fix(service-automation): answer a delegated subflow child refusal as a refusal, not a terminal failure

[claude]

Fixes#14379

A parent run paused at a subflow node forwards a resume down to the child it is parked on — the screen-flow path, where the caller holds ONE stable run id (the parent's) and posts every wizard step to it. When the child refused that bag, the delegation block read it as a child that ran and died: it called failSuspendedRun on the parent and answered a code-less{ success: false, error }. One mistyped form field therefore destroyed a running workflow — the parent's suspension consumed and a failure recorded, the still-paused child orphaned with nothing left to bubble into, the caller told 400 FLOW_FAILED ("it ran and was rejected") for something that never ran, and their corrected retry on the same run id answered RUN_NOT_FOUND.

The delegation now branches on the child's own code. A retryable refusal is answered as a refusal, with its code intact and both pauses untouched; failSuspendedRun is reserved for a child that genuinely ran and failed.

Head at the time of every measurement below: 4ae326704.

Ruling of record (14379#issuecomment-5504400729, verbatim)

The fix criterion — prefer the producer-first one. The card offers two discriminators; take the second. ⛔ Do not branch on "is the child's suspension still live" — that is a second store read whose answer can race, and it infers intent from state. Branch on the child's own code being one of the refusal codes the engine itself answers (INVALID_SCREEN_INPUT, INVALID_SIGNAL, RESUME_IN_PROGRESS, STORE_UNAVAILABLE), which is the producer naming the condition — the same rule the platform applies everywhere else. failSuspendedRun is then reserved for a child that genuinely ran and failed.

⚠️And propagate the code. The current envelope carries none, which is why the transport lands on 400 FLOW_FAILED. Returning the child's envelope with its code intact is half the fix; a fix that leaves both pauses alive but still answers a code-less envelope has repaired the state and left the caller equally misled.

The pins the card names are the right ones, and one more: refused parent resume ⇒ code: 'INVALID_SCREEN_INPUT', parent and child still suspended, corrected retry on the parent completes. Add a negative control — a child that terminally throws must still fail the parent — or the fix can pass by never failing anything.

⚠️ Serialisation: three cards are live on these same 40 lines

… #14392 — the "child run … is gone — continuing without child output" line, which sits in the else of the very if (childRun) this card's arm lives inside. Graded p3 this round. Two separate diffs: a log-text fix disappearing inside a state-machine repair is how the state-machine repair stops getting reviewed on its own merits.

Serialisation honoured: the branch is cut from origin/mainafter PR #14388 merged, and the else arm carrying the "child run … is gone" log line is byte-untouched — #14392 stays a separate diff, still open.

The change

packages/services/service-automation/src/engine.ts, two additions and nothing else:

1. A module-private closed set, RETRYABLE_RESUME_REFUSAL_CODES, naming the codes resumeInternal itself answers for a resume that never ran — INVALID_SCREEN_INPUT, INVALID_SIGNAL, RESUME_IN_PROGRESS, STORE_UNAVAILABLE — plus the one-line predicate that reads it. RUN_NOT_FOUND is deliberately absent and the docblock says why: it is the engine's terminal "this pause is gone for good" class (the automation: the run-resume route still answers HTTP 200 wrapping an inner {success:false} — the route #3962's status-code unification left behind #8684 comment sitting 30 lines above), which a transport answers 404 and no retry can fix.
2. A new arm placed before the terminal-failure arm, answering the child's envelope verbatim but for the parent's durationMs, consuming neither pause and refreshing nothing (the child did not advance, so the parent's surfaced screen is already current).

No log site was added at any level: a refusal is a response, not a degradation, and the child already logged its own warn where it produced the refusal.

Premise checks on origin/main (all verified before the first edit)

#	Premise	Verdict
P1	resumeInternal's subflow block still has exactly three arms, no refusal arm	holds — located at engine.ts:4798 by run.correlation.startsWith('subflow:'); the three arms read exactly as the card quotes them
P2	The card's measurement reproduces on the current tree	holds — written as a failing test first and run before any source edit: 4 failed, 1 passed, every failure expected undefined to be 'INVALID_SCREEN_INPUT' / 'INVALID_SIGNAL'
P3	PR #14388 is on origin/main; refuseInvalidScreenInput / ENGINE_BUILT_SIGNAL untouched	holds — the signal-less normalisation to {} is at the public door; neither symbol appears in the diff
P4	The refusal codes are the four the ruling names	holds, with one reachability note below — grepped the producers inside resumeInternal: RESUME_IN_PROGRESS, STORE_UNAVAILABLE, RUN_NOT_FOUND (three sites), INVALID_SCREEN_INPUT (via refuseInvalidScreenInput), INVALID_SIGNAL. No other code is produced there. Nothing was invented and packages/spec was not touched
P5	packages/spec, content/docs/releases/** and the #14392 log line untouched	holds — the diff is 3 files: engine.ts, one new test file, one changeset

P4 reachability note (reported, not acted on). Two of the four are reachable through delegation today and are pinned end to end: INVALID_SCREEN_INPUT and INVALID_SIGNAL. The other two are in the set because the producer answers them from this method, but neither has a deterministic fixture: RESUME_IN_PROGRESS needs a real race window against a concurrent direct child resume, and a STORE_UNAVAILABLE outage trips the parent's own loadSuspendedRunStrict several frames earlier, so the parent never reaches the delegation block at all. Keeping them in the set is the producer-first rule applied whole; the pins claim only what was measured.

Hypotheses (each falsifiable, each with its evidence)

• H1 — one new arm before the terminal one, no failSuspendedRun, no pause consumed: HOLDS. That is the whole source change.
• H2 — is the parent's pause consumed before the delegation block? NO, so nothing needed restoring.forgetSuspendedRun(run, 'resumed') — the one consumption on this path — sits ~90 lines after the delegation block, and the only other consumer is the failSuspendedRun the new arm bypasses. creditChildRun returns immediately when childSummary is absent, which it is on a direct parent resume. Proven behaviourally, not just by reading: hasSuspendedRun(parentRunId) is true after the refusal in every refusal pin.
• H3 — the corrected retry completes end to end: HOLDS. The child's screen accepts the corrected bag, the child completes, the engine-built signal maps its output into the parent, and the downstream node observes { kind: 'normal' }. Both suspensions are gone afterwards.
• H4 — the negative control still fails the parent through failSuspendedRun, envelope shape unchanged: HOLDS. A child whose node throws after the screen accepted the bag still answers success: false, codeundefined, error matching subflow run '…' (child_flow) failed: …, with both suspensions consumed. This test is green on both sides of the change — it is the control that stops the arm from passing by never failing anything.

Tests

New file packages/services/service-automation/src/builtin/subflow-child-refusal.test.ts — 5 pins, built on installBuiltinNodes with real subflow and screen nodes, exactly the composition the card measured.

pin	asserts
a	refused parent resume ⇒ success: false, code: 'INVALID_SCREEN_INPUT', the child's own actionable text, parent and child still suspended, the parent's surfaced screen unchanged, downstream never ran
b	corrected retry on the same parent run id ⇒ completes, child output mapped into the parent, both suspensions gone
c	the signal-less gesture resume(parentRunId) ⇒ the same refusal, both pauses intact, corrected retry still lands (the population the scope note 14379#issuecomment-5504169090 adds)
d	a second refusal code on the same path — INVALID_SIGNAL from a reserved variable name against a child pause that declares no screen contract ⇒ same shape, then the legitimate submission lands
e	negative control — a child that genuinely ran and threw ⇒ parent failed terminally, code undefined, error text unchanged

Every refusal pin asserts the ADR-0112 code (and the error text), never a bare "it failed".

Verdict lines, quoted from the runs, all at 4ae326704:

BEFORE the source edit (the red half, same test file):
Test Files 1 failed (1)
Tests 4 failed | 1 passed (5)
AssertionError: expected undefined to be 'INVALID_SCREEN_INPUT'
Targeted suites (new pins + subflow-node + both screen-resume suites):
Test Files 4 passed (4)
Tests 41 passed (41)
os-verify-lock: VERDICT command-exit 0
Whole package:
Test Files 99 passed (99)
Tests 1171 passed (1171)
os-verify-lock: VERDICT command-exit 0
Downstream consumer `@objectstack/plugin-approvals` (closure built first):
Test Files 35 passed (35)
Tests 652 passed (652)
os-verify-lock: VERDICT command-exit 0

Type check: this package declares no typecheck script and carries a frozen DEBT ledger entry of 3. tsc --noEmit -p tsconfig.json reports exactly those 3 pre-existing TS2341 in src/nested-region-parity.test.ts (a file this diff does not touch) — unchanged. --listFiles confirms both edited files really are in that program (engine.ts and subflow-child-refusal.test.ts both listed), so this is a measurement and not a green over source nothing read.

Ablation (on the committed tree, both legs proven on disk)

Mutation: the new arm's guard neutralised in place, with a greppable sentinel so the on-disk change is provable from two directions.

HEAD_BLOB=111b7185441f3eabb94e62c8390155c7efe2b625
PRE marker=1 sentinel=0
POST marker=0 sentinel=1
MUTATED_BLOB=5b463c5d48b7d523513e8b01963cf3fad9fa9b7e
ABLATION_VITEST_EXIT=1
Test Files 1 failed (1)
Tests 4 failed | 1 passed (5)
RESTORED_BLOB=111b7185441f3eabb94e62c8390155c7efe2b625
RESTORE marker=1 sentinel=0
git diff HEAD -- $TARGET (expect empty): [empty]
git status --porcelain -- $TARGET (expect empty): [empty]
ABLATION_DONE

Predicted direction, observed: pins a–d red, pin e (the negative control) green. Restore verified by blob-hash equality against the HEAD blob and an empty git diff HEAD, not by an exit code; the script carried a trap … EXIT INT TERM with absolute paths throughout, and an earlier attempt that produced a zero-match substitution aborted at the guard rather than reporting a green ablation — it is reported here as an admitted no-op run, not quietly retried.

No rebuild is required for this ablation and none was performed. The pin imports the subject relatively (../engine.js, same package), which vitest resolves to src/engine.ts, and the package's only resolve.alias entry is an unrelated one for @objectstack/platform-objects. That is proven positively rather than asserted: mutating src/engine.ts alone, with no build, flipped the suite red, and restoring it alone flipped it green.

Gates

Derived on the final head from the actual change set, never a hand-written list: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands at 4ae326704 — 36 commands over the 3 changed paths. 33 exited 0. Three are PREREQUISITE NOT MET, recorded as NOT MEASURED and not as passes, each with the gate's own words:

• check-test-completeness (exit 3) — "this gate grades a saved turbo run test log, and no log was named … the local reading for this gate is NOT MEASURED. ⛔ It is not a red".
• check:dual-build-cjs-loads (exit 3) — "PREREQUISITE NOT MET — this gate reads built output, and some package has no dist/ … ⛔ This is NOT a pass: nothing was measured." (Its own self-test passed: "93 cases pass".)
• check:type-check-debt (exit 3) — "--re-measure cannot run: 33 workspace dependenc(ies) … have no built type entry point on disk … ⛔ This is NOT a pass and NOT a finding". Its sibling check:type-check-coveragedid run and passed: "OK — 68/78 workspace packages type-checked".

Every exit code above was captured before any pipe (cmd > file 2>&1; EXIT=$?), and each verdict is quoted from the gate's own output rather than read off a bare $?.

Beyond the derived family: check:nul-bytes passed ("scanned 7940 text file(s) … no raw ASCII control bytes"), and a direct control-byte scan over the three changed files returned no hits.

Repo-wide lint was run in full, not narrowed — pnpm lint (eslint . --no-inline-config over the whole repo) exited 0.

git merge-tree --write-tree --name-only origin/main HEAD returned a clean tree with no file list, so content/docs/permissions/system-context.mdx is not implicated and no regeneration is owed.

One honest caveat on the derivation: re-running it after a fresh fetch warned "STALE TREE — this answer is derived from a tree at least 7 commit(s) behind origin/main, and 2 file(s) it derives from CHANGED across that range … .github/workflows/lint.ymlscripts/role-word-baseline.json". Both were inspected: the lint.yml change is comment-only (no step added or removed) and role-word-baseline.json moved by one line, so the family for these paths is unchanged. CI runs the real farm regardless.

Clause-②: no

Declared from the actual diff, not from the plan: git diff -U0 origin/main...HEAD | grep export returns exactly one line, a comment in the new test file ("parks on a real screen node and exports what it collected"). No export was added, removed or renamed, and no accept set moved — RETRYABLE_RESUME_REFUSAL_CODES and isRetryableResumeRefusal are module-private. The public resume contract already declares all four codes as answers (packages/spec/src/contracts/automation-service.ts); this change makes the parent's resume return one instead of swallowing it.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/service-automation, touching 7 documentable anchor(s).

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/automation/flows.mdx(via INVALID_SCREEN_INPUT (literal, a string literal in RETRYABLE_RESUME_REFUSAL_CODES))

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 5 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 0e68ed25cc45c15ce296c299614b2b51a3296e52 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 12ede636a4b77f1c4df9993fade21b1996dd7e3a — the merge of head 4ae326704950de2991b47cf21bd71c5601bc536f into base 0e68ed25cc45c15ce296c299614b2b51a3296e52, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 12ede636a4b77f1c4df9993fade21b1996dd7e3a && git checkout 12ede636a4b77f1c4df9993fade21b1996dd7e3a
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 0e68ed25cc45c15ce296c299614b2b51a3296e52 4ae326704950de2991b47cf21bd71c5601bc536f && git checkout -B drift-repro 0e68ed25cc45c15ce296c299614b2b51a3296e52 && git merge --no-ff 4ae326704950de2991b47cf21bd71c5601bc536f
node scripts/docs-audit/affected-docs.mjs --json 0e68ed25cc45c15ce296c299614b2b51a3296e52

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 0e68ed25cc45c15ce296c299614b2b51a3296e52 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-sales]

Landing provenance — ready + auto-merge at head 4ae326704

• Card: service-automation: a subflow parent resume treats the delegated child screen's RETRYABLE refusal (INVALID_SCREEN_INPUT) as a terminal child failure — the parent is failed, the still-paused child is orphaned, and the corrected retry answers RUN_NOT_FOUND #14379 (Fixes, closes on merge).
• Review: PM ACCEPT 14379#issuecomment-5509505046 at this head. Clause-② no, verified by the seat from the diff: no exported symbol added, removed or changed (git diff -U0 origin/main...HEAD | grep export → nothing; RETRYABLE_RESUME_REFUSAL_CODES and isRetryableResumeRefusal are module-private in engine.ts), no accept/reject change on a public endpoint (the parent now answers a delegated child's retryable refusal as that refusal instead of failing the run, consuming neither pause). No contract review is owed; no needs:contract-review carrier was ever on this pair.
• Surface: 3 files — packages/services/service-automation/src/engine.ts (the subflow delegation block only), the new src/builtin/subflow-child-refusal.test.ts (5 pins), one patch changeset for @objectstack/service-automation. No packages/spec, no content/docs/releases/, no skills/.
• CI on 4ae326704: every check green — Lint & Repo Gatessuccess at 12:48:18Z, Test Core (1/6)success at 12:44:51Z and the aggregate Test Coresuccess, TypeScript Type Check and the four Type Check · jobs success, Build Core, Dogfood Verify CLI, Dogfood Regression Gate (1-3/3), Temporal Conformancesuccess; Check Changeset, Governed Surface Queue Guard, the single-writer and same-issue guards success.
• Action: draft → ready and auto-merge enabled at 12:54:17Z (method MERGE). On MERGED: the card auto-closes and the seat strips pm:dispatched from service-automation: a subflow parent resume treats the delegated child screen's RETRYABLE refusal (INVALID_SCREEN_INPUT) as a terminal child failure — the parent is failed, the still-paused child is orphaned, and the corrected retry answers RUN_NOT_FOUND #14379; the engine.ts subflow region is released to the next service-automation card (service-automation: three more readers of suspended-run state still prefer the per-process map over the shared store #14332 / service-automation: two concurrent resumes of one run on two replicas can both advance it — the idempotency guard is per-process #14333 / try_catch whose catch region itself fails still discards the whole step record — the third returned-failure path, left unfolded by #14184 #14222 / [finding] service-automation: the subflow up-bubble path always logs "child run … is gone — continuing without child output" even when the engine-built signal carries the child's output #14392 / automation: create_record collapses the engine's DUPLICATE_RECORD envelope to a string, so a flow's try_catch / fault edge still cannot tell "already there" from "the store is down" #14419, one at a time).

---

Generated by Claude Code

[claude]

Fixes#14379

A parent run paused at a subflow node forwards a resume down to the child it is parked on — the screen-flow path, where the caller holds ONE stable run id (the parent's) and posts every wizard step to it. When the child refused that bag, the delegation block read it as a child that ran and died: it called failSuspendedRun on the parent and answered a code-less{ success: false, error }. One mistyped form field therefore destroyed a running workflow — the parent's suspension consumed and a failure recorded, the still-paused child orphaned with nothing left to bubble into, the caller told 400 FLOW_FAILED ("it ran and was rejected") for something that never ran, and their corrected retry on the same run id answered RUN_NOT_FOUND.

The delegation now branches on the child's own code. A retryable refusal is answered as a refusal, with its code intact and both pauses untouched; failSuspendedRun is reserved for a child that genuinely ran and failed.

Head at the time of every measurement below: 4ae326704.

Ruling of record (14379#issuecomment-5504400729, verbatim)

The fix criterion — prefer the producer-first one. The card offers two discriminators; take the second. ⛔ Do not branch on "is the child's suspension still live" — that is a second store read whose answer can race, and it infers intent from state. Branch on the child's own code being one of the refusal codes the engine itself answers (INVALID_SCREEN_INPUT, INVALID_SIGNAL, RESUME_IN_PROGRESS, STORE_UNAVAILABLE), which is the producer naming the condition — the same rule the platform applies everywhere else. failSuspendedRun is then reserved for a child that genuinely ran and failed.

⚠️And propagate the code. The current envelope carries none, which is why the transport lands on 400 FLOW_FAILED. Returning the child's envelope with its code intact is half the fix; a fix that leaves both pauses alive but still answers a code-less envelope has repaired the state and left the caller equally misled.

The pins the card names are the right ones, and one more: refused parent resume ⇒ code: 'INVALID_SCREEN_INPUT', parent and child still suspended, corrected retry on the parent completes. Add a negative control — a child that terminally throws must still fail the parent — or the fix can pass by never failing anything.

⚠️ Serialisation: three cards are live on these same 40 lines

… #14392 — the "child run … is gone — continuing without child output" line, which sits in the else of the very if (childRun) this card's arm lives inside. Graded p3 this round. Two separate diffs: a log-text fix disappearing inside a state-machine repair is how the state-machine repair stops getting reviewed on its own merits.

Serialisation honoured: the branch is cut from origin/mainafter PR #14388 merged, and the else arm carrying the "child run … is gone" log line is byte-untouched — #14392 stays a separate diff, still open.

The change

packages/services/service-automation/src/engine.ts, two additions and nothing else:

1. A module-private closed set, RETRYABLE_RESUME_REFUSAL_CODES, naming the codes resumeInternal itself answers for a resume that never ran — INVALID_SCREEN_INPUT, INVALID_SIGNAL, RESUME_IN_PROGRESS, STORE_UNAVAILABLE — plus the one-line predicate that reads it. RUN_NOT_FOUND is deliberately absent and the docblock says why: it is the engine's terminal "this pause is gone for good" class (the automation: the run-resume route still answers HTTP 200 wrapping an inner {success:false} — the route #3962's status-code unification left behind #8684 comment sitting 30 lines above), which a transport answers 404 and no retry can fix.
2. A new arm placed before the terminal-failure arm, answering the child's envelope verbatim but for the parent's durationMs, consuming neither pause and refreshing nothing (the child did not advance, so the parent's surfaced screen is already current).

No log site was added at any level: a refusal is a response, not a degradation, and the child already logged its own warn where it produced the refusal.

Premise checks on origin/main (all verified before the first edit)

#	Premise	Verdict
P1	resumeInternal's subflow block still has exactly three arms, no refusal arm	holds — located at engine.ts:4798 by run.correlation.startsWith('subflow:'); the three arms read exactly as the card quotes them
P2	The card's measurement reproduces on the current tree	holds — written as a failing test first and run before any source edit: 4 failed, 1 passed, every failure expected undefined to be 'INVALID_SCREEN_INPUT' / 'INVALID_SIGNAL'
P3	PR #14388 is on origin/main; refuseInvalidScreenInput / ENGINE_BUILT_SIGNAL untouched	holds — the signal-less normalisation to {} is at the public door; neither symbol appears in the diff
P4	The refusal codes are the four the ruling names	holds, with one reachability note below — grepped the producers inside resumeInternal: RESUME_IN_PROGRESS, STORE_UNAVAILABLE, RUN_NOT_FOUND (three sites), INVALID_SCREEN_INPUT (via refuseInvalidScreenInput), INVALID_SIGNAL. No other code is produced there. Nothing was invented and packages/spec was not touched
P5	packages/spec, content/docs/releases/** and the #14392 log line untouched	holds — the diff is 3 files: engine.ts, one new test file, one changeset

P4 reachability note (reported, not acted on). Two of the four are reachable through delegation today and are pinned end to end: INVALID_SCREEN_INPUT and INVALID_SIGNAL. The other two are in the set because the producer answers them from this method, but neither has a deterministic fixture: RESUME_IN_PROGRESS needs a real race window against a concurrent direct child resume, and a STORE_UNAVAILABLE outage trips the parent's own loadSuspendedRunStrict several frames earlier, so the parent never reaches the delegation block at all. Keeping them in the set is the producer-first rule applied whole; the pins claim only what was measured.

Hypotheses (each falsifiable, each with its evidence)

• H1 — one new arm before the terminal one, no failSuspendedRun, no pause consumed: HOLDS. That is the whole source change.
• H2 — is the parent's pause consumed before the delegation block? NO, so nothing needed restoring.forgetSuspendedRun(run, 'resumed') — the one consumption on this path — sits ~90 lines after the delegation block, and the only other consumer is the failSuspendedRun the new arm bypasses. creditChildRun returns immediately when childSummary is absent, which it is on a direct parent resume. Proven behaviourally, not just by reading: hasSuspendedRun(parentRunId) is true after the refusal in every refusal pin.
• H3 — the corrected retry completes end to end: HOLDS. The child's screen accepts the corrected bag, the child completes, the engine-built signal maps its output into the parent, and the downstream node observes { kind: 'normal' }. Both suspensions are gone afterwards.
• H4 — the negative control still fails the parent through failSuspendedRun, envelope shape unchanged: HOLDS. A child whose node throws after the screen accepted the bag still answers success: false, codeundefined, error matching subflow run '…' (child_flow) failed: …, with both suspensions consumed. This test is green on both sides of the change — it is the control that stops the arm from passing by never failing anything.

Tests

New file packages/services/service-automation/src/builtin/subflow-child-refusal.test.ts — 5 pins, built on installBuiltinNodes with real subflow and screen nodes, exactly the composition the card measured.

pin	asserts
a	refused parent resume ⇒ success: false, code: 'INVALID_SCREEN_INPUT', the child's own actionable text, parent and child still suspended, the parent's surfaced screen unchanged, downstream never ran
b	corrected retry on the same parent run id ⇒ completes, child output mapped into the parent, both suspensions gone
c	the signal-less gesture resume(parentRunId) ⇒ the same refusal, both pauses intact, corrected retry still lands (the population the scope note 14379#issuecomment-5504169090 adds)
d	a second refusal code on the same path — INVALID_SIGNAL from a reserved variable name against a child pause that declares no screen contract ⇒ same shape, then the legitimate submission lands
e	negative control — a child that genuinely ran and threw ⇒ parent failed terminally, code undefined, error text unchanged

Every refusal pin asserts the ADR-0112 code (and the error text), never a bare "it failed".

Verdict lines, quoted from the runs, all at 4ae326704:

BEFORE the source edit (the red half, same test file):
Test Files 1 failed (1)
Tests 4 failed | 1 passed (5)
AssertionError: expected undefined to be 'INVALID_SCREEN_INPUT'
Targeted suites (new pins + subflow-node + both screen-resume suites):
Test Files 4 passed (4)
Tests 41 passed (41)
os-verify-lock: VERDICT command-exit 0
Whole package:
Test Files 99 passed (99)
Tests 1171 passed (1171)
os-verify-lock: VERDICT command-exit 0
Downstream consumer `@objectstack/plugin-approvals` (closure built first):
Test Files 35 passed (35)
Tests 652 passed (652)
os-verify-lock: VERDICT command-exit 0

Type check: this package declares no typecheck script and carries a frozen DEBT ledger entry of 3. tsc --noEmit -p tsconfig.json reports exactly those 3 pre-existing TS2341 in src/nested-region-parity.test.ts (a file this diff does not touch) — unchanged. --listFiles confirms both edited files really are in that program (engine.ts and subflow-child-refusal.test.ts both listed), so this is a measurement and not a green over source nothing read.

Ablation (on the committed tree, both legs proven on disk)

Mutation: the new arm's guard neutralised in place, with a greppable sentinel so the on-disk change is provable from two directions.

HEAD_BLOB=111b7185441f3eabb94e62c8390155c7efe2b625
PRE marker=1 sentinel=0
POST marker=0 sentinel=1
MUTATED_BLOB=5b463c5d48b7d523513e8b01963cf3fad9fa9b7e
ABLATION_VITEST_EXIT=1
Test Files 1 failed (1)
Tests 4 failed | 1 passed (5)
RESTORED_BLOB=111b7185441f3eabb94e62c8390155c7efe2b625
RESTORE marker=1 sentinel=0
git diff HEAD -- $TARGET (expect empty): [empty]
git status --porcelain -- $TARGET (expect empty): [empty]
ABLATION_DONE

Predicted direction, observed: pins a–d red, pin e (the negative control) green. Restore verified by blob-hash equality against the HEAD blob and an empty git diff HEAD, not by an exit code; the script carried a trap … EXIT INT TERM with absolute paths throughout, and an earlier attempt that produced a zero-match substitution aborted at the guard rather than reporting a green ablation — it is reported here as an admitted no-op run, not quietly retried.

No rebuild is required for this ablation and none was performed. The pin imports the subject relatively (../engine.js, same package), which vitest resolves to src/engine.ts, and the package's only resolve.alias entry is an unrelated one for @objectstack/platform-objects. That is proven positively rather than asserted: mutating src/engine.ts alone, with no build, flipped the suite red, and restoring it alone flipped it green.

Gates

Derived on the final head from the actual change set, never a hand-written list: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands at 4ae326704 — 36 commands over the 3 changed paths. 33 exited 0. Three are PREREQUISITE NOT MET, recorded as NOT MEASURED and not as passes, each with the gate's own words:

• check-test-completeness (exit 3) — "this gate grades a saved turbo run test log, and no log was named … the local reading for this gate is NOT MEASURED. ⛔ It is not a red".
• check:dual-build-cjs-loads (exit 3) — "PREREQUISITE NOT MET — this gate reads built output, and some package has no dist/ … ⛔ This is NOT a pass: nothing was measured." (Its own self-test passed: "93 cases pass".)
• check:type-check-debt (exit 3) — "--re-measure cannot run: 33 workspace dependenc(ies) … have no built type entry point on disk … ⛔ This is NOT a pass and NOT a finding". Its sibling check:type-check-coveragedid run and passed: "OK — 68/78 workspace packages type-checked".

Every exit code above was captured before any pipe (cmd > file 2>&1; EXIT=$?), and each verdict is quoted from the gate's own output rather than read off a bare $?.

Beyond the derived family: check:nul-bytes passed ("scanned 7940 text file(s) … no raw ASCII control bytes"), and a direct control-byte scan over the three changed files returned no hits.

Repo-wide lint was run in full, not narrowed — pnpm lint (eslint . --no-inline-config over the whole repo) exited 0.

git merge-tree --write-tree --name-only origin/main HEAD returned a clean tree with no file list, so content/docs/permissions/system-context.mdx is not implicated and no regeneration is owed.

One honest caveat on the derivation: re-running it after a fresh fetch warned "STALE TREE — this answer is derived from a tree at least 7 commit(s) behind origin/main, and 2 file(s) it derives from CHANGED across that range … .github/workflows/lint.ymlscripts/role-word-baseline.json". Both were inspected: the lint.yml change is comment-only (no step added or removed) and role-word-baseline.json moved by one line, so the family for these paths is unchanged. CI runs the real farm regardless.

Clause-②: no

Declared from the actual diff, not from the plan: git diff -U0 origin/main...HEAD | grep export returns exactly one line, a comment in the new test file ("parks on a real screen node and exports what it collected"). No export was added, removed or renamed, and no accept set moved — RETRYABLE_RESUME_REFUSAL_CODES and isRetryableResumeRefusal are module-private. The public resume contract already declares all four codes as answers (packages/spec/src/contracts/automation-service.ts); this change makes the parent's resume return one instead of swallowing it.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/service-automation, touching 7 documentable anchor(s).

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/automation/flows.mdx(via INVALID_SCREEN_INPUT (literal, a string literal in RETRYABLE_RESUME_REFUSAL_CODES))

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 5 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 0e68ed25cc45c15ce296c299614b2b51a3296e52 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 12ede636a4b77f1c4df9993fade21b1996dd7e3a — the merge of head 4ae326704950de2991b47cf21bd71c5601bc536f into base 0e68ed25cc45c15ce296c299614b2b51a3296e52, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 12ede636a4b77f1c4df9993fade21b1996dd7e3a && git checkout 12ede636a4b77f1c4df9993fade21b1996dd7e3a
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 0e68ed25cc45c15ce296c299614b2b51a3296e52 4ae326704950de2991b47cf21bd71c5601bc536f && git checkout -B drift-repro 0e68ed25cc45c15ce296c299614b2b51a3296e52 && git merge --no-ff 4ae326704950de2991b47cf21bd71c5601bc536f
node scripts/docs-audit/affected-docs.mjs --json 0e68ed25cc45c15ce296c299614b2b51a3296e52

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 0e68ed25cc45c15ce296c299614b2b51a3296e52 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-sales]

Landing provenance — ready + auto-merge at head 4ae326704

• Card: service-automation: a subflow parent resume treats the delegated child screen's RETRYABLE refusal (INVALID_SCREEN_INPUT) as a terminal child failure — the parent is failed, the still-paused child is orphaned, and the corrected retry answers RUN_NOT_FOUND #14379 (Fixes, closes on merge).
• Review: PM ACCEPT 14379#issuecomment-5509505046 at this head. Clause-② no, verified by the seat from the diff: no exported symbol added, removed or changed (git diff -U0 origin/main...HEAD | grep export → nothing; RETRYABLE_RESUME_REFUSAL_CODES and isRetryableResumeRefusal are module-private in engine.ts), no accept/reject change on a public endpoint (the parent now answers a delegated child's retryable refusal as that refusal instead of failing the run, consuming neither pause). No contract review is owed; no needs:contract-review carrier was ever on this pair.
• Surface: 3 files — packages/services/service-automation/src/engine.ts (the subflow delegation block only), the new src/builtin/subflow-child-refusal.test.ts (5 pins), one patch changeset for @objectstack/service-automation. No packages/spec, no content/docs/releases/, no skills/.
• CI on 4ae326704: every check green — Lint & Repo Gatessuccess at 12:48:18Z, Test Core (1/6)success at 12:44:51Z and the aggregate Test Coresuccess, TypeScript Type Check and the four Type Check · jobs success, Build Core, Dogfood Verify CLI, Dogfood Regression Gate (1-3/3), Temporal Conformancesuccess; Check Changeset, Governed Surface Queue Guard, the single-writer and same-issue guards success.
• Action: draft → ready and auto-merge enabled at 12:54:17Z (method MERGE). On MERGED: the card auto-closes and the seat strips pm:dispatched from service-automation: a subflow parent resume treats the delegated child screen's RETRYABLE refusal (INVALID_SCREEN_INPUT) as a terminal child failure — the parent is failed, the still-paused child is orphaned, and the corrected retry answers RUN_NOT_FOUND #14379; the engine.ts subflow region is released to the next service-automation card (service-automation: three more readers of suspended-run state still prefer the per-process map over the shared store #14332 / service-automation: two concurrent resumes of one run on two replicas can both advance it — the idempotency guard is per-process #14333 / try_catch whose catch region itself fails still discards the whole step record — the third returned-failure path, left unfolded by #14184 #14222 / [finding] service-automation: the subflow up-bubble path always logs "child run … is gone — continuing without child output" even when the engine-built signal carries the child's output #14392 / automation: create_record collapses the engine's DUPLICATE_RECORD envelope to a string, so a flow's try_catch / fault edge still cannot tell "already there" from "the store is down" #14419, one at a time).

---

Generated by Claude Code

[claude]

Fixes#14379

A parent run paused at a subflow node forwards a resume down to the child it is parked on — the screen-flow path, where the caller holds ONE stable run id (the parent's) and posts every wizard step to it. When the child refused that bag, the delegation block read it as a child that ran and died: it called failSuspendedRun on the parent and answered a code-less{ success: false, error }. One mistyped form field therefore destroyed a running workflow — the parent's suspension consumed and a failure recorded, the still-paused child orphaned with nothing left to bubble into, the caller told 400 FLOW_FAILED ("it ran and was rejected") for something that never ran, and their corrected retry on the same run id answered RUN_NOT_FOUND.

The delegation now branches on the child's own code. A retryable refusal is answered as a refusal, with its code intact and both pauses untouched; failSuspendedRun is reserved for a child that genuinely ran and failed.

Head at the time of every measurement below: 4ae326704.

Ruling of record (14379#issuecomment-5504400729, verbatim)

The fix criterion — prefer the producer-first one. The card offers two discriminators; take the second. ⛔ Do not branch on "is the child's suspension still live" — that is a second store read whose answer can race, and it infers intent from state. Branch on the child's own code being one of the refusal codes the engine itself answers (INVALID_SCREEN_INPUT, INVALID_SIGNAL, RESUME_IN_PROGRESS, STORE_UNAVAILABLE), which is the producer naming the condition — the same rule the platform applies everywhere else. failSuspendedRun is then reserved for a child that genuinely ran and failed.

⚠️And propagate the code. The current envelope carries none, which is why the transport lands on 400 FLOW_FAILED. Returning the child's envelope with its code intact is half the fix; a fix that leaves both pauses alive but still answers a code-less envelope has repaired the state and left the caller equally misled.

The pins the card names are the right ones, and one more: refused parent resume ⇒ code: 'INVALID_SCREEN_INPUT', parent and child still suspended, corrected retry on the parent completes. Add a negative control — a child that terminally throws must still fail the parent — or the fix can pass by never failing anything.

⚠️ Serialisation: three cards are live on these same 40 lines

… #14392 — the "child run … is gone — continuing without child output" line, which sits in the else of the very if (childRun) this card's arm lives inside. Graded p3 this round. Two separate diffs: a log-text fix disappearing inside a state-machine repair is how the state-machine repair stops getting reviewed on its own merits.

Serialisation honoured: the branch is cut from origin/mainafter PR #14388 merged, and the else arm carrying the "child run … is gone" log line is byte-untouched — #14392 stays a separate diff, still open.

The change

packages/services/service-automation/src/engine.ts, two additions and nothing else:

1. A module-private closed set, RETRYABLE_RESUME_REFUSAL_CODES, naming the codes resumeInternal itself answers for a resume that never ran — INVALID_SCREEN_INPUT, INVALID_SIGNAL, RESUME_IN_PROGRESS, STORE_UNAVAILABLE — plus the one-line predicate that reads it. RUN_NOT_FOUND is deliberately absent and the docblock says why: it is the engine's terminal "this pause is gone for good" class (the automation: the run-resume route still answers HTTP 200 wrapping an inner {success:false} — the route #3962's status-code unification left behind #8684 comment sitting 30 lines above), which a transport answers 404 and no retry can fix.
2. A new arm placed before the terminal-failure arm, answering the child's envelope verbatim but for the parent's durationMs, consuming neither pause and refreshing nothing (the child did not advance, so the parent's surfaced screen is already current).

No log site was added at any level: a refusal is a response, not a degradation, and the child already logged its own warn where it produced the refusal.

Premise checks on origin/main (all verified before the first edit)

#	Premise	Verdict
P1	resumeInternal's subflow block still has exactly three arms, no refusal arm	holds — located at engine.ts:4798 by run.correlation.startsWith('subflow:'); the three arms read exactly as the card quotes them
P2	The card's measurement reproduces on the current tree	holds — written as a failing test first and run before any source edit: 4 failed, 1 passed, every failure expected undefined to be 'INVALID_SCREEN_INPUT' / 'INVALID_SIGNAL'
P3	PR #14388 is on origin/main; refuseInvalidScreenInput / ENGINE_BUILT_SIGNAL untouched	holds — the signal-less normalisation to {} is at the public door; neither symbol appears in the diff
P4	The refusal codes are the four the ruling names	holds, with one reachability note below — grepped the producers inside resumeInternal: RESUME_IN_PROGRESS, STORE_UNAVAILABLE, RUN_NOT_FOUND (three sites), INVALID_SCREEN_INPUT (via refuseInvalidScreenInput), INVALID_SIGNAL. No other code is produced there. Nothing was invented and packages/spec was not touched
P5	packages/spec, content/docs/releases/** and the #14392 log line untouched	holds — the diff is 3 files: engine.ts, one new test file, one changeset

P4 reachability note (reported, not acted on). Two of the four are reachable through delegation today and are pinned end to end: INVALID_SCREEN_INPUT and INVALID_SIGNAL. The other two are in the set because the producer answers them from this method, but neither has a deterministic fixture: RESUME_IN_PROGRESS needs a real race window against a concurrent direct child resume, and a STORE_UNAVAILABLE outage trips the parent's own loadSuspendedRunStrict several frames earlier, so the parent never reaches the delegation block at all. Keeping them in the set is the producer-first rule applied whole; the pins claim only what was measured.

Hypotheses (each falsifiable, each with its evidence)

• H1 — one new arm before the terminal one, no failSuspendedRun, no pause consumed: HOLDS. That is the whole source change.
• H2 — is the parent's pause consumed before the delegation block? NO, so nothing needed restoring.forgetSuspendedRun(run, 'resumed') — the one consumption on this path — sits ~90 lines after the delegation block, and the only other consumer is the failSuspendedRun the new arm bypasses. creditChildRun returns immediately when childSummary is absent, which it is on a direct parent resume. Proven behaviourally, not just by reading: hasSuspendedRun(parentRunId) is true after the refusal in every refusal pin.
• H3 — the corrected retry completes end to end: HOLDS. The child's screen accepts the corrected bag, the child completes, the engine-built signal maps its output into the parent, and the downstream node observes { kind: 'normal' }. Both suspensions are gone afterwards.
• H4 — the negative control still fails the parent through failSuspendedRun, envelope shape unchanged: HOLDS. A child whose node throws after the screen accepted the bag still answers success: false, codeundefined, error matching subflow run '…' (child_flow) failed: …, with both suspensions consumed. This test is green on both sides of the change — it is the control that stops the arm from passing by never failing anything.

Tests

New file packages/services/service-automation/src/builtin/subflow-child-refusal.test.ts — 5 pins, built on installBuiltinNodes with real subflow and screen nodes, exactly the composition the card measured.

pin	asserts
a	refused parent resume ⇒ success: false, code: 'INVALID_SCREEN_INPUT', the child's own actionable text, parent and child still suspended, the parent's surfaced screen unchanged, downstream never ran
b	corrected retry on the same parent run id ⇒ completes, child output mapped into the parent, both suspensions gone
c	the signal-less gesture resume(parentRunId) ⇒ the same refusal, both pauses intact, corrected retry still lands (the population the scope note 14379#issuecomment-5504169090 adds)
d	a second refusal code on the same path — INVALID_SIGNAL from a reserved variable name against a child pause that declares no screen contract ⇒ same shape, then the legitimate submission lands
e	negative control — a child that genuinely ran and threw ⇒ parent failed terminally, code undefined, error text unchanged

Every refusal pin asserts the ADR-0112 code (and the error text), never a bare "it failed".

Verdict lines, quoted from the runs, all at 4ae326704:

BEFORE the source edit (the red half, same test file):
Test Files 1 failed (1)
Tests 4 failed | 1 passed (5)
AssertionError: expected undefined to be 'INVALID_SCREEN_INPUT'
Targeted suites (new pins + subflow-node + both screen-resume suites):
Test Files 4 passed (4)
Tests 41 passed (41)
os-verify-lock: VERDICT command-exit 0
Whole package:
Test Files 99 passed (99)
Tests 1171 passed (1171)
os-verify-lock: VERDICT command-exit 0
Downstream consumer `@objectstack/plugin-approvals` (closure built first):
Test Files 35 passed (35)
Tests 652 passed (652)
os-verify-lock: VERDICT command-exit 0

Type check: this package declares no typecheck script and carries a frozen DEBT ledger entry of 3. tsc --noEmit -p tsconfig.json reports exactly those 3 pre-existing TS2341 in src/nested-region-parity.test.ts (a file this diff does not touch) — unchanged. --listFiles confirms both edited files really are in that program (engine.ts and subflow-child-refusal.test.ts both listed), so this is a measurement and not a green over source nothing read.

Ablation (on the committed tree, both legs proven on disk)

Mutation: the new arm's guard neutralised in place, with a greppable sentinel so the on-disk change is provable from two directions.

HEAD_BLOB=111b7185441f3eabb94e62c8390155c7efe2b625
PRE marker=1 sentinel=0
POST marker=0 sentinel=1
MUTATED_BLOB=5b463c5d48b7d523513e8b01963cf3fad9fa9b7e
ABLATION_VITEST_EXIT=1
Test Files 1 failed (1)
Tests 4 failed | 1 passed (5)
RESTORED_BLOB=111b7185441f3eabb94e62c8390155c7efe2b625
RESTORE marker=1 sentinel=0
git diff HEAD -- $TARGET (expect empty): [empty]
git status --porcelain -- $TARGET (expect empty): [empty]
ABLATION_DONE

Predicted direction, observed: pins a–d red, pin e (the negative control) green. Restore verified by blob-hash equality against the HEAD blob and an empty git diff HEAD, not by an exit code; the script carried a trap … EXIT INT TERM with absolute paths throughout, and an earlier attempt that produced a zero-match substitution aborted at the guard rather than reporting a green ablation — it is reported here as an admitted no-op run, not quietly retried.

No rebuild is required for this ablation and none was performed. The pin imports the subject relatively (../engine.js, same package), which vitest resolves to src/engine.ts, and the package's only resolve.alias entry is an unrelated one for @objectstack/platform-objects. That is proven positively rather than asserted: mutating src/engine.ts alone, with no build, flipped the suite red, and restoring it alone flipped it green.

Gates

Derived on the final head from the actual change set, never a hand-written list: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands at 4ae326704 — 36 commands over the 3 changed paths. 33 exited 0. Three are PREREQUISITE NOT MET, recorded as NOT MEASURED and not as passes, each with the gate's own words:

• check-test-completeness (exit 3) — "this gate grades a saved turbo run test log, and no log was named … the local reading for this gate is NOT MEASURED. ⛔ It is not a red".
• check:dual-build-cjs-loads (exit 3) — "PREREQUISITE NOT MET — this gate reads built output, and some package has no dist/ … ⛔ This is NOT a pass: nothing was measured." (Its own self-test passed: "93 cases pass".)
• check:type-check-debt (exit 3) — "--re-measure cannot run: 33 workspace dependenc(ies) … have no built type entry point on disk … ⛔ This is NOT a pass and NOT a finding". Its sibling check:type-check-coveragedid run and passed: "OK — 68/78 workspace packages type-checked".

Every exit code above was captured before any pipe (cmd > file 2>&1; EXIT=$?), and each verdict is quoted from the gate's own output rather than read off a bare $?.

Beyond the derived family: check:nul-bytes passed ("scanned 7940 text file(s) … no raw ASCII control bytes"), and a direct control-byte scan over the three changed files returned no hits.

Repo-wide lint was run in full, not narrowed — pnpm lint (eslint . --no-inline-config over the whole repo) exited 0.

git merge-tree --write-tree --name-only origin/main HEAD returned a clean tree with no file list, so content/docs/permissions/system-context.mdx is not implicated and no regeneration is owed.

One honest caveat on the derivation: re-running it after a fresh fetch warned "STALE TREE — this answer is derived from a tree at least 7 commit(s) behind origin/main, and 2 file(s) it derives from CHANGED across that range … .github/workflows/lint.ymlscripts/role-word-baseline.json". Both were inspected: the lint.yml change is comment-only (no step added or removed) and role-word-baseline.json moved by one line, so the family for these paths is unchanged. CI runs the real farm regardless.

Clause-②: no

Declared from the actual diff, not from the plan: git diff -U0 origin/main...HEAD | grep export returns exactly one line, a comment in the new test file ("parks on a real screen node and exports what it collected"). No export was added, removed or renamed, and no accept set moved — RETRYABLE_RESUME_REFUSAL_CODES and isRetryableResumeRefusal are module-private. The public resume contract already declares all four codes as answers (packages/spec/src/contracts/automation-service.ts); this change makes the parent's resume return one instead of swallowing it.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/service-automation, touching 7 documentable anchor(s).

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/automation/flows.mdx(via INVALID_SCREEN_INPUT (literal, a string literal in RETRYABLE_RESUME_REFUSAL_CODES))

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 5 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 0e68ed25cc45c15ce296c299614b2b51a3296e52 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 12ede636a4b77f1c4df9993fade21b1996dd7e3a — the merge of head 4ae326704950de2991b47cf21bd71c5601bc536f into base 0e68ed25cc45c15ce296c299614b2b51a3296e52, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 12ede636a4b77f1c4df9993fade21b1996dd7e3a && git checkout 12ede636a4b77f1c4df9993fade21b1996dd7e3a
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 0e68ed25cc45c15ce296c299614b2b51a3296e52 4ae326704950de2991b47cf21bd71c5601bc536f && git checkout -B drift-repro 0e68ed25cc45c15ce296c299614b2b51a3296e52 && git merge --no-ff 4ae326704950de2991b47cf21bd71c5601bc536f
node scripts/docs-audit/affected-docs.mjs --json 0e68ed25cc45c15ce296c299614b2b51a3296e52

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 0e68ed25cc45c15ce296c299614b2b51a3296e52 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-sales]

Landing provenance — ready + auto-merge at head 4ae326704

• Card: service-automation: a subflow parent resume treats the delegated child screen's RETRYABLE refusal (INVALID_SCREEN_INPUT) as a terminal child failure — the parent is failed, the still-paused child is orphaned, and the corrected retry answers RUN_NOT_FOUND #14379 (Fixes, closes on merge).
• Review: PM ACCEPT 14379#issuecomment-5509505046 at this head. Clause-② no, verified by the seat from the diff: no exported symbol added, removed or changed (git diff -U0 origin/main...HEAD | grep export → nothing; RETRYABLE_RESUME_REFUSAL_CODES and isRetryableResumeRefusal are module-private in engine.ts), no accept/reject change on a public endpoint (the parent now answers a delegated child's retryable refusal as that refusal instead of failing the run, consuming neither pause). No contract review is owed; no needs:contract-review carrier was ever on this pair.
• Surface: 3 files — packages/services/service-automation/src/engine.ts (the subflow delegation block only), the new src/builtin/subflow-child-refusal.test.ts (5 pins), one patch changeset for @objectstack/service-automation. No packages/spec, no content/docs/releases/, no skills/.
• CI on 4ae326704: every check green — Lint & Repo Gatessuccess at 12:48:18Z, Test Core (1/6)success at 12:44:51Z and the aggregate Test Coresuccess, TypeScript Type Check and the four Type Check · jobs success, Build Core, Dogfood Verify CLI, Dogfood Regression Gate (1-3/3), Temporal Conformancesuccess; Check Changeset, Governed Surface Queue Guard, the single-writer and same-issue guards success.
• Action: draft → ready and auto-merge enabled at 12:54:17Z (method MERGE). On MERGED: the card auto-closes and the seat strips pm:dispatched from service-automation: a subflow parent resume treats the delegated child screen's RETRYABLE refusal (INVALID_SCREEN_INPUT) as a terminal child failure — the parent is failed, the still-paused child is orphaned, and the corrected retry answers RUN_NOT_FOUND #14379; the engine.ts subflow region is released to the next service-automation card (service-automation: three more readers of suspended-run state still prefer the per-process map over the shared store #14332 / service-automation: two concurrent resumes of one run on two replicas can both advance it — the idempotency guard is per-process #14333 / try_catch whose catch region itself fails still discards the whole step record — the third returned-failure path, left unfolded by #14184 #14222 / [finding] service-automation: the subflow up-bubble path always logs "child run … is gone — continuing without child output" even when the engine-built signal carries the child's output #14392 / automation: create_record collapses the engine's DUPLICATE_RECORD envelope to a string, so a flow's try_catch / fault edge still cannot tell "already there" from "the store is down" #14419, one at a time).

---

Generated by Claude Code

[claude]

Fixes#14379

A parent run paused at a subflow node forwards a resume down to the child it is parked on — the screen-flow path, where the caller holds ONE stable run id (the parent's) and posts every wizard step to it. When the child refused that bag, the delegation block read it as a child that ran and died: it called failSuspendedRun on the parent and answered a code-less{ success: false, error }. One mistyped form field therefore destroyed a running workflow — the parent's suspension consumed and a failure recorded, the still-paused child orphaned with nothing left to bubble into, the caller told 400 FLOW_FAILED ("it ran and was rejected") for something that never ran, and their corrected retry on the same run id answered RUN_NOT_FOUND.

The delegation now branches on the child's own code. A retryable refusal is answered as a refusal, with its code intact and both pauses untouched; failSuspendedRun is reserved for a child that genuinely ran and failed.

Head at the time of every measurement below: 4ae326704.

Ruling of record (14379#issuecomment-5504400729, verbatim)

The fix criterion — prefer the producer-first one. The card offers two discriminators; take the second. ⛔ Do not branch on "is the child's suspension still live" — that is a second store read whose answer can race, and it infers intent from state. Branch on the child's own code being one of the refusal codes the engine itself answers (INVALID_SCREEN_INPUT, INVALID_SIGNAL, RESUME_IN_PROGRESS, STORE_UNAVAILABLE), which is the producer naming the condition — the same rule the platform applies everywhere else. failSuspendedRun is then reserved for a child that genuinely ran and failed.

⚠️And propagate the code. The current envelope carries none, which is why the transport lands on 400 FLOW_FAILED. Returning the child's envelope with its code intact is half the fix; a fix that leaves both pauses alive but still answers a code-less envelope has repaired the state and left the caller equally misled.

The pins the card names are the right ones, and one more: refused parent resume ⇒ code: 'INVALID_SCREEN_INPUT', parent and child still suspended, corrected retry on the parent completes. Add a negative control — a child that terminally throws must still fail the parent — or the fix can pass by never failing anything.

⚠️ Serialisation: three cards are live on these same 40 lines

… #14392 — the "child run … is gone — continuing without child output" line, which sits in the else of the very if (childRun) this card's arm lives inside. Graded p3 this round. Two separate diffs: a log-text fix disappearing inside a state-machine repair is how the state-machine repair stops getting reviewed on its own merits.

Serialisation honoured: the branch is cut from origin/mainafter PR #14388 merged, and the else arm carrying the "child run … is gone" log line is byte-untouched — #14392 stays a separate diff, still open.

The change

packages/services/service-automation/src/engine.ts, two additions and nothing else:

1. A module-private closed set, RETRYABLE_RESUME_REFUSAL_CODES, naming the codes resumeInternal itself answers for a resume that never ran — INVALID_SCREEN_INPUT, INVALID_SIGNAL, RESUME_IN_PROGRESS, STORE_UNAVAILABLE — plus the one-line predicate that reads it. RUN_NOT_FOUND is deliberately absent and the docblock says why: it is the engine's terminal "this pause is gone for good" class (the automation: the run-resume route still answers HTTP 200 wrapping an inner {success:false} — the route #3962's status-code unification left behind #8684 comment sitting 30 lines above), which a transport answers 404 and no retry can fix.
2. A new arm placed before the terminal-failure arm, answering the child's envelope verbatim but for the parent's durationMs, consuming neither pause and refreshing nothing (the child did not advance, so the parent's surfaced screen is already current).

No log site was added at any level: a refusal is a response, not a degradation, and the child already logged its own warn where it produced the refusal.

Premise checks on origin/main (all verified before the first edit)

#	Premise	Verdict
P1	resumeInternal's subflow block still has exactly three arms, no refusal arm	holds — located at engine.ts:4798 by run.correlation.startsWith('subflow:'); the three arms read exactly as the card quotes them
P2	The card's measurement reproduces on the current tree	holds — written as a failing test first and run before any source edit: 4 failed, 1 passed, every failure expected undefined to be 'INVALID_SCREEN_INPUT' / 'INVALID_SIGNAL'
P3	PR #14388 is on origin/main; refuseInvalidScreenInput / ENGINE_BUILT_SIGNAL untouched	holds — the signal-less normalisation to {} is at the public door; neither symbol appears in the diff
P4	The refusal codes are the four the ruling names	holds, with one reachability note below — grepped the producers inside resumeInternal: RESUME_IN_PROGRESS, STORE_UNAVAILABLE, RUN_NOT_FOUND (three sites), INVALID_SCREEN_INPUT (via refuseInvalidScreenInput), INVALID_SIGNAL. No other code is produced there. Nothing was invented and packages/spec was not touched
P5	packages/spec, content/docs/releases/** and the #14392 log line untouched	holds — the diff is 3 files: engine.ts, one new test file, one changeset

P4 reachability note (reported, not acted on). Two of the four are reachable through delegation today and are pinned end to end: INVALID_SCREEN_INPUT and INVALID_SIGNAL. The other two are in the set because the producer answers them from this method, but neither has a deterministic fixture: RESUME_IN_PROGRESS needs a real race window against a concurrent direct child resume, and a STORE_UNAVAILABLE outage trips the parent's own loadSuspendedRunStrict several frames earlier, so the parent never reaches the delegation block at all. Keeping them in the set is the producer-first rule applied whole; the pins claim only what was measured.

Hypotheses (each falsifiable, each with its evidence)

• H1 — one new arm before the terminal one, no failSuspendedRun, no pause consumed: HOLDS. That is the whole source change.
• H2 — is the parent's pause consumed before the delegation block? NO, so nothing needed restoring.forgetSuspendedRun(run, 'resumed') — the one consumption on this path — sits ~90 lines after the delegation block, and the only other consumer is the failSuspendedRun the new arm bypasses. creditChildRun returns immediately when childSummary is absent, which it is on a direct parent resume. Proven behaviourally, not just by reading: hasSuspendedRun(parentRunId) is true after the refusal in every refusal pin.
• H3 — the corrected retry completes end to end: HOLDS. The child's screen accepts the corrected bag, the child completes, the engine-built signal maps its output into the parent, and the downstream node observes { kind: 'normal' }. Both suspensions are gone afterwards.
• H4 — the negative control still fails the parent through failSuspendedRun, envelope shape unchanged: HOLDS. A child whose node throws after the screen accepted the bag still answers success: false, codeundefined, error matching subflow run '…' (child_flow) failed: …, with both suspensions consumed. This test is green on both sides of the change — it is the control that stops the arm from passing by never failing anything.

Tests

New file packages/services/service-automation/src/builtin/subflow-child-refusal.test.ts — 5 pins, built on installBuiltinNodes with real subflow and screen nodes, exactly the composition the card measured.

pin	asserts
a	refused parent resume ⇒ success: false, code: 'INVALID_SCREEN_INPUT', the child's own actionable text, parent and child still suspended, the parent's surfaced screen unchanged, downstream never ran
b	corrected retry on the same parent run id ⇒ completes, child output mapped into the parent, both suspensions gone
c	the signal-less gesture resume(parentRunId) ⇒ the same refusal, both pauses intact, corrected retry still lands (the population the scope note 14379#issuecomment-5504169090 adds)
d	a second refusal code on the same path — INVALID_SIGNAL from a reserved variable name against a child pause that declares no screen contract ⇒ same shape, then the legitimate submission lands
e	negative control — a child that genuinely ran and threw ⇒ parent failed terminally, code undefined, error text unchanged

Every refusal pin asserts the ADR-0112 code (and the error text), never a bare "it failed".

Verdict lines, quoted from the runs, all at 4ae326704:

BEFORE the source edit (the red half, same test file):
Test Files 1 failed (1)
Tests 4 failed | 1 passed (5)
AssertionError: expected undefined to be 'INVALID_SCREEN_INPUT'
Targeted suites (new pins + subflow-node + both screen-resume suites):
Test Files 4 passed (4)
Tests 41 passed (41)
os-verify-lock: VERDICT command-exit 0
Whole package:
Test Files 99 passed (99)
Tests 1171 passed (1171)
os-verify-lock: VERDICT command-exit 0
Downstream consumer `@objectstack/plugin-approvals` (closure built first):
Test Files 35 passed (35)
Tests 652 passed (652)
os-verify-lock: VERDICT command-exit 0

Type check: this package declares no typecheck script and carries a frozen DEBT ledger entry of 3. tsc --noEmit -p tsconfig.json reports exactly those 3 pre-existing TS2341 in src/nested-region-parity.test.ts (a file this diff does not touch) — unchanged. --listFiles confirms both edited files really are in that program (engine.ts and subflow-child-refusal.test.ts both listed), so this is a measurement and not a green over source nothing read.

Ablation (on the committed tree, both legs proven on disk)

Mutation: the new arm's guard neutralised in place, with a greppable sentinel so the on-disk change is provable from two directions.

HEAD_BLOB=111b7185441f3eabb94e62c8390155c7efe2b625
PRE marker=1 sentinel=0
POST marker=0 sentinel=1
MUTATED_BLOB=5b463c5d48b7d523513e8b01963cf3fad9fa9b7e
ABLATION_VITEST_EXIT=1
Test Files 1 failed (1)
Tests 4 failed | 1 passed (5)
RESTORED_BLOB=111b7185441f3eabb94e62c8390155c7efe2b625
RESTORE marker=1 sentinel=0
git diff HEAD -- $TARGET (expect empty): [empty]
git status --porcelain -- $TARGET (expect empty): [empty]
ABLATION_DONE

Predicted direction, observed: pins a–d red, pin e (the negative control) green. Restore verified by blob-hash equality against the HEAD blob and an empty git diff HEAD, not by an exit code; the script carried a trap … EXIT INT TERM with absolute paths throughout, and an earlier attempt that produced a zero-match substitution aborted at the guard rather than reporting a green ablation — it is reported here as an admitted no-op run, not quietly retried.

No rebuild is required for this ablation and none was performed. The pin imports the subject relatively (../engine.js, same package), which vitest resolves to src/engine.ts, and the package's only resolve.alias entry is an unrelated one for @objectstack/platform-objects. That is proven positively rather than asserted: mutating src/engine.ts alone, with no build, flipped the suite red, and restoring it alone flipped it green.

Gates

Derived on the final head from the actual change set, never a hand-written list: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands at 4ae326704 — 36 commands over the 3 changed paths. 33 exited 0. Three are PREREQUISITE NOT MET, recorded as NOT MEASURED and not as passes, each with the gate's own words:

• check-test-completeness (exit 3) — "this gate grades a saved turbo run test log, and no log was named … the local reading for this gate is NOT MEASURED. ⛔ It is not a red".
• check:dual-build-cjs-loads (exit 3) — "PREREQUISITE NOT MET — this gate reads built output, and some package has no dist/ … ⛔ This is NOT a pass: nothing was measured." (Its own self-test passed: "93 cases pass".)
• check:type-check-debt (exit 3) — "--re-measure cannot run: 33 workspace dependenc(ies) … have no built type entry point on disk … ⛔ This is NOT a pass and NOT a finding". Its sibling check:type-check-coveragedid run and passed: "OK — 68/78 workspace packages type-checked".

Every exit code above was captured before any pipe (cmd > file 2>&1; EXIT=$?), and each verdict is quoted from the gate's own output rather than read off a bare $?.

Beyond the derived family: check:nul-bytes passed ("scanned 7940 text file(s) … no raw ASCII control bytes"), and a direct control-byte scan over the three changed files returned no hits.

Repo-wide lint was run in full, not narrowed — pnpm lint (eslint . --no-inline-config over the whole repo) exited 0.

git merge-tree --write-tree --name-only origin/main HEAD returned a clean tree with no file list, so content/docs/permissions/system-context.mdx is not implicated and no regeneration is owed.

One honest caveat on the derivation: re-running it after a fresh fetch warned "STALE TREE — this answer is derived from a tree at least 7 commit(s) behind origin/main, and 2 file(s) it derives from CHANGED across that range … .github/workflows/lint.ymlscripts/role-word-baseline.json". Both were inspected: the lint.yml change is comment-only (no step added or removed) and role-word-baseline.json moved by one line, so the family for these paths is unchanged. CI runs the real farm regardless.

Clause-②: no

Declared from the actual diff, not from the plan: git diff -U0 origin/main...HEAD | grep export returns exactly one line, a comment in the new test file ("parks on a real screen node and exports what it collected"). No export was added, removed or renamed, and no accept set moved — RETRYABLE_RESUME_REFUSAL_CODES and isRetryableResumeRefusal are module-private. The public resume contract already declares all four codes as answers (packages/spec/src/contracts/automation-service.ts); this change makes the parent's resume return one instead of swallowing it.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/service-automation, touching 7 documentable anchor(s).

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/automation/flows.mdx(via INVALID_SCREEN_INPUT (literal, a string literal in RETRYABLE_RESUME_REFUSAL_CODES))

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 5 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 0e68ed25cc45c15ce296c299614b2b51a3296e52 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 12ede636a4b77f1c4df9993fade21b1996dd7e3a — the merge of head 4ae326704950de2991b47cf21bd71c5601bc536f into base 0e68ed25cc45c15ce296c299614b2b51a3296e52, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 12ede636a4b77f1c4df9993fade21b1996dd7e3a && git checkout 12ede636a4b77f1c4df9993fade21b1996dd7e3a
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 0e68ed25cc45c15ce296c299614b2b51a3296e52 4ae326704950de2991b47cf21bd71c5601bc536f && git checkout -B drift-repro 0e68ed25cc45c15ce296c299614b2b51a3296e52 && git merge --no-ff 4ae326704950de2991b47cf21bd71c5601bc536f
node scripts/docs-audit/affected-docs.mjs --json 0e68ed25cc45c15ce296c299614b2b51a3296e52

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 0e68ed25cc45c15ce296c299614b2b51a3296e52 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-sales]

Landing provenance — ready + auto-merge at head 4ae326704

• Card: service-automation: a subflow parent resume treats the delegated child screen's RETRYABLE refusal (INVALID_SCREEN_INPUT) as a terminal child failure — the parent is failed, the still-paused child is orphaned, and the corrected retry answers RUN_NOT_FOUND #14379 (Fixes, closes on merge).
• Review: PM ACCEPT 14379#issuecomment-5509505046 at this head. Clause-② no, verified by the seat from the diff: no exported symbol added, removed or changed (git diff -U0 origin/main...HEAD | grep export → nothing; RETRYABLE_RESUME_REFUSAL_CODES and isRetryableResumeRefusal are module-private in engine.ts), no accept/reject change on a public endpoint (the parent now answers a delegated child's retryable refusal as that refusal instead of failing the run, consuming neither pause). No contract review is owed; no needs:contract-review carrier was ever on this pair.
• Surface: 3 files — packages/services/service-automation/src/engine.ts (the subflow delegation block only), the new src/builtin/subflow-child-refusal.test.ts (5 pins), one patch changeset for @objectstack/service-automation. No packages/spec, no content/docs/releases/, no skills/.
• CI on 4ae326704: every check green — Lint & Repo Gatessuccess at 12:48:18Z, Test Core (1/6)success at 12:44:51Z and the aggregate Test Coresuccess, TypeScript Type Check and the four Type Check · jobs success, Build Core, Dogfood Verify CLI, Dogfood Regression Gate (1-3/3), Temporal Conformancesuccess; Check Changeset, Governed Surface Queue Guard, the single-writer and same-issue guards success.
• Action: draft → ready and auto-merge enabled at 12:54:17Z (method MERGE). On MERGED: the card auto-closes and the seat strips pm:dispatched from service-automation: a subflow parent resume treats the delegated child screen's RETRYABLE refusal (INVALID_SCREEN_INPUT) as a terminal child failure — the parent is failed, the still-paused child is orphaned, and the corrected retry answers RUN_NOT_FOUND #14379; the engine.ts subflow region is released to the next service-automation card (service-automation: three more readers of suspended-run state still prefer the per-process map over the shared store #14332 / service-automation: two concurrent resumes of one run on two replicas can both advance it — the idempotency guard is per-process #14333 / try_catch whose catch region itself fails still discards the whole step record — the third returned-failure path, left unfolded by #14184 #14222 / [finding] service-automation: the subflow up-bubble path always logs "child run … is gone — continuing without child output" even when the engine-built signal carries the child's output #14392 / automation: create_record collapses the engine's DUPLICATE_RECORD envelope to a string, so a flow's try_catch / fault edge still cannot tell "already there" from "the store is down" #14419, one at a time).

---

Generated by Claude Code

[claude]

Fixes#14379

A parent run paused at a subflow node forwards a resume down to the child it is parked on — the screen-flow path, where the caller holds ONE stable run id (the parent's) and posts every wizard step to it. When the child refused that bag, the delegation block read it as a child that ran and died: it called failSuspendedRun on the parent and answered a code-less{ success: false, error }. One mistyped form field therefore destroyed a running workflow — the parent's suspension consumed and a failure recorded, the still-paused child orphaned with nothing left to bubble into, the caller told 400 FLOW_FAILED ("it ran and was rejected") for something that never ran, and their corrected retry on the same run id answered RUN_NOT_FOUND.

The delegation now branches on the child's own code. A retryable refusal is answered as a refusal, with its code intact and both pauses untouched; failSuspendedRun is reserved for a child that genuinely ran and failed.

Head at the time of every measurement below: 4ae326704.

Ruling of record (14379#issuecomment-5504400729, verbatim)

The fix criterion — prefer the producer-first one. The card offers two discriminators; take the second. ⛔ Do not branch on "is the child's suspension still live" — that is a second store read whose answer can race, and it infers intent from state. Branch on the child's own code being one of the refusal codes the engine itself answers (INVALID_SCREEN_INPUT, INVALID_SIGNAL, RESUME_IN_PROGRESS, STORE_UNAVAILABLE), which is the producer naming the condition — the same rule the platform applies everywhere else. failSuspendedRun is then reserved for a child that genuinely ran and failed.

⚠️And propagate the code. The current envelope carries none, which is why the transport lands on 400 FLOW_FAILED. Returning the child's envelope with its code intact is half the fix; a fix that leaves both pauses alive but still answers a code-less envelope has repaired the state and left the caller equally misled.

The pins the card names are the right ones, and one more: refused parent resume ⇒ code: 'INVALID_SCREEN_INPUT', parent and child still suspended, corrected retry on the parent completes. Add a negative control — a child that terminally throws must still fail the parent — or the fix can pass by never failing anything.

⚠️ Serialisation: three cards are live on these same 40 lines

… #14392 — the "child run … is gone — continuing without child output" line, which sits in the else of the very if (childRun) this card's arm lives inside. Graded p3 this round. Two separate diffs: a log-text fix disappearing inside a state-machine repair is how the state-machine repair stops getting reviewed on its own merits.

Serialisation honoured: the branch is cut from origin/mainafter PR #14388 merged, and the else arm carrying the "child run … is gone" log line is byte-untouched — #14392 stays a separate diff, still open.

The change

packages/services/service-automation/src/engine.ts, two additions and nothing else:

1. A module-private closed set, RETRYABLE_RESUME_REFUSAL_CODES, naming the codes resumeInternal itself answers for a resume that never ran — INVALID_SCREEN_INPUT, INVALID_SIGNAL, RESUME_IN_PROGRESS, STORE_UNAVAILABLE — plus the one-line predicate that reads it. RUN_NOT_FOUND is deliberately absent and the docblock says why: it is the engine's terminal "this pause is gone for good" class (the automation: the run-resume route still answers HTTP 200 wrapping an inner {success:false} — the route #3962's status-code unification left behind #8684 comment sitting 30 lines above), which a transport answers 404 and no retry can fix.
2. A new arm placed before the terminal-failure arm, answering the child's envelope verbatim but for the parent's durationMs, consuming neither pause and refreshing nothing (the child did not advance, so the parent's surfaced screen is already current).

No log site was added at any level: a refusal is a response, not a degradation, and the child already logged its own warn where it produced the refusal.

Premise checks on origin/main (all verified before the first edit)

#	Premise	Verdict
P1	resumeInternal's subflow block still has exactly three arms, no refusal arm	holds — located at engine.ts:4798 by run.correlation.startsWith('subflow:'); the three arms read exactly as the card quotes them
P2	The card's measurement reproduces on the current tree	holds — written as a failing test first and run before any source edit: 4 failed, 1 passed, every failure expected undefined to be 'INVALID_SCREEN_INPUT' / 'INVALID_SIGNAL'
P3	PR #14388 is on origin/main; refuseInvalidScreenInput / ENGINE_BUILT_SIGNAL untouched	holds — the signal-less normalisation to {} is at the public door; neither symbol appears in the diff
P4	The refusal codes are the four the ruling names	holds, with one reachability note below — grepped the producers inside resumeInternal: RESUME_IN_PROGRESS, STORE_UNAVAILABLE, RUN_NOT_FOUND (three sites), INVALID_SCREEN_INPUT (via refuseInvalidScreenInput), INVALID_SIGNAL. No other code is produced there. Nothing was invented and packages/spec was not touched
P5	packages/spec, content/docs/releases/** and the #14392 log line untouched	holds — the diff is 3 files: engine.ts, one new test file, one changeset

P4 reachability note (reported, not acted on). Two of the four are reachable through delegation today and are pinned end to end: INVALID_SCREEN_INPUT and INVALID_SIGNAL. The other two are in the set because the producer answers them from this method, but neither has a deterministic fixture: RESUME_IN_PROGRESS needs a real race window against a concurrent direct child resume, and a STORE_UNAVAILABLE outage trips the parent's own loadSuspendedRunStrict several frames earlier, so the parent never reaches the delegation block at all. Keeping them in the set is the producer-first rule applied whole; the pins claim only what was measured.

Hypotheses (each falsifiable, each with its evidence)

• H1 — one new arm before the terminal one, no failSuspendedRun, no pause consumed: HOLDS. That is the whole source change.
• H2 — is the parent's pause consumed before the delegation block? NO, so nothing needed restoring.forgetSuspendedRun(run, 'resumed') — the one consumption on this path — sits ~90 lines after the delegation block, and the only other consumer is the failSuspendedRun the new arm bypasses. creditChildRun returns immediately when childSummary is absent, which it is on a direct parent resume. Proven behaviourally, not just by reading: hasSuspendedRun(parentRunId) is true after the refusal in every refusal pin.
• H3 — the corrected retry completes end to end: HOLDS. The child's screen accepts the corrected bag, the child completes, the engine-built signal maps its output into the parent, and the downstream node observes { kind: 'normal' }. Both suspensions are gone afterwards.
• H4 — the negative control still fails the parent through failSuspendedRun, envelope shape unchanged: HOLDS. A child whose node throws after the screen accepted the bag still answers success: false, codeundefined, error matching subflow run '…' (child_flow) failed: …, with both suspensions consumed. This test is green on both sides of the change — it is the control that stops the arm from passing by never failing anything.

Tests

New file packages/services/service-automation/src/builtin/subflow-child-refusal.test.ts — 5 pins, built on installBuiltinNodes with real subflow and screen nodes, exactly the composition the card measured.

pin	asserts
a	refused parent resume ⇒ success: false, code: 'INVALID_SCREEN_INPUT', the child's own actionable text, parent and child still suspended, the parent's surfaced screen unchanged, downstream never ran
b	corrected retry on the same parent run id ⇒ completes, child output mapped into the parent, both suspensions gone
c	the signal-less gesture resume(parentRunId) ⇒ the same refusal, both pauses intact, corrected retry still lands (the population the scope note 14379#issuecomment-5504169090 adds)
d	a second refusal code on the same path — INVALID_SIGNAL from a reserved variable name against a child pause that declares no screen contract ⇒ same shape, then the legitimate submission lands
e	negative control — a child that genuinely ran and threw ⇒ parent failed terminally, code undefined, error text unchanged

Every refusal pin asserts the ADR-0112 code (and the error text), never a bare "it failed".

Verdict lines, quoted from the runs, all at 4ae326704:

BEFORE the source edit (the red half, same test file):
Test Files 1 failed (1)
Tests 4 failed | 1 passed (5)
AssertionError: expected undefined to be 'INVALID_SCREEN_INPUT'
Targeted suites (new pins + subflow-node + both screen-resume suites):
Test Files 4 passed (4)
Tests 41 passed (41)
os-verify-lock: VERDICT command-exit 0
Whole package:
Test Files 99 passed (99)
Tests 1171 passed (1171)
os-verify-lock: VERDICT command-exit 0
Downstream consumer `@objectstack/plugin-approvals` (closure built first):
Test Files 35 passed (35)
Tests 652 passed (652)
os-verify-lock: VERDICT command-exit 0

Type check: this package declares no typecheck script and carries a frozen DEBT ledger entry of 3. tsc --noEmit -p tsconfig.json reports exactly those 3 pre-existing TS2341 in src/nested-region-parity.test.ts (a file this diff does not touch) — unchanged. --listFiles confirms both edited files really are in that program (engine.ts and subflow-child-refusal.test.ts both listed), so this is a measurement and not a green over source nothing read.

Ablation (on the committed tree, both legs proven on disk)

Mutation: the new arm's guard neutralised in place, with a greppable sentinel so the on-disk change is provable from two directions.

HEAD_BLOB=111b7185441f3eabb94e62c8390155c7efe2b625
PRE marker=1 sentinel=0
POST marker=0 sentinel=1
MUTATED_BLOB=5b463c5d48b7d523513e8b01963cf3fad9fa9b7e
ABLATION_VITEST_EXIT=1
Test Files 1 failed (1)
Tests 4 failed | 1 passed (5)
RESTORED_BLOB=111b7185441f3eabb94e62c8390155c7efe2b625
RESTORE marker=1 sentinel=0
git diff HEAD -- $TARGET (expect empty): [empty]
git status --porcelain -- $TARGET (expect empty): [empty]
ABLATION_DONE

Predicted direction, observed: pins a–d red, pin e (the negative control) green. Restore verified by blob-hash equality against the HEAD blob and an empty git diff HEAD, not by an exit code; the script carried a trap … EXIT INT TERM with absolute paths throughout, and an earlier attempt that produced a zero-match substitution aborted at the guard rather than reporting a green ablation — it is reported here as an admitted no-op run, not quietly retried.

No rebuild is required for this ablation and none was performed. The pin imports the subject relatively (../engine.js, same package), which vitest resolves to src/engine.ts, and the package's only resolve.alias entry is an unrelated one for @objectstack/platform-objects. That is proven positively rather than asserted: mutating src/engine.ts alone, with no build, flipped the suite red, and restoring it alone flipped it green.

Gates

Derived on the final head from the actual change set, never a hand-written list: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands at 4ae326704 — 36 commands over the 3 changed paths. 33 exited 0. Three are PREREQUISITE NOT MET, recorded as NOT MEASURED and not as passes, each with the gate's own words:

• check-test-completeness (exit 3) — "this gate grades a saved turbo run test log, and no log was named … the local reading for this gate is NOT MEASURED. ⛔ It is not a red".
• check:dual-build-cjs-loads (exit 3) — "PREREQUISITE NOT MET — this gate reads built output, and some package has no dist/ … ⛔ This is NOT a pass: nothing was measured." (Its own self-test passed: "93 cases pass".)
• check:type-check-debt (exit 3) — "--re-measure cannot run: 33 workspace dependenc(ies) … have no built type entry point on disk … ⛔ This is NOT a pass and NOT a finding". Its sibling check:type-check-coveragedid run and passed: "OK — 68/78 workspace packages type-checked".

Every exit code above was captured before any pipe (cmd > file 2>&1; EXIT=$?), and each verdict is quoted from the gate's own output rather than read off a bare $?.

Beyond the derived family: check:nul-bytes passed ("scanned 7940 text file(s) … no raw ASCII control bytes"), and a direct control-byte scan over the three changed files returned no hits.

Repo-wide lint was run in full, not narrowed — pnpm lint (eslint . --no-inline-config over the whole repo) exited 0.

git merge-tree --write-tree --name-only origin/main HEAD returned a clean tree with no file list, so content/docs/permissions/system-context.mdx is not implicated and no regeneration is owed.

One honest caveat on the derivation: re-running it after a fresh fetch warned "STALE TREE — this answer is derived from a tree at least 7 commit(s) behind origin/main, and 2 file(s) it derives from CHANGED across that range … .github/workflows/lint.ymlscripts/role-word-baseline.json". Both were inspected: the lint.yml change is comment-only (no step added or removed) and role-word-baseline.json moved by one line, so the family for these paths is unchanged. CI runs the real farm regardless.

Clause-②: no

Declared from the actual diff, not from the plan: git diff -U0 origin/main...HEAD | grep export returns exactly one line, a comment in the new test file ("parks on a real screen node and exports what it collected"). No export was added, removed or renamed, and no accept set moved — RETRYABLE_RESUME_REFUSAL_CODES and isRetryableResumeRefusal are module-private. The public resume contract already declares all four codes as answers (packages/spec/src/contracts/automation-service.ts); this change makes the parent's resume return one instead of swallowing it.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/service-automation, touching 7 documentable anchor(s).

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/automation/flows.mdx(via INVALID_SCREEN_INPUT (literal, a string literal in RETRYABLE_RESUME_REFUSAL_CODES))

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 5 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 0e68ed25cc45c15ce296c299614b2b51a3296e52 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 12ede636a4b77f1c4df9993fade21b1996dd7e3a — the merge of head 4ae326704950de2991b47cf21bd71c5601bc536f into base 0e68ed25cc45c15ce296c299614b2b51a3296e52, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 12ede636a4b77f1c4df9993fade21b1996dd7e3a && git checkout 12ede636a4b77f1c4df9993fade21b1996dd7e3a
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 0e68ed25cc45c15ce296c299614b2b51a3296e52 4ae326704950de2991b47cf21bd71c5601bc536f && git checkout -B drift-repro 0e68ed25cc45c15ce296c299614b2b51a3296e52 && git merge --no-ff 4ae326704950de2991b47cf21bd71c5601bc536f
node scripts/docs-audit/affected-docs.mjs --json 0e68ed25cc45c15ce296c299614b2b51a3296e52

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 0e68ed25cc45c15ce296c299614b2b51a3296e52 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-sales]

Landing provenance — ready + auto-merge at head 4ae326704

• Card: service-automation: a subflow parent resume treats the delegated child screen's RETRYABLE refusal (INVALID_SCREEN_INPUT) as a terminal child failure — the parent is failed, the still-paused child is orphaned, and the corrected retry answers RUN_NOT_FOUND #14379 (Fixes, closes on merge).
• Review: PM ACCEPT 14379#issuecomment-5509505046 at this head. Clause-② no, verified by the seat from the diff: no exported symbol added, removed or changed (git diff -U0 origin/main...HEAD | grep export → nothing; RETRYABLE_RESUME_REFUSAL_CODES and isRetryableResumeRefusal are module-private in engine.ts), no accept/reject change on a public endpoint (the parent now answers a delegated child's retryable refusal as that refusal instead of failing the run, consuming neither pause). No contract review is owed; no needs:contract-review carrier was ever on this pair.
• Surface: 3 files — packages/services/service-automation/src/engine.ts (the subflow delegation block only), the new src/builtin/subflow-child-refusal.test.ts (5 pins), one patch changeset for @objectstack/service-automation. No packages/spec, no content/docs/releases/, no skills/.
• CI on 4ae326704: every check green — Lint & Repo Gatessuccess at 12:48:18Z, Test Core (1/6)success at 12:44:51Z and the aggregate Test Coresuccess, TypeScript Type Check and the four Type Check · jobs success, Build Core, Dogfood Verify CLI, Dogfood Regression Gate (1-3/3), Temporal Conformancesuccess; Check Changeset, Governed Surface Queue Guard, the single-writer and same-issue guards success.
• Action: draft → ready and auto-merge enabled at 12:54:17Z (method MERGE). On MERGED: the card auto-closes and the seat strips pm:dispatched from service-automation: a subflow parent resume treats the delegated child screen's RETRYABLE refusal (INVALID_SCREEN_INPUT) as a terminal child failure — the parent is failed, the still-paused child is orphaned, and the corrected retry answers RUN_NOT_FOUND #14379; the engine.ts subflow region is released to the next service-automation card (service-automation: three more readers of suspended-run state still prefer the per-process map over the shared store #14332 / service-automation: two concurrent resumes of one run on two replicas can both advance it — the idempotency guard is per-process #14333 / try_catch whose catch region itself fails still discards the whole step record — the third returned-failure path, left unfolded by #14184 #14222 / [finding] service-automation: the subflow up-bubble path always logs "child run … is gone — continuing without child output" even when the engine-built signal carries the child's output #14392 / automation: create_record collapses the engine's DUPLICATE_RECORD envelope to a string, so a flow's try_catch / fault edge still cannot tell "already there" from "the store is down" #14419, one at a time).

---

Generated by Claude Code

[claude]

Fixes#14379

A parent run paused at a subflow node forwards a resume down to the child it is parked on — the screen-flow path, where the caller holds ONE stable run id (the parent's) and posts every wizard step to it. When the child refused that bag, the delegation block read it as a child that ran and died: it called failSuspendedRun on the parent and answered a code-less{ success: false, error }. One mistyped form field therefore destroyed a running workflow — the parent's suspension consumed and a failure recorded, the still-paused child orphaned with nothing left to bubble into, the caller told 400 FLOW_FAILED ("it ran and was rejected") for something that never ran, and their corrected retry on the same run id answered RUN_NOT_FOUND.

The delegation now branches on the child's own code. A retryable refusal is answered as a refusal, with its code intact and both pauses untouched; failSuspendedRun is reserved for a child that genuinely ran and failed.

Head at the time of every measurement below: 4ae326704.

Ruling of record (14379#issuecomment-5504400729, verbatim)

The fix criterion — prefer the producer-first one. The card offers two discriminators; take the second. ⛔ Do not branch on "is the child's suspension still live" — that is a second store read whose answer can race, and it infers intent from state. Branch on the child's own code being one of the refusal codes the engine itself answers (INVALID_SCREEN_INPUT, INVALID_SIGNAL, RESUME_IN_PROGRESS, STORE_UNAVAILABLE), which is the producer naming the condition — the same rule the platform applies everywhere else. failSuspendedRun is then reserved for a child that genuinely ran and failed.

⚠️And propagate the code. The current envelope carries none, which is why the transport lands on 400 FLOW_FAILED. Returning the child's envelope with its code intact is half the fix; a fix that leaves both pauses alive but still answers a code-less envelope has repaired the state and left the caller equally misled.

The pins the card names are the right ones, and one more: refused parent resume ⇒ code: 'INVALID_SCREEN_INPUT', parent and child still suspended, corrected retry on the parent completes. Add a negative control — a child that terminally throws must still fail the parent — or the fix can pass by never failing anything.

⚠️ Serialisation: three cards are live on these same 40 lines

… #14392 — the "child run … is gone — continuing without child output" line, which sits in the else of the very if (childRun) this card's arm lives inside. Graded p3 this round. Two separate diffs: a log-text fix disappearing inside a state-machine repair is how the state-machine repair stops getting reviewed on its own merits.

Serialisation honoured: the branch is cut from origin/mainafter PR #14388 merged, and the else arm carrying the "child run … is gone" log line is byte-untouched — #14392 stays a separate diff, still open.

The change

packages/services/service-automation/src/engine.ts, two additions and nothing else:

1. A module-private closed set, RETRYABLE_RESUME_REFUSAL_CODES, naming the codes resumeInternal itself answers for a resume that never ran — INVALID_SCREEN_INPUT, INVALID_SIGNAL, RESUME_IN_PROGRESS, STORE_UNAVAILABLE — plus the one-line predicate that reads it. RUN_NOT_FOUND is deliberately absent and the docblock says why: it is the engine's terminal "this pause is gone for good" class (the automation: the run-resume route still answers HTTP 200 wrapping an inner {success:false} — the route #3962's status-code unification left behind #8684 comment sitting 30 lines above), which a transport answers 404 and no retry can fix.
2. A new arm placed before the terminal-failure arm, answering the child's envelope verbatim but for the parent's durationMs, consuming neither pause and refreshing nothing (the child did not advance, so the parent's surfaced screen is already current).

No log site was added at any level: a refusal is a response, not a degradation, and the child already logged its own warn where it produced the refusal.

Premise checks on origin/main (all verified before the first edit)

#	Premise	Verdict
P1	resumeInternal's subflow block still has exactly three arms, no refusal arm	holds — located at engine.ts:4798 by run.correlation.startsWith('subflow:'); the three arms read exactly as the card quotes them
P2	The card's measurement reproduces on the current tree	holds — written as a failing test first and run before any source edit: 4 failed, 1 passed, every failure expected undefined to be 'INVALID_SCREEN_INPUT' / 'INVALID_SIGNAL'
P3	PR #14388 is on origin/main; refuseInvalidScreenInput / ENGINE_BUILT_SIGNAL untouched	holds — the signal-less normalisation to {} is at the public door; neither symbol appears in the diff
P4	The refusal codes are the four the ruling names	holds, with one reachability note below — grepped the producers inside resumeInternal: RESUME_IN_PROGRESS, STORE_UNAVAILABLE, RUN_NOT_FOUND (three sites), INVALID_SCREEN_INPUT (via refuseInvalidScreenInput), INVALID_SIGNAL. No other code is produced there. Nothing was invented and packages/spec was not touched
P5	packages/spec, content/docs/releases/** and the #14392 log line untouched	holds — the diff is 3 files: engine.ts, one new test file, one changeset

P4 reachability note (reported, not acted on). Two of the four are reachable through delegation today and are pinned end to end: INVALID_SCREEN_INPUT and INVALID_SIGNAL. The other two are in the set because the producer answers them from this method, but neither has a deterministic fixture: RESUME_IN_PROGRESS needs a real race window against a concurrent direct child resume, and a STORE_UNAVAILABLE outage trips the parent's own loadSuspendedRunStrict several frames earlier, so the parent never reaches the delegation block at all. Keeping them in the set is the producer-first rule applied whole; the pins claim only what was measured.

Hypotheses (each falsifiable, each with its evidence)

• H1 — one new arm before the terminal one, no failSuspendedRun, no pause consumed: HOLDS. That is the whole source change.
• H2 — is the parent's pause consumed before the delegation block? NO, so nothing needed restoring.forgetSuspendedRun(run, 'resumed') — the one consumption on this path — sits ~90 lines after the delegation block, and the only other consumer is the failSuspendedRun the new arm bypasses. creditChildRun returns immediately when childSummary is absent, which it is on a direct parent resume. Proven behaviourally, not just by reading: hasSuspendedRun(parentRunId) is true after the refusal in every refusal pin.
• H3 — the corrected retry completes end to end: HOLDS. The child's screen accepts the corrected bag, the child completes, the engine-built signal maps its output into the parent, and the downstream node observes { kind: 'normal' }. Both suspensions are gone afterwards.
• H4 — the negative control still fails the parent through failSuspendedRun, envelope shape unchanged: HOLDS. A child whose node throws after the screen accepted the bag still answers success: false, codeundefined, error matching subflow run '…' (child_flow) failed: …, with both suspensions consumed. This test is green on both sides of the change — it is the control that stops the arm from passing by never failing anything.

Tests

New file packages/services/service-automation/src/builtin/subflow-child-refusal.test.ts — 5 pins, built on installBuiltinNodes with real subflow and screen nodes, exactly the composition the card measured.

pin	asserts
a	refused parent resume ⇒ success: false, code: 'INVALID_SCREEN_INPUT', the child's own actionable text, parent and child still suspended, the parent's surfaced screen unchanged, downstream never ran
b	corrected retry on the same parent run id ⇒ completes, child output mapped into the parent, both suspensions gone
c	the signal-less gesture resume(parentRunId) ⇒ the same refusal, both pauses intact, corrected retry still lands (the population the scope note 14379#issuecomment-5504169090 adds)
d	a second refusal code on the same path — INVALID_SIGNAL from a reserved variable name against a child pause that declares no screen contract ⇒ same shape, then the legitimate submission lands
e	negative control — a child that genuinely ran and threw ⇒ parent failed terminally, code undefined, error text unchanged

Every refusal pin asserts the ADR-0112 code (and the error text), never a bare "it failed".

Verdict lines, quoted from the runs, all at 4ae326704:

BEFORE the source edit (the red half, same test file):
Test Files 1 failed (1)
Tests 4 failed | 1 passed (5)
AssertionError: expected undefined to be 'INVALID_SCREEN_INPUT'
Targeted suites (new pins + subflow-node + both screen-resume suites):
Test Files 4 passed (4)
Tests 41 passed (41)
os-verify-lock: VERDICT command-exit 0
Whole package:
Test Files 99 passed (99)
Tests 1171 passed (1171)
os-verify-lock: VERDICT command-exit 0
Downstream consumer `@objectstack/plugin-approvals` (closure built first):
Test Files 35 passed (35)
Tests 652 passed (652)
os-verify-lock: VERDICT command-exit 0

Type check: this package declares no typecheck script and carries a frozen DEBT ledger entry of 3. tsc --noEmit -p tsconfig.json reports exactly those 3 pre-existing TS2341 in src/nested-region-parity.test.ts (a file this diff does not touch) — unchanged. --listFiles confirms both edited files really are in that program (engine.ts and subflow-child-refusal.test.ts both listed), so this is a measurement and not a green over source nothing read.

Ablation (on the committed tree, both legs proven on disk)

Mutation: the new arm's guard neutralised in place, with a greppable sentinel so the on-disk change is provable from two directions.

HEAD_BLOB=111b7185441f3eabb94e62c8390155c7efe2b625
PRE marker=1 sentinel=0
POST marker=0 sentinel=1
MUTATED_BLOB=5b463c5d48b7d523513e8b01963cf3fad9fa9b7e
ABLATION_VITEST_EXIT=1
Test Files 1 failed (1)
Tests 4 failed | 1 passed (5)
RESTORED_BLOB=111b7185441f3eabb94e62c8390155c7efe2b625
RESTORE marker=1 sentinel=0
git diff HEAD -- $TARGET (expect empty): [empty]
git status --porcelain -- $TARGET (expect empty): [empty]
ABLATION_DONE

Predicted direction, observed: pins a–d red, pin e (the negative control) green. Restore verified by blob-hash equality against the HEAD blob and an empty git diff HEAD, not by an exit code; the script carried a trap … EXIT INT TERM with absolute paths throughout, and an earlier attempt that produced a zero-match substitution aborted at the guard rather than reporting a green ablation — it is reported here as an admitted no-op run, not quietly retried.

No rebuild is required for this ablation and none was performed. The pin imports the subject relatively (../engine.js, same package), which vitest resolves to src/engine.ts, and the package's only resolve.alias entry is an unrelated one for @objectstack/platform-objects. That is proven positively rather than asserted: mutating src/engine.ts alone, with no build, flipped the suite red, and restoring it alone flipped it green.

Gates

Derived on the final head from the actual change set, never a hand-written list: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands at 4ae326704 — 36 commands over the 3 changed paths. 33 exited 0. Three are PREREQUISITE NOT MET, recorded as NOT MEASURED and not as passes, each with the gate's own words:

• check-test-completeness (exit 3) — "this gate grades a saved turbo run test log, and no log was named … the local reading for this gate is NOT MEASURED. ⛔ It is not a red".
• check:dual-build-cjs-loads (exit 3) — "PREREQUISITE NOT MET — this gate reads built output, and some package has no dist/ … ⛔ This is NOT a pass: nothing was measured." (Its own self-test passed: "93 cases pass".)
• check:type-check-debt (exit 3) — "--re-measure cannot run: 33 workspace dependenc(ies) … have no built type entry point on disk … ⛔ This is NOT a pass and NOT a finding". Its sibling check:type-check-coveragedid run and passed: "OK — 68/78 workspace packages type-checked".

Every exit code above was captured before any pipe (cmd > file 2>&1; EXIT=$?), and each verdict is quoted from the gate's own output rather than read off a bare $?.

Beyond the derived family: check:nul-bytes passed ("scanned 7940 text file(s) … no raw ASCII control bytes"), and a direct control-byte scan over the three changed files returned no hits.

Repo-wide lint was run in full, not narrowed — pnpm lint (eslint . --no-inline-config over the whole repo) exited 0.

git merge-tree --write-tree --name-only origin/main HEAD returned a clean tree with no file list, so content/docs/permissions/system-context.mdx is not implicated and no regeneration is owed.

One honest caveat on the derivation: re-running it after a fresh fetch warned "STALE TREE — this answer is derived from a tree at least 7 commit(s) behind origin/main, and 2 file(s) it derives from CHANGED across that range … .github/workflows/lint.ymlscripts/role-word-baseline.json". Both were inspected: the lint.yml change is comment-only (no step added or removed) and role-word-baseline.json moved by one line, so the family for these paths is unchanged. CI runs the real farm regardless.

Clause-②: no

Declared from the actual diff, not from the plan: git diff -U0 origin/main...HEAD | grep export returns exactly one line, a comment in the new test file ("parks on a real screen node and exports what it collected"). No export was added, removed or renamed, and no accept set moved — RETRYABLE_RESUME_REFUSAL_CODES and isRetryableResumeRefusal are module-private. The public resume contract already declares all four codes as answers (packages/spec/src/contracts/automation-service.ts); this change makes the parent's resume return one instead of swallowing it.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/service-automation, touching 7 documentable anchor(s).

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/automation/flows.mdx(via INVALID_SCREEN_INPUT (literal, a string literal in RETRYABLE_RESUME_REFUSAL_CODES))

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 5 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 0e68ed25cc45c15ce296c299614b2b51a3296e52 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 12ede636a4b77f1c4df9993fade21b1996dd7e3a — the merge of head 4ae326704950de2991b47cf21bd71c5601bc536f into base 0e68ed25cc45c15ce296c299614b2b51a3296e52, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 12ede636a4b77f1c4df9993fade21b1996dd7e3a && git checkout 12ede636a4b77f1c4df9993fade21b1996dd7e3a
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 0e68ed25cc45c15ce296c299614b2b51a3296e52 4ae326704950de2991b47cf21bd71c5601bc536f && git checkout -B drift-repro 0e68ed25cc45c15ce296c299614b2b51a3296e52 && git merge --no-ff 4ae326704950de2991b47cf21bd71c5601bc536f
node scripts/docs-audit/affected-docs.mjs --json 0e68ed25cc45c15ce296c299614b2b51a3296e52

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 0e68ed25cc45c15ce296c299614b2b51a3296e52 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-sales]

Landing provenance — ready + auto-merge at head 4ae326704

• Card: service-automation: a subflow parent resume treats the delegated child screen's RETRYABLE refusal (INVALID_SCREEN_INPUT) as a terminal child failure — the parent is failed, the still-paused child is orphaned, and the corrected retry answers RUN_NOT_FOUND #14379 (Fixes, closes on merge).
• Review: PM ACCEPT 14379#issuecomment-5509505046 at this head. Clause-② no, verified by the seat from the diff: no exported symbol added, removed or changed (git diff -U0 origin/main...HEAD | grep export → nothing; RETRYABLE_RESUME_REFUSAL_CODES and isRetryableResumeRefusal are module-private in engine.ts), no accept/reject change on a public endpoint (the parent now answers a delegated child's retryable refusal as that refusal instead of failing the run, consuming neither pause). No contract review is owed; no needs:contract-review carrier was ever on this pair.
• Surface: 3 files — packages/services/service-automation/src/engine.ts (the subflow delegation block only), the new src/builtin/subflow-child-refusal.test.ts (5 pins), one patch changeset for @objectstack/service-automation. No packages/spec, no content/docs/releases/, no skills/.
• CI on 4ae326704: every check green — Lint & Repo Gatessuccess at 12:48:18Z, Test Core (1/6)success at 12:44:51Z and the aggregate Test Coresuccess, TypeScript Type Check and the four Type Check · jobs success, Build Core, Dogfood Verify CLI, Dogfood Regression Gate (1-3/3), Temporal Conformancesuccess; Check Changeset, Governed Surface Queue Guard, the single-writer and same-issue guards success.
• Action: draft → ready and auto-merge enabled at 12:54:17Z (method MERGE). On MERGED: the card auto-closes and the seat strips pm:dispatched from service-automation: a subflow parent resume treats the delegated child screen's RETRYABLE refusal (INVALID_SCREEN_INPUT) as a terminal child failure — the parent is failed, the still-paused child is orphaned, and the corrected retry answers RUN_NOT_FOUND #14379; the engine.ts subflow region is released to the next service-automation card (service-automation: three more readers of suspended-run state still prefer the per-process map over the shared store #14332 / service-automation: two concurrent resumes of one run on two replicas can both advance it — the idempotency guard is per-process #14333 / try_catch whose catch region itself fails still discards the whole step record — the third returned-failure path, left unfolded by #14184 #14222 / [finding] service-automation: the subflow up-bubble path always logs "child run … is gone — continuing without child output" even when the engine-built signal carries the child's output #14392 / automation: create_record collapses the engine's DUPLICATE_RECORD envelope to a string, so a flow's try_catch / fault edge still cannot tell "already there" from "the store is down" #14419, one at a time).

---

Generated by Claude Code

[claude]

Fixes#14379

A parent run paused at a subflow node forwards a resume down to the child it is parked on — the screen-flow path, where the caller holds ONE stable run id (the parent's) and posts every wizard step to it. When the child refused that bag, the delegation block read it as a child that ran and died: it called failSuspendedRun on the parent and answered a code-less{ success: false, error }. One mistyped form field therefore destroyed a running workflow — the parent's suspension consumed and a failure recorded, the still-paused child orphaned with nothing left to bubble into, the caller told 400 FLOW_FAILED ("it ran and was rejected") for something that never ran, and their corrected retry on the same run id answered RUN_NOT_FOUND.

The delegation now branches on the child's own code. A retryable refusal is answered as a refusal, with its code intact and both pauses untouched; failSuspendedRun is reserved for a child that genuinely ran and failed.

Head at the time of every measurement below: 4ae326704.

Ruling of record (14379#issuecomment-5504400729, verbatim)

The fix criterion — prefer the producer-first one. The card offers two discriminators; take the second. ⛔ Do not branch on "is the child's suspension still live" — that is a second store read whose answer can race, and it infers intent from state. Branch on the child's own code being one of the refusal codes the engine itself answers (INVALID_SCREEN_INPUT, INVALID_SIGNAL, RESUME_IN_PROGRESS, STORE_UNAVAILABLE), which is the producer naming the condition — the same rule the platform applies everywhere else. failSuspendedRun is then reserved for a child that genuinely ran and failed.

⚠️And propagate the code. The current envelope carries none, which is why the transport lands on 400 FLOW_FAILED. Returning the child's envelope with its code intact is half the fix; a fix that leaves both pauses alive but still answers a code-less envelope has repaired the state and left the caller equally misled.

The pins the card names are the right ones, and one more: refused parent resume ⇒ code: 'INVALID_SCREEN_INPUT', parent and child still suspended, corrected retry on the parent completes. Add a negative control — a child that terminally throws must still fail the parent — or the fix can pass by never failing anything.

⚠️ Serialisation: three cards are live on these same 40 lines

… #14392 — the "child run … is gone — continuing without child output" line, which sits in the else of the very if (childRun) this card's arm lives inside. Graded p3 this round. Two separate diffs: a log-text fix disappearing inside a state-machine repair is how the state-machine repair stops getting reviewed on its own merits.

Serialisation honoured: the branch is cut from origin/mainafter PR #14388 merged, and the else arm carrying the "child run … is gone" log line is byte-untouched — #14392 stays a separate diff, still open.

The change

packages/services/service-automation/src/engine.ts, two additions and nothing else:

1. A module-private closed set, RETRYABLE_RESUME_REFUSAL_CODES, naming the codes resumeInternal itself answers for a resume that never ran — INVALID_SCREEN_INPUT, INVALID_SIGNAL, RESUME_IN_PROGRESS, STORE_UNAVAILABLE — plus the one-line predicate that reads it. RUN_NOT_FOUND is deliberately absent and the docblock says why: it is the engine's terminal "this pause is gone for good" class (the automation: the run-resume route still answers HTTP 200 wrapping an inner {success:false} — the route #3962's status-code unification left behind #8684 comment sitting 30 lines above), which a transport answers 404 and no retry can fix.
2. A new arm placed before the terminal-failure arm, answering the child's envelope verbatim but for the parent's durationMs, consuming neither pause and refreshing nothing (the child did not advance, so the parent's surfaced screen is already current).

No log site was added at any level: a refusal is a response, not a degradation, and the child already logged its own warn where it produced the refusal.

Premise checks on origin/main (all verified before the first edit)

#	Premise	Verdict
P1	resumeInternal's subflow block still has exactly three arms, no refusal arm	holds — located at engine.ts:4798 by run.correlation.startsWith('subflow:'); the three arms read exactly as the card quotes them
P2	The card's measurement reproduces on the current tree	holds — written as a failing test first and run before any source edit: 4 failed, 1 passed, every failure expected undefined to be 'INVALID_SCREEN_INPUT' / 'INVALID_SIGNAL'
P3	PR #14388 is on origin/main; refuseInvalidScreenInput / ENGINE_BUILT_SIGNAL untouched	holds — the signal-less normalisation to {} is at the public door; neither symbol appears in the diff
P4	The refusal codes are the four the ruling names	holds, with one reachability note below — grepped the producers inside resumeInternal: RESUME_IN_PROGRESS, STORE_UNAVAILABLE, RUN_NOT_FOUND (three sites), INVALID_SCREEN_INPUT (via refuseInvalidScreenInput), INVALID_SIGNAL. No other code is produced there. Nothing was invented and packages/spec was not touched
P5	packages/spec, content/docs/releases/** and the #14392 log line untouched	holds — the diff is 3 files: engine.ts, one new test file, one changeset

P4 reachability note (reported, not acted on). Two of the four are reachable through delegation today and are pinned end to end: INVALID_SCREEN_INPUT and INVALID_SIGNAL. The other two are in the set because the producer answers them from this method, but neither has a deterministic fixture: RESUME_IN_PROGRESS needs a real race window against a concurrent direct child resume, and a STORE_UNAVAILABLE outage trips the parent's own loadSuspendedRunStrict several frames earlier, so the parent never reaches the delegation block at all. Keeping them in the set is the producer-first rule applied whole; the pins claim only what was measured.

Hypotheses (each falsifiable, each with its evidence)

• H1 — one new arm before the terminal one, no failSuspendedRun, no pause consumed: HOLDS. That is the whole source change.
• H2 — is the parent's pause consumed before the delegation block? NO, so nothing needed restoring.forgetSuspendedRun(run, 'resumed') — the one consumption on this path — sits ~90 lines after the delegation block, and the only other consumer is the failSuspendedRun the new arm bypasses. creditChildRun returns immediately when childSummary is absent, which it is on a direct parent resume. Proven behaviourally, not just by reading: hasSuspendedRun(parentRunId) is true after the refusal in every refusal pin.
• H3 — the corrected retry completes end to end: HOLDS. The child's screen accepts the corrected bag, the child completes, the engine-built signal maps its output into the parent, and the downstream node observes { kind: 'normal' }. Both suspensions are gone afterwards.
• H4 — the negative control still fails the parent through failSuspendedRun, envelope shape unchanged: HOLDS. A child whose node throws after the screen accepted the bag still answers success: false, codeundefined, error matching subflow run '…' (child_flow) failed: …, with both suspensions consumed. This test is green on both sides of the change — it is the control that stops the arm from passing by never failing anything.

Tests

New file packages/services/service-automation/src/builtin/subflow-child-refusal.test.ts — 5 pins, built on installBuiltinNodes with real subflow and screen nodes, exactly the composition the card measured.

pin	asserts
a	refused parent resume ⇒ success: false, code: 'INVALID_SCREEN_INPUT', the child's own actionable text, parent and child still suspended, the parent's surfaced screen unchanged, downstream never ran
b	corrected retry on the same parent run id ⇒ completes, child output mapped into the parent, both suspensions gone
c	the signal-less gesture resume(parentRunId) ⇒ the same refusal, both pauses intact, corrected retry still lands (the population the scope note 14379#issuecomment-5504169090 adds)
d	a second refusal code on the same path — INVALID_SIGNAL from a reserved variable name against a child pause that declares no screen contract ⇒ same shape, then the legitimate submission lands
e	negative control — a child that genuinely ran and threw ⇒ parent failed terminally, code undefined, error text unchanged

Every refusal pin asserts the ADR-0112 code (and the error text), never a bare "it failed".

Verdict lines, quoted from the runs, all at 4ae326704:

BEFORE the source edit (the red half, same test file):
Test Files 1 failed (1)
Tests 4 failed | 1 passed (5)
AssertionError: expected undefined to be 'INVALID_SCREEN_INPUT'
Targeted suites (new pins + subflow-node + both screen-resume suites):
Test Files 4 passed (4)
Tests 41 passed (41)
os-verify-lock: VERDICT command-exit 0
Whole package:
Test Files 99 passed (99)
Tests 1171 passed (1171)
os-verify-lock: VERDICT command-exit 0
Downstream consumer `@objectstack/plugin-approvals` (closure built first):
Test Files 35 passed (35)
Tests 652 passed (652)
os-verify-lock: VERDICT command-exit 0

Type check: this package declares no typecheck script and carries a frozen DEBT ledger entry of 3. tsc --noEmit -p tsconfig.json reports exactly those 3 pre-existing TS2341 in src/nested-region-parity.test.ts (a file this diff does not touch) — unchanged. --listFiles confirms both edited files really are in that program (engine.ts and subflow-child-refusal.test.ts both listed), so this is a measurement and not a green over source nothing read.

Ablation (on the committed tree, both legs proven on disk)

Mutation: the new arm's guard neutralised in place, with a greppable sentinel so the on-disk change is provable from two directions.

HEAD_BLOB=111b7185441f3eabb94e62c8390155c7efe2b625
PRE marker=1 sentinel=0
POST marker=0 sentinel=1
MUTATED_BLOB=5b463c5d48b7d523513e8b01963cf3fad9fa9b7e
ABLATION_VITEST_EXIT=1
Test Files 1 failed (1)
Tests 4 failed | 1 passed (5)
RESTORED_BLOB=111b7185441f3eabb94e62c8390155c7efe2b625
RESTORE marker=1 sentinel=0
git diff HEAD -- $TARGET (expect empty): [empty]
git status --porcelain -- $TARGET (expect empty): [empty]
ABLATION_DONE

Predicted direction, observed: pins a–d red, pin e (the negative control) green. Restore verified by blob-hash equality against the HEAD blob and an empty git diff HEAD, not by an exit code; the script carried a trap … EXIT INT TERM with absolute paths throughout, and an earlier attempt that produced a zero-match substitution aborted at the guard rather than reporting a green ablation — it is reported here as an admitted no-op run, not quietly retried.

No rebuild is required for this ablation and none was performed. The pin imports the subject relatively (../engine.js, same package), which vitest resolves to src/engine.ts, and the package's only resolve.alias entry is an unrelated one for @objectstack/platform-objects. That is proven positively rather than asserted: mutating src/engine.ts alone, with no build, flipped the suite red, and restoring it alone flipped it green.

Gates

Derived on the final head from the actual change set, never a hand-written list: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands at 4ae326704 — 36 commands over the 3 changed paths. 33 exited 0. Three are PREREQUISITE NOT MET, recorded as NOT MEASURED and not as passes, each with the gate's own words:

• check-test-completeness (exit 3) — "this gate grades a saved turbo run test log, and no log was named … the local reading for this gate is NOT MEASURED. ⛔ It is not a red".
• check:dual-build-cjs-loads (exit 3) — "PREREQUISITE NOT MET — this gate reads built output, and some package has no dist/ … ⛔ This is NOT a pass: nothing was measured." (Its own self-test passed: "93 cases pass".)
• check:type-check-debt (exit 3) — "--re-measure cannot run: 33 workspace dependenc(ies) … have no built type entry point on disk … ⛔ This is NOT a pass and NOT a finding". Its sibling check:type-check-coveragedid run and passed: "OK — 68/78 workspace packages type-checked".

Every exit code above was captured before any pipe (cmd > file 2>&1; EXIT=$?), and each verdict is quoted from the gate's own output rather than read off a bare $?.

Beyond the derived family: check:nul-bytes passed ("scanned 7940 text file(s) … no raw ASCII control bytes"), and a direct control-byte scan over the three changed files returned no hits.

Repo-wide lint was run in full, not narrowed — pnpm lint (eslint . --no-inline-config over the whole repo) exited 0.

git merge-tree --write-tree --name-only origin/main HEAD returned a clean tree with no file list, so content/docs/permissions/system-context.mdx is not implicated and no regeneration is owed.

One honest caveat on the derivation: re-running it after a fresh fetch warned "STALE TREE — this answer is derived from a tree at least 7 commit(s) behind origin/main, and 2 file(s) it derives from CHANGED across that range … .github/workflows/lint.ymlscripts/role-word-baseline.json". Both were inspected: the lint.yml change is comment-only (no step added or removed) and role-word-baseline.json moved by one line, so the family for these paths is unchanged. CI runs the real farm regardless.

Clause-②: no

Declared from the actual diff, not from the plan: git diff -U0 origin/main...HEAD | grep export returns exactly one line, a comment in the new test file ("parks on a real screen node and exports what it collected"). No export was added, removed or renamed, and no accept set moved — RETRYABLE_RESUME_REFUSAL_CODES and isRetryableResumeRefusal are module-private. The public resume contract already declares all four codes as answers (packages/spec/src/contracts/automation-service.ts); this change makes the parent's resume return one instead of swallowing it.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/service-automation, touching 7 documentable anchor(s).

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/automation/flows.mdx(via INVALID_SCREEN_INPUT (literal, a string literal in RETRYABLE_RESUME_REFUSAL_CODES))

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 5 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 0e68ed25cc45c15ce296c299614b2b51a3296e52 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 12ede636a4b77f1c4df9993fade21b1996dd7e3a — the merge of head 4ae326704950de2991b47cf21bd71c5601bc536f into base 0e68ed25cc45c15ce296c299614b2b51a3296e52, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 12ede636a4b77f1c4df9993fade21b1996dd7e3a && git checkout 12ede636a4b77f1c4df9993fade21b1996dd7e3a
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 0e68ed25cc45c15ce296c299614b2b51a3296e52 4ae326704950de2991b47cf21bd71c5601bc536f && git checkout -B drift-repro 0e68ed25cc45c15ce296c299614b2b51a3296e52 && git merge --no-ff 4ae326704950de2991b47cf21bd71c5601bc536f
node scripts/docs-audit/affected-docs.mjs --json 0e68ed25cc45c15ce296c299614b2b51a3296e52

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 0e68ed25cc45c15ce296c299614b2b51a3296e52 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-sales]

Landing provenance — ready + auto-merge at head 4ae326704

• Card: service-automation: a subflow parent resume treats the delegated child screen's RETRYABLE refusal (INVALID_SCREEN_INPUT) as a terminal child failure — the parent is failed, the still-paused child is orphaned, and the corrected retry answers RUN_NOT_FOUND #14379 (Fixes, closes on merge).
• Review: PM ACCEPT 14379#issuecomment-5509505046 at this head. Clause-② no, verified by the seat from the diff: no exported symbol added, removed or changed (git diff -U0 origin/main...HEAD | grep export → nothing; RETRYABLE_RESUME_REFUSAL_CODES and isRetryableResumeRefusal are module-private in engine.ts), no accept/reject change on a public endpoint (the parent now answers a delegated child's retryable refusal as that refusal instead of failing the run, consuming neither pause). No contract review is owed; no needs:contract-review carrier was ever on this pair.
• Surface: 3 files — packages/services/service-automation/src/engine.ts (the subflow delegation block only), the new src/builtin/subflow-child-refusal.test.ts (5 pins), one patch changeset for @objectstack/service-automation. No packages/spec, no content/docs/releases/, no skills/.
• CI on 4ae326704: every check green — Lint & Repo Gatessuccess at 12:48:18Z, Test Core (1/6)success at 12:44:51Z and the aggregate Test Coresuccess, TypeScript Type Check and the four Type Check · jobs success, Build Core, Dogfood Verify CLI, Dogfood Regression Gate (1-3/3), Temporal Conformancesuccess; Check Changeset, Governed Surface Queue Guard, the single-writer and same-issue guards success.
• Action: draft → ready and auto-merge enabled at 12:54:17Z (method MERGE). On MERGED: the card auto-closes and the seat strips pm:dispatched from service-automation: a subflow parent resume treats the delegated child screen's RETRYABLE refusal (INVALID_SCREEN_INPUT) as a terminal child failure — the parent is failed, the still-paused child is orphaned, and the corrected retry answers RUN_NOT_FOUND #14379; the engine.ts subflow region is released to the next service-automation card (service-automation: three more readers of suspended-run state still prefer the per-process map over the shared store #14332 / service-automation: two concurrent resumes of one run on two replicas can both advance it — the idempotency guard is per-process #14333 / try_catch whose catch region itself fails still discards the whole step record — the third returned-failure path, left unfolded by #14184 #14222 / [finding] service-automation: the subflow up-bubble path always logs "child run … is gone — continuing without child output" even when the engine-built signal carries the child's output #14392 / automation: create_record collapses the engine's DUPLICATE_RECORD envelope to a string, so a flow's try_catch / fault edge still cannot tell "already there" from "the store is down" #14419, one at a time).

---

Generated by Claude Code

[claude]

Fixes#14379

A parent run paused at a subflow node forwards a resume down to the child it is parked on — the screen-flow path, where the caller holds ONE stable run id (the parent's) and posts every wizard step to it. When the child refused that bag, the delegation block read it as a child that ran and died: it called failSuspendedRun on the parent and answered a code-less{ success: false, error }. One mistyped form field therefore destroyed a running workflow — the parent's suspension consumed and a failure recorded, the still-paused child orphaned with nothing left to bubble into, the caller told 400 FLOW_FAILED ("it ran and was rejected") for something that never ran, and their corrected retry on the same run id answered RUN_NOT_FOUND.

The delegation now branches on the child's own code. A retryable refusal is answered as a refusal, with its code intact and both pauses untouched; failSuspendedRun is reserved for a child that genuinely ran and failed.

Head at the time of every measurement below: 4ae326704.

Ruling of record (14379#issuecomment-5504400729, verbatim)

The fix criterion — prefer the producer-first one. The card offers two discriminators; take the second. ⛔ Do not branch on "is the child's suspension still live" — that is a second store read whose answer can race, and it infers intent from state. Branch on the child's own code being one of the refusal codes the engine itself answers (INVALID_SCREEN_INPUT, INVALID_SIGNAL, RESUME_IN_PROGRESS, STORE_UNAVAILABLE), which is the producer naming the condition — the same rule the platform applies everywhere else. failSuspendedRun is then reserved for a child that genuinely ran and failed.

⚠️And propagate the code. The current envelope carries none, which is why the transport lands on 400 FLOW_FAILED. Returning the child's envelope with its code intact is half the fix; a fix that leaves both pauses alive but still answers a code-less envelope has repaired the state and left the caller equally misled.

The pins the card names are the right ones, and one more: refused parent resume ⇒ code: 'INVALID_SCREEN_INPUT', parent and child still suspended, corrected retry on the parent completes. Add a negative control — a child that terminally throws must still fail the parent — or the fix can pass by never failing anything.

⚠️ Serialisation: three cards are live on these same 40 lines

… #14392 — the "child run … is gone — continuing without child output" line, which sits in the else of the very if (childRun) this card's arm lives inside. Graded p3 this round. Two separate diffs: a log-text fix disappearing inside a state-machine repair is how the state-machine repair stops getting reviewed on its own merits.

Serialisation honoured: the branch is cut from origin/mainafter PR #14388 merged, and the else arm carrying the "child run … is gone" log line is byte-untouched — #14392 stays a separate diff, still open.

The change

packages/services/service-automation/src/engine.ts, two additions and nothing else:

1. A module-private closed set, RETRYABLE_RESUME_REFUSAL_CODES, naming the codes resumeInternal itself answers for a resume that never ran — INVALID_SCREEN_INPUT, INVALID_SIGNAL, RESUME_IN_PROGRESS, STORE_UNAVAILABLE — plus the one-line predicate that reads it. RUN_NOT_FOUND is deliberately absent and the docblock says why: it is the engine's terminal "this pause is gone for good" class (the automation: the run-resume route still answers HTTP 200 wrapping an inner {success:false} — the route #3962's status-code unification left behind #8684 comment sitting 30 lines above), which a transport answers 404 and no retry can fix.
2. A new arm placed before the terminal-failure arm, answering the child's envelope verbatim but for the parent's durationMs, consuming neither pause and refreshing nothing (the child did not advance, so the parent's surfaced screen is already current).

No log site was added at any level: a refusal is a response, not a degradation, and the child already logged its own warn where it produced the refusal.

Premise checks on origin/main (all verified before the first edit)

#	Premise	Verdict
P1	resumeInternal's subflow block still has exactly three arms, no refusal arm	holds — located at engine.ts:4798 by run.correlation.startsWith('subflow:'); the three arms read exactly as the card quotes them
P2	The card's measurement reproduces on the current tree	holds — written as a failing test first and run before any source edit: 4 failed, 1 passed, every failure expected undefined to be 'INVALID_SCREEN_INPUT' / 'INVALID_SIGNAL'
P3	PR #14388 is on origin/main; refuseInvalidScreenInput / ENGINE_BUILT_SIGNAL untouched	holds — the signal-less normalisation to {} is at the public door; neither symbol appears in the diff
P4	The refusal codes are the four the ruling names	holds, with one reachability note below — grepped the producers inside resumeInternal: RESUME_IN_PROGRESS, STORE_UNAVAILABLE, RUN_NOT_FOUND (three sites), INVALID_SCREEN_INPUT (via refuseInvalidScreenInput), INVALID_SIGNAL. No other code is produced there. Nothing was invented and packages/spec was not touched
P5	packages/spec, content/docs/releases/** and the #14392 log line untouched	holds — the diff is 3 files: engine.ts, one new test file, one changeset

P4 reachability note (reported, not acted on). Two of the four are reachable through delegation today and are pinned end to end: INVALID_SCREEN_INPUT and INVALID_SIGNAL. The other two are in the set because the producer answers them from this method, but neither has a deterministic fixture: RESUME_IN_PROGRESS needs a real race window against a concurrent direct child resume, and a STORE_UNAVAILABLE outage trips the parent's own loadSuspendedRunStrict several frames earlier, so the parent never reaches the delegation block at all. Keeping them in the set is the producer-first rule applied whole; the pins claim only what was measured.

Hypotheses (each falsifiable, each with its evidence)

• H1 — one new arm before the terminal one, no failSuspendedRun, no pause consumed: HOLDS. That is the whole source change.
• H2 — is the parent's pause consumed before the delegation block? NO, so nothing needed restoring.forgetSuspendedRun(run, 'resumed') — the one consumption on this path — sits ~90 lines after the delegation block, and the only other consumer is the failSuspendedRun the new arm bypasses. creditChildRun returns immediately when childSummary is absent, which it is on a direct parent resume. Proven behaviourally, not just by reading: hasSuspendedRun(parentRunId) is true after the refusal in every refusal pin.
• H3 — the corrected retry completes end to end: HOLDS. The child's screen accepts the corrected bag, the child completes, the engine-built signal maps its output into the parent, and the downstream node observes { kind: 'normal' }. Both suspensions are gone afterwards.
• H4 — the negative control still fails the parent through failSuspendedRun, envelope shape unchanged: HOLDS. A child whose node throws after the screen accepted the bag still answers success: false, codeundefined, error matching subflow run '…' (child_flow) failed: …, with both suspensions consumed. This test is green on both sides of the change — it is the control that stops the arm from passing by never failing anything.

Tests

New file packages/services/service-automation/src/builtin/subflow-child-refusal.test.ts — 5 pins, built on installBuiltinNodes with real subflow and screen nodes, exactly the composition the card measured.

pin	asserts
a	refused parent resume ⇒ success: false, code: 'INVALID_SCREEN_INPUT', the child's own actionable text, parent and child still suspended, the parent's surfaced screen unchanged, downstream never ran
b	corrected retry on the same parent run id ⇒ completes, child output mapped into the parent, both suspensions gone
c	the signal-less gesture resume(parentRunId) ⇒ the same refusal, both pauses intact, corrected retry still lands (the population the scope note 14379#issuecomment-5504169090 adds)
d	a second refusal code on the same path — INVALID_SIGNAL from a reserved variable name against a child pause that declares no screen contract ⇒ same shape, then the legitimate submission lands
e	negative control — a child that genuinely ran and threw ⇒ parent failed terminally, code undefined, error text unchanged

Every refusal pin asserts the ADR-0112 code (and the error text), never a bare "it failed".

Verdict lines, quoted from the runs, all at 4ae326704:

BEFORE the source edit (the red half, same test file):
Test Files 1 failed (1)
Tests 4 failed | 1 passed (5)
AssertionError: expected undefined to be 'INVALID_SCREEN_INPUT'
Targeted suites (new pins + subflow-node + both screen-resume suites):
Test Files 4 passed (4)
Tests 41 passed (41)
os-verify-lock: VERDICT command-exit 0
Whole package:
Test Files 99 passed (99)
Tests 1171 passed (1171)
os-verify-lock: VERDICT command-exit 0
Downstream consumer `@objectstack/plugin-approvals` (closure built first):
Test Files 35 passed (35)
Tests 652 passed (652)
os-verify-lock: VERDICT command-exit 0

Type check: this package declares no typecheck script and carries a frozen DEBT ledger entry of 3. tsc --noEmit -p tsconfig.json reports exactly those 3 pre-existing TS2341 in src/nested-region-parity.test.ts (a file this diff does not touch) — unchanged. --listFiles confirms both edited files really are in that program (engine.ts and subflow-child-refusal.test.ts both listed), so this is a measurement and not a green over source nothing read.

Ablation (on the committed tree, both legs proven on disk)

Mutation: the new arm's guard neutralised in place, with a greppable sentinel so the on-disk change is provable from two directions.

HEAD_BLOB=111b7185441f3eabb94e62c8390155c7efe2b625
PRE marker=1 sentinel=0
POST marker=0 sentinel=1
MUTATED_BLOB=5b463c5d48b7d523513e8b01963cf3fad9fa9b7e
ABLATION_VITEST_EXIT=1
Test Files 1 failed (1)
Tests 4 failed | 1 passed (5)
RESTORED_BLOB=111b7185441f3eabb94e62c8390155c7efe2b625
RESTORE marker=1 sentinel=0
git diff HEAD -- $TARGET (expect empty): [empty]
git status --porcelain -- $TARGET (expect empty): [empty]
ABLATION_DONE

Predicted direction, observed: pins a–d red, pin e (the negative control) green. Restore verified by blob-hash equality against the HEAD blob and an empty git diff HEAD, not by an exit code; the script carried a trap … EXIT INT TERM with absolute paths throughout, and an earlier attempt that produced a zero-match substitution aborted at the guard rather than reporting a green ablation — it is reported here as an admitted no-op run, not quietly retried.

No rebuild is required for this ablation and none was performed. The pin imports the subject relatively (../engine.js, same package), which vitest resolves to src/engine.ts, and the package's only resolve.alias entry is an unrelated one for @objectstack/platform-objects. That is proven positively rather than asserted: mutating src/engine.ts alone, with no build, flipped the suite red, and restoring it alone flipped it green.

Gates

Derived on the final head from the actual change set, never a hand-written list: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands at 4ae326704 — 36 commands over the 3 changed paths. 33 exited 0. Three are PREREQUISITE NOT MET, recorded as NOT MEASURED and not as passes, each with the gate's own words:

• check-test-completeness (exit 3) — "this gate grades a saved turbo run test log, and no log was named … the local reading for this gate is NOT MEASURED. ⛔ It is not a red".
• check:dual-build-cjs-loads (exit 3) — "PREREQUISITE NOT MET — this gate reads built output, and some package has no dist/ … ⛔ This is NOT a pass: nothing was measured." (Its own self-test passed: "93 cases pass".)
• check:type-check-debt (exit 3) — "--re-measure cannot run: 33 workspace dependenc(ies) … have no built type entry point on disk … ⛔ This is NOT a pass and NOT a finding". Its sibling check:type-check-coveragedid run and passed: "OK — 68/78 workspace packages type-checked".

Every exit code above was captured before any pipe (cmd > file 2>&1; EXIT=$?), and each verdict is quoted from the gate's own output rather than read off a bare $?.

Beyond the derived family: check:nul-bytes passed ("scanned 7940 text file(s) … no raw ASCII control bytes"), and a direct control-byte scan over the three changed files returned no hits.

Repo-wide lint was run in full, not narrowed — pnpm lint (eslint . --no-inline-config over the whole repo) exited 0.

git merge-tree --write-tree --name-only origin/main HEAD returned a clean tree with no file list, so content/docs/permissions/system-context.mdx is not implicated and no regeneration is owed.

One honest caveat on the derivation: re-running it after a fresh fetch warned "STALE TREE — this answer is derived from a tree at least 7 commit(s) behind origin/main, and 2 file(s) it derives from CHANGED across that range … .github/workflows/lint.ymlscripts/role-word-baseline.json". Both were inspected: the lint.yml change is comment-only (no step added or removed) and role-word-baseline.json moved by one line, so the family for these paths is unchanged. CI runs the real farm regardless.

Clause-②: no

Declared from the actual diff, not from the plan: git diff -U0 origin/main...HEAD | grep export returns exactly one line, a comment in the new test file ("parks on a real screen node and exports what it collected"). No export was added, removed or renamed, and no accept set moved — RETRYABLE_RESUME_REFUSAL_CODES and isRetryableResumeRefusal are module-private. The public resume contract already declares all four codes as answers (packages/spec/src/contracts/automation-service.ts); this change makes the parent's resume return one instead of swallowing it.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/service-automation, touching 7 documentable anchor(s).

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/automation/flows.mdx(via INVALID_SCREEN_INPUT (literal, a string literal in RETRYABLE_RESUME_REFUSAL_CODES))

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 5 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 0e68ed25cc45c15ce296c299614b2b51a3296e52 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 12ede636a4b77f1c4df9993fade21b1996dd7e3a — the merge of head 4ae326704950de2991b47cf21bd71c5601bc536f into base 0e68ed25cc45c15ce296c299614b2b51a3296e52, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 12ede636a4b77f1c4df9993fade21b1996dd7e3a && git checkout 12ede636a4b77f1c4df9993fade21b1996dd7e3a
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 0e68ed25cc45c15ce296c299614b2b51a3296e52 4ae326704950de2991b47cf21bd71c5601bc536f && git checkout -B drift-repro 0e68ed25cc45c15ce296c299614b2b51a3296e52 && git merge --no-ff 4ae326704950de2991b47cf21bd71c5601bc536f
node scripts/docs-audit/affected-docs.mjs --json 0e68ed25cc45c15ce296c299614b2b51a3296e52

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 0e68ed25cc45c15ce296c299614b2b51a3296e52 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-sales]

Landing provenance — ready + auto-merge at head 4ae326704

• Card: service-automation: a subflow parent resume treats the delegated child screen's RETRYABLE refusal (INVALID_SCREEN_INPUT) as a terminal child failure — the parent is failed, the still-paused child is orphaned, and the corrected retry answers RUN_NOT_FOUND #14379 (Fixes, closes on merge).
• Review: PM ACCEPT 14379#issuecomment-5509505046 at this head. Clause-② no, verified by the seat from the diff: no exported symbol added, removed or changed (git diff -U0 origin/main...HEAD | grep export → nothing; RETRYABLE_RESUME_REFUSAL_CODES and isRetryableResumeRefusal are module-private in engine.ts), no accept/reject change on a public endpoint (the parent now answers a delegated child's retryable refusal as that refusal instead of failing the run, consuming neither pause). No contract review is owed; no needs:contract-review carrier was ever on this pair.
• Surface: 3 files — packages/services/service-automation/src/engine.ts (the subflow delegation block only), the new src/builtin/subflow-child-refusal.test.ts (5 pins), one patch changeset for @objectstack/service-automation. No packages/spec, no content/docs/releases/, no skills/.
• CI on 4ae326704: every check green — Lint & Repo Gatessuccess at 12:48:18Z, Test Core (1/6)success at 12:44:51Z and the aggregate Test Coresuccess, TypeScript Type Check and the four Type Check · jobs success, Build Core, Dogfood Verify CLI, Dogfood Regression Gate (1-3/3), Temporal Conformancesuccess; Check Changeset, Governed Surface Queue Guard, the single-writer and same-issue guards success.
• Action: draft → ready and auto-merge enabled at 12:54:17Z (method MERGE). On MERGED: the card auto-closes and the seat strips pm:dispatched from service-automation: a subflow parent resume treats the delegated child screen's RETRYABLE refusal (INVALID_SCREEN_INPUT) as a terminal child failure — the parent is failed, the still-paused child is orphaned, and the corrected retry answers RUN_NOT_FOUND #14379; the engine.ts subflow region is released to the next service-automation card (service-automation: three more readers of suspended-run state still prefer the per-process map over the shared store #14332 / service-automation: two concurrent resumes of one run on two replicas can both advance it — the idempotency guard is per-process #14333 / try_catch whose catch region itself fails still discards the whole step record — the third returned-failure path, left unfolded by #14184 #14222 / [finding] service-automation: the subflow up-bubble path always logs "child run … is gone — continuing without child output" even when the engine-built signal carries the child's output #14392 / automation: create_record collapses the engine's DUPLICATE_RECORD envelope to a string, so a flow's try_catch / fault edge still cannot tell "already there" from "the store is down" #14419, one at a time).

---

Generated by Claude Code