test(plugin-approvals): reproduce #15358 — a cascade-failed ancestor is reported as the repairable strand it is not

[os-warren]

Part of #15358

⛔ This PR does NOT implement the ruled option B. It lands the measurement that option B was ruled on, and it reports one premise that the drive falsified. The card stays open; see "The fork" below.

What is here

One new pin file, packages/plugins/plugin-approvals/src/stranded-run-repairability.test.ts, driving a real AutomationEngine and a real ApprovalService (approvals tables on an in-memory ObjectQL double whose write verbs route through ObjectQL's own dispatch predicates), plus the ledger row check:engine-double-contract asks for that double.

One fixture produces both shapes at once. deal_subflow parks at an approval; its approve edge leads to a subflow node hosting post_approval, which parks at a second approval whose approve edge throws.

run	how it ended	restoreConsumedSuspension	reported runState today
child	resume consumed the pause, downstream node threw — a strand	restored: true	failed
parent	parked at its subflow node, cascade-failed by failAncestors	refused NO_CONSUMED_SUSPENSION	failed

The parent's own decision succeeded — the pin asserts resumed: true on it before the cascade — so its later failed row is not a decision that never moved. That is the over-report the card is about, now measured rather than read off the sources.

PIN 1 asserts both labels in a single toEqual, deliberately: whatever lands for option B must turn it red, and a split that relabels only one of the two rows still fails it.

The fork — why option B's first clause could not be executed here

The ruling's clause 1 is "getRun widens to carry the discriminator the engine already records". The engine records consumedSuspension / consumedSuspensionDropped on the durable RunRecord. AutomationEngine.getRun answers an ExecutionLogEntry, and PIN 3 measures that this object carries neither field, for either run — with a positive control in the same assertion block so the absences are absences in a real terminal record, not the shape of a null.

That is deliberate on the producer's side, not an oversight: recordLog states the snapshot is "a parameter rather than a field of ExecutionLogEntry" because that interface "is served verbatim by GET /automation/:name/runs/:runId" — and the runtime route does serve it verbatim, with no schema strip.

⇒ Widening only the plugin-side declaration cannot separate these two rows. On a real engine the discriminator is absent for both, so a classifier reading absence as "not a strand" answers UNREPAIRABLE for the repairable row — telling an operator not to attempt a repair that succeeds, which is the #15555 harm shape one surface over. So the ruled split needs a producer-side decision first, and there are two readings of where the discriminator gets published:

• Publish it on the run-detail surface — a field on the engine's ExecutionLogEntry plus its spec declaration, after which the plugin reads it through getRun exactly as ruled. Cost: a new key on a published HTTP response, for every automation API consumer.
• Keep the wire surface untouched — a dedicated read-only engine member the plugin declares on ApprovalResumeSurface the way listSuspendedRunsDurable already is. Cost: the ruling's "getRun widens" becomes "the surface widens", and there is one more optional member whose absence has to be handled.

Those differ in what the platform promises to every automation API caller, so this seat did not pick one. ⛔ No public type in plugin-approvals is touched by this PR.

Also measured (the door control)

PIN 4 drives the same strand through two doors in one run: decide throws RESUME_FAILED carrying { finalized, decision, runId, repairable: true } (#13807), while recall reports the same strand as a bare resumeError string with no envelope at all — strandedDecisionDetails on the recall result is undefined. The difference is the door, not the strand.

Verification

Final head 9f4e3ed55.

• pnpm --filter @objectstack/plugin-approvals test — 42 files, 694 tests, all passing.
• pnpm --filter @objectstack/plugin-approvals typecheck — green; its third leg (check:test-typecheck, tsconfig.test.json) is the one that covers the new file, because the package's own tsconfig.json excludes **/*.test.ts.
• Ablation, to show PIN 1 reads the classifier rather than the harness: classifyStrandedRunState's case 'failed' arm mutated to return undefined, proven on disk by the injected marker count and a changed blob hash (141b6300 becomes 6975962a); the run went red on PIN 1 only (1 failed, 3 passed), which is the expected direction — PINs 2 to 4 read the engine, not the classifier. Restored with git checkout HEAD -- ABSOLUTE_PATH, proven by git diff HEAD empty, the blob hash back at 141b6300, and the marker gone. The plugin's own source resolves from src here (relative import), so no rebuild sits between the mutation and the reading; the engine resolves through exports to dist, which was built before every run.
• Gate family derived mechanically on the final head with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands and run in full — 56 commands, every one exit 0, each exit code captured immediately after its own single redirection. check:engine-double-contract was genuinely red first (the new double was unledgered) and is green after the --write regeneration committed here. Three families answered exit 3 PREREQUISITE NOT MET (check:dual-build-cjs-loads, check:i18n, check:type-check-debt); the workspace build was run and all three re-run to real green readings — check:type-check-debt needs an 8192 MB heap in this container.

No changeset

Test file plus a gate ledger — nothing any package publishes changes. Same shape as the most recent test-only landing in this tree (d5df8168f, one new pin file, no changeset). skip-changeset applied.

验收备注

• recall's stranded exit carries no machine-readable repairability signal. Measured in PIN 4: the same strand that makes decide throw an envelope with repairable: true leaves recall returning resumed: false plus a bare resumeError string, and strandedDecisionDetails on that result is undefined. ⛔ Noted, NOT filed: recall deliberately tolerates a run it cannot resume (its own doc says the withdrawal and the record-lock release are the point), and no declared contract promises the envelope at this door — so this is a characterisation, outside the three filing classes. It is pinned in PIN 4 so it cannot drift unnoticed, and it is the door half of the POST /api/v1/approvals/requests/{id}/reject returns 500 while its effect lands AND strands the workflow run — three inconsistent outcomes from one call #13807 family if anyone widens that ruling.
• The card's own instance card, re-read as triage asked. service-automation: restoreConsumedSuspension cannot reach a nested run — a stranded child's cascade-failed ancestors are consumed without a snapshot, so restoring the child continues into a dead parent #15222 is open and is the same shape this PR reproduces — its cascade-failed ancestor answers NO_CONSUMED_SUSPENSION, exactly as PIN 2 measures. ⛔ Nothing about it is folded into this PR.
• The dispatch expected strandedDecisionDetails on the recall result to be null; the measured value is undefined. Reported rather than smoothed over.

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 245c6a23cd14b39cfd4badd27b6db957c731cefc → packageMentionDocs.

[os-warren]

PM 独立复核 —— 逐条自己量的，没有采信 seat 的读数

复核在一个独立 worktree（9f4e3ed55 detached，全新 pnpm install）里做，不是 seat 的树。

1. 交付面 —— PASS

检查	我的读数
三点 diff origin/main...HEAD	2 个文件：新 pin 文件 + scripts/engine-double-contract.pinned.json
Governed surface	check-governed-merges.mjs --test <两个文件> → EXIT=0（不受管），阳性对照 docs/adr/0041-flow-trigger-family.md → EXIT=3
Clause-②	NO，结构上成立：0 个文件落在 packages/spec/**
plugin-approvals 公有类型	未动（diff 里根本没有该包的源文件）

2. 四个 pin —— PASS，但第一遍是 UNMEASURED 不是绿

第一次直接跑得到 Failed to resolve entry for package "@objectstack/service-automation" —— 收集期失败，0 test。那不是红也不是绿，是没量到。pnpm --filter @objectstack/plugin-approvals... build 之后：4 passed (4)。整包 42 files / 694 tests 全过。check-engine-double-contract 与其 --self-test 双双 exit 0（811 pinned / 747 retained 行守住）。

3. 我自己做的两次消融

消融 A —— 分类器臂（复现 seat 的读数）：classifyStrandedRunState 的 case 'failed': return 'failed' 改成 return undefined。先断言锚点唯一（occurrences = 1），blob 141b6300 → efa52fe9。结果 1 failed | 3 passed，红的正是 PIN 1，且差异正是预测的形状：

- [["cascade-failed ancestor","failed"], ["genuine strand","failed"]]
+ []

还原后 blob 回到 141b6300。

消融 B —— PIN 3 的反空转（seat 没做这一条）：在 recordLog 里加 if (consumedSuspension) (entry as any).consumedSuspension = consumedSuspension; —— 也就是把 B 的第 1 条下放到生产者去做。重建 dist 后 PIN 3 变红，而且只对 strand 那一行红，cascade 那一行仍然缺席。

⇒ 这一条同时证了两件事：PIN 3 的 consumedSuspension 断言不空转；而且那个判据一旦发布出来就真的能把两行分开。剩下的唯一问题就是它在哪儿发布。

（插一句方法学：还原源文件后不重建 dist 再跑，仍是 1 failed。陈旧 dist 会伪装成一次红——所以每次消融的还原都必须带重建。）

4. ⛔ 一条 seat 没报、而且是我自己喂错的：consumedSuspensionDropped 不存在

卡上、以及我派发简报里原样转述的那句判据，是「终态记录若既无 consumedSuspension 也无 consumedSuspensionDropped」，并且标成「引擎自己的话」。全仓 grep：

• consumedSuspensionDropped —— 整棵树 0 处命中（不在 RunRecord，不在 ExecutionLogEntry，没有生产者，没有测试）；
• 那句 "a run that reached a terminal state which was not a strand (completed, cancelled, cascade-failed)" —— 没有任何文件写过。

引擎真正记的只有 RunRecord.consumedSuspension 一个字段，它自己的原话是：

written only on that one path, so its presence is itself the statement "this failed run had a pause and no longer has one".

「缺席 ⇒ 不是 strand」是对这一个字段的推读，不是引用，更不是两个字段的合取。

对本 PR 的后果，两条，都不打圆场：

1. PIN 3 的 consumedSuspension 断言是活的（消融 B 证的）；
2. PIN 3 的 consumedSuspensionDropped 断言今天空转 —— 没有任何可达的树状态能让它红。它不是证据。

对裁定的后果见卡上的升级评论：裁定的第 1 条写的是「getRun 加宽以携带引擎已经记录的那个判据」，而它点名的两个字段里，有一个压根没有生产者。

5. 我验证过的修正补丁 —— 交回 seat 推

补丁我已经写好并跑过（改的是文件头 docblock + PIN 3 的两行注释，无可执行改动：仍是同样 4 个 pin、同样的断言；42 files / 694 tests 绿，两个 gate 绿）。它把那句伪引用删掉，换成量出来的判据，并把空转那一行显式标注为前向守卫而非证据。

⛔ PM 不推 seat 的分支（本会话规则：不得推非指定分支），所以这条以跟进派发交回 seat 落。

6. PM 认定

交付的东西 PASS。 这是一个诚实的复现 pin：它把缺陷做成可执行的，把裁定的第 1 条前提证伪了，还自己带了门控对照（PIN 4）。status: needs_decision 是对的返回 —— 生产者侧发布点是契约决策，⛔ 车道席位不自选，已升级到卡上。

---

Generated by Claude Code

[os-warren]

⛔ 撤回：上一条 PM 复核的第 4 节是错的。这个 PR 的引文是准确的

上一条评论（5564466653）第 4 节说 consumedSuspensionDropped 不存在、说本 PR 引的那句「引擎自己的话」没有任何文件写过。两条都是假的。 跟进席位在推送前照我要求做了独立复量，直接把它打回来了 —— 这是正确的动作，⛔ 补丁没有被推上去。

我错在哪儿（机制，不是措辞）

我的 grep 跑在共享主 checkout 的工作树上。那棵树停在 3bd90d415（分支 claude/pm-dispatch-services-q9gycs），落后 origin/main 523 个提交。我把一次「陈旧树上的零命中」当成了「整棵树 0 命中」。

git grep -c "consumedSuspensionDropped" origin/main -- packages：

engine.ts:6   index.ts:1   stranded-run-object-store.test.ts:4
suspended-run-store.ts:2   sys-automation-run.object.ts:3

在正确的树上逐处读到：

• 声明：packages/services/service-automation/src/engine.ts:1331 —— consumedSuspensionDropped?: ConsumedSuspensionDropNotice;，就在 RunRecord.consumedSuspension 的下一条；
• 生产者：packages/services/service-automation/src/suspended-run-store.ts:796 —— consumedSuspensionDropped: readConsumedSuspensionDropNotice(row)；
• 消费者：engine.ts:6681 —— } else if (terminal.consumedSuspensionDropped) { dropped = terminal.consumedSuspensionDropped; … }，活的分支逻辑；
• 测试：stranded-run-object-store.test.ts:296-303（[Decision] Workflow resume ordering: a thrown node today leaves the run terminally unresumable — which of three shapes, given that the current order buys exactly-once across a crash? #13937 的 over-budget 快照那一块）。

而那句被我说成「没有任何文件写过」的话，逐字写在该字段自己的 docblock 里（engine.ts:1324-1325）：

…a terminal record with neither field is a run that reached a terminal state which was not a strand (completed, cancelled, cascade-failed), or never paused at all.

⇒ 本 PR 文件头的引用是准确的。 我准备的那个「修正」补丁如果推上去，会把一句正确的引擎引文换成一句错的 —— 正好是它自称要消除的那类错误。

随之作废的两条

• ⛔ 「PIN 3 的 consumedSuspensionDropped 断言空转」—— 作废。该字段有声明、有生产者、有消费者，runRecordToLogEntry 完全可以复制它 ⇒ 该断言与另一条一样是活的。
• ⛔ 「裁定的判据点名的两半里有一半没有生产者」—— 作废。两半都有。[Decision] inspectStrandedRequests now over-reports: it keys on status === 'failed' while the platform gained an authoritative strand discriminator — a cascade-failed run the engine calls NOT stranded is reported as one #15358 上的升级评论已同步更正。

复核里没有受这次污染、仍然成立的部分

这几条都是在正确的树上取的（PR head 的独立 worktree 9f4e3ed55，或直接 git show origin/main:）：

读数	状态
四个 pin 4 passed (4)（先 pnpm --filter @objectstack/plugin-approvals... build；第一遍是收集期失败 ⇒ UNMEASURED，不是红）	✅ 成立
整包 42 files / 694 tests 全过	✅ 成立
三点 diff = 2 文件；governed 判定 EXIT=0，ADR 阳性对照 EXIT=3（已在正确的树上重跑，不是沿用旧读数）	✅ 成立
Clause-② NO（0 文件落在 packages/spec/**）	✅ 成立
分类器消融 case 'failed' → undefined ⇒ 1 failed | 3 passed，红的是 PIN 1，差异形状如预测；blob 前后哈希与还原都验过	✅ 成立
PIN 3 反空转：在 recordLog 里发布 consumedSuspension ⇒ PIN 3 变红，且只对 strand 行红，cascade 行仍缺席	✅ 成立
PIN 3 的结构结论：ExecutionLogEntry（engine.ts:891，正确的树上重读）字段为 id / flowName / flowVersion / status / startedAt / completedAt / durationMs / trigger / steps / variables? / output? / error? / summary? —— 两个判据字段都不在；runRecordToLogEntry 也一个都不复制	✅ 成立

⇒ PR 的 PASS 认定不变，needs_decision 的升级不变 —— 卡的分叉（判据在哪儿发布）站在 PIN 3 的结构测量上，那条没被污染。作废的只有我自己加的第 4 节。

我改的规矩

⛔ 主 checkout 的工作树不再用于任何测量。它是别的会话在动的共享树，HEAD 会在脚下漂。本席后续所有源码读数只走两条路：正确 base 的专用 worktree，或 git grep / git show 显式带 ref。

---

Generated by Claude Code

[os-warren]

落地判定：必需上下文实测 6 条全绿；Part-of 那条红着留下，原因记在这里

维护者定的落地路径：本项目必须走合并队列。据此判定这个 PR 能不能进队，⛔ 不靠推断，实测：

必需上下文集（node scripts/check-required-contexts.mjs，EXIT=0）

lint.yml:lint                  → 'Lint & Repo Gates'
lint.yml:typecheck             → 'TypeScript Type Check'
ci.yml:test-gate               → 'Test Core'
ci.yml:dogfood-gate            → 'Dogfood Regression Gate'
ci.yml:build-core              → 'Build Core'
ci.yml:temporal-conformance    → 'Temporal Conformance (live PG + MySQL)'

6 条，本 PR 上全部 success。 Part-of PR must not also close its card 不在这个集合里 —— 与该 workflow 自陈一致（它没有 merge_group: 触发，而必需项必须能在队列构建上报告）。⇒ 合并队列会接受它。

⚠️ 我此前把这条写成「结构上不可能是必需项」的推断；上面是实测，两者结论一致，但只有后者算数。

⛔ 但它确实红，而且红得有道理 —— 这是一次明知故犯，记在这里

check-partof-closing-keyword.mjs 的 RULE 2：No commit on the pull request may carry a card-relation trailer at all: no closing keyword, no Part-of and no Refs bound to any card number. The body is the only carrier of the relation.

本 PR 两个 commit 都带了 Part of #15358（17a9dde7d 与 9f4e3ed55）。跟进席位独立复核了这个判定：它没有肉眼比对，而是从脚本里 import 了 commitRelations() 跑在两个 commit 的 %B 上，两次都返回 [{"keyword":"Part of","card":"15358"}]，正是 judge() 转成 EXIT_CONTRADICTION 的输入；--self-test exit 0（66 cases）作为阳性对照。RULE 1（正文）不涉及。

修法已经做好了，卡在一个权限上：

• 席位用 git commit-tree 重写了两个 commit（复用原 tree、parent、author/committer 及其日期，只用 grep -vFx 删掉那一行），新 head f6eb6189af77d817f144137684e8a3d34f5a3837；
• git diff 9f4e3ed55 <新head> 为空（0 字节）—— 内容逐字节未变；
• 重写后 commitRelations() 对两个 commit 都返回 []；
• ⛔ git push --force-with-lease 被本会话的权限分类器拒绝（pinned 与 plain 两种写法都拒），席位按该工具自己的指示停下、没有绕道（比如改用 API 改 ref —— 那是同一个破坏性动作换一扇门）。远端 head 仍是 9f4e3ed55，刚确认过，所以 lease 仍然安全。

⇒ 本 PR 带着这条红进队。 它换来的是：card relation 在本 PR 上有两个载体（正文 + 两个 commit 尾注）而不是一个。⚠️ 实际的自动关卡风险不适用 —— Part of 不是 GitHub 的 closing keyword，不会关掉 #15358；受损的是单写者纪律本身。

⭐ 修正提交已就绪、随时可推。若之后有人拿到 force-push 权限，f6eb6189a 直接推上去即可，⛔ 不需要重做，也不需要新 PR。

---

Generated by Claude Code