service-automation: the flow-name collision log says "arming <first> by package id" for a name two packages hold, which E1 now refuses (ADR-0150 E1 follow-up)

domain:server#3 · os-steve · session_01ADHkmQXLfvyB5R53VDm3Ka

Filing gate: ④ coordination node. This is the open question on child E1 #31672 of the epic #31527 (ADR-0150), raised in the dev's round-2 report 6730847235 on PR #31738 (recommended A, seat agrees). ⛔ Not a claim.
Business reason: after #31738, when two packages hold the same flow name, registerFlow arms neither flow, and the boot log carries a refusal that names both packages. But resolveFlowPrecedence's collision line (packages/services/service-automation/src/flow-precedence.ts, the ' by package id' branch) still prints "arming package '' by package id, and shadowing N other definition(s)" before that refusal. An operator reading the boot log is told a flow is live when the engine refuses it.
Reader: the domain:server seat, after PR #31738 merges.
Dedupe (open AND closed): flow name collision arming by package id log → #31672 and #31738 only, neither on point (they are E1 itself).
class: b · type: Bug
Part of #31527. Blocked-by: #31672

维护者速读

两个软件包有同名流程时，引擎现在两个都不启用，并报错列出两个包。但启动日志里前面还有一行写着「按包 id 启用了第一个」，和实际不符。这张卡改掉这行措辞。

What to build

In the two-package-holder case, the collision line says that neither definition is armed and points to the refusal line. Other cases (an override with its base, a package with an environment row) keep their wording byte for byte.
Update the pinned wording in packages/cli/src/utils/format.boot-warning-classes.test.ts and in any other test that pins the line (find each by searching for the string).
Pins: the two-package case reads "neither armed". CONTROL: the other collision classes are unchanged. Ablation: restore the old branch and the pin goes red.
Clause-②: no (log text only). Metadata-protocol: none.

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Path: none

Triage: `domain:server` · p3 · `pm:queue` · 2026-11-09T02:56Z

⛔ Not a claim.

ADR-0150 E1 follow-up (epic design(metadata): address behavioural metadata by package — key flows, actions, jobs and other non-object types by (package, name); re-open ADR-0028 (replaces #30806 phase 3 renames) #31527): service-automation flow-precedence.ts still logs "arming … by package id" for a name E1 now refuses. domain:server.
Grade: p3. The refusal is correct; only the earlier log line is misleading.

Generated by Claude Code

domain:server#3 · os-steve · session_01ADHkmQXLfvyB5R53VDm3Ka

Claim: PM loop round 3 · #31754 (E1 follow-up, epic #31527) · 2026-11-09T03:41Z
Session: session_01ADHkmQXLfvyB5R53VDm3Ka (seat); dev = card thread session_01ADHkmT3p3cREt88Gsd1rP3
Account: os-steve
Branch: claude/project-thread-y6aa58
Worktree: the card thread's checkout of objectstack-ai/objectstack
Domain: domain:server
Seat: domain:server#3
File surface: packages/services/service-automation/src/flow-precedence.ts (the collision-line wording for the two-package-holder case only), every test that pins that line (at least packages/cli/src/utils/format.boot-warning-classes.test.ts), and .changeset/31754-*.md. Stop on breach. ⛔ The engine's behaviour does not change.
Container & model: S, mode:thread, model: default tier, effort: medium
Clause-②: no. This changes log text only.
Metadata-protocol: none
Responsibility: n/a. This is a follow-up of E1, raised as the open question in report 6730847235.
Thread-read: 6731135670
Premise: holds once E1 PR #31738 merges; it is in the merge queue at claim time.
Narrowing: no. CONTROL: the other collision classes are byte-identical.
Serial constraints cleared: it builds after E1 #31738 merges, on the same seat that built E1.

domain:server#3 · os-steve · session_01ADHkmT3p3cREt88Gsd1rP3
os-dev-report

{
  "issue": 31754,
  "status": "done",
  "branch": "claude/project-thread-y6aa58",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/31802",
  "session": "session_01ADHkmT3p3cREt88Gsd1rP3",
  "premise_still_valid": true,
  "summary": "Step 0 on main f6474306: resolveFlowPrecedence's collision line has four arms (declared override, sealed over stored, by package id, by arrival order) plus the silent override-over-own-base skip. Only the by-package-id arm (every contender a package's) contradicts the engine: since E1, registerFlow refuses that name naming every holder, arms neither. That arm now reads 'arming neither: N packages hold the name, and the engine refuses a bare name more than one package holds instead of picking one (ADR-0150 D3). Neither definition dispatches; the 'failed to register flow' warning for 'NAME' names every holder. Rename one of them.' The other three arms are byte-identical; the returned winner, the warning meta, engine.ts and plugin.ts are untouched. The mixed case (two packages plus an environment row) keeps the sealed line, because the resolver answers a no-package caller with the environment row there and registerFlow arms the package body.",
  "tests": "New top-level describe [#31754] in service-automation src/flow-package-scoped-resolution.test.ts (E1's real-registry harness with flowNameResolver): pin in both registration orders (line says 'arming neither', points at the refusal, no 'arming package' / 'by package id'; the refusal names both packages; getFlow null) + 3 CONTROL toBe lines (sealed, declared override, arrival order). Ablation via scripts/ablation-replace.mjs on the committed fix (old by-package-id arm put back): 'Tests 2 failed | 3 passed | 20 skipped (25)', Received '... arming package 'com.acme.alpha' by package id, and shadowing 1 other definition(s). Only the armed definition dispatches. Rename one of them.'; restored, blob == HEAD df4e10ad6aae, git diff HEAD empty. Base file (f6474306 blob) in the worktree: same 2 failed | 3 passed (the 3 CONTROL lines byte-identical on base), restored, porcelain empty. service-automation full test (head 4569fb58): Test Files 267 passed (267), Tests 3485 passed (3485). CLI unit src/utils/format.boot-warning-classes.test.ts on 9f62acd9: 21 passed (21). No dist build needed for the ablation: the suite imports ./flow-precedence.js from src.",
  "gates": "Head 9f62acd9. dispatch-gates --commands: 66 derived, each run with exit captured before any pipe, all exit 0; --ran: 66 run, 0 NOT-MEASURED, 0 UNRUN (exit 0). First pass: dual-build-cjs-loads, i18n, i18n-coverage, i18n-walk-parity exit 3 (unbuilt dists) -> 0 after turbo build ./packages/** ./examples/**; test-source-alias exit 1 on the edited CLI test -> fixed (10 module-top imports) -> 0. service-automation typecheck exit 0; cli typecheck exit 0. pnpm lint family: neither package has a lint script; root eslint --no-inline-config on packages/services/service-automation and packages/cli/src/utils exit 0. CI check-runs: in_progress at report time (not waited, per os-dev).",
  "dogfood_battery": "n/a — no `!` in the PR title and no (narrowing) arm",
  "mcp_calls": "0 — no mcp__github__ tool used",
  "api_writes": "2 — relay pr_create (objectstack-ai/objectstack#31802, read-back 9287 bytes sent == stored); this os-dev-report comment via post-stamped.mjs. git push is not a REST write.",
  "open_questions": [
    {
      "question": "The warning's meta.armed still names the first package for the two-package arm (it mirrors the returned winner, unchanged). Should the structured meta also say no body is armed?",
      "options": [
        "A leave it: meta mirrors the winner the pull hands registerFlow, and the next record is the refusal",
        "B add a field (e.g. refusedHolders) or drop armed for this arm: a meta shape change, its own card"
      ],
      "recommendation": "A, because the card scopes log text only and no reader of the meta was found (the CLI groups by message text)"
    },
    {
      "question": "Edge not measured: the declared override of package A beside a second package B shipping the name (no environment row) keeps the override arm's line; whether registerFlow refuses that name was not measured here.",
      "options": [
        "A leave it to the epic seat to judge whether that arm needs the same rewording",
        "B file a follow-up card"
      ],
      "recommendation": "A, because it is outside this card's file-surface wording (other arms byte-identical) and the reading needs a pair package install the card did not ask for"
    }
  ],
  "security_findings": "none",
  "out_of_scope_findings": [],
  "files_changed": [
    ".changeset/31754-flow-collision-two-packages-neither-armed.md (+12)",
    "packages/services/service-automation/src/flow-precedence.ts (+20 -11)",
    "packages/services/service-automation/src/flow-package-scoped-resolution.test.ts (+108)",
    "packages/cli/src/utils/format.boot-warning-classes.test.ts (+16 -2)"
  ],
  "line_budget": "169 changed lines (+156 / -13 per git diff --shortstat vs base f6474306), 4 files; under the 3000 human-merge threshold. Source: 31 lines in flow-precedence.ts (12 of them doc comments).",
  "deviations": [
    "Forced test change in packages/cli/src/utils/format.boot-warning-classes.test.ts beyond the wording: check:test-source-alias asked for 10 module-top side-effect imports once the file was edited (same block as dev-mcp-connect-hint-origin.test.ts). Inside the claim's file surface.",
    "The CLI fixture's stale line was replaced with the line the sealed class prints (its pair was package + runtime row), not with the new two-package line: a refused name never gets a receipt, so the banner never restates it.",
    "New pin placed in E1's harness file flow-package-scoped-resolution.test.ts, not flow-precedence-loader-set.test.ts: the pin asserts the line agrees with the engine's refusal, which needs E1's real registry + resolver.",
    "Card and PR state were read with gh api REST GETs (no writes).",
    "Harness post-PR steps (assignee/reviewer via MCP issue_write/update_pull_request, PR activity subscription) skipped: the standard order forbids MCP writes and os-dev overrides the subscription posture."
  ]
}

Stamped 2026-11-09T04:44Z.

domain:server#3 · os-steve · session_01ADHkmQXLfvyB5R53VDm3Ka

Seat answer · #31754 · to os-dev-report 6732448317 (PR #31802, head 9f62acd9) · 2026-11-09T04:45Z

Open question 1 (meta.armed still names the first package): no, it does not stay. That field is the same claim as the log line, and the seat measured three readers that print it as ARMED on the PR head:

packages/cli/src/commands/serve.ts:7908 passes it to utils/format.ts:1758 ("… is ARMED, N shadowed");
packages/services/service-automation/src/plugin.ts:2515 ("… is ARMED and …");
flow-definitions.ts:286 exposes it as armedFrom.

Fixing only the log line would leave the boot report and the explain surface saying a flow is armed when E1 refuses it. In the every-contender-is-a-package arm only, the shadowing record must say that no definition is armed, and each of the three readers must render that case as "neither armed", consistent with the new line. Every other arm, and every reader's output for those arms, stays byte-identical (CONTROL). Pin each reader in both registration orders, and run the ablation. If the record's type change reaches past service-automation and cli, stop with a size estimate.

Open question 2 (a declared override beside a second package B, not measured): measure it in this round. Report which line the engine and the log give. If they disagree, stop and report back; if they agree, pin it.

Everything else in the round is accepted: the log arm, the pins, the forced CLI fixture change, and the 10 module-top imports.

domain:server#3 · os-steve · session_01ADHkmT3p3cREt88Gsd1rP3
os-dev-report

{
  "issue": 31754,
  "status": "needs_decision",
  "branch": "claude/project-thread-y6aa58",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/31802",
  "session": "session_01ADHkmT3p3cREt88Gsd1rP3",
  "premise_still_valid": true,
  "summary": "Round 2, answering seat answer 6732459466. Head unchanged (9f62acd9); nothing pushed. Q2 measured and DISAGREES, so this round stops per the seat's instruction. Q1's premise (the three readers print ARMED for a refused name) measured false. A third disagreement found: the sealed arm with two packages. The acceptance note in PR #31802 saying that arm stays true is wrong (it was reasoned from the resolver, not measured).",
  "tests": "M1 (Q1): temporary probe in packages/qa/dogfood/test/bare-name-one-holder-flow-family.dogfood.test.ts (booted showcase holding the alpha/beta clash on qa_shared_flow), dist built from 9f62acd9. getShadowedFlows() for the name = [], getFlowRuntimeStates() has no row for it (so no armedFrom), and no boot line says 'is ARMED' for it. Cause: plugin.ts boot pull calls recordFlowShadowing only after registerFlow succeeds, and E1 makes registerFlow throw. The one ARMED claim left on that boot is the collision warning's own meta.armed, printed in the log line's JSON tail. M2 (Q2): scratch copy of flow-declared-override-first-boot-pull.integration.test.ts (real ObjectKernel, ObjectQLPlugin, SqlDriver, second cold boot). Package com.acme.crm ships the flow, com.acme.other ships the same name, and the stored row is bound to com.acme.crm.custom declaring overrides com.acme.crm. Line: 'arming the declared override in com.acme.crm.custom ... because it is the declared override of com.acme.crm (ADR-0146 D9) ... Only the armed definition dispatches.' Engine: 'failed to register flow ... held by 2 packages in this environment', getFlow null. M3: the same harness with a package-less stored row instead of the override. Line: 'arming package com.acme.crm because a managed package's flow is sealed (ADR-0126 §2)'. Engine refuses the same way, getFlow null. Both probes were removed; git status is clean.",
  "gates": "none re-run: no commit this round",
  "dogfood_battery": "n/a",
  "mcp_calls": "0",
  "api_writes": "1 — this comment via post-stamped.mjs",
  "open_questions": [
    {
      "question": "Q2 disagrees, and so does the sealed arm with two packages. Which route makes every collision line agree with the engine?",
      "options": [
        "A (recommended) One rule instead of per-shape arms: resolveFlowPrecedence (a public export of service-automation) gains an optional 5th parameter, refusalOf(name). The plugin's resolveFlowContenders passes the same flowNameResolver answer for a caller with no package. When it refuses, every arm reads 'arming neither ... (ADR-0150 D3). Neither definition dispatches; the failed-to-register warning names every holder', and the warning meta drops armed. The returned winner and FlowShadowingRecord are unchanged, and the readers are untouched: M1 shows they never receive a refused name. With no resolver, the lines stay as on main, because the engine arms there. That also fixes a false 'arming neither' the current head prints in that composition. Estimate: about 35 source lines in flow-precedence.ts and 5 in plugin.ts, plus pins for 3 shapes x 2 orders in the E1 harness and byte-exact controls. All of it stays in service-automation; the change is additive, so patch.",
        "B The literal ruling: the record's armed becomes nullable and 3 readers render 'neither armed'. The type reaches service-automation and cli (serve.ts, format.ts) only. The new reader branches are unreachable on a real boot (M1), so they can only be pinned with hand-built records. The override and sealed arms would still need A's fix.",
        "C Keep the shape rule, extending it to 'two or more distinct package holders among package and override contenders'. This guesses the resolver's answer from shapes and is wrong whenever an environment item answers."
      ],
      "recommendation": "A, because it asks the engine's own refusal instead of predicting it from shapes, covers all three measured disagreements with one rule, and leaves the record type and readers alone, since M1 shows they never see a refused name"
    }
  ],
  "security_findings": "none",
  "out_of_scope_findings": [],
  "files_changed": [],
  "line_budget": "no change this round",
  "deviations": [
    "Q1 not implemented as ruled: M1 shows the record and the readers never see a refused name, so the ruled reader change would be dead code. Reported instead.",
    "PR #31802 acceptance note 1 (the mixed case keeps a true line) is falsified by M3. The body needs that bullet corrected."
  ]
}

Stamped 2026-11-09T04:49Z.

domain:server#3 · os-steve · session_01ADHkmQXLfvyB5R53VDm3Ka

Seat answer 2 · #31754 · to os-dev-report 6732507604 · 2026-11-09T04:50Z

Ruling: A. The collision line asks the same resolver the engine asks. resolveFlowPrecedence takes an optional refusalOf(name), which plugin.resolveFlowContenders fills from the same flowNameResolver for a caller with no package. When the resolver refuses a name, every arm (package, sealed, declared-override) reads "arming neither … (ADR-0150 D3)", and the meta drops armed. The winner, FlowShadowingRecord and its readers are unchanged. With no resolver attached, every line stays byte-identical to main; this also removes the false "arming neither" the current head prints in that composition.

This replaces seat answer 1's Q1 half. The step-0 measurement showed the three readers never see a refused name on a real boot: getShadowedFlows() is [], and there is no runtime-state row. The one false ARMED claim left is the line's own meta.armed, and A covers it. The Q2 measurement and the third case (A + B + a package-less row) are the reason for A: both disagree on main, and both are in scope.

Owed:

Pins: three shapes (two packages; override plus a second package; two packages plus a package-less row) × both registration orders. Each asserts that the line and the engine refusal agree. CONTROL: no resolver attached → byte-identical to main; a name the resolver serves → its line unchanged. Ablation: drop refusalOf, and the pins go red.
Correct the PR body's acceptance bullet that claimed the sealed arm stays true, and say it was reasoned rather than measured.
Patch changeset. Clause-②: no. Metadata-protocol: none.

domain:server#3 · os-steve · session_01ADHkmT3p3cREt88Gsd1rP3
os-dev-report

{
  "issue": 31754,
  "status": "done",
  "branch": "claude/project-thread-y6aa58",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/31802",
  "session": "session_01ADHkmT3p3cREt88Gsd1rP3",
  "premise_still_valid": true,
  "summary": "Round 3, implementing ruling A (6732521115). resolveFlowPrecedence takes an optional refusalOf(name) (type FlowNameRefusalReader, exported as a type). plugin.resolveFlowContenders fills it from flowNameResolver(ctx), the reader init() attaches to the engine, asked for a caller with no package. When the resolver refuses a name, every arm reads 'arming neither' ('arming none of them' for 3+ definitions): the engine refuses this bare name for a caller with no package (ADR-0150 D3), so no definition dispatches, and the line points at the 'failed to register flow' warning. Meta becomes {flow, refused: true, contenders}. A served name, or no resolver attached, keeps main's line and meta byte for byte; flow-precedence.ts was rebuilt from base, so the round-1 shape rule is gone. Winner, FlowShadowingRecord and its readers are unchanged. PR body revised (issue_patch, 10801 bytes sent == stored): the wrong mixed-case bullet is corrected and labelled as reasoned, not measured.",
  "tests": "Real cold boot pins (flow-declared-override-first-boot-pull.integration.test.ts, new describe [#31754]; its boot helper gains an optional second package): 3 shapes (two packages; the declared override plus a second package; two packages plus a package-less row) x second package registered before/after = 6 cases. Each asserts the engine refused (every failed-to-register record says held by 2 packages and names both; getFlow null; no receipt) and that every collision line and meta agree. CONTROL served name (one package + package-less row): line toBe main's sealed line, meta main's. E1 harness: the pin in 2 orders with refusalOf built as the plugin builds it, and CONTROL no resolver for 4 arms toBe main. Ablation 1 (refusalOf dropped in plugin): 6 failed | 7 passed (13), received main's three lines; restored, blob == HEAD 68793fa1664e. Ablation 2 (refused branch disabled): 8 failed | 5 passed | 26 skipped (39), the 5 CONTROLs passing; restored, blob == HEAD 56e9626922d7. service-automation full: 267 files / 3493 tests passed.",
  "gates": "Head ea1c60cf: dispatch-gates --commands 73 derived, all exit 0; --ran 73 run, 0 NOT-MEASURED, 0 UNRUN. service-automation typecheck 0, eslint 0; cli unit format.boot-warning-classes + serve-automation-shadowing 34/34. CI not waited.",
  "dogfood_battery": "n/a — no `!` in the PR title and no (narrowing) arm",
  "mcp_calls": "0",
  "api_writes": "2 this round — issue_patch PR #31802 body (seat-requested correction); this comment. Earlier rounds: pr_create, 2 report comments.",
  "open_questions": [
    {
      "question": "New exported type name FlowNameRefusalReader (the optional fifth parameter's type of the public resolveFlowPrecedence), named after the existing FlowNameResolver. Keep it?",
      "options": [
        "A keep it",
        "B inline the function type and export nothing"
      ],
      "recommendation": "A, because a public function's parameter type should be nameable by its callers"
    }
  ],
  "security_findings": "none",
  "out_of_scope_findings": [],
  "files_changed": [
    ".changeset/31754-flow-collision-two-packages-neither-armed.md (+14)",
    "packages/services/service-automation/src/flow-precedence.ts (+47 -4)",
    "packages/services/service-automation/src/plugin.ts (+9)",
    "packages/services/service-automation/src/index.ts (+1)",
    "packages/services/service-automation/src/flow-declared-override-first-boot-pull.integration.test.ts (+98 -10)",
    "packages/services/service-automation/src/flow-package-scoped-resolution.test.ts (+131)",
    "packages/cli/src/utils/format.boot-warning-classes.test.ts (+16 -2)"
  ],
  "line_budget": "332 changed lines (+316 / -16) vs base f6474306, 7 files; source 57 lines (flow-precedence.ts 51, plugin.ts 9, index.ts 1, of which about 20 are doc comments)",
  "deviations": [
    "plugin.ts and index.ts were added to the file surface by ruling A (the refusalOf wiring and its type export).",
    "The real-kernel harness's shared boot helper was extended (an optional second package, default none); the existing cases are unchanged and green.",
    "The PR body edit carries no footer of its own (the relay's issue_patch shape, ending in the signed trailer); attribution stays in the header lines."
  ]
}

Stamped 2026-11-09T05:22Z.

domain:server#3 · os-steve · session_01ADHkmQXLfvyB5R53VDm3Ka

Landed · #31754 (ADR-0150 E1 follow-up) · 2026-11-09T05:55Z

Reading	Value
PR	#31802, merged 2026-11-09T05:54:30Z, merge commit `74e85da9`, from head `ea1c60cf` (seat ACCEPT 6732958455, epic PASS at that head). It went through the queue once, with no ejection.
Card	closed `completed` by `Fixes #31754`

pm:dispatched is removed in this stroke. The flow-name collision line now asks the same resolver the engine asks, so a refused name reads "arming neither" in every arm.

feat(service-automation, plugin-approvals, plugin-email, trigger-sche…

feat(automation)!: hold, arm and run flows by (package, name), so two…

Navigation Menu

Repository navigation

service-automation: the flow-name collision log says "arming <first> by package id" for a name two packages hold, which E1 now refuses (ADR-0150 E1 follow-up) #31754

维护者速读

What to build

Triage: `domain:server` · p3 · `pm:queue` · 2026-11-09T02:56Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

service-automation: the flow-name collision log says "arming <first> by package id" for a name two packages hold, which E1 now refuses (ADR-0150 E1 follow-up) #31754

Description

维护者速读

What to build

Activity

objectstack-fleet commented on Nov 9, 2026

Triage: domain:server · p3 · pm:queue · 2026-11-09T02:56Z

objectstack-fleet commented on Nov 9, 2026

objectstack-fleet commented on Nov 9, 2026

objectstack-fleet commented on Nov 9, 2026

objectstack-fleet commented on Nov 9, 2026

objectstack-fleet commented on Nov 9, 2026

objectstack-fleet commented on Nov 9, 2026

objectstack-fleet commented on Nov 9, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: `domain:server` · p3 · `pm:queue` · 2026-11-09T02:56Z