test(runtime): the runs ?status= pin reads ExecutionStatus instead of copying it

[os-litant]

Fixes #15890

automation-runs-query-validation.test.ts carried a row named "forwards every declared ExecutionStatus member" whose members were eight string literals typed into the test body. The list was identical to the enum on the day it was written and short by one the day refused was appended (#14945), so the row went on passing while covering eight of nine — a test named for a property it had stopped measuring, green the entire time.

What changed

Three sites, all in packages/runtime:

site	before	after
domains/automation-runs-query-validation.test.ts	it.each([...8 literals])	it.each(ExecutionStatus.options)
query-param.ts	"bounds it to the eight ExecutionStatus members"	bounds it to ExecutionStatus itself — the enum rather than a copy of its members — and when that stopped being a copy
domains/automation.ts	"z.enum([...8 ExecutionStatus members])"	"declares it as ExecutionStatus.optional()" — the enum itself — and when it started saying that

Reading the vocabulary is the discipline both neighbours already apply: the boundary hands parseEnumParam that same array (domains/automation.ts), and automation-api.zod.test.ts turned its own inline copy into the same read under #7359.

Deliberately not "nine". Swapping a stale literal for a fresh one re-arms the identical trap and reads authoritative the whole time. Each site now says what the set is defined by, not how many are in it — the same correction #16414 made, where the accepted repair also declined to mint a replacement number.

The appended-last invariant is untouched. execution.zod.ts reserves .options positions for readers that index them ("Appended last so every reader that indexes .options keeps its positions"). Iterating .options only reads it; nothing here sorts or re-seats it. The two positional readers (execution.test.ts's .at(-1) and .slice(0, 8)) are unchanged and still pass.

Round 2 — a false sentence this branch introduced, and three smaller corrections

An independent review (5563157456) returned PASS with four non-blocking findings. The pin, the ablation and the population sweep all held and are unchanged. Commit bf70dbf5a34 carries the repairs and quotes each corrected sentence verbatim, because the squash body is composed from commit messages rather than from this one.

1. The comment rewrite replaced a true sentence with a false one

The first pass wrote, of ListRunsRequestSchema, "has always declared it — as ExecutionStatus.optional(), the enum itself rather than a copy of its members" (domains/automation.ts) and "bounds it to ExecutionStatus itself — the enum, never a copy of its members" (query-param.ts). Both are false about history — and the sentence the first one replaced, "has always declared it (z.enum([...8 ExecutionStatus members]).optional())", was accurate about it. Repairing a stale count introduced a falsehood about history, on the one card whose entire subject is untrue claims about this vocabulary.

Verified against git show, on packages/spec/src/api/automation-api.zod.ts:

• git show 5e685a7d6f7:... — at the schema's introduction (2026-02-21) the line read status: z.enum(['pending', 'running', 'paused', 'completed', 'failed', 'cancelled', 'timed_out', 'retrying']).optional(). An inline copy of eight members.
• git show cf7c69421a7^:... — byte-for-byte the same literal the day before finding: ListRunsRequestSchema.status is declared on the wire but no handler and no service option carries it — GET /automation/:name/runs?status=failed silently lists every run #7359.
• git log -S on that literal, same path — exactly two commits touch it: the introduction, and cf7c69421a7, the landed finding: ListRunsRequestSchema.status is declared on the wire but no handler and no service option carries it — GET /automation/:name/runs?status=failed silently lists every run #7359 (2026-08-11), which replaced the copy with ExecutionStatus.optional() in the same commit that made this boundary read the parameter.

Both sites now say what the line declares today and when it started saying it. No count of the live enum is minted: "eight" is a property of a literal cf7c69421a7 deleted, frozen, and it is what makes the sentence explain itself rather than assert itself.

⚠️ The sha worth citing is cf7c69421a7. The review's 2af301e4a21 is the same change's pre-squash branch commit and is not an ancestor of origin/main, so it resolves for nobody reading main.

2. dist IS on the suite's resolved path

"No dist is on the resolved path" was true of the two ablation legs and false of the suite. Measured on a fresh worktree with nothing built, the suite cannot collect the file at all:

Error: Failed to resolve entry for package "@objectstack/observability".
 Test Files  1 failed (1)
      Tests  no tests

http-dispatcher.ts, which the test imports, imports @objectstack/observability; packages/runtime/vitest.config.ts carries no alias entry for that package; its exports map serves ./dist/index.js. So the suite needs a built dependency closure, and this round built one (pnpm --filter '@objectstack/runtime^...' build) before re-running.

What survives is the narrower, true claim: both ablation legs are source-resolved — the mutated domains/automation.ts is reached by relative import inside the package, and ExecutionStatus through the config's @objectstack/spec/* to ../spec/src/* rule — so no rebuild leg applies to them and ablation-dist-preflight does not.

3. TERMINAL_RUN_STATUSES is not a "documented narrower subset"

Measured in plugin-approvals/src/approval-service.ts, it is {completed, failed, cancelled, timed_out} — a set its own header calls "A CLOSED set, deliberately", whose dead-run sweep treats every other answer, an unknown status included, as alive, so an unrecognised state can never cost someone a live approval. That is a fail-safe default, not a narrowing anyone documented relative to ExecutionStatus.

It was closed before refused existed, and refused — "Terminal, never resumed" — is not in it. Once lane 2 (#15788) makes a run actually reach that status, a still-pending approval on it reads as alive to that sweep: a reader of this vocabulary that has not learned the new member, owned by the refused lanes rather than by this card. What does not change is the sweep's place in this PR: a four-member ReadonlySet is not a stale copy of the nine-member enum, so it is still not a site this change touches.

4. "hours ago" was not hours

#16414 landed as 0ea5f9d9f79 at 2026-09-06T21:22:02Z; the commit that said "hours" was authored 22:50:48Z the same day — 89 minutes by those two stamps, 66 by the review's anchor. Two anchors, two numbers, and the elapsed time was never load-bearing: the citation of #16414 stays, the time reference is dropped rather than replaced by a third number of my own.

Round 2 is comment prose only. Every line the round changed in the two src/ files begins // or *; no executable line moves, and the test file is untouched by it.

The acceptance test is that the pin can REDDEN

A pin reading ExecutionStatus.options passes trivially, so the pin was ablated rather than merely run. Direction and the identity of the failing row were written down before the run. Settled in round 1 and not redone here.

parseEnumParam in domains/automation.ts was handed a hand-copied eight-member array in place of ExecutionStatus.options, exactly reproducing the defect this PR removes.

• Predicted: redden, with exactly one failing row — ?status=refused — and nothing else moving.
• Measured: Tests 1 failed | 47 passed (48). The single failure is forwards every declared ExecutionStatus member — ?status=refused, raising ValidationError: Invalid `status` query parameter — expected one of pending, running, paused, completed, failed, cancelled, timed_out, retrying, received "refused" through parseEnumParam at query-param.ts:227.
• The predicted counts were 41/1, from a static row estimate of 42; the real suite is 48 rows. Direction and failing-row identity held; the absolute was my miscount, recorded here rather than quietly corrected.

Mutation and restore were both proven on disk, not read off an exit code: the anchor went 1 to 0 and the injected text 0 to 1, the blob moved 1a69cc22 to a1d3cce0, and the restore under trap ... EXIT INT TERM brought the path back to blob 1a69cc22 — byte-identical to its HEAD blob — with git diff HEAD and git status --porcelain both empty.

The row count is 9 because it was read

--reporter=verbose names all nine generated rows, one per member, ending in ?status=refused. The ninth row exists only because refused is in the enum. Re-measured this round at 0688d68edf5: nine rows, ?status=cancelled · completed · failed · paused · pending · refused · retrying · running · timed_out.

The suite is genuinely type-checked, not excluded-tests green: packages/runtime/tsconfig.json excludes **/*.test.ts, so plain tsc --noEmit says nothing about this file. Under the test-layer program tsconfig.test.json, tsc --noEmit --listFiles puts all three edited files in a 1406-file program, and none of the 191 ledgered errors is in any of them.

Population, swept rather than assumed

The card named three sites; that was treated as a lead, not a total. Every tracked non-dist file was scanned for windows carrying four or more of the nine member spellings, and separately for count words adjacent to ExecutionStatus. The matcher's positive control is this file's own pre-change text, which it reports at eight of nine with refused missing — and which it stops reporting after the change.

Outside the three sites above, no live stale copy: execution.test.ts's eight-member list is the deliberate prefix pin for the appended-last invariant, AUTOMATION_RESULT_STATUSES is a different five-member union held exhaustive by a type-level equality, plugin-approvals' TERMINAL_RUN_STATUSES is the four-member closed set described in round 2 above, and the generated reference docs carry all nine. Commit messages were swept too: the landed #7359 bodies say "re-listing its eight members inline", which described the tree accurately at the time and is immutable history — and is the same record git log -S confirms above.

One stale copy does survive, in docs/qa/platform-checklist/areas/automation.json. It is filed as #16424 and deliberately not edited here — a JSON checklist has no enum to read, so its repair is an authoring decision, and it sits behind a different gate family.

Verification

All at 0688d68edf5, this branch's head after merging origin/main in. ⚠️ Recorded rather than smoothed over: git rev-parse origin/main read 0a038cc06d9 moments before the merge, but the merge's second parent is bf3d6130f3a — a sibling worktree's fetch advanced the shared refs/remotes/origin/main in between, so six commits came in where that reading named four. One of them, 2025b1f7ecd (#16363), lands in packages/runtime (src/dispatcher-error-vocabulary.ts), which is why the package's full typecheck — both layers — was re-run and not only the pin; its full test suite is CI's Test Core, on the generation the queue rebuilds. Shared box, so the wall-clock absolutes below are not idle-box figures.

• pnpm --filter '@objectstack/runtime^...' build — green, and required: see round-2 finding 2 above.
• pnpm --filter @objectstack/runtime exec vitest run --reporter=verbose src/domains/automation-runs-query-validation.test.ts — 48 passed (48), 1 file, with the nine member rows named above.
• pnpm --filter @objectstack/runtime typecheck — green on both layers; check:test-typecheck prints OK at 27 files / 191 errors / 69 pinned signatures, the unchanged ledger baseline.
• Gate union, re-derived at this head: the 46 families node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack derives from the change set (3 paths vs merge base bf3d6130f), plus the 39 Artifact rosters and the 10 Declared WIDE population families the Reconciliation line omits. 94 unique commands, exit code captured before any pipe: 89 green, 5 NOT MEASURED, zero findings.
• check-partof-closing-keyword was re-run with real PR_BODY and PR_COMMITS_FILE rather than left at its NOT WIRED exit: green, over this body and the branch's 4 commit messages (two of them merges of origin/main). They carry no card-relation trailer and zero closing keywords; the only closing keyword on this PR is Fixes #15890, on line 1 of this body, which is parsed separately from them. The complete set of card numbers the squash will concatenate is finding: ListRunsRequestSchema.status is declared on the wire but no handler and no service option carries it — GET /automation/:name/runs?status=failed silently lists every run #7359, A flow cannot REFUSE with per-record text: the only channel that interpolates is a screen description, and a message-only screen still renders Submit and toasts "completed" #14945, service-automation: honour outcome: 'refused' on the flow end node — a terminal refused run status (distinct from failed) with the interpolated message persisted on the run (lane 2 of the #14945 ruling 2′) #15788, runtime: the ?status= forwarding pin hand-copies the eight ExecutionStatus members — with refused appended (#14945) it covers eight of nine and stays green #15890, docs(cli): state the measured platform-id width at four citation sites #16414 — five, all verb-less.
• The five NOT MEASURED are environment states, each self-declared, none a verdict on this diff: check-single-claim-paths prints NOT WIRED without a PR number; check:react-declaration-parity needs an objectui manifest this repo holds no copy of; check:dual-build-cjs-loads, check:published-readme-exports and check:type-check-debt print PREREQUISITE NOT MET (exit 3) because they read built output across the whole tree and only @objectstack/runtime's closure was built. CI's Build Core job supplies what they need.
• Lint, as a declared narrowing rather than a skip: eslint --no-inline-config --format json over the three changed files reports 3 files linted, 0 errors, 0 warnings. The narrowing is a measurement because eslint.config.mjs states, with its own positive control, that this repo "never enables type-aware linting (no parserOptions.project, no typed @typescript-eslint rules) for ANY file, test or not" — so a three-file diff cannot move the verdict on any file it does not touch.

Release note

No changeset. Test-only plus comment text: no behaviour, no asserted value and no minted count changes, so this PR releases nothing from any package and carries skip-changeset.

Attribution: authored by Claude Code in session session_01D47qPfEWVPmhguWgBZCi5N; the same id rides every commit on this branch as a Claude-Session: trailer.

[github-actions]

📓 Docs Drift Check

1 anchor(s) derived from 1 changed package(s); no hand-written page names any of them. ⚠️ 1 changed file(s) yielded no anchor (packages/runtime/src/query-param.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

What this run could not see

• 1 changed file(s) yielded no anchor (packages/runtime/src/query-param.ts) — pages documenting those are invisible to this run
• the SDK route bridge reached 61 of 219 client-bound route-ledger rows — the other 158 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 158: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 24 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 3e7ef9c2389e3e5e02903634947de9cece4736b4 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from f4f6fe0b3b9573c9a809a6f7f2b8c755b136fab1 — the merge of head 0688d68edf56d593943cceed17937738428c837e into base 3e7ef9c2389e3e5e02903634947de9cece4736b4, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin f4f6fe0b3b9573c9a809a6f7f2b8c755b136fab1 && git checkout f4f6fe0b3b9573c9a809a6f7f2b8c755b136fab1
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 3e7ef9c2389e3e5e02903634947de9cece4736b4 0688d68edf56d593943cceed17937738428c837e && git checkout -B drift-repro 3e7ef9c2389e3e5e02903634947de9cece4736b4 && git merge --no-ff 0688d68edf56d593943cceed17937738428c837e

node scripts/docs-audit/affected-docs.mjs --json 3e7ef9c2389e3e5e02903634947de9cece4736b4

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

[os-litant]

VERDICT: PASS

Independent adversarial review of head 08874237790 (merge-base 7ad2ca00232), from a fresh detached scratch worktree of my own: deps installed offline, @objectstack/runtime's dependency closure built under the verify lock (29 tasks, exit 0). Nothing pushed, nothing on the PR touched but this comment. I did not read the dispatching seat's conclusions; everything below is re-derived.

1. The acceptance test — the pin must REDDEN (prediction vs observation)

Prediction file written at 23:42:53Z (sha256 36e5d898…) before either mutation. Baseline measured first: Tests 48 passed (48), nine forwards every declared ExecutionStatus member — ?status=%s rows, the ninth ?status=refused.

Ablation A — the boundary stops honouring the vocabulary. parseEnumParam('status', …) in domains/automation.ts handed the hand-copied 8-member array in place of ExecutionStatus.options. Nothing rebuilt.

• Predicted: REDDEN; 1 failed / 47 passed (48); the single failing row ?status=refused; nothing else moves.
• On disk, before any verdict was read: anchor ExecutionStatus.options), 1→0, marker ABLATION_16426_HANDCOPY 0→1, blob 1a69cc22… (= HEAD) → d3d7471f….
• Observed: Tests 1 failed | 47 passed (48). The only × row: forwards every declared ExecutionStatus member — ?status=refused, raising ValidationError: Invalid status query parameter — expected one of pending, running, paused, completed, failed, cancelled, timed_out, retrying, received "refused" via parseEnumParam src/query-param.ts:227 ← handleAutomationRequest src/domains/automation.ts:1825. The other eight member rows stayed ✓.
• Restore under trap … EXIT INT TERM, absolute path, git checkout HEAD -- <abs>: on-disk blob 1a69cc22… == HEAD blob, anchors back to 1/0, git diff HEAD 0 lines, git status --porcelain 0 lines.

Direction, both counts and the row's identity all matched.

Ablation B — is 9 READ, or typed? 'refused' removed from packages/spec/src/automation/execution.zod.ts in SOURCE only; packages/spec/dist (freshly built) deliberately NOT rebuilt and verified to still carry 'refused' in 6 files with no marker.

• Predicted: stay green but shrink — 0 failed / 47 passed (47), 8 rows, no ?status=refused row.
• On disk: anchor 1→0, marker 0→1, blob f0351cdb… → d71fb7f1….
• Observed: Tests 47 passed (47), 8 rows, 0 named refused. Restore proven the same way (blob == HEAD, diff and porcelain empty).

Static half: the test file at HEAD contains zero 'refused' string literals (the word appears only in comments). The ninth row exists only because the enum was read — and read from src.

Rebuild leg, established rather than assumed. packages/runtime had NO dist in my worktree at any point (turbo run build --filter='@objectstack/runtime^...' builds dependencies only), so the mutated automation.ts could only have been read from source. packages/spec/dist existed during B, was unchanged, and the run still tracked src — the vitest.config.ts alias ^@objectstack\/spec\/([a-z-]+)$ → ../spec/src/$1/index.ts doing what it says. One correction to the PR body (finding 2): the suite as a whole does NOT load in an unbuilt tree — Error: Failed to resolve entry for package "@objectstack/observability" at http-dispatcher.ts:12, an un-aliased import resolving through exports to a missing dist. So "no dist is on the resolved path" is wrong about the suite and right about the two legs that matter.

2. Positional readers of ExecutionStatus.options

The diff touches no packages/spec file; the only added executable line is it.each(ExecutionStatus.options); the added lines contain no .sort|.reverse|.splice|.unshift|.push|.shift( (0). The readers were run: execution.test.ts (.at(-1) === 'refused', .slice(0, 8) prefix), automation-api.zod.test.ts (#7359 read), end-node-outcome.test.ts — 3 files / 112 passed, the "appended LAST" pin explicitly ✓. Held.

3. Behaviour-neutral?

esbuild --loader=ts --format=esm (comments dropped) over merge-base vs HEAD: domains/automation.ts 25,887 bytes both, sha256 95d485f5… both; query-param.ts 2,163 bytes both, sha256 668eb799… both — byte-identical. Control that the stripper can fire: the same treatment of the test file differs (5 lines). Executable text unchanged; executable LINES moved by comment growth: the parseEnumParam( call 1822→1825 (+3), the invalid_option throw 225→227 (+2) — the PR body's query-param.ts:227 is the HEAD line and is correct. No published surface, no asserted value changed.

4. Population, re-derived with my own matcher

Matcher: Pattern A = count token eight|nine|8|9 (also 8-member, ...8, eight of nine, 8/9; decimals like 1.8 excluded) within ±3 lines of ExecutionStatus (STRONG) or of status + member|enum|vocabulary (weak); Pattern B = 6- and 20-line windows carrying ≥4 distinct member spellings, flagging exactly-8-without-refused. Run over all 8,065 tracked files minus dist/binaries, and over every commit message on origin/main (git log --format=%B).

• Positive controls: the pre-change text of all three card sites fires — A on query-param.ts:180 and automation.ts:1799, B on the test list. Recorded honestly: my first matcher version MISSED automation.ts:1799 (the [...8 spelling — I had excluded a leading .); a control firing on 2 of 3 is a failed control, so it was fixed and re-run before any tree number was trusted. Commit-sweep control: the landed finding: ListRunsRequestSchema.status is declared on the wire but no handler and no service option carries it — GET /automation/:name/runs?status=failed silently lists every run #7359 squash cf7c69421a7 fires twice ("z.enum([...8 members])", "re-listing its eight members inline").
• Live stale copies at merge-base: 4 — the card's three (fixed here) + docs/qa/platform-checklist/areas/automation.json:429 (platform-checklist: automation.json states the ExecutionStatus vocabulary as eight hand-copied members, so it is short by refused #16424, confirmed open; the other B windows at 410/421/424 are the same line through a 20-line window).
• Deliberate / different vocabulary, each verified: execution.test.ts:29 .slice(0, 8) prefix pin (the positional invariant — correct); AUTOMATION_RESULT_STATUSES five members held by Assert<Eq<…>> at automation-result-status.pin.test.ts:79 (claim true); TERMINAL_RUN_STATUSES — finding 3.
• Generated docs: all nine (references/api/automation-api.mdx:473; references/automation/execution.mdx:106, 170-178, 352). My B flags at execution.mdx:158 and execution.zod.ts:14 are windowing artifacts (refused sits one / six lines past the window) — resolved by reading them.
• Historical, immutable: four CHANGELOG copies of the same finding: ListRunsRequestSchema.status is declared on the wire but no handler and no service option carries it — GET /automation/:name/runs?status=failed silently lists every run #7359 release line (client, runtime, service-automation, spec) and the squash cf7c69421a7. 0 STALE8 windows in any commit message on main.
• Weak hits: 37, all triaged, none about ExecutionStatus (error-code counts, cron strings, id widths, other schemas' member counts).
• HEAD text of the three files: 0 Pattern-A hits; no eight|nine|8|9 left in automation.ts:1780-1830 or anywhere in query-param.ts.

Total: 4 live stale (3 fixed here, 1 filed) + 1 deliberate prefix pin + 2 sibling sets of other vocabularies + 5 historical records. The card's three were a floor by exactly one, and that one the PR had already filed.

5. No replacement number minted

Both rewrites name the definer (ExecutionStatus / ExecutionStatus.optional()), not a cardinality. Held. The would-be squash body (the 2 commit messages) carries eight count-word lines ("eight of nine", "eight-member list", "Deliberately NOT 'nine'") — all narrating the defect as history, none stating the enum's current size.

6. Are the rewritten sentences TRUE of the tree?

Present tense: yes — ListRunsRequestSchema.status is ExecutionStatus.optional() (automation-api.zod.ts:434) and the boundary hands parseEnumParam ExecutionStatus.options (automation.ts:1825). History: finding 1.

7. Commit stream (the set GitHub squashes: both commits, merge commit included)

git log origin/main..HEAD: 2 messages. Closing keywords (close|closes|closed|fix|fixes|fixed|resolve|resolves|resolved + #N, and the issue-URL form): 0. Part-of|Refs|Related: trailers: 0. Complete #N set: {#7359, #14945, #16414} — plain citations; the card relation lives once, in the body (Fixes #15890). CI's "Part-of PR must not also close its card" is green on head. Statements checked against the tree: neighbour read under #7359 ✓ (automation-api.zod.test.ts:553-560), appended-last note ✓, prefix pin ✓, Eq ✓, checklist filed ✓, CHANGELOG copies untouched ✓ (four exist), merge-commit parents ab5a382 + 7ad2ca0 ✓ with ab5a382's parent 0ea5f9d an ancestor of main ✓. Nit: "#16414 landed hours ago" is 66 minutes (merged 21:44:24Z; commit authored 22:50:48Z).

8. Typecheck — which program actually reaches the pin

tsc --noEmit --listFiles -p tsconfig.json (build program): exit 0, 807 files, the test file absent, the two src files present — a plain typecheck is indeed silent on the pin. -p tsconfig.test.json: exit 2 with the 191 ledgered errors, 1,081 files, all three edited files present, 0 errors naming any of them. pnpm --filter @objectstack/runtime check:test-typecheck: exit 0, OK … 27 file(s) / 191 error(s) / 69 pinned signature(s) — the same ledger the PR reports. (Drift: the PR says 1,406 files in that program; mine is 1,081 in a closure-only build state — same three files, same zero.) ESLint --no-inline-config --format json on the three files: exit 0, 3 files, 0 errors, 0 warnings.

Findings

1. Non-blocking — the rewritten automation.ts:1799 sentence is true of the tree and false of the history it narrates. "ListRunsRequestSchema has always declared it — as ExecutionStatus.optional()": at cf7c69421a7^ (parent of the finding: ListRunsRequestSchema.status is declared on the wire but no handler and no service option carries it — GET /automation/:name/runs?status=failed silently lists every run #7359 squash) the schema read status: z.enum(['pending', …, 'retrying']).optional(); finding: ListRunsRequestSchema.status is declared on the wire but no handler and no service option carries it — GET /automation/:name/runs?status=failed silently lists every run #7359 itself is what made it ExecutionStatus.optional() (that file's own comment still says "the members were previously re-listed inline"). The old text described that pre-finding: ListRunsRequestSchema.status is declared on the wire but no handler and no service option carries it — GET /automation/:name/runs?status=failed silently lists every run #7359 form correctly; the new "always … as" does not. query-param.ts:180's "never a copy of its members" overreaches the same way. Comment-only, no behaviour or asserted value, hence not a blocker — but in a prose-accuracy PR it deserves a reword, before merge or as the first follow-up: e.g. "has always declared it — today as ExecutionStatus.optional() (finding: ListRunsRequestSchema.status is declared on the wire but no handler and no service option carries it — GET /automation/:name/runs?status=failed silently lists every run #7359 replaced the inline copy)" and "the enum itself rather than a copy of its members (since finding: ListRunsRequestSchema.status is declared on the wire but no handler and no service option carries it — GET /automation/:name/runs?status=failed silently lists every run #7359)".
2. Non-blocking — the PR body over-claims "No dist is on the resolved path." The suite cannot load without @objectstack/observability's dist (measured above). The two mutation legs ARE source-resolved (proven by A with no runtime dist at all, and by B with spec dist present and unchanged), so "no rebuild leg applies" stands; the sentence about the suite does not. PR-body text only.
3. Non-blocking — the population characterization of TERMINAL_RUN_STATUSES is looser than the tree. The PR says it "documents itself as a narrower subset"; the docblock (plugin-approvals/src/approval-service.ts:245-260) says "A CLOSED set, deliberately" with a fail-safe rationale, was written 2026-07-27 (b9490597c46, Approval: a dead approval run can leave the record RECORD_LOCKED (#3424 follow-up, expected-behavior 3) #3456) before refused existed, and does not name refused among its exclusions although the enum calls refused terminal. feat(spec): the flow end node declares its outcome — refused with an interpolated message, and the run vocabulary gains refused #15889's reader census already lists the approvals release path (approval-service.test.ts:2583, it.each(['completed', 'cancelled', 'timed_out'])) as one that "must LEARN refused" in lane 2 — service-automation: honour outcome: 'refused' on the flow end node — a terminal refused run status (distinct from failed) with the interpolated message persisted on the run (lane 2 of the #14945 ruling 2′) #15788, still open and pm:blocked, so the engine writes no refused today and nothing is wrong yet. An adjacent count literal of the same family for lane 2's ledger: approval-service.ts:341 "The engine writes exactly four run statuses". Nothing for this PR to do; recorded so "no live stale copy outside" reads as "none outside lane 2's list".
4. Non-blocking nit — "hours ago" is 66 minutes.

What I attacked and could NOT break

• The pin reddens under the exact defect it exists to catch — one row, by name, counts as predicted, with on-disk proof of both mutation and restore.
• The row count follows the enum's SOURCE: not a typed 9, and not dist.
• .options is iterated, never re-seated; the positional readers pass and no spec file is in the diff.
• Comment-stripped executable text of both src files is byte-identical to main.
• No minted cardinality in the three files; no closing keyword or trailer anywhere in the commit stream.
• CI on head: 40 check runs, 0 failures (Test Core shards, all four Type Check jobs, Lint & Repo Gates, Part-of guard, Governed Surface Queue Guard green).

NOT MEASURED (by me)

• The full @objectstack/runtime suite — only the one file ran locally; CI's Test Core shards are green on head.
• The 94-command dispatch-gate union — I ran lint (3 files), both typecheck programs, the ledger gate and the targeted runtime/spec suites; the rest is CI's.
• check:dual-build-cjs-loads, check:published-readme-exports, check:type-check-debt, check:react-declaration-parity, check-single-claim-paths, check-partof-closing-keyword locally (the last is green in CI).
• docs/qa/platform-checklist gates (platform-checklist: automation.json states the ExecutionStatus vocabulary as eight hand-copied members, so it is short by refused #16424 is not this PR's).
• Whether the queue composes the squash body from the concatenated commits or from the PR body — both were scanned; the verdict is the same either way.

Anchors re-derived at HEAD: card's 320-322 → 321; automation.ts:1799 unchanged; :1822 → :1825 (+3); query-param.ts:180 unchanged; the throw 225 → 227 (+2).

🤖 Generated with Claude Code

https://claude.ai/code/session_01D47qPfEWVPmhguWgBZCi5N

---

Generated by Claude Code

[os-litant]

Review ADOPTED — PASS, at tier, verbatim. ⛔ But round 2 dispatched: finding 1 is a false sentence this PR introduced

domain:cli execution PM seat (#6024). Adopting 5563157456 in full.

✅ Tier verification

130 harness-stamped "model" fields across 114 assistant turns, every one claude-fable-5-1, zero off-tier. First line is VERDICT: PASS.

What held

The acceptance test was the discriminating one, and it fired: prediction written to a file first (1 failed / 47 passed of 48, failing row ?status=refused), mutation proven on disk (anchor 1→0, blob 1a69cc22… → d3d7471f…) before any verdict, restore proven by blob equality plus empty git diff HEAD and porcelain.

⭐ Ablation B is the one I most wanted and did not ask for by name: removing refused from the spec source while leaving spec dist present and untouched → 47 passed, 8 rows, none named refused. That answers "is 9 read, or is 9 typed?" and settles which artifact the suite resolves from. And the population sweep's positive control initially fired on only 2 of the 3 known sites — so it was fixed and re-run rather than shipped. A control that could not fire would have proved nothing; this one was made to fire before being trusted.

⛔ Finding 1 — and why I am not landing it as-is

The reviewer marked it non-blocking. I verified it myself and I am treating it as worth one round.

The rewritten comment claims ListRunsRequestSchema "has always declared it — as ExecutionStatus.optional()". Measured at 2af301e4a21 (the #7359 commit), the line it replaced was:

- status: z.enum(['pending','running','paused','completed','failed','cancelled','timed_out','retrying']).optional()
+ status: ExecutionStatus.optional()

⇒ It has not always declared the enum. It declared an inline copy of eight members until #7359. query-param.ts:180's "never a copy of its members" overreaches identically.

⭐ The lesson is sharper than the defect: the sentence being replaced was historically accurate. The old text described the pre-#7359 state correctly. Fixing the count problem introduced a history falsehood — this card exists to stop false claims about this exact vocabulary from living in the tree, and the repair reproduced the defect class one line over.

⛔ I am not landing a false sentence into main when the fix is a reword, and the truthful version is stronger: the schema declares the enum today, since #7359, and before that it was an eight-member copy — which is precisely the defect being closed on the test side. Saying so makes the comment explain itself.

Round 2 is scoped to findings 1–4 only. ⛔ The pin, the ablation and the population sweep are settled and are not being redone. ⛔ New commits only — no amend, no rebase, no force-push; a correcting commit must quote what it corrects, verified against git show.

Recorded, not folded in

Findings 2–4 go with round 2: the body's "no dist on the resolved path" is right about the two ablation legs and wrong about the suite (@objectstack/observability needs dist); TERMINAL_RUN_STATUSES is a pre-refused closed set already on lane 2's (#15788) must-learn list rather than a "self-documented narrower subset"; and "hours ago" was 66 minutes.

Also on the record from this review: behaviour-neutrality was proven by comment-stripped esbuild output byte-identical to main, with a control that fires on the test file — not by reading the diff. Commit stream: 0 closing keywords, 0 trailers, #N = {#7359, #14945, #16414}. CI: 40 check runs, 0 failures.

---

Generated by Claude Code

[os-litant]

Round 2 accepted — and two corrections to my own comment above

domain:cli execution PM seat (#6024). Round 2 landed at 0688d68edf5. ⛔ Not landing yet: CI has 38 runs with 0 failures but three still in progress, and I do not land on a partial read.

⛔ Correction 1 — I cited the wrong commit

In 5563169978 I wrote "Measured at 2af301e4a21 (the #7359 commit)". Re-measured:

git merge-base --is-ancestor 2af301e4a21 origin/main  ->  ⛔ NOT an ancestor
git merge-base --is-ancestor cf7c69421a7 origin/main  ->  YES

2af301e4a21 is the pre-squash branch commit; the sha that resolves on main is cf7c69421a7 ("… (#7359) (#7490)"). The diff I quoted is real and the conclusion is unchanged — the line was an inline eight-member z.enum([...]) until #7359 — but I named a commit that is not on main, which is exactly the kind of citation that rots for the next reader. The implementer caught it and cited the landed sha instead.

⛔ Correction 2 — I repeated an attribution I had not checked

I wrote that TERMINAL_RUN_STATUSES is "a pre-refused closed set already on lane 2's (#15788) must-learn list". That attribution came from the review; it does not hold. Neither #15788's body nor its single comment mentions plugin-approvals or that set.

The measurement was sound; the attribution was not, and I passed it on without testing it. ⭐ That distinction is the whole point of the discipline I keep applying to other people's reports, and I did not apply it to a sentence I was quoting approvingly.

⇒ Filed properly as #16433, with the dedup's positive control recorded (the sweep's own originating cards #3456 and #4469 came back, so the query reached the right neighbourhood). It is a live trap: refused is documented "Terminal, never resumed" but is absent from that four-member set, and the sweep's guard continues past it — so the day lane 2 makes a run reach refused, pending approvals on it read as ALIVE and are never released. Same defect class as this card, on the behaviour side.

What round 2 fixed, verified against the tree

Both rewordings are now true, and — the part that mattered — neither mints a live count. "Eight" survives only as a frozen property of a deleted literal:

#7359 put that spelling there, replacing an inline z.enum([...]) copy of eight members; until then the wire's bound WAS exactly such a fixed count.

It has NOT always been spelled that way: from the schema's introduction until #7359 that line was an inline z.enum([...]).optional() copy of eight members.

The historical claims were each verified against git show before being written, including a shallow-clone guard so the -S window is real, and git log -S over that literal returns exactly two commits — the one that adds it and the one that removes it.

Landing checks so far: 4 commits, 0 closing keywords; complete #N set {#7359, #14945, #15788, #15890, #16414}, all verb-less (#15890 appears only as "Round 2 on #15890, after review"); still 3 files, still comment-only, pin still 48 passed with 9 rows still read.

⭐ One environmental finding worth keeping

Round 2 recorded, rather than smoothing over, that git rev-parse origin/main read 0a038cc06d9 moments before its merge while the merge's second parent is bf3d6130f3a — a sibling worktree's fetch advanced the shared refs/remotes/origin/main in between, so six commits arrived where the reading named four.

⇒ refs/remotes/origin/* is shared across every worktree in the same way refs/stash is. A remote-tracking ref read in one worktree can be moved by another agent between the read and its use. Worth knowing before anyone builds a measurement on "main was at X when I looked".

---

Generated by Claude Code