[Decision] `inspectStrandedRequests` now over-reports: it keys on `status === 'failed'` while the platform gained an authoritative strand discriminator — a cascade-failed run the engine calls NOT stranded is reported as one

[os-warren]

Filed by the domain:services execution seat (session session_01XpTx2tbq3pZRYAdoGt6E6Y, os-warren, seat post #6021) out of #13909's final dispatch, which was instructed to stop and report this fork rather than decide it. Unassigned; domain:*, type and priority are triage's.

⚠️ This is the opposite defect from the one #13909 was dispatched for. That card asked to widen the inspector's oracle because it was too narrow. It was widened — by that card's own slice 1 (PR #13934, 59c089149, 2026-09-01). What is left is that it is now too wide, in exactly the direction the dispatch warned about: "a widened oracle that now reports every terminal failed run is as useless as one that reports none."

The measurement

ApprovalService.classifyStrandedRunState (packages/plugins/plugin-approvals/src/approval-service.ts:268-298) keys on run.status === 'failed'.

PR #15237 (5964124dd) then gave the platform a strictly narrower discriminator, and the engine's own words call it authoritative — packages/services/service-automation/src/engine.ts:1287-1289: a terminal record with neither consumedSuspension nor consumedSuspensionDropped

is a run that reached a terminal state which was not a strand (completed, cancelled, cascade-failed), or never paused at all.

⇒ A cascade-failed run — the failAncestors shape engine.ts:5558-5560 explicitly calls not stranded, because failSuspendedRun consumes the ancestors' pauses and journals nothing — has status: 'failed', no live suspension, and a terminal approval request. It is therefore reported today as runState: 'failed': a run the platform declares is not a strand, and that restoreConsumedSuspension cannot re-arm.

⛔ Not hypothetical — it is the subject of open #15222.

Why it is not mechanical, and why it is a decision rather than a dispatch

Two structural facts, both measured:

1. ApprovalResumeSurface.getRun (approval-service.ts:144) is declared returning only an optional status — so the inspector structurally cannot see the faithful property. And ApprovalResumeSurface is barrel-exported from plugin-approvals/src/index.ts.
2. StrandedRunState is 'missing' | 'failed' (:319) and is barrel-exported too.

⇒ Every route changes what the inspector promises, not merely what it finds — which is precisely the Clause-② boundary #13909's dispatch drew as its stop-and-report line. ⇒ Contract-review tier, Clause-②: yes, whichever option is ruled.

Options

A — Leave it; record the over-approximation as declared behaviour. The inspector's underlying answer ("this request's run cannot advance") is true of a cascade-failed run; only the label over-claims. Zero contract change. Cost: an operator cannot tell a repairable strand from an unrepairable cascade failure, and restoreConsumedSuspension will refuse on some reported rows.

B — Widen ApprovalResumeSurface.getRun to carry the consumed-suspension discriminator, and split StrandedRunState into a repairable and an unrepairable member — report BOTH, labelled apart. Cost: two public type changes.

C — Narrow the oracle to the discriminator, so only restoreConsumedSuspension-repairable runs are reported. Cost: ⛔ it deletes the only surface that currently shows a cascade-failed request — a visibility regression on a condition the engine calls worse than a strand — and it still needs (1)'s getRun widening anyway.

• ① 项目长远合理性(权重 ≥50%,领起推荐) —— 平台现在已经有一个权威判据(consumedSuspension / consumedSuspensionDropped),而这个 inspector 键在一个更粗的属性上。让报告面与平台自己的词汇对齐,是缩小特例的方向;继续键在 status === 'failed' 上,则每新增一种终态形状,这个标签就再偏一点,而且偏移是静默的。①指向 B:一次把判据接上,而不是让每个未来的读者都得学一遍「这个标签比它的名字宽」。⛔ C 表面上也对齐了判据,但它用删掉一整类行的可见性来买对齐 —— 长远看这是把一个标注问题换成一个失明问题,更贵。
• ② 实际业务拉动 —— 非零且已具名:service-automation: restoreConsumedSuspension cannot reach a nested run — a stranded child's cascade-failed ancestors are consumed without a snapshot, so restoring the child continues into a dead parent #15222 就是这个形状的 open 卡(嵌套 run 的 cascade-failed 祖先)。运维侧的可见后果也具体 —— 报出来的行里有一部分,运维照着去按修复动词会被拒绝。⇒ 按分歧推荐序,有实测拉动 ⇒ 荐长远终态一次付清,即 B。
• ③ 防 AI 犯错 —— 出错时谁看到什么。今天:一个 AI(或人)读到 runState: 'failed',合理地推断这行可以用 restoreConsumedSuspension 修,然后被拒绝,而拒绝的理由与标签无关。B 把这变成响亮的结构性区分:不可修复的那类带自己的成员名,消费方在类型层面就被迫处理它。A 则把这条知识留在散文里 —— 而散文正是本车道今天已经被咬过两次的地方(一条描述对两个副本之一为真、却被读作对两者都为真)。
• ④ 创业阶段不扩散 —— B 确实扩了两个导出类型,这是真成本,⛔ 不粉饰。但它不引入新概念:判据已经存在于引擎里、#15222 已经存在于板上,B 只是把已有的区分搬到消费方看得见的位置。相比之下 A 的「永久义务」是每个消费者都要记得这个标签比名字宽 —— 按本车道的经验,那种义务不会被记住。

推荐:B。 四棱中①以≥50% 权重领起并指向 B;②有具名拉动、按分歧推荐序取长远终态;③B 是响亮/结构性的一侧;④的扩面成本真实但有界,且不引入新概念。
回退:A 是可辩护的暂缓 —— 今天报出来的集合没有一行是错的,只有它的标注过宽;若维护者判断标注精度暂时不值两个导出类型的变更,A 零风险且可随时改判。⛔ C 不建议:它是唯一会丢失运维需要的一行的选项。
置信缺口(本分析看不见什么): 未测量今天实际有多少 cascade-failed 行被报进来 —— 那需要真实部署上的运维普查,与 #13909 的定容问题同源(单独立卡)。这个数字只影响紧急度,⛔ 不翻转方向:B 在数字为零时也仍然是对的形状,只是不急。

Refs

#13909 (closed; this fork is what survived it) · #15222 (the nested-run instance of exactly this shape) · #13937 / PR #15237 (5964124dd, the discriminator) · #13934 (59c089149, the widening that created the over-report) · #15336 (the grouped §5 finding — nearest family, but ⛔ does not state this) · #13807 (released downstream)

⛔ Unaffected by the ADR-0131 tenancy pause — no tenant surface.

[os-warren]

⛔ Label correction by the filing seat — domain:services and priority:p2 removed; only needs-user-decision stands. Read back: ["needs-user-decision"].

I applied both on filing, in a card whose own body says "Unassigned; domain:*, type and priority are triage's — this seat does not produce them." domain:* has a single producer and this seat is not it; the routing here is not in doubt, but "obvious" is exactly the reasoning the single-producer rule exists to refuse. needs-user-decision stays — a pm state label is the filing seat's to set, and this card must not read as dispatchable.

⚠️ Recorded rather than quietly fixed because it is the fifth instance today of one shape: stating a rule and not executing it in the same breath. The others — correction 84 (typed the answer into my own positive control), 85 (enumerated from memory instead of searching for the predicate), 88 (wrote "read back: X" before reading), 89 (quoted a card body inside a table whose stated purpose was to re-verify against the tree). ⇒ Writing the rule down is not running it, and this seat has now produced that failure five times in one session while getting the rule text right every time.

⛔ Nothing about the decision's substance changes. Triage's routing, grading and type are owed as normal.

---

Generated by Claude Code

[os-warren]

Maintainer ruling recorded — B: ApprovalResumeSurface.getRun carries the consumed-suspension discriminator, and StrandedRunState splits into a repairable and an unrepairable member — both reported, labelled apart. needs-user-decision → pm:queue in the same stroke.

Director seat, summon 14 (session_01LsEjuNMPitCHwEfYftZ1um, GitHub os-warren). Provenance: maintainer, live PM chat, 2026-09-04, decision batch #36, verbatim 「同意」 on the presented recommendation 1(1A·2A) · 2B · 3D (this card is item 2). Premise carried from the card body (measured by the filing seat on origin/main): classifyStrandedRunState keys on run.status === 'failed'; the engine's authoritative discriminator is consumedSuspension / consumedSuspensionDropped (PR #15237); getRun exposes only status; both types are barrel-exported; #15222 is the live instance.

The ruling

1. getRun widens to carry the discriminator the engine already records, so the inspector can see the property it needs instead of a coarser one.
2. StrandedRunState splits: the repairable strand (a live pause restoreConsumedSuspension can re-arm) and the unrepairable terminal failure (cascade-failed and its kin) become distinct members. Both stay reported — an operator still sees a cascade-failed request; they now also see that the repair verb will not apply. The existing 'missing' member is untouched.
3. ⛔ Not A: leaving a label wider than its name is a permanent obligation on every consumer to remember it, and this lane has already been bitten twice by prose carrying what a type should. ⛔ Not C: narrowing deletes the only surface that shows a cascade-failed request — a visibility regression on a condition the engine calls worse than a strand.

Execution (domain:services seat)

One M PR: the two type changes, the classifier reading the discriminator, inspectStrandedRequests reporting both members, pins for both directions (a cascade-failed run lands in the unrepairable member; a genuine strand still lands in the repairable one; 'missing' unchanged), the changeset naming the widened getRun and the new member (minor, additive surface — the floor rule ruled on #15294). Clause-② yes whichever way it was ruled (both types are published); needs:contract-review on card and PR once a diff exists, ⛔ not before; this seat reviews at tier. #15222 stays its own card and is the first consumer of the new member. domain:*, type and priority are triage's (the filing seat withdrew its own labels on the single-producer rule, 5540634683); the confidence gap — how many cascade-failed rows are reported on real deployments — affects urgency only and is a separate ops-census card if anyone wants the number.

Ruling authority: maintainer 2026-09-04 (batch #36). Related: #13909 · #15222 · #13937 / PR #15237 · #13934 · #15336.

---

Generated by Claude Code