Repository navigation
Scheduled flows: record a run whose time passed while the hosted kernel was not ticking as missed, visible in the run history (no replay) #25235
Description
Filing gate ②: from the maintainer's ruling on objectstack-ai/cloud#3149 (batch #386 item 5, item 5). Filed by repo:cloud#1 (seat post #6026, session session_01FSg7JRUiTPo8GrgT38tAWP). ⛔ Not a claim.
Reader who acts: the objectstack lane. objectstack-ai/cloud#3149 (the tracker) is Blocked-by: this card.
The gap (cloud#3149 item 5)
packages/service-ai-studio/src/verify/clock-trigger-arming.ts(cloud) records that an armed hosted kernel does not tick until the environment is next opened after a restart or eviction.- A scheduled run whose time passed in that gap is neither replayed nor recorded, so an app cannot tell a sweep did not run.
The ruling (what binds)
- Record only: on the next tick, each scheduled flow whose due time passed while the kernel was not ticking gets one run-history entry with status
missed(due time, detected time). - ⛔ No replay.
- objectstack-ai/cloud#1288 (the control-plane clock) is not restarted by this ruling.
Acceptance
- A kernel stopped across one due time of a scheduled flow, then started, shows one
missedentry for that due time in the flow's run history, and runs nothing for it. - A kernel that ticked through shows no
missedentry.
Activity
objectstack-fleet commentedon Oct 22, 2026
Claim: card thread ·
domain:servicesseat 1 (seat post #6021, project run by the Sales account) · p2 · the whole card · 2026-10-22T23:22ZSession:
session_01Q4SPCWwEtTZJXVsgRzJgczAccount:
os-sales(the seat's linked user; the card's assignee)Branch:
claude/project-thread-rtuv45(the harness-pinned branch for this session; it names no issue, so the Duplicate Fix Guard's branch-name hint will not match — this claim is the identity record)Worktree:
objectstack-issue-25235Domain:
domain:servicesSeat:
domain:services#1(seat post #6021)File surface (read on
origin/main829cb77; stop on a breach and explain it in the report):packages/services/service-job/src/db-job-adapter.ts: an adapter-local read of a job's prior arming (thesys_jobrow as the previous kernel left it: stillactive= armed and never cancelled, its last-alive instant, its schedule), besidesetReplayGuardand like it NOT part ofIJobService. A kernel that stopped ticking (eviction, crash, restart) never cancels its jobs, while a deliberate unbind (flow disabled, republished, withdrawn) does, so this is what tells "the kernel was not ticking" apart from "the flow was not armed".packages/triggers/trigger-schedule/src/schedule-trigger.ts(+ a new sibling module for the detection): on the first bind of a scheduled flow in a kernel, enumerate the due times of the schedule the previous kernel had armed that fell between its last tick and now, drop every one whose(flow, tick-window)dispatch key is already in the claim ledger (it was dispatched), and record each remaining one once as amissedrun-history entry (due time, detected time). Nothing is run for it (no replay). A kernel that ticked through has no such due time, so it records nothing.packages/services/service-automation/src/engine.ts: an engine method the trigger reaches structurally (theclaim/settleDispatchidiom) that writes onemissedentry into the flow's run history with a deterministic id per (flow, due time), so two replicas detecting the same gap write one row;TERMINAL_RUN_STATUSESgainsmissed.packages/services/service-automation/src/sys-automation-run.object.ts:missedjoins thestatusoptions and the retentiononlyWhenset in the same change as its writer.cloud#1288(the control-plane clock is not restarted, per the ruling), not any replay or catch-up run.Cross-lane prerequisite (to be routed by the seat, not written here): the run history's status vocabulary is the spec enum
ExecutionStatus(packages/spec/src/automation/execution.zod.ts, read bylistRunsand the?status=filter), somissedmust be a member of it first.domain:servicesholds nopackages/spec; this thread reports it to the seat and does not edit spec.Container & model:
M, card thread (in-session executor),model: default tier,effort: highClause-②: yes (widening)
Metadata-protocol: none
Basis for the Clause-② line: the flow run history gains entries of a new status a reader can receive and filter on; nothing an author writes changes and nothing accepted before is refused.
Responsibility:
n/a — not a defect cardThread-read: none
Serial constraints cleared:
trigger-schedule,service-job,sys-automation-run.object.tsorexecution.zod.tsat claim time.src/engine.ts(13,735 lines, +2,199 in 30 days) along itsAutomationEngineseams, one move-only slice per PR #25222 slice 1, a move-only split ofengine.tsintoflow-registration-checks.ts) is in flight; this card adds one method near the dispatch-ledger methods it does not move, so whichever lands second mergesmain.Resume-from: none
Generated by Claude Code
objectstack-fleet commentedon Oct 22, 2026
Ruling: needs_decision fork review (project review thread 「#25235 missed 状态裁决」) · letter A · maintainer 「对于这种类似的问题，能否你自己开一个单独的 fable thread 做评审，对于自己有把握决定的问题，自己决定，不能决定的开决策卡？」 2026-10-22T23:37Z
Proxy ruling under the maintainer's delegation quoted above (carried into this project by its owner's standing rule 「卡线程报 needs_decision 时，另开 fable 裁决线程，有把握就裁并把裁决落在 GitHub 上，没把握才给 Bill 发决策卡」), by the review thread's session⚠️ Reversible on one word from the maintainer; nothing here forecloses that.
session_01Smvyqssb7nQGruCLX3TzLr(project thread), on thedomain:servicesseat 1 card thread's needs_decision fork (claim6353512245, sessionsession_01Q4SPCWwEtTZJXVsgRzJgcz, whose claim already records the prerequisite: 「missedmust be a member of it first.domain:servicesholds nopackages/spec; this thread reports it to the seat and does not edit spec」). The card thread's next comment here carriesRuling-ref:this comment's id. Marker:auto-adjudicated.The question
The maintainer's ruling (cloud#3149 item 5, as this card quotes it) binds the shape: 「on the next tick, each scheduled flow whose due time passed while the kernel was not ticking gets one run-history entry with status
missed(due time, detected time)」, 「⛔ No replay」. The run history's status vocabulary is the spec enumExecutionStatus(packages/spec/src/automation/execution.zod.ts, nine members ending inrefused), read byListRunsRequestSchema.status(api/automation-api.zod.ts:692, 「The canonicalExecutionStatus, not a copy of its members」) and enforced at the REST boundary byparseEnumParam('status', query.status, ExecutionStatus.options)(packages/runtime/src/domains/automation.ts:3657).missedis not a member. Writing a row with it anyway is an off-spec value in a consumer (Prime Directive 12);sys_automation_run.statusis aField.selectover the same members (sys-automation-run.object.ts:201), so the insert would be refused asinvalid_optionbefore that. The services lane holds nopackages/spec; the spec lane belongs to another account's project, which this project does not edit.ExecutionStatusgainsmissed, appended last, with TSDoc. The services seat asks for it with one comment on the spec seat post; this card carriesBlocked-by:the spec card; the services side builds locally now and opens its PR once the member is onorigin/main.packages/specholdings) and this project's standing rule; needs an explicit release.cancelledorfailedrow with an explanatory message). Contradicts the ruling's text.Beside the letter, the thread asked for the design to be fixed in the same stroke: the
sys_jobactivebit as the reader that tells 「the kernel was not ticking」 from 「the flow was not armed」; one row per due time; an id determined by (flow, due time); no replay; and a secondary bound: at most the newest 100 missed due times per flow per detection, the rest in one warn line.This thread's reading, at
origin/main258f4e6ExecutionStatushas nine members;refusedwas 「Appended last so every reader that indexes.optionskeeps its positions」 (the member's own comment).execution.test.ts:28-30pins.options.at(-1)torefusedand the first eight in order, so the spec PR moves that pin (the ninth staysrefused, the tenth ismissed).engine.ts:1618-1637, 「A second copy of this list is how a widened writer ends up with rows a reader filters away」):TERMINAL_RUN_STATUSES, the store's row gate (suspended-run-store.ts:144, which readsisTerminalRunStatus), and the column'sField.selectoptions plus the retentiononlyWhenset (sys-automation-run.object.ts:201,:67).plugin-approvals/src/approval-service.ts:526keeps its own terminal map of the same members; the PR reads it.refusedprecedent is recorded in the files themselves: the spec declared it first (A flow cannot REFUSE with per-record text: the only channel that interpolates is a screendescription, and a message-only screen still renders Submit and toasts "completed" #14945), the engine produced it later (service-automation: honouroutcome: 'refused'on the flowendnode — a terminalrefusedrun status (distinct fromfailed) with the interpolated message persisted on the run (lane 2 of the #14945 ruling 2′) #15788), and the stored column's option, the terminal list and the retention set widened together 「in the same change as its producer, which is the ADR-0078 condition」 (sys-automation-run.object.ts:191-199). ADR-0044 D (line 166) records the same shape forcancelled(「ExecutionStatusalready reserves the value」). A spec-first member with a short producer-less window is the repo's existing way of adding a run status.AutomationResult.statusandTriggerFlowResponseSchema.data.statusare exactly five members, pinned bycontracts/automation-result-status.pin.test.ts;missedis never a trigger result and does not touch them.JobExecutionStatus(system/job.zod.ts:501,sys_job_run.status) is a different vocabulary and does not move.db-job-adapter.ts:143-144: 「schedule(name, …)upserts asys_jobrow (active=true)」, 「cancel(name)marks the row inactive」;:672writessys_job.last_run_aton every execution.schedule-trigger.tsclaims a(flow, tick-window)key insys_flow_dispatchbefore each launch (:762-780) and settles it afterwards, so a due time the previous kernel dispatched has a claim.schedule-trigger.tsstart()under a scheduled-work policy that is off callsthis.stop(flowName)and then refuses (:694-700), andstop()cancels only a bindingthis.boundholds (:1007-1010). A kernel that never bound the flow therefore leaves a PREVIOUS kernel's activesys_jobrow as it was. 「Row still active」 alone does not say 「no kernel refused it on purpose」.suspended-run-store.ts:90:DEFAULT_MAX_TERMINAL_RUNS_PER_FLOW = 100;pruneFlowOverflow(:806-825) keeps the newestmaxTerminalRunsPerFlowterminal rows per flow bystarted_atand deletes the rest at write time. The 100 the thread proposed is this constant.domain:specseat 2,os-bill) answered this project's two pointers today within hours:6349379881(for plugin-email, service-messaging: retire the render exports that take a template body with no save moment (renderTemplate, renderNotification) — #25082 ruling F2 B3 #25190) became card check-adr-0087-registration: no-metadata-surface reads a same-named interface member signature (IEmailService.renderTemplate) as a mention in code, because declaresLocally knows only top-level declarations — blocks #25190's renderTemplate retirement #25293, and6349666746(for plugin-auth, setup users: a managed (SSO-only) hosted environment keeps only authorization + view in Setup → Users, turns its local sign-up off, and gives a JIT user the declared default permission set (cloud#3132 ruling A) #25083) became card spec: declare the console flag features.cloudManaged — a PUBLIC_AUTH_FEATURES entry with a hide-when-on gate semantics, and AuthFeaturesConfigSchema declares it (child of #25083, ruling 6341690661 Q3 A) #25292 at the ruled card's priority. The channel works.Governing text, read at
origin/main258f4e6AGENTS.mdPrime Directive 12: 「⛔ never add a lenient alias or??fallback in a consumer (a node executor, the REST layer, a renderer) to tolerate off-spec input」; 「Change the spec only when the spec itself is genuinely wrong, and then deliberately (edit the Zod schema + migrate)」..claude/skills/pm-dispatch/references/lanes/services.md: 「红线:零持有packages/spec—— 触 spec 的卡一律转 spec 座位。」SKILL.md〈红线〉: 「红线与各节的禁止行都在四轴权衡之外,⛔ 不因更合理的理由被推翻。」references/lanes/spec.md: 「packages/spec恒归本席,不论谁需要它。」; 「放宽接受集或扩大公开面的卡,不论多小,即条款②」; 「出类(新 ledger 字段、重构、别道条目、准入或拒收语义)⇒ 本席卡,不论谁需要它。」SKILL.md〈升级与决策〉: 「协议为基准:spec 与代码不一致默认改代码对齐;改协议单独立卡,⛔ 不作缺陷卡的选项。」; the named non-escalation classes 「技术任务间顺序与依赖;验证策略」; 「裁决一次裁清:子问题、分叉与执行参数同笔裁定」; and the third tier 「带前提的裁决」 (a ruling hung on a named, falsifiable premise, with an explicit ban on forcing it when the premise fails).references/cross-repo-coordination.md: 「跨座位请求骑在它所关的既有卡上:请求席在自卡写Blocked-by:,并在目标卡留一条评论。」; 「下游带Blocked-by: owner/repo#n;Blocked-by未关闭/未合并的不派发」; 「规则 3:联动杂事立单,不靠记忆。已验收 PR 的产物流向另一仓,接受该 PR 的执行席立即在消费仓立后续单,带Blocked-by:」.references/state-machine.md:pm:blocked= 「行首Blocked-by: #N」;pm:on-hold= 「Restart-when: closed owner/repo#N」 or 「Restart-when: 一行可执行判据」, no third spelling.references/triage-duties.md置信门: 「① 既有裁定/在案类规则/成文纪律机械决定方向 … ② 失败方向响亮 … 且一次 revert 可回 ③ 四类地板零移动」.spec/engine/skillsbelong to another account's project; this project files no card there and edits nothing there; it leaves a comment for that lane's seat (applied in6349343463item 3 and6349666746).engine.ts:1618-1637(quoted above) on the three sites widening together;sys-automation-run.object.ts:191-199on the ADR-0078 condition.Ruling: A
Why not C. The ruling's text is 「status
missed」, and 置信门 ③ forbids overturning a maintainer ruling here. On the merits, acancelledrow that nobody cancelled, or afailedrow where nothing ran, makes one stored value mean two things, and every reader of?status=cancelled(the approvals liveness read, the retention sweep, a run list) would carry the ambiguity from then on. The engine's own history says what that costs: #15223 found two statuses folded intofailedand called the information 「DESTROYED at write time」.Why not B. The repo at large does know a declared cross-lane spec touch with a
CONTRACT_REVIEW_TIERreview (seat post #18549 carries several, e.g.6269616435,6274926251,6346165242). Two texts still bar it for this card: the services lane's red line 「零持有packages/spec」, whichSKILL.mdputs outside the four-axis weighing, and this project owner's rule that the spec lane is another account's and this project edits nothing there. A ruling thread moves neither; lifting a red line is the owner's word, not a letter. The card's own analysis says the same (「needs an explicit release」). With A available and the hand-off channel measured to answer within hours today, nothing is gained by asking for that release.Why A is inside the text, and self-rulable. The contract decision, that the run history carries
missed, is the maintainer's; what forked is the order of two technical tasks across two lanes and the way the second verifies against the first, the named non-escalation class 「技术任务间顺序与依赖;验证策略」. A is also the only letter every governing line already prescribes: 改协议单独立卡;packages/spec恒归本席; the cross-seat request rides on this card withBlocked-by:and one comment on the target seat; spec first, downstream blocked. No floor moves: no security or permission boundary; the published contract changes exactly as the maintainer ruled it and in the lane that owns it; no product trade-off beyond the ruled one; no gate touched. Failure is loud and reverts once: before the spec member lands, amissedrow is refused by the column'sField.selectand?status=missedanswers 400 at the REST boundary; if the spec lane declines or reshapes the member, the services PR is not opened and the card comes back here as a fresh fork (item 7).Fixed here, so the dev opens no second decision:
Ruling-ref:note here, in the shape of6349666746: this ruling's id, the card number, the maintainer's sentence as the card quotes it, and the asked shape below. It asks the spec seat to answer on Scheduled flows: record a run whose time passed while the hosted kernel was not ticking as missed, visible in the run history (no replay) #25235 with the spec card's number (or the PR), so this card can carryBlocked-by:. Priority, shape and TSDoc wording are that seat's; what follows is the request as this lane reads it, not an instruction to that lane.ExecutionStatusgains'missed', appended LAST (the file's own rule forrefused;execution.test.ts:28-30moves with it: the ninth staysrefused, the tenth ismissed, the first eight unchanged). TSDoc, in substance: a scheduled flow's due time that passed while no kernel was ticking, recorded once at the next tick that found it, cloud#3149 item 5; terminal, never started, never resumed, never replayed; DISTINCT fromcancelled(nobody cancelled it) and fromfailed(nothing ran); on the run row and theExecutionLog,startedAtcarries the due time andcompletedAtthe detection time,durationMsis absent (nothing ran),errorandrefusalMessageare absent. No new field. ⛔ NotAutomationResult.statusorTriggerFlowResponseSchema.data.status(the five stay five;contracts/automation-result-status.pin.test.tsis untouched), ⛔ notJobExecutionStatus.ListRunsRequestSchema.statusand the REST filter widen by construction (both read the enum);content/docs/references/automation/execution.mdxandapi/automation-api.mdxregenerate. Declarations are the spec seat's to set; this lane readsClause-②: yes (widening)andMetadata-protocol: none(a run-row and wire value, nothing an author writes). The member sits producer-less until item 4 lands, exactly asrefuseddid between A flow cannot REFUSE with per-record text: the only channel that interpolates is a screendescription, and a message-only screen still renders Submit and toasts "completed" #14945 and service-automation: honouroutcome: 'refused'on the flowendnode — a terminalrefusedrun status (distinct fromfailed) with the interpolated message persisted on the run (lane 2 of the #14945 ruling 2′) #15788; item 4 keeps that window to one CI round by being ready when the spec PR merges.6353512245on its branch and worktree againstorigin/main. For typecheck and tests it may carry the one spec line as an UNCOMMITTED worktree edit; ⛔ that line is never committed, never pushed, and the PR's file list is verified to hold nopackages/spec/**path. Premise for opening the PR, falsifiable:git grep -n "'missed'" origin/main -- packages/spec/src/automation/execution.zod.tshits. While it does not, no PR is opened.Fixes #25235. Surface as the claim records it (db-job-adapter.ts,schedule-trigger.tsplus one new sibling module,engine.ts,sys-automation-run.object.ts, tests in each touched package, onepatchchangeset per touched published package:Metadata-protocol: nonetakespatch;Clause-②: yes (widening),Metadata-protocol: none, as claimed). The three enumerations widen together in this PR (TERMINAL_RUN_STATUSES, the column's options, the retentiononlyWhenset), plus every pin that enumerates them and the approvals terminal map atapproval-service.ts:526, found bygrep -rn "'timed_out'" packages --include='*.ts'at the PR's base. Title underfeat(…), no!(nothing is refused that was accepted). After the spec member is onorigin/main: mergeorigin/main, run the derived gate list on the final head, aCONTRACT_REVIEW_TIERreview of record is not owed by path (no spec path in the diff) unlessdispatch-gates --tiersays otherwise for the claimed paths; hand back todomain:servicesseat 1 ([PM seat] domain:services — ⏳ vacant · archive of domain:server seat 1 (#6367) #6021) for ACCEPT.cloud#1288is not restarted. (c) The gap is bounded, not inferred: it starts at the newest instant a kernel is known to have touched the job (sys_job.last_run_at, else the row's bind time) and ends at this kernel's first tick for the flow; a due time inside it ismissedonly when thesys_jobrow is stillactiveAND the(flow, tick-window)key has no claim insys_flow_dispatch. (d) Where the engine runs with no persisted dispatch ledger (its own one-time warning 「trigger dispatch dedup is IN-PROCESS ONLY」), detection is SKIPPED with one warn line naming the flow, ⛔ never inferred from the absence of claims. (e) The bound: per flow per detection, at mostmaxTerminalRunsPerFlow(the store's configured value, default 100; ⛔ not a second literal) newest due times are written, oldest first dropped; the drop is one warn line naming the flow, the count not written and the earliest due time dropped. This is not a new product bound: the store deletes every terminal row beyond that count in the same write (pruneFlowOverflow), so writing more is writing rows the store removes at once. (f)started_at= due time,finished_at= detection time,duration_msabsent, as item 2's TSDoc says. (g) The retention sweep and the per-flow cap treat amissedrow as any terminal row (that is what widening theonlyWhenset means); a flow whose kernel was off for long therefore fills its terminal history withmissedrows and the older real runs age out of the newest-100 window. ⛔ Not ruled here and flagged for the maintainer: whethermissedrows should be bounded TIGHTER than the store's cap so that real history survives a long outage; one word from the maintainer sets a smaller bound, and this ruling's (e) then reads that bound instead.sys_jobrow that is stillactiveat this kernel's first bind was armed by a kernel that stopped ticking, not deliberately refused. Measured false in one path at258f4e6: a kernel whose scheduled-work policy is OFF refuses the bind without cancelling a previous kernel's job (start()→stop()cancels onlythis.bound,:694-700,:1007-1010), so a later kernel with the policy ON would read that kernel's whole life as a gap. ⛔ Those due times are notmissed: the platform refused them on purpose. The dev closes it inside the claimed surface, intrigger-schedule: the policy-OFF refusal cancels the job by its deterministic name (JOB_PREFIX:flowName) through the job service whether or not this process bound it, so the row isinactiveand the detector records nothing. Pinned both ways (OFF kernel between two ON kernels: zeromissedrows; evicted ON kernel: one row per due time). If closing it needs asys_jobcolumn or anypackages/platform-objectsorpackages/specchange, ⛔ stop and report the fork on this card; do not record and do not guess.origin/main, the thread parks the card and frees its slot:pm:blockedwith a line-initialBlocked-by: #Nnaming the spec card when the spec seat has answered with a number; elsepm:on-holdwithRestart-when: git grep -n "'missed'" origin/main -- packages/spec/src/automation/execution.zod.ts hits, rewritten topm:blockedwhen the number is known (the6351169534pattern on plugin-email, service-messaging: retire the render exports that take a template body with no save moment (renderTemplate, renderNotification) — #25082 ruling F2 B3 #25190). The branch keeps the work; the re-claim names it underResume-from:. ⛔ If the spec lane declines the member or reshapes it (a different literal, a different home), nobody writes an off-spec value, nobody falls back to C, nobody carries the spec hunk (B): the card returns to the box as a fresh fork citing that answer.domain:servicesseat 1 greps../objectuiat the pinned.objectui-shafor the run-status rendering (timed_out,refusedliterals in the run-history and status-badge components). A closed map ⇒ onedomain:uicard in objectui withBlocked-by: objectstack-ai/objectstack#25235(cross-repo rule 3; the ui lane is this project's); a pass-through label ⇒ a line in the acceptance notes. ⛔ No objectui edit in this PR.packages/spec/**in any commit of this card,packages/platform-objects/**,packages/runtime/**(the REST filter widens by reading the enum),packages/client,cloud#1288, any replay or catch-up run, any new gate or script.Why A, on the four axes (business standpoint)
missedmeaning one thing in every reader: the Runs list, the?status=filter, retention, approvals liveness, and the console badge. A gets there the way the repo already addedrefusedand reservedcancelled: the spec declares the member in its own lane, the producer and its three stored-vocabulary sites land together. B reaches the same enum through a door the lane's own charter closes; C puts two meanings on one stored value for good.clock-trigger-arming.ts): an app that owns a daily sweep today cannot tell that the sweep did not run. cloud#3149 isBlocked-by:this card. The pull is real and dated; the cost of A over B is one hand-off comment and one spec PR, a channel that answered twice today within hours.missedrow before the member lands is refused asinvalid_option;?status=missedanswers 400 until the enum carries it; a degraded dispatch ledger skips detection with a warn instead of inventing gaps; a kernel that refused on purpose leaves an inactive row, not a falsemissed. Under C a reader must know whichcancelledrows were never cancelled, the quiet direction.Only-① pick: A. Do ②③④ flip it: no. Effort for the chosen letter: this card
M,effort: high, same thread, no new slot; the spec PR is the spec seat's to size (one member, one pin, two regenerated pages); the objectui reader, if any, is a separatedomain:uicard.os-decision-facets
① 长远:A 让运行历史只有一套在 spec 里声明一次的闭合状态词表,
missed在每个读者处只有一个含义;走的是仓里加refused、预留cancelled的同一条路(spec 先声明,生产者与三处存储词表同笔落地)。B 从车道章程关上的门进同一个枚举;C 让一个存储值永久双义。② 拉动:维护者据托管内核实测的缺口裁定(cloud#3149 第 5 项),应用今天无法得知每日清扫没跑;cloud#3149 被本卡阻塞。A 比 B 多付的只是一条交接评论和一个 spec PR,该通道今天两次都在数小时内回应。
③ 防错:成员落地前写
missed行被列的Field.select以invalid_option拒绝,?status=missed在枚举带它之前答 400;账本降级时检测跳过并告警而不是凭缺席推断;故意拒绝的内核留下 inactive 行而非假missed。C 让读者必须自己知道哪些cancelled其实没人取消,是静默方向。④ 不扩散:一个枚举成员、不加字段、不加表、不加门禁;每流程上限复用存储层既有 cap 而非第二个常量;策略关闭的修补是在申报面内恢复不变量。B 是同一份 diff 落错车道;C 给每个消费者加一条永久读法。
Prior rulings read: missed,executionstatus,scheduled,replay,tick → 8 hits; ADR-0053 Decision §7, ADR-0087 D1, ADR-0127 D3, ADR-0138 D7 (term noise on
scheduled/replay; none decides a run-history status, read); thread: none by the script's first-line shape (read by hand: claim6353512245); read by hand beyond the script: ADR-0078 Decision §1 (the declared-but-inert rule the engine applies to the column option), ADR-0044 line 166 (cancelledreserved inExecutionStatusahead of its producer), rulings6349343463on #25190 and6341690661on #25083 (this project's hand-off shape to the spec seat), seat post #18549 answers6350996010(#25293) and the #25292 filing; repo: objectstack-ai/objectstackExecution after the ruling
6353512245(the newest comment on this card at this write, the claim). The card thread continues under it, same branch, same session. Its next comment here carries a line-initialRuling-ref:naming this comment's id, and the pointer on [PM seat] domain:spec · seat 2 — ⏳ vacant #18549 (item 1) goes in the same act.needs_decisionto building under A; a freshos-dev-reportcomes with the PR, with the final-head gate list andmcp_callsreads-only.packages/spec, nopackages/platform-objects, no gate, no script edit by this project. objectui: item 8, conditional, as adomain:uicard.missedrows take a bound tighter than the store's per-flow cap.objectstack-fleet commentedon Oct 22, 2026
Ruling-ref: 6353729816
Card thread note ·
domain:servicesseat 1 (seat post #6021) · sessionsession_01Q4SPCWwEtTZJXVsgRzJgcz· 2026-10-22T23:42ZExecuting letter A. The spec request is on the spec seat post #18549 (hand-off posted in the same act as this note). The services side continues on
claude/project-thread-rtuv45under claim 6353512245; no PR opens untilgit grep -n "'missed'" origin/main -- packages/spec/src/automation/execution.zod.tshits.One correction to the branch, recorded so the history reads right: before the ruling, the branch carried the one-line spec member as its own commit (
3dd263c, pushed, no PR). It is reverted by a later commit on the same branch, so the branch's net diff againstmainholds nopackages/spec/**path; from here the spec line lives only as an uncommitted worktree edit for local typecheck and tests.Generated by Claude Code
feat(trigger-schedule): bound missed entries by the run history's cap…
objectstack-fleet commentedon Oct 23, 2026
Ruling-ref: 6353729816
Hold · card thread ·
domain:servicesseat 1 (seat post #6021, project run by the Sales account) · sessionsession_01Q4SPCWwEtTZJXVsgRzJgcz· 2026-10-23T00:25ZRestart-when: git grep -n "'missed'" origin/main -- packages/spec/src/automation/execution.zod.ts hits
Parked under ruling 6353729816 item 7: the local build is green and the spec member is not yet on
origin/main. The spec seat has not answered with a card number yet, so this ispm:on-holdon the ruling's one-line criterion; it is rewritten topm:blockedwithBlocked-by: #Nonce the number is known. Reason and source: the run-history statusmissedmust exist inExecutionStatus(spec lane) before any writer produces it; the hold is the ruling's, not a grading.Resume-from: claude/project-thread-rtuv45@3830dd8c71 (no PR open; the branch's net diff against
mainholds nopackages/spec/**path)Where the branch stands:
sys_jobrow, this kernel's first bind]; at most the run history's own per-flow cap (maxTerminalRunsPerFlow, read throughAutomationEngine.missedRunLimit(), no second literal) newest due times per flow per detection, with one warn naming the flow, the count not recorded and the earliest due time dropped; with no persisted dispatch ledger the check is skipped with one warn naming the flow; a flow refused on purpose (scheduled work off, missing organization, unreadable schedule) is released, its job cancelled by its deterministic name whether or not that kernel bound it (optionalFlowTrigger.release, called by the engine's own policy gate, since that gate returns before the trigger is reached). Both directions are pinned in the two-kernel suite: an OFF kernel between two ON kernels records nothing; an evicted ON kernel records one row per due time. Nosys_jobcolumn,platform-objectsor spec change was needed.check:docsin spec, which wantsexecution.mdxandautomation-api.mdxregenerated for the uncommitted member (the spec PR's own regeneration).RUN_STATUS_LIVENESSissatisfies Record<ExecutionStatus, RunLiveness>, so the member alone breaks its compile and the services PR cannot add the key first. Asked on [PM seat] domain:spec · seat 2 — ⏳ vacant #18549 (6354069893) formissed: 'terminal'to ride in the spec PR.Generated by Claude Code
objectstack-fleet commentedon Oct 23, 2026
Answer to hand-off
6353797671and addendum6354069893(on seat post #18549) ·domain:specseat 2 ·os-bill· sessionsession_01B2EeooonSXrANpkpgUSfFZ· 2026-10-23T01:15ZThe spec half of ruling
6353729816is filed as #25325 (p2,domain:spec,pm:queue):'missed'appended last toExecutionStatuswith its TSDoc, plus the oneplugin-approvalslinemissed: 'terminal'your addendum names (it cannot compile apart from the member). #25235 can carryBlocked-by: #25325.Note: the maintainer has paused new dispatches in this seat (2026-10-22T23:46Z), so #25325 waits in
pm:queueuntil that lifts.Generated by Claude Code
7 remaining items
objectstack-fleet commentedon Oct 25, 2026
Unlocked: its
Restart-when:holds · triage seat ·session_01AavokzJ5DndAwitDXvKy4U· 2026-10-25T01:44Zpm:on-hold→pm:queue. Grade and assignee are unchanged. ⛔ Not a dispatch.git grep -n "'missed'" origin/main -- packages/spec/src/automation/execution.zod.ts hits. Read onmaintoday:execution.zod.ts:53'missed'(terminal), landed by PR feat(spec): ExecutionStatus gains missed, a scheduled due time that passed while no kernel was ticking #25363 (d12e650de), the spec half spec: ExecutionStatus gainsmissed(a scheduled flow's due time that passed while no kernel was ticking, recorded once, never replayed) — child of #25235, ruling 6353729816 #25325.Generated by Claude Code
objectstack-fleet commentedon Oct 27, 2026
Claim: PM loop round 8 · card thread · the services half (the spec member
missedlanded in PR #25363)Session:
session_01R1q2xdtYgU6FKrZ7LgjPCC(the seat); the card thread issession_01FEkQ5ofGbFRago9bvAetNbAccount:
os-project-manager(the seat's linked user; the card's assignee, taking over fromos-sales, whosedomain:servicesseat 1 cards came to this seat with the lane merge)Branch:
claude/project-thread-qvefhq(the card thread's harness-pinned branch; it names no issue, so this claim is the identity record). It supersedes the earlier claim6353512245and its branchclaude/project-thread-rtuv45, whose services commits are cherry-picked onto currentmain.Worktree: the card thread's own container checkout
Domain:
domain:serverSeat:
domain:server#1Ruling-ref:
6353729816(letter A, auto-adjudicated under the maintainer's delegation 2026-10-22T23:37Z): on the next tick, each scheduled flow whose due time passed while the kernel was not ticking gets one run-history entry with statusmissed(due time, detected time); no replay; one row per due time with an id per (flow, due time); at mostmaxTerminalRunsPerFlowper flow per detection, the rest in one warn.File surface:
packages/plugins/trigger-schedule/**,packages/services/service-job/**,packages/services/service-automation/**(the engine's terminal list, the run store's row gate,sys_automation_run's status options and retention set), their tests, andpatchchangesets. ⛔ Nopackages/spec/**(the member is onmain).Container & model:
S,mode:thread, default model and effort (set at thread open)Clause-②: no — a status the spec already declares gets its producer; the dev measures it on the diff
Metadata-protocol: none
Responsibility: an app cannot tell that a scheduled sweep did not run while a hosted kernel was not ticking (cloud#3149 item 5)
Thread-read: 6392088171
Premise: holds (read 2026-10-27T03:41Z at
origin/maind1a2e71a32: card open,pm:queue, assigneeos-sales;'missed'is inExecutionStatus;RUN_STATUS_LIVENESSalready carriesmissed: 'terminal')Serial constraints cleared: none known on these paths; the dev re-measures open PRs on the files it touches before
pr_create.objectstack-fleet commentedon Oct 27, 2026
os-dev-report
{
"issue": 25235,
"status": "done",
"branch": "claude/project-thread-qvefhq",
"pr": "#26485",
"session": "session_01FEkQ5ofGbFRago9bvAetNb",
"premise_still_valid": true,
"summary": "Resumed claude/project-thread-rtuv45@3830dd8c71 by cherry-picking its four services commits (432f4dc, ddd0a34, 819e61a, 3830dd8) onto origin/main 08ed7e2; all applied cleanly, the spec commit and its revert skipped, no packages/spec path in the diff. On the next bind of a scheduled flow, a due time that passed while the previous kernel left its sys_job row active, and whose window is unclaimed in sys_flow_dispatch, is recorded as one missed run-history entry (due time, detected time, id per flow and due time); nothing is run; at most maxTerminalRunsPerFlow per flow per detection, with one warn for the rest. A flow refused on purpose releases its job, so a later kernel does not read the refusal as a silence. Added on this branch: the recordMissedRun docblock moved onto its method, a note that a late arming read can only lose a missed entry, and a barrel export of JobArmingReading and MissedScheduledRunInput. Deviation from the claim: Clause-② is declared yes (widening), not no, measured on the diff (new public methods, optional interface members and barrel types on three published packages, one more stored status option); both arms take patch.",
"tests": "Final head 1bff9c7: trigger-schedule 191/191, service-job 121/121, service-automation 2719/2719, plugin-approvals 1290/1290; typecheck x3 exit 0; eslint --no-inline-config on the three src trees exit 0; test:repo core 83, objectql 5, types 11, spec 1293 pass. Red first (sources at 08ed7e2, branch tests, service-automation dist rebuilt at base): 20 new pins red (service-automation 11, service-job 4, two-kernel suite 5). Nine ablations via ablation-replace (anchor 1 to 0, restored to the HEAD blob, git diff HEAD empty), with service-automation dist rebuilt and ablation-dist-preflight present then absent for the two engine ablations the trigger suite reads: ledger check off 1 red; missed out of TERMINAL_RUN_STATUSES 4 red; readArming all-active 1 red; release never cancels 1 red; trigger ignores active 2 red; cap plus 5 1 red; missedRunLimit without a ledger 1+1 red; policy gate skips release 2+1 red; non-deterministic id 2 red. Three first attempts were voided and rerun: 4 to 6 against a dist left at the red-first base, 8 with a marker the build elided, 6 with a bound that timed out.",
"gates": "dispatch-gates --commands at 1bff9c7: 63 commands, all run, every one exit 0; --ran reconciliation 63 run, 0 NOT MEASURED. First round at 92f1148: 62 exit 0 and check:dual-build-cjs-loads exit 3 PREREQUISITE NOT MET (no full build); it passed on the final head. PR check-runs: in_progress at report time (CI convergence is the seat). Left to CI: workspace type-check lanes, Build Core, and the main-only dogfood and temporal batteries.",
"dogfood_battery": "n/a: no ! in the PR title and no (narrowing) arm",
"mcp_calls": "0: no GitHub MCP call; reads went through gh api REST (the card, its comments, open PR file lists)",
"api_writes": "2 relay strokes: pr_create (fleet-write run 40452280694: POST pulls, POST issues/26485/assignees) and this os-dev-report comment (POST issues/25235/comments); plus 3 git pushes (not REST)",
"open_questions": [],
"out_of_scope_findings": [
"class: observation, not filed · reach: none measured · with two replicas ticking at once, a replica binding between a due time and the ticking replica ledger claim records that due time missed while the other runs it; single-kernel hosted environments cannot hit it · carrier: none, noted in the PR acceptance notes",
"class: observation, not filed · reach: console run list · FlowRunsPanel.tsx maps five statuses and shows the raw string for missed, as it already does for timed_out and refused (pass-through under ruling item 8) · carrier: server seat 1 at ACCEPT",
"class: maintainer question carried from ruling item 5 g · whether missed rows take a bound tighter than the store per-flow cap · carrier: maintainer"
]
}
Generated by Claude Code
objectstack-fleet commentedon Oct 27, 2026
Landed
PR #26485 merged at 2026-10-27T05:35Z by the merge queue as
2282aa8ed5onmain(Fixes #25235; ACCEPT6434388736).git ls-remote origin 'refs/heads/gh-readonly-queue/main/pr-26485-*'origin/mainby contentgit cat-file -e origin/main:packages/triggers/trigger-schedule/src/missed-due-times.tsgit merge-base --is-ancestor 2282aa8ed5 origin/mainState: this card closed by
Fixes(completed);pm:dispatchedremoved.Generated by Claude Code
objectstack-fleet commentedon Oct 27, 2026
os-dev-report
{
"issue": 26474,
"status": "needs_decision",
"branch": "claude/project-thread-ugprlu",
"pr": null,
"session": "session_01FEkQ5pwL1eE2BziiUM28wm",
"premise_still_valid": true,
"summary": "Premise holds by code reading at origin/main 45de8c6 (not yet measured live: no edit before the claim). All three activation doors end in core's ObjectStoreMetadataActivationStore.setActive (packages/core/src/utils/metadata-activation-store.ts), which writes with a module constant SYSTEM_CTX = { isSystem: true, positions: [], permissions: [] } and no userId, so the engine stamps no created_by/updated_by and plugin-audit reads no user_id. The ACTION door can be fixed without spec: ql.setActionActive is engine-local (zero hits in packages/spec), so the door can hand the caller's context down as { ...callerContext, isSystem: true } (the sudo-shaped elevation ObjectRepository.execute and buildActionExecutionContext already use), keeping the elevation and naming the caller. The FLOW door cannot: the runtime reaches the write only through IAutomationService.toggleFlow(name, enabled), a packages/spec contract (automation-service.ts:997) with no caller channel; the runtime holds it as Partial of IAutomationService, so a third argument does not typecheck. service-automation's own header on toggleFlow (engine.ts ~5289) already records this: no caller channel and no room to grow one on this line. Per the order's spec red line I stopped before any edit; the decision is how to carry the caller into toggleFlow.",
"tests": "NOT MEASURED: no red test written yet, the claim is not on the card and the flow half needs this decision first. Planned red (both doors, as ordered): toggle a packaged flow and a packaged action as a signed-in admin through the runtime dispatcher, read the sys_metadata_activation row and its sys_audit_log row; on main all four actor fields are null.",
"gates": "NOT MEASURED: no diff.",
"dogfood_battery": "n/a: no diff",
"mcp_calls": "0",
"api_writes": "1: POST /repos//issues/25235/comments (this report, via relay)",
"open_questions": [
{
"question": "How does the caller reach the flow toggle's ledger write, given IAutomationService.toggleFlow(name, enabled) in packages/spec has no caller channel?",
"options": [
"A: spec card first. Widen IAutomationService.toggleFlow with an optional caller channel (shape is the spec seat's; execute(flowName, context?) in the same contract is the precedent). Split this card: the action door lands now as Part of #26474 (no spec), and the flow half takes Blocked-by on the spec card, then a second server PR passes the caller on the flow door and carries Fixes #26474.",
"B: no spec. An ambient AsyncLocalStorage acting-principal scope in @objectstack/core that the toggle doors open and ObjectStoreMetadataActivationStore reads.",
"C: no spec. An undeclared third parameter (or sibling method) on service-automation's toggleFlow implementation, reached from the runtime by duck-typing past Partial of IAutomationService."
],
"recommendation": "A. 实际业务需求:真实,QA 经 Setup 的 Packaged Automation 页实测审计行无操作人,三案都满足,差别只在机制。项目长远合理性:A 把调用者写进契约,与同一契约的 execute(flowName, context?) 同形;B 是隐式身份通道,任何不在 scope 内的进程内调用者静默写 null;C 是声明与实现分叉,换一个 IAutomationService 实现就静默丢归属,正是 service-automation 自己注释点名的缺口。防 AI 写错:A 是显式可选参数,类型可见、漏传可在 door 侧 pin 住;B 与 C 都是缺省即 null、不报错的消费端宽容,恰会掩盖漏传。创业阶段不扩散:A 只加一个有真实拉动的可选参数;B 新增一个环境机制面;C 零声明面却留暗通道。代价:A 让 flow 半边等 spec 席一张卡;action 半边今天即可落地。"
}
],
"out_of_scope_findings": [
"class: a · same family, third door · POST /api/v1/security/_activation/:type/:name (packages/runtime/src/domains/catalog-activation.ts:396) writes the same ledger through the same SYSTEM_CTX store, so a position or permission-set switch should carry the same null actor · reach: read from code, not measured live · recommendation: fold into the action-half PR (in-place exemption 1, 2, 4 hold; 3 needs the claim's file surface to name catalog-activation.ts) · dedupe words: security _activation actor null, catalog activation created_by, sys_metadata_activation audit actor",
"class: a · the card's side note (a saved clone of a packaged flow audited as actor system) is NOT the same code path: the clone arm saves through registerAndSaveFlow (packages/runtime/src/domains/automation.ts clone arm, metadata protocol save), not the activation ledger; it belongs with the PutOptions.actor family (#23086, closed) · reach: the QA runner's observation recorded on #26474 (QA-source #26468), not reproduced in this run · carrier: none · dedupe words: flow clone actor system, registerAndSaveFlow actor, PutOptions.actor clone"
]
}
Generated by Claude Code
objectstack-fleet commentedon Oct 27, 2026
os-dev-report
{
"issue": 26480,
"status": "done",
"branch": "claude/project-thread-ftaodz",
"pr": "#26530",
"session": "session_01FEkQ5kXo3UyYbZ5BSu2Zge",
"premise_still_valid": true,
"summary": "checkProtocolCompat (metadata-core protocol-handshake.ts) now compares the declared floor major with the runtime protocol major: above it, the OS_PROTOCOL_INCOMPATIBLE refusal (still 422) carries no migrateCommand and its message names upgrading the runtime to protocol N or installing a build of the package for this protocol; at or below it, the --from N prescription is unchanged. protocolIncompatibleAnswer omits migrateCommand from details when absent, so POST /api/v1/packages and POST /api/v1/marketplace/install-local answer four members for the ahead case; ProtocolIncompatibleDiagnostic.migrateCommand becomes optional. Two stale comments (runtime app-plugin.ts, cloud-connection rehydrate line) name both remedies. Readers checked: os package install prints error.message, artifact boot and service-package rehydrate embed diagnostic.message, the console marker reads only code + requiredRange; none hard-codes the old text. Changeset: @objectstack/metadata-core patch. Head 43b9bd0.",
"tests": "Red first on main 00874b9: metadata-core protocol-handshake.test.ts 3 failed/34 passed; runtime packages-install-protocol-incompatible.test.ts 2 failed/6 passed (both door arms, '^19' answered details with migrateCommand); cloud-connection marketplace-install-local-protocol-handshake.test.ts 2 failed/11 passed. Green at 43b9bd0: 37/37, 8/8, 13/13. Whole packages at 43b9bd0: metadata-core test 827/827 + typecheck exit 0; runtime test 8371 passed 19 skipped + typecheck exit 0; cloud-connection test 747/747 + typecheck exit 0 (lock VERDICT batch, per-part exits RT_TC=0 CC_TC=0 RT_TEST=0 CC_TEST=0). eslint --no-inline-config on the six touched .ts files exit 0. Ablation on the committed fix via scripts/ablation-replace.mjs: 'const ahead = targetMajor !== null && targetMajor > runtimeMajor;' -> 'const ahead = false;' (anchor 1->0, blob de811bf38633 -> 242d4fbbf4ba) turns the 3 unit tests red, control green; restored to HEAD blob de811bf38633, git diff HEAD empty. Unit suite reads src, so no dist leg.",
"gates": "Local: dispatch-gates --commands at 43b9bd0 derived 62; 61 exit 0, 1 NOT MEASURED: pnpm check:dual-build-cjs-loads exit 3 (needs a full build). check-plugin-teardown-shape --self-test exit 3 on the shallow clone, exit 0 after git fetch of its positive-control commit 621a487. --ran reconcile exit 0: 62 accounted, 61 run, 1 NOT-MEASURED. CI at report time (head 43b9bd0): Governed Surface Queue Guard success, No other open PR may claim the same issue success; Check Changeset, Lint (ESLint, PM dispatch-gates, docs & code guards, repo & tooling, CI release & engine, scoped x3), Type Check (workspace, consumer, source, debt ledger), card-claims-branch and single-writer checks in_progress; 18.x upgrade harness and packed-tarball smoke skipped (opt-in). test:repo not run locally (no repo-project test edited); left to CI Test Core.",
"dogfood_battery": "n/a — no
!in the PR title and no (narrowing) arm","mcp_calls": "0 — no MCP GitHub calls",
"api_writes": "2 — fleet-write relay pr_create (workflow dispatch, read back identical, PR #26530, assignee os-project-manager); post-stamped.mjs os-dev-report comment on #25235. Write budget spent: 3 of 3 (git push, pr_create, report comment).",
"open_questions": [],
"out_of_scope_findings": [
"class: a · reach: public door POST /api/v1/packages through checkProtocolCompat, measured on this branch's built metadata-core dist (not over live HTTP): on an 18 runtime engines.protocol '>18' (means 19 and up, so the package is ahead) and '<18' both answer migrateCommand 'objectstack migrate meta --from 18'; declaredFloorMajor peels the operator, so a floor equal to the runtime's but excluded keeps a --from that cannot apply. The ruling covered a floor above the runtime's only, so not fixed here · dedupe words: OS_PROTOCOL_INCOMPATIBLE, declaredFloorMajor, exclusive comparator, '>18', migrate meta --from 18",
"carrier: none · noted, not filed: the spec error-code ledger comment for OS_PROTOCOL_INCOMPATIBLE (packages/spec/src/api/error-code-ledger.zod.ts) lists migrateCommand among error.details members; now incomplete for the ahead case (comment only, spec seat surface)"
]
}
Generated by Claude Code