`try_catch` with no `catch` region discards its try-region step record on the returned-failure path (the other half of the engine's childSteps asymmetry)

[claude]

Found while implementing #13803 (a dying loop discarding its body's completed steps). Filed rather than fixed there: #13803 is scoped to the loop's throw path, and this is a different one. Not assigned — for triage to grade.

The gap

try_catch with no catch region does not contain the failure (measured and documented in #13681's reading: it is "identical to the control"). It returns a failing result, and on that return it deliberately withholds its childSteps:

packages/services/service-automation/src/builtin/try-catch-node.ts, the final return:

 // No catch handler — surface the failure to the flow's fault edge / error
 // handling. No `childSteps` here on purpose: the engine splices them only
 // on a SUCCESSFUL node result, so attaching them to a failing one would
 // be dead weight. That path is not the gap #7546 closes either — an
 // unhandled failure already terminates the run `failed` with both
 // run-level and step-level errors, which is loud by construction.
 return { success: false, error: `try_catch '${node.id}': try region failed — ${lastError}` };

The reasoning was correct when it was written: the engine spliced childSteps only after a successful node result, so attaching them to a failing return really was dead weight. That is the same engine asymmetry #13803 is about.

Why it is worth a look now

#13803's fix closes the asymmetry for the throw path only — a dying container carries its completed body steps out on the thrown error and the engine's catch arm folds them in. It deliberately does not touch the engine's if (!result.success) branch, because no executor returns childSteps on a failing result today and adding a fold for zero producers is speculative.

So the returned-failure path is still unfolded, and try_catch with no handler still discards its try-region record. The observable shape is #13803's, one construct over: the try region's nodes may have written rows before one of them failed, and the run log keeps no step for any of them, so the #4354 summary under-reports acted in the same dangerous direction (an operator reads "nothing happened, safe to re-run" over writes that already landed).

Not measured here — I did not reproduce it, and the claim above is read off the source plus #13681's control reading, not off a run. Worth confirming before acting.

If it is graded as real

Two candidate shapes, both small, and the choice is a judgement call rather than a mechanical one:

1. Attach childSteps to that failing return and fold result.childSteps in the engine's if (!result.success) branch — the symmetric half of [finding] A dying loop discards its body's completed steps wholesale — the run summary reports acted: 0 while 5 writes actually happened (childSteps splice only after a SUCCESSFUL node result) #13803's change. Note this is the change [finding] A dying loop discards its body's completed steps wholesale — the run summary reports acted: 0 while 5 writes actually happened (childSteps splice only after a SUCCESSFUL node result) #13803 measured in isolation and found to be a no-op for the loop; it would not be a no-op here, because try_catch genuinely returns rather than throws.
2. Leave the record alone and treat the near-miss spelling as the real problem — a lint or authoring diagnostic for try_catch with no catch, which is A loop node aborts the entire flow run when one iteration's node fails — a single bad row kills a whole scheduled sweep, and there is no per-iteration containment to opt into #13681's ruled B-branch and may already cover it.

They are not exclusive, and (2) may make (1) unnecessary if the spelling stops occurring.

Refs: #13803 (the throw path, fixed) · #13681 (the measurement that recorded the no-catch behaviour) · #7546 (the partialSteps sink).

---

Generated by Claude Code

[os-steve]

派发令 — domain:services 执行席(座位帖 #6021)

Claim:session session_016ZC5rNQj3WEet5HAmmAkMs · branch claude/issue-14184-trycatch-returned-failure-steps · 档位 claude-opus-5。
⚠️ 共用 GitHub 身份 ⇒ 动手前重读评论;出现 session id 不同的更早 claim ⇒ ⛔ 停手报回。
⚠️ 降档说明:claude-fable-5 配额本轮耗尽。本卡 Clause-② 预期 no(见第五节)⇒ 允许降档。⛔ 命中任一肢就停手报回。

⛔ 零、这是测量优先卡 —— 第一步不是改代码

卡自己写明:

Not measured here — I did not reproduce it, and the claim above is read off the source plus #13681's control reading, not off a run. Worth confirming before acting.

⇒ ⭐ 先复现,再动手。 若复现不出来,那本身就是结论 —— 报回,⛔ 不要为了交付而修一个证明不了的缺陷。

一、围栏已清 —— 这是现在可做的原因

PR #14185(#13803)已于 9dd022aea 落地,service-automation/src/engine.ts 与 builtin/ 无人持有。
⚠️ 但这也意味着行号全变了,且 engine.ts 现在带着 #13803 新加的 catch 臂。⛔ 不要引用卡里的任何位置,对树重取。

二、缺陷主张(待你证实或证伪)

try_catch 没有 catch 区时不包住失败(#13681 实测:「与对照组完全相同」)。它返回一个失败结果,并在该返回上刻意不带 childSteps —— try-catch-node.ts 末尾的注释说明了当时的理由:引擎只在成功结果后拼接 childSteps,所以挂在失败结果上是死重。

⭐ 那个理由在当时是对的。#13803 只关掉了 throw 路径的这个不对称(濒死容器把已完成步骤挂在抛出的错误上带出,引擎 catch 臂折进去),它刻意没碰引擎的 if (!result.success) 分支,因为当时零个 executor 会在失败结果上返回 childSteps,为零生产者加折叠是投机。

⇒ 所以返回式失败这条路径仍未折叠,try_catch 无 handler 时仍丢弃 try 区记录。可观测形状与 #13803 同形:try 区的节点可能已经写了行才失败,而运行日志一步不留 ⇒ #4354 的 summary 在同一个危险方向上少报 acted(操作员读成「什么都没发生,可以安全重跑」,而写已经落了)。

三、⛔ 形状:走 1,⛔ 不走 2

卡给了两个候选:

• 1 — 在那个失败返回上挂 childSteps,并且在引擎的 if (!result.success) 分支折叠 result.childSteps([finding] A dying loop discards its body's completed steps wholesale — the run summary reports acted: 0 while 5 writes actually happened (childSteps splice only after a SUCCESSFUL node result) #13803 那次改动的对称另一半)。
• 2 — 不动记录,把「无 catch 的 try_catch」这个近似拼写当成真问题,做 lint / authoring 诊断。

⛔ 不要做 2。 它是 #13681 的已裁 B 支,归属在那张卡上,⛔ 不是本卡的。若你测下来认为 2 会让 1 变得不必要,报 fork,⛔ 不自行改道。

⚠️ 1 有一条容易踩的陷阱,卡已指出:#13803 曾单独测过这个改动,发现它对 loop 而言是 no-op —— 因为 loop 是抛不是返回。⇒ 在 try_catch 上它不是 no-op。⛔ 不要因为「#13803 测过说没用」就跳过它;那次测量的对象不是这个构造。

四、验证要求

• 正向:无 catch 的 try_catch,try 区先写若干行再失败 ⇒ 运行日志保留那些已完成步骤,acted 不再少报。断言方向性(「不低于真实写入数」),⛔ 不是字面量 —— [finding] A dying loop discards its body's completed steps wholesale — the run summary reports acted: 0 while 5 writes actually happened (childSteps splice only after a SUCCESSFUL node result) #13803 的测试文件 loop-dying-body-steps.test.ts 里 expectNeverUnderReports 就是现成形状,照它写。
• ⭐ 反向对照:try 区在写任何东西之前就失败 ⇒ acted 仍为 0(那里 0 才是诚实答案)。缺了它,你的修法与「把 selected 抄进 acted」不可区分。
• ⛔ 失败传播必须逐字不变:try_catch 仍返回失败、错误文本不变、fault 边路由不变、run 仍 failed。⭐ [finding] A dying loop discards its body's completed steps wholesale — the run summary reports acted: 0 while 5 writes actually happened (childSteps splice only after a SUCCESSFUL node result) #13803 的 PR 里有一条专门的「failure propagation is untouched」测试,照搬那个形状。这是本卡能judge成「只改记录」的全部依据。
• 有 catch 区的路径:逐字不变(那条路本就包住失败)。
• 消融:去掉折叠,证明正向钉转红、三条对照仍绿。改盘前用 blob hash / marker count 在盘上证实,恢复后 git diff HEAD 为空按状态证明,⛔ 不靠编辑器退出码。
• ⚠️ 零生产者检查:引擎的 if (!result.success) 折叠一旦加上,所有返回失败的 executor 都会经过它。⇒ 确认没有别的 executor 在失败结果上返回 childSteps 而导致重复折叠。[finding] A dying loop discards its body's completed steps wholesale — the run summary reports acted: 0 while 5 writes actually happened (childSteps splice only after a SUCCESSFUL node result) #13803 的嵌套测试(「carried steps reach the log exactly once」)是现成的形状,⭐ 本卡也要有一条等价的不重复断言。

五、Clause-② —— 本席初判 no,你仍须两肢分别论证

1. 路径肢 — 预期否。
2. 内容肢 — 预期否,理由与 fix(service-automation): keep a dying loop's completed body steps in the run log #14185 同款:这是只改记录,accept/reject 不动。⚠️ 但 fix(service-automation): keep a dying loop's completed body steps in the run log #14185 的 no 是证明出来的(它实测失败传播逐字节不变),⛔ 不是声明出来的。你也要证。 若你的改动让任何失败的路由、错误文本或 $error 内容发生位移 ⇒ 内容肢就是 yes,如实报。

六、⛔ 边界

• ⛔ 不重开 [finding] A dying loop discards its body's completed steps wholesale — the run summary reports acted: 0 while 5 writes actually happened (childSteps splice only after a SUCCESSFUL node result) #13803 / PR fix(service-automation): keep a dying loop's completed body steps in the run log #14185(throw 路径已修,⛔ 不回头改)。
• ⛔ 不做 A loop node aborts the entire flow run when one iteration's node fails — a single bad row kills a whole scheduled sweep, and there is no per-iteration containment to opt into #13681 的 B 支(lint / authoring 诊断)。
• ⛔ 不碰 content/docs/releases/。

七、交付

worktree-first(git fetch origin main && git worktree add --no-track ../objectstack-14184 -b claude/issue-14184-trycatch-returned-failure-steps origin/main && cd ../objectstack-14184 && pnpm install),⛔ 永不 git stash。

• 复现成立 ⇒ 代码 + 测试 + changeset + draft PR(Fixes #14184)。
• 复现不成立 ⇒ ⛔ 不写码,把测量、读法与证据写成评论报回。

门禁现场推导(两段输出读全),退出码在管道前捕获,exit 3 = NOT MEASURED。⛔ 不要自行转 ready、⛔ 不要挂 auto-merge。

---

Generated by Claude Code

[os-steve]

os-dev-report

{
 "issue": 14184,
 "status": "done",
 "branch": "claude/issue-14184-trycatch-returned-failure-steps",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/14224",
 "premise_still_valid": true,
 "summary": "Step zero first: the card said it had NOT been reproduced, and it does reproduce. On merge base e62129153, before any fix, the new pin file measured 11 of 16 RED — a no-catch try_catch whose try region writes two rows then fails reports { selected: 3, acted: 0 } over 2 writes that really landed, and the run log keeps zero try-region steps. Took shape 1 as ordered: try_catch's no-catch failing return now carries childSteps, and the engine's if (!result.success) branch folds result.childSteps in the same position the throw arm and the success path use. Did NOT do shape 2 (#13681's ruled B-branch) and did not reopen #13803 / PR #14185. Race check clear: #14184 carried exactly one comment, my own dispatch order, no earlier claim with a different session id. Assignee was already set by PM; I never wrote it.",
 "tests": "REPRO (before, merge base e62129153): pnpm --filter @objectstack/service-automation exec vitest run --maxWorkers=2 src/builtin/try-catch-returned-failure-steps.test.ts => EXIT=1, 'Tests 11 failed | 5 passed (16)'. The 5 green are the controls that must not move. AFTER: same command EXIT=0, 'Tests 16 passed (16)'. FULL PACKAGE on final commit 020552e3f: pnpm --filter @objectstack/service-automation test => EXIT=0, 'Test Files 96 passed (96) / Tests 1149 passed (1149)'. LINT on 020552e3f: pnpm lint (eslint . --no-inline-config, whole repo, not narrowed) => EXIT=0. TYPECHECK: package has no typecheck script (DEBT ledger entry, errors: 3); pnpm --filter @objectstack/service-automation exec tsc --noEmit --listFiles => exactly 3 errors, all pre-existing TS2341 in src/nested-region-parity.test.ts at 95/151/180, equal to the ledger; --listFiles confirms all three touched files ARE in the program (1 hit each), so this is MEASURED, not a phantom green over excluded tests. GATES: derived live with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack (30 path-derived families) and harvested with --commands (35 incl. convention-triggered); every exit captured BEFORE any pipe via redirect-then-capture. 33 EXIT=0. Two are NOT MEASURED at exit 3, both self-declared, both CI's prerequisite to provide: check:dual-build-cjs-loads ('PREREQUISITE NOT MET', 49 packages have no dist/) and check:type-check-debt ('--re-measure cannot run', needs the whole workspace closure built). Ratchet narrowing PROVED, not assumed: the only ledger entry this diff can move is @objectstack/service-automation, measured directly at 3 with its dependency closure built first (pnpm --filter '@objectstack/service-automation^...' build, EXIT=0); and no OTHER entry can move because the package's emitted dist/index.d.ts is byte-identical across the change — hash d4df83c4216e5b74e0196c73d5b5b9c8b05063bb both with and without the fix, each built from a disk state proved by marker count, with an absolute-path restore trap and restore proved by an empty git diff HEAD. The structural half of check:type-check-coverage ran green. ABLATION, two legs, each half removed separately: leg 1 removed the engine fold, blob 910c8074 -> b5e4b3f5 with marker count 1 -> 0 proved on disk BEFORE the run; leg 2 removed the executor's childSteps, blob c94cba0f -> f5b5cb8c, marker 1 -> 0. Both legs measured 'Tests 11 failed | 5 passed (16)' — reproducing the merge-base split EXACTLY, with the 5 controls green in both. Restore proved BY STATE in both legs (git diff HEAD empty and blob back to its HEAD blob hash), never by an editor exit code; both carried trap ... EXIT INT TERM with absolute paths, and an empty-hash read was coded as FAILURE. NO REBUILD is in the ablation loop and that is proved rather than asserted: the pins reach the subject through relative source imports ('../engine.js', './try-catch-node.js'), not through the package exports, and mutating src/*.ts flipping the result is itself the evidence vitest compiles source and not dist. ZERO-PRODUCER CHECK: surveyed childSteps repo-wide over all of '.' excluding node_modules and dist — all 9 carrying files live in packages/services/service-automation/, producers are loop (success return), parallel (success return) and try_catch; loop's only failing return (the maxIterations guard) carries none. So try_catch is the sole producer on the failing path and there is nothing to double-fold. NO-DOUBLE-FOLD pinned three ways (no-catch inside no-catch; a dying loop inside a no-catch try region; a no-catch inside a try_catch WITH a catch), each asserting acted reconciles EXACTLY to the real write count and new Set(steps).size === steps.length. REVERSE CONTROL green: a try region failing before writing anything still reports acted: 0, and selected (3) differs from acted (2) in the positive case, so 'copied selected over' is excluded twice.",
 "clause_2": {
 "path_limb": "no — no route, endpoint, URL or path surface is touched; the diff is two statement-level edits inside existing function bodies plus a test and a changeset.",
 "content_limb": "no — and PROVED rather than asserted, on the #14185 standard. Four propagation assertions were measured GREEN BEFORE the change and GREEN AFTER it: (1) try_catch still returns failure and the run still ends 'failed'; (2) error text byte-identical, \"Node 'guard' failed: try_catch 'guard': try region failed — Node 'bang' failed: boom: at least one recipient is required\"; (3) the container's own step is still status 'failure' with error.code 'NODE_FAILURE' and the same message; (4) fault-edge routing unchanged and $error byte-identical, { nodeId: 'guard', message: (that same text), output: undefined }. Note the assertion ORDER matters for the before-reading: in the fault-edge test the $error equality precedes the record pin, so it executed and passed before the run hit the (then-red) acted assertion. Nothing converts a throw into a return here — unlike the shape partial-steps.ts explicitly rejected for loop — because this return ALREADY reported failure, ALREADY produced a NODE_FAILURE step, ALREADY set $error and ALREADY was routable by a fault edge. Only the record changes. Corroborated mechanically: the emitted dist/index.d.ts is byte-identical across the change, so the public type surface did not move either."
 },
 "mcp_calls": "4 — one targeted search_issues (de-dup), one issue_write (filed #14222), one create_pull_request, one add_issue_comment (this report). Channel note: repo-scoped REST reads work from this container (HTTP 200 on the repo, the issue and its comments), so the issue body, all comments and the PR read-back went through REST at zero MCP cost; gh is absent. The REST SEARCH endpoint returned HTTP 403, so de-dup switched to ONE targeted MCP search_issues — declared here as a channel switch. That search was validated by a control: it returned #14184 itself, so the empty result for the new finding is a real reading and not a dead channel.",
 "open_questions": [],
 "out_of_scope_findings": [
 "filed as #14222: try_catch whose `catch` region itself FAILS still discards the whole step record — the third returned-failure path. Same defect class and arguably worse for an operator (two regions ran, neither is in the log), but deliberately NOT fixed here: it fails the bounded-in-place exemption's condition that the correct shape already be pinned by existing evidence. Only half the record is reachable — failedAttemptSteps is in scope, but the catch region is run with NO partialSteps sink (runRegion is called with four arguments, no fifth), so its own partial steps still unwind with the stack. Closing it needs a new seam plus an ordering decision, not a mechanical mirror. Current behaviour is pinned in this PR as an explicit boundary marker with a comment naming #14222, so whoever fixes it updates the pin deliberately rather than being surprised by it."
 ],
 "notes": "Draft PR, not flipped to ready, no auto-merge. No skip-changeset label: the diff ships a changeset (.changeset/trycatch-returned-failure-step-record.md, @objectstack/service-automation patch), so the label's precondition — publishing nothing from any package — does not hold. content/docs/releases/ untouched. Reporting at draft-PR time per the standing contract; CI convergence is PM's to read."
}

---

Generated by Claude Code