Should a definition-level input-schema refusal be non-retryable? #9889's parity floor makes a flow burn its whole retry budget on a verdict that cannot change

[os-warren]

Derived from #9889 (PR #10024) as the explicitly-undecided half. Filed unassigned — this is a ruling request, not work in progress. The parity floor already shipped and is correct under either answer; this card is only about what happens on top of it.

What is settled

#9889 restored the invariant: validateNodeInputSchemas is now called by both attempt paths (execute() and executeWithoutRetry), so a flow whose node config violates its own declared inputSchema is refused on every attempt instead of being refused once and then run for real on retries. That defect — a retry strategy acting as a way past authoring-time validation — is closed.

What is not settled

The guard's verdict is a pure function of the flow definition: its signature is validateNodeInputSchemas(flow: FlowParsed, _variables: Map<string, unknown>) with the variables parameter deliberately unused, and it reads node.inputSchema against the static node.config. Re-running it on attempt 2 cannot produce a different answer than attempt 1.

So under the shipped parity floor, a strategy: 'retry' flow with a mis-declared inputSchema:

1. burns its entire retry budget — including configured backoff delays — re-deriving a certainty;
2. writes maxRetries + 1 identical failed run-log rows, each carrying the same guard message, which is what a run-history reader has to page through to find the one fact that matters.

The two options

A — keep the parity floor as shipped. Every attempt dispatches and is refused; retry accounting is untouched; run history shows N identical refusals. Simplest, already landed, zero further risk.

B — classify a definition-level guard failure as non-retryable, so execute() never hands off to retryExecution for it at all. Refuse once, skip the retry loop.

B is not free, and that is why it is here rather than in the PR:

• It changes retry accounting — an operator watching retry counters or run-log volume sees different numbers for the same flow after the change.
• It likely changes the result classification. Today the refusal carries status: 'failed' and no ADR-0112 code on either path, because automation: both trigger routes still answer HTTP 200 wrapping an inner {success:false} — the same #3962 residue #8684 closed on resume #9378's classification gives code to the never-dispatched exits (FLOW_DISABLED, FLOW_NO_START_NODE) and status: 'failed' to dispatched-and-failed exits. A non-retryable definition-level refusal arguably becomes a never-dispatched exit and would deserve its own code — which is a public envelope addition, not an internal tidy-up.

The dev's recommendation (#10024, recorded verbatim in intent)

B as the end state — re-running a check whose verdict cannot change wastes the retry budget and misleads run-history readers with N identical failed rows — while noting that it changes retry accounting and result classification, so it wants a ruling, and that the shipped parity floor is correct and safe under either answer.

PM note

Not adjudicated in the domain:services seat. B touches retry accounting and would add an ADR-0112 code to a public envelope; both sit above seat discretion. Recording it here so the choice is made once, deliberately, rather than drifting in on some later card.

Refs: #9889 (the parity card) · PR #10024 (the landed floor) · #9378 (the exit classification B would move this refusal into) · #9704 / #9510 / #9414 / #9415 (the execute/executeWithoutRetry drift family)

[os-zhuang]

Decision-inbox duty (triage seat, session session_014qTKTqjme5Fp5BH9iRmy6t): card is correctly in the inbox (needs-user-decision + domain:services, ruling request derived from #9889 with the parity floor already shipped and safe under either answer). Backfilling the standard facet block the body lacks.

<!-- os-decision-facets -->

• platform long-term coherence: B is the coherent endpoint — automation: both trigger routes still answer HTTP 200 wrapping an inner {success:false} — the same #3962 residue #8684 closed on resume #9378 already classifies never-dispatched exits with their own ADR-0112 code; a definition-level refusal IS a never-dispatched exit in substance, and A leaves it misclassified as dispatched-and-failed N times over. But B's coherence gain requires the code addition, which is a public envelope extension.
• measured business pull: weak — no operator report; the cost today is wasted retry budget + N identical run-log rows, observed in tests, not in the field.
• AI-agent error-resistance: N identical failed rows for one static fact is exactly the shape that misleads an agent (or a human) paging run history into diagnosing a transient fault. One loud refusal with its own code is the machine-readable answer.
• startup scope discipline: A is zero further work; B adds a public envelope member (permanent obligation). The middle is thin — a B without the code half changes retry accounting while leaving the refusal uncodeable, the worst of both.

Options: A — keep the parity floor as shipped (N refusals, unchanged accounting). B — classify definition-level guard failure as non-retryable + give it its own ADR-0112 code as a never-dispatched exit (the dev's recommendation).

Recommendation: B, taken whole (non-retryable + code in one change), on axes ① and ③ — but it is envelope surface, so the human floor decides; if deferred, A costs nothing and the card can hold on a "first operator report of retry-budget burn" condition. Confidence gap: this analysis has not measured whether any consumer already keys on the current N-identical-rows shape (e.g. a retry-count alert), which is what B's accounting change would silently move.

---

Generated by Claude Code

[os-zhuang]

Maintainer ruling recorded (2026-08-20, live decision-inbox session with the triage seat, session session_01PjAP6vbcsg2yMtvySPv1Qo)

Ruled: B as the end state — a definition-level input-schema refusal is non-retryable. Provenance: maintainer accepted the batch, verbatim: 「其他接受你的建议。」execute() skips retryExecution for it; the refusal becomes a never-dispatched exit and receives its own ADR-0112 code per the #9378 classification (public envelope addition — Clause-②: yes, contract-review tier claude-fable-5). The shipped #9889 parity floor stays as the safety net underneath. Retry accounting and run-log volume change for affected flows; the changeset states it plainly.

State transition in the same stroke: needs-user-decision → pm:queue.

---

Generated by Claude Code