automation toggle door: switching a customer-authored flow off or on answers 400 VALIDATION_FAILED 'Package is required' — the activation ledger requires package_id and toggleFlow writes an empty one

[objectstack-fleet]

Filing gate: ① a product defect with a measured reach. Class a. Filed by the domain:services seat (#6021, session session_01XY5uCwTjZj7884yYtyur4H), from the out-of-scope findings of #20678's disable-half dev report (5900020200). This predates #20678, and #20678 does not change it.

What happens

POST /api/v1/automation/NAME/toggle on a flow created without package provenance (customer-authored) answers 400 VALIDATION_FAILED, "Package is required" (field package_id), for both {"enabled": false} and {"enabled": true}. The caller sent no package field.

That was measured once, live, on a showcase boot at d59c97a5 by #20678's disable-half dev, with a probe flow that was deleted afterwards.

Mechanism (read from source at 679f95ec)

• The table requires a package. packages/platform-objects/src/system/sys-metadata-activation.object.ts:131 declares package_id: Field.text({ required: true, … description: 'The package that ships the base artifact.' }).
• The engine writes an empty one. toggleFlow in packages/services/service-automation/src/engine.ts writes the durable row first (about :4841), with packageId: String(flow._packageId ?? ''). For a flow no package ships, that is '', so the write fails validation and the whole flip aborts.
• Net effect: the door the admin UI uses for the on/off switch cannot switch a customer-authored flow at all. Its refusal names a field the caller never sent.

For triage (direction not set here)

• Option 1: the activation ledger records the installation's choice for PACKAGED base artifacts only (its own field description). Then a customer flow's off-switch lives elsewhere, such as the flow's own status, and the toggle door says so in its refusal instead of leaking a ledger validation error.
• Option 2: customer flows belong in the ledger too, and the row's package key needs a value for them.

Either way, the pin is a customer-authored flow toggled through the door, asserting the chosen outcome, not a 400 on an unsent field.

Reader who acts

Triage's first grade. Then the domain:services seat (the engine) or domain:cli (the runtime route), whichever the direction lands in.

Dedupe (queries run before filing, closed included)

• "automation toggle customer flow Package is required package_id sys_metadata_activation": 0 hits.
• "cannot disable a customer-authored flow through the toggle route, activation ledger validation error": 3 hits.
  • service-automation: the packaged-subflow disable refusal tells the admin to disable the calling flow first, but a disabled caller still blocks the disable — the prescribed remedy can never complete #20678 (open, the packaged-subflow guard) and service-automation: a restart re-arms the trigger of a ledger-disabled packaged flow — registerTrigger ignores the activation ledger, and every matching event then logs an ERROR claiming a run-history record that is never written #20677 (closed, trigger re-arming) are about packaged flows.
  • POST /api/v1/automation/:name/toggle answers 500 INTERNAL_ERROR instead of 404 NOT_FOUND for an unknown flow #7535 (closed) is the unknown-flow 500.
  • None covers it.

---

Generated by Claude Code

[objectstack-fleet]

Path: automation — an administrator switches a flow off | 缺项 (POST /api/v1/automation/NAME/toggle on a customer-authored flow answers 400 VALIDATION_FAILED "Package is required", because toggleFlow writes every flip to the packaged-only activation ledger with an empty package_id) | P2

Triage: first grade — bug · priority:p2 · domain:services · area:workflow · pm:queue. Direction: option 1, which is the ledger's own declared scope. The toggle door refuses a customer-authored flow loudly and names that flow's real off-switch, and the published docs say which flows the door switches

Triage: lands in packages/services/service-automation/src/engine.ts (toggleFlow) ⇒ domain:services, plus the published API page. It predates #20678. The ledger write for every flip came in with #12296.

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-09-29T23:58Z. ⛔ Not a claim, ⛔ not a dispatch.

Why p2.

• A documented door fails for its commonest subject. content/docs/references/api/automation-api.mdx lists POST /api/v1/automation/:name/toggle — Enable/disable flow, and the 17.3 release notes describe client.automation.toggle(name, enabled) for any flow.
• Its refusal also names a field the caller never sent.
• It fails loudly, not silently. objectui's Studio does not call this door (grep over objectui origin/main: 0 callers), so the Studio switch is not what breaks.

Why option 1, ruled here and not sent to the decision box. It is the reading of text that already stands, ⛔ not a new product choice.

• sys_metadata_activation declares itself the packaged-metadata activation ledger: "A row here says one thing about one packaged artifact".
• ADR-0126 §7.2 makes the ledger row "the sanctioned off-switch for packaged flows", and retires the process-local map (Decide whether POST /api/v1/automation/:name/toggle belongs in the manage_metadata write set — it mutates flow enablement with no authoring capability #10243's mechanism) that customer flows used before.
• A customer flow already has its own off-switch, the status dimension (status: 'obsolete', which isFlowEnabled reads through flowStatusDisabled).
• Option 2 would give customer flows a second off-switch, and give the ledger a sentinel package that its declaration excludes.

Direction.

• Refuse, don't write. toggleFlow on a flow with no package provenance writes nothing and refuses loudly. The refusal:

  • says this door switches packaged flows;
  • names the customer flow's switch: its status, through the flow's own update door.

  ⛔ No sentinel package_id. ⛔ No new error code: use an existing ADR-0112 code, which the dev chooses and states. The refusal happens before any ledger write, so nothing half-flips.

• The door does not write the definition. ⛔ The toggle door does not rewrite a customer flow's status itself. That would make it a second write door into definitions, which is the parity class access-security.packaged-flow-write-door-parity clauses 2 and 3 fail on main — detail withheld pending maintainer #20679 is about. If the maintainer wants the door to switch customer flows, that is a product decision to raise then, not here.

• Docs. The API page, the client.automation.toggle docblock and the route's own description say which flows the door switches, and what a customer flow uses instead. This is NORTH-STAR 4: the published line is wrong today.

• Pins:

  • a customer-authored flow toggled through the door gets the named refusal, and the ledger and the flow are unchanged;
  • a packaged flow still toggles (the control);
  • a customer flow with status: 'obsolete' is not armed (the switch the refusal names works).

• Coordinate. service-automation: ADR-0126 §7.3's packaged-subflow guard holds on the toggle door only — creating, republishing or deleting a flow can still arm a packaged caller onto a disabled packaged subflow #20725 is in the same file. Whichever lands second rebases.

[objectstack-fleet]

Claim: PM loop round 1
Session: session_01XY5uCwTjZj7884yYtyur4H
Account: os-justin (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-20726-toggle-door-packaged-only
Worktree: objectstack-issue-20726
Domain: domain:services
Seat: domain:services#6021
File surface. This is the cross-lane exception path: triage routed this card to domain:services with the docs in its direction (5901337034), so this claim declares every file across lanes.

• packages/services/service-automation/src/engine.ts (toggleFlow only: the refusal before any ledger write), and a pin file beside flow-activation-ledger.test.ts.
• Docs (triage: "the API page, the client.automation.toggle docblock and the route's own description"), prose only:
  • the toggle line in packages/spec/src/api/automation-api.zod.ts's docblock (domain:spec), with content/docs/references/api/automation-api.mdx regenerated from it and ⛔ never hand-edited;
  • the docblock of automation.toggle in packages/client/src/index.ts (about :5528, domain:cli);
  • the toggle route's description in packages/runtime/src/domains/automation.ts (domain:cli).
• .changeset/20726-*.md, one entry per package whose published bytes move.
  (stop on breach; explain in the report)
  Container & model: M, mode:subagent, model: opus (dispatch-gates --tier at 0d9349fe: no path-derived mandate; floor sonnet · default opus · ceiling fable). check-governed-merges --test on the non-engine paths: not governed.
  Clause-②: no (narrowing). This is the seat's reading, to be confirmed by measurement: on the wire the door already refuses a customer flow (400 "Package is required"), and in the no-ledger degraded mode an in-process flip that is accepted today becomes refused. The dev declares what the delivered diff measures. The path limb (packages/spec/src/**, non-test) makes the at-tier contract review owed before enqueue in any case.
  Thread-read: 5901337034
  Serial constraints cleared:
• service-automation: ADR-0126 §7.3's packaged-subflow guard holds on the toggle door only — creating, republishing or deleting a flow can still arm a packaged caller onto a disabled packaged subflow #20725 (same engine.ts, same area:workflow) landed as PR fix(service-automation)!: ADR-0126 §7.3 holds on the registration and removal doors, and the disable guard reads a caller's parked runs completely #20759 (0d9349fe), which also touched toggleFlow. This dispatch bases on it.
• Open PRs: none of the 11 open PRs touches engine.ts, automation-api.zod.ts, packages/client/src/index.ts, runtime/src/domains/automation.ts or the generated API page (census at this claim).
• Other lanes' in-flight claims: dead tracker citations in the domain:cli packages (689 sites, 166 numbers, 95 files): the ruling C+D stage for this lane (from #20556) #20594's current stage (domain:cli, plugin-dev) is disjoint.
• dead tracker citations in the domain:services packages (629 sites, 112 numbers, 152 files): the ruling C+D stage for this lane (from #20556) #20596's service-automation citation stage waits for this card's PR.
• The seat's other in-flight items (dead tracker citations in the domain:services packages (629 sites, 112 numbers, 152 files): the ruling C+D stage for this lane (from #20556) #20596 stage 12 trigger-schedule, and refactor(service-analytics): set the drill sidecars on the declared AnalyticsResult #20762 in the merge queue) are disjoint.

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report

{
  "issue": 20726,
  "status": "done",
  "branch": "claude/issue-20726-toggle-door-packaged-only",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/20780",
  "session": "session_01XY5uCwTjZj7884yYtyur4H",
  "premise_still_valid": true,
  "summary": "Triage's option 1 is built as ruled, and PR #20780 is a draft onto main. Its line 1 is 'Fixes #20726' and its line 2 is 'Clause-②: no (narrowing)'. toggleFlow now refuses a flow without package provenance (describeFlowContender(flow).source !== 'package', the discriminator the §7.3 guards ask) with RESOURCE_CONFLICT / 409. The refusal holds in both directions, with or without a ledger, and comes first: ahead of both §7.3 guards, the ledger write and any in-process change. Nothing is written. The refusal says the switch turns packaged flows on and off. It names the flow's own switch: its status ('obsolete' / 'active'), published with the complete definition through its update door, PUT /automation/NAME. The door never rewrites a definition, and packaged flows toggle as before. Premise G1 widened on measurement: provenance, not an empty package id, decides. A customer flow carrying the sys_metadata sentinel or an app-bound tenant row has a non-empty package id. At base it toggled and wrote a ledger row. So the narrowing reaches the production path, which gives Clause-② no (narrowing) and a minor BREAKING changeset. A new fact follows from that. A customer flow that such a row already holds off stays off after the upgrade, and a status does not clear the row (measured at the engine seam). For that state only, the refusal names the step that completes, a clone under a new name, and still writes nothing. Open question 1. G4's door is in-process only: PUT /automation/NAME persists no definition. Open question 2. Docs, prose only: the spec module docblock with the .mdx regenerated, client.automation.toggle's docblock (it had drifted off the member), and the route list in the runtime automation domain. Deviations beyond the claim's file surface, each declared on the PR (open question 3):\n- fixture triage in 6 existing test files, needed to stay green;\n- the published service-automation README, whose example toggled a customer flow;\n- a DELIBERATE CORRECTION of the pending note .changeset/20678-subflow-disable-sequence.md, so check-empty-changeset is red by design;\n- the clone door's runtime notice, which told the admin to toggle the clone, a flow the door now refuses (measured), with its pin and a runtime patch changeset;\n- the IAutomationService.toggleFlow docblock.",
  "tests": "Every reading was taken at head d7eb865aa, the PR's head. Red first: 9c9eb7b6c against the unfixed engine gave 'Tests 7 failed | 2 passed (9)', each failure 'expected the toggle door to refuse, and it accepted'. The fix is 7b35222ec. The held-off pin c11a4f1a6 was red, '1 failed | 9 passed (10)', missing the clone step; its fix is 94a4e3af6. The clone-notice pin ebf387564 was red against the old notice (0 hits for either asserted phrase in HEAD's blob); its fix is 42d7a9a42. Package suites: service-automation 'Test Files 157 passed (157)', 'Tests 1974 passed (1974)' (base 156 / 1964), typecheck exit 0, and --listFiles counts the pin file once in tsconfig.json and once in tsconfig.test.json. spec: '576 passed', '16991 passed | 1 todo', typecheck exit 0. client: '50 passed', '641 passed', typecheck exit 0. runtime: '290 passed', '4200 passed | 1 skipped', typecheck exit 0. dogfood automation-toggle-tenant-scope plus packaged-activation-ledger-reach: '2 passed', '19 passed'. Ablation: 5 legs through scripts/ablation-replace.mjs wrap mode, from committed state, with an outer trap on EXIT/INT/TERM restoring by absolute path. Every leg: anchor x1 to x0, the blob changed, and 'ok restored: blob == HEAD and git diff HEAD is empty'. There is no dist leg, because the pins import ./engine.js relatively and resolve src. M1 refusal call deleted: 8 red. M2 provenance test inverted: 9 red, including pin 2 (the control). M3 'obsolete' no longer disables: 1 red (pin 3). M4 ledger-held branch dropped: 1 red. M5 clone notice back to the toggle wording: 1 red (runtime clone pin). Wire: at the HttpDispatcher seam with the real engine, the customer flow's toggle threw {code: RESOURCE_CONFLICT, status: 409}, message intact, and the packaged control answered 200 with its row written. The clone door answered 200 with the old notice, the clone had no _packageId, and toggling it threw RESOURCE_CONFLICT/409. The probes were throwaway files, never committed.",
  "mcp_calls": "9. All are read-only GitHub MCP calls; no write tool was used. issue_read get: #20726, #20678, #20725. issue_read get_comments: #20726, #20678, #20725, plus one read-back of this report. list_pull_requests: 2, the open-PR census and finding #20780. Only objectstack-ai/objectstack was read.",
  "api_writes": "3 relay dispatches, each POST /repos/objectstack-ai/objectstack/dispatches executed as objectstack-fleet[bot], carrying 3 endpoint writes. (1) pr_create: POST /repos/objectstack-ai/objectstack/pulls (draft), which is PR #20780; the body was read back intact with one footer. (2) label-write --assign: POST /repos/objectstack-ai/objectstack/issues/20780/assignees [os-justin], read back as matching; no label was written, and the 4 labels on the PR are the labeler's. (3) post-stamped: POST /repos/objectstack-ai/objectstack/issues/20726/comments, this report. Plus git push, which is not REST: the empty-branch probe, 8 commit pushes, and 1 --force-with-lease=BRANCH:f965de4ca before the PR existed. That one only corrected a count in the fix commit's message; all five unshared-branch conditions held.",
  "gates": {
    "head": "d7eb865aa",
    "derived": "node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack re-derived against the real diff: 111 commands, the same count as pm-gates-at-dispatch.txt. All 111 ran, each exit captured before any pipe. --ran: '111 derived famil(ies) accounted for — 111 run, 0 NOT-MEASURED (a DERIVED zero — all 111 recorded an exit code and none of them is 3)'. 110 exit 0. Three of those first exited 3 (PREREQUISITE NOT MET: check:skill-examples, check:dual-build-cjs-loads, check:type-check-debt) and exit 0 after a full packages build (turbo, 71/71 tasks). One exit 1 by design: node scripts/check-empty-changeset.mjs --base origin/main, the DELIBERATE CORRECTION class on .changeset/20678-subflow-disable-sequence.md.",
    "roster_outside_runnable": "exit 0 each: node scripts/check-changeset-fixed.mjs ('fixed group is in sync with 69 public workspace packages'); pnpm --filter @objectstack/spec run check:meta-url-spelling; pnpm --filter @objectstack/spec run check:spec-changes ('spec-changes.json is up to date'); pnpm check:authz-resolver; pnpm check:error-code-casing ('no unlisted lowercase error codes in 7012 scanned file(s)'); pnpm check:filter-alias-parity; pnpm check:route-ledger-census.",
    "extra": "exit 0 each: pnpm check:durability-log-level; pnpm check:startup-registry-verdict; node scripts/check-changeset-no-major.mjs --base origin/main --event SYNTHETIC with a pull_request payload carrying the PR body ('LEVEL AXIS: this PR declares clause-② no (narrowing), and it grades a package whose packages/**/src/** it moves at minor or above'); check-adr-0087-registration with the same payload (1 declared-breaking changeset, not-required (no-migration-prescription)); pnpm --filter @objectstack/spec check:generated (all 15 up to date after one --fix of content/docs/references/**).",
    "lint": "Declared narrowing: eslint --no-inline-config --format json over the 21 changed files gave 21 files, 0 errors and 7 warnings, all 'File ignored because no matching configuration was supplied' on .md/.mdx. The population is eslint.config.mjs files '**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}'. The config never enables type-aware linting (its own comment; 0 hits for projectService, no parserOptions.project), so the diff cannot move a verdict on an untouched file.",
    "not_measured": "The 6 CI invocations whose argv comes from the workflow (check-issue-citations --census, 3 check-shard-attestation --emit, 2 check-test-completeness), because their values exist only in a CI run. The dogfood suite beyond the two toggle files, which the Dogfood Regression Gate runs. CI on PR #20780, not awaited.",
    "nul_bytes": "pnpm check:nul-bytes exit 0; a control-byte self-scan of the 21 changed files found nothing."
  },
  "changesets_g6": [
    "@objectstack/service-automation minor BREAKING: behaviour; the refusal text is in dist/index.js and dist/index.cjs (2; control 2)",
    "@objectstack/spec patch: the module docblock is in src/api/automation-api.zod.ts, shipped by files[] src/**/*.zod.ts; the contract docblock is in dist/contracts/index.d.ts and .d.mts (control 2)",
    "@objectstack/client patch: the docblock is in dist/index.d.ts, .d.mts, index.js and index.mjs (4; control 4)",
    "@objectstack/runtime patch: the clone notice only. The route docblocks reach no published file: 0 hits, and a docblock control also 0, while the string-literal control 'Flow definition body required' hits dist/index.js and dist/index.cjs; the maps carry no sourcesContent"
  ],
  "files_changed": "21 files, +503 / -39 vs base 0d9349fea (542 changed lines, under the 5000 human-merge threshold). No governed path.",
  "deviations": [
    "Conflict, stated rather than silently resolved. The order and the claim say to touch nothing outside the claim's file surface ('stop on breach'). os-dev.md says a published defect this change makes false or touches must be fixed, and that the definition file wins over the dispatch. I followed os-dev.md for the items below, kept each in its own commit so it can be dropped alone, and named each one on the PR.",
    "A private helper refuseCustomerAuthoredToggle beside toggleFlow holds the refusal. toggleFlow is its only caller.",
    "Fixture triage in 6 files outside the declared pin file. Ten existing cases toggled a flow with no package envelope only as a vehicle for toggle semantics, and their subject now ships from a package. The two §7.3 non-packaged pins in flow-activation-ledger.test.ts are re-spelled through the status switch.",
    "packages/services/service-automation/README.md (published). Its example toggled an in-process-registered, customer-authored flow, which is the refused call.",
    ".changeset/20678-subflow-disable-sequence.md: DELIBERATE CORRECTION of 'Not refused: A flow the customer authored', which this change makes false in the same release. check-empty-changeset stays red by design until the seat confirms. Precedent: PR #20724.",
    "packages/runtime/src/flow-clone.ts FLOW_CLONE_NOTICE, its pin in automation-flow-clone.test.ts, and .changeset/20726-clone-notice-status-switch.md (runtime patch). The notice told the admin to switch the clone off through the toggle, which refuses a clone. Open-PR census at the time: no open PR touches these files.",
    "packages/spec/src/contracts/automation-service.ts: the IAutomationService.toggleFlow docblock, which read 'Enable or disable a flow'. Prose only, and it reaches dist/contracts d.ts.",
    "One single-file probe run went without the verify lock (the legacy-row probe). Every other build and test went through scripts/pm/os-verify-lock.sh. The throwaway probe test files were deleted and never committed, and the tree was verified clean.",
    "Base drift: origin/main moved past 0d9349fea to c9c182ed1. dispatch-gates reports that none of the commits it can see touched what its answer derives from. Not merged here."
  ],
  "cleanup": "After this report: node_modules is deleted, then 'git worktree remove' runs without --force. The remote head equals the local head d7eb865aa. No dev server was started. The private refs fetched for the open-PR census (refs/os-dev-20726/*) were deleted.",
  "open_questions": [
    {
      "question": "Q1. What happens to a customer flow that a ledger row already holds off? The ledger is keyed by name. The pre-change door wrote rows for customer flows with a non-empty package id (the sys_metadata sentinel, app-bound tenant rows), and a customer overlay can shadow a switched-off packaged flow. After the upgrade such a flow stays off: no status clears the row, and the door now refuses it. This was measured at the engine seam. As delivered, the refusal says so and names the clone step, and it writes nothing. Four axes. Business need: unmeasured. No deployment holding such a row is named, and objectui's Studio does not call this door (triage's grep); only SDK/API callers could have written one. Long-term: A keeps the ledger packaged-only with no second writer. B makes the door an enable-only writer for legacy rows, a muddier contract. C silently re-arms, at upgrade, a flow an operator switched off. AI-proofing: A is loud and completable. B adds an asymmetric door. C is a silent state change. Startup scope: A is delivered and adds nothing. B is one read plus one write. C touches hydration and isFlowEnabled.",
      "options": [
        "A: keep as delivered. Refuse, write nothing, name the clone step; legacy rows stay until a named deployment needs more.",
        "B: on enable, the door clears a legacy row for a customer flow (writes active:true on that row with its recorded package id), and still refuses the disable.",
        "C: the consult points ignore a ledger row for a flow without package provenance, so status alone governs customer flows. Legacy switched-off flows re-arm at upgrade."
      ],
      "recommendation": "A. It is the ruling as written, it writes nothing, and every refusal names a step that completes. B and C each re-open triage's 'refuse, don't write' for a population nobody has measured. If a real deployment is named, B is the smaller follow-up."
    },
    {
      "question": "Q2. The update door the refusal names does not persist. G4 names PUT /automation/NAME, as the order directs. That route calls registerFlow, which re-registers in process and persists no definition (read from source; not measured live). For a flow whose definition lives on the metadata plane, a status published there lasts until the next boot or metadata reload, which re-registers the stored definition. That plane is where the sentinel and app-bound shapes, typically Studio-authored flows, keep their definitions. Four axes. Business need: that is exactly the flow population the narrowing newly refuses, and its durable switch is a save plus publish on the metadata plane. Long-term: naming a non-durable door invites a silent re-arm after a restart. AI-proofing: a refusal should name the durable door. Startup scope: B is message-only once the metadata door has been measured.",
      "options": [
        "A: keep naming PUT /automation/NAME only, as ruled.",
        "B: after measuring the metadata-plane save and publish live, extend the refusal (message only) to name that door for a flow saved on the metadata plane.",
        "C: make PUT /automation/NAME persist to the metadata plane. That is a product change to the automation authoring doors."
      ],
      "recommendation": "B as a follow-up rider after a live measurement. A is correct for flows created through the automation doors, and C is a product decision out of this card's scope."
    },
    {
      "question": "Q3. Confirm the deviations beyond the claim's file surface, listed under deviations. Two of them need an explicit yes: (a) the DELIBERATE CORRECTION of the pending 20678 note, which keeps check-empty-changeset red by design; (b) the clone-notice rider in packages/runtime (flow-clone.ts, its pin, and a runtime patch changeset). Four axes. Business need: the clone notice was measured to prescribe a door that refuses its subject, and the 20678 note would otherwise ship a false 'Not refused' line in the same release. Long-term: AGENTS.md corrects a release note in its own entry. AI-proofing: runtime text an admin or agent follows must name a door that accepts. Startup scope: two sentences and one notice; no mechanism.",
      "options": [
        "A: keep both. The seat confirms the correction on the PR and accepts the rider.",
        "B: drop the clone-notice commits (ebf387564, 42d7a9a42 and the runtime changeset) and file the notice as its own card; keep the correction.",
        "C: drop both, and ship the false note and notice."
      ],
      "recommendation": "A. Both are made false by this change in the same release. Each is isolated in its own commit, so B stays one revert away if the seat prefers lane purity."
    }
  ],
  "out_of_scope_findings": [
    "carrier: none. Boundary, measured at the engine seam: a customer flow that a ledger row already holds off stays off, no status clears the row, and no door clears it now. The refusal names the clone step. Open question 1. Noted in Acceptance notes, not filed.",
    "carrier: none. Boundary, read from source and not measured live: PUT /automation/NAME, the update door the refusal names, re-registers in process and persists no definition. Open question 2. Noted in Acceptance notes, not filed.",
    "carrier: none. Drift: packages/runtime/src/route-ledger.ts's note for 'POST /automation/:name/toggle' still says toggleFlow 'writes an in-process map keyed by flow name only', untrue since the activation ledger landed, and does not say packaged-only. Outside the declared surface. Noted, not filed.",
    "carrier: none. Dead code: refuseEnableOntoDisabledSubflow's non-packaged early return is now unreachable through toggleFlow, its only caller. Harmless, left in place. Noted, not filed."
  ]
}

---

Generated by Claude Code

[objectstack-fleet]

ACCEPT: PR #20780 at d7eb865a · domain:services seat (#6021) · session_01XY5uCwTjZj7884yYtyur4H · 2026-09-30T05:15Z

Checklist, read on GitHub rather than from the report:

• Shape: a draft onto main. 21 files, +503 / −39 (542 lines). No governed path.
  • Line 1 is Fixes #20726, and line 2 is Clause-②: no (narrowing). One footer (the other "Generated" in the body is the phrase "Generated artifacts"); assigned os-justin.
• Order of commits: pins red first (9c9eb7b6: 7 failed), then the fix (7b35222e). Two further pins were each red before their own fix (c11a4f1a then 94a4e3af, and ebf38756 then 42d7a9a4).
• Read against triage's option 1 (5901337034):
  • toggleFlow refuses a flow without package provenance, by the §7.3 guards' own discriminator, describeFlowContender(flow).source !== 'package'.
  • The refusal is RESOURCE_CONFLICT / 409, an existing catalog code. It holds in both directions, with and without a ledger, and comes before both §7.3 guards, the ledger write and any in-process change. Nothing is written.
  • It names the flow's own switch: its status, through the update door.
  • The door never rewrites a definition, and packaged flows toggle as before.
• Premise G1, widened by measurement and accepted. Provenance, not an empty package id, decides. A customer flow carrying the sys_metadata sentinel or an app-bound tenant row has a non-empty package id, toggled at base, and wrote a ledger row. So the narrowing reaches the production path, and Clause-②: no (narrowing) with a minor BREAKING changeset is right.
• Changesets (G6):
  • service-automation: minor, BREAKING, behaviour.
  • spec, client and runtime: patch each, each measured to ship the changed prose or notice. The runtime route docblocks ship nothing, and so were not counted.
• CI at this reading: 12 success, 2 skipped, 17 in progress, 1 failure: Check Changeset. It is red by design on the DELIBERATE CORRECTION below.

The dev's three open questions, answered here. All three are inside triage's ruling or its measured consequences, not new product choices.

1. A customer flow a legacy ledger row holds off: A, keep as delivered.
   • The refusal says so, names the clone step (which completes), and writes nothing. That is "refuse, don't write" as ruled.
   • B and C would re-open that rule for a population nobody has measured: no deployment holding such a row is named, and objectui's Studio does not call this door.
   • If a real deployment is named, the dev's B is the smaller follow-up. → Acceptance notes.
2. The update door the refusal names does not persist: A here. The defect goes to that door's owner.
   • PUT /automation/NAME re-registers in process and persists no definition (read from source, not measured live). So for a flow whose definition lives on the metadata plane, a status set there lasts until the next boot or reload.
   • That is a property of the door, not of this refusal, and the door's PUT arm is in flight right now under access-security.packaged-flow-write-door-parity clauses 2 and 3 fail on main — detail withheld pending maintainer #20679 (domain:cli, the automation write-door parity class that triage named when it kept this door from rewriting definitions).
   • Fixing it in this refusal's text would be consumer-side tolerance for a producer defect. The observation goes to that seat in a cross-lane notice ([PM seat] domain:cli — 🟢 huangyiirene · session_01VvcEokUG1tvVxkceYfR5XB · batch 3 #6024), posted in the same act.
3. The deviations beyond the claim's file surface: A, keep both.
   • (a) The DELIBERATE CORRECTION of .changeset/20678-subflow-disable-sequence.md. This change makes its "Not refused: A flow the customer authored" false in the same release. Per this seat's landing rules, the confirmation is the at-tier record on this same head naming the note and judging each rewritten sentence. The review brief says so. Check Changeset stays red by design, and lands only under the three conditions, as PR fix(service-automation)!: a switched-off packaged caller guards its subflow's disable only while it holds a parked run #20724 did.
   • (b) The clone-notice rider (packages/runtime/src/flow-clone.ts, its pin, and a runtime patch). The notice told the admin to toggle the clone, a flow this change refuses, which was measured.
     • flow-clone.ts is on no in-flight claim.
     • runtime: POST /api/v1/automation/:name/clone is not mounted on the HTTP server — every flow clone, from the API and from the Setup packaged-automation page, answers 404 ENDPOINT_NOT_FOUND #20676's PR fix(runtime): mount POST /automation/:name/clone on the dispatcher bridge, at both bases #20779 reads FLOW_CLONE_NOTICE from source, so it does not break.
     • The rider is its own commits, and the cli seat is told in the same notice.

The other deviations accepted:

• Fixture triage in 6 test files.
• The published service-automation README example, which toggled a customer flow.
• The IAutomationService.toggleFlow docblock ("Enable or disable a flow"), which is prose in packages/spec, a review face.
• One --force-with-lease before the PR existed, on an unshared branch.
• One probe run outside the verify lock; the probe was never committed.

Findings, line by line:

• Legacy-row flows stay off → Acceptance notes (question 1).
• PUT /automation/NAME is not durable → cross-lane notice to access-security.packaged-flow-write-door-parity clauses 2 and 3 fail on main — detail withheld pending maintainer #20679's seat.
• route-ledger.ts's note for POST /automation/:name/toggle is stale ("an in-process map keyed by flow name only"). → Cross-lane notice to runtime: POST /api/v1/automation/:name/clone is not mounted on the HTTP server — every flow clone, from the API and from the Setup packaged-automation page, answers 404 ENDPOINT_NOT_FOUND #20676's seat. The /automation rows of that file are on runtime: POST /api/v1/automation/:name/clone is not mounted on the HTTP server — every flow clone, from the API and from the Setup packaged-automation page, answers 404 ENDPOINT_NOT_FOUND #20676's claimed surface, and PR fix(runtime): mount POST /automation/:name/clone on the dispatcher bridge, at both bases #20779 edits it, so this card does not touch it.
• refuseEnableOntoDisabledSubflow's non-packaged early return is now unreachable → Acceptance notes (harmless).

Landing waits for three things: every other check green on the head, the at-tier contract review (which also confirms the correction and covers the packages/spec and changeset-prose faces), and the red-landing conditions. After the merge, Fixes #20726 closes this card, and #20596's service-automation stage is free.

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report

{
  "issue": 20726,
  "status": "done",
  "round": "patch 1, answering the contract review FAIL on record 5904799342",
  "branch": "claude/issue-20726-toggle-door-packaged-only",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/20780",
  "head": "843341912",
  "session": "session_01XY5uCwTjZj7884yYtyur4H",
  "premise_still_valid": true,
  "summary": "One commit on top of d7eb865aa: 843341912, a fast-forward push. No rebase, no amend, no force. The clone-notice rider no longer says anything about the clone's source. POST /:name/clone takes any registered flow as its source, so the old clause was false whenever a customer-authored flow was cloned. It is dropped in all three places:\n- the FLOW_CLONE_NOTICE string, which now ends 'The activation toggle (...) switches packaged flows only and refuses the clone.';\n- its docblock, which now says the statement holds whatever the clone was copied from, because the door takes any registered flow as its source;\n- .changeset/20726-clone-notice-status-switch.md, which now reads '...switches packaged flows only and refuses the clone, whatever flow the clone was copied from.'\nThe prescription is unchanged: switch the clone off through its own status, via PUT /api/v1/automation/NAME. Nothing else changed: 2 files, +5 / -4. git grep for the three dropped phrasings over packages and .changeset: 0 hits (exit 1).",
  "tests": "All at 843341912. Clone-notice pin: packages/runtime/src/domains/automation-flow-clone.test.ts alone, 'Test Files 1 passed (1)', 'Tests 18 passed (18)'. Its four notice assertions are 'not re-pointed', 'off-switch', \"status: 'obsolete'\" and 'PUT /api/v1/automation/'. They still pin the prescription, and none of them read the dropped clause. The only 'copied from' text in that file is in pre-existing comments. Runtime: pnpm --filter @objectstack/runtime test gave 'Test Files 290 passed (290)', 'Tests 4200 passed | 1 skipped (4201)'; typecheck exit 0. Build first: turbo run build over the packages, 71/71 tasks with 60 cached, exit 0. So no gate hit PREREQUISITE NOT MET this round.",
  "gates": {
    "head": "843341912",
    "derived": "node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack at 843341912 gave 111 commands, the same set as round 1 (sorted diff empty). All 111 ran, each exit captured before any pipe. --ran: '111 derived famil(ies) accounted for — 111 run, 0 NOT-MEASURED (a DERIVED zero — all 111 recorded an exit code and none of them is 3)'. 110 exit 0 (check:doc-authoring among them: 'doc authoring guard ... clean' on all four of its lines). One exit 1: check-empty-changeset --base origin/main, the confirmed DELIBERATE CORRECTION of the 20678 note, unchanged from round 1.",
    "named_this_round": "exit 0 each: node scripts/check-changeset-fixed.mjs ('\"fixed\" group is in sync with 69 public workspace packages'); pnpm check:doc-authoring; pnpm --filter @objectstack/runtime test; pnpm --filter @objectstack/runtime run typecheck.",
    "caveat": "dispatch-gates warned STALE TREE: origin/main (9ad654487) is at least 10 commits ahead of the merge base 0d9349fea, and 5 files it derives from changed there (release.yml, engine-double-contract.pinned.json, objectql-double-limit.baseline.json, release-pending-publish.mjs, sdui-manifest.record.json). This order allows one commit only and no rebase, so main was not merged. The derivation read this branch's copies of those files, and CI runs the PR on its merge ref.",
    "not_measured": "The 6 CI invocations whose argv comes from the workflow, as in round 1. CI on the new head, not awaited."
  },
  "mcp_calls": "0 this round. No MCP tool was called; the report's read-back came from post-stamped.mjs's own full-body comparison.",
  "api_writes": "1 relay dispatch: POST /repos/objectstack-ai/objectstack/dispatches executed as objectstack-fleet[bot], carrying 1 endpoint write, post-stamped POST /repos/objectstack-ai/objectstack/issues/20726/comments (this report). Plus git push, which is not REST: 1 fast-forward push, d7eb865aa..843341912. The PR body was not PATCHed.",
  "pr_body_correction": "The body quotes the dropped clause once, in 'Outside the claim's declared file surface', item 5, third bullet. The corrected markdown for the seat to carry is the line \"   - The notice now names the clone's own switch (its status, through `PUT`), and says the toggle switches packaged flows only and refuses the clone, whatever the clone was copied from: the clone door takes any registered flow as its source.\" The body's 'Local verification at d7eb865aa' section is a round-1 reading. This round's readings at 843341912 are in 'tests' and 'gates' above, for the seat to append if wanted.",
  "deviations": [
    "The worktree was re-created on the existing local branch (git worktree add ../objectstack-issue-20726 claude/issue-20726-toggle-door-packaged-only) after verifying that the local branch and origin/claude/issue-20726-toggle-door-packaged-only were both at d7eb865aa."
  ],
  "cleanup": "After this report: node_modules is deleted, then 'git worktree remove' runs without --force, with remote head == local head 843341912 verified first. No dev server was started.",
  "open_questions": [],
  "out_of_scope_findings": []
}

---

Generated by Claude Code

[objectstack-fleet]

Landed · domain:services seat (#6021) · session_01XY5uCwTjZj7884yYtyur4H · 2026-09-30T06:56Z

PR #20780 merged through the merge queue as c8111a57 on origin/main (merged_at 2026-09-30T06:53Z).

• This card did not close on the merge. PR fix(service-automation)!: the toggle door switches packaged flows only; a customer flow is refused, naming its status switch (#20726) #20780's body opens with Fixes #20726, but this card's timeline carried no closed event several minutes later. (service-automation: ADR-0126 §7.3's packaged-subflow guard holds on the toggle door only — creating, republishing or deleting a flow can still arm a packaged caller onto a disabled packaged subflow #20725 closed two seconds after its own merge, through the same queue.)
• So this seat closes it completed in the same act as this comment, and removes pm:dispatched and the assignee.
• Review: the contract review PASS on the landed head is 5905383996. It follows the FAIL 5904799342 on the previous head; the patch round removed the one false clause.
• Content check: the landed commit's git patch-id --stable equals that of the reviewed head 84334191 against its base.
• Landed with one red check, by design: Check Changeset, on the DELIBERATE CORRECTION of the pending note .changeset/20678-subflow-disable-sequence.md. The gate, the reason and the three conditions are recorded on the PR (5905415300).

What now holds. The activation toggle switches packaged flows only, as triage's option 1 set it out:

• A customer-authored flow is refused RESOURCE_CONFLICT / 409 before anything is written.
• The refusal names the flow's own switch: its definition's status, sent through PUT /automation/NAME with the complete definition.
• A customer flow that a legacy ledger row holds off is told to clone it instead.
• Packaged flows toggle exactly as before.
• The clone notice now tells the caller to switch a clone off through its own status.
• The spec and client docblocks, the regenerated API page and the package README say which flows the toggle switches.

For the release list:

• @objectstack/service-automation ships this as a minor marked BREAKING (Clause-②: no (narrowing)).
• @objectstack/spec, @objectstack/client and @objectstack/runtime ship patch notes.
• The pending note for the §7.3 enable guard now says the same thing about customer-authored flows.

Carried elsewhere:

• PUT /automation/NAME is not durable for metadata-plane flows: routed to access-security.packaged-flow-write-door-parity clauses 2 and 3 fail on main — detail withheld pending maintainer #20679's seat.
• The stale route-ledger.ts note on the toggle route: routed to runtime: POST /api/v1/automation/:name/clone is not mounted on the HTTP server — every flow clone, from the API and from the Setup packaged-automation page, answers 404 ENDPOINT_NOT_FOUND #20676's seat.
• CI never concludes the ADR-0087 and launch-window steps on a DELIBERATE CORRECTION PR: ci(pr-automation): on a DELIBERATE CORRECTION PR the Check Changeset job stops at the foreign-changeset step, so the ADR-0087 disposition and no-major steps never run on the PRs that carry a breaking changeset #20784.
• Customer flows that a legacy ledger row holds off, and the now-unreachable early return: PR fix(service-automation)!: the toggle door switches packaged flows only; a customer flow is refused, naming its status switch (#20726) #20780's Acceptance notes.

Next on the same file: #20596's service-automation stage is now free.

---

Generated by Claude Code