[objectstack-fleet]

Requested by Steve · project thread
Fixes #31672

Clause-②: no (narrowing)
Metadata-protocol: none
Narrowing: (1) D3 (a), as the card declares: a package flow's bare subflow / map reference whose only holder is an environment-authored flow is refused (outside-closure, naming the environment). (2) D3 step 3, ruled inside ADR-0150 by the epic seat (#31527 comment 6728487836): a package flow's bare reference whose only holder is a package outside its declared dependency closure is refused (outside-closure, naming that package). Measured first-party for (1) and (2): 0, including the sibling-in-one-artifact sub-case (ADR-0130 co-ownership): 0. (3) A flow name two packages hold, which only a deployment sealed at its cold boot with a clash that predates phase 1 reaches (#31677 Q1, ruled A, comment 6729831159): arming it is refused and a run of it is refused, naming both, so neither flow is armed (it used to arm the lexicographically first package's flow). Measured first-party: 0. Methods under Verification.
Skills-docs: follow-up #31741

epic:#31527 child E1 · domain:server#3 · dev session session_01ADHkmQjmHnuYAuaRd9k252

维护者速读

• 改了什么：流程引擎按（软件包, 名称）解析裸流程名，全部经 R 的共享解析器 resolvePackageScopedName。软件包内流程的子流程/映射节点先找本包，再找它声明依赖闭包里唯一的持有者，否则拒绝并列出全部候选。两个软件包同名的流程（包括冷启动封存的 phase 1 之前的旧冲突）在注册和运行时都拒绝，不再按包名字典序挑一个。启停台账按（软件包, 名称）生效：过期行仍然关闭当前持有者，并警告一次。
• 为什么改：专题 design(metadata): address behavioural metadata by package — key flows, actions, jobs and other non-object types by (package, name); re-open ADR-0028 (replaces #30806 phase 3 renames) #31527 子卡 E1（ADR-0150 D3/D4），以及 webhooks, connectors, email templates on (package, name) (ADR-0150 child E5) #31677 Q1 裁决 A。
• 风险与回滚：收窄三处，第一方实测都是 0 处。单持有者的裸名、REST 门、触发器行为不变。phase 1 的 2 条 dogfood 用例按裁决改为读拒绝。回滚即还原本 PR。
• 先看：engine.ts 的 registerFlow 与 execute 两处 flowNameRefusal 闸门；plugin.ts 的 flowNameResolver；flow-activation-projection.ts。
• 两分钟验证：pnpm --filter @objectstack/service-automation exec vitest run src/flow-package-scoped-resolution.test.ts，预期 20 条全绿。
• 需要你做的：无。席位在史诗席复核通过且 CI 绿后落地。

What changes

Step 0 — every read point that looks a flow up by bare name today (on origin/main b126c13):

#	Read point	File / symbol	Caller	This PR
1	arming a name (boot pull, kernel:ready bind, reload re-sync, mutation sync all end here)	engine.ts registerFlow (via plugin.ts resolveFlowContenders → flow-precedence.ts resolveFlowPrecedence, which arms the lexicographically-first package on two package holders)	no package	gated: the resolver is asked for a caller with no package; a name two packages hold is refused, naming both, and nothing is armed
2	running a flow by name	engine.ts execute (this.flows.get(flowName))	doors, triggers (no package); subflow / map children (the calling flow's package)	gated: the resolver is asked for the caller's package
3	subflow / map child name	builtin/subflow-node.ts, builtin/map-node.ts → engine.execute(flowName, childContext)	the parent flow's package (childContext.flowName, stamped by resolveRunContext)	resolved through #2
4	activation ledger projection	flow-definitions.ts hydrateFlowActivations, toggleFlow; read by isFlowEnabled, describeDisabledFlow, the §7.3 subflow guards (subflow-guards.ts)	—	keyed by (package, name) (FlowActivationProjection)
5	which package ships a name	engine.ts packagedFlowOwner (the loader's set, plugin.ts packagedFlowReader)	—	unchanged; it is now also the caller package of #2 and the holder #4 reads
6	context-free by-name reads	getFlow, getFlowRegistration, toggleFlow, getFlowVersionHistory, rollbackFlow, unregisterFlow, flowCredentialHoldings	no package	unchanged: they read the engine's one armed slot per name, which #1 now fills only for a name with one holder
7	stored references by flow name	run store (flowName), credential channel, dispatch keys, approvals flow:NAME, history by checksum	—	not here: S3 #31684 (R7–R10, R14, R20) adds the package columns
8	screen node getFlow(flowName)	builtin/screen-nodes.ts	the run's own flow	unchanged: reads the running flow's own definition

Step 1. Both gates call one engine seam, flowNameRefusal, which asks the reader the host attaches (setFlowNameResolver, new). The automation plugin attaches flowNameResolver(ctx): resolvePackageScopedName from @objectstack/objectql over the ObjectQL registry, read at question time (the startup-registry rule). ⛔ No second resolver and no first-registered fallback: the engine reads only the resolver's refused answer; resolved and not-found leave the existing path (a name the registry knows nothing of has one holder, the engine's own map).

• Caller package. execute reads context.flowName, which the engine stamps on every run context (resolveRunContext), so a child call carries its parent's name; the caller package is that flow's packagedFlowOwner, or none for a door, a trigger, or an environment-authored flow (ADR-0150 D3: an environment item resolves as a caller with no package).
• Arming. registerFlow asks for a caller with no package, so a name two packages hold (ambiguous-in-environment) throws the resolver's sentence before anything is armed. Each of the four call sites already catches a registration throw and logs it as a warning carrying the flow and the sentence naming both packages (the boot pull's is [Automation] failed to register flow).
• Activation. flowLedgerDisabled becomes a FlowActivationProjection that keeps each row's package and state. The row of the package that ships the name decides for it, in either state. A row of another package that still holds the name keys only that package's flow (D4). A stale row, whose package no longer holds the name, still switches the shipping package's flow off, as before rows were keyed, and is warned once naming both packages and the remedy: switch the flow again, which writes the shipping package's own row (epic seat ruling B on Q3). "Still holds" is the resolver reaching that package's own flow; with no resolver it reads as stale, so the row keeps the flow off. A row naming no package binds to the one holder (D8's backfill reading). The two writers stay hydrateFlowActivations and toggleFlow (the existing pin in flow-activation-ledger.test.ts holds).
• Dependency. @objectstack/objectql is a runtime dependency of service-automation. E5 made that move on main first, so after the merge it is no longer in this diff. No cycle: objectql's runtime workspace closure (11 packages) does not contain service-automation; pnpm check:workspace-manifest-cycles green. The flow reader asks for the registry slice through E5's packageScopedRegistryOf, so the slice is checked in one place.

ADR-0150's four readings.

• (a) Phase 1's one-holder tests stay green: flow stays in BARE_NAME_ONE_HOLDER_TYPES and this PR touches nothing in objectql. Of phase 1's dogfood pins, exactly the two that read the sealed clash's armed flow move to the refusal, as webhooks, connectors, email templates on (package, name) (ADR-0150 child E5) #31677 Q1 rules; every other pin is unchanged.
• (b) Bare-name behaviour is unchanged for every name with one holder, except the declared narrowing: a door, a trigger, MCP and the SDK reach execute with no run context, so they resolve environment-wide, and a name with one holder resolves (pinned: reading (b) block, plus the door control in the red-line-1 block).
• (c) No migration in this PR.
• (d) Clause-②: no (narrowing); no protocol change, so no ADR-0087 migration entry (not-required (no-migration-prescription) in the changeset).

Tests

New src/flow-package-scoped-resolution.test.ts (20 cases) over a real SchemaRegistry (packages through installPackage, so the declared closure is the save door's) and the plugin's own flowNameResolver:

• own flow, closure holder, environment caller to a package holder, engine-only flow: all run;
• red line 1: D3 (a) refused naming the environment; D3 step 3 refused naming the stranger package; the door control runs the same environment flow;
• red line 2: a name two packages hold is refused at registration naming both, nothing armed; a door run of a sealed clash is refused naming both; a package caller whose closure holds the name twice is refused naming both; control: one holder arms;
• reading (b): a door runs a packaged flow by its bare name; with no resolver attached a subflow reaches an environment flow as before;
• D4: the shipping package's row switches its flow off, a row of another package that still holds the name does not; a stale row still switches the holder off, is warned once naming both packages and the remedy, and the remedy works; the toggle door writes and reads under the shipping package; four FlowActivationProjection unit cases.

Forced test changes: packages/qa/dogfood/test/bare-name-one-holder-flow-family.dogfood.test.ts, the two pins that read the sealed clash's flow as armed (armedFlowLabel('qa_shared_flow') === 'alpha flow', in the cold-boot case and the third-package install case) now read it unarmed and find the refusal naming both packages in the boot log. The seat directed this after #31677 Q1 was ruled A. The file's header now states the refusal. No other existing test changed.

Acceptance notes

• D4's "all same-named flows arm" is not done here. The engine keeps one armed slot per bare name and refuses a name two packages hold. Per the epic seat, arming both is a prerequisite of B objectql: narrow the phase-1 one-holder refusal from environment to namespace for flow (ADR-0150 child B, flow family) #31696 (which narrows phase 1 for flows), not of S3: it becomes reachable only when phase 1 stops refusing a second flow holder.
• A missing resolver slice refuses nothing. An engine with no ObjectQL registry answers as before; accepted while phase 1 refuses for flow. B objectql: narrow the phase-1 one-holder refusal from environment to namespace for flow (ADR-0150 child B, flow family) #31696 must fail closed on a missing slice or prove every composition carries it (the epic seat's recorded obligation, same as E5's).
• The precedence's collision line still says "arming … by package id". For two package holders resolveFlowPrecedence still logs Flow name collision: … arming <first> by package id, and the refusal line follows it naming both. The wording is pinned by packages/cli/src/utils/format.boot-warning-classes.test.ts, outside this card's file surface, so it is reported as a follow-up and not changed here.
• The §7.3 subflow guards still list callers by bare reference, so a caller whose reference is now refused still counts as reaching the child (a stricter guard, unchanged from today).
• A refused child call answers success: false with the resolver's sentence and no code: no new error code is minted. The doors' 409 RESOURCE_CONFLICT for an ambiguous bare address is G1's (D5). E2 (actions) and E6 (api endpoints) callers execute with no caller package until their cards land (seat: A).

Verification

Ablations (each refusal and ledger pin; mutation through scripts/ablation-replace.mjs on a committed head, restored, blob == HEAD, git diff HEAD empty)

• The registerFlow gate deleted (head c2f2031): Tests 1 failed | 19 passed (20): the two-holder registration pin goes red.
• The execute gate deleted (head c2f2031): 4 failed: D3 (a), D3 step 3, the sealed-clash door run and the ambiguous-in-closure caller all go red (the child runs: this is also the base reading, the behaviour on main).
• The projection's "still holds" check replaced by continue (head 4cf79d48): Tests 2 failed | 15 passed (17): the stale-row engine pin and unit pin go red.
• The stale-row report deleted (head 4cf79d48): 2 failed | 15 passed (17): the same two pins go red on the warning.
• The holder's own row no longer deciding (head 4cf79d48): 3 failed | 14 passed (17): the foreign-holder row, stale-row remedy and toggle pins go red.

First-party narrowing measures

• (1), (2): every type: 'subflow' / type: 'map' node in examples/** and packages/** outside tests and the spec (git grep on b126c13): 5 nodes, all in examples/app-showcase, naming showcase_notify_owner, showcase_closure_signoff, showcase_one_task_signoff, showcase_recalc_task_estimate, all flows of the same package. Refused by D3 (a): 0; by D3 step 3: 0; sibling-in-one-artifact sub-case: 0.
• (3): across every boot of the full dogfood battery (bcc5ba6), the cold boot's Bare-name conflict at boot warning appears 4 times and names one flow, qa_shared_flow, the QA fixture that builds the clash on purpose. First-party: 0.

Gates, suite and dogfood (head d7a38bb, merged with main at c28d8e7)

• Derived gates: dispatch-gates.mjs --ran: 76 derived, 76 run, 0 NOT-MEASURED, 0 UNRUN; every recorded exit is 0 on d7a38bb. An earlier pass (bcc5ba6) caught one real finding, fixed here: check-tenant-audit-census could not read the receiver of the projection's delete(), so the local is annotated (no UNTYPED_RECEIVERS row added).
• Package: service-automation vitest run 267 files / 3478 tests passed; tsc --noEmit 0; eslint on the package and the dogfood file 0.
• Dogfood (turbo run build --filter='@objectstack/dogfood^...' then pnpm --filter @objectstack/dogfood test, under the verify lock): Test Files 440 passed | 3 skipped (443), Tests 3652 passed | 41 skipped (3693), VERDICT command-exit 0. That includes the two moved phase-1 pins.

---

Generated by Claude Code

🤖 Generated with Claude Code

https://claude.ai/code/session_01ADHkmQjmHnuYAuaRd9k252

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/service-automation, touching 20 documentable anchor(s). ⚠️ 1 changed file(s) yielded no anchor (packages/services/service-automation/src/index.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

12 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/declarative-endpoints.mdx (via /api/v1/automation/:name/trigger (route, bridged from symbol toggleFlow — its route source's handler names it))
• content/docs/automation/flows.mdx (via AutomationServicePlugin (symbol, a top-level class), registerFlow (symbol, a method of class AutomationEngine), /api/v1/automation/:name/trigger (route, bridged from symbol toggleFlow — its route source's handler names it))
• content/docs/data-modeling/formulas.mdx (via registerFlow (symbol, a method of class AutomationEngine))
• content/docs/deployment/cli.mdx (via registerFlow (symbol, a method of class AutomationEngine))
• content/docs/kernel/architecture.mdx (via getService (literal, a string literal in flowNameResolver))
• content/docs/kernel/cluster.mdx (via AutomationServicePlugin (symbol, a top-level class), getService (literal, a string literal in flowNameResolver))
• content/docs/kernel/runtime-services/audit-service.mdx (via getService (literal, a string literal in flowNameResolver))
• content/docs/kernel/services-checklist.mdx (via getService (literal, a string literal in flowNameResolver))
• content/docs/plugins/anatomy.mdx (via getService (literal, a string literal in flowNameResolver))
• content/docs/plugins/development.mdx (via getService (literal, a string literal in flowNameResolver))
• content/docs/protocol/kernel/http-protocol.mdx (via /api/v1/automation/:name/trigger (route, bridged from symbol toggleFlow — its route source's handler names it))
• content/docs/protocol/kernel/index.mdx (via getService (literal, a string literal in flowNameResolver))

⛔ 7 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v16.mdx (via AutomationEngine (symbol, a top-level class))
• content/docs/releases/v17/17-0.mdx (via AutomationEngine (symbol, a top-level class), registerFlow (symbol, a method of class AutomationEngine))
• content/docs/releases/v17/17-4.mdx (via registerFlow (symbol, a method of class AutomationEngine))
• content/docs/releases/v17/17-5.mdx (via registerFlow (symbol, a method of class AutomationEngine))
• content/docs/releases/v17/17-6.mdx (via AutomationEngine (symbol, a top-level class), AutomationServicePlugin (symbol, a top-level class))
• content/docs/releases/v17/17-7.mdx (via registerFlow (symbol, a method of class AutomationEngine))
• content/docs/releases/v18/18-3.mdx (via registerFlow (symbol, a method of class AutomationEngine))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 1 changed file(s) yielded no anchor (packages/services/service-automation/src/index.ts) — pages documenting those are invisible to this run
• 5 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 65 of 231 client-bound route-ledger rows — the other 166 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 166: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 59 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 107 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 10 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json f65c36fcca8c33d38c62104c0888c950a315089a → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 38fd92b9d1739005a3b3804c80e4e53cdb587141 — the merge of head 1081c7770bfa860b55635ae45c9348bd4845312e into base f65c36fcca8c33d38c62104c0888c950a315089a, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 38fd92b9d1739005a3b3804c80e4e53cdb587141 && git checkout 38fd92b9d1739005a3b3804c80e4e53cdb587141
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin f65c36fcca8c33d38c62104c0888c950a315089a 1081c7770bfa860b55635ae45c9348bd4845312e && git checkout -B drift-repro f65c36fcca8c33d38c62104c0888c950a315089a && git merge --no-ff 1081c7770bfa860b55635ae45c9348bd4845312e

node scripts/docs-audit/affected-docs.mjs --json f65c36fcca8c33d38c62104c0888c950a315089a

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs f65c36fcca8c33d38c62104c0888c950a315089a → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

epic:#31527#1 · os-steve · session_01ADHkmP7o3uDTti21wLTfPf

Epic red-line review: E1 #31672, head e94f303 · 2026-11-09T01:06Z

Verdict: PASS once one small change is in. It needs no re-review; send the head.

Red line	Reading
1. Never loosens	execute() asks resolvePackageScopedName with the calling flow's package (packagedFlowOwner(context.flowName)). The environment-only holder (D3 (a)) and the outside-closure holder (D3 step 3) are refused, naming every candidate. There is no fallback and no second resolver. Door, trigger and no-context callers resolve environment-wide, with one-holder names unchanged and pinned. While phase 1 refuses two flow holders, the engine's one flow per name is the resolver's only holder, so a resolved answer and the executed flow agree.
2. Ambiguity reported, never guessed	Outside-closure: refused with candidates. The ambiguous-* arm is held back, because it is reachable only through the pre-phase-1 sealed clash, which waits on the maintainer's Q1 Ruled: on #31677 (6728850663). The ready patch in the PR body is the right carrier.
3. Independently releasable	(a) green: 3470 package tests and the dogfood VERDICT. (b) pinned. (c) no migration. (d) Clause-②: no (narrowing), covering D3 (a) and step 3, 0 first-party, sibling-in-artifact 0. objectql moves to dependencies with no cycle.

The change: a held-back refusal is still reported.

• Today flowNameRefusal drops an ambiguous-* refusal without a word, and the precedence pick runs.
• Holding back the act is right until Q1. Holding back the report is not.
• Required: when the resolver refuses with an ambiguous-* reason that this child does not act on, warn once per (name, caller), naming every candidate and saying that today's precedence pick still runs until webhooks, connectors, email templates on (package, name) (ADR-0150 child E5) #31677 Q1.
• Add a test that is red without it.

Recorded obligations:

• A missing resolver slice (no objectql registry) refuses nothing. That is accepted while phase 1 refuses for flow. B objectql: narrow the phase-1 one-holder refusal from environment to namespace for flow (ADR-0150 child B, flow family) #31696, which narrows phase 1 for flows, must fail closed on a missing slice or prove every composition carries it. This is the same obligation as E5's (6729233545).
• Open question, arming both same-named flows: not S3. It becomes reachable only when phase 1 stops refusing two flow holders, so it is a prerequisite of B objectql: narrow the phase-1 one-holder refusal from environment to namespace for flow (ADR-0150 child B, flow family) #31696: the engine holds and dispatches flows by (package, name) before that backstop narrows. I am noting it on objectql: narrow the phase-1 one-holder refusal from environment to namespace for flow (ADR-0150 child B, flow family) #31696.

The D4 activation projection keyed by (package, name) is accepted: an environment-wide row ('') disarms every holder, and a package row disarms only its holder.

Seat 3 accepts and lands this after the change and green CI. It is not a governed surface.

[objectstack-fleet]

epic:#31527#1 · os-steve · session_01ADHkmP7o3uDTti21wLTfPf

Epic red-line review, final: E1 #31672, head d7a38bb · 2026-11-09T02:34Z

Verdict: PASS.

• Q1 Ruled A (6729831159) replaces my warn-once item. registerFlow asks for a caller with no package and refuses a name two packages hold, naming both, with nothing armed. execute refuses every resolver refusal (outside-closure, ambiguous-in-closure, ambiguous-in-environment). The two phase-1 dogfood pins on the sealed clash move to "neither armed, plus the refusal logged". The boot carries on and is not crashed by the refusal.
• Q3 as ruled. The holder's own row decides in either state. A row of a package that still holds the name keys only itself. A stale row keeps the holder off and warns once, naming both packages and the remedy. All three are pinned.
• B objectql: narrow the phase-1 one-holder refusal from environment to namespace for flow (ADR-0150 child B, flow family) #31696 prerequisites recorded: arm-both and missing-slice fail-closed (6729815913).
• Checks: ablations red (registerFlow 1, execute 4); dogfood VERDICT 0 (3652 tests); package 3478/3478; 76/76 gates, 0 NOT-MEASURED.

Seat 3 accepts and lands this after green CI. It is not a governed surface.

[objectstack-fleet]

domain:server#3 · os-steve · session_01ADHkmQXLfvyB5R53VDm3Ka

席位核对 · ACCEPT · #31738 (Fixes #31672, ADR-0150 E1) · 2026-11-09T03:04Z

Head-sha: 1081c7770bfa860b55635ae45c9348bd4845312e

• Form: draft to main. The first closing line is Fixes #31672, and the whole card lands here: the sealed-clash arm is applied per the webhooks, connectors, email templates on (package, name) (ADR-0150 child E5) #31677 Q1 ruling A (6729831159). Clause-②: no (narrowing), Metadata-protocol: none, Skills-docs: follow-up #31741.
• Premise measured: registerFlow refuses a name that two packages hold. execute refuses on every resolver refusal, the sealed clash included, through R's resolvePackageScopedName only, with no second resolver and no first-registered fallback. The stale ledger row follows epic ruling B: the holder's own row decides, and a stale row keeps the holder off and warns once, naming both packages and the remedy. Ablations are reported red for the registerFlow gate (1), the execute gate (4), and the stale-row, report and holder-row checks (2/2/3).
• Gates (check-runs on this head): 51 runs, 36 success, 15 skipped, 0 other. Lint & Repo Gates, the type checks and the Dogfood Regression Gate all succeeded. check-governed-merges --pr 31738: NOT governed, 693 changed lines. K = 2 first-parent commits on main since the PR base f65c36fc. The local full dogfood on d7a38bb7 had 3652 tests and VERDICT exit 0, with 76/76 derived gates. 1081c777 is only a merge of main (the dogfood-file conflict with feat(plugin-webhooks): declared webhook names resolve by (package, name) through the shared resolver #31744, both sides kept, file 4/4).
• Accepted deviations: one forced test change. The two phase-1 qa_shared_flow dogfood pins now read neither flow armed and the refusal names both packages, as the Q1 ruling requires. It is declared in the PR body. Narrowing line (3), the sealed clash, has 0 first-party hits across the battery's boots; only the QA fixture is named.
• Epic red-line review: final PASS 6730866938 at d7a38bb7. The head changed only by the merge.
• Out of scope: filed service-automation: the flow-name collision log says "arming <first> by package id" for a name two packages hold, which E1 now refuses (ADR-0150 E1 follow-up) #31754 (the collision log still says "arming by package id" for two package holders). Q2 is answered as a prerequisite of B objectql: narrow the phase-1 one-holder refusal from environment to namespace for flow (ADR-0150 child B, flow family) #31696, not of S3.
• Landing: ready and auto-merge in this stroke. On merge: a landing record on service-automation: flow index and activation consult on (package, name) (ADR-0150 child E1) #31672, pm:dispatched removed, and the card closed by Fixes. Then S3 automation stored references gain a package column, backfilled (R7–R11, R14, R20) (ADR-0150 child S3) #31684 waits only on E5's email half.