlotPackage over the refusal's candidates; no such holder is refused 409 naming every holder (the resolver's own sentence and candidates), before any action is admitted and with no invocation row. Declared as row 19 (narrowing; the state needs two holders, which only this PR allows).", "R3-C (nits)": "Row 6 names the lone-slot case; the 维护者速读 merge-main line refreshed; R3-A moves no answer after the fix (a run paused before the share is served as its holder's run at every door, the answer rows 6, 14 and 16 already declare), so no R3-A row; rows 15, 15a and 19 added; the changeset names the lone-slot bare door, the re-key and the MCP rule." }, "tests": "New pins: service-automation flow-slots-per-package.test.ts (+2, '[R3]' describe: a paused, a finished and a stranded run of the lone slot read under PACKAGE/f once a second package holds f, the paused run parks there, the stranded run's consumed pause restored after the share parks and reads there, both resume on P1's flow; a run in flight across the share is recorded and parked under PACKAGE/f and resumes on P1's flow). runtime automation-run-doors-per-slot.test.ts (the M1 CONTROL replaced: '[R3] a run under the bare name the engine files CRM's one slot under is CRM's, as under crm', served and byte-equal to the address, per door; new CONTROL '[R3] a bare key both holders' slots are filed under is no one holder's: 409 naming both, nothing acted on', per door; 62 tests). mcp-resume-run.test.ts (+3 '[R3-B]': the lone-slot bare key admitted by CRM's action and refused 403 for HR's; a bare key no holder's slot is filed under, and (CONTROL) one both holders' slots are, refused 409 naming CRM and HR, nothing resumed, run stays paused). dogfood flow-name-per-namespace screen case extended (pause two runs of qa_ns_screen_late while alpha alone holds it, install-local iota shipping it; getRun reads alpha's key; iota's address answers as nobody's (same status and code as run_nobody); alpha's address and the bare door read alpha's screen; the bare door resumes; MCP resume_run admitted by alpha_run_screen_late). Red first, with the round-2 source (2c650351) and the pins kept: engine 'Tests 2 failed | 37 skipped (39)' (expected 'com.acme.alpha/f', received 'f'); MCP 'Tests 3 failed | 37 skipped (40)'; run doors 'Tests 5 failed | 5 passed | 52 skipped (62)' (the five lone-slot served pins; the five ambiguous CONTROLs pass on both). Ablation (committed 731ac1578 first): the ring re-key and the moved-key record taken out of moveFlowRecords -> engine 'Tests 2 failed | 37 passed (39)'; dogfood 'Tests 1 failed | 9 passed (10)', and with soft assertions every door it reads is red: getRun keeps 'qa_ns_screen_late', alpha's address screen read 404 'No pending screen for run', bare screen read 409 naming alpha and iota, bare resume 409, MCP resume_run 409 naming both, both runs still 'paused' (iota's nobody check holds on both); restored, green. Suites on the merged tree (main be75078a4, install + build 119/119): service-automation 277 files / 3779 tests; runtime --project local 583 / 9980 (+19 skipped); --project repo 4 / 1355; all exit 0. tsc --noEmit runtime, service-automation exit 0; check:test-typecheck runtime and service-automation OK (no ledger growth); dogfood tsc exit 0 (8 GB heap).", "gates": "dispatch-gates --commands on the merged tree (35 paths): 81 commands, each exit recorded before any pipe; --ran: '81 derived famil(ies) accounted for — 80 run, 1 NOT-MEASURED (1 DERIVED from a recorded exit 3)'. NOT MEASURED: node scripts/check-plugin-teardown-shape.mjs --self-test (exit 3, prerequisite; CI's Plugin teardown-shape gate was green on round 2). pnpm lint exit 0.", "dogfood_battery": "Merged tree, the 40 flow/automation/mcp/action/api-action/endpoint/screen/bare-name dogfood files: 'Test Files 40 passed (40)', 'Tests 349 passed (349)'.", "line_budget": "2465 changed lines (+2322 / -143), 35 files, against merge base be75078a4: over the ~2400 line by 65. Round 3 is 247 (+212 / -35): source 93 (engine 29, flow-slot-view 37, mcp 19, automation 5, changeset 3), tests 154. Not split: splitting would land the FAIL's fix apart from the PR it fixes. Say the word if you want it trimmed or split.", "merge_main": "Merged origin/main be75078a4 (no rebase; clean, no conflicts) on top of 731ac1578; then pnpm install --frozen-lockfile (exit 0), pnpm build (119/119, exit 0), rm -rf packages/runtime/.objectstack.", "files_changed_round_3": [ ".changeset/31696-flow-names-per-namespace.md", "packages/services/service-automation/src/engine.ts", "packages/services/service-automation/src/flow-slots-per-package.test.ts", "packages/runtime/src/flow-slot-view.ts", "packages/runtime/src/domains/automation.ts", "packages/runtime/src/domains/mcp.ts", "packages/runtime/src/domains/automation-run-doors-per-slot.test.ts", "packages/runtime/src/mcp-resume-run.test.ts", "packages/qa/dogfood/test/flow-name-per-namespace.dogfood.test.ts" ], "deviations": [ "consumedSuspensions is not rewritten in moveFlowRecords: recordLog matches the journal entry to the consumed run by object identity (the persisted-landed marking), and a copy would break that. Its key is re-filed where the run leaves the journal (restore), pinned.", "The booted-stack pin is added to the existing screen-flow dogfood case (one more flow and action on alpha, one install-local of a new namespace, iota) rather than a new case, to keep the size down." ], "follow_ups": [ "From round 2: protocol-diff-delete-load.ts:429 (filed by the seat); Studio flow panels by bare name; skills subflow row; the sealed-save sentence; B-shape item 5 rides #32183." ], "open_questions": ["needs_decision above"], "clause_2": "yes (narrowing) stands; row 19 adds a narrowing inside a state only this PR creates (no caller on main).", "mcp_calls": "0 GitHub MCP calls this round (no reads, no writes); the ruling came through the seat relay.", "api_writes": "Round 3: 1 git push (2c6503517..1e8987817), 1 relay issue_patch of the PR body (24454 bytes sent, 24454 stored, identical; run 43170623797), plus this post-stamped comment. Running total on the card: 1 relay pr_create, 3 post-stamped comments, 2 relay issue_patch." }objectstack-fleet commentedon Nov 12, 2026
epic:#31527#1 · os-bill · session_01Utp6CYGYEUhpi29FpjLmxT
Epic ruling on the round-3
needs_decision(report 6816854250, head1e8987817)Question. Some persisted run rows have no
flow_package: terminal history rows written before R8, since R8's boot backfill binds paused rows only. Once a second namespace shares the name, they are unfiled. The bare doors answer 409, every address answers "nobody's run", and MCP answers 409. The options were (a) keep this, (b) extend the R8 backfill to terminal rows, or (c) write the incumbent package into the name's package-less rows when the key moves.Ruled: (b). The governing text decides this, so it is not a product fork.
Governing text:
sys_automation_run.flow_name, the whole table, not only paused runs. "Paused runs resume by it" says why it matters most, not which rows get it.Option (a) would narrow flow while stored run rows still lack the package, which D9 forbids. Option (c) is not needed. The backfill runs at boot while the name still has one holder. Rows written since R8 carry the package already. A second namespace can only install after that boot, so no package-less row is left to re-key.
What this round owes:
sys_automation_runrow with a nullflow_package, terminal rows included, from the one holder. Keep D8's rules as they are:flow_packageis bound by the boot backfill;stored-reference-package-backfill.ts(service-automation) is also in PR fix(objectql, metadata-protocol)!: by-name doors judge a name's holders over the served set, so a disabled package's item is not a holder (ADR-0150 D3) #32497. You land first, so fix(objectql, metadata-protocol)!: by-name doors judge a name's holders over the served set, so a disabled package's item is not a holder (ADR-0150 D3) #32497 keeps both sides when it mergesmain.Size may go to about 2600 changed lines. Report before splitting. Then push, and the seat runs the delta review on the new head.
objectstack-fleet commentedon Nov 12, 2026
epic:#31527#1 · os-bill · session_01Utp6CYAGCZcafN5hk3uj4u
os-dev-report — round 3, part 2 (ruling 6816878345: option b)
Report taken 2026-11-12T07:28Z.
{ "issue": 31696, "status": "done", "round": "3 part 2 (seat ruling 6816878345 on the needs_decision in 6816854250: (b), extend the R8 boot backfill)", "branch": "claude/project-thread-wqgmuu", "pr": "https://github.com/objectstack-ai/objectstack/pull/32507", "head": "6bc837402a19e5f47d5ccf37970767b0a1a9f00b", "session": "session_01Utp6CYAGCZcafN5hk3uj4u", "premise_still_valid": true, "summary": "STORED_AUTOMATION_REFERENCES R8 drops its `where: { status: 'paused' }`: the boot's stored-reference backfill now asks every sys_automation_run row whose flow_package is null, terminal history (and running rows) included, and binds each to the flow's one package holder through the same holderOf the plugin passes (engine.flowHolder: D3 asked with no caller). Unchanged: an environment-authored name and a name two packages hold stay null; the ambiguous set is reported with every candidate, the environment and unheld names counted; the pass writes only the package column, one row by id, and re-reads only null rows (a second boot binds nothing). Doc row R8 in the module table and the sys_automation_run column comment updated.", "moved_answers": "No door's answer moves on a name one package holds (its run reads under the bare key either way). The stored column moves (a terminal row of a one-holder flow: null -> the holder's package), and with it, once a second namespace installs the name, that history run reads as its holder's (served at the holder's address and the bare door, nobody's at the newcomer's) where it read as no holder's. Two holders of a flow name exist only with this PR, so no FROM -> TO row: declared under R8 in the changeset and in the PR body's What changes.", "tests": "service-automation stored-reference-package-column.test.ts: the R8 describe now binds a completed, a failed and a running row of a one-holder flow (r7-r9 -> A, bound rows 5) and keeps a completed row of a two-holder name and a failed row of an environment flow null (CONTROL: ambiguous rows 2 with both candidates named, unpackaged rows 2); the re-run (0 writes) and dry-run pins unchanged and green. dogfood flow-name-per-namespace: a history row of qa_ns_screen_late with no package, written by a test plugin at kernel:ready (before the boot's kernel:bootstrapped backfill), is bound to alpha by the boot; after iota installs the name, GET /automation/alpha/qa_ns_screen_late/runs/:id and the bare door answer 200 'completed', and iota's address answers it exactly as run_nobody. Ablation (committed 6bc837402 first; R8 narrowed back to paused rows): unit 'Tests 1 failed | 22 passed (23)' (r7-r9 stay null); dogfood 'Tests 1 failed | 9 passed (10)', with soft assertions: the column stays null, alpha's address 404 RUN_NOT_FOUND 'Execution not found', the bare door 409 naming alpha and iota (iota's nobody check holds both ways); restored, green. Suites on the final tree: service-automation 277 files / 3779 tests; the 40 dogfood files 40 / 349 (automation-stored-reference-package-column.dogfood.test.ts among them); runtime unchanged since part 1 (583 / 9980 + 4 / 1355). service-automation tsc and check:test-typecheck OK.", "gates": "dispatch-gates --commands on the final tree (38 paths): 81 commands, each exit recorded before any pipe; --ran: '81 derived famil(ies) accounted for — 80 run, 1 NOT-MEASURED (1 DERIVED from a recorded exit 3)' (node scripts/check-plugin-teardown-shape.mjs --self-test, prerequisite). pnpm lint exit 0.", "line_budget": "2522 changed lines (+2366 / -156), 38 files, against merge base be75078a4; this part added 57 (+44 / -13); inside the ~2600 the seat allowed.", "boot_cost": "The pass re-reads null rows on every boot, so after the first boot it walks the rows that stay null: an environment flow's history and an ambiguous name's (terminal history is capped per flow at write time; keyset pages of 500, one read per page).", "files_changed": [ "packages/services/service-automation/src/stored-reference-package-backfill.ts", "packages/services/service-automation/src/sys-automation-run.object.ts", "packages/services/service-automation/src/stored-reference-package-column.test.ts", "packages/qa/dogfood/test/flow-name-per-namespace.dogfood.test.ts", ".changeset/31696-flow-names-per-namespace.md" ], "deviations": [], "open_questions": [], "mcp_calls": "0 GitHub MCP calls.", "api_writes": "This part: 1 git push (1e8987817..6bc837402), 1 relay issue_patch of the PR body (26044 bytes sent, 26044 stored, identical; run 43175448646), plus this post-stamped comment. Running total on the card: 1 relay pr_create, 4 post-stamped comments, 3 relay issue_patch." }objectstack-fleet commentedon Nov 12, 2026
epic:#31527#1 · os-bill · session_01Utp6CYGYEUhpi29FpjLmxT
Epic ruling on the round-3 contract review FAIL at
6bc837402a(PR #32507)The round-2 sequence, should-fix 2 and ruling (b) are closed, each measured and ablated. One must-fix is left: approvals. It is the class R3-A named, a per-run record keyed by flow name that the runtime reads.
R4-A: fix it in this PR. Declaring it and filing a follow-up is not enough. ADR-0150 D9 narrows a type only once its stored references carry the package, and
sys_approval_request.process_nameis D8 row R7. This is the same reading as ruling (b).The writer. When a request opens, stamp
process_packagefrom the run's own package. Today it is null on every row, old and new, and the review measured that.The readers. Read the request's flow from its own slot at every call site in
plugin-approvals/src/approval-service.ts:assertReviseEdge(:6650);attachFlowSteps(:10133);:6206);:7970);armedFlowPackage(:3690).Read by
process_package, else by the request's run (flow_run_id) through the same slot lookup as the run doors. A request whose package cannot be read keeps the 409 naming every holder. Grep the package for any othergetFlow(on a name cut fromprocess_name, and list each call site in the report.R7 backfill. Check that it binds open requests with a null
process_packagefrom the one holder at boot, like R8. The ADR's note says open requests only. If the backfill does not do this, extend it the same way.Pins, on a booted stack.
flow_routeandflow_steps, and resubmit must answer as before.The FROM → TO table gets a row only if an answer still moves after the fix.
The nit: add the bare cancel, the holder's address resume and a finished run's read to the dogfood
[R3]case.Size. This may take the PR to about 2900 changed lines. That is still under 3000, so no human merge is needed. Report before splitting.
Landing. K is 6 now, so there is no need to merge
mainbefore you push. The seat mergesmainat landing if K reaches 15.objectstack-fleet commentedon Nov 12, 2026
epic:#31527#1 · os-bill · session_01Utp6CYAGCZcafN5hk3uj4u
os-dev-report — round 4 (contract review 6817817143, ruling R4-A 6817831965: approvals)
Report taken 2026-11-12T08:32Z.
{ "issue": 31696, "status": "done", "round": "4 (R4-A on the round-3 FAIL at 6bc837402: approval requests read their flow from their own slot)", "branch": "claude/project-thread-wqgmuu", "pr": "https://github.com/objectstack-ai/objectstack/pull/32507", "head": "097cb8f7761898065954997f3c83a0cfcc330be1", "session": "session_01Utp6CYAGCZcafN5hk3uj4u", "premise_still_valid": true, "summary": "1. Writer: openNodeRequest stamps sys_approval_request.process_package with the package of the run's own slot (the slot its key is filed under; the approval node passes the engine's flowKeyOfRun(context)). Every request opened since carries it, on a one-holder name too; an environment-authored flow's request stays null. 2. Readers: one lookup, requestFlowSlot(name, {process_package, flow_run_id}): the slot of the stamped package, else the slot the run's key is filed under (suspensionOf, else getRun: the run doors' rule, exactly one slot), else none, and then the bare getFlow, which answers a one-holder name as before and refuses a shared one naming every holder. Never a pick. Read that way: assertReviseEdge (send-back), attachFlowSteps (flow_route / flow_steps), expectedPauseNode (resubmit from a revise window), flowPackageOf (armedFlowPackage, asked by the slot key: at open and on the legacy re-resolution in decide), and the batch parent above a recalled item (its flowName is the parent run's slot key: read through getRunFlow({flowName: key}), else getFlow as before). The plugin declares the engine's public members it reads (getFlowSlots, flowSlotKey, getFlowSlot, getRunFlow; getRun's flowName; flowKeyOfRun on the node surface); all optional, absent = the bare read. 3. R7 backfill: checked, it binds pending and returned requests with a null process_package from flowHolder (the one holder) at boot, leaves ambiguous and unheld names null and reports them; not extended (D8 note: open requests). Its notes, its warn line, the plugin's failure line and the column comment now name the readers.", "call_sites": "plugin-approvals sources, every flow read on a name cut from process_name, all now through the request's slot: approval-service.ts:6723 assertReviseEdge, :8043 expectedPauseNode (resubmit window), :10206 attachFlowSteps, :4570 and :5417 flowPackageOf (armedFlowPackage), :6278 the batch parent (by run key; :6279 the getFlow fallback for an engine without getRunFlow). No other getFlow( in the package's sources. Names cut from process_name that read no flow: approval-service.ts:7628 the stranded-request report's flowName (display), reader-locale-labels.ts flowNameOfProcess (i18n keys flows.<flow>.*), display-labels.ts (humanized label), stored-process-package-backfill.ts (the R7 backfill, by flowHolder).", "moved_answers": "No answer moves on a name one package holds (its slot is the bare read's). On a name two packages hold, send-back, the request read's flow_route / flow_steps and the resubmit window answer as they did before the second namespace installed it, for requests opened before and after: no FROM -> TO row. The stored column moves (null -> the run's package, written at open): declared under R7 in the changeset and in the body's What changes. A request whose package and run name no one slot keeps the 409 naming every holder (CONTROL).", "tests": "plugin-approvals approval-revise.test.ts, new describe (real engine, P1's revise flow, then P2's flow of the name with no review node): requests opened before (one sent back) and after P2 ships the name carry P1; getRequest has flow_steps and flow_route; send-back answers 'returned'; resubmit resumes; a row with process_package nulled sends back through its run; CONTROL: nulled and flow_run_id 'run_nobody', the send-back rejects naming P1 and P2 and the row stays pending. Booted stack, new approval-flow-name-per-namespace.dogfood.test.ts (alpha's record-after-create approval flow with a revise window; install-local of iota shipping the name): before/back/after store process_package alpha; GET /approvals/requests/:id 200 with flow_steps ['Alpha gate'] and flow_route; revise 200 ('returned') for before and after; resubmit of the request sent back before the install 200; nulled process_package revises 200 through the run; CONTROL nulled + run_nobody: 409 RESOURCE_CONFLICT naming alpha and iota, row pending. Ablation (committed 097cb8f77 first; requestFlow -> the bare getFlow): unit 'Tests 2 failed | 24 passed (26)'; dogfood (soft assertions) both reads without flow_steps / flow_route, revise 409 naming alpha and iota with the request still pending, the nulled request 409; resubmit 200 and the CONTROL 409 hold both ways; restored, green. Nit: flow-name-per-namespace [R3] pauses four LATE runs before iota installs; adds the bare cancel (200, cancelled), alpha's address resume (200, completed) and the finished run's read at alpha's address and the bare door (200, completed). Suites: plugin-approvals 117 files / 1605 tests; dogfood 58 files (the round-3 40, every approval-* dogfood file, every file booting ApprovalsServicePlugin, the new file) 58 / 453, dogfood tsc --noEmit exit 0 (8 GB heap); pnpm lint exit 0. plugin-approvals pnpm typecheck OK (check:test-typecheck: no ledger growth).", "not_pinned": "Read, not pinned: the batch parent (getRunFlow by the parent's key), the resubmit-window check (expectedPauseNode, reached on a stranded continuation) and flowPackageOf (a queue approver's package). Each reads through the same lookup the pinned sites use; the batch parent through the engine's own run-key read.", "gates": "dispatch-gates --commands on the round-4 tree (45 paths): 85 commands, each exit recorded before any pipe; --ran: '85 derived famil(ies) accounted for — 84 run, 1 NOT-MEASURED (1 DERIVED from a recorded exit 3)' (node scripts/check-plugin-teardown-shape.mjs --self-test, prerequisite, as in rounds 2-3).", "line_budget": "2866 changed lines (+2681 / -185), 45 files, against merge base be75078a4; this round +318 / -32 against 6bc837402 (9 files); inside the ~2900 the seat allowed. main not merged (K = 6).", "residuals": "Approval requests decided before this release carry no process_package (the backfill binds open ones): they read through their run; once the name is shared and the run's record has left history, the read shows no route (the refusal, never another holder's flow).", "files_changed": [ "packages/plugins/plugin-approvals/src/approval-service.ts", "packages/plugins/plugin-approvals/src/approval-node.ts", "packages/plugins/plugin-approvals/src/approvals-plugin.ts", "packages/plugins/plugin-approvals/src/stored-process-package-backfill.ts", "packages/plugins/plugin-approvals/src/sys-approval-request.object.ts", "packages/plugins/plugin-approvals/src/approval-revise.test.ts", "packages/qa/dogfood/test/approval-flow-name-per-namespace.dogfood.test.ts", "packages/qa/dogfood/test/flow-name-per-namespace.dogfood.test.ts", ".changeset/31696-flow-names-per-namespace.md" ], "deviations": [], "open_questions": [], "mcp_calls": "GitHub MCP: read-only (issue_read: the card, the ruling, the reviews). No GitHub MCP write.", "api_writes": "This round: 1 git push (6bc837402..097cb8f7761898065954997f3c83a0cfcc330be1), 1 relay issue_patch of the PR body, plus this post-stamped comment. Running total on the card: 1 relay pr_create, 5 post-stamped comments, 4 relay issue_patch." }objectstack-fleet commentedon Nov 12, 2026
epic:#31527#1 · os-bill · session_01Utp6CYGYEUhpi29FpjLmxT
Landed
b96b87579, an ancestor oforigin/main3948deb57d550d78daa82fb36450d3b57dc68ceb(seat record 6820205161)Fixes)Status:
pm:dispatchedandpm:blockingremoved here. The follow-up child #32647 stays open.Owed on
main: the changeset.changeset/31696-flow-names-per-namespace.mdlanded withadr-0087: not-required (no-migration-prescription)on a declaredMetadata-protocol: narrowed, which #32649 (merged at 09:23Z, before this PR's queue run) now refuses. A follow-up PR from this card's thread adds the semantic entryflow-by-name-read-shared-or-unreachable-refusedand switches the line toregistered.Next in the chain: #32513 (#31700) and #32497 (#32183) merge
main.Merge remote-tracking branch 'origin/main' into claude/project-thread…
Merge origin/main into claude/project-thread-3giljf
objectstack-fleet commentedon Nov 12, 2026
coordinator#1 · huangyiirene · session_01J8VVAmYgf86vDvSwsNtaf7
Carrier filed for the inbound-hook skill line that rulings 6794435934 (item 2) and 6794825287 deferred until after the switch: #32776 (
domain:skills, p1 inherited, maintainer-ordered). The skills part #32416 merged at 4640647.